Index: Makefile.in
==================================================================
--- Makefile.in
+++ Makefile.in
@@ -30,10 +30,11 @@
 #
 CC = @CC@
 CFLAGS = @CPPFLAGS@ @CFLAGS@
 TCC = ${CC} ${CFLAGS} -I. -I${TOP}/src -I${TOP}/ext/rtree -I${TOP}/ext/icu
 TCC += -I${TOP}/ext/fts3 -I${TOP}/ext/async -I${TOP}/ext/session
+TCC += -I${TOP}/ext/userauth
 
 # Define this for the autoconf-based build, so that the code knows it can
 # include the generated config.h
 #
 TCC += -D_HAVE_SQLITE_CONFIG_H -DBUILD_sqlite
@@ -185,11 +186,11 @@
          notify.lo opcodes.lo os.lo os_unix.lo os_win.lo \
          pager.lo parse.lo pcache.lo pcache1.lo pragma.lo prepare.lo printf.lo \
          random.lo resolve.lo rowset.lo rtree.lo \
          sqlite3session.lo select.lo sqlite3rbu.lo status.lo stmt.lo \
          table.lo threads.lo tokenize.lo treeview.lo trigger.lo \
-         update.lo upsert.lo util.lo vacuum.lo \
+         update.lo userauth.lo upsert.lo util.lo vacuum.lo \
          vdbe.lo vdbeapi.lo vdbeaux.lo vdbeblob.lo vdbemem.lo vdbesort.lo \
          vdbetrace.lo wal.lo walker.lo where.lo wherecode.lo whereexpr.lo \
          window.lo utf.lo vtab.lo
 
 # Object files for the amalgamation.
@@ -354,10 +355,13 @@
   $(TOP)/ext/rtree/geopoly.c
 SRC += \
   $(TOP)/ext/session/sqlite3session.c \
   $(TOP)/ext/session/sqlite3session.h
 SRC += \
+  $(TOP)/ext/userauth/userauth.c \
+  $(TOP)/ext/userauth/sqlite3userauth.h
+SRC += \
   $(TOP)/ext/rbu/sqlite3rbu.h \
   $(TOP)/ext/rbu/sqlite3rbu.c
 SRC += \
   $(TOP)/ext/misc/json1.c \
   $(TOP)/ext/misc/stmt.c
@@ -446,18 +450,20 @@
   $(TOP)/ext/misc/ieee754.c \
   $(TOP)/ext/misc/mmapwarm.c \
   $(TOP)/ext/misc/nextchar.c \
   $(TOP)/ext/misc/normalize.c \
   $(TOP)/ext/misc/percentile.c \
+  $(TOP)/ext/misc/prefixes.c \
   $(TOP)/ext/misc/regexp.c \
   $(TOP)/ext/misc/remember.c \
   $(TOP)/ext/misc/series.c \
   $(TOP)/ext/misc/spellfix.c \
   $(TOP)/ext/misc/totype.c \
   $(TOP)/ext/misc/unionvtab.c \
   $(TOP)/ext/misc/wholenumber.c \
-  $(TOP)/ext/misc/zipfile.c
+  $(TOP)/ext/misc/zipfile.c \
+  $(TOP)/ext/userauth/userauth.c
 
 # Source code to the library files needed by the test fixture
 #
 TESTSRC2 = \
   $(TOP)/src/attach.c \
@@ -469,10 +475,11 @@
   $(TOP)/src/date.c \
   $(TOP)/src/dbpage.c \
   $(TOP)/src/dbstat.c \
   $(TOP)/src/expr.c \
   $(TOP)/src/func.c \
+  $(TOP)/src/global.c \
   $(TOP)/src/insert.c \
   $(TOP)/src/wal.c \
   $(TOP)/src/main.c \
   $(TOP)/src/mem5.c \
   $(TOP)/src/os.c \
@@ -558,10 +565,12 @@
   $(TOP)/ext/rtree/geopoly.c
 EXTHDR += \
   $(TOP)/ext/icu/sqliteicu.h
 EXTHDR += \
   $(TOP)/ext/rtree/sqlite3rtree.h
+EXTHDR += \
+  $(TOP)/ext/userauth/sqlite3userauth.h
 
 # executables needed for testing
 #
 TESTPROGS = \
   testfixture$(TEXE) \
@@ -578,11 +587,12 @@
   $(TOP)/test/fuzzdata2.db \
   $(TOP)/test/fuzzdata3.db \
   $(TOP)/test/fuzzdata4.db \
   $(TOP)/test/fuzzdata5.db \
   $(TOP)/test/fuzzdata6.db \
-  $(TOP)/test/fuzzdata7.db
+  $(TOP)/test/fuzzdata7.db \
+  $(TOP)/test/fuzzdata8.db
 
 # Standard options to testfixture
 #
 TESTOPTS = --verbose=file --output=test-out.txt
 
@@ -601,10 +611,16 @@
 SHELL_OPT += -DSQLITE_INTROSPECTION_PRAGMAS
 FUZZERSHELL_OPT = -DSQLITE_ENABLE_JSON1
 FUZZCHECK_OPT = -DSQLITE_ENABLE_JSON1 -DSQLITE_ENABLE_MEMSYS5 -DSQLITE_OSS_FUZZ
 FUZZCHECK_OPT += -DSQLITE_MAX_MEMORY=50000000
 FUZZCHECK_OPT += -DSQLITE_PRINTF_PRECISION_LIMIT=1000
+FUZZCHECK_OPT += -DSQLITE_ENABLE_DESERIALIZE
+FUZZCHECK_OPT += -DSQLITE_ENABLE_FTS4
+#FUZZCHECK_OPT += -DSQLITE_ENABLE_FTS5
+FUZZCHECK_OPT += -DSQLITE_ENABLE_RTREE
+FUZZCHECK_OPT += -DSQLITE_ENABLE_GEOPOLY
+FUZZCHECK_OPT += -DSQLITE_ENABLE_DBSTAT_VTAB
 FUZZCHECK_SRC = $(TOP)/test/fuzzcheck.c $(TOP)/test/ossfuzz.c
 DBFUZZ_OPT =
 
 # This is the default Makefile target.  The objects listed here
 # are what get build when you type just "make" with no arguments.
@@ -659,11 +675,11 @@
 ossshell$(TEXE):	$(TOP)/test/ossfuzz.c $(TOP)/test/ossshell.c sqlite3.c sqlite3.h
 	$(LTLINK) -o $@ $(FUZZCHECK_OPT) $(TOP)/test/ossshell.c \
              $(TOP)/test/ossfuzz.c sqlite3.c $(TLIBS)
 
 sessionfuzz$(TEXE):	$(TOP)/test/sessionfuzz.c sqlite3.c sqlite3.h
-	$(CC) $(CFLAGS) -I. -o $@ $(TOP)/test/sessionfuzz.c $(TLIBS)
+	$(LTLINK) -o $@ $(TOP)/test/sessionfuzz.c $(TLIBS)
 
 dbfuzz$(TEXE):	$(TOP)/test/dbfuzz.c sqlite3.c sqlite3.h
 	$(LTLINK) -o $@ $(DBFUZZ_OPT) $(TOP)/test/dbfuzz.c sqlite3.c $(TLIBS)
 
 DBFUZZ2_OPTS = \
@@ -672,15 +688,30 @@
   -DSQLITE_ENABLE_DESERIALIZE \
   -DSQLITE_DEBUG \
   -DSQLITE_ENABLE_DBSTAT_VTAB \
   -DSQLITE_ENABLE_RTREE \
   -DSQLITE_ENABLE_FTS4 \
-  -DSQLITE_EANBLE_FTS5
+  -DSQLITE_ENABLE_FTS5
 
-dbfuzz2:	$(TOP)/test/dbfuzz2.c sqlite3.c sqlite3.h
-	clang-6.0 -I. -g -O0 -fsanitize=fuzzer,undefined -o dbfuzz2 \
-		$(DBFUZZ2_OPTS) $(TOP)/test/dbfuzz2.c sqlite3.c
+dbfuzz2$(TEXE):	$(TOP)/test/dbfuzz2.c sqlite3.c sqlite3.h
+	$(CC) $(OPT_FEATURE_FLAGS) $(OPTS) -I. -g -O0 \
+		-DSTANDALONE -o dbfuzz2 \
+		$(DBFUZZ2_OPTS) $(TOP)/test/dbfuzz2.c sqlite3.c $(TLIBS)
+	mkdir -p dbfuzz2-dir
+	cp $(TOP)/test/dbfuzz2-seed* dbfuzz2-dir
+
+dbfuzz2-asan:	$(TOP)/test/dbfuzz2.c sqlite3.c sqlite3.h
+	clang-6.0 $(OPT_FEATURE_FLAGS) $(OPTS) -I. -g -O0 \
+		-fsanitize=fuzzer,undefined,address -o dbfuzz2-asan \
+		$(DBFUZZ2_OPTS) $(TOP)/test/dbfuzz2.c sqlite3.c $(TLIBS)
+	mkdir -p dbfuzz2-dir
+	cp $(TOP)/test/dbfuzz2-seed* dbfuzz2-dir
+
+dbfuzz2-msan:	$(TOP)/test/dbfuzz2.c sqlite3.c sqlite3.h
+	clang-6.0 $(OPT_FEATURE_FLAGS) $(OPTS) -I. -g -O0 \
+		-fsanitize=fuzzer,undefined,memory -o dbfuzz2-msan \
+		$(DBFUZZ2_OPTS) $(TOP)/test/dbfuzz2.c sqlite3.c $(TLIBS)
 	mkdir -p dbfuzz2-dir
 	cp $(TOP)/test/dbfuzz2-seed* dbfuzz2-dir
 
 mptester$(TEXE):	sqlite3.lo $(TOP)/mptest/mptest.c
 	$(LTLINK) -o $@ -I. $(TOP)/mptest/mptest.c sqlite3.lo \
@@ -1042,10 +1073,11 @@
 	$(TOP)/ext/misc/completion.c \
 	$(TOP)/ext/misc/sqlar.c \
 	$(TOP)/ext/expert/sqlite3expert.c \
 	$(TOP)/ext/expert/sqlite3expert.h \
 	$(TOP)/ext/misc/zipfile.c \
+	$(TOP)/ext/misc/memtrace.c \
         $(TOP)/src/test_windirent.c
 
 shell.c:	$(SHELL_SRC) $(TOP)/tool/mkshellc.tcl
 	$(TCLSH_CMD) $(TOP)/tool/mkshellc.tcl >shell.c
 
@@ -1115,11 +1147,14 @@
 	$(LTCOMPILE) -DSQLITE_CORE -c $(TOP)/ext/fts3/fts3_write.c
 
 rtree.lo:	$(TOP)/ext/rtree/rtree.c $(HDR) $(EXTHDR)
 	$(LTCOMPILE) -DSQLITE_CORE -c $(TOP)/ext/rtree/rtree.c
 
-sqlite3session.lo:	$(TOP)/ext/session/sqlite3session.c $(HDR) $(EXTHDR)
+sqlite3session.lo:	$(TOP)/ext/userauth/userauth.c $(HDR) $(EXTHDR)
+	$(LTCOMPILE) -DSQLITE_CORE -c $(TOP)/ext/userauth/userauth.c
+
+userauth.lo:	$(TOP)/ext/session/sqlite3session.c $(HDR) $(EXTHDR)
 	$(LTCOMPILE) -DSQLITE_CORE -c $(TOP)/ext/session/sqlite3session.c
 
 json1.lo:	$(TOP)/ext/misc/json1.c
 	$(LTCOMPILE) -DSQLITE_CORE -c $(TOP)/ext/misc/json1.c
 
@@ -1176,10 +1211,11 @@
 TESTFIXTURE_FLAGS += -DBUILD_sqlite
 TESTFIXTURE_FLAGS += -DSQLITE_SERIES_CONSTRAINT_VERIFY=1
 TESTFIXTURE_FLAGS += -DSQLITE_DEFAULT_PAGE_SIZE=1024
 TESTFIXTURE_FLAGS += -DSQLITE_ENABLE_STMTVTAB
 TESTFIXTURE_FLAGS += -DSQLITE_ENABLE_DBPAGE_VTAB
+TESTFIXTURE_FLAGS += -DSQLITE_ENABLE_DESERIALIZE
 
 TESTFIXTURE_SRC0 = $(TESTSRC2) libsqlite3.la
 TESTFIXTURE_SRC1 = sqlite3.c
 TESTFIXTURE_SRC = $(TESTSRC) $(TOP)/src/tclsqlite.c
 TESTFIXTURE_SRC += $(TESTFIXTURE_SRC$(USE_AMALGAMATION))
@@ -1277,10 +1313,13 @@
 	$(LTLINK) sqlite3_checker.c -o $@ $(LIBTCL) $(TLIBS)
 
 dbdump$(TEXE): $(TOP)/ext/misc/dbdump.c sqlite3.lo
 	$(LTLINK) -DDBDUMP_STANDALONE -o $@ \
            $(TOP)/ext/misc/dbdump.c sqlite3.lo $(TLIBS)
+
+dbtotxt$(TEXE): $(TOP)/tool/dbtotxt.c
+	$(LTLINK)-o $@ $(TOP)/tool/dbtotxt.c
 
 showdb$(TEXE):	$(TOP)/tool/showdb.c sqlite3.lo
 	$(LTLINK) -o $@ $(TOP)/tool/showdb.c sqlite3.lo $(TLIBS)
 
 showstat4$(TEXE):	$(TOP)/tool/showstat4.c sqlite3.lo
@@ -1293,13 +1332,19 @@
 	$(LTLINK) -o $@ $(TOP)/tool/showwal.c sqlite3.lo $(TLIBS)
 
 showshm$(TEXE):	$(TOP)/tool/showshm.c
 	$(LTLINK) -o $@ $(TOP)/tool/showshm.c
 
+index_usage$(TEXE): $(TOP)/tool/index_usage.c sqlite3.lo
+	$(LTLINK) $(SHELL_OPT) -o $@ $(TOP)/tool/index_usage.c sqlite3.lo $(TLIBS)
+
 changeset$(TEXE):	$(TOP)/ext/session/changeset.c sqlite3.lo
 	$(LTLINK) -o $@ $(TOP)/ext/session/changeset.c sqlite3.lo $(TLIBS)
 
+changesetfuzz$(TEXE):	$(TOP)/ext/session/changesetfuzz.c sqlite3.lo
+	$(LTLINK) -o $@ $(TOP)/ext/session/changesetfuzz.c sqlite3.lo $(TLIBS)
+
 rollback-test$(TEXE):	$(TOP)/tool/rollback-test.c sqlite3.lo
 	$(LTLINK) -o $@ $(TOP)/tool/rollback-test.c sqlite3.lo $(TLIBS)
 
 atrc$(TEXX): $(TOP)/test/atrc.c sqlite3.lo
 	$(LTLINK) -o $@ $(TOP)/test/atrc.c sqlite3.lo $(TLIBS)

Index: Makefile.msc
==================================================================
--- Makefile.msc
+++ Makefile.msc
@@ -343,10 +343,11 @@
 OPT_FEATURE_FLAGS = $(OPT_FEATURE_FLAGS) -DSQLITE_ENABLE_JSON1=1
 OPT_FEATURE_FLAGS = $(OPT_FEATURE_FLAGS) -DSQLITE_ENABLE_STMTVTAB=1
 OPT_FEATURE_FLAGS = $(OPT_FEATURE_FLAGS) -DSQLITE_ENABLE_DBPAGE_VTAB=1
 OPT_FEATURE_FLAGS = $(OPT_FEATURE_FLAGS) -DSQLITE_ENABLE_DBSTAT_VTAB=1
 OPT_FEATURE_FLAGS = $(OPT_FEATURE_FLAGS) -DSQLITE_INTROSPECTION_PRAGMAS=1
+OPT_FEATURE_FLAGS = $(OPT_FEATURE_FLAGS) -DSQLITE_ENABLE_DESERIALIZE=1
 !ENDIF
 OPT_FEATURE_FLAGS = $(OPT_FEATURE_FLAGS) -DSQLITE_ENABLE_COLUMN_METADATA=1
 !ENDIF
 
 # Should the session extension be enabled?  If so, add compilation options
@@ -1524,10 +1525,11 @@
   $(TOP)\ext\misc\ieee754.c \
   $(TOP)\ext\misc\mmapwarm.c \
   $(TOP)\ext\misc\nextchar.c \
   $(TOP)\ext\misc\normalize.c \
   $(TOP)\ext\misc\percentile.c \
+  $(TOP)\ext\misc\prefixes.c \
   $(TOP)\ext\misc\regexp.c \
   $(TOP)\ext\misc\remember.c \
   $(TOP)\ext\misc\series.c \
   $(TOP)\ext\misc\spellfix.c \
   $(TOP)\ext\misc\totype.c \
@@ -1622,11 +1624,12 @@
   $(TOP)\test\fuzzdata2.db \
   $(TOP)\test\fuzzdata3.db \
   $(TOP)\test\fuzzdata4.db \
   $(TOP)\test\fuzzdata5.db \
   $(TOP)\test\fuzzdata6.db \
-  $(TOP)\test\fuzzdata7.db
+  $(TOP)\test\fuzzdata7.db \
+  $(TOP)\test\fuzzdata8.db
 # <</mark>>
 
 # Additional compiler options for the shell.  These are only effective
 # when the shell is not being dynamically linked.
 #
@@ -1640,11 +1643,17 @@
 # <<mark>>
 # Extra compiler options for various test tools.
 #
 MPTESTER_COMPILE_OPTS = -DSQLITE_ENABLE_JSON1 -DSQLITE_ENABLE_FTS5
 FUZZERSHELL_COMPILE_OPTS = -DSQLITE_ENABLE_JSON1
-FUZZCHECK_COMPILE_OPTS = -DSQLITE_ENABLE_JSON1 -DSQLITE_ENABLE_MEMSYS5 -DSQLITE_OSS_FUZZ -DSQLITE_MAX_MEMORY=50000000 -DSQLITE_PRINTF_PRECISION_LIMIT=1000
+FUZZCHECK_OPTS = -DSQLITE_ENABLE_JSON1 -DSQLITE_ENABLE_MEMSYS5 -DSQLITE_OSS_FUZZ -DSQLITE_MAX_MEMORY=50000000 -DSQLITE_PRINTF_PRECISION_LIMIT=1000
+FUZZCHECK_OPTS = $(FUZZCHECK_OPTS) -DSQLITE_ENABLE_DESERIALIZE
+FUZZCHECK_OPTS = $(FUZZCHECK_OPTS) -DSQLITE_ENABLE_FTS4
+FUZZCHECK_OPTS = $(FUZZCHECK_OPTS) -DSQLITE_ENABLE_RTREE
+FUZZCHECK_OPTS = $(FUZZCHECK_OPTS) -DSQLITE_ENABLE_GEOPOLY
+FUZZCHECK_OPTS = $(FUZZCHECK_OPTS) -DSQLITE_ENABLE_DBSTAT_VTAB
+
 FUZZCHECK_SRC = $(TOP)\test\fuzzcheck.c $(TOP)\test\ossfuzz.c
 OSSSHELL_SRC = $(TOP)\test\ossshell.c $(TOP)\test\ossfuzz.c
 DBFUZZ_COMPILE_OPTS = -DSQLITE_THREADSAFE=0 -DSQLITE_OMIT_LOAD_EXTENSION
 KV_COMPILE_OPTS = -DSQLITE_THREADSAFE=0 -DSQLITE_DIRECT_OVERFLOW_READ
 ST_COMPILE_OPTS = -DSQLITE_THREADSAFE=0
@@ -1727,14 +1736,14 @@
 
 dbfuzz.exe:	$(TOP)\test\dbfuzz.c $(SQLITE3C) $(SQLITE3H)
 	$(LTLINK) $(NO_WARN) $(DBFUZZ_COMPILE_OPTS) $(TOP)\test\dbfuzz.c $(SQLITE3C) /link $(LDFLAGS) $(LTLINKOPTS)
 
 fuzzcheck.exe:	$(FUZZCHECK_SRC) $(SQLITE3C) $(SQLITE3H)
-	$(LTLINK) $(NO_WARN) $(FUZZCHECK_COMPILE_OPTS) $(FUZZCHECK_SRC) $(SQLITE3C) /link $(LDFLAGS) $(LTLINKOPTS)
+	$(LTLINK) $(NO_WARN) $(FUZZCHECK_OPTS) $(FUZZCHECK_SRC) $(SQLITE3C) /link $(LDFLAGS) $(LTLINKOPTS)
 
 ossshell.exe:	$(OSSSHELL_SRC) $(SQLITE3C) $(SQLITE3H)
-	$(LTLINK) $(NO_WARN) $(FUZZCHECK_COMPILE_OPTS) $(OSSSHELL_SRC) $(SQLITE3C) /link $(LDFLAGS) $(LTLINKOPTS)
+	$(LTLINK) $(NO_WARN) $(FUZZCHECK_OPTS) $(OSSSHELL_SRC) $(SQLITE3C) /link $(LDFLAGS) $(LTLINKOPTS)
 
 sessionfuzz.exe:	zlib $(TOP)\test\sessionfuzz.c $(SQLITE3C) $(SQLITE3H)
 	$(LTLINK) $(NO_WARN) -I$(ZLIBINCDIR) $(TOP)\test\sessionfuzz.c /link $(LDFLAGS) $(LTLINKOPTS) /LIBPATH:$(ZLIBLIBDIR) $(ZLIBLIB)
 
 mptester.exe:	$(TOP)\mptest\mptest.c $(SQLITE3C) $(SQLITE3H)
@@ -2127,10 +2136,11 @@
 	$(TOP)\ext\misc\shathree.c \
 	$(TOP)\ext\misc\fileio.c \
 	$(TOP)\ext\misc\completion.c \
 	$(TOP)\ext\expert\sqlite3expert.c \
 	$(TOP)\ext\expert\sqlite3expert.h \
+	$(TOP)\ext\misc\memtrace.c \
 	$(TOP)\src\test_windirent.c
 
 # If use of zlib is enabled, add the "zipfile.c" source file.
 #
 !IF $(USE_ZLIB)!=0
@@ -2295,10 +2305,11 @@
 TESTFIXTURE_FLAGS = $(TESTFIXTURE_FLAGS) -DSQLITE_SERIES_CONSTRAINT_VERIFY=1
 TESTFIXTURE_FLAGS = $(TESTFIXTURE_FLAGS) -DSQLITE_DEFAULT_PAGE_SIZE=1024
 TESTFIXTURE_FLAGS = $(TESTFIXTURE_FLAGS) -DSQLITE_ENABLE_STMTVTAB=1
 TESTFIXTURE_FLAGS = $(TESTFIXTURE_FLAGS) -DSQLITE_ENABLE_DBPAGE_VTAB=1
 TESTFIXTURE_FLAGS = $(TESTFIXTURE_FLAGS) -DSQLITE_ENABLE_JSON1=1
+TESTFIXTURE_FLAGS = $(TESTFIXTURE_FLAGS) -DSQLITE_ENABLE_DESERIALIZE=1
 TESTFIXTURE_FLAGS = $(TESTFIXTURE_FLAGS) $(TEST_CCONV_OPTS)
 
 TESTFIXTURE_SRC0 = $(TESTEXT) $(TESTSRC2)
 TESTFIXTURE_SRC1 = $(TESTEXT) $(SQLITE3C)
 !IF $(USE_AMALGAMATION)==0
@@ -2422,10 +2433,13 @@
 	$(LTCOMPILE) $(NO_WARN) -c $(TOP)\src\test_loadext.c
 
 testloadext.dll:	testloadext.lo
 	$(LD) $(LDFLAGS) $(LTLINKOPTS) $(LTLIBPATHS) /DLL /OUT:$@ testloadext.lo
 
+dbtotxt.exe:	$(TOP)\tool\dbtotxt.c
+	$(LTLINK) $(NO_WARN)	$(TOP)\tool\dbtotxt.c /link $(LDFLAGS) $(LTLINKOPTS)
+
 showdb.exe:	$(TOP)\tool\showdb.c $(SQLITE3C) $(SQLITE3H)
 	$(LTLINK) $(NO_WARN) -DSQLITE_THREADSAFE=0 -DSQLITE_OMIT_LOAD_EXTENSION \
 		$(TOP)\tool\showdb.c $(SQLITE3C) /link $(LDFLAGS) $(LTLINKOPTS)
 
 showstat4.exe:	$(TOP)\tool\showstat4.c $(SQLITE3C) $(SQLITE3H)
@@ -2441,15 +2455,24 @@
 		$(TOP)\tool\showwal.c $(SQLITE3C) /link $(LDFLAGS) $(LTLINKOPTS)
 
 showshm.exe:	$(TOP)\tool\showshm.c
 	$(LTLINK) $(NO_WARN)	$(TOP)\tool\showshm.c /link $(LDFLAGS) $(LTLINKOPTS)
 
+index_usage.exe: $(TOP)\tool\index_usage.c $(SQLITE3C) $(SQLITE3H)
+	$(LTLINK) $(NO_WARN) -DSQLITE_THREADSAFE=0 -DSQLITE_OMIT_LOAD_EXTENSION \
+		$(TOP)\tool\index_usage.c $(SQLITE3C) /link $(LDFLAGS) $(LTLINKOPTS)
+
 changeset.exe:	$(TOP)\ext\session\changeset.c $(SQLITE3C) $(SQLITE3H)
 	$(LTLINK) $(NO_WARN) -DSQLITE_THREADSAFE=0 -DSQLITE_OMIT_LOAD_EXTENSION \
 		-DSQLITE_ENABLE_SESSION=1 -DSQLITE_ENABLE_PREUPDATE_HOOK=1 \
 		$(TOP)\ext\session\changeset.c $(SQLITE3C) /link $(LDFLAGS) $(LTLINKOPTS)
 
+changesetfuzz.exe:	$(TOP)\ext\session\changesetfuzz.c $(SQLITE3C) $(SQLITE3H)
+	$(LTLINK) $(NO_WARN) -DSQLITE_THREADSAFE=0 -DSQLITE_OMIT_LOAD_EXTENSION \
+		-DSQLITE_ENABLE_SESSION=1 -DSQLITE_ENABLE_PREUPDATE_HOOK=1 \
+		$(TOP)\ext\session\changesetfuzz.c $(SQLITE3C) /link $(LDFLAGS) $(LTLINKOPTS)
+
 fts3view.exe:	$(TOP)\ext\fts3\tool\fts3view.c $(SQLITE3C) $(SQLITE3H)
 	$(LTLINK) $(NO_WARN) -DSQLITE_THREADSAFE=0 -DSQLITE_OMIT_LOAD_EXTENSION \
 		$(TOP)\ext\fts3\tool\fts3view.c $(SQLITE3C) /link $(LDFLAGS) $(LTLINKOPTS)
 
 rollback-test.exe:	$(TOP)\tool\rollback-test.c $(SQLITE3C) $(SQLITE3H)

Index: VERSION
==================================================================
--- VERSION
+++ VERSION
@@ -1,1 +1,1 @@
-3.26.0
+3.27.0

Index: autoconf/Makefile.msc
==================================================================
--- autoconf/Makefile.msc
+++ autoconf/Makefile.msc
@@ -281,10 +281,11 @@
 OPT_FEATURE_FLAGS = $(OPT_FEATURE_FLAGS) -DSQLITE_ENABLE_JSON1=1
 OPT_FEATURE_FLAGS = $(OPT_FEATURE_FLAGS) -DSQLITE_ENABLE_STMTVTAB=1
 OPT_FEATURE_FLAGS = $(OPT_FEATURE_FLAGS) -DSQLITE_ENABLE_DBPAGE_VTAB=1
 OPT_FEATURE_FLAGS = $(OPT_FEATURE_FLAGS) -DSQLITE_ENABLE_DBSTAT_VTAB=1
 OPT_FEATURE_FLAGS = $(OPT_FEATURE_FLAGS) -DSQLITE_INTROSPECTION_PRAGMAS=1
+OPT_FEATURE_FLAGS = $(OPT_FEATURE_FLAGS) -DSQLITE_ENABLE_DESERIALIZE=1
 !ENDIF
 OPT_FEATURE_FLAGS = $(OPT_FEATURE_FLAGS) -DSQLITE_ENABLE_COLUMN_METADATA=1
 !ENDIF
 
 # Should the session extension be enabled?  If so, add compilation options
@@ -935,10 +936,11 @@
 #
 !IF $(DYNAMIC_SHELL)==0 && $(FOR_WIN10)==0
 SHELL_COMPILE_OPTS = $(SHELL_COMPILE_OPTS) -DSQLITE_ENABLE_FTS4=1
 SHELL_COMPILE_OPTS = $(SHELL_COMPILE_OPTS) -DSQLITE_ENABLE_EXPLAIN_COMMENTS=1
 SHELL_COMPILE_OPTS = $(SHELL_COMPILE_OPTS) -DSQLITE_ENABLE_OFFSET_SQL_FUNC=1
+SHELL_COMPILE_OPTS = $(SHELL_COMPILE_OPTS) -DSQLITE_ENABLE_DESERIALIZE=1
 !ENDIF
 
 
 # This is the default Makefile target.  The objects listed here
 # are what get build when you type just "make" with no arguments.

Index: configure
==================================================================
--- configure
+++ configure
@@ -1,8 +1,8 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.69 for sqlite 3.26.0.
+# Generated by GNU Autoconf 2.69 for sqlite 3.27.0.
 #
 #
 # Copyright (C) 1992-1996, 1998-2012 Free Software Foundation, Inc.
 #
 #
@@ -724,12 +724,12 @@
 MAKEFLAGS=
 
 # Identity of this package.
 PACKAGE_NAME='sqlite'
 PACKAGE_TARNAME='sqlite'
-PACKAGE_VERSION='3.26.0'
-PACKAGE_STRING='sqlite 3.26.0'
+PACKAGE_VERSION='3.27.0'
+PACKAGE_STRING='sqlite 3.27.0'
 PACKAGE_BUGREPORT=''
 PACKAGE_URL=''
 
 # Factoring default headers for most tests.
 ac_includes_default="\
@@ -1464,11 +1464,11 @@
 #
 if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures sqlite 3.26.0 to adapt to many kinds of systems.
+\`configure' configures sqlite 3.27.0 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
 To assign environment variables (e.g., CC, CFLAGS...), specify them as
 VAR=VALUE.  See below for descriptions of some of the useful variables.
@@ -1529,11 +1529,11 @@
 _ACEOF
 fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of sqlite 3.26.0:";;
+     short | recursive ) echo "Configuration of sqlite 3.27.0:";;
    esac
   cat <<\_ACEOF
 
 Optional Features:
   --disable-option-checking  ignore unrecognized --enable/--with options
@@ -1655,11 +1655,11 @@
 fi
 
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-sqlite configure 3.26.0
+sqlite configure 3.27.0
 generated by GNU Autoconf 2.69
 
 Copyright (C) 2012 Free Software Foundation, Inc.
 This configure script is free software; the Free Software Foundation
 gives unlimited permission to copy, distribute and modify it.
@@ -2074,11 +2074,11 @@
 } # ac_fn_c_check_header_mongrel
 cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by sqlite $as_me 3.26.0, which was
+It was created by sqlite $as_me 3.27.0, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   $ $0 $@
 
 _ACEOF
@@ -12230,11 +12230,11 @@
 cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # Save the log message, to keep $0 and so on meaningful, and to
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by sqlite $as_me 3.26.0, which was
+This file was extended by sqlite $as_me 3.27.0, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
   CONFIG_HEADERS  = $CONFIG_HEADERS
   CONFIG_LINKS    = $CONFIG_LINKS
@@ -12296,11 +12296,11 @@
 
 _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
 ac_cs_version="\\
-sqlite config.status 3.26.0
+sqlite config.status 3.27.0
 configured by $0, generated by GNU Autoconf 2.69,
   with options \\"\$ac_cs_config\\"
 
 Copyright (C) 2012 Free Software Foundation, Inc.
 This config.status script is free software; the Free Software Foundation

Index: doc/lemon.html
==================================================================
--- doc/lemon.html
+++ doc/lemon.html
@@ -774,10 +774,13 @@
    %include {#include &lt;unistd.h&gt;}
 </pre></p>
 
 <p>This might be needed, for example, if some of the C actions in the
 grammar call functions that are prototyped in unistd.h.</p>
+
+<p>Use the <tt><a href="#pcode">%code</a></tt> directive to add code to
+the end of the generated parser.</p>
 
 <a name='pleft'></a>
 <h4>The <tt>%left</tt> directive</h4>
 
 The <tt>%left</tt> directive is used (along with the

Index: ext/expert/expert1.test
==================================================================
--- ext/expert/expert1.test
+++ ext/expert/expert1.test
@@ -241,12 +241,14 @@
   SELECT * FROM t7 WHERE a=? OR b=?
 } {
   CREATE INDEX t7_idx_00000062 ON t7(b);
   CREATE INDEX t7_idx_00000061 ON t7(a);
   MULTI-INDEX OR
-    SEARCH TABLE t7 USING INDEX t7_idx_00000061 (a=?) 
-    SEARCH TABLE t7 USING INDEX t7_idx_00000062 (b=?)
+    INDEX 1
+      SEARCH TABLE t7 USING INDEX t7_idx_00000061 (a=?) 
+    INDEX 2
+      SEARCH TABLE t7 USING INDEX t7_idx_00000062 (b=?)
 }
 
 # rowid terms.
 #
 do_setup_rec_test $tn.13.1 {

Index: ext/expert/sqlite3expert.c
==================================================================
--- ext/expert/sqlite3expert.c
+++ ext/expert/sqlite3expert.c
@@ -642,10 +642,11 @@
     0,                            /* xFindFunction - function overloading */
     0,                            /* xRename - rename the table */
     0,                            /* xSavepoint */
     0,                            /* xRelease */
     0,                            /* xRollbackTo */
+    0,                            /* xShadowName */
   };
 
   return sqlite3_create_module(p->dbv, "expert", &expertModule, (void*)p);
 }
 /*

Index: ext/fts3/fts3.c
==================================================================
--- ext/fts3/fts3.c
+++ ext/fts3/fts3.c
@@ -318,10 +318,18 @@
 int sqlite3Fts3Always(int b) { assert( b ); return b; }
 int sqlite3Fts3Never(int b)  { assert( !b ); return b; }
 # endif
 #endif
 
+/*
+** This variable is set to false when running tests for which the on disk
+** structures should not be corrupt. Otherwise, true. If it is false, extra
+** assert() conditions in the fts3 code are activated - conditions that are
+** only true if it is guaranteed that the fts3 database is not corrupt.
+*/
+int sqlite3_fts3_may_be_corrupt = 1;
+
 /* 
 ** Write a 64-bit variable-length integer to memory starting at p[0].
 ** The length of data written will be between 1 and FTS3_VARINT_MAX bytes.
 ** The number of bytes written is returned.
 */
@@ -336,11 +344,11 @@
   assert( q - (unsigned char *)p <= FTS3_VARINT_MAX );
   return (int) (q - (unsigned char *)p);
 }
 
 #define GETVARINT_STEP(v, ptr, shift, mask1, mask2, var, ret) \
-  v = (v & mask1) | ( (*ptr++) << shift );                    \
+  v = (v & mask1) | ( (*(const unsigned char*)(ptr++)) << shift );  \
   if( (v & mask2)==0 ){ var = v; return ret; }
 #define GETVARINT_INIT(v, ptr, shift, mask1, mask2, var, ret) \
   v = (*ptr++);                                               \
   if( (v & mask2)==0 ){ var = v; return ret; }
 
@@ -374,24 +382,25 @@
 /*
 ** Similar to sqlite3Fts3GetVarint(), except that the output is truncated to 
 ** a non-negative 32-bit integer before it is returned.
 */
 int sqlite3Fts3GetVarint32(const char *p, int *pi){
+  const unsigned char *ptr = (const unsigned char*)p;
   u32 a;
 
 #ifndef fts3GetVarint32
-  GETVARINT_INIT(a, p, 0,  0x00,     0x80, *pi, 1);
+  GETVARINT_INIT(a, ptr, 0,  0x00,     0x80, *pi, 1);
 #else
-  a = (*p++);
+  a = (*ptr++);
   assert( a & 0x80 );
 #endif
 
-  GETVARINT_STEP(a, p, 7,  0x7F,     0x4000, *pi, 2);
-  GETVARINT_STEP(a, p, 14, 0x3FFF,   0x200000, *pi, 3);
-  GETVARINT_STEP(a, p, 21, 0x1FFFFF, 0x10000000, *pi, 4);
+  GETVARINT_STEP(a, ptr, 7,  0x7F,     0x4000, *pi, 2);
+  GETVARINT_STEP(a, ptr, 14, 0x3FFF,   0x200000, *pi, 3);
+  GETVARINT_STEP(a, ptr, 21, 0x1FFFFF, 0x10000000, *pi, 4);
   a = (a & 0x0FFFFFFF );
-  *pi = (int)(a | ((u32)(*p & 0x07) << 28));
+  *pi = (int)(a | ((u32)(*ptr & 0x07) << 28));
   assert( 0==(a & 0x80000000) );
   assert( *pi>=0 );
   return 5;
 }
 
@@ -558,17 +567,22 @@
   int rc = SQLITE_OK;              /* Return code */
   const char *zDb = p->zDb;        /* Name of database (e.g. "main", "temp") */
   sqlite3 *db = p->db;             /* Database handle */
 
   /* Drop the shadow tables */
-  if( p->zContentTbl==0 ){
-    fts3DbExec(&rc, db, "DROP TABLE IF EXISTS %Q.'%q_content'", zDb, p->zName);
-  }
-  fts3DbExec(&rc, db, "DROP TABLE IF EXISTS %Q.'%q_segments'", zDb,p->zName);
-  fts3DbExec(&rc, db, "DROP TABLE IF EXISTS %Q.'%q_segdir'", zDb, p->zName);
-  fts3DbExec(&rc, db, "DROP TABLE IF EXISTS %Q.'%q_docsize'", zDb, p->zName);
-  fts3DbExec(&rc, db, "DROP TABLE IF EXISTS %Q.'%q_stat'", zDb, p->zName);
+  fts3DbExec(&rc, db, 
+    "DROP TABLE IF EXISTS %Q.'%q_segments';"
+    "DROP TABLE IF EXISTS %Q.'%q_segdir';"
+    "DROP TABLE IF EXISTS %Q.'%q_docsize';"
+    "DROP TABLE IF EXISTS %Q.'%q_stat';"
+    "%s DROP TABLE IF EXISTS %Q.'%q_content';",
+    zDb, p->zName,
+    zDb, p->zName,
+    zDb, p->zName,
+    zDb, p->zName,
+    (p->zContentTbl ? "--" : ""), zDb,p->zName
+  );
 
   /* If everything has worked, invoke fts3DisconnectMethod() to free the
   ** memory associated with the Fts3Table structure and return SQLITE_OK.
   ** Otherwise, return an SQLite error code.
   */
@@ -796,14 +810,14 @@
 ** The pointer returned points to memory obtained from sqlite3_malloc(). It
 ** is the callers responsibility to call sqlite3_free() to release this
 ** memory.
 */
 static char *fts3QuoteId(char const *zInput){
-  int nRet;
+  sqlite3_int64 nRet;
   char *zRet;
   nRet = 2 + (int)strlen(zInput)*2 + 1;
-  zRet = sqlite3_malloc(nRet);
+  zRet = sqlite3_malloc64(nRet);
   if( zRet ){
     int i;
     char *z = zRet;
     *(z++) = '"';
     for(i=0; zInput[i]; i++){
@@ -980,11 +994,11 @@
     for(p=zParam; *p; p++){
       if( *p==',' ) nIndex++;
     }
   }
 
-  aIndex = sqlite3_malloc(sizeof(struct Fts3Index) * nIndex);
+  aIndex = sqlite3_malloc64(sizeof(struct Fts3Index) * nIndex);
   *apIndex = aIndex;
   if( !aIndex ){
     return SQLITE_NOMEM;
   }
 
@@ -1059,25 +1073,25 @@
   }
   sqlite3_free(zSql);
 
   if( rc==SQLITE_OK ){
     const char **azCol;           /* Output array */
-    int nStr = 0;                 /* Size of all column names (incl. 0x00) */
+    sqlite3_int64 nStr = 0;       /* Size of all column names (incl. 0x00) */
     int nCol;                     /* Number of table columns */
     int i;                        /* Used to iterate through columns */
 
     /* Loop through the returned columns. Set nStr to the number of bytes of
     ** space required to store a copy of each column name, including the
     ** nul-terminator byte.  */
     nCol = sqlite3_column_count(pStmt);
     for(i=0; i<nCol; i++){
       const char *zCol = sqlite3_column_name(pStmt, i);
-      nStr += (int)strlen(zCol) + 1;
+      nStr += strlen(zCol) + 1;
     }
 
     /* Allocate and populate the array to return. */
-    azCol = (const char **)sqlite3_malloc(sizeof(char *) * nCol + nStr);
+    azCol = (const char **)sqlite3_malloc64(sizeof(char *) * nCol + nStr);
     if( azCol==0 ){
       rc = SQLITE_NOMEM;
     }else{
       char *p = (char *)&azCol[nCol];
       for(i=0; i<nCol; i++){
@@ -1121,11 +1135,11 @@
 ){
   Fts3Hash *pHash = (Fts3Hash *)pAux;
   Fts3Table *p = 0;               /* Pointer to allocated vtab */
   int rc = SQLITE_OK;             /* Return code */
   int i;                          /* Iterator variable */
-  int nByte;                      /* Size of allocation used for *p */
+  sqlite3_int64 nByte;            /* Size of allocation used for *p */
   int iCol;                       /* Column index */
   int nString = 0;                /* Bytes required to hold all column names */
   int nCol = 0;                   /* Number of columns in the FTS table */
   char *zCsr;                     /* Space for holding column names */
   int nDb;                        /* Bytes required to hold database name */
@@ -1155,14 +1169,14 @@
 
   nDb = (int)strlen(argv[1]) + 1;
   nName = (int)strlen(argv[2]) + 1;
 
   nByte = sizeof(const char *) * (argc-2);
-  aCol = (const char **)sqlite3_malloc(nByte);
+  aCol = (const char **)sqlite3_malloc64(nByte);
   if( aCol ){
     memset((void*)aCol, 0, nByte);
-    azNotindexed = (char **)sqlite3_malloc(nByte);
+    azNotindexed = (char **)sqlite3_malloc64(nByte);
   }
   if( azNotindexed ){
     memset(azNotindexed, 0, nByte);
   }
   if( !aCol || !azNotindexed ){
@@ -1353,11 +1367,11 @@
           nIndex * sizeof(struct Fts3Index) +  /* aIndex */
           nCol * sizeof(u8) +                  /* abNotindexed */
           nName +                              /* zName */
           nDb +                                /* zDb */
           nString;                             /* Space for azColumn strings */
-  p = (Fts3Table*)sqlite3_malloc(nByte);
+  p = (Fts3Table*)sqlite3_malloc64(nByte);
   if( p==0 ){
     rc = SQLITE_NOMEM;
     goto fts3_init_out;
   }
   memset(p, 0, nByte);
@@ -2132,11 +2146,11 @@
 ** into *pp contains all positions of both *pp1 and *pp2 in sorted
 ** order and with any duplicates removed.  All pointers are
 ** updated appropriately.   The caller is responsible for insuring
 ** that there is enough space in *pp to hold the complete output.
 */
-static void fts3PoslistMerge(
+static int fts3PoslistMerge(
   char **pp,                      /* Output buffer */
   char **pp1,                     /* Left input list */
   char **pp2                      /* Right input list */
 ){
   char *p = *pp;
@@ -2145,15 +2159,21 @@
 
   while( *p1 || *p2 ){
     int iCol1;         /* The current column index in pp1 */
     int iCol2;         /* The current column index in pp2 */
 
-    if( *p1==POS_COLUMN ) fts3GetVarint32(&p1[1], &iCol1);
+    if( *p1==POS_COLUMN ){ 
+      fts3GetVarint32(&p1[1], &iCol1);
+      if( iCol1==0 ) return FTS_CORRUPT_VTAB;
+    }
     else if( *p1==POS_END ) iCol1 = POSITION_LIST_END;
     else iCol1 = 0;
 
-    if( *p2==POS_COLUMN ) fts3GetVarint32(&p2[1], &iCol2);
+    if( *p2==POS_COLUMN ){
+      fts3GetVarint32(&p2[1], &iCol2);
+      if( iCol2==0 ) return FTS_CORRUPT_VTAB;
+    }
     else if( *p2==POS_END ) iCol2 = POSITION_LIST_END;
     else iCol2 = 0;
 
     if( iCol1==iCol2 ){
       sqlite3_int64 i1 = 0;       /* Last position from pp1 */
@@ -2197,10 +2217,11 @@
 
   *p++ = POS_END;
   *pp = p;
   *pp1 = p1 + 1;
   *pp2 = p2 + 1;
+  return SQLITE_OK;
 }
 
 /*
 ** This function is used to merge two position lists into one. When it is
 ** called, *pp1 and *pp2 must both point to position lists. A position-list is
@@ -2261,14 +2282,13 @@
       if( iCol1 ){
         *p++ = POS_COLUMN;
         p += sqlite3Fts3PutVarint(p, iCol1);
       }
 
-      assert( *p1!=POS_END && *p1!=POS_COLUMN );
-      assert( *p2!=POS_END && *p2!=POS_COLUMN );
       fts3GetDeltaVarint(&p1, &iPos1); iPos1 -= 2;
       fts3GetDeltaVarint(&p2, &iPos2); iPos2 -= 2;
+      if( iPos1<0 || iPos2<0 ) break;
 
       while( 1 ){
         if( iPos2==iPos1+nToken 
          || (isExact==0 && iPos2>iPos1 && iPos2<=iPos1+nToken) 
         ){
@@ -2490,10 +2510,11 @@
   int bDescDoclist,               /* True if arguments are desc */
   char *a1, int n1,               /* First doclist */
   char *a2, int n2,               /* Second doclist */
   char **paOut, int *pnOut        /* OUT: Malloc'd doclist */
 ){
+  int rc = SQLITE_OK;
   sqlite3_int64 i1 = 0;
   sqlite3_int64 i2 = 0;
   sqlite3_int64 iPrev = 0;
   char *pEnd1 = &a1[n1];
   char *pEnd2 = &a2[n2];
@@ -2533,11 +2554,11 @@
   ** docids to grow. 
   **
   ** A symetric argument may be made if the doclists are in descending 
   ** order.
   */
-  aOut = sqlite3_malloc(n1+n2+FTS3_VARINT_MAX-1);
+  aOut = sqlite3_malloc64((i64)n1+n2+FTS3_VARINT_MAX-1+FTS3_BUFFER_PADDING);
   if( !aOut ) return SQLITE_NOMEM;
 
   p = aOut;
   fts3GetDeltaVarint3(&p1, pEnd1, 0, &i1);
   fts3GetDeltaVarint3(&p2, pEnd2, 0, &i2);
@@ -2544,11 +2565,12 @@
   while( p1 || p2 ){
     sqlite3_int64 iDiff = DOCID_CMP(i1, i2);
 
     if( p2 && p1 && iDiff==0 ){
       fts3PutDeltaVarint3(&p, bDescDoclist, &iPrev, &bFirstOut, i1);
-      fts3PoslistMerge(&p, &p1, &p2);
+      rc = fts3PoslistMerge(&p, &p1, &p2);
+      if( rc ) break;
       fts3GetDeltaVarint3(&p1, pEnd1, bDescDoclist, &i1);
       fts3GetDeltaVarint3(&p2, pEnd2, bDescDoclist, &i2);
     }else if( !p2 || (p1 && iDiff<0) ){
       fts3PutDeltaVarint3(&p, bDescDoclist, &iPrev, &bFirstOut, i1);
       fts3PoslistCopy(&p, &p1);
@@ -2558,14 +2580,20 @@
       fts3PoslistCopy(&p, &p2);
       fts3GetDeltaVarint3(&p2, pEnd2, bDescDoclist, &i2);
     }
   }
 
+  if( rc!=SQLITE_OK ){
+    sqlite3_free(aOut);
+    p = aOut = 0;
+  }else{
+    assert( (p-aOut)<=n1+n2+FTS3_VARINT_MAX-1 );
+    memset(&aOut[(p-aOut)], 0, FTS3_BUFFER_PADDING);
+  }
   *paOut = aOut;
   *pnOut = (int)(p-aOut);
-  assert( *pnOut<=n1+n2+FTS3_VARINT_MAX-1 );
-  return SQLITE_OK;
+  return rc;
 }
 
 /*
 ** This function does a "phrase" merge of two doclists. In a phrase merge,
 ** the output contains a copy of each position from the right-hand input
@@ -2596,11 +2624,11 @@
   int bFirstOut = 0;
   char *aOut;
 
   assert( nDist>0 );
   if( bDescDoclist ){
-    aOut = sqlite3_malloc(*pnRight + FTS3_VARINT_MAX);
+    aOut = sqlite3_malloc64((sqlite3_int64)*pnRight + FTS3_VARINT_MAX);
     if( aOut==0 ) return SQLITE_NOMEM;
   }else{
     aOut = aRight;
   }
   p = aOut;
@@ -2780,10 +2808,11 @@
     */
     pTS->aaOutput[0] = sqlite3_malloc(nDoclist + FTS3_VARINT_MAX + 1);
     pTS->anOutput[0] = nDoclist;
     if( pTS->aaOutput[0] ){
       memcpy(pTS->aaOutput[0], aDoclist, nDoclist);
+      memset(&pTS->aaOutput[0][nDoclist], 0, FTS3_VARINT_MAX);
     }else{
       return SQLITE_NOMEM;
     }
   }else{
     char *aMerge = aDoclist;
@@ -2831,12 +2860,12 @@
   Fts3MultiSegReader *pCsr, 
   Fts3SegReader *pNew
 ){
   if( (pCsr->nSegment%16)==0 ){
     Fts3SegReader **apNew;
-    int nByte = (pCsr->nSegment + 16)*sizeof(Fts3SegReader*);
-    apNew = (Fts3SegReader **)sqlite3_realloc(pCsr->apSegment, nByte);
+    sqlite3_int64 nByte = (pCsr->nSegment + 16)*sizeof(Fts3SegReader*);
+    apNew = (Fts3SegReader **)sqlite3_realloc64(pCsr->apSegment, nByte);
     if( !apNew ){
       sqlite3Fts3SegReaderFree(pNew);
       return SQLITE_NOMEM;
     }
     pCsr->apSegment = apNew;
@@ -2896,11 +2925,11 @@
       int nRoot = sqlite3_column_bytes(pStmt, 4);
       char const *zRoot = sqlite3_column_blob(pStmt, 4);
 
       /* If zTerm is not NULL, and this segment is not stored entirely on its
       ** root node, the range of leaves scanned can be reduced. Do this. */
-      if( iStartBlock && zTerm ){
+      if( iStartBlock && zTerm && zRoot ){
         sqlite3_int64 *pi = (isPrefix ? &iLeavesEndBlock : 0);
         rc = fts3SelectLeaf(p, zTerm, nTerm, zRoot, nRoot, &iStartBlock, pi);
         if( rc!=SQLITE_OK ) goto finished;
         if( isPrefix==0 && isScan==0 ) iLeavesEndBlock = iStartBlock;
       }
@@ -3838,18 +3867,32 @@
 */
 static int fts3RollbackToMethod(sqlite3_vtab *pVtab, int iSavepoint){
   Fts3Table *p = (Fts3Table*)pVtab;
   UNUSED_PARAMETER(iSavepoint);
   assert( p->inTransaction );
-  assert( p->mxSavepoint >= iSavepoint );
   TESTONLY( p->mxSavepoint = iSavepoint );
   sqlite3Fts3PendingTermsClear(p);
   return SQLITE_OK;
 }
+
+/*
+** Return true if zName is the extension on one of the shadow tables used
+** by this module.
+*/
+static int fts3ShadowName(const char *zName){
+  static const char *azName[] = {
+    "content", "docsize", "segdir", "segments", "stat", 
+  };
+  unsigned int i;
+  for(i=0; i<sizeof(azName)/sizeof(azName[0]); i++){
+    if( sqlite3_stricmp(zName, azName[i])==0 ) return 1;
+  }
+  return 0;
+}
 
 static const sqlite3_module fts3Module = {
-  /* iVersion      */ 2,
+  /* iVersion      */ 3,
   /* xCreate       */ fts3CreateMethod,
   /* xConnect      */ fts3ConnectMethod,
   /* xBestIndex    */ fts3BestIndexMethod,
   /* xDisconnect   */ fts3DisconnectMethod,
   /* xDestroy      */ fts3DestroyMethod,
@@ -3868,10 +3911,11 @@
   /* xFindFunction */ fts3FindFunctionMethod,
   /* xRename */       fts3RenameMethod,
   /* xSavepoint    */ fts3SavepointMethod,
   /* xRelease      */ fts3ReleaseMethod,
   /* xRollbackTo   */ fts3RollbackToMethod,
+  /* xShadowName   */ fts3ShadowName,
 };
 
 /*
 ** This function is registered as the module destructor (called when an
 ** FTS3 enabled database connection is closed). It frees the memory
@@ -4148,10 +4192,11 @@
   }
 
   return rc;
 }
 
+#ifndef SQLITE_DISABLE_FTS4_DEFERRED
 /*
 ** This function is called on each phrase after the position lists for
 ** any deferred tokens have been loaded into memory. It updates the phrases
 ** current position list to include only those positions that are really
 ** instances of the phrase (after considering deferred tokens). If this
@@ -4251,10 +4296,11 @@
     }
   }
 
   return SQLITE_OK;
 }
+#endif /* SQLITE_DISABLE_FTS4_DEFERRED */
 
 /*
 ** Maximum number of tokens a phrase may have to be considered for the
 ** incremental doclists strategy.
 */
@@ -4595,13 +4641,14 @@
 
       /* Check if the current entries really are a phrase match */
       if( bEof==0 ){
         int nList = 0;
         int nByte = a[p->nToken-1].nList;
-        char *aDoclist = sqlite3_malloc(nByte+1);
+        char *aDoclist = sqlite3_malloc(nByte+FTS3_BUFFER_PADDING);
         if( !aDoclist ) return SQLITE_NOMEM;
         memcpy(aDoclist, a[p->nToken-1].pList, nByte+1);
+        memset(&aDoclist[nByte], 0, FTS3_BUFFER_PADDING);
 
         for(i=0; i<(p->nToken-1); i++){
           if( a[i].bIgnore==0 ){
             char *pL = a[i].pList;
             char *pR = aDoclist;
@@ -4988,11 +5035,11 @@
   /* Determine which, if any, tokens in the expression should be deferred. */
 #ifndef SQLITE_DISABLE_FTS4_DEFERRED
   if( rc==SQLITE_OK && nToken>1 && pTab->bFts4 ){
     Fts3TokenAndCost *aTC;
     Fts3Expr **apOr;
-    aTC = (Fts3TokenAndCost *)sqlite3_malloc(
+    aTC = (Fts3TokenAndCost *)sqlite3_malloc64(
         sizeof(Fts3TokenAndCost) * nToken
       + sizeof(Fts3Expr *) * nOr * 2
     );
     apOr = (Fts3Expr **)&aTC[nToken];
 
@@ -5299,20 +5346,20 @@
   if( *pRc==SQLITE_OK 
    && pExpr->eType==FTSQUERY_NEAR 
    && (pExpr->pParent==0 || pExpr->pParent->eType!=FTSQUERY_NEAR)
   ){
     Fts3Expr *p; 
-    int nTmp = 0;                 /* Bytes of temp space */
+    sqlite3_int64 nTmp = 0;       /* Bytes of temp space */
     char *aTmp;                   /* Temp space for PoslistNearMerge() */
 
     /* Allocate temporary working space. */
     for(p=pExpr; p->pLeft; p=p->pLeft){
       assert( p->pRight->pPhrase->doclist.nList>0 );
       nTmp += p->pRight->pPhrase->doclist.nList;
     }
     nTmp += p->pPhrase->doclist.nList;
-    aTmp = sqlite3_malloc(nTmp*2);
+    aTmp = sqlite3_malloc64(nTmp*2);
     if( !aTmp ){
       *pRc = SQLITE_NOMEM;
       res = 0;
     }else{
       char *aPoslist = p->pPhrase->doclist.pList;
@@ -5578,19 +5625,18 @@
 ** by pExpr, calling this function for each row. This function increments
 ** the values in Fts3Expr.aMI[] according to the position-list currently
 ** found in Fts3Expr.pPhrase->doclist.pList for each of the phrase 
 ** expression nodes.
 */
-static void fts3EvalUpdateCounts(Fts3Expr *pExpr){
+static void fts3EvalUpdateCounts(Fts3Expr *pExpr, int nCol){
   if( pExpr ){
     Fts3Phrase *pPhrase = pExpr->pPhrase;
     if( pPhrase && pPhrase->doclist.pList ){
       int iCol = 0;
       char *p = pPhrase->doclist.pList;
 
-      assert( *p );
-      while( 1 ){
+      do{
         u8 c = 0;
         int iCnt = 0;
         while( 0xFE & (*p | c) ){
           if( (c&0x80)==0 ) iCnt++;
           c = *p++ & 0x80;
@@ -5602,15 +5648,15 @@
         pExpr->aMI[iCol*3 + 1] += iCnt;
         pExpr->aMI[iCol*3 + 2] += (iCnt>0);
         if( *p==0x00 ) break;
         p++;
         p += fts3GetVarint32(p, &iCol);
-      }
+      }while( iCol<nCol );
     }
 
-    fts3EvalUpdateCounts(pExpr->pLeft);
-    fts3EvalUpdateCounts(pExpr->pRight);
+    fts3EvalUpdateCounts(pExpr->pLeft, nCol);
+    fts3EvalUpdateCounts(pExpr->pRight, nCol);
   }
 }
 
 /*
 ** Expression pExpr must be of type FTSQUERY_PHRASE.
@@ -5650,11 +5696,11 @@
 
     /* Allocate space for the aMSI[] array of each FTSQUERY_PHRASE node */
     for(p=pRoot; p; p=p->pLeft){
       Fts3Expr *pE = (p->eType==FTSQUERY_PHRASE?p:p->pRight);
       assert( pE->aMI==0 );
-      pE->aMI = (u32 *)sqlite3_malloc(pTab->nColumn * 3 * sizeof(u32));
+      pE->aMI = (u32 *)sqlite3_malloc64(pTab->nColumn * 3 * sizeof(u32));
       if( !pE->aMI ) return SQLITE_NOMEM;
       memset(pE->aMI, 0, pTab->nColumn * 3 * sizeof(u32));
     }
 
     fts3EvalRestart(pCsr, pRoot, &rc);
@@ -5676,11 +5722,11 @@
            && pRoot->eType==FTSQUERY_NEAR 
            && sqlite3Fts3EvalTestDeferred(pCsr, &rc) 
       );
 
       if( rc==SQLITE_OK && pCsr->isEof==0 ){
-        fts3EvalUpdateCounts(pRoot);
+        fts3EvalUpdateCounts(pRoot, pTab->nColumn);
       }
     }
 
     pCsr->isEof = 0;
     pCsr->iPrevId = iPrevId;

Index: ext/fts3/fts3Int.h
==================================================================
--- ext/fts3/fts3Int.h
+++ ext/fts3/fts3Int.h
@@ -93,10 +93,12 @@
 ** Maximum length of a varint encoded integer. The varint format is different
 ** from that used by SQLite, so the maximum length is 10, not 9.
 */
 #define FTS3_VARINT_MAX 10
 
+#define FTS3_BUFFER_PADDING 8
+
 /*
 ** FTS4 virtual tables may maintain multiple indexes - one index of all terms
 ** in the document set and zero or more prefix indexes. All indexes are stored
 ** as one or more b+-trees in the %_segments and %_segdir tables. 
 **
@@ -125,10 +127,22 @@
 ** Terminator values for position-lists and column-lists.
 */
 #define POS_COLUMN  (1)     /* Column-list terminator */
 #define POS_END     (0)     /* Position-list terminator */ 
 
+/*
+** The assert_fts3_nc() macro is similar to the assert() macro, except that it
+** is used for assert() conditions that are true only if it can be 
+** guranteed that the database is not corrupt.
+*/
+#if defined(SQLITE_DEBUG) || defined(SQLITE_TEST)
+extern int sqlite3_fts3_may_be_corrupt;
+# define assert_fts3_nc(x) assert(sqlite3_fts3_may_be_corrupt || (x))
+#else
+# define assert_fts3_nc(x) assert(x)
+#endif
+
 /*
 ** This section provides definitions to allow the
 ** FTS3 extension to be compiled outside of the 
 ** amalgamation.
 */

Index: ext/fts3/fts3_aux.c
==================================================================
--- ext/fts3/fts3_aux.c
+++ ext/fts3/fts3_aux.c
@@ -64,11 +64,11 @@
 ){
   char const *zDb;                /* Name of database (e.g. "main") */
   char const *zFts3;              /* Name of fts3 table */
   int nDb;                        /* Result of strlen(zDb) */
   int nFts3;                      /* Result of strlen(zFts3) */
-  int nByte;                      /* Bytes of space to allocate here */
+  sqlite3_int64 nByte;            /* Bytes of space to allocate here */
   int rc;                         /* value returned by declare_vtab() */
   Fts3auxTable *p;                /* Virtual table object to return */
 
   UNUSED_PARAMETER(pUnused);
 
@@ -96,11 +96,11 @@
 
   rc = sqlite3_declare_vtab(db, FTS3_AUX_SCHEMA);
   if( rc!=SQLITE_OK ) return rc;
 
   nByte = sizeof(Fts3auxTable) + sizeof(Fts3Table) + nDb + nFts3 + 2;
-  p = (Fts3auxTable *)sqlite3_malloc(nByte);
+  p = (Fts3auxTable *)sqlite3_malloc64(nByte);
   if( !p ) return SQLITE_NOMEM;
   memset(p, 0, nByte);
 
   p->pFts3Tab = (Fts3Table *)&p[1];
   p->pFts3Tab->zDb = (char *)&p->pFts3Tab[1];
@@ -246,11 +246,11 @@
 }
 
 static int fts3auxGrowStatArray(Fts3auxCursor *pCsr, int nSize){
   if( nSize>pCsr->nStat ){
     struct Fts3auxColstats *aNew;
-    aNew = (struct Fts3auxColstats *)sqlite3_realloc(pCsr->aStat, 
+    aNew = (struct Fts3auxColstats *)sqlite3_realloc64(pCsr->aStat, 
         sizeof(struct Fts3auxColstats) * nSize
     );
     if( aNew==0 ) return SQLITE_NOMEM;
     memset(&aNew[pCsr->nStat], 0, 
         sizeof(struct Fts3auxColstats) * (nSize - pCsr->nStat)
@@ -414,19 +414,19 @@
   if( iEq>=0 || iGe>=0 ){
     const unsigned char *zStr = sqlite3_value_text(apVal[0]);
     assert( (iEq==0 && iGe==-1) || (iEq==-1 && iGe==0) );
     if( zStr ){
       pCsr->filter.zTerm = sqlite3_mprintf("%s", zStr);
-      pCsr->filter.nTerm = sqlite3_value_bytes(apVal[0]);
       if( pCsr->filter.zTerm==0 ) return SQLITE_NOMEM;
+      pCsr->filter.nTerm = (int)strlen(pCsr->filter.zTerm);
     }
   }
 
   if( iLe>=0 ){
     pCsr->zStop = sqlite3_mprintf("%s", sqlite3_value_text(apVal[iLe]));
-    pCsr->nStop = sqlite3_value_bytes(apVal[iLe]);
     if( pCsr->zStop==0 ) return SQLITE_NOMEM;
+    pCsr->nStop = (int)strlen(pCsr->zStop);
   }
   
   if( iLangid>=0 ){
     iLangVal = sqlite3_value_int(apVal[iLangid]);
 
@@ -537,14 +537,15 @@
      0,                           /* xRollback     */
      0,                           /* xFindFunction */
      0,                           /* xRename       */
      0,                           /* xSavepoint    */
      0,                           /* xRelease      */
-     0                            /* xRollbackTo   */
+     0,                           /* xRollbackTo   */
+     0                            /* xShadowName   */
   };
   int rc;                         /* Return code */
 
   rc = sqlite3_create_module(db, "fts4aux", &fts3aux_module, 0);
   return rc;
 }
 
 #endif /* !defined(SQLITE_CORE) || defined(SQLITE_ENABLE_FTS3) */

Index: ext/fts3/fts3_expr.c
==================================================================
--- ext/fts3/fts3_expr.c
+++ ext/fts3/fts3_expr.c
@@ -120,12 +120,12 @@
 /*
 ** Allocate nByte bytes of memory using sqlite3_malloc(). If successful,
 ** zero the memory before returning a pointer to it. If unsuccessful, 
 ** return NULL.
 */
-static void *fts3MallocZero(int nByte){
-  void *pRet = sqlite3_malloc(nByte);
+static void *fts3MallocZero(sqlite3_int64 nByte){
+  void *pRet = sqlite3_malloc64(nByte);
   if( pRet ) memset(pRet, 0, nByte);
   return pRet;
 }
 
 int sqlite3Fts3OpenTokenizer(
@@ -196,11 +196,11 @@
   *pnConsumed = i;
   rc = sqlite3Fts3OpenTokenizer(pTokenizer, pParse->iLangid, z, i, &pCursor);
   if( rc==SQLITE_OK ){
     const char *zToken;
     int nToken = 0, iStart = 0, iEnd = 0, iPosition = 0;
-    int nByte;                               /* total space to allocate */
+    sqlite3_int64 nByte;                    /* total space to allocate */
 
     rc = pModule->xNext(pCursor, &zToken, &nToken, &iStart, &iEnd, &iPosition);
     if( rc==SQLITE_OK ){
       nByte = sizeof(Fts3Expr) + sizeof(Fts3Phrase) + nToken;
       pRet = (Fts3Expr *)fts3MallocZero(nByte);
@@ -250,12 +250,12 @@
 
 /*
 ** Enlarge a memory allocation.  If an out-of-memory allocation occurs,
 ** then free the old allocation.
 */
-static void *fts3ReallocOrFree(void *pOrig, int nNew){
-  void *pRet = sqlite3_realloc(pOrig, nNew);
+static void *fts3ReallocOrFree(void *pOrig, sqlite3_int64 nNew){
+  void *pRet = sqlite3_realloc64(pOrig, nNew);
   if( !pRet ){
     sqlite3_free(pOrig);
   }
   return pRet;
 }
@@ -495,11 +495,10 @@
   if( sqlite3_fts3_enable_parentheses ){
     if( *zInput=='(' ){
       int nConsumed = 0;
       pParse->nNest++;
       rc = fts3ExprParse(pParse, zInput+1, nInput-1, ppExpr, &nConsumed);
-      if( rc==SQLITE_OK && !*ppExpr ){ rc = SQLITE_DONE; }
       *pnConsumed = (int)(zInput - z) + 1 + nConsumed;
       return rc;
     }else if( *zInput==')' ){
       pParse->nNest--;
       *pnConsumed = (int)((zInput - z) + 1);
@@ -794,11 +793,11 @@
   }
 
   if( rc==SQLITE_OK ){
     if( (eType==FTSQUERY_AND || eType==FTSQUERY_OR) ){
       Fts3Expr **apLeaf;
-      apLeaf = (Fts3Expr **)sqlite3_malloc(sizeof(Fts3Expr *) * nMaxDepth);
+      apLeaf = (Fts3Expr **)sqlite3_malloc64(sizeof(Fts3Expr *) * nMaxDepth);
       if( 0==apLeaf ){
         rc = SQLITE_NOMEM;
       }else{
         memset(apLeaf, 0, sizeof(Fts3Expr *) * nMaxDepth);
       }
@@ -1214,11 +1213,11 @@
   }
 
   zExpr = (const char *)sqlite3_value_text(argv[1]);
   nExpr = sqlite3_value_bytes(argv[1]);
   nCol = argc-2;
-  azCol = (char **)sqlite3_malloc(nCol*sizeof(char *));
+  azCol = (char **)sqlite3_malloc64(nCol*sizeof(char *));
   if( !azCol ){
     sqlite3_result_error_nomem(context);
     goto exprtest_out;
   }
   for(ii=0; ii<nCol; ii++){

Index: ext/fts3/fts3_hash.c
==================================================================
--- ext/fts3/fts3_hash.c
+++ ext/fts3/fts3_hash.c
@@ -33,12 +33,12 @@
 #include "fts3_hash.h"
 
 /*
 ** Malloc and Free functions
 */
-static void *fts3HashMalloc(int n){
-  void *p = sqlite3_malloc(n);
+static void *fts3HashMalloc(sqlite3_int64 n){
+  void *p = sqlite3_malloc64(n);
   if( p ){
     memset(p, 0, n);
   }
   return p;
 }

Index: ext/fts3/fts3_icu.c
==================================================================
--- ext/fts3/fts3_icu.c
+++ ext/fts3/fts3_icu.c
@@ -58,11 +58,11 @@
   int n = 0;
 
   if( argc>0 ){
     n = strlen(argv[0])+1;
   }
-  p = (IcuTokenizer *)sqlite3_malloc(sizeof(IcuTokenizer)+n);
+  p = (IcuTokenizer *)sqlite3_malloc64(sizeof(IcuTokenizer)+n);
   if( !p ){
     return SQLITE_NOMEM;
   }
   memset(p, 0, sizeof(IcuTokenizer));
 
@@ -115,11 +115,11 @@
     zInput = "";
   }else if( nInput<0 ){
     nInput = strlen(zInput);
   }
   nChar = nInput+1;
-  pCsr = (IcuCursor *)sqlite3_malloc(
+  pCsr = (IcuCursor *)sqlite3_malloc64(
       sizeof(IcuCursor) +                /* IcuCursor */
       ((nChar+3)&~3) * sizeof(UChar) +   /* IcuCursor.aChar[] */
       (nChar+1) * sizeof(int)            /* IcuCursor.aOffset[] */
   );
   if( !pCsr ){

Index: ext/fts3/fts3_snippet.c
==================================================================
--- ext/fts3/fts3_snippet.c
+++ ext/fts3/fts3_snippet.c
@@ -176,11 +176,11 @@
   else if( p->aRef[2]==0 ){
     p->aRef[2] = 1;
     aOut = &p->aMatchinfo[p->nElem+2];
     xRet = fts3MIBufferFree;
   }else{
-    aOut = (u32*)sqlite3_malloc(p->nElem * sizeof(u32));
+    aOut = (u32*)sqlite3_malloc64(p->nElem * sizeof(u32));
     if( aOut ){
       xRet = sqlite3_free;
       if( p->bGlobal ) memcpy(aOut, &p->aMatchinfo[1], p->nElem*sizeof(u32));
     }
   }
@@ -431,11 +431,12 @@
 
       while( iCsr<(iStart+pIter->nSnippet) ){
         int j;
         u64 mPhrase = (u64)1 << i;
         u64 mPos = (u64)1 << (iCsr - iStart);
-        assert( iCsr>=iStart );
+        assert( iCsr>=iStart && (iCsr - iStart)<=64 );
+        assert( i>=0 && i<=64 );
         if( (mCover|mCovered)&mPhrase ){
           iScore++;
         }else{
           iScore += 1000;
         }
@@ -473,15 +474,18 @@
   assert( rc==SQLITE_OK || pCsr==0 );
   if( pCsr ){
     int iFirst = 0;
     pPhrase->pList = pCsr;
     fts3GetDeltaPosition(&pCsr, &iFirst);
-    assert( iFirst>=0 );
-    pPhrase->pHead = pCsr;
-    pPhrase->pTail = pCsr;
-    pPhrase->iHead = iFirst;
-    pPhrase->iTail = iFirst;
+    if( iFirst<0 ){
+      rc = FTS_CORRUPT_VTAB;
+    }else{
+      pPhrase->pHead = pCsr;
+      pPhrase->pTail = pCsr;
+      pPhrase->iHead = iFirst;
+      pPhrase->iTail = iFirst;
+    }
   }else{
     assert( rc!=SQLITE_OK || (
        pPhrase->pList==0 && pPhrase->pHead==0 && pPhrase->pTail==0 
     ));
   }
@@ -514,11 +518,11 @@
   int *piScore                    /* OUT: Score of snippet pFragment */
 ){
   int rc;                         /* Return Code */
   int nList;                      /* Number of phrases in expression */
   SnippetIter sIter;              /* Iterates through snippet candidates */
-  int nByte;                      /* Number of bytes of space to allocate */
+  sqlite3_int64 nByte;            /* Number of bytes of space to allocate */
   int iBestScore = -1;            /* Best snippet score found so far */
   int i;                          /* Loop counter */
 
   memset(&sIter, 0, sizeof(sIter));
 
@@ -532,11 +536,11 @@
 
   /* Now that it is known how many phrases there are, allocate and zero
   ** the required space using malloc().
   */
   nByte = sizeof(SnippetPhrase) * nList;
-  sIter.aPhrase = (SnippetPhrase *)sqlite3_malloc(nByte);
+  sIter.aPhrase = (SnippetPhrase *)sqlite3_malloc64(nByte);
   if( !sIter.aPhrase ){
     return SQLITE_NOMEM;
   }
   memset(sIter.aPhrase, 0, nByte);
 
@@ -602,12 +606,12 @@
   /* If there is insufficient space allocated at StrBuffer.z, use realloc()
   ** to grow the buffer until so that it is big enough to accomadate the
   ** appended data.
   */
   if( pStr->n+nAppend+1>=pStr->nAlloc ){
-    int nAlloc = pStr->nAlloc+nAppend+100;
-    char *zNew = sqlite3_realloc(pStr->z, nAlloc);
+    sqlite3_int64 nAlloc = pStr->nAlloc+(sqlite3_int64)nAppend+100;
+    char *zNew = sqlite3_realloc64(pStr->z, nAlloc);
     if( !zNew ){
       return SQLITE_NOMEM;
     }
     pStr->z = zNew;
     pStr->nAlloc = nAlloc;
@@ -658,10 +662,11 @@
     int nRight;                   /* Tokens to the right of last highlight */
     int nDesired;                 /* Ideal number of tokens to shift forward */
 
     for(nLeft=0; !(hlmask & ((u64)1 << nLeft)); nLeft++);
     for(nRight=0; !(hlmask & ((u64)1 << (nSnippet-1-nRight))); nRight++);
+    assert( (nSnippet-1-nRight)<=63 && (nSnippet-1-nRight)>=0 );
     nDesired = (nLeft-nRight)/2;
 
     /* Ideally, the start of the snippet should be pushed forward in the
     ** document nDesired tokens. This block checks if there are actually
     ** nDesired tokens to the right of the snippet. If so, *piPos and
@@ -850,11 +855,11 @@
 }
 
 /*
 ** This function gathers 'y' or 'b' data for a single phrase.
 */
-static void fts3ExprLHits(
+static int fts3ExprLHits(
   Fts3Expr *pExpr,                /* Phrase expression node */
   MatchInfo *p                    /* Matchinfo context */
 ){
   Fts3Table *pTab = (Fts3Table *)p->pCursor->base.pVtab;
   int iStart;
@@ -880,29 +885,33 @@
     }
     assert( *pIter==0x00 || *pIter==0x01 );
     if( *pIter!=0x01 ) break;
     pIter++;
     pIter += fts3GetVarint32(pIter, &iCol);
+    if( iCol>=p->nCol ) return FTS_CORRUPT_VTAB;
   }
+  return SQLITE_OK;
 }
 
 /*
 ** Gather the results for matchinfo directives 'y' and 'b'.
 */
-static void fts3ExprLHitGather(
+static int fts3ExprLHitGather(
   Fts3Expr *pExpr,
   MatchInfo *p
 ){
+  int rc = SQLITE_OK;
   assert( (pExpr->pLeft==0)==(pExpr->pRight==0) );
   if( pExpr->bEof==0 && pExpr->iDocid==p->pCursor->iPrevId ){
     if( pExpr->pLeft ){
-      fts3ExprLHitGather(pExpr->pLeft, p);
-      fts3ExprLHitGather(pExpr->pRight, p);
+      rc = fts3ExprLHitGather(pExpr->pLeft, p);
+      if( rc==SQLITE_OK ) rc = fts3ExprLHitGather(pExpr->pRight, p);
     }else{
-      fts3ExprLHits(pExpr, p);
+      rc = fts3ExprLHits(pExpr, p);
     }
   }
+  return rc;
 }
 
 /*
 ** fts3ExprIterate() callback used to collect the "global" matchinfo stats
 ** for a single query. 
@@ -1115,15 +1124,16 @@
 static int fts3MatchinfoLcs(Fts3Cursor *pCsr, MatchInfo *pInfo){
   LcsIterator *aIter;
   int i;
   int iCol;
   int nToken = 0;
+  int rc = SQLITE_OK;
 
   /* Allocate and populate the array of LcsIterator objects. The array
   ** contains one element for each matchable phrase in the query.
   **/
-  aIter = sqlite3_malloc(sizeof(LcsIterator) * pCsr->nPhrase);
+  aIter = sqlite3_malloc64(sizeof(LcsIterator) * pCsr->nPhrase);
   if( !aIter ) return SQLITE_NOMEM;
   memset(aIter, 0, sizeof(LcsIterator) * pCsr->nPhrase);
   (void)fts3ExprIterate(pCsr->pExpr, fts3MatchinfoLcsCb, (void*)aIter);
 
   for(i=0; i<pInfo->nPhrase; i++){
@@ -1135,17 +1145,20 @@
   for(iCol=0; iCol<pInfo->nCol; iCol++){
     int nLcs = 0;                 /* LCS value for this column */
     int nLive = 0;                /* Number of iterators in aIter not at EOF */
 
     for(i=0; i<pInfo->nPhrase; i++){
-      int rc;
       LcsIterator *pIt = &aIter[i];
       rc = sqlite3Fts3EvalPhrasePoslist(pCsr, pIt->pExpr, iCol, &pIt->pRead);
-      if( rc!=SQLITE_OK ) return rc;
+      if( rc!=SQLITE_OK ) goto matchinfo_lcs_out;
       if( pIt->pRead ){
         pIt->iPos = pIt->iPosOffset;
-        fts3LcsIteratorAdvance(&aIter[i]);
+        fts3LcsIteratorAdvance(pIt);
+        if( pIt->pRead==0 ){
+          rc = FTS_CORRUPT_VTAB;
+          goto matchinfo_lcs_out;
+        }
         nLive++;
       }
     }
 
     while( nLive>0 ){
@@ -1173,12 +1186,13 @@
     }
 
     pInfo->aMatchinfo[iCol] = nLcs;
   }
 
+ matchinfo_lcs_out:
   sqlite3_free(aIter);
-  return SQLITE_OK;
+  return rc;
 }
 
 /*
 ** Populate the buffer pInfo->aMatchinfo[] with an array of integers to
 ** be returned by the matchinfo() function. Argument zArg contains the 
@@ -1270,11 +1284,11 @@
 
       case FTS3_MATCHINFO_LHITS_BM:
       case FTS3_MATCHINFO_LHITS: {
         int nZero = fts3MatchinfoSize(pInfo, zArg[i]) * sizeof(u32);
         memset(pInfo->aMatchinfo, 0, nZero);
-        fts3ExprLHitGather(pCsr->pExpr, pInfo);
+        rc = fts3ExprLHitGather(pCsr->pExpr, pInfo);
         break;
       }
 
       default: {
         Fts3Expr *pExpr;
@@ -1421,10 +1435,14 @@
 
   if( !pCsr->pExpr ){
     sqlite3_result_text(pCtx, "", 0, SQLITE_STATIC);
     return;
   }
+
+  /* Limit the snippet length to 64 tokens. */
+  if( nToken<-64 ) nToken = -64;
+  if( nToken>+64 ) nToken = +64;
 
   for(nSnippet=1; 1; nSnippet++){
 
     int iSnip;                    /* Loop counter 0..nSnippet-1 */
     u64 mCovered = 0;             /* Bitmask of phrases covered by snippet */
@@ -1564,11 +1582,11 @@
   /* Count the number of terms in the query */
   rc = fts3ExprLoadDoclists(pCsr, 0, &nToken);
   if( rc!=SQLITE_OK ) goto offsets_out;
 
   /* Allocate the array of TermOffset iterators. */
-  sCtx.aTerm = (TermOffset *)sqlite3_malloc(sizeof(TermOffset)*nToken);
+  sCtx.aTerm = (TermOffset *)sqlite3_malloc64(sizeof(TermOffset)*nToken);
   if( 0==sCtx.aTerm ){
     rc = SQLITE_NOMEM;
     goto offsets_out;
   }
   sCtx.iDocid = pCsr->iPrevId;

Index: ext/fts3/fts3_term.c
==================================================================
--- ext/fts3/fts3_term.c
+++ ext/fts3/fts3_term.c
@@ -66,13 +66,13 @@
 ){
   char const *zDb;                /* Name of database (e.g. "main") */
   char const *zFts3;              /* Name of fts3 table */
   int nDb;                        /* Result of strlen(zDb) */
   int nFts3;                      /* Result of strlen(zFts3) */
-  int nByte;                      /* Bytes of space to allocate here */
+  sqlite3_int64 nByte;            /* Bytes of space to allocate here */
   int rc;                         /* value returned by declare_vtab() */
-  Fts3termTable *p;                /* Virtual table object to return */
+  Fts3termTable *p;               /* Virtual table object to return */
   int iIndex = 0;
 
   UNUSED_PARAMETER(pCtx);
   if( argc==5 ){
     iIndex = atoi(argv[4]);
@@ -94,11 +94,11 @@
 
   rc = sqlite3_declare_vtab(db, FTS3_TERMS_SCHEMA);
   if( rc!=SQLITE_OK ) return rc;
 
   nByte = sizeof(Fts3termTable) + sizeof(Fts3Table) + nDb + nFts3 + 2;
-  p = (Fts3termTable *)sqlite3_malloc(nByte);
+  p = (Fts3termTable *)sqlite3_malloc64(nByte);
   if( !p ) return SQLITE_NOMEM;
   memset(p, 0, nByte);
 
   p->pFts3Tab = (Fts3Table *)&p[1];
   p->pFts3Tab->zDb = (char *)&p->pFts3Tab[1];
@@ -359,15 +359,16 @@
      0,                           /* xRollback     */
      0,                           /* xFindFunction */
      0,                           /* xRename       */
      0,                           /* xSavepoint    */
      0,                           /* xRelease      */
-     0                            /* xRollbackTo   */
+     0,                           /* xRollbackTo   */
+     0                            /* xShadowName   */
   };
   int rc;                         /* Return code */
 
   rc = sqlite3_create_module(db, "fts4term", &fts3term_module, 0);
   return rc;
 }
 
 #endif
 #endif /* !defined(SQLITE_CORE) || defined(SQLITE_ENABLE_FTS3) */

Index: ext/fts3/fts3_test.c
==================================================================
--- ext/fts3/fts3_test.c
+++ ext/fts3/fts3_test.c
@@ -571,22 +571,51 @@
 }
 
 /* 
 ** End of tokenizer code.
 **************************************************************************/ 
+
+/*
+**      sqlite3_fts3_may_be_corrupt BOOLEAN
+**
+** Set or clear the global "may-be-corrupt" flag. Return the old value.
+*/
+static int SQLITE_TCLAPI fts3_may_be_corrupt(
+  void * clientData,
+  Tcl_Interp *interp,
+  int objc,
+  Tcl_Obj *CONST objv[]
+){
+  int bOld = sqlite3_fts3_may_be_corrupt;
+
+  if( objc!=2 && objc!=1 ){
+    Tcl_WrongNumArgs(interp, 1, objv, "?BOOLEAN?");
+    return TCL_ERROR;
+  }
+  if( objc==2 ){
+    int bNew;
+    if( Tcl_GetBooleanFromObj(interp, objv[1], &bNew) ) return TCL_ERROR;
+    sqlite3_fts3_may_be_corrupt = bNew;
+  }
+
+  Tcl_SetObjResult(interp, Tcl_NewIntObj(bOld));
+  return TCL_OK;
+}
 
 int Sqlitetestfts3_Init(Tcl_Interp *interp){
   Tcl_CreateObjCommand(interp, "fts3_near_match", fts3_near_match_cmd, 0, 0);
   Tcl_CreateObjCommand(interp, 
       "fts3_configure_incr_load", fts3_configure_incr_load_cmd, 0, 0
   );
   Tcl_CreateObjCommand(
       interp, "fts3_test_tokenizer", fts3_test_tokenizer_cmd, 0, 0
   );
-
   Tcl_CreateObjCommand(
       interp, "fts3_test_varint", fts3_test_varint_cmd, 0, 0
   );
+  Tcl_CreateObjCommand(
+      interp, "sqlite3_fts3_may_be_corrupt", fts3_may_be_corrupt, 0, 0
+  );
   return TCL_OK;
 }
 #endif                  /* SQLITE_ENABLE_FTS3 || SQLITE_ENABLE_FTS4 */
 #endif                  /* ifdef SQLITE_TEST */

Index: ext/fts3/fts3_tokenize_vtab.c
==================================================================
--- ext/fts3/fts3_tokenize_vtab.c
+++ ext/fts3/fts3_tokenize_vtab.c
@@ -120,11 +120,11 @@
 
     for(i=0; i<argc; i++){
       nByte += (int)(strlen(argv[i]) + 1);
     }
 
-    *pazDequote = azDequote = sqlite3_malloc(sizeof(char *)*argc + nByte);
+    *pazDequote = azDequote = sqlite3_malloc64(sizeof(char *)*argc + nByte);
     if( azDequote==0 ){
       rc = SQLITE_NOMEM;
     }else{
       char *pSpace = (char *)&azDequote[argc];
       for(i=0; i<argc; i++){
@@ -441,14 +441,15 @@
      0,                           /* xRollback     */
      0,                           /* xFindFunction */
      0,                           /* xRename       */
      0,                           /* xSavepoint    */
      0,                           /* xRelease      */
-     0                            /* xRollbackTo   */
+     0,                           /* xRollbackTo   */
+     0                            /* xShadowName   */
   };
   int rc;                         /* Return code */
 
   rc = sqlite3_create_module(db, "fts3tokenize", &fts3tok_module, (void*)pHash);
   return rc;
 }
 
 #endif /* !defined(SQLITE_CORE) || defined(SQLITE_ENABLE_FTS3) */

Index: ext/fts3/fts3_unicode.c
==================================================================
--- ext/fts3/fts3_unicode.c
+++ ext/fts3/fts3_unicode.c
@@ -80,11 +80,11 @@
 typedef struct unicode_tokenizer unicode_tokenizer;
 typedef struct unicode_cursor unicode_cursor;
 
 struct unicode_tokenizer {
   sqlite3_tokenizer base;
-  int bRemoveDiacritic;
+  int eRemoveDiacritic;
   int nException;
   int *aiException;
 };
 
 struct unicode_cursor {
@@ -153,11 +153,11 @@
 
   if( nEntry ){
     int *aNew;                    /* New aiException[] array */
     int nNew;                     /* Number of valid entries in array aNew[] */
 
-    aNew = sqlite3_realloc(p->aiException, (p->nException+nEntry)*sizeof(int));
+    aNew = sqlite3_realloc64(p->aiException,(p->nException+nEntry)*sizeof(int));
     if( aNew==0 ) return SQLITE_NOMEM;
     nNew = p->nException;
 
     z = (const unsigned char *)zIn;
     while( z<zTerm ){
@@ -225,21 +225,24 @@
   int rc = SQLITE_OK;
 
   pNew = (unicode_tokenizer *) sqlite3_malloc(sizeof(unicode_tokenizer));
   if( pNew==NULL ) return SQLITE_NOMEM;
   memset(pNew, 0, sizeof(unicode_tokenizer));
-  pNew->bRemoveDiacritic = 1;
+  pNew->eRemoveDiacritic = 1;
 
   for(i=0; rc==SQLITE_OK && i<nArg; i++){
     const char *z = azArg[i];
     int n = (int)strlen(z);
 
     if( n==19 && memcmp("remove_diacritics=1", z, 19)==0 ){
-      pNew->bRemoveDiacritic = 1;
+      pNew->eRemoveDiacritic = 1;
     }
     else if( n==19 && memcmp("remove_diacritics=0", z, 19)==0 ){
-      pNew->bRemoveDiacritic = 0;
+      pNew->eRemoveDiacritic = 0;
+    }
+    else if( n==19 && memcmp("remove_diacritics=2", z, 19)==0 ){
+      pNew->eRemoveDiacritic = 2;
     }
     else if( n>=11 && memcmp("tokenchars=", z, 11)==0 ){
       rc = unicodeAddExceptions(pNew, 1, &z[11], n-11);
     }
     else if( n>=11 && memcmp("separators=", z, 11)==0 ){
@@ -339,20 +342,20 @@
   do {
     int iOut;
 
     /* Grow the output buffer if required. */
     if( (zOut-pCsr->zToken)>=(pCsr->nAlloc-4) ){
-      char *zNew = sqlite3_realloc(pCsr->zToken, pCsr->nAlloc+64);
+      char *zNew = sqlite3_realloc64(pCsr->zToken, pCsr->nAlloc+64);
       if( !zNew ) return SQLITE_NOMEM;
       zOut = &zNew[zOut - pCsr->zToken];
       pCsr->zToken = zNew;
       pCsr->nAlloc += 64;
     }
 
     /* Write the folded case of the last character read to the output */
     zEnd = z;
-    iOut = sqlite3FtsUnicodeFold((int)iCode, p->bRemoveDiacritic);
+    iOut = sqlite3FtsUnicodeFold((int)iCode, p->eRemoveDiacritic);
     if( iOut ){
       WRITE_UTF8(zOut, iOut);
     }
 
     /* If the cursor is not at EOF, read the next character */

Index: ext/fts3/fts3_unicode2.c
==================================================================
--- ext/fts3/fts3_unicode2.c
+++ ext/fts3/fts3_unicode2.c
@@ -1,7 +1,7 @@
 /*
-** 2012 May 25
+** 2012-05-25
 **
 ** The author disclaims copyright to this source code.  In place of
 ** a legal notice, here is a blessing:
 **
 **    May you do good and not evil.
@@ -157,36 +157,52 @@
 ** of the ASCII letter only. For example, if passed 235 - "LATIN
 ** SMALL LETTER E WITH DIAERESIS" - return 65 ("LATIN SMALL LETTER
 ** E"). The resuls of passing a codepoint that corresponds to an
 ** uppercase letter are undefined.
 */
-static int remove_diacritic(int c){
+static int remove_diacritic(int c, int bComplex){
   unsigned short aDia[] = {
         0,  1797,  1848,  1859,  1891,  1928,  1940,  1995, 
      2024,  2040,  2060,  2110,  2168,  2206,  2264,  2286, 
      2344,  2383,  2472,  2488,  2516,  2596,  2668,  2732, 
      2782,  2842,  2894,  2954,  2984,  3000,  3028,  3336, 
-     3456,  3696,  3712,  3728,  3744,  3896,  3912,  3928, 
-     3968,  4008,  4040,  4106,  4138,  4170,  4202,  4234, 
-     4266,  4296,  4312,  4344,  4408,  4424,  4472,  4504, 
-     6148,  6198,  6264,  6280,  6360,  6429,  6505,  6529, 
-    61448, 61468, 61534, 61592, 61642, 61688, 61704, 61726, 
-    61784, 61800, 61836, 61880, 61914, 61948, 61998, 62122, 
-    62154, 62200, 62218, 62302, 62364, 62442, 62478, 62536, 
-    62554, 62584, 62604, 62640, 62648, 62656, 62664, 62730, 
-    62924, 63050, 63082, 63274, 63390, 
+     3456,  3696,  3712,  3728,  3744,  3766,  3832,  3896, 
+     3912,  3928,  3944,  3968,  4008,  4040,  4056,  4106, 
+     4138,  4170,  4202,  4234,  4266,  4296,  4312,  4344, 
+     4408,  4424,  4442,  4472,  4488,  4504,  6148,  6198, 
+     6264,  6280,  6360,  6429,  6505,  6529, 61448, 61468, 
+    61512, 61534, 61592, 61610, 61642, 61672, 61688, 61704, 
+    61726, 61784, 61800, 61816, 61836, 61880, 61896, 61914, 
+    61948, 61998, 62062, 62122, 62154, 62184, 62200, 62218, 
+    62252, 62302, 62364, 62410, 62442, 62478, 62536, 62554, 
+    62584, 62604, 62640, 62648, 62656, 62664, 62730, 62766, 
+    62830, 62890, 62924, 62974, 63032, 63050, 63082, 63118, 
+    63182, 63242, 63274, 63310, 63368, 63390, 
   };
-  char aChar[] = {
-    '\0', 'a',  'c',  'e',  'i',  'n',  'o',  'u',  'y',  'y',  'a',  'c',  
-    'd',  'e',  'e',  'g',  'h',  'i',  'j',  'k',  'l',  'n',  'o',  'r',  
-    's',  't',  'u',  'u',  'w',  'y',  'z',  'o',  'u',  'a',  'i',  'o',  
-    'u',  'g',  'k',  'o',  'j',  'g',  'n',  'a',  'e',  'i',  'o',  'r',  
-    'u',  's',  't',  'h',  'a',  'e',  'o',  'y',  '\0', '\0', '\0', '\0', 
-    '\0', '\0', '\0', '\0', 'a',  'b',  'd',  'd',  'e',  'f',  'g',  'h',  
-    'h',  'i',  'k',  'l',  'l',  'm',  'n',  'p',  'r',  'r',  's',  't',  
-    'u',  'v',  'w',  'w',  'x',  'y',  'z',  'h',  't',  'w',  'y',  'a',  
-    'e',  'i',  'o',  'u',  'y',  
+#define HIBIT ((unsigned char)0x80)
+  unsigned char aChar[] = {
+    '\0',      'a',       'c',       'e',       'i',       'n',       
+    'o',       'u',       'y',       'y',       'a',       'c',       
+    'd',       'e',       'e',       'g',       'h',       'i',       
+    'j',       'k',       'l',       'n',       'o',       'r',       
+    's',       't',       'u',       'u',       'w',       'y',       
+    'z',       'o',       'u',       'a',       'i',       'o',       
+    'u',       'u'|HIBIT, 'a'|HIBIT, 'g',       'k',       'o',       
+    'o'|HIBIT, 'j',       'g',       'n',       'a'|HIBIT, 'a',       
+    'e',       'i',       'o',       'r',       'u',       's',       
+    't',       'h',       'a',       'e',       'o'|HIBIT, 'o',       
+    'o'|HIBIT, 'y',       '\0',      '\0',      '\0',      '\0',      
+    '\0',      '\0',      '\0',      '\0',      'a',       'b',       
+    'c'|HIBIT, 'd',       'd',       'e'|HIBIT, 'e',       'e'|HIBIT, 
+    'f',       'g',       'h',       'h',       'i',       'i'|HIBIT, 
+    'k',       'l',       'l'|HIBIT, 'l',       'm',       'n',       
+    'o'|HIBIT, 'p',       'r',       'r'|HIBIT, 'r',       's',       
+    's'|HIBIT, 't',       'u',       'u'|HIBIT, 'v',       'w',       
+    'w',       'x',       'y',       'z',       'h',       't',       
+    'w',       'y',       'a',       'a'|HIBIT, 'a'|HIBIT, 'a'|HIBIT, 
+    'e',       'e'|HIBIT, 'e'|HIBIT, 'i',       'o',       'o'|HIBIT, 
+    'o'|HIBIT, 'o'|HIBIT, 'u',       'u'|HIBIT, 'u'|HIBIT, 'y',       
   };
 
   unsigned int key = (((unsigned int)c)<<3) | 0x00000007;
   int iRes = 0;
   int iHi = sizeof(aDia)/sizeof(aDia[0]) - 1;
@@ -199,11 +215,12 @@
     }else{
       iHi = iTest-1;
     }
   }
   assert( key>=aDia[iRes] );
-  return ((c > (aDia[iRes]>>3) + (aDia[iRes]&0x07)) ? c : (int)aChar[iRes]);
+  if( bComplex==0 && (aChar[iRes] & 0x80) ) return c;
+  return (c > (aDia[iRes]>>3) + (aDia[iRes]&0x07)) ? c : ((int)aChar[iRes] & 0x7F);
 }
 
 
 /*
 ** Return true if the argument interpreted as a unicode codepoint
@@ -212,12 +229,12 @@
 int sqlite3FtsUnicodeIsdiacritic(int c){
   unsigned int mask0 = 0x08029FDF;
   unsigned int mask1 = 0x000361F8;
   if( c<768 || c>817 ) return 0;
   return (c < 768+32) ?
-      (mask0 & (1 << (c-768))) :
-      (mask1 & (1 << (c-768-32)));
+      (mask0 & ((unsigned int)1 << (c-768))) :
+      (mask1 & ((unsigned int)1 << (c-768-32)));
 }
 
 
 /*
 ** Interpret the argument as a unicode codepoint. If the codepoint
@@ -226,11 +243,11 @@
 ** Otherwise, return a copy of the argument.
 **
 ** The results are undefined if the value passed to this function
 ** is less than zero.
 */
-int sqlite3FtsUnicodeFold(int c, int bRemoveDiacritic){
+int sqlite3FtsUnicodeFold(int c, int eRemoveDiacritic){
   /* Each entry in the following array defines a rule for folding a range
   ** of codepoints to lower case. The rule applies to a range of nRange
   ** codepoints starting at codepoint iCode.
   **
   ** If the least significant bit in flags is clear, then the rule applies
@@ -349,11 +366,13 @@
     if( c<(p->iCode + p->nRange) && 0==(0x01 & p->flags & (p->iCode ^ c)) ){
       ret = (c + (aiOff[p->flags>>1])) & 0x0000FFFF;
       assert( ret>0 );
     }
 
-    if( bRemoveDiacritic ) ret = remove_diacritic(ret);
+    if( eRemoveDiacritic ){
+      ret = remove_diacritic(ret, eRemoveDiacritic==2);
+    }
   }
   
   else if( c>=66560 && c<66600 ){
     ret = c + 40;
   }

Index: ext/fts3/fts3_write.c
==================================================================
--- ext/fts3/fts3_write.c
+++ ext/fts3/fts3_write.c
@@ -394,23 +394,24 @@
   assert( SizeofArray(azSql)==SizeofArray(p->aStmt) );
   assert( eStmt<SizeofArray(azSql) && eStmt>=0 );
   
   pStmt = p->aStmt[eStmt];
   if( !pStmt ){
+    int f = SQLITE_PREPARE_PERSISTENT|SQLITE_PREPARE_NO_VTAB;
     char *zSql;
     if( eStmt==SQL_CONTENT_INSERT ){
       zSql = sqlite3_mprintf(azSql[eStmt], p->zDb, p->zName, p->zWriteExprlist);
     }else if( eStmt==SQL_SELECT_CONTENT_BY_ROWID ){
+      f &= ~SQLITE_PREPARE_NO_VTAB;
       zSql = sqlite3_mprintf(azSql[eStmt], p->zReadExprlist);
     }else{
       zSql = sqlite3_mprintf(azSql[eStmt], p->zDb, p->zName);
     }
     if( !zSql ){
       rc = SQLITE_NOMEM;
     }else{
-      rc = sqlite3_prepare_v3(p->db, zSql, -1, SQLITE_PREPARE_PERSISTENT,
-                              &pStmt, NULL);
+      rc = sqlite3_prepare_v3(p->db, zSql, -1, f, &pStmt, NULL);
       sqlite3_free(zSql);
       assert( rc==SQLITE_OK || pStmt==0 );
       p->aStmt[eStmt] = pStmt;
     }
   }
@@ -564,11 +565,11 @@
   int iLangid,                    /* Language id */
   int iIndex,                     /* Index in p->aIndex[] */
   int iLevel                      /* Level of segments */
 ){
   sqlite3_int64 iBase;            /* First absolute level for iLangid/iIndex */
-  assert( iLangid>=0 );
+  assert_fts3_nc( iLangid>=0 );
   assert( p->nIndex>0 );
   assert( iIndex>=0 && iIndex<p->nIndex );
 
   iBase = ((sqlite3_int64)iLangid * p->nIndex + iIndex) * FTS3_SEGDIR_MAXLEVEL;
   return iBase + iLevel;
@@ -1406,11 +1407,11 @@
 
   /* Check that the doclist does not appear to extend past the end of the
   ** b-tree node. And that the final byte of the doclist is 0x00. If either 
   ** of these statements is untrue, then the data structure is corrupt.
   */
-  if( (&pReader->aNode[pReader->nNode] - pReader->aDoclist)<pReader->nDoclist
+  if( pReader->nDoclist > pReader->nNode-(pReader->aDoclist-pReader->aNode)
    || (pReader->nPopulate==0 && pReader->aDoclist[pReader->nDoclist-1])
   ){
     return FTS_CORRUPT_VTAB;
   }
   return SQLITE_OK;
@@ -1606,12 +1607,17 @@
   Fts3SegReader **ppReader        /* OUT: Allocated Fts3SegReader */
 ){
   Fts3SegReader *pReader;         /* Newly allocated SegReader object */
   int nExtra = 0;                 /* Bytes to allocate segment root node */
 
-  assert( iStartLeaf<=iEndLeaf );
+  assert( zRoot!=0 || nRoot==0 );
+#ifdef CORRUPT_DB
+  assert( zRoot!=0 || CORRUPT_DB );
+#endif
+
   if( iStartLeaf==0 ){
+    if( iEndLeaf!=0 ) return FTS_CORRUPT_VTAB;
     nExtra = nRoot + FTS3_NODE_PADDING;
   }
 
   pReader = (Fts3SegReader *)sqlite3_malloc(sizeof(Fts3SegReader) + nExtra);
   if( !pReader ){
@@ -1627,11 +1633,11 @@
   if( nExtra ){
     /* The entire segment is stored in the root node. */
     pReader->aNode = (char *)&pReader[1];
     pReader->rootOnly = 1;
     pReader->nNode = nRoot;
-    memcpy(pReader->aNode, zRoot, nRoot);
+    if( nRoot ) memcpy(pReader->aNode, zRoot, nRoot);
     memset(&pReader->aNode[nRoot], 0, FTS3_NODE_PADDING);
   }else{
     pReader->iCurrentBlock = iStartLeaf-1;
   }
   *ppReader = pReader;
@@ -2246,10 +2252,15 @@
   }
   nData = pWriter->nData;
 
   nPrefix = fts3PrefixCompress(pWriter->zTerm, pWriter->nTerm, zTerm, nTerm);
   nSuffix = nTerm-nPrefix;
+
+  /* If nSuffix is zero or less, then zTerm/nTerm must be a prefix of 
+  ** pWriter->zTerm/pWriter->nTerm. i.e. must be equal to or less than when
+  ** compared with BINARY collation. This indicates corruption.  */
+  if( nSuffix<=0 ) return FTS_CORRUPT_VTAB;
 
   /* Figure out how many bytes are required by this new entry */
   nReq = sqlite3Fts3VarintLen(nPrefix) +    /* varint containing prefix size */
     sqlite3Fts3VarintLen(nSuffix) +         /* varint containing suffix size */
     nSuffix +                               /* Term suffix */
@@ -2954,11 +2965,13 @@
           if( p->bDescIdx && nDoclist>0 ){
             iDelta = iPrev - iDocid;
           }else{
             iDelta = iDocid - iPrev;
           }
-          assert( iDelta>0 || (nDoclist==0 && iDelta==iDocid) );
+          if( iDelta<=0 && (nDoclist>0 || iDelta!=iDocid) ){
+            return FTS_CORRUPT_VTAB;
+          }
           assert( nDoclist>0 || iDelta==iDocid );
 
           nByte = sqlite3Fts3VarintLen(iDelta) + (isRequirePos?nList+1:0);
           if( nDoclist+nByte>pCsr->nBuffer ){
             char *aNew;
@@ -3320,18 +3333,20 @@
   int N,             /* The number of integers to decode */
   u32 *a,            /* Write the integer values */
   const char *zBuf,  /* The BLOB containing the varints */
   int nBuf           /* size of the BLOB */
 ){
-  int i, j;
-  UNUSED_PARAMETER(nBuf);
-  for(i=j=0; i<N; i++){
-    sqlite3_int64 x;
-    j += sqlite3Fts3GetVarint(&zBuf[j], &x);
-    assert(j<=nBuf);
-    a[i] = (u32)(x & 0xffffffff);
-  }
+  int i = 0;
+  if( nBuf && (zBuf[nBuf-1]&0x80)==0 ){
+    int j;
+    for(i=j=0; i<N && j<nBuf; i++){
+      sqlite3_int64 x;
+      j += sqlite3Fts3GetVarint(&zBuf[j], &x);
+      a[i] = (u32)(x & 0xffffffff);
+    }
+  }
+  while( i<N ) a[i++] = 0;
 }
 
 /*
 ** Insert the sizes (in tokens) for each column of the document
 ** with docid equal to p->iPrevDocid.  The sizes are encoded as
@@ -3733,21 +3748,21 @@
       p->iOff += fts3GetVarint32(&p->aNode[p->iOff], &nPrefix);
     }
     p->iOff += fts3GetVarint32(&p->aNode[p->iOff], &nSuffix);
 
     if( nPrefix>p->iOff || nSuffix>p->nNode-p->iOff ){
-      return SQLITE_CORRUPT_VTAB;
+      return FTS_CORRUPT_VTAB;
     }
     blobGrowBuffer(&p->term, nPrefix+nSuffix, &rc);
     if( rc==SQLITE_OK ){
       memcpy(&p->term.a[nPrefix], &p->aNode[p->iOff], nSuffix);
       p->term.n = nPrefix+nSuffix;
       p->iOff += nSuffix;
       if( p->iChild==0 ){
         p->iOff += fts3GetVarint32(&p->aNode[p->iOff], &p->nDoclist);
         if( (p->nNode-p->iOff)<p->nDoclist ){
-          return SQLITE_CORRUPT_VTAB;
+          return FTS_CORRUPT_VTAB;
         }
         p->aDoclist = &p->aNode[p->iOff];
         p->iOff += p->nDoclist;
       }
     }

Index: ext/fts3/unicode/mkunicode.tcl
==================================================================
--- ext/fts3/unicode/mkunicode.tcl
+++ ext/fts3/unicode/mkunicode.tcl
@@ -7,15 +7,16 @@
   set lRange [list]
 
   set nRange 1
   set iFirst  [lindex $map 0 0]
   set cPrev   [lindex $map 0 1]
+  set fPrev   [lindex $map 0 2]
 
   foreach m [lrange $map 1 end] {
-    foreach {i c} $m {}
+    foreach {i c f} $m {}
 
-    if {$cPrev == $c} {
+    if {$cPrev == $c && $fPrev==$f} {
       for {set j [expr $iFirst+$nRange]} {$j<$i} {incr j} {
         if {[info exists tl_lookup_table($j)]==0} break
       }
 
       if {$j==$i} {
@@ -27,27 +28,30 @@
       }
     }
 
     lappend lRange [list $iFirst $nRange]
     lappend aChar  $cPrev
+    lappend aFlag  $fPrev
 
     set iFirst $i
     set cPrev  $c
+    set fPrev  $f
     set nRange 1
   }
   lappend lRange [list $iFirst $nRange]
   lappend aChar $cPrev
+  lappend aFlag $fPrev
 
   puts "/*"
   puts "** If the argument is a codepoint corresponding to a lowercase letter"
   puts "** in the ASCII range with a diacritic added, return the codepoint"
   puts "** of the ASCII letter only. For example, if passed 235 - \"LATIN"
   puts "** SMALL LETTER E WITH DIAERESIS\" - return 65 (\"LATIN SMALL LETTER"
   puts "** E\"). The resuls of passing a codepoint that corresponds to an"
   puts "** uppercase letter are undefined."
   puts "*/"
-  puts "static int ${::remove_diacritic}(int c)\{"
+  puts "static int ${::remove_diacritic}(int c, int bComplex)\{"
   puts "  unsigned short aDia\[\] = \{"
   puts -nonewline "        0, "
   set i 1
   foreach r $lRange {
     foreach {iCode nRange} $r {}
@@ -57,18 +61,23 @@
     puts -nonewline [format "%5d" [expr ($iCode<<3) + $nRange-1]]
     puts -nonewline ", "
   }
   puts ""
   puts "  \};"
-  puts "  char aChar\[\] = \{"
-  puts -nonewline "    '\\0', "
+  puts "#define HIBIT ((unsigned char)0x80)"
+  puts "  unsigned char aChar\[\] = \{"
+  puts -nonewline "    '\\0',      "
   set i 1
-  foreach c $aChar {
-    set str "'$c',  "
-    if {$c == ""} { set str "'\\0', " }
+  foreach c $aChar f $aFlag {
+    if { $f } {
+      set str "'$c'|HIBIT, "
+    } else {
+      set str "'$c',       "
+    }
+    if {$c == ""} { set str "'\\0',      " }
 
-    if {($i % 12)==0} {puts "" ; puts -nonewline "    " }
+    if {($i % 6)==0} {puts "" ; puts -nonewline "    " }
     incr i
     puts -nonewline "$str"
   }
   puts ""
   puts "  \};"
@@ -85,19 +94,21 @@
     }else{
       iHi = iTest-1;
     }
   }
   assert( key>=aDia[iRes] );
-  return ((c > (aDia[iRes]>>3) + (aDia[iRes]&0x07)) ? c : (int)aChar[iRes]);}
+  if( bComplex==0 && (aChar[iRes] & 0x80) ) return c;
+  return (c > (aDia[iRes]>>3) + (aDia[iRes]&0x07)) ? c : ((int)aChar[iRes] & 0x7F);}
   puts "\}"
 }
 
 proc print_isdiacritic {zFunc map} {
 
   set lCode [list]
   foreach m $map {
-    foreach {code char} $m {}
+    foreach {code char flag} $m {}
+    if {$flag} continue
     if {$code && $char == ""} { lappend lCode $code }
   }
   set lCode [lsort -integer $lCode]
   set iFirst [lindex $lCode 0]
   set iLast [lindex $lCode end]
@@ -122,12 +133,12 @@
   puts "  unsigned int mask0 = [format "0x%08X" $i1];"
   puts "  unsigned int mask1 = [format "0x%08X" $i2];"
 
   puts "  if( c<$iFirst || c>$iLast ) return 0;"
   puts "  return (c < $iFirst+32) ?"
-  puts "      (mask0 & (1 << (c-$iFirst))) :"
-  puts "      (mask1 & (1 << (c-$iFirst-32)));"
+  puts "      (mask0 & ((unsigned int)1 << (c-$iFirst))) :"
+  puts "      (mask1 & ((unsigned int)1 << (c-$iFirst-32)));"
   puts "\}"
 }
 
 
 #-------------------------------------------------------------------------
@@ -470,11 +481,11 @@
   puts "** Otherwise, return a copy of the argument."
   puts "**"
   puts "** The results are undefined if the value passed to this function"
   puts "** is less than zero."
   puts "*/"
-  puts "int ${zFunc}\(int c, int bRemoveDiacritic)\{"
+  puts "int ${zFunc}\(int c, int eRemoveDiacritic)\{"
 
   set liOff [tl_generate_ioff_table $lRecord]
   tl_print_table_header
   foreach entry $lRecord { 
     if {[tl_print_table_entry toggle $entry $liOff]} { 
@@ -514,11 +525,13 @@
     if( c<(p->iCode + p->nRange) && 0==(0x01 & p->flags & (p->iCode ^ c)) ){
       ret = (c + (aiOff[p->flags>>1])) & 0x0000FFFF;
       assert( ret>0 );
     }
 
-    if( bRemoveDiacritic ) ret = ${::remove_diacritic}(ret);
+    if( eRemoveDiacritic ){
+      ret = ${::remove_diacritic}(ret, eRemoveDiacritic==2);
+    }
   }
   }]
 
   foreach entry $lHigh {
     tl_print_if_entry $entry
@@ -603,14 +616,10 @@
   set caseS [categories_switch C S {c k m o}]
   set caseZ [categories_switch C Z {l p s}]
 
   set nCat [expr [llength [array names C]] + 1]
   puts [code {
-    int sqlite3Fts5UnicodeNCat(void) { 
-      return $nCat;
-    }
-
     int sqlite3Fts5UnicodeCatParse(const char *zCat, u8 *aArray){ 
       aArray[0] = 1;
       switch( zCat[0] ){
         $caseC
         $caseL
@@ -689,11 +698,11 @@
   puts [code {
     static u16 aFts5UnicodeBlock[] = {$aBlockArray};
     static u16 aFts5UnicodeMap[] = {$aMapArray};
     static u16 aFts5UnicodeData[] = {$aDataArray};
 
-    int sqlite3Fts5UnicodeCategory(int iCode) { 
+    int sqlite3Fts5UnicodeCategory(u32 iCode) { 
       int iRes = -1;
       int iHi;
       int iLo;
       int ret;
       u16 iKey;
@@ -772,11 +781,11 @@
           iCP++;
         }else{
           aArray[0] = 1;
         }
 
-        c = sqlite3Fts5UnicodeCategory(i);
+        c = sqlite3Fts5UnicodeCategory((u32)i);
         if( aArray[c]==0 ){
           *piCode = i;
           return 1;
         }
       }
@@ -827,11 +836,11 @@
 
 
 proc print_fileheader {} {
   puts [string trim {
 /*
-** 2012 May 25
+** 2012-05-25
 **
 ** The author disclaims copyright to this source code.  In place of
 ** a legal notice, here is a blessing:
 **
 **    May you do good and not evil.

Index: ext/fts3/unicode/parseunicode.tcl
==================================================================
--- ext/fts3/unicode/parseunicode.tcl
+++ ext/fts3/unicode/parseunicode.tcl
@@ -5,15 +5,27 @@
 # diacritical marks from a unicode string. Each mapping is itself a list
 # consisting of two elements - the unicode codepoint and the single ASCII
 # character that it should be replaced with, or an empty string if the 
 # codepoint should simply be removed from the input. Examples:
 #
-#   { 224 a  }     (replace codepoint 224 to "a")
-#   { 769 "" }     (remove codepoint 769 from input)
+#   { 224 a  0 }     (replace codepoint 224 to "a")
+#   { 769 "" 0 }     (remove codepoint 769 from input)
 #
 # Mappings are only returned for non-upper case codepoints. It is assumed
 # that the input has already been folded to lower case.
+#
+# The third value in the list is always either 0 or 1. 0 if the 
+# UnicodeData.txt file maps the codepoint to a single ASCII character and
+# a diacritic, or 1 if the mapping is indirect. For example, consider the 
+# two entries:
+#
+# 1ECD;LATIN SMALL LETTER O WITH DOT BELOW;Ll;0;L;006F 0323;;;;N;;;1ECC;;1ECC
+# 1ED9;LATIN SMALL LETTER O WITH CIRCUMFLEX AND DOT BELOW;Ll;0;L;1ECD 0302;;;;N;;;1ED8;;1ED8
+#
+# The first codepoint is a direct mapping (as 006F is ASCII and 0323 is a 
+# diacritic). The second is an indirect mapping, as it maps to the
+# first codepoint plus 0302 (a diacritic).
 #
 proc rd_load_unicodedata_text {zName} {
   global tl_lookup_table
 
   set fd [open $zName]
@@ -51,22 +63,33 @@
 
     set iCode  [expr "0x$code"]
     set iAscii [expr "0x[lindex $character_decomposition_mapping 0]"]
     set iDia   [expr "0x[lindex $character_decomposition_mapping 1]"]
 
+    # Filter out upper-case characters, as they will be mapped to their
+    # lower-case equivalents before this data is used.
     if {[info exists tl_lookup_table($iCode)]} continue
+
+    # Check if this is an indirect mapping. If so, set bIndirect to true
+    # and change $iAscii to the indirectly mappped ASCII character.
+    set bIndirect 0
+    if {[info exists dia($iDia)] && [info exists mapping($iAscii)]} {
+      set iAscii $mapping($iAscii)
+      set bIndirect 1
+    }
 
     if { ($iAscii >= 97 && $iAscii <= 122)
       || ($iAscii >= 65 && $iAscii <= 90)
     } {
-      lappend lRet [list $iCode [string tolower [format %c $iAscii]]]
+      lappend lRet [list $iCode [string tolower [format %c $iAscii]] $bIndirect]
+      set mapping($iCode) $iAscii
       set dia($iDia) 1
     }
   }
 
   foreach d [array names dia] {
-    lappend lRet [list $d ""]
+    lappend lRet [list $d "" 0]
   }
   set lRet [lsort -integer -index 0 $lRet]
 
   close $fd
   set lRet

Index: ext/fts5/fts5.h
==================================================================
--- ext/fts5/fts5.h
+++ ext/fts5/fts5.h
@@ -118,16 +118,12 @@
 **   should be greater than or equal to zero and smaller than the value
 **   output by xInstCount().
 **
 **   Usually, output parameter *piPhrase is set to the phrase number, *piCol
 **   to the column in which it occurs and *piOff the token offset of the
-**   first token of the phrase. The exception is if the table was created
-**   with the offsets=0 option specified. In this case *piOff is always
-**   set to -1.
-**
-**   Returns SQLITE_OK if successful, or an error code (i.e. SQLITE_NOMEM) 
-**   if an error occurs.
+**   first token of the phrase. Returns SQLITE_OK if successful, or an error
+**   code (i.e. SQLITE_NOMEM) if an error occurs.
 **
 **   This API can be quite slow if used with an FTS5 table created with the
 **   "detail=none" or "detail=column" option. 
 **
 ** xRowid:
@@ -412,15 +408,15 @@
 **            1st place" entries are added to the index for tokens "i", "won",
 **            "first" and "place". If the user then queries for '1st + place',
 **            the tokenizer substitutes "first" for "1st" and the query works
 **            as expected.
 **
-**       <li> By adding multiple synonyms for a single term to the FTS index.
-**            In this case, when tokenizing query text, the tokenizer may 
-**            provide multiple synonyms for a single term within the document.
-**            FTS5 then queries the index for each synonym individually. For
-**            example, faced with the query:
+**       <li> By querying the index for all synonyms of each query term
+**            separately. In this case, when tokenizing query text, the
+**            tokenizer may provide multiple synonyms for a single term 
+**            within the document. FTS5 then queries the index for each 
+**            synonym individually. For example, faced with the query:
 **
 **   <codeblock>
 **     ... MATCH 'first place'</codeblock>
 **
 **            the tokenizer offers both "1st" and "first" as synonyms for the
@@ -440,11 +436,11 @@
 **            document such as "I won first place" is tokenized, entries are
 **            added to the FTS index for "i", "won", "first", "1st" and
 **            "place".
 **
 **            This way, even if the tokenizer does not provide synonyms
-**            when tokenizing query text (it should not - to do would be
+**            when tokenizing query text (it should not - to do so would be
 **            inefficient), it doesn't matter if the user queries for 
 **            'first + place' or '1st + place', as there are entries in the
 **            FTS index corresponding to both forms of the first token.
 **   </ol>
 **

Index: ext/fts5/fts5Int.h
==================================================================
--- ext/fts5/fts5Int.h
+++ ext/fts5/fts5Int.h
@@ -85,10 +85,16 @@
 # define assert_nc(x) assert(sqlite3_fts5_may_be_corrupt || (x))
 #else
 # define assert_nc(x) assert(x)
 #endif
 
+/*
+** A version of memcmp() that does not cause asan errors if one of the pointer
+** parameters is NULL and the number of bytes to compare is zero.
+*/
+#define fts5Memcmp(s1, s2, n) ((n)==0 ? 0 : memcmp((s1), (s2), (n)))
+
 /* Mark a function parameter as unused, to suppress nuisance compiler
 ** warnings. */
 #ifndef UNUSED_PARAM
 # define UNUSED_PARAM(X)  (void)(X)
 #endif
@@ -272,11 +278,11 @@
 /* Write and decode big-endian 32-bit integer values */
 void sqlite3Fts5Put32(u8*, int);
 int sqlite3Fts5Get32(const u8*);
 
 #define FTS5_POS2COLUMN(iPos) (int)(iPos >> 32)
-#define FTS5_POS2OFFSET(iPos) (int)(iPos & 0xFFFFFFFF)
+#define FTS5_POS2OFFSET(iPos) (int)(iPos & 0x7FFFFFFF)
 
 typedef struct Fts5PoslistReader Fts5PoslistReader;
 struct Fts5PoslistReader {
   /* Variables used only by sqlite3Fts5PoslistIterXXX() functions. */
   const u8 *a;                    /* Position list to iterate through */
@@ -307,11 +313,11 @@
   int *pi,                        /* IN/OUT: Offset within a[] */
   i64 *piOff                      /* IN/OUT: Current offset */
 );
 
 /* Malloc utility */
-void *sqlite3Fts5MallocZero(int *pRc, int nByte);
+void *sqlite3Fts5MallocZero(int *pRc, sqlite3_int64 nByte);
 char *sqlite3Fts5Strndup(int *pRc, const char *pIn, int nIn);
 
 /* Character set tests (like isspace(), isalpha() etc.) */
 int sqlite3Fts5IsBareword(char t);
 
@@ -518,12 +524,22 @@
 ** End of interface to code in fts5_varint.c.
 **************************************************************************/
 
 
 /**************************************************************************
-** Interface to code in fts5.c. 
+** Interface to code in fts5_main.c. 
+*/
+
+/*
+** Virtual-table object.
 */
+typedef struct Fts5Table Fts5Table;
+struct Fts5Table {
+  sqlite3_vtab base;              /* Base class used by SQLite core */
+  Fts5Config *pConfig;            /* Virtual table configuration */
+  Fts5Index *pIndex;              /* Full-text index */
+};
 
 int sqlite3Fts5GetTokenizer(
   Fts5Global*, 
   const char **azArg,
   int nArg,
@@ -530,11 +546,13 @@
   Fts5Tokenizer**,
   fts5_tokenizer**,
   char **pzErr
 );
 
-Fts5Index *sqlite3Fts5IndexFromCsrid(Fts5Global*, i64, Fts5Config **);
+Fts5Table *sqlite3Fts5TableFromCsrid(Fts5Global*, i64);
+
+int sqlite3Fts5FlushToDisk(Fts5Table*);
 
 /*
 ** End of interface to code in fts5.c.
 **************************************************************************/
 
@@ -786,12 +804,12 @@
 */
 int sqlite3Fts5UnicodeIsdiacritic(int c);
 int sqlite3Fts5UnicodeFold(int c, int bRemoveDiacritic);
 
 int sqlite3Fts5UnicodeCatParse(const char*, u8*);
-int sqlite3Fts5UnicodeCategory(int iCode);
+int sqlite3Fts5UnicodeCategory(u32 iCode);
 void sqlite3Fts5UnicodeAscii(u8*, u8*);
 /*
 ** End of interface to code in fts5_unicode2.c.
 **************************************************************************/
 
 #endif

Index: ext/fts5/fts5_aux.c
==================================================================
--- ext/fts5/fts5_aux.c
+++ ext/fts5/fts5_aux.c
@@ -134,11 +134,11 @@
 static void fts5HighlightAppend(
   int *pRc, 
   HighlightContext *p, 
   const char *z, int n
 ){
-  if( *pRc==SQLITE_OK ){
+  if( *pRc==SQLITE_OK && z ){
     if( n<0 ) n = (int)strlen(z);
     p->zOut = sqlite3_mprintf("%z%.*s", p->zOut, n, z);
     if( p->zOut==0 ) *pRc = SQLITE_NOMEM;
   }
 }
@@ -266,11 +266,11 @@
 static int fts5SentenceFinderAdd(Fts5SFinder *p, int iAdd){
   if( p->nFirstAlloc==p->nFirst ){
     int nNew = p->nFirstAlloc ? p->nFirstAlloc*2 : 64;
     int *aNew;
 
-    aNew = (int*)sqlite3_realloc(p->aFirst, nNew*sizeof(int));
+    aNew = (int*)sqlite3_realloc64(p->aFirst, nNew*sizeof(int));
     if( aNew==0 ) return SQLITE_NOMEM;
     p->aFirst = aNew;
     p->nFirstAlloc = nNew;
   }
   p->aFirst[p->nFirst++] = iAdd;
@@ -333,25 +333,26 @@
   int iOff = 0;
   int iFirst = -1;
   int nInst;
   int nScore = 0;
   int iLast = 0;
+  sqlite3_int64 iEnd = (sqlite3_int64)iPos + nToken;
 
   rc = pApi->xInstCount(pFts, &nInst);
   for(i=0; i<nInst && rc==SQLITE_OK; i++){
     rc = pApi->xInst(pFts, i, &ip, &ic, &iOff);
-    if( rc==SQLITE_OK && ic==iCol && iOff>=iPos && iOff<(iPos+nToken) ){
+    if( rc==SQLITE_OK && ic==iCol && iOff>=iPos && iOff<iEnd ){
       nScore += (aSeen[ip] ? 1 : 1000);
       aSeen[ip] = 1;
       if( iFirst<0 ) iFirst = iOff;
       iLast = iOff + pApi->xPhraseSize(pFts, ip);
     }
   }
 
   *pnScore = nScore;
   if( piPos ){
-    int iAdj = iFirst - (nToken - (iLast-iFirst)) / 2;
+    sqlite3_int64 iAdj = iFirst - (nToken - (iLast-iFirst)) / 2;
     if( (iAdj+nToken)>nDocsize ) iAdj = nDocsize - nToken;
     if( iAdj<0 ) iAdj = 0;
     *piPos = iAdj;
   }
 
@@ -440,11 +441,13 @@
         int iAdj;
         int nScore;
         int jj;
 
         rc = pApi->xInst(pFts, ii, &ip, &ic, &io);
-        if( ic!=i || rc!=SQLITE_OK ) continue;
+        if( ic!=i ) continue;
+        if( io>nDocsize ) rc = FTS5_CORRUPT;
+        if( rc!=SQLITE_OK ) continue;
         memset(aSeen, 0, nPhrase);
         rc = fts5SnippetScore(pApi, pFts, nDocsize, aSeen, i,
             io, nToken, &nScore, &iAdj
         );
         if( rc==SQLITE_OK && nScore>nBestScore ){
@@ -566,17 +569,17 @@
   p = pApi->xGetAuxdata(pFts, 0);
   if( p==0 ){
     int nPhrase;                  /* Number of phrases in query */
     sqlite3_int64 nRow = 0;       /* Number of rows in table */
     sqlite3_int64 nToken = 0;     /* Number of tokens in table */
-    int nByte;                    /* Bytes of space to allocate */
+    sqlite3_int64 nByte;          /* Bytes of space to allocate */
     int i;
 
     /* Allocate the Fts5Bm25Data object */
     nPhrase = pApi->xPhraseCount(pFts);
     nByte = sizeof(Fts5Bm25Data) + nPhrase*2*sizeof(double);
-    p = (Fts5Bm25Data*)sqlite3_malloc(nByte);
+    p = (Fts5Bm25Data*)sqlite3_malloc64(nByte);
     if( p==0 ){
       rc = SQLITE_NOMEM;
     }else{
       memset(p, 0, nByte);
       p->nPhrase = nPhrase;
@@ -584,10 +587,11 @@
       p->aFreq = &p->aIDF[nPhrase];
     }
 
     /* Calculate the average document length for this FTS5 table */
     if( rc==SQLITE_OK ) rc = pApi->xRowCount(pFts, &nRow);
+    assert( rc!=SQLITE_OK || nRow>0 );
     if( rc==SQLITE_OK ) rc = pApi->xColumnTotalSize(pFts, -1, &nToken);
     if( rc==SQLITE_OK ) p->avgdl = (double)nToken  / (double)nRow;
 
     /* Calculate an IDF for each phrase in the query */
     for(i=0; rc==SQLITE_OK && i<nPhrase; i++){
@@ -708,7 +712,5 @@
     );
   }
 
   return rc;
 }
-
-

Index: ext/fts5/fts5_buffer.c
==================================================================
--- ext/fts5/fts5_buffer.c
+++ ext/fts5/fts5_buffer.c
@@ -15,16 +15,16 @@
 
 #include "fts5Int.h"
 
 int sqlite3Fts5BufferSize(int *pRc, Fts5Buffer *pBuf, u32 nByte){
   if( (u32)pBuf->nSpace<nByte ){
-    u32 nNew = pBuf->nSpace ? pBuf->nSpace : 64;
+    u64 nNew = pBuf->nSpace ? pBuf->nSpace : 64;
     u8 *pNew;
     while( nNew<nByte ){
       nNew = nNew * 2;
     }
-    pNew = sqlite3_realloc(pBuf->p, nNew);
+    pNew = sqlite3_realloc64(pBuf->p, nNew);
     if( pNew==0 ){
       *pRc = SQLITE_NOMEM;
       return 1;
     }else{
       pBuf->nSpace = nNew;
@@ -50,11 +50,11 @@
   aBuf[2] = (iVal>> 8) & 0x00FF;
   aBuf[3] = (iVal>> 0) & 0x00FF;
 }
 
 int sqlite3Fts5Get32(const u8 *aBuf){
-  return (aBuf[0] << 24) + (aBuf[1] << 16) + (aBuf[2] << 8) + aBuf[3];
+  return (int)((((u32)aBuf[0])<<24) + (aBuf[1]<<16) + (aBuf[2]<<8) + aBuf[3]);
 }
 
 /*
 ** Append buffer nData/pData to buffer pBuf. If an OOM error occurs, set 
 ** the error code in p. If an error has already occurred when this function
@@ -181,11 +181,11 @@
     if( iVal==1 ){
       fts5FastGetVarint32(a, i, iVal);
       iOff = ((i64)iVal) << 32;
       fts5FastGetVarint32(a, i, iVal);
     }
-    *piOff = iOff + (iVal-2);
+    *piOff = iOff + ((iVal-2) & 0x7FFFFFFF);
     *pi = i;
     return 0;
   }
 }
 
@@ -242,14 +242,14 @@
   if( fts5BufferGrow(&rc, pBuf, 5+5+5) ) return rc;
   sqlite3Fts5PoslistSafeAppend(pBuf, &pWriter->iPrev, iPos);
   return SQLITE_OK;
 }
 
-void *sqlite3Fts5MallocZero(int *pRc, int nByte){
+void *sqlite3Fts5MallocZero(int *pRc, sqlite3_int64 nByte){
   void *pRet = 0;
   if( *pRc==SQLITE_OK ){
-    pRet = sqlite3_malloc(nByte);
+    pRet = sqlite3_malloc64(nByte);
     if( pRet==0 ){
       if( nByte>0 ) *pRc = SQLITE_NOMEM;
     }else{
       memset(pRet, 0, nByte);
     }

Index: ext/fts5/fts5_config.c
==================================================================
--- ext/fts5/fts5_config.c
+++ ext/fts5/fts5_config.c
@@ -293,11 +293,11 @@
     return rc;
   }
 
   if( sqlite3_strnicmp("tokenize", zCmd, nCmd)==0 ){
     const char *p = (const char*)zArg;
-    int nArg = (int)strlen(zArg) + 1;
+    sqlite3_int64 nArg = strlen(zArg) + 1;
     char **azArg = sqlite3Fts5MallocZero(&rc, sizeof(char*) * nArg);
     char *pDel = sqlite3Fts5MallocZero(&rc, nArg * 2);
     char *pSpace = pDel;
 
     if( azArg && pSpace ){
@@ -423,12 +423,12 @@
   char **pzOut,                   /* OUT: malloc'd buffer containing str/bw */
   int *pbQuoted                   /* OUT: Set to true if dequoting required */
 ){
   const char *zRet = 0;
 
-  int nIn = (int)strlen(zIn);
-  char *zOut = sqlite3_malloc(nIn+1);
+  sqlite3_int64 nIn = strlen(zIn);
+  char *zOut = sqlite3_malloc64(nIn+1);
 
   assert( *pRc==SQLITE_OK );
   *pbQuoted = 0;
   *pzOut = 0;
 
@@ -527,11 +527,11 @@
   char **pzErr                    /* OUT: Error message */
 ){
   int rc = SQLITE_OK;             /* Return code */
   Fts5Config *pRet;               /* New object to return */
   int i;
-  int nByte;
+  sqlite3_int64 nByte;
 
   *ppOut = pRet = (Fts5Config*)sqlite3_malloc(sizeof(Fts5Config));
   if( pRet==0 ) return SQLITE_NOMEM;
   memset(pRet, 0, sizeof(Fts5Config));
   pRet->db = db;

Index: ext/fts5/fts5_expr.c
==================================================================
--- ext/fts5/fts5_expr.c
+++ ext/fts5/fts5_expr.c
@@ -209,11 +209,11 @@
 
   *pz = &pToken->p[pToken->n];
   return tok;
 }
 
-static void *fts5ParseAlloc(u64 t){ return sqlite3_malloc((int)t); }
+static void *fts5ParseAlloc(u64 t){ return sqlite3_malloc64((sqlite3_int64)t);}
 static void fts5ParseFree(void *p){ sqlite3_free(p); }
 
 int sqlite3Fts5ExprNew(
   Fts5Config *pConfig,            /* FTS5 Configuration */
   int iCol,
@@ -354,12 +354,12 @@
   for(p=pTerm; p; p=p->pSynonym){
     Fts5IndexIter *pIter = p->pIter;
     if( sqlite3Fts5IterEof(pIter)==0 && pIter->iRowid==iRowid ){
       if( pIter->nData==0 ) continue;
       if( nIter==nAlloc ){
-        int nByte = sizeof(Fts5PoslistReader) * nAlloc * 2;
-        Fts5PoslistReader *aNew = (Fts5PoslistReader*)sqlite3_malloc(nByte);
+        sqlite3_int64 nByte = sizeof(Fts5PoslistReader) * nAlloc * 2;
+        Fts5PoslistReader *aNew = (Fts5PoslistReader*)sqlite3_malloc64(nByte);
         if( aNew==0 ){
           rc = SQLITE_NOMEM;
           goto synonym_poslist_out;
         }
         memcpy(aNew, aIter, sizeof(Fts5PoslistReader) * nIter);
@@ -435,12 +435,12 @@
   fts5BufferZero(&pPhrase->poslist);
 
   /* If the aStatic[] array is not large enough, allocate a large array
   ** using sqlite3_malloc(). This approach could be improved upon. */
   if( pPhrase->nTerm>ArraySize(aStatic) ){
-    int nByte = sizeof(Fts5PoslistReader) * pPhrase->nTerm;
-    aIter = (Fts5PoslistReader*)sqlite3_malloc(nByte);
+    sqlite3_int64 nByte = sizeof(Fts5PoslistReader) * pPhrase->nTerm;
+    aIter = (Fts5PoslistReader*)sqlite3_malloc64(nByte);
     if( !aIter ) return SQLITE_NOMEM;
   }
   memset(aIter, 0, sizeof(Fts5PoslistReader) * pPhrase->nTerm);
 
   /* Initialize a term iterator for each term in the phrase */
@@ -570,11 +570,11 @@
   assert( pNear->nPhrase>1 );
 
   /* If the aStatic[] array is not large enough, allocate a large array
   ** using sqlite3_malloc(). This approach could be improved upon. */
   if( pNear->nPhrase>ArraySize(aStatic) ){
-    int nByte = sizeof(Fts5NearTrimmer) * pNear->nPhrase;
+    sqlite3_int64 nByte = sizeof(Fts5NearTrimmer) * pNear->nPhrase;
     a = (Fts5NearTrimmer*)sqlite3Fts5MallocZero(&rc, nByte);
   }else{
     memset(aStatic, 0, sizeof(aStatic));
   }
   if( rc!=SQLITE_OK ){
@@ -1479,22 +1479,24 @@
   if( pParse->rc==SQLITE_OK ){
     if( pPhrase==0 ){
       return pNear;
     }
     if( pNear==0 ){
-      int nByte = sizeof(Fts5ExprNearset) + SZALLOC * sizeof(Fts5ExprPhrase*);
-      pRet = sqlite3_malloc(nByte);
+      sqlite3_int64 nByte;
+      nByte = sizeof(Fts5ExprNearset) + SZALLOC * sizeof(Fts5ExprPhrase*);
+      pRet = sqlite3_malloc64(nByte);
       if( pRet==0 ){
         pParse->rc = SQLITE_NOMEM;
       }else{
         memset(pRet, 0, nByte);
       }
     }else if( (pNear->nPhrase % SZALLOC)==0 ){
       int nNew = pNear->nPhrase + SZALLOC;
-      int nByte = sizeof(Fts5ExprNearset) + nNew * sizeof(Fts5ExprPhrase*);
+      sqlite3_int64 nByte;
 
-      pRet = (Fts5ExprNearset*)sqlite3_realloc(pNear, nByte);
+      nByte = sizeof(Fts5ExprNearset) + nNew * sizeof(Fts5ExprPhrase*);
+      pRet = (Fts5ExprNearset*)sqlite3_realloc64(pNear, nByte);
       if( pRet==0 ){
         pParse->rc = SQLITE_NOMEM;
       }
     }else{
       pRet = pNear;
@@ -1554,12 +1556,12 @@
   if( pCtx->rc!=SQLITE_OK ) return pCtx->rc;
   if( nToken>FTS5_MAX_TOKEN_SIZE ) nToken = FTS5_MAX_TOKEN_SIZE;
 
   if( pPhrase && pPhrase->nTerm>0 && (tflags & FTS5_TOKEN_COLOCATED) ){
     Fts5ExprTerm *pSyn;
-    int nByte = sizeof(Fts5ExprTerm) + sizeof(Fts5Buffer) + nToken+1;
-    pSyn = (Fts5ExprTerm*)sqlite3_malloc(nByte);
+    sqlite3_int64 nByte = sizeof(Fts5ExprTerm) + sizeof(Fts5Buffer) + nToken+1;
+    pSyn = (Fts5ExprTerm*)sqlite3_malloc64(nByte);
     if( pSyn==0 ){
       rc = SQLITE_NOMEM;
     }else{
       memset(pSyn, 0, nByte);
       pSyn->zTerm = ((char*)pSyn) + sizeof(Fts5ExprTerm) + sizeof(Fts5Buffer);
@@ -1571,11 +1573,11 @@
     Fts5ExprTerm *pTerm;
     if( pPhrase==0 || (pPhrase->nTerm % SZALLOC)==0 ){
       Fts5ExprPhrase *pNew;
       int nNew = SZALLOC + (pPhrase ? pPhrase->nTerm : 0);
 
-      pNew = (Fts5ExprPhrase*)sqlite3_realloc(pPhrase, 
+      pNew = (Fts5ExprPhrase*)sqlite3_realloc64(pPhrase, 
           sizeof(Fts5ExprPhrase) + sizeof(Fts5ExprTerm) * nNew
       );
       if( pNew==0 ){
         rc = SQLITE_NOMEM;
       }else{
@@ -1657,13 +1659,13 @@
     sCtx.pPhrase = 0;
   }else{
 
     if( pAppend==0 ){
       if( (pParse->nPhrase % 8)==0 ){
-        int nByte = sizeof(Fts5ExprPhrase*) * (pParse->nPhrase + 8);
+        sqlite3_int64 nByte = sizeof(Fts5ExprPhrase*) * (pParse->nPhrase + 8);
         Fts5ExprPhrase **apNew;
-        apNew = (Fts5ExprPhrase**)sqlite3_realloc(pParse->apPhrase, nByte);
+        apNew = (Fts5ExprPhrase**)sqlite3_realloc64(pParse->apPhrase, nByte);
         if( apNew==0 ){
           pParse->rc = SQLITE_NOMEM;
           fts5ExprPhraseFree(sCtx.pPhrase);
           return 0;
         }
@@ -1714,12 +1716,14 @@
         sizeof(Fts5ExprNearset) + sizeof(Fts5ExprPhrase*));
   }
   if( rc==SQLITE_OK ){
     Fts5Colset *pColsetOrig = pOrig->pNode->pNear->pColset;
     if( pColsetOrig ){
-      int nByte = sizeof(Fts5Colset) + (pColsetOrig->nCol-1) * sizeof(int);
-      Fts5Colset *pColset = (Fts5Colset*)sqlite3Fts5MallocZero(&rc, nByte);
+      sqlite3_int64 nByte;
+      Fts5Colset *pColset;
+      nByte = sizeof(Fts5Colset) + (pColsetOrig->nCol-1) * sizeof(int);
+      pColset = (Fts5Colset*)sqlite3Fts5MallocZero(&rc, nByte);
       if( pColset ){ 
         memcpy(pColset, pColsetOrig, nByte);
       }
       pNew->pRoot->pNear->pColset = pColset;
     }
@@ -1835,11 +1839,11 @@
   Fts5Colset *pNew;               /* New colset object to return */
 
   assert( pParse->rc==SQLITE_OK );
   assert( iCol>=0 && iCol<pParse->pConfig->nCol );
 
-  pNew = sqlite3_realloc(p, sizeof(Fts5Colset) + sizeof(int)*nCol);
+  pNew = sqlite3_realloc64(p, sizeof(Fts5Colset) + sizeof(int)*nCol);
   if( pNew==0 ){
     pParse->rc = SQLITE_NOMEM;
   }else{
     int *aiCol = pNew->aiCol;
     int i, j;
@@ -1931,11 +1935,11 @@
 ** fails, (*pRc) is set to SQLITE_NOMEM and NULL is returned.
 */
 static Fts5Colset *fts5CloneColset(int *pRc, Fts5Colset *pOrig){
   Fts5Colset *pRet;
   if( pOrig ){
-    int nByte = sizeof(Fts5Colset) + (pOrig->nCol-1) * sizeof(int);
+    sqlite3_int64 nByte = sizeof(Fts5Colset) + (pOrig->nCol-1) * sizeof(int);
     pRet = (Fts5Colset*)sqlite3Fts5MallocZero(pRc, nByte);
     if( pRet ){ 
       memcpy(pRet, pOrig, nByte);
     }
   }else{
@@ -2085,11 +2089,11 @@
 ){
   Fts5ExprNode *pRet = 0;
 
   if( pParse->rc==SQLITE_OK ){
     int nChild = 0;               /* Number of children of returned node */
-    int nByte;                    /* Bytes of space to allocate for this node */
+    sqlite3_int64 nByte;          /* Bytes of space to allocate for this node */
  
     assert( (eType!=FTS5_STRING && !pNear)
          || (eType==FTS5_STRING && !pLeft && !pRight)
     );
     if( eType==FTS5_STRING && pNear==0 ) return 0;
@@ -2217,19 +2221,19 @@
 
   return pRet;
 }
 
 static char *fts5ExprTermPrint(Fts5ExprTerm *pTerm){
-  int nByte = 0;
+  sqlite3_int64 nByte = 0;
   Fts5ExprTerm *p;
   char *zQuoted;
 
   /* Determine the maximum amount of space required. */
   for(p=pTerm; p; p=p->pSynonym){
     nByte += (int)strlen(pTerm->zTerm) * 2 + 3 + 2;
   }
-  zQuoted = sqlite3_malloc(nByte);
+  zQuoted = sqlite3_malloc64(nByte);
 
   if( zQuoted ){
     int i = 0;
     for(p=pTerm; p; p=p->pSynonym){
       char *zIn = p->zTerm;
@@ -2465,11 +2469,11 @@
     zNearsetCmd = (const char*)sqlite3_value_text(apVal[1]);
     iArg = 2;
   }
 
   nConfig = 3 + (nArg-iArg);
-  azConfig = (const char**)sqlite3_malloc(sizeof(char*) * nConfig);
+  azConfig = (const char**)sqlite3_malloc64(sizeof(char*) * nConfig);
   if( azConfig==0 ){
     sqlite3_result_error_nomem(pCtx);
     return;
   }
   azConfig[0] = 0;
@@ -2551,11 +2555,11 @@
   memset(aArr, 0, sizeof(aArr));
   sqlite3Fts5UnicodeCatParse("L*", aArr);
   sqlite3Fts5UnicodeCatParse("N*", aArr);
   sqlite3Fts5UnicodeCatParse("Co", aArr);
   iCode = sqlite3_value_int(apVal[0]);
-  sqlite3_result_int(pCtx, aArr[sqlite3Fts5UnicodeCategory(iCode)]);
+  sqlite3_result_int(pCtx, aArr[sqlite3Fts5UnicodeCategory((u32)iCode)]);
 }
 
 static void fts5ExprFold(
   sqlite3_context *pCtx,          /* Function call context */
   int nArg,                       /* Number of args */
@@ -2646,11 +2650,11 @@
   int bMiss;
 };
 
 Fts5PoslistPopulator *sqlite3Fts5ExprClearPoslists(Fts5Expr *pExpr, int bLive){
   Fts5PoslistPopulator *pRet;
-  pRet = sqlite3_malloc(sizeof(Fts5PoslistPopulator)*pExpr->nPhrase);
+  pRet = sqlite3_malloc64(sizeof(Fts5PoslistPopulator)*pExpr->nPhrase);
   if( pRet ){
     int i;
     memset(pRet, 0, sizeof(Fts5PoslistPopulator)*pExpr->nPhrase);
     for(i=0; i<pExpr->nPhrase; i++){
       Fts5Buffer *pBuf = &pExpr->apExprPhrase[i]->poslist;
@@ -2845,6 +2849,5 @@
     *pnCollist = 0;
   }
 
   return rc;
 }
-

Index: ext/fts5/fts5_hash.c
==================================================================
--- ext/fts5/fts5_hash.c
+++ ext/fts5/fts5_hash.c
@@ -88,18 +88,18 @@
 
   *ppNew = pNew = (Fts5Hash*)sqlite3_malloc(sizeof(Fts5Hash));
   if( pNew==0 ){
     rc = SQLITE_NOMEM;
   }else{
-    int nByte;
+    sqlite3_int64 nByte;
     memset(pNew, 0, sizeof(Fts5Hash));
     pNew->pnByte = pnByte;
     pNew->eDetail = pConfig->eDetail;
 
     pNew->nSlot = 1024;
     nByte = sizeof(Fts5HashEntry*) * pNew->nSlot;
-    pNew->aSlot = (Fts5HashEntry**)sqlite3_malloc(nByte);
+    pNew->aSlot = (Fts5HashEntry**)sqlite3_malloc64(nByte);
     if( pNew->aSlot==0 ){
       sqlite3_free(pNew);
       *ppNew = 0;
       rc = SQLITE_NOMEM;
     }else{
@@ -163,11 +163,11 @@
   int nNew = pHash->nSlot*2;
   int i;
   Fts5HashEntry **apNew;
   Fts5HashEntry **apOld = pHash->aSlot;
 
-  apNew = (Fts5HashEntry**)sqlite3_malloc(nNew*sizeof(Fts5HashEntry*));
+  apNew = (Fts5HashEntry**)sqlite3_malloc64(nNew*sizeof(Fts5HashEntry*));
   if( !apNew ) return SQLITE_NOMEM;
   memset(apNew, 0, nNew*sizeof(Fts5HashEntry*));
 
   for(i=0; i<pHash->nSlot; i++){
     while( apOld[i] ){
@@ -257,11 +257,11 @@
 
   /* If an existing hash entry cannot be found, create a new one. */
   if( p==0 ){
     /* Figure out how much space to allocate */
     char *zKey;
-    int nByte = sizeof(Fts5HashEntry) + (nToken+1) + 1 + 64;
+    sqlite3_int64 nByte = sizeof(Fts5HashEntry) + (nToken+1) + 1 + 64;
     if( nByte<128 ) nByte = 128;
 
     /* Grow the Fts5Hash.aSlot[] array if necessary. */
     if( (pHash->nEntry*2)>=pHash->nSlot ){
       int rc = fts5HashResize(pHash);
@@ -268,11 +268,11 @@
       if( rc!=SQLITE_OK ) return rc;
       iHash = fts5HashKey2(pHash->nSlot, (u8)bByte, (const u8*)pToken, nToken);
     }
 
     /* Allocate new Fts5HashEntry and add it to the hash table. */
-    p = (Fts5HashEntry*)sqlite3_malloc(nByte);
+    p = (Fts5HashEntry*)sqlite3_malloc64(nByte);
     if( !p ) return SQLITE_NOMEM;
     memset(p, 0, sizeof(Fts5HashEntry));
     p->nAlloc = nByte;
     zKey = fts5EntryKey(p);
     zKey[0] = bByte;
@@ -307,16 +307,16 @@
     **     + 1 byte for a "new column" byte,
     **     + 3 bytes for a new column number (16-bit max) as a varint,
     **     + 5 bytes for the new position offset (32-bit max).
     */
     if( (p->nAlloc - p->nData) < (9 + 4 + 1 + 3 + 5) ){
-      int nNew = p->nAlloc * 2;
+      sqlite3_int64 nNew = p->nAlloc * 2;
       Fts5HashEntry *pNew;
       Fts5HashEntry **pp;
-      pNew = (Fts5HashEntry*)sqlite3_realloc(p, nNew);
+      pNew = (Fts5HashEntry*)sqlite3_realloc64(p, nNew);
       if( pNew==0 ) return SQLITE_NOMEM;
-      pNew->nAlloc = nNew;
+      pNew->nAlloc = (int)nNew;
       for(pp=&pHash->aSlot[iHash]; *pp!=p; pp=&(*pp)->pHashNext);
       *pp = pNew;
       p = pNew;
     }
     nIncr -= p->nData;
@@ -436,11 +436,11 @@
   Fts5HashEntry *pList;
   int iSlot;
   int i;
 
   *ppSorted = 0;
-  ap = sqlite3_malloc(sizeof(Fts5HashEntry*) * nMergeSlot);
+  ap = sqlite3_malloc64(sizeof(Fts5HashEntry*) * nMergeSlot);
   if( !ap ) return SQLITE_NOMEM;
   memset(ap, 0, sizeof(Fts5HashEntry*) * nMergeSlot);
 
   for(iSlot=0; iSlot<pHash->nSlot; iSlot++){
     Fts5HashEntry *pIter;
@@ -481,11 +481,12 @@
   char *zKey = 0;
   Fts5HashEntry *p;
 
   for(p=pHash->aSlot[iHash]; p; p=p->pHashNext){
     zKey = fts5EntryKey(p);
-    if( memcmp(zKey, pTerm, nTerm)==0 && zKey[nTerm]==0 ) break;
+    assert( p->nKey+1==(int)strlen(zKey) );
+    if( nTerm==p->nKey+1 && memcmp(zKey, pTerm, nTerm)==0 ) break;
   }
 
   if( p ){
     fts5HashAddPoslistSize(pHash, p);
     *ppDoclist = (const u8*)&zKey[nTerm+1];
@@ -532,6 +533,5 @@
     *pzTerm = 0;
     *ppDoclist = 0;
     *pnDoclist = 0;
   }
 }
-

Index: ext/fts5/fts5_index.c
==================================================================
--- ext/fts5/fts5_index.c
+++ ext/fts5/fts5_index.c
@@ -510,11 +510,10 @@
 */
 struct Fts5Iter {
   Fts5IndexIter base;             /* Base class containing output vars */
 
   Fts5Index *pIndex;              /* Index that owns this iterator */
-  Fts5Structure *pStruct;         /* Database structure for this iterator */
   Fts5Buffer poslist;             /* Buffer containing current poslist */
   Fts5Colset *pColset;            /* Restrict matches to these columns */
 
   /* Invoked to set output variables. */
   void (*xSetOutputs)(Fts5Iter*, Fts5SegIter*);
@@ -571,11 +570,11 @@
 ** Allocate and return a buffer at least nByte bytes in size.
 **
 ** If an OOM error is encountered, return NULL and set the error code in
 ** the Fts5Index handle passed as the first argument.
 */
-static void *fts5IdxMalloc(Fts5Index *p, int nByte){
+static void *fts5IdxMalloc(Fts5Index *p, sqlite3_int64 nByte){
   return sqlite3Fts5MallocZero(&p->rc, nByte);
 }
 
 /*
 ** Compare the contents of the pLeft buffer with the pRight/nRight blob.
@@ -605,11 +604,11 @@
 **
 **     res = *pLeft - *pRight
 */
 static int fts5BufferCompare(Fts5Buffer *pLeft, Fts5Buffer *pRight){
   int nCmp = MIN(pLeft->n, pRight->n);
-  int res = memcmp(pLeft->p, pRight->p, nCmp);
+  int res = fts5Memcmp(pLeft->p, pRight->p, nCmp);
   return (res==0 ? (pLeft->n - pRight->n) : res);
 }
 
 static int fts5LeafFirstTermOff(Fts5Data *pLeaf){
   int ret;
@@ -671,12 +670,12 @@
     if( rc==SQLITE_ERROR ) rc = FTS5_CORRUPT;
 
     if( rc==SQLITE_OK ){
       u8 *aOut = 0;               /* Read blob data into this buffer */
       int nByte = sqlite3_blob_bytes(p->pReader);
-      int nAlloc = sizeof(Fts5Data) + nByte + FTS5_DATA_PADDING;
-      pRet = (Fts5Data*)sqlite3_malloc(nAlloc);
+      sqlite3_int64 nAlloc = sizeof(Fts5Data) + nByte + FTS5_DATA_PADDING;
+      pRet = (Fts5Data*)sqlite3_malloc64(nAlloc);
       if( pRet ){
         pRet->nn = nByte;
         aOut = pRet->p = (u8*)&pRet[1];
       }else{
         rc = SQLITE_NOMEM;
@@ -688,10 +687,11 @@
       if( rc!=SQLITE_OK ){
         sqlite3_free(pRet);
         pRet = 0;
       }else{
         /* TODO1: Fix this */
+        pRet->p[nByte] = 0x00;
         pRet->szLeaf = fts5GetU16(&pRet->p[2]);
       }
     }
     p->rc = rc;
     p->nRead++;
@@ -727,11 +727,12 @@
   char *zSql
 ){
   if( p->rc==SQLITE_OK ){
     if( zSql ){
       p->rc = sqlite3_prepare_v3(p->pConfig->db, zSql, -1,
-                                 SQLITE_PREPARE_PERSISTENT, ppStmt, 0);
+          SQLITE_PREPARE_PERSISTENT|SQLITE_PREPARE_NO_VTAB,
+          ppStmt, 0);
     }else{
       p->rc = SQLITE_NOMEM;
     }
   }
   sqlite3_free(zSql);
@@ -768,27 +769,16 @@
 */
 static void fts5DataDelete(Fts5Index *p, i64 iFirst, i64 iLast){
   if( p->rc!=SQLITE_OK ) return;
 
   if( p->pDeleter==0 ){
-    int rc;
     Fts5Config *pConfig = p->pConfig;
     char *zSql = sqlite3_mprintf(
         "DELETE FROM '%q'.'%q_data' WHERE id>=? AND id<=?", 
           pConfig->zDb, pConfig->zName
     );
-    if( zSql==0 ){
-      rc = SQLITE_NOMEM;
-    }else{
-      rc = sqlite3_prepare_v3(pConfig->db, zSql, -1,
-                              SQLITE_PREPARE_PERSISTENT, &p->pDeleter, 0);
-      sqlite3_free(zSql);
-    }
-    if( rc!=SQLITE_OK ){
-      p->rc = rc;
-      return;
-    }
+    if( fts5IndexPrepareStmt(p, &p->pDeleter, zSql) ) return;
   }
 
   sqlite3_bind_int64(p->pDeleter, 1, iFirst);
   sqlite3_bind_int64(p->pDeleter, 2, iLast);
   sqlite3_step(p->pDeleter);
@@ -856,11 +846,11 @@
   int rc = SQLITE_OK;
   int i = 0;
   int iLvl;
   int nLevel = 0;
   int nSegment = 0;
-  int nByte;                      /* Bytes of space to allocate at pRet */
+  sqlite3_int64 nByte;            /* Bytes of space to allocate at pRet */
   Fts5Structure *pRet = 0;        /* Structure object to return */
 
   /* Grab the cookie value */
   if( piCookie ) *piCookie = sqlite3Fts5Get32(pData);
   i = 4;
@@ -867,10 +857,15 @@
 
   /* Read the total number of levels and segments from the start of the
   ** structure record.  */
   i += fts5GetVarint32(&pData[i], nLevel);
   i += fts5GetVarint32(&pData[i], nSegment);
+  if( nLevel>FTS5_MAX_SEGMENT   || nLevel<0
+   || nSegment>FTS5_MAX_SEGMENT || nSegment<0
+  ){
+    return FTS5_CORRUPT;
+  }
   nByte = (
       sizeof(Fts5Structure) +                    /* Main structure */
       sizeof(Fts5StructureLevel) * (nLevel-1)    /* aLevel[] array */
   );
   pRet = (Fts5Structure*)sqlite3Fts5MallocZero(&rc, nByte);
@@ -889,29 +884,39 @@
       if( i>=nData ){
         rc = FTS5_CORRUPT;
       }else{
         i += fts5GetVarint32(&pData[i], pLvl->nMerge);
         i += fts5GetVarint32(&pData[i], nTotal);
-        assert( nTotal>=pLvl->nMerge );
+        if( nTotal<pLvl->nMerge ) rc = FTS5_CORRUPT;
         pLvl->aSeg = (Fts5StructureSegment*)sqlite3Fts5MallocZero(&rc, 
             nTotal * sizeof(Fts5StructureSegment)
         );
+        nSegment -= nTotal;
       }
 
       if( rc==SQLITE_OK ){
         pLvl->nSeg = nTotal;
         for(iSeg=0; iSeg<nTotal; iSeg++){
+          Fts5StructureSegment *pSeg = &pLvl->aSeg[iSeg];
           if( i>=nData ){
             rc = FTS5_CORRUPT;
             break;
           }
-          i += fts5GetVarint32(&pData[i], pLvl->aSeg[iSeg].iSegid);
-          i += fts5GetVarint32(&pData[i], pLvl->aSeg[iSeg].pgnoFirst);
-          i += fts5GetVarint32(&pData[i], pLvl->aSeg[iSeg].pgnoLast);
+          i += fts5GetVarint32(&pData[i], pSeg->iSegid);
+          i += fts5GetVarint32(&pData[i], pSeg->pgnoFirst);
+          i += fts5GetVarint32(&pData[i], pSeg->pgnoLast);
+          if( pSeg->pgnoLast<pSeg->pgnoFirst ){
+            rc = FTS5_CORRUPT;
+            break;
+          }
         }
+        if( iLvl>0 && pLvl[-1].nMerge && nTotal==0 ) rc = FTS5_CORRUPT;
+        if( iLvl==nLevel-1 && pLvl->nMerge ) rc = FTS5_CORRUPT;
       }
     }
+    if( nSegment!=0 && rc==SQLITE_OK ) rc = FTS5_CORRUPT;
+
     if( rc!=SQLITE_OK ){
       fts5StructureRelease(pRet);
       pRet = 0;
     }
   }
@@ -925,16 +930,16 @@
 */
 static void fts5StructureAddLevel(int *pRc, Fts5Structure **ppStruct){
   if( *pRc==SQLITE_OK ){
     Fts5Structure *pStruct = *ppStruct;
     int nLevel = pStruct->nLevel;
-    int nByte = (
+    sqlite3_int64 nByte = (
         sizeof(Fts5Structure) +                  /* Main structure */
         sizeof(Fts5StructureLevel) * (nLevel+1)  /* aLevel[] array */
     );
 
-    pStruct = sqlite3_realloc(pStruct, nByte);
+    pStruct = sqlite3_realloc64(pStruct, nByte);
     if( pStruct ){
       memset(&pStruct->aLevel[nLevel], 0, sizeof(Fts5StructureLevel));
       pStruct->nLevel++;
       *ppStruct = pStruct;
     }else{
@@ -955,14 +960,14 @@
   int bInsert
 ){
   if( *pRc==SQLITE_OK ){
     Fts5StructureLevel *pLvl = &pStruct->aLevel[iLvl];
     Fts5StructureSegment *aNew;
-    int nByte;
+    sqlite3_int64 nByte;
 
     nByte = (pLvl->nSeg + nExtra) * sizeof(Fts5StructureSegment);
-    aNew = sqlite3_realloc(pLvl->aSeg, nByte);
+    aNew = sqlite3_realloc64(pLvl->aSeg, nByte);
     if( aNew ){
       if( bInsert==0 ){
         memset(&aNew[pLvl->nSeg], 0, sizeof(Fts5StructureSegment) * nExtra);
       }else{
         int nMove = pLvl->nSeg * sizeof(Fts5StructureSegment);
@@ -1472,14 +1477,14 @@
   Fts5DlidxIter *pIter = 0;
   int i;
   int bDone = 0;
 
   for(i=0; p->rc==SQLITE_OK && bDone==0; i++){
-    int nByte = sizeof(Fts5DlidxIter) + i * sizeof(Fts5DlidxLvl);
+    sqlite3_int64 nByte = sizeof(Fts5DlidxIter) + i * sizeof(Fts5DlidxLvl);
     Fts5DlidxIter *pNew;
 
-    pNew = (Fts5DlidxIter*)sqlite3_realloc(pIter, nByte);
+    pNew = (Fts5DlidxIter*)sqlite3_realloc64(pIter, nByte);
     if( pNew==0 ){
       p->rc = SQLITE_NOMEM;
     }else{
       i64 iRowid = FTS5_DLIDX_ROWID(iSegid, i, iLeafPg);
       Fts5DlidxLvl *pLvl = &pNew->aLvl[i];
@@ -1645,16 +1650,17 @@
   u8 *a = pIter->pLeaf->p;        /* Buffer to read data from */
   int iOff = pIter->iLeafOffset;  /* Offset to read at */
   int nNew;                       /* Bytes of new data */
 
   iOff += fts5GetVarint32(&a[iOff], nNew);
-  if( iOff+nNew>pIter->pLeaf->nn ){
+  if( iOff+nNew>pIter->pLeaf->szLeaf || nKeep>pIter->term.n || nNew==0 ){
     p->rc = FTS5_CORRUPT;
     return;
   }
   pIter->term.n = nKeep;
   fts5BufferAppendBlob(&p->rc, &pIter->term, nNew, &a[iOff]);
+  assert( pIter->term.n<=pIter->term.nSpace );
   iOff += nNew;
   pIter->iTermLeafOffset = iOff;
   pIter->iTermLeafPgno = pIter->iLeafPgno;
   pIter->iLeafOffset = iOff;
 
@@ -1715,11 +1721,11 @@
   }
 
   if( p->rc==SQLITE_OK ){
     pIter->iLeafOffset = 4;
     assert_nc( pIter->pLeaf->nn>4 );
-    assert( fts5LeafFirstTermOff(pIter->pLeaf)==4 );
+    assert_nc( fts5LeafFirstTermOff(pIter->pLeaf)==4 );
     pIter->iPgidxOff = pIter->pLeaf->szLeaf+1;
     fts5SegIterLoadTerm(p, pIter, 0);
     fts5SegIterLoadNPos(p, pIter);
   }
 }
@@ -1771,11 +1777,11 @@
     pIter->iRowid += iDelta;
 
     /* If necessary, grow the pIter->aRowidOffset[] array. */
     if( iRowidOffset>=pIter->nRowidOffset ){
       int nNew = pIter->nRowidOffset + 8;
-      int *aNew = (int*)sqlite3_realloc(pIter->aRowidOffset, nNew*sizeof(int));
+      int *aNew = (int*)sqlite3_realloc64(pIter->aRowidOffset,nNew*sizeof(int));
       if( aNew==0 ){
         p->rc = SQLITE_NOMEM;
         break;
       }
       pIter->aRowidOffset = aNew;
@@ -2225,14 +2231,14 @@
   int iOff;
   const u8 *a = pIter->pLeaf->p;
   int szLeaf = pIter->pLeaf->szLeaf;
   int n = pIter->pLeaf->nn;
 
-  int nMatch = 0;
-  int nKeep = 0;
-  int nNew = 0;
-  int iTermOff;
+  u32 nMatch = 0;
+  u32 nKeep = 0;
+  u32 nNew = 0;
+  u32 iTermOff;
   int iPgidx;                     /* Current offset in pgidx */
   int bEndOfPage = 0;
 
   assert( p->rc==SQLITE_OK );
 
@@ -2252,19 +2258,19 @@
       goto search_failed;
     }
 
     assert( nKeep>=nMatch );
     if( nKeep==nMatch ){
-      int nCmp;
-      int i;
-      nCmp = MIN(nNew, nTerm-nMatch);
+      u32 nCmp;
+      u32 i;
+      nCmp = (u32)MIN(nNew, nTerm-nMatch);
       for(i=0; i<nCmp; i++){
         if( a[iOff+i]!=pTerm[nMatch+i] ) break;
       }
       nMatch += i;
 
-      if( nTerm==nMatch ){
+      if( (u32)nTerm==nMatch ){
         if( i==nNew ){
           goto search_success;
         }else{
           goto search_failed;
         }
@@ -2304,10 +2310,11 @@
       if( fts5LeafIsTermless(pIter->pLeaf)==0 ){
         iPgidx = pIter->pLeaf->szLeaf;
         iPgidx += fts5GetVarint32(&pIter->pLeaf->p[iPgidx], iOff);
         if( iOff<4 || iOff>=pIter->pLeaf->szLeaf ){
           p->rc = FTS5_CORRUPT;
+          return;
         }else{
           nKeep = 0;
           iTermOff = iOff;
           n = pIter->pLeaf->nn;
           iOff += fts5GetVarint32(&a[iOff], nNew);
@@ -2316,12 +2323,15 @@
       }
     }while( 1 );
   }
 
  search_success:
-
   pIter->iLeafOffset = iOff + nNew;
+  if( pIter->iLeafOffset>n || nNew<1 ){
+    p->rc = FTS5_CORRUPT;
+    return;
+  }
   pIter->iTermLeafOffset = pIter->iLeafOffset;
   pIter->iTermLeafPgno = pIter->iLeafPgno;
 
   fts5BufferSet(&p->rc, &pIter->term, nKeep, pTerm);
   fts5BufferAppendBlob(&p->rc, &pIter->term, nNew, &a[iOff]);
@@ -2424,11 +2434,11 @@
   **   2) the iterator points to EOF, or
   **   3) the iterator points to an entry with term (pTerm/nTerm), or
   **   4) the FTS5INDEX_QUERY_SCAN flag was set and the iterator points
   **      to an entry with a term greater than or equal to (pTerm/nTerm).
   */
-  assert( p->rc!=SQLITE_OK                                          /* 1 */
+  assert_nc( p->rc!=SQLITE_OK                                       /* 1 */
    || pIter->pLeaf==0                                               /* 2 */
    || fts5BufferCompareBlob(&pIter->term, pTerm, nTerm)==0          /* 3 */
    || (bGe && fts5BufferCompareBlob(&pIter->term, pTerm, nTerm)>0)  /* 4 */
   );
 }
@@ -2522,11 +2532,11 @@
       assert( pRes->iFirst==i2 );
     }else if( p2->pLeaf==0 ){
       assert( pRes->iFirst==i1 );
     }else{
       int nMin = MIN(p1->term.n, p2->term.n);
-      int res = memcmp(p1->term.p, p2->term.p, nMin);
+      int res = fts5Memcmp(p1->term.p, p2->term.p, nMin);
       if( res==0 ) res = p1->term.n - p2->term.n;
 
       if( res==0 ){
         assert( pRes->bTermEq==1 );
         assert( p1->iRowid!=p2->iRowid );
@@ -2745,11 +2755,10 @@
   if( pIter ){
     int i;
     for(i=0; i<pIter->nSeg; i++){
       fts5SegIterClear(&pIter->aSeg[i]);
     }
-    fts5StructureRelease(pIter->pStruct);
     fts5BufferFree(&pIter->poslist);
     sqlite3_free(pIter);
   }
 }
 
@@ -3093,11 +3102,12 @@
   Fts5Index *p,
   Fts5SegIter *pSeg,
   Fts5Colset *pColset,
   Fts5Buffer *pBuf
 ){
-  if( 0==fts5BufferGrow(&p->rc, pBuf, pSeg->nPos) ){
+  if( 0==fts5BufferGrow(&p->rc, pBuf, pSeg->nPos+FTS5_DATA_ZERO_PADDING) ){
+    memset(&pBuf->p[pBuf->n+pSeg->nPos], 0, FTS5_DATA_ZERO_PADDING);
     if( pColset==0 ){
       fts5ChunkIterate(p, pSeg, (void*)pBuf, fts5PoslistCallback);
     }else{
       if( p->pConfig->eDetail==FTS5_DETAIL_FULL ){
         PoslistCallbackCtx sCtx;
@@ -3391,13 +3401,11 @@
   }
   *ppOut = pNew = fts5MultiIterAlloc(p, nSeg);
   if( pNew==0 ) return;
   pNew->bRev = (0!=(flags & FTS5INDEX_QUERY_DESC));
   pNew->bSkipEmpty = (0!=(flags & FTS5INDEX_QUERY_SKIPEMPTY));
-  pNew->pStruct = pStruct;
   pNew->pColset = pColset;
-  fts5StructureRef(pStruct);
   if( (flags & FTS5INDEX_QUERY_NOOUTPUT)==0 ){
     fts5IterSetOutputCb(&p->rc, pNew);
   }
 
   /* Initialize each of the component segment iterators. */
@@ -3571,36 +3579,36 @@
       u32 mask;
       memset(aUsed, 0, sizeof(aUsed));
       for(iLvl=0; iLvl<pStruct->nLevel; iLvl++){
         for(iSeg=0; iSeg<pStruct->aLevel[iLvl].nSeg; iSeg++){
           int iId = pStruct->aLevel[iLvl].aSeg[iSeg].iSegid;
-          if( iId<=FTS5_MAX_SEGMENT ){
-            aUsed[(iId-1) / 32] |= 1 << ((iId-1) % 32);
+          if( iId<=FTS5_MAX_SEGMENT && iId>0 ){
+            aUsed[(iId-1) / 32] |= (u32)1 << ((iId-1) % 32);
           }
         }
       }
 
       for(i=0; aUsed[i]==0xFFFFFFFF; i++);
       mask = aUsed[i];
-      for(iSegid=0; mask & (1 << iSegid); iSegid++);
+      for(iSegid=0; mask & ((u32)1 << iSegid); iSegid++);
       iSegid += 1 + i*32;
 
 #ifdef SQLITE_DEBUG
       for(iLvl=0; iLvl<pStruct->nLevel; iLvl++){
         for(iSeg=0; iSeg<pStruct->aLevel[iLvl].nSeg; iSeg++){
-          assert( iSegid!=pStruct->aLevel[iLvl].aSeg[iSeg].iSegid );
+          assert_nc( iSegid!=pStruct->aLevel[iLvl].aSeg[iSeg].iSegid );
         }
       }
-      assert( iSegid>0 && iSegid<=FTS5_MAX_SEGMENT );
+      assert_nc( iSegid>0 && iSegid<=FTS5_MAX_SEGMENT );
 
       {
         sqlite3_stmt *pIdxSelect = fts5IdxSelectStmt(p);
         if( p->rc==SQLITE_OK ){
           u8 aBlob[2] = {0xff, 0xff};
           sqlite3_bind_int(pIdxSelect, 1, iSegid);
           sqlite3_bind_blob(pIdxSelect, 2, aBlob, 2, SQLITE_STATIC);
-          assert( sqlite3_step(pIdxSelect)!=SQLITE_ROW );
+          assert_nc( sqlite3_step(pIdxSelect)!=SQLITE_ROW );
           p->rc = sqlite3_reset(pIdxSelect);
           sqlite3_bind_null(pIdxSelect, 2);
         }
       }
 #endif
@@ -3666,11 +3674,11 @@
   Fts5Index *p,
   Fts5SegWriter *pWriter,
   int nLvl
 ){
   if( p->rc==SQLITE_OK && nLvl>=pWriter->nDlidx ){
-    Fts5DlidxWriter *aDlidx = (Fts5DlidxWriter*)sqlite3_realloc(
+    Fts5DlidxWriter *aDlidx = (Fts5DlidxWriter*)sqlite3_realloc64(
         pWriter->aDlidx, sizeof(Fts5DlidxWriter) * nLvl
     );
     if( aDlidx==0 ){
       p->rc = SQLITE_NOMEM;
     }else{
@@ -3745,12 +3753,14 @@
   Fts5Index *p,                   /* FTS5 backend object */
   Fts5SegWriter *pWriter,         /* Writer object */
   int nTerm, const u8 *pTerm      /* First term on new page */
 ){
   fts5WriteFlushBtree(p, pWriter);
-  fts5BufferSet(&p->rc, &pWriter->btterm, nTerm, pTerm);
-  pWriter->iBtPage = pWriter->writer.pgno;
+  if( p->rc==SQLITE_OK ){
+    fts5BufferSet(&p->rc, &pWriter->btterm, nTerm, pTerm);
+    pWriter->iBtPage = pWriter->writer.pgno;
+  }
 }
 
 /*
 ** This function is called when flushing a leaf page that contains no
 ** terms at all to disk.
@@ -3897,19 +3907,21 @@
   int nTerm, const u8 *pTerm 
 ){
   int nPrefix;                    /* Bytes of prefix compression for term */
   Fts5PageWriter *pPage = &pWriter->writer;
   Fts5Buffer *pPgidx = &pWriter->writer.pgidx;
+  int nMin = MIN(pPage->term.n, nTerm);
 
   assert( p->rc==SQLITE_OK );
   assert( pPage->buf.n>=4 );
   assert( pPage->buf.n>4 || pWriter->bFirstTermInPage );
 
   /* If the current leaf page is full, flush it to disk. */
   if( (pPage->buf.n + pPgidx->n + nTerm + 2)>=p->pConfig->pgsz ){
     if( pPage->buf.n>4 ){
       fts5WriteFlushLeaf(p, pWriter);
+      if( p->rc!=SQLITE_OK ) return;
     }
     fts5BufferGrow(&p->rc, &pPage->buf, nTerm+FTS5_DATA_PADDING);
   }
   
   /* TODO1: Updating pgidx here. */
@@ -3938,17 +3950,18 @@
       ** In this case the previous term is not available, so just write a
       ** copy of (pTerm/nTerm) into the parent node. This is slightly
       ** inefficient, but still correct.  */
       int n = nTerm;
       if( pPage->term.n ){
-        n = 1 + fts5PrefixCompress(pPage->term.n, pPage->term.p, pTerm);
+        n = 1 + fts5PrefixCompress(nMin, pPage->term.p, pTerm);
       }
       fts5WriteBtreeTerm(p, pWriter, n, pTerm);
+      if( p->rc!=SQLITE_OK ) return;
       pPage = &pWriter->writer;
     }
   }else{
-    nPrefix = fts5PrefixCompress(pPage->term.n, pPage->term.p, pTerm);
+    nPrefix = fts5PrefixCompress(nMin, pPage->term.p, pTerm);
     fts5BufferAppendVarint(&p->rc, &pPage->buf, nPrefix);
   }
 
   /* Append the number of bytes of new data, then the term data itself
   ** to the page. */
@@ -3991,11 +4004,11 @@
 
     /* Write the rowid. */
     if( pWriter->bFirstRowidInDoclist || pWriter->bFirstRowidInPage ){
       fts5BufferAppendVarint(&p->rc, &pPage->buf, iRowid);
     }else{
-      assert( p->rc || iRowid>pWriter->iPrevRowid );
+      assert_nc( p->rc || iRowid>pWriter->iPrevRowid );
       fts5BufferAppendVarint(&p->rc, &pPage->buf, iRowid - pWriter->iPrevRowid);
     }
     pWriter->iPrevRowid = iRowid;
     pWriter->bFirstRowidInDoclist = 0;
     pWriter->bFirstRowidInPage = 0;
@@ -4113,11 +4126,11 @@
 */
 static void fts5TrimSegments(Fts5Index *p, Fts5Iter *pIter){
   int i;
   Fts5Buffer buf;
   memset(&buf, 0, sizeof(Fts5Buffer));
-  for(i=0; i<pIter->nSeg; i++){
+  for(i=0; i<pIter->nSeg && p->rc==SQLITE_OK; i++){
     Fts5SegIter *pSeg = &pIter->aSeg[i];
     if( pSeg->pSeg==0 ){
       /* no-op */
     }else if( pSeg->pLeaf==0 ){
       /* All keys from this input segment have been transfered to the output.
@@ -4131,39 +4144,47 @@
       Fts5Data *pData;
       int iId = pSeg->pSeg->iSegid;
       u8 aHdr[4] = {0x00, 0x00, 0x00, 0x00};
 
       iLeafRowid = FTS5_SEGMENT_ROWID(iId, pSeg->iTermLeafPgno);
-      pData = fts5DataRead(p, iLeafRowid);
+      pData = fts5LeafRead(p, iLeafRowid);
       if( pData ){
-        fts5BufferZero(&buf);
-        fts5BufferGrow(&p->rc, &buf, pData->nn);
-        fts5BufferAppendBlob(&p->rc, &buf, sizeof(aHdr), aHdr);
-        fts5BufferAppendVarint(&p->rc, &buf, pSeg->term.n);
-        fts5BufferAppendBlob(&p->rc, &buf, pSeg->term.n, pSeg->term.p);
-        fts5BufferAppendBlob(&p->rc, &buf, pData->szLeaf-iOff, &pData->p[iOff]);
-        if( p->rc==SQLITE_OK ){
-          /* Set the szLeaf field */
-          fts5PutU16(&buf.p[2], (u16)buf.n);
-        }
-
-        /* Set up the new page-index array */
-        fts5BufferAppendVarint(&p->rc, &buf, 4);
-        if( pSeg->iLeafPgno==pSeg->iTermLeafPgno 
-         && pSeg->iEndofDoclist<pData->szLeaf 
-        ){
-          int nDiff = pData->szLeaf - pSeg->iEndofDoclist;
-          fts5BufferAppendVarint(&p->rc, &buf, buf.n - 1 - nDiff - 4);
-          fts5BufferAppendBlob(&p->rc, &buf, 
-              pData->nn - pSeg->iPgidxOff, &pData->p[pSeg->iPgidxOff]
-          );
-        }
-
-        fts5DataRelease(pData);
-        pSeg->pSeg->pgnoFirst = pSeg->iTermLeafPgno;
-        fts5DataDelete(p, FTS5_SEGMENT_ROWID(iId, 1), iLeafRowid);
-        fts5DataWrite(p, iLeafRowid, buf.p, buf.n);
+        if( iOff>pData->szLeaf ){
+          /* This can occur if the pages that the segments occupy overlap - if
+          ** a single page has been assigned to more than one segment. In
+          ** this case a prior iteration of this loop may have corrupted the
+          ** segment currently being trimmed.  */
+          p->rc = FTS5_CORRUPT;
+        }else{
+          fts5BufferZero(&buf);
+          fts5BufferGrow(&p->rc, &buf, pData->nn);
+          fts5BufferAppendBlob(&p->rc, &buf, sizeof(aHdr), aHdr);
+          fts5BufferAppendVarint(&p->rc, &buf, pSeg->term.n);
+          fts5BufferAppendBlob(&p->rc, &buf, pSeg->term.n, pSeg->term.p);
+          fts5BufferAppendBlob(&p->rc, &buf, pData->szLeaf-iOff,&pData->p[iOff]);
+          if( p->rc==SQLITE_OK ){
+            /* Set the szLeaf field */
+            fts5PutU16(&buf.p[2], (u16)buf.n);
+          }
+
+          /* Set up the new page-index array */
+          fts5BufferAppendVarint(&p->rc, &buf, 4);
+          if( pSeg->iLeafPgno==pSeg->iTermLeafPgno 
+              && pSeg->iEndofDoclist<pData->szLeaf 
+            ){
+            int nDiff = pData->szLeaf - pSeg->iEndofDoclist;
+            fts5BufferAppendVarint(&p->rc, &buf, buf.n - 1 - nDiff - 4);
+            fts5BufferAppendBlob(&p->rc, &buf, 
+                pData->nn - pSeg->iPgidxOff, &pData->p[pSeg->iPgidxOff]
+                );
+          }
+
+          pSeg->pSeg->pgnoFirst = pSeg->iTermLeafPgno;
+          fts5DataDelete(p, FTS5_SEGMENT_ROWID(iId, 1), iLeafRowid);
+          fts5DataWrite(p, iLeafRowid, buf.p, buf.n);
+        }
+        fts5DataRelease(pData);
       }
     }
   }
   fts5BufferFree(&buf);
 }
@@ -4251,11 +4272,11 @@
     int nPos;                     /* position-list size field value */
     int nTerm;
     const u8 *pTerm;
 
     pTerm = fts5MultiIterTerm(pIter, &nTerm);
-    if( nTerm!=term.n || memcmp(pTerm, term.p, nTerm) ){
+    if( nTerm!=term.n || fts5Memcmp(pTerm, term.p, nTerm) ){
       if( pnRem && writer.nLeafWritten>nRem ){
         break;
       }
       fts5BufferSet(&p->rc, &term, nTerm, pTerm);
       bTermWritten =0;
@@ -4506,10 +4527,11 @@
       int nDoclist;               /* Size of doclist in bytes */
 
       /* Write the term for this entry to disk. */
       sqlite3Fts5HashScanEntry(pHash, &zTerm, &pDoclist, &nDoclist);
       fts5WriteAppendTerm(p, &writer, (int)strlen(zTerm), (const u8*)zTerm);
+      if( p->rc!=SQLITE_OK ) break;
 
       assert( writer.bFirstRowidInPage==0 );
       if( pgsz>=(pBuf->n + pPgidx->n + nDoclist + 1) ){
         /* The entire doclist will fit on the current leaf. */
         fts5BufferSafeAppendBlob(pBuf, pDoclist, nDoclist);
@@ -4528,10 +4550,11 @@
           if( writer.bFirstRowidInPage ){
             fts5PutU16(&pBuf->p[0], (u16)pBuf->n);   /* first rowid on page */
             pBuf->n += sqlite3Fts5PutVarint(&pBuf->p[pBuf->n], iRowid);
             writer.bFirstRowidInPage = 0;
             fts5WriteDlidxAppend(p, &writer, iRowid);
+            if( p->rc!=SQLITE_OK ) break;
           }else{
             pBuf->n += sqlite3Fts5PutVarint(&pBuf->p[pBuf->n], iDelta);
           }
           assert( pBuf->n<=pBuf->nSpace );
 
@@ -4585,11 +4608,11 @@
       }
 
       /* TODO2: Doclist terminator written here. */
       /* pBuf->p[pBuf->n++] = '\0'; */
       assert( pBuf->n<=pBuf->nSpace );
-      sqlite3Fts5HashScanNext(pHash);
+      if( p->rc==SQLITE_OK ) sqlite3Fts5HashScanNext(pHash);
     }
     sqlite3Fts5HashClear(pHash);
     fts5WriteFinish(p, &writer, &pgnoLast);
 
     /* Update the Fts5Structure. It is written back to the database by the
@@ -4629,11 +4652,11 @@
 static Fts5Structure *fts5IndexOptimizeStruct(
   Fts5Index *p, 
   Fts5Structure *pStruct
 ){
   Fts5Structure *pNew = 0;
-  int nByte = sizeof(Fts5Structure);
+  sqlite3_int64 nByte = sizeof(Fts5Structure);
   int nSeg = pStruct->nSegment;
   int i;
 
   /* Figure out if this structure requires optimization. A structure does
   ** not require optimization if either:
@@ -4759,15 +4782,17 @@
   i64 iDelta,
   Fts5Iter *pMulti,
   Fts5Buffer *pBuf
 ){
   int nData = pMulti->base.nData;
+  int nByte = nData + 9 + 9 + FTS5_DATA_ZERO_PADDING;
   assert( nData>0 );
-  if( p->rc==SQLITE_OK && 0==fts5BufferGrow(&p->rc, pBuf, nData+9+9) ){
+  if( p->rc==SQLITE_OK && 0==fts5BufferGrow(&p->rc, pBuf, nByte) ){
     fts5BufferSafeAppendVarint(pBuf, iDelta);
     fts5BufferSafeAppendVarint(pBuf, nData*2);
     fts5BufferSafeAppendBlob(pBuf, pMulti->base.pData, nData);
+    memset(&pBuf->p[pBuf->n], 0, FTS5_DATA_ZERO_PADDING);
   }
 }
 
 
 static void fts5DoclistIterNext(Fts5DoclistIter *pIter){
@@ -4944,10 +4969,12 @@
         i64 iPos2 = 0;
         int iOff1 = 0;
         int iOff2 = 0;
         u8 *a1 = &i1.aPoslist[i1.nSize];
         u8 *a2 = &i2.aPoslist[i2.nSize];
+        int nCopy;
+        u8 *aCopy;
 
         i64 iPrev = 0;
         Fts5PoslistWriter writer;
         memset(&writer, 0, sizeof(writer));
 
@@ -4975,11 +5002,11 @@
                 sqlite3Fts5PoslistSafeAppend(&tmp, &iPrev, iPos1);
               }
               sqlite3Fts5PoslistNext64(a1, i1.nPoslist, &iOff1, &iPos1);
               if( iPos1<0 ) break;
             }else{
-              assert( iPos2!=iPrev );
+              assert_nc( iPos2!=iPrev );
               sqlite3Fts5PoslistSafeAppend(&tmp, &iPrev, iPos2);
               sqlite3Fts5PoslistNext64(a2, i2.nPoslist, &iOff2, &iPos2);
               if( iPos2<0 ) break;
             }
           }
@@ -4987,22 +5014,28 @@
 
         if( iPos1>=0 ){
           if( iPos1!=iPrev ){
             sqlite3Fts5PoslistSafeAppend(&tmp, &iPrev, iPos1);
           }
-          fts5BufferSafeAppendBlob(&tmp, &a1[iOff1], i1.nPoslist-iOff1);
+          aCopy = &a1[iOff1];
+          nCopy = i1.nPoslist - iOff1;
         }else{
           assert( iPos2>=0 && iPos2!=iPrev );
           sqlite3Fts5PoslistSafeAppend(&tmp, &iPrev, iPos2);
-          fts5BufferSafeAppendBlob(&tmp, &a2[iOff2], i2.nPoslist-iOff2);
+          aCopy = &a2[iOff2];
+          nCopy = i2.nPoslist - iOff2;
+        }
+        if( nCopy>0 ){
+          fts5BufferSafeAppendBlob(&tmp, aCopy, nCopy);
         }
 
         /* WRITEPOSLISTSIZE */
         fts5BufferSafeAppendVarint(&out, tmp.n * 2);
         fts5BufferSafeAppendBlob(&out, tmp.p, tmp.n);
         fts5DoclistIterNext(&i1);
         fts5DoclistIterNext(&i2);
+        assert( out.n<=(p1->n+p2->n+9) );
         if( i1.aPoslist==0 || i2.aPoslist==0 ) break;
       }
     }
 
     if( i1.aPoslist ){
@@ -5100,11 +5133,11 @@
       }
       fts5BufferFree(&aBuf[i]);
     }
     fts5MultiIterFree(p1);
 
-    pData = fts5IdxMalloc(p, sizeof(Fts5Data) + doclist.n);
+    pData = fts5IdxMalloc(p, sizeof(Fts5Data)+doclist.n+FTS5_DATA_ZERO_PADDING);
     if( pData ){
       pData->p = (u8*)&pData[1];
       pData->nn = pData->szLeaf = doclist.n;
       if( doclist.n ) memcpy(pData->p, doclist.p, doclist.n);
       fts5MultiIterNew2(p, pData, bDesc, ppIter);
@@ -5400,11 +5433,11 @@
       sqlite3Fts5IterClose((Fts5IndexIter*)pRet);
       pRet = 0;
       fts5CloseReader(p);
     }
 
-    *ppIter = &pRet->base;
+    *ppIter = (Fts5IndexIter*)pRet;
     sqlite3Fts5BufferFree(&buf);
   }
   return fts5IndexReturn(p);
 }
 
@@ -5862,15 +5895,15 @@
       int nTerm;                  /* Size of term on leaf in bytes */
       int res;                    /* Comparison of term and split-key */
 
       iOff = fts5LeafFirstTermOff(pLeaf);
       iRowidOff = fts5LeafFirstRowidOff(pLeaf);
-      if( iRowidOff>=iOff ){
+      if( iRowidOff>=iOff || iOff>=pLeaf->szLeaf ){
         p->rc = FTS5_CORRUPT;
       }else{
         iOff += fts5GetVarint32(&pLeaf->p[iOff], nTerm);
-        res = memcmp(&pLeaf->p[iOff], zIdxTerm, MIN(nTerm, nIdxTerm));
+        res = fts5Memcmp(&pLeaf->p[iOff], zIdxTerm, MIN(nTerm, nIdxTerm));
         if( res==0 ) res = nTerm - nIdxTerm;
         if( res<0 ) p->rc = FTS5_CORRUPT;
       }
 
       fts5IntegrityCheckPgidx(p, pLeaf);
@@ -6261,11 +6294,11 @@
   int iSegid,iHeight,iPgno,bDlidx;/* Rowid components */
   const u8 *aBlob; int n;         /* Record to decode */
   u8 *a = 0;
   Fts5Buffer s;                   /* Build up text to return here */
   int rc = SQLITE_OK;             /* Return code */
-  int nSpace = 0;
+  sqlite3_int64 nSpace = 0;
   int eDetailNone = (sqlite3_user_data(pCtx)!=0);
 
   assert( nArg==2 );
   UNUSED_PARAM(nArg);
   memset(&s, 0, sizeof(Fts5Buffer));
@@ -6277,12 +6310,11 @@
   n = sqlite3_value_bytes(apVal[1]);
   aBlob = sqlite3_value_blob(apVal[1]);
   nSpace = n + FTS5_DATA_ZERO_PADDING;
   a = (u8*)sqlite3Fts5MallocZero(&rc, nSpace);
   if( a==0 ) goto decode_out;
-  memcpy(a, aBlob, n);
-
+  if( n>0 ) memcpy(a, aBlob, n);
 
   fts5DecodeRowid(iRowid, &iSegid, &bDlidx, &iHeight, &iPgno);
 
   fts5DebugRowid(&rc, &s, iRowid);
   if( bDlidx ){
@@ -6373,10 +6405,13 @@
     }else{
       iRowidOff = fts5GetU16(&a[0]);
       iPgidxOff = szLeaf = fts5GetU16(&a[2]);
       if( iPgidxOff<n ){
         fts5GetVarint32(&a[iPgidxOff], iTermOff);
+      }else if( iPgidxOff>n ){
+        rc = FTS5_CORRUPT;
+        goto decode_out;
       }
     }
 
     /* Decode the position list tail at the start of the page */
     if( iRowidOff!=0 ){
@@ -6384,18 +6419,26 @@
     }else if( iTermOff!=0 ){
       iOff = iTermOff;
     }else{
       iOff = szLeaf;
     }
+    if( iOff>n ){
+      rc = FTS5_CORRUPT;
+      goto decode_out;
+    }
     fts5DecodePoslist(&rc, &s, &a[4], iOff-4);
 
     /* Decode any more doclist data that appears on the page before the
     ** first term. */
     nDoclist = (iTermOff ? iTermOff : szLeaf) - iOff;
+    if( nDoclist+iOff>n ){
+      rc = FTS5_CORRUPT;
+      goto decode_out;
+    }
     fts5DecodeDoclist(&rc, &s, &a[iOff], nDoclist);
 
-    while( iPgidxOff<n ){
+    while( iPgidxOff<n && rc==SQLITE_OK ){
       int bFirst = (iPgidxOff==szLeaf);     /* True for first term on page */
       int nByte;                            /* Bytes of data */
       int iEnd;
       
       iPgidxOff += fts5GetVarint32(&a[iPgidxOff], nByte);
@@ -6406,16 +6449,28 @@
         fts5GetVarint32(&a[iPgidxOff], nByte);
         iEnd = iPgidxPrev + nByte;
       }else{
         iEnd = szLeaf;
       }
+      if( iEnd>szLeaf ){
+        rc = FTS5_CORRUPT;
+        break;
+      }
 
       if( bFirst==0 ){
         iOff += fts5GetVarint32(&a[iOff], nByte);
+        if( nByte>term.n ){
+          rc = FTS5_CORRUPT;
+          break;
+        }
         term.n = nByte;
       }
       iOff += fts5GetVarint32(&a[iOff], nByte);
+      if( iOff+nByte>n ){
+        rc = FTS5_CORRUPT;
+        break;
+      }
       fts5BufferAppendBlob(&rc, &term, nByte, &a[iOff]);
       iOff += nByte;
 
       sqlite3Fts5BufferAppendPrintf(
           &rc, &s, " term=%.*s", term.n, (const char*)term.p

Index: ext/fts5/fts5_main.c
==================================================================
--- ext/fts5/fts5_main.c
+++ ext/fts5/fts5_main.c
@@ -26,12 +26,12 @@
 
 
 typedef struct Fts5Auxdata Fts5Auxdata;
 typedef struct Fts5Auxiliary Fts5Auxiliary;
 typedef struct Fts5Cursor Fts5Cursor;
+typedef struct Fts5FullTable Fts5FullTable;
 typedef struct Fts5Sorter Fts5Sorter;
-typedef struct Fts5Table Fts5Table;
 typedef struct Fts5TokenizerModule Fts5TokenizerModule;
 
 /*
 ** NOTES ON TRANSACTIONS: 
 **
@@ -108,17 +108,12 @@
   fts5_tokenizer x;               /* Tokenizer functions */
   void (*xDestroy)(void*);        /* Destructor function */
   Fts5TokenizerModule *pNext;     /* Next registered tokenizer module */
 };
 
-/*
-** Virtual-table object.
-*/
-struct Fts5Table {
-  sqlite3_vtab base;              /* Base class used by SQLite core */
-  Fts5Config *pConfig;            /* Virtual table configuration */
-  Fts5Index *pIndex;              /* Full-text index */
+struct Fts5FullTable {
+  Fts5Table p;                    /* Public class members from fts5Int.h */
   Fts5Storage *pStorage;          /* Document store */
   Fts5Global *pGlobal;            /* Global (connection wide) data */
   Fts5Cursor *pSortCsr;           /* Sort data from this cursor */
 #ifdef SQLITE_DEBUG
   struct Fts5TransactionState ts;
@@ -252,11 +247,11 @@
 #define FTS5_COMMIT     3
 #define FTS5_ROLLBACK   4
 #define FTS5_SAVEPOINT  5
 #define FTS5_RELEASE    6
 #define FTS5_ROLLBACKTO 7
-static void fts5CheckTransactionState(Fts5Table *p, int op, int iSavepoint){
+static void fts5CheckTransactionState(Fts5FullTable *p, int op, int iSavepoint){
   switch( op ){
     case FTS5_BEGIN:
       assert( p->ts.eState==0 );
       p->ts.eState = 1;
       p->ts.iSavepoint = -1;
@@ -291,11 +286,11 @@
       p->ts.iSavepoint = iSavepoint-1;
       break;
 
     case FTS5_ROLLBACKTO:
       assert( p->ts.eState==1 );
-      assert( iSavepoint>=0 );
+      assert( iSavepoint>=-1 );
       assert( iSavepoint<=p->ts.iSavepoint );
       p->ts.iSavepoint = iSavepoint;
       break;
   }
 }
@@ -304,31 +299,31 @@
 #endif
 
 /*
 ** Return true if pTab is a contentless table.
 */
-static int fts5IsContentless(Fts5Table *pTab){
-  return pTab->pConfig->eContent==FTS5_CONTENT_NONE;
+static int fts5IsContentless(Fts5FullTable *pTab){
+  return pTab->p.pConfig->eContent==FTS5_CONTENT_NONE;
 }
 
 /*
 ** Delete a virtual table handle allocated by fts5InitVtab(). 
 */
-static void fts5FreeVtab(Fts5Table *pTab){
+static void fts5FreeVtab(Fts5FullTable *pTab){
   if( pTab ){
-    sqlite3Fts5IndexClose(pTab->pIndex);
+    sqlite3Fts5IndexClose(pTab->p.pIndex);
     sqlite3Fts5StorageClose(pTab->pStorage);
-    sqlite3Fts5ConfigFree(pTab->pConfig);
+    sqlite3Fts5ConfigFree(pTab->p.pConfig);
     sqlite3_free(pTab);
   }
 }
 
 /*
 ** The xDisconnect() virtual table method.
 */
 static int fts5DisconnectMethod(sqlite3_vtab *pVtab){
-  fts5FreeVtab((Fts5Table*)pVtab);
+  fts5FreeVtab((Fts5FullTable*)pVtab);
   return SQLITE_OK;
 }
 
 /*
 ** The xDestroy() virtual table method.
@@ -335,11 +330,11 @@
 */
 static int fts5DestroyMethod(sqlite3_vtab *pVtab){
   Fts5Table *pTab = (Fts5Table*)pVtab;
   int rc = sqlite3Fts5DropAll(pTab->pConfig);
   if( rc==SQLITE_OK ){
-    fts5FreeVtab((Fts5Table*)pVtab);
+    fts5FreeVtab((Fts5FullTable*)pVtab);
   }
   return rc;
 }
 
 /*
@@ -364,32 +359,32 @@
 ){
   Fts5Global *pGlobal = (Fts5Global*)pAux;
   const char **azConfig = (const char**)argv;
   int rc = SQLITE_OK;             /* Return code */
   Fts5Config *pConfig = 0;        /* Results of parsing argc/argv */
-  Fts5Table *pTab = 0;            /* New virtual table object */
+  Fts5FullTable *pTab = 0;        /* New virtual table object */
 
   /* Allocate the new vtab object and parse the configuration */
-  pTab = (Fts5Table*)sqlite3Fts5MallocZero(&rc, sizeof(Fts5Table));
+  pTab = (Fts5FullTable*)sqlite3Fts5MallocZero(&rc, sizeof(Fts5FullTable));
   if( rc==SQLITE_OK ){
     rc = sqlite3Fts5ConfigParse(pGlobal, db, argc, azConfig, &pConfig, pzErr);
     assert( (rc==SQLITE_OK && *pzErr==0) || pConfig==0 );
   }
   if( rc==SQLITE_OK ){
-    pTab->pConfig = pConfig;
+    pTab->p.pConfig = pConfig;
     pTab->pGlobal = pGlobal;
   }
 
   /* Open the index sub-system */
   if( rc==SQLITE_OK ){
-    rc = sqlite3Fts5IndexOpen(pConfig, bCreate, &pTab->pIndex, pzErr);
+    rc = sqlite3Fts5IndexOpen(pConfig, bCreate, &pTab->p.pIndex, pzErr);
   }
 
   /* Open the storage sub-system */
   if( rc==SQLITE_OK ){
     rc = sqlite3Fts5StorageOpen(
-        pConfig, pTab->pIndex, bCreate, &pTab->pStorage, pzErr
+        pConfig, pTab->p.pIndex, bCreate, &pTab->pStorage, pzErr
     );
   }
 
   /* Call sqlite3_declare_vtab() */
   if( rc==SQLITE_OK ){
@@ -398,12 +393,12 @@
 
   /* Load the initial configuration */
   if( rc==SQLITE_OK ){
     assert( pConfig->pzErrmsg==0 );
     pConfig->pzErrmsg = pzErr;
-    rc = sqlite3Fts5IndexLoadConfig(pTab->pIndex);
-    sqlite3Fts5IndexRollback(pTab->pIndex);
+    rc = sqlite3Fts5IndexLoadConfig(pTab->p.pIndex);
+    sqlite3Fts5IndexRollback(pTab->p.pIndex);
     pConfig->pzErrmsg = 0;
   }
 
   if( rc!=SQLITE_OK ){
     fts5FreeVtab(pTab);
@@ -612,11 +607,11 @@
 
   pInfo->idxNum = idxFlags;
   return SQLITE_OK;
 }
 
-static int fts5NewTransaction(Fts5Table *pTab){
+static int fts5NewTransaction(Fts5FullTable *pTab){
   Fts5Cursor *pCsr;
   for(pCsr=pTab->pGlobal->pCsr; pCsr; pCsr=pCsr->pNext){
     if( pCsr->base.pVtab==(sqlite3_vtab*)pTab ) return SQLITE_OK;
   }
   return sqlite3Fts5StorageReset(pTab->pStorage);
@@ -624,20 +619,20 @@
 
 /*
 ** Implementation of xOpen method.
 */
 static int fts5OpenMethod(sqlite3_vtab *pVTab, sqlite3_vtab_cursor **ppCsr){
-  Fts5Table *pTab = (Fts5Table*)pVTab;
-  Fts5Config *pConfig = pTab->pConfig;
+  Fts5FullTable *pTab = (Fts5FullTable*)pVTab;
+  Fts5Config *pConfig = pTab->p.pConfig;
   Fts5Cursor *pCsr = 0;           /* New cursor object */
-  int nByte;                      /* Bytes of space to allocate */
+  sqlite3_int64 nByte;            /* Bytes of space to allocate */
   int rc;                         /* Return code */
 
   rc = fts5NewTransaction(pTab);
   if( rc==SQLITE_OK ){
     nByte = sizeof(Fts5Cursor) + pConfig->nCol * sizeof(int);
-    pCsr = (Fts5Cursor*)sqlite3_malloc(nByte);
+    pCsr = (Fts5Cursor*)sqlite3_malloc64(nByte);
     if( pCsr ){
       Fts5Global *pGlobal = pTab->pGlobal;
       memset(pCsr, 0, nByte);
       pCsr->aColumnSize = (int*)&pCsr[1];
       pCsr->pNext = pGlobal->pCsr;
@@ -671,11 +666,11 @@
     | FTS5CSR_REQUIRE_POSLIST 
   );
 }
 
 static void fts5FreeCursorComponents(Fts5Cursor *pCsr){
-  Fts5Table *pTab = (Fts5Table*)(pCsr->base.pVtab);
+  Fts5FullTable *pTab = (Fts5FullTable*)(pCsr->base.pVtab);
   Fts5Auxdata *pData;
   Fts5Auxdata *pNext;
 
   sqlite3_free(pCsr->aInstIter);
   sqlite3_free(pCsr->aInst);
@@ -715,11 +710,11 @@
 ** Close the cursor.  For additional information see the documentation
 ** on the xClose method of the virtual table interface.
 */
 static int fts5CloseMethod(sqlite3_vtab_cursor *pCursor){
   if( pCursor ){
-    Fts5Table *pTab = (Fts5Table*)(pCursor->pVtab);
+    Fts5FullTable *pTab = (Fts5FullTable*)(pCursor->pVtab);
     Fts5Cursor *pCsr = (Fts5Cursor*)pCursor;
     Fts5Cursor **pp;
 
     fts5FreeCursorComponents(pCsr);
     /* Remove the cursor from the Fts5Global.pCsr list */
@@ -772,11 +767,11 @@
 
 /*
 ** Set the FTS5CSR_REQUIRE_RESEEK flag on all FTS5_PLAN_MATCH cursors 
 ** open on table pTab.
 */
-static void fts5TripCursors(Fts5Table *pTab){
+static void fts5TripCursors(Fts5FullTable *pTab){
   Fts5Cursor *pCsr;
   for(pCsr=pTab->pGlobal->pCsr; pCsr; pCsr=pCsr->pNext){
     if( pCsr->ePlan==FTS5_PLAN_MATCH
      && pCsr->base.pVtab==(sqlite3_vtab*)pTab 
     ){
@@ -799,15 +794,15 @@
 */
 static int fts5CursorReseek(Fts5Cursor *pCsr, int *pbSkip){
   int rc = SQLITE_OK;
   assert( *pbSkip==0 );
   if( CsrFlagTest(pCsr, FTS5CSR_REQUIRE_RESEEK) ){
-    Fts5Table *pTab = (Fts5Table*)(pCsr->base.pVtab);
+    Fts5FullTable *pTab = (Fts5FullTable*)(pCsr->base.pVtab);
     int bDesc = pCsr->bDesc;
     i64 iRowid = sqlite3Fts5ExprRowid(pCsr->pExpr);
 
-    rc = sqlite3Fts5ExprFirst(pCsr->pExpr, pTab->pIndex, iRowid, bDesc);
+    rc = sqlite3Fts5ExprFirst(pCsr->pExpr, pTab->p.pIndex, iRowid, bDesc);
     if( rc==SQLITE_OK &&  iRowid!=sqlite3Fts5ExprRowid(pCsr->pExpr) ){
       *pbSkip = 1;
     }
 
     CsrFlagClear(pCsr, FTS5CSR_REQUIRE_RESEEK);
@@ -900,22 +895,26 @@
   va_end(ap);
   *ppStmt = pRet;
   return rc;
 } 
 
-static int fts5CursorFirstSorted(Fts5Table *pTab, Fts5Cursor *pCsr, int bDesc){
-  Fts5Config *pConfig = pTab->pConfig;
+static int fts5CursorFirstSorted(
+  Fts5FullTable *pTab, 
+  Fts5Cursor *pCsr, 
+  int bDesc
+){
+  Fts5Config *pConfig = pTab->p.pConfig;
   Fts5Sorter *pSorter;
   int nPhrase;
-  int nByte;
+  sqlite3_int64 nByte;
   int rc;
   const char *zRank = pCsr->zRank;
   const char *zRankArgs = pCsr->zRankArgs;
   
   nPhrase = sqlite3Fts5ExprPhraseCount(pCsr->pExpr);
   nByte = sizeof(Fts5Sorter) + sizeof(int) * (nPhrase-1);
-  pSorter = (Fts5Sorter*)sqlite3_malloc(nByte);
+  pSorter = (Fts5Sorter*)sqlite3_malloc64(nByte);
   if( pSorter==0 ) return SQLITE_NOMEM;
   memset(pSorter, 0, nByte);
   pSorter->nIdx = nPhrase;
 
   /* TODO: It would be better to have some system for reusing statement
@@ -948,14 +947,14 @@
   }
 
   return rc;
 }
 
-static int fts5CursorFirst(Fts5Table *pTab, Fts5Cursor *pCsr, int bDesc){
+static int fts5CursorFirst(Fts5FullTable *pTab, Fts5Cursor *pCsr, int bDesc){
   int rc;
   Fts5Expr *pExpr = pCsr->pExpr;
-  rc = sqlite3Fts5ExprFirst(pExpr, pTab->pIndex, pCsr->iFirstRowid, bDesc);
+  rc = sqlite3Fts5ExprFirst(pExpr, pTab->p.pIndex, pCsr->iFirstRowid, bDesc);
   if( sqlite3Fts5ExprEof(pExpr) ){
     CsrFlagSet(pCsr, FTS5CSR_EOF);
   }
   fts5CsrNewrow(pCsr);
   return rc;
@@ -966,11 +965,11 @@
 ** MATCH expression that begins with a '*' character. The remainder of
 ** the text passed to the MATCH operator are used as  the special query
 ** parameters.
 */
 static int fts5SpecialMatch(
-  Fts5Table *pTab, 
+  Fts5FullTable *pTab, 
   Fts5Cursor *pCsr, 
   const char *zQuery
 ){
   int rc = SQLITE_OK;             /* Return code */
   const char *z = zQuery;         /* Special query text */
@@ -977,22 +976,22 @@
   int n;                          /* Number of bytes in text at z */
 
   while( z[0]==' ' ) z++;
   for(n=0; z[n] && z[n]!=' '; n++);
 
-  assert( pTab->base.zErrMsg==0 );
+  assert( pTab->p.base.zErrMsg==0 );
   pCsr->ePlan = FTS5_PLAN_SPECIAL;
 
   if( 0==sqlite3_strnicmp("reads", z, n) ){
-    pCsr->iSpecial = sqlite3Fts5IndexReads(pTab->pIndex);
+    pCsr->iSpecial = sqlite3Fts5IndexReads(pTab->p.pIndex);
   }
   else if( 0==sqlite3_strnicmp("id", z, n) ){
     pCsr->iSpecial = pCsr->iCsrId;
   }
   else{
     /* An unrecognized directive. Return an error message. */
-    pTab->base.zErrMsg = sqlite3_mprintf("unknown special query: %.*s", n, z);
+    pTab->p.base.zErrMsg = sqlite3_mprintf("unknown special query: %.*s", n, z);
     rc = SQLITE_ERROR;
   }
 
   return rc;
 }
@@ -1000,11 +999,11 @@
 /*
 ** Search for an auxiliary function named zName that can be used with table
 ** pTab. If one is found, return a pointer to the corresponding Fts5Auxiliary
 ** structure. Otherwise, if no such function exists, return NULL.
 */
-static Fts5Auxiliary *fts5FindAuxiliary(Fts5Table *pTab, const char *zName){
+static Fts5Auxiliary *fts5FindAuxiliary(Fts5FullTable *pTab, const char *zName){
   Fts5Auxiliary *pAux;
 
   for(pAux=pTab->pGlobal->pAux; pAux; pAux=pAux->pNext){
     if( sqlite3_stricmp(zName, pAux->zFunc)==0 ) return pAux;
   }
@@ -1013,12 +1012,12 @@
   return 0;
 }
 
 
 static int fts5FindRankFunction(Fts5Cursor *pCsr){
-  Fts5Table *pTab = (Fts5Table*)(pCsr->base.pVtab);
-  Fts5Config *pConfig = pTab->pConfig;
+  Fts5FullTable *pTab = (Fts5FullTable*)(pCsr->base.pVtab);
+  Fts5Config *pConfig = pTab->p.pConfig;
   int rc = SQLITE_OK;
   Fts5Auxiliary *pAux = 0;
   const char *zRank = pCsr->zRank;
   const char *zRankArgs = pCsr->zRankArgs;
 
@@ -1030,11 +1029,11 @@
                               SQLITE_PREPARE_PERSISTENT, &pStmt, 0);
       sqlite3_free(zSql);
       assert( rc==SQLITE_OK || pCsr->pRankArgStmt==0 );
       if( rc==SQLITE_OK ){
         if( SQLITE_ROW==sqlite3_step(pStmt) ){
-          int nByte;
+          sqlite3_int64 nByte;
           pCsr->nRankArg = sqlite3_column_count(pStmt);
           nByte = sizeof(sqlite3_value*)*pCsr->nRankArg;
           pCsr->apRankArg = (sqlite3_value**)sqlite3Fts5MallocZero(&rc, nByte);
           if( rc==SQLITE_OK ){
             int i;
@@ -1052,12 +1051,12 @@
   }
 
   if( rc==SQLITE_OK ){
     pAux = fts5FindAuxiliary(pTab, zRank);
     if( pAux==0 ){
-      assert( pTab->base.zErrMsg==0 );
-      pTab->base.zErrMsg = sqlite3_mprintf("no such function: %s", zRank);
+      assert( pTab->p.base.zErrMsg==0 );
+      pTab->p.base.zErrMsg = sqlite3_mprintf("no such function: %s", zRank);
       rc = SQLITE_ERROR;
     }
   }
 
   pCsr->pRank = pAux;
@@ -1128,12 +1127,12 @@
   int idxNum,                     /* Strategy index */
   const char *zUnused,            /* Unused */
   int nVal,                       /* Number of elements in apVal */
   sqlite3_value **apVal           /* Arguments for the indexing scheme */
 ){
-  Fts5Table *pTab = (Fts5Table*)(pCursor->pVtab);
-  Fts5Config *pConfig = pTab->pConfig;
+  Fts5FullTable *pTab = (Fts5FullTable*)(pCursor->pVtab);
+  Fts5Config *pConfig = pTab->p.pConfig;
   Fts5Cursor *pCsr = (Fts5Cursor*)pCursor;
   int rc = SQLITE_OK;             /* Error code */
   int iVal = 0;                   /* Counter for apVal[] */
   int bDesc;                      /* True if ORDER BY [rank|rowid] DESC */
   int bOrderByRank;               /* True if ORDER BY rank */
@@ -1158,12 +1157,12 @@
   assert( pCsr->csrflags==0 );
   assert( pCsr->pRank==0 );
   assert( pCsr->zRank==0 );
   assert( pCsr->zRankArgs==0 );
 
-  assert( pzErrmsg==0 || pzErrmsg==&pTab->base.zErrMsg );
-  pConfig->pzErrmsg = &pTab->base.zErrMsg;
+  assert( pzErrmsg==0 || pzErrmsg==&pTab->p.base.zErrMsg );
+  pConfig->pzErrmsg = &pTab->p.base.zErrMsg;
 
   /* Decode the arguments passed through to this function.
   **
   ** Note: The following set of if(...) statements must be in the same
   ** order as the corresponding entries in the struct at the top of
@@ -1225,11 +1224,11 @@
         /* The user has issued a query of the form "MATCH '*...'". This
         ** indicates that the MATCH expression is not a full text query,
         ** but a request for an internal parameter.  */
         rc = fts5SpecialMatch(pTab, pCsr, &zExpr[1]);
       }else{
-        char **pzErr = &pTab->base.zErrMsg;
+        char **pzErr = &pTab->p.base.zErrMsg;
         rc = sqlite3Fts5ExprNew(pConfig, iCol, zExpr, &pCsr->pExpr, pzErr);
         if( rc==SQLITE_OK ){
           if( bOrderByRank ){
             pCsr->ePlan = FTS5_PLAN_SORTED_MATCH;
             rc = fts5CursorFirstSorted(pTab, pCsr, bDesc);
@@ -1248,11 +1247,11 @@
   }else{
     /* This is either a full-table scan (ePlan==FTS5_PLAN_SCAN) or a lookup
     ** by rowid (ePlan==FTS5_PLAN_ROWID).  */
     pCsr->ePlan = (pRowidEq ? FTS5_PLAN_ROWID : FTS5_PLAN_SCAN);
     rc = sqlite3Fts5StorageStmt(
-        pTab->pStorage, fts5StmtType(pCsr), &pCsr->pStmt, &pTab->base.zErrMsg
+        pTab->pStorage, fts5StmtType(pCsr), &pCsr->pStmt, &pTab->p.base.zErrMsg
     );
     if( rc==SQLITE_OK ){
       if( pCsr->ePlan==FTS5_PLAN_ROWID ){
         sqlite3_bind_value(pCsr->pStmt, 1, apVal[0]);
       }else{
@@ -1331,16 +1330,16 @@
 static int fts5SeekCursor(Fts5Cursor *pCsr, int bErrormsg){
   int rc = SQLITE_OK;
 
   /* If the cursor does not yet have a statement handle, obtain one now. */ 
   if( pCsr->pStmt==0 ){
-    Fts5Table *pTab = (Fts5Table*)(pCsr->base.pVtab);
+    Fts5FullTable *pTab = (Fts5FullTable*)(pCsr->base.pVtab);
     int eStmt = fts5StmtType(pCsr);
     rc = sqlite3Fts5StorageStmt(
-        pTab->pStorage, eStmt, &pCsr->pStmt, (bErrormsg?&pTab->base.zErrMsg:0)
+        pTab->pStorage, eStmt, &pCsr->pStmt, (bErrormsg?&pTab->p.base.zErrMsg:0)
     );
-    assert( rc!=SQLITE_OK || pTab->base.zErrMsg==0 );
+    assert( rc!=SQLITE_OK || pTab->p.base.zErrMsg==0 );
     assert( CsrFlagTest(pCsr, FTS5CSR_REQUIRE_CONTENT) );
   }
 
   if( rc==SQLITE_OK && CsrFlagTest(pCsr, FTS5CSR_REQUIRE_CONTENT) ){
     assert( pCsr->pExpr );
@@ -1358,15 +1357,15 @@
     }
   }
   return rc;
 }
 
-static void fts5SetVtabError(Fts5Table *p, const char *zFormat, ...){
+static void fts5SetVtabError(Fts5FullTable *p, const char *zFormat, ...){
   va_list ap;                     /* ... printf arguments */
   va_start(ap, zFormat);
-  assert( p->base.zErrMsg==0 );
-  p->base.zErrMsg = sqlite3_vmprintf(zFormat, ap);
+  assert( p->p.base.zErrMsg==0 );
+  p->p.base.zErrMsg = sqlite3_vmprintf(zFormat, ap);
   va_end(ap);
 }
 
 /*
 ** This function is called to handle an FTS INSERT command. In other words,
@@ -1382,15 +1381,15 @@
 ** The commands implemented by this function are documented in the "Special
 ** INSERT Directives" section of the documentation. It should be updated if
 ** more commands are added to this function.
 */
 static int fts5SpecialInsert(
-  Fts5Table *pTab,                /* Fts5 table object */
+  Fts5FullTable *pTab,            /* Fts5 table object */
   const char *zCmd,               /* Text inserted into table-name column */
   sqlite3_value *pVal             /* Value inserted into rank column */
 ){
-  Fts5Config *pConfig = pTab->pConfig;
+  Fts5Config *pConfig = pTab->p.pConfig;
   int rc = SQLITE_OK;
   int bError = 0;
 
   if( 0==sqlite3_stricmp("delete-all", zCmd) ){
     if( pConfig->eContent==FTS5_CONTENT_NORMAL ){
@@ -1421,13 +1420,13 @@
 #ifdef SQLITE_DEBUG
   }else if( 0==sqlite3_stricmp("prefix-index", zCmd) ){
     pConfig->bPrefixIndex = sqlite3_value_int(pVal);
 #endif
   }else{
-    rc = sqlite3Fts5IndexLoadConfig(pTab->pIndex);
+    rc = sqlite3Fts5IndexLoadConfig(pTab->p.pIndex);
     if( rc==SQLITE_OK ){
-      rc = sqlite3Fts5ConfigSetValue(pTab->pConfig, zCmd, pVal, &bError);
+      rc = sqlite3Fts5ConfigSetValue(pTab->p.pConfig, zCmd, pVal, &bError);
     }
     if( rc==SQLITE_OK ){
       if( bError ){
         rc = SQLITE_ERROR;
       }else{
@@ -1437,11 +1436,11 @@
   }
   return rc;
 }
 
 static int fts5SpecialDelete(
-  Fts5Table *pTab, 
+  Fts5FullTable *pTab, 
   sqlite3_value **apVal
 ){
   int rc = SQLITE_OK;
   int eType1 = sqlite3_value_type(apVal[1]);
   if( eType1==SQLITE_INTEGER ){
@@ -1451,11 +1450,11 @@
   return rc;
 }
 
 static void fts5StorageInsert(
   int *pRc, 
-  Fts5Table *pTab, 
+  Fts5FullTable *pTab, 
   sqlite3_value **apVal, 
   i64 *piRowid
 ){
   int rc = *pRc;
   if( rc==SQLITE_OK ){
@@ -1485,26 +1484,25 @@
   sqlite3_vtab *pVtab,            /* Virtual table handle */
   int nArg,                       /* Size of argument array */
   sqlite3_value **apVal,          /* Array of arguments */
   sqlite_int64 *pRowid            /* OUT: The affected (or effected) rowid */
 ){
-  Fts5Table *pTab = (Fts5Table*)pVtab;
-  Fts5Config *pConfig = pTab->pConfig;
+  Fts5FullTable *pTab = (Fts5FullTable*)pVtab;
+  Fts5Config *pConfig = pTab->p.pConfig;
   int eType0;                     /* value_type() of apVal[0] */
   int rc = SQLITE_OK;             /* Return code */
 
   /* A transaction must be open when this is called. */
   assert( pTab->ts.eState==1 );
 
   assert( pVtab->zErrMsg==0 );
   assert( nArg==1 || nArg==(2+pConfig->nCol+2) );
-  assert( nArg==1 
-      || sqlite3_value_type(apVal[1])==SQLITE_INTEGER 
-      || sqlite3_value_type(apVal[1])==SQLITE_NULL 
+  assert( sqlite3_value_type(apVal[0])==SQLITE_INTEGER 
+       || sqlite3_value_type(apVal[0])==SQLITE_NULL 
   );
-  assert( pTab->pConfig->pzErrmsg==0 );
-  pTab->pConfig->pzErrmsg = &pTab->base.zErrMsg;
+  assert( pTab->p.pConfig->pzErrmsg==0 );
+  pTab->p.pConfig->pzErrmsg = &pTab->p.base.zErrMsg;
 
   /* Put any active cursors into REQUIRE_SEEK state. */
   fts5TripCursors(pTab);
 
   eType0 = sqlite3_value_type(apVal[0]);
@@ -1541,11 +1539,11 @@
     assert( nArg!=1 || eType0==SQLITE_INTEGER );
 
     /* Filter out attempts to run UPDATE or DELETE on contentless tables.
     ** This is not suported.  */
     if( eType0==SQLITE_INTEGER && fts5IsContentless(pTab) ){
-      pTab->base.zErrMsg = sqlite3_mprintf(
+      pTab->p.base.zErrMsg = sqlite3_mprintf(
           "cannot %s contentless fts5 table: %s", 
           (nArg>1 ? "UPDATE" : "DELETE from"), pConfig->zName
       );
       rc = SQLITE_ERROR;
     }
@@ -1554,73 +1552,79 @@
     else if( nArg==1 ){
       i64 iDel = sqlite3_value_int64(apVal[0]);  /* Rowid to delete */
       rc = sqlite3Fts5StorageDelete(pTab->pStorage, iDel, 0);
     }
 
-    /* INSERT */
-    else if( eType0!=SQLITE_INTEGER ){     
-      /* If this is a REPLACE, first remove the current entry (if any) */
-      if( eConflict==SQLITE_REPLACE 
-       && sqlite3_value_type(apVal[1])==SQLITE_INTEGER 
-      ){
-        i64 iNew = sqlite3_value_int64(apVal[1]);  /* Rowid to delete */
-        rc = sqlite3Fts5StorageDelete(pTab->pStorage, iNew, 0);
-      }
-      fts5StorageInsert(&rc, pTab, apVal, pRowid);
-    }
-
-    /* UPDATE */
-    else{
-      i64 iOld = sqlite3_value_int64(apVal[0]);  /* Old rowid */
-      i64 iNew = sqlite3_value_int64(apVal[1]);  /* New rowid */
-      if( iOld!=iNew ){
-        if( eConflict==SQLITE_REPLACE ){
-          rc = sqlite3Fts5StorageDelete(pTab->pStorage, iOld, 0);
-          if( rc==SQLITE_OK ){
-            rc = sqlite3Fts5StorageDelete(pTab->pStorage, iNew, 0);
-          }
-          fts5StorageInsert(&rc, pTab, apVal, pRowid);
-        }else{
-          rc = sqlite3Fts5StorageContentInsert(pTab->pStorage, apVal, pRowid);
-          if( rc==SQLITE_OK ){
-            rc = sqlite3Fts5StorageDelete(pTab->pStorage, iOld, 0);
-          }
-          if( rc==SQLITE_OK ){
-            rc = sqlite3Fts5StorageIndexInsert(pTab->pStorage, apVal, *pRowid);
-          }
-        }
-      }else{
-        rc = sqlite3Fts5StorageDelete(pTab->pStorage, iOld, 0);
-        fts5StorageInsert(&rc, pTab, apVal, pRowid);
-      }
-    }
-  }
-
-  pTab->pConfig->pzErrmsg = 0;
+    /* INSERT or UPDATE */
+    else{
+      int eType1 = sqlite3_value_numeric_type(apVal[1]);
+
+      if( eType1!=SQLITE_INTEGER && eType1!=SQLITE_NULL ){
+        rc = SQLITE_MISMATCH;
+      }
+
+      else if( eType0!=SQLITE_INTEGER ){     
+        /* If this is a REPLACE, first remove the current entry (if any) */
+        if( eConflict==SQLITE_REPLACE && eType1==SQLITE_INTEGER ){
+          i64 iNew = sqlite3_value_int64(apVal[1]);  /* Rowid to delete */
+          rc = sqlite3Fts5StorageDelete(pTab->pStorage, iNew, 0);
+        }
+        fts5StorageInsert(&rc, pTab, apVal, pRowid);
+      }
+
+      /* UPDATE */
+      else{
+        i64 iOld = sqlite3_value_int64(apVal[0]);  /* Old rowid */
+        i64 iNew = sqlite3_value_int64(apVal[1]);  /* New rowid */
+        if( eType1==SQLITE_INTEGER && iOld!=iNew ){
+          if( eConflict==SQLITE_REPLACE ){
+            rc = sqlite3Fts5StorageDelete(pTab->pStorage, iOld, 0);
+            if( rc==SQLITE_OK ){
+              rc = sqlite3Fts5StorageDelete(pTab->pStorage, iNew, 0);
+            }
+            fts5StorageInsert(&rc, pTab, apVal, pRowid);
+          }else{
+            rc = sqlite3Fts5StorageContentInsert(pTab->pStorage, apVal, pRowid);
+            if( rc==SQLITE_OK ){
+              rc = sqlite3Fts5StorageDelete(pTab->pStorage, iOld, 0);
+            }
+            if( rc==SQLITE_OK ){
+              rc = sqlite3Fts5StorageIndexInsert(pTab->pStorage, apVal,*pRowid);
+            }
+          }
+        }else{
+          rc = sqlite3Fts5StorageDelete(pTab->pStorage, iOld, 0);
+          fts5StorageInsert(&rc, pTab, apVal, pRowid);
+        }
+      }
+    }
+  }
+
+  pTab->p.pConfig->pzErrmsg = 0;
   return rc;
 }
 
 /*
 ** Implementation of xSync() method. 
 */
 static int fts5SyncMethod(sqlite3_vtab *pVtab){
   int rc;
-  Fts5Table *pTab = (Fts5Table*)pVtab;
+  Fts5FullTable *pTab = (Fts5FullTable*)pVtab;
   fts5CheckTransactionState(pTab, FTS5_SYNC, 0);
-  pTab->pConfig->pzErrmsg = &pTab->base.zErrMsg;
+  pTab->p.pConfig->pzErrmsg = &pTab->p.base.zErrMsg;
   fts5TripCursors(pTab);
   rc = sqlite3Fts5StorageSync(pTab->pStorage);
-  pTab->pConfig->pzErrmsg = 0;
+  pTab->p.pConfig->pzErrmsg = 0;
   return rc;
 }
 
 /*
 ** Implementation of xBegin() method. 
 */
 static int fts5BeginMethod(sqlite3_vtab *pVtab){
-  fts5CheckTransactionState((Fts5Table*)pVtab, FTS5_BEGIN, 0);
-  fts5NewTransaction((Fts5Table*)pVtab);
+  fts5CheckTransactionState((Fts5FullTable*)pVtab, FTS5_BEGIN, 0);
+  fts5NewTransaction((Fts5FullTable*)pVtab);
   return SQLITE_OK;
 }
 
 /*
 ** Implementation of xCommit() method. This is a no-op. The contents of
@@ -1627,21 +1631,21 @@
 ** the pending-terms hash-table have already been flushed into the database
 ** by fts5SyncMethod().
 */
 static int fts5CommitMethod(sqlite3_vtab *pVtab){
   UNUSED_PARAM(pVtab);  /* Call below is a no-op for NDEBUG builds */
-  fts5CheckTransactionState((Fts5Table*)pVtab, FTS5_COMMIT, 0);
+  fts5CheckTransactionState((Fts5FullTable*)pVtab, FTS5_COMMIT, 0);
   return SQLITE_OK;
 }
 
 /*
 ** Implementation of xRollback(). Discard the contents of the pending-terms
 ** hash-table. Any changes made to the database are reverted by SQLite.
 */
 static int fts5RollbackMethod(sqlite3_vtab *pVtab){
   int rc;
-  Fts5Table *pTab = (Fts5Table*)pVtab;
+  Fts5FullTable *pTab = (Fts5FullTable*)pVtab;
   fts5CheckTransactionState(pTab, FTS5_ROLLBACK, 0);
   rc = sqlite3Fts5StorageRollback(pTab->pStorage);
   return rc;
 }
 
@@ -1661,17 +1665,17 @@
   Fts5Context *pCtx, 
   int iCol, 
   sqlite3_int64 *pnToken
 ){
   Fts5Cursor *pCsr = (Fts5Cursor*)pCtx;
-  Fts5Table *pTab = (Fts5Table*)(pCsr->base.pVtab);
+  Fts5FullTable *pTab = (Fts5FullTable*)(pCsr->base.pVtab);
   return sqlite3Fts5StorageSize(pTab->pStorage, iCol, pnToken);
 }
 
 static int fts5ApiRowCount(Fts5Context *pCtx, i64 *pnRow){
   Fts5Cursor *pCsr = (Fts5Cursor*)pCtx;
-  Fts5Table *pTab = (Fts5Table*)(pCsr->base.pVtab);
+  Fts5FullTable *pTab = (Fts5FullTable*)(pCsr->base.pVtab);
   return sqlite3Fts5StorageRowCount(pTab->pStorage, pnRow);
 }
 
 static int fts5ApiTokenize(
   Fts5Context *pCtx, 
@@ -1702,11 +1706,13 @@
   const char **pz, 
   int *pn
 ){
   int rc = SQLITE_OK;
   Fts5Cursor *pCsr = (Fts5Cursor*)pCtx;
-  if( fts5IsContentless((Fts5Table*)(pCsr->base.pVtab)) ){
+  if( fts5IsContentless((Fts5FullTable*)(pCsr->base.pVtab)) 
+   || pCsr->ePlan==FTS5_PLAN_SPECIAL 
+  ){
     *pz = 0;
     *pn = 0;
   }else{
     rc = fts5SeekCursor(pCsr, 0);
     if( rc==SQLITE_OK ){
@@ -1771,14 +1777,15 @@
 */
 static int fts5CacheInstArray(Fts5Cursor *pCsr){
   int rc = SQLITE_OK;
   Fts5PoslistReader *aIter;       /* One iterator for each phrase */
   int nIter;                      /* Number of iterators/phrases */
+  int nCol = ((Fts5Table*)pCsr->base.pVtab)->pConfig->nCol;
   
   nIter = sqlite3Fts5ExprPhraseCount(pCsr->pExpr);
   if( pCsr->aInstIter==0 ){
-    int nByte = sizeof(Fts5PoslistReader) * nIter;
+    sqlite3_int64 nByte = sizeof(Fts5PoslistReader) * nIter;
     pCsr->aInstIter = (Fts5PoslistReader*)sqlite3Fts5MallocZero(&rc, nByte);
   }
   aIter = pCsr->aInstIter;
 
   if( aIter ){
@@ -1809,11 +1816,11 @@
         if( iBest<0 ) break;
 
         nInst++;
         if( nInst>=pCsr->nInstAlloc ){
           pCsr->nInstAlloc = pCsr->nInstAlloc ? pCsr->nInstAlloc*2 : 32;
-          aInst = (int*)sqlite3_realloc(
+          aInst = (int*)sqlite3_realloc64(
               pCsr->aInst, pCsr->nInstAlloc*sizeof(int)*3
               );
           if( aInst ){
             pCsr->aInst = aInst;
           }else{
@@ -1824,10 +1831,14 @@
 
         aInst = &pCsr->aInst[3 * (nInst-1)];
         aInst[0] = iBest;
         aInst[1] = FTS5_POS2COLUMN(aIter[iBest].iPos);
         aInst[2] = FTS5_POS2OFFSET(aIter[iBest].iPos);
+        if( aInst[1]<0 || aInst[1]>=nCol ){
+          rc = FTS5_CORRUPT;
+          break;
+        }
         sqlite3Fts5PoslistReaderNext(&aIter[iBest]);
       }
     }
 
     pCsr->nInstCount = nInst;
@@ -1896,12 +1907,12 @@
   return SQLITE_OK;
 }
 
 static int fts5ApiColumnSize(Fts5Context *pCtx, int iCol, int *pnToken){
   Fts5Cursor *pCsr = (Fts5Cursor*)pCtx;
-  Fts5Table *pTab = (Fts5Table*)(pCsr->base.pVtab);
-  Fts5Config *pConfig = pTab->pConfig;
+  Fts5FullTable *pTab = (Fts5FullTable*)(pCsr->base.pVtab);
+  Fts5Config *pConfig = pTab->p.pConfig;
   int rc = SQLITE_OK;
 
   if( CsrFlagTest(pCsr, FTS5CSR_REQUIRE_DOCSIZE) ){
     if( pConfig->bColumnsize ){
       i64 iRowid = fts5CursorRowid(pCsr);
@@ -2153,11 +2164,11 @@
   int iPhrase, 
   void *pUserData,
   int(*xCallback)(const Fts5ExtensionApi*, Fts5Context*, void*)
 ){
   Fts5Cursor *pCsr = (Fts5Cursor*)pCtx;
-  Fts5Table *pTab = (Fts5Table*)(pCsr->base.pVtab);
+  Fts5FullTable *pTab = (Fts5FullTable*)(pCsr->base.pVtab);
   int rc;
   Fts5Cursor *pNew = 0;
 
   rc = fts5OpenMethod(pCsr->base.pVtab, (sqlite3_vtab_cursor**)&pNew);
   if( rc==SQLITE_OK ){
@@ -2230,29 +2241,23 @@
   }
 }
 
 
 /*
-** Given cursor id iId, return a pointer to the corresponding Fts5Index 
+** Given cursor id iId, return a pointer to the corresponding Fts5Table 
 ** object. Or NULL If the cursor id does not exist.
-**
-** If successful, set *ppConfig to point to the associated config object 
-** before returning.
 */
-Fts5Index *sqlite3Fts5IndexFromCsrid(
+Fts5Table *sqlite3Fts5TableFromCsrid(
   Fts5Global *pGlobal,            /* FTS5 global context for db handle */
-  i64 iCsrId,                     /* Id of cursor to find */
-  Fts5Config **ppConfig           /* OUT: Configuration object */
+  i64 iCsrId                      /* Id of cursor to find */
 ){
   Fts5Cursor *pCsr;
-  Fts5Table *pTab;
-
   pCsr = fts5CursorFromCsrid(pGlobal, iCsrId);
-  pTab = (Fts5Table*)pCsr->base.pVtab;
-  *ppConfig = pTab->pConfig;
-
-  return pTab->pIndex;
+  if( pCsr ){
+    return (Fts5Table*)pCsr->base.pVtab;
+  }
+  return 0;
 }
 
 /*
 ** Return a "position-list blob" corresponding to the current position of
 ** cursor pCsr via sqlite3_result_blob(). A position-list blob contains
@@ -2328,12 +2333,12 @@
 static int fts5ColumnMethod(
   sqlite3_vtab_cursor *pCursor,   /* Cursor to retrieve value from */
   sqlite3_context *pCtx,          /* Context for sqlite3_result_xxx() calls */
   int iCol                        /* Index of column to read value from */
 ){
-  Fts5Table *pTab = (Fts5Table*)(pCursor->pVtab);
-  Fts5Config *pConfig = pTab->pConfig;
+  Fts5FullTable *pTab = (Fts5FullTable*)(pCursor->pVtab);
+  Fts5Config *pConfig = pTab->p.pConfig;
   Fts5Cursor *pCsr = (Fts5Cursor*)pCursor;
   int rc = SQLITE_OK;
   
   assert( CsrFlagTest(pCsr, FTS5CSR_EOF)==0 );
 
@@ -2381,11 +2386,11 @@
   int nUnused,                    /* Number of SQL function arguments */
   const char *zName,              /* Name of SQL function */
   void (**pxFunc)(sqlite3_context*,int,sqlite3_value**), /* OUT: Result */
   void **ppArg                    /* OUT: User data for *pxFunc */
 ){
-  Fts5Table *pTab = (Fts5Table*)pVtab;
+  Fts5FullTable *pTab = (Fts5FullTable*)pVtab;
   Fts5Auxiliary *pAux;
 
   UNUSED_PARAM(nUnused);
   pAux = fts5FindAuxiliary(pTab, zName);
   if( pAux ){
@@ -2403,47 +2408,48 @@
 */
 static int fts5RenameMethod(
   sqlite3_vtab *pVtab,            /* Virtual table handle */
   const char *zName               /* New name of table */
 ){
-  Fts5Table *pTab = (Fts5Table*)pVtab;
+  Fts5FullTable *pTab = (Fts5FullTable*)pVtab;
   return sqlite3Fts5StorageRename(pTab->pStorage, zName);
 }
+
+int sqlite3Fts5FlushToDisk(Fts5Table *pTab){
+  fts5TripCursors((Fts5FullTable*)pTab);
+  return sqlite3Fts5StorageSync(((Fts5FullTable*)pTab)->pStorage);
+}
 
 /*
 ** The xSavepoint() method.
 **
 ** Flush the contents of the pending-terms table to disk.
 */
 static int fts5SavepointMethod(sqlite3_vtab *pVtab, int iSavepoint){
-  Fts5Table *pTab = (Fts5Table*)pVtab;
   UNUSED_PARAM(iSavepoint);  /* Call below is a no-op for NDEBUG builds */
-  fts5CheckTransactionState(pTab, FTS5_SAVEPOINT, iSavepoint);
-  fts5TripCursors(pTab);
-  return sqlite3Fts5StorageSync(pTab->pStorage);
+  fts5CheckTransactionState((Fts5FullTable*)pVtab, FTS5_SAVEPOINT, iSavepoint);
+  return sqlite3Fts5FlushToDisk((Fts5Table*)pVtab);
 }
 
 /*
 ** The xRelease() method.
 **
 ** This is a no-op.
 */
 static int fts5ReleaseMethod(sqlite3_vtab *pVtab, int iSavepoint){
-  Fts5Table *pTab = (Fts5Table*)pVtab;
   UNUSED_PARAM(iSavepoint);  /* Call below is a no-op for NDEBUG builds */
-  fts5CheckTransactionState(pTab, FTS5_RELEASE, iSavepoint);
-  fts5TripCursors(pTab);
-  return sqlite3Fts5StorageSync(pTab->pStorage);
+  fts5CheckTransactionState((Fts5FullTable*)pVtab, FTS5_RELEASE, iSavepoint);
+  return sqlite3Fts5FlushToDisk((Fts5Table*)pVtab);
 }
 
 /*
 ** The xRollbackTo() method.
 **
 ** Discard the contents of the pending terms table.
 */
 static int fts5RollbackToMethod(sqlite3_vtab *pVtab, int iSavepoint){
-  Fts5Table *pTab = (Fts5Table*)pVtab;
+  Fts5FullTable *pTab = (Fts5FullTable*)pVtab;
   UNUSED_PARAM(iSavepoint);  /* Call below is a no-op for NDEBUG builds */
   fts5CheckTransactionState(pTab, FTS5_ROLLBACKTO, iSavepoint);
   fts5TripCursors(pTab);
   return sqlite3Fts5StorageRollback(pTab->pStorage);
 }
@@ -2642,14 +2648,29 @@
 ){
   assert( nArg==0 );
   UNUSED_PARAM2(nArg, apUnused);
   sqlite3_result_text(pCtx, "--FTS5-SOURCE-ID--", -1, SQLITE_TRANSIENT);
 }
+
+/*
+** Return true if zName is the extension on one of the shadow tables used
+** by this module.
+*/
+static int fts5ShadowName(const char *zName){
+  static const char *azName[] = {
+    "config", "content", "data", "docsize", "idx"
+  };
+  unsigned int i;
+  for(i=0; i<sizeof(azName)/sizeof(azName[0]); i++){
+    if( sqlite3_stricmp(zName, azName[i])==0 ) return 1;
+  }
+  return 0;
+}
 
 static int fts5Init(sqlite3 *db){
   static const sqlite3_module fts5Mod = {
-    /* iVersion      */ 2,
+    /* iVersion      */ 3,
     /* xCreate       */ fts5CreateMethod,
     /* xConnect      */ fts5ConnectMethod,
     /* xBestIndex    */ fts5BestIndexMethod,
     /* xDisconnect   */ fts5DisconnectMethod,
     /* xDestroy      */ fts5DestroyMethod,
@@ -2668,10 +2689,11 @@
     /* xFindFunction */ fts5FindFunctionMethod,
     /* xRename       */ fts5RenameMethod,
     /* xSavepoint    */ fts5SavepointMethod,
     /* xRelease      */ fts5ReleaseMethod,
     /* xRollbackTo   */ fts5RollbackToMethod,
+    /* xShadowName   */ fts5ShadowName
   };
 
   int rc;
   Fts5Global *pGlobal = 0;
 

Index: ext/fts5/fts5_storage.c
==================================================================
--- ext/fts5/fts5_storage.c
+++ ext/fts5/fts5_storage.c
@@ -113,11 +113,11 @@
       case FTS5_STMT_REPLACE_CONTENT: {
         int nCol = pC->nCol + 1;
         char *zBind;
         int i;
 
-        zBind = sqlite3_malloc(1 + nCol*2);
+        zBind = sqlite3_malloc64(1 + nCol*2);
         if( zBind ){
           for(i=0; i<nCol; i++){
             zBind[i*2] = '?';
             zBind[i*2 + 1] = ',';
           }
@@ -134,12 +134,13 @@
     }
 
     if( zSql==0 ){
       rc = SQLITE_NOMEM;
     }else{
-      rc = sqlite3_prepare_v3(pC->db, zSql, -1,
-                              SQLITE_PREPARE_PERSISTENT, &p->aStmt[eStmt], 0);
+      int f = SQLITE_PREPARE_PERSISTENT;
+      if( eStmt>FTS5_STMT_LOOKUP ) f |= SQLITE_PREPARE_NO_VTAB;
+      rc = sqlite3_prepare_v3(pC->db, zSql, -1, f, &p->aStmt[eStmt], 0);
       sqlite3_free(zSql);
       if( rc!=SQLITE_OK && pzErrMsg ){
         *pzErrMsg = sqlite3_mprintf("%s", sqlite3_errmsg(pC->db));
       }
     }
@@ -279,15 +280,15 @@
   Fts5Storage **pp,
   char **pzErr                    /* OUT: Error message */
 ){
   int rc = SQLITE_OK;
   Fts5Storage *p;                 /* New object */
-  int nByte;                      /* Bytes of space to allocate */
+  sqlite3_int64 nByte;            /* Bytes of space to allocate */
 
   nByte = sizeof(Fts5Storage)               /* Fts5Storage object */
         + pConfig->nCol * sizeof(i64);      /* Fts5Storage.aTotalSize[] */
-  *pp = p = (Fts5Storage*)sqlite3_malloc(nByte);
+  *pp = p = (Fts5Storage*)sqlite3_malloc64(nByte);
   if( !p ) return SQLITE_NOMEM;
 
   memset(p, 0, nByte);
   p->aTotalSize = (i64*)&p[1];
   p->pConfig = pConfig;
@@ -294,11 +295,11 @@
   p->pIndex = pIndex;
 
   if( bCreate ){
     if( pConfig->eContent==FTS5_CONTENT_NORMAL ){
       int nDefn = 32 + pConfig->nCol*10;
-      char *zDefn = sqlite3_malloc(32 + pConfig->nCol * 10);
+      char *zDefn = sqlite3_malloc64(32 + (sqlite3_int64)pConfig->nCol * 10);
       if( zDefn==0 ){
         rc = SQLITE_NOMEM;
       }else{
         int i;
         int iOff;
@@ -585,11 +586,11 @@
 int sqlite3Fts5StorageRebuild(Fts5Storage *p){
   Fts5Buffer buf = {0,0,0};
   Fts5Config *pConfig = p->pConfig;
   sqlite3_stmt *pScan = 0;
   Fts5InsertCtx ctx;
-  int rc;
+  int rc, rc2;
 
   memset(&ctx, 0, sizeof(Fts5InsertCtx));
   ctx.pStorage = p;
   rc = sqlite3Fts5StorageDeleteAll(p);
   if( rc==SQLITE_OK ){
@@ -624,10 +625,12 @@
     if( rc==SQLITE_OK ){
       rc = fts5StorageInsertDocsize(p, iRowid, &buf);
     }
   }
   sqlite3_free(buf.p);
+  rc2 = sqlite3_reset(pScan);
+  if( rc==SQLITE_OK ) rc = rc2;
 
   /* Write the averages record */
   if( rc==SQLITE_OK ){
     rc = fts5StorageSaveTotals(p);
   }
@@ -873,11 +876,11 @@
   Fts5IntegrityCtx ctx;
   sqlite3_stmt *pScan;
 
   memset(&ctx, 0, sizeof(Fts5IntegrityCtx));
   ctx.pConfig = p->pConfig;
-  aTotalSize = (i64*)sqlite3_malloc(pConfig->nCol * (sizeof(int)+sizeof(i64)));
+  aTotalSize = (i64*)sqlite3_malloc64(pConfig->nCol*(sizeof(int)+sizeof(i64)));
   if( !aTotalSize ) return SQLITE_NOMEM;
   aColSize = (int*)&aTotalSize[pConfig->nCol];
   memset(aTotalSize, 0, sizeof(i64) * pConfig->nCol);
 
   /* Generate the expected index checksum based on the contents of the
@@ -1073,11 +1076,17 @@
 }
 
 int sqlite3Fts5StorageRowCount(Fts5Storage *p, i64 *pnRow){
   int rc = fts5StorageLoadTotals(p, 0);
   if( rc==SQLITE_OK ){
+    /* nTotalRow being zero does not necessarily indicate a corrupt 
+    ** database - it might be that the FTS5 table really does contain zero
+    ** rows. However this function is only called from the xRowCount() API,
+    ** and there is no way for that API to be invoked if the table contains
+    ** no rows. Hence the FTS5_CORRUPT return.  */
     *pnRow = p->nTotalRow;
+    if( p->nTotalRow<=0 ) rc = FTS5_CORRUPT;
   }
   return rc;
 }
 
 /*

Index: ext/fts5/fts5_test_mi.c
==================================================================
--- ext/fts5/fts5_test_mi.c
+++ ext/fts5/fts5_test_mi.c
@@ -307,11 +307,11 @@
   Fts5MatchinfoCtx *p;
   int nCol;
   int nPhrase;
   int i;
   int nInt;
-  int nByte;
+  sqlite3_int64 nByte;
   int rc;
 
   nCol = pApi->xColumnCount(pFts);
   nPhrase = pApi->xPhraseCount(pFts);
 
@@ -328,11 +328,11 @@
   }
 
   nByte = sizeof(Fts5MatchinfoCtx)          /* The struct itself */
          + sizeof(u32) * nInt               /* The p->aRet[] array */
          + (i+1);                           /* The p->zArg string */
-  p = (Fts5MatchinfoCtx*)sqlite3_malloc(nByte);
+  p = (Fts5MatchinfoCtx*)sqlite3_malloc64(nByte);
   if( p==0 ){
     sqlite3_result_error_nomem(pCtx);
     return 0;
   }
   memset(p, 0, nByte);

Index: ext/fts5/fts5_test_tok.c
==================================================================
--- ext/fts5/fts5_test_tok.c
+++ ext/fts5/fts5_test_tok.c
@@ -135,11 +135,11 @@
 
     for(i=0; i<argc; i++){
       nByte += (int)(strlen(argv[i]) + 1);
     }
 
-    *pazDequote = azDequote = sqlite3_malloc(sizeof(char *)*argc + nByte);
+    *pazDequote = azDequote = sqlite3_malloc64(sizeof(char *)*argc + nByte);
     if( azDequote==0 ){
       rc = SQLITE_NOMEM;
     }else{
       char *pSpace = (char *)&azDequote[argc];
       for(i=0; i<argc; i++){
@@ -333,11 +333,11 @@
   Fts5tokRow *pRow;
 
   if( (pCsr->nRow & (pCsr->nRow-1))==0 ){
     int nNew = pCsr->nRow ? pCsr->nRow*2 : 32;
     Fts5tokRow *aNew;
-    aNew = (Fts5tokRow*)sqlite3_realloc(pCsr->aRow, nNew*sizeof(Fts5tokRow));
+    aNew = (Fts5tokRow*)sqlite3_realloc64(pCsr->aRow, nNew*sizeof(Fts5tokRow));
     if( aNew==0 ) return SQLITE_NOMEM;
     memset(&aNew[pCsr->nRow], 0, sizeof(Fts5tokRow)*(nNew-pCsr->nRow));
     pCsr->aRow = aNew;
   }
 
@@ -376,11 +376,11 @@
     int nByte = sqlite3_value_bytes(apVal[0]);
     pCsr->zInput = sqlite3_malloc(nByte+1);
     if( pCsr->zInput==0 ){
       rc = SQLITE_NOMEM;
     }else{
-      memcpy(pCsr->zInput, zByte, nByte);
+      if( nByte>0 ) memcpy(pCsr->zInput, zByte, nByte);
       pCsr->zInput[nByte] = 0;
       rc = pTab->tok.xTokenize(
           pTab->pTok, (void*)pCsr, 0, zByte, nByte, fts5tokCb
       );
     }
@@ -469,14 +469,15 @@
      0,                           /* xRollback     */
      0,                           /* xFindFunction */
      0,                           /* xRename       */
      0,                           /* xSavepoint    */
      0,                           /* xRelease      */
-     0                            /* xRollbackTo   */
+     0,                           /* xRollbackTo   */
+     0                            /* xShadowName   */
   };
   int rc;                         /* Return code */
 
   rc = sqlite3_create_module(db, "fts5tokenize", &fts5tok_module, (void*)pApi);
   return rc;
 }
 
 #endif /* defined(SQLITE_TEST) && defined(SQLITE_ENABLE_FTS5) */

Index: ext/fts5/fts5_tokenize.c
==================================================================
--- ext/fts5/fts5_tokenize.c
+++ ext/fts5/fts5_tokenize.c
@@ -150,11 +150,11 @@
 
     /* Fold to lower case */
     nByte = ie-is;
     if( nByte>nFold ){
       if( pFold!=aFold ) sqlite3_free(pFold);
-      pFold = sqlite3_malloc(nByte*2);
+      pFold = sqlite3_malloc64((sqlite3_int64)nByte*2);
       if( pFold==0 ){
         rc = SQLITE_NOMEM;
         break;
       }
       nFold = nByte*2;
@@ -232,16 +232,21 @@
 typedef struct Unicode61Tokenizer Unicode61Tokenizer;
 struct Unicode61Tokenizer {
   unsigned char aTokenChar[128];  /* ASCII range token characters */
   char *aFold;                    /* Buffer to fold text into */
   int nFold;                      /* Size of aFold[] in bytes */
-  int bRemoveDiacritic;           /* True if remove_diacritics=1 is set */
+  int eRemoveDiacritic;           /* True if remove_diacritics=1 is set */
   int nException;
   int *aiException;
 
   unsigned char aCategory[32];    /* True for token char categories */
 };
+
+/* Values for eRemoveDiacritic (must match internals of fts5_unicode2.c) */
+#define FTS5_REMOVE_DIACRITICS_NONE    0
+#define FTS5_REMOVE_DIACRITICS_SIMPLE  1
+#define FTS5_REMOVE_DIACRITICS_COMPLEX 2
 
 static int fts5UnicodeAddExceptions(
   Unicode61Tokenizer *p,          /* Tokenizer object */
   const char *z,                  /* Characters to treat as exceptions */
   int bTokenChars                 /* 1 for 'tokenchars', 0 for 'separators' */
@@ -249,17 +254,18 @@
   int rc = SQLITE_OK;
   int n = (int)strlen(z);
   int *aNew;
 
   if( n>0 ){
-    aNew = (int*)sqlite3_realloc(p->aiException, (n+p->nException)*sizeof(int));
+    aNew = (int*)sqlite3_realloc64(p->aiException,
+                                   (n+p->nException)*sizeof(int));
     if( aNew ){
       int nNew = p->nException;
       const unsigned char *zCsr = (const unsigned char*)z;
       const unsigned char *zTerm = (const unsigned char*)&z[n];
       while( zCsr<zTerm ){
-        int iCode;
+        u32 iCode;
         int bToken;
         READ_UTF8(zCsr, zTerm, iCode);
         if( iCode<128 ){
           p->aTokenChar[iCode] = (unsigned char)bTokenChars;
         }else{
@@ -267,11 +273,11 @@
           assert( (bToken==0 || bToken==1) ); 
           assert( (bTokenChars==0 || bTokenChars==1) );
           if( bToken!=bTokenChars && sqlite3Fts5UnicodeIsdiacritic(iCode)==0 ){
             int i;
             for(i=0; i<nNew; i++){
-              if( aNew[i]>iCode ) break;
+              if( (u32)aNew[i]>iCode ) break;
             }
             memmove(&aNew[i+1], &aNew[i], (nNew-i)*sizeof(int));
             aNew[i] = iCode;
             nNew++;
           }
@@ -359,11 +365,11 @@
     if( p ){
       const char *zCat = "L* N* Co";
       int i;
       memset(p, 0, sizeof(Unicode61Tokenizer));
 
-      p->bRemoveDiacritic = 1;
+      p->eRemoveDiacritic = FTS5_REMOVE_DIACRITICS_SIMPLE;
       p->nFold = 64;
       p->aFold = sqlite3_malloc(p->nFold * sizeof(char));
       if( p->aFold==0 ){
         rc = SQLITE_NOMEM;
       }
@@ -380,14 +386,19 @@
       }
 
       for(i=0; rc==SQLITE_OK && i<nArg; i+=2){
         const char *zArg = azArg[i+1];
         if( 0==sqlite3_stricmp(azArg[i], "remove_diacritics") ){
-          if( (zArg[0]!='0' && zArg[0]!='1') || zArg[1] ){
+          if( (zArg[0]!='0' && zArg[0]!='1' && zArg[0]!='2') || zArg[1] ){
             rc = SQLITE_ERROR;
+          }else{
+            p->eRemoveDiacritic = (zArg[0] - '0');
+            assert( p->eRemoveDiacritic==FTS5_REMOVE_DIACRITICS_NONE
+                 || p->eRemoveDiacritic==FTS5_REMOVE_DIACRITICS_SIMPLE
+                 || p->eRemoveDiacritic==FTS5_REMOVE_DIACRITICS_COMPLEX
+            );
           }
-          p->bRemoveDiacritic = (zArg[0]=='1');
         }else
         if( 0==sqlite3_stricmp(azArg[i], "tokenchars") ){
           rc = fts5UnicodeAddExceptions(p, zArg, 1);
         }else
         if( 0==sqlite3_stricmp(azArg[i], "separators") ){
@@ -417,11 +428,11 @@
 ** passed as the first argument, codepoint iCode is considered a token 
 ** character (not a separator).
 */
 static int fts5UnicodeIsAlnum(Unicode61Tokenizer *p, int iCode){
   return (
-    p->aCategory[sqlite3Fts5UnicodeCategory(iCode)]
+    p->aCategory[sqlite3Fts5UnicodeCategory((u32)iCode)]
     ^ fts5UnicodeIsException(p, iCode)
   );
 }
 
 static int fts5UnicodeTokenize(
@@ -446,11 +457,11 @@
   UNUSED_PARAM(iUnused);
 
   /* Each iteration of this loop gobbles up a contiguous run of separators,
   ** then the next token.  */
   while( rc==SQLITE_OK ){
-    int iCode;                    /* non-ASCII codepoint read from input */
+    u32 iCode;                    /* non-ASCII codepoint read from input */
     char *zOut = aFold;
     int is;
     int ie;
 
     /* Skip any separator characters. */
@@ -478,11 +489,11 @@
     while( zCsr<zTerm ){
 
       /* Grow the output buffer so that there is sufficient space to fit the
       ** largest possible utf-8 character.  */
       if( zOut>pEnd ){
-        aFold = sqlite3_malloc(nFold*2);
+        aFold = sqlite3_malloc64((sqlite3_int64)nFold*2);
         if( aFold==0 ){
           rc = SQLITE_NOMEM;
           goto tokenize_done;
         }
         zOut = &aFold[zOut - p->aFold];
@@ -497,11 +508,11 @@
         /* An non-ascii-range character. Fold it into the output buffer if
         ** it is a token character, or break out of the loop if it is not. */
         READ_UTF8(zCsr, zTerm, iCode);
         if( fts5UnicodeIsAlnum(p,iCode)||sqlite3Fts5UnicodeIsdiacritic(iCode) ){
  non_ascii_tokenchar:
-          iCode = sqlite3Fts5UnicodeFold(iCode, p->bRemoveDiacritic);
+          iCode = sqlite3Fts5UnicodeFold(iCode, p->eRemoveDiacritic);
           if( iCode ) WRITE_UTF8(zOut, iCode);
         }else{
           break;
         }
       }else if( a[*zCsr]==0 ){
@@ -1272,7 +1283,5 @@
     );
   }
 
   return rc;
 }
-
-

Index: ext/fts5/fts5_unicode2.c
==================================================================
--- ext/fts5/fts5_unicode2.c
+++ ext/fts5/fts5_unicode2.c
@@ -1,7 +1,7 @@
 /*
-** 2012 May 25
+** 2012-05-25
 **
 ** The author disclaims copyright to this source code.  In place of
 ** a legal notice, here is a blessing:
 **
 **    May you do good and not evil.
@@ -26,36 +26,52 @@
 ** of the ASCII letter only. For example, if passed 235 - "LATIN
 ** SMALL LETTER E WITH DIAERESIS" - return 65 ("LATIN SMALL LETTER
 ** E"). The resuls of passing a codepoint that corresponds to an
 ** uppercase letter are undefined.
 */
-static int fts5_remove_diacritic(int c){
+static int fts5_remove_diacritic(int c, int bComplex){
   unsigned short aDia[] = {
         0,  1797,  1848,  1859,  1891,  1928,  1940,  1995, 
      2024,  2040,  2060,  2110,  2168,  2206,  2264,  2286, 
      2344,  2383,  2472,  2488,  2516,  2596,  2668,  2732, 
      2782,  2842,  2894,  2954,  2984,  3000,  3028,  3336, 
-     3456,  3696,  3712,  3728,  3744,  3896,  3912,  3928, 
-     3968,  4008,  4040,  4106,  4138,  4170,  4202,  4234, 
-     4266,  4296,  4312,  4344,  4408,  4424,  4472,  4504, 
-     6148,  6198,  6264,  6280,  6360,  6429,  6505,  6529, 
-    61448, 61468, 61534, 61592, 61642, 61688, 61704, 61726, 
-    61784, 61800, 61836, 61880, 61914, 61948, 61998, 62122, 
-    62154, 62200, 62218, 62302, 62364, 62442, 62478, 62536, 
-    62554, 62584, 62604, 62640, 62648, 62656, 62664, 62730, 
-    62924, 63050, 63082, 63274, 63390, 
+     3456,  3696,  3712,  3728,  3744,  3766,  3832,  3896, 
+     3912,  3928,  3944,  3968,  4008,  4040,  4056,  4106, 
+     4138,  4170,  4202,  4234,  4266,  4296,  4312,  4344, 
+     4408,  4424,  4442,  4472,  4488,  4504,  6148,  6198, 
+     6264,  6280,  6360,  6429,  6505,  6529, 61448, 61468, 
+    61512, 61534, 61592, 61610, 61642, 61672, 61688, 61704, 
+    61726, 61784, 61800, 61816, 61836, 61880, 61896, 61914, 
+    61948, 61998, 62062, 62122, 62154, 62184, 62200, 62218, 
+    62252, 62302, 62364, 62410, 62442, 62478, 62536, 62554, 
+    62584, 62604, 62640, 62648, 62656, 62664, 62730, 62766, 
+    62830, 62890, 62924, 62974, 63032, 63050, 63082, 63118, 
+    63182, 63242, 63274, 63310, 63368, 63390, 
   };
-  char aChar[] = {
-    '\0', 'a',  'c',  'e',  'i',  'n',  'o',  'u',  'y',  'y',  'a',  'c',  
-    'd',  'e',  'e',  'g',  'h',  'i',  'j',  'k',  'l',  'n',  'o',  'r',  
-    's',  't',  'u',  'u',  'w',  'y',  'z',  'o',  'u',  'a',  'i',  'o',  
-    'u',  'g',  'k',  'o',  'j',  'g',  'n',  'a',  'e',  'i',  'o',  'r',  
-    'u',  's',  't',  'h',  'a',  'e',  'o',  'y',  '\0', '\0', '\0', '\0', 
-    '\0', '\0', '\0', '\0', 'a',  'b',  'd',  'd',  'e',  'f',  'g',  'h',  
-    'h',  'i',  'k',  'l',  'l',  'm',  'n',  'p',  'r',  'r',  's',  't',  
-    'u',  'v',  'w',  'w',  'x',  'y',  'z',  'h',  't',  'w',  'y',  'a',  
-    'e',  'i',  'o',  'u',  'y',  
+#define HIBIT ((unsigned char)0x80)
+  unsigned char aChar[] = {
+    '\0',      'a',       'c',       'e',       'i',       'n',       
+    'o',       'u',       'y',       'y',       'a',       'c',       
+    'd',       'e',       'e',       'g',       'h',       'i',       
+    'j',       'k',       'l',       'n',       'o',       'r',       
+    's',       't',       'u',       'u',       'w',       'y',       
+    'z',       'o',       'u',       'a',       'i',       'o',       
+    'u',       'u'|HIBIT, 'a'|HIBIT, 'g',       'k',       'o',       
+    'o'|HIBIT, 'j',       'g',       'n',       'a'|HIBIT, 'a',       
+    'e',       'i',       'o',       'r',       'u',       's',       
+    't',       'h',       'a',       'e',       'o'|HIBIT, 'o',       
+    'o'|HIBIT, 'y',       '\0',      '\0',      '\0',      '\0',      
+    '\0',      '\0',      '\0',      '\0',      'a',       'b',       
+    'c'|HIBIT, 'd',       'd',       'e'|HIBIT, 'e',       'e'|HIBIT, 
+    'f',       'g',       'h',       'h',       'i',       'i'|HIBIT, 
+    'k',       'l',       'l'|HIBIT, 'l',       'm',       'n',       
+    'o'|HIBIT, 'p',       'r',       'r'|HIBIT, 'r',       's',       
+    's'|HIBIT, 't',       'u',       'u'|HIBIT, 'v',       'w',       
+    'w',       'x',       'y',       'z',       'h',       't',       
+    'w',       'y',       'a',       'a'|HIBIT, 'a'|HIBIT, 'a'|HIBIT, 
+    'e',       'e'|HIBIT, 'e'|HIBIT, 'i',       'o',       'o'|HIBIT, 
+    'o'|HIBIT, 'o'|HIBIT, 'u',       'u'|HIBIT, 'u'|HIBIT, 'y',       
   };
 
   unsigned int key = (((unsigned int)c)<<3) | 0x00000007;
   int iRes = 0;
   int iHi = sizeof(aDia)/sizeof(aDia[0]) - 1;
@@ -68,11 +84,12 @@
     }else{
       iHi = iTest-1;
     }
   }
   assert( key>=aDia[iRes] );
-  return ((c > (aDia[iRes]>>3) + (aDia[iRes]&0x07)) ? c : (int)aChar[iRes]);
+  if( bComplex==0 && (aChar[iRes] & 0x80) ) return c;
+  return (c > (aDia[iRes]>>3) + (aDia[iRes]&0x07)) ? c : ((int)aChar[iRes] & 0x7F);
 }
 
 
 /*
 ** Return true if the argument interpreted as a unicode codepoint
@@ -81,12 +98,12 @@
 int sqlite3Fts5UnicodeIsdiacritic(int c){
   unsigned int mask0 = 0x08029FDF;
   unsigned int mask1 = 0x000361F8;
   if( c<768 || c>817 ) return 0;
   return (c < 768+32) ?
-      (mask0 & (1 << (c-768))) :
-      (mask1 & (1 << (c-768-32)));
+      (mask0 & ((unsigned int)1 << (c-768))) :
+      (mask1 & ((unsigned int)1 << (c-768-32)));
 }
 
 
 /*
 ** Interpret the argument as a unicode codepoint. If the codepoint
@@ -95,11 +112,11 @@
 ** Otherwise, return a copy of the argument.
 **
 ** The results are undefined if the value passed to this function
 ** is less than zero.
 */
-int sqlite3Fts5UnicodeFold(int c, int bRemoveDiacritic){
+int sqlite3Fts5UnicodeFold(int c, int eRemoveDiacritic){
   /* Each entry in the following array defines a rule for folding a range
   ** of codepoints to lower case. The rule applies to a range of nRange
   ** codepoints starting at codepoint iCode.
   **
   ** If the least significant bit in flags is clear, then the rule applies
@@ -218,11 +235,13 @@
     if( c<(p->iCode + p->nRange) && 0==(0x01 & p->flags & (p->iCode ^ c)) ){
       ret = (c + (aiOff[p->flags>>1])) & 0x0000FFFF;
       assert( ret>0 );
     }
 
-    if( bRemoveDiacritic ) ret = fts5_remove_diacritic(ret);
+    if( eRemoveDiacritic ){
+      ret = fts5_remove_diacritic(ret, eRemoveDiacritic==2);
+    }
   }
   
   else if( c>=66560 && c<66600 ){
     ret = c + 40;
   }
@@ -229,16 +248,10 @@
 
   return ret;
 }
 
 
-#if 0
-int sqlite3Fts5UnicodeNCat(void) { 
-  return 32;
-}
-#endif
-
 int sqlite3Fts5UnicodeCatParse(const char *zCat, u8 *aArray){ 
   aArray[0] = 1;
   switch( zCat[0] ){
     case 'C':
           switch( zCat[1] ){
@@ -716,11 +729,11 @@
     186,   570,   2042,  58,    5850,  154,   2010,  154,   794,   2266,  
     378,   2266,  3738,  39,    39,    39,    39,    39,    39,    17351, 
     34,    3074,  7692,  63,    63,    
   };
 
-int sqlite3Fts5UnicodeCategory(int iCode) { 
+int sqlite3Fts5UnicodeCategory(u32 iCode) { 
   int iRes = -1;
   int iHi;
   int iLo;
   int ret;
   u16 iKey;
@@ -754,11 +767,10 @@
   int iTbl = 0;
   while( i<128 ){
     int bToken = aArray[ aFts5UnicodeData[iTbl] & 0x1F ];
     int n = (aFts5UnicodeData[iTbl] >> 5) + i;
     for(; i<128 && i<n; i++){
-      aAscii[i] = (u8)bToken;
+      aAscii[i] = bToken;
     }
     iTbl++;
   }
 }
-

Index: ext/fts5/fts5_varint.c
==================================================================
--- ext/fts5/fts5_varint.c
+++ ext/fts5/fts5_varint.c
@@ -74,11 +74,11 @@
   {
     u64 v64;
     u8 n;
     p -= 2;
     n = sqlite3Fts5GetVarint(p, &v64);
-    *v = (u32)v64;
+    *v = ((u32)v64) & 0x7FFFFFFF;
     assert( n>3 && n<=9 );
     return n;
   }
 }
 
@@ -340,6 +340,5 @@
   if( iVal<(1 << 14) ) return 2;
   if( iVal<(1 << 21) ) return 3;
   if( iVal<(1 << 28) ) return 4;
   return 5;
 }
-

Index: ext/fts5/fts5_vocab.c
==================================================================
--- ext/fts5/fts5_vocab.c
+++ ext/fts5/fts5_vocab.c
@@ -53,20 +53,19 @@
 };
 
 struct Fts5VocabCursor {
   sqlite3_vtab_cursor base;
   sqlite3_stmt *pStmt;            /* Statement holding lock on pIndex */
-  Fts5Index *pIndex;              /* Associated FTS5 index */
+  Fts5Table *pFts5;               /* Associated FTS5 table */
 
   int bEof;                       /* True if this cursor is at EOF */
   Fts5IndexIter *pIter;           /* Term/rowid iterator object */
 
   int nLeTerm;                    /* Size of zLeTerm in bytes */
   char *zLeTerm;                  /* (term <= $zLeTerm) paramater, or NULL */
 
   /* These are used by 'col' tables only */
-  Fts5Config *pConfig;            /* Fts5 table configuration */
   int iCol;
   i64 *aCnt;
   i64 *aDoc;
 
   /* Output values used by all tables. */
@@ -325,12 +324,11 @@
 static int fts5VocabOpenMethod(
   sqlite3_vtab *pVTab, 
   sqlite3_vtab_cursor **ppCsr
 ){
   Fts5VocabTable *pTab = (Fts5VocabTable*)pVTab;
-  Fts5Index *pIndex = 0;
-  Fts5Config *pConfig = 0;
+  Fts5Table *pFts5 = 0;
   Fts5VocabCursor *pCsr = 0;
   int rc = SQLITE_OK;
   sqlite3_stmt *pStmt = 0;
   char *zSql = 0;
 
@@ -345,35 +343,38 @@
   assert( rc==SQLITE_OK || pStmt==0 );
   if( rc==SQLITE_ERROR ) rc = SQLITE_OK;
 
   if( pStmt && sqlite3_step(pStmt)==SQLITE_ROW ){
     i64 iId = sqlite3_column_int64(pStmt, 0);
-    pIndex = sqlite3Fts5IndexFromCsrid(pTab->pGlobal, iId, &pConfig);
+    pFts5 = sqlite3Fts5TableFromCsrid(pTab->pGlobal, iId);
   }
 
-  if( rc==SQLITE_OK && pIndex==0 ){
-    rc = sqlite3_finalize(pStmt);
-    pStmt = 0;
-    if( rc==SQLITE_OK ){
-      pVTab->zErrMsg = sqlite3_mprintf(
-          "no such fts5 table: %s.%s", pTab->zFts5Db, pTab->zFts5Tbl
-      );
-      rc = SQLITE_ERROR;
+  if( rc==SQLITE_OK ){
+    if( pFts5==0 ){
+      rc = sqlite3_finalize(pStmt);
+      pStmt = 0;
+      if( rc==SQLITE_OK ){
+        pVTab->zErrMsg = sqlite3_mprintf(
+            "no such fts5 table: %s.%s", pTab->zFts5Db, pTab->zFts5Tbl
+            );
+        rc = SQLITE_ERROR;
+      }
+    }else{
+      rc = sqlite3Fts5FlushToDisk(pFts5);
     }
   }
 
   if( rc==SQLITE_OK ){
-    int nByte = pConfig->nCol * sizeof(i64) * 2 + sizeof(Fts5VocabCursor);
+    int nByte = pFts5->pConfig->nCol * sizeof(i64)*2 + sizeof(Fts5VocabCursor);
     pCsr = (Fts5VocabCursor*)sqlite3Fts5MallocZero(&rc, nByte);
   }
 
   if( pCsr ){
-    pCsr->pIndex = pIndex;
+    pCsr->pFts5 = pFts5;
     pCsr->pStmt = pStmt;
-    pCsr->pConfig = pConfig;
     pCsr->aCnt = (i64*)&pCsr[1];
-    pCsr->aDoc = &pCsr->aCnt[pConfig->nCol];
+    pCsr->aDoc = &pCsr->aCnt[pFts5->pConfig->nCol];
   }else{
     sqlite3_finalize(pStmt);
   }
 
   *ppCsr = (sqlite3_vtab_cursor*)pCsr;
@@ -385,10 +386,11 @@
   sqlite3Fts5IterClose(pCsr->pIter);
   pCsr->pIter = 0;
   sqlite3_free(pCsr->zLeTerm);
   pCsr->nLeTerm = -1;
   pCsr->zLeTerm = 0;
+  pCsr->bEof = 0;
 }
 
 /*
 ** Close the cursor.  For additional information see the documentation
 ** on the xClose method of the virtual table interface.
@@ -423,26 +425,28 @@
   }
   return rc;
 }
 
 static int fts5VocabInstanceNext(Fts5VocabCursor *pCsr){
-  int eDetail = pCsr->pConfig->eDetail;
+  int eDetail = pCsr->pFts5->pConfig->eDetail;
   int rc = SQLITE_OK;
   Fts5IndexIter *pIter = pCsr->pIter;
   i64 *pp = &pCsr->iInstPos;
   int *po = &pCsr->iInstOff;
   
+  assert( sqlite3Fts5IterEof(pIter)==0 );
+  assert( pCsr->bEof==0 );
   while( eDetail==FTS5_DETAIL_NONE
       || sqlite3Fts5PoslistNext64(pIter->pData, pIter->nData, po, pp) 
   ){
     pCsr->iInstPos = 0;
     pCsr->iInstOff = 0;
 
     rc = sqlite3Fts5IterNextScan(pCsr->pIter);
     if( rc==SQLITE_OK ){
       rc = fts5VocabInstanceNewTerm(pCsr);
-      if( eDetail==FTS5_DETAIL_NONE ) break;
+      if( pCsr->bEof || eDetail==FTS5_DETAIL_NONE ) break;
     }
     if( rc ){
       pCsr->bEof = 1;
       break;
     }
@@ -456,11 +460,11 @@
 */
 static int fts5VocabNextMethod(sqlite3_vtab_cursor *pCursor){
   Fts5VocabCursor *pCsr = (Fts5VocabCursor*)pCursor;
   Fts5VocabTable *pTab = (Fts5VocabTable*)pCursor->pVtab;
   int rc = SQLITE_OK;
-  int nCol = pCsr->pConfig->nCol;
+  int nCol = pCsr->pFts5->pConfig->nCol;
 
   pCsr->rowid++;
 
   if( pTab->eType==FTS5_VOCAB_INSTANCE ){
     return fts5VocabInstanceNext(pCsr);
@@ -478,10 +482,11 @@
     }else{
       const char *zTerm;
       int nTerm;
 
       zTerm = sqlite3Fts5IterTerm(pCsr->pIter, &nTerm);
+      assert( nTerm>=0 );
       if( pCsr->nLeTerm>=0 ){
         int nCmp = MIN(nTerm, pCsr->nLeTerm);
         int bCmp = memcmp(pCsr->zLeTerm, zTerm, nCmp);
         if( bCmp<0 || (bCmp==0 && pCsr->nLeTerm<nTerm) ){
           pCsr->bEof = 1;
@@ -494,11 +499,11 @@
       memset(pCsr->aDoc, 0, nCol * sizeof(i64));
       pCsr->iCol = 0;
 
       assert( pTab->eType==FTS5_VOCAB_COL || pTab->eType==FTS5_VOCAB_ROW );
       while( rc==SQLITE_OK ){
-        int eDetail = pCsr->pConfig->eDetail;
+        int eDetail = pCsr->pFts5->pConfig->eDetail;
         const u8 *pPos; int nPos;   /* Position list */
         i64 iPos = 0;               /* 64-bit position read from poslist */
         int iOff = 0;               /* Current offset within position list */
 
         pPos = pCsr->pIter->pData;
@@ -517,19 +522,19 @@
           case FTS5_VOCAB_COL:
             if( eDetail==FTS5_DETAIL_FULL ){
               int iCol = -1;
               while( 0==sqlite3Fts5PoslistNext64(pPos, nPos, &iOff, &iPos) ){
                 int ii = FTS5_POS2COLUMN(iPos);
-                pCsr->aCnt[ii]++;
                 if( iCol!=ii ){
                   if( ii>=nCol ){
                     rc = FTS5_CORRUPT;
                     break;
                   }
                   pCsr->aDoc[ii]++;
                   iCol = ii;
                 }
+                pCsr->aCnt[ii]++;
               }
             }else if( eDetail==FTS5_DETAIL_COLUMNS ){
               while( 0==sqlite3Fts5PoslistNext64(pPos, nPos, &iOff,&iPos) ){
                 assert_nc( iPos>=0 && iPos<nCol );
                 if( iPos>=nCol ){
@@ -554,11 +559,13 @@
         }
         if( pTab->eType==FTS5_VOCAB_INSTANCE ) break;
 
         if( rc==SQLITE_OK ){
           zTerm = sqlite3Fts5IterTerm(pCsr->pIter, &nTerm);
-          if( nTerm!=pCsr->term.n || memcmp(zTerm, pCsr->term.p, nTerm) ){
+          if( nTerm!=pCsr->term.n 
+          || (nTerm>0 && memcmp(zTerm, pCsr->term.p, nTerm)) 
+          ){
             break;
           }
           if( sqlite3Fts5IterEof(pCsr->pIter) ) break;
         }
       }
@@ -565,11 +572,11 @@
     }
   }
 
   if( rc==SQLITE_OK && pCsr->bEof==0 && pTab->eType==FTS5_VOCAB_COL ){
     while( pCsr->aDoc[pCsr->iCol]==0 ) pCsr->iCol++;
-    assert( pCsr->iCol<pCsr->pConfig->nCol );
+    assert( pCsr->iCol<pCsr->pFts5->pConfig->nCol );
   }
   return rc;
 }
 
 /*
@@ -612,10 +619,11 @@
       zTerm = (const char *)sqlite3_value_text(pGe);
       nTerm = sqlite3_value_bytes(pGe);
     }
     if( pLe ){
       const char *zCopy = (const char *)sqlite3_value_text(pLe);
+      if( zCopy==0 ) zCopy = "";
       pCsr->nLeTerm = sqlite3_value_bytes(pLe);
       pCsr->zLeTerm = sqlite3_malloc(pCsr->nLeTerm+1);
       if( pCsr->zLeTerm==0 ){
         rc = SQLITE_NOMEM;
       }else{
@@ -623,18 +631,19 @@
       }
     }
   }
 
   if( rc==SQLITE_OK ){
-    rc = sqlite3Fts5IndexQuery(pCsr->pIndex, zTerm, nTerm, f, 0, &pCsr->pIter);
+    Fts5Index *pIndex = pCsr->pFts5->pIndex;
+    rc = sqlite3Fts5IndexQuery(pIndex, zTerm, nTerm, f, 0, &pCsr->pIter);
   }
   if( rc==SQLITE_OK && eType==FTS5_VOCAB_INSTANCE ){
     rc = fts5VocabInstanceNewTerm(pCsr);
   }
-  if( rc==SQLITE_OK 
-   && !pCsr->bEof 
-   && (eType!=FTS5_VOCAB_INSTANCE || pCsr->pConfig->eDetail!=FTS5_DETAIL_NONE)
+  if( rc==SQLITE_OK && !pCsr->bEof 
+   && (eType!=FTS5_VOCAB_INSTANCE 
+    || pCsr->pFts5->pConfig->eDetail!=FTS5_DETAIL_NONE)
   ){
     rc = fts5VocabNextMethod(pCursor);
   }
 
   return rc;
@@ -653,11 +662,11 @@
   sqlite3_vtab_cursor *pCursor,   /* Cursor to retrieve value from */
   sqlite3_context *pCtx,          /* Context for sqlite3_result_xxx() calls */
   int iCol                        /* Index of column to read value from */
 ){
   Fts5VocabCursor *pCsr = (Fts5VocabCursor*)pCursor;
-  int eDetail = pCsr->pConfig->eDetail;
+  int eDetail = pCsr->pFts5->pConfig->eDetail;
   int eType = ((Fts5VocabTable*)(pCursor->pVtab))->eType;
   i64 iVal = 0;
 
   if( iCol==0 ){
     sqlite3_result_text(
@@ -665,11 +674,11 @@
     );
   }else if( eType==FTS5_VOCAB_COL ){
     assert( iCol==1 || iCol==2 || iCol==3 );
     if( iCol==1 ){
       if( eDetail!=FTS5_DETAIL_NONE ){
-        const char *z = pCsr->pConfig->azCol[pCsr->iCol];
+        const char *z = pCsr->pFts5->pConfig->azCol[pCsr->iCol];
         sqlite3_result_text(pCtx, z, -1, SQLITE_STATIC);
       }
     }else if( iCol==2 ){
       iVal = pCsr->aDoc[pCsr->iCol];
     }else{
@@ -693,12 +702,12 @@
         if( eDetail==FTS5_DETAIL_FULL ){
           ii = FTS5_POS2COLUMN(pCsr->iInstPos);
         }else if( eDetail==FTS5_DETAIL_COLUMNS ){
           ii = (int)pCsr->iInstPos;
         }
-        if( ii>=0 && ii<pCsr->pConfig->nCol ){
-          const char *z = pCsr->pConfig->azCol[ii];
+        if( ii>=0 && ii<pCsr->pFts5->pConfig->nCol ){
+          const char *z = pCsr->pFts5->pConfig->azCol[ii];
           sqlite3_result_text(pCtx, z, -1, SQLITE_STATIC);
         }
         break;
       }
       default: {
@@ -753,12 +762,11 @@
     /* xFindFunction */ 0,
     /* xRename       */ 0,
     /* xSavepoint    */ 0,
     /* xRelease      */ 0,
     /* xRollbackTo   */ 0,
+    /* xShadowName   */ 0
   };
   void *p = (void*)pGlobal;
 
   return sqlite3_create_module_v2(db, "fts5vocab", &fts5Vocab, p, 0);
 }
-
-

Index: ext/fts5/test/fts5aa.test
==================================================================
--- ext/fts5/test/fts5aa.test
+++ ext/fts5/test/fts5aa.test
@@ -36,12 +36,11 @@
 }
 
 do_execsql_test 1.1 {
   DROP TABLE t1;
   SELECT name, sql FROM sqlite_master;
-} {
-}
+} {}
 
 #-------------------------------------------------------------------------
 #
 
 do_execsql_test 2.0 {
@@ -407,10 +406,11 @@
 } {200}
 
 do_execsql_test 15.0 {
   INSERT INTO t1(t1) VALUES('integrity-check');
 }
+sqlite3_db_config db DEFENSIVE 0
 do_execsql_test 15.1 {
   UPDATE t1_content SET c1 = 'xyz xyz xyz xyz xyz abc' WHERE rowid = 1;
 }
 do_catchsql_test 15.2 {
   INSERT INTO t1(t1) VALUES('integrity-check');

Index: ext/fts5/test/fts5ai.test
==================================================================
--- ext/fts5/test/fts5ai.test
+++ ext/fts5/test/fts5ai.test
@@ -49,9 +49,15 @@
 }
 
 do_execsql_test 1.2 {
   INSERT INTO t1(t1) VALUES('integrity-check');
 }
+
+do_execsql_test 1.3 {
+  SAVEPOINT one;
+    INSERT INTO t1 VALUES('v w x');
+  ROLLBACK TO one;
+}
 }
 
 
 finish_test

Index: ext/fts5/test/fts5ak.test
==================================================================
--- ext/fts5/test/fts5ak.test
+++ ext/fts5/test/fts5ak.test
@@ -141,9 +141,17 @@
 } {
   {[a b c] x [c d e]}
   {[a b c] [c d e]}
   {[a b c d e]}
 }
+
+do_execsql_test 3.2 {
+  SELECT highlight(ft, 0, NULL, NULL) FROM ft WHERE ft MATCH 'a+b+c AND c+d+e';
+} {
+  {a b c x c d e}
+  {a b c c d e}
+  {a b c d e}
+}
 
 }
 
 finish_test

ADDED   ext/fts5/test/fts5circref.test
Index: ext/fts5/test/fts5circref.test
==================================================================
--- /dev/null
+++ ext/fts5/test/fts5circref.test
@@ -0,0 +1,80 @@
+# 2018 Dec 22
+#
+# The author disclaims copyright to this source code.  In place of
+# a legal notice, here is a blessing:
+#
+#    May you do good and not evil.
+#    May you find forgiveness for yourself and forgive others.
+#    May you share freely, never taking more than you give.
+#
+#*************************************************************************
+# This file implements regression tests for SQLite library.  The
+# focus of this script is testing the FTS5 module.
+#
+
+source [file join [file dirname [info script]] fts5_common.tcl]
+set testprefix fts5circref
+
+# If SQLITE_ENABLE_FTS5 is not defined, omit this file.
+ifcapable !fts5 {
+  finish_test
+  return
+}
+
+do_execsql_test 1.0 {
+  CREATE VIRTUAL TABLE tt USING fts5(a);
+  SELECT name FROM sqlite_master ORDER BY 1;
+} {
+  tt tt_config tt_content tt_data tt_docsize tt_idx
+}
+db_save_and_close
+
+foreach {tn schema sql} {
+  1 {
+    CREATE TRIGGER tr1 AFTER INSERT ON tt_config BEGIN
+      SELECT * FROM tt;
+    END;
+  } {
+    INSERT INTO tt(tt, rank) VALUES('usermerge', 4);
+  }
+
+  2 {
+    CREATE TRIGGER tr1 AFTER INSERT ON tt_docsize BEGIN
+      SELECT * FROM tt;
+    END;
+  } {
+    INSERT INTO tt(a) VALUES('one two three');
+  }
+
+  3 {
+    CREATE TRIGGER tr1 AFTER INSERT ON tt_content BEGIN
+      SELECT * FROM tt;
+    END;
+  } {
+    INSERT INTO tt(a) VALUES('one two three');
+  }
+
+  4 {
+    CREATE TRIGGER tr1 AFTER INSERT ON tt_data BEGIN
+      SELECT * FROM tt;
+    END;
+  } {
+    INSERT INTO tt(a) VALUES('one two three');
+  }
+
+  5 {
+    CREATE TRIGGER tr1 AFTER INSERT ON tt_idx BEGIN
+      SELECT * FROM tt;
+    END;
+  } {
+    INSERT INTO tt(a) VALUES('one two three');
+  }
+} {
+  db_restore_and_reopen
+  do_execsql_test 1.1.$tn.1 $schema
+  do_catchsql_test 1.1.$tn.2 $sql {1 {SQL logic error}}
+  db close
+}
+
+
+finish_test

Index: ext/fts5/test/fts5connect.test
==================================================================
--- ext/fts5/test/fts5connect.test
+++ ext/fts5/test/fts5connect.test
@@ -242,6 +242,5 @@
     INSERT INTO ft3(ft3) VALUES('integrity-check');
   }
 }
 
 finish_test
-

Index: ext/fts5/test/fts5corrupt.test
==================================================================
--- ext/fts5/test/fts5corrupt.test
+++ ext/fts5/test/fts5corrupt.test
@@ -39,19 +39,21 @@
 db_save
 
 do_execsql_test 1.2 { INSERT INTO t1(t1) VALUES('integrity-check') }
 set segid [lindex [fts5_level_segids t1] 0]
 
+sqlite3_db_config db DEFENSIVE 0
 do_test 1.3 {
   execsql {
     DELETE FROM t1_data WHERE rowid = fts5_rowid('segment', $segid, 4);
   }
   catchsql { INSERT INTO t1(t1) VALUES('integrity-check') }
 } {1 {database disk image is malformed}}
 
 do_test 1.4 {
   db_restore_and_reopen
+  sqlite3_db_config db DEFENSIVE 0
   execsql {
     UPDATE t1_data set block = X'00000000' || substr(block, 5) WHERE
     rowid = fts5_rowid('segment', $segid, 4);
   }
   catchsql { INSERT INTO t1(t1) VALUES('integrity-check') }
@@ -87,12 +89,12 @@
   INSERT INTO t3 VALUES('five o');
 }
 do_execsql_test 3.1 {
   SELECT * FROM t3 WHERE t3 MATCH 'o'
 } {{one o} {three o} {five o}}
-
+sqlite3_db_config db DEFENSIVE 0
 do_catchsql_test 3.1 {
   DELETE FROM t3_content WHERE rowid = 3;
   SELECT * FROM t3 WHERE t3 MATCH 'o';
 } {1 {database disk image is malformed}}
 
 finish_test

Index: ext/fts5/test/fts5corrupt2.test
==================================================================
--- ext/fts5/test/fts5corrupt2.test
+++ ext/fts5/test/fts5corrupt2.test
@@ -97,10 +97,11 @@
 # final leaf to some sizes may create a valid leaf page.
 #
 set lrowid [db one {SELECT max(rowid) FROM t1_data WHERE (rowid & $mask)=0}] 
 set nbyte [db one {SELECT length(block) FROM t1_data WHERE rowid=$lrowid}]
 set all [db eval {SELECT rowid FROM t1}]
+sqlite3_db_config db DEFENSIVE 0
 for {set i [expr $nbyte-2]} {$i>=0} {incr i -1} {
   do_execsql_test 2.$i.1 {
     BEGIN;
       UPDATE t1_data SET block = substr(block, 1, $i) WHERE rowid=$lrowid;
   }
@@ -246,10 +247,11 @@
   }
 }
 
 #--------------------------------------------------------------------
 reset_db
+sqlite3_db_config db DEFENSIVE 0
 do_execsql_test 6.1 {
   CREATE VIRTUAL TABLE x5 USING fts5(tt);
   INSERT INTO x5 VALUES('a');
   INSERT INTO x5 VALUES('a a');
   INSERT INTO x5 VALUES('a a a');

Index: ext/fts5/test/fts5corrupt3.test
==================================================================
--- ext/fts5/test/fts5corrupt3.test
+++ ext/fts5/test/fts5corrupt3.test
@@ -21,10 +21,11 @@
 ifcapable !fts5 {
   finish_test
   return
 }
 sqlite3_fts5_may_be_corrupt 1
+database_may_be_corrupt
 
 proc create_t1 {} {
   expr srand(0)
   db func rnddoc fts5_rnddoc
   db eval {
@@ -33,12 +34,10 @@
     WITH ii(i) AS (SELECT 1 UNION SELECT i+1 FROM ii WHERE i<100)
       INSERT INTO t1 SELECT rnddoc(10) FROM ii;
   }
 }
 
-if 1 {
-
 # Create a simple FTS5 table containing 100 documents. Each document 
 # contains 10 terms, each of which start with the character "x".
 #
 do_test 1.0 { create_t1 } {}
 
@@ -49,10 +48,11 @@
   }]
   set L [db one {SELECT length(block) FROM t1_data WHERE rowid = $rowid}]
   set {} {}
 } {} 
 
+sqlite3_db_config db DEFENSIVE 0
 for {set i 0} {$i < $L} {incr i} {
   do_test 1.2.$i {
     catchsql {
       BEGIN;
       UPDATE t1_data SET block = substr(block, 1, $i) WHERE id = $rowid;
@@ -84,10 +84,11 @@
 #-------------------------------------------------------------------------
 # Test that missing leaf pages are recognized as corruption.
 #
 reset_db
 do_test 3.0 { create_t1 } {}
+sqlite3_db_config db DEFENSIVE 0
 
 do_execsql_test 3.1 {
   SELECT count(*) FROM t1_data;
 } {105}
 
@@ -156,10 +157,11 @@
 
 #-------------------------------------------------------------------------
 # Test that segments that end unexpectedly are identified as corruption.
 #
 reset_db
+sqlite3_db_config db DEFENSIVE 0
 do_test 4.0 {
   execsql { 
     CREATE VIRTUAL TABLE t1 USING fts5(x);
     INSERT INTO t1(t1, rank) VALUES('pgsz', 32);
   }
@@ -180,10 +182,11 @@
   lset var end [expr $end - $i]
   set struct [binary format c* $var]
 
   db close
   sqlite3 db test.db
+  sqlite3_db_config db DEFENSIVE 0
 
   db eval {
     BEGIN;
     UPDATE t1_data SET block = $struct WHERE id=10;
   }
@@ -255,10 +258,11 @@
 }
 
 #------------------------------------------------------------------------
 #
 reset_db
+sqlite3_db_config db DEFENSIVE 0
 do_execsql_test 6.1.0 {
   CREATE VIRTUAL TABLE t1 USING fts5(a);
   INSERT INTO t1 VALUES('bbbbb ccccc');
   SELECT quote(block) FROM t1_data WHERE rowid>100;
 } {X'000000180630626262626201020201056363636363010203040A'}
@@ -271,10 +275,11 @@
   INSERT INTO t1(t1) VALUES('integrity-check');
 } {1 {database disk image is malformed}}
 
 #-------
 reset_db
+sqlite3_db_config db DEFENSIVE 0
 do_execsql_test 6.2.0 {
   CREATE VIRTUAL TABLE t1 USING fts5(a);
   INSERT INTO t1(t1, rank) VALUES('pgsz', 32);
   INSERT INTO t1 VALUES('aa bb cc dd ee');
   SELECT pgno, quote(term) FROM t1_idx;
@@ -286,10 +291,11 @@
   INSERT INTO t1(t1) VALUES('integrity-check');
 } {1 {database disk image is malformed}}
 
 #-------
 reset_db
+sqlite3_db_config db DEFENSIVE 0
 do_execsql_test 6.3.0 {
   CREATE VIRTUAL TABLE t1 USING fts5(a);
   INSERT INTO t1 VALUES('abc abcdef abcdefghi');
   SELECT quote(block) FROM t1_data WHERE id>100;
 }    {X'0000001C043061626301020204036465660102030703676869010204040808'}
@@ -360,10 +366,11 @@
     INSERT INTO t5 VALUES( rnddoc(10000) );
     INSERT INTO t5(t5) VALUES('optimize');
   }
 } {}
 
+sqlite3_db_config db DEFENSIVE 0
 do_test 7.1 {
   foreach i [db eval { SELECT rowid FROM t5_data WHERE rowid>100 }] {
     db eval BEGIN  
     db eval {DELETE FROM t5_data WHERE rowid = $i}
     set r [catchsql { INSERT INTO t5(t5) VALUES('integrity-check')} ]
@@ -370,21 +377,20 @@
     if {$r != "1 {database disk image is malformed}"} { error $r }
     db eval ROLLBACK  
   }
 } {}
 
-}
-
 #------------------------------------------------------------------------
 # Corruption within the structure record.
 #
 reset_db
 do_execsql_test 8.1 {
   CREATE VIRTUAL TABLE t1 USING fts5(x, y);
   INSERT INTO t1 VALUES('one', 'two');
 }
 
+sqlite3_db_config db DEFENSIVE 0
 do_test 9.1.1 {
   set    blob "12345678"    ;# cookie
   append blob "0105"        ;# 1 level, total of 5 segments
   append blob "06"          ;# write counter
   append blob "0002"        ;# first level has 0 segments merging, 2 other.
@@ -404,8 +410,7377 @@
   execsql "REPLACE INTO t1_data VALUES(10, X'$blob')"
 } {}
 do_catchsql_test 9.2.2 {
   SELECT * FROM t1('one AND two');
 } {1 {database disk image is malformed}}
+
+#-------------------------------------------------------------------------
+reset_db
+do_test 10.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 32768 pagesize 4096 filename c9.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 00 00 00 00 07   .....@  ........
+|     32: 00 00 00 00 00 00 00 00 00 00 00 07 00 00 00 04   ................
+|     48: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00   ................
+|     96: 00 00 00 00 0d 00 00 00 07 0d d2 00 0f c4 0f 6d   ...............m
+|    112: 0f 02 0e ab 0e 4e 0d f6 0d d2 00 00 00 00 00 00   .....N..........
+|   3536: 00 00 22 07 06 17 11 11 01 31 74 61 62 6c 65 74   .........1tablet
+|   3552: 32 74 32 07 43 52 45 41 54 45 20 54 41 42 4c 45   2t2.CREATE TABLE
+|   3568: 20 74 32 28 78 29 56 06 06 17 1f 1f 01 7d 74 61    t2(x)V.......ta
+|   3584: 62 6c 65 74 31 5f 63 6f 6e 66 69 67 74 31 5f 63   blet1_configt1_c
+|   3600: 6f 6e 66 69 67 06 43 52 45 41 54 45 20 54 41 42   onfig.CREATE TAB
+|   3616: 4c 45 20 27 74 31 5f 63 6f 6e 66 69 67 27 28 6b   LE 't1_config'(k
+|   3632: 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20 76 29    PRIMARY KEY, v)
+|   3648: 20 57 49 54 48 4f 55 54 20 52 4f 57 49 44 5b 05    WITHOUT ROWID[.
+|   3664: 07 17 21 21 01 81 01 74 61 62 6c 65 74 31 5f 64   ..!!...tablet1_d
+|   3680: 6f 63 73 69 7a 65 74 31 5f 64 6f 63 73 69 7a 65   ocsizet1_docsize
+|   3696: 05 43 52 45 41 54 45 20 54 41 42 4c 45 20 27 74   .CREATE TABLE 't
+|   3712: 31 5f 64 6f 63 73 69 7a 65 27 28 69 64 20 49 4e   1_docsize'(id IN
+|   3728: 54 45 47 45 52 20 50 52 49 4d 41 52 59 20 4b 45   TEGER PRIMARY KE
+|   3744: 59 2c 20 73 7a 20 42 4c 4f 42 29 55 04 06 17 21   Y, sz BLOB)U...!
+|   3760: 21 01 77 74 61 62 6c 65 74 31 5f 63 6f 6e 74 65   !.wtablet1_conte
+|   3776: 6e 74 74 31 5f 63 6f 6e 74 65 6e 74 04 43 52 45   ntt1_content.CRE
+|   3792: 41 54 45 20 54 41 42 4c 45 20 27 74 31 5f 63 6f   ATE TABLE 't1_co
+|   3808: 6e 74 65 6e 74 27 28 69 64 20 49 4e 54 45 47 45   ntent'(id INTEGE
+|   3824: 52 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20 63   R PRIMARY KEY, c
+|   3840: 30 29 69 03 07 17 19 19 01 81 2d 74 61 62 6c 65   0)i.......-table
+|   3856: 74 31 5f 69 64 78 74 31 5f 69 64 78 03 43 52 45   t1_idxt1_idx.CRE
+|   3872: 41 54 45 20 54 41 42 4c 45 20 27 74 31 5f 69 64   ATE TABLE 't1_id
+|   3888: 78 27 28 73 65 67 69 64 2c 20 74 65 72 6d 2c 20   x'(segid, term, 
+|   3904: 70 67 6e 6f 2c 20 50 52 49 4d 41 52 59 20 4b 45   pgno, PRIMARY KE
+|   3920: 59 28 73 65 67 69 64 2c 20 74 65 72 6d 29 29 20   Y(segid, term)) 
+|   3936: 57 49 54 48 4f 55 54 20 52 4f 57 49 44 55 02 07   WITHOUT ROWIDU..
+|   3952: 17 1b 1b 01 81 01 74 61 62 6c 65 74 31 5f 64 61   ......tablet1_da
+|   3968: 74 61 74 31 5f 64 61 74 61 02 43 52 45 41 54 45   tat1_data.CREATE
+|   3984: 20 54 41 42 4c 45 20 27 74 31 5f 64 61 74 61 27    TABLE 't1_data'
+|   4000: 28 69 64 20 49 4e 54 45 47 45 52 20 50 52 49 4d   (id INTEGER PRIM
+|   4016: 41 52 59 20 4b 45 59 2c 20 62 6c 6f 63 6b 20 42   ARY KEY, block B
+|   4032: 4c 4f 42 29 3a 01 06 17 11 11 08 63 74 61 62 6c   LOB):......ctabl
+|   4048: 65 74 31 74 31 43 52 45 41 54 45 20 56 49 52 54   et1t1CREATE VIRT
+|   4064: 55 41 4c 20 54 41 42 4c 45 20 74 31 20 55 53 49   UAL TABLE t1 USI
+|   4080: 4e 47 20 66 74 73 35 28 63 6f 6e 74 65 6e 74 29   NG fts5(content)
+| page 2 offset 4096
+|      0: 0d 00 00 00 03 0f bd 00 0f e8 0f ef 0f bd 00 00   ................
+|   4016: 00 00 00 00 00 00 00 00 00 00 00 00 00 24 84 80   .............$..
+|   4032: 80 80 80 01 03 00 4e 00 00 00 1e 06 30 61 62 61   ......N.....0aba
+|   4048: 63 6b 01 02 02 04 02 66 74 02 06 36 b0 a0 10 21   ck.....ft..6...!
+|   4064: d6 f7 07 46 96 d6 97 a6 05 01 03 00 10 03 03 0f   ...F............
+|   4080: 0a 03 00 24 00 00 00 00 01 01 01 00 01 01 01 01   ...$............
+| page 3 offset 8192
+|      0: 0a 00 00 00 01 0f fa 00 0f fa 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 00 00 00 00 00 00 05 04 09 0c 01 02   ................
+| page 4 offset 12288
+|      0: 0d 00 00 00 03 0f e0 00 0f f6 0f ec 0f e0 00 00   ................
+|   4064: 0a 03 03 00 1b 61 62 61 6e 64 6f 6e 08 02 03 00   .....abandon....
+|   4080: 17 61 62 61 66 74 08 01 03 00 17 61 62 61 63 6b   .abaft.....aback
+| page 5 offset 16384
+|      0: 0d 00 00 00 03 0f ee 00 0f fa 0f f4 0f ee 00 00   ................
+|   4064: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 03   ................
+|   4080: 03 00 0e 01 04 02 03 00 0e 01 04 01 03 00 0e 01   ................
+| page 6 offset 20480
+|      0: 0a 00 00 00 01 0f f4 00 0f f4 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 0b 03 1b 01 76 65 72 73 69 6f 6e 04   ........version.
+| page 7 offset 24576
+|      0: 0d 00 00 00 03 0f d6 00 0f f4 0f e1 0f d6 00 00   ................
+|   4048: 00 00 00 00 00 00 09 03 02 1b 72 65 62 75 69 6c   ..........rebuil
+|   4064: 64 11 02 02 2b 69 6e 74 65 67 72 69 74 79 2d 63   d...+integrity-c
+|   4080: 68 65 62 6c 65 74 31 74 31 43 52 45 41 54 45 20   heblet1t1CREATE 
+| page 8 offset 28672
+|      0: 56 49 52 54 55 41 4c 20 54 41 42 4c 45 20 74 31   VIRTUAL TABLE t1
+|     16: 20 55 53 49 4e 47 20 66 74 73 35 28 63 6f 6e 74    USING fts5(cont
+|     32: 65 6e 74 29 0d 00 00 00 03 0f bd 00 0f e8 0f ef   ent)............
+|     48: 0f bd 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
+| end c9.db
+  }]
+} {}
+do_catchsql_test 10.1 {
+  SELECT * FROM t1 WHERE t1 MATCH 'abandon';
+} {1 {database disk image is malformed}}
+
+#-------------------------------------------------------------------------
+#
+reset_db
+do_test 11.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 28672 pagesize 4096 filename c10b.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 01 00 00 00 07   .....@  ........
+|     32: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00   ................
+|     48: 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00   ................
+|     80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01   ................
+|     96: 00 2e 30 38 0d 00 00 00 07 0d d2 00 0f c4 0f 6d   ..08...........m
+|    112: 0f 02 0e ab 0e 4e 0d f6 0d d2 00 00 00 00 00 00   .....N..........
+|   3536: 00 00 22 07 06 17 11 11 01 31 74 61 62 6c 65 74   .........1tablet
+|   3552: 32 74 32 07 43 52 45 41 54 45 20 54 41 42 4c 45   2t2.CREATE TABLE
+|   3568: 20 74 32 28 78 29 56 06 06 17 1f 1f 01 7d 74 61    t2(x)V.......ta
+|   3584: 62 6c 65 74 31 5f 63 6f 6e 66 69 67 74 31 5f 63   blet1_configt1_c
+|   3600: 6f 6e 66 69 67 06 43 52 45 41 54 45 20 54 41 42   onfig.CREATE TAB
+|   3616: 4c 45 20 27 74 31 5f 63 6f 6e 66 69 67 27 28 6b   LE 't1_config'(k
+|   3632: 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20 76 29    PRIMARY KEY, v)
+|   3648: 20 57 49 54 48 4f 55 54 20 52 4f 57 49 44 5b 05    WITHOUT ROWID[.
+|   3664: 07 17 21 21 01 81 01 74 61 62 6c 65 74 31 5f 64   ..!!...tablet1_d
+|   3680: 6f 63 73 69 7a 65 74 31 5f 64 6f 63 73 69 7a 65   ocsizet1_docsize
+|   3696: 05 43 52 45 41 54 45 20 54 41 42 4c 45 20 27 74   .CREATE TABLE 't
+|   3712: 31 5f 64 6f 63 73 69 7a 65 27 28 69 64 20 49 4e   1_docsize'(id IN
+|   3728: 54 45 47 45 52 20 50 52 49 4d 41 52 59 20 4b 45   TEGER PRIMARY KE
+|   3744: 59 2c 20 73 7a 20 42 4c 4f 42 29 55 04 06 17 21   Y, sz BLOB)U...!
+|   3760: 21 01 77 74 61 62 6c 65 74 31 5f 63 6f 6e 74 65   !.wtablet1_conte
+|   3776: 6e 74 74 31 5f 63 6f 6e 74 65 6e 74 04 43 52 45   ntt1_content.CRE
+|   3792: 41 54 45 20 54 41 42 4c 45 20 27 74 31 5f 63 6f   ATE TABLE 't1_co
+|   3808: 6e 74 65 6e 74 27 28 69 64 20 49 4e 54 45 47 45   ntent'(id INTEGE
+|   3824: 52 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20 63   R PRIMARY KEY, c
+|   3840: 30 29 69 03 07 17 19 19 01 81 2d 74 61 62 6c 65   0)i.......-table
+|   3856: 74 31 5f 69 64 78 74 31 5f 69 64 78 03 43 52 45   t1_idxt1_idx.CRE
+|   3872: 41 54 45 20 54 41 42 4c 45 20 27 74 31 5f 69 64   ATE TABLE 't1_id
+|   3888: 78 27 28 73 65 67 69 64 2c 20 74 65 72 6d 2c 20   x'(segid, term, 
+|   3904: 70 67 6e 6f 2c 20 50 52 49 4d 41 52 59 20 4b 45   pgno, PRIMARY KE
+|   3920: 59 28 73 65 67 69 64 2c 20 74 65 72 6d 29 29 20   Y(segid, term)) 
+|   3936: 57 49 54 48 4f 55 54 20 52 4f 57 49 44 55 02 07   WITHOUT ROWIDU..
+|   3952: 17 1b 1b 01 81 01 74 61 62 6c 65 74 31 5f 64 61   ......tablet1_da
+|   3968: 74 61 74 31 5f 64 61 74 61 02 43 52 45 41 54 45   tat1_data.CREATE
+|   3984: 20 54 41 42 4c 45 20 27 74 31 5f 64 61 74 61 27    TABLE 't1_data'
+|   4000: 28 69 64 20 49 4e 54 45 47 45 52 20 50 52 44 d9   (id INTEGER PRD.
+|   4016: 41 52 59 20 4b 45 59 2c 20 62 6c 6f 63 6b 20 42   ARY KEY, block B
+|   4032: 4c 4f 42 29 3a 01 06 17 11 11 08 63 74 61 62 6c   LOB):......ctabl
+|   4048: 65 74 31 74 31 43 52 45 41 54 45 20 56 49 52 54   et1t1CREATE VIRT
+|   4064: 55 41 4c 20 54 41 42 4c 45 20 74 31 20 55 53 49   UAL TABLE t1 USI
+|   4080: 4e 47 20 66 74 73 35 28 63 6f 6e 74 65 6e 74 29   NG fts5(content)
+| page 2 offset 4096
+|      0: 0d 00 00 00 06 0f 59 00 0f e8 0f ef 0f bd 0f b0   ......Y.........
+|     16: 0f 73 0f 59 00 00 00 00 00 00 00 00 00 00 00 00   .s.Y............
+|   3920: 00 00 00 00 00 00 00 00 00 13 84 80 80 80 80 04   ................
+|   3936: 03 01 2a 0a 00 00 00 00 01 02 02 00 02 01 01 01   ..*.............
+|   3952: 02 01 01 36 84 80 80 80 80 03 03 05 66 00 40 00   ...6........f.@.
+|   3968: 00 00 01 00 00 00 29 07 30 61 63 74 69 76 65 04   ......).0active.
+|   3984: 02 02 02 03 74 6f 6d 06 02 02 05 02 69 63 07 02   ....tom.....ic..
+|   4000: 02 01 06 62 6f 6f 6d 65 72 05 02 02 04 0b 08 07   ...boomer.......
+|   4016: 06 84 80 80 80 80 02 03 01 10 01 07 07 24 84 80   .............$..
+|   4032: 80 80 80 01 03 00 4e 00 00 00 1e 06 30 61 62 61   ......N.....0aba
+|   4048: 63 6b 01 02 02 04 02 66 74 02 02 02 04 04 6e 64   ck.....ft.....nd
+|   4064: 6f 6e 03 02 02 04 0a 07 05 01 03 00 10 03 03 0f   on..............
+|   4080: 0a 03 00 24 00 00 00 00 01 01 01 00 01 01 01 01   ...$............
+| page 3 offset 8192
+|      0: 0a 00 00 00 02 0f f3 00 0f fa 0f f3 00 00 00 00   ................
+|   4080: 00 00 00 06 04 01 0c 01 02 02 05 04 09 0c 01 02   ................
+| page 4 offset 12288
+|      0: 0d 00 00 00 07 0f b6 00 0f f6 0f ec 0f e0 0f d5   ................
+|     16: 0f ca 0f c1 0f b6 00 00 00 00 00 00 00 00 00 00   ................
+|   4016: 00 00 00 00 00 00 09 07 03 00 19 61 74 6f 6d 69   ...........atomi
+|   4032: 63 07 06 03 00 15 61 74 6f 6d 09 05 03 00 19 62   c.....atom.....b
+|   4048: 6f 6f 6d 65 72 09 04 03 00 19 61 63 74 69 76 65   oomer.....active
+|   4064: 0a 03 03 00 1b 61 62 61 6e 64 6f 6e 08 02 03 00   .....abandon....
+|   4080: 17 61 62 61 66 74 08 01 03 00 17 61 62 61 63 6b   .abaft.....aback
+| page 5 offset 16384
+|      0: 0d 00 00 00 07 0f d6 00 0f fa 0f f4 0f ee 0f e8   ................
+|     16: 0f e2 0f dc 0f d6 00 00 00 00 00 00 00 00 00 00   ................
+|   4048: 00 00 00 00 00 00 04 07 03 00 0e 01 04 06 03 00   ................
+|   4064: 0e 01 04 05 03 00 0e 01 04 04 03 00 0e 01 04 03   ................
+|   4080: 03 00 0e 01 04 02 03 00 0e 01 04 01 03 00 0e 01   ................
+| page 6 offset 20480
+|      0: 0a 00 00 00 01 0f f4 00 0f f4 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 0b 03 1b 01 76 65 72 73 69 6f 6e 04   ........version.
+| page 7 offset 24576
+|      0: 0d 00 00 00 03 0f d6 00 0f f4 0f e1 0f d6 00 00   ................
+|   4048: 00 00 00 00 00 00 09 03 02 1b 72 65 62 75 69 6c   ..........rebuil
+|   4064: 64 11 02 02 2b 69 6e 74 65 67 72 69 74 79 2d 63   d...+integrity-c
+|   4080: 68 65 63 6b 0a 01 02 1d 6f 70 74 69 6d 69 7a 65   heck....optimize
+| end c10b.db
+}]} {}
+
+# This returns SQLITE_CONSTRAINT instead of SQLITE_CORRUPT. The problem is
+# that the corrupted structure-record leads fts5 to try to use a segment-id
+# that is already in use. This is caught by the PRIMARY KEY constraint on
+# the %_idx table.
+#
+do_catchsql_test 11.1 {
+  UPDATE t1 SET content='abc' WHERE content='boomer';
+} {1 {constraint failed}}
+
+#-------------------------------------------------------------------------
+#
+reset_db
+do_test 12.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 28672 pagesize 4096 filename c2.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 00 00 00 00 07   .....@  ........
+|     32: 00 00 00 00 00 00 00 00 00 00 00 07 00 00 00 00   ................
+|     48: 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00   ................
+|     96: 00 00 00 00 0d 00 00 00 07 0d d2 00 0f c4 0f 6d   ...............m
+|    112: 0f 02 0e ab 0e 4e 0d f6 0d d2 00 00 00 00 00 00   .....N..........
+|   3536: 00 00 22 07 06 17 11 11 01 31 74 61 62 6c 65 74   .........1tablet
+|   3552: 32 74 32 07 43 52 45 41 54 45 20 54 41 42 4c 45   2t2.CREATE TABLE
+|   3568: 20 74 32 28 78 29 56 06 06 17 1f 1f 01 7d 74 61    t2(x)V.......ta
+|   3584: 62 6c 65 74 31 5f 63 6f 6e 66 69 67 74 31 5f 63   blet1_configt1_c
+|   3600: 6f 6e 66 69 67 06 43 52 45 41 54 45 20 54 41 42   onfig.CREATE TAB
+|   3616: 4c 45 20 27 74 31 5f 63 6f 6e 66 69 67 27 28 6b   LE 't1_config'(k
+|   3632: 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20 76 29    PRIMARY KEY, v)
+|   3648: 20 57 49 54 48 4f 55 54 20 52 4f 57 49 44 5b 05    WITHOUT ROWID[.
+|   3664: 07 17 21 21 01 81 01 74 61 62 6c 65 74 31 5f 64   ..!!...tablet1_d
+|   3680: 6f 63 73 69 7a 65 74 31 5f 64 6f 63 73 69 7a 65   ocsizet1_docsize
+|   3696: 05 43 52 45 41 54 45 20 54 41 42 4c 45 20 27 74   .CREATE TABLE 't
+|   3712: 31 5f 64 6f 63 73 69 7a 65 27 28 69 64 20 49 4e   1_docsize'(id IN
+|   3728: 54 45 47 45 52 20 50 52 49 4d 41 52 59 20 4b 45   TEGER PRIMARY KE
+|   3744: 59 2c 20 73 7a 20 42 4c 4f 42 29 55 04 06 17 21   Y, sz BLOB)U...!
+|   3760: 21 01 77 74 61 62 6c 65 74 31 5f 63 6f 6e 74 65   !.wtablet1_conte
+|   3776: 6e 74 74 31 5f 63 6f 6e 74 65 6e 74 04 43 52 45   ntt1_content.CRE
+|   3792: 41 54 45 20 54 41 42 4c 45 20 27 74 31 5f 63 6f   ATE TABLE 't1_co
+|   3808: 6e 74 65 6e 74 27 28 69 64 20 49 4e 54 45 47 45   ntent'(id INTEGE
+|   3824: 52 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20 63   R PRIMARY KEY, c
+|   3840: 30 29 69 03 07 17 19 19 01 81 2d 74 61 62 6c 65   0)i.......-table
+|   3856: 74 31 5f 69 64 78 74 31 5f 69 64 78 03 43 52 45   t1_idxt1_idx.CRE
+|   3872: 41 54 45 20 54 41 42 4c 45 20 27 74 31 5f 69 64   ATE TABLE 't1_id
+|   3888: 78 27 28 73 65 67 69 64 2c 20 74 65 72 6d 2c 20   x'(segid, term, 
+|   3904: 70 67 6e 6f 2c 20 50 52 49 4d 41 52 59 20 4b 45   pgno, PRIMARY KE
+|   3920: 59 28 73 65 67 69 64 2c 20 74 65 72 6d 29 29 20   Y(segid, term)) 
+|   3936: 57 49 54 48 4f 55 54 20 52 4f 57 49 44 55 02 07   WITHOUT ROWIDU..
+|   3952: 17 1b 1b 01 81 01 74 61 62 6c 65 74 31 5f 64 61   ......tablet1_da
+|   3968: 74 61 74 31 5f 64 61 74 61 02 43 52 45 41 54 45   tat1_data.CREATE
+|   3984: 20 54 41 42 4c 45 20 27 74 31 5f 64 61 74 61 27    TABLE 't1_data'
+|   4000: 28 69 64 20 49 4e 54 45 47 45 52 20 50 52 49 4d   (id INTEGER PRIM
+|   4016: 41 52 59 20 4b 45 59 2c 20 62 6c 6f 63 6b 20 42   ARY KEY, block B
+|   4032: 4c 4f 42 29 3a 01 06 17 11 11 08 63 74 61 62 6c   LOB):......ctabl
+|   4048: 65 74 31 74 31 43 52 45 41 54 45 20 56 49 52 54   et1t1CREATE VIRT
+|   4064: 55 41 4c 20 54 41 42 4c 45 20 74 31 20 55 53 49   UAL TABLE t1 USI
+|   4080: 4e 47 20 66 74 73 35 28 63 6f 6e 74 65 6e 74 29   NG fts5(content)
+| page 2 offset 4096
+|      0: 0d 00 00 00 03 0f bd 00 0f d8 0f ef 0f bd 00 00   ................
+|   4016: 00 00 00 00 00 00 00 00 00 00 00 00 00 24 84 80   .............$..
+|   4032: 80 80 80 01 03 00 4e 00 00 00 1e 06 30 61 62 61   ......N.....0aba
+|   4048: 63 6b 01 02 02 04 02 66 74 02 02 02 04 04 6e 64   ck.....ft.....nd
+|   4064: 6f 6e 03 02 02 04 0a 07 05 01 03 00 10 03 03 0f   on..............
+|   4080: 0a 03 00 24 00 00 00 00 01 01 01 20 01 01 01 01   ...$....... ....
+| page 3 offset 8192
+|      0: 0a 00 00 00 01 0f fa 00 0f fa 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 00 00 00 00 00 00 05 04 09 0c 01 02   ................
+| page 4 offset 12288
+|      0: 0d 00 00 00 03 0f e0 00 0f f6 0f ec 0f e0 3f e0   ..............?.
+|     16: a0 30 30 01 b6 16 26 16 e6 46 f6 e0 80 20 30 01   .00...&..F... 0.
+|     32: 76 16 26 16 67 40 80 10 30 01 76 16 26 16 36 b0   v.&.g@..0.v.&.6.
+|     48: d0 00 00 00 30 fe e0 00 ff a0 ff 40 fe 00 00 00   ....0......@....
+| page 5 offset 16384
+|   4064: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 03   ................
+|   4080: 03 00 0e 01 04 02 03 00 0e 01 04 01 03 00 0e 01   ................
+| page 6 offset 20480
+|      0: 0a 00 00 00 01 0f f4 00 0f f4 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 0b 03 1b 01 76 65 72 73 69 6f 6e 04   ........version.
+| page 7 offset 24576
+|      0: 0d 00 00 00 03 0f d6 00 0f f4 0f e1 0f d6 00 00   ................
+|   4048: 00 00 00 00 00 00 09 03 02 1b 72 65 62 75 69 6c   ..........rebuil
+|   4064: 64 11 02 02 2b 69 6e 74 65 67 72 69 74 79 2d 63   d...+integrity-c
+|   4080: 68 65 63 6b 0a 01 02 1d 6f 70 74 69 6d 69 7a 65   heck....optimize
+| end c2.db
+}]} {}
+
+do_catchsql_test 11.1 {
+  SELECT * FROM t1 WHERE t1 MATCH 'abandon';
+} {1 {vtable constructor failed: t1}}
+
+do_catchsql_test 11.2 {
+  INSERT INTO t1(t1, rank) VALUES('merge', 500);
+} {1 {vtable constructor failed: t1}}
+
+#-------------------------------------------------------------------------
+#
+reset_db
+do_test 13.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 28672 pagesize 4096 filename c13.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 00 00 00 00 07   .....@  ........
+|     32: 00 00 00 00 00 00 00 00 00 00 00 07 00 00 00 04   ................
+|     48: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00   ................
+|     96: 00 00 00 00 0d 00 00 00 07 0d d2 00 0f c4 0f 6d   ...............m
+|    112: 0f 02 0e ab 0e 4e 0d f6 0d d2 00 00 00 00 00 00   .....N..........
+|   3536: 00 00 22 07 06 17 11 11 01 31 74 61 62 6c 65 74   .........1tablet
+|   3552: 32 74 32 07 43 52 45 41 54 45 20 54 41 42 4c 45   2t2.CREATE TABLE
+|   3568: 20 74 32 28 78 29 56 06 06 17 1f 1f 01 7d 74 61    t2(x)V.......ta
+|   3584: 62 6c 65 74 31 5f 63 6f 6e 66 69 67 74 31 5f 63   blet1_configt1_c
+|   3600: 6f 6e 66 69 67 06 43 52 45 41 54 45 20 54 41 42   onfig.CREATE TAB
+|   3616: 4c 45 20 27 74 31 5f 63 6f 6e 66 69 67 27 28 6b   LE 't1_config'(k
+|   3632: 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20 76 29    PRIMARY KEY, v)
+|   3648: 20 57 49 54 48 4f 55 54 20 52 4f 57 49 44 5b 05    WITHOUT ROWID[.
+|   3664: 07 17 21 21 01 81 01 74 61 62 6c 65 74 31 5f 64   ..!!...tablet1_d
+|   3680: 6f 63 73 69 7a 65 74 31 5f 64 6f 63 73 69 7a 65   ocsizet1_docsize
+|   3696: 05 43 52 45 41 54 45 20 54 41 42 4c 45 20 27 74   .CREATE TABLE 't
+|   3712: 31 5f 64 6f 63 73 69 7a 65 27 28 69 64 20 49 4e   1_docsize'(id IN
+|   3728: 54 45 47 45 52 20 50 52 49 4d 41 52 59 20 4b 45   TEGER PRIMARY KE
+|   3744: 59 2c 20 73 7a 20 42 4c 4f 42 29 55 04 06 17 21   Y, sz BLOB)U...!
+|   3760: 21 01 77 74 61 62 6c 65 74 31 5f 63 6f 6e 74 65   !.wtablet1_conte
+|   3776: 6e 74 74 31 5f 63 6f 6e 74 65 6e 74 04 43 52 45   ntt1_content.CRE
+|   3792: 41 54 45 20 54 41 42 4c 45 20 27 74 31 5f 63 6f   ATE TABLE 't1_co
+|   3808: 6e 74 65 6e 74 27 28 69 64 20 49 4e 54 45 47 45   ntent'(id INTEGE
+|   3824: 52 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20 63   R PRIMARY KEY, c
+|   3840: 30 29 69 03 07 17 19 19 01 81 2d 74 61 62 6c 65   0)i.......-table
+|   3856: 74 31 5f 69 64 78 74 31 5f 69 64 78 03 43 52 45   t1_idxt1_idx.CRE
+|   3872: 41 54 45 20 54 41 42 4c 45 20 27 74 31 4f 69 64   ATE TABLE 't1Oid
+|   3888: 78 27 28 73 65 67 69 64 2c 20 74 65 72 6d 2c 20   x'(segid, term, 
+|   3904: 70 67 6e 6f 2c 20 50 52 49 4d 41 52 59 20 4b 45   pgno, PRIMARY KE
+|   3920: 59 28 73 65 67 69 64 2c 20 74 65 72 6d 29 29 20   Y(segid, term)) 
+|   3936: 57 49 54 48 4f 55 54 20 52 4f 57 49 44 55 02 07   WITHOUT ROWIDU..
+|   3952: 17 1b 1b 01 81 01 74 61 62 6c 65 74 31 5f 64 61   ......tablet1_da
+|   3968: 74 61 74 31 5f 64 61 74 61 02 43 52 45 41 54 45   tat1_data.CREATE
+|   3984: 20 54 41 42 4c 45 20 27 74 31 5f 64 61 74 61 27    TABLE 't1_data'
+|   4000: 28 69 64 20 49 4e 54 45 47 45 52 20 50 52 49 4d   (id INTEGER PRIM
+|   4016: 41 52 59 20 4b 45 59 2c 20 62 6c 6f 63 6b 20 42   ARY KEY, block B
+|   4032: 4c 4f 42 29 3a 01 06 17 11 11 08 63 74 61 62 6c   LOB):......ctabl
+|   4048: 65 74 31 74 31 43 52 45 41 54 45 20 56 49 52 54   et1t1CREATE VIRT
+|   4064: 55 41 4c 20 54 41 42 4c 45 20 74 31 20 55 53 49   UAL TABLE t1 USI
+|   4080: 4e 47 20 66 74 73 35 28 63 6f 6e 74 65 6e 74 29   NG fts5(content)
+| page 2 offset 4096
+|      0: 0d 00 00 00 03 0f bd 00 0f e8 0f ef 0f bd 00 00   ................
+|   4016: 00 00 00 00 00 00 00 00 00 00 00 00 00 24 84 80   .............$..
+|   4032: 80 80 80 01 03 00 4e 00 00 00 1e 06 30 61 62 61   ......N.....0aba
+|   4048: 63 6b 01 02 02 04 02 66 74 02 02 02 04 04 6e 64   ck.....ft.....nd
+|   4064: 6f 6e 03 02 02 04 0a 07 05 01 03 00 10 03 03 0f   on..............
+|   4080: 0a 03 00 24 00 eb 00 00 00 01 01 01 00 01 01 01   ...$............
+| page 3 offset 8192
+|      0: 01 0a 00 00 00 01 0f fa 00 0f fa 00 00 00 00 00   ................
+|   4080: 00 00 00 00 00 00 00 00 00 00 05 04 09 0c 01 02   ................
+| page 4 offset 12288
+|      0: 0d 00 00 00 03 0f e0 00 0f f6 0f ec 0f e0 00 00   ................
+|   4064: 0a 03 03 00 1b 61 62 61 6e 64 6f 6e 08 02 03 00   .....abandon....
+|   4080: 17 61 62 61 66 74 08 01 03 00 17 61 62 61 63 6b   .abaft.....aback
+| page 5 offset 16384
+|      0: 0d 00 00 00 03 0f ee 00 0f fa 0f f2 0f ee 00 00   ................
+|   4064: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 03   ................
+|   4080: 03 00 0e 01 04 02 03 00 0e 01 04 01 03 00 0e 01   ................
+| page 6 offset 20480
+|      0: 0a 00 00 00 01 0f f4 00 0f f4 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 0b 03 1b 01 76 65 72 73 69 6f 6e 04   ........version.
+| page 7 offset 24576
+|      0: 0d 00 00 00 03 0f d6 00 0f f4 0f e1 0f d6 00 00   ................
+|   4048: 00 00 00 00 00 00 09 03 02 1b 72 65 62 75 69 6c   ..........rebuil
+|   4064: 64 11 02 02 2b 69 6e 74 65 67 72 69 74 79 2d 63   d...+integrity-c
+|   4080: 68 65 63 6b 0a 01 02 1d 6f 70 74 69 6d 69 7a 65   heck....optimize
+| end c13.db
+SELECT * FROM t1 WHERE t1 MATCH 'abandon';
+}]} {}
+
+do_catchsql_test 13.1 {
+  SELECT * FROM t1 WHERE t1 MATCH 'abandon'; 
+} {1 {vtable constructor failed: t1}}
+
+#-------------------------------------------------------------------------
+reset_db
+do_test 14.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 28672 pagesize 4096 filename c14b.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 01 00 00 00 07   .....@  ........
+|     32: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00   ................
+|     48: 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00   ................
+|     80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01   ................
+|     96: 00 2e 30 38 0d 00 00 00 07 0d d2 00 0f c4 0f 6d   ..08...........m
+|    112: 0f 02 0e ab 0e 4e 0d f6 0d d2 00 00 00 00 00 00   .....N..........
+|   3536: 00 00 22 07 06 17 11 11 01 31 74 61 62 6c 65 74   .........1tablet
+|   3552: 32 74 32 07 43 52 45 41 54 45 20 54 41 42 4c 45   2t2.CREATE TABLE
+|   3568: 20 74 32 28 78 29 56 06 06 17 1f 1f 01 7d 74 61    t2(x)V.......ta
+|   3584: 62 6c 65 74 31 5f 63 6f 6e 66 69 67 74 31 5f 63   blet1_configt1_c
+|   3600: 6f 6e 66 69 67 06 43 52 45 41 54 45 20 54 41 42   onfig.CREATE TAB
+|   3616: 4c 45 20 27 74 31 5f 63 6f 6e 66 69 67 27 28 6b   LE 't1_config'(k
+|   3632: 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20 76 29    PRIMARY KEY, v)
+|   3648: 20 57 49 54 48 4f 55 54 20 52 4f 57 49 44 5b 05    WITHOUT ROWID[.
+|   3664: 07 17 21 21 01 81 01 74 61 62 6c 65 74 31 5f 64   ..!!...tablet1_d
+|   3680: 6f 63 73 69 7a 65 74 31 5f 64 6f 63 73 69 7a 65   ocsizet1_docsize
+|   3696: 05 43 52 45 41 54 45 20 54 41 42 4c 45 20 27 74   .CREATE TABLE 't
+|   3712: 31 5f 64 6f 63 73 69 7a 65 27 28 69 64 20 49 4e   1_docsize'(id IN
+|   3728: 54 45 47 45 52 20 50 52 49 4d 41 52 59 20 4b 45   TEGER PRIMARY KE
+|   3744: 59 2c 20 73 7a 20 42 4c 4f 42 29 55 04 06 17 21   Y, sz BLOB)U...!
+|   3760: 21 01 77 74 61 62 6c 65 74 31 5f 63 6f 6e 74 65   !.wtablet1_conte
+|   3776: 6e 74 74 31 5f 63 6f 6e 74 65 6e 74 04 43 52 45   ntt1_content.CRE
+|   3792: 41 54 45 20 54 41 42 4c 45 20 27 74 31 5f 63 6f   ATE TABLE 't1_co
+|   3808: 6e 74 65 6e 74 27 28 69 64 20 49 4e 54 45 47 45   ntent'(id INTEGE
+|   3824: 52 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20 63   R PRIMARY KEY, c
+|   3840: 30 29 69 03 07 17 19 19 01 81 2d 74 61 62 6c 65   0)i.......-table
+|   3856: 74 31 5f 69 64 78 74 31 5f 69 64 78 03 43 52 45   t1_idxt1_idx.CRE
+|   3872: 41 54 45 20 54 41 42 4c 45 20 27 74 31 5f 69 64   ATE TABLE 't1_id
+|   3888: 78 27 28 73 65 67 69 64 2c 20 74 65 72 6d 2c 20   x'(segid, term, 
+|   3904: 70 67 6e 6f 2c 20 50 52 49 4d 41 52 59 20 4b 45   pgno, PRIMARY KE
+|   3920: 59 28 73 65 67 69 64 2c 20 74 65 72 6d 29 29 20   Y(segid, term)) 
+|   3936: 57 49 54 48 4f 55 54 20 52 4f 57 49 44 55 02 07   WITHOUT ROWIDU..
+|   3952: 17 1b 1b 01 81 01 74 61 62 6c 65 74 31 5f 64 61   ......tablet1_da
+|   3968: 74 61 74 31 5f 64 61 74 61 02 43 52 45 41 54 45   tat1_data.CREATE
+|   3984: 20 54 41 42 4c 45 20 27 74 31 5f 64 61 74 61 27    TABLE 't1_data'
+|   4000: 28 69 64 20 49 4e 54 45 47 45 52 20 50 52 49 4d   (id INTEGER PRIM
+|   4016: 41 52 59 20 4b 45 59 2c 20 62 6c 6f 63 6b 20 42   ARY KEY, block B
+|   4032: 4c 4f 42 29 3a 01 06 17 11 11 08 63 74 61 62 6c   LOB):......ctabl
+|   4048: 65 74 31 74 31 43 52 45 41 54 45 20 56 49 52 54   et1t1CREATE VIRT
+|   4064: 55 41 4c 20 54 41 42 4c 45 20 74 31 20 55 53 49   UAL TABLE t1 USI
+|   4080: 4e 47 20 66 74 73 35 28 63 6f 6e 74 65 6e 74 29   NG fts5(content)
+| page 2 offset 4096
+|      0: 0d 0f ef 00 04 0f 18 00 0f e8 0f 18 0f bd 0f 2c   ...............,
+|   3856: 00 00 00 00 00 00 00 00 12 0a 03 00 2a 00 00 00   ............*...
+|   3872: 00 01 02 02 00 02 01 01 01 02 01 01 81 09 88 80   ................
+|   3888: 80 80 80 01 04 00 82 16 00 00 00 79 06 30 61 62   ...........y.0ab
+|   3904: 61 63 6b 08 02 07 04 04 6e 64 6f 6e 08 02 05 02   ack.....ndon....
+|   3920: 05 63 74 69 76 65 04 02 02 04 02 0b 02 04 6c 70   .ctive........lp
+|   3936: 68 61 08 04 02 0a 02 03 74 6b 6d 06 02 02 03 02   ha......tkm.....
+|   3952: 6f 6d 08 02 09 05 02 69 63 07 02 02 01 06 62 61   om.....ic.....ba
+|   3968: 63 6b 75 70 08 02 04 02 05 6f 6f 6d 65 72 05 02   ckup.....oomer..
+|   3984: 02 01 0c 63 68 61 6e 6e 65 62 6f 6f 6d 65 72 08   ...channeboomer.
+|   4000: 02 08 07 01 6c 08 02 03 01 04 74 65 73 74 08 02   ....l.....test..
+|   4016: 06 04 0a 09 0d 0a 08 07 07 0b 0a 11 06 24 84 80   .............$..
+|   4032: 80 80 80 01 03 00 4e 00 00 00 1e 06 30 61 62 61   ......N.....0aba
+|   4048: 63 6b 01 02 02 04 02 66 74 02 02 02 04 04 6e 64   ck.....ft.....nd
+|   4064: 6f 6e 03 02 02 03 9a 07 05 01 03 00 10 08 11 00   on..............
+|   4080: 00 00 11 24 00 00 00 00 01 01 01 00 01 01 01 01   ...$............
+| page 3 offset 8192
+|      0: 0a 00 00 00 02 0f f3 00 0f fa 0f f3 00 00 00 00   ................
+|   4080: 00 00 00 06 04 01 0c 01 02 02 05 04 09 0c 01 02   ................
+| page 4 offset 12288
+|      0: 0d 00 00 00 08 0f 6a 00 0f f6 0f ec 0f e0 0f d5   ......j.........
+|     16: 0f ca 0f c1 0f b6 0f 6a 00 00 00 00 00 00 00 00   .......j........
+|   3936: 00 00 00 00 00 00 00 00 00 00 4a 08 04 00 81 19   ..........J.....
+|   3952: 61 6c 70 68 61 20 63 68 61 6e 6e 65 6c 20 62 61   alpha channel ba
+|   3968: 63 6b 75 70 20 61 62 61 6e 64 6f 6e 20 74 65 73   ckup abandon tes
+|   3984: 74 20 61 62 61 63 6b 20 63 68 61 6e 6e 65 62 6f   t aback channebo
+|   4000: 6f 6d 65 72 20 61 74 6f 6d 20 61 6c 70 68 61 20   omer atom alpha 
+|   4016: 61 63 74 69 76 65 09 07 03 00 19 61 74 6f 6d 69   active.....atomi
+|   4032: 63 07 06 03 00 15 61 74 6b 6d 09 05 03 00 19 62   c.....atkm.....b
+|   4048: 6f 6f 6d 65 72 09 04 03 00 19 61 63 74 69 76 65   oomer.....active
+|   4064: 0a 03 03 00 1b 61 62 61 6e 64 6f 6e 08 02 03 00   .....abandon....
+|   4080: 17 61 62 61 66 74 08 01 03 00 17 61 62 61 63 6b   .abaft.....aback
+| page 5 offset 16384
+|      0: 0d 00 00 00 08 0f d0 00 0f fa 0f f4 0f ee 0f e8   ................
+|     16: 0f e2 0f dc 0f d6 0f d0 00 00 00 00 00 00 00 00   ................
+|   4048: 04 08 03 00 0e 0a 04 07 03 00 0e 01 04 06 03 00   ................
+|   4064: 0e 01 04 05 03 00 0e 01 04 04 03 00 0e 01 04 03   ................
+|   4080: 03 00 0e 01 04 02 03 00 0e 01 04 01 03 00 0e 01   ................
+| page 6 offset 20480
+|      0: 0a 00 00 00 01 0f f4 00 0f f4 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 0b 03 1b 01 76 65 72 73 69 6f 6e 04   ........version.
+| page 7 offset 24576
+|      0: 0d 00 00 00 03 0f d6 00 0f f4 0f e1 0f d6 00 00   ................
+|   4048: 00 00 00 00 00 00 09 03 02 1b 72 65 62 75 69 6c   ..........rebuil
+|   4064: 64 11 02 02 2b 69 6e 74 65 67 72 69 74 79 2d 63   d...+integrity-c
+|   4080: 68 65 63 6b 0a 01 02 1d 6f 70 74 69 6d 69 7a 65   heck....optimize
+| end c14b.db
+}]} {}
+
+do_catchsql_test 14.1 {
+  INSERT INTO t1(t1) VALUES('optimize');
+} {1 {database disk image is malformed}}
+
+#---------------------------------------------------------------------------
+#
+reset_db
+do_test 15.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 32768 pagesize 4096 filename c16.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 00 00 00 00 07   .....@  ........
+|     32: 00 00 00 00 00 00 00 00 00 00 00 07 00 00 00 00   ................
+|     48: 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00   ................
+|     96: 00 00 00 00 0d 00 00 00 07 0d d2 00 0f c4 0f 6d   ...............m
+|    112: 0f 02 0e ab 0e 4e 0d f6 0d d2 00 00 00 00 00 00   .....N..........
+|   3536: 00 00 22 07 06 17 11 11 01 31 74 61 62 6c 65 74   .........1tablet
+|   3552: 32 74 32 07 43 52 45 41 54 45 20 54 41 42 4c 45   2t2.CREATE TABLE
+|   3568: 20 74 32 28 78 29 56 06 06 17 1f 1f 01 7d 74 61    t2(x)V.......ta
+|   3584: 62 6c 65 74 31 5f 63 6f 6e 66 69 67 74 31 5f 63   blet1_configt1_c
+|   3600: 6f 6e 66 69 67 06 43 52 45 41 54 45 20 54 41 42   onfig.CREATE TAB
+|   3616: 4c 45 20 27 74 31 5f 63 6f 6e 66 69 67 27 28 6b   LE 't1_config'(k
+|   3632: 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20 76 29    PRIMARY KEY, v)
+|   3648: 20 57 49 54 48 4f 55 54 20 52 4f 57 49 44 5b 05    WITHOUT ROWID[.
+|   3664: 07 17 21 21 01 81 01 74 61 62 6c 00 0f f6 0f ec   ..!!...tabl.....
+|   3680: 0f e0 73 69 7a 65 74 31 5f 64 6f 63 73 69 7a 65   ..sizet1_docsize
+|   3696: 05 43 52 45 41 54 45 20 54 41 42 4c 45 20 27 74   .CREATE TABLE 't
+|   3712: 31 5f 64 6f 63 73 69 7a 65 27 28 69 64 20 49 4e   1_docsize'(id IN
+|   3728: 54 45 47 45 52 20 50 52 49 4d 41 52 59 20 4b 45   TEGER PRIMARY KE
+|   3744: 59 2c 20 73 7a 20 42 4c 4f 42 29 55 04 06 17 21   Y, sz BLOB)U...!
+|   3760: 21 01 77 74 61 62 6c 65 74 31 5f 63 6f 6e 74 65   !.wtablet1_conte
+|   3776: 6e 74 74 31 5f 63 6f 6e 74 65 6e 74 04 43 52 45   ntt1_content.CRE
+|   3792: 41 54 45 20 54 41 42 4c 45 20 27 74 31 5f 63 6f   ATE TABLE 't1_co
+|   3808: 6e 74 65 6e 74 27 28 69 64 20 49 4e 54 45 47 45   ntent'(id INTEGE
+|   3824: 52 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20 63   R PRIMARY KEY, c
+|   3840: 30 29 69 03 07 17 19 19 01 81 2d 74 61 62 6c 65   0)i.......-table
+|   3856: 74 31 5f 69 64 78 74 31 5f 69 64 78 03 43 52 45   t1_idxt1_idx.CRE
+|   3872: 41 54 45 20 54 41 42 4c 45 20 27 74 31 5f 69 64   ATE TABLE 't1_id
+|   3888: 78 27 28 73 65 67 69 64 2c 20 74 65 72 6d 2c 20   x'(segid, term, 
+|   3904: 70 67 6e 6f 2c 20 50 52 49 4d 41 52 59 20 4b 45   pgno, PRIMARY KE
+|   3920: 59 28 73 65 67 69 64 2c 20 74 65 72 6d 29 29 20   Y(segid, term)) 
+|   3936: 57 49 54 48 4f 55 54 20 52 4f 57 49 44 55 02 07   WITHOUT ROWIDU..
+|   3952: 17 1b 1b 01 81 01 74 61 62 6c 65 74 31 5f 64 61   ......tablet1_da
+|   3968: 74 61 74 31 5f 64 61 74 61 02 43 52 45 41 54 45   tat1_data.CREATE
+|   3984: 20 54 41 42 4c 45 20 27 74 31 5f 64 61 74 61 27    TABLE 't1_data'
+|   4000: 28 69 64 20 49 4e 54 45 47 45 52 20 50 52 49 4d   (id INTEGER PRIM
+|   4016: 41 52 59 20 4b 45 59 2c 20 62 6c 6f 63 6b 20 42   ARY KEY, block B
+|   4032: 4c 4f 42 29 3a 01 06 17 11 11 08 63 74 61 62 6c   LOB):......ctabl
+|   4048: 65 74 31 74 31 43 52 45 41 54 45 20 56 49 52 54   et1t1CREATE VIRT
+|   4064: 55 41 4c 20 54 41 42 4c 45 20 74 31 20 55 53 49   UAL TABLE t1 USI
+|   4080: 4e 47 20 66 74 73 35 28 63 6f 6e 74 65 6e 74 29   NG fts5(content)
+| page 2 offset 4096
+|      0: 0d 00 00 00 03 0f bd 00 0f e8 0f ef 0f bd 00 00   ................
+|   4016: 00 00 00 00 00 00 00 00 00 00 00 00 00 24 84 80   .............$..
+|   4032: 80 80 80 01 03 00 4e 00 00 00 1e 06 30 61 62 61   ......N.....0aba
+|   4048: 63 6b 01 02 02 04 02 66 74 00 02 22 04 04 6e 64   ck.....ft.....nd
+|   4064: 6f 6e 04 67 90 38 2a 07 05 01 03 00 10 03 03 0f   on.g.8*.........
+|   4080: 0a 03 00 24 00 00 00 00 01 01 01 00 01 01 01 01   ...$............
+| page 3 offset 8192
+|      0: 0a 00 00 00 01 0f fa 00 0f fa 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 00 00 00 00 00 00 05 04 09 0c 01 02   ................
+| page 4 offset 12288
+|      0: 0d 00 00 00 03 0f e0 00 0f f6 0f ec 0f e0 00 00   ................
+|   4064: 0a 03 03 00 1b 61 62 61 6e 64 6f 6e 08 02 03 00   .....abandon....
+|   4080: 17 61 62 61 66 74 08 01 03 00 17 61 62 61 63 6b   .abaft.....aback
+| page 5 offset 16384
+|      0: 0d 00 00 00 03 0f ee 00 0f fa 0f f4 0f ee 00 00   ................
+|   4064: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 03   ................
+|   4080: 03 00 0e 01 04 02 03 00 0e 01 04 01 03 00 0e 01   ................
+| page 6 offset 20480
+|      0: 0a 00 00 00 01 0f f4 00 0f f4 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 0b 03 1b 01 76 65 72 73 69 6f 6e 04   ........version.
+| page 7 offset 24576
+|      0: 0d 00 00 00 03 0f d6 00 0f f4 0f e1 0f d6 00 00   ................
+|   4048: 00 00 00 00 00 00 09 03 02 1b 72 65 62 75 69 6c   ..........rebuil
+|   4064: 64 11 02 02 2b 69 6e 74 65 67 72 69 74 79 2d 63   d...+integrity-c
+|   4080: 68 65 63 6b 0a 01 02 1d 6f 70 74 69 6d 69 7a 65   heck....optimize
+| page 8 offset 28672
+|      0: 03 07 17 19 19 01 81 2d 74 61 62 6c 65 74 31 5f   .......-tablet1_
+|     16: 69 64 78 74 31 5f 69 64 78 03 43 52 45 41 54 45   idxt1_idx.CREATE
+|     32: 20 54 41 42 4c 45 20 27 74 31 5f 66 17 42 03 30    TABLE 't1_f.B.0
+|     48: 01 00 00 10 10 04 02 02 00 00 00 00 00 00 00 00   ................
+|     64: 70 00 00 00 00 00 00 00 00 00 00 00 70 00 00 00   p...........p...
+| end c16.db
+}]} {}
+
+do_catchsql_test 15.1 {
+  INSERT INTO t1(t1) VALUES('integrity-check');
+} {1 {database disk image is malformed}}
+
+#---------------------------------------------------------------------------
+#
+reset_db
+do_test 16.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 28672 pagesize 4096 filename c17.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 00 00 00 00 07   .....@  ........
+|     32: 00 00 00 00 00 00 00 00 00 00 00 07 00 00 00 00   ................
+|     48: 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00   ................
+|     96: 00 00 00 00 0d 00 00 00 07 0d d2 00 0f c4 0f 6d   ...............m
+|    112: 0f 02 0e ab 0e 4e 0d f6 0d d2 00 00 00 00 00 00   .....N..........
+|   3536: 00 00 22 07 06 17 11 11 01 31 74 61 62 6c 65 74   .........1tablet
+|   3552: 32 74 32 07 43 52 45 41 54 45 20 54 41 42 4c 45   2t2.CREATE TABLE
+|   3568: 20 74 32 28 78 29 56 06 06 17 1f 1f 01 7d 74 61    t2(x)V.......ta
+|   3584: 62 6c 65 74 31 5f 63 6f 6e 66 69 67 74 31 5f 63   blet1_configt1_c
+|   3600: 6f 6e 66 69 67 06 43 52 45 41 54 45 20 54 41 42   onfig.CREATE TAB
+|   3616: 4c 45 20 27 74 31 5f 63 6f 6e 66 69 67 27 28 6b   LE 't1_config'(k
+|   3632: 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20 76 29    PRIMARY KEY, v)
+|   3648: 20 57 49 54 48 4f 55 54 20 52 4f 57 49 44 5b 05    WITHOUT ROWID[.
+|   3664: 07 17 21 21 01 81 01 74 61 62 6c 65 74 31 5f 64   ..!!...tablet1_d
+|   3680: 6f 63 73 69 7a 65 74 31 5f 64 6f 63 73 69 7a 65   ocsizet1_docsize
+|   3696: 05 43 52 45 41 54 45 20 54 41 42 4c 45 20 27 74   .CREATE TABLE 't
+|   3712: 31 5f 64 6f 63 73 69 7a 65 27 28 69 64 20 49 4e   1_docsize'(id IN
+|   3728: 54 45 47 45 52 20 50 52 49 4d 41 52 59 20 4b 45   TEGER PRIMARY KE
+|   3744: 59 2c 20 73 7a 20 42 4c 4f 42 29 55 04 06 17 21   Y, sz BLOB)U...!
+|   3760: 21 01 77 74 61 62 6c 65 74 31 5f 63 6f 6e 74 65   !.wtablet1_conte
+|   3776: 6e 74 74 31 5f 63 6f 6e 74 65 6e 74 04 43 52 45   ntt1_content.CRE
+|   3792: 41 54 45 20 54 41 42 4c 45 20 27 74 31 5f 63 6f   ATE TABLE 't1_co
+|   3808: 6e 74 65 6e 74 27 28 69 64 20 49 4e 54 45 47 45   ntent'(id INTEGE
+|   3824: 52 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20 63   R PRIMARY KEY, c
+|   3840: 30 29 69 03 07 17 19 19 01 81 2d 74 61 62 6c 65   0)i.......-table
+|   3856: 74 31 5f 69 64 78 74 31 5f 69 64 78 03 43 52 45   t1_idxt1_idx.CRE
+|   3872: 41 54 45 20 54 41 42 4c 45 20 27 74 31 5f 69 64   ATE TABLE 't1_id
+|   3888: 78 27 28 73 65 67 69 64 2c 20 74 65 72 6d 2c 20   x'(segid, term, 
+|   3904: 70 67 6e 6f 2c 20 50 52 49 4d 41 52 59 20 4b 45   pgno, PRIMARY KE
+|   3920: 59 28 73 65 67 69 64 2c 20 74 65 72 6d 29 29 20   Y(segid, term)) 
+|   3936: 57 49 54 48 4f 55 54 20 52 4f 57 49 44 55 02 07   WITHOUT ROWIDU..
+|   3952: 17 1b 1b 01 81 01 74 61 62 6c 65 74 31 5f 64 61   ......tablet1_da
+|   3968: 74 61 74 31 5f 64 61 74 61 02 43 52 45 41 54 45   tat1_data.CREATE
+|   3984: 20 54 41 42 4c 45 20 27 74 31 5f 64 61 74 61 27    TABLE 't1_data'
+|   4000: 28 69 64 20 49 4e 54 45 47 45 52 20 50 52 49 4d   (id INTEGER PRIM
+|   4016: 41 52 59 20 4b 45 59 2c 20 62 6c 6f 63 6b 20 42   ARY KEY, block B
+|   4032: 4c 4f 42 29 3a 01 06 17 11 11 08 63 74 61 62 6c   LOB):......ctabl
+|   4048: 65 74 31 74 31 43 52 45 41 54 45 20 56 49 52 54   et1t1CREATE VIRT
+|   4064: 55 41 4c 20 54 41 42 4c 45 20 74 31 20 55 53 49   UAL TABLE t1 USI
+|   4080: 4e 47 20 66 74 73 35 28 63 6f 6e 74 65 6e 74 29   NG fts5(content)
+| page 2 offset 4096
+|      0: 0d 00 00 00 03 0f bd 00 0f e8 0f ef 0f bd 00 00   ................
+|   4016: 00 00 00 00 00 00 00 00 00 00 00 00 00 24 84 80   .............$..
+|   4032: 80 80 80 01 03 00 4e 00 00 00 1e 06 30 61 62 61   ......N.....0aba
+|   4048: 63 6b 01 02 02 04 02 66 74 00 02 22 04 04 6e 64   ck.....ft.....nd
+|   4064: 6f 6e 03 02 02 04 0a 07 05 01 03 00 10 03 03 0f   on..............
+|   4080: 0a 03 00 24 00 00 00 00 01 01 01 00 01 01 41 01   ...$..........A.
+| page 3 offset 8192
+|      0: 0a 00 00 00 01 0f fa 00 0f fa 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 00 00 00 00 00 00 05 04 09 0c 01 02   ................
+| page 4 offset 12288
+|      0: 0d 00 00 00 03 0f e0 00 0f f6 0f ec 0f e0 00 00   ................
+|   4064: 0a 03 03 00 1b 61 62 61 6e 64 6f 6e 08 02 03 00   .....abandon....
+|   4080: 17 61 62 61 66 74 08 01 03 00 17 61 62 61 63 6b   .abaft.....aback
+| page 5 offset 16384
+|      0: 0d 00 00 00 03 0f ee 00 0f fa 0f f4 0f ee 00 00   ................
+|   4064: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 03   ................
+|   4080: 03 00 0e 01 04 02 03 00 0e 01 04 01 03 00 0e 01   ................
+| page 6 offset 20480
+|      0: 0a 00 00 00 01 0f f4 00 0f f4 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 0b 03 1b 01 76 65 72 73 69 6f 6e 04   ........version.
+| page 7 offset 24576
+|      0: 0d 00 00 00 03 0f d6 00 0f f4 0f e1 0f d6 00 00   ................
+|   4048: 00 00 00 00 00 00 09 03 02 1b 72 65 62 75 69 6c   ..........rebuil
+|   4064: 64 11 02 02 2b 69 6e 74 65 67 72 69 74 79 2d 63   d...+integrity-c
+|   4080: 68 65 63 6b 0a 01 02 1d 6f 70 74 69 6d 69 7a 65   heck....optimize
+| end c17.db
+}]} {}
+
+do_catchsql_test 16.1 {
+INSERT INTO t1(t1) VALUES('integrity-check');
+} {1 {vtable constructor failed: t1}}
+
+#--------------------------------------------------------------------------
+reset_db
+do_test 17.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 28672 pagesize 4096 filename c18.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 00 00 00 00 07   .....@  ........
+|     32: 00 00 00 00 00 00 00 00 00 00 00 07 00 00 00 00   ................
+|     48: 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00   ................
+|     96: 00 00 00 00 0d 00 00 00 07 0d d2 00 0f c4 0f 6d   ...............m
+|    112: 0f 02 0e ab 0e 4e 0d f6 0d d2 00 00 00 00 00 00   .....N..........
+|   3536: 00 00 22 07 06 17 11 11 01 31 74 61 62 6c 65 74   .........1tablet
+|   3552: 32 74 32 07 43 52 45 41 54 45 20 54 41 42 4c 45   2t2.CREATE TABLE
+|   3568: 20 74 32 28 78 29 56 06 06 17 1f 1f 01 7d 74 61    t2(x)V.......ta
+|   3584: 62 6c 65 74 31 5f 63 6f 6e 66 69 67 74 31 5f 63   blet1_configt1_c
+|   3600: 6f 6e 66 69 67 06 43 52 45 41 54 45 20 54 41 42   onfig.CREATE TAB
+|   3616: 4c 45 20 27 74 31 5f 63 6f 6e 66 69 67 27 28 6b   LE 't1_config'(k
+|   3632: 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20 76 29    PRIMARY KEY, v)
+|   3648: 20 57 49 54 48 4f 55 54 20 52 4f 57 49 44 5b 05    WITHOUT ROWID[.
+|   3664: 07 17 21 21 01 81 01 74 61 62 6c 65 74 31 5f 64   ..!!...tablet1_d
+|   3680: 6f 63 73 69 7a 65 74 31 5f 64 6f 63 73 69 7a 65   ocsizet1_docsize
+|   3696: 05 43 52 45 41 54 45 20 54 41 42 4c 45 20 27 74   .CREATE TABLE 't
+|   3712: 31 5f 64 6f 63 73 69 7a 65 27 28 69 64 20 49 4e   1_docsize'(id IN
+|   3728: 54 45 47 45 52 20 50 52 49 4d 41 52 59 20 4b 45   TEGER PRIMARY KE
+|   3744: 59 2c 20 73 7a 20 42 4c 4f 42 29 55 04 06 17 21   Y, sz BLOB)U...!
+|   3760: 21 01 77 74 61 62 6c 65 74 31 5f 63 6f 6e 74 65   !.wtablet1_conte
+|   3776: 6e 74 74 31 5f 63 6f 6e 74 65 6e 74 04 43 52 45   ntt1_content.CRE
+|   3792: 41 54 45 20 54 41 42 4c 45 20 27 74 31 5f 63 6f   ATE TABLE 't1_co
+|   3808: 6e 74 65 6e 74 27 28 69 64 20 49 4e 54 45 47 45   ntent'(id INTEGE
+|   3824: 52 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20 63   R PRIMARY KEY, c
+|   3840: 30 29 69 03 07 17 19 19 01 81 2d 74 61 62 6c 65   0)i.......-table
+|   3856: 74 31 5f 69 64 78 74 31 5f 69 64 78 03 43 52 45   t1_idxt1_idx.CRE
+|   3872: 41 54 45 20 54 41 42 4c 45 20 27 74 31 5f 69 64   ATE TABLE 't1_id
+|   3888: 78 27 28 73 65 67 69 64 2c 20 74 65 72 6d 2c 20   x'(segid, term, 
+|   3904: 70 67 6e 6f 2c 20 50 52 49 4d 41 52 59 20 4b 45   pgno, PRIMARY KE
+|   3920: 59 28 73 65 67 69 64 2c 20 74 65 72 6d 29 29 20   Y(segid, term)) 
+|   3936: 57 49 54 48 4f 55 54 20 52 4f 57 49 44 55 02 07   WITHOUT ROWIDU..
+|   3952: 17 1b 1b 01 81 01 74 61 62 6c 65 74 31 5f 64 61   ......tablet1_da
+|   3968: 74 61 74 31 5f 64 61 74 61 02 43 52 45 41 54 45   tat1_data.CREATE
+|   3984: 20 54 41 42 4c 45 20 27 74 31 5f 64 61 74 61 27    TABLE 't1_data'
+|   4000: 28 69 64 20 49 4e 54 45 47 45 52 20 50 52 49 4d   (id INTEGER PRIM
+|   4016: 41 52 59 20 4b 45 59 2c 20 62 6c 6f 63 6b 20 42   ARY KEY, block B
+|   4032: 4c 4f 42 29 3a 01 06 17 11 11 08 63 74 61 62 6c   LOB):......ctabl
+|   4048: 65 74 31 74 31 43 52 45 41 54 45 20 56 49 52 54   et1t1CREATE VIRT
+|   4064: 55 41 4c 20 54 41 42 4c 45 20 74 31 20 55 53 49   UAL TABLE t1 USI
+|   4080: 4e 47 20 66 74 73 35 28 63 6f 6e 74 65 6e 74 29   NG fts5(content)
+| page 2 offset 4096
+|      0: 0d 00 00 00 03 0f bd 00 0f e8 0f ef 0f bd 00 00   ................
+|   4016: 00 00 00 00 00 00 00 00 00 00 00 00 00 24 84 80   .............$..
+|   4032: 80 80 80 01 03 00 4e 00 00 00 1e 06 30 61 62 61   ......N.....0aba
+|   4048: 63 6b 01 02 02 04 02 66 74 00 02 22 04 04 6e 64   ck.....ft.....nd
+|   4064: 6f 6e 03 02 02 04 0a 07 05 01 03 00 10 03 03 0f   on..............
+|   4080: 0a 03 00 24 00 00 0a aa aa aa aa aa aa aa aa aa   ...$............
+| page 3 offset 8192
+|      0: aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa   ................
+|     16: aa aa aa aa aa aa aa aa 00 00 10 10 10 00 10 10   ................
+|     32: 10 10 a0 00 00 00 10 ff a0 00 ff 52 05 64 95 25   ...........R.d.%
+|     48: 45 54 14 c2 05 44 14 24 c4 52 07 43 12 05 55 34   ET...D.$.R.C..U4
+|     64: 94 e4 72 06 67 47 33 52 86 36 f6 e7 46 56 e7 42   ..r.gG3R.6..FV.B
+|     80: 90 d0 00 00 00 30 fb d0 00 fe 80 fe f0 fb 00 00   .....0..........
+|   4080: 00 00 00 00 00 00 00 00 00 00 05 04 09 0c 01 02   ................
+| page 4 offset 12288
+|      0: 0d 00 00 00 03 0f e0 00 0f f6 0f ec 0f e0 00 00   ................
+|   4064: 0a 03 03 00 1b 61 62 61 6e 64 6f 6e 08 02 03 00   .....abandon....
+|   4080: 17 61 62 61 66 74 08 01 03 00 17 61 62 61 63 6b   .abaft.....aback
+| page 5 offset 16384
+|      0: 0d 00 00 00 03 0f ee 00 0f fa 0f f4 0f ee 00 00   ................
+|   4064: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 03   ................
+|   4080: 03 00 0e 01 04 02 03 00 0e 01 04 01 03 00 0e 01   ................
+| page 6 offset 20480
+|      0: 0a 00 00 00 01 0f f4 00 0f f4 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 0b 03 1b 01 76 65 72 73 69 6f 6e 04   ........version.
+| page 7 offset 24576
+|      0: 0d 00 00 00 03 0f d6 00 0f f4 0f e1 0f d6 00 00   ................
+|   4048: 00 00 00 00 00 00 09 03 02 1b 72 65 62 75 69 6c   ..........rebuil
+|   4064: 64 11 02 02 2b 69 6e 74 65 67 72 69 74 79 2d 63   d...+integrity-c
+|   4080: 68 65 63 6b 0a 01 02 1d 6f 70 74 69 6d 69 7a 65   heck....optimize
+| end c18.db
+}]} {}
+
+do_catchsql_test 17.1 {
+  SELECT * FROM t1 WHERE t1 MATCH 'abandon';
+} {1 {vtable constructor failed: t1}}
+
+#--------------------------------------------------------------------------
+reset_db
+do_test 18.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 28672 pagesize 4096 filename c19b.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 01 00 00 00 07   .....@  ........
+|     32: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00   ................
+|     48: 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00   ................
+|     80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01   ................
+|     96: 00 2e 30 38 0d 00 00 00 07 0d d2 00 0f c4 0f 6d   ..08...........m
+|    112: 0f 02 0e ab 0e 4e 0d f6 0d d2 00 00 00 00 00 00   .....N..........
+|   3536: 00 00 22 07 06 17 11 11 01 31 74 61 62 6c 65 74   .........1tablet
+|   3552: 32 74 32 07 43 52 45 41 54 45 20 54 41 42 4c 45   2t2.CREATE TABLE
+|   3568: 20 74 32 28 78 29 56 06 06 17 1f 1f 01 7d 74 61    t2(x)V.......ta
+|   3584: 62 6c 65 74 31 5f 63 6f 6e 66 69 67 74 31 5f 63   blet1_configt1_c
+|   3600: 6f 6e 66 69 67 06 43 52 45 41 54 45 20 54 41 42   onfig.CREATE TAB
+|   3616: 4c 45 20 27 74 31 5f 63 6f 6e 66 69 67 27 28 6b   LE 't1_config'(k
+|   3632: 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20 76 29    PRIMARY KEY, v)
+|   3648: 20 57 49 54 48 4f 55 54 20 52 4f 57 49 44 5b 05    WITHOUT ROWID[.
+|   3664: 07 17 21 21 01 81 01 74 61 62 6c 65 74 31 5f 64   ..!!...tablet1_d
+|   3680: 6f 63 73 69 7a 65 74 31 5f 64 6f 63 73 69 7a 65   ocsizet1_docsize
+|   3696: 05 43 52 45 41 54 45 20 54 41 42 4c 45 20 27 74   .CREATE TABLE 't
+|   3712: 31 5f 64 6f 63 73 69 7a 65 27 28 69 64 20 49 4e   1_docsize'(id IN
+|   3728: 54 45 47 45 52 20 50 52 49 4d 41 52 59 20 4b 45   TEGER PRIMARY KE
+|   3744: 59 2c 20 73 7a 20 42 4c 4f 42 29 55 04 06 17 21   Y, sz BLOB)U...!
+|   3760: 21 01 77 74 61 62 6c 65 74 31 5f 63 6f 6e 74 65   !.wtablet1_conte
+|   3776: 6e 74 74 31 5f 63 6f 6e 74 65 6e 74 04 43 52 45   ntt1_content.CRE
+|   3792: 41 54 45 20 54 41 42 4c 45 20 27 74 31 5f 63 6f   ATE TABLE 't1_co
+|   3808: 6e 74 65 6e 74 27 28 69 64 20 49 4e 54 45 47 45   ntent'(id INTEGE
+|   3824: 52 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20 63   R PRIMARY KEY, c
+|   3840: 30 29 69 03 07 17 19 19 01 81 2d 74 61 62 6c 65   0)i.......-table
+|   3856: 74 31 5f 69 64 78 74 31 5f 69 64 78 03 43 52 45   t1_idxt1_idx.CRE
+|   3872: 41 54 45 20 54 41 42 4c 45 20 27 74 31 5f 69 64   ATE TABLE 't1_id
+|   3888: 78 27 28 73 65 67 69 64 2c 20 74 65 72 6d 2c 20   x'(segid, term, 
+|   3904: 70 67 6e 6f 2c 20 50 52 49 4d 41 52 59 20 4b 45   pgno, PRIMARY KE
+|   3920: 59 28 73 65 67 69 64 2c 20 74 65 72 6d 29 29 20   Y(segid, term)) 
+|   3936: 57 49 54 48 4f 55 54 20 52 4f 57 49 44 55 02 07   WITHOUT ROWIDU..
+|   3952: 17 1b 1b 01 81 01 74 61 62 6c 65 74 31 5f 64 61   ......tablet1_da
+|   3968: 74 61 74 31 5f 64 61 74 61 02 43 52 45 41 54 45   tat1_data.CREATE
+|   3984: 20 54 41 42 4c 45 20 27 74 31 5f 64 61 74 61 27    TABLE 't1_data'
+|   4000: 28 69 64 20 49 4e 54 45 47 45 52 20 50 52 49 4d   (id INTEGER PRIM
+|   4016: 41 52 59 20 4b 45 59 2c 20 62 6c 6f 63 6b 20 42   ARY KEY, block B
+|   4032: 4c 4f 42 29 3a 01 06 17 11 11 08 63 74 61 62 6c   LOB):......ctabl
+|   4048: 65 74 31 74 31 43 52 45 41 54 45 20 56 49 52 54   et1t1CREATE VIRT
+|   4064: 55 41 4c 20 54 41 42 4c 45 20 74 31 20 55 53 49   UAL TABLE t1 USI
+|   4080: 4e 47 20 66 74 73 35 28 63 6f 6e 74 65 6e 74 29   NG fts5(content)
+| page 2 offset 4096
+|      0: 0d 09 a6 00 06 09 22 00 0f e8 09 22 0f bd 0f 2c   ...............,
+|     16: 09 bd 09 3c 00 00 00 00 00 00 00 00 00 00 00 00   ...<............
+|   2336: 00 00 18 0a 03 00 36 00 00 00 00 01 04 04 00 04   ......6.........
+|   2352: 01 01 01 02 01 01 03 01 01 04 01 01 63 90 80 80   ............c...
+|   2368: 80 80 01 04 00 81 4a 00 00 00 56 06 30 61 62 61   ......J...V.0aba
+|   2384: 63 6b 08 01 04 04 6e 64 6f 6e 03 01 05 01 02 05   ck....ndon......
+|   2400: 63 74 69 76 65 08 01 02 04 6c 70 68 61 08 01 02   ctive....lpha...
+|   2416: 03 74 6f 6d 08 01 01 06 62 61 63 6b 75 70 08 01   .tom....backup..
+|   2432: 01 0c 63 68 61 6e 6e 65 62 6f 6f 6d 65 72 08 01   ..channeboomer..
+|   2448: 07 01 6c 08 01 01 04 74 65 73 74 08 01 04 09 0a   ..l....test.....
+|   2464: 09 08 07 0a 10 05 0f 18 00 17 30 00 00 00 00 01   ..........0.....
+|   2480: 03 03 00 03 01 01 01 02 01 01 03 01 01 8a 53 8c   ..............S.
+|   2496: 80 80 80 80 01 04 00 95 2a 00 00 05 35 0d 30 30   ........*...5.00
+|   2512: 31 30 66 66 61 30 30 30 66 66 61 05 02 1c 02 49   10ffa000ffa....I
+|   2528: 33 34 33 35 32 34 35 34 31 35 34 34 35 32 30 35   3435245415445205
+|   2544: 34 34 31 34 32 34 63 34 35 32 30 32 37 37 34 33   441424c452027743
+|   2560: 31 35 66 36 39 36 34 37 38 32 37 32 38 37 33 36   15f6964782728736
+|   2576: 35 36 37 36 39 36 34 32 63 32 30 37 34 36 35 37   56769642c2074657
+|   2592: 32 36 64 32 63 32 30 37 30 05 02 12 02 3b 36 31   26d2c2070....;61
+|   2608: 37 32 31 32 31 30 31 37 37 37 34 36 31 36 32 35   7212101777461625
+|   2624: 63 36 35 37 34 33 31 35 66 36 33 36 66 36 65 37   c6574315f636f6e7
+|   2640: 34 36 35 36 65 37 34 37 34 33 31 35 66 36 33 36   4656e7474315f636
+|   2656: 66 36 65 37 34 36 35 36 65 05 04 07 07 01 04 31   f6e74656e......1
+|   2672: 66 62 64 05 02 19 01 44 32 34 38 34 38 30 38 30   fbd....D24848080
+|   2688: 38 30 38 30 30 31 30 33 30 30 34 65 30 30 30 30   80800103004e0000
+|   2704: 30 30 31 65 30 36 33 30 36 31 36 32 36 31 36 33   001e063061626163
+|   2720: 36 62 30 31 30 32 30 32 30 34 30 32 36 36 37 34   6b01020204026674
+|   2736: 30 32 30 32 30 32 30 34 30 34 36 65 05 02 1a 02   02020204046e....
+|   2752: 03 66 65 72 05 02 1d 01 28 33 65 37 34 36 35 36   .fer....(3e74656
+|   2768: 65 37 34 32 39 30 64 30 30 30 30 30 30 30 33 30   e74290d000000030
+|   2784: 66 62 64 30 30 30 66 65 38 30 66 65 66 30 66 62   fbd000fe80fef0fb
+|   2800: 64 05 02 18 01 4a 34 31 35 32 35 39 32 30 34 62   d....J415259204b
+|   2816: 34 35 35 39 32 63 32 30 36 32 36 63 36 66 36 33   45592c20626c6f63
+|   2832: 36 62 32 30 34 32 34 63 34 66 34 32 32 39 33 61   6b20424c4f42293a
+|   2848: 30 31 30 36 31 37 31 31 31 31 30 38 36 33 37 34   0106171111086374
+|   2864: 36 31 36 32 36 63 36 35 37 34 33 31 37 34 33 31   61626c6574317431
+|   2880: 05 02 16 02 49 33 35 32 34 35 34 31 35 34 34 35   ....I35245415445
+|   2896: 32 30 35 36 34 39 35 32 35 34 35 35 34 31 34 63   205649525455414c
+|   2912: 32 30 35 34 34 31 34 32 34 63 34 35 32 30 37 34   205441424c452074
+|   2928: 33 31 6f 30 35 35 35 33 34 39 34 65 34 37 32 30   31o05553494e4720
+|   2944: 36 36 37 34 37 33 33 35 32 38 36 33 36 66 05 02   6674733528636f..
+|   2960: 17 02 49 35 32 30 35 34 34 31 34 32 34 63 34 35   ..I5205441424c45
+|   2976: 32 30 32 37 37 34 33 31 35 66 36 33 36 66 36 65   202774315f636f6e
+|   2992: 37 34 36 35 36 65 37 34 32 37 32 38 36 39 36 34   74656e7427286964
+|   3008: 32 30 34 39 34 65 35 34 34 35 34 37 34 35 35 32   20494e5445474552
+|   3024: 32 30 35 30 35 32 34 39 34 64 34 31 05 02 0e 44   205052494d41...D
+|   3040: 29 62 30 35 30 37 31 37 32 31 32 31 30 31 38 31   )b05071721210181
+|   3056: 30 31 37 34 36 31 36 32 36 63 36 35 37 34 33 31   017461626c657431
+|   3072: 35 66 36 34 36 66 36 33 37 33 05 02 09 01 4a 35   5f646f6373....J5
+|   3088: 32 34 35 34 31 35 34 34 35 32 30 35 34 34 31 34   2454154452054414
+|   3104: 32 34 63 34 35 32 30 32 37 37 34 33 31 35 66 36   24c45202774315f6
+|   3120: 34 36 31 37 34 36 31 32 37 32 38 36 39 36 34 32   4617461272869642
+|   3136: 30 34 39 34 65 35 34 34 35 34 37 34 35 35 32 32   0494e54454745522
+|   3152: 30 35 30 35 32 34 39 34 64 05 02 15 03 3a 35 39   05052494d....:59
+|   3168: 32 30 34 62 34 35 35 39 32 63 32 30 36 33 33 30   204b45592c206330
+|   3184: 32 39 36 39 30 33 30 37 31 37 31 39 31 39 30 31   2969030717191901
+|   3200: 38 31 32 64 37 34 36 31 36 32 36 63 36 35 37 34   812d7461626c6574
+|   3216: 33 31 35 66 36 39 79 79 05 02 0f 02 49 34 32 30   315f69yy....I420
+|   3232: 35 32 34 66 35 37 34 39 34 34 35 35 30 32 30 37   524f574944550207
+|   3248: 31 37 31 62 31 62 30 31 38 31 30 31 37 34 36 31   171b1b0181017461
+|   3264: 36 32 36 63 36 37 37 34 33 31 35 66 36 34 36 31   626c6774315f6461
+|   3280: 37 34 36 31 37 34 33 31 35 66 36 34 36 31 37 34   746174315f646174
+|   3296: 36 31 30 32 34 33 05 02 14 02 07 66 36 39 36 34   610243.....f6964
+|   3312: 37 38 05 02 11 01 4a 36 34 36 66 36 65 30 33 30   78....J646f6e030
+|   3328: 32 30 32 30 34 30 61 30 37 30 35 30 31 30 33 30   202040a070501030
+|   3344: 30 31 30 30 33 30 33 30 66 30 61 30 33 30 30 32   01003030f0a03002
+|   3360: 34 30 30 30 30 30 30 30 30 30 31 30 31 30 31 30   4000000000101010
+|   3376: 30 30 31 30 31 30 31 30 31 30 61 30 30 30 30 30   0010101010a00000
+|   3392: 30 05 02 1b 02 49 35 32 37 32 38 36 39 36 34 32   0....I5272869642
+|   3408: 30 34 39 34 65 35 34 34 35 34 37 34 35 35 32 32   0494e54454745522
+|   3424: 30 35 30 35 32 34 39 34 64 34 31 35 32 35 39 32   05052494d4152592
+|   3440: 30 34 62 34 35 35 39 32 63 32 30 37 33 37 61 32   04b45592c20737a2
+|   3456: 30 34 32 34 63 34 66 34 32 32 39 35 35 30 34 05   0424c4f42295504.
+|   3472: 04 06 07 02 49 37 36 65 36 66 32 63 32 30 35 30   ....I76e6f2c2050
+|   3488: 35 32 34 39 34 64 34 31 35 32 35 39 32 30 34 62   52494d415259204b
+|   3504: 34 35 35 39 32 38 37 33 36 35 36 37 36 39 36 34   4559287365676964
+|   3520: 32 63 32 30 37 34 36 35 37 32 36 64 32 39 32 39   2c207465726d2929
+|   3536: 32 30 35 37 34 39 35 34 34 38 34 66 35 35 05 02   20574954484f55..
+|   3552: 13 02 49 39 37 61 36 35 37 34 33 31 35 66 36 34   ..I97a6574315f64
+|   3568: 36 66 36 33 37 33 36 39 37 61 36 35 30 35 34 33   6f6373697a650543
+|   3584: 35 32 34 35 34 31 35 34 34 35 32 30 35 34 34 31   5245415445205441
+|   3600: 34 32 34 63 34 35 32 30 32 37 37 34 33 31 35 66   424c45202774315f
+|   3616: 36 34 36 66 36 33 37 33 36 39 37 61 05 04 05 07   646f6373697a....
+|   3632: 01 0e 37 34 30 34 34 33 35 32 34 35 34 31 35 34   ..74044352454154
+|   3648: 05 04 08 07 02 49 36 32 39 32 30 35 37 34 39 35   .....I6292057495
+|   3664: 34 34 38 34 66 35 35 35 34 32 30 35 32 34 66 35   4484f555420524f5
+|   3680: 37 34 39 34 34 35 62 30 35 30 37 31 37 32 31 32   749445b050717212
+|   3696: 31 30 31 38 31 30 31 37 34 36 31 36 32 36 63 36   10181017461626c6
+|   3712: 35 37 34 33 31 35 66 36 34 36 66 36 33 37 33 05   574315f646f6373.
+|   3728: 02 04 01 06 62 61 63 6b 75 70 05 02 1e 02 05 65   ....backup.....e
+|   3744: 61 6d 65 72 05 02 02 02 05 6f 6f 6d 65 72 05 01   amer.....oomer..
+|   3760: 02 40 75 6d 6d 32 34 63 34 35 32 30 32 37 37 34   .@umm24c45202774
+|   3776: 33 31 35 66 36 33 36 66 36 65 36 36 36 39 36 37   315f636f6e666967
+|   3792: 32 37 32 38 36 62 32 30 35 30 35 32 34 39 34 64   27286b205052494d
+|   3808: 34 31 35 32 35 39 32 30 34 62 34 35 35 39 32 63   415259204b45592c
+|   3824: 32 30 05 02 03 01 04 79 65 6b 72 05 02 10 04 11   20.....yekr.....
+|   3840: 4e 41 09 49 08 2d 4f 4e 4e 2e 4f 3f 4e 0c 4f 4f   NA.I.-ONN.O?N.OO
+|   3856: 4e 4f 14 4e 0b 0a 09 45 0f ef 00 14 2a 00 00 00   NO.N...E....*...
+|   3872: 00 01 02 02 00 02 01 01 01 02 01 01 81 09 88 80   ................
+|   3888: 80 80 80 01 04 00 82 16 00 00 00 79 06 30 61 62   ...........y.0ab
+|   3904: 61 63 6b 08 02 07 04 04 6e 64 6f 6e 08 02 05 02   ack.....ndon....
+|   3920: 05 63 74 69 76 65 04 02 02 04 02 0b 02 04 6c 70   .ctive........lp
+|   3936: 68 61 08 04 02 0a 02 03 74 6b 6d 06 02 02 03 02   ha......tkm.....
+|   3952: 6f 6d 08 02 09 05 02 69 63 07 02 02 01 06 62 61   om.....ic.....ba
+|   3968: 63 6b 75 70 08 02 04 02 05 6f 6f 6d 65 72 05 02   ckup.....oomer..
+|   3984: 02 01 0c 63 68 61 6e 6e 65 62 6f 6f 6d 65 72 08   ...channeboomer.
+|   4000: 02 08 07 01 6c 08 02 03 01 04 74 65 73 74 08 02   ....l.....test..
+|   4016: 06 04 0a 09 0d 0a 08 07 07 0b 0a 11 06 24 84 80   .............$..
+|   4032: 80 80 80 01 03 00 4e 00 00 00 1e 06 30 61 62 61   ......N.....0aba
+|   4048: 63 6b 01 08 02 04 02 66 74 00 02 22 04 04 6e 64   ck.....ft.....nd
+|   4064: 6f 6e 03 02 02 04 0a 07 05 01 03 00 10 06 22 00   on..............
+|   4080: 00 00 11 24 00 00 00 00 01 01 01 00 01 01 01 01   ...$............
+| page 3 offset 8192
+|      0: 0a 00 00 00 04 0f e5 00 0f fa 0f f3 0f ec 0f e5   ................
+|   4064: 00 00 00 00 00 06 04 01 0c 01 04 02 06 04 01 0c   ................
+|   4080: 01 03 02 06 04 01 0c 01 02 02 05 04 09 0c 01 02   ................
+| page 4 offset 12288
+|      0: 0d 0f 68 00 06 08 98 00 0f f6 0f ec 0f d5 08 98   ..h.............
+|     16: 0f c1 0f b6 0f 68 0f 68 00 00 00 00 00 00 00 00   .....h.h........
+|   2192: 00 00 00 00 00 00 00 00 8d 4d 05 04 00 9b 1f 62   .........M.....b
+|   2208: 65 61 6d 65 72 20 62 75 6d 6d 32 34 63 34 35 32   eamer bumm24c452
+|   2224: 30 32 37 37 34 33 31 35 66 36 33 36 66 36 65 36   02774315f636f6e6
+|   2240: 36 36 39 36 37 32 37 32 38 36 62 32 30 35 30 35   6696727286b20505
+|   2256: 32 34 39 34 64 34 31 35 32 35 39 32 30 34 62 34   2494d415259204b4
+|   2272: 35 35 39 32 63 32 30 0a 37 36 32 39 32 30 35 37   5592c20.76292057
+|   2288: 34 39 35 34 34 38 34 66 35 35 35 34 32 30 35 32   4954484f55542052
+|   2304: 34 66 35 37 34 39 34 34 35 62 30 35 30 37 31 37   4f5749445b050717
+|   2320: 32 31 32 31 30 31 38 31 30 31 37 34 36 31 36 32   2121018101746162
+|   2336: 36 63 36 35 37 34 33 31 35 66 36 34 36 66 36 33   6c6574315f646f63
+|   2352: 37 33 0a 36 39 37 61 36 35 37 34 33 31 35 66 36   73.697a6574315f6
+|   2368: 34 36 66 36 33 37 33 36 39 37 61 36 35 30 35 34   46f6373697a65054
+|   2384: 33 35 32 34 35 34 31 35 34 34 35 32 30 35 34 34   3524541544520544
+|   2400: 31 34 32 34 63 34 35 32 30 32 37 37 34 33 31 35   1424c45202774315
+|   2416: 66 36 34 36 66 36 33 37 33 36 39 37 61 0a 36 35   f646f6373697a.65
+|   2432: 32 37 32 38 36 39 36 34 32 30 34 39 34 65 35 34   2728696420494e54
+|   2448: 34 35 34 37 34 35 35 32 32 30 35 30 35 32 34 39   4547455220505249
+|   2464: 34 64 34 31 35 32 35 39 32 30 34 62 34 35 35 39   4d415259204b4559
+|   2480: 32 63 32 30 37 33 37 61 32 30 34 32 34 63 34 66   2c20737a20424c4f
+|   2496: 34 32 32 39 35 35 30 34 0a 30 36 31 37 32 31 32   42295504.0617212
+|   2512: 31 30 31 37 37 37 34 36 31 36 32 35 63 36 35 37   101777461625c657
+|   2528: 34 33 31 35 66 36 33 36 66 36 65 37 34 36 35 36   4315f636f6e74656
+|   2544: 65 37 34 37 34 33 31 35 66 36 33 36 66 36 65 37   e7474315f636f6e7
+|   2560: 34 36 35 36 65 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b   4656e...........
+|   2576: 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b   ................
+|   2592: 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b   ................
+|   2608: 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b   ................
+|   2624: 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b   ................
+|   2640: 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b   ................
+|   2656: 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 37 34 30   .............740
+|   2672: 34 34 33 35 32 34 35 34 31 35 34 0a 34 35 32 30   44352454154.4520
+|   2688: 35 34 34 31 34 32 34 63 34 35 32 30 32 37 37 34   5441424c45202774
+|   2704: 33 31 35 66 36 33 36 66 36 65 37 34 36 35 36 65   315f636f6e74656e
+|   2720: 37 34 32 37 32 38 36 39 36 34 32 30 34 39 34 65   742728696420494e
+|   2736: 35 34 34 35 34 37 34 35 35 32 32 30 35 30 35 62   544547455220505b
+|   2752: 30 35 30 37 31 37 32 31 32 31 30 31 38 31 30 31   0507172121018101
+|   2768: 37 34 36 31 36 32 36 63 36 35 37 34 33 31 35 66   7461626c6574315f
+|   2784: 36 34 36 66 36 33 37 33 0a 36 39 37 61 36 35 37   646f6373.697a657
+|   2800: 34 33 31 35 66 36 34 36 66 36 33 37 33 36 39 37   4315f646f6373697
+|   2816: 61 36 35 30 35 34 33 35 32 34 35 34 31 35 34 34   a650543524541544
+|   2832: 35 32 30 35 34 34 31 34 32 34 63 34 35 32 30 32   5205441424c45202
+|   2848: 37 37 34 33 31 35 66 36 34 36 66 36 33 37 33 36   774315f646f63736
+|   2864: 39 37 61 0a 36 35 32 37 32 38 36 39 36 34 32 30   97a.652728696420
+|   2880: 34 39 34 65 35 34 34 35 34 37 34 35 35 32 32 30   494e544547455220
+|   2896: 35 30 35 32 34 39 34 64 34 31 35 32 35 39 32 30   5052494d41525920
+|   2912: 34 62 34 35 35 39 32 63 32 30 37 33 37 61 32 30   4b45592c20737a20
+|   2928: 34 32 34 63 34 66 34 32 32 39 35 35 30 34 0a 30   424c4f42295504.0
+|   2944: 36 31 37 32 31 32 31 30 31 37 37 37 34 36 31 36   6172121017774616
+|   2960: 32 35 63 36 35 37 34 33 31 35 66 36 33 36 66 36   25c6574315f636f6
+|   2976: 65 37 34 36 35 36 65 37 34 37 34 33 31 35 66 36   e74656e7474315f6
+|   2992: 33 36 66 36 65 37 34 36 35 36 65 0b 0b 0b 0b 0b   36f6e74656e.....
+|   3008: 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b   ................
+|   3024: 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b   ................
+|   3040: 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b   ................
+|   3056: 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b   ................
+|   3072: 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b   ................
+|   3088: 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b   ................
+|   3104: 0b 0b 0b 37 34 30 34 34 33 35 32 34 35 34 31 35   ...7404435245415
+|   3120: 34 0a 34 35 32 30 35 34 34 31 34 32 34 63 34 35   4.45205441424c45
+|   3136: 32 30 32 37 37 34 33 31 35 66 36 33 36 66 36 65   202774315f636f6e
+|   3152: 37 34 36 35 36 65 37 34 32 37 32 38 36 39 36 34   74656e7427286964
+|   3168: 32 30 34 39 34 65 35 34 34 35 34 37 34 35 35 32   20494e5445474552
+|   3184: 32 30 35 30 35 32 34 39 34 64 34 31 0a 35 32 35   205052494d41.525
+|   3200: 39 32 30 34 62 34 35 35 39 32 63 32 30 36 33 33   9204b45592c20633
+|   3216: 30 32 39 36 39 30 33 30 37 31 37 31 39 31 39 30   0296903071719190
+|   3232: 31 38 31 32 64 37 34 36 31 36 32 36 63 36 35 37   1812d7461626c657
+|   3248: 34 33 31 35 66 36 39 c3 bf c3 bf 7e c3 bf c3 89   4315f69....~....
+|   3264: 4b 52 c2 81 35 66 36 39 36 34 37 38 0a 30 33 34   KR..5f696478.034
+|   3280: 33 35 32 34 35 34 31 35 34 34 35 32 30 35 34 34   3524541544520544
+|   3296: 31 34 32 34 63 34 35 32 30 32 37 37 34 33 31 35   1424c45202774315
+|   3312: 66 36 39 36 34 37 38 32 37 32 38 37 33 36 35 36   f696478272873656
+|   3328: 37 36 39 36 34 32 63 32 30 37 34 36 35 37 32 36   769642c207465726
+|   3344: 64 32 63 32 30 37 30 0a 36 37 36 65 36 66 32 63   d2c2070.676e6f2c
+|   3360: 32 30 35 30 35 32 34 39 34 64 34 31 35 32 35 39   205052494d415259
+|   3376: 32 30 34 62 34 35 35 39 32 38 37 33 36 35 36 37   204b455928736567
+|   3392: 36 39 36 34 32 63 32 30 37 34 36 35 37 32 36 64   69642c207465726d
+|   3408: 32 39 32 39 32 30 35 37 34 39 35 34 34 38 34 66   292920574954484f
+|   3424: 35 35 0a 35 34 32 30 35 32 34 66 35 37 34 39 34   55.5420524f57494
+|   3440: 34 35 35 30 32 30 37 31 37 31 62 31 62 30 31 38   4550207171b1b018
+|   3456: 31 30 31 37 34 36 31 36 32 36 63 36 37 37 34 33   1017461626c67743
+|   3472: 31 35 66 36 34 36 31 37 34 36 31 37 34 33 31 35   15f6461746174315
+|   3488: 66 36 34 36 31 37 34 36 31 30 32 34 33 0a 35 32   f646174610243.52
+|   3504: 34 35 34 31 35 34 34 35 32 30 35 34 34 31 34 32   4541544520544142
+|   3520: 34 63 34 35 32 30 32 37 37 34 33 31 35 66 36 34   4c45202774315f64
+|   3536: 36 31 37 34 36 31 32 37 32 38 36 39 36 34 32 30   6174612728696420
+|   3552: 34 39 34 65 35 34 34 35 34 37 34 35 35 32 32 30   494e544547455220
+|   3568: 35 30 35 32 34 39 34 64 0a 34 31 35 32 35 39 32   5052494d.4152592
+|   3584: 30 34 62 34 35 35 39 32 63 32 30 36 32 36 63 36   04b45592c20626c6
+|   3600: 66 36 33 36 62 32 30 34 32 34 63 34 66 34 32 32   f636b20424c4f422
+|   3616: 39 33 61 30 31 30 36 31 37 31 31 31 31 30 38 36   93a0106171111086
+|   3632: 33 37 34 36 31 36 32 36 63 36 35 37 34 33 31 37   37461626c6574317
+|   3648: 34 33 31 0a 34 33 35 32 34 35 34 31 35 34 34 35   431.435245415445
+|   3664: 32 30 35 36 34 39 35 32 35 34 35 35 34 31 34 63   205649525455414c
+|   3680: 32 30 35 34 34 31 34 32 34 63 34 35 32 30 37 34   205441424c452074
+|   3696: 33 31 c3 94 30 35 35 35 33 34 39 34 65 34 37 32   31..05553494e472
+|   3712: 30 36 36 37 34 37 33 33 35 32 38 36 33 36 66 0a   06674733528636f.
+|   3728: 33 65 37 34 36 35 36 65 37 34 32 39 30 64 30 30   3e74656e74290d00
+|   3744: 30 30 30 30 30 33 30 66 62 64 30 30 30 66 65 38   0000030fbd000fe8
+|   3760: 30 66 65 66 30 66 62 64 0a 5b 31 66 62 64 5d 32   0fef0fbd.[1fbd]2
+|   3776: 34 38 34 38 30 38 30 38 30 38 30 30 31 30 33 30   4848080808001030
+|   3792: 30 34 65 30 30 30 30 30 30 31 65 30 36 33 30 36   04e0000001e06306
+|   3808: 31 36 32 36 31 36 33 36 62 30 31 30 32 30 32 30   16261636b0102020
+|   3824: 34 30 32 36 36 37 34 30 32 30 32 30 32 30 34 30   4026674020202040
+|   3840: 34 36 65 0a 36 34 36 66 36 65 30 33 30 32 30 32   46e.646f6e030202
+|   3856: 30 34 30 61 30 37 30 35 30 31 30 33 30 30 31 30   040a070501030010
+|   3872: 30 33 30 33 30 66 30 61 30 33 30 30 32 34 30 30   03030f0a03002400
+|   3888: 30 30 30 30 30 30 30 31 30 31 30 31 30 30 30 31   0000000101010001
+|   3904: 30 31 30 31 30 31 30 61 30 30 30 30 30 30 0a 30   0101010a000000.0
+|   3920: 31 30 66 66 61 30 30 30 66 66 61 0a 5b 32 66 65   10ffa000ffa.[2fe
+|   3936: 72 20 62 61 63 6b 75 70 0f ca 00 4e 81 1d 61 6c   r backup...N..al
+|   3952: 70 68 61 20 63 68 61 6e 6e 65 6c 20 c2 af 62 61   pha channel ..ba
+|   3968: 63 6b 75 70 20 61 62 61 6e 64 6f 6e 20 74 65 73   ckup abandon tes
+|   3984: 74 20 61 62 61 63 6b 20 63 68 61 6e 6e 65 62 6f   t aback channebo
+|   4000: 6f 6d 65 72 20 61 74 6f 6d 20 61 6c 70 68 61 20   omer atom alpha 
+|   4016: 61 63 74 69 76 65 09 07 03 00 19 61 74 6f 6d 69   active.....atomi
+|   4032: 63 07 06 03 00 15 61 74 6b 6d 0f e0 00 0b 19 62   c.....atkm.....b
+|   4048: 6f 6f 6d 65 72 09 04 03 00 19 61 63 74 69 76 65   oomer.....active
+|   4064: 00 00 00 0c 1b 61 62 61 6e 64 6f 6e 08 02 03 00   .....abandon....
+|   4080: 17 61 66 21 66 74 08 01 03 00 17 61 62 61 63 6b   .af!ft.....aback
+| page 5 offset 16384
+|      0: 0d 0f ee 00 06 0f d6 00 0f fa 0f f4 0f e8 0f e2   ................
+|     16: 0f dc 0f d6 0f d0 0f d0 00 00 00 00 00 00 00 00   ................
+|   4048: 0f ee 00 06 0e 0a 04 07 03 00 0e 01 04 06 03 00   ................
+|   4064: 0e 01 04 05 03 00 0e 1d 04 04 03 00 0e 01 00 00   ................
+|   4080: 00 06 0e 01 04 02 03 00 0e 01 04 01 03 00 0e 01   ................
+| page 6 offset 20480
+|      0: 0a 00 00 00 01 0f f4 00 0f f4 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 0b 03 1b 01 76 65 72 73 69 6f 6e 04   ........version.
+| page 7 offset 24576
+|      0: 0d 00 00 00 03 0f d6 00 0f f4 0f e1 0f d6 00 00   ................
+|   4048: 00 00 00 00 00 00 09 03 02 1b 72 65 62 75 69 6c   ..........rebuil
+|   4064: 64 11 02 02 2b 69 6e 74 65 67 72 69 74 79 2d 63   d...+integrity-c
+|   4080: 68 65 63 6b 0a 01 02 1d 6f 70 74 69 6d 69 7a 65   heck....optimize
+| end c19b.db
+}]} {}
+
+do_catchsql_test 18.1 {
+  INSERT INTO t1(t1) VALUES('optimize');
+} {1 {database disk image is malformed}}
+
+#--------------------------------------------------------------------------
+reset_db
+do_test 19.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 28672 pagesize 4096 filename c20b.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 01 00 00 00 07   .....@  ........
+|     32: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00   ................
+|     48: 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00   ................
+|     80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01   ................
+|     96: 00 2e 30 38 0d 00 00 00 07 0d d2 00 0f c4 0f 6d   ..08...........m
+|    112: 0f 02 0e ab 0e 4e 0d f6 0d d2 00 00 00 00 00 00   .....N..........
+|   3536: 00 00 22 07 06 17 11 11 01 31 74 61 62 6c 65 74   .........1tablet
+|   3552: 32 74 32 07 43 52 45 41 54 45 20 54 41 42 4c 45   2t2.CREATE TABLE
+|   3568: 20 74 32 28 78 29 56 06 06 17 1f 1f 01 7d 74 61    t2(x)V.......ta
+|   3584: 62 6c 65 74 31 5f 63 6f 6e 66 69 67 74 31 5f 63   blet1_configt1_c
+|   3600: 6f 6e 66 69 67 06 43 52 45 41 54 45 20 54 41 42   onfig.CREATE TAB
+|   3616: 4c 45 20 27 74 31 5f 63 6f 6e 66 69 67 27 28 6b   LE 't1_config'(k
+|   3632: 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20 76 29    PRIMARY KEY, v)
+|   3648: 20 57 49 54 48 4f 55 54 20 52 4f 57 49 44 5b 05    WITHOUT ROWID[.
+|   3664: 07 17 21 21 01 81 01 74 61 62 6c 65 74 31 5f 64   ..!!...tablet1_d
+|   3680: 6f 63 73 69 7a 65 74 31 5f 64 6f 63 73 69 7a 65   ocsizet1_docsize
+|   3696: 05 43 52 45 41 54 45 20 54 41 42 4c 45 20 27 74   .CREATE TABLE 't
+|   3712: 31 5f 64 6f 63 73 69 7a 65 27 28 69 64 20 49 4e   1_docsize'(id IN
+|   3728: 54 45 47 45 52 20 50 52 49 4d 41 52 59 20 4b 45   TEGER PRIMARY KE
+|   3744: 59 2c 20 73 7a 20 42 4c 4f 42 29 55 04 06 17 21   Y, sz BLOB)U...!
+|   3760: 21 01 77 74 61 62 6c 65 74 31 5f 63 6f 6e 74 65   !.wtablet1_conte
+|   3776: 6e 74 74 31 5f 63 6f 6e 74 65 6e 74 04 43 52 45   ntt1_content.CRE
+|   3792: 41 54 45 20 54 41 42 4c 45 20 27 74 31 5f 63 6f   ATE TABLE 't1_co
+|   3808: 6e 74 65 6e 74 27 28 69 64 20 49 4e 54 45 47 45   ntent'(id INTEGE
+|   3824: 52 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20 63   R PRIMARY KEY, c
+|   3840: 30 29 69 03 07 17 19 19 01 81 2d 74 61 62 6c 65   0)i.......-table
+|   3856: 74 31 5f 69 64 78 74 31 5f 69 64 78 03 43 52 45   t1_idxt1_idx.CRE
+|   3872: 41 54 45 20 54 41 42 4c 45 20 27 74 31 5f 69 64   ATE TABLE 't1_id
+|   3888: 78 27 28 73 65 67 69 64 2c 20 74 65 72 6d 2c 20   x'(segid, term, 
+|   3904: 70 67 6e 6f 2c 20 50 52 49 4d 41 52 59 20 4b 45   pgno, PRIMARY KE
+|   3920: 59 28 73 65 67 69 64 2c 20 74 65 72 6d 29 29 20   Y(segid, term)) 
+|   3936: 57 49 54 48 4f 55 54 20 52 4f 57 49 44 55 02 07   WITHOUT ROWIDU..
+|   3952: 17 1b 1b 01 81 01 74 61 62 6c 65 74 31 5f 64 61   ......tablet1_da
+|   3968: 74 61 74 31 5f 64 61 74 61 02 43 52 45 41 54 45   tat1_data.CREATE
+|   3984: 20 54 41 42 4c 45 20 27 74 31 5f 64 61 74 61 27    TABLE 't1_data'
+|   4000: 28 69 64 20 49 4e 54 45 47 45 52 20 50 52 49 4d   (id INTEGER PRIM
+|   4016: 41 52 59 20 4b 45 59 2c 20 62 6c 6f 63 6b 20 42   ARY KEY, block B
+|   4032: 4c 4f 42 29 3a 01 06 17 11 11 08 63 74 61 62 6c   LOB):......ctabl
+|   4048: 65 74 31 74 31 43 52 45 41 54 45 20 56 49 52 54   et1t1CREATE VIRT
+|   4064: 55 41 4c 20 54 41 42 4c 45 20 74 31 20 55 53 49   UAL TABLE t1 USI
+|   4080: 4e 47 20 66 74 73 35 28 63 6f 6e 74 65 6e 74 29   NG fts5(content)
+| page 2 offset 4096
+|      0: 0d 0f 20 00 05 0e a0 00 0f e8 0e a0 0f bd 0f 34   .. ............4
+|     16: 0e b7 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
+|   3744: 15 0a 03 00 30 00 00 00 00 01 03 03 00 03 01 01   ....0...........
+|   3760: 01 02 01 01 03 01 01 62 8c 80 80 80 80 01 04 00   .......b........
+|   3776: 81 48 00 00 00 55 06 30 61 62 61 63 6b 08 01 04   .H...U.0aback...
+|   3792: 04 6e 64 6f 6e 03 01 05 01 02 05 63 74 69 76 65   .ndon......ctive
+|   3808: 08 01 02 04 6c 70 68 61 08 01 02 03 74 6f 6d 08   ....lpha....tom.
+|   3824: 01 01 06 62 61 63 6b 75 70 08 01 02 05 6f 6f 6d   ...backup....oom
+|   3840: 65 72 08 01 01 07 63 68 61 6e 6e 65 6c 08 01 01   er....channel...
+|   3856: 04 74 65 73 74 08 01 04 09 0a 09 08 07 0a 09 0b   .test...........
+|   3872: 0f ef 00 14 2a 00 00 00 00 01 02 02 00 02 01 01   ....*...........
+|   3888: 01 02 01 01 81 01 88 80 80 80 80 01 04 00 82 06   ................
+|   3904: 00 00 00 72 06 30 61 62 61 63 6b 08 02 07 04 04   ...r.0aback.....
+|   3920: 6e 64 6f 6e 08 02 05 02 05 63 74 69 76 65 04 02   ndon.....ctive..
+|   3936: 02 04 02 0b 02 04 6c 70 68 61 08 04 02 0a 02 03   ......lpha......
+|   3952: 74 6f 6d 06 02 02 02 02 09 05 02 69 63 07 02 02   tom........ic...
+|   3968: 01 06 62 61 63 6b 75 70 08 02 04 02 05 6f 6f 66   ..backup.....oof
+|   3984: 65 72 05 02 02 04 03 6d 65 72 08 02 08 01 07 63   er.....mer.....c
+|   4000: 68 61 6e 6e 65 6c 08 02 03 01 04 74 65 73 74 08   hannel.....test.
+|   4016: 02 06 04 0a 09 0d 0a 0b 07 0b 0a 08 0c 24 84 80   .............$..
+|   4032: 80 80 80 01 03 00 4e 00 00 00 1e 06 30 61 62 61   ......N.....0aba
+|   4048: 63 6b 01 02 66 04 00 22 74 00 02 22 04 04 6e 64   ck..f...t.....nd
+|   4064: 6f 6e 03 02 02 04 0a 07 05 01 03 00 10 06 06 00   on..............
+|   4080: 00 00 11 24 00 00 00 00 01 01 01 00 01 01 01 01   ...$............
+| page 3 offset 8192
+|      0: 0a 00 00 00 03 0f ec 00 0f fa 0f f3 0f ec 00 00   ................
+|   4064: 00 00 00 00 00 00 00 00 00 00 00 00 06 04 01 0c   ................
+|   4080: 01 03 02 06 04 01 0c 01 02 02 05 04 09 0c 01 02   ................
+| page 4 offset 12288
+|      0: 0d 0f e0 00 06 0f b6 00 0f f6 0f ec 0f d5 0f ca   ................
+|     16: 0f c1 0f b6 0f 70 0f 70 00 00 00 00 00 00 00 00   .....p.p........
+|   3952: 0f e0 00 46 81 0d 61 6c 70 68 61 20 63 68 61 6e   ...F..alpha chan
+|   3968: 6e 65 6c 20 62 61 63 6b 75 70 20 61 62 61 6e 64   nel backup aband
+|   3984: 6f 6e 20 74 65 73 74 20 61 62 61 63 6b 20 62 6f   on test aback bo
+|   4000: 6f 6d 65 72 20 61 74 6f 6d 20 61 6c 70 68 61 20   omer atom alpha 
+|   4016: 61 63 74 69 76 65 09 07 03 00 19 61 74 6f 6d 69   active.....atomi
+|   4032: 63 07 06 03 00 15 61 74 6f 6d 09 05 03 00 19 62   c.....atom.....b
+|   4048: 6f 6f 66 65 72 09 04 03 00 19 61 63 74 69 76 65   oofer.....active
+|   4064: 00 00 00 0c 1b 61 62 61 6e 64 6f 6e 08 02 03 00   .....abandon....
+|   4080: 17 61 62 61 66 74 08 01 03 00 17 61 62 61 63 6b   .abaft.....aback
+| page 5 offset 16384
+|      0: 0d 0f ee 00 06 0f d6 00 0f fa 0f f4 0f e8 0f e2   ................
+|     16: 0f dc 0f d6 0f d0 0f d0 00 00 00 00 00 00 00 00   ................
+|   4048: 0f ee 00 06 0e 0a 04 07 03 00 0e 01 04 06 03 00   ................
+|   4064: 0e 01 04 05 03 00 0e 01 04 04 03 00 0e 01 00 00   ................
+|   4080: 00 06 0e 01 04 02 03 00 0e 01 04 01 03 00 0e 01   ................
+| page 6 offset 20480
+|      0: 0a 00 00 00 01 0f f4 00 0f f4 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 0b 03 1b 01 76 65 72 73 69 6f 6e 04   ........version.
+| page 7 offset 24576
+|      0: 0d 00 00 00 03 0f d6 00 0f f4 0f e1 0f d6 00 00   ................
+|   4048: 00 00 00 00 00 00 09 03 02 1b 72 65 62 75 69 6c   ..........rebuil
+|   4064: 64 11 02 02 2b 69 6e 74 65 67 72 69 74 79 2d 63   d...+integrity-c
+|   4080: 86 65 63 6b 0a 01 02 1d 6f 70 74 69 6d 69 7a 65   .eck....optimize
+| end c20b.db
+}]} {}
+
+do_catchsql_test 19.1 {
+  INSERT INTO t1(t1) VALUES('optimize');
+} {1 {database disk image is malformed}}
+
+#--------------------------------------------------------------------------
+reset_db
+do_test 20.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 28672 pagesize 4096 filename crash-cf347c523f793c.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 00 00 00 00 07   .....@  ........
+|     32: 00 00 00 00 00 00 00 00 00 00 00 07 00 00 00 00   ................
+|     48: 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00   ................
+|     96: 00 00 00 00 0d 00 00 00 07 0d d2 00 0f c4 0f 6d   ...............m
+|    112: 0f 02 0e ab 0e 4e 0d f6 0d d2 00 00 00 00 00 00   .....N..........
+|   3536: 00 00 22 07 06 17 11 11 01 31 74 61 62 6c 65 74   .........1tablet
+|   3552: 32 74 32 07 43 52 45 41 54 45 20 54 41 42 4c 45   2t2.CREATE TABLE
+|   3568: 20 74 32 28 78 29 56 06 06 17 1f 1f 01 7d 74 61    t2(x)V.......ta
+|   3584: 62 6c 65 74 31 5f 63 6f 6e 66 69 67 74 31 5f 63   blet1_configt1_c
+|   3600: 6f 6e 66 69 67 06 43 52 45 41 54 45 20 54 41 42   onfig.CREATE TAB
+|   3616: 4c 45 20 27 74 31 5f 63 6f 6e 66 69 67 27 28 6b   LE 't1_config'(k
+|   3632: 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20 76 29    PRIMARY KEY, v)
+|   3648: 20 57 49 54 48 4f 55 54 20 52 4f 57 49 44 5b 05    WITHOUT ROWID[.
+|   3664: 07 17 21 21 01 81 01 74 61 62 6c 65 74 31 5f 64   ..!!...tablet1_d
+|   3680: 6f 63 73 69 7a 65 74 31 5f 64 6f 63 73 69 7a 65   ocsizet1_docsize
+|   3696: 05 43 52 45 41 54 45 20 54 41 42 4c 45 20 27 74   .CREATE TABLE 't
+|   3712: 31 5f 64 6f 63 73 69 7a 65 27 28 69 64 20 49 4e   1_docsize'(id IN
+|   3728: 54 45 47 45 52 20 50 52 49 4d 41 52 59 20 4b 45   TEGER PRIMARY KE
+|   3744: 59 2c 20 73 7a 20 42 4c 4f 42 29 55 04 06 17 21   Y, sz BLOB)U...!
+|   3760: 21 01 77 74 61 62 6c 65 74 31 5f 63 6f 6e 74 65   !.wtablet1_conte
+|   3776: 6e 74 74 31 5f 63 6f 6e 74 65 6e 74 04 43 52 45   ntt1_content.CRE
+|   3792: 41 54 45 20 54 41 42 4c 45 20 27 74 31 5f 63 6f   ATE TABLE 't1_co
+|   3808: 6e 74 65 6e 74 27 28 69 64 20 49 4e 54 45 47 45   ntent'(id INTEGE
+|   3824: 52 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20 63   R PRIMARY KEY, c
+|   3840: 30 29 69 03 07 17 19 19 01 81 2d 74 61 62 6c 65   0)i.......-table
+|   3856: 74 31 5f 69 64 78 74 31 5f 69 64 78 03 43 52 45   t1_idxt1_idx.CRE
+|   3872: 41 54 45 20 54 41 42 4c 45 20 27 74 31 5f 69 64   ATE TABLE 't1_id
+|   3888: 78 27 28 73 65 67 69 64 2c 20 74 65 72 6d 2c 20   x'(segid, term, 
+|   3904: 70 67 6e 6f 2c 20 50 52 49 4d 41 52 59 20 4b 45   pgno, PRIMARY KE
+|   3920: 59 28 73 65 67 69 64 2c 20 74 65 72 6d 29 29 20   Y(segid, term)) 
+|   3936: 57 49 54 48 4f 55 54 20 52 4f 57 49 44 55 02 07   WITHOUT ROWIDU..
+|   3952: 17 1b 1b 01 81 01 74 61 62 6c 65 74 31 5f 64 61   ......tablet1_da
+|   3968: 74 61 74 31 5f 64 61 74 61 02 43 52 45 41 54 45   tat1_data.CREATE
+|   3984: 20 54 41 42 4c 45 20 27 74 31 5f 64 61 74 61 27    TABLE 't1_data'
+|   4000: 28 69 64 20 49 4e 54 45 47 45 52 20 50 52 49 4d   (id INTEGER PRIM
+|   4016: 41 52 59 20 4b 45 59 2c 20 62 6c 6f 63 6b 20 42   ARY KEY, block B
+|   4032: 4c 4f 42 29 3a 01 06 17 11 11 08 63 74 61 62 6c   LOB):......ctabl
+|   4048: 65 74 31 74 31 43 52 45 41 54 45 20 56 49 52 54   et1t1CREATE VIRT
+|   4064: 55 41 4c 20 54 41 42 4c 45 20 74 31 20 55 53 49   UAL TABLE t1 USI
+|   4080: 4e 47 20 66 74 73 35 28 63 6f 6e 74 65 6e 74 29   NG fts5(content)
+| page 2 offset 4096
+|      0: 0d 00 00 00 03 0f bd 00 0f e8 0f ef 0f bd 00 00   ................
+|   4016: 00 00 00 00 00 00 00 00 00 00 00 00 00 24 84 80   .............$..
+|   4032: 80 80 80 01 03 00 4e 00 00 00 1e 06 30 61 62 61   ......N.....0aba
+|   4048: 63 6b 01 02 02 04 02 66 74 02 02 02 04 04 6e 64   ck.....ft.....nd
+|   4064: 6f 6e 03 02 02 04 0a 07 05 01 03 00 10 03 03 0f   on..............
+|   4080: 0a 03 00 24 00 00 00 0e ee ee ee ee ee ee ee ee   ...$............
+| page 3 offset 8192
+|      0: ee ee ee ee ee ee ee ee ee ee ee ee ee ee ee ee   ................
+|     16: ee ee ee ee ee ee ee ee ee ee ee ee ee ee ee ee   ................
+|     32: ee ee ee ee ee ee ee ee ee ee ee ee 00 10 10 10   ................
+|     48: 00 10 10 10 10 a0 00 00 00 10 ff a0 00 ff 00 00   ................
+|   4080: 00 00 00 00 00 00 00 00 00 00 05 04 09 0c 01 02   ................
+| page 4 offset 12288
+|      0: 0d 00 00 00 03 0f e0 00 0f f6 0f ec 0f e0 00 00   ................
+|   4064: 0a 03 03 00 1b 61 62 61 6e 64 6f 6e 08 02 03 00   .....abandon....
+|   4080: 17 61 62 61 66 74 08 01 03 00 17 61 62 61 63 6b   .abaft.....aback
+| page 5 offset 16384
+|      0: 0d 00 00 00 03 0f ee 00 0f fa 0f f4 0f ee 00 00   ................
+|   4064: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 03   ................
+|   4080: 03 00 0e 01 04 02 03 00 0e 01 04 01 03 00 0e 01   ................
+| page 6 offset 20480
+|      0: 0a 00 00 00 01 0f f4 00 0f f4 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 0b 03 1b 01 76 65 72 73 69 6f 6e 04   ........version.
+| page 7 offset 24576
+|      0: 0d 00 00 00 03 0f d6 00 0f f4 0f e1 0f d6 00 00   ................
+|   4048: 00 00 00 00 00 00 09 03 02 1b 72 65 62 75 69 6c   ..........rebuil
+|   4064: 64 11 02 02 2b 69 6e 74 65 67 72 69 74 79 2d 63   d...+integrity-c
+|   4080: 68 65 63 6b 0a 01 02 1d 6f 70 74 69 6d 69 7a 65   heck....optimize
+| end crash-cf347c523f793c.db
+}]} {}
+
+do_catchsql_test 20.1 {
+  SELECT * FROM t1 WHERE t1 MATCH 'abandon';
+} {1 {vtable constructor failed: t1}}
+
+#-------------------------------------------------------------------------
+reset_db
+do_test 21.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 28672 pagesize 4096 filename c22b.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 01 00 00 00 07   .....@  ........
+|     32: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00   ................
+|     48: 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00   ................
+|     80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01   ................
+|     96: 00 2e 30 38 0d 00 00 00 07 0d d2 00 0f c4 0f 6d   ..08...........m
+|    112: 0f 02 0e ab 0e 4e 0d f6 0d d2 00 00 00 00 00 00   .....N..........
+|   3536: 00 00 22 07 06 17 11 11 01 31 74 61 62 6c 65 74   .........1tablet
+|   3552: 32 74 32 07 43 52 45 41 54 45 20 54 41 42 4c 45   2t2.CREATE TABLE
+|   3568: 20 74 32 28 78 29 56 06 06 17 1f 1f 01 7d 74 61    t2(x)V.......ta
+|   3584: 62 6c 65 74 31 5f 63 6f 6e 66 69 67 74 31 5f 63   blet1_configt1_c
+|   3600: 6f 6e 66 69 67 06 43 52 45 41 54 45 20 54 41 42   onfig.CREATE TAB
+|   3616: 4c 45 20 27 74 31 5f 63 6f 6e 66 69 67 27 28 6b   LE 't1_config'(k
+|   3632: 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20 76 29    PRIMARY KEY, v)
+|   3648: 20 57 49 54 48 4f 55 54 20 52 4f 57 49 44 5b 05    WITHOUT ROWID[.
+|   3664: 07 17 21 21 01 81 01 74 61 62 6c 65 74 31 5f 64   ..!!...tablet1_d
+|   3680: 6f 63 73 69 7a 65 74 31 5f 64 6f 63 73 69 7a 65   ocsizet1_docsize
+|   3696: 05 43 52 45 41 54 45 20 54 41 42 4c 45 20 27 74   .CREATE TABLE 't
+|   3712: 31 5f 64 6f 63 73 69 7a 65 27 28 69 64 20 49 4e   1_docsize'(id IN
+|   3728: 54 45 47 45 52 20 50 52 49 4d 41 52 59 20 4b 45   TEGER PRIMARY KE
+|   3744: 59 2c 20 73 7a 20 42 4c 4f 42 29 55 04 06 17 21   Y, sz BLOB)U...!
+|   3760: 21 01 77 74 61 62 6c 65 74 31 5f 63 6f 6e 74 65   !.wtablet1_conte
+|   3776: 6e 74 74 31 5f 63 6f 6e 74 65 6e 74 04 43 52 45   ntt1_content.CRE
+|   3792: 41 54 45 20 54 41 42 4c 45 20 27 74 31 5f 63 6f   ATE TABLE 't1_co
+|   3808: 6e 74 65 6e 74 27 28 69 64 20 49 4e 54 45 47 45   ntent'(id INTEGE
+|   3824: 52 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20 63   R PRIMARY KEY, c
+|   3840: 30 29 69 03 07 17 19 19 01 81 2d 74 61 62 6c 65   0)i.......-table
+|   3856: 74 31 5f 69 64 78 74 31 5f 69 64 78 03 43 52 45   t1_idxt1_idx.CRE
+|   3872: 41 54 45 20 54 41 42 4c 45 20 27 74 31 5f 69 64   ATE TABLE 't1_id
+|   3888: 78 27 28 73 65 67 69 64 2c 20 74 65 72 6d 2c 20   x'(segid, term, 
+|   3904: 70 67 6e 6f 2c 20 50 52 49 4d 41 52 59 20 4b 45   pgno, PRIMARY KE
+|   3920: 59 28 73 65 67 69 64 2c 20 74 65 72 6d 29 29 20   Y(segid, term)) 
+|   3936: 57 49 54 48 4f 55 54 20 52 4f 57 49 44 55 02 07   WITHOUT ROWIDU..
+|   3952: 17 1b 1b 01 81 01 74 61 62 6c 65 74 31 5f 64 61   ......tablet1_da
+|   3968: 74 61 74 31 5f 64 61 74 61 02 43 52 45 41 54 45   tat1_data.CREATE
+|   3984: 20 54 41 42 4c 45 20 27 74 31 5f 64 61 74 61 27    TABLE 't1_data'
+|   4000: 28 69 64 20 49 4e 54 45 47 45 52 20 50 52 49 4d   (id INTEGER PRIM
+|   4016: 41 52 59 20 4b 45 59 2c 20 62 6c 6f 63 6b 20 42   ARY KEY, block B
+|   4032: 4c 4f 42 29 3a 01 06 17 11 11 08 63 74 61 62 6c   LOB):......ctabl
+|   4048: 65 74 31 74 31 43 52 45 41 54 45 20 56 49 52 54   et1t1CREATE VIRT
+|   4064: 55 41 4c 20 54 41 42 4c 45 20 74 31 20 55 53 49   UAL TABLE t1 USI
+|   4080: 4e 47 20 66 74 73 35 28 63 6f 6e 74 65 6e 74 29   NG fts5(content)
+| page 2 offset 4096
+|      0: 0d 0e 8e 00 06 0e 2f 00 0f e8 0e 2f 0f bd 0f 3b   ....../..../...;
+|     16: 0e a5 0e 49 00 00 00 00 00 00 00 00 00 00 00 00   ...I............
+|   3616: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18   ................
+|   3632: 0a 03 00 36 00 00 00 00 01 04 04 00 04 01 01 01   ...6............
+|   3648: 02 01 01 03 01 01 04 01 01 3e 90 80 80 80 80 01   .........>......
+|   3664: 04 00 81 00 00 00 00 36 06 30 62 61 63 6b 75 05   .......6.0backu.
+|   3680: 02 04 05 02 04 02 05 65 61 6d 65 72 05 02 02 05   .......eamer....
+|   3696: 02 02 02 05 6f 6f 6d 65 72 05 01 05 01 02 05 75   ....oomer......u
+|   3712: 6d 6d 65 72 05 02 03 05 02 03 04 0d 0d 0b 0f 27   mmer...........'
+|   3728: 00 17 30 00 00 00 00 01 03 03 00 03 01 01 01 02   ..0.............
+|   3744: 01 01 03 01 01 7b 8c 80 80 80 80 01 04 00 81 7a   ...............z
+|   3760: 00 00 00 6d 06 30 61 62 61 63 6b 0d 02 07 04 04   ...m.0aback.....
+|   3776: 6e 64 6f 6e 0d 02 05 02 05 63 74 69 76 65 09 02   ndon.....ctive..
+|   3792: 02 04 02 0b 02 04 6c 70 68 61 0d 04 02 0a 02 03   ......lpha......
+|   3808: 74 6f 6d 0b 02 02 02 02 09 05 02 69 63 0c 02 02   tom........ic...
+|   3824: 01 06 62 61 63 6b 75 70 0d 02 04 02 05 6f 6f 6d   ..backup.....oom
+|   3840: 65 72 0a 02 02 03 02 08 01 07 63 68 61 6e 6e 65   er........channe
+|   3856: 6c 0d 02 03 01 04 74 65 73 74 0d 02 06 04 0a 09   l.....test......
+|   3872: 0d 0a 0b 07 0b 0d 0c 0f ef 00 14 2a 00 00 00 00   ...........*....
+|   3888: 01 02 02 00 02 01 01 01 02 01 01 7b 88 80 80 80   ................
+|   3904: 80 01 04 00 81 7a 00 00 00 6d 06 30 61 62 61 63   .....z...m.0abac
+|   3920: 6b 08 02 07 04 04 6e 64 6f 6e 08 02 05 02 05 63   k.....ndon.....c
+|   3936: 74 69 76 65 04 02 02 04 02 0b 02 04 6c 70 68 61   tive........lpha
+|   3952: 08 04 02 0a 02 03 74 6f 6d 06 02 02 02 02 09 05   ......tom.......
+|   3968: 02 69 63 07 02 02 01 06 62 61 63 6b 75 70 08 02   .ic.....backup..
+|   3984: 04 02 05 6f 6f 6d 65 72 05 02 02 03 02 08 01 07   ...oomer........
+|   4000: 63 68 61 6e 6e 65 6c 08 02 03 01 04 74 65 73 74   channel.....test
+|   4016: 08 02 06 04 0a 09 0d 0a 0b 07 0b 0d 0c 24 84 80   .............$..
+|   4032: 80 80 80 01 03 00 4e 00 00 00 1e 06 30 61 62 61   ......N.....0aba
+|   4048: 63 6b 01 02 02 04 02 66 74 00 02 22 04 04 6e 64   ck.....ft.....nd
+|   4064: 6f 6e 03 02 02 08 0a 07 05 01 03 00 10 0d 23 00   on............#.
+|   4080: 00 00 11 24 00 00 00 00 01 01 01 00 01 01 01 01   ...$............
+| page 3 offset 8192
+|      0: 0a 00 00 00 04 0f e5 00 0f fa 0f f3 0f ec 0f e5   ................
+|   4064: 00 00 00 00 00 06 04 01 0c 01 04 02 06 04 01 0c   ................
+|   4080: 01 03 02 06 04 01 0c 01 02 02 05 04 09 0c 01 02   ................
+| page 4 offset 12288
+|      0: 0d 0f 5a 00 0d 0e ce 00 0f f6 0f ec 0f e0 0f d5   ..Z.............
+|     16: 0e e7 0f c1 0f b6 0f 70 0f 65 0e ce 0f 51 0f 46   .......p.e...Q.F
+|     32: 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
+|   3776: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 17 0a   ................
+|   3792: 03 00 35 62 65 61 6d 65 72 20 62 75 6d 6d 65 72   ..5beamer bummer
+|   3808: 20 62 61 63 6b 75 29 17 05 03 00 35 62 65 61 6d    backu)....5beam
+|   3824: 65 72 20 62 75 6d 6d 65 72 20 62 61 63 6b 75 29   er bummer backu)
+|   3840: 44 0d 04 00 81 0d 61 6c 70 68 61 20 63 68 61 6e   D.....alpha chan
+|   3856: 6e 65 6c 20 62 61 63 6b 75 70 20 61 62 61 6e 64   nel backup aband
+|   3872: 6f 6e 20 74 65 73 74 20 61 62 61 63 6b 20 62 6f   on test aback bo
+|   3888: 6f 6d 65 72 20 61 74 6f 6d 20 61 6c 70 68 61 20   omer atom alpha 
+|   3904: 61 63 74 69 76 65 09 0c 03 00 19 61 74 6f 6d 69   active.....atomi
+|   3920: 63 07 0b 03 00 15 61 74 6f 6d 0f ca 00 0b 19 62   c.....atom.....b
+|   3936: 6f 6f 6d 65 72 09 09 03 00 19 61 63 74 69 76 65   oomer.....active
+|   3952: 44 08 04 00 81 0d 61 6c 70 68 61 20 63 68 61 6e   D.....alpha chan
+|   3968: 6e 65 6c 20 62 61 63 6b 75 70 20 61 62 61 6e 64   nel backup aband
+|   3984: 6f 6e 20 74 65 73 74 20 61 62 61 63 6b 20 62 6f   on test aback bo
+|   4000: 6f 6d 65 72 20 61 74 6f 6d 20 61 6c 70 68 61 20   omer atom alpha 
+|   4016: 61 63 74 69 76 65 09 07 03 00 19 61 74 6f 6d 69   active.....atomi
+|   4032: 63 07 06 03 00 15 61 74 6f 6d 00 00 00 0b 19 62   c.....atom.....b
+|   4048: 6f 6f 6d 65 72 09 04 03 00 19 61 63 74 69 76 65   oomer.....active
+|   4064: 0a 03 03 00 1b 61 62 61 6e 64 6f 6e 08 02 03 00   .....abandon....
+|   4080: 17 61 62 61 66 74 08 01 03 00 17 61 62 61 63 6b   .abaft.....aback
+| page 5 offset 16384
+|      0: 0d 00 00 00 0d 0f b2 00 0f fa 0f f4 0f ee 0f e8   ................
+|     16: 0f e2 0f dc 0f d6 0f d0 0f ca 0f c4 0f be 0f b8   ................
+|     32: 0f b2 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
+|   4016: 00 00 04 0d 03 00 0e 0a 04 0c 03 00 0e 01 04 0b   ................
+|   4032: 03 00 0e 01 04 0a 03 00 0e 03 04 09 03 00 0e 01   ................
+|   4048: 04 08 03 00 0e 0a 04 07 03 00 0e 01 04 06 03 00   ................
+|   4064: 0e 01 04 05 03 00 0e 03 04 04 03 00 0e 01 04 03   ................
+|   4080: 03 00 0e 01 04 02 03 00 0e 01 04 01 03 00 0e 01   ................
+| page 6 offset 20480
+|      0: 0a 00 00 00 01 0f f4 00 0f f4 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 0b 03 1b 01 76 65 72 73 69 6f 6e 04   ........version.
+| page 7 offset 24576
+|      0: 0d 00 00 00 03 0f d6 00 0f f4 0f e1 0f d6 00 00   ................
+|   4048: 00 00 00 00 00 00 09 03 02 1b 72 65 62 75 69 6c   ..........rebuil
+|   4064: 64 11 02 02 2b 69 6e 74 65 67 72 69 74 79 2d 63   d...+integrity-c
+|   4080: 68 65 63 6b 0a 01 02 1d 6f 70 74 69 6d 69 7a 65   heck....optimize
+| end c22b.db
+}]} {}
+
+do_catchsql_test 21.1 {
+  DELETE FROM t1 WHERE t1 MATCH 'ab*ndon';
+} {1 {database disk image is malformed}}
+
+#-------------------------------------------------------------------------
+#
+reset_db
+do_test 22.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 28672 pagesize 4096 filename c22b.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 02 00 00 00 07   .....@  ........
+|     32: 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 00   ................
+|     48: 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00   ................
+|     80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02   ................
+|     96: 00 2e 30 38 0d 00 00 00 07 0d d2 00 0f c4 0f 6d   ..08...........m
+|    112: 0f 02 0e ab 0e 4e 0d f6 0d d2 00 00 00 00 00 00   .....N..........
+|   3536: 00 00 22 07 06 17 11 11 01 31 74 61 62 6c 65 74   .........1tablet
+|   3552: 32 74 32 07 43 52 45 41 54 45 20 54 41 42 4c 45   2t2.CREATE TABLE
+|   3568: 20 74 32 28 78 29 56 06 06 17 1f 1f 01 7d 74 61    t2(x)V.......ta
+|   3584: 62 6c 65 74 31 5f 63 6f 6e 66 69 67 74 31 5f 63   blet1_configt1_c
+|   3600: 6f 6e 66 69 67 06 43 52 45 41 54 45 20 54 41 42   onfig.CREATE TAB
+|   3616: 4c 45 20 27 74 31 5f 63 6f 6e 66 69 67 27 28 6b   LE 't1_config'(k
+|   3632: 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20 76 29    PRIMARY KEY, v)
+|   3648: 20 57 49 54 48 4f 55 54 20 52 4f 57 49 44 5b 05    WITHOUT ROWID[.
+|   3664: 07 17 21 21 01 81 01 74 41 62 6c 65 74 31 5f 64   ..!!...tAblet1_d
+|   3680: 6f 63 73 69 7a 65 74 31 5f 64 6f 63 73 69 7a 65   ocsizet1_docsize
+|   3696: 05 43 52 45 41 54 45 20 54 41 42 4c 45 20 27 74   .CREATE TABLE 't
+|   3712: 31 5f 64 6f 63 73 69 7a 65 27 28 69 64 20 49 4e   1_docsize'(id IN
+|   3728: 54 45 47 45 52 20 50 52 49 4d 41 52 59 20 4b 45   TEGER PRIMARY KE
+|   3744: 59 2c 20 73 7a 20 42 4c 4f 42 29 55 04 06 17 21   Y, sz BLOB)U...!
+|   3760: 21 01 77 74 61 62 6c 65 74 31 5f 63 6f 6e 74 65   !.wtablet1_conte
+|   3776: 6e 74 74 31 5f 63 6f 6e 74 65 6e 74 04 43 52 45   ntt1_content.CRE
+|   3792: 41 54 45 20 54 41 42 4c 45 20 27 74 31 5f 63 6f   ATE TABLE 't1_co
+|   3808: 6e 74 65 6e 74 27 28 69 64 20 49 4e 54 45 47 45   ntent'(id INTEGE
+|   3824: 52 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20 63   R PRIMARY KEY, c
+|   3840: 30 29 69 03 07 17 19 19 01 81 2d 74 61 62 6c 65   0)i.......-table
+|   3856: 74 31 5f 69 64 78 74 31 5f 69 64 78 03 43 52 45   t1_idxt1_idx.CRE
+|   3872: 41 54 45 20 54 41 42 4c 45 20 27 74 31 5f 69 64   ATE TABLE 't1_id
+|   3888: 78 27 28 73 65 67 69 64 2c 20 74 65 72 6d 2c 20   x'(segid, term, 
+|   3904: 70 67 6e 6f 2c 20 50 52 49 4d 41 52 59 20 4b 45   pgno, PRIMARY KE
+|   3920: 59 28 73 65 67 69 64 2c 20 74 65 72 6d 29 29 20   Y(segid, term)) 
+|   3936: 57 49 54 48 4f 55 54 20 52 4f 57 49 44 55 02 07   WITHOUT ROWIDU..
+|   3952: 17 1b 1b 01 81 01 74 61 62 6c 65 74 31 5f 64 61   ......tablet1_da
+|   3968: 74 61 74 31 5f 64 61 74 61 02 43 52 45 41 54 45   tat1_data.CREATE
+|   3984: 20 54 41 42 4c 45 20 27 74 31 5f 64 61 74 61 27    TABLE 't1_data'
+|   4000: 28 69 64 20 49 4e 54 45 47 45 52 20 50 52 49 4d   (id INTEGER PRIM
+|   4016: 41 52 59 20 4b 45 59 2c 20 62 6c 6f 63 6b 20 42   ARY KEY, block B
+|   4032: 4c 4f 42 29 3a 01 06 17 11 11 08 63 74 61 62 6c   LOB):......ctabl
+|   4048: 65 74 31 74 31 43 52 45 41 54 45 20 56 49 52 54   et1t1CREATE VIRT
+|   4064: 75 41 4c 20 54 41 42 4c 45 20 74 31 20 55 53 49   uAL TABLE t1 USI
+|   4080: 4e 47 20 66 74 73 35 28 63 6f 6e 74 65 6e 74 29   NG fts5(content)
+| page 2 offset 4096
+|      0: 0d 0f 15 00 05 08 4e 00 0f e8 08 4e 0f bd 0f 29   ......N....N...)
+|     16: 08 65 00 00 00 00 00 00 00 00 00 00 00 00 00 00   .e..............
+|   2112: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 15 0a   ................
+|   2128: 03 00 30 00 00 00 00 01 03 02 01 03 01 01 01 02   ..0.............
+|   2144: 01 01 03 01 01 8d 28 8c 80 80 80 80 01 04 00 9a   ......(.........
+|   2160: 54 00 00 06 77 19 30 30 30 30 30 30 33 30 66 65   T...w.00000030fe
+|   2176: 65 30 30 30 66 66 61 30 66 66 34 30 66 65 65 05   e000ffa0ff40fee.
+|   2192: 02 19 02 0b 31 30 66 66 61 30 30 30 66 66 61 05   ....10ffa000ffa.
+|   2208: 06 13 18 09 02 25 33 34 33 35 32 34 35 34 31 35   .....%3435245415
+|   2224: 34 34 35 32 30 35 34 34 31 34 32 34 63 34 35 32   445205441424c452
+|   2240: 30 32 37 37 34 33 31 35 66 36 39 05 02 07 02 37   02774315f69....7
+|   2256: 34 30 33 30 33 30 30 30 65 30 31 30 34 30 32 30   40303000e0104020
+|   2272: 33 30 30 30 65 30 31 30 34 30 31 30 33 30 30 30   3000e01040103000
+|   2288: 65 30 31 30 61 30 30 30 30 30 30 30 31 30 66 66   e010a000000010ff
+|   2304: 34 30 30 30 66 66 34 05 02 1b 02 27 35 30 34 30   4000ff4....'5040
+|   2320: 39 30 63 30 31 30 32 30 64 30 30 30 30 30 30 30   90c01020d0000000
+|   2336: 33 30 66 65 30 30 30 30 66 66 36 30 66 65 63 30   30fe0000ff60fec0
+|   2352: 66 65 30 05 02 2c 27 02 66 30 05 02 16 02 1d 36   fe0..,'.f0.....6
+|   2368: 31 37 31 31 31 31 30 38 36 33 37 34 36 31 36 32   1711110863746162
+|   2384: 36 63 36 35 37 34 33 31 37 34 33 31 05 02 0d 02   6c6574317431....
+|   2400: 29 39 30 33 30 32 31 62 37 32 36 35 36 32 37 35   )903021b72656275
+|   2416: 36 34 36 31 37 34 36 31 37 34 33 31 35 66 36 34   6461746174315f64
+|   2432: 36 31 37 34 36 31 30 32 34 33 05 02 1f 02 43 61   6174610243....Ca
+|   2448: 30 33 30 33 30 30 31 62 36 31 36 32 36 31 36 65   0303001b6162616e
+|   2464: 36 34 36 66 36 65 30 38 30 32 30 33 30 30 31 37   646f6e0802030017
+|   2480: 36 31 36 32 36 31 36 36 37 34 30 38 30 31 30 33   6162616674080103
+|   2496: 30 30 31 37 36 31 36 32 36 31 36 33 36 62 30 64   0017616261636b0d
+|   2512: 30 30 05 02 18 34 1d 33 36 62 30 31 30 32 30 32   00...4.36b010202
+|   2528: 30 34 30 32 36 36 37 34 30 32 30 32 30 32 30 34   0402667402020204
+|   2544: 30 34 36 65 05 02 2e 02 33 62 30 33 31 62 30 31   046e....3b031b01
+|   2560: 37 36 36 35 37 32 37 33 36 39 36 66 36 65 30 34   76657273696f6e04
+|   2576: 30 64 30 30 30 30 30 30 30 33 30 66 64 36 30 30   0d000000030fd600
+|   2592: 30 66 66 34 30 66 65 31 30 66 64 36 05 02 1d 01   0ff40fe10fd6....
+|   2608: 04 31 66 62 64 05 04 10 18 01 01 32 05 02 14 02   .1fbd......2....
+|   2624: 43 34 38 34 38 30 38 30 38 30 38 30 30 31 30 33   C484808080800103
+|   2640: 30 30 34 65 30 30 30 30 30 30 31 65 30 36 33 30   004e0000001e0630
+|   2656: 36 31 36 32 36 31 36 33 36 62 30 31 30 32 30 32   616261636b010202
+|   2672: 30 34 30 32 36 36 37 34 30 32 30 32 30 32 30 34   0402667402020204
+|   2688: 30 34 36 65 05 04 11 18 02 01 66 05 02 2a 03 02   046e......f..*..
+|   2704: 65 72 05 02 31 01 08 33 35 32 38 36 33 36 66 05   er..1..3528636f.
+|   2720: 02 24 02 03 66 65 30 05 04 17 18 01 2b 34 31 35   .$..fe0.....+415
+|   2736: 32 35 39 32 30 34 62 34 35 35 39 32 63 32 30 36   259204b45592c206
+|   2752: 32 36 63 36 66 36 33 36 62 32 30 34 32 34 63 34   26c6f636b20424c4
+|   2768: 66 34 32 32 39 33 61 30 05 02 0c 2c 1f 31 30 36   f42293a0...,.106
+|   2784: 31 37 31 31 31 31 30 38 36 33 37 34 36 31 36 32   1711110863746162
+|   2800: 36 63 36 35 37 34 33 31 37 34 33 31 05 02 22 02   6c6574317431....
+|   2816: 40 33 35 32 34 35 34 31 35 34 34 35 32 30 35 36   @352454154452056
+|   2832: 34 39 35 32 35 34 37 35 34 31 34 63 32 30 35 34   49525475414c2054
+|   2848: 34 31 34 32 34 63 34 35 32 30 37 34 33 31 32 30   41424c4520743120
+|   2864: 35 35 35 33 34 39 34 65 34 37 32 30 36 36 37 34   5553494e47206674
+|   2880: 37 05 02 23 42 09 33 33 35 32 38 36 33 36 66 05   7..#B.33528636f.
+|   2896: 02 0e 02 03 66 65 65 05 02 1a 01 34 35 32 34 35   ....fee....45245
+|   2912: 34 31 35 34 34 35 32 30 35 34 34 31 34 32 34 63   415445205441424c
+|   2928: 34 35 32 30 32 37 37 34 33 31 35 66 36 34 36 31   45202774315f6461
+|   2944: 37 34 36 31 32 37 32 38 36 39 36 34 32 30 34 39   7461272869642049
+|   2960: 05 02 20 16 37 c3 b0 35 32 30 32 37 37 34 33 31   .. .7..520277431
+|   2976: 35 66 36 34 36 31 37 34 36 31 32 37 32 38 36 39   5f64617461272869
+|   2992: 36 34 32 30 34 39 34 65 35 34 34 35 34 37 34 35   6420494e54454745
+|   3008: 35 32 32 30 35 30 35 32 34 39 34 64 05 02 0b 03   52205052494d....
+|   3024: 48 35 39 32 30 34 62 34 35 35 39 32 63 32 30 36   H59204b45592c206
+|   3040: 33 33 30 32 39 36 39 30 33 30 30 30 31 35 37 35   3302969030001575
+|   3056: 33 31 31 39 32 36 64 37 34 36 31 36 32 36 63 36   311926d7461626c6
+|   3072: 35 37 34 33 31 35 66 36 39 36 34 37 38 37 34 33   574315f696478743
+|   3088: 31 35 66 36 39 36 34 37 38 05 02 06 02 38 34 32   15f696478....842
+|   3104: 30 35 32 34 66 35 37 34 39 34 34 35 35 30 32 30   0524f57494455020
+|   3120: 37 31 37 31 62 31 62 30 31 38 31 30 31 37 34 36   7171b1b018101746
+|   3136: 31 36 32 36 63 36 35 37 34 33 31 35 66 31 37 34   1626c6574315f174
+|   3152: 36 31 30 32 34 33 05 02 0a 02 03 66 66 34 05 02   610243.....ff4..
+|   3168: 1c 01 4a 36 34 36 66 36 65 30 33 30 32 30 32 30   ..J646f6e0302020
+|   3184: 34 30 61 30 37 30 35 30 31 30 33 30 30 31 30 30   40a0705010300100
+|   3200: 33 30 33 30 66 30 61 30 33 30 30 32 34 30 30 30   3030f0a030024000
+|   3216: 30 30 30 30 30 30 31 30 31 30 31 30 30 30 31 30   0000001010100010
+|   3232: 31 30 31 30 30 39 61 30 30 30 30 30 30 05 02 2f   101009a000000../
+|   3248: 42 09 31 30 61 30 30 30 30 30 30 05 02 28 08 43   B.10a000000..(.C
+|   3264: 74 30 32 30 32 30 34 30 61 30 37 30 35 30 31 30   t0202040a0705010
+|   3280: 33 30 30 31 30 30 33 30 33 30 66 30 61 30 33 30   3001003030f0a030
+|   3296: 30 32 34 30 30 30 30 30 30 30 30 30 31 30 31 30   0240000000001010
+|   3312: 31 30 30 30 31 30 31 30 31 30 31 30 61 30 30 30   100010101010a000
+|   3328: 30 30 30 05 02 12 02 49 37 36 65 36 66 32 63 32   000....I76e6f2c2
+|   3344: 30 35 30 35 32 34 39 34 64 34 31 35 32 35 39 32   05052494d4152592
+|   3360: 30 34 62 34 35 35 39 32 38 37 33 36 35 36 37 36   04b4559287365676
+|   3376: 39 36 34 32 63 32 30 37 34 36 35 37 32 36 64 32   9642c207465726d2
+|   3392: 39 32 39 32 30 35 37 34 39 35 34 34 38 34 66 35   92920574954484f5
+|   3408: 35 05 02 09 02 4c 39 37 61 36 35 37 34 33 31 35   5....L97a6574315
+|   3424: 66 36 34 36 66 36 33 37 33 36 39 37 61 36 35 30   f646f6373697a650
+|   3440: 35 34 33 35 32 34 35 34 31 35 34 34 35 32 30 35   5435245415445205
+|   3456: 34 38 36 39 36 34 32 30 34 39 34 65 35 34 34 35   48696420494e5445
+|   3472: 34 37 34 35 35 32 32 30 35 30 35 32 34 39 34 34   4745522050524944
+|   3488: 64 31 05 02 05 02 27 65 37 34 36 35 36 65 37 34   d1....'e74656e74
+|   3504: 32 39 30 64 30 30 30 30 30 30 30 33 30 66 62 64   290d000000030fbd
+|   3520: 30 30 30 62 65 38 30 66 65 66 30 66 62 64 05 02   000be80fef0fbd..
+|   3536: 0f 1e 0b 66 65 38 30 66 65 66 30 66 62 64 05 02   ...fe80fef0fbd..
+|   3552: 25 02 03 66 64 36 05 02 1e 01 4a 37 36 32 39 32   %..fd6....J76292
+|   3568: 30 35 37 34 39 35 34 34 38 34 66 35 35 35 34 32   0574954484f55542
+|   3584: 30 35 32 34 66 35 37 34 39 34 34 35 62 30 35 30   0524f5749445b050
+|   3600: 37 31 37 32 31 32 31 30 31 38 31 30 31 37 34 36   7172121018101746
+|   3616: 31 36 32 36 63 36 35 37 34 33 31 35 66 36 34 36   1626c6574315f646
+|   3632: 66 36 33 37 33 05 02 04 02 21 38 32 37 32 38 37   f6373....!827287
+|   3648: 33 36 35 36 37 36 39 36 34 32 63 32 30 37 34 36   3656769642c20746
+|   3664: 35 37 32 36 64 32 63 32 30 37 30 05 02 08 01 01   5726d2c2070.....
+|   3680: 61 05 02 2b 01 06 62 61 63 6b 75 70 05 02 32 02   a..+..backup..2.
+|   3696: 05 65 61 6d 65 72 05 02 02 02 05 6f 6f 6d 65 72   .eamer.....oomer
+|   3712: 05 01 02 40 75 6d 6d 32 34 63 34 35 32 30 32 37   ...@umm24c452027
+|   3728: 37 34 33 31 35 66 36 33 36 66 36 65 36 36 36 39   74315f636f6e6669
+|   3744: 36 37 32 37 32 38 36 62 32 30 35 30 35 32 34 39   6727286b20505249
+|   3760: 34 64 34 31 35 32 35 39 32 30 34 62 34 35 35 39   4d415259204b4559
+|   3776: 32 63 32 30 05 02 03 01 15 65 35 34 34 35 34 37   2c20.....e544547
+|   3792: 34 35 35 32 32 30 35 30 35 32 34 39 34 64 05 02   4552205052494d..
+|   3808: 21 01 02 66 61 05 02 15 04 1d 12 2a 3c 2c 07 22   !..fa......*<,..
+|   3824: 2e 48 22 38 0a 06 49 06 07 0d 09 30 24 45 0e 08   .H.8..I....0$E..
+|   3840: 39 3c 4d 3d 08 4f 0e 48 4e 51 2c 10 08 4f 26 06   9<M=.O.HNQ,..O&.
+|   3856: 0b 0a 09 45 1a 0f ef 00 14 2a 00 00 00 00 01 02   ...E.....*......
+|   3872: 01 01 02 01 01 01 02 01 01 81 0c 88 80 80 80 80   ................
+|   3888: 01 04 00 82 1c 00 00 00 7c 08 30 61 62 61 6e 64   ........|.0aband
+|   3904: 6f 6e 08 02 05 02 05 63 74 69 76 65 04 02 02 04   on.....ctive....
+|   3920: 02 0b 02 04 6c 70 68 61 08 04 02 0a 02 03 74 6b   ....lpha......tk
+|   3936: 6d 06 02 02 03 02 6f 6d 08 02 09 05 02 69 63 07   m.....om.....ic.
+|   3952: 02 02 01 06 62 61 63 6b 75 70 08 02 04 02 05 6f   ....backup.....o
+|   3968: 6f 6d 65 72 05 02 02 01 0c 63 68 61 6e 6e 65 62   omer.....channeb
+|   3984: 6f 6f 6d 65 72 08 02 08 07 01 6c 08 02 03 01 06   oomer.....l.....
+|   4000: 73 74 61 61 63 6b 08 02 07 01 03 74 65 62 08 02   staack.....teb..
+|   4016: 06 04 0c 0d 0a 08 07 07 0b 0a 11 06 0b 24 84 80   .............$..
+|   4032: 80 80 80 01 03 00 4e 00 00 00 1e 06 30 61 62 61   ......N.....0aba
+|   4048: 63 6b 01 02 02 04 02 66 74 02 02 02 04 04 6e 64   ck.....ft.....nd
+|   4064: 6f 6e 03 02 02 04 0a 07 05 01 03 00 10 08 41 00   on............A.
+|   4080: 00 00 11 24 00 00 00 00 01 01 00 01 01 01 01 01   ...$............
+| page 3 offset 8192
+|      0: 0a 00 00 00 03 0f ec 00 ff 00 0f f3 0f ec 00 00   ................
+|   4064: 00 00 00 00 00 00 00 00 00 00 00 00 06 04 01 0c   ................
+|   4080: 01 03 02 06 04 01 0c 01 02 02 05 04 09 0c 01 02   ................
+| page 4 offset 12288
+|      0: 0d 0f ca 00 08 07 e1 00 0f f6 0f ec 0f e0 0f d5   ................
+|     16: 07 e1 0f c1 0f b6 0f 6a 00 00 00 00 00 00 00 00   .......j........
+|   2016: 00 8f 06 05 04 00 9e 11 62 65 61 6d 65 72 20 62   ........beamer b
+|   2032: 75 6d 6d 32 34 63 34 35 32 30 32 37 37 34 33 31   umm24c4520277431
+|   2048: 35 66 36 33 36 66 36 65 36 36 36 39 36 37 32 37   5f636f6e66696727
+|   2064: 32 38 36 62 32 30 35 30 35 32 34 39 34 64 34 31   286b205052494d41
+|   2080: 35 32 35 39 32 30 34 62 34 35 35 39 32 63 32 30   5259204b45592c20
+|   2096: 0a 37 36 32 39 32 30 35 37 34 39 35 34 34 38 34   .762920574954484
+|   2112: 66 35 35 35 34 32 30 35 32 34 66 35 37 34 39 34   f555420524f57494
+|   2128: 34 35 62 30 35 30 37 31 37 32 31 32 31 30 31 38   45b0507172121018
+|   2144: 31 30 31 37 34 36 31 36 32 36 63 36 35 37 34 33   1017461626c65743
+|   2160: 31 35 66 36 34 36 66 36 33 37 33 0a 36 39 37 61   15f646f6373.697a
+|   2176: 36 35 37 34 33 31 35 66 36 34 36 66 36 33 37 33   6574315f646f6373
+|   2192: 36 39 37 61 36 35 30 35 34 33 35 32 34 35 34 31   697a650543524541
+|   2208: 35 34 34 35 32 30 35 34 38 36 39 36 34 32 30 34   5445205486964204
+|   2224: 39 34 65 35 34 34 35 34 37 34 35 35 32 32 30 35   94e5445474552205
+|   2240: 30 35 32 34 39 34 34 64 31 0a 35 32 35 39 32 30   0524944d1.525920
+|   2256: 34 62 34 35 35 39 32 63 32 30 36 33 33 30 32 39   4b45592c20633029
+|   2272: 36 39 30 33 30 30 30 31 35 37 35 33 31 31 39 32   6903000157531192
+|   2288: 36 64 37 34 36 31 36 32 36 63 36 35 37 34 33 31   6d7461626c657431
+|   2304: 35 66 36 39 36 34 37 38 37 34 33 31 35 66 36 39   5f69647874315f69
+|   2320: 36 34 37 38 0a 30 33 34 33 35 32 34 35 34 31 35   6478.03435245415
+|   2336: 34 34 35 32 30 35 34 34 31 34 32 34 63 34 35 32   445205441424c452
+|   2352: 30 32 37 37 34 33 31 35 66 36 39 01 0e 37 38 32   02774315f69..782
+|   2368: 37 32 38 37 33 36 35 36 37 36 39 36 34 32 63 32   72873656769642c2
+|   2384: 30 37 34 36 35 37 32 36 64 32 63 32 30 37 30 0a   07465726d2c2070.
+|   2400: 36 37 36 65 36 66 32 63 32 30 35 30 35 32 34 39   676e6f2c20505249
+|   2416: 34 64 34 31 35 32 35 39 32 30 34 62 34 35 35 39   4d415259204b4559
+|   2432: 32 38 37 33 36 35 36 37 36 39 36 34 32 63 32 30   2873656769642c20
+|   2448: 37 34 36 35 37 32 36 64 32 39 32 39 32 30 35 37   7465726d29292057
+|   2464: 34 39 35 34 34 38 34 66 35 35 0a 35 34 32 30 35   4954484f55.54205
+|   2480: 32 34 66 35 37 34 39 34 34 35 35 30 32 30 37 31   24f5749445502071
+|   2496: 37 31 62 31 62 30 31 38 31 30 31 37 34 36 31 36   71b1b01810174616
+|   2512: 32 36 63 36 35 37 34 33 31 35 66 31 37 34 36 31   26c6574315f17461
+|   2528: 30 32 34 33 0a 35 32 34 35 34 31 35 34 34 35 32   0243.52454154452
+|   2544: 30 35 34 34 31 34 32 34 63 34 c3 b0 35 32 30 32   05441424c4..5202
+|   2560: 37 37 34 33 31 35 66 36 34 36 31 37 34 36 31 32   774315f646174612
+|   2576: 37 32 38 36 39 36 34 32 30 34 39 34 65 35 34 34   728696420494e544
+|   2592: 35 34 37 34 35 35 32 32 30 35 30 35 32 34 39 34   5474552205052494
+|   2608: 64 0a 34 31 35 32 35 39 32 30 34 62 34 35 35 39   d.415259204b4559
+|   2624: 32 63 32 30 36 32 36 63 36 66 36 33 36 62 32 30   2c20626c6f636b20
+|   2640: 34 32 34 63 34 66 34 32 32 39 33 61 30 21 30 36   424c4f42293a0!06
+|   2656: 31 37 31 31 31 31 30 38 36 33 37 34 36 31 36 32   1711110863746162
+|   2672: 36 63 36 35 37 34 33 31 37 34 33 31 0a 34 33 35   6c6574317431.435
+|   2688: 32 34 35 34 31 35 34 34 35 32 30 35 36 34 39 35   2454154452056495
+|   2704: 32 35 34 37 35 34 31 34 63 32 30 35 34 34 31 34   25475414c2054414
+|   2720: 32 34 63 34 35 32 30 37 34 33 31 32 30 35 35 35   24c4520743120555
+|   2736: 33 34 39 34 65 34 37 32 30 36 36 37 34 37 33 33   3494e47206674733
+|   2752: 35 32 38 36 33 36 66 0a 36 65 37 34 36 35 36 65   528636f.6e74656e
+|   2768: 37 34 32 39 30 64 30 30 30 30 30 30 30 33 30 66   74290d000000030f
+|   2784: 62 64 30 30 30 62 65 38 30 66 65 66 30 66 62 64   bd000be80fef0fbd
+|   2800: 0a 5b 31 66 62 64 5d 32 34 38 34 38 30 38 30 38   .[1fbd]248480808
+|   2816: 30 38 30 30 31 30 33 30 30 34 65 30 30 30 30 30   0800103004e00000
+|   2832: 30 31 65 30 36 33 30 36 31 36 32 36 31 36 33 36   01e0630616261636
+|   2848: 62 30 31 30 32 30 32 30 34 30 32 36 36 37 34 30   b010202040266740
+|   2864: 32 30 32 30 32 30 34 30 34 36 65 0a 36 34 36 66   2020204046e.646f
+|   2880: 36 65 30 54 30 32 30 32 30 34 30 61 30 37 30 35   6e0T0202040a0705
+|   2896: 30 31 30 33 30 30 31 30 30 33 30 33 30 66 30 61   0103001003030f0a
+|   2912: 30 33 30 30 32 34 30 30 30 30 30 30 30 30 30 31   0300240000000001
+|   2928: 30 31 30 31 30 30 30 31 30 31 30 31 30 31 30 61   010100010101010a
+|   2944: 30 30 30 30 30 30 0a 30 31 30 66 66 61 30 30 30   000000.010ffa000
+|   2960: 66 66 61 0a 5b 32 21 66 61 5d 30 35 30 34 30 39   ffa.[2!fa]050409
+|   2976: 30 63 30 31 30 32 30 64 30 30 30 30 30 30 30 33   0c01020d00000003
+|   2992: 30 66 65 30 30 30 30 66 66 36 30 66 65 63 30 66   0fe0000ff60fec0f
+|   3008: 66 30 0a 5b 33 66 65 30 5d 30 61 30 33 30 33 30   f0.[3fe0]0a03030
+|   3024: 30 31 62 36 31 36 32 36 31 36 65 36 34 36 66 36   01b6162616e646f6
+|   3040: 65 30 38 30 32 30 33 30 30 31 37 36 31 36 32 36   e080203001761626
+|   3056: 31 36 36 37 34 30 38 30 31 30 33 30 30 31 37 36   1667408010300176
+|   3072: 31 36 32 36 31 36 33 36 62 30 64 30 30 0a 30 30   16261636b0d00.00
+|   3088: 30 30 30 33 30 66 65 65 30 30 30 66 66 61 30 66   00030fee000ffa0f
+|   3104: 66 34 30 66 65 65 0a 5b 34 66 65 65 5d 30 34 30   f40fee.[4fee]040
+|   3120: 33 30 33 30 30 30 65 30 31 30 34 30 32 30 33 30   303000e010402030
+|   3136: 30 30 65 30 31 30 34 30 31 30 33 30 30 30 65 30   00e01040103000e0
+|   3152: 31 30 61 30 30 30 30 30 30 30 31 30 66 66 34 30   10a000000010ff40
+|   3168: 30 30 66 66 34 0a 5b 35 66 66 34 5d 30 62 30 33   00ff4.[5ff4]0b03
+|   3184: 31 62 30 31 37 36 36 35 37 32 37 33 36 39 36 66   1b0176657273696f
+|   3200: 36 65 30 34 30 64 30 30 30 30 30 30 30 33 30 66   6e040d000000030f
+|   3216: 64 36 30 30 30 66 66 34 30 66 65 31 30 66 64 36   d6000ff40fe10fd6
+|   3232: 0a 5b 36 66 64 36 5d 30 39 30 33 30 32 31 62 37   .[6fd6]0903021b7
+|   3248: 32 36 35 36 32 37 35 36 34 36 31 37 34 36 31 37   2656275646174617
+|   3264: 34 33 31 35 66 36 34 36 31 37 34 36 31 30 32 34   4315f64617461024
+|   3280: 33 0a 35 32 34 35 34 31 35 34 34 35 32 30 35 34   3.52454154452054
+|   3296: 34 31 34 32 34 63 34 35 32 30 32 37 37 34 33 31   41424c4520277431
+|   3312: 35 66 36 34 36 31 37 34 36 31 32 37 32 38 36 39   5f64617461272869
+|   3328: 36 34 32 30 34 39 c2 81 65 35 34 34 35 34 37 34   642049..e5445474
+|   3344: 35 35 32 32 30 35 30 35 32 34 39 34 64 0a 34 31   552205052494d.41
+|   3360: 35 32 35 39 32 30 34 62 34 35 35 39 32 63 32 30   5259204b45592c20
+|   3376: 36 32 36 63 36 66 36 33 36 62 32 30 34 32 34 63   626c6f636b20424c
+|   3392: 34 66 34 32 32 39 33 61 30 31 30 36 31 37 31 31   4f42293a01061711
+|   3408: 31 31 30 38 36 33 37 34 36 31 36 32 36 63 36 35   1108637461626c65
+|   3424: 37 34 33 31 37 34 33 31 0a 34 33 35 32 34 35 34   74317431.4352454
+|   3440: 31 35 34 34 35 32 30 35 36 34 39 35 32 35 34 37   1544520564952547
+|   3456: 35 34 31 34 63 32 30 35 34 34 31 34 32 34 63 34   5414c205441424c4
+|   3472: 35 32 30 37 34 33 31 32 30 35 35 35 33 34 39 34   5207431205553494
+|   3488: 65 34 37 32 30 36 36 37 34 37 3b 33 35 32 38 36   e472066747;35286
+|   3504: 33 36 66 0a 36 65 37 34 36 35 36 65 37 34 32 39   36f.6e74656e7429
+|   3520: 30 64 30 30 30 30 30 30 30 33 30 66 62 64 30 30   0d000000030fbd00
+|   3536: 30 66 65 38 30 66 65 66 30 66 62 64 0a 5b 31 66   0fe80fef0fbd.[1f
+|   3552: 62 64 5d 32 34 38 34 38 30 38 30 38 30 38 30 30   bd]2484808080800
+|   3568: 31 30 33 30 30 34 65 30 30 30 30 30 30 31 65 30   103004e0000001e0
+|   3584: 36 33 30 36 31 36 32 36 31 36 33 36 62 30 31 30   630616261636b010
+|   3600: 32 30 32 30 34 30 32 36 36 37 34 30 32 30 32 30   2020402667402020
+|   3616: 32 30 34 30 34 36 65 0a 36 34 36 66 36 65 30 33   204046e.646f6e03
+|   3632: 30 32 30 32 30 34 30 61 30 37 30 35 30 31 30 33   0202040a07050103
+|   3648: 30 30 31 30 30 33 30 33 30 66 30 61 30 33 30 30   001003030f0a0300
+|   3664: 32 34 30 30 30 30 30 30 30 30 30 31 30 31 30 31   2400000000010101
+|   3680: 30 30 30 31 30 31 30 31 30 31 30 61 30 30 30 30   00010101010a0000
+|   3696: 30 30 0a 30 31 30 66 66 61 30 30 30 66 66 61 0a   00.010ffa000ffa.
+|   3712: 5b 32 66 29 61 5d 30 35 30 34 30 39 30 63 30 31   [2f)a]0504090c01
+|   3728: 30 32 30 64 30 30 30 30 30 30 30 33 30 66 65 30   020d000000030fe0
+|   3744: 30 30 30 66 66 36 30 66 65 63 30 66 65 30 0a 5b   000ff60fec0fe0.[
+|   3760: 33 66 65 30 5d 30 61 30 33 30 33 30 30 31 62 36   3fe0]0a0303001b6
+|   3776: 31 36 32 36 31 36 65 36 34 36 66 36 65 30 38 30   162616e646f6e080
+|   3792: 32 30 33 30 30 31 37 36 31 36 32 36 31 36 36 37   2030017616261667
+|   3808: 34 30 38 30 31 30 33 30 33 36 62 30 31 30 32 30   4080103036b01020
+|   3824: 32 30 34 30 32 36 36 37 34 30 32 30 32 30 32 30   2040266740202020
+|   3840: 34 30 34 36 65 0a 36 34 36 66 36 65 30 33 30 32   4046e.646f6e0302
+|   3856: 30 32 30 34 30 61 30 37 30 35 30 31 30 33 30 30   02040a0705010300
+|   3872: 31 30 30 33 30 33 30 66 30 61 30 33 30 30 32 34   1003030f0a030024
+|   3888: 30 30 30 30 30 30 30 30 30 31 30 31 30 31 30 30   0000000001010100
+|   3904: 30 31 30 31 30 31 30 30 39 61 30 30 30 30 30 30   010101009a000000
+|   3920: 0a 30 31 30 66 66 61 30 30 30 66 66 61 0a 5b 32   .010ffa000ffa.[2
+|   3936: 66 65 72 20 62 61 63 6b 75 70 4a 08 04 00 81 19   fer backupJ.....
+|   3952: 61 6c 70 68 61 20 63 68 61 6e 6e 65 6c 20 62 61   alpha channel ba
+|   3968: 63 6b 75 70 20 61 62 61 6e 64 6f 6e 20 74 65 62   ckup abandon teb
+|   3984: 20 73 74 61 61 63 6b 20 63 68 61 6e 6e 65 62 6f    staack channebo
+|   4000: 6f 6d 65 72 20 61 74 6f 6d 20 61 6c 70 68 61 20   omer atom alpha 
+|   4016: 61 63 74 69 76 65 09 07 03 00 19 61 74 6f 6d 69   active.....atomi
+|   4032: 63 07 06 03 00 15 61 74 6b 6d 00 00 00 0b 19 62   c.....atkm.....b
+|   4048: 6f 6f 6d 65 72 09 04 03 00 19 61 63 74 69 76 65   oomer.....active
+|   4064: 0a 03 03 00 1b 61 62 61 6e 64 6f 6e 08 02 03 00   .....abandon....
+|   4080: 17 61 62 61 66 74 08 01 03 00 17 61 62 61 63 6b   .abaft.....aback
+| page 5 offset 16384
+|      0: 0d 00 00 00 08 0f d0 00 0f fa 0f f4 0f ee 0f e8   ................
+|     16: 0f e2 0f dc 0f d6 0f d0 00 00 00 00 00 00 00 00   ................
+|   4048: 04 08 03 00 0e 0a 04 07 03 00 0e 01 04 06 03 00   ................
+|   4064: 0e 01 04 05 03 00 0e 31 04 04 03 00 0e 01 04 03   .......1........
+|   4080: 03 00 0e 01 04 02 03 00 0e 01 04 01 03 00 0e 01   ................
+| page 6 offset 20480
+|      0: 0a 00 00 00 01 0f f4 00 0f f4 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 0b 03 1b 01 76 65 72 73 69 6f 6e 04   ........version.
+| page 7 offset 24576
+|      0: 0d 00 00 00 03 0f d6 00 0f f4 0f e1 0f d6 00 00   ................
+|   4048: 00 00 00 00 00 00 09 03 02 1b 72 65 62 75 69 6c   ..........rebuil
+|   4064: 64 11 02 02 2b 69 6e 74 65 67 72 69 74 79 2d 63   d...+integrity-c
+|   4080: 68 65 63 6b 0a 01 02 1d 6f 70 74 69 6d 69 7a 65   heck....optimize
+| end c22b.db
+}]} {}
+
+
+do_catchsql_test 22.1 {
+  INSERT INTO t1(t1) VALUES('optimize');
+} {1 {vtable constructor failed: t1}}
+
+#--------------------------------------------------------------------------
+reset_db
+do_test 23.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 28672 pagesize 4096 filename c24b.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 01 00 00 00 07   .....@  ........
+|     32: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 04   ................
+|     48: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00   ................
+|     80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01   ................
+|     96: 00 2e 30 38 0d 00 00 00 07 0d d2 00 0f c4 0f 6d   ..08...........m
+|    112: 0f 02 0e ab 0e 4e 0d f6 0d d2 00 00 00 00 00 00   .....N..........
+|   3536: 00 00 22 07 06 17 11 11 01 31 74 61 62 6c 65 74   .........1tablet
+|   3552: 32 74 32 07 43 52 45 41 54 45 20 54 41 42 4c 45   2t2.CREATE TABLE
+|   3568: 20 74 32 28 78 29 56 06 06 17 1f 1f 01 7d 74 61    t2(x)V.......ta
+|   3584: 62 6c 65 74 31 5f 63 6f 6e 66 69 67 74 31 5f 63   blet1_configt1_c
+|   3600: 6f 6e 66 69 67 06 43 52 45 41 54 45 20 54 41 42   onfig.CREATE TAB
+|   3616: 4c 45 20 27 74 31 5f 63 6f 6e 66 69 67 27 28 6b   LE 't1_config'(k
+|   3632: 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20 76 29    PRIMARY KEY, v)
+|   3648: 20 57 49 54 48 4f 55 54 20 52 4f 57 49 44 5b 05    WITHOUT ROWID[.
+|   3664: 07 17 21 21 01 81 01 74 61 62 6c 65 74 31 5f 64   ..!!...tablet1_d
+|   3680: 6f 63 73 69 7a 65 74 31 5f 64 6f 63 73 69 7a 65   ocsizet1_docsize
+|   3696: 05 43 52 45 41 54 45 20 54 41 42 4c 45 20 27 74   .CREATE TABLE 't
+|   3712: 31 5f 64 6f 63 73 69 7a 65 27 28 69 64 20 49 4e   1_docsize'(id IN
+|   3728: 54 45 47 45 52 20 50 52 49 4d 41 52 59 20 4b 45   TEGER PRIMARY KE
+|   3744: 59 2c 20 73 7a 20 42 4c 4f 42 29 55 04 06 17 21   Y, sz BLOB)U...!
+|   3760: 21 01 77 74 61 62 6c 65 74 31 5f 63 6f 6e 74 65   !.wtablet1_conte
+|   3776: 6e 74 74 31 5f 63 6f 6e 74 65 6e 74 04 43 52 45   ntt1_content.CRE
+|   3792: 41 54 45 20 54 41 42 4c 45 20 27 74 31 5f 63 6f   ATE TABLE 't1_co
+|   3808: 6e 74 65 6e 74 27 28 69 64 20 49 4e 54 45 47 45   ntent'(id INTEGE
+|   3824: 52 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20 63   R PRIMARY KEY, c
+|   3840: 30 29 69 03 07 17 19 19 01 81 2d 74 61 62 6c 65   0)i.......-table
+|   3856: 74 31 5f 69 64 78 74 31 5f 69 64 78 03 43 52 45   t1_idxt1_idx.CRE
+|   3872: 41 54 45 20 54 41 42 4c 45 20 27 74 31 5f 69 64   ATE TABLE 't1_id
+|   3888: 78 27 28 73 65 67 69 64 2c 20 74 65 72 6d 2c 20   x'(segid, term, 
+|   3904: 70 67 6e 6f 2c 20 50 52 49 4d 41 52 59 20 4b 45   pgno, PRIMARY KE
+|   3920: 59 28 73 65 67 69 64 2c 20 74 65 72 6d 29 29 20   Y(segid, term)) 
+|   3936: 57 49 54 48 4f 55 54 20 52 4f 57 49 44 55 02 07   WITHOUT ROWIDU..
+|   3952: 17 1b 1b 01 81 01 74 61 62 6c 65 74 31 5f 64 61   ......tablet1_da
+|   3968: 74 61 74 31 5f 64 61 74 61 02 43 52 45 41 54 45   tat1_data.CREATE
+|   3984: 20 54 41 42 4c 45 20 27 74 31 5f 64 61 74 61 27    TABLE 't1_data'
+|   4000: 28 69 64 20 49 4e 54 45 47 45 52 20 50 52 49 4d   (id INTEGER PRIM
+|   4016: 41 52 59 20 4b 45 59 2c 20 62 6c 6f 63 6b 20 42   ARY KEY, block B
+|   4032: 4c 4f 42 29 3a 01 06 17 11 11 08 63 74 61 62 6c   LOB):......ctabl
+|   4048: 65 74 31 74 31 43 52 45 41 54 45 20 56 49 52 54   et1t1CREATE VIRT
+|   4064: 55 41 4c 20 54 41 42 4c 45 20 74 31 20 55 53 49   UAL TABLE t1 USI
+|   4080: 4e 47 20 66 74 73 35 28 63 6f 6e 74 65 6e 74 29   NG fts5(content)
+| page 2 offset 4096
+|      0: 0d 0f 1c 00 05 0e cb 00 0f e8 0e cb 0f bd 0f 30   ...............0
+|     16: 0e e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
+|   3776: 00 00 00 00 00 00 00 00 00 00 00 15 0a 03 00 30   ...............0
+|   3792: 00 00 00 00 01 03 03 00 03 01 01 01 02 01 01 03   ................
+|   3808: 01 01 33 8c 80 80 80 80 01 03 00 6c 00 00 00 2c   ..3........l...,
+|   3824: 07 30 62 61 63 6b 75 70 05 02 04 02 05 65 61 6d   .0backup.....eam
+|   3840: 65 72 05 02 02 02 05 6f 6f 6d 65 72 05 01 02 05   er.....oomer....
+|   3856: 75 6d 6d 65 72 05 02 03 04 0b 0a 09 0f ef 00 14   ummer...........
+|   3872: 2a 00 00 00 00 01 02 02 00 02 01 01 01 02 01 01   *...............
+|   3888: 81 05 88 80 80 80 80 01 04 00 82 0e 00 00 00 76   ...............v
+|   3904: 06 30 61 62 61 63 6b 08 02 07 04 04 6e 64 6f 6e   .0aback.....ndon
+|   3920: 08 02 05 02 05 63 74 69 76 65 04 02 02 04 02 0b   .....ctive......
+|   3936: 02 04 6c 70 68 61 08 02 0a 02 03 74 6f 6d 06 02   ..lpha.....tom..
+|   3952: 02 02 02 09 05 02 69 63 07 02 02 01 06 62 61 63   ......ic.....bac
+|   3968: 6b 75 70 08 02 04 02 05 6f 6f 6d 65 72 05 02 02   kup.....oomer...
+|   3984: 03 02 08 01 07 63 68 61 6e 6e 65 6c 08 02 03 01   .....channel....
+|   4000: 05 65 6c 70 68 61 08 02 02 01 04 74 65 73 74 08   .elpha.....test.
+|   4016: 02 06 04 0a 09 0d 09 0b 07 0b 0d 0c 0a 24 84 80   .............$..
+|   4032: 80 80 80 01 03 00 4e 00 00 00 1e 02 61 23 25 23   ......N.....a#%#
+|   4048: 27 2b 01 02 02 04 02 66 74 02 02 02 04 04 6e 64   '+.....ft.....nd
+|   4064: 6f 6e 03 02 00 a0 42 70 05 01 03 00 10 08 13 00   on....Bp........
+|   4080: 00 00 11 24 00 00 00 00 01 01 01 00 01 01 01 01   ...$............
+| page 3 offset 8192
+|      0: 0a 00 00 00 03 0f ec 00 0f fa 0f f3 0f ec 00 00   ................
+|   4064: 00 00 00 00 00 00 00 00 00 00 00 00 06 04 01 0c   ................
+|   4080: 01 03 02 06 04 01 0c 01 02 02 05 04 09 0c 01 02   ................
+| page 4 offset 12288
+|      0: 0d 0f ca 00 08 0f 57 00 0f f6 0f ec 0f e0 0f d5   ......W.........
+|     16: 0f 57 0f c1 0f b6 0f 70 00 00 00 00 00 00 00 00   .W.....p........
+|   3920: 00 00 00 00 00 00 00 17 05 03 00 35 62 65 61 6d   ...........5beam
+|   3936: 65 72 20 62 75 6d 6d 65 72 20 62 61 63 6b 75 70   er bummer backup
+|   3952: 44 08 04 00 81 0d 65 6c 70 68 61 20 63 68 61 6e   D.....elpha chan
+|   3968: 6e 65 6c 20 62 61 63 6b 75 70 20 61 62 61 6e 64   nel backup aband
+|   3984: 6f 6e 20 74 65 73 74 20 61 62 61 63 6b 20 62 6f   on test aback bo
+|   4000: 6f 6d 65 72 20 61 74 6f 6d 20 61 6c 70 68 61 20   omer atom alpha 
+|   4016: 61 63 74 69 76 65 09 07 03 00 19 61 74 6f 6d 69   active.....atomi
+|   4032: 63 07 06 03 00 15 61 74 6f 6d 00 00 00 0b 19 62   c.....atom.....b
+|   4048: 6f 6f 6d 65 72 09 04 03 00 19 61 63 74 69 76 65   oomer.....active
+|   4064: 0a 03 03 00 1b 61 62 61 6e 64 6f 6e 08 02 03 00   .....abandon....
+|   4080: 17 61 62 61 66 74 08 01 03 00 17 61 62 61 63 6b   .abaft.....aback
+| page 5 offset 16384
+|      0: 0d 00 00 00 08 0f d0 00 0f fa 0f f4 0f ee 0f e8   ................
+|     16: 0f e2 0f dc 0f d6 0f d0 00 00 00 00 00 00 00 00   ................
+|   4048: 04 08 03 00 0e 0a 04 07 03 00 0e 01 04 06 03 00   ................
+|   4064: 0e 01 04 05 03 00 0e 03 04 04 03 00 0e 01 04 03   ................
+|   4080: 03 00 0e 01 04 02 03 00 0e 01 04 01 03 00 0e 01   ................
+| page 6 offset 20480
+|      0: 0a 00 00 00 01 0f f4 00 0f f4 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 0b 03 1b 01 76 65 72 73 69 6f 6e 04   ........version.
+| page 7 offset 24576
+|      0: 0d 00 00 00 03 0f d6 00 0f f4 0f e1 0f d6 00 00   ................
+|   4048: 00 00 00 00 00 00 09 03 02 1b 72 65 62 75 69 6c   ..........rebuil
+|   4064: 64 11 02 02 2b 69 6e 74 65 67 72 69 74 79 2d 63   d...+integrity-c
+|   4080: 68 65 63 6b 0a 01 02 1d 6f 70 74 69 6d 69 7a 65   heck....optimize
+| end c24b.db
+}]} {}
+
+do_catchsql_test 23.1 {
+  INSERT INTO t1(t1) VALUES('optimize');
+} {1 {database disk image is malformed}}
+
+#--------------------------------------------------------------------------
+reset_db
+do_test 24.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 32768 pagesize 4096 filename crash-b87dfef02880fe.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 00 00 00 00 08   .....@  ........
+|     32: 00 00 00 02 00 00 00 01 00 00 00 09 00 00 00 04   ................
+|     48: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00   ................
+|     96: 00 00 00 00 0d 0f c7 00 07 0d 92 00 0f 8d 0f 36   ...............6
+|    112: 0e cb 0e 6b 0e 0e 0d b6 0d 92 0d 92 00 00 00 00   ...k............
+|   3472: 00 00 22 08 06 17 11 11 01 31 74 61 62 6c 65 74   .........1tablet
+|   3488: 32 74 32 08 43 52 45 41 54 45 20 54 41 42 4c 45   2t2.CREATE TABLE
+|   3504: 20 74 32 28 78 29 56 07 06 17 1f 1f 01 7d 74 61    t2(x)V.......ta
+|   3520: 62 6c 65 74 31 5f 63 6f 6e 66 69 67 74 31 5f 63   blet1_configt1_c
+|   3536: 6f 6e 66 69 67 07 43 52 45 41 54 45 20 54 41 42   onfig.CREATE TAB
+|   3552: 4c 45 20 27 74 31 5f 63 6f 6e 66 69 67 27 28 6b   LE 't1_config'(k
+|   3568: 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20 76 29    PRIMARY KEY, v)
+|   3584: 20 57 49 54 48 4f 55 54 20 52 4f 57 49 44 5b 06    WITHOUT ROWID[.
+|   3600: 07 17 21 21 01 81 01 74 61 62 6c 65 74 31 5f 64   ..!!...tablet1_d
+|   3616: 6f 63 73 69 7a 65 74 31 5f 64 6f 63 73 69 7a 65   ocsizet1_docsize
+|   3632: 06 43 52 45 41 54 45 20 54 41 42 4c 45 20 27 74   .CREATE TABLE 't
+|   3648: 31 5f 64 6f 63 73 69 7a 65 27 28 69 64 20 49 4e   1_docsize'(id IN
+|   3664: 54 45 47 45 52 20 50 52 49 4d 41 52 59 20 4b 45   TEGER PRIMARY KE
+|   3680: 59 2c 20 73 7a 20 42 4c 4f 42 29 5e 05 07 17 21   Y, sz BLOB)^...!
+|   3696: 21 01 81 07 74 61 62 6c 65 74 31 5f 63 6f 6e 74   !...tablet1_cont
+|   3712: 65 6e 74 74 31 5f 63 6f 6e 74 65 6e 74 05 43 52   entt1_content.CR
+|   3728: 45 41 54 45 20 54 41 42 4c 45 20 27 74 31 5f 63   EATE TABLE 't1_c
+|   3744: 6f 6e 74 65 6e 74 27 28 69 64 20 49 4e 54 45 47   ontent'(id INTEG
+|   3760: 45 52 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20   ER PRIMARY KEY, 
+|   3776: 63 30 2c 20 63 31 2c 20 63 32 29 69 04 07 17 19   c0, c1, c2)i....
+|   3792: 19 01 81 2d 74 61 62 6c 65 74 31 5f 69 64 78 74   ...-tablet1_idxt
+|   3808: 31 5f 69 64 78 04 43 52 45 41 54 45 20 54 41 42   1_idx.CREATE TAB
+|   3824: 4c 45 20 27 74 31 5f 69 64 78 27 28 73 65 67 69   LE 't1_idx'(segi
+|   3840: 64 2c 20 74 65 72 6d 2c 20 70 67 6e 6f 2c 20 50   d, term, pgno, P
+|   3856: 52 49 4d 41 52 59 20 4b 45 59 28 73 65 67 69 64   RIMARY KEY(segid
+|   3872: 2c 20 74 65 72 6d 29 29 20 57 49 54 48 4f 55 54   , term)) WITHOUT
+|   3888: 20 52 4f 57 49 44 55 03 07 17 1b 1b 01 81 01 74    ROWIDU........t
+|   3904: 61 62 6c 65 74 31 5f 64 61 74 61 74 31 5f 64 61   ablet1_datat1_da
+|   3920: 74 61 03 43 52 45 41 54 45 20 54 41 42 4c 45 20   ta.CREATE TABLE 
+|   3936: 27 74 31 5f 64 61 74 61 27 28 69 64 20 49 4e 54   't1_data'(id INT
+|   3952: 45 47 45 52 20 50 52 49 4d 41 52 59 20 4b 45 59   EGER PRIMARY KEY
+|   3968: 2c 20 62 6c 6f 63 6b 20 42 4c 4f 42 29 38 02 06   , block BLOB)8..
+|   3984: 17 11 11 08 5f 74 61 62 6c 65 74 31 74 31 43 52   ...._tablet1t1CR
+|   4000: 45 41 54 45 20 56 49 52 54 55 41 4c 20 54 41 42   EATE VIRTUAL TAB
+|   4016: 4c 45 20 74 31 20 55 53 49 4e 47 20 66 74 73 35   LE t1 USING fts5
+|   4032: 28 61 2c 62 2c 63 29 00 00 00 39 00 00 00 00 00   (a,b,c)...9.....
+| page 3 offset 8192
+|      0: 0d 00 00 00 03 0c 94 00 0f e6 0f ef 0c 94 00 00   ................
+|   3216: 00 00 00 00 86 4a 84 80 80 80 80 01 04 00 8d 18   .....J..........
+|   3232: 00 00 03 2b 02 30 30 01 02 06 01 02 06 01 02 06   ...+.00.........
+|   3248: 1f 02 03 01 02 03 01 02 03 01 08 32 30 31 36 30   ...........20160
+|   3264: 36 30 39 01 02 07 01 02 07 01 02 07 01 01 34 01   609...........4.
+|   3280: 02 05 01 02 05 01 02 05 01 01 35 01 02 04 01 02   ..........5.....
+|   3296: 04 01 02 04 02 07 30 30 30 30 30 30 30 1c 02 04   ......0000000...
+|   3312: 01 02 04 01 02 04 01 06 62 69 6e 61 72 79 03 06   ........binary..
+|   3328: 01 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01   ................
+|   3344: 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01 02   ................
+|   3360: 02 03 06 01 02 02 03 06 01 02 02 03 06 01 02 02   ................
+|   3376: 03 06 01 02 02 03 06 01 02 02 01 08 63 6f 6d 70   ............comp
+|   3392: 69 6c 65 72 01 02 02 01 02 02 01 02 02 01 06 64   iler...........d
+|   3408: 62 73 74 61 74 07 02 03 01 02 03 01 02 03 02 04   bstat...........
+|   3424: 65 62 75 67 04 02 02 01 02 02 01 02 02 01 06 65   ebug...........e
+|   3440: 6e 61 62 6c 65 07 02 02 01 02 02 01 02 02 01 02   nable...........
+|   3456: 02 01 02 02 01 02 02 01 02 02 01 02 02 01 02 02   ................
+|   3472: 01 02 02 01 02 02 01 02 02 01 02 02 01 02 02 01   ................
+|   3488: 02 02 01 02 02 01 02 02 01 02 02 01 02 02 01 02   ................
+|   3504: 02 01 02 02 02 08 78 74 65 6e 73 69 6f 6e 1f 02   ......xtension..
+|   3520: 04 01 02 04 01 02 04 01 04 66 74 73 34 1a 02 03   .........fts4...
+|   3536: 01 02 03 01 02 03 04 01 35 0d 02 03 01 02 03 01   ........5.......
+|   3552: 02 03 01 03 67 63 63 01 02 03 01 02 03 01 02 03   ....gcc.........
+|   3568: 02 06 65 6f 70 6f 6c 79 10 02 03 01 02 03 01 02   ..eopoly........
+|   3584: 03 01 05 6a 73 6f 6e 31 13 02 03 01 02 03 01 02   ...json1........
+|   3600: 03 01 04 6c 6f 61 64 1f 02 03 01 02 03 01 02 03   ...load.........
+|   3616: 01 03 6d 61 78 1c 02 02 01 02 02 01 02 02 02 05   ..max...........
+|   3632: 65 6d 6f 72 79 1c 02 03 01 02 03 01 02 03 04 04   emory...........
+|   3648: 73 79 73 35 16 02 03 01 02 03 01 02 03 01 06 6e   sys5...........n
+|   3664: 6f 63 61 73 65 02 06 01 02 02 03 06 01 02 02 03   ocase...........
+|   3680: 06 01 02 02 03 06 01 02 02 03 06 01 02 02 03 06   ................
+|   3696: 01 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01   ................
+|   3712: 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01 02   ................
+|   3728: 02 01 04 6f 6d 69 74 1f 02 02 01 02 02 01 02 02   ...omit.........
+|   3744: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 02   ................
+|   3760: 58 81 96 4d 01 06 01 02 02 03 06 01 02 02 03 06   X..M............
+|   3776: 01 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01   ................
+|   3792: 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01 02   ................
+|   3808: 02 03 06 01 02 02 03 06 01 02 02 03 06 01 02 02   ................
+|   3824: 01 0a 74 68 72 65 61 64 73 61 66 65 22 02 02 01   ..threadsafe....
+|   3840: 02 02 01 02 02 01 04 76 74 61 62 07 02 04 01 02   .......vtab.....
+|   3856: 04 01 02 04 01 01 78 01 06 01 01 02 01 06 01 01   ......x.........
+|   3872: 02 01 06 01 01 02 01 06 01 01 02 01 06 01 01 02   ................
+|   3888: 01 06 01 01 02 01 06 01 01 02 01 06 01 01 02 01   ................
+|   3904: 06 01 01 02 01 06 01 01 02 01 06 01 01 02 01 06   ................
+|   3920: 01 01 02 01 06 01 01 02 01 06 01 01 02 01 06 01   ................
+|   3936: 01 02 01 06 01 01 02 01 06 01 01 02 01 06 01 01   ................
+|   3952: 02 01 06 01 01 02 01 06 01 01 02 01 06 01 01 02   ................
+|   3968: 01 06 01 01 02 01 06 01 01 02 01 06 01 01 02 01   ................
+|   3984: 06 01 01 02 01 06 01 01 02 01 06 01 01 02 01 06   ................
+|   4000: 01 01 02 01 06 01 01 02 01 06 01 01 02 01 06 01   ................
+|   4016: 01 02 01 06 01 01 02 01 06 01 01 02 01 06 01 01   ................
+|   4032: 02 01 06 01 01 02 01 06 01 01 02 04 15 13 0c 0c   ................
+|   4048: 12 44 13 11 0f 47 13 0f 0c 0e 11 10 0f 0e 10 0f   .D...G..........
+|   4064: 44 0f 10 40 15 0f 07 01 03 00 14 24 5a 24 24 0f   D..@.......$Z$$.
+|   4080: 0a 03 00 24 00 00 00 00 01 01 01 00 01 01 01 01   ...$............
+| page 4 offset 12288
+|      0: 0a 00 00 00 01 0f fa 00 0f fa 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 00 00 00 00 00 00 05 04 09 0c 01 02   ................
+| page 5 offset 16384
+|      0: 0d 00 00 00 24 0c 0a 00 0f d8 0f af 0f 86 0f 74   ....$..........t
+|     16: 0f 61 0f 4e 0f 2f 0f 0f 0e ef 0e d7 0e be 0e a5   .a.N./..........
+|     32: 0e 8d 0e 74 0e 5b 0e 40 0e 24 0e 08 0d ef 0d d5   ...t.[.@.$......
+|     48: 0d bb 0d a0 0d 84 0d 68 0d 4f 0d 35 0d 1b 0c fb   .......h.O.5....
+|     64: 0c da 0c b9 0c 99 0c 78 0c 57 0c 3e 0c 24 0c 0a   .......x.W.>.$..
+|   3072: 00 00 00 00 00 00 00 00 00 00 18 24 05 00 25 0f   ...........$..%.
+|   3088: 19 54 48 52 45 41 44 53 41 46 45 3d 30 58 42 49   .THREADSAFE=0XBI
+|   3104: 4e 41 52 59 18 23 05 00 25 0f 19 54 48 52 45 41   NARY.#..%..THREA
+|   3120: 44 53 41 46 45 3d 30 58 4e 4f 43 41 53 45 17 22   DSAFE=0XNOCASE..
+|   3136: 05 00 25 0f 17 54 48 52 45 41 44 53 41 46 45 3d   ..%..THREADSAFE=
+|   3152: 30 58 52 54 52 49 4d 1f 21 05 00 33 0f 19 4f 4d   0XRTRIM.!..3..OM
+|   3168: 49 54 20 4c 4f 41 44 20 45 58 54 45 4e 53 49 4f   IT LOAD EXTENSIO
+|   3184: 4e 58 42 49 4e 41 52 59 1f 20 05 00 33 0f 19 4f   NXBINARY. ..3..O
+|   3200: 4d 49 54 20 4c 4f 41 44 b2 04 55 85 44 54 e5 34   MIT LOAD..U.DT.4
+|   3216: 94 f4 e5 84 e4 f4 34 15 34 51 e1 f0 50 03 30 f1   ......4.4Q..P.0.
+|   3232: 74 f4 d4 95 42 04 c4 f4 14 42 04 55 85 44 54 e5   t...B....B.U.DT.
+|   3248: 34 94 f4 e5 85 25 45 24 94 d1 f1 e0 50 03 30 f1   4....%E$....P.0.
+|   3264: 94 d4 15 82 04 d4 54 d4 f5 25 93 d3 53 03 03 03   ......T..%..S...
+|   3280: 03 03 03 05 84 24 94 e4 15 25 91 f1 d0 50 03 30   .....$...%...P.0
+|   3296: f1 94 d4 15 82 04 d4 54 d4 f5 25 93 d3 53 03 03   .......T..%..S..
+|   3312: 03 03 03 03 05 84 e4 f4 34 15 34 51 e1 c0 50 03   ........4.4Q..P.
+|   3328: 30 f1 74 d4 15 82 04 d4 54 d4 f5 25 93 d3 53 03   0.t.....T..%..S.
+|   3344: 03 03 03 03 03 05 85 25 45 24 94 d1 81 b0 50 02   .......%E$....P.
+|   3360: 50 f1 94 54 e4 14 24 c4 52 05 25 45 24 54 55 84   P..T..$.R.%E$TU.
+|   3376: 24 94 e4 15 25 91 81 a0 50 02 50 f1 94 54 e4 14   $...%...P.P..T..
+|   3392: 24 c4 52 05 25 45 24 54 55 84 e4 f4 34 15 34 51   $.R.%E$TU...4.4Q
+|   3408: 71 90 50 02 50 f1 74 54 e4 14 24 c4 52 05 25 45   q.P.P.tT..$.R.%E
+|   3424: 24 54 55 85 25 45 24 94 d1 a1 80 50 02 90 f1 94   $TU.%E$....P....
+|   3440: 54 e4 14 24 c4 52 04 d4 54 d5 35 95 33 55 84 24   T..$.R..T.5.3U.$
+|   3456: 94 e4 15 25 91 a1 70 50 02 90 f1 94 54 e4 14 24   ...%..pP....T..$
+|   3472: c4 52 04 d4 54 d5 35 95 33 55 84 e4 f4 34 15 34   .R..T.5.3U...4.4
+|   3488: 51 91 60 50 02 90 f1 74 54 e4 14 24 c4 52 04 d4   Q.`P...tT..$.R..
+|   3504: 54 d5 35 95 33 55 85 25 45 24 94 d1 81 50 50 02   T.5.3U.%E$...PP.
+|   3520: 50 f1 94 54 e4 14 24 c4 52 04 a5 34 f4 e3 15 84   P..T..$.R..4....
+|   3536: 24 94 e4 15 25 91 81 40 50 02 50 f1 94 54 e4 14   $...%..@P.P..T..
+|   3552: 24 c4 52 04 a5 34 f4 e3 15 84 e4 f4 34 15 34 51   $.R..4......4.4Q
+|   3568: 71 30 50 02 50 f1 74 54 e4 14 24 c4 52 04 a5 34   q0P.P.tT..$.R..4
+|   3584: f4 e3 15 85 25 45 24 94 d1 a1 20 50 02 90 f1 94   ....%E$... P....
+|   3600: 54 e4 14 24 c4 52 04 74 54 f5 04 f4 c5 95 84 24   T..$.R.tT......$
+|   3616: 94 e4 15 25 91 a1 10 50 02 90 f1 94 54 e4 14 24   ...%...P....T..$
+|   3632: c4 52 04 74 54 f5 04 f4 c5 95 84 e4 f4 34 15 34   .R.tT........4.4
+|   3648: 51 91 00 50 02 90 f1 74 54 e4 14 24 c4 52 04 74   Q..P...tT..$.R.t
+|   3664: 54 f5 04 f4 c5 95 85 25 45 24 94 d1 70 f0 50 02   T......%E$..p.P.
+|   3680: 30 f1 94 54 e4 14 24 c5 20 46 54 53 35 58 42 49   0..T..$. FTS5XBI
+|   3696: 4e 41 52 59 17 0e 05 00 23 0f 19 45 4e 41 42 4c   NARY....#..ENABL
+|   3712: 45 20 46 54 53 35 58 4e 4f 43 41 53 45 16 0d 05   E FTS5XNOCASE...
+|   3728: 00 23 0f 17 45 4e 41 42 4c 45 20 46 54 53 35 58   .#..ENABLE FTS5X
+|   3744: 52 54 52 49 4d 17 0c 05 00 23 0f 19 45 4e 41 42   RTRIM....#..ENAB
+|   3760: 4c 45 20 46 54 53 34 58 42 49 4e 41 52 59 97 0b   LE FTS4XBINARY..
+|   3776: 05 00 23 0f 19 45 4e 41 42 4c 45 20 46 54 53 34   ..#..ENABLE FTS4
+|   3792: 58 4e 4f 43 41 53 45 16 0a 05 00 23 0f 17 45 4e   XNOCASE....#..EN
+|   3808: 41 42 4c 45 20 46 54 53 34 58 52 54 52 49 4d 1e   ABLE FTS4XRTRIM.
+|   3824: 09 05 00 31 0f 19 45 4e 41 42 4c 45 20 44 42 53   ...1..ENABLE DBS
+|   3840: 54 41 54 20 56 54 41 42 58 42 49 4e 41 52 59 1e   TAT VTABXBINARY.
+|   3856: 08 05 00 31 0f 19 45 4e 41 42 4c 45 20 44 42 53   ...1..ENABLE DBS
+|   3872: 54 41 54 20 56 54 41 42 58 4e 4f 43 41 53 45 1d   TAT VTABXNOCASE.
+|   3888: 07 05 00 31 0f 17 45 4e 41 42 4c 45 20 44 42 53   ...1..ENABLE DBS
+|   3904: 54 41 54 20 56 54 41 42 58 52 54 52 49 4d 11 06   TAT VTABXRTRIM..
+|   3920: 05 00 17 0f 19 44 45 42 55 47 58 42 49 4e 41 52   .....DEBUGXBINAR
+|   3936: 59 11 05 05 00 17 0f 19 44 45 42 55 47 58 4e 4f   Y.......DEBUGXNO
+|   3952: 43 41 53 45 10 02 02 50 08 5f 17 44 45 42 55 47   CASE...P._.DEBUG
+|   3968: 58 52 54 52 49 4d 27 03 05 00 43 0f 19 43 4f 4d   XRTRIM'...C..COM
+|   3984: 50 49 4c 45 52 3d 67 63 63 2d 35 2e 34 2e 30 20   PILER=gcc-5.4.0 
+|   4000: 32 30 31 36 30 36 30 39 58 42 49 4e 41 52 59 27   20160609XBINARY'
+|   4016: 02 05 00 43 0f 19 43 4f 4d 50 49 4c 45 52 3d 67   ...C..COMPILER=g
+|   4032: 63 63 2d 35 2e 34 2e 30 20 32 30 31 36 30 36 30   cc-5.4.0 2016060
+|   4048: 39 58 4e 4f 43 41 53 45 26 01 05 00 43 0f 17 43   9XNOCASE&...C..C
+|   4064: 4f 4d 50 49 4c 45 52 3d 67 63 63 2d 35 2e 34 2e   OMPILER=gcc-5.4.
+|   4080: 30 20 32 30 31 36 30 36 30 39 58 52 54 52 49 4d   0 20160609XRTRIM
+| page 6 offset 20480
+|      0: 0d 00 00 00 24 0e e0 00 0f f8 0f f0 0f e8 0f e0   ....$...........
+|     16: 0f d8 0f d0 0f c8 0f c0 0f b8 0f b0 0f a8 0f a0   ................
+|     32: 0f 98 0f 90 0f 88 0f 80 0f 78 0f 70 0f 68 0f 60   .........x.p.h.`
+|     48: 0f 58 0f 50 0f 48 0f 40 0f 38 0f 30 0f 28 0f 20   .X.P.H.@.8.0.(. 
+|     64: 0f 18 0f 10 0f 08 0f 00 0e f8 0e f0 0e e8 0e e0   ................
+|   3808: 06 24 03 00 12 02 01 01 06 23 03 00 12 02 01 01   .$.......#......
+|   3824: 06 22 03 00 12 02 01 01 06 21 03 00 12 03 01 01   .........!......
+|   3840: 06 20 03 00 12 03 01 01 06 1f 03 00 12 03 01 01   . ..............
+|   3856: 06 1e 03 00 12 03 01 01 06 1d 03 00 12 03 01 01   ................
+|   3872: 06 1c 03 00 12 03 01 01 06 1b 03 00 12 02 01 01   ................
+|   3888: 06 1a 03 00 12 02 01 01 06 19 03 00 12 02 01 01   ................
+|   3904: 06 18 03 00 12 02 01 01 06 17 03 00 12 02 01 01   ................
+|   3920: 06 16 03 00 12 02 01 01 06 15 03 00 12 02 01 01   ................
+|   3936: 06 14 03 00 12 02 01 01 06 13 03 00 12 02 01 01   ................
+|   3952: 06 12 03 00 12 02 01 01 06 11 03 00 12 02 01 01   ................
+|   3968: 06 10 03 00 12 02 01 01 06 0f 03 00 12 02 01 01   ................
+|   3984: 06 0e 03 00 12 02 01 01 06 0d 03 00 12 02 01 01   ................
+|   4000: 06 0c 03 00 12 02 01 01 06 0b 03 00 12 02 01 01   ................
+|   4016: 06 0a 03 00 12 02 01 01 06 09 03 00 12 03 01 01   ................
+|   4032: 06 08 03 00 12 03 01 01 06 07 03 00 12 03 01 01   ................
+|   4048: 06 06 03 00 12 01 01 01 06 05 03 00 12 01 01 01   ................
+|   4064: 06 04 03 00 12 01 01 01 06 03 03 00 12 06 01 01   ................
+|   4080: 06 02 03 00 12 06 01 01 06 01 03 00 12 06 01 01   ................
+| page 7 offset 24576
+|      0: 0a 00 00 00 01 0f f4 00 0f f4 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 0b 03 1b 01 76 65 72 73 69 6f 6e 04   ........version.
+| page 8 offset 28672
+|      0: 0d 00 00 00 03 0f d6 00 0f f4 0f e9 0f d6 00 00   ................
+|   4048: 00 00 00 00 00 00 11 03 02 2b 69 6e 74 65 67 72   .........+integr
+|   4064: 69 74 79 2d 63 68 65 63 6b 09 02 02 1b 72 65 62   ity-check....reb
+|   4080: 75 69 6c 64 0a 01 02 1d 6f 70 74 69 6d 69 7a 65   uild....optimize
+| end crash-b87dfef02880fe.db
+}]} {}
+
+do_catchsql_test 24.1 {
+  UPDATE t1 SET b=quote(zeroblob(200)) WHERE a MATCH 'thread*';
+} {1 {database disk image is malformed}}
+
+do_catchsql_test 24.2 {
+  INSERT INTO t1(t1) VALUES('integrity-check');
+} {1 {database disk image is malformed}}
+
+#--------------------------------------------------------------------------
+reset_db
+do_test 25.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 28672 pagesize 4096 filename crash-e3b1b19e4d4bcc.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 06 00 00 00 00   .....@  ........
+|     32: 00 00 00 00 00 00 00 06 00 00 00 04 00 00 00 00   ................
+|     48: 03 20 54 35 24 54 15 44 52 04 94 e4 44 55 82 07   . T5$T.DR...DU..
+|     64: 43 27 a2 04 f4 e2 07 43 22 87 a2 95 30 30 71 71   C'.....C....00qq
+|     80: 11 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33   .SQLite format 3
+|     96: 00 10 00 01 0d 00 00 00 07 0d d2 00 0f c4 0f 6d   ...............m
+|    112: 0f 02 0e ab 0e 4e 0d f6 0d d2 03 30 01 00 00 10   .....N.....0....
+|    128: 10 04 02 02 00 00 00 00 00 00 00 00 30 00 00 00   ............0...
+|    144: 00 00 00 00 00 00 00 00 20 00 00 00 40 00 00 00   ........ ...@...
+|   3536: 00 00 22 07 06 17 11 11 01 31 74 61 62 6c 65 74   .........1tablet
+|   3552: 32 74 32 07 43 52 45 41 54 45 20 54 41 42 4c 45   2t2.CREATE TABLE
+|   3568: 20 74 32 28 78 29 56 06 06 17 1f 1f 01 7d 74 61    t2(x)V.......ta
+|   3584: 62 6c 65 74 31 5f 63 6f 6e 66 69 67 74 31 5f 63   blet1_configt1_c
+|   3600: 6f 6e 66 69 67 06 43 52 45 41 54 45 20 54 41 42   onfig.CREATE TAB
+|   3616: 4c 45 20 27 74 31 5f 63 6f 6e 66 69 67 27 28 6b   LE 't1_config'(k
+|   3632: 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20 76 29    PRIMARY KEY, v)
+|   3648: 20 57 49 54 48 4f 55 54 20 52 4f 57 49 44 5b 05    WITHOUT ROWID[.
+|   3664: 07 17 21 21 01 81 01 74 61 62 6c 65 74 31 5f 64   ..!!...tablet1_d
+|   3680: 6f 63 73 69 7a 65 74 31 5f 64 6f 63 73 69 7a 65   ocsizet1_docsize
+|   3696: 05 43 52 45 41 54 45 20 54 41 42 4c 45 20 27 74   .CREATE TABLE 't
+|   3712: 31 5f 64 6f 63 73 69 7a 65 27 28 69 64 20 49 4e   1_docsize'(id IN
+|   3728: 54 45 47 45 52 20 50 52 49 4d 41 52 59 20 4b 45   TEGER PRIMARY KE
+|   3744: 59 2c 20 73 7a 20 42 4c 4f 42 29 55 04 06 17 21   Y, sz BLOB)U...!
+|   3760: 21 01 77 74 61 62 6c 65 74 31 5f 63 6f 6e 74 65   !.wtablet1_conte
+|   3776: 6e 74 74 31 5f 63 6f 6e 74 65 6e 74 04 43 52 45   ntt1_content.CRE
+|   3792: 41 54 45 20 54 41 42 4c 45 20 27 74 31 5f 63 6f   ATE TABLE 't1_co
+|   3808: 6e 74 65 6e 74 27 28 69 64 20 49 4e 54 45 47 45   ntent'(id INTEGE
+|   3824: 52 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20 63   R PRIMARY KEY, c
+|   3840: 30 29 69 03 07 17 19 19 01 81 2d 74 61 62 6c 65   0)i.......-table
+|   3856: 74 31 5f 69 64 78 74 31 5f 69 64 78 03 43 52 45   t1_idxt1_idx.CRE
+|   3872: 41 54 45 20 54 41 42 4c 45 20 27 74 31 5f 69 64   ATE TABLE 't1_id
+|   3888: 78 27 28 73 65 67 69 64 2c 20 74 65 72 6d 2c 20   x'(segid, term, 
+|   3904: 70 67 6e 6f 2c 20 50 52 49 4d 41 52 59 20 4b 45   pgno, PRIMARY KE
+|   3920: 59 28 73 65 67 69 64 2c 20 74 65 72 6d 29 29 20   Y(segid, term)) 
+|   3936: 57 49 54 48 4f 55 54 20 52 4f 57 49 44 55 02 07   WITHOUT ROWIDU..
+|   3952: 17 1b 1b 01 81 01 74 61 62 6c 65 74 31 5f 64 61   ......tablet1_da
+|   3968: 74 61 74 31 5f 64 61 74 61 02 43 52 45 41 54 45   tat1_data.CREATE
+|   3984: 20 54 41 42 4c 45 20 27 74 31 5f 64 61 74 61 27    TABLE 't1_data'
+|   4000: 28 69 64 20 49 4e 54 45 47 45 52 20 50 52 d9 44   (id INTEGER PR.D
+|   4016: 41 52 59 20 4b 45 59 2c 20 62 6c 6f 63 6b 20 42   ARY KEY, block B
+|   4032: 4c 4f 42 29 3a 01 06 17 11 11 08 63 74 61 62 6c   LOB):......ctabl
+|   4048: 65 74 31 74 31 43 52 45 41 54 45 20 56 49 52 54   et1t1CREATE VIRT
+|   4064: 55 41 4c 20 54 41 42 4c 45 20 74 31 20 55 53 49   UAL TABLE t1 USI
+|   4080: 4e 47 20 66 74 73 35 28 63 6f 6e 74 65 6e 74 29   NG fts5(content)
+| page 2 offset 4096
+|      0: 0d 00 00 00 03 0f bd 00 0f e8 0f ef 0f bd 00 00   ................
+|   4016: 00 00 00 00 00 00 00 00 00 00 00 00 00 24 84 80   .............$..
+|   4032: 80 80 80 01 03 00 4e 00 00 00 1e 06 30 61 62 61   ......N.....0aba
+|   4048: 63 6b 01 02 02 04 02 66 74 02 02 02 04 04 6e 64   ck.....ft.....nd
+|   4064: 6f 6e 03 02 02 04 0a 07 05 01 03 00 10 03 03 0f   on..............
+|   4080: 0a 03 00 24 00 00 00 00 01 01 01 00 01 01 01 01   ...$............
+| page 3 offset 8192
+|      0: 0a 00 00 00 01 0f fa 00 0f fa 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 00 00 00 00 00 00 05 04 09 0c 01 02   ................
+| page 4 offset 12288
+|      0: 0d 00 00 00 03 0f e0 00 0f f6 0f e0 fe 00 00 00   ................
+|   4064: 0a 03 03 00 1b 61 62 61 6e 64 6f 6e 08 02 00 03   .....abandon....
+|   4080: 17 61 62 61 66 74 08 01 03 00 17 61 62 61 63 6b   .abaft.....aback
+| page 5 offset 16384
+|      0: 0d 00 00 00 03 0f ee 00 0f fa 0f f4 0f ee 00 00   ................
+|   4064: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 03   ................
+|   4080: 03 00 0e 01 04 02 03 00 0e 01 04 01 03 00 0e 01   ................
+| page 6 offset 20480
+|      0: 0a 00 00 00 01 0f f4 00 0f f4 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 0b 03 1b 01 76 65 72 73 69 6f 6e 04   ........version.
+| page 7 offset 24576
+|      0: 0d 00 00 00 03 0f d6 00 0f f4 01 fe 0f d6 00 00   ................
+|   4048: 00 00 00 00 00 00 09 03 02 1b 72 65 62 75 69 6c   ..........rebuil
+|   4064: 64 11 02 02 2b 69 6e 74 65 67 72 69 74 79 2d 63   d...+integrity-c
+|   4080: 68 65 63 6b 0a 01 02 1d 6f 70 74 69 6d 69 7a 65   heck....optimize
+| end crash-e3b1b19e4d4bcc.db
+}]} {}
+
+do_catchsql_test 25.1 {
+  INSERT INTO t1(t1) VALUES('rebuild');
+} {1 {database disk image is malformed}}
+
+do_execsql_test 25.2 {
+  PRAGMA page_size=512;
+} 
+
+#--------------------------------------------------------------------------
+reset_db
+do_test 26.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 32768 pagesize 4096 filename c30b.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 01 00 00 00 08   .....@  ........
+|     32: 00 00 00 02 00 00 00 01 00 00 00 01 00 00 00 04   ................
+|     48: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00   ................
+|     80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01   ................
+|     96: 00 2e 30 38 0d 0f c7 00 07 0d 92 00 0f 8d 0f 36   ..08...........6
+|    112: 0e cb 0e 6b 0e 0e 0d b6 0d 92 0d 92 00 00 00 00   ...k............
+|   3472: 00 00 22 08 06 17 11 11 01 31 74 61 62 6c 65 74   .........1tablet
+|   3488: 32 74 32 08 43 52 45 41 54 45 20 54 41 42 4c 45   2t2.CREATE TABLE
+|   3504: 20 74 32 28 78 29 56 07 06 17 1f 1f 01 7d 74 61    t2(x)V.......ta
+|   3520: 62 6c 65 74 31 5f 63 6f 6e 66 69 67 74 31 5f 63   blet1_configt1_c
+|   3536: 6f 6e 66 69 67 07 43 52 45 41 54 45 20 54 41 42   onfig.CREATE TAB
+|   3552: 4c 45 20 27 74 31 5f 63 6f 6e 66 69 67 27 28 6b   LE 't1_config'(k
+|   3568: 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20 76 29    PRIMARY KEY, v)
+|   3584: 20 57 49 54 48 4f 55 54 20 52 4f 57 49 44 5b 06    WITHOUT ROWID[.
+|   3600: 07 17 21 21 01 81 01 74 61 62 6c 65 74 31 5f 64   ..!!...tablet1_d
+|   3616: 6f 63 73 69 7a 65 74 31 5f 64 6f 63 73 69 7a 65   ocsizet1_docsize
+|   3632: 06 43 52 45 41 54 45 20 54 41 42 4c 45 20 27 74   .CREATE TABLE 't
+|   3648: 31 5f 64 6f 63 73 69 7a 65 27 28 69 64 20 49 4e   1_docsize'(id IN
+|   3664: 54 45 47 45 52 20 50 52 49 4d 41 52 59 20 4b 45   TEGER PRIMARY KE
+|   3680: 59 2c 20 73 7a 20 42 4c 4f 42 29 5e 05 07 17 21   Y, sz BLOB)^...!
+|   3696: 21 01 81 07 74 61 62 6c 65 74 31 5f 63 6f 6e 74   !...tablet1_cont
+|   3712: 65 6e 74 74 31 5f 63 6f 6e 74 65 6e 74 05 43 52   entt1_content.CR
+|   3728: 45 41 54 45 20 54 41 42 4c 45 20 27 74 31 5f 63   EATE TABLE 't1_c
+|   3744: 6f 6e 74 65 6e 74 27 28 69 64 20 49 4e 54 45 47   ontent'(id INTEG
+|   3760: 45 52 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20   ER PRIMARY KEY, 
+|   3776: 63 30 2c 20 63 31 2c 20 63 32 29 69 04 07 17 19   c0, c1, c2)i....
+|   3792: 19 01 81 2d 74 61 62 6c 65 74 31 5f 69 64 78 74   ...-tablet1_idxt
+|   3808: 31 5f 69 64 78 04 43 52 45 41 54 45 20 54 41 42   1_idx.CREATE TAB
+|   3824: 4c 45 20 27 74 31 5f 69 64 78 27 28 73 65 67 69   LE 't1_idx'(segi
+|   3840: 64 2c 20 74 65 72 6d 2c 20 70 67 6e 6f 2c 20 50   d, term, pgno, P
+|   3856: 52 49 4d 41 52 59 20 4b 45 59 28 73 65 67 69 64   RIMARY KEY(segid
+|   3872: 2c 20 74 65 72 6d 29 29 20 57 49 54 48 4f 55 54   , term)) WITHOUT
+|   3888: 20 52 4f 57 49 44 55 03 07 17 1b 1b 01 81 01 74    ROWIDU........t
+|   3904: 61 62 6c 65 74 31 5f 64 61 74 61 74 31 5f 64 61   ablet1_datat1_da
+|   3920: 74 61 03 43 52 45 41 54 45 20 54 41 42 4c 45 20   ta.CREATE TABLE 
+|   3936: 27 74 31 5f 64 61 74 61 27 28 69 64 20 49 4e 54   't1_data'(id INT
+|   3952: 45 47 45 52 20 50 52 49 4d 41 52 59 20 4b 45 59   EGER PRIMARY KEY
+|   3968: 2c 20 62 6c 6f 63 6b 20 42 4c 4f 42 29 38 02 06   , block BLOB)8..
+|   3984: 17 11 11 08 5f 74 61 62 6c 65 74 31 74 31 43 52   ...._tablet1t1CR
+|   4000: 45 41 54 45 20 56 49 52 54 55 41 4c 20 54 41 42   EATE VIRTUAL TAB
+|   4016: 4c 45 20 74 31 20 55 53 49 4e 47 20 66 74 73 35   LE t1 USING fts5
+|   4032: 28 61 2c 62 2c 63 29 00 00 00 39 00 00 00 00 00   (a,b,c)...9.....
+| page 3 offset 8192
+|      0: 0d 0c 0f 00 05 09 fe 00 0f e6 09 fe 0c 94 0c 23   ...............#
+|     16: 0a 15 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
+|   2544: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 15 0a   ................
+|   2560: 03 00 30 00 00 00 00 01 03 03 00 03 01 01 01 02   ..0.............
+|   2576: 01 01 03 01 01 83 72 8c 80 80 80 80 01 04 00 87   ......r.........
+|   2592: 68 00 00 01 e4 02 30 30 03 03 06 02 83 0f 30 30   h.....00......00
+|   2608: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30   0000000000000000
+|   2624: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30   0000000000000000
+|   2640: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30   0000000000000000
+|   2656: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30   0000000000000000
+|   2672: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30   0000000000000000
+|   2688: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30   0000000000000000
+|   2704: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30   0000000000000000
+|   2720: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30   0000000000000000
+|   2736: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30   0000000000000000
+|   2752: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30   0000000000000000
+|   2768: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30   0000000000000000
+|   2784: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30   0000000000000000
+|   2800: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30   0000000000000000
+|   2816: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30   0000000000000000
+|   2832: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30   0000000000000000
+|   2848: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30   0000000000000000
+|   2864: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30   0000000000000000
+|   2880: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30   0000000000000000
+|   2896: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30   0000000000000000
+|   2912: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30   0000000000000000
+|   2928: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30   0000000000000000
+|   2944: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30   0000000000000000
+|   2960: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30   0000000000000000
+|   2976: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30   0000000000000000
+|   2992: 30 30 30 30 30 30 30 30 30 30 30 30 30 03 06 01   0000000000000...
+|   3008: 01 03 01 08 32 30 31 36 30 36 30 39 03 03 07 01   ....20160609....
+|   3024: 01 34 03 03 05 01 01 35 03 03 04 01 06 62 69 6e   .4.....5.....bin
+|   3040: 61 72 79 03 07 01 02 02 01 08 63 6f 6d 70 69 6c   ary.......compil
+|   3056: 65 72 03 03 02 01 03 67 63 63 03 03 03 01 01 78   er.....gcc.....x
+|   3072: 03 07 01 01 02 04 06 83 17 0d 06 06 0d 0d 08 0f   ................
+|   3088: ef 00 14 2a 00 00 00 00 01 02 02 00 02 01 01 01   ...*............
+|   3104: 02 01 01 6a 88 80 80 80 80 01 04 00 81 58 00 00   ...j.........X..
+|   3120: 00 5f 07 30 62 69 6e 61 72 79 0c 01 03 01 01 06   ._.0binary......
+|   3136: 65 6e 61 62 6c 65 0a 01 01 01 01 01 01 01 01 01   enable..........
+|   3152: 01 01 01 04 66 74 73 34 0a 01 01 01 01 01 04 01   ....fts4........
+|   3168: 35 0d 01 01 01 01 01 01 06 6e 6f 63 61 73 65 0b   5........nocase.
+|   3184: 01 03 01 01 05 72 74 72 69 6d 0a 01 03 01 01 01   .....rtrim......
+|   3200: 78 0a 01 01 01 01 01 01 01 01 01 01 01 04 0c 14   x...............
+|   3216: 0c 09 0c 0b 86 4a 84 80 80 80 80 01 04 00 8d 18   .....J..........
+|   3232: 00 00 03 2b 02 30 30 01 02 06 01 02 06 01 02 06   ...+.00.........
+|   3248: 1f 02 03 01 02 03 01 02 03 01 08 32 30 31 36 30   ...........20160
+|   3264: 36 30 39 01 02 07 01 02 07 01 02 07 01 01 34 01   609...........4.
+|   3280: 02 05 01 02 05 01 02 05 01 01 35 01 02 04 01 02   ..........5.....
+|   3296: 04 01 02 04 02 07 30 30 30 30 30 30 30 1c 02 04   ......0000000...
+|   3312: 01 02 04 01 02 04 01 06 62 69 6e 61 72 79 03 06   ........binary..
+|   3328: 01 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01   ................
+|   3344: 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01 02   ................
+|   3360: 02 03 06 01 02 02 03 06 01 02 02 03 06 01 02 02   ................
+|   3376: 03 06 01 02 02 03 06 01 02 02 01 08 63 6f 6d 70   ............comp
+|   3392: 69 6c 65 72 01 02 02 01 02 02 01 02 02 01 06 64   iler...........d
+|   3408: 62 73 74 61 74 07 02 03 01 02 03 01 02 03 02 04   bstat...........
+|   3424: 65 62 75 67 04 02 02 01 02 02 01 02 02 01 06 65   ebug...........e
+|   3440: 6e 61 62 6c 65 07 02 02 01 02 02 01 02 02 01 02   nable...........
+|   3456: 02 01 02 02 01 02 02 01 02 02 01 02 02 01 02 02   ................
+|   3472: 01 02 02 01 02 02 01 02 02 01 02 02 01 02 02 01   ................
+|   3488: 02 02 01 02 02 01 02 02 01 02 02 01 02 02 01 02   ................
+|   3504: 02 01 02 02 02 08 78 74 65 6e 73 69 6f 6e 1f 02   ......xtension..
+|   3520: 04 01 02 04 01 02 04 01 04 66 74 73 34 0a 02 03   .........fts4...
+|   3536: 01 02 03 01 02 03 04 01 35 0d 02 03 01 02 03 01   ........5.......
+|   3552: 02 03 01 03 67 63 63 01 02 03 01 02 03 01 02 03   ....gcc.........
+|   3568: 02 06 65 6f 70 6f 6c 79 10 02 03 01 02 03 01 02   ..eopoly........
+|   3584: 03 01 05 6a 73 6f 6e 31 13 02 03 01 02 03 01 02   ...json1........
+|   3600: 03 01 04 6c 6f 61 64 1f 02 03 01 02 03 01 02 03   ...load.........
+|   3616: 01 03 6d 61 78 1c 02 02 01 02 02 01 02 02 02 05   ..max...........
+|   3632: 65 6d 6f 72 79 1c 02 03 01 02 03 01 02 03 04 04   emory...........
+|   3648: 73 79 73 35 16 02 03 01 02 03 01 02 03 01 06 6e   sys5...........n
+|   3664: 6f 63 61 73 65 02 06 01 02 02 03 06 01 02 02 03   ocase...........
+|   3680: 06 01 02 02 03 06 01 02 02 03 06 01 02 02 03 06   ................
+|   3696: 01 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01   ................
+|   3712: 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01 02   ................
+|   3728: 02 01 04 6f 6d 69 74 1f 02 02 01 02 02 01 02 02   ...omit.........
+|   3744: 01 05 72 74 72 65 65 19 02 03 01 02 03 01 02 03   ..rtree.........
+|   3760: 04 02 69 6d 01 06 01 02 02 03 06 01 02 02 03 06   ..im............
+|   3776: 01 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01   ................
+|   3792: 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01 02   ................
+|   3808: 02 03 06 01 02 02 03 06 01 02 02 03 06 01 02 02   ................
+|   3824: 01 0a 74 68 72 65 61 64 73 61 66 65 03 57 34 56   ..threadsafe.W4V
+|   3840: 94 64 91 46 85 84 04 76 74 61 62 07 02 04 01 02   .d.F...vtab.....
+|   3856: 04 01 02 04 01 01 78 01 06 01 01 02 01 06 01 01   ......x.........
+|   3872: 02 01 06 01 01 02 01 06 01 01 02 01 06 01 10 02   ................
+|   3888: 01 06 01 01 02 01 06 01 01 02 01 06 01 01 02 01   ................
+|   3904: 06 01 01 02 01 06 01 01 02 01 06 01 01 02 01 06   ................
+|   3920: 01 01 02 01 06 01 01 02 01 06 01 01 02 01 06 01   ................
+|   3936: 01 02 01 06 01 01 02 01 06 01 01 02 01 06 01 01   ................
+|   3952: 02 01 06 01 01 02 01 06 01 01 02 01 06 01 01 02   ................
+|   3968: 01 06 01 01 02 01 06 01 01 02 01 06 01 01 02 01   ................
+|   3984: 06 01 01 02 01 06 01 01 02 01 06 01 01 02 01 06   ................
+|   4000: 01 01 02 01 06 01 01 02 01 06 01 01 02 01 06 01   ................
+|   4016: 01 02 01 06 01 01 02 01 06 01 01 02 01 06 01 01   ................
+|   4032: 02 01 06 01 01 02 01 06 01 01 02 04 15 13 0c 0c   ................
+|   4048: 12 44 13 11 0f 47 13 0f 0c 0e 11 10 0f 0e 10 0f   .D...G..........
+|   4064: 44 0f 10 40 15 0f 07 01 03 00 14 1e 4e 1f 1e 00   D..@........N...
+|   4080: 00 00 11 24 00 00 00 00 01 01 01 00 01 01 01 01   ...$............
+| page 4 offset 12288
+|      0: 0a 00 00 00 03 0f ec 00 0f fa 0f f3 0f ec 00 00   ................
+|   4064: 00 00 00 00 00 00 00 00 00 00 00 00 06 04 01 0c   ................
+|   4080: 01 03 02 06 04 01 0c 01 02 02 05 04 09 0c 01 02   ................
+| page 5 offset 16384
+|      0: 0d 0e 5b 00 1e 0a 4d 00 0f d8 0f af 0a 4d 0f 74   ..[...M......M.t
+|     16: 0f 61 0f 4e 0f 2f 0f 0f 0e ef 0e 40 0e 24 0e 08   .a.N./.....@.$..
+|     32: 0d ef 0d d5 0d bb 0d a0 0d 84 0d 68 0d 4f 0d 35   ...........h.O.5
+|     48: 0d 1b 0c fb 0c da 0c b9 0c 99 0c 78 0c 57 0c 3e   ...........x.W.>
+|     64: 0c 24 0c 0a 0c 0a 0c 0a 0c 0a 0c 0a 0c 0a 0c 0a   .$..............
+|   2624: 00 00 00 00 00 00 00 00 00 00 00 00 00 83 3a 03   ..............:.
+|   2640: 06 00 43 86 33 19 43 4f 4d 50 49 4c 45 52 3d 67   ..C.3.COMPILER=g
+|   2656: 63 63 2d 35 2e 34 2e 30 20 32 30 31 36 30 36 30   cc-5.4.0 2016060
+|   2672: 39 58 27 30 30 30 30 30 30 30 30 30 30 30 30 30   9X'0000000000000
+|   2688: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30   0000000000000000
+|   2704: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30   0000000000000000
+|   2720: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30   0000000000000000
+|   2736: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30   0000000000000000
+|   2752: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30   0000000000000000
+|   2768: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30   0000000000000000
+|   2784: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30   0000000000000000
+|   2800: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30   0000000000000000
+|   2816: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30   0000000000000000
+|   2832: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30   0000000000000000
+|   2848: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30   0000000000000000
+|   2864: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30   0000000000000000
+|   2880: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30   0000000000000000
+|   2896: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30   0000000000000000
+|   2912: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30   0000000000000000
+|   2928: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30   0000000000000000
+|   2944: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30   0000000000000000
+|   2960: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30   0000000000000000
+|   2976: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30   0000000000000000
+|   2992: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30   0000000000000000
+|   3008: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30   0000000000000000
+|   3024: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30   0000000000000000
+|   3040: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30   0000000000000000
+|   3056: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30   0000000000000000
+|   3072: 30 30 30 27 42 49 4e 41 52 59 18 24 05 00 25 0f   000'BINARY.$..%.
+|   3088: 19 54 48 52 45 41 44 53 41 46 45 3d 30 58 42 49   .THREADSAFE=0XBI
+|   3104: 4e 41 52 59 18 23 05 00 25 0f 19 54 48 52 45 41   NARY.#..%..THREA
+|   3120: 44 53 41 46 45 3d 30 58 4e 4f 43 41 53 45 17 22   DSAFE=0XNOCASE..
+|   3136: 05 00 25 0f 17 54 48 52 45 41 44 53 41 46 45 3d   ..%..THREADSAFE=
+|   3152: 30 58 52 54 52 49 4d 1f 21 05 00 33 0f 19 4f 4d   0XRTRIM.!..3..OM
+|   3168: 49 54 20 4c 4f 41 44 20 45 58 54 45 4e 53 49 4f   IT LOAD EXTENSIO
+|   3184: 4e 58 42 49 4e 41 52 59 1f 20 05 00 33 0f 19 4f   NXBINARY. ..3..O
+|   3200: 4d 49 54 20 4c 4f 41 44 20 45 58 54 45 4e 53 49   MIT LOAD EXTENSI
+|   3216: 4f 4e 58 4e 4f 43 41 53 45 1e 1f 05 00 33 0f 17   ONXNOCASE....3..
+|   3232: 4f 4d 49 54 20 4c 4f 41 44 20 45 58 54 45 4e 53   OMIT LOAD EXTENS
+|   3248: 49 4f 4e 58 52 54 52 49 4d 1f 1e 05 00 33 0f 19   IONXRTRIM....3..
+|   3264: 4d 41 58 20 4d 45 4d 4f 52 59 3d 35 30 30 30 30   MAX MEMORY=50000
+|   3280: 30 30 30 58 42 49 4e 41 52 59 1f 1d 05 00 33 0f   000XBINARY....3.
+|   3296: 19 4d 41 58 20 4d 45 4d 4f 52 59 3d 35 30 30 30   .MAX MEMORY=5000
+|   3312: 30 30 30 30 58 4e 4f 43 41 53 45 1e 1c 05 00 33   0000XNOCASE....3
+|   3328: 0f 17 4d 41 58 20 4d 45 4d 4f 52 59 3d 35 30 30   ..MAX MEMORY=500
+|   3344: 30 30 30 30 30 58 52 54 52 49 4d 18 1b 05 00 25   00000XRTRIM....%
+|   3360: 0f 19 45 4e 41 42 4c 45 20 52 54 52 45 45 58 42   ..ENABLE RTREEXB
+|   3376: 49 4e 41 52 59 18 1a 05 00 25 0f 19 45 4e 41 42   INARY....%..ENAB
+|   3392: 4c 45 20 52 54 52 45 45 58 4e 4f 43 41 53 45 17   LE RTREEXNOCASE.
+|   3408: 19 05 00 25 0f 17 45 4e 41 42 4c 45 20 52 54 52   ...%..ENABLE RTR
+|   3424: 45 45 58 52 54 52 49 4d 1a 18 05 00 29 0f 19 45   EEXRTRIM....)..E
+|   3440: 4e 41 42 4c 45 20 4d 45 4d 53 59 53 35 58 42 49   NABLE MEMSYS5XBI
+|   3456: 4e 41 52 59 1a 17 05 00 29 0f 19 45 4e 41 42 4c   NARY....)..ENABL
+|   3472: 42 60 2d 45 4d 53 59 53 35 58 4e 4f 43 41 53 45   B`-EMSYS5XNOCASE
+|   3488: 19 16 05 00 29 0f 17 45 4e 41 42 4c 45 20 4d 45   ....)..ENABLE ME
+|   3504: 4d 53 59 53 35 58 52 54 52 49 4d 18 15 05 00 25   MSYS5XRTRIM....%
+|   3520: 0f 19 45 4e 41 42 4c 45 20 4a 53 4f 4e 31 58 42   ..ENABLE JSON1XB
+|   3536: 49 4e 41 52 59 18 14 05 00 25 0f 19 45 4e 41 42   INARY....%..ENAB
+|   3552: 4c 45 20 4a 53 4f 4e 31 58 4e 4f 43 41 53 45 17   LE JSON1XNOCASE.
+|   3568: 13 05 00 25 0f 17 45 4e 41 42 4c 45 20 4a 53 4f   ...%..ENABLE JSO
+|   3584: 4e 31 58 52 54 52 49 4d 1a 12 05 00 29 0f 19 45   N1XRTRIM....)..E
+|   3600: 4e 41 42 4c 45 20 47 45 4f 50 4f 4c 59 58 42 49   NABLE GEOPOLYXBI
+|   3616: 4e 41 52 59 1a 11 05 00 29 0f 19 45 4e 41 42 4c   NARY....)..ENABL
+|   3632: 45 20 47 45 4f 50 4f 4c 59 58 4e 4f 43 41 53 45   E GEOPOLYXNOCASE
+|   3648: 19 10 05 00 29 0f 17 45 4e 41 42 4c 45 20 47 45   ....)..ENABLE GE
+|   3664: 4f 50 4f 4c 59 58 52 54 52 49 4d 0f 86 00 94 23   OPOLYXRTRIM....#
+|   3680: 0f 19 45 4e 41 42 4c 45 20 46 54 53 35 58 42 49   ..ENABLE FTS5XBI
+|   3696: 4e 41 52 59 00 00 00 7b 23 0f 19 45 4e 41 42 4c   NARY....#..ENABL
+|   3712: 45 20 46 54 53 35 58 4e 4f 43 41 53 45 00 00 00   E FTS5XNOCASE...
+|   3728: 62 23 0f 17 45 4e 41 42 4c 45 20 46 54 53 35 58   b#..ENABLE FTS5X
+|   3744: 52 54 52 49 4d 00 00 00 4a 23 0f 19 45 4e 41 42   RTRIM...J#..ENAB
+|   3760: 4c 45 20 46 54 53 34 58 42 49 4e 41 52 59 00 00   LE FTS4XBINARY..
+|   3776: 00 31 23 0f 19 45 4e 41 42 4c 45 20 46 54 53 34   .1#..ENABLE FTS4
+|   3792: 58 4e 4f 43 41 53 45 00 00 00 18 23 0f 17 45 4e   XNOCASE....#..EN
+|   3808: 41 42 4c 45 20 46 54 53 34 58 52 54 52 49 4d 1e   ABLE FTS4XRTRIM.
+|   3824: 09 05 00 31 0f 19 45 4e 41 42 4c 45 20 44 42 53   ...1..ENABLE DBS
+|   3840: 54 41 54 20 56 54 41 42 58 42 49 4e 41 52 59 1e   TAT VTABXBINARY.
+|   3856: 08 05 00 31 0f 19 45 4e 41 42 4c 45 20 44 42 53   ...1..ENABLE DBS
+|   3872: 54 41 54 20 56 54 24 15 48 4e 4f 43 41 53 45 1d   TAT VT$.HNOCASE.
+|   3888: 07 05 00 31 0f 17 45 4e 41 42 4c 45 20 44 42 53   ...1..ENABLE DBS
+|   3904: 54 41 54 20 56 54 41 42 58 52 54 52 49 4d 11 06   TAT VTABXRTRIM..
+|   3920: 05 00 17 0f 19 44 45 42 55 47 58 42 49 4e 41 52   .....DEBUGXBINAR
+|   3936: 59 11 05 05 00 17 0f 19 44 45 42 55 47 58 4e 4f   Y.......DEBUGXNO
+|   3952: 43 41 53 45 10 04 05 00 17 0f 17 44 45 42 55 47   CASE.......DEBUG
+|   3968: 58 52 54 52 49 4d 00 00 00 29 43 0f 19 43 4f 4d   XRTRIM...)C..COM
+|   3984: 50 49 4c 45 52 3d 67 63 63 2d 35 2e 34 2e 30 20   PILER=gcc-5.4.0 
+|   4000: 32 30 31 36 30 36 30 39 58 42 49 4e 41 52 59 27   20160609XBINARY'
+|   4016: 02 05 00 43 0f 19 43 4f 4d 50 49 4c 45 52 3d 67   ...C..COMPILER=g
+|   4032: 63 63 2d 35 2e 34 2e 30 20 32 30 31 36 30 36 30   cc-5.4.0 2016060
+|   4048: 39 58 4e 4f 43 41 53 45 26 01 05 00 43 0f 17 43   9XNOCASE&...C..C
+|   4064: 4f 4d 50 49 4c 45 52 3d 67 63 63 2d 35 2e 34 2e   OMPILER=gcc-5.4.
+|   4080: 30 20 32 30 31 36 30 36 30 39 58 52 54 52 49 4d   0 20160609XRTRIM
+| page 6 offset 20480
+|      0: 0d 0f 88 00 1e 0e e0 00 0f f8 0f f0 0f b0 0f e0   ................
+|     16: 0f d8 0f d0 0f c8 0f c0 0f b8 0f 80 0f 78 0f 70   .............x.p
+|     32: 0f 68 0f 60 0f 58 0f 50 0f 48 0f 40 0f 38 0f 30   .h.`.X.P.H.@.8.0
+|     48: 0f 28 0f 20 0f 18 0f 10 0f 08 0f 00 0e f8 0e f0   .(. ............
+|     64: 0e e8 0e e0 0e e0 0e e0 0e e0 0e e0 0e e0 0e e0   ................
+|   3808: 06 24 03 00 12 02 01 01 06 23 03 00 12 02 01 01   .$.......#......
+|   3824: 06 22 03 00 12 02 01 01 06 21 03 00 12 03 01 01   .........!......
+|   3840: 06 20 03 00 12 03 01 01 06 1f 03 00 12 03 01 01   . ..............
+|   3856: 06 1e 03 00 12 03 01 01 06 1d 03 00 12 03 01 01   ................
+|   3872: 06 1c 03 00 12 03 01 01 06 1b 03 00 12 02 01 01   ................
+|   3888: 06 1a 03 00 12 02 01 01 06 19 03 00 12 02 01 01   ................
+|   3904: 06 18 03 00 12 02 01 01 06 17 03 00 12 02 01 01   ................
+|   3920: 06 16 03 00 12 02 01 01 06 15 03 00 12 02 01 01   ................
+|   3936: 06 14 03 00 12 02 01 01 06 13 03 00 12 02 01 01   ................
+|   3952: 06 12 03 00 12 02 01 01 06 11 03 00 12 02 01 01   ................
+|   3968: 06 10 03 00 12 02 01 01 0f e8 00 28 12 02 01 01   ...........(....
+|   3984: 00 00 00 28 12 02 01 01 00 00 00 20 12 02 01 01   ...(....... ....
+|   4000: 00 00 00 18 12 02 01 01 00 00 00 10 12 02 01 01   ................
+|   4016: 06 03 03 00 12 06 02 01 06 09 03 00 12 03 01 01   ................
+|   4032: 06 08 03 00 12 03 01 01 06 07 03 00 12 03 01 01   ................
+|   4048: 06 06 03 00 12 01 01 01 06 05 03 00 12 01 01 01   ................
+|   4064: 06 04 03 00 12 01 01 01 00 00 00 08 12 06 01 01   ................
+|   4080: 06 02 03 00 12 06 01 01 06 01 03 00 12 06 01 01   ................
+| page 7 offset 24576
+|      0: 0a 00 00 00 01 0f f4 00 0f f4 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 0b 03 1b 01 76 65 72 73 69 6f 6e 04   ........version.
+| page 8 offset 28672
+|      0: 0d 00 00 00 03 0f d6 00 0f f4 0f e9 0f d6 00 00   ................
+|   4048: 00 00 00 00 00 00 11 03 02 2b 69 6e 74 65 67 72   .........+integr
+|   4064: 69 74 79 2d 63 68 65 63 6b 09 02 02 1b 72 65 62   ity-check....reb
+|   4080: 75 69 6c 64 0a 01 02 1d 6f 70 74 69 6d 69 7a 65   uild....optimize
+| end c30b.db
+}]} {}
+
+do_catchsql_test 26.1 {
+  BEGIN;
+    INSERT INTO t1(t1) VALUES('rebuild');
+    INSERT INTO t1(t1) VALUES('integrity-check');
+  COMMIT;
+} {0 {}}
+
+#--------------------------------------------------------------------------
+reset_db
+do_test 27.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 32768 pagesize 4096 filename timeout-2ca5b0658c98.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 00 00 00 00 08   .....@  ........
+|     32: 00 00 00 02 00 00 00 01 00 00 00 09 00 00 00 04   ................
+|     48: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00   ................
+|     96: 00 00 00 00 0d 0f c7 00 07 0d 92 00 0f 8d 0f 36   ...............6
+|    112: 0e cb 0e 6b 0e 0e 0d b6 0d 92 0d 92 00 00 00 00   ...k............
+|   3472: 00 00 22 08 06 17 11 11 01 31 74 61 62 6c 65 74   .........1tablet
+|   3488: 32 74 32 08 43 52 45 41 54 45 20 54 41 42 4c 45   2t2.CREATE TABLE
+|   3504: 20 74 32 28 78 29 56 07 06 17 1f 1f 01 7d 74 61    t2(x)V.......ta
+|   3520: 62 6c 65 74 31 5f 63 6f 6e 66 69 67 74 31 5f 63   blet1_configt1_c
+|   3536: 6f 6e 66 69 67 07 43 52 45 41 54 45 20 54 41 42   onfig.CREATE TAB
+|   3552: 4c 45 20 27 74 31 5f 63 6f 6e 66 69 67 27 28 6b   LE 't1_config'(k
+|   3568: 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20 76 29    PRIMARY KEY, v)
+|   3584: 20 57 49 54 48 4f 55 54 20 52 4f 57 49 44 5b 06    WITHOUT ROWID[.
+|   3600: 07 17 21 21 01 81 01 74 61 62 6c 65 74 31 5f 64   ..!!...tablet1_d
+|   3616: 6f 63 73 69 7a 65 74 31 5f 64 6f 63 73 69 7a 65   ocsizet1_docsize
+|   3632: 06 43 52 45 41 54 45 20 54 41 42 4c 45 20 27 74   .CREATE TABLE 't
+|   3648: 31 5f 64 6f 63 73 69 7a 65 27 28 69 64 20 49 4e   1_docsize'(id IN
+|   3664: 54 45 47 45 52 20 50 52 49 4d 41 52 59 20 4b 45   TEGER PRIMARY KE
+|   3680: 59 2c 20 73 7a 20 42 4c 4f 42 29 5e 05 07 17 21   Y, sz BLOB)^...!
+|   3696: 21 01 81 07 74 61 62 6c 65 74 31 5f 63 6f 6e 74   !...tablet1_cont
+|   3712: 65 6e 74 74 31 5f 63 6f 6e 74 65 6e 74 05 43 52   entt1_content.CR
+|   3728: 45 41 54 45 20 54 41 42 4c 45 20 27 74 31 5f 63   EATE TABLE 't1_c
+|   3744: 6f 6e 74 65 6e 74 27 28 69 64 20 49 4e 54 45 47   ontent'(id INTEG
+|   3760: 45 52 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20   ER PRIMARY KEY, 
+|   3776: 63 30 2c 20 63 31 2c 20 63 32 29 69 04 07 17 19   c0, c1, c2)i....
+|   3792: 19 01 81 2d 74 61 62 6c 65 74 31 5f 69 64 78 74   ...-tablet1_idxt
+|   3808: 31 5f 69 64 78 04 43 52 45 41 54 45 20 54 41 42   1_idx.CREATE TAB
+|   3824: 4c 45 20 27 74 31 5f 69 64 78 27 28 73 65 67 69   LE 't1_idx'(segi
+|   3840: 64 2c 20 74 65 72 6d 2c 20 70 67 6e 6f 2c 20 50   d, term, pgno, P
+|   3856: 52 49 4d 41 52 59 20 4b 45 59 28 73 65 67 69 64   RIMARY KEY(segid
+|   3872: 2c 20 74 65 72 6d 29 29 20 57 49 54 48 4f 55 54   , term)) WITHOUT
+|   3888: 20 52 4f 57 49 44 55 03 07 17 1b 1b 01 81 01 74    ROWIDU........t
+|   3904: 61 62 6c 65 74 31 5f 64 61 74 61 74 31 5f 64 61   ablet1_datat1_da
+|   3920: 74 61 03 43 52 45 41 54 45 20 54 41 42 4c 45 20   ta.CREATE TABLE 
+|   3936: 27 74 31 5f 64 61 74 61 27 28 69 64 20 49 4e 54   't1_data'(id INT
+|   3952: 45 47 45 52 20 50 52 49 4d 41 52 59 20 4b 45 59   EGER PRIMARY KEY
+|   3968: 2c 20 62 6c 6f 63 6b 20 42 4c 4f 42 29 38 02 06   , block BLOB)8..
+|   3984: 17 11 11 08 5f 74 61 62 6c 65 74 31 74 31 43 52   ...._tablet1t1CR
+|   4000: 45 41 54 45 20 56 49 52 54 55 41 4c 20 54 41 42   EATE VIRTUAL TAB
+|   4016: 4c 45 20 74 31 20 55 53 49 4e 47 20 66 74 73 35   LE t1 USING fts5
+|   4032: 28 61 2c 62 2c 63 29 00 00 00 39 00 00 00 00 00   (a,b,c)...9.....
+| page 3 offset 8192
+|      0: 0d 00 00 00 03 0c 94 00 0f e6 0f ef 0c 94 00 00   ................
+|   3216: 00 00 00 00 86 4a 84 80 80 80 80 01 04 00 8d 18   .....J..........
+|   3232: 00 00 03 2b 02 30 30 01 02 06 01 02 06 01 02 06   ...+.00.........
+|   3248: 1f 02 03 01 02 03 01 02 03 01 08 32 30 31 36 30   ...........20160
+|   3264: 36 30 39 01 02 07 01 02 07 01 02 07 01 01 34 01   609...........4.
+|   3280: 02 05 01 02 05 01 02 05 01 01 35 01 02 04 01 02   ..........5.....
+|   3296: 04 01 02 04 02 07 30 30 30 30 30 30 30 1c 02 04   ......0000000...
+|   3312: 01 02 04 01 02 04 01 06 62 69 6e 61 72 79 03 06   ........binary..
+|   3328: 01 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01   ................
+|   3344: 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01 02   ................
+|   3360: 02 03 06 01 02 02 03 06 01 02 02 03 06 01 02 02   ................
+|   3376: 03 06 01 02 02 03 06 01 02 02 01 08 63 6f 6d 70   ............comp
+|   3392: 69 6c 65 72 01 20 01 02 02 02 01 02 02 01 06 64   iler. .........d
+|   3408: 62 73 7c cc cc cc cc cc cc cc cc cc cc cc cc cc   bs|.............
+|   3424: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc   ................
+|   3440: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc   ................
+|   3456: cc cc cc cc cc cc c4 61 74 07 02 03 01 02 03 01   .......at.......
+|   3472: 02 03 02 04 65 62 75 67 04 02 02 01 02 02 01 02   ....ebug........
+|   3488: 02 01 06 65 6e 61 62 6c 65 07 02 02 01 02 02 01   ...enable.......
+|   3504: 02 02 01 02 02 01 02 02 01 02 02 01 02 02 01 02   ................
+|   3520: 02 01 02 02 01 02 02 01 02 02 01 02 02 01 02 02   ................
+|   3536: 01 02 02 01 02 02 01 02 02 01 02 02 01 02 05 23   ...............#
+|   3552: d6 76 36 32 d3 52 e3 42 e3 02 03 23 03 13 63 03   .v62.R.B...#..c.
+|   3568: 63 03 95 84 e4 f4 34 15 34 52 60 10 50 04 30 f1   c.....4.4R`.P.0.
+|   3584: 74 34 f4 d5 04 94 c4 55 23 d6 76 36 32 d3 52 e3   t4.....U#.v62.R.
+|   3600: 42 e3 02 03 23 03 13 63 03 63 03 95 85 25 45 24   B...#..c.c...%E$
+|   3616: 94 d0 d0 00 00 02 40 ee 00 00 ff 80 ff 00 fe 80   ......@.........
+|   3632: fe 00 fd 80 fd 00 fc 80 fc 00 fb 80 fb 00 fa 80   ................
+|   3648: fa 00 f9 80 f9 00 f8 80 f8 00 f7 80 f7 00 f6 80   ................
+|   3664: f6 00 f5 80 f5 00 f4 80 f4 00 f8 0f 30 0f 28 0f   ............0.(.
+|   3680: 20 0f 18 0f 10 0f 08 0f 00 0e f8 0e f0 0e e8 0e    ...............
+|   3696: e0 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01   ................
+|   3712: 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01 02   ................
+|   3728: 02 01 04 6f 6d 69 74 1f 02 02 01 02 02 01 02 02   ...omit.........
+|   3744: 01 05 72 74 72 65 65 19 02 03 01 02 03 01 02 03   ..rtree.........
+|   3760: 04 02 69 6d 01 06 01 02 02 03 06 01 02 02 03 06   ..im............
+|   3776: 01 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01   ................
+|   3792: 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01 02   ................
+|   3808: 02 03 06 01 02 02 03 06 01 02 02 03 06 01 02 02   ................
+|   3824: 01 0a 74 68 72 65 61 64 73 61 66 65 22 02 02 01   ..threadsafe....
+|   3840: 02 02 01 02 02 01 04 76 74 61 62 07 02 04 01 02   .......vtab.....
+|   3856: 04 01 02 04 01 01 78 01 06 01 01 02 01 06 01 01   ......x.........
+|   3872: 02 01 06 01 01 02 01 06 01 01 02 01 06 01 01 02   ................
+|   3888: 01 06 01 01 02 01 06 01 01 02 01 06 01 01 02 01   ................
+|   3904: 06 01 01 02 01 06 01 01 02 01 06 01 01 02 01 06   ................
+|   3920: 01 01 02 01 06 01 01 02 01 06 01 01 02 01 06 01   ................
+|   3936: 01 02 01 06 01 01 02 01 06 01 01 02 01 06 01 01   ................
+|   3952: 02 01 06 01 01 02 01 06 01 01 02 01 06 01 01 02   ................
+|   3968: 01 06 01 01 02 01 06 01 01 02 01 06 01 01 02 01   ................
+|   3984: 06 01 01 02 01 06 01 01 02 01 06 01 01 02 01 06   ................
+|   4000: 01 01 02 01 06 01 01 02 01 06 01 01 02 01 06 01   ................
+|   4016: 01 02 01 06 01 01 02 01 06 01 01 02 01 06 01 01   ................
+|   4032: 02 01 06 01 01 02 01 06 01 01 02 04 15 13 0c 0c   ................
+|   4048: 12 44 13 11 0f 47 13 0f 0c 0e 11 10 0f 0e 10 0f   .D...G..........
+|   4064: 44 0f 10 40 15 0f 07 01 03 00 14 24 5a 24 24 0f   D..@.......$Z$$.
+|   4080: 0a 03 00 24 00 00 00 00 01 01 01 00 01 01 01 01   ...$............
+| page 4 offset 12288
+|      0: 0a 00 00 00 01 0f fa 00 0f fa 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 00 00 00 00 00 00 05 04 09 0c 01 02   ................
+| page 5 offset 16384
+|      0: 0d 00 00 00 24 0c 0a 00 0f d8 0f af 0f 86 0f 74   ....$..........t
+|     16: 0f 61 0f 4e 0f 2f 0f 0f 0e ef 0e d7 0e be 0e a5   .a.N./..........
+|     32: 0e 8d 0e 74 0e 5b 0e 40 0e 24 0e 08 0d ef 0d d5   ...t.[.@.$......
+|     48: 0d bb 0d a0 0d 84 0d 68 0d 4f 0d 35 0d 1b 0c fb   .......h.O.5....
+|     64: 0c da 0c b9 0c 99 0c 78 0c 57 0c 3e 0c 24 0c 0a   .......x.W.>.$..
+|   3072: 00 00 00 00 00 00 00 00 00 00 18 24 05 00 25 0f   ...........$..%.
+|   3088: 19 54 48 52 45 41 44 53 41 46 45 3d 30 58 42 49   .THREADSAFE=0XBI
+|   3104: 4e 41 52 59 18 23 05 00 25 0f 19 54 48 52 45 41   NARY.#..%..THREA
+|   3120: 44 53 41 46 45 3d 30 58 4e 4f 43 41 53 45 17 22   DSAFE=0XNOCASE..
+|   3136: 05 00 25 0f 17 54 48 52 45 41 44 53 41 46 45 3d   ..%..THREADSAFE=
+|   3152: 30 58 52 54 52 49 4d 1f 21 05 00 33 0f 19 4f 4d   0XRTRIM.!..3..OM
+|   3168: 49 54 20 4c 4f 41 44 20 45 58 54 45 4e 53 49 4f   IT LOAD EXTENSIO
+|   3184: 4e 58 42 49 4e 41 52 59 1f 20 05 00 33 0f 19 4f   NXBINARY. ..3..O
+|   3200: 4d 49 54 20 4c 4f 41 44 20 45 58 54 45 4e 53 49   MIT LOAD EXTENSI
+|   3216: 4f 4e 58 4e 4f 43 41 53 45 1e 1f 05 00 33 0f 17   ONXNOCASE....3..
+|   3232: 4f 4d 49 54 20 4c 4f 41 44 20 45 5f e8 54 45 4e   OMIT LOAD E_.TEN
+|   3248: 53 49 4f 4e 58 52 54 52 49 4d 1f 1e 05 00 33 0f   SIONXRTRIM....3.
+|   3264: 19 4d 41 58 20 4d 45 4d 4f 52 59 3d 35 30 31 81   .MAX MEMORY=501.
+|   3280: 40 50 02 50 f1 94 54 e4 14 24 c4 52 04 a5 35 f4   @P.P..T..$.R..5.
+|   3296: e3 15 84 e4 f4 34 15 34 51 71 30 50 02 50 f1 74   .....4.4Qq0P.P.t
+|   3312: 54 e4 14 24 c4 52 04 a5 34 f4 e3 15 85 25 45 24   T..$.R..4....%E$
+|   3328: 94 d1 a1 20 50 02 90 f1 94 54 e4 14 24 c4 52 04   ... P....T..$.R.
+|   3344: 74 54 f5 04 f4 c5 95 84 24 94 e4 15 25 91 a1 10   tT......$...%...
+|   3360: 50 02 90 f1 94 54 e4 14 24 c4 52 04 74 54 f5 04   P....T..$.R.tT..
+|   3376: f4 c5 95 84 e4 f4 34 15 34 51 91 00 50 02 90 f1   ......4.4Q..P...
+|   3392: 74 54 e4 14 24 c4 52 04 74 54 f5 04 f4 c5 95 85   tT..$.R.tT......
+|   3408: 25 45 24 94 d1 70 f0 50 02 30 f1 94 54 e4 14 24   %E$..p.P.0..T..$
+|   3424: c4 52 04 65 45 33 55 84 24 94 e4 15 25 91 70 e0   .R.eE3U.$...%.p.
+|   3440: 50 02 30 f1 94 54 e4 14 24 c4 52 04 65 45 33 55   P.0..T..$.R.eE3U
+|   3456: 84 e4 f4 34 15 34 51 60 d0 50 02 30 f1 74 54 e4   ...4.4Q`.P.0.tT.
+|   3472: 14 24 c4 52 04 65 45 33 55 85 25 45 24 94 d1 70   .$.R.eE3U.%E$..p
+|   3488: c0 50 02 30 f1 94 54 e4 14 24 c4 52 04 65 45 33   .P.0..T..$.R.eE3
+|   3504: 45 84 24 94 e4 15 25 91 70 b0 50 02 30 f1 94 54   E.$...%.p.P.0..T
+|   3520: e4 14 24 c4 52 04 65 45 33 45 84 e4 f4 34 15 34   ..$.R.eE3E...4.4
+|   3536: 51 60 a0 50 02 30 f1 74 54 e4 14 24 c4 52 04 65   Q`.P.0.tT..$.R.e
+|   3552: 45 33 45 85 25 45 24 94 d1 e0 90 50 03 10 f1 94   E3E.%E$....P....
+|   3568: 54 e4 42 4c 45 20 44 42 53 54 41 54 20 56 54 41   T.BLE DBSTAT VTA
+|   3584: 42 58 42 49 4e 41 52 59 1e 08 05 00 31 0f 19 45   BXBINARY....1..E
+|   3600: e4 14 24 c4 52 04 44 25 35 44 15 42 05 65 42 41   ..$.R.D%5D.B.eBA
+|   3616: 54 84 e4 f4 34 15 34 51 d0 70 50 03 10 f1 74 54   T...4.4Q.pP...tT
+|   3632: e4 14 24 c4 52 04 44 25 35 44 15 42 05 65 44 14   ..$.R.D%5D.B.eD.
+|   3648: 25 85 25 45 24 94 d1 10 60 50 01 70 f1 94 44 54   %.%E$...`P.p..DT
+|   3664: 25 54 75 84 24 94 e4 15 25 91 10 50 50 01 70 f1   %Tu.$...%..PP.p.
+|   3680: 94 44 54 25 54 75 84 e4 f4 34 15 34 51 00 40 50   .DT%Tu...4.4Q.@P
+|   3696: 01 70 f1 74 44 54 25 54 75 85 25 45 24 94 d2 70   .p.tDT%Tu.%E$..p
+|   3712: 30 50 04 30 f1 94 34 f4 d5 04 94 c4 55 23 d6 76   0P.0..4.....U#.v
+|   3728: 36 32 d3 52 e3 42 e3 02 03 23 03 13 63 03 63 03   62.R.B...#..c.c.
+|   3744: 95 84 24 94 e4 15 25 92 70 20 50 04 30 f1 94 34   ..$...%.p P.0..4
+|   3760: f4 d5 04 94 c4 53 30 01 00 00 10 10 04 02 02 00   .....S0.........
+|   3776: 00 00 00 00 00 00 00 80 00 00 00 20 00 00 00 10   ........... ....
+|   3792: 00 00 00 90 00 00 00 40 00 00 00 00 00 00 00 00   .......@........
+| page 6 offset 20480
+|   3808: 06 24 03 00 12 02 01 01 06 23 03 00 12 02 01 01   .$.......#......
+|   3824: 06 22 03 00 12 02 01 01 06 21 03 00 12 03 01 01   .........!......
+|   3840: 06 20 03 00 12 03 01 01 06 1f 03 00 12 03 01 01   . ..............
+|   3856: 06 1e 03 00 12 03 01 01 06 1d 03 00 12 03 01 01   ................
+|   3872: 06 1c 03 00 12 03 01 01 06 1b 03 00 12 02 01 01   ................
+|   3888: 06 1a 03 00 12 02 01 01 06 19 03 00 12 02 01 01   ................
+|   3904: 06 18 03 00 12 02 01 01 06 17 03 00 12 02 01 01   ................
+|   3920: 06 16 03 00 12 02 01 01 06 15 03 00 12 02 01 01   ................
+|   3936: 06 14 03 00 12 02 01 01 06 13 03 00 12 02 01 01   ................
+|   3952: 06 12 03 00 12 02 01 01 06 11 03 00 12 02 01 01   ................
+|   3968: 06 10 03 00 12 02 01 01 06 0f 03 00 12 02 01 01   ................
+|   3984: 06 0e 03 00 12 02 01 01 06 0d 03 00 12 02 01 01   ................
+|   4000: 06 0c 03 00 12 02 01 01 06 0b 03 00 12 02 01 01   ................
+|   4016: 06 0a 03 00 12 02 01 01 06 09 03 00 12 03 01 01   ................
+|   4032: 06 08 03 00 12 03 01 01 06 07 03 00 12 03 01 01   ................
+|   4048: 06 06 03 00 12 01 01 01 06 05 03 00 12 01 01 01   ................
+|   4064: 06 04 03 00 12 01 01 01 06 03 03 00 12 06 01 01   ................
+|   4080: 06 02 03 00 12 06 01 01 06 01 03 00 12 06 01 01   ................
+| page 7 offset 24576
+|      0: 0a 00 00 00 01 0f f4 00 0f f4 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 0b 03 1b 01 76 65 72 73 69 6f 6e 04   ........version.
+| page 8 offset 28672
+|      0: 0d 00 00 00 03 0f d6 00 0f f4 0f e9 0f d6 00 00   ................
+|   4048: 00 00 00 00 00 00 11 03 02 2b 69 6e 74 65 67 72   .........+integr
+|   4064: 69 74 79 2d 63 68 65 63 6b 09 02 02 1b 72 65 62   ity-check....reb
+|   4080: 75 69 6c 64 0a 01 02 1d 6f 70 74 69 6d 69 7a 65   uild....optimize
+| end timeout-2ca5b0658c98.db
+}]} {}
+
+do_catchsql_test 27.1 {
+  DELETE FROM t1 WHERE a MATCH 'fts*';
+} {1 {database disk image is malformed}}
+
+#-------------------------------------------------------------------------
+reset_db
+do_test 28.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 40960 pagesize 4096 filename crash-e2d47e0624a42c.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 00 00 00 00 0a   .....@  ........
+|     32: 00 00 00 00 00 00 00 00 00 00 00 0d 00 00 00 04   ................
+|     48: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00   ................
+|     96: 00 00 00 00 0d 00 00 00 0d 0b 6e 00 0f a3 0f 4c   ..........n....L
+|    112: 0e e1 0e 81 0e 24 0d cc 0d 72 0d 1b 0c b0 0c 50   .....$...r.....P
+|    128: 0b f8 0b b3 0b 6e 00 00 00 00 00 00 00 00 00 00   .....n..........
+|   2912: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 43 0d   ..............C.
+|   2928: 06 17 11 11 08 75 74 61 62 6c 65 74 34 74 34 43   .....utablet4t4C
+|   2944: 52 45 41 54 45 20 56 49 52 54 55 41 4c 20 54 41   REATE VIRTUAL TA
+|   2960: 42 4c 45 20 74 34 20 55 53 49 4e 47 20 66 74 73   BLE t4 USING fts
+|   2976: 35 76 6f 63 61 62 28 27 74 32 27 2c 20 27 72 6f   5vocab('t2', 'ro
+|   2992: 77 27 29 43 0c 06 17 11 11 08 75 74 61 62 6c 65   w')C......utable
+|   3008: 74 33 74 33 43 52 45 41 54 45 20 56 49 52 54 55   t3t3CREATE VIRTU
+|   3024: 41 4c 20 54 41 42 4c 45 20 74 33 20 55 53 49 4e   AL TABLE t3 USIN
+|   3040: 47 20 66 74 73 35 76 6f 63 61 62 28 27 74 31 27   G fts5vocab('t1'
+|   3056: 2c 20 27 72 6f 77 27 29 56 0b 06 17 1f 1f 01 7d   , 'row')V.......
+|   3072: 74 61 62 6c 65 74 32 5f 63 6f 6e 66 69 67 74 32   tablet2_configt2
+|   3088: 5f 63 6f 6e 66 69 67 0a 43 52 45 41 54 45 20 54   _config.CREATE T
+|   3104: 41 42 4c 45 20 27 74 32 5f 63 6f 6e 66 69 67 27   ABLE 't2_config'
+|   3120: 28 6b 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20   (k PRIMARY KEY, 
+|   3136: 76 29 20 57 49 54 48 4f 55 54 20 52 4f 57 49 44   v) WITHOUT ROWID
+|   3152: 5e 0a 07 17 21 21 01 81 07 74 61 62 6c 65 74 32   ^...!!...tablet2
+|   3168: 5f 63 6f 6e 74 65 6e 74 74 32 5f 63 6f 6e 74 65   _contentt2_conte
+|   3184: 6e 74 09 43 52 45 41 54 45 20 54 41 42 4c 45 20   nt.CREATE TABLE 
+|   3200: 27 74 32 5f 63 6f 6e 74 65 6e 74 27 28 69 64 20   't2_content'(id 
+|   3216: 49 4e 54 45 47 45 52 20 50 52 49 4d 41 52 59 20   INTEGER PRIMARY 
+|   3232: 4b 45 59 2c 20 63 30 2c 20 63 31 2c 20 63 32 29   KEY, c0, c1, c2)
+|   3248: 69 09 07 17 19 19 01 81 2d 74 61 62 6c 65 74 32   i.......-tablet2
+|   3264: 5f 69 64 78 74 32 5f 69 64 78 08 43 52 45 41 54   _idxt2_idx.CREAT
+|   3280: 45 20 54 41 42 4c 45 20 27 74 32 5f 69 64 78 27   E TABLE 't2_idx'
+|   3296: 28 73 65 67 69 64 2c 20 74 65 72 6d 2c 20 70 67   (segid, term, pg
+|   3312: 6e 6f 2c 20 50 52 49 4d 41 52 59 20 4b 45 59 28   no, PRIMARY KEY(
+|   3328: 73 65 67 69 64 2c 20 74 65 72 6d 29 29 20 57 49   segid, term)) WI
+|   3344: 54 48 4f 55 54 20 52 4f 57 49 44 55 08 07 17 1b   THOUT ROWIDU....
+|   3360: 1b 01 81 01 74 61 62 6c 65 74 32 5f 64 61 74 61   ....tablet2_data
+|   3376: 74 32 5f 64 61 74 61 07 43 52 45 41 54 45 20 54   t2_data.CREATE T
+|   3392: 41 42 4c 45 20 27 74 32 5f 64 61 74 61 27 28 69   ABLE 't2_data'(i
+|   3408: 64 20 49 4e 54 45 47 45 52 20 50 52 49 4d 41 52   d INTEGER PRIMAR
+|   3424: 59 20 4b 45 59 2c 20 62 6c 6f 63 6b 20 42 4c 4f   Y KEY, block BLO
+|   3440: 42 29 58 07 07 17 11 11 08 81 1d 74 61 62 6c 65   B)X........table
+|   3456: 74 32 74 32 43 52 45 41 54 45 20 56 49 52 54 55   t2t2CREATE VIRTU
+|   3472: 41 4c 20 54 41 42 4c 45 20 74 32 20 55 53 49 4e   AL TABLE t2 USIN
+|   3488: 47 20 66 74 73 35 28 27 61 27 2c 5b 62 5d 2c 22   G fts5('a',[b],.
+|   3504: 63 22 2c 64 65 74 61 69 6c 3d 6e 6f 6e 65 2c 63   c.,detail=none,c
+|   3520: 6f 6c 75 6d 6e 73 69 7a 65 3d 30 29 56 06 06 17   olumnsize=0)V...
+|   3536: 1f 1f 01 7d 74 61 62 6c 65 74 31 5f 63 6f 6e 66   ....tablet1_conf
+|   3552: 69 67 74 31 5f 63 6f 6e 66 69 67 06 43 52 45 41   igt1_config.CREA
+|   3568: 54 45 20 54 41 42 4c 45 20 27 74 31 5f 63 6f 6e   TE TABLE 't1_con
+|   3584: 66 69 67 27 28 6b 20 50 52 49 4d 41 52 59 20 4b   fig'(k PRIMARY K
+|   3600: 45 59 2c 20 76 29 20 57 49 54 48 4f 55 54 20 52   EY, v) WITHOUT R
+|   3616: 4f 57 49 44 5b 05 07 17 21 21 01 81 01 74 61 62   OWID[...!!...tab
+|   3632: 6c 65 74 31 5f 64 6f 63 73 69 7a 65 74 31 5f 64   let1_docsizet1_d
+|   3648: 6f 63 73 69 7a 65 05 43 52 45 41 54 45 20 54 41   ocsize.CREATE TA
+|   3664: 42 4c 45 20 27 74 31 5f 64 6f 63 73 69 7a 65 27   BLE 't1_docsize'
+|   3680: 28 69 64 20 49 4e 54 45 47 45 52 20 50 52 49 4d   (id INTEGER PRIM
+|   3696: 41 52 59 20 4b 45 59 2c 20 73 7a 20 42 4c 4f 42   ARY KEY, sz BLOB
+|   3712: 29 5e 04 07 17 21 21 01 81 07 74 61 62 6c 65 74   )^...!!...tablet
+|   3728: 31 5f 63 6f 6e 74 65 6e 74 74 31 5f 63 6f 6e 74   1_contentt1_cont
+|   3744: 65 6e 74 04 43 52 45 41 54 45 20 54 41 42 4c 45   ent.CREATE TABLE
+|   3760: 20 27 74 31 5f 63 6f 6e 74 65 6e 74 27 28 69 64    't1_content'(id
+|   3776: 20 49 4e 54 45 47 45 52 20 50 52 49 4d 41 52 59    INTEGER PRIMARY
+|   3792: 20 4b 45 59 2c 20 63 30 2c 20 63 31 2c 20 63 32    KEY, c0, c1, c2
+|   3808: 29 69 03 07 17 19 19 01 81 2d 74 61 62 6c 65 74   )i.......-tablet
+|   3824: 31 5f 69 64 78 74 31 5f 69 64 78 03 43 52 45 41   1_idxt1_idx.CREA
+|   3840: 54 45 20 54 41 42 4c 45 20 27 74 31 5f 69 64 78   TE TABLE 't1_idx
+|   3856: 27 28 73 65 67 69 64 2c 20 74 65 72 6d 2c 20 70   '(segid, term, p
+|   3872: 67 6e 6f 2c 20 50 52 49 4d 41 52 59 20 4b 45 59   gno, PRIMARY KEY
+|   3888: 28 73 65 67 69 64 2c 20 74 65 72 6d 29 29 20 57   (segid, term)) W
+|   3904: 49 54 48 4f 55 54 20 52 4f 57 49 44 55 02 07 17   ITHOUT ROWIDU...
+|   3920: 1b 1b 01 81 01 74 61 62 6c 65 74 31 5f 64 61 74   .....tablet1_dat
+|   3936: 61 74 31 5f 64 61 74 61 02 43 52 45 41 54 45 20   at1_data.CREATE 
+|   3952: 54 41 42 4c 45 20 27 74 31 5f 64 61 74 61 27 28   TABLE 't1_data'(
+|   3968: 69 64 20 49 4e 54 45 47 45 52 20 50 52 49 4d 41   id INTEGER PRIMA
+|   3984: 52 59 20 4b 45 59 2c 20 62 6c 6f 63 6b 20 42 4c   RY KEY, block BL
+|   4000: 4f 42 29 5b 01 07 17 11 11 08 81 23 74 61 62 6c   OB)[.......#tabl
+|   4016: 65 74 31 74 31 43 52 45 41 54 45 20 56 49 52 54   et1t1CREATE VIRT
+|   4032: 55 41 4c 20 54 41 42 4c 45 20 74 31 20 55 53 49   UAL TABLE t1 USI
+|   4048: 4e 47 20 66 74 73 35 28 61 2c 62 20 75 6e 69 6e   NG fts5(a,b unin
+|   4064: 64 65 78 65 64 2c 63 2c 74 6f 6b 65 6e 69 7a 65   dexed,c,tokenize
+|   4080: 3d 22 70 6f 72 74 65 72 20 61 73 63 69 69 22 29   =.porter ascii.)
+| page 2 offset 4096
+|      0: 0d 0f 68 00 05 0f 13 00 0f e6 0f 13 0f a8 0f 7c   ..h............|
+|     16: 0f 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 00   .*..............
+|   3856: 00 00 00 15 0a 03 00 30 00 00 00 00 01 03 03 00   .......0........
+|   3872: 03 01 01 01 02 01 01 03 01 01 37 8c 80 80 80 80   ..........7.....
+|   3888: 01 03 00 74 00 00 00 2e 02 30 61 03 02 02 01 01   ...t.....0a.....
+|   3904: 62 03 02 03 01 01 63 03 02 04 01 01 67 03 06 01   b.....c.....g...
+|   3920: 02 02 01 01 68 03 06 01 02 03 01 01 69 03 06 01   ....h.......i...
+|   3936: 02 04 04 06 06 06 08 08 0f ef 00 14 2a 00 00 00   ............*...
+|   3952: 00 01 02 02 00 02 01 01 01 02 01 01 25 88 80 80   ............%...
+|   3968: 80 80 01 03 00 50 00 00 00 1f 02 30 67 02 08 02   .....P.....0g...
+|   3984: 01 02 02 01 01 68 02 08 03 01 02 03 01 01 69 02   .....h........i.
+|   4000: 08 04 01 02 04 04 09 09 37 84 80 80 80 80 01 03   ........7.......
+|   4016: 00 74 00 00 00 2e 02 30 61 01 02 02 01 01 62 01   .t.....0a.....b.
+|   4032: 02 03 01 01 63 01 02 04 01 01 67 01 06 01 02 20   ....c.....g.... 
+|   4048: 10 16 80 10 60 10 20 30 10 16 90 10 60 10 20 40   ....`. 0....`. @
+|   4064: 40 60 60 60 80 80 70 10 30 01 40 30 90 00 90 00   @```..p.0.@0....
+|   4080: 00 01 12 40 00 00 00 00 10 10 10 00 10 10 10 10   ...@............
+| page 3 offset 8192
+|      0: a0 00 00 00 30 fe c0 00 ff a0 ff 30 fe 00 00 00   ....0......0....
+|   4064: 00 00 00 00 00 00 00 00 00 00 00 00 06 04 01 0c   ................
+|   4080: 01 03 02 06 04 01 0c 01 02 02 05 04 09 0c 01 02   ................
+| page 4 offset 12288
+|      0: 0d 00 00 00 03 0f be 00 0f ea 0f d4 0f be 00 00   ................
+|   4016: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 14 03   ................
+|   4032: 05 00 17 17 17 61 20 62 20 63 67 20 68 20 69 67   .....a b cg h ig
+|   4048: 20 68 20 69 14 02 05 00 17 17 17 67 20 68 20 69    h i.......g h i
+|   4064: 61 20 62 20 63 67 20 68 20 69 14 01 05 00 17 17   a b cg h i......
+|   4080: 17 61 20 62 20 63 64 20 65 20 66 67 20 68 20 69   .a b cd e fg h i
+| page 5 offset 16384
+|      0: 0d 00 00 00 03 0f e8 00 0f f8 0f f0 0f e8 00 00   ................
+|   4064: 00 00 00 00 00 00 00 00 06 03 03 00 12 03 00 03   ................
+|   4080: 06 02 03 00 12 03 00 03 06 01 03 00 12 03 00 03   ................
+| page 6 offset 20480
+|      0: 0a 00 00 00 01 0f f4 00 0f f4 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 0b 03 1b 01 76 65 72 73 69 6f 6e 04   ........version.
+| page 7 offset 24576
+|      0: 0d 00 00 00 03 0f 9e 00 0f e6 0f ef 0f 9e 00 00   ................
+|   3984: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 84   ..............A.
+|   4000: 80 80 80 80 01 04 00 81 06 00 00 00 34 02 30 61   ............4.0a
+|   4016: 01 01 01 01 01 62 01 01 01 01 01 63 01 01 01 01   .....b.....c....
+|   4032: 01 64 01 01 01 65 01 01 01 66 01 01 01 01 01 68   .d...e...f.....h
+|   4048: 01 01 01 01 01 69 01 01 01 04 06 06 06 04 04 04   .....i..........
+|   4064: 06 06 07 01 03 00 14 03 09 09 09 0f 0a 03 00 24   ...............$
+|   4080: 00 00 00 00 01 01 01 00 01 01 01 01 0a 00 00 00   ................
+| page 8 offset 28672
+|      0: 01 0f fa 00 0f fa 00 00 00 00 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 00 00 00 00 00 00 05 04 09 0c 01 02   ................
+| page 9 offset 32768
+|      0: 0d 00 00 00 03 0f be 00 0f ea 0f d4 1f be 00 00   ................
+|   4016: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 14 03   ................
+|   4032: 05 00 17 17 17 61 20 62 20 63 67 20 68 20 69 67   .....a b cg h ig
+|   4048: 20 68 20 69 14 02 05 00 17 17 17 67 20 68 20 69    h i.......g h i
+|   4064: 61 20 62 20 63 67 20 68 20 69 14 01 05 00 17 17   a b cg h i......
+|   4080: 17 61 20 62 20 63 64 20 65 20 66 67 20 68 20 69   .a b cd e fg h i
+| page 10 offset 36864
+|      0: 0a 00 00 00 01 0f f4 00 0f f4 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 0b 03 1b 01 76 65 72 73 69 6f 6e 04   ........version.
+| end crash-e2d47e0624a42c.db
+}]} {}
+
+do_catchsql_test 28.1 {
+  SELECT count( fts5_decode(id, block) ) FROM t2_data;
+} {1 {database disk image is malformed}}
+
+#-------------------------------------------------------------------------
+reset_db
+do_test 29.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 28672 pagesize 4096 filename crash-e114c036e13dde.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 00 00 00 00 07   .....@  ........
+|     32: 00 00 00 02 00 00 00 01 00 00 00 08 00 00 00 04   ................
+|     48: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00   ................
+|     96: 00 00 00 00 0d 0f c7 00 06 0d b6 00 0f 8d 0f 36   ...............6
+|    112: 0e cb 0e 6b 0e 0e 0d b6 0d b6 00 00 00 00 00 00   ...k............
+|   3504: 00 00 00 00 00 00 56 07 06 17 1f 1f 01 7d 74 61   ......V.......ta
+|   3520: 62 6c 65 74 31 5f 63 6f 6e 66 69 67 74 31 5f 63   blet1_configt1_c
+|   3536: 6f 6e 66 69 67 07 43 52 45 41 54 45 20 54 41 42   onfig.CREATE TAB
+|   3552: 4c 45 20 27 74 31 5f 63 6f 6e 66 69 67 27 28 6b   LE 't1_config'(k
+|   3568: 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20 76 29    PRIMARY KEY, v)
+|   3584: 20 57 49 54 48 4f 55 54 20 52 4f 57 49 44 5b 06    WITHOUT ROWID[.
+|   3600: 07 17 21 21 01 81 01 74 61 62 6c 65 74 31 5f 64   ..!!...tablet1_d
+|   3616: 6f 63 73 69 7a 65 74 31 5f 64 6f 63 73 69 7a 65   ocsizet1_docsize
+|   3632: 06 43 52 45 41 54 45 20 54 41 42 4c 45 20 27 74   .CREATE TABLE 't
+|   3648: 31 5f 64 6f 63 73 69 7a 65 27 28 69 64 20 49 4e   1_docsize'(id IN
+|   3664: 54 45 47 45 52 20 50 52 49 4d 41 52 59 20 4b 45   TEGER PRIMARY KE
+|   3680: 59 2c 20 73 7a 20 42 4c 4f 42 29 5e 05 07 17 21   Y, sz BLOB)^...!
+|   3696: 21 01 81 07 74 61 62 6c 65 74 31 5f 63 6f 6e 74   !...tablet1_cont
+|   3712: 65 6e 74 74 31 5f 63 6f 6e 74 65 6e 74 05 43 52   entt1_content.CR
+|   3728: 45 41 54 45 20 54 41 42 4c 45 20 27 74 31 5f 63   EATE TABLE 't1_c
+|   3744: 6f 6e 74 65 6e 74 27 28 69 64 20 49 4e 54 45 47   ontent'(id INTEG
+|   3760: 45 52 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20   ER PRIMARY KEY, 
+|   3776: 63 30 2c 20 63 31 2c 20 63 32 29 69 04 07 17 19   c0, c1, c2)i....
+|   3792: 19 01 81 2d 74 61 62 6c 65 74 31 5f 69 64 78 74   ...-tablet1_idxt
+|   3808: 31 5f 69 64 78 04 43 52 45 41 54 45 20 54 41 42   1_idx.CREATE TAB
+|   3824: 4c 45 20 27 74 31 5f 69 64 78 27 28 73 65 67 69   LE 't1_idx'(segi
+|   3840: 64 2c 20 74 65 72 6d 2c 20 70 67 6e 6f 2c 20 50   d, term, pgno, P
+|   3856: 52 49 4d 41 52 59 20 4b 45 59 28 73 65 67 69 64   RIMARY KEY(segid
+|   3872: 2c 20 74 65 72 6d 29 29 20 57 49 54 48 4f 55 54   , term)) WITHOUT
+|   3888: 20 52 4f 57 49 44 55 03 07 17 1b 1b 01 81 01 74    ROWIDU........t
+|   3904: 61 62 6c 65 74 31 5f 64 61 74 61 74 31 5f 64 61   ablet1_datat1_da
+|   3920: 74 61 03 43 52 45 41 54 45 20 54 41 42 4c 45 20   ta.CREATE TABLE 
+|   3936: 27 74 31 5f 64 61 74 61 27 28 69 64 20 49 4e 54   't1_data'(id INT
+|   3952: 45 47 45 52 20 50 52 49 4d 41 52 59 20 4b 45 59   EGER PRIMARY KEY
+|   3968: 2c 20 62 6c 6f 63 6b 20 42 4c 4f 42 29 38 02 06   , block BLOB)8..
+|   3984: 17 11 11 08 5f 74 61 62 6c 65 74 31 74 31 43 52   ...._tablet1t1CR
+|   4000: 45 41 54 45 20 56 49 52 54 55 41 4c 20 54 41 42   EATE VIRTUAL TAB
+|   4016: 4c 45 20 74 31 20 55 53 49 4e 47 20 66 74 73 35   LE t1 USING fts5
+|   4032: 28 61 2c 62 2c 63 29 00 00 00 39 00 00 00 00 00   (a,b,c)...9.....
+| page 3 offset 8192
+|      0: 0d 00 00 00 03 0c af 00 0f e6 0f ef 0c af 00 00   ................
+|   3232: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 86   ................
+|   3248: 2f 84 80 80 80 80 01 04 00 8c 62 00 00 03 12 02   /.........b.....
+|   3264: 30 30 01 04 05 03 01 04 05 03 01 04 05 03 1f 02   00..............
+|   3280: 03 01 02 03 01 02 03 01 08 35 30 30 30 30 30 30   .........5000000
+|   3296: 30 1c 02 04 01 02 04 01 02 04 01 01 36 01 02 04   0...........6...
+|   3312: 01 02 04 01 02 04 01 06 62 69 6e 61 72 79 03 06   ........binary..
+|   3328: 01 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01   ................
+|   3344: 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01 02   ................
+|   3360: 02 03 06 01 02 02 03 06 01 02 02 03 06 01 02 02   ................
+|   3376: 03 06 01 02 02 03 06 01 02 02 01 05 63 6c 61 6e   ............clan
+|   3392: 67 01 02 03 01 02 03 01 02 03 02 07 6f 6d 70 69   g...........ompi
+|   3408: 6c 65 72 01 02 02 01 02 02 01 02 02 01 06 64 62   ler...........db
+|   3424: 73 74 61 74 07 02 03 01 02 03 01 02 03 02 04 65   stat...........e
+|   3440: 62 75 67 04 02 02 01 02 02 01 02 02 01 06 65 6e   bug...........en
+|   3456: 61 62 6c 65 07 02 02 01 02 02 01 02 02 01 02 02   able............
+|   3472: 01 02 02 01 02 02 01 02 02 01 02 02 01 02 02 01   ................
+|   3488: 02 02 01 02 02 01 02 02 01 02 02 01 02 02 01 02   ................
+|   3504: 02 01 02 02 01 02 02 01 02 02 01 02 02 01 02 02   ................
+|   3520: 01 02 02 02 08 78 74 65 6e 73 69 6f 6e 1f 02 04   .....xtension...
+|   3536: 01 02 04 01 02 04 01 04 66 74 73 34 0a 02 03 03   ........fts4....
+|   3552: 01 02 01 02 03 04 01 35 0d 02 03 01 02 03 01 02   .......5........
+|   3568: 03 01 07 67 65 6f 70 6f 6c 79 10 02 03 01 02 03   ...geopoly......
+|   3584: 01 02 03 01 05 6a 73 6f 6e 31 13 02 03 01 02 03   .....json1......
+|   3600: 01 02 03 01 04 6c 6f 61 64 1f 02 03 01 02 03 01   .....load.......
+|   3616: 02 03 01 03 6d 61 78 1c 02 02 01 02 02 01 02 02   ....max.........
+|   3632: 02 05 65 6d 6f 72 79 1c 02 03 01 02 03 01 02 03   ..emory.........
+|   3648: 04 04 73 79 73 35 16 02 03 01 02 03 01 02 03 01   ..sys5..........
+|   3664: 06 6e 6f 63 61 73 65 02 06 01 02 02 03 06 01 02   .nocase.........
+|   3680: 02 03 06 01 02 02 03 06 01 02 02 03 06 01 02 02   ................
+|   3696: 03 06 01 02 02 03 06 01 02 02 03 06 01 02 02 03   ................
+|   3712: 06 01 02 02 03 06 01 02 02 03 06 01 12 02 03 06   ................
+|   3728: 01 02 02 01 04 6f 6d 69 74 1f 02 02 01 02 02 01   .....omit.......
+|   3744: 02 02 01 05 72 74 72 65 65 19 02 03 01 02 03 01   ....rtree.......
+|   3760: 02 03 04 02 69 6d 01 06 01 02 02 03 06 01 02 02   ....im..........
+|   3776: 03 06 01 02 02 03 06 01 02 02 03 06 01 02 02 03   ................
+|   3792: 06 01 02 02 03 06 01 02 02 03 06 01 02 02 03 06   ................
+|   3808: 01 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01   ................
+|   3824: 02 02 01 0a 74 68 72 65 61 64 73 61 66 65 22 02   ....threadsafe..
+|   3840: 02 01 02 02 01 02 02 01 04 76 74 61 62 07 02 04   .........vtab...
+|   3856: 01 02 04 01 02 04 01 01 78 01 06 01 01 02 01 06   ........x.......
+|   3872: 01 01 02 01 06 01 01 02 01 06 01 01 02 01 06 01   ................
+|   3888: 01 02 01 06 01 01 02 01 06 01 01 02 01 06 01 01   ................
+|   3904: 02 01 06 01 01 02 01 06 01 01 02 01 06 01 01 02   ................
+|   3920: 01 06 01 01 02 01 06 01 01 02 01 06 01 01 02 01   ................
+|   3936: 06 01 01 02 01 06 01 01 02 01 06 01 01 02 01 06   ................
+|   3952: 01 01 02 01 06 01 01 02 01 06 01 01 02 01 06 01   ................
+|   3968: 01 02 01 06 01 01 02 01 06 01 01 02 01 06 01 01   ................
+|   3984: 02 01 06 01 01 02 01 06 01 01 02 01 06 01 01 02   ................
+|   4000: 01 06 01 01 02 01 06 01 01 02 01 06 01 01 02 01   ................
+|   4016: 06 01 01 02 01 06 01 01 02 01 06 01 01 02 01 06   ................
+|   4032: 01 01 02 01 06 01 01 02 01 06 01 01 02 04 18 13   ................
+|   4048: 0c 44 10 12 11 0f 47 13 0f 0c 12 10 0f 0e 10 0f   .D....G.........
+|   4064: 44 0f 10 40 15 0f 07 01 03 00 14 24 57 24 24 0f   D..@.......$W$$.
+|   4080: 0a 03 00 24 00 00 00 00 01 01 01 00 01 01 01 01   ...$............
+| page 4 offset 12288
+|      0: 0a 00 00 00 01 0f fa 00 0f fa 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 00 00 00 00 00 00 05 04 09 0c 01 02   ................
+| page 5 offset 16384
+|      0: 0d 00 00 00 24 0c 1f 00 0f df 0f bd 0f 9b 0f 89   ....$...........
+|     16: 0f 76 0f 63 0f 44 0f 24 0f 04 0e ec 0e d3 0e ba   .v.c.D.$........
+|     32: 0e a2 0e 89 0e 70 e5 50 e3 90 e1 d0 e0 40 de a0   .....p.P.....@..
+|     48: dd 00 db 50 d9 90 d7 ea ca ea be d0 d6 40 d4 a0   ...P.........@..
+|     64: d3 00 d1 00 ce f0 cc e0 ca e0 c8 d0 c6 c0 c5 30   ...............0
+|     80: c3 90 c1 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
+|   3088: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18   ................
+|   3104: 24 05 00 25 0f 19 54 48 52 45 41 44 53 41 46 45   $..%..THREADSAFE
+|   3120: 3d 30 58 42 49 4e 41 52 59 18 23 05 00 25 0f 19   =0XBINARY.#..%..
+|   3136: 54 48 52 45 41 44 53 41 46 45 3d 30 58 4e 4f 43   THREADSAFE=0XNOC
+|   3152: 41 53 45 17 22 05 00 25 0f 17 54 48 52 45 41 44   ASE....%..THREAD
+|   3168: 53 41 46 45 3d 30 05 00 33 0f 19 4f 4d 49 54 20   SAFE=0..3..OMIT 
+|   3184: 4c 4f 41 44 20 45 58 54 45 4e 53 49 4f 4e 58 42   LOAD EXTENSIONXB
+|   3200: 49 4e 41 52 59 1f 20 05 00 33 0f 19 4f 4d 49 54   INARY. ..3..OMIT
+|   3216: 20 4c 4f 41 44 20 45 58 54 45 4e 53 49 4f 4e 58    LOAD EXTENSIONX
+|   3232: 4e 4f 43 41 53 45 1e 1f 05 00 33 0f 17 4f 4d 49   NOCASE....3..OMI
+|   3248: 54 20 4c f4 14 42 04 55 85 44 54 e5 34 94 f4 e5   T L..B.U.DT.4...
+|   3264: 85 25 45 24 94 d1 f1 e0 50 03 30 f1 94 d4 15 82   .%E$....P.0.....
+|   3280: 04 d4 54 d4 f5 25 93 d3 53 03 03 03 03 03 03 05   ..T..%..S.......
+|   3296: 84 24 94 e4 15 25 91 f1 d0 50 03 30 f1 94 d4 15   .$...%...P.0....
+|   3312: 82 04 d4 54 d4 f5 25 93 d3 53 03 03 03 03 03 03   ...T..%..S......
+|   3328: 05 84 e4 f4 34 15 34 51 e1 c0 50 03 30 f1 74 d4   ....4.4Q..P.0.t.
+|   3344: 15 82 04 d4 54 d4 f2 90 f1 74 54 e4 14 24 c4 52   ....T....tT..$.R
+|   3360: 04 74 54 f5 04 f4 c5 95 85 25 45 24 94 d1 70 f0   .tT......%E$..p.
+|   3376: 50 02 30 f1 94 54 e4 14 24 c4 52 04 65 45 33 55   P.0..T..$.R.eE3U
+|   3392: 84 24 94 e4 15 25 91 70 e0 50 02 30 f1 94 54 e4   .$...%.p.P.0..T.
+|   3408: 14 24 c4 52 04 65 45 33 55 84 e4 f4 34 15 34 51   .$.R.eE3U...4.4Q
+|   3424: 60 d0 50 02 30 f1 74 54 e4 14 24 c4 52 04 65 45   `.P.0.tT..$.R.eE
+|   3440: 33 55 85 25 45 24 94 d1 70 c0 50 02 30 f1 94 54   3U.%E$..p.P.0..T
+|   3456: e4 14 24 c4 52 04 65 45 33 45 84 24 94 e4 15 25   ..$.R.eE3E.$...%
+|   3472: 91 70 b0 50 02 30 f1 94 54 e4 14 24 c4 52 04 65   .p.P.0..T..$.R.e
+|   3488: 45 33 45 84 e4 f4 34 15 34 51 60 a0 74 54 e4 14   E3E...4.4Q`.tT..
+|   3504: 24 c4 52 04 65 45 33 45 85 25 45 24 94 d1 e0 90   $.R.eE3E.%E$....
+|   3520: 50 03 10 f1 94 54 e4 14 24 c4 52 04 44 25 35 44   P....T..$.R.D%5D
+|   3536: 15 42 05 65 44 14 25 84 24 94 e4 15 25 91 e0 80   .B.eD.%.$...%...
+|   3552: 50 03 10 f1 94 54 e4 14 24 c4 52 04 44 25 35 44   P....T..$.R.D%5D
+|   3568: 15 42 05 65 44 14 25 84 e4 f4 34 15 34 51 d0 70   .B.eD.%...4.4Q.p
+|   3584: 50 03 10 f1 74 54 e4 14 24 c4 52 04 44 25 35 44   P...tT..$.R.D%5D
+|   3600: 15 42 05 65 44 14 25 85 25 45 24 94 d1 10 60 50   .B.eD.%.%E$...`P
+|   3616: 01 70 f1 94 44 54 25 54 75 84 24 94 e4 15 25 91   .p..DT%Tu.$...%.
+|   3632: 10 50 50 01 70 f1 94 44 54 25 54 75 84 e4 f4 34   .PP.p..DT%Tu...4
+|   3648: 15 34 51 00 40 50 01 70 f1 74 44 54 25 54 75 85   .4Q.@P.p.tDT%Tu.
+|   3664: 25 45 24 94 d2 00 30 50 03 50 f1 94 34 f4 d5 04   %E$...0P.P..4...
+|   3680: 94 c4 55 23 d6 36 c6 16 e6 72 d3 62 e3 02 e3 05   ..U#.6...r.b....
+|   3696: 84 24 94 e4 15 25 92 00 20 50 03 50 f1 94 34 f4   .$...%.. P.P..4.
+|   3712: d5 04 94 c4 55 23 d6 36 c6 16 e6 72 d3 62 e3 02   ....U#.6...r.b..
+|   3728: e3 05 84 e4 f4 34 15 34 51 f0 10 50 03 50 f1 74   .....4.4Q..P.P.t
+|   3744: 34 f4 d5 04 94 c4 55 23 d6 36 c6 16 e6 72 d3 62   4.....U#.6...r.b
+|   3760: e3 02 e3 05 85 25 45 24 94 d0 d0 00 00 02 40 ee   .....%E$......@.
+|   3776: 00 00 ff 80 ff 00 fe 80 fe 00 fd 80 fd 00 fc 80   ................
+|   3792: fc 00 fb 80 fb 00 fa 80 fa 00 f9 80 f9 00 f8 80   ................
+|   3808: f8 00 f7 80 f7 00 f6 80 f6 00 f5 80 f5 00 f4 80   ................
+|   3824: f4 00 f3 80 f3 00 f2 80 f2 00 f1 80 f1 00 f0 80   ................
+|   3840: f0 00 ef 80 ef 00 ee 80 ee 00 00 00 00 00 00 00   ................
+| page 6 offset 20480
+|   3808: 06 24 03 00 12 02 01 01 06 23 03 00 12 02 01 01   .$.......#......
+|   3824: 06 22 03 00 12 02 01 01 06 21 03 00 12 03 01 01   .........!......
+|   3840: 06 20 03 00 12 03 01 01 06 1f 03 00 12 03 01 01   . ..............
+|   3856: 06 1e 03 00 12 03 01 01 06 1d 03 00 12 03 01 01   ................
+|   3872: 06 1c 03 00 12 03 01 01 06 1b 03 00 12 02 01 01   ................
+|   3888: 06 1a 03 00 12 02 01 01 06 19 03 00 12 02 01 01   ................
+|   3904: 06 18 03 00 12 02 01 01 06 17 03 00 12 02 01 01   ................
+|   3920: 06 16 03 00 12 02 01 01 06 15 03 00 12 02 01 01   ................
+|   3936: 06 14 03 00 12 02 01 01 06 13 03 00 12 02 01 01   ................
+|   3952: 06 12 03 00 12 02 01 01 06 11 03 00 12 02 01 01   ................
+|   3968: 06 10 03 00 12 02 01 01 06 0f 03 00 12 02 01 01   ................
+|   3984: 06 0e 03 00 12 02 01 01 06 0d 03 00 12 02 01 01   ................
+|   4000: 06 0c 03 00 12 02 01 01 06 0b 03 00 12 02 01 01   ................
+|   4016: 06 0a 03 00 12 02 01 01 06 09 03 00 12 03 01 01   ................
+|   4032: 06 08 03 00 12 03 01 01 06 07 03 00 12 03 01 01   ................
+|   4048: 06 06 03 00 12 01 01 01 06 05 03 00 12 01 01 01   ................
+|   4064: 06 04 03 00 12 01 01 01 06 03 03 00 12 05 01 01   ................
+|   4080: 06 02 03 00 12 05 01 01 06 01 03 00 12 05 01 01   ................
+| page 7 offset 24576
+|      0: 0a 00 00 00 01 0f f4 00 0f f4 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 0b 03 1b 01 76 65 72 73 69 6f 6e 04   ........version.
+| end crash-e114c036e13dde.db
+}]} {}
+
+do_catchsql_test 29.1 {
+  CREATE VIRTUAL TABLE t3 USING fts5vocab('t1','col');
+} {0 {}}
+do_catchsql_test 29.2 {
+  SELECT rowid, quote(term), * FROM t3 WHERE term=='nocase';
+} {1 {database disk image is malformed}}
+
+#-------------------------------------------------------------------------
+reset_db
+do_test 30.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 40960 pagesize 4096 filename crash-eef41e30b388a0.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 00 00 00 00 0a   .....@  ........
+|     32: 00 00 00 00 00 00 00 00 00 00 00 0d 00 00 00 04   ................
+|     48: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00   ................
+|     96: 00 00 00 00 0d 00 00 00 0d 0b 6e 00 0f a3 0f 4c   ..........n....L
+|    112: 0e e1 0e 81 0e 24 0d cc 0d 72 0d 1b 0c b0 0c 50   .....$...r.....P
+|    128: 0b f8 0b b3 0b 6e 00 00 00 00 00 00 00 00 00 00   .....n..........
+|   2912: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 43 0d   ..............C.
+|   2928: 06 17 11 11 08 75 74 61 62 6c 65 74 34 74 34 43   .....utablet4t4C
+|   2944: 52 45 41 54 45 20 56 49 52 54 55 41 4c 20 54 41   REATE VIRTUAL TA
+|   2960: 42 4c 45 20 74 34 20 55 53 49 4e 47 20 66 74 73   BLE t4 USING fts
+|   2976: 35 76 6f 63 61 62 28 27 74 32 27 2c 20 27 72 6f   5vocab('t2', 'ro
+|   2992: 77 27 29 43 0c 06 17 11 11 08 75 74 61 62 6c 65   w')C......utable
+|   3008: 74 33 74 33 43 52 45 41 54 45 20 56 49 52 54 55   t3t3CREATE VIRTU
+|   3024: 41 4c 20 54 41 42 4c 45 20 74 33 20 55 53 49 4e   AL TABLE t3 USIN
+|   3040: 47 20 66 74 73 35 76 6f 63 61 62 28 27 74 31 27   G fts5vocab('t1'
+|   3056: 2c 20 27 72 6f 77 27 29 56 0b 06 17 1f 1f 01 7d   , 'row')V.......
+|   3072: 74 61 62 6c 65 74 32 5f 63 6f 6e 66 69 67 74 32   tablet2_configt2
+|   3088: 5f 63 6f 6e 66 69 67 0a 43 52 45 41 54 45 20 54   _config.CREATE T
+|   3104: 41 42 4c 45 20 27 74 32 5f 63 6f 6e 66 69 67 27   ABLE 't2_config'
+|   3120: 28 6b 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20   (k PRIMARY KEY, 
+|   3136: 76 29 20 57 49 54 48 4f 55 54 20 52 4f 57 49 44   v) WITHOUT ROWID
+|   3152: 5e 0a 07 17 21 21 01 81 07 74 61 62 6c 65 74 32   ^...!!...tablet2
+|   3168: 5f 63 6f 6e 74 65 6e 74 74 32 5f 63 6f 6e 74 65   _contentt2_conte
+|   3184: 6e 74 09 43 52 45 41 54 45 20 54 41 42 4c 45 20   nt.CREATE TABLE 
+|   3200: 27 74 32 5f 63 6f 6e 74 65 6e 74 27 28 69 64 20   't2_content'(id 
+|   3216: 49 4e 54 45 47 45 52 20 50 52 49 4d 41 52 59 20   INTEGER PRIMARY 
+|   3232: 4b 45 59 2c 20 63 30 2c 20 63 31 2c 20 63 32 29   KEY, c0, c1, c2)
+|   3248: 69 09 07 17 19 19 01 81 2d 74 61 62 6c 65 74 32   i.......-tablet2
+|   3264: 5f 69 64 78 74 32 5f 69 64 78 08 43 52 45 41 54   _idxt2_idx.CREAT
+|   3280: 45 20 54 41 42 4c 45 20 27 74 32 5f 69 64 78 27   E TABLE 't2_idx'
+|   3296: 28 73 65 67 69 64 2c 20 74 65 72 6d 2c 20 70 67   (segid, term, pg
+|   3312: 6e 6f 2c 20 50 52 49 4d 41 52 59 20 4b 45 59 28   no, PRIMARY KEY(
+|   3328: 73 65 67 69 64 2c 20 74 65 72 6d 29 29 20 57 49   segid, term)) WI
+|   3344: 54 48 4f 55 54 20 52 4f 57 49 44 55 08 07 17 1b   THOUT ROWIDU....
+|   3360: 1b 01 81 01 74 61 62 6c 65 74 32 5f 64 61 74 61   ....tablet2_data
+|   3376: 74 32 5f 64 61 74 61 07 43 52 45 41 54 45 20 54   t2_data.CREATE T
+|   3392: 41 42 4c 45 20 27 74 32 5f 64 61 74 61 27 28 69   ABLE 't2_data'(i
+|   3408: 64 20 49 4e 54 45 47 45 52 20 50 52 49 4d 41 52   d INTEGER PRIMAR
+|   3424: 59 20 4b 45 59 2c 20 62 6c 6f 63 6b 20 42 4c 4f   Y KEY, block BLO
+|   3440: 42 29 58 07 07 17 11 11 08 81 1d 74 61 62 6c 65   B)X........table
+|   3456: 74 32 74 32 43 52 45 41 54 45 20 56 49 52 54 55   t2t2CREATE VIRTU
+|   3472: 41 4c 20 54 41 42 4c 45 20 74 32 20 55 53 49 4e   AL TABLE t2 USIN
+|   3488: 47 20 66 74 73 35 28 27 61 27 2c 5b 62 5d 2c 22   G fts5('a',[b],.
+|   3504: 63 22 2c 64 65 74 61 69 6c 3d 6e 6f 6e 65 2c 63   c.,detail=none,c
+|   3520: 6f 6c 75 6d 6e 73 69 7a 65 3d 30 29 56 06 06 17   olumnsize=0)V...
+|   3536: 1f 1f 01 7d 74 61 62 6c 65 74 31 5f 63 6f 6e 66   ....tablet1_conf
+|   3552: 69 67 74 31 5f 63 6f 6e 66 69 67 06 43 52 45 41   igt1_config.CREA
+|   3568: 54 45 20 54 41 42 4c 45 20 27 74 31 5f 63 6f 6e   TE TABLE 't1_con
+|   3584: 66 69 67 27 28 6b 20 50 52 49 4d 41 52 59 20 4b   fig'(k PRIMARY K
+|   3600: 45 59 2c 20 76 29 20 57 49 54 48 4f 55 54 20 52   EY, v) WITHOUT R
+|   3616: 4f 57 49 44 5b 05 07 17 21 21 01 81 01 74 61 62   OWID[...!!...tab
+|   3632: 6c 65 74 31 5f 64 6f 63 73 69 7a 65 74 31 5f 64   let1_docsizet1_d
+|   3648: 6f 63 73 69 7a 65 05 43 52 45 41 54 45 20 54 41   ocsize.CREATE TA
+|   3664: 42 4c 45 20 27 74 31 5f 64 6f 63 73 69 7a 65 27   BLE 't1_docsize'
+|   3680: 28 69 64 20 49 4e 54 45 47 45 52 20 50 52 49 4d   (id INTEGER PRIM
+|   3696: 41 52 59 20 4b 45 59 2c 20 73 7a 20 42 4c 4f 42   ARY KEY, sz BLOB
+|   3712: 29 5e 04 07 17 21 21 01 81 07 74 61 62 6c 65 74   )^...!!...tablet
+|   3728: 31 5f 63 6f 6e 74 65 6e 74 74 31 5f 63 6f 6e 74   1_contentt1_cont
+|   3744: 65 6e 74 04 43 52 45 41 54 45 20 54 41 42 4c 45   ent.CREATE TABLE
+|   3760: 20 27 74 31 5f 63 6f 6e 74 65 6e 74 27 28 69 64    't1_content'(id
+|   3776: 20 49 4e 54 45 47 45 52 20 50 52 49 4d 41 52 59    INTEGER PRIMARY
+|   3792: 20 4b 45 59 2c 20 63 30 2c 20 63 31 2c 20 63 32    KEY, c0, c1, c2
+|   3808: 29 69 03 07 17 19 19 01 81 2d 74 61 62 6c 65 74   )i.......-tablet
+|   3824: 31 5f 69 64 78 74 31 5f 69 64 78 03 43 52 45 41   1_idxt1_idx.CREA
+|   3840: 54 45 20 54 41 42 4c 45 20 27 74 31 5f 69 64 78   TE TABLE 't1_idx
+|   3856: 27 28 73 65 67 69 64 2c 20 74 65 72 6d 2c 20 70   '(segid, term, p
+|   3872: 67 6e 6f 2c 20 50 52 49 4d 41 52 59 20 4b 45 59   gno, PRIMARY KEY
+|   3888: 28 73 65 67 69 64 2c 20 74 65 72 6d 29 29 20 57   (segid, term)) W
+|   3904: 49 54 48 4f 55 54 20 52 4f 57 49 44 55 02 07 17   ITHOUT ROWIDU...
+|   3920: 1b 1b 01 81 01 74 61 62 6c 65 74 31 5f 64 61 74   .....tablet1_dat
+|   3936: 61 74 31 5f 64 61 74 61 02 43 52 45 41 54 45 20   at1_data.CREATE 
+|   3952: 54 41 42 4c 45 20 27 74 31 5f 64 61 74 61 27 28   TABLE 't1_data'(
+|   3968: 69 64 20 49 4e 54 45 47 45 52 20 50 52 49 4d 41   id INTEGER PRIMA
+|   3984: 52 59 20 4b 45 59 2c 20 62 6c 6f 63 6b 20 42 4c   RY KEY, block BL
+|   4000: 4f 42 29 5b 01 07 17 11 11 08 81 23 74 61 62 6c   OB)[.......#tabl
+|   4016: 65 74 31 74 31 43 52 45 41 54 45 20 56 49 52 54   et1t1CREATE VIRT
+|   4032: 55 41 4c 20 54 41 42 4c 45 20 74 31 20 55 53 49   UAL TABLE t1 USI
+|   4048: 4e 47 20 66 74 73 35 28 61 2c 62 20 75 6e 69 6e   NG fts5(a,b unin
+|   4064: 64 65 78 65 64 2c 63 2c 74 6f 6b 65 6e 69 7a 65   dexed,c,tokenize
+|   4080: 3d 22 70 6f 72 74 65 72 20 61 73 63 69 69 22 29   =.porter ascii.)
+| page 2 offset 4096
+|      0: 0d 0f 68 00 05 0f 13 00 0f e6 0f 13 0f a8 0f 7c   ..h............|
+|     16: 0f 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 00   .*..............
+|   3856: 00 00 00 15 0a 03 00 30 00 00 00 00 01 03 03 00   .......0........
+|   3872: 03 01 01 01 02 01 01 03 01 01 37 8c 80 80 80 80   ..........7.....
+|   3888: 01 03 00 74 00 00 00 2e 02 30 61 03 02 02 01 01   ...t.....0a.....
+|   3904: 62 03 02 03 01 01 63 03 02 04 01 01 67 03 06 01   b.....c.....g...
+|   3920: 02 02 01 01 68 03 06 01 02 03 01 01 69 03 06 01   ....h.......i...
+|   3936: 02 04 00 00 66 46 08 08 0f ef 00 14 2a 00 00 00   ....fF......*...
+|   3952: 00 01 02 02 00 02 01 01 01 02 01 01 25 88 80 80   ............%...
+|   3968: 80 80 01 03 00 50 00 00 00 1f 02 30 67 02 08 02   .....P.....0g...
+|   3984: 01 02 02 01 01 68 02 08 03 01 02 03 01 01 69 02   .....h........i.
+|   4000: 08 04 01 02 04 04 09 09 37 84 80 80 80 80 01 03   ........7.......
+|   4016: 00 74 00 00 00 2e 02 30 61 01 02 02 01 01 62 01   .t.....0a.....b.
+|   4032: 02 03 01 01 63 01 02 04 01 01 67 01 06 01 02 02   ....c.....g.....
+|   4048: 01 01 68 01 06 01 02 03 01 01 69 01 06 01 02 04   ..h.......i.....
+|   4064: 04 06 06 06 08 08 07 01 03 00 14 03 09 00 09 00   ................
+|   4080: 00 00 11 24 00 00 00 00 01 01 01 00 01 01 01 01   ...$............
+| page 3 offset 8192
+|      0: 0a 00 00 00 03 0f ec 00 0f fa 0f f3 0f ec 00 00   ................
+|   4064: 00 00 00 00 00 00 00 00 00 00 00 00 06 04 01 0c   ................
+|   4080: 01 03 02 06 04 01 0c 01 02 02 05 04 09 0c 01 02   ................
+| page 4 offset 12288
+|      0: 0d 00 00 00 03 0f be 00 0f ea 0f d4 0f be 00 00   ................
+|   4016: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 14 03   ................
+|   4032: 05 00 17 17 17 61 20 62 20 63 67 20 68 20 69 67   .....a b cg h ig
+|   4048: 20 68 20 69 14 02 05 00 17 17 17 67 20 68 20 69    h i.......g h i
+|   4064: 61 20 62 20 63 67 20 68 20 69 14 01 05 00 17 17   a b cg h i......
+|   4080: 17 61 20 62 20 63 64 20 52 06 66 72 06 82 06 90   .a b cd R.fr....
+| page 5 offset 16384
+|      0: d0 00 00 00 30 fe 80 00 ff 80 ff 00 fe 00 00 00   ....0...........
+|   4064: 00 00 00 00 00 00 00 00 06 03 03 00 12 03 00 03   ................
+|   4080: 06 02 03 00 12 03 00 03 06 01 03 00 12 03 00 03   ................
+| page 6 offset 20480
+|      0: 0a 00 00 00 01 0f f4 00 0f f4 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 0b 03 1b 01 76 65 72 73 69 6f 6e 04   ........version.
+| page 7 offset 24576
+|      0: 0d 00 00 00 03 0f 9e 00 0f e6 0f ef 0f 9e 00 00   ................
+|   3984: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 84   ..............A.
+|   4000: 80 80 80 80 01 04 00 81 06 00 00 00 34 02 30 61   ............4.0a
+|   4016: 01 01 01 01 01 62 01 01 01 01 01 63 01 01 01 01   .....b.....c....
+|   4032: 01 64 01 01 01 65 01 01 01 66 01 01 01 67 01 01   .d...e...f...g..
+|   4048: 01 01 01 68 01 01 01 01 01 69 01 01 01 04 06 06   ...h.....i......
+|   4064: 06 04 04 04 06 06 07 01 03 00 14 03 09 09 09 0f   ................
+|   4080: 0a 03 00 24 00 00 00 00 01 01 01 00 01 01 01 01   ...$............
+| page 8 offset 28672
+|      0: 0a 00 00 00 01 0f fa 00 0f fa 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 00 00 00 00 00 00 05 04 09 0c 01 02   ................
+| page 9 offset 32768
+|      0: 0d 00 00 00 03 0f be 00 0f ea 0f d4 0f be 00 00   ................
+|   4016: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 14 03   ................
+|   4032: 05 00 17 17 17 61 20 62 20 63 67 20 68 20 69 67   .....a b cg h ig
+|   4048: 20 68 20 69 14 02 05 00 17 17 17 67 20 68 20 69    h i.......g h i
+|   4064: 61 20 62 20 63 67 20 68 20 69 14 01 05 00 17 17   a b cg h i......
+|   4080: 17 61 20 62 20 63 64 20 65 20 66 67 20 68 20 69   .a b cd e fg h i
+| page 10 offset 36864
+|      0: 0a 00 00 00 01 0f f4 00 0f f4 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 0b 03 1b 01 76 65 72 73 69 6f 6e 04   ........version.
+| end crash-eef41e30b388a0.db
+}]} {}
+
+do_catchsql_test 30.1 {
+  SELECT fts5_decode(id, block) FROM t1_data;
+} {1 {database disk image is malformed}}
+
+#-------------------------------------------------------------------------
+reset_db
+do_test 31.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 8192 pagesize 4096 filename crash-7629f35f11d48e.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 00 00 00 00 02   .....@  ........
+|     32: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 04   ................
+|     48: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00   ................
+|     96: 00 00 00 00 0d 00 00 00 01 0f c7 00 0f c7 00 00   ................
+|   4032: 00 00 00 00 00 00 00 37 01 06 17 15 15 01 53 74   .......7......St
+|   4048: 61 62 6c 65 64 75 61 6c 64 75 61 6c 02 43 52 45   abledualdual.CRE
+|   4064: 41 54 45 20 54 41 42 4c 45 20 64 75 61 6c 28 64   ATE TABLE dual(d
+|   4080: 75 6d 6d 79 20 76 61 72 28 31 29 29 0d 00 00 00   ummy var(1))....
+| page 2 offset 4096
+|      0: 01 0f fb 00 0f fb 00 00 00 00 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 00 00 00 00 00 00 00 03 01 02 0f 58   ...............X
+| end crash-7629f35f11d48e.db
+}]} {}
+
+do_execsql_test 31.1 {
+  CREATE VIRTUAL TABLE t1 USING fts5(a,b,c);
+  WITH RECURSIVE c(x) AS (VALUES(1) UNION ALL SELECT x+1 FROM c WHERE x<72)
+    INSERT INTO t1(a) SELECT randomblob(2829) FROM c;
+  WITH RECURSIVE c(x) AS (VALUES(1) UNION ALL SELECT x+1 FROM c WHERE x<10)
+    INSERT INTO t1(a) SELECT randomblob(3000) FROM c;
+}
+
+do_catchsql_test 31.2 {
+  DELETE FROM t1 WHERE a MATCH X'6620e574f32a';
+} {0 {}}
+
+#-------------------------------------------------------------------------
+reset_db
+do_test 32.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 40960 pagesize 4096 filename crash-e2d47e0624a42c.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 00 00 00 00 0a   .....@  ........
+|     32: 00 00 00 00 00 00 00 00 00 00 00 0d 00 00 00 04   ................
+|     48: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00   ................
+|     96: 00 00 00 00 0d 00 00 00 0d 0b 6e 00 0f a3 0f 4c   ..........n....L
+|    112: 0e e1 0e 81 0e 24 0d cc 0d 72 0d 1b 0c b0 0c 50   .....$...r.....P
+|    128: 0b f8 0b b3 0b 6e 00 00 00 00 00 00 00 00 00 00   .....n..........
+|   2912: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 43 0d   ..............C.
+|   2928: 06 17 11 11 08 75 74 61 62 6c 65 74 34 74 34 43   .....utablet4t4C
+|   2944: 52 45 41 54 45 20 56 49 52 54 55 41 4c 20 54 41   REATE VIRTUAL TA
+|   2960: 42 4c 45 20 74 34 20 55 53 49 4e 47 20 66 74 73   BLE t4 USING fts
+|   2976: 35 76 6f 63 61 62 28 27 74 32 27 2c 20 27 72 6f   5vocab('t2', 'ro
+|   2992: 77 27 29 43 0c 06 17 11 11 08 75 74 61 62 6c 65   w')C......utable
+|   3008: 74 33 74 33 43 52 45 41 54 45 20 56 49 52 54 55   t3t3CREATE VIRTU
+|   3024: 41 4c 20 54 41 42 4c 45 20 74 33 20 55 53 49 4e   AL TABLE t3 USIN
+|   3040: 47 20 66 74 73 35 76 6f 63 61 62 28 27 74 31 27   G fts5vocab('t1'
+|   3056: 2c 20 27 72 6f 77 27 29 56 0b 06 17 1f 1f 01 7d   , 'row')V.......
+|   3072: 74 61 62 6c 65 74 32 5f 63 6f 6e 66 69 67 74 32   tablet2_configt2
+|   3088: 5f 63 6f 6e 66 69 67 0a 43 52 45 41 54 45 20 54   _config.CREATE T
+|   3104: 41 42 4c 45 20 27 74 32 5f 63 6f 6e 66 69 67 27   ABLE 't2_config'
+|   3120: 28 6b 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20   (k PRIMARY KEY, 
+|   3136: 76 29 20 57 49 54 48 4f 55 54 20 52 4f 57 49 44   v) WITHOUT ROWID
+|   3152: 5e 0a 07 17 21 21 01 81 07 74 61 62 6c 65 74 32   ^...!!...tablet2
+|   3168: 5f 63 6f 6e 74 65 6e 74 74 32 5f 63 6f 6e 74 65   _contentt2_conte
+|   3184: 6e 74 09 43 52 45 41 54 45 20 54 41 42 4c 45 20   nt.CREATE TABLE 
+|   3200: 27 74 32 5f 63 6f 6e 74 65 6e 74 27 28 69 64 20   't2_content'(id 
+|   3216: 49 4e 54 45 47 45 52 20 50 52 49 4d 41 52 59 20   INTEGER PRIMARY 
+|   3232: 4b 45 59 2c 20 63 30 2c 20 63 31 2c 20 63 32 29   KEY, c0, c1, c2)
+|   3248: 69 09 07 17 19 19 01 81 2d 74 61 62 6c 65 74 32   i.......-tablet2
+|   3264: 5f 69 64 78 74 32 5f 69 64 78 08 43 52 45 41 54   _idxt2_idx.CREAT
+|   3280: 45 20 54 41 42 4c 45 20 27 74 32 5f 69 64 78 27   E TABLE 't2_idx'
+|   3296: 28 73 65 67 69 64 2c 20 74 65 72 6d 2c 20 70 67   (segid, term, pg
+|   3312: 6e 6f 2c 20 50 52 49 4d 41 52 59 20 4b 45 59 28   no, PRIMARY KEY(
+|   3328: 73 65 67 69 64 2c 20 74 65 72 6d 29 29 20 57 49   segid, term)) WI
+|   3344: 54 48 4f 55 54 20 52 4f 57 49 44 55 08 07 17 1b   THOUT ROWIDU....
+|   3360: 1b 01 81 01 74 61 62 6c 65 74 32 5f 64 61 74 61   ....tablet2_data
+|   3376: 74 32 5f 64 61 74 61 07 43 52 45 41 54 45 20 54   t2_data.CREATE T
+|   3392: 41 42 4c 45 20 27 74 32 5f 64 61 74 61 27 28 69   ABLE 't2_data'(i
+|   3408: 64 20 49 4e 54 45 47 45 52 20 50 52 49 4d 41 52   d INTEGER PRIMAR
+|   3424: 59 20 4b 45 59 2c 20 62 6c 6f 63 6b 20 42 4c 4f   Y KEY, block BLO
+|   3440: 42 29 58 07 07 17 11 11 08 81 1d 74 61 62 6c 65   B)X........table
+|   3456: 74 32 74 32 43 52 45 41 54 45 20 56 49 52 54 55   t2t2CREATE VIRTU
+|   3472: 41 4c 20 54 41 42 4c 45 20 74 32 20 55 53 49 4e   AL TABLE t2 USIN
+|   3488: 47 20 66 74 73 35 28 27 61 27 2c 5b 62 5d 2c 22   G fts5('a',[b],.
+|   3504: 63 22 2c 64 65 74 61 69 6c 3d 6e 6f 6e 65 2c 63   c.,detail=none,c
+|   3520: 6f 6c 75 6d 6e 73 69 7a 65 3d 30 29 56 06 06 17   olumnsize=0)V...
+|   3536: 1f 1f 01 7d 74 61 62 6c 65 74 31 5f 63 6f 6e 66   ....tablet1_conf
+|   3552: 69 67 74 31 5f 63 6f 6e 66 69 67 06 43 52 45 41   igt1_config.CREA
+|   3568: 54 45 20 54 41 42 4c 45 20 27 74 31 5f 63 6f 6e   TE TABLE 't1_con
+|   3584: 66 69 67 27 28 6b 20 50 52 49 4d 41 52 59 20 4b   fig'(k PRIMARY K
+|   3600: 45 59 2c 20 76 29 20 57 49 54 48 4f 55 54 20 52   EY, v) WITHOUT R
+|   3616: 4f 57 49 44 5b 05 07 17 21 21 01 81 01 74 61 62   OWID[...!!...tab
+|   3632: 6c 65 74 31 5f 64 6f 63 73 69 7a 65 74 31 5f 64   let1_docsizet1_d
+|   3648: 6f 63 73 69 7a 65 05 43 52 45 41 54 45 20 54 41   ocsize.CREATE TA
+|   3664: 42 4c 45 20 27 74 31 5f 64 6f 63 73 69 7a 65 27   BLE 't1_docsize'
+|   3680: 28 69 64 20 49 4e 54 45 47 45 52 20 50 52 49 4d   (id INTEGER PRIM
+|   3696: 41 52 59 20 4b 45 59 2c 20 73 7a 20 42 4c 4f 42   ARY KEY, sz BLOB
+|   3712: 29 5e 04 07 17 21 21 01 81 07 74 61 62 6c 65 74   )^...!!...tablet
+|   3728: 31 5f 63 6f 6e 74 65 6e 74 74 31 5f 63 6f 6e 74   1_contentt1_cont
+|   3744: 65 6e 74 04 43 52 45 41 54 45 20 54 41 42 4c 45   ent.CREATE TABLE
+|   3760: 20 27 74 31 5f 63 6f 6e 74 65 6e 74 27 28 69 64    't1_content'(id
+|   3776: 20 49 4e 54 45 47 45 52 20 50 52 49 4d 41 52 59    INTEGER PRIMARY
+|   3792: 20 4b 45 59 2c 20 63 30 2c 20 63 31 2c 20 63 32    KEY, c0, c1, c2
+|   3808: 29 69 03 07 17 19 19 01 81 2d 74 61 62 6c 65 74   )i.......-tablet
+|   3824: 31 5f 69 64 78 74 31 5f 69 64 78 03 43 52 45 41   1_idxt1_idx.CREA
+|   3840: 54 45 20 54 41 42 4c 45 20 27 74 31 5f 69 64 78   TE TABLE 't1_idx
+|   3856: 27 28 73 65 67 69 64 2c 20 74 65 72 6d 2c 20 70   '(segid, term, p
+|   3872: 67 6e 6f 2c 20 50 52 49 4d 41 52 59 20 4b 45 59   gno, PRIMARY KEY
+|   3888: 28 73 65 67 69 64 2c 20 74 65 72 6d 29 29 20 57   (segid, term)) W
+|   3904: 49 54 48 4f 55 54 20 52 4f 57 49 44 55 02 07 17   ITHOUT ROWIDU...
+|   3920: 1b 1b 01 81 01 74 61 62 6c 65 74 31 5f 64 61 74   .....tablet1_dat
+|   3936: 61 74 31 5f 64 61 74 61 02 43 52 45 41 54 45 20   at1_data.CREATE 
+|   3952: 54 41 42 4c 45 20 27 74 31 5f 64 61 74 61 27 28   TABLE 't1_data'(
+|   3968: 69 64 20 49 4e 54 45 47 45 52 20 50 52 49 4d 41   id INTEGER PRIMA
+|   3984: 52 59 20 4b 45 59 2c 20 62 6c 6f 63 6b 20 42 4c   RY KEY, block BL
+|   4000: 4f 42 29 5b 01 07 17 11 11 08 81 23 74 61 62 6c   OB)[.......#tabl
+|   4016: 65 74 31 74 31 43 52 45 41 54 45 20 56 49 52 54   et1t1CREATE VIRT
+|   4032: 55 41 4c 20 54 41 42 4c 45 20 74 31 20 55 53 49   UAL TABLE t1 USI
+|   4048: 4e 47 20 66 74 73 35 28 61 2c 62 20 75 6e 69 6e   NG fts5(a,b unin
+|   4064: 64 65 78 65 64 2c 63 2c 74 6f 6b 65 6e 69 7a 65   dexed,c,tokenize
+|   4080: 3d 22 70 6f 72 74 65 72 20 61 73 63 69 69 22 29   =.porter ascii.)
+| page 2 offset 4096
+|      0: 0d 0f 68 00 05 0f 13 00 0f e6 0f 13 0f a8 0f 7c   ..h............|
+|     16: 0f 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 00   .*..............
+|   3856: 00 00 00 15 0a 03 00 30 00 00 00 00 01 03 03 00   .......0........
+|   3872: 03 01 01 01 02 01 01 03 01 01 37 8c 80 80 80 80   ..........7.....
+|   3888: 01 03 00 74 00 00 00 2e 02 30 61 03 02 02 01 01   ...t.....0a.....
+|   3904: 62 03 02 03 01 01 63 03 02 04 01 01 67 03 06 01   b.....c.....g...
+|   3920: 02 02 01 01 68 03 06 01 02 03 01 01 69 03 06 01   ....h.......i...
+|   3936: 02 04 04 06 06 06 08 08 0f ef 00 14 2a 00 00 00   ............*...
+|   3952: 00 01 02 02 00 02 01 01 01 02 01 01 25 88 80 80   ............%...
+|   3968: 80 80 01 03 00 50 00 00 00 1f 02 30 67 02 08 02   .....P.....0g...
+|   3984: 01 02 02 01 01 68 02 08 03 01 02 03 01 01 69 02   .....h........i.
+|   4000: 08 04 01 02 04 04 09 09 37 84 80 80 80 80 01 03   ........7.......
+|   4016: 00 74 00 00 00 2e 02 30 61 01 02 02 01 01 62 01   .t.....0a.....b.
+|   4032: 02 03 01 01 63 01 02 04 01 01 67 01 06 01 02 20   ....c.....g.... 
+|   4048: 10 16 80 10 60 10 20 30 10 16 90 10 60 10 20 40   ....`. 0....`. @
+|   4064: 40 60 60 60 80 80 70 10 30 01 40 30 90 00 90 00   @```..p.0.@0....
+|   4080: 00 01 12 40 00 00 00 00 10 10 10 00 10 10 10 10   ...@............
+| page 3 offset 8192
+|      0: a0 00 00 00 30 fe c0 00 ff a0 ff 30 fe 00 00 00   ....0......0....
+|   4064: 00 00 00 00 00 00 00 00 00 00 00 00 06 04 01 0c   ................
+|   4080: 01 03 02 06 04 01 0c 01 02 02 05 04 09 0c 01 02   ................
+| page 4 offset 12288
+|      0: 0d 00 00 00 03 0f be 00 0f ea 0f d4 0f be 00 00   ................
+|   4016: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 14 03   ................
+|   4032: 05 00 17 17 17 61 20 62 20 63 67 20 68 20 69 67   .....a b cg h ig
+|   4048: 20 68 20 69 14 02 05 00 17 17 17 67 20 68 20 69    h i.......g h i
+|   4064: 61 20 62 20 63 67 20 68 20 69 14 01 05 00 17 17   a b cg h i......
+|   4080: 17 61 20 62 20 63 64 20 65 20 66 67 20 68 20 69   .a b cd e fg h i
+| page 5 offset 16384
+|      0: 0d 00 00 00 03 0f e8 00 0f f8 0f f0 0f e8 00 00   ................
+|   4064: 00 00 00 00 00 00 00 00 06 03 03 00 12 03 00 03   ................
+|   4080: 06 02 03 00 12 03 00 03 06 01 03 00 12 03 00 03   ................
+| page 6 offset 20480
+|      0: 0a 00 00 00 01 0f f4 00 0f f4 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 0b 03 1b 01 76 65 72 73 69 6f 6e 04   ........version.
+| page 7 offset 24576
+|      0: 0d 00 00 00 03 0f 9e 00 0f e6 0f ef 0f 9e 00 00   ................
+|   3984: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 84   ..............A.
+|   4000: 80 80 80 80 01 04 00 81 06 00 00 00 34 02 30 61   ............4.0a
+|   4016: 01 01 01 01 01 62 01 01 01 01 01 63 01 01 01 01   .....b.....c....
+|   4032: 01 64 01 01 01 65 01 01 01 66 01 01 01 01 01 68   .d...e...f.....h
+|   4048: 01 01 01 01 01 69 01 01 01 04 06 06 06 04 04 04   .....i..........
+|   4064: 06 06 07 01 03 00 14 03 09 09 09 0f 0a 03 00 24   ...............$
+|   4080: 00 00 00 00 01 01 01 00 01 01 01 01 0a 00 00 00   ................
+| page 8 offset 28672
+|      0: 01 0f fa 00 0f fa 00 00 00 00 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 00 00 00 00 00 00 05 04 09 0c 01 02   ................
+| page 9 offset 32768
+|      0: 0d 00 00 00 03 0f be 00 0f ea 0f d4 1f be 00 00   ................
+|   4016: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 14 03   ................
+|   4032: 05 00 17 17 17 61 20 62 20 63 67 20 68 20 69 67   .....a b cg h ig
+|   4048: 20 68 20 69 14 02 05 00 17 17 17 67 20 68 20 69    h i.......g h i
+|   4064: 61 20 62 20 63 67 20 68 20 69 14 01 05 00 17 17   a b cg h i......
+|   4080: 17 61 20 62 20 63 64 20 65 20 66 67 20 68 20 69   .a b cd e fg h i
+| page 10 offset 36864
+|      0: 0a 00 00 00 01 0f f4 00 0f f4 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 0b 03 1b 01 76 65 72 73 69 6f 6e 04   ........version.
+| end crash-e2d47e0624a42c.db
+}]} {}
+
+do_catchsql_test 32.1 {
+  SELECT snippet(t1, -1, '.', '..', '[', ']'), 
+         highlight(t1, 2, '[', ']') 
+  FROM t1('g + h') 
+  WHERE rank MATCH 'bm25(1.0, 1.0)' ORDER BY rank;
+} {1 {vtable constructor failed: t1}}
+
+do_catchsql_test 32.2 {
+  SELECT * FROM t3;
+} {1 {database disk image is malformed}}
+
+do_catchsql_test 32.3 {
+  SELECT * FROM t4;
+} {1 {database disk image is malformed}}
+
+do_catchsql_test 32.4 {
+  SELECT fts5_decode(id, block) FROM t1_data;
+} {1 {database disk image is malformed}}
+
+do_catchsql_test 32.5 {
+  SELECT fts5_decode(id, block) FROM t2_data;
+} {1 {database disk image is malformed}}
+
+#-------------------------------------------------------------------------
+reset_db
+do_test 33.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 28672 pagesize 4096 filename crash-fed6e90021ba5d.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 00 00 00 00 07   .....@  ........
+|     32: 00 00 00 02 00 00 00 01 00 00 00 08 00 00 00 04   ................
+|     48: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00   ................
+|     96: 00 00 00 00 0d 0f c7 00 06 0d b6 00 0f 8d 0f 36   ...............6
+|    112: 0e cb 0e 6b 0e 0e 0d b6 0d b6 00 00 00 00 00 00   ...k............
+|   3504: 00 00 00 00 00 00 56 07 06 17 1f 1f 01 7d 74 61   ......V.......ta
+|   3520: 62 6c 65 74 31 5f 63 6f 6e 66 69 67 74 31 5f 63   blet1_configt1_c
+|   3536: 6f 6e 66 69 67 07 43 52 45 41 54 45 20 54 41 42   onfig.CREATE TAB
+|   3552: 4c 45 20 27 74 31 5f 63 6f 6e 66 69 67 27 28 6b   LE 't1_config'(k
+|   3568: 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20 76 29    PRIMARY KEY, v)
+|   3584: 20 57 49 54 48 4f 55 54 20 52 4f 57 49 44 5b 06    WITHOUT ROWID[.
+|   3600: 07 17 21 21 01 81 01 74 61 62 6c 65 74 31 5f 64   ..!!...tablet1_d
+|   3616: 6f 63 73 69 8a 65 74 31 5f 64 6f 63 73 69 7a 65   ocsi.et1_docsize
+|   3632: 06 43 52 45 41 54 45 20 54 41 42 4c 45 20 27 74   .CREATE TABLE 't
+|   3648: 31 5f 64 6f 63 73 69 7a 65 27 28 69 64 20 49 4e   1_docsize'(id IN
+|   3664: 54 45 47 45 52 20 50 52 49 4d 41 52 59 20 4b 45   TEGER PRIMARY KE
+|   3680: 59 2c 20 73 7a 20 42 4c 4f 42 29 5e 05 07 17 21   Y, sz BLOB)^...!
+|   3696: 21 01 81 07 74 61 62 6c 65 74 31 5f 63 6f 6e 74   !...tablet1_cont
+|   3712: 65 6e 74 74 31 5f 63 6f 6e 74 65 6e 74 05 43 52   entt1_content.CR
+|   3728: 45 41 54 45 20 54 41 42 4c 45 20 27 74 31 5f 63   EATE TABLE 't1_c
+|   3744: 6f 6e 74 65 6e 74 27 28 69 64 20 49 4e 54 45 47   ontent'(id INTEG
+|   3760: 45 52 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20   ER PRIMARY KEY, 
+|   3776: 63 30 2c 20 63 31 2c 20 63 32 29 69 04 07 17 19   c0, c1, c2)i....
+|   3792: 19 01 81 2d 74 61 62 6c 65 74 31 5f 69 64 78 74   ...-tablet1_idxt
+|   3808: 31 5f 69 64 78 04 43 52 45 41 54 45 20 54 41 42   1_idx.CREATE TAB
+|   3824: 4c 45 20 27 74 31 5f 69 64 78 27 28 73 65 67 69   LE 't1_idx'(segi
+|   3840: 64 2c 20 74 65 72 6d 2c 20 70 67 6e 6f 2c 20 50   d, term, pgno, P
+|   3856: 52 49 4d 41 52 59 20 4b 45 59 28 73 65 67 69 64   RIMARY KEY(segid
+|   3872: 2c 20 74 65 72 6d 29 29 20 57 49 54 48 4f 55 54   , term)) WITHOUT
+|   3888: 20 52 4f 57 49 44 55 03 07 17 1b 1b 01 81 01 74    ROWIDU........t
+|   3904: 61 62 6c 65 74 31 5f 64 61 74 61 74 31 5f 64 61   ablet1_datat1_da
+|   3920: 74 61 03 43 52 45 41 54 45 20 54 41 42 4c 45 20   ta.CREATE TABLE 
+|   3936: 27 74 31 5f 64 61 74 61 27 28 69 64 20 49 4e 54   't1_data'(id INT
+|   3952: 45 47 45 52 20 50 52 49 4d 41 52 59 20 4b 45 59   EGER PRIMARY KEY
+|   3968: 2c 20 62 6c 6f 63 6b 20 42 4c 4f 42 29 38 02 06   , block BLOB)8..
+|   3984: 17 11 11 08 5f 74 61 62 6c 65 74 31 74 31 43 52   ...._tablet1t1CR
+|   4000: 45 41 54 45 20 56 49 52 54 55 41 4c 20 54 41 42   EATE VIRTUAL TAB
+|   4016: 4c 45 20 74 31 20 55 53 49 4e 47 20 66 74 73 35   LE t1 USING fts5
+|   4032: 28 61 2c 62 2c 63 29 00 00 00 39 00 00 00 00 00   (a,b,c)...9.....
+| page 3 offset 8192
+|      0: 0d 00 00 00 03 0c af 00 0f e6 0f ef 0c af 00 00   ................
+|   3232: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 86   ................
+|   3248: 2f 84 80 80 80 80 01 04 00 8c 62 00 00 03 12 02   /.........b.....
+|   3264: 30 30 01 04 05 03 01 04 05 03 01 04 05 03 1f 02   00..............
+|   3280: 03 01 02 03 01 02 03 01 08 35 30 30 30 30 30 30   .........5000000
+|   3296: 30 1c 02 04 01 0e ee ca ec ea ea ab e4 f5 ca b1   0...............
+|   3312: ac ee ec de ef 3e ee ca ee ec f2 f8 0f f0 0f e8   .....>..........
+|   3328: 0f e0 0f d8 0f d0 0f c8 0f c0 0f b8 0f b0 0f a8   ................
+|   3344: 0f a0 0f 98 0f 90 0f 88 0f 80 0f 78 0f 70 0f 68   ...........x.p.h
+|   3360: 0f 60 0f 58 0f 50 0f 48 0f 40 0f 38 0f 30 0f 28   .`.X.P.H.@.8.0.(
+|   3376: 0f 20 0f 18 0f 10 0f 08 0f 00 0e f8 0e f0 0e e8   . ..............
+|   3392: 0e e0 02 03 01 02 03 01 02 03 02 07 6f 6d 70 69   ............ompi
+|   3408: 6c 65 72 01 02 02 01 02 02 01 02 02 01 06 64 62   ler...........db
+|   3424: 73 74 61 74 07 02 03 01 02 03 01 02 03 02 04 65   stat...........e
+|   3440: 62 75 67 04 02 02 01 02 02 01 02 02 01 06 65 6e   bug...........en
+|   3456: 61 62 6c 65 07 02 02 01 02 02 01 02 02 01 02 02   able............
+|   3472: 01 02 02 01 02 02 01 02 02 01 02 02 01 02 02 01   ................
+|   3488: 02 02 01 02 02 01 02 02 01 02 02 01 02 02 01 02   ................
+|   3504: 02 01 02 02 01 02 02 01 02 02 01 02 02 01 02 02   ................
+|   3520: 01 02 02 02 08 78 74 65 6e 73 69 6f 6e 1f 02 04   .....xtension...
+|   3536: 01 02 04 01 02 04 01 04 66 74 73 34 0a 02 03 03   ........fts4....
+|   3552: 01 02 01 02 03 04 01 35 0d 02 03 01 02 03 01 02   .......5........
+|   3568: 03 01 07 67 65 6f 70 6f 6c 79 10 02 03 01 02 03   ...geopoly......
+|   3584: 01 02 03 01 05 6a 73 6f 6e 31 13 02 03 01 02 03   .....json1......
+|   3600: 01 02 03 01 04 6c 6f 61 64 1f 02 03 01 02 03 01   .....load.......
+|   3616: 02 03 01 03 6d 61 78 1c 02 02 01 02 02 01 02 02   ....max.........
+|   3632: 02 05 65 6d 6f 72 79 1c 02 03 01 02 03 01 02 03   ..emory.........
+|   3648: 04 04 73 79 73 35 16 02 03 01 02 03 01 02 03 01   ..sys5..........
+|   3664: 06 6e 6f 63 61 73 65 02 06 01 02 02 03 06 01 02   .nocase.........
+|   3680: 02 03 06 01 02 02 03 06 01 02 02 03 06 01 02 02   ................
+|   3696: 03 06 01 02 02 03 06 01 02 02 03 06 01 02 02 03   ................
+|   3712: 06 01 02 02 03 06 01 02 02 03 06 01 02 02 03 06   ................
+|   3728: 01 02 02 01 04 6f 6d 69 74 1f 02 02 01 02 02 01   .....omit.......
+|   3744: 02 02 01 05 72 74 72 65 65 19 02 03 01 02 03 01   ....rtree.......
+|   3760: 02 03 04 02 69 6d 01 06 01 02 02 03 06 01 02 02   ....im..........
+|   3776: 03 06 01 02 02 03 06 01 02 02 03 06 01 02 02 03   ................
+|   3792: 06 01 02 02 03 06 01 02 02 03 06 01 02 02 03 06   ................
+|   3808: 01 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01   ................
+|   3824: 02 02 01 0a 74 68 72 65 61 64 73 61 66 65 22 02   ....threadsafe..
+|   3840: 02 01 02 02 01 02 02 01 04 76 74 61 62 07 02 04   .........vtab...
+|   3856: 01 02 04 01 02 04 01 01 78 01 06 01 01 02 01 06   ........x.......
+|   3872: 01 01 02 01 06 01 01 02 01 06 01 01 02 01 06 01   ................
+|   3888: 01 02 01 06 01 01 02 01 06 01 01 02 01 06 01 01   ................
+|   3904: 02 01 06 01 01 02 01 06 01 01 02 01 06 01 01 02   ................
+|   3920: 01 06 01 01 02 01 06 01 01 02 01 06 01 01 02 01   ................
+|   3936: 06 01 01 02 01 06 01 01 02 01 06 01 01 02 01 06   ................
+|   3952: 01 01 02 01 06 01 01 02 01 06 01 01 02 01 06 01   ................
+|   3968: 01 02 01 06 01 01 02 01 06 01 01 02 01 06 01 01   ................
+|   3984: 02 01 06 01 01 02 01 06 01 01 02 01 06 01 01 02   ................
+|   4000: 01 06 01 01 02 01 06 01 01 02 01 06 01 01 02 01   ................
+|   4016: 06 01 01 02 01 06 01 01 02 01 06 01 01 02 01 06   ................
+|   4032: 01 01 02 01 06 01 01 02 01 06 01 01 02 04 18 13   ................
+|   4048: 0c 44 10 12 11 0f 47 13 0f 0c 12 10 0f 0e 10 0f   .D....G.........
+|   4064: 44 0f 10 40 15 0f 07 01 03 00 14 24 57 24 24 0f   D..@.......$W$$.
+|   4080: 0a 03 00 24 00 00 00 00 01 01 01 00 01 01 01 01   ...$............
+| page 4 offset 12288
+|      0: 0a 00 00 00 01 0f fa 00 0f fa 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 00 00 00 00 00 00 05 04 09 0c 01 02   ................
+| page 5 offset 16384
+|      0: 0d 00 00 00 24 0c 1f 00 0f df 0f bd 0f 9b 0f 89   ....$...........
+|     16: 0f 76 0f 63 0f 44 0f 24 0f 04 0e ec 0e d3 0e ba   .v.c.D.$........
+|     32: 0e a2 0e 89 0e 70 0e 55 0e 39 0e 1d 0e 04 0d ea   .....p.U.9......
+|     48: 0d d0 0d b5 0d 99 0d 7d 0d 64 0d 4a 0d 30 0d 10   .........d.J.0..
+|     64: 0c ef 0c ce 0c ae 54 d5 35 95 33 55 84 24 94 e4   ......T.5.3U.$..
+|     80: 15 25 91 a1 70 50 02 90 f1 94 54 e4 14 24 c4 52   .%..pP....T..$.R
+|     96: 04 d4 54 d5 35 95 33 55 84 e4 f4 34 15 34 51 91   ..T.5.3U...4.4Q.
+|    112: 60 50 02 90 f1 74 54 e4 14 24 c4 52 04 d4 54 d5   `P...tT..$.R..T.
+|    128: 35 95 33 55 85 25 45 24 94 d1 81 50 50 02 50 f1   5.3U.%E$...PP.P.
+|    144: 94 54 e4 14 24 c4 52 04 a5 34 f4 e3 15 84 24 94   .T..$.R..4....$.
+|    160: e4 15 25 91 81 40 50 02 50 f1 94 54 e4 14 24 c4   ..%..@P.P..T..$.
+|    176: 52 04 a5 34 f4 e3 15 84 e4 f4 34 15 34 51 71 30   R..4......4.4Qq0
+|    192: 50 02 50 f1 74 54 e4 14 24 c4 52 04 ae 4f 41 33   P.P.tT..$.R..OA3
+|    208: 55 85 25 45 24 94 d1 a1 20 50 02 90 f1 94 54 e4   U.%E$... P....T.
+|    224: 14 24 c4 52 04 74 54 f5 04 f4 c5 95 84 24 94 e4   .$.R.tT......$..
+|    240: 15 25 91 a1 10 50 02 90 f1 94 54 e4 14 24 c4 52   .%...P....T..$.R
+|    256: 04 74 54 f5 04 f4 c5 95 84 e4 f4 34 15 34 51 91   .tT........4.4Q.
+|    272: 00 50 02 90 f1 74 54 e4 14 24 c4 52 04 74 54 f5   .P...tT..$.R.tT.
+|    288: 04 f4 c5 95 85 25 45 24 94 d1 70 f0 50 02 30 f1   .....%E$..p.P.0.
+|    304: 94 54 e4 14 24 c4 52 04 65 45 33 55 84 24 94 e4   .T..$.R.eE3U.$..
+|    320: 15 25 91 70 e0 50 02 30 f1 94 54 e4 40 0f 38 0f   .%.p.P.0..T.@.8.
+|    336: 30 0f 28 0f 20 0f 18 0f 10 0f 08 0f 00 0e f8 0e   0.(. ...........
+|    352: f0 0e e8 0e e0 00 00 00 00 00 00 00 00 00 00 00   ................
+| page 6 offset 20480
+|   3808: 06 24 03 00 12 02 01 01 06 23 03 00 12 02 01 01   .$.......#......
+|   3824: 06 22 03 00 12 02 01 01 06 21 03 00 12 03 01 01   .........!......
+|   3840: 06 20 03 00 12 03 01 01 06 1f 03 00 12 03 01 01   . ..............
+|   3856: 06 1e 03 00 12 03 01 01 06 1d 03 00 12 03 01 01   ................
+|   3872: 06 1c 03 00 12 03 01 01 06 1b 03 00 12 02 01 01   ................
+|   3888: 06 1a 03 00 12 02 01 01 06 19 03 00 12 02 01 01   ................
+|   3904: 06 18 03 00 12 02 01 01 06 17 03 00 12 02 01 01   ................
+|   3920: 06 16 03 00 12 02 01 01 06 15 03 00 12 02 01 01   ................
+|   3936: 06 14 03 00 12 02 01 01 06 13 03 00 12 02 01 01   ................
+|   3952: 06 12 03 00 12 02 01 01 06 11 03 00 12 02 01 01   ................
+|   3968: 06 10 03 00 12 02 01 01 06 0f 03 00 12 02 01 01   ................
+|   3984: 06 0e 03 00 12 02 01 01 06 0d 03 00 12 02 01 01   ................
+|   4000: 06 0c 03 00 12 02 01 01 06 0b 03 00 12 02 01 01   ................
+|   4016: 06 0a 03 00 12 02 01 01 06 09 03 00 12 03 01 01   ................
+|   4032: 06 08 03 00 12 03 01 01 06 07 03 00 12 03 01 01   ................
+|   4048: 06 06 03 00 12 01 01 01 06 05 03 00 12 01 01 01   ................
+|   4064: 06 04 03 00 12 01 01 01 06 03 03 00 12 05 01 01   ................
+|   4080: 06 02 03 00 12 05 01 01 06 01 03 00 12 05 01 01   ................
+| page 7 offset 24576
+|      0: 0a 00 00 00 01 0f f4 00 0f f4 52 59 11 05 05 00   ..........RY....
+|     16: 17 0f 19 44 45 42 55 47 58 4e 4f 43 41 53 45 10   ...DEBUGXNOCASE.
+|     32: 04 05 00 17 0f 17 44 45 42 55 47 58 52 54 52 49   ......DEBUGXRTRI
+|     48: 4d 20 03 05 00 35 0f 19 43 4f 4d 50 49 4c 45 52   M ...5..COMPILER
+|     64: 3d 63 6c 61 6e 67 2d 36 2e 30 2e 30 58 42 49 4e   =clang-6.0.0XBIN
+|     80: 41 52 59 20 02 05 00 35 0f 19 43 4f 4d 50 49 4c   ARY ...5..COMPIL
+|     96: 45 52 3d 63 6c 61 6e 67 2d 36 2e 30 2e 30 58 4e   ER=clang-6.0.0XN
+|    112: 4f 43 41 53 45 1f 01 05 00 35 0f 17 43 4f 4d 50   OCASE....5..COMP
+|    128: 49 4c 45 52 3d 63 6c 61 6e 67 2d 36 2e 30 2e 30   ILER=clang-6.0.0
+|    144: 58 52 54 52 49 4d 0d 00 00 00 24 0e e0 00 0f 6f   XRTRIM....$....o
+|    160: 6e 74 65 6e 74 05 43 52 45 41 54 45 20 54 41 42   ntent.CREATE TAB
+|    176: 4c 45 20 27 74 31 5f 63 6f 6e 74 65 6e 74 27 28   LE 't1_content'(
+|    192: 69 64 20 49 4e 54 45 47 45 52 20 50 52 49 4d 41   id INTEGER PRIMA
+|    208: 52 59 20 4b 45 59 2c 20 63 30 2c 20 63 31 2c 20   RY KEY, c0, c1, 
+|    224: 63 32 29 69 04 07 17 19 19 01 81 2d 74 61 62 6c   c2)i.......-tabl
+|    240: 65 74 31 5f 69 64 78 74 31 5f 69 64 78 04 43 52   et1_idxt1_idx.CR
+|    256: 45 41 54 45 20 54 41 42 4c 45 20 27 74 31 5f 69   EATE TABLE 't1_i
+|    272: 64 78 27 28 73 65 67 69 64 2c 20 74 65 72 6d 2c   dx'(segid, term,
+|    288: 20 70 67 6e 6f 2c 20 50 52 49 4d 41 52 59 20 4b    pgno, PRIMARY K
+|    304: 45 59 28 73 65 67 69 64 2c 20 74 65 72 6d 29 29   EY(segid, term))
+|    320: 20 57 49 54 48 4f 55 54 20 52 4f 57 49 44 55 03    WITHOUT ROWIDU.
+|    336: 07 17 1b 1b 01 81 01 74 61 62 6c 65 74 31 5f 64   .......tablet1_d
+|    352: 61 74 61 74 31 5f 64 61 74 61 03 43 52 45 41 54   atat1_data.CREAT
+|    368: 45 20 54 41 42 4c 45 20 27 74 31 5f 64 61 74 61   E TABLE 't1_data
+|    384: 27 28 69 64 20 49 4e 54 45 47 45 52 20 50 52 49   '(id INTEGER PRI
+|    400: 4d 41 52 59 20 4b 45 59 2c 20 62 6c 6f 63 6b 20   MARY KEY, block 
+|    416: 42 4c 4f 42 29 38 02 06 17 11 11 08 5f 74 61 62   BLOB)8......_tab
+|    432: 6c 65 74 31 74 31 43 52 45 41 54 45 20 56 49 52   let1t1CREATE VIR
+|    448: 54 55 41 4c 20 54 41 42 4c 45 20 74 31 20 55 53   TUAL TABLE t1 US
+|    464: 49 4e 47 20 66 74 73 35 28 61 2c 62 2c 63 29 00   ING fts5(a,b,c).
+|    480: 00 00 39 00 00 00 00 00 00 00 00 00 00 00 00 00   ..9.............
+|   4080: 00 00 00 00 0b 03 1b 01 76 65 72 73 69 6f 6e 04   ........version.
+| end crash-fed6e90021ba5d.db
+}]} {}
+
+do_execsql_test 33.1 {
+  CREATE VIRTUAL TABLE t2 USING fts5vocab('t1','row');
+  CREATE VIRTUAL TABLE t3 USING fts5vocab('t1','col');
+  CREATE VIRTUAL TABLE t4 USING fts5vocab('t1','instance');
+}
+
+do_catchsql_test 33.2 {
+  SELECT * FROM t2;
+} {1 {database disk image is malformed}}
+
+do_catchsql_test 33.3 {
+  SELECT * FROM t2, t3, t4 WHERE t2.term=t3.term AND t3.term=t4.term;
+} {1 {database disk image is malformed}}
+
+#-------------------------------------------------------------------------
+reset_db
+do_test 34.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 40960 pagesize 4096 filename crash-a60a9da4c8932f.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 00 00 00 00 0a   .....@  ........
+|     32: 00 00 00 00 00 00 00 00 00 00 00 0d 00 00 00 04   ................
+|     48: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00   ................
+|     96: 00 00 00 00 0d 00 00 00 0d 0b 6e 00 0f a3 0f 4c   ..........n....L
+|    112: 0e e1 0e 81 0e 24 0d cc 0d 72 0d 1b 0c b0 0c 50   .....$...r.....P
+|    128: 0b f8 0b b3 0b 6e 00 00 00 00 00 00 00 00 00 00   .....n..........
+|   2912: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 43 0d   ..............C.
+|   2928: 06 17 11 11 08 75 74 61 62 6c 65 74 34 74 34 43   .....utablet4t4C
+|   2944: 52 45 41 54 45 20 56 49 52 54 55 41 4c 20 54 41   REATE VIRTUAL TA
+|   2960: 42 4c 45 20 74 34 20 55 53 49 4e 47 20 66 74 73   BLE t4 USING fts
+|   2976: 35 76 6f 63 61 62 28 27 74 32 27 2c 20 27 72 6f   5vocab('t2', 'ro
+|   2992: 77 27 29 43 0c 06 17 11 11 08 75 74 61 62 6c 65   w')C......utable
+|   3008: 74 33 74 33 43 52 45 41 54 45 20 56 49 52 54 55   t3t3CREATE VIRTU
+|   3024: 41 4c 20 54 41 42 4c 45 20 74 33 20 55 53 49 4e   AL TABLE t3 USIN
+|   3040: 47 20 66 74 73 35 76 6f 63 61 62 28 27 74 31 27   G fts5vocab('t1'
+|   3056: 2c 20 27 72 6f 77 27 29 56 0b 06 17 1f 1f 01 7d   , 'row')V.......
+|   3072: 74 61 62 6c 65 74 32 5f 63 6f 6e 66 69 67 74 32   tablet2_configt2
+|   3088: 5f 63 6f 6e 66 69 67 0a 43 52 45 41 54 45 20 54   _config.CREATE T
+|   3104: 41 42 4c 45 20 27 74 32 5f 63 6f 6e 66 69 67 27   ABLE 't2_config'
+|   3120: 28 6b 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20   (k PRIMARY KEY, 
+|   3136: 76 29 20 57 49 54 48 4f 55 54 20 52 4f 57 49 44   v) WITHOUT ROWID
+|   3152: 5e 0a 07 17 21 21 01 81 07 74 61 62 6c 65 74 32   ^...!!...tablet2
+|   3168: 5f 63 6f 6e 74 65 6e 74 74 32 5f 63 6f 6e 74 65   _contentt2_conte
+|   3184: 6e 74 09 43 52 45 41 54 45 20 54 41 42 4c 45 20   nt.CREATE TABLE 
+|   3200: 27 74 32 5f 63 6f 6e 74 65 6e 74 27 28 69 64 20   't2_content'(id 
+|   3216: 49 4e 54 45 47 45 52 20 50 52 49 4d 41 52 59 20   INTEGER PRIMARY 
+|   3232: 4b 45 59 2c 20 63 30 2c 20 63 31 2c 20 63 32 29   KEY, c0, c1, c2)
+|   3248: 69 09 07 17 19 19 01 81 2d 74 61 62 6c 65 74 32   i.......-tablet2
+|   3264: 5f 69 64 78 74 32 5f 69 64 78 08 43 52 45 41 54   _idxt2_idx.CREAT
+|   3280: 45 20 54 41 42 4c 45 20 27 74 32 5f 69 64 78 27   E TABLE 't2_idx'
+|   3296: 28 73 65 67 69 64 2c 20 74 65 72 6d 2c 20 70 67   (segid, term, pg
+|   3312: 6e 6f 2c 20 50 52 49 4d 41 52 59 20 4b 45 59 28   no, PRIMARY KEY(
+|   3328: 73 65 67 69 64 2c 20 74 65 72 6d 29 29 20 57 49   segid, term)) WI
+|   3344: 54 48 4f 55 54 20 52 4f 57 49 44 55 08 07 17 1b   THOUT ROWIDU....
+|   3360: 1b 01 81 01 74 61 62 6c 65 74 32 5f 64 61 74 61   ....tablet2_data
+|   3376: 74 32 5f 64 61 74 61 07 43 52 45 41 54 45 20 54   t2_data.CREATE T
+|   3392: 41 42 4c 45 20 27 74 32 5f 64 61 74 61 27 28 69   ABLE 't2_data'(i
+|   3408: 64 20 49 4e 54 45 47 45 52 20 50 52 49 4d 41 52   d INTEGER PRIMAR
+|   3424: 59 20 4b 45 59 2c 20 62 6c 6f 63 6b 20 42 4c 4f   Y KEY, block BLO
+|   3440: 42 29 58 07 07 17 11 11 08 81 1d 74 61 62 6c 65   B)X........table
+|   3456: 74 32 74 32 43 52 45 41 54 45 20 56 49 52 54 55   t2t2CREATE VIRTU
+|   3472: 41 4c 20 54 41 42 4c 45 20 74 32 20 55 53 49 4e   AL TABLE t2 USIN
+|   3488: 47 20 66 74 73 35 28 27 61 27 2c 5b 62 5d 2c 22   G fts5('a',[b],.
+|   3504: 63 22 2c 64 65 74 61 69 6c 3d 6e 6f 6e 65 2c 63   c.,detail=none,c
+|   3520: 6f 6c 75 6d 6e 73 69 7a 65 3d 30 29 56 06 06 17   olumnsize=0)V...
+|   3536: 1f 1f 01 7d 74 61 62 6c 65 74 31 5f 63 6f 6e 66   ....tablet1_conf
+|   3552: 69 67 74 31 5f 63 6f 6e 66 69 67 06 43 52 45 41   igt1_config.CREA
+|   3568: 54 45 20 54 41 42 4c 45 20 27 74 31 5f 63 6f 6e   TE TABLE 't1_con
+|   3584: 66 69 67 27 28 6b 20 50 52 49 4d 41 52 59 20 4b   fig'(k PRIMARY K
+|   3600: 45 59 2c 20 76 29 20 57 49 54 48 4f 55 54 20 52   EY, v) WITHOUT R
+|   3616: 4f 57 49 44 5b 05 07 17 21 21 01 81 01 74 61 62   OWID[...!!...tab
+|   3632: 6c 65 74 31 5f 64 6f 63 73 69 7a 65 74 31 5f 64   let1_docsizet1_d
+|   3648: 6f 63 73 69 7a 65 05 43 52 45 41 54 45 20 54 41   ocsize.CREATE TA
+|   3664: 42 4c 45 20 27 74 31 5f 64 6f 63 73 69 7a 65 27   BLE 't1_docsize'
+|   3680: 28 69 64 20 49 4e 54 45 47 45 52 20 50 52 49 4d   (id INTEGER PRIM
+|   3696: 41 52 59 20 4b 45 59 2c 20 73 7a 20 42 4c 4f 42   ARY KEY, sz BLOB
+|   3712: 29 5e 04 07 17 21 21 01 81 07 74 61 62 6c 65 74   )^...!!...tablet
+|   3728: 31 5f 63 6f 6e 74 65 6e 74 74 31 5f 63 6f 6e 74   1_contentt1_cont
+|   3744: 65 6e 74 04 43 52 45 41 54 45 20 54 41 42 4c 45   ent.CREATE TABLE
+|   3760: 20 27 74 31 5f 63 6f 6e 74 65 6e 74 27 28 69 64    't1_content'(id
+|   3776: 20 49 4e 54 45 47 45 52 20 50 52 49 4d 41 52 59    INTEGER PRIMARY
+|   3792: 20 4b 45 59 2c 20 63 30 2c 20 63 31 2c 20 63 32    KEY, c0, c1, c2
+|   3808: 29 69 03 07 17 19 19 01 81 2d 74 61 62 6c 65 74   )i.......-tablet
+|   3824: 31 5f 69 64 78 74 31 5f 69 64 78 03 43 52 45 41   1_idxt1_idx.CREA
+|   3840: 54 45 20 54 41 42 4c 45 20 27 74 31 5f 69 64 78   TE TABLE 't1_idx
+|   3856: 27 28 73 65 67 69 64 2c 20 74 65 72 6d 2c 20 70   '(segid, term, p
+|   3872: 67 6e 6f 2c 20 50 52 49 4d 41 52 59 20 4b 45 59   gno, PRIMARY KEY
+|   3888: 28 73 65 67 69 64 2c 20 74 65 72 6d 29 29 20 57   (segid, term)) W
+|   3904: 49 54 48 4f 55 54 20 52 4f 57 49 44 55 02 07 17   ITHOUT ROWIDU...
+|   3920: 1b 1b 01 81 01 74 61 62 6c 65 74 31 5f 64 61 74   .....tablet1_dat
+|   3936: 61 74 31 5f 64 61 74 61 02 43 52 45 41 54 45 20   at1_data.CREATE 
+|   3952: 54 41 42 4c 45 20 27 74 31 5f 64 61 74 61 27 28   TABLE 't1_data'(
+|   3968: 69 64 20 49 4e 54 45 47 45 52 20 50 52 49 4d 41   id INTEGER PRIMA
+|   3984: 52 59 20 4b 45 59 2c 20 62 6c 6f 63 6b 20 42 4c   RY KEY, block BL
+|   4000: 4f 42 29 5b 01 07 17 11 11 08 81 23 74 61 62 6c   OB)[.......#tabl
+|   4016: 65 74 31 74 31 43 52 45 41 54 45 20 56 49 52 54   et1t1CREATE VIRT
+|   4032: 55 41 4c 20 54 41 42 4c 45 20 74 31 20 55 53 49   UAL TABLE t1 USI
+|   4048: 4e 47 20 66 74 73 35 28 61 2c 62 20 75 6e 69 6e   NG fts5(a,b unin
+|   4064: 64 65 78 65 64 2c 63 2c 74 6f 6b 65 6e 69 7a 65   dexed,c,tokenize
+|   4080: 3d 22 70 6f 72 74 65 72 20 61 73 63 69 69 22 29   =.porter ascii.)
+| page 2 offset 4096
+|      0: 0d 0f 68 00 05 0f 13 00 0f e6 0f 13 0f a8 0f 7c   ..h............|
+|     16: 0f 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 00   .*..............
+|   3856: 00 00 00 15 0a 03 00 30 00 00 00 00 01 03 03 00   .......0........
+|   3872: 03 01 01 01 02 01 01 03 01 01 37 8c 80 80 80 80   ..........7.....
+|   3888: 01 03 00 74 00 20 68 20 69 0d 00 00 00 03 0f e8   ...t. h i.......
+|   3904: 00 0f f8 0f f0 0f e8 00 00 00 00 00 00 00 00 00   ................
+| page 5 offset 16384
+|   4064: 00 00 00 00 00 00 00 00 06 03 03 00 12 03 00 00   ................
+|   4080: 60 20 30 01 20 30 00 30 60 10 30 01 20 30 00 30   ` 0. 0.0`.0. 0.0
+| page 6 offset 20480
+|      0: a0 00 00 00 10 ff 40 00 ff 00 00 00 00 00 00 00   ......@.........
+|   4080: 00 00 00 00 0b 03 1b 01 76 65 72 73 69 6f 6e 04   ........version.
+| page 7 offset 24576
+|      0: 0d 00 00 00 03 0f 9e 00 0f e6 0f ef 0f 9e 00 00   ................
+|   3984: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 84   ..............A.
+|   4000: 80 80 80 80 01 04 00 81 06 00 00 00 34 02 30 61   ............4.0a
+|   4016: 01 01 00 00 00 00 00 00 00 00 00 11 87 89 06 26   ...............&
+|   4032: 01 64 01 01 01 65 01 01 01 66 01 01 01 67 01 01   .d...e...f...g..
+|   4048: 01 01 01 68 01 01 01 01 01 69 01 01 01 04 06 06   ...h.....i......
+|   4064: 06 04 44 00 06 06 07 01 03 00 14 03 09 09 09 0f   ..D.............
+|   4080: 0a 03 00 24 00 00 00 00 01 01 01 00 01 01 01 01   ...$............
+| page 8 offset 28672
+|      0: 0a 00 00 00 01 0f fa 00 0f fa 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 00 00 00 00 00 00 05 04 09 0c 01 02   ................
+| page 9 offset 32768
+|      0: 0d 00 00 00 03 0f be 00 0f ea 0f d4 0f be 00 00   ................
+|   4016: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 14 03   ................
+|   4032: 05 00 17 17 17 61 20 62 20 63 67 20 68 20 69 67   .....a b cg h ig
+|   4048: 20 68 20 69 14 02 05 00 17 17 17 67 20 68 20 69    h i.......g h i
+|   4064: 61 20 62 20 63 67 20 68 20 69 14 01 05 00 17 17   a b cg h i......
+|   4080: 17 61 20 62 20 63 64 20 65 20 66 67 20 68 20 69   .a b cd e fg h i
+| page 10 offset 36864
+|      0: 0a 00 00 00 01 0f f4 00 0f f4 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 0b 03 1b 01 76 65 72 73 69 6f 6e 04   ........version.
+| end crash-a60a9da4c8932f.db
+}]} {}
+
+do_catchsql_test 34.1 {
+  SELECT fts5_decode(id, block) FROM t1_data;
+} {1 {database disk image is malformed}}
+
+do_catchsql_test 34.2 {
+  SELECT fts5_decode(id, block) FROM t2_data;
+} {1 {database disk image is malformed}}
+
+#-------------------------------------------------------------------------
+reset_db
+do_test 35.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 32768 pagesize 4096 filename crash-ae135cb10977c7.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 00 00 00 00 08   .....@  ........
+|     32: 00 00 00 02 00 00 00 01 00 00 00 09 00 00 00 04   ................
+|     48: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00   ................
+|     96: 00 00 00 00 0d 0f c7 00 07 0d 92 00 0f 8d 0f 36   ...............6
+|    112: 0e cb 0e 6b 0e 0e 0d b6 0d 92 0d 92 00 00 00 00   ...k............
+|   3472: 00 00 22 08 06 17 11 11 01 31 74 61 62 6c 65 74   .........1tablet
+|   3488: 32 74 32 08 43 52 45 41 54 45 20 54 41 42 4c 45   2t2.CREATE TABLE
+|   3504: 20 74 32 28 78 29 56 07 06 17 1f 1f 01 7d 74 61    t2(x)V.......ta
+|   3520: 62 6c 65 74 31 5f 63 6f 6e 66 69 67 74 31 5f 63   blet1_configt1_c
+|   3536: 6f 6e 66 69 67 07 43 52 45 41 54 45 20 54 41 42   onfig.CREATE TAB
+|   3552: 4c 45 20 27 74 31 5f 63 6f 6e 66 69 67 27 28 6b   LE 't1_config'(k
+|   3568: 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20 76 29    PRIMARY KEY, v)
+|   3584: 20 57 49 54 48 4f 55 54 20 52 4f 57 49 44 5b 06    WITHOUT ROWID[.
+|   3600: 07 17 21 21 01 81 01 74 61 62 6c 65 74 31 5f 64   ..!!...tablet1_d
+|   3616: 6f 63 73 69 7a 65 74 31 5f 64 6f 63 73 69 7a 65   ocsizet1_docsize
+|   3632: 06 43 52 45 41 54 45 20 54 41 42 4c 45 20 27 74   .CREATE TABLE 't
+|   3648: 31 5f 64 6f 63 73 69 7a 65 27 28 69 64 20 49 4e   1_docsize'(id IN
+|   3664: 54 45 47 45 52 20 50 52 49 4d 41 52 59 20 4b 45   TEGER PRIMARY KE
+|   3680: 59 2c 20 73 7a 20 42 4c 4f 42 29 5e 05 07 17 21   Y, sz BLOB)^...!
+|   3696: 21 01 81 07 74 61 62 6c 65 74 31 5f 63 6f 6e 74   !...tablet1_cont
+|   3712: 65 6e 74 74 31 5f 63 6f 6e 74 65 6e 74 05 43 52   entt1_content.CR
+|   3728: 45 41 54 45 20 54 41 42 4c 45 20 27 74 31 5f 63   EATE TABLE 't1_c
+|   3744: 6f 6e 74 65 6e 74 27 28 69 64 20 49 4e 54 45 47   ontent'(id INTEG
+|   3760: 45 52 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20   ER PRIMARY KEY, 
+|   3776: 63 30 2c 20 63 31 2c 20 63 32 29 69 04 07 17 19   c0, c1, c2)i....
+|   3792: 19 01 81 2d 74 61 62 6c 65 74 31 5f 69 64 78 74   ...-tablet1_idxt
+|   3808: 31 5f 69 64 78 04 43 52 45 41 54 45 20 54 41 42   1_idx.CREATE TAB
+|   3824: 4c 45 20 27 74 31 5f 69 64 78 27 28 73 65 67 69   LE 't1_idx'(segi
+|   3840: 64 2c 20 74 65 72 6d 2c 20 70 67 6e 6f 2c 20 50   d, term, pgno, P
+|   3856: 52 49 4d 41 52 59 20 4b 45 59 28 73 65 67 69 64   RIMARY KEY(segid
+|   3872: 2c 20 74 65 72 6d 29 29 20 57 49 54 48 4f 55 54   , term)) WITHOUT
+|   3888: 20 52 4f 57 49 44 55 03 07 17 1b 1b 01 81 01 74    ROWIDU........t
+|   3904: 61 62 6c 65 74 31 5f 64 61 74 61 74 31 5f 64 61   ablet1_datat1_da
+|   3920: 74 61 03 43 52 45 41 54 45 20 54 41 42 4c 45 20   ta.CREATE TABLE 
+|   3936: 27 74 31 5f 64 61 74 61 27 28 69 64 20 49 4e 54   't1_data'(id INT
+|   3952: 45 47 45 52 20 50 52 49 4d 41 52 59 20 4b 45 59   EGER PRIMARY KEY
+|   3968: 2c 20 62 6c 6f 63 6b 20 42 4c 4f 42 29 38 02 06   , block BLOB)8..
+|   3984: 17 11 11 08 5f 74 61 62 6c 65 74 31 74 31 43 52   ...._tablet1t1CR
+|   4000: 45 41 54 45 20 56 49 52 54 55 41 4c 20 54 41 42   EATE VIRTUAL TAB
+|   4016: 4c 45 20 74 31 20 55 53 49 4e 47 20 66 74 73 35   LE t1 USING fts5
+|   4032: 28 61 2c 62 2c 63 29 00 00 00 39 00 00 00 00 00   (a,b,c)...9.....
+| page 3 offset 8192
+|      0: 0d 00 00 00 03 0c 94 00 0f e6 0f ef 0c 94 00 00   ................
+|   3216: 00 00 00 00 86 4a 84 80 80 80 80 01 04 00 8d 18   .....J..........
+|   3232: 00 00 03 2b 02 30 30 01 02 06 01 02 06 01 02 06   ...+.00.........
+|   3248: 1f 02 03 01 02 03 01 02 03 01 08 32 30 31 36 30   ...........20160
+|   3264: 36 30 39 01 02 07 01 02 07 01 02 07 01 01 34 01   609...........4.
+|   3280: 02 05 01 02 05 01 02 05 01 01 35 01 02 04 01 02   ..........5.....
+|   3296: 04 01 02 04 02 07 30 30 30 30 30 30 30 1c 02 3d   ......0000000..=
+|   3312: 01 02 04 01 02 04 01 06 62 69 6e 61 72 79 03 06   ........binary..
+|   3328: 01 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01   ................
+|   3344: 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01 02   ................
+|   3360: 02 03 06 01 02 02 03 06 01 02 02 03 06 01 02 02   ................
+|   3376: 03 06 01 02 02 03 06 01 02 02 01 08 63 6f 6d 70   ............comp
+|   3392: 69 6c 65 72 01 02 02 01 02 02 01 02 02 01 06 64   iler...........d
+|   3408: 62 73 74 61 74 07 02 03 01 02 03 01 02 03 02 04   bstat...........
+|   3424: 65 62 75 67 04 02 02 01 02 02 01 02 02 01 07 65   ebug...........e
+|   3440: 6e 61 62 6c 65 07 02 02 01 02 02 01 02 02 01 02   nable...........
+|   3456: 02 01 02 02 01 02 02 01 02 02 01 02 02 01 02 02   ................
+|   3472: 01 02 02 01 02 02 01 02 02 01 02 02 01 02 02 01   ................
+|   3488: 02 02 01 02 02 01 02 02 01 02 02 01 02 02 01 02   ................
+|   3504: 02 01 02 02 02 08 78 74 65 6e 73 69 6f 6e 1f 02   ......xtension..
+|   3520: 04 01 02 04 01 02 04 01 04 66 74 73 34 0a 02 03   .........fts4...
+|   3536: 01 02 03 01 02 03 04 01 35 0d 02 03 01 02 03 01   ........5.......
+|   3552: 02 03 01 03 67 63 63 01 02 03 01 02 03 01 02 03   ....gcc.........
+|   3568: 02 06 65 6f 70 6f 6c 79 10 02 03 01 02 03 01 02   ..eopoly........
+|   3584: 03 01 05 6a 73 6f 6e 31 13 02 03 01 02 03 01 02   ...json1........
+|   3600: 03 01 04 6c 6f 61 64 1f 02 03 01 02 03 01 02 03   ...load.........
+|   3616: 01 03 6d 61 78 1c 02 02 01 02 02 01 02 02 02 05   ..max...........
+|   3632: 65 6d 6f 72 79 1c 02 03 01 02 03 01 02 03 04 04   emory...........
+|   3648: 73 79 73 35 16 02 03 01 02 03 01 02 03 01 06 6e   sys5...........n
+|   3664: 6f 63 61 73 65 02 06 01 02 02 03 06 01 02 02 03   ocase...........
+|   3680: 06 01 02 02 03 06 01 02 02 03 06 01 02 02 03 06   ................
+|   3696: 01 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01   ................
+|   3712: 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01 02   ................
+|   3728: 02 01 04 6f 6d 69 74 1f 02 02 01 02 02 01 02 02   ...omit.........
+|   3744: 01 05 72 74 72 65 65 19 02 03 01 02 03 01 02 03   ..rtree.........
+|   3760: 04 02 69 6d 01 06 01 02 02 03 06 01 02 02 03 06   ..im............
+|   3776: 01 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01   ................
+|   3792: 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01 02   ................
+|   3808: 02 03 06 01 02 02 03 06 01 02 02 03 06 01 02 02   ................
+|   3824: 01 0a 74 68 72 65 61 64 73 61 66 65 22 02 02 01   ..threadsafe....
+|   3840: 02 02 01 02 02 01 04 76 74 61 62 07 02 04 01 02   .......vtab.....
+|   3856: 04 01 02 04 01 01 78 01 06 01 01 02 01 06 01 01   ......x.........
+|   3872: 02 01 06 01 01 02 01 06 01 01 02 01 06 01 01 02   ................
+|   3888: 01 06 01 01 02 01 06 01 01 02 01 06 01 01 02 01   ................
+|   3904: 06 01 01 02 01 06 01 01 02 01 06 01 01 02 01 06   ................
+|   3920: 01 01 02 01 06 01 01 02 01 06 01 01 02 01 06 01   ................
+|   3936: 01 02 01 06 01 01 02 01 06 01 01 02 01 06 01 01   ................
+|   3952: 02 01 06 01 01 02 01 06 01 01 02 01 06 01 01 02   ................
+|   3968: 01 06 01 01 02 01 06 01 01 02 01 06 01 01 02 01   ................
+|   3984: 06 01 01 02 01 06 01 01 02 01 06 01 01 02 01 06   ................
+|   4000: 01 01 02 01 06 01 01 02 01 06 01 01 02 01 06 01   ................
+|   4016: 01 02 01 06 01 01 02 01 06 01 01 02 01 06 01 01   ................
+|   4032: 02 01 06 01 01 02 01 06 01 01 02 04 15 13 0c 0c   ................
+|   4048: 12 44 13 11 0f 47 13 0e fc 0e 11 10 0f 0e 10 0f   .D...G..........
+|   4064: 44 0f 10 40 15 0f 07 01 03 00 14 24 5a 24 24 0f   D..@.......$Z$$.
+|   4080: 0a 03 00 24 00 00 00 00 01 01 01 00 01 01 01 01   ...$............
+| page 4 offset 12288
+|      0: 0a 00 00 00 01 0f fa 00 0f fa 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 00 00 00 00 00 00 05 04 09 0c 01 02   ................
+| page 5 offset 16384
+|      0: 0d 00 00 00 24 0c 0a 00 0f d8 0f af 0f 86 0f 74   ....$..........t
+|     16: 0f 61 0f 4e 0f 2f 0f 0f 0e ef 0e d7 0e be 0e a5   .a.N./..........
+|     32: 0e 8d 0e 74 0e 5b 0e 40 0e 24 0e 08 01 2f 0d d5   ...t.[.@.$.../..
+|     48: 0d bb 0d a0 0d 84 0d 68 0d 4f 0d 35 0d 1b 0c fb   .......h.O.5....
+|     64: 0c da 0c b9 0c 99 0c 78 0c 57 0c 3e 0c 24 0c 0a   .......x.W.>.$..
+|   3072: 00 00 00 00 00 00 00 00 00 00 18 24 05 00 25 0f   ...........$..%.
+|   3088: 19 54 48 52 45 41 44 53 41 46 45 3d 30 58 42 49   .THREADSAFE=0XBI
+|   3104: 4e 41 52 59 18 23 05 00 25 0f 19 54 48 52 45 41   NARY.#..%..THREA
+|   3120: 44 53 41 46 45 3d 30 58 4e 4f 43 41 53 45 17 8f   DSAFE=0XNOCASE..
+|   3136: 05 00 25 0f 17 54 48 52 45 41 44 53 41 46 45 3d   ..%..THREADSAFE=
+|   3152: 30 58 52 54 52 49 4d 1f 21 05 00 33 0f 19 4f 4d   0XRTRIM.!..3..OM
+|   3168: 49 54 20 4c 4f 41 44 20 45 58 54 45 4e 53 49 4f   IT LOAD EXTENSIO
+|   3184: 4e 58 42 49 4e 41 52 59 1f 20 05 00 33 0f 19 4f   NXBINARY. ..3..O
+|   3200: 4d 49 54 20 4c 4f 41 44 20 45 58 54 45 4e 53 49   MIT LOAD EXTENSI
+|   3216: 4f 4e 58 4e 4f 43 41 53 45 1e 1f 05 00 33 0f 17   ONXNOCASE....3..
+|   3232: 4f 4d 49 54 20 4c 4f 41 44 20 45 58 54 45 4e 53   OMIT LOAD EXTENS
+|   3248: 49 4f 4e 58 52 54 52 49 4d 1f 1e 05 00 33 0f 19   IONXRTRIM....3..
+|   3264: 4d 41 58 20 4d 45 4d 4f 52 59 3d 35 30 30 30 30   MAX MEMORY=50000
+|   3280: 30 30 30 57 42 49 4e 41 52 59 1f 1d 05 00 33 0f   000WBINARY....3.
+|   3296: 19 4d 41 58 20 4d 45 4d 4f 52 59 3d 35 30 30 30   .MAX MEMORY=5000
+|   3312: 30 30 30 30 58 4e 4f 43 41 53 45 1e 1c 05 00 33   0000XNOCASE....3
+|   3328: 0f 17 4d 41 58 20 4d 45 4d 4f 52 59 3d 35 30 30   ..MAX MEMORY=500
+|   3344: 30 30 30 30 30 58 52 54 52 49 4d 18 1b 05 00 25   00000XRTRIM....%
+|   3360: 0f 19 45 4e 41 42 4c 45 20 52 54 52 45 45 58 42   ..ENABLE RTREEXB
+|   3376: 49 4e 41 52 59 18 1a 05 00 25 0f 19 45 4e 41 42   INARY....%..ENAB
+|   3392: 4c 45 20 52 54 52 45 45 59 4e 4f 43 41 53 45 17   LE RTREEYNOCASE.
+|   3408: 19 05 00 25 0f 17 45 4e 41 42 4c 45 20 52 54 52   ...%..ENABLE RTR
+|   3424: 45 45 58 52 54 52 49 4d 1a 18 05 00 29 0f 19 45   EEXRTRIM....)..E
+|   3440: 4e 41 42 4c 45 20 4d 45 4d 53 59 53 35 58 42 49   NABLE MEMSYS5XBI
+|   3456: 4e 41 52 59 1a 17 05 00 29 0f 19 45 4e 41 42 4c   NARY....)..ENABL
+|   3472: 45 20 4d 45 4d 53 59 53 35 58 4e 4f 43 41 53 45   E MEMSYS5XNOCASE
+|   3488: 19 16 05 00 29 0f 17 45 4e 41 42 4c 45 20 4d 45   ....)..ENABLE ME
+|   3504: 4d 53 59 53 35 58 52 54 52 49 4d 18 15 05 00 25   MSYS5XRTRIM....%
+|   3520: 0f 19 45 4e 41 42 4c 45 20 4a 53 4f 4e 31 58 42   ..ENABLE JSON1XB
+|   3536: 49 4e 41 52 59 18 14 05 00 25 0f 19 45 4e 41 42   INARY....%..ENAB
+|   3552: 4c 45 20 4a 53 4f 4e 31 58 4e 4f 43 41 53 45 17   LE JSON1XNOCASE.
+|   3568: 13 05 00 25 0f 17 45 4e 41 42 4c 45 20 4a 53 4f   ...%..ENABLE JSO
+|   3584: 4e 31 58 52 54 52 49 4d 1a 12 05 00 29 0f 19 45   N1XRTRIM....)..E
+|   3600: 4e 41 42 4c 45 20 47 45 4f 50 4f 4c 59 58 42 49   NABLE GEOPOLYXBI
+|   3616: 4e 41 52 59 1a 11 05 00 29 0f 19 45 4f 41 42 4c   NARY....)..EOABL
+|   3632: 45 20 47 45 4f 50 4f 4c 59 58 4e 4f 43 51 53 45   E GEOPOLYXNOCQSE
+|   3648: 19 10 05 00 29 0f 17 45 4e 41 42 4c 45 20 47 45   ....)..ENABLE GE
+|   3664: 4f 50 4f 4c 59 58 52 54 52 49 4d 17 0f 05 00 23   OPOLYXRTRIM....#
+|   3680: 0f 19 45 4e 41 42 4c 45 20 46 54 53 35 58 42 49   ..ENABLE FTS5XBI
+|   3696: 4e 41 52 59 17 0e 05 00 23 0f 19 45 4e 41 42 4c   NARY....#..ENABL
+|   3712: 45 20 46 54 53 35 58 4e 4f 43 41 53 45 16 1d 05   E FTS5XNOCASE...
+|   3728: 00 23 0f a4 45 4e 41 42 4c 45 20 46 54 53 35 58   .#..ENABLE FTS5X
+|   3744: 52 54 52 49 4d 17 0c 05 00 23 0f 19 45 4e 41 42   RTRIM....#..ENAB
+|   3760: 4c 45 20 46 55 53 34 58 42 49 4e 41 52 59 17 0b   LE FUS4XBINARY..
+|   3776: 05 00 23 0f 19 45 4e 41 42 4c 45 20 46 54 53 34   ..#..ENABLE FTS4
+|   3792: 58 4e 4f 43 41 53 45 16 0a 05 00 23 0f 17 45 4e   XNOCASE....#..EN
+|   3808: 41 42 4c 45 20 46 54 53 34 58 52 54 52 49 4d 1e   ABLE FTS4XRTRIM.
+|   3824: 09 05 00 31 0f 19 45 4e 41 42 4c 45 20 44 42 53   ...1..ENABLE DBS
+|   3840: 54 41 54 20 56 54 41 42 58 42 49 4e 41 52 59 1e   TAT VTABXBINARY.
+|   3856: 08 05 00 31 0f 19 45 4e 41 42 4c 45 20 44 42 53   ...1..ENABLE DBS
+|   3872: 54 41 54 20 56 54 41 42 58 4e 4f 43 41 53 45 1d   TAT VTABXNOCASE.
+|   3888: 07 05 00 31 0f 17 45 4e 41 42 4c 45 20 44 42 53   ...1..ENABLE DBS
+|   3904: 54 41 54 20 56 54 41 42 58 52 54 52 49 4d 11 06   TAT VTABXRTRIM..
+|   3920: 05 00 17 0f 19 44 45 42 55 47 58 42 49 4e 41 52   .....DEBUGXBINAR
+|   3936: 59 11 05 05 00 17 0f 19 44 45 42 55 47 58 4e 4f   Y.......DEBUGXNO
+|   3952: 43 41 53 45 10 04 05 00 17 0f 17 44 45 42 55 47   CASE.......DEBUG
+|   3968: 58 52 54 52 49 4d 27 03 05 00 43 0f 19 43 4f 4d   XRTRIM'...C..COM
+|   3984: 50 49 4c 45 52 3d 67 63 63 2d 35 2e 34 2e 30 20   PILER=gcc-5.4.0 
+|   4000: 32 30 31 36 30 36 30 39 58 42 49 4e 41 52 59 27   20160609XBINARY'
+|   4016: 02 05 00 43 0f 19 43 4f 4d 50 49 4c 45 52 3d 67   ...C..COMPILER=g
+|   4032: 63 63 2d 35 2e 34 2e 30 20 32 30 31 36 30 36 30   cc-5.4.0 2016060
+|   4048: 39 58 4e 4f 43 41 53 45 26 01 05 00 43 0f 17 43   9XNOCASE&...C..C
+|   4064: 4f 4d 50 49 4c 45 52 3d 67 63 63 2d 35 2e 34 2e   OMPILER=gcc-5.4.
+|   4080: 30 20 32 30 31 36 30 36 30 39 58 52 54 52 49 4d   0 20160609XRTRIM
+| page 6 offset 20480
+|      0: 0d 00 00 00 24 0e e0 00 0f f8 0f f0 0f e8 0f e0   ....$...........
+|     16: 0f d8 0f d0 0f c8 0f c0 0f b8 0f b0 0f a8 0f a0   ................
+|     32: 0f 98 0f 90 0f 88 0f 80 0f 78 0f 70 0f 68 0f 60   .........x.p.h.`
+|     48: 0f 58 0f 50 0f 48 0f 40 0f 38 0f 30 0f 28 0f 20   .X.P.H.@.8.0.(. 
+|     64: 0f 18 0f 10 0f 08 0f 00 0e f8 0e f0 0e e8 0e e0   ................
+|   3808: 06 24 03 00 12 02 01 01 06 23 03 00 12 02 01 01   .$.......#......
+|   3824: 06 22 03 00 12 02 01 01 06 21 03 00 12 03 01 01   .........!......
+|   3840: 06 20 03 00 12 03 01 01 06 1f 03 00 12 03 01 01   . ..............
+|   3856: 06 1e 03 00 12 03 01 01 06 1d 03 00 12 03 01 01   ................
+|   3872: 06 1c 03 00 12 03 01 01 06 1b 03 00 12 02 01 01   ................
+|   3888: 06 1a 03 00 12 02 01 01 06 19 03 00 12 02 01 01   ................
+|   3904: 06 18 03 00 12 02 01 01 06 17 03 00 12 02 01 01   ................
+|   3920: 06 16 03 00 12 02 01 01 06 15 03 00 12 02 01 01   ................
+|   3936: 06 14 03 00 12 02 01 01 06 13 03 00 12 02 01 01   ................
+|   3952: 06 12 03 00 12 02 01 01 06 11 03 00 12 02 01 01   ................
+|   3968: 06 10 03 00 12 02 01 01 06 0f 03 00 12 02 01 01   ................
+|   3984: 06 0e 03 00 12 02 01 01 06 0d 03 00 12 02 01 01   ................
+|   4000: 06 0c 03 00 12 02 01 01 06 0b 03 00 12 02 01 01   ................
+|   4016: 06 0a 03 00 12 02 01 01 06 09 03 00 12 03 01 01   ................
+|   4032: 06 08 03 00 12 03 01 01 06 07 03 00 12 03 01 01   ................
+|   4048: 06 06 03 00 12 01 01 01 06 05 03 00 12 01 01 01   ................
+|   4064: 06 04 03 00 12 01 01 01 06 03 03 00 12 06 01 01   ................
+|   4080: 06 02 03 00 12 06 01 01 06 01 03 00 12 06 01 01   ................
+| page 7 offset 24576
+|      0: 0a 00 00 00 01 0f f4 00 0f f4 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 0b 03 1b 01 76 65 72 73 69 6f 6e 04   ........version.
+| page 8 offset 28672
+|      0: 0d 00 00 00 03 0f d6 00 0f f4 0f e9 0f d6 00 00   ................
+|   4048: 00 00 00 00 00 00 11 03 02 2b 69 6e 74 65 67 72   .........+integr
+|   4064: 69 74 79 2d 63 68 65 63 6b 09 02 02 1b 72 65 62   ity-check....reb
+|   4080: 75 69 6c 64 0a 01 02 1d 6f 70 74 69 6d 69 7a 65   uild....optimize
+| end crash-ae135cb10977c7.db
+}]} {}
+
+do_catchsql_test 35.1 {
+  SELECT * FROM t1 WHERE t1 MATCH 'e*';
+} {1 {database disk image is malformed}}
+
+#-------------------------------------------------------------------------
+reset_db
+do_test 36.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 24576 pagesize 4096 filename crash-a6651222df1bd1.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 00 00 00 00 06   .....@  ........
+|     32: 00 00 00 00 00 00 00 00 00 00 00 06 00 00 00 04   ................
+|     48: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00   ................
+|     96: 00 00 00 00 0d 00 00 00 06 0e 0f 00 0f aa 0f 53   ...............S
+|    112: 0e e8 0e 8b 0e 33 0e 0f 00 00 00 00 00 00 00 00   .....3..........
+|   3584: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22   ................
+|   3600: 06 06 17 11 11 01 31 74 61 62 6c 65 62 62 62 62   ......1tablebbbb
+|   3616: 06 43 52 45 41 54 45 20 54 41 42 4c 45 20 62 62   .CREATE TABLE bb
+|   3632: 28 61 29 56 05 06 17 1f 1f 01 7d 74 61 62 6c 65   (a)V.......table
+|   3648: 74 31 5f 63 6f 6e 66 69 67 74 31 5f 63 6f 6e 66   t1_configt1_conf
+|   3664: 69 67 05 43 52 45 41 54 45 20 54 41 42 4c 45 20   ig.CREATE TABLE 
+|   3680: 27 74 31 5f 63 6f 6e 66 69 67 27 28 6b 20 50 52   't1_config'(k PR
+|   3696: 49 4d 41 52 59 20 4b 45 59 2c 20 76 29 20 57 49   IMARY KEY, v) WI
+|   3712: 54 48 4f 55 54 20 52 4f 57 49 44 5b 04 07 17 21   THOUT ROWID[...!
+|   3728: 21 01 81 01 74 61 62 6c 65 74 31 5f 64 6f 63 73   !...tablet1_docs
+|   3744: 69 7a 65 74 31 5f 64 6f 63 73 69 7a 65 04 43 52   izet1_docsize.CR
+|   3760: 45 41 54 45 20 54 41 42 4c 45 20 27 74 31 5f 64   EATE TABLE 't1_d
+|   3776: 6f 63 73 69 7a 65 27 28 69 64 20 49 4e 54 45 47   ocsize'(id INTEG
+|   3792: 45 52 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20   ER PRIMARY KEY, 
+|   3808: 73 7a 20 42 4c 4f 42 29 69 03 07 17 19 19 01 81   sz BLOB)i.......
+|   3824: 2d 74 61 62 6c 65 74 31 5f 69 64 78 74 31 5f 69   -tablet1_idxt1_i
+|   3840: 64 78 03 43 52 45 41 54 45 20 54 41 42 4c 45 20   dx.CREATE TABLE 
+|   3856: 27 74 31 5f 69 64 78 27 28 73 65 67 69 64 2c 20   't1_idx'(segid, 
+|   3872: 74 65 72 6d 2c 20 70 67 6e 6f 2c 20 50 52 49 4d   term, pgno, PRIM
+|   3888: 41 52 59 20 4b 45 59 28 73 65 67 69 64 2c 20 74   ARY KEY(segid, t
+|   3904: 65 72 6d 29 29 20 57 49 54 48 4f 55 54 20 52 4f   erm)) WITHOUT RO
+|   3920: 57 49 44 55 02 07 17 1b 1b 01 81 01 74 61 62 6c   WIDU........tabl
+|   3936: 65 74 31 5f 64 61 74 61 74 31 5f 64 61 74 61 02   et1_datat1_data.
+|   3952: 43 52 45 41 54 45 20 54 41 42 4c 45 20 27 74 31   CREATE TABLE 't1
+|   3968: 5f 64 61 74 61 27 28 69 64 20 49 4e 54 45 47 45   _data'(id INTEGE
+|   3984: 52 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20 62   R PRIMARY KEY, b
+|   4000: 6c 6f 63 6b 20 42 4c 4f 42 29 54 01 07 17 11 11   lock BLOB)T.....
+|   4016: 08 81 15 74 61 62 6c 65 74 31 74 31 43 52 45 41   ...tablet1t1CREA
+|   4032: 54 45 20 56 49 52 54 55 41 4c 20 54 41 42 4c 45   TE VIRTUAL TABLE
+|   4048: 20 74 31 20 55 53 49 4e 47 20 66 74 73 35 28 61    t1 USING fts5(a
+|   4064: 2c 62 2c 70 72 65 66 69 78 3d 22 31 2c 32 2c 33   ,b,prefix=.1,2,3
+|   4080: 2c 34 22 2c 20 63 6f 6e 74 65 6e 74 3d 22 22 29   ,4., content=..)
+| page 2 offset 4096
+|      0: 0d 0b 6a 00 37 09 4c 02 0f e7 09 4c 0f c6 0f a4   ..j.7.L....L....
+|     16: 0f 88 0f 6d 0f 4b 0f 2c 0f 0e 0e ec 0e cd 0e ad   ...m.K.,........
+|     32: 0e 8e 0e 6c 0e 4b 0e 29 0e 08 0d e6 0d c4 0d b5   ...l.K.)........
+|     48: 0d 97 0d 76 0d 54 0d 31 0d 15 0c f3 0c d3 0c b5   ...v.T.1........
+|     64: 0c 95 0c 73 0c 54 0c 32 0c 10 0b ee 0b cc 0b b0   ...s.T.2........
+|     80: 0b 8d 0b 7e 0b 48 0b 2e 0b 0b 0a ef 0a cc 0a ad   ...~.H..........
+|     96: 0a 8c 0a 6d 0a 4d 0a 2b 0a 0c 09 ec 09 ca 09 a8   ...m.M.+........
+|    112: 09 86 09 63 0f f1 00 00 00 00 00 00 00 00 00 00   ...c............
+|   2368: 00 00 00 00 00 00 00 00 00 00 00 00 15 0a 03 00   ................
+|   2384: 30 00 00 00 01 01 03 35 00 03 01 11 12 02 01 12   0......5........
+|   2400: 03 01 11 1c 8c 80 80 80 80 10 03 00 3e 00 00 00   ............>...
+|   2416: 17 01 05 05 34 74 61 62 6c 03 02 03 01 04 77 68   ....4tabl.....wh
+|   2432: 65 72 03 02 06 09 1b 8c 80 80 80 80 0f 03 00 3c   er.............<
+|   2448: 00 00 00 16 05 34 66 74 73 34 03 02 02 01 04 6e   .....4fts4.....n
+|   2464: 75 6d 62 03 06 01 04 09 1b 8c 80 80 80 80 0e 03   umb.............
+|   2480: 00 3c 00 00 00 16 04 33 74 68 65 03 06 01 01 04   .<.....3the.....
+|   2496: 01 03 77 68 65 03 02 04 04 0a 1b 8c 80 80 80 80   ..whe...........
+|   2512: 0d 03 00 3c 00 00 00 16 04 33 6e 75 6d 03 06 01   ...<.....3num...
+|   2528: 01 05 01 03 74 61 62 03 02 03 04 0a 19 8c 80 80   ....tab.........
+|   2544: 80 80 0c 03 00 38 00 00 00 14 03 32 77 68 03 02   .....8.....2wh..
+|   2560: 04 00 04 33 66 74 73 03 02 02 04 07 18 8c 80 80   ...3fts.........
+|   2576: 80 80 0b 03 00 36 00 00 00 13 03 32 74 61 03 02   .....6.....2ta..
+|   2592: 03 02 01 68 03 06 01 01 04 04 07 1b 8c 80 80 80   ...h............
+|   2608: 80 0a 03 00 3c 00 00 00 16 03 32 6e 75 03 06 01   ....<.....2nu...
+|   2624: 01 05 01 02 6f 66 03 06 01 01 06 04 09 19 8c 80   ....of..........
+|   2640: 80 80 80 09 03 00 38 00 00 00 14 03 32 66 74 03   ......8.....2ft.
+|   2656: 02 02 01 02 69 73 03 06 01 01 03 04 07 18 8c 80   ....is..........
+|   2672: 80 80 80 08 03 00 36 00 00 00 13 02 31 74 03 08   ......6.....1t..
+|   2688: 03 01 01 04 01 01 77 03 02 04 04 09 1a 8c 80 80   ......w.........
+|   2704: 80 80 07 03 00 3a 00 00 00 15 02 31 6e 03 08 01   .....:.....1n...
+|   2720: 01 02 05 01 00 6f 03 06 01 01 06 04 09 18 8c 80   .....o..........
+|   2736: 80 80 80 06 03 00 36 00 00 00 13 04 02 31 66 03   ......6......1f.
+|   2752: 02 02 01 01 69 03 06 01 01 03 05 06 1c 8c 80 80   ....i...........
+|   2768: 80 80 05 03 00 3e 00 00 00 17 04 30 74 68 65 03   .....>.....0the.
+|   2784: 06 01 01 04 01 05 77 68 65 72 65 03 02 04 0a 15   ......where.....
+|   2800: 8c 80 80 80 80 04 03 00 30 00 00 00 11 01 01 06   ........0.......
+|   2816: 06 30 74 61 62 6c 65 03 02 03 07 1c 8c 80 80 80   .0table.........
+|   2832: 80 03 03 00 3e 00 00 00 17 07 30 6e 75 6d 62 65   ....>.....0numbe
+|   2848: 72 03 06 01 01 05 01 02 6f 66 03 06 04 0d 13 8c   r.......of......
+|   2864: 80 80 80 80 02 03 00 2c 00 00 00 0f 01 01 03 02   .......,........
+|   2880: 30 6e 03 06 01 01 02 07 1b 8c 80 80 80 80 01 03   0n..............
+|   2896: 00 3c 00 00 00 16 08 30 66 74 73 34 61 75 78 03   .<.....0fts4aux.
+|   2912: 02 02 01 02 69 73 03 06 04 0c 00 00 00 14 2a 00   ....is........*.
+|   2928: 00 00 01 01 02 24 00 02 01 01 12 02 01 12 08 88   .....$..........
+|   2944: 80 80 80 80 12 03 00 16 00 00 00 05 02 1c 88 80   ................
+|   2960: 80 80 80 11 03 00 3e 00 00 00 17 05 34 72 6f 77   ......>.....4row
+|   2976: 73 02 06 01 01 05 01 04 74 68 65 72 02 02 04 0b   s.......ther....
+|   2992: 15 88 80 80 80 80 10 03 00 30 00 00 00 11 02 01   .........0......
+|   3008: 01 07 05 34 62 65 74 77 02 02 04 08 1b 88 80 80   ...4betw........
+|   3024: 80 80 0f 03 00 3c 00 00 00 16 04 04 33 72 6f 77   .....<......3row
+|   3040: 02 06 01 01 05 01 03 74 68 65 02 08 05 0a 1b 88   .......the......
+|   3056: 80 80 80 80 0e 03 00 3c 00 00 00 16 01 01 02 04   .......<........
+|   3072: 33 61 72 65 02 02 03 01 03 62 65 74 02 02 07 08   3are.....bet....
+|   3088: 1b 88 80 80 80 80 0d 03 00 3c 00 00 00 16 13 32   .........<.....2
+|   3104: 74 68 02 08 02 01 01 07 00 04 33 61 6e 64 02 06   th........3and..
+|   3120: 04 0a 1b 88 80 80 80 80 0c 03 00 3c 00 00 00 16   ...........<....
+|   3136: 03 32 69 6e 02 06 01 01 06 01 02 72 6f 02 06 01   .2in.......ro...
+|   3152: 01 05 04 09 18 88 80 80 80 80 0b 03 00 36 00 00   .............6..
+|   3168: 00 13 02 03 32 61 72 02 02 03 01 02 62 65 02 02   ....2ar.....be..
+|   3184: 04 05 07 1b 88 80 80 80 80 0a 03 00 3c 00 00 00   ............<...
+|   3200: 16 02 31 74 02 08 02 01 01 07 00 03 32 61 6e 02   ..1t........2an.
+|   3216: 06 01 01 04 09 19 88 80 80 80 80 09 03 00 38 00   ..............8.
+|   3232: 00 00 14 02 31 6e 02 06 01 01 03 01 01 72 02 06   ....1n.......r..
+|   3248: 01 01 05 04 08 17 88 80 80 80 80 08 03 00 34 00   ..............4.
+|   3264: 00 00 12 02 31 62 02 02 04 01 01 69 02 06 01 01   ....1b.....i....
+|   3280: 06 04 06 19 88 80 80 80 80 07 03 00 38 00 00 00   ............8...
+|   3296: 14 04 02 31 32 02 02 05 01 01 61 02 08 03 01 01   ...12.....a.....
+|   3312: 02 05 06 1b 88 80 80 80 80 06 03 00 3c 00 00 00   ............<...
+|   3328: 16 06 30 74 68 65 72 65 02 02 02 00 02 31 31 02   ..0there.....11.
+|   3344: 06 01 01 04 0a 15 88 80 80 80 80 05 03 00 30 00   ..............0.
+|   3360: 00 00 11 01 01 05 04 30 74 68 65 02 06 01 01 07   .......0the.....
+|   3376: 07 1c 88 80 80 80 80 04 03 00 3e 00 00 00 17 01   ..........>.....
+|   3392: 01 06 02 30 6e 02 06 01 01 03 01 04 72 6f 77 73   ...0n.......rows
+|   3408: 02 06 07 08 1b 88 80 80 80 80 03 03 00 3c 00 00   .............<..
+|   3424: 00 16 08 30 62 65 74 77 65 65 6e 02 02 04 01 02   ...0between.....
+|   3440: 69 6e 02 06 04 0c 1a 88 80 80 80 80 02 03 00 3a   in.............:
+|   3456: 00 00 00 15 04 30 61 6e 64 02 06 01 01 02 02 02   .....0and.......
+|   3472: 72 65 02 02 03 04 0a 17 88 80 80 80 80 01 03 00   re..............
+|   3488: 34 00 00 00 12 02 30 31 02 06 01 01 04 01 01 32   4.....01.......2
+|   3504: 02 02 05 04 08 08 84 80 80 80 80 12 03 00 16 00   ................
+|   3520: 00 00 05 04 1b 84 80 80 80 80 11 03 00 3c 00 00   .............<..
+|   3536: 00 16 05 34 74 61 62 6c 01 06 01 01 05 02 03 65   ...4tabl.......e
+|   3552: 72 6d 01 02 04 0b 1b 84 80 80 80 80 10 03 00 3c   rm.............<
+|   3568: 00 00 00 16 05 34 65 61 63 68 01 02 03 01 04 70   .....4each.....p
+|   3584: 72 65 73 01 02 05 04 09 1a 84 80 80 80 80 0f 03   res.............
+|   3600: 00 3a 00 00 00 15 04 33 74 65 72 01 02 04 02 02   .:.....3ter.....
+|   3616: 68 65 01 06 01 01 03 04 08 1b 84 80 80 80 80 0e   he..............
+|   3632: 03 00 3c 00 00 00 16 04 33 70 72 65 01 02 05 01   ..<.....3pre....
+|   3648: 03 74 61 62 01 06 01 01 05 04 08 1a 84 80 80 80   .tab............
+|   3664: 80 0d 03 00 3a 00 00 00 15 04 33 66 6f 72 01 02   ....:.....3for..
+|   3680: 02 02 02 74 73 01 06 01 01 04 04 08 1b 84 80 80   ...ts...........
+|   3696: 80 80 0c 03 00 3c 00 00 00 16 03 32 74 68 01 06   .....<.....2th..
+|   3712: 01 01 03 00 04 33 65 61 63 01 02 03 04 09 18 84   .....3eac.......
+|   3728: 80 80 80 80 0b 03 00 36 00 00 00 13 03 32 74 61   .......6.....2ta
+|   3744: 01 06 01 01 05 02 01 65 01 02 04 04 09 19 84 80   .......e........
+|   3760: 80 80 80 0a 03 00 38 00 00 00 14 03 32 69 6e 01   ......8.....2in.
+|   3776: 06 01 01 02 01 02 70 72 01 02 05 04 09 18 84 80   ......pr........
+|   3792: 80 80 80 09 03 00 36 00 00 00 13 03 32 66 6f 01   ......6.....2fo.
+|   3808: 02 02 02 01 74 01 06 01 01 04 04 07 1b 84 80 80   ....t...........
+|   3824: 80 80 08 03 00 3c 00 00 00 16 02 31 74 01 0a 04   .....<.....1t...
+|   3840: 01 01 03 04 00 03 32 65 61 01 02 03 04 0a 17 84   ......2ea.......
+|   3856: 80 80 80 80 07 03 00 34 00 00 00 12 02 31 69 01   .......4.....1i.
+|   3872: 06 01 01 02 01 01 70 01 02 05 04 08 18 84 80 80   ......p.........
+|   3888: 80 80 06 03 00 36 00 00 00 13 02 31 65 01 02 03   .....6.....1e...
+|   3904: 01 01 66 01 08 02 01 01 04 04 06 1b 84 80 80 80   ..f.............
+|   3920: 80 05 03 00 3c 00 00 00 16 05 30 74 65 72 6d 01   ....<.....0term.
+|   3936: 02 04 02 02 68 65 01 06 01 01 03 04 09 14 84 80   ....he..........
+|   3952: 80 80 80 04 03 00 2e 00 00 00 10 06 30 64 61 62   ............0dab
+|   3968: 6c 65 01 06 01 01 05 04 15 84 80 80 80 80 03 03   le..............
+|   3984: 00 30 00 00 00 11 02 08 30 70 72 65 73 65 6e 74   .0......0present
+|   4000: 01 02 05 05 1b 84 80 80 80 80 02 03 00 3c 00 00   .............<..
+|   4016: 00 16 04 30 66 74 73 01 06 01 01 04 01 02 69 6e   ...0fts.......in
+|   4032: 01 06 01 01 04 0a 1a 84 80 80 80 80 01 03 00 3a   ...............:
+|   4048: 00 00 00 15 05 30 65 61 63 68 01 02 03 01 03 66   .....0each.....f
+|   4064: 6f 72 01 02 02 04 09 06 01 03 00 12 03 0b 0f 00   or..............
+|   4080: 00 08 8c 80 80 80 80 11 03 00 16 00 00 00 05 04   ................
+| page 3 offset 8192
+|      0: 0a 00 00 00 32 0e 4f 00 0f fa 0f f1 0f e9 0f e1   ....2.O.........
+|     16: 0f d8 0f d1 0f c9 0f c1 0f b9 0f b1 0f a9 0f a0   ................
+|     32: 0f 98 0f 90 0f 87 0f 80 0f 78 0f 71 0f 68 0f 5f   .........x.q.h._
+|     48: 0f 56 0f 4d 0f 41 0f 38 0f 2f 0f 26 0f 1d 0f 13   .V.M.A.8./.&....
+|     64: 0f 0a 0f 01 0e f7 0e ee 0e e6 0e dd 0e d6 0e cd   ................
+|     80: 0e c3 0e ba 0e b0 0e a8 0e 9f 0e 96 0e 8e 0e 85   ................
+|     96: 0e 7c 0e 73 0e 6a 0e 60 0e 58 0e 4f 00 00 00 00   .|.s.j.`.X.O....
+|   3648: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08   ................
+|   3664: 04 01 10 01 03 34 74 20 07 04 01 0e 01 03 34 1e   .....4t ......4.
+|   3680: 09 04 01 12 01 03 33 74 68 1c 08 04 01 10 01 03   ......3th.......
+|   3696: 33 6e 1a 08 04 01 10 01 03 32 77 18 08 04 01 10   3n.......2w.....
+|   3712: 01 03 32 74 16 08 04 01 10 01 03 32 6e 14 07 04   ..2t.......2n...
+|   3728: 01 0e 01 03 32 12 08 04 01 10 01 03 31 74 10 08   ....2.......1t..
+|   3744: 04 01 10 01 03 31 6e 0e 07 04 01 0e 01 03 31 0c   .....1n.......1.
+|   3760: 09 04 01 12 01 03 30 74 68 0a 08 04 01 10 01 03   ......0th.......
+|   3776: 30 74 08 09 04 01 12 01 03 30 6e 75 06 08 04 01   0t.......0nu....
+|   3792: 10 01 03 30 6e 04 06 04 01 0c 01 03 02 08 04 01   ...0n...........
+|   3808: 10 01 02 34 72 22 07 04 01 0e 01 02 34 20 08 04   ...4r.......4 ..
+|   3824: 01 10 01 02 33 72 1e 09 04 01 12 01 02 33 61 72   ....3r.......3ar
+|   3840: 1c 08 04 01 10 01 02 32 74 1a 08 04 01 10 01 02   .......2t.......
+|   3856: 32 69 18 09 04 01 12 01 02 32 61 72 16 08 04 01   2i.......2ar....
+|   3872: 10 01 02 31 74 14 08 04 01 10 01 02 31 6e 12 08   ...1t.......1n..
+|   3888: 04 01 10 01 02 31 62 10 08 04 01 10 01 02 31 32   .....1b.......12
+|   3904: 0e 0b 04 01 16 01 02 30 74 68 65 72 0c 08 04 01   .......0ther....
+|   3920: 10 01 02 30 74 0a 08 04 01 10 01 02 30 6e 08 08   ...0t.......0n..
+|   3936: 14 01 10 01 02 30 62 06 08 04 01 10 01 02 30 61   .....0b.......0a
+|   3952: 04 06 04 01 0c 01 02 02 07 04 09 10 01 34 74 22   .............4t.
+|   3968: 06 04 09 0e 01 34 20 08 04 09 12 01 33 74 65 1e   .....4 .....3te.
+|   3984: 07 04 09 10 01 33 70 1c 07 04 09 10 01 33 66 1a   .....3p......3f.
+|   4000: 08 04 09 12 01 32 74 68 18 07 04 09 10 01 32 74   .....2th......2t
+|   4016: 16 07 04 09 10 01 32 69 14 07 04 09 10 01 32 66   ......2i......2f
+|   4032: 12 07 04 09 10 01 31 74 10 07 04 09 10 01 31 69   ......1t......1i
+|   4048: 0e 06 04 09 0e 01 31 0c 08 04 09 12 01 30 74 65   ......1......0te
+|   4064: 0a 07 04 09 10 01 30 74 08 07 04 09 10 01 30 70   ......0t......0p
+|   4080: 06 08 04 09 12 01 30 66 74 04 05 04 09 0c 01 02   ......0ft.......
+| page 4 offset 12288
+|      0: 0d 00 00 00 03 0f eb 00 0f f9 0f f2 0f eb 00 00   ................
+|   4064: 00 00 00 00 00 00 00 00 00 00 00 05 03 03 00 10   ................
+|   4080: 03 05 05 02 03 00 10 04 06 05 01 03 00 10 04 04   ................
+| page 5 offset 16384
+|      0: 0a 00 00 00 02 0f eb 00 0f eb 0f f4 00 00 00 00   ................
+|   4064: 00 00 00 00 00 00 00 00 00 00 00 08 03 15 01 70   ...............p
+|   4080: 67 73 7a 18 0b 03 1b 01 76 65 72 73 69 6f 6e 04   gsz.....version.
+| page 6 offset 20480
+|      0: 0d 00 00 00 03 0f f2 00 0f fc 0f f7 0f f2 00 00   ................
+|   4080: 00 00 03 03 02 01 03 03 02 02 01 02 02 01 0c e9   ................
+| end crash-a6651222df1bd1.db
+}]} {}
+
+do_catchsql_test 36.1 {
+  INSERT INTO t1(b) VALUES(
+      x'78de3fa24af3733ca8769291a0fee3669f9fddefc5cba913e4225d4b6ce2b04f26b87fad3ee6f9b7d90a1ea62a169bf41e5d32707a6ca5c3d05e4bde05c9d89eaaa8c50e74333d2e9fcd7dfe95528a3a016aac1102d825c5cd70cf99d8a88e0ea7f798d4334386518b7ad359beb168b93aba059a2a3bd93112d65b44c12b9904ea786b204d80531cdf0504bf9b203dbe927061974caf7b9f30cbc3397b61f802e732012a6663d41c3607d6f1c0dbcfd489adac05ca500c0b04439d894cd93a840159225ef73b627e178b9f84b3ffe66cf22a963a8368813ff7961fc47f573211ccec95e0220dcbb3bf429f4a50ba54d7a53784ac51bfef346e6a');
+} {1 {database disk image is malformed}}
+
+#-------------------------------------------------------------------------
+reset_db
+do_test 37.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 40960 pagesize 4096 filename null-memcmp-param-1..db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 00 00 00 00 0a   .....@  ........
+|     32: 00 00 00 00 00 00 00 00 00 00 00 0d 00 00 00 04   ................
+|     48: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00   ................
+|     96: 00 00 00 00 0d 00 00 00 0d 0b 6e 00 0f a3 0f 4c   ..........n....L
+|    112: 0e e1 0e 81 0e 24 0d cc 0d 72 0d 1b 0c b0 0c 50   .....$...r.....P
+|    128: 0b f8 0b b3 0b 6e 00 00 00 00 00 00 00 00 00 00   .....n..........
+|   2912: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 43 0d   ..............C.
+|   2928: 06 17 11 11 08 75 74 61 62 6c 66 74 34 74 34 43   .....utablft4t4C
+|   2944: 52 45 41 54 45 20 56 49 52 54 55 41 4c 20 54 41   REATE VIRTUAL TA
+|   2960: 42 4c 45 20 74 34 20 55 53 49 4e 47 20 66 74 73   BLE t4 USING fts
+|   2976: 35 76 6f 63 61 62 28 27 74 32 27 2c 20 27 72 6f   5vocab('t2', 'ro
+|   2992: 77 27 29 43 0c 06 17 11 11 08 75 74 61 62 6c 65   w')C......utable
+|   3008: 74 33 74 33 43 52 45 41 54 45 20 56 49 52 54 55   t3t3CREATE VIRTU
+|   3024: 41 4c 20 54 41 42 4c 45 20 74 33 20 55 53 49 4e   AL TABLE t3 USIN
+|   3040: 47 20 66 74 73 35 76 6f 63 61 62 28 27 74 31 27   G fts5vocab('t1'
+|   3056: 2c 20 27 72 6f 77 27 29 56 0b 06 17 1f 1f 01 7d   , 'row')V.......
+|   3072: 74 61 62 6c 65 74 32 5f 63 6f 6e 66 69 67 74 32   tablet2_configt2
+|   3088: 5f 63 6f 6e 66 69 67 0a 43 52 45 41 54 45 20 54   _config.CREATE T
+|   3104: 41 42 4c 45 20 27 74 32 5f 63 6f 6e 66 69 67 27   ABLE 't2_config'
+|   3120: 28 6b 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20   (k PRIMARY KEY, 
+|   3136: 76 29 20 57 49 54 48 4f 55 54 20 52 4f 57 49 44   v) WITHOUT ROWID
+|   3152: 5e 0a 07 17 21 21 01 81 07 74 61 62 6c 65 74 32   ^...!!...tablet2
+|   3168: 5f 63 6f 6e 74 65 6e 74 74 32 5f 63 6f 6e 74 65   _contentt2_conte
+|   3184: 6e 74 09 43 52 45 41 54 45 20 54 41 42 4c 45 20   nt.CREATE TABLE 
+|   3200: 27 74 32 5f 63 6f 6e 74 65 6e 74 27 28 69 64 20   't2_content'(id 
+|   3216: 49 4e 54 45 47 45 52 20 50 52 49 4d 41 52 59 20   INTEGER PRIMARY 
+|   3232: 4b 45 59 2c 20 63 30 2c 20 63 31 2c 20 63 32 29   KEY, c0, c1, c2)
+|   3248: 69 09 07 17 19 19 01 81 2d 74 61 62 6c 65 74 32   i.......-tablet2
+|   3264: 5f 69 64 78 74 32 5f 69 64 78 08 43 52 45 41 54   _idxt2_idx.CREAT
+|   3280: 45 20 54 41 42 4c 45 20 27 74 32 5f 69 64 78 27   E TABLE 't2_idx'
+|   3296: 28 73 65 67 69 64 2c 20 74 65 72 6d 2c 20 70 67   (segid, term, pg
+|   3312: 6e 6f 2c 20 50 52 49 4d 41 52 59 20 4b 45 59 28   no, PRIMARY KEY(
+|   3328: 73 65 67 69 64 2c 20 74 65 72 6d 29 29 20 57 49   segid, term)) WI
+|   3344: 54 48 4f 55 54 20 52 4f 57 49 44 55 08 07 17 1b   THOUT ROWIDU....
+|   3360: 1b 01 81 01 74 61 62 6c 65 74 32 5f 64 61 74 61   ....tablet2_data
+|   3376: 74 32 5f 64 61 74 61 07 43 52 45 41 54 45 20 54   t2_data.CREATE T
+|   3392: 41 42 4c 45 20 27 74 32 5f 64 61 74 61 27 28 69   ABLE 't2_data'(i
+|   3408: 64 20 49 4e 54 45 47 45 52 20 50 52 49 4d 41 52   d INTEGER PRIMAR
+|   3424: 59 20 4b 45 59 2c 20 62 6c 6f 63 6b 20 42 4c 4f   Y KEY, block BLO
+|   3440: 42 29 58 07 07 17 11 11 08 81 1d 74 61 62 6c 65   B)X........table
+|   3456: 74 32 74 32 43 52 45 41 54 45 20 56 49 52 54 55   t2t2CREATE VIRTU
+|   3472: 41 4c 20 54 41 42 4c 45 20 74 32 20 55 53 49 4e   AL TABLE t2 USIN
+|   3488: 47 20 64 44 73 35 28 27 61 27 2c 5b 62 5d 2c 22   G dDs5('a',[b],.
+|   3504: 63 22 2c 64 65 74 61 69 6c 3d 6e 6f 6e 65 2c 63   c.,detail=none,c
+|   3520: 6f 6c 75 6d 6e 73 69 7a 65 3d 30 29 56 06 06 17   olumnsize=0)V...
+|   3536: 1f 1f 01 7d 74 61 62 6c 65 74 31 5f 63 6f 6e 66   ....tablet1_conf
+|   3552: 69 67 74 31 5f 63 6f 6e 66 69 67 06 43 52 45 41   igt1_config.CREA
+|   3568: 54 45 20 54 41 42 4c 45 20 27 74 31 5f 63 6f 6e   TE TABLE 't1_con
+|   3584: 66 69 67 27 28 6b 20 50 52 49 4d 41 52 59 20 4b   fig'(k PRIMARY K
+|   3600: 45 59 2c 20 76 29 20 57 49 54 48 4f 55 54 20 52   EY, v) WITHOUT R
+|   3616: 4f 57 49 44 5b 05 07 17 21 21 01 81 01 74 61 62   OWID[...!!...tab
+|   3632: 6c 65 74 31 5f 64 6f 63 73 69 7a 65 74 31 5f 64   let1_docsizet1_d
+|   3648: 6f 63 73 69 7a 65 05 43 52 45 41 54 45 20 54 41   ocsize.CREATE TA
+|   3664: 42 4c 45 20 27 74 31 5f 64 6f 63 73 69 7a 65 27   BLE 't1_docsize'
+|   3680: 28 69 64 20 49 4e 54 45 47 45 52 20 50 52 49 4d   (id INTEGER PRIM
+|   3696: 41 52 59 20 4b 45 59 2c 20 73 7a 20 42 4c 4f 42   ARY KEY, sz BLOB
+|   3712: 29 5e 04 07 17 21 21 01 81 07 74 61 62 6c 65 74   )^...!!...tablet
+|   3728: 31 5f 63 6f 6e 74 65 6e 74 74 31 5f 63 6f 6e 74   1_contentt1_cont
+|   3744: 65 6e 74 04 43 52 45 41 54 45 20 54 41 42 4c 45   ent.CREATE TABLE
+|   3760: 20 27 74 31 5f 63 6f 6e 74 65 6e 74 27 28 69 64    't1_content'(id
+|   3776: 20 49 4e 54 45 47 45 52 20 50 52 49 4d 41 52 59    INTEGER PRIMARY
+|   3792: 20 4b 45 59 2c 20 63 30 2c 20 63 31 2c 20 63 32    KEY, c0, c1, c2
+|   3808: 29 69 03 07 17 19 19 01 81 2d 74 61 62 6c 65 74   )i.......-tablet
+|   3824: 31 5f 69 64 78 74 31 5f 69 64 78 03 43 52 45 41   1_idxt1_idx.CREA
+|   3840: 54 45 20 54 41 42 4c 45 20 27 74 31 5f 69 64 78   TE TABLE 't1_idx
+|   3856: 27 28 73 65 67 69 64 2c 20 74 65 72 6d 2c 20 70   '(segid, term, p
+|   3872: 67 6e 6f 2c 20 50 52 49 4d 41 52 59 20 4b 45 59   gno, PRIMARY KEY
+|   3888: 28 73 65 67 69 64 2c 20 74 65 72 6d 29 29 20 57   (segid, term)) W
+|   3904: 49 54 48 4f 55 54 20 52 4f 57 49 44 55 02 07 17   ITHOUT ROWIDU...
+|   3920: 1b 1b 01 81 01 74 61 62 6c 65 74 31 5f 64 61 74   .....tablet1_dat
+|   3936: 61 74 31 5f 64 61 74 61 02 43 52 45 41 54 45 20   at1_data.CREATE 
+|   3952: 54 41 42 4c 45 20 27 74 31 5f 64 61 74 61 27 28   TABLE 't1_data'(
+|   3968: 69 64 20 49 4e 54 45 47 45 52 20 50 52 49 4d 41   id INTEGER PRIMA
+|   3984: 52 59 20 4b 45 59 2c 20 62 6c 6f 63 6b 20 42 4c   RY KEY, block BL
+|   4000: 4f 42 29 5b 01 07 17 11 11 08 81 23 74 61 62 6c   OB)[.......#tabl
+|   4016: 65 74 31 74 31 43 52 45 41 54 45 20 56 49 52 54   et1t1CREATE VIRT
+|   4032: 55 41 4c 20 54 41 42 4c 45 20 74 31 20 55 53 49   UAL TABLE t1 USI
+|   4048: 4e 47 20 66 74 73 35 28 61 2c 62 20 75 6e 69 6e   NG fts5(a,b unin
+|   4064: 64 65 78 65 64 2c 63 2c 74 6f 6b 65 6e 69 7a 65   dexed,c,tokenize
+|   4080: 3d 22 70 6f 72 74 65 72 20 61 73 63 69 69 22 29   =.porter ascii.)
+| page 2 offset 4096
+|      0: 0d 0f 68 00 05 0f 13 00 0f e6 0f 13 0f a8 0f 7c   ..h............|
+|     16: 0f 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 00   .*..............
+|   3856: 00 00 00 15 0a 03 00 30 00 00 00 00 01 03 03 00   .......0........
+|   3872: 03 01 01 01 02 01 01 03 01 01 37 8c 80 80 80 80   ..........7.....
+|   3888: 01 03 00 74 00 00 00 2e 02 30 61 03 02 02 01 01   ...t.....0a.....
+|   3904: 62 03 02 03 01 01 63 03 02 04 01 01 67 03 06 01   b.....c.....g...
+|   3920: 02 02 01 01 68 03 06 01 02 03 01 01 69 03 06 01   ....h.......i...
+|   3936: 02 04 04 06 06 06 08 08 0f ef 00 14 2a 00 00 00   ............*...
+|   3952: 00 01 02 02 00 02 01 01 01 02 01 01 25 88 80 80   ............%...
+|   3968: 80 80 01 03 00 50 00 00 00 1f 01 30 67 02 08 02   .....P.....0g...
+|   3984: 01 02 02 01 01 68 02 08 03 01 02 03 01 01 69 02   .....h........i.
+|   4000: 08 04 01 02 04 04 09 09 37 84 80 80 80 80 01 03   ........7.......
+|   4016: 00 74 00 00 00 2e 02 30 61 01 5a 02 01 01 62 01   .t.....0a.Z...b.
+|   4032: 02 03 01 01 63 01 02 04 01 01 67 01 06 01 02 02   ....c.....g.....
+|   4048: 01 01 68 01 06 01 02 03 01 01 69 01 06 01 02 04   ..h.......i.....
+|   4064: 04 06 06 06 08 08 07 01 03 00 14 03 09 00 09 00   ................
+|   4080: 00 00 11 24 00 00 00 00 01 01 01 00 01 01 01 01   ...$............
+| page 3 offset 8192
+|      0: 0a 00 00 00 03 0f ec 00 0f fa 0f f3 0f ec 00 00   ................
+|   4064: 00 00 00 00 00 00 00 00 00 00 00 00 06 04 01 0c   ................
+|   4080: 01 03 02 06 04 01 0c 01 02 02 05 04 09 0c 01 02   ................
+| page 4 offset 12288
+|      0: 0d 00 00 00 03 0f be 00 0f ea 0f d4 0f be 00 00   ................
+|   4016: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 14 03   ................
+|   4032: 05 00 17 17 17 61 20 62 20 63 67 20 68 20 69 67   .....a b cg h ig
+|   4048: 20 68 20 69 14 02 05 00 17 17 17 67 20 68 20 69    h i.......g h i
+|   4064: 61 20 62 20 63 67 20 68 20 69 14 01 05 00 17 17   a b cg h i......
+|   4080: 17 61 20 62 20 63 64 20 65 20 66 67 20 68 20 69   .a b cd e fg h i
+| page 5 offset 16384
+|      0: 0d 00 00 00 03 0f e8 00 0f f8 0f f0 0f e8 00 00   ................
+|   4064: 00 00 00 00 00 00 00 00 06 03 03 00 12 03 00 03   ................
+|   4080: 06 02 03 00 12 03 00 03 06 01 03 00 12 03 00 03   ................
+| page 6 offset 20480
+|      0: 0a 00 00 00 01 0f f4 00 0f f4 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 0b 03 1b 01 76 65 72 73 69 6f 6e 04   ........version.
+| page 7 offset 24576
+|      0: 0d 00 00 00 03 0f 9e 00 0f e6 0f ef 0f 9e 00 00   ................
+|   3984: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 84   ..............A.
+|   4000: 80 80 80 80 01 04 00 81 06 00 00 00 34 02 30 61   ............4.0a
+|   4016: 01 01 01 01 01 62 01 01 01 01 01 63 01 01 01 01   .....b.....c....
+|   4032: 01 64 01 01 01 65 01 01 01 66 01 01 01 67 01 01   .d...e...f...g..
+|   4048: 01 01 01 68 01 01 01 01 01 69 01 01 01 04 06 06   ...h.....i......
+|   4064: 06 04 04 04 06 06 07 01 03 00 14 03 09 09 09 0f   ................
+|   4080: 0a 03 00 24 00 00 00 00 01 01 01 00 01 01 01 01   ...$............
+| page 8 offset 28672
+|      0: 0a 00 00 00 01 0f fa 00 0f fa 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 00 00 00 00 00 00 05 04 09 0c 01 02   ................
+| page 9 offset 32768
+|      0: 0d 00 00 00 03 0f be 00 0f ea 0f d4 0f be 00 00   ................
+|   4016: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 14 03   ................
+|   4032: 05 00 17 17 17 61 20 62 20 63 67 20 68 20 69 67   .....a b cg h ig
+|   4048: 20 68 20 69 14 02 05 00 17 17 17 67 20 68 20 69    h i.......g h i
+|   4064: 61 20 62 20 63 67 20 68 20 69 14 01 05 00 17 17   a b cg h i......
+|   4080: 17 61 20 62 20 63 64 20 65 20 66 67 20 68 30 69   .a b cd e fg h0i
+| page 10 offset 36864
+|      0: 0a 00 00 00 01 0f f4 00 0f f4 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 0b 03 1b 01 76 65 72 73 69 6f 6e 04   ........version.
+| end null-memcmp-param-1..db
+}]} {}
+
+do_catchsql_test 37.1 {
+  SELECT * FROM t3;
+} {1 {database disk image is malformed}}
+
+#-------------------------------------------------------------------------
+reset_db 
+do_execsql_test 37.0 {
+  CREATE VIRTUAL TABLE t1 USING fts5(b, c);
+  INSERT INTO t1 VALUES('a', 'b');
+  SELECT quote(block) FROM t1_data WHERE rowid=10;
+} {X'000000000101010001010101'}
+
+do_execsql_test 37.1 {
+  UPDATE t1_data SET block = X'FFFFFFFF0101010001010101' WHERE rowid = 10;
+  SELECT rowid FROM t1('a');
+} {1}
+
+#-------------------------------------------------------------------------
+reset_db 
+do_execsql_test 38.0 {
+  CREATE VIRTUAL TABLE t1 USING fts5(b, c);
+  INSERT INTO t1 VALUES('a', 'b');
+  INSERT INTO t1 VALUES('a', 'b');
+  SELECT quote(block) FROM t1_data WHERE rowid=1;
+} {X'020202'}
+
+do_execsql_test 38.1 {
+  SELECT * FROM t1('a b') ORDER BY rank;
+} {a b a b}
+
+do_execsql_test 38.2 {
+  UPDATE t1_data SET block = X'000202' WHERE rowid=1;
+}
+breakpoint
+do_catchsql_test 38.3 {
+  SELECT * FROM t1('a b') ORDER BY rank;
+} {1 {database disk image is malformed}}
+
+db close
+sqlite3 db test.db
+do_catchsql_test 38.4 {
+  SELECT * FROM t1('a b') ORDER BY rank;
+} {1 {database disk image is malformed}}
+
+#-------------------------------------------------------------------------
+reset_db
+do_test 38.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 32768 pagesize 4096 filename crash-fd2a1313e5b5e9.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 00 00 00 00 08   .....@  ........
+|     32: 00 00 00 02 00 00 00 01 00 00 00 09 00 00 00 04   ................
+|     48: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00   ................
+|     96: 00 00 00 00 0d 0f c7 00 07 0d 92 00 0f 8d 0f 36   ...............6
+|    112: 0e cb 0e 6b 0e 0e 0d b6 0d 92 0d 92 00 00 00 00   ...k............
+|   3472: 00 00 22 08 06 17 11 11 01 31 74 61 62 6c 65 74   .........1tablet
+|   3488: 32 74 32 08 43 52 45 41 54 45 20 54 41 42 4c 45   2t2.CREATE TABLE
+|   3504: 20 74 32 28 78 29 56 07 06 17 1f 1f 01 7d 74 61    t2(x)V.......ta
+|   3520: 62 6c 65 74 31 5f 63 6f 6e 66 69 67 74 31 5f 63   blet1_configt1_c
+|   3536: 6f 6e 66 69 67 07 43 52 45 41 54 45 20 54 41 42   onfig.CREATE TAB
+|   3552: 4c 45 20 27 74 31 5f 63 6f 6e 66 69 67 27 28 6b   LE 't1_config'(k
+|   3568: 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20 76 29    PRIMARY KEY, v)
+|   3584: 20 57 49 54 48 4f 55 54 20 52 4f 57 49 44 5b 06    WITHOUT ROWID[.
+|   3600: 07 17 21 21 01 81 01 74 61 62 6c 65 74 31 5f 64   ..!!...tablet1_d
+|   3616: 6f 63 73 69 7a 65 74 31 5f 64 6f 63 73 69 7a 65   ocsizet1_docsize
+|   3632: 06 43 52 45 41 54 45 20 54 41 42 4c 45 20 27 74   .CREATE TABLE 't
+|   3648: 31 5f 64 6f 63 73 69 7a 65 27 28 69 64 20 49 4e   1_docsize'(id IN
+|   3664: 54 45 47 45 52 20 50 52 49 4d 41 52 59 20 4b 45   TEGER PRIMARY KE
+|   3680: 59 2c 20 73 7a 20 42 4c 4f 42 29 5e 05 07 17 21   Y, sz BLOB)^...!
+|   3696: 21 01 81 07 74 61 62 6c 65 b8 31 5f 63 6f 6e 74   !...table.1_cont
+|   3712: 65 6e 74 74 31 5f 63 6f 6e 74 65 6e 74 05 43 52   entt1_content.CR
+|   3728: 45 41 54 45 20 54 41 42 4c 45 20 27 74 31 5f 63   EATE TABLE 't1_c
+|   3744: 6f 6e 74 65 6e 74 27 28 69 64 20 49 4e 54 45 47   ontent'(id INTEG
+|   3760: 45 52 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20   ER PRIMARY KEY, 
+|   3776: 63 30 2c 20 63 31 2c 20 63 32 29 69 04 07 17 19   c0, c1, c2)i....
+|   3792: 19 01 81 2d 74 61 62 6c 65 74 31 5f 69 64 78 74   ...-tablet1_idxt
+|   3808: 31 5f 69 64 78 04 43 52 45 41 54 45 20 54 41 42   1_idx.CREATE TAB
+|   3824: 4c 45 20 27 74 31 5f 69 64 78 27 28 73 65 67 69   LE 't1_idx'(segi
+|   3840: 64 2c 20 74 65 72 6d 2c 20 70 67 6e 6f 2c 20 50   d, term, pgno, P
+|   3856: 52 49 4d 41 52 59 20 4b 45 59 28 73 65 67 69 64   RIMARY KEY(segid
+|   3872: 2c 20 74 65 72 6d 29 29 20 57 49 54 48 4f 55 54   , term)) WITHOUT
+|   3888: 20 52 4f 57 49 44 55 03 07 17 1b 1b 01 81 01 74    ROWIDU........t
+|   3904: 61 62 6c 65 74 31 5f 64 61 74 61 74 31 5f 64 61   ablet1_datat1_da
+|   3920: 74 61 03 43 52 45 41 54 45 20 54 41 42 4c 45 20   ta.CREATE TABLE 
+|   3936: 27 74 31 5f 64 61 74 61 27 28 69 64 20 49 4e 54   't1_data'(id INT
+|   3952: 45 47 45 52 20 50 52 49 4d 41 52 59 20 4b 45 59   EGER PRIMARY KEY
+|   3968: 2c 20 62 6c 6f 63 6b 20 42 4c 4f 42 29 38 02 06   , block BLOB)8..
+|   3984: 17 11 11 08 5f 74 61 62 6c 65 74 31 74 31 43 52   ...._tablet1t1CR
+|   4000: 45 41 54 45 20 56 49 52 54 55 41 4c 20 54 41 42   EATE VIRTUAL TAB
+|   4016: 4c 45 20 74 31 20 55 53 49 4e 47 20 66 74 73 35   LE t1 USING fts5
+|   4032: 28 61 2c 62 2c 63 29 00 00 00 39 00 00 00 00 00   (a,b,c)...9.....
+| page 3 offset 8192
+|      0: 0d 00 00 00 03 0c 94 00 0f e6 0f ef 0c 94 00 00   ................
+|   3216: 00 00 00 00 86 4a 84 80 80 80 80 01 04 00 8d 18   .....J..........
+|   3232: 00 00 03 2b 02 30 30 01 02 06 01 02 06 01 02 06   ...+.00.........
+|   3248: 1f 02 03 01 02 03 01 02 03 01 08 32 30 31 36 30   ...........20160
+|   3264: 36 30 39 01 02 07 01 02 07 01 02 07 01 01 34 01   609...........4.
+|   3280: 02 05 01 02 05 01 02 05 01 01 35 01 02 04 01 02   ..........5.....
+|   3296: 04 01 02 04 02 07 30 30 30 30 30 30 30 1c 02 04   ......0000000...
+|   3312: 01 02 04 01 02 04 01 06 62 69 6e 61 72 79 03 06   ........binary..
+|   3328: 01 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01   ................
+|   3344: 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01 02   ................
+|   3360: 02 03 06 01 02 02 03 06 01 02 02 03 06 01 02 02   ................
+|   3376: 03 06 01 02 02 03 06 01 02 02 01 08 63 6f 6d 70   ............comp
+|   3392: 69 6c 65 72 01 02 02 01 02 02 01 02 02 01 06 64   iler...........d
+|   3408: 62 73 74 61 74 07 02 03 01 02 03 01 02 03 02 04   bstat...........
+|   3424: 65 62 75 67 04 02 02 01 02 02 01 02 02 01 06 65   ebug...........e
+|   3440: 6e 61 62 6c 65 07 02 02 01 02 02 01 02 02 01 02   nable...........
+|   3456: 02 01 02 02 01 02 02 01 02 02 01 02 02 01 02 02   ................
+|   3472: 01 02 02 01 02 02 01 02 02 01 02 02 01 02 02 01   ................
+|   3488: 02 02 01 02 02 01 02 02 01 02 02 01 02 02 01 02   ................
+|   3504: 02 01 02 02 02 08 78 74 65 6e 73 69 6f 6e 1f 02   ......xtension..
+|   3520: 04 01 02 04 01 02 04 01 04 66 74 73 34 0a 02 03   .........fts4...
+|   3536: 01 02 03 01 02 03 04 01 35 0d 02 03 01 02 03 01   ........5.......
+|   3552: 02 03 01 03 67 63 63 01 02 03 01 02 03 01 02 03   ....gcc.........
+|   3568: 02 06 65 6f 70 6f 6c 79 10 02 03 01 02 03 01 02   ..eopoly........
+|   3584: 03 01 05 6a 73 6f 6e 31 13 02 03 01 02 03 01 02   ...json1........
+|   3600: 03 01 04 6c 6f 61 64 1f 02 03 01 02 03 01 02 03   ...load.........
+|   3616: 01 03 6d 61 78 1c 02 02 01 02 02 01 02 02 02 05   ..max...........
+|   3632: 65 6d 6f 72 79 1c 02 03 01 02 03 01 02 03 04 04   emory...........
+|   3648: 73 79 73 35 16 02 03 01 02 03 01 02 03 01 06 6e   sys5...........n
+|   3664: 6f 63 61 73 65 02 06 01 02 02 03 06 01 02 02 03   ocase...........
+|   3680: 06 01 02 02 03 06 01 02 02 03 06 01 02 02 03 06   ................
+|   3696: 01 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01   ................
+|   3712: 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01 02   ................
+|   3728: 02 01 04 6f 6d 69 74 1f 02 02 01 02 02 01 02 02   ...omit.........
+|   3744: 01 05 72 74 72 65 65 19 02 03 01 02 03 01 02 03   ..rtree.........
+|   3760: 04 02 69 6d 01 06 01 02 02 03 06 01 02 02 03 06   ..im............
+|   3776: 01 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01   ................
+|   3792: 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01 02   ................
+|   3808: 02 03 06 01 02 02 03 06 01 02 02 03 06 01 02 02   ................
+|   3824: 01 0a 74 68 72 65 61 64 73 61 66 65 22 02 02 01   ..threadsafe....
+|   3840: 02 02 01 02 01 01 04 76 74 61 62 07 02 04 01 02   .......vtab.....
+|   3856: 04 01 02 04 01 01 78 01 06 01 01 02 01 06 01 01   ......x.........
+|   3872: 02 01 06 01 01 02 01 06 01 01 02 01 06 01 01 02   ................
+|   3888: 01 06 01 01 02 01 06 01 01 02 01 06 01 01 02 01   ................
+|   3904: 06 01 01 02 01 06 01 01 02 01 06 01 01 02 01 06   ................
+|   3920: 01 01 02 01 06 01 01 02 01 06 01 01 02 01 06 01   ................
+|   3936: 01 02 01 06 01 01 02 01 06 01 01 02 01 06 01 01   ................
+|   3952: 02 01 06 01 01 02 01 06 01 01 02 01 06 01 01 02   ................
+|   3968: 01 06 01 01 02 01 06 01 01 02 01 06 01 01 02 01   ................
+|   3984: 06 01 01 02 01 06 01 01 02 01 06 01 01 02 01 06   ................
+|   4000: 01 01 02 01 06 01 01 02 01 06 01 ec 02 01 06 01   ................
+|   4016: 01 02 01 06 01 01 02 01 06 01 01 02 01 06 01 01   ................
+|   4032: 02 01 06 01 01 02 01 06 01 01 01 04 15 13 0c 0c   ................
+|   4048: 12 44 13 11 0f 47 13 0f 0c 0e 11 10 0f 0e 10 0f   .D...G..........
+|   4064: 44 0f 10 40 15 0f 07 01 03 00 14 24 5a 24 24 0f   D..@.......$Z$$.
+|   4080: 0a 03 00 24 00 00 00 00 01 01 01 00 01 01 01 01   ...$............
+| page 4 offset 12288
+|      0: 0a 00 00 00 01 0f fa 00 0f fa 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 00 00 00 00 00 00 05 04 09 0c 01 02   ................
+| page 5 offset 16384
+|      0: 0d 00 00 00 24 0c 0a 00 0f d8 0f af 0f 86 0f 74   ....$..........t
+|     16: 0f 61 0f 4e 0f 2f 0f 0f 0e ef 0e d7 0e be 0e a5   .a.N./..........
+|     32: 0e 8d 0e 74 0e 5b 0e 40 0e 24 0e 08 0d ef 0d d5   ...t.[.@.$......
+|     48: 0d bb 0d a0 0d 84 0d 68 0d 4f 0d 35 0d 1b 0c fb   .......h.O.5....
+|     64: 0c da 0c b9 0c 99 0c 78 0c 57 0c 3e 0c 24 0c 0a   .......x.W.>.$..
+|   3072: 00 00 00 00 00 00 00 00 00 00 18 24 05 00 25 0f   ...........$..%.
+|   3088: 19 54 48 52 45 41 44 53 41 46 45 3d 30 58 42 49   .THREADSAFE=0XBI
+|   3104: 4e 41 52 59 18 23 05 00 25 0f 19 54 48 52 45 41   NARY.#..%..THREA
+|   3120: 44 53 41 46 45 3d 30 58 4e 4f 43 41 53 45 17 22   DSAFE=0XNOCASE..
+|   3136: 05 00 25 0f 17 54 48 52 45 41 44 53 41 46 45 3d   ..%..THREADSAFE=
+|   3152: 30 58 52 54 52 49 4d 1f 21 05 00 33 0f 19 4f 4d   0XRTRIM.!..3..OM
+|   3168: 49 54 20 4c 4f 41 44 20 45 58 54 45 4e 53 49 4f   IT LOAD EXTENSIO
+|   3184: 4e 58 42 49 4e 41 52 59 1f 20 05 00 33 0f 19 4f   NXBINARY. ..3..O
+|   3200: 4d 49 54 20 4c 4f 41 44 20 45 58 54 45 4e 53 49   MIT LOAD EXTENSI
+|   3216: 4f 4e 58 4e 4f 43 41 53 45 1e 1f 05 00 33 0f 17   ONXNOCASE....3..
+|   3232: 4f 4d 49 54 20 4c 4f 41 44 20 45 58 54 45 4e 53   OMIT LOAD EXTENS
+|   3248: 49 4f 4e 58 52 54 52 49 4d 1f 1e 05 00 33 0f 19   IONXRTRIM....3..
+|   3264: 4d 41 58 20 4d 45 4d 4f 52 59 60 35 30 30 30 30   MAX MEMORY`50000
+|   3280: 30 30 30 58 42 49 4e 41 52 59 1f 1d 05 00 33 0f   000XBINARY....3.
+|   3296: 19 4d 41 58 20 4d 44 4d 4f 52 59 3d 35 30 30 30   .MAX MDMORY=5000
+|   3312: 30 30 30 30 58 4e 4f 43 41 53 45 1e 1c 05 00 33   0000XNOCASE....3
+|   3328: 0f 17 4d 41 58 20 4d 45 4d 4f 52 59 3d 35 30 30   ..MAX MEMORY=500
+|   3344: 30 30 30 30 30 58 52 54 52 49 4d 18 1b 05 00 25   00000XRTRIM....%
+|   3360: 0f 19 45 4e 41 42 4c 45 20 52 54 52 45 45 58 42   ..ENABLE RTREEXB
+|   3376: 49 4e 41 52 59 18 1a 05 00 25 0f 19 45 4e 41 42   INARY....%..ENAB
+|   3392: 4c 45 20 52 54 52 45 45 58 4e 4f 43 41 53 45 17   LE RTREEXNOCASE.
+|   3408: 19 05 00 25 0f 17 45 4e 41 42 4c 45 20 52 54 52   ...%..ENABLE RTR
+|   3424: 45 45 58 52 54 52 49 4d 1a 18 05 00 29 0f 19 45   EEXRTRIM....)..E
+|   3440: 4e 41 42 4c 45 20 4d 45 4d 53 59 53 35 58 42 49   NABLE MEMSYS5XBI
+|   3456: 4e 41 52 59 1a 17 05 00 29 0f 19 45 4e 41 42 4c   NARY....)..ENABL
+|   3472: 45 20 4d 45 4d 53 59 53 35 58 4e 4f 43 41 53 45   E MEMSYS5XNOCASE
+|   3488: 19 16 05 00 29 0f 17 45 4e 41 42 4c 45 20 4d 45   ....)..ENABLE ME
+|   3504: 4d 53 59 53 35 58 52 54 52 49 4d 18 15 05 00 25   MSYS5XRTRIM....%
+|   3520: 0f 19 45 4e 41 42 4c 45 20 4a 53 4f 4e 31 58 42   ..ENABLE JSON1XB
+|   3536: 49 4e 41 52 59 18 14 05 00 25 0f 19 45 4e 41 42   INARY....%..ENAB
+|   3552: 4c 45 20 4a 53 4f 4e 31 58 4e 4f 43 41 53 45 17   LE JSON1XNOCASE.
+|   3568: 13 05 00 25 0f 17 45 4e 41 42 4c 45 20 4a 53 4f   ...%..ENABLE JSO
+|   3584: 4e 31 58 52 54 52 49 4d 1a 12 05 00 29 0f 19 45   N1XRTRIM....)..E
+|   3600: 4e 41 42 4c 45 20 47 45 4f 50 4f 4c 59 58 42 49   NABLE GEOPOLYXBI
+|   3616: 4e 41 52 59 1a 11 05 00 29 0f 19 45 4e 41 42 4c   NARY....)..ENABL
+|   3632: 45 20 47 45 4f 50 4f 4c 59 58 4e 4f 43 41 53 45   E GEOPOLYXNOCASE
+|   3648: 19 10 05 00 29 0f 17 45 4e 41 42 4c 45 20 47 45   ....)..ENABLE GE
+|   3664: 4f 50 4f 4c 59 58 52 54 52 49 4d 17 0f 05 00 23   OPOLYXRTRIM....#
+|   3680: 0f 19 45 4e 41 42 4c 45 20 46 54 53 35 58 42 49   ..ENABLE FTS5XBI
+|   3696: 4e 41 52 59 17 0e 05 00 23 0f 19 45 4e 41 42 4c   NARY....#..ENABL
+|   3712: 45 20 46 54 53 35 58 4e 4f 43 41 53 45 16 0d 05   E FTS5XNOCASE...
+|   3728: 00 23 0f 17 45 4e 41 42 4c 45 20 46 54 53 35 58   .#..ENABLE FTS5X
+|   3744: 52 54 52 49 4d 17 0c 05 00 23 0f 19 45 4e 41 42   RTRIM....#..ENAB
+|   3760: 4c 45 20 46 54 53 34 58 42 49 4e 41 52 59 17 0b   LE FTS4XBINARY..
+|   3776: 05 00 23 0f 19 45 4e 41 42 4c 45 20 46 54 53 34   ..#..ENABLE FTS4
+|   3792: 58 4e 4f 43 41 53 45 16 0a 05 00 23 0f 17 45 4e   XNOCASE....#..EN
+|   3808: 41 42 4c 45 20 46 54 53 34 58 52 54 52 49 4d 1e   ABLE FTS4XRTRIM.
+|   3824: 09 05 00 31 0f 19 45 4e 41 42 4c 45 20 44 42 53   ...1..ENABLE DBS
+|   3840: 54 41 54 20 56 54 41 42 58 42 49 4e 41 52 59 1e   TAT VTABXBINARY.
+|   3856: 08 05 00 31 0f 19 45 4e 41 42 4c 45 20 44 42 53   ...1..ENABLE DBS
+|   3872: 54 41 54 20 56 54 41 42 58 4e 4f 43 41 53 45 1d   TAT VTABXNOCASE.
+|   3888: 07 05 00 31 0f 17 45 4e 41 42 4c 45 20 44 42 53   ...1..ENABLE DBS
+|   3904: 54 41 54 20 56 54 41 42 58 52 54 52 49 4d 11 06   TAT VTABXRTRIM..
+|   3920: 05 00 17 0f 19 44 45 42 55 47 58 42 49 4e 41 52   .....DEBUGXBINAR
+|   3936: 59 11 05 05 00 17 0f 19 44 45 42 55 47 58 4e 4f   Y.......DEBUGXNO
+|   3952: 43 41 53 45 10 04 05 00 17 0f 17 44 45 42 55 47   CASE.......DEBUG
+|   3968: 58 52 54 52 49 4d 27 03 05 00 43 0f 19 43 4f 4d   XRTRIM'...C..COM
+|   3984: 50 49 4c 45 52 3d 67 63 63 2d 35 2e 34 2e 30 20   PILER=gcc-5.4.0 
+|   4000: 32 30 31 36 30 36 30 39 58 42 49 4e 41 52 59 27   20160609XBINARY'
+|   4016: 02 05 00 43 0f 19 43 4f 4d 50 49 4c 45 52 3d 67   ...C..COMPILER=g
+|   4032: 63 63 2d 35 2e 34 2e 30 20 32 30 31 36 30 36 30   cc-5.4.0 2016060
+|   4048: 39 58 4e 4f 43 41 53 45 26 01 05 00 43 0f 17 43   9XNOCASE&...C..C
+|   4064: 4f 4d 50 49 4c 45 52 3d 67 63 63 2d 35 2e 34 2e   OMPILER=gcc-5.4.
+|   4080: 30 20 32 30 31 36 30 36 30 39 58 52 54 52 49 4d   0 20160609XRTRIM
+| page 6 offset 20480
+|      0: 0d 00 00 00 24 0e e0 00 0f f8 0f f0 0f e8 0f e0   ....$...........
+|     16: 0f d8 0f d0 0f c8 0f c0 0f b8 0f b0 0f a8 0f a0   ................
+|     32: 0f 98 0f 90 0f 88 0f 80 0f 78 0f 70 0f 68 0f 60   .........x.p.h.`
+|     48: 0f 58 0f 50 0f 48 0f 40 0f 38 0f 30 0f 28 0f 20   .X.P.H.@.8.0.(. 
+|     64: 0f 18 0f 10 0f 08 0f 00 0e f8 0e f0 0e e8 0e e0   ................
+|   3808: 06 24 03 00 12 02 01 01 06 23 03 00 12 02 01 01   .$.......#......
+|   3824: 06 22 03 00 12 02 01 01 06 21 03 00 12 03 01 01   .........!......
+|   3840: 06 20 03 00 12 03 01 01 06 1f 03 00 12 03 01 01   . ..............
+|   3856: 06 1e 03 00 12 03 01 01 06 1d 03 00 12 03 01 01   ................
+|   3872: 06 1c 03 00 12 03 01 01 16 1b 03 00 12 02 01 01   ................
+|   3888: 06 1a 03 00 12 02 01 01 06 19 03 00 12 02 01 01   ................
+|   3904: 06 18 03 00 12 02 01 01 06 17 03 00 12 02 01 01   ................
+|   3920: 06 16 03 00 12 02 01 01 06 15 03 00 12 02 01 01   ................
+|   3936: 06 14 03 00 12 02 01 01 06 13 03 00 12 02 01 01   ................
+|   3952: 06 12 03 00 12 02 01 01 06 11 03 00 12 02 01 01   ................
+|   3968: 06 10 03 00 12 02 01 01 06 0f 03 00 12 02 01 01   ................
+|   3984: 06 0e 03 00 12 02 01 01 06 0d 03 00 12 02 01 01   ................
+|   4000: 06 0c 03 00 12 02 01 01 06 0b 03 00 12 02 01 01   ................
+|   4016: 06 0a 03 00 12 02 01 01 05 09 03 00 12 03 01 01   ................
+|   4032: 06 08 03 00 12 03 01 01 06 07 03 10 12 03 01 01   ................
+|   4048: 06 06 03 00 12 01 01 01 06 05 03 00 12 01 01 01   ................
+|   4064: 06 04 03 00 12 01 01 01 06 03 03 00 12 05 f1 01   ................
+|   4080: 06 02 03 00 12 06 01 01 06 01 03 00 12 06 01 01   ................
+| page 7 offset 24576
+|      0: 0a 00 00 00 01 0f f4 00 0f f4 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 0b 03 1b 01 76 65 72 73 69 6f 6e 04   ........version.
+| page 8 offset 28672
+|      0: 0d 00 00 00 03 0f d6 00 0f f4 0f e9 0f d6 00 00   ................
+|   4048: 00 00 00 00 00 00 11 03 02 2b 69 6e 74 65 67 72   .........+integr
+|   4064: 69 74 79 2d 63 68 65 63 6b 09 02 02 1b 72 65 62   ity-check....reb
+|   4080: 75 69 6c 64 0a 01 02 1d 6f 70 74 69 6d 69 7a 65   uild....optimize
+| end crash-fd2a1313e5b5e9.db
+}]} {}
+
+do_catchsql_test 38.1 {
+  UPDATE t1 SET b=quote(zeroblob(200)) WHERE t1 MATCH 'thread*';
+} {0 {}}
+
+#-------------------------------------------------------------------------
+reset_db
+do_test 39.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+.open --hexdb
+| size 24576 pagesize 4096 filename crash-e650fe95502908.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 00 00 00 00 06   .....@  ........
+|     32: 00 00 00 00 00 00 00 00 00 00 00 06 00 00 00 04   ................
+|     48: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00   ................
+|     96: 00 00 00 00 0d 00 00 00 06 0e 0f 00 0f aa 0f 53   ...............S
+|    112: 0e e8 0e 8b 0e 33 0e 0f 00 00 00 00 00 00 00 00   .....3..........
+|   3584: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22   ................
+|   3600: 06 06 17 11 11 01 31 74 61 62 6c 65 62 62 62 62   ......1tablebbbb
+|   3616: 06 43 52 45 41 54 45 20 54 41 42 4c 45 20 62 62   .CREATE TABLE bb
+|   3632: 28 61 29 56 05 06 17 1f 1f 01 7d 74 61 62 6c 65   (a)V.......table
+|   3648: 74 31 5f 63 6f 6e 66 69 67 74 31 5f 63 6f 6e 66   t1_configt1_conf
+|   3664: 69 67 05 43 52 45 41 54 45 20 54 41 42 4c 45 20   ig.CREATE TABLE 
+|   3680: 27 74 31 5f 63 6f 6e 66 69 67 27 28 6b 20 50 52   't1_config'(k PR
+|   3696: 49 4d 41 52 59 20 4b 45 59 2c 20 76 29 20 57 49   IMARY KEY, v) WI
+|   3712: 54 48 4f 55 54 20 52 4f 57 49 44 5b 04 07 17 21   THOUT ROWID[...!
+|   3728: 21 01 81 01 74 61 62 6c 65 74 31 5f 64 6f 63 73   !...tablet1_docs
+|   3744: 69 7a 65 74 31 5f 64 6f 63 73 69 7a 65 04 43 52   izet1_docsize.CR
+|   3760: 45 41 54 45 20 54 41 42 4c 45 20 27 74 31 5f 64   EATE TABLE 't1_d
+|   3776: 6f 63 73 69 7a 65 27 28 69 64 20 49 4e 54 45 47   ocsize'(id INTEG
+|   3792: 45 52 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20   ER PRIMARY KEY, 
+|   3808: 73 7a 20 42 4c 4f 42 29 69 03 07 17 19 19 01 81   sz BLOB)i.......
+|   3824: 2d 74 61 62 6c 65 74 31 5f 69 64 78 74 31 5f 69   -tablet1_idxt1_i
+|   3840: 64 78 03 43 52 45 41 54 45 20 54 41 42 4c 45 20   dx.CREATE TABLE 
+|   3856: 27 74 31 5f 69 64 78 27 28 73 65 67 69 64 2c 20   't1_idx'(segid, 
+|   3872: 74 65 72 6d 2c 20 70 67 6e 6f 2c 20 50 52 49 4d   term, pgno, PRIM
+|   3888: 41 52 59 20 4b 45 59 28 73 65 67 69 64 2c 20 74   ARY KEY(segid, t
+|   3904: 65 72 6d 29 29 20 57 49 54 48 4f 55 54 20 52 4f   erm)) WITHOUT RO
+|   3920: 57 49 44 55 02 07 17 1b 1b 01 81 01 74 61 62 6c   WIDU........tabl
+|   3936: 65 74 31 5f 64 61 74 61 74 31 5f 64 61 74 61 02   et1_datat1_data.
+|   3952: 43 52 45 41 54 45 20 54 41 42 4c 45 20 27 74 31   CREATE TABLE 't1
+|   3968: 5f 64 61 74 61 27 28 69 64 20 49 4e 54 45 47 45   _data'(id INTEGE
+|   3984: 52 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20 62   R PRIMARY KEY, b
+|   4000: 6c 6f 63 6b 20 42 4c 4f 42 29 54 01 07 17 11 11   lock BLOB)T.....
+|   4016: 08 81 15 74 61 62 6c 65 74 31 74 31 43 52 45 41   ...tablet1t1CREA
+|   4032: 54 45 20 56 49 52 54 55 41 4c 20 54 41 42 4c 45   TE VIRTUAL TABLE
+|   4048: 20 74 31 20 55 53 49 4e 47 20 66 74 73 35 28 61    t1 USING fts5(a
+|   4064: 2c 62 2c 70 72 65 66 69 78 3d 22 32 2c 32 2c 33   ,b,prefix=.2,2,3
+|   4080: 2c 34 22 2c 20 63 6f 6e 74 65 6e 74 3d 22 22 29   ,4., content=..)
+| page 2 offset 4096
+|      0: 0d 0b 6a 00 37 09 4c 02 0f e7 09 4c 0f c6 0f a4   ..j.7.L....L....
+|     16: 0f 88 0f 6d 0f 4b 0f 2c 0f 0e 0e ec 0e cd 0e ad   ...m.K.,........
+|     32: 0e 8e 0e 6c 0e 4b 0e 29 0e 08 0d e6 0d c4 0d b5   ...l.K.)........
+|     48: 0d 97 0d 76 0d 54 0d 31 0d 15 0c f3 0c d3 0c b5   ...v.T.1........
+|     64: 0c 95 0c 73 0c 54 0c 32 0c 10 0b ee 0b cc 0b b0   ...s.T.2........
+|     80: 0b 8d 0b 7e 0b 48 0b 2e 0b 0b 0a ef 0a cc 0a ad   ...~.H..........
+|     96: 0a 8c 0a 6d 0a 4d 0a 2b 0a 0c 09 ec 09 ca 09 a8   ...m.M.+........
+|    112: 09 86 09 63 0f f1 00 00 00 00 00 00 00 00 00 00   ...c............
+|   2368: 00 00 00 00 00 00 00 00 00 00 00 00 15 0a 03 00   ................
+|   2384: 30 00 00 00 01 01 03 35 00 03 01 01 12 02 01 12   0......5........
+|   2400: 03 01 11 1c 8c 80 80 80 80 10 03 00 3e 00 00 00   ............>...
+|   2416: 17 01 05 05 34 74 61 62 6c 03 02 03 01 04 77 68   ....4tabl.....wh
+|   2432: 65 72 03 02 06 09 1b 8c 80 80 80 80 0f 03 00 3c   er.............<
+|   2448: 00 00 00 16 05 34 66 74 73 34 03 02 02 01 04 6e   .....4fts4.....n
+|   2464: 75 6d 62 03 06 01 04 09 1b 8c 80 80 80 80 0e 03   umb.............
+|   2480: 00 3c 00 00 00 16 04 33 74 68 65 03 06 01 01 04   .<.....3the.....
+|   2496: 01 03 77 68 65 03 02 04 04 0a 1b 8c 80 80 80 80   ..whe...........
+|   2512: 0d 03 00 3c 00 00 00 16 04 33 6e 75 6d 03 06 01   ...<.....3num...
+|   2528: 01 05 01 03 74 61 62 03 02 03 04 0a 19 8c 80 80   ....tab.........
+|   2544: 80 80 0c 03 00 38 00 00 00 14 03 32 77 68 03 02   .....8.....2wh..
+|   2560: 04 00 04 33 66 74 73 03 02 02 04 07 18 8c 80 80   ...3fts.........
+|   2576: 80 80 0b 03 00 36 00 00 00 13 03 32 74 61 03 02   .....6.....2ta..
+|   2592: 03 02 01 68 03 06 01 01 04 04 07 1b 8c 80 80 80   ...h............
+|   2608: 80 0a 03 00 3c 00 00 00 16 03 32 6e 75 03 06 01   ....<.....2nu...
+|   2624: 01 05 01 02 6f 66 03 06 01 01 06 04 09 19 8c 80   ....of..........
+|   2640: 80 80 80 09 03 00 38 00 00 00 14 03 32 66 74 03   ......8.....2ft.
+|   2656: 02 02 01 02 69 73 03 06 01 01 03 04 07 18 8c 80   ....is..........
+|   2672: 80 80 80 08 03 00 36 00 00 00 13 02 31 74 03 08   ......6.....1t..
+|   2688: 03 01 01 04 01 01 77 03 02 04 04 09 1a 8c 80 80   ......w.........
+|   2704: 80 80 07 03 00 3a ff 00 00 15 02 31 6e 03 08 01   .....:.....1n...
+|   2720: 01 02 05 01 01 6f 03 06 01 01 06 04 09 18 8c 80   .....o..........
+|   2736: 80 80 80 06 03 00 36 00 00 00 13 04 02 31 66 03   ......6......1f.
+|   2752: 02 02 01 01 69 03 06 01 01 03 05 06 1c 8c 80 80   ....i...........
+|   2768: 80 80 05 03 00 3e 00 00 00 17 04 30 74 68 65 03   .....>.....0the.
+|   2784: 06 00 f1 04 01 05 77 68 65 72 65 03 02 04 0a 15   ......where.....
+|   2800: 8c 80 80 80 80 04 03 00 30 00 00 00 11 01 01 06   ........0.......
+|   2816: 06 30 74 61 62 6c 65 03 02 03 07 1c 8c 80 80 80   .0table.........
+|   2832: 80 03 03 00 3e 00 00 00 17 07 30 6e 75 6d 62 65   ....>.....0numbe
+|   2848: 72 03 06 01 01 05 01 02 6f 66 03 06 04 0d 13 8c   r.......of......
+|   2864: 80 80 80 80 02 03 00 2c 00 00 00 0f 01 01 03 02   .......,........
+|   2880: 30 6e 03 06 01 01 02 07 1b 8c 80 80 80 80 01 03   0n..............
+|   2896: 00 3c 00 00 00 16 08 30 66 74 73 34 61 75 78 03   .<.....0fts4aux.
+|   2912: 02 02 01 02 69 73 03 06 04 0c 00 00 00 14 2a 00   ....is........*.
+|   2928: 00 00 01 01 02 24 00 02 01 01 12 02 01 12 08 88   .....$..........
+|   2944: 80 80 80 80 12 03 00 16 00 00 00 05 02 1c 88 80   ................
+|   2960: 80 80 80 11 03 00 3e 00 00 00 17 05 34 72 6f 77   ......>.....4row
+|   2976: 73 02 06 01 01 05 01 04 74 68 65 72 02 02 04 0b   s.......ther....
+|   2992: 15 88 80 80 80 80 10 03 00 30 00 00 00 11 02 01   .........0......
+|   3008: 01 07 05 34 62 65 74 77 02 02 04 08 1b 88 80 80   ...4betw........
+|   3024: 80 80 0f 03 00 3c 00 00 00 16 04 04 33 72 6f 77   .....<......3row
+|   3040: 02 06 01 01 05 01 03 74 68 65 02 08 05 0a 1b 88   .......the......
+|   3056: 80 80 80 80 0e 03 00 3c 00 00 00 16 01 01 02 04   .......<........
+|   3072: 33 61 72 65 02 02 03 01 03 62 65 74 02 02 07 08   3are.....bet....
+|   3088: 1b 88 80 80 80 80 0d 03 00 3c 00 00 00 16 03 32   .........<.....2
+|   3104: 74 68 02 08 02 01 01 07 00 04 33 61 6e 64 02 06   th........3and..
+|   3120: 04 0a 1b 88 80 80 80 80 0c 03 00 3c 00 00 00 16   ...........<....
+|   3136: 03 32 69 6e 02 06 01 01 06 01 02 72 6f 02 06 01   .2in.......ro...
+|   3152: 01 05 04 09 18 88 80 80 80 80 0b 03 00 36 00 00   .............6..
+|   3168: 00 13 02 03 32 61 72 02 02 03 01 02 62 65 02 02   ....2ar.....be..
+|   3184: 04 05 07 1b 88 80 80 80 80 0a 03 00 3c 00 00 00   ............<...
+|   3200: 16 02 31 74 02 08 02 01 01 07 00 03 32 61 6e 02   ..1t........2an.
+|   3216: 06 01 01 04 09 19 88 80 80 80 80 09 03 00 38 00   ..............8.
+|   3232: 00 00 14 02 31 6e 02 06 01 01 03 01 01 72 02 06   ....1n.......r..
+|   3248: 01 01 05 04 08 17 88 80 80 80 80 08 03 00 34 00   ..............4.
+|   3264: 00 00 12 02 31 62 02 02 04 01 01 69 02 06 01 01   ....1b.....i....
+|   3280: 06 04 06 19 88 80 80 80 80 07 03 00 38 00 00 00   ............8...
+|   3296: 14 04 02 31 32 02 02 05 01 01 61 02 08 03 01 01   ...12.....a.....
+|   3312: 02 05 06 1b 88 80 80 80 80 06 03 00 3c 00 00 00   ............<...
+|   3328: 16 06 30 74 68 65 72 65 02 02 02 00 02 31 31 02   ..0there.....11.
+|   3344: 06 01 01 04 0a 15 88 80 80 80 80 05 03 00 30 00   ..............0.
+|   3360: 00 00 11 01 01 05 04 30 74 68 65 02 06 01 01 07   .......0the.....
+|   3376: 07 1c 88 80 80 80 80 04 03 00 3e 00 00 00 17 01   ..........>.....
+|   3392: 01 06 02 30 6e 02 06 01 01 03 01 04 72 6f 77 73   ...0n.......rows
+|   3408: 02 06 07 08 1b 88 80 80 80 80 03 03 00 3c 00 00   .............<..
+|   3424: 00 16 08 30 62 65 74 77 65 65 6e 02 02 04 01 02   ...0between.....
+|   3440: 69 6e 02 06 04 0c 1a 88 80 80 80 80 02 03 00 3a   in.............:
+|   3456: 00 00 00 15 04 30 61 6e 64 02 06 01 01 02 02 02   .....0and.......
+|   3472: 72 65 02 02 03 04 0a 17 88 80 80 80 80 01 03 00   re..............
+|   3488: 34 00 00 00 12 02 30 31 02 06 01 01 04 01 01 32   4.....01.......2
+|   3504: 02 02 05 04 08 08 84 80 80 80 81 12 03 00 16 00   ................
+|   3520: 00 00 05 04 1b 84 61 80 80 80 11 03 00 3c 00 00   ......a......<..
+|   3536: 00 16 05 34 74 61 62 6c 01 06 01 01 05 02 03 65   ...4tabl.......e
+|   3552: 72 6d 01 02 04 0b 1b 84 80 80 80 80 10 03 00 3c   rm.............<
+|   3568: 00 00 00 16 05 34 65 61 63 68 01 02 03 01 04 70   .....4each.....p
+|   3584: 72 65 73 01 02 05 04 09 1a 84 80 80 80 80 0f 03   res.............
+|   3600: 00 3a 00 00 00 15 04 33 74 65 72 01 02 04 02 02   .:.....3ter.....
+|   3616: 68 65 01 06 01 01 03 04 08 1b 84 80 80 80 80 0e   he..............
+|   3632: 03 00 3c 00 00 00 16 04 33 70 72 65 01 02 05 01   ..<.....3pre....
+|   3648: 03 74 61 62 01 06 01 01 05 04 08 1a 84 80 80 80   .tab............
+|   3664: 80 0d 03 00 3a 00 00 00 15 04 33 66 6f 72 01 02   ....:.....3for..
+|   3680: 02 02 02 74 73 01 06 01 01 04 04 08 1b 84 80 80   ...ts...........
+|   3696: 80 80 0c 03 00 3c 00 00 00 16 03 32 74 68 01 06   .....<.....2th..
+|   3712: 01 01 03 00 04 33 65 61 63 01 02 03 04 09 18 84   .....3eac.......
+|   3728: 80 80 80 80 0b 03 00 36 00 00 00 13 03 32 74 71   .......6.....2tq
+|   3744: 01 06 01 01 05 02 01 65 01 02 04 04 09 19 84 80   .......e........
+|   3760: 80 80 80 0a 03 00 38 00 00 00 14 03 32 69 6e 01   ......8.....2in.
+|   3776: 06 01 01 02 01 02 70 72 01 02 05 0b 89 18 84 80   ......pr........
+|   3792: 80 80 80 09 03 00 36 00 00 00 13 03 32 66 6f 01   ......6.....2fo.
+|   3808: 02 02 02 01 74 01 06 01 01 04 04 07 1b 84 80 80   ....t...........
+|   3824: 80 80 08 03 00 3c 00 00 00 16 02 31 74 01 0a 04   .....<.....1t...
+|   3840: 01 01 03 04 00 03 32 65 61 01 02 03 04 0a 17 84   ......2ea.......
+|   3856: 80 80 80 80 07 03 00 34 00 00 00 12 02 31 69 01   .......4.....1i.
+|   3872: 06 01 01 02 01 01 70 01 02 05 04 08 18 84 80 80   ......p.........
+|   3888: 80 80 06 03 00 36 00 00 00 13 02 31 65 01 02 03   .....6.....1e...
+|   3904: 01 01 66 01 08 02 01 01 04 04 06 1b 84 80 80 80   ..f.............
+|   3920: 80 05 03 00 3c 00 00 00 16 05 30 74 65 72 6d 01   ....<.....0term.
+|   3936: 02 04 02 02 68 65 01 06 01 01 03 04 09 14 84 80   ....he..........
+|   3952: 80 80 80 04 03 00 2e 00 00 00 10 06 30 74 61 62   ............0tab
+|   3968: 6c 65 01 06 01 01 05 04 15 84 80 80 80 80 03 03   le..............
+|   3984: 00 30 00 00 00 11 02 08 30 70 72 65 73 65 6e 74   .0......0present
+|   4000: 01 02 05 05 1b 84 80 80 80 80 02 03 00 3c 00 00   .............<..
+|   4016: 00 16 04 30 66 74 73 01 06 01 01 04 01 02 69 6e   ...0fts.......in
+|   4032: 01 06 01 01 04 0a 1a 84 80 80 80 80 01 03 00 3a   ...............:
+|   4048: 00 00 00 15 05 30 65 61 63 f4 01 02 03 01 03 66   .....0eac......f
+|   4064: 6f 72 01 02 02 04 09 06 01 03 00 12 03 0b 0f 00   or..............
+|   4080: 00 08 8c 80 80 80 80 11 03 00 16 00 00 00 05 04   ................
+| page 3 offset 8192
+|      0: 0a 00 00 00 32 0e 4f 00 0f fa 0f f1 0f e9 0f e1   ....2.O.........
+|     16: 0f d8 0f d1 0f c9 0f c1 0f b9 0f b1 0f a9 0f a0   ................
+|     32: 0f 98 0f 90 0f 87 0f 80 0f 78 0f 71 0f 68 0f 5f   .........x.q.h._
+|     48: 0f 56 0f 4d 0f 41 0f 38 0f 2f 0f 26 0f 1d 0f 13   .V.M.A.8./.&....
+|     64: 0f 0a 0f 01 0e f7 0e ee 0e e6 0e dd 0e d6 0e cd   ................
+|     80: 0e c3 0e ba 0e b0 0e a8 0e 9f 0e 96 0e 8e 0e 85   ................
+|     96: 0e 7c 0e 73 0e 6a 0e 60 0e 58 0e 4f 00 00 00 00   .|.s.j.`.X.O....
+|   3648: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08   ................
+|   3664: 04 01 10 01 03 34 74 20 07 04 01 0e 01 03 34 1e   .....4t ......4.
+|   3680: 09 04 01 12 01 03 33 74 68 1c 08 04 01 10 01 03   ......3th.......
+|   3696: 33 6e 1a 08 04 01 10 01 03 32 77 18 08 04 01 10   3n.......2w.....
+|   3712: 01 03 32 74 16 08 04 01 10 01 03 32 6e 14 07 04   ..2t.......2n...
+|   3728: 01 0e 01 03 32 12 08 04 01 10 01 03 31 74 10 08   ....2.......1t..
+|   3744: 04 01 10 01 03 31 6e 0e 07 04 01 0e 01 03 31 0c   .....1n.......1.
+|   3760: 09 04 01 12 01 03 30 74 68 0a 08 04 01 10 01 03   ......0th.......
+|   3776: 30 74 08 09 04 01 12 01 03 30 6e 75 06 08 04 01   0t.......0nu....
+|   3792: 10 01 03 30 6e 04 06 04 01 0c 01 03 02 08 04 01   ...0n...........
+|   3808: 10 01 02 34 72 22 07 04 01 0e 01 02 34 20 08 04   ...4r.......4 ..
+|   3824: 01 10 01 02 33 72 1e 09 04 01 12 01 02 33 61 72   ....3r.......3ar
+|   3840: 1c 08 04 01 10 01 02 32 74 1a 08 04 01 10 b3 02   .......2t.......
+|   3856: 32 69 18 09 04 01 12 01 02 32 61 72 16 08 04 01   2i.......2ar....
+|   3872: 10 01 02 31 74 14 08 04 01 10 01 02 31 6e 12 08   ...1t.......1n..
+|   3888: 04 01 10 01 02 31 62 10 08 04 01 10 01 02 31 32   .....1b.......12
+|   3904: 0e 0b 04 01 16 01 02 30 74 68 65 72 0c 08 04 01   .......0ther....
+|   3920: 10 01 02 30 74 0a 08 04 01 10 01 02 30 6e 08 08   ...0t.......0n..
+|   3936: 04 01 10 01 02 30 62 06 08 04 01 10 01 02 30 61   .....0b.......0a
+|   3952: 05 06 04 01 0c 01 02 02 07 04 09 10 01 34 74 22   .............4t.
+|   3968: 06 04 09 0e 01 34 20 08 04 09 12 01 33 74 65 1e   .....4 .....3te.
+|   3984: 07 04 09 10 01 33 70 1c 07 04 09 10 01 33 66 1a   .....3p......3f.
+|   4000: 08 04 09 12 01 32 74 68 18 07 04 09 10 01 32 2d   .....2th......2-
+|   4016: 16 07 04 09 10 01 32 69 14 07 04 09 10 01 32 66   ......2i......2f
+|   4032: 12 07 04 09 10 01 31 74 10 07 04 09 10 01 31 69   ......1t......1i
+|   4048: 0e 06 04 09 0e 01 31 0c 08 04 09 12 01 30 74 65   ......1......0te
+|   4064: 0a 07 04 09 10 01 30 74 08 07 04 09 10 01 30 70   ......0t......0p
+|   4080: 06 08 04 09 12 01 30 66 74 04 05 04 09 0c 01 02   ......0ft.......
+| page 4 offset 12288
+|      0: 0d 00 00 00 03 0f eb 00 0f f9 0f f2 0f eb 00 00   ................
+|   4064: 00 00 00 00 00 00 00 00 00 00 00 05 03 03 00 10   ................
+|   4080: 03 05 05 02 03 00 10 04 06 05 01 03 00 10 04 03   ................
+| page 5 offset 16384
+|      0: 0a 00 00 00 02 0f eb 00 0f eb 0f f4 00 00 00 00   ................
+|   4064: 00 00 00 00 00 00 00 00 00 00 00 08 03 15 01 70   ...............p
+|   4080: 67 73 7a 18 0b 03 1b 01 76 65 72 73 69 6f 6e 04   gsz.....version.
+| page 6 offset 20480
+|      0: 0d 00 00 00 03 0f f2 00 0f fc 0f f7 0f f2 00 00   ................
+|   4080: 00 00 03 03 02 01 03 03 02 02 01 02 02 01 02 09   ................
+| end crash-e650fe95502908.db
+}]} {}
+
+do_execsql_test 39.1 {
+  SELECT rowid FROM t1('t*');
+} {1 2 3}
+
+#-------------------------------------------------------------------------
+reset_db
+do_test 40.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+.open --hexdb
+| size 24576 pagesize 4096 filename crash2.txt.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 00 00 00 00 06   .....@  ........
+|     32: 00 00 00 00 00 00 00 00 00 00 00 06 00 00 00 04   ................
+|     48: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00   ................
+|     96: 00 00 00 00 0d 00 00 00 06 0e 0f 00 0f aa 0f 53   ...............S
+|    112: 0e e8 0e 8b 0e 33 0e 0f 00 00 00 00 00 00 00 00   .....3..........
+|   3584: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22   ................
+|   3600: 06 06 17 11 11 01 31 74 61 62 6c 65 62 62 62 62   ......1tablebbbb
+|   3616: 06 43 52 45 41 54 45 20 54 41 42 4c 45 20 62 62   .CREATE TABLE bb
+|   3632: 28 61 29 56 05 06 17 1f 1f 01 7d 74 61 52 6c 65   (a)V.......taRle
+|   3648: 74 31 5f 63 6f 6e 66 69 67 74 31 5f 63 6f 6e 66   t1_configt1_conf
+|   3664: 69 67 05 43 52 45 41 54 45 20 54 41 42 4c 45 20   ig.CREATE TABLE 
+|   3680: 27 74 31 5f 63 6f 6e 66 69 67 27 28 6b 20 50 52   't1_config'(k PR
+|   3696: 49 4d 41 52 59 20 4b 45 59 2c 20 76 29 20 57 49   IMARY KEY, v) WI
+|   3712: 54 48 4f 55 54 20 52 4f 57 49 44 5b 04 07 17 21   THOUT ROWID[...!
+|   3728: 21 01 81 01 74 61 62 6c 65 74 31 5f 64 6f 73 73   !...tablet1_doss
+|   3744: 69 7a 65 74 31 5f 64 6f 63 73 69 7a 65 04 43 52   izet1_docsize.CR
+|   3760: 45 41 54 45 20 54 41 42 4c 45 20 27 74 31 5f 64   EATE TABLE 't1_d
+|   3776: 6f 63 73 69 7a 65 27 28 69 64 20 49 4e 54 45 47   ocsize'(id INTEG
+|   3792: 45 52 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20   ER PRIMARY KEY, 
+|   3808: 73 7a 20 42 4c 4f 42 29 69 03 07 17 19 19 01 81   sz BLOB)i.......
+|   3824: 2d 74 61 62 6c 65 74 31 5f 69 64 78 74 31 5f 69   -tablet1_idxt1_i
+|   3840: 64 78 03 43 52 45 41 54 45 20 54 41 42 4c 45 20   dx.CREATE TABLE 
+|   3856: 27 74 31 5f 69 64 78 27 28 73 65 67 69 64 2c 20   't1_idx'(segid, 
+|   3872: 74 65 72 6d 2c 20 70 67 6e 6f 2c 20 50 52 49 4d   term, pgno, PRIM
+|   3888: 41 52 59 20 4b 45 59 28 73 65 67 69 64 2c 20 74   ARY KEY(segid, t
+|   3904: 65 72 6d 29 29 20 57 49 54 48 4f 55 54 20 52 4f   erm)) WITHOUT RO
+|   3920: 57 49 44 55 02 07 17 1b 1b 01 81 01 74 61 62 6c   WIDU........tabl
+|   3936: 65 74 31 5f 64 61 74 61 74 31 5f 64 61 74 61 02   et1_datat1_data.
+|   3952: 43 52 45 41 54 45 20 54 41 42 4c 45 20 27 74 31   CREATE TABLE 't1
+|   3968: 5f 64 61 74 61 27 28 69 64 20 49 4e 54 45 47 45   _data'(id INTEGE
+|   3984: 52 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20 62   R PRIMARY KEY, b
+|   4000: 6c 6f 63 6b 20 42 4c 4f 42 29 54 01 07 17 11 11   lock BLOB)T.....
+|   4016: 08 81 15 74 61 62 6c 65 74 31 74 31 43 52 45 41   ...tablet1t1CREA
+|   4032: 54 45 20 56 49 52 54 55 41 4c 20 54 41 42 4c 45   TE VIRTUAL TABLE
+|   4048: 20 74 31 20 55 53 49 4e 47 20 66 74 73 35 28 61    t1 USING fts5(a
+|   4064: 2c 62 2c 70 72 65 66 69 78 3d 22 31 2c 32 2c 33   ,b,prefix=.1,2,3
+|   4080: 2c 34 22 2c 20 63 6f 6e 74 65 6e 74 3d 22 22 29   ,4., content=..)
+| page 2 offset 4096
+|      0: 0d 0b 6a 00 37 09 4c 02 0f e7 09 4c 0f c6 0f a4   ..j.7.L....L....
+|     16: 0f 88 0f 6d 0f 4b 0f 2c 0f 0e 0e ec 0e cd 0e ad   ...m.K.,........
+|     32: 0e 8e 0e 6c 0e 4b 0e 29 0e 08 0d e6 0d c4 0d b5   ...l.K.)........
+|     48: 0d 97 0d 76 0d 54 0d 31 0d 15 0c f3 0c d3 0c b5   ...v.T.1........
+|     64: 0c 95 0c 73 0c 54 0c 32 0c 10 0b ee 0b cc 0b b0   ...s.T.2........
+|     80: 0b 8d 0b 7e 0b 48 0b 2e 0b 0b 0a ef 0a cc 0a ad   ...~.H..........
+|     96: 0a 8c 0a 6d 0a 4d 0a 2b 0a 0c 09 ec 09 ca 09 a8   ...m.M.+........
+|    112: 09 86 09 63 0f f1 00 00 00 00 00 00 00 00 00 00   ...c............
+|   2368: 00 00 00 00 00 00 00 00 00 00 00 00 15 0a 03 00   ................
+|   2384: 30 00 00 00 01 01 03 35 00 03 01 01 12 02 01 12   0......5........
+|   2400: 03 01 11 1c 8c 80 80 80 80 10 03 00 3e 00 00 00   ............>...
+|   2416: 17 01 05 05 34 74 61 62 6c 03 02 03 01 04 77 68   ....4tabl.....wh
+|   2432: 65 72 03 02 06 09 1b 8c 80 80 80 80 0f 03 00 3c   er.............<
+|   2448: 00 00 00 16 05 34 66 75 73 34 03 02 02 01 04 6e   .....4fus4.....n
+|   2464: 75 6d 62 03 06 01 04 09 1b 8c 80 80 80 80 0e 03   umb.............
+|   2480: 00 3c 00 00 00 16 04 33 74 68 65 03 06 01 01 04   .<.....3the.....
+|   2496: 01 03 77 68 65 03 02 04 04 0a 1b 8c 80 80 80 80   ..whe...........
+|   2512: 0d 03 00 3c 00 00 00 16 04 33 6e 75 6d 03 06 01   ...<.....3num...
+|   2528: 01 05 01 03 74 61 62 05 62 03 04 0a 19 8c 80 80   ....tab.b.......
+|   2544: 80 80 0c 03 00 38 00 00 00 14 03 32 77 68 03 02   .....8.....2wh..
+|   2560: 04 00 04 33 66 74 73 03 02 02 04 07 18 8c 80 80   ...3fts.........
+|   2576: 80 80 0b 03 00 36 00 00 00 13 03 32 74 61 03 02   .....6.....2ta..
+|   2592: 03 02 01 68 03 06 01 01 04 04 07 1b 8c 80 80 80   ...h............
+|   2608: 80 0a 03 00 3c 00 00 00 16 03 32 6e 75 03 06 01   ....<.....2nu...
+|   2624: 01 05 01 02 6f 66 03 06 01 01 06 04 09 19 8c 80   ....of..........
+|   2640: 80 80 80 09 03 00 38 00 00 00 14 03 32 66 74 03   ......8.....2ft.
+|   2656: 02 02 01 02 69 73 03 06 01 01 03 04 07 18 8c 80   ....is..........
+|   2672: 80 80 80 08 03 00 36 00 00 00 13 02 31 74 03 08   ......6.....1t..
+|   2688: 03 01 01 04 01 01 77 03 02 04 04 09 1a 8c 80 80   ......w.........
+|   2704: 80 80 07 03 00 3a ff 00 00 15 02 31 6e 03 08 01   .....:.....1n...
+|   2720: 01 02 05 01 01 6f 03 06 01 01 06 04 09 18 8c 80   .....o..........
+|   2736: 80 80 80 06 03 00 36 00 00 00 13 04 02 31 66 03   ......6......1f.
+|   2752: 02 02 01 01 69 03 06 01 01 03 05 06 1c 8c 80 80   ....i...........
+|   2768: 80 80 05 03 00 3e 00 00 00 17 04 30 74 68 65 03   .....>.....0the.
+|   2784: 06 01 01 04 01 05 77 68 65 72 65 03 02 04 0a 15   ......where.....
+|   2800: 8c 80 80 80 80 04 03 00 30 00 00 00 11 01 01 06   ........0.......
+|   2816: 06 30 74 61 62 6c 65 03 02 03 07 1c 8c 80 80 80   .0table.........
+|   2832: 80 03 03 00 3e 00 00 00 17 07 30 6e 75 6d 62 65   ....>.....0numbe
+|   2848: 72 03 06 01 01 05 01 02 6f 66 03 06 04 0d 13 8c   r.......of......
+|   2864: 80 80 80 80 02 03 00 2c 00 00 00 0f 01 01 03 02   .......,........
+|   2880: 30 6e 03 06 01 01 02 07 1b 8c 80 80 80 80 01 03   0n..............
+|   2896: 00 3c 00 00 00 16 08 30 66 74 73 34 61 75 78 03   .<.....0fts4aux.
+|   2912: 02 02 01 02 69 73 03 06 04 0c 00 00 00 14 2a 00   ....is........*.
+|   2928: 00 00 01 01 02 24 00 02 01 01 12 02 01 12 08 88   .....$..........
+|   2944: 80 80 80 80 11 03 00 16 00 00 00 05 02 1c 88 80   ................
+|   2960: 80 80 80 11 03 00 3e 00 00 00 17 05 34 72 6f 77   ......>.....4row
+|   2976: 73 02 06 01 01 05 01 04 74 68 65 72 02 02 04 0b   s.......ther....
+|   2992: 15 88 80 80 80 80 10 03 00 30 00 00 00 11 02 01   .........0......
+|   3008: 01 07 05 34 62 65 74 77 02 02 04 08 1b 88 80 80   ...4betw........
+|   3024: 80 80 0f 03 00 3c 00 00 00 16 04 04 33 72 6f 77   .....<......3row
+|   3040: 02 06 01 01 05 01 03 74 68 65 02 08 05 0a 1b 88   .......the......
+|   3056: 80 80 80 80 0e 03 00 3c 00 00 00 16 02 01 02 04   .......<........
+|   3072: 33 61 72 65 02 02 03 01 03 62 65 74 02 02 07 08   3are.....bet....
+|   3088: 1b 88 80 80 80 80 0d 03 00 3c 00 00 00 16 03 32   .........<.....2
+|   3104: 74 68 02 08 02 01 01 07 00 04 33 61 6e 64 02 06   th........3and..
+|   3120: 04 0a 1b 88 80 80 80 80 0c 03 00 3c 00 00 00 16   ...........<....
+|   3136: 03 32 69 6e 02 06 01 01 06 01 02 72 6f 02 06 01   .2in.......ro...
+|   3152: 01 05 04 09 18 88 80 80 80 80 0b 03 00 36 00 00   .............6..
+|   3168: 00 13 02 03 32 61 72 02 02 03 01 02 62 65 02 02   ....2ar.....be..
+|   3184: 04 05 07 1b 88 80 80 80 80 0a 03 00 3c 00 00 00   ............<...
+|   3200: 16 02 31 74 02 08 02 01 01 07 00 03 32 61 6e 02   ..1t........2an.
+|   3216: 06 01 01 04 09 19 88 80 80 80 80 09 03 00 38 00   ..............8.
+|   3232: 00 00 14 02 31 6e 02 06 01 01 03 01 01 72 02 06   ....1n.......r..
+|   3248: 01 01 05 04 08 17 88 80 80 80 80 08 03 00 34 00   ..............4.
+|   3264: 00 00 12 02 31 62 02 02 04 01 01 69 02 06 01 01   ....1b.....i....
+|   3280: 06 04 06 19 88 80 80 80 80 07 03 00 38 00 00 00   ............8...
+|   3296: 14 04 02 31 32 02 02 05 01 01 61 02 08 03 01 01   ...12.....a.....
+|   3312: 02 05 06 1b 88 80 80 80 80 06 03 00 3c 00 00 00   ............<...
+|   3328: 16 06 30 74 68 65 72 65 02 02 02 00 02 31 31 02   ..0there.....11.
+|   3344: 06 01 01 04 0a 15 88 80 80 80 80 05 03 00 30 00   ..............0.
+|   3360: 00 00 11 01 01 05 04 30 74 68 65 02 06 01 01 07   .......0the.....
+|   3376: 07 1c 88 80 80 80 80 04 03 00 3e 00 00 00 17 01   ..........>.....
+|   3392: 01 06 02 30 6e 02 06 01 01 03 01 04 72 6f 77 73   ...0n.......rows
+|   3408: 02 06 07 08 1b 88 80 80 80 80 03 03 00 3c 00 00   .............<..
+|   3424: 00 16 08 30 62 65 74 77 65 65 6e 02 02 04 01 02   ...0between.....
+|   3440: 69 6e 02 06 04 0c 1a 88 80 80 80 80 02 03 00 3a   in.............:
+|   3456: 00 00 00 15 04 30 61 6e 64 02 06 01 01 02 02 02   .....0and.......
+|   3472: 72 65 02 02 03 04 0a 17 88 80 80 80 80 01 03 00   re..............
+|   3488: 34 00 00 00 12 02 30 31 02 06 01 01 04 01 01 32   4.....01.......2
+|   3504: 02 02 06 04 08 08 84 80 80 80 80 12 03 00 16 00   ................
+|   3520: 00 00 05 04 1b 84 80 80 80 80 11 03 00 3c 00 00   .............<..
+|   3536: 00 16 05 34 74 61 62 6c 01 06 01 01 05 02 03 65   ...4tabl.......e
+|   3552: 72 6d 01 02 04 0b 1b 84 80 80 80 80 10 03 00 3c   rm.............<
+|   3568: 00 00 00 16 05 34 65 61 63 68 01 02 03 01 04 70   .....4each.....p
+|   3584: 72 65 73 01 02 05 04 09 1a 84 80 80 80 80 0f 03   res.............
+|   3600: 00 3a 00 00 00 15 04 33 74 65 72 01 02 04 02 02   .:.....3ter.....
+|   3616: 68 65 01 06 01 01 03 04 08 1b 84 80 80 80 80 0e   he..............
+|   3632: 03 00 3c 00 00 00 16 04 33 70 72 65 01 02 05 01   ..<.....3pre....
+|   3648: 03 74 61 62 01 06 01 01 05 04 08 1a 84 80 80 80   .tab............
+|   3664: 80 0d 03 00 3a 00 00 00 15 04 33 66 6f 72 01 02   ....:.....3for..
+|   3680: 02 02 02 74 73 01 06 01 01 04 04 08 1b 84 80 80   ...ts...........
+|   3696: 80 80 0c 03 00 3c 00 00 00 16 03 32 74 68 01 06   .....<.....2th..
+|   3712: 01 01 03 00 04 33 65 61 63 01 02 03 04 09 18 84   .....3eac.......
+|   3728: 80 80 80 80 0b 03 00 36 00 00 00 13 03 32 74 61   .......6.....2ta
+|   3744: 01 06 01 01 05 02 01 65 01 02 04 04 09 19 84 80   .......e........
+|   3760: 80 80 80 0a 03 00 38 00 00 00 14 03 32 69 6e 01   ......8.....2in.
+|   3776: 06 01 01 02 01 02 70 72 01 02 05 04 09 18 84 80   ......pr........
+|   3792: 80 80 80 09 03 00 36 00 00 00 13 03 32 66 6f 01   ......6.....2fo.
+|   3808: 02 02 02 01 74 01 06 01 01 04 04 07 1b 84 80 80   ....t...........
+|   3824: 80 80 08 03 00 3c 00 00 00 16 02 31 74 01 0a 04   .....<.....1t...
+|   3840: 01 01 03 04 00 03 32 65 61 01 02 03 04 0a 17 84   ......2ea.......
+|   3856: 80 80 80 80 07 03 00 34 00 00 00 12 02 31 69 01   .......4.....1i.
+|   3872: 06 01 01 02 01 01 70 01 02 05 04 08 18 84 80 80   ......p.........
+|   3888: 80 80 06 03 00 36 00 00 00 13 02 31 65 01 02 03   .....6.....1e...
+|   3904: 01 01 66 01 08 02 01 01 04 04 06 1b 84 80 80 80   ..f.............
+|   3920: 80 05 03 00 3c 00 00 00 16 05 30 74 65 72 6d 01   ....<.....0term.
+|   3936: 02 04 02 02 68 65 01 06 01 01 03 04 09 14 84 80   ....he..........
+|   3952: 80 80 80 04 03 00 2e 00 00 00 10 06 30 74 61 62   ............0tab
+|   3968: 6c 65 01 06 00 01 05 04 15 84 80 80 80 80 03 03   le..............
+|   3984: 00 30 00 00 00 11 02 08 30 70 72 65 73 65 6e 74   .0......0present
+|   4000: 01 02 05 05 1b 84 80 80 80 80 02 03 00 3c 00 00   .............<..
+|   4016: 00 16 04 30 66 74 73 01 06 01 01 04 01 02 69 6e   ...0fts.......in
+|   4032: 01 06 01 01 04 0a 1a 84 80 80 80 80 01 03 00 3a   ...............:
+|   4048: 00 00 00 15 05 30 65 61 63 68 01 02 03 01 03 66   .....0each.....f
+|   4064: 6f 72 01 02 02 04 09 06 01 03 00 12 03 0b 0f 00   or..............
+|   4080: 00 08 8c 80 80 80 80 11 03 00 16 00 00 00 05 04   ................
+| page 3 offset 8192
+|      0: 0a 00 00 00 32 0e 4f 00 0f fa 10 f1 0f e9 0f e1   ....2.O.........
+|     16: 0f d8 0f d1 0f c9 0f c1 0f b9 0f b1 0f a9 0f a0   ................
+|     32: 0f 98 0f 90 0f 87 0f 80 0f 78 0f 71 0f 68 0f 5f   .........x.q.h._
+|     48: bd 56 0f 4d 0f 41 0f 38 0f 2f 0f 26 0f 1d 0f 13   .V.M.A.8./.&....
+|     64: 0f 0a 0f 01 0e f7 0e ee 0e e6 0e dd 0e d6 0e cd   ................
+|     80: 0e c3 0e ba 0e b0 0e a8 0e 9f 0e 96 0e 8e 0e 85   ................
+|     96: 0e 7c 0e 73 0e 6a 0e 60 0e 58 0e 4f 00 00 00 00   .|.s.j.`.X.O....
+|   3648: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08   ................
+|   3664: 04 01 10 01 03 34 74 20 07 04 01 0e 01 03 34 1e   .....4t ......4.
+|   3680: 09 04 01 12 01 03 33 74 68 1c 08 04 01 10 01 03   ......3th.......
+|   3696: 33 6e 1a 08 04 01 10 01 03 32 77 18 08 04 01 10   3n.......2w.....
+|   3712: 01 03 32 74 16 08 04 01 10 01 03 32 6e 14 07 04   ..2t.......2n...
+|   3728: 01 0e 01 03 32 12 08 04 01 10 01 03 31 74 10 08   ....2.......1t..
+|   3744: 04 01 10 01 03 31 6e 0e 07 04 01 0e 01 03 31 0c   .....1n.......1.
+|   3760: 09 04 01 12 01 03 30 74 68 0a 08 04 01 10 01 03   ......0th.......
+|   3776: 30 74 08 09 04 01 12 01 03 30 6e 75 06 08 04 01   0t.......0nu....
+|   3792: 10 01 03 30 6e 04 06 04 01 0c 01 05 52 08 04 01   ...0n.......R...
+|   3808: 10 01 02 34 72 22 07 04 01 0e 01 02 34 20 08 04   ...4r.......4 ..
+|   3824: 01 10 01 02 33 72 1e 09 04 01 12 01 02 33 61 72   ....3r.......3ar
+|   3840: 1c 08 04 01 10 01 02 32 74 1a 08 04 01 10 b3 02   .......2t.......
+|   3856: 32 69 18 09 04 01 12 01 02 32 61 72 16 08 04 01   2i.......2ar....
+|   3872: 10 01 02 31 74 14 08 04 01 10 01 02 31 6e 12 08   ...1t.......1n..
+|   3888: 04 01 10 01 02 31 62 10 08 04 01 10 01 02 31 32   .....1b.......12
+|   3904: 0e 0b 04 01 16 01 02 30 74 68 65 72 0c 08 04 01   .......0ther....
+|   3920: 10 01 02 30 74 0a 08 04 01 10 01 02 30 6e 08 08   ...0t.......0n..
+|   3936: 04 01 10 01 02 30 62 06 08 04 01 10 01 02 30 61   .....0b.......0a
+|   3952: 04 06 04 01 0c 01 02 02 07 04 09 10 01 34 74 22   .............4t.
+|   3968: 06 04 09 0e 01 34 20 08 04 09 12 01 33 74 65 1e   .....4 .....3te.
+|   3984: 07 04 09 10 01 33 70 1c 07 04 09 10 01 33 66 1a   .....3p......3f.
+|   4000: 08 04 09 12 01 32 74 68 18 07 04 09 10 01 32 74   .....2th......2t
+|   4016: 16 07 04 09 10 01 32 69 14 07 04 09 10 01 32 66   ......2i......2f
+|   4032: 12 07 04 09 10 01 31 74 10 07 04 09 10 01 31 69   ......1t......1i
+|   4048: 0e 06 04 09 0e 01 31 0c 08 04 09 12 01 30 74 65   ......1......0te
+|   4064: 0a 07 04 09 10 01 30 74 08 07 04 09 10 01 30 70   ......0t......0p
+|   4080: 06 08 04 09 12 01 30 66 74 04 05 04 09 0c 01 02   ......0ft.......
+| page 4 offset 12288
+|      0: 0d 00 00 00 03 0f eb 00 0f f9 0f f2 0f eb 00 00   ................
+|   4064: 00 00 00 00 00 00 00 00 00 00 00 05 03 03 00 10   ................
+|   4080: 03 05 05 02 03 00 10 04 06 05 01 03 00 10 04 04   ................
+| page 5 offset 16384
+|      0: 0a 00 00 00 02 0f eb 00 0f eb 0f f4 00 00 00 00   ................
+|   4064: 00 00 00 00 00 00 00 00 00 00 00 08 03 15 01 70   ...............p
+|   4080: 67 73 7a 18 0b 03 1b 01 76 65 72 73 69 6f 6e 04   gsz.....version.
+| page 6 offset 20480
+|      0: 0d 00 00 00 03 0f f2 00 0f fc 0f f7 0f f2 00 00   ................
+|   4080: 00 00 03 03 02 01 03 03 02 02 01 02 02 01 02 09   ................
+| end crash2.txt.db
+}]} {}
+
+do_execsql_test 40.1 {
+  BEGIN;
+  INSERT INTO t1(b) VALUES(X'819192e578de3fa24af3733ca8769291a0fee3669f9fddefc5cba913e4225d4b6ce2b04f26b87fad3ee6f9b7d90a1ea62a169bf41e5d32707a6ca5c3d05e4bde05c9d89eaaa8c50e74333d2e9fcd7dfe95528a3a016aac1102d825c5cd70cf99d8a88e0ea7f798d4334386518b7ad359beb168b93aba059a2a3bd93112d65b44c12b9904ea786b204d80531cdf0504bf9b203dbe927061974caf7b9f30cbc3397b61f802e732012a6663d41c3607d6f1c0dbcfd489adac05ca500c0b04439d894cd93a840159225ef73b627e178b9f84b3ffe66cf22a963a8368813ff7961fc47f573211ccec95e0220dcbb3bf429f4a50ba54d7a53784ac51bf');
+  INSERT INTO t1(b) VALUES(X'c8ae0d0e7c3175946e62ba2b449511d4eb504079984a20f77969f62206c9f3d7ea25358ab705e6978627290b6d48db9032f815a06a79a4f4b809841a0942eed12954ed166f666111812a508abc3bec87958846edaec0a6fe14564bc0a4b78f1c35ebcacca6bae29cc37ae9b59d8a2d7593af1e47dda0ece2268a98d20febafad037964f139851f9a57f48b3706b01721769071991412044cd6006f1d72eb6eb4aa5ad77e378176db8c15575fbeee47165e38a7c6c5a557ac2dfe11813976eaf6741cf593a9e457053a3c34cddfbe605a6e25419f993de8374fafcd3636509d8416a51dc7bcc14cfca322ae343078f47e23522431c17d0da0c033');
+  INSERT INTO t1(b) VALUES(X'dc29a94e873a45a4243fce9b912aaefbadf1d0423e0345793874b356eeb500b92fb05284c1601fe9bad3143f72162f10242cec27c44ebf764c8fc9fb0824e32c4161472a4f914f579e0e8274f08ca1a02e59b9d8eec1f31061f9ccb9ed97a6f06534e991f7992c761489e6a7724f6e9c2b581e77487ded3a986d53c4419bbd3e9747cee300e670dd7294874c77e2ed48da68eaa6c3ec954a09ac410493d98e34d6686e54fbbe80696705f10e040c66093efb40746b33600685c94c664c7942835a9e954866121d5dcfb2cb12e92521ea3df175ee17072502dad9b9c1565f801b2179799011eb7418bfa00323e3157589e648ff7378be233c79b7');
+}
+
+do_catchsql_test 40.2 {
+  INSERT INTO t1(a,b) VALUES(1,11),(2,22),(3, true ),(4,44);
+} {1 {database disk image is malformed}}
+
+#-------------------------------------------------------------------------
+reset_db
+do_execsql_test 41.0 {
+  CREATE VIRTUAL TABLE t1 USING fts5(a,b,c);
+  REPLACE INTO t1_data VALUES(1,X'255a5824');
+  REPLACE INTO t1_data VALUES(10,X'0a1000000102020002010101020101');
+  INSERT INTO t1_data VALUES(137438953473,X'0000032b0030300102060102060102061f0203010203010203010832303136303630390102070102070102070101340102050102050102050101350102040102040102040207303030303030301c0204010204010204010662696e6272790306010202030601020203060102020306010202030601020203060102020306010202030601020203060102020306010202030601020203060102020108636f6d70696c657201020201020201020201066462737461740702030102030102030424656275670402020102020102020106656e61626c6507020201020201020201020201020201020201020201020201020201020201020201020201020201020201020201020201020201020201020201020201020202087874656e73696f6e1f02040102040102040104667473340a02030102030102030401350d020301020301020301036763630102030102030102030206656f706f6c7910020301020301020301056a736f6e3113020301020301020301046c6f61641f020301020301020301036d61781c02020102020102020205656d6f72791c020301020301020304047379733516020301020301020301066e6f6361736502060102020306010202030601020203060102020306010202030601020203060102020306010202030601020203060102020301b10202030601020201046f6d69741f0202010202010202010572747265651902030102030102030402696d010601020203060102020306010202030601020203060102020306010202030601020203060102020306010202030601020203060102020306010202010a746872656164736166652202020102020102020104767461620702040102040102040101780106010102010601010201060101020106010102010601010201060101020106010102010601010201060101020106010102010601010201060101020106010102010601010201060101020106010102010601010201060101020106010102010601010201060101020106010102010601010201060101020106010102010601010201060101020106010102010601010201060101020106010102010601010201060101020106010102010601010201060101020415130c0c124413110f47130f0c0e11100f0e100f440f1040150f');
+  INSERT INTO t1_data VALUES(274877906945,X'00000183023030250601011d010331c2ba250601010d0101342506010121010135250601011e02036ec2ba250601012b0101382506010112010161250a0101021a1d02016f2506010111010162250601013201026377250601012f010166250801011f0c010167250601012701026863250601010f02026473250601013002016b2506010133020175250601010e010169250601012c0204386ec2be250601012001016a250601010401056bc2b2cebc250601010901016c25060101150203cebc71250601011301036dd18a250601010c01016f25060101260102706425060101240101712506010122010173250a010116040d02016f2506010134010175250801011b14020161250601010b010376c2aa25060101100202d7ac250601010601017725060101030201752506010114010179250a0101190e050202357a250601010701017a250601012e0102c2aa250801011c100201b3250601010a0202ba6225060101310203be656625060101080103c5a77425060101050102de8e250601011704080a08080a080a080809090809090808080b080c080a0a0809080a0809080a0908080a09080a08090a0a');
+  INSERT INTO t1_idx VALUES(1,X'',2);
+  INSERT INTO t1_idx VALUES(2,X'',2);
+}
+
+do_catchsql_test 41.1 {
+  INSERT INTO t1(t1) VALUES('optimize');
+} {1 {database disk image is malformed}}
+
+do_catchsql_test 41.2 {
+  INSERT INTO t1(t1) VALUES('integrity-check');
+} {1 {database disk image is malformed}}
+
+#-------------------------------------------------------------------------
+reset_db
+do_test 42.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 32768 pagesize 4096 filename 8cfba7fbb67e48de92c6.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 00 00 00 00 08   .....@  ........
+|     32: 00 00 00 02 00 00 00 01 00 00 00 09 00 00 00 04   ................
+|     48: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00   ................
+|     96: 00 00 00 00 0d 0f c7 00 07 0d 92 00 0f 8d 0f 36   ...............6
+|    112: 0e cb 0e 6b 0e 0e 0d b6 0d 92 0d 92 00 00 00 00   ...k............
+|   3472: 00 00 22 08 06 17 11 11 01 31 74 61 62 6c 65 74   .........1tablet
+|   3488: 32 74 32 08 43 52 45 41 54 45 20 54 41 42 4c 45   2t2.CREATE TABLE
+|   3504: 20 74 32 28 78 29 56 07 06 17 1f 1f 01 7d 74 61    t2(x)V.......ta
+|   3520: 62 6c 65 74 31 5f 63 6f 6e 66 69 67 74 31 5f 63   blet1_configt1_c
+|   3536: 6f 6e 66 69 67 07 43 52 45 41 54 45 20 54 41 42   onfig.CREATE TAB
+|   3552: 4c 45 20 27 74 31 5f 63 6f 6e 66 69 67 27 28 6b   LE 't1_config'(k
+|   3568: 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20 76 29    PRIMARY KEY, v)
+|   3584: 20 57 49 54 48 4f 55 54 20 52 4f 57 49 44 5b 06    WITHOUT ROWID[.
+|   3600: 07 17 21 21 01 81 01 74 61 62 6c 65 74 31 5f 64   ..!!...tablet1_d
+|   3616: 6f 63 73 69 7a 65 74 31 5f 64 6f 63 73 69 7a 65   ocsizet1_docsize
+|   3632: 06 43 52 45 41 54 45 20 54 41 42 4c 45 20 27 74   .CREATE TABLE 't
+|   3648: 31 5f 64 6f 63 73 69 7a 65 27 28 69 64 20 49 4e   1_docsize'(id IN
+|   3664: 54 45 47 45 52 20 50 52 49 4d 41 52 59 20 4b 45   TEGER PRIMARY KE
+|   3680: 59 2c 20 73 7a 20 42 4c 4f 42 29 5e 05 07 17 21   Y, sz BLOB)^...!
+|   3696: 21 01 81 07 74 61 62 6c 65 74 31 5f 63 6f 6e 74   !...tablet1_cont
+|   3712: 65 6e 74 74 31 5f 63 6f 6e 74 65 6e 74 05 43 52   entt1_content.CR
+|   3728: 45 41 54 45 20 54 41 42 4c 45 20 27 74 31 5f 63   EATE TABLE 't1_c
+|   3744: 6f 6e 74 65 6e 74 27 28 69 64 20 49 4e 54 45 47   ontent'(id INTEG
+|   3760: 45 52 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20   ER PRIMARY KEY, 
+|   3776: 63 30 2c 20 63 31 2c 20 63 32 29 69 04 07 17 19   c0, c1, c2)i....
+|   3792: 19 01 81 2d 74 61 62 6c 65 74 31 5f 69 64 78 74   ...-tablet1_idxt
+|   3808: 31 5f 69 64 78 04 43 52 45 41 54 45 20 54 41 42   1_idx.CREATE TAB
+|   3824: 4c 45 20 27 74 31 5f 69 64 78 27 28 73 65 67 69   LE 't1_idx'(segi
+|   3840: 64 2c 20 74 65 72 6d 2c 20 70 67 6e 6f 2c 20 50   d, term, pgno, P
+|   3856: 52 49 4d 41 52 59 20 4b 45 59 28 73 65 67 69 64   RIMARY KEY(segid
+|   3872: 2c 20 74 65 72 6d 29 29 20 57 49 54 48 4f 55 54   , term)) WITHOUT
+|   3888: 20 52 4f 57 49 44 55 03 07 17 1b 1b 01 81 01 74    ROWIDU........t
+|   3904: 61 62 6c 65 74 31 5f 64 61 74 61 74 31 5f 64 61   ablet1_datat1_da
+|   3920: 74 61 03 43 52 45 41 54 45 20 54 41 42 4c 45 20   ta.CREATE TABLE 
+|   3936: 27 74 31 5f 64 61 74 61 27 28 69 64 20 49 4e 54   't1_data'(id INT
+|   3952: 45 47 45 52 20 50 52 49 4d 41 52 59 20 4b 45 59   EGER PRIMARY KEY
+|   3968: 2c 20 62 6c 6f 63 6b 20 42 4c 4f 42 29 38 02 06   , block BLOB)8..
+|   3984: 17 11 11 08 5f 74 61 62 6c 65 74 31 74 31 43 52   ...._tablet1t1CR
+|   4000: 45 41 54 45 20 56 49 52 54 55 41 4c 20 54 41 42   EATE VIRTUAL TAB
+|   4016: 4c 45 20 74 31 20 55 53 49 4e 47 20 66 74 73 35   LE t1 USING fts5
+|   4032: 28 61 2c 62 2c 63 29 00 00 00 39 00 00 00 00 00   (a,b,c)...9.....
+| page 3 offset 8192
+|      0: 0d 00 00 00 03 0c 94 00 0f e6 0f ef 0c 94 00 00   ................
+|   3216: 00 00 00 00 86 4a 84 80 80 80 80 01 04 00 8d 18   .....J..........
+|   3232: 00 00 03 2b 02 30 30 01 02 06 01 02 06 01 02 06   ...+.00.........
+|   3248: 1f 02 03 01 02 03 01 02 03 01 08 32 30 31 36 30   ...........20160
+|   3264: 36 30 39 01 02 07 01 02 07 01 02 07 01 01 34 01   609...........4.
+|   3280: 02 05 01 02 05 01 02 05 01 01 35 01 02 04 01 02   ..........5.....
+|   3296: 04 01 02 04 02 07 30 30 30 30 30 30 30 1c 02 04   ......0000000...
+|   3312: 01 02 04 01 02 04 01 06 62 69 6e 62 72 79 03 06   ........binbry..
+|   3328: 01 02 02 03 06 01 02 02 03 06 01 02 01 03 06 01   ................
+|   3344: 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01 02   ................
+|   3360: 02 03 06 01 02 02 03 06 01 02 02 03 06 01 02 02   ................
+|   3376: 03 06 01 02 02 03 06 01 02 02 01 08 63 6f 6d 70   ............comp
+|   3392: 69 6c 65 72 01 02 02 01 02 02 01 02 02 01 06 64   iler...........d
+|   3408: 62 73 74 61 74 07 02 03 01 02 03 01 02 03 02 04   bstat...........
+|   3424: 65 62 75 67 04 02 02 01 02 02 01 02 02 01 06 65   ebug...........e
+|   3440: 6e 61 62 6c 65 07 02 02 01 02 02 01 02 02 01 02   nable...........
+|   3456: 02 01 02 02 01 02 02 01 02 02 01 02 02 01 02 02   ................
+|   3472: 01 02 02 01 02 02 01 02 02 01 02 02 01 02 02 01   ................
+|   3488: 02 02 01 02 02 01 02 02 01 02 02 01 02 02 01 02   ................
+|   3504: 02 01 02 02 02 08 78 74 65 6e 73 69 6f 6e 1f 02   ......xtension..
+|   3520: 04 01 02 04 01 02 04 01 04 66 74 73 34 0a 02 03   .........fts4...
+|   3536: 01 02 03 01 02 03 04 01 35 0d 02 03 01 02 03 01   ........5.......
+|   3552: 02 03 01 03 67 63 63 01 02 03 01 02 03 01 02 03   ....gcc.........
+|   3568: 02 06 65 6f 70 6f 6c 79 10 02 03 01 02 03 01 02   ..eopoly........
+|   3584: 03 01 05 6a 73 6f 6e 31 13 02 03 01 02 03 01 02   ...json1........
+|   3600: 03 01 04 6c 6f 61 64 1f 02 03 01 02 03 01 02 03   ...load.........
+|   3616: 01 03 6d 61 78 1c 02 02 01 02 02 01 02 02 02 05   ..max...........
+|   3632: 65 6d 6f 72 79 1c 02 03 01 02 03 01 02 03 04 04   emory...........
+|   3648: 73 79 73 35 16 02 03 01 02 03 01 02 03 01 06 6e   sys5...........n
+|   3664: 6f 63 61 73 65 02 06 01 02 02 03 06 01 02 02 03   ocase...........
+|   3680: 06 01 02 02 03 06 01 02 02 03 06 01 02 02 03 06   ................
+|   3696: 01 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01   ................
+|   3712: 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01 02   ................
+|   3728: 02 01 04 6f 6d 69 74 1f 02 02 01 02 02 01 02 02   ...omit.........
+|   3744: 01 05 72 74 72 65 65 19 02 03 01 02 03 01 02 03   ..rtree.........
+|   3760: 04 02 69 6d 01 06 01 02 02 03 06 01 02 02 03 06   ..im............
+|   3776: 01 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01   ................
+|   3792: 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01 02   ................
+|   3808: 02 03 06 01 02 02 03 06 01 02 02 03 06 01 02 02   ................
+|   3824: 01 0a 74 68 72 65 61 64 73 61 66 65 22 02 02 01   ..threadsafe....
+|   3840: 02 02 01 02 02 01 04 76 74 61 62 07 02 04 01 02   .......vtab.....
+|   3856: 04 01 02 04 01 01 78 01 06 01 01 02 01 06 01 01   ......x.........
+|   3872: 02 01 06 01 01 02 01 06 01 01 02 01 06 01 01 02   ................
+|   3888: 01 06 01 01 02 01 06 01 01 02 01 06 01 01 02 01   ................
+|   3904: 06 01 01 02 01 06 01 01 02 01 06 01 01 02 01 06   ................
+|   3920: 01 01 02 01 06 01 01 02 01 06 01 01 02 01 06 01   ................
+|   3936: 01 02 01 06 01 01 02 01 06 01 01 02 01 06 01 01   ................
+|   3952: 02 01 06 01 01 02 01 06 01 01 02 01 06 01 01 02   ................
+|   3968: 01 06 01 01 02 01 06 01 01 02 01 06 01 01 02 01   ................
+|   3984: 06 01 01 02 01 06 01 01 02 01 06 01 01 02 01 06   ................
+|   4000: 01 01 02 01 06 01 01 02 01 06 01 01 02 01 06 01   ................
+|   4016: 01 02 01 06 01 01 02 01 06 01 01 02 01 06 01 01   ................
+|   4032: 02 01 06 01 01 02 01 06 01 01 02 04 15 13 0c 0c   ................
+|   4048: 12 44 13 11 0f 47 13 0f 0c 0e 11 10 0f 0e 10 0f   .D...G..........
+|   4064: 44 0f 10 40 15 0f 07 01 03 00 14 24 5a 24 24 0f   D..@.......$Z$$.
+|   4080: 0a 03 00 24 00 00 00 00 01 01 01 00 01 01 01 01   ...$............
+| page 4 offset 12288
+|      0: 0a 00 00 00 01 0f fa 00 0f fa 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 00 00 00 00 00 00 05 04 09 0b 01 02   ................
+| page 5 offset 16384
+|      0: 0d 00 00 00 24 0c 0a 00 0f d8 0f af 0f 86 0f 74   ....$..........t
+|     16: 0f 61 0f 4e 0f 2f 0f 0f 0e ef 0e d7 0e be 0e a5   .a.N./..........
+|     32: 0e 8d 0e 74 0e 5b 0e 40 0e 24 0e 08 0d ef 0d d5   ...t.[.@.$......
+|     48: 0d bb 0d a0 0d 84 0d 68 0d 4f 0d 35 0d 1b 0c fb   .......h.O.5....
+|     64: 0c da 0c b9 0c 99 0c 78 0c 57 0c 3e 0c 24 0c 0a   .......x.W.>.$..
+|   3072: 00 00 00 00 00 00 00 00 00 00 18 24 05 00 25 0f   ...........$..%.
+|   3088: 19 54 48 52 45 41 44 53 41 46 45 3d 30 58 42 49   .THREADSAFE=0XBI
+|   3104: 4f 41 52 59 18 23 05 00 25 0f 19 54 48 52 45 41   OARY.#..%..THREA
+|   3120: 44 53 41 46 45 3d 30 58 4e 4f 43 41 53 45 17 22   DSAFE=0XNOCASE..
+|   3136: 05 00 25 0f 17 54 48 52 45 41 44 53 41 46 45 3d   ..%..THREADSAFE=
+|   3152: 30 58 52 54 52 49 4d 1f 21 05 00 33 0f 19 4f 4d   0XRTRIM.!..3..OM
+|   3168: 49 54 20 4c 4f 41 44 20 45 58 54 45 4e 53 49 4f   IT LOAD EXTENSIO
+|   3184: 4e 58 42 49 4e 41 52 59 1f 20 05 00 33 0f 19 4f   NXBINARY. ..3..O
+|   3200: 4d 49 54 20 4c 4f 41 44 20 45 58 54 45 4e 53 49   MIT LOAD EXTENSI
+|   3216: 4f 4e 58 4e 4f 43 41 53 45 1e 1f 05 00 33 0f 17   ONXNOCASE....3..
+|   3232: 4f 4d 49 54 20 4c 4f 41 44 20 45 58 54 45 4e 53   OMIT LOAD EXTENS
+|   3248: 49 4f 4e 58 52 54 52 49 4d 1f 1e 05 00 33 0f 19   IONXRTRIM....3..
+|   3264: 4d 41 58 20 4d 45 4d 4f 52 59 3d 35 30 30 30 30   MAX MEMORY=50000
+|   3280: 30 30 30 58 42 49 4e 41 52 59 1f 1d 05 00 33 0f   000XBINARY....3.
+|   3296: 19 4d 41 58 20 4d 45 4d 4f 52 59 3d 35 30 30 30   .MAX MEMORY=5000
+|   3312: 30 30 30 30 58 4e 4f 43 41 53 45 1e 1c 05 00 33   0000XNOCASE....3
+|   3328: 0f 17 4d 41 58 20 4d 45 4d 4f 52 59 3d 35 30 30   ..MAX MEMORY=500
+|   3344: 30 30 30 30 30 58 52 54 52 49 4d 18 1b 05 00 25   00000XRTRIM....%
+|   3360: 0f 19 45 4e 41 42 4c 45 20 52 54 52 45 45 58 42   ..ENABLE RTREEXB
+|   3376: 49 4e 41 52 59 18 1a 05 00 25 0f 19 45 4e 41 42   INARY....%..ENAB
+|   3392: 4c 45 20 52 54 52 45 45 58 4e 4f 43 41 53 45 17   LE RTREEXNOCASE.
+|   3408: 19 05 00 25 0f 17 45 4e 41 42 4c 45 20 52 54 52   ...%..ENABLE RTR
+|   3424: 45 45 58 52 54 52 49 4d 1a 18 05 00 29 0f 19 45   EEXRTRIM....)..E
+|   3440: 4e 41 42 4c 45 20 4d 45 4d 53 59 53 35 58 42 49   NABLE MEMSYS5XBI
+|   3456: 4e 41 52 59 1a 17 05 00 29 0f 19 45 4e 41 42 4c   NARY....)..ENABL
+|   3472: 45 20 4d 45 4d 53 59 53 35 58 4e 4f 43 41 53 45   E MEMSYS5XNOCASE
+|   3488: 19 16 05 00 29 0f 17 45 4e 41 42 4c 45 20 4d 45   ....)..ENABLE ME
+|   3504: 4d 53 59 53 35 58 52 54 52 49 4d 18 15 05 00 25   MSYS5XRTRIM....%
+|   3520: 0f 19 45 4e 41 42 4c 45 20 4a 53 4f 4e 31 58 42   ..ENABLE JSON1XB
+|   3536: 49 4e 41 52 59 18 14 05 00 25 0f 19 45 4e 41 42   INARY....%..ENAB
+|   3552: 4c 45 20 4a 53 4f 4e 31 58 4e 4f 43 41 53 45 17   LE JSON1XNOCASE.
+|   3568: 13 05 00 25 0f 17 45 4e 41 42 4c 45 20 4a 53 4f   ...%..ENABLE JSO
+|   3584: 4e 31 58 52 54 52 49 4d 1a 12 05 00 29 0f 19 45   N1XRTRIM....)..E
+|   3600: 4e 41 42 4c 45 20 47 45 4f 50 4f 4c 59 57 42 49   NABLE GEOPOLYWBI
+|   3616: 4e 41 52 59 1a 11 05 00 29 0f 19 45 4e 41 42 4c   NARY....)..ENABL
+|   3632: 45 20 47 45 4f 50 4f 4c 59 58 4e 4f 42 41 53 45   E GEOPOLYXNOBASE
+|   3648: 19 10 05 00 29 0f 17 45 4e 41 42 4c 45 20 47 45   ....)..ENABLE GE
+|   3664: 4f 50 4f 4c 59 58 52 54 52 49 4d 17 0f 05 00 23   OPOLYXRTRIM....#
+|   3680: 0f 19 45 4e 41 42 4c 45 20 46 54 53 35 58 42 49   ..ENABLE FTS5XBI
+|   3696: 4e 41 52 59 17 0e 05 00 23 0f 19 45 4e 41 42 4c   NARY....#..ENABL
+|   3712: 45 20 46 54 53 35 58 4e 4f 43 41 53 45 16 0d 05   E FTS5XNOCASE...
+|   3728: 00 23 0f 17 45 4e 41 42 4c 45 20 46 54 53 35 58   .#..ENABLE FTS5X
+|   3744: 52 54 52 49 4d 17 0c 05 00 23 0f 19 45 4e 41 42   RTRIM....#..ENAB
+|   3760: 4c 45 20 46 54 53 34 58 42 49 4e 41 52 59 17 0b   LE FTS4XBINARY..
+|   3776: 05 00 23 0f 19 45 4e 41 42 4c 45 20 46 54 53 34   ..#..ENABLE FTS4
+|   3792: 58 4e 4f 43 41 53 45 16 0a 05 00 23 0f 17 45 4e   XNOCASE....#..EN
+|   3808: 41 42 4c 45 20 46 54 53 34 58 52 54 52 49 4d 1e   ABLE FTS4XRTRIM.
+|   3824: 09 05 00 31 0f 19 45 4e 41 42 4c 45 20 44 42 53   ...1..ENABLE DBS
+|   3840: 54 41 54 20 56 54 41 42 58 42 49 4e 41 52 59 1e   TAT VTABXBINARY.
+|   3856: 08 05 00 31 0f 19 45 4e 41 42 4c 45 20 44 42 53   ...1..ENABLE DBS
+|   3872: 54 41 54 20 56 54 41 42 58 4e 4f 43 41 53 45 1d   TAT VTABXNOCASE.
+|   3888: 07 05 00 31 0f 17 45 4e 41 42 4c 45 20 44 42 53   ...1..ENABLE DBS
+|   3904: 54 41 54 20 56 54 41 42 58 52 54 52 49 4d 11 06   TAT VTABXRTRIM..
+|   3920: 05 00 17 0f 19 44 45 42 55 47 58 42 49 4e 41 52   .....DEBUGXBINAR
+|   3936: 59 11 05 05 00 17 0f 19 44 45 42 55 47 58 4e 4f   Y.......DEBUGXNO
+|   3952: 43 41 53 45 10 04 05 00 17 0f 17 44 45 42 55 47   CASE.......DEBUG
+|   3968: 58 52 54 52 49 4d 27 03 05 00 43 0f 19 43 4f 4d   XRTRIM'...C..COM
+|   3984: 50 49 4c 45 52 3d 67 63 63 2d 35 2e 34 2e 30 20   PILER=gcc-5.4.0 
+|   4000: 32 30 31 36 30 36 30 39 52 02 49 4e 41 52 59 27   20160609R.INARY'
+|   4016: 02 05 00 43 0f 19 43 4f 4d 50 49 4c 45 52 3d 67   ...C..COMPILER=g
+|   4032: 63 63 2d 35 2e 34 2e 30 20 32 30 31 36 30 36 30   cc-5.4.0 2016060
+|   4048: 39 58 4e 4f 43 41 53 45 26 01 05 00 43 0f 17 43   9XNOCASE&...C..C
+|   4064: 4f 4d 50 49 4c 45 52 3d 67 63 63 2d 35 2e 34 2e   OMPILER=gcc-5.4.
+|   4080: 30 20 32 30 31 36 30 36 30 39 58 52 54 52 49 4d   0 20160609XRTRIM
+| page 6 offset 20480
+|      0: 0d 00 00 00 24 0e e0 00 0f f8 0f f0 0f e8 0f e0   ....$...........
+|     16: 0f d8 0f d0 0f c8 0f c0 0f b8 0f b0 0f a8 0f a0   ................
+|     32: 0f 98 0f 90 0f 88 0f 80 0f 78 0f 70 0f 68 0f 60   .........x.p.h.`
+|     48: 0f 58 0f 50 0f 48 0f 40 0f 38 0f 30 0f 28 0f 20   .X.P.H.@.8.0.(. 
+|     64: 0f 18 0f 10 0f 08 0f 00 0e f8 0e f0 0e e8 0e e0   ................
+|   3808: 06 24 03 00 12 02 01 01 06 23 03 00 12 02 01 01   .$.......#......
+|   3824: 06 22 03 00 12 02 01 01 06 21 03 00 12 03 01 01   .........!......
+|   3840: 06 20 03 00 12 03 01 01 06 1f 03 00 12 03 01 01   . ..............
+|   3856: 06 1e 03 00 12 03 01 01 06 1d 03 00 12 03 01 01   ................
+|   3872: 06 1c 03 00 12 03 01 01 06 1b 03 00 12 02 01 01   ................
+|   3888: 06 1a 03 00 12 02 01 01 06 19 03 00 12 02 01 01   ................
+|   3904: 06 18 03 00 12 02 01 01 06 17 03 00 12 02 01 01   ................
+|   3920: 06 16 03 00 12 02 01 01 06 15 03 00 12 02 01 01   ................
+|   3936: 06 14 03 00 12 02 01 01 06 13 03 00 12 02 01 01   ................
+|   3952: 06 12 03 00 12 02 01 01 06 11 03 00 12 02 01 01   ................
+|   3968: 06 10 03 00 12 02 01 01 06 0f 03 00 12 02 01 01   ................
+|   3984: 06 0e 03 00 12 02 01 01 06 0d 03 00 12 02 01 01   ................
+|   4000: 06 0c 03 00 12 02 01 01 06 0b 03 00 12 02 01 01   ................
+|   4016: 06 0a 03 00 12 02 01 01 06 09 03 00 12 03 01 01   ................
+|   4032: 06 08 03 00 12 03 01 01 06 07 03 00 12 03 01 01   ................
+|   4048: 06 06 03 00 12 01 01 01 06 05 03 00 12 01 01 01   ................
+|   4064: 06 04 03 00 12 01 01 01 06 03 03 00 12 06 01 01   ................
+|   4080: 06 02 03 00 12 06 01 01 06 01 03 00 12 06 01 01   ................
+| page 7 offset 24576
+|      0: 0a 00 00 00 01 0f f4 00 0f f4 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 0b 03 1b 01 76 65 72 73 69 6f 6e 04   ........version.
+| page 8 offset 28672
+|      0: 0d 00 00 00 03 0f d6 00 0f f4 0f e9 0f d6 00 00   ................
+|   4048: 00 00 00 00 00 00 11 03 02 2b 69 6e 74 65 67 72   .........+integr
+|   4064: 69 74 79 2d 63 68 65 63 6b 09 02 02 1b 72 65 62   ity-check....reb
+|   4080: 75 69 6c 64 0a 01 02 1d 6f 70 74 69 5d 69 7a 65   uild....opti]ize
+| end 8cfba7fbb67e48de92c6.db
+}]} {}
+
+do_catchsql_test 42.1 {
+  INSERT INTO t1(t1) VALUES('integrity-check');
+} {1 {database disk image is malformed}}
+
+#-------------------------------------------------------------------------
+reset_db
+do_test 43.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 24576 pagesize 4096 filename 89028ffd2c29b679e250.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 00 00 00 00 06   .....@  ........
+|     32: 00 00 00 00 00 00 00 00 00 00 00 06 00 00 00 04   ................
+|     48: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00   ................
+|     96: 00 00 00 00 0d 00 00 00 06 0e 0f 00 0f aa 0f 53   ...............S
+|    112: 0e e8 0e 8b 0e 33 0e 0f 00 00 00 00 00 00 00 00   .....3..........
+|   3584: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22   ................
+|   3600: 06 06 17 11 11 01 31 74 61 62 6c 65 62 62 62 62   ......1tablebbbb
+|   3616: 06 43 52 45 41 54 45 20 54 41 42 4c 45 20 62 62   .CREATE TABLE bb
+|   3632: 28 61 29 56 05 06 17 1f 1f 01 7d 74 61 62 6c 65   (a)V.......table
+|   3648: 74 31 5f 63 6f 6e 66 69 67 74 31 5f 63 6f 6e 66   t1_configt1_conf
+|   3664: 69 67 05 43 52 45 41 54 45 20 54 41 42 4c 45 20   ig.CREATE TABLE 
+|   3680: 27 74 31 5f 63 6f 6e 66 69 67 27 28 6b 20 50 52   't1_config'(k PR
+|   3696: 49 4d 41 52 59 20 4b 45 59 2c 20 76 29 20 57 49   IMARY KEY, v) WI
+|   3712: 54 48 4f 55 54 20 52 4f 57 49 44 5b 04 07 17 21   THOUT ROWID[...!
+|   3728: 21 01 81 01 74 61 62 6c 65 74 31 5f 64 6f 63 73   !...tablet1_docs
+|   3744: 69 7a 65 74 31 5f 12 6f 63 73 69 7a 65 04 43 52   izet1_.ocsize.CR
+|   3760: 45 41 54 45 20 54 41 42 4c 45 20 27 74 31 5f 64   EATE TABLE 't1_d
+|   3776: 6f 63 73 69 7a 65 27 28 69 64 20 49 4e 54 45 47   ocsize'(id INTEG
+|   3792: 45 52 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20   ER PRIMARY KEY, 
+|   3808: 73 7a 20 42 4c 4f 42 29 69 03 07 17 19 19 01 81   sz BLOB)i.......
+|   3824: 2d 74 61 62 6c 65 74 31 5f 69 64 78 74 31 5f 69   -tablet1_idxt1_i
+|   3840: 64 78 03 43 52 45 41 54 45 20 54 41 42 4c 45 20   dx.CREATE TABLE 
+|   3856: 27 74 31 5f 69 64 78 27 28 73 65 67 69 64 2c 20   't1_idx'(segid, 
+|   3872: 74 65 72 6d 2c 20 70 67 6e 6f 2c 20 50 52 49 4d   term, pgno, PRIM
+|   3888: 41 52 59 20 4b 45 59 28 73 65 67 69 64 2c 20 74   ARY KEY(segid, t
+|   3904: 65 72 6d 29 29 20 57 49 54 48 4f 55 54 20 52 4f   erm)) WITHOUT RO
+|   3920: 57 49 44 55 02 07 17 1b 1b 01 81 01 74 61 62 6c   WIDU........tabl
+|   3936: 65 74 31 5f 64 61 74 61 74 31 5e 64 61 74 61 02   et1_datat1^data.
+|   3952: 43 52 45 41 54 45 20 54 41 42 4c 45 20 27 74 31   CREATE TABLE 't1
+|   3968: 5f 64 61 74 61 27 28 69 64 20 49 4e 54 45 47 45   _data'(id INTEGE
+|   3984: 52 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20 62   R PRIMARY KEY, b
+|   4000: 6c 6f 63 6b 20 42 4c 4f 42 29 54 01 07 17 11 11   lock BLOB)T.....
+|   4016: 08 81 15 74 61 62 6c 65 74 31 74 31 43 52 45 41   ...tablet1t1CREA
+|   4032: 54 45 20 56 49 52 54 55 41 4c 20 54 41 42 4c 45   TE VIRTUAL TABLE
+|   4048: 20 74 31 20 55 53 49 4e 47 20 66 74 73 35 28 61    t1 USING fts5(a
+|   4064: 2c 62 2c 70 72 65 66 69 78 3d 22 31 2c 32 2c 33   ,b,prefix=.1,2,3
+|   4080: 2c 34 22 2c 20 63 6f 6e 74 65 6e 74 3d 22 22 29   ,4., content=..)
+| page 2 offset 4096
+|      0: 0d 0b 6a 00 37 09 4c 02 0f e8 09 4c 0f c6 0f a4   ..j.7.L....L....
+|     16: 0f 88 0f 6d 0f 4b 0f 2c 0f 0e 0e ec 0e cd 0e ad   ...m.K.,........
+|     32: 0e 8e 0e 6c 0e 4b 0e 29 0e 08 0d e6 0d c4 0d b5   ...l.K.)........
+|     48: 0d 97 0d 76 0d 54 0d 31 0d 15 0c f3 0c d3 0c b5   ...v.T.1........
+|     64: 0c 95 0c 73 0c 54 0c 32 0c 10 0b ee 0b cc 0b b0   ...s.T.2........
+|     80: 0b 8d 0b 7e 0b 48 0b 2e 0b 0b 0a ef 0a cc 0a ad   ...~.H..........
+|     96: 0a 8c 0a 6d 0a 4d 0a 2b 0a 0c 09 ec 09 ca 09 a8   ...m.M.+........
+|    112: 09 86 09 63 0f f1 00 00 00 00 00 00 00 00 00 00   ...c............
+|   2368: 00 00 00 00 00 00 00 00 00 00 00 00 15 0a 03 00   ................
+|   2384: 30 00 00 00 01 01 03 35 00 03 00 01 12 02 01 12   0......5........
+|   2400: 03 01 11 1c 8c 80 80 80 80 10 03 00 3e 00 00 00   ............>...
+|   2416: 17 01 05 05 34 74 61 62 6c 03 02 03 01 04 77 68   ....4tabl.....wh
+|   2432: 65 72 03 02 06 09 1b 8c 80 80 80 80 0f 03 00 3c   er.............<
+|   2448: 00 00 00 16 05 34 66 74 73 34 03 02 02 01 04 6e   .....4fts4.....n
+|   2464: 75 6d 62 03 06 01 04 09 1b 8c 80 80 80 80 0e 03   umb.............
+|   2480: 00 3c 00 00 00 16 04 33 74 68 65 03 06 01 01 04   .<.....3the.....
+|   2496: 01 03 77 68 65 03 02 04 04 0a 1b 8c 80 80 80 80   ..whe...........
+|   2512: 0d 03 00 3c 00 00 00 16 04 33 6e 75 6d 03 06 01   ...<.....3num...
+|   2528: 01 05 01 03 74 61 62 03 02 03 04 0a 19 8c 80 80   ....tab.........
+|   2544: 80 80 0c 03 00 38 00 00 00 14 03 32 77 68 03 02   .....8.....2wh..
+|   2560: 04 00 04 33 66 74 73 03 02 02 04 07 18 8c 80 80   ...3fts.........
+|   2576: 80 80 0b 03 00 36 00 00 00 13 03 32 74 61 03 02   .....6.....2ta..
+|   2592: 03 02 01 68 03 06 01 01 04 04 07 1b 8c 80 80 80   ...h............
+|   2608: 80 0a 03 00 3c 00 00 00 16 03 32 6e 75 03 06 01   ....<.....2nu...
+|   2624: 01 05 01 02 6f 66 03 06 01 01 06 04 09 19 8c 80   ....of..........
+|   2640: 80 80 80 09 03 00 38 00 00 00 14 03 32 66 74 03   ......8.....2ft.
+|   2656: 02 02 01 02 69 73 03 06 01 01 03 04 07 18 8c 80   ....is..........
+|   2672: 80 80 80 08 03 00 36 94 00 00 13 02 31 74 03 08   ......6.....1t..
+|   2688: 03 01 01 04 01 01 77 03 02 04 04 09 1a 8c 80 80   ......w.........
+|   2704: 80 80 07 03 00 3a 00 00 00 15 02 31 6e 03 08 01   .....:.....1n...
+|   2720: 01 02 05 01 01 6f 03 06 01 01 06 04 09 18 8c 80   .....o..........
+|   2736: 80 80 80 06 03 00 36 00 00 00 13 04 02 31 66 03   ......6......1f.
+|   2752: 02 02 01 01 69 03 06 01 01 03 05 06 1c 8c 80 80   ....i...........
+|   2768: 80 80 05 03 00 3e 00 00 00 17 04 30 74 68 65 03   .....>.....0the.
+|   2784: 06 01 01 04 01 05 77 68 65 72 65 03 02 04 0a 15   ......where.....
+|   2800: 8c 80 80 80 80 04 03 00 30 00 00 00 11 01 01 06   ........0.......
+|   2816: 06 30 74 61 62 6c 65 03 02 03 07 1c 8c 80 80 80   .0table.........
+|   2832: 80 03 03 00 3e 00 00 00 17 07 30 6e 75 6d 62 65   ....>.....0numbe
+|   2848: 72 03 06 01 01 05 01 02 6f 66 03 06 04 0d 13 8c   r.......of......
+|   2864: 80 80 80 80 02 03 00 2c 00 00 00 0f 01 01 03 02   .......,........
+|   2880: 30 6e 03 06 01 01 02 07 1b 8c 80 80 80 80 01 03   0n..............
+|   2896: 00 3c 00 00 00 16 08 30 66 74 73 34 61 75 78 03   .<.....0fts4aux.
+|   2912: 02 02 01 02 69 73 04 06 04 0c 00 00 00 14 2a 00   ....is........*.
+|   2928: 00 00 01 01 02 24 00 02 01 01 12 02 01 12 08 88   .....$..........
+|   2944: 80 80 80 80 12 03 00 16 00 00 00 05 02 1c 88 80   ................
+|   2960: 80 80 80 11 03 00 3e 00 00 00 17 05 34 72 6f 77   ......>.....4row
+|   2976: 73 02 06 01 01 05 01 04 74 68 65 72 02 02 04 0b   s.......ther....
+|   2992: 15 88 80 80 80 80 10 03 00 30 00 00 00 11 02 01   .........0......
+|   3008: 01 07 05 34 62 65 74 77 02 02 04 08 1b 88 80 80   ...4betw........
+|   3024: 80 80 0f 03 00 3c 00 00 00 16 04 04 33 72 6f 77   .....<......3row
+|   3040: 02 06 01 01 05 01 03 74 68 65 02 08 05 0a 1b 88   .......the......
+|   3056: 80 80 80 80 0e 03 00 3c 00 00 00 16 01 01 02 04   .......<........
+|   3072: 33 61 72 65 02 02 03 01 03 62 65 74 02 02 07 08   3are.....bet....
+|   3088: 1b 88 80 80 80 80 0d 03 00 3c 00 00 00 16 03 32   .........<.....2
+|   3104: 74 68 02 08 02 01 01 07 00 04 33 61 6e 64 02 06   th........3and..
+|   3120: 04 0a 1b 88 80 80 80 80 0c 03 00 3c 00 00 00 16   ...........<....
+|   3136: 03 32 69 6e 02 06 01 01 06 01 02 72 6f 02 06 01   .2in.......ro...
+|   3152: 01 05 04 09 18 88 80 80 80 80 0b 03 00 36 00 00   .............6..
+|   3168: 00 13 02 03 32 61 72 02 02 03 01 02 62 65 02 02   ....2ar.....be..
+|   3184: 04 05 07 1b 88 80 80 80 80 0a 03 00 3c 00 00 00   ............<...
+|   3200: 16 02 31 74 02 08 02 01 01 07 00 03 32 61 6e 02   ..1t........2an.
+|   3216: 06 01 01 04 09 19 88 80 80 80 80 09 03 00 38 00   ..............8.
+|   3232: 00 00 14 02 31 6e 02 06 01 01 03 01 01 72 02 06   ....1n.......r..
+|   3248: 01 01 05 04 08 17 88 80 80 80 80 08 03 00 34 00   ..............4.
+|   3264: 00 00 12 02 31 62 02 02 04 01 01 69 02 06 01 01   ....1b.....i....
+|   3280: 06 04 06 19 88 80 80 80 80 07 03 00 38 00 00 00   ............8...
+|   3296: 14 04 02 31 32 02 02 05 01 01 61 02 08 03 01 01   ...12.....a.....
+|   3312: 02 05 06 1b 88 80 80 80 80 06 03 00 3c 00 00 00   ............<...
+|   3328: 16 06 30 74 68 65 72 65 02 02 02 00 02 31 31 02   ..0there.....11.
+|   3344: 06 01 01 04 0a 15 88 80 80 80 80 05 00 90 30 00   ..............0.
+|   3360: 00 00 11 01 01 05 04 30 74 68 65 02 06 01 01 07   .......0the.....
+|   3376: 07 1c 88 80 80 80 80 04 03 00 3e 00 00 00 17 01   ..........>.....
+|   3392: 01 06 02 30 6e 02 06 01 01 03 01 04 72 6f 77 73   ...0n.......rows
+|   3408: 02 06 07 08 1b 88 80 80 80 80 03 03 00 3c 00 00   .............<..
+|   3424: 00 16 07 30 62 65 74 77 65 65 6e 02 02 04 01 02   ...0between.....
+|   3440: 69 6e 02 06 04 0c 1a 88 80 80 80 80 02 03 00 3a   in.............:
+|   3456: 00 00 00 15 04 30 61 6e 64 02 06 01 01 02 02 02   .....0and.......
+|   3472: 72 65 02 02 03 04 0a 17 88 80 80 80 80 01 03 00   re..............
+|   3488: 34 00 00 00 12 02 30 31 02 06 01 01 04 01 01 32   4.....01.......2
+|   3504: 02 02 05 04 08 08 84 80 80 80 80 12 03 00 16 00   ................
+|   3520: 00 00 05 04 1b 84 80 80 80 80 11 03 00 3c 00 00   .............<..
+|   3536: 00 16 05 34 74 61 62 6c 01 06 01 01 05 02 03 65   ...4tabl.......e
+|   3552: 72 6d 01 02 04 0b 1b 84 80 80 80 80 10 03 00 3c   rm.............<
+|   3568: 00 00 00 16 05 34 65 61 63 68 01 02 03 01 04 70   .....4each.....p
+|   3584: 72 65 73 01 02 05 04 09 1a 84 80 80 80 80 0f 03   res.............
+|   3600: 00 3a 00 00 00 15 04 33 74 65 72 01 02 04 02 02   .:.....3ter.....
+|   3616: 68 65 01 06 01 01 03 04 08 1b 84 80 80 80 80 0e   he..............
+|   3632: 03 00 3c 00 00 00 16 04 33 70 72 65 01 02 05 01   ..<.....3pre....
+|   3648: 03 74 61 62 01 06 01 01 05 04 08 1a 84 80 80 80   .tab............
+|   3664: 80 0d 03 00 3a 00 00 00 15 04 33 66 6f 72 01 02   ....:.....3for..
+|   3680: 02 02 02 74 73 01 06 01 01 04 04 08 1b 84 80 80   ...ts...........
+|   3696: 80 80 0c 03 00 3c 00 00 00 16 03 32 74 68 01 06   .....<.....2th..
+|   3712: 01 01 03 00 04 33 65 61 63 01 02 03 04 09 18 84   .....3eac.......
+|   3728: 80 80 80 80 0b 03 00 36 00 00 00 13 03 32 74 61   .......6.....2ta
+|   3744: 01 06 01 01 05 02 01 65 01 02 04 04 09 19 84 80   .......e........
+|   3760: 80 80 80 0a 03 00 38 00 00 00 14 03 32 69 6e 01   ......8.....2in.
+|   3776: 06 01 01 02 01 02 70 72 01 02 05 04 09 18 84 80   ......pr........
+|   3792: 80 80 80 09 03 00 36 00 00 00 13 03 32 66 6f 01   ......6.....2fo.
+|   3808: 02 02 02 01 74 01 06 01 01 04 04 07 1b 84 80 80   ....t...........
+|   3824: 80 80 08 03 00 3c 00 00 00 16 02 31 74 01 0a 04   .....<.....1t...
+|   3840: 01 01 03 04 00 03 32 65 61 01 02 03 04 0a 17 84   ......2ea.......
+|   3856: 80 80 80 80 07 03 00 34 00 00 00 12 02 31 69 01   .......4.....1i.
+|   3872: 06 01 01 02 01 01 71 01 02 05 04 08 18 84 80 80   ......q.........
+|   3888: 80 80 06 03 00 36 00 00 00 13 02 31 65 01 02 03   .....6.....1e...
+|   3904: 01 01 66 01 08 02 01 01 04 04 06 1b 84 80 80 80   ..f.............
+|   3920: 80 05 03 00 3c 00 00 00 16 05 30 74 65 72 6d 01   ....<.....0term.
+|   3936: 02 04 02 02 68 65 01 06 01 01 03 04 09 14 84 80   ....he..........
+|   3952: 80 80 80 04 03 00 2e 00 00 00 10 06 30 74 61 62   ............0tab
+|   3968: 6c 65 01 06 01 01 05 04 15 84 80 80 80 80 03 03   le..............
+|   3984: 00 30 00 00 00 11 02 08 30 70 72 65 73 65 6e 74   .0......0present
+|   4000: 01 02 05 05 1b 84 80 80 80 80 02 03 00 3c 00 00   .............<..
+|   4016: 00 16 04 30 66 74 73 01 06 01 01 04 01 02 69 6e   ...0fts.......in
+|   4032: 01 06 01 01 04 0a 1a 84 80 80 80 80 01 03 00 3a   ...............:
+|   4048: 00 00 00 15 05 30 65 61 63 68 01 02 03 01 03 66   .....0each.....f
+|   4064: 6f 72 01 02 02 04 09 06 01 03 00 12 03 0b 0f 00   or..............
+|   4080: 00 08 8c 80 80 80 80 11 03 00 16 00 00 00 05 04   ................
+| page 3 offset 8192
+|      0: 0a 00 00 00 32 0e 4f 00 0f fa 0f f1 0f e9 0f e1   ....2.O.........
+|     16: 0f d8 0f d1 0f c9 0f c1 0f b9 0f b1 0f a9 0f a0   ................
+|     32: 0f 98 0f 91 0f 87 0f 80 0f 78 0f 71 0f 68 0f 5f   .........x.q.h._
+|     48: 0f 56 0f 4d 0f 41 0f 38 0f 2f 0f 26 0f 1d 0f 13   .V.M.A.8./.&....
+|     64: 0f 0a 0f 01 0e f7 0e ee 0e e6 0e dd 0e d6 0e cd   ................
+|     80: 0e c3 0e ba 0e b0 0e a8 0e 9f 0e 96 0e 8e 0e 85   ................
+|     96: 0e 7c 0e 73 0e 6a 0e 60 0e 58 0e 4f 00 00 00 00   .|.s.j.`.X.O....
+|   3648: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08   ................
+|   3664: 04 01 10 01 03 34 74 20 07 04 01 0e 01 03 34 1e   .....4t ......4.
+|   3680: 09 05 01 12 01 03 33 74 68 1c 08 04 01 10 01 03   ......3th.......
+|   3696: 33 6e 1a 08 04 01 10 01 03 32 77 18 08 04 01 10   3n.......2w.....
+|   3712: 01 03 32 74 16 08 04 01 10 01 03 32 6e 14 07 04   ..2t.......2n...
+|   3728: 01 0e 01 03 32 12 08 04 01 10 01 03 31 74 10 08   ....2.......1t..
+|   3744: 04 01 10 01 03 31 6e 0e 07 04 01 0e 01 03 31 0c   .....1n.......1.
+|   3760: 09 04 01 12 01 03 30 74 68 0a 08 04 01 10 01 03   ......0th.......
+|   3776: 30 74 08 09 04 01 12 01 03 30 6e 75 06 08 04 01   0t.......0nu....
+|   3792: 10 01 03 30 6e 04 06 04 01 0c 01 03 02 08 04 01   ...0n...........
+|   3808: 10 01 02 34 72 22 07 04 01 0e 01 02 34 20 08 04   ...4r.......4 ..
+|   3824: 01 10 01 02 33 72 1e 09 04 01 12 01 02 33 61 72   ....3r.......3ar
+|   3840: 1c 08 04 01 10 01 02 32 74 1a 08 04 01 10 02 02   .......2t.......
+|   3856: 32 69 18 09 04 01 12 01 02 32 61 72 16 08 04 01   2i.......2ar....
+|   3872: 10 01 02 31 74 14 08 04 01 10 01 02 31 6e 12 08   ...1t.......1n..
+|   3888: 04 01 10 01 02 31 62 10 08 04 01 10 01 02 31 32   .....1b.......12
+|   3904: 0e 0b 04 01 16 01 02 30 74 68 65 72 0c 08 04 01   .......0ther....
+|   3920: 10 01 02 30 74 0a 08 04 01 10 01 02 30 6e 08 08   ...0t.......0n..
+|   3936: 04 01 10 01 02 30 62 06 08 04 01 10 01 02 30 61   .....0b.......0a
+|   3952: 04 06 04 01 0c 01 02 02 07 04 09 10 01 34 74 22   .............4t.
+|   3968: 06 04 09 0e 01 34 20 08 04 09 12 01 33 74 65 1e   .....4 .....3te.
+|   3984: 07 04 09 10 01 33 70 1c 07 04 09 10 01 33 66 1a   .....3p......3f.
+|   4000: 08 04 09 12 01 32 74 68 18 07 04 09 10 01 32 74   .....2th......2t
+|   4016: 16 07 04 09 10 01 32 69 14 07 04 09 10 01 32 66   ......2i......2f
+|   4032: 12 07 04 09 10 01 31 74 10 07 04 09 10 01 31 69   ......1t......1i
+|   4048: 0e 06 04 09 0e 01 31 0c 08 04 09 12 01 30 74 65   ......1......0te
+|   4064: 0a 07 04 09 10 01 30 74 08 07 04 09 10 01 30 70   ......0t......0p
+|   4080: 06 08 04 09 12 01 30 66 74 04 05 04 09 0c 01 02   ......0ft.......
+| page 4 offset 12288
+|      0: 0d 00 00 00 03 0f eb 00 0f f9 0f f2 0f eb 00 00   ................
+|   4064: 00 00 00 00 00 00 00 00 00 00 00 05 03 03 00 10   ................
+|   4080: 03 05 05 02 03 00 10 04 06 05 01 03 00 10 04 04   ................
+| page 5 offset 16384
+|      0: 0a 00 00 00 02 0f eb 00 0f eb 0f f4 00 00 00 00   ................
+|   4064: 00 00 00 00 00 00 00 00 00 00 00 08 03 15 01 70   ...............p
+|   4080: 67 73 7a 18 0b 03 1b 01 76 65 72 73 69 6f 6e 04   gsz.....version.
+| page 6 offset 20480
+|      0: 0d 00 00 00 03 0f f2 00 0f fc 0f f7 0f f2 00 00   ................
+|   4080: 00 00 03 03 02 01 03 03 02 02 01 02 02 01 02 09   ................
+| end 89028ffd2c29b679e250.db
+}]} {}
+
+do_catchsql_test 43.1 {
+  INSERT INTO t1(t1) VALUES('optimize');
+} {1 {database disk image is malformed}}
+
+#-------------------------------------------------------------------------
+reset_db
+do_execsql_test 44.1 {
+  CREATE VIRTUAL TABLE t1 USING fts5(a,b unindexed,c,tokenize="porter ascii");
+  REPLACE INTO t1_data VALUES(1,X'03090009');
+  REPLACE INTO t1_data VALUES(10,X'000000000103030003010101020101030101');
+  INSERT INTO t1_data VALUES(137438953473,X'0000002e023061011202010162010203010163010204010167010601020201016801050102030101690106010204040606060808');
+  INSERT INTO t1_data VALUES(274877906945,X'0000001f02306702080201020201016802080301020301016a420804010204040909');
+  INSERT INTO t1_data VALUES(412316860417,X'0000002e023061030202010162030203010163030204010167030601020201016803060102030101690306010204040606060808');
+  INSERT INTO t1_idx VALUES(1,X'',2);
+  INSERT INTO t1_idx VALUES(2,X'',2);
+  INSERT INTO t1_idx VALUES(3,X'',2);
+  INSERT INTO t1_content VALUES(1,'a b c','d e f','g h i');
+  INSERT INTO t1_content VALUES(2,'g h i','a b c','g h i');
+  INSERT INTO t1_content VALUES(3,'a b c','g h i','g h i');
+  INSERT INTO t1_docsize VALUES(1,X'030003');
+  INSERT INTO t1_docsize VALUES(2,X'030003');
+  INSERT INTO t1_docsize VALUES(3,X'030003');
+} {}
+
+do_catchsql_test 44.2 {
+INSERT INTO t1(t1) VALUES('integrity-check');
+} {1 {database disk image is malformed}}
+
+do_catchsql_test 44.2 {
+  SELECT snippet(t1, -1, '.', '..', '', 2 ) FROM t1('g h') ORDER BY rank; 
+} {1 {database disk image is malformed}}
+
+#--------------------------------------------------------------------------
+reset_db
+do_test 45.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 24576 pagesize 4096 filename crash-0b162c9e69b999.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 00 00 00 00 06   .....@  ........
+|     32: 00 00 00 00 00 00 00 00 00 00 00 06 00 00 00 04   ................
+|     48: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00   ................
+|     96: 00 00 00 00 0d 00 00 00 06 0e 0f 00 0f aa 0f 53   ...............S
+|    112: 0e e8 0e 8b 0e 33 0e 0f 00 00 00 00 00 00 00 00   .....3..........
+|   3584: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22   ................
+|   3600: 06 06 17 11 11 01 31 74 61 62 6c 65 62 62 62 62   ......1tablebbbb
+|   3616: 06 43 52 45 41 54 45 20 54 41 42 4c 45 20 62 62   .CREATE TABLE bb
+|   3632: 28 61 29 56 05 06 17 1f 1f 01 7d 74 61 52 6c 65   (a)V.......taRle
+|   3648: 74 31 5f 63 6f 6e 66 69 67 74 31 5f 63 6f 6e 66   t1_configt1_conf
+|   3664: 69 67 05 43 52 45 41 54 45 20 54 41 42 4c 45 20   ig.CREATE TABLE 
+|   3680: 27 74 31 5f 63 6f 6e 66 69 67 27 28 6b 20 50 52   't1_config'(k PR
+|   3696: 49 4d 41 52 59 20 4b 45 59 2c 20 76 29 20 57 49   IMARY KEY, v) WI
+|   3712: 54 48 4f 55 54 20 52 4f 57 49 44 5b 04 07 17 21   THOUT ROWID[...!
+|   3728: 21 01 81 01 74 61 62 6c 65 74 31 5f 64 6f 73 73   !...tablet1_doss
+|   3744: 69 7a 65 74 31 5f 64 6f 63 73 69 7a 65 04 43 52   izet1_docsize.CR
+|   3760: 45 41 54 45 20 54 41 42 4c 45 20 27 74 31 5f 64   EATE TABLE 't1_d
+|   3776: 6f 63 73 69 7a 65 27 28 69 64 20 49 4e 54 45 47   ocsize'(id INTEG
+|   3792: 45 52 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20   ER PRIMARY KEY, 
+|   3808: 73 7a 20 42 4c 4f 42 29 69 03 07 17 19 19 01 81   sz BLOB)i.......
+|   3824: 2d 74 61 62 6c 65 74 31 5f 69 64 78 74 31 5f 69   -tablet1_idxt1_i
+|   3840: 64 78 03 43 52 45 41 54 45 20 54 41 42 4c 45 20   dx.CREATE TABLE 
+|   3856: 27 74 31 5f 69 64 78 27 28 73 65 67 69 64 2c 20   't1_idx'(segid, 
+|   3872: 74 65 72 6d 2c 20 70 67 6e 6f 2c 20 50 52 49 4d   term, pgno, PRIM
+|   3888: 41 52 59 20 4b 45 59 28 73 65 67 69 64 2c 20 74   ARY KEY(segid, t
+|   3904: 65 72 6d 29 29 20 57 49 54 48 4f 55 54 20 52 4f   erm)) WITHOUT RO
+|   3920: 57 49 44 55 02 07 17 1b 1b 01 81 01 74 61 62 6c   WIDU........tabl
+|   3936: 65 74 31 5f 64 61 74 61 74 31 5f 64 61 74 61 02   et1_datat1_data.
+|   3952: 43 52 45 41 54 45 20 54 41 42 4c 45 20 27 74 31   CREATE TABLE 't1
+|   3968: 5f 64 61 74 61 27 28 69 64 20 49 4e 54 45 47 45   _data'(id INTEGE
+|   3984: 52 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20 62   R PRIMARY KEY, b
+|   4000: 6c 6f 63 6b 20 42 4c 4f 42 29 54 01 07 17 11 11   lock BLOB)T.....
+|   4016: 08 81 15 74 61 62 6c 65 74 31 74 31 43 52 45 41   ...tablet1t1CREA
+|   4032: 54 45 20 56 49 52 54 55 41 4c 20 54 41 42 4c 45   TE VIRTUAL TABLE
+|   4048: 20 74 31 20 55 53 49 4e 47 20 66 74 73 35 28 61    t1 USING fts5(a
+|   4064: 2c 62 2c 70 72 65 66 69 78 3d 22 31 2c 32 2c 33   ,b,prefix=.1,2,3
+|   4080: 2c 34 22 2c 20 63 6f 6e 74 65 6e 74 3d 22 22 29   ,4., content=..)
+| page 2 offset 4096
+|      0: 0d 0b 6a 00 37 09 4c 02 0f e7 09 4c 0f c6 0f a4   ..j.7.L....L....
+|     16: 0f 88 0f 6d 0f 4b 0f 2c 0f 0e 0e ec 0e cd 0e ad   ...m.K.,........
+|     32: 0e 8e 0e 6c 0e 4b 0e 29 0e 08 0d e6 0d c4 0d b5   ...l.K.)........
+|     48: 0d 97 0d 76 0d 54 0d 31 0d 15 0c f3 0c d3 0c b5   ...v.T.1........
+|     64: 0c 95 0c 73 0c 54 0c 32 0c 10 0b ee 0b cc 0b b0   ...s.T.2........
+|     80: 0b 8d 0b 7e 0b 48 0b 2e 0b 0b 0a ef 0a cc 0a ad   ...~.H..........
+|     96: 0a 8c 0a 6d 0a 4d 0a 2b 0a 0c 09 ec 09 ca 09 a8   ...m.M.+........
+|    112: 09 86 09 63 0f f1 00 00 00 00 00 00 00 00 00 00   ...c............
+|   2368: 00 00 00 00 00 00 00 00 00 00 00 00 15 0a 03 00   ................
+|   2384: 30 00 00 00 01 01 03 35 00 03 01 01 12 02 01 12   0......5........
+|   2400: 03 01 11 1c 8c 80 80 80 80 10 03 00 3e 00 00 00   ............>...
+|   2416: 17 01 05 05 34 74 61 62 6c 03 02 03 01 04 77 68   ....4tabl.....wh
+|   2432: 65 72 03 02 06 09 1b 8c 80 80 80 80 0f 03 00 3c   er.............<
+|   2448: 00 00 00 16 05 34 66 75 73 34 03 02 02 01 04 6e   .....4fus4.....n
+|   2464: 75 6d 62 03 06 01 04 09 1b 8c 80 80 80 80 0e 03   umb.............
+|   2480: 00 3c 00 00 00 16 04 33 74 68 65 03 06 01 01 04   .<.....3the.....
+|   2496: 01 03 77 68 65 03 02 04 04 0a 1b 8c 80 80 80 80   ..whe...........
+|   2512: 0d 03 00 3c 00 00 00 16 04 33 6e 74 6d 03 06 01   ...<.....3ntm...
+|   2528: 01 05 01 03 74 61 62 05 62 03 04 0a 19 8c 80 80   ....tab.b.......
+|   2544: 80 80 0c 03 00 38 00 00 00 14 03 32 77 68 03 02   .....8.....2wh..
+|   2560: 04 00 04 33 66 74 73 03 02 02 04 07 18 8c 80 80   ...3fts.........
+|   2576: 80 80 0b 03 00 36 00 00 00 13 03 32 74 61 03 02   .....6.....2ta..
+|   2592: 03 02 01 68 03 06 01 01 04 04 07 1b 8c 80 80 80   ...h............
+|   2608: 80 0a 03 00 3c 00 00 00 16 03 32 6e 75 03 06 01   ....<.....2nu...
+|   2624: 01 05 01 02 6f 66 03 06 01 01 06 04 09 19 8c 80   ....of..........
+|   2640: 80 80 80 09 03 00 38 00 00 00 14 03 32 66 74 03   ......8.....2ft.
+|   2656: 02 02 01 02 69 73 03 06 01 01 03 04 07 18 8c 80   ....is..........
+|   2672: 80 80 80 08 03 00 36 00 00 00 13 02 31 74 03 08   ......6.....1t..
+|   2688: 03 01 01 04 01 01 77 03 02 04 04 09 1a 8c 80 80   ......w.........
+|   2704: 80 80 07 03 00 3a ff 00 00 15 02 31 6e 03 08 01   .....:.....1n...
+|   2720: 01 02 05 01 01 6f 03 06 01 01 06 04 09 18 8c 80   .....o..........
+|   2736: 80 80 80 06 03 00 36 00 00 00 13 04 02 31 66 03   ......6......1f.
+|   2752: 02 02 01 01 69 03 06 01 01 03 05 06 1c 8c 80 80   ....i...........
+|   2768: 80 80 05 03 00 3e 00 00 00 17 04 30 74 68 65 03   .....>.....0the.
+|   2784: 06 01 01 04 01 05 77 68 65 72 65 03 02 04 0a 15   ......where.....
+|   2800: 8c 80 80 80 80 04 03 00 30 00 00 00 11 01 01 06   ........0.......
+|   2816: 06 30 74 61 62 6c 65 03 02 03 07 1c 8c 80 80 80   .0table.........
+|   2832: 80 03 03 00 3e 00 00 00 17 07 30 6e 75 6d 62 65   ....>.....0numbe
+|   2848: 72 03 06 01 01 05 01 02 6f 66 03 06 04 0d 13 8c   r.......of......
+|   2864: 80 80 80 80 02 03 00 2c 00 00 00 0f 01 01 03 02   .......,........
+|   2880: 30 6e 03 06 01 01 02 07 1b 8c 80 80 80 80 01 03   0n..............
+|   2896: 00 3c 00 00 00 16 08 30 66 74 73 34 61 75 78 03   .<.....0fts4aux.
+|   2912: 02 02 01 02 69 73 03 06 04 0c 00 00 00 14 2a 00   ....is........*.
+|   2928: 00 00 01 01 02 24 00 02 01 01 12 02 01 12 08 88   .....$..........
+|   2944: 80 80 80 80 11 03 00 16 00 00 01 05 02 1c 88 80   ................
+|   2960: 80 80 80 11 03 00 3e 00 00 00 17 05 34 72 6f 77   ......>.....4row
+|   2976: 73 02 06 01 01 05 01 04 74 68 65 72 02 02 04 0b   s.......ther....
+|   2992: 15 88 80 80 80 80 10 03 00 30 00 00 00 11 02 01   .........0......
+|   3008: 01 07 05 34 62 65 74 77 02 02 04 08 1b 88 80 80   ...4betw........
+|   3024: 80 80 0f 03 00 3c 00 00 00 16 04 04 33 72 6f 77   .....<......3row
+|   3040: 02 06 01 01 05 01 03 74 68 65 02 08 05 0a 1b 88   .......the......
+|   3056: 80 80 80 80 0e 03 00 3c 00 00 00 16 02 01 02 04   .......<........
+|   3072: 33 61 72 65 02 02 03 01 03 62 65 74 02 02 07 08   3are.....bet....
+|   3088: 1b 88 80 80 80 80 0d 03 00 3c 00 00 00 16 03 32   .........<.....2
+|   3104: 74 68 02 08 02 01 01 07 00 04 33 61 6e 64 02 06   th........3and..
+|   3120: 04 0a 1b 88 80 80 80 80 0c 03 00 3c 00 00 00 16   ...........<....
+|   3136: 03 32 69 6e 02 06 01 01 06 01 02 72 6f 02 06 01   .2in.......ro...
+|   3152: 01 05 04 09 18 88 80 80 80 80 0b 03 00 36 00 00   .............6..
+|   3168: 00 13 02 03 32 61 72 02 02 03 01 02 62 65 02 02   ....2ar.....be..
+|   3184: 04 05 07 1b 88 80 80 80 80 0a 03 00 3c 00 00 00   ............<...
+|   3200: 16 02 31 74 02 08 02 01 01 07 00 03 32 61 6e 02   ..1t........2an.
+|   3216: 06 01 01 04 09 19 88 80 80 80 80 09 03 00 38 00   ..............8.
+|   3232: 00 00 14 02 31 6e 02 06 01 01 03 01 01 72 02 06   ....1n.......r..
+|   3248: 01 01 05 04 08 17 88 80 80 80 80 08 03 00 34 00   ..............4.
+|   3264: 00 00 12 02 31 62 02 02 04 01 01 69 02 06 01 01   ....1b.....i....
+|   3280: 06 04 06 19 88 80 80 80 80 07 03 00 38 00 00 00   ............8...
+|   3296: 14 04 02 31 32 02 02 05 01 01 61 02 08 03 01 01   ...12.....a.....
+|   3312: 02 05 06 1b 88 80 80 80 80 06 03 00 3c 00 00 00   ............<...
+|   3328: 16 06 30 74 68 65 72 65 02 02 02 00 02 31 31 02   ..0there.....11.
+|   3344: 06 01 01 04 0a 15 88 80 80 80 80 05 03 00 30 00   ..............0.
+|   3360: 00 00 11 01 01 05 04 30 74 68 65 02 06 01 01 07   .......0the.....
+|   3376: 07 1c 88 80 80 80 80 04 03 00 3e 00 00 00 17 01   ..........>.....
+|   3392: 01 06 02 30 6e 02 06 01 01 03 01 04 72 6f 77 73   ...0n.......rows
+|   3408: 02 06 07 08 1b 88 80 80 80 80 03 03 00 3c 00 00   .............<..
+|   3424: 00 16 08 30 62 65 74 77 65 65 6e 02 02 04 01 02   ...0between.....
+|   3440: 69 6e 02 06 04 0c 1a 88 80 80 80 80 02 03 00 3a   in.............:
+|   3456: 00 00 00 15 04 30 61 6e 64 02 06 01 01 02 02 02   .....0and.......
+|   3472: 72 65 02 02 03 04 0a 17 88 80 80 80 80 01 03 00   re..............
+|   3488: 34 00 00 00 12 02 30 31 02 06 01 01 04 01 01 32   4.....01.......2
+|   3504: 02 02 06 04 08 08 84 80 80 80 80 12 03 00 16 00   ................
+|   3520: 00 00 05 04 1b 84 80 80 80 80 11 03 00 3c 00 00   .............<..
+|   3536: 00 16 05 34 74 61 62 6c 01 06 01 01 05 02 03 65   ...4tabl.......e
+|   3552: 72 6d 01 02 04 0b 1b 84 80 80 80 80 10 03 00 3c   rm.............<
+|   3568: 00 00 00 16 05 34 65 61 63 68 01 02 03 01 04 70   .....4each.....p
+|   3584: 72 65 73 01 02 05 04 09 1a 84 80 80 80 80 0f 03   res.............
+|   3600: 00 3a 00 00 00 15 04 33 74 65 72 01 02 04 02 02   .:.....3ter.....
+|   3616: 68 65 01 06 01 01 03 04 08 1b 84 80 80 80 80 0e   he..............
+|   3632: 03 00 3c 00 00 00 16 04 33 70 72 65 01 02 05 01   ..<.....3pre....
+|   3648: 03 74 61 62 01 06 01 01 05 04 08 1a 84 80 80 80   .tab............
+|   3664: 80 0d 03 00 3a 00 00 00 15 04 33 66 6f 72 01 02   ....:.....3for..
+|   3680: 02 02 02 74 73 01 06 01 01 04 04 08 1b 84 80 80   ...ts...........
+|   3696: 80 80 0c 03 00 3c 00 00 00 16 03 32 74 68 01 06   .....<.....2th..
+|   3712: 01 01 03 00 04 33 65 61 63 01 02 03 04 09 18 84   .....3eac.......
+|   3728: 80 80 80 80 0b 03 00 36 00 00 00 13 03 32 74 61   .......6.....2ta
+|   3744: 01 06 01 01 05 02 01 65 01 02 04 04 09 19 84 80   .......e........
+|   3760: 80 80 80 0a 03 00 38 00 00 00 14 03 32 69 6e 01   ......8.....2in.
+|   3776: 06 01 01 02 01 02 70 72 01 02 05 04 09 18 84 80   ......pr........
+|   3792: 80 80 80 09 03 00 36 00 00 00 13 03 32 66 6f 01   ......6.....2fo.
+|   3808: 02 02 02 01 74 01 06 01 01 04 04 07 1b 84 80 80   ....t...........
+|   3824: 80 80 08 03 00 3c 00 00 00 16 02 31 74 01 0a 04   .....<.....1t...
+|   3840: 01 01 03 04 00 03 32 65 61 01 02 03 04 0a 17 84   ......2ea.......
+|   3856: 80 80 80 80 07 03 00 34 00 00 00 12 02 31 69 01   .......4.....1i.
+|   3872: 06 01 01 02 01 01 70 01 02 05 04 08 18 84 80 80   ......p.........
+|   3888: 80 80 06 03 00 36 00 00 00 13 02 31 65 01 02 03   .....6.....1e...
+|   3904: 01 01 66 01 08 02 01 01 04 04 06 1b 84 80 80 80   ..f.............
+|   3920: 80 05 03 00 3c 00 00 00 16 05 30 74 65 72 6d 01   ....<.....0term.
+|   3936: 02 04 02 02 68 65 01 06 01 01 03 04 09 14 84 80   ....he..........
+|   3952: 80 80 80 04 03 00 2e 00 00 00 10 06 30 74 61 62   ............0tab
+|   3968: 6c 65 01 06 00 01 05 04 15 84 80 80 80 80 03 03   le..............
+|   3984: 00 30 00 00 00 11 02 08 30 70 72 65 73 65 6e 74   .0......0present
+|   4000: 01 02 05 05 1b 84 80 80 80 80 02 03 00 3c 00 00   .............<..
+|   4016: 00 16 04 30 66 74 73 01 06 01 01 04 01 02 69 6e   ...0fts.......in
+|   4032: 01 06 01 01 04 0a 1a 84 80 80 80 80 01 03 00 3a   ...............:
+|   4048: 00 00 00 15 05 30 65 61 63 68 01 02 03 01 03 66   .....0each.....f
+|   4064: 6f 72 01 02 02 04 09 06 01 03 00 12 03 0b 0f 00   or..............
+|   4080: 00 08 8c 80 80 80 80 11 03 00 16 00 00 00 05 04   ................
+| page 3 offset 8192
+|      0: 0a 00 00 00 32 0e 4f 00 0f fa 10 f1 0f e9 0f e1   ....2.O.........
+|     16: 0f d8 0f d1 0f c9 0f c1 0f b9 0f b1 0f a9 0f a0   ................
+|     32: 0f 98 0f 90 0f 87 0f 80 0f 78 0f 71 0f 68 0f 5f   .........x.q.h._
+|     48: bd 56 0f 4d 0f 41 0f 38 0f 2f 0f 26 0f 1d 0f 13   .V.M.A.8./.&....
+|     64: 0f 0a 0f 01 0e f7 0e ee 0e e6 0e dd 0e d6 0e cd   ................
+|     80: 0e c3 0e ba 0e b0 0e a8 0e 9f 0e 96 0e 8e 0e 85   ................
+|     96: 0e 7c 0e 73 0e 6a 0e 60 0e 58 0e 4f 00 00 00 00   .|.s.j.`.X.O....
+|   3648: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08   ................
+|   3664: 04 01 10 2f 03 34 74 20 07 04 01 0e 01 03 34 1e   .../.4t ......4.
+|   3680: 09 04 01 12 01 03 33 74 68 1c 08 04 01 10 01 03   ......3th.......
+|   3696: 33 6e 1a 08 04 01 10 01 03 32 77 18 08 04 01 10   3n.......2w.....
+|   3712: 01 03 32 74 16 08 04 01 10 01 03 32 6e 14 07 04   ..2t.......2n...
+|   3728: 01 0e 01 03 32 12 08 04 01 10 01 03 31 74 10 08   ....2.......1t..
+|   3744: 04 01 10 01 03 31 6e 0e 07 04 01 0e 02 03 31 0c   .....1n.......1.
+|   3760: 09 04 01 12 01 03 30 74 68 0a 08 04 01 10 01 03   ......0th.......
+|   3776: 30 74 08 09 04 01 12 01 03 30 6e 75 06 08 04 01   0t.......0nu....
+|   3792: 10 01 03 30 6e 04 06 04 01 0c 01 05 52 08 04 01   ...0n.......R...
+|   3808: 10 01 02 34 72 22 07 04 01 0e 01 02 34 20 08 04   ...4r.......4 ..
+|   3824: 01 10 01 02 33 72 1e 09 04 01 12 01 02 33 61 72   ....3r.......3ar
+|   3840: 1c 08 04 01 10 01 02 32 74 1a 08 04 01 10 b3 02   .......2t.......
+|   3856: 32 69 18 09 04 01 12 01 02 32 61 72 16 08 04 01   2i.......2ar....
+|   3872: 10 01 02 31 74 14 08 04 01 10 01 02 31 6e 12 08   ...1t.......1n..
+|   3888: 04 01 10 01 02 31 62 10 08 04 01 10 01 02 31 32   .....1b.......12
+|   3904: 0e 0b 04 01 16 01 02 30 74 68 65 72 0c 08 04 01   .......0ther....
+|   3920: 10 01 02 30 74 0a 08 04 01 10 01 02 30 6e 08 08   ...0t.......0n..
+|   3936: 04 01 10 01 02 30 62 06 08 04 01 10 01 02 30 61   .....0b.......0a
+|   3952: 04 06 04 01 0c 01 02 02 07 04 09 10 01 34 74 22   .............4t.
+|   3968: 06 04 09 0e 01 34 20 08 04 09 12 01 33 74 65 1e   .....4 .....3te.
+|   3984: 07 04 09 10 01 33 70 1c 07 04 09 10 01 33 66 1a   .....3p......3f.
+|   4000: 08 04 09 12 01 32 74 68 18 07 04 09 10 01 32 74   .....2th......2t
+|   4016: 16 07 04 09 10 01 32 69 14 07 04 09 10 01 32 66   ......2i......2f
+|   4032: 12 07 04 09 10 01 31 74 10 07 04 09 10 01 31 69   ......1t......1i
+|   4048: 0e 06 04 09 0e 01 31 0c 08 04 09 12 01 30 74 65   ......1......0te
+|   4064: 0a 07 04 09 10 01 30 74 08 07 04 09 10 01 30 70   ......0t......0p
+|   4080: 06 08 04 09 12 01 30 66 74 04 05 04 09 0c 01 02   ......0ft.......
+| page 4 offset 12288
+|      0: 0d 00 00 00 03 0f eb 00 0f f9 0f f2 0f eb 00 00   ................
+|   4064: 00 00 00 00 00 00 00 00 00 00 00 05 03 03 00 10   ................
+|   4080: 03 05 05 02 03 00 10 04 06 05 01 03 00 10 04 04   ................
+| page 5 offset 16384
+|      0: 0a 00 00 00 02 0f eb 00 0f eb 0f f4 00 00 00 00   ................
+|   4064: 00 00 00 00 00 00 00 00 00 00 00 08 03 15 01 70   ...............p
+|   4080: 67 73 7a 18 0b 03 1b 01 76 65 72 73 69 6f 6e 04   gsz.....version.
+| page 6 offset 20480
+|      0: 0d 00 00 00 03 0f f2 00 0f fc 0f f7 0f f2 00 00   ................
+|   4080: 00 00 03 03 02 01 03 03 02 02 01 02 02 01 02 09   ................
+}]} {}
+
+do_catchsql_test 45.2 {
+  INSERT INTO t1(t1, rank) VALUES('merge', 5);
+  INSERT INTO t1(t1, rank) VALUES('merge', 5);
+  INSERT INTO t1(t1, rank) VALUES('merge', 5);
+  INSERT INTO t1(t1, rank) VALUES('merge', 5);
+  INSERT INTO t1(t1, rank) VALUES('merge', 5);
+  INSERT INTO t1(t1, rank) VALUES('merge', 5);
+  INSERT INTO t1(t1, rank) VALUES('merge', 5);
+  INSERT INTO t1(t1, rank) VALUES('merge', 5);
+  INSERT INTO t1(t1, rank) VALUES('merge', 5);
+  INSERT INTO t1(t1, rank) VALUES('merge', 5);
+  INSERT INTO t1(t1, rank) VALUES('merge', 5);
+  INSERT INTO t1(t1, rank) VALUES('merge', 5);
+  INSERT INTO t1(t1, rank) VALUES('merge', 5);
+  INSERT INTO t1(t1, rank) VALUES('merge', 5);
+  INSERT INTO t1(t1, rank) VALUES('merge', 5);
+  INSERT INTO t1(t1, rank) VALUES('merge', 5);
+} {0 {}}
+
+#--------------------------------------------------------------------------
+reset_db
+do_test 46.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 32768 pagesize 4096 filename crash-1ee8bd451dd1ad.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 00 00 00 00 08   .....@  ........
+|     32: 00 00 00 02 00 00 00 01 00 00 00 09 00 00 00 04   ................
+|     48: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00   ................
+|     96: 00 00 00 00 0d 0f c7 00 07 0d 92 00 0f 8d 0f 36   ...............6
+|    112: 0e cb 0e 6b 0e 0e 0d b6 0d 92 0d 92 00 00 00 00   ...k............
+|   3472: 00 00 22 08 06 17 11 11 01 31 74 61 62 6c 65 74   .........1tablet
+|   3488: 32 74 32 08 43 52 45 41 54 45 20 54 41 42 4c 45   2t2.CREATE TABLE
+|   3504: 20 74 32 28 78 29 56 07 06 17 1f 1f 01 7d 74 60    t2(x)V.......t`
+|   3520: 62 6c 65 74 31 5f 63 6f 6e 66 69 67 74 31 5f 63   blet1_configt1_c
+|   3536: 6f 6e 66 69 67 07 43 52 45 41 54 45 20 54 41 42   onfig.CREATE TAB
+|   3552: 4c 45 20 27 74 31 5f 63 6f 6e 66 69 67 27 28 6b   LE 't1_config'(k
+|   3568: 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20 76 29    PRIMARY KEY, v)
+|   3584: 20 57 49 54 48 4f 55 54 20 52 4f 57 49 44 5b 06    WITHOUT ROWID[.
+|   3600: 07 17 21 21 01 81 01 74 61 62 6c 65 74 31 5f 64   ..!!...tablet1_d
+|   3616: 6f 63 73 69 7a 65 74 31 5f 64 6f 63 73 69 7a 65   ocsizet1_docsize
+|   3632: 06 43 52 45 41 54 45 20 54 41 42 4c 45 20 27 74   .CREATE TABLE 't
+|   3648: 31 5f 64 6f 63 73 69 7a 65 27 28 69 64 20 49 4e   1_docsize'(id IN
+|   3664: 54 45 47 45 52 20 50 52 49 4d 41 52 59 20 4b 45   TEGER PRIMARY KE
+|   3680: 59 2c 20 73 7a 20 42 4c 4f 42 29 5e 05 07 17 21   Y, sz BLOB)^...!
+|   3696: 21 01 81 07 74 61 62 6c 65 74 31 5f 63 6f 6e 74   !...tablet1_cont
+|   3712: 65 6e 74 74 31 5f 63 6f 6e 74 65 6e 74 05 43 52   entt1_content.CR
+|   3728: 45 41 54 45 20 54 41 42 4c 45 20 27 74 31 5f 63   EATE TABLE 't1_c
+|   3744: 6f 6e 74 65 6e 74 27 28 69 64 20 49 4e 54 45 47   ontent'(id INTEG
+|   3760: 45 52 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20   ER PRIMARY KEY, 
+|   3776: 63 30 2c 20 63 31 2c 20 63 32 29 69 04 07 17 19   c0, c1, c2)i....
+|   3792: 19 01 81 2d 74 61 62 6c 65 74 31 5f 69 64 78 74   ...-tablet1_idxt
+|   3808: 31 5f 69 64 78 04 43 52 45 41 54 45 20 54 41 42   1_idx.CREATE TAB
+|   3824: 4c 45 20 27 74 31 5f 69 64 78 27 28 73 65 67 69   LE 't1_idx'(segi
+|   3840: 64 2c 20 74 65 72 6d 2c 20 70 67 6e 6f 2c 20 50   d, term, pgno, P
+|   3856: 52 49 4d 41 52 59 20 4b 45 59 28 73 65 67 69 64   RIMARY KEY(segid
+|   3872: 2c 20 74 65 72 6d 29 29 20 57 49 54 48 4f 55 54   , term)) WITHOUT
+|   3888: 20 52 4f 57 49 44 55 03 07 17 1b 1b 01 81 01 74    ROWIDU........t
+|   3904: 61 62 6c 65 74 31 5f 64 61 74 61 74 31 5f 64 61   ablet1_datat1_da
+|   3920: 74 61 03 43 52 45 41 54 45 20 54 41 42 4c 45 20   ta.CREATE TABLE 
+|   3936: 27 74 31 5f 64 61 74 61 27 28 69 64 20 49 4e 54   't1_data'(id INT
+|   3952: 45 47 45 52 20 50 52 49 4d 41 52 59 20 4b 45 59   EGER PRIMARY KEY
+|   3968: 2c 20 62 6c 6f 63 6b 20 42 4c 4f 42 29 38 02 06   , block BLOB)8..
+|   3984: 17 11 11 08 5f 74 61 62 6c 65 74 31 74 31 43 52   ...._tablet1t1CR
+|   4000: 45 41 54 45 20 56 49 52 54 55 41 4c 20 54 41 42   EATE VIRTUAL TAB
+|   4016: 4c 45 20 74 31 20 55 53 49 4e 47 20 66 74 73 35   LE t1 USING fts5
+|   4032: 28 61 2c 62 2c 63 29 00 00 00 39 00 00 00 00 00   (a,b,c)...9.....
+| page 3 offset 8192
+|      0: 0d 00 00 00 03 0c 94 00 0f e6 0f ef 0c 94 00 00   ................
+|   3216: 00 00 00 00 86 4a 84 80 80 80 80 01 04 00 8d 18   .....J..........
+|   3232: 00 00 03 2b 02 30 30 01 02 06 01 02 06 01 02 06   ...+.00.........
+|   3248: 1f 02 03 01 02 03 01 02 03 01 08 32 30 31 36 30   ...........20160
+|   3264: 36 30 39 01 02 07 01 02 07 01 02 07 01 01 34 01   609...........4.
+|   3280: 02 05 01 02 05 01 02 05 01 01 35 01 02 04 01 02   ..........5.....
+|   3296: 04 01 02 04 02 07 30 30 30 30 30 30 30 1c 02 3d   ......0000000..=
+|   3312: 01 02 04 01 02 04 01 06 62 69 6e 61 72 79 03 06   ........binary..
+|   3328: 01 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01   ................
+|   3344: 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01 02   ................
+|   3360: 02 03 06 01 02 02 03 06 01 02 02 03 06 01 02 02   ................
+|   3376: 03 06 01 02 02 03 06 01 02 02 01 08 63 6f 6d 70   ............comp
+|   3392: 69 6c 65 72 01 02 02 01 02 02 01 02 02 01 06 64   iler...........d
+|   3408: 62 73 74 61 74 07 02 03 01 02 03 01 02 03 02 04   bstat...........
+|   3424: 65 62 75 67 04 02 02 01 02 02 01 02 02 01 06 65   ebug...........e
+|   3440: 6e 61 62 6c 65 07 02 02 01 02 02 01 02 02 01 02   nable...........
+|   3456: 02 01 02 02 01 02 02 01 02 02 01 02 02 01 02 02   ................
+|   3472: 01 02 02 01 02 02 01 02 02 01 02 02 01 02 02 01   ................
+|   3488: 02 02 01 02 02 01 02 02 01 02 02 01 02 02 01 02   ................
+|   3504: 02 01 02 02 02 08 78 74 65 6e 73 69 6f 6e 1f 02   ......xtension..
+|   3520: 04 01 02 04 01 02 04 01 04 66 74 73 34 0a 02 03   .........fts4...
+|   3536: 01 02 03 01 02 03 04 01 35 0d 02 03 01 02 03 01   ........5.......
+|   3552: 02 03 01 03 67 63 63 01 02 03 01 02 03 01 02 03   ....gcc.........
+|   3568: 02 06 65 6f 70 6f 6c 79 10 02 03 01 02 03 01 02   ..eopoly........
+|   3584: 03 01 05 6a 73 6f 6e 31 13 02 03 01 02 03 01 02   ...json1........
+|   3600: 03 01 04 6c 6f 61 64 1f 02 03 01 02 03 01 02 03   ...load.........
+|   3616: 01 03 6d 61 78 1c 02 02 01 02 02 01 02 02 02 05   ..max...........
+|   3632: 65 6d 6f 72 79 1c 02 03 01 02 03 01 02 03 04 04   emory...........
+|   3648: 73 79 73 35 16 02 03 01 02 03 01 02 03 01 06 6e   sys5...........n
+|   3664: 6f 63 61 73 65 02 06 01 02 02 03 06 01 02 02 03   ocase...........
+|   3680: 06 01 02 02 03 06 01 02 02 03 06 01 02 02 03 06   ................
+|   3696: 01 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01   ................
+|   3712: 02 02 03 07 01 02 02 03 06 01 02 02 03 06 01 02   ................
+|   3728: 02 01 04 6f 6d 69 74 1f 02 02 01 02 02 01 02 02   ...omit.........
+|   3744: 01 05 72 74 72 65 65 19 02 03 01 02 03 01 02 03   ..rtree.........
+|   3760: 04 02 69 6d 01 06 01 02 02 03 06 01 02 02 03 06   ..im............
+|   3776: 01 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01   ................
+|   3792: 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01 02   ................
+|   3808: 02 03 06 01 02 02 03 06 06 e2 02 03 06 01 02 02   ................
+|   3824: 01 0a 74 68 72 65 61 64 73 61 66 65 22 02 02 01   ..threadsafe....
+|   3840: 02 02 01 02 02 01 04 76 74 61 62 07 02 04 01 02   .......vtab.....
+|   3856: 04 01 02 04 01 01 78 01 06 01 01 02 01 06 01 01   ......x.........
+|   3872: 02 01 06 01 01 02 01 06 01 01 02 01 06 01 01 02   ................
+|   3888: 01 06 01 01 02 01 06 01 01 02 01 06 01 01 02 01   ................
+|   3904: 06 01 01 02 01 06 01 01 02 01 06 01 01 02 01 06   ................
+|   3920: 01 01 02 01 06 01 01 02 01 06 01 01 02 01 06 01   ................
+|   3936: 01 02 01 06 01 01 02 01 06 01 01 02 01 06 01 01   ................
+|   3952: 02 01 06 01 01 02 01 06 01 01 02 01 06 01 01 02   ................
+|   3968: 01 06 01 01 02 01 06 01 01 02 01 06 01 01 02 01   ................
+|   3984: 06 01 01 02 01 06 01 01 02 01 06 01 01 02 01 06   ................
+|   4000: 01 01 02 01 06 01 01 02 01 06 01 01 02 01 06 01   ................
+|   4016: 01 02 01 06 01 01 02 01 06 01 01 02 01 06 01 01   ................
+|   4032: 02 01 06 01 01 02 01 06 01 01 02 04 15 13 0c 0c   ................
+|   4048: 12 44 13 11 0f 47 13 0f 0c 0e 11 10 0f 0e 10 0f   .D...G..........
+|   4064: 44 0f 10 40 15 0f 07 01 03 00 14 24 5a 24 24 0f   D..@.......$Z$$.
+|   4080: 0a 03 00 24 00 00 00 00 01 01 01 00 01 01 01 01   ...$............
+| page 4 offset 12288
+|      0: 0a 00 00 00 01 0f fa 00 0f fa 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 00 00 00 00 00 00 05 04 09 0c 01 02   ................
+| page 5 offset 16384
+|      0: 0d 00 00 00 24 0c 0a 00 0f d8 0f af 0f 86 0f 74   ....$..........t
+|     16: 0f 61 0f 4e 0f 2f 0f 0f 0e ef 0e d7 0e be 0e a5   .a.N./..........
+|     32: 0e 8d 0e 74 0e 5b 0e 40 0e 24 0e 08 0d ef 0d d5   ...t.[.@.$......
+|     48: 0d bb 0d a0 0d 84 0d 68 0d 4f 0d 35 0d 1b 0c fb   .......h.O.5....
+|     64: 0c da 0c b9 0c 99 0c 78 0c 57 0c 3e 0c 24 0c 0a   .......x.W.>.$..
+|   3072: 00 00 00 00 00 00 00 00 00 00 18 24 05 00 25 0f   ...........$..%.
+|   3088: 19 54 48 52 45 41 44 53 41 46 45 3d 30 58 42 49   .THREADSAFE=0XBI
+|   3104: 4e 41 52 59 18 23 05 00 25 0f 19 54 48 52 45 41   NARY.#..%..THREA
+|   3120: 44 53 31 46 45 3d 30 58 4e 4f 43 41 53 45 17 22   DS1FE=0XNOCASE..
+|   3136: 05 00 25 0f 17 54 48 52 45 41 44 53 41 46 45 3d   ..%..THREADSAFE=
+|   3152: 30 58 52 54 52 49 4d 1f 21 05 00 33 0f 19 4f 4d   0XRTRIM.!..3..OM
+|   3168: 49 54 20 4c 4f 41 44 20 45 58 54 45 4e 53 49 4f   IT LOAD EXTENSIO
+|   3184: 4e 58 42 49 4e 41 52 59 1f 20 05 00 33 0f 19 4f   NXBINARY. ..3..O
+|   3200: 4d 49 54 20 4c 4f 41 44 20 45 58 54 45 4e 53 49   MIT LOAD EXTENSI
+|   3216: 4f 4e 58 4e 4f 43 41 53 45 1e 1f 05 00 33 0f 17   ONXNOCASE....3..
+|   3232: 4f 4d 49 54 20 4c 4f 41 44 20 45 58 54 45 4e 53   OMIT LOAD EXTENS
+|   3248: 49 4f 4e 58 52 54 52 49 4d 1f 1e 05 00 33 0f 19   IONXRTRIM....3..
+|   3264: 4d 41 58 20 4d 45 4d 4f 52 59 3d 35 30 30 30 30   MAX MEMORY=50000
+|   3280: 30 30 30 58 42 49 4e 41 52 59 1f 1d 05 00 33 0f   000XBINARY....3.
+|   3296: 19 4d 41 58 20 4d 45 4d 4f 52 59 3d 35 30 30 30   .MAX MEMORY=5000
+|   3312: 30 30 30 30 58 4e 4f 43 41 53 45 1e 1c 05 00 33   0000XNOCASE....3
+|   3328: 0f 17 4d 41 58 20 4d 45 4d 4f 52 59 3d 35 30 30   ..MAX MEMORY=500
+|   3344: 30 30 30 30 30 58 52 54 52 49 4d 18 1b 05 00 25   00000XRTRIM....%
+|   3360: 0f 19 45 4e 41 42 4c 45 20 52 54 52 45 45 58 42   ..ENABLE RTREEXB
+|   3376: 49 4e 41 52 59 18 1a 05 00 25 0f 19 45 4e 41 42   INARY....%..ENAB
+|   3392: 4c 45 20 52 54 52 45 45 58 4e 4f 43 41 53 45 17   LE RTREEXNOCASE.
+|   3408: 19 05 00 25 0f 17 45 4e 40 42 4c 45 20 52 54 52   ...%..EN@BLE RTR
+|   3424: 45 45 58 52 54 52 49 4d 1a 18 05 00 29 0f 19 45   EEXRTRIM....)..E
+|   3440: 4e 41 42 4c 45 20 4d 45 4d 53 59 53 35 58 42 49   NABLE MEMSYS5XBI
+|   3456: 4e 41 52 59 1a 17 05 00 29 0f 19 45 4e 41 42 4c   NARY....)..ENABL
+|   3472: 45 20 4d 45 4d 53 59 53 35 58 4e 4f 43 41 53 45   E MEMSYS5XNOCASE
+|   3488: 19 16 05 00 29 0f 17 45 4e 41 42 4c 45 20 4d 45   ....)..ENABLE ME
+|   3504: 4d 53 59 53 35 58 52 54 52 49 4d 18 15 05 00 25   MSYS5XRTRIM....%
+|   3520: 0f 19 45 4e 41 42 4c 45 20 4a 53 4f 4e 31 59 42   ..ENABLE JSON1YB
+|   3536: 49 4e 41 52 59 18 14 05 00 25 0f 19 45 4e 41 42   INARY....%..ENAB
+|   3552: 4c 45 20 4a 53 4f 4e 31 58 4e 4f 43 41 53 45 17   LE JSON1XNOCASE.
+|   3568: 13 05 00 25 0f 17 45 4e 41 42 4c 45 20 4a 53 4f   ...%..ENABLE JSO
+|   3584: 4e 31 58 52 54 52 49 4d 1a 12 05 00 29 0f 19 45   N1XRTRIM....)..E
+|   3600: 4e 41 42 4c 45 20 47 45 4f 50 4f 4c 59 58 42 49   NABLE GEOPOLYXBI
+|   3616: 4e 41 52 59 1a 11 05 00 29 0f 19 45 4e 41 42 4c   NARY....)..ENABL
+|   3632: 45 20 47 45 4f 50 4f 4c 59 58 4e 4f 43 41 53 45   E GEOPOLYXNOCASE
+|   3648: 19 10 05 00 29 0f 17 45 4e 41 42 4c 45 20 47 45   ....)..ENABLE GE
+|   3664: 4f 50 4f 4c 59 58 52 54 52 49 4d 17 0f 15 00 23   OPOLYXRTRIM....#
+|   3680: 0f 19 45 4e 41 42 4c 45 20 46 54 53 35 58 42 49   ..ENABLE FTS5XBI
+|   3696: 4e 41 52 59 17 0e 05 00 23 0f 19 45 4e 41 42 4c   NARY....#..ENABL
+|   3712: 45 20 46 54 53 35 58 4e 4f 43 41 53 45 16 0d 05   E FTS5XNOCASE...
+|   3728: 00 23 0f a4 45 4e 41 42 4c 45 20 46 54 53 35 58   .#..ENABLE FTS5X
+|   3744: 52 54 52 49 4d 17 0c 05 00 23 0f 19 45 4e 41 42   RTRIM....#..ENAB
+|   3760: 4c 45 20 46 54 53 34 58 42 49 4e 41 52 59 17 0b   LE FTS4XBINARY..
+|   3776: 05 00 23 0f 19 45 4e 41 42 4c 45 20 46 54 53 34   ..#..ENABLE FTS4
+|   3792: 58 4e 4f 43 41 53 45 16 0a 05 00 23 0f 17 45 4e   XNOCASE....#..EN
+|   3808: 41 42 4c 45 20 46 54 53 34 58 52 54 52 49 4d 1e   ABLE FTS4XRTRIM.
+|   3824: 09 05 00 31 0f 19 45 4e 41 42 4c 45 20 44 42 53   ...1..ENABLE DBS
+|   3840: 54 41 54 20 56 54 41 42 58 42 49 4e 41 52 59 1e   TAT VTABXBINARY.
+|   3856: 08 04 f0 31 0f 19 45 4e 41 42 4c 45 20 44 42 53   ...1..ENABLE DBS
+|   3872: 54 41 54 20 56 54 41 42 58 4e 4f 43 41 53 45 1d   TAT VTABXNOCASE.
+|   3888: 07 05 00 31 0f 17 45 4e 41 42 4c 45 20 44 42 53   ...1..ENABLE DBS
+|   3904: 54 41 54 20 56 54 41 42 58 52 54 52 49 4d 11 06   TAT VTABXRTRIM..
+|   3920: 05 00 17 0f 19 44 45 42 55 47 58 42 49 4e 41 52   .....DEBUGXBINAR
+|   3936: 59 11 05 05 00 17 0f 19 44 45 42 55 47 58 4e 4f   Y.......DEBUGXNO
+|   3952: 43 41 53 45 10 04 05 00 17 0f 17 44 45 42 55 47   CASE.......DEBUG
+|   3968: 58 52 54 52 49 4d 27 03 05 00 43 0f 19 43 4f 4d   XRTRIM'...C..COM
+|   3984: 50 49 4c 45 52 3d 67 63 63 2d 35 2e 34 2e 30 20   PILER=gcc-5.4.0 
+|   4000: 32 30 31 36 30 36 30 39 58 42 49 4e 41 52 59 27   20160609XBINARY'
+|   4016: 02 05 00 43 0f 19 43 4f 4d 50 49 4c 45 52 3d 67   ...C..COMPILER=g
+|   4032: 63 63 2d 35 2e 34 2e 30 20 32 30 31 36 30 36 30   cc-5.4.0 2016060
+|   4048: 39 58 4e 4f 43 41 53 45 26 01 05 00 43 0f 17 43   9XNOCASE&...C..C
+|   4064: 4f 4d 50 49 4c 45 52 3d 67 63 63 2d 35 2e 34 2e   OMPILER=gcc-5.4.
+|   4080: 30 20 32 30 31 36 30 36 30 39 58 52 54 52 49 4d   0 20160609XRTRIM
+| page 6 offset 20480
+|      0: 0d 00 00 00 24 0e e0 00 0f f8 0f f0 0f e8 0f e0   ....$...........
+|     16: 0f d8 0f d0 0f c8 0f c0 0f b8 0f b0 0f a8 0f a0   ................
+|     32: 0f 98 0f 90 0f 88 0f 80 0f 78 0f 70 0f 68 0f 60   .........x.p.h.`
+|     48: 0f 58 0f 50 0f 48 0f 40 0f 38 0f 30 0f 28 0f 20   .X.P.H.@.8.0.(. 
+|     64: 0f 18 0f 10 0f 08 0f 00 0e f8 0e f0 0e e8 0e e0   ................
+|   3808: 06 24 03 00 12 02 01 01 06 23 03 00 12 02 01 01   .$.......#......
+|   3824: 06 22 03 00 12 02 01 01 06 21 03 00 12 03 01 01   .........!......
+|   3840: 06 20 03 00 22 03 01 01 06 1f 03 00 12 03 01 01   . ..............
+|   3856: 06 1e 03 00 12 03 01 01 06 1d 03 00 12 03 01 01   ................
+|   3872: 06 1c 03 00 12 03 01 01 06 1b 03 00 12 02 01 01   ................
+|   3888: 06 1a 03 00 12 02 01 01 06 19 03 00 12 02 01 01   ................
+|   3904: 06 18 03 00 12 02 01 01 06 17 03 00 12 02 01 01   ................
+|   3920: 06 16 03 00 12 02 01 01 06 15 03 00 12 02 01 01   ................
+|   3936: 06 14 03 00 12 02 01 01 06 13 03 00 12 02 01 01   ................
+|   3952: 06 12 03 00 12 02 01 01 06 11 03 00 12 02 01 01   ................
+|   3968: 06 10 03 00 12 02 01 01 06 0f 03 00 12 02 01 01   ................
+|   3984: 06 0e 03 00 12 02 01 01 06 0d 03 00 12 02 01 01   ................
+|   4000: 06 0c 03 00 12 02 01 01 06 0b 03 00 12 02 01 01   ................
+|   4016: 06 0a 03 00 12 02 01 01 06 09 03 00 12 03 01 01   ................
+|   4032: 06 08 03 00 12 03 01 01 06 07 03 00 12 03 01 01   ................
+|   4048: 06 a2 03 00 12 01 01 01 06 05 03 00 12 01 01 01   ................
+|   4064: 06 04 03 00 12 01 01 01 06 03 03 00 12 06 01 01   ................
+|   4080: 06 02 03 00 12 06 01 01 06 01 03 00 12 06 01 01   ................
+| page 7 offset 24576
+|      0: 0a 00 00 00 01 0f f4 00 0f f4 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 0b 03 1b 01 76 65 72 73 69 6f 6e 04   ........version.
+| page 8 offset 28672
+|      0: 0d 00 00 00 03 0f d6 00 0f f4 0f e9 0f d6 00 00   ................
+|   4048: 00 00 00 00 00 00 11 03 02 2b 69 6e 74 65 67 72   .........+integr
+|   4064: 69 74 79 2d 63 68 65 63 6b 09 02 02 1b 72 65 62   ity-check....reb
+|   4080: 75 69 6c 64 0a 01 02 1d 6f 70 74 69 6d 69 7a 65   uild....optimize
+| end crash-1ee8bd451dd1ad.db
+}]} {}
+
+do_catchsql_test 46.1 {
+  SELECT snippet(t1,'[','', '--',-1,10) FROM t1('*');
+} {0 {{}}}
+
+#--------------------------------------------------------------------------
+reset_db
+do_test 47.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 40960 pagesize 4096 filename 4b6fc659283f2735616c.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 00 00 00 00 0a   .....@  ........
+|     32: 00 00 00 00 00 00 00 00 00 00 00 0d 00 00 00 04   ................
+|     48: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00   ................
+|     96: 00 00 00 00 0d 00 00 00 0d 0b 6e 00 0f a3 0f 4c   ..........n....L
+|    112: 0e e1 0e 81 0e 24 0d cc 0d 72 0d 1b 0c b0 0c 50   .....$...r.....P
+|    128: 0b f8 0b b3 0b 6e 00 00 00 00 00 00 00 00 00 00   .....n..........
+|   2912: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 43 0d   ..............C.
+|   2928: 06 17 11 11 08 75 74 61 62 6c 65 74 34 74 34 43   .....utablet4t4C
+|   2944: 52 45 41 54 45 20 56 49 52 54 55 41 4c 20 54 41   REATE VIRTUAL TA
+|   2960: 42 4c 45 20 74 34 20 55 53 49 4e 47 20 66 74 73   BLE t4 USING fts
+|   2976: 35 76 6f 63 61 62 28 27 74 32 27 2c 20 27 72 6f   5vocab('t2', 'ro
+|   2992: 77 27 29 43 0c 06 17 11 11 08 75 74 61 62 6c 65   w')C......utable
+|   3008: 74 33 74 33 43 52 45 41 54 45 20 56 49 52 54 55   t3t3CREATE VIRTU
+|   3024: 41 4c 20 54 41 42 4c 45 20 74 33 20 55 53 49 4e   AL TABLE t3 USIN
+|   3040: 47 20 66 74 73 35 76 6f 63 61 62 28 27 74 31 27   G fts5vocab('t1'
+|   3056: 2c 20 27 72 6f 77 27 29 56 0b 06 17 1f 1f 01 7d   , 'row')V.......
+|   3072: 74 61 62 6c 65 7d 42 5f 63 6f 6e 66 69 67 74 32   table.B_configt2
+|   3088: 5f 63 6f 6e 66 69 67 0a 43 52 45 41 54 45 20 54   _config.CREATE T
+|   3104: 41 42 4c 45 20 27 74 32 5f 63 6f 6e 66 69 67 27   ABLE 't2_config'
+|   3120: 28 6b 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20   (k PRIMARY KEY, 
+|   3136: 76 29 20 57 49 54 48 4f 55 54 20 52 4f 57 49 44   v) WITHOUT ROWID
+|   3152: 5e 0a 07 17 21 21 01 81 07 74 61 62 6c 65 74 32   ^...!!...tablet2
+|   3168: 5f 63 6f 6e 74 65 6e 74 74 32 5f 63 6f 6e 74 65   _contentt2_conte
+|   3184: 6e 74 09 43 52 45 41 54 45 20 54 41 42 4c 45 20   nt.CREATE TABLE 
+|   3200: 27 74 32 5f 63 6f 6e 74 65 6e 74 27 28 69 64 20   't2_content'(id 
+|   3216: 49 4e 54 45 47 45 52 20 50 52 49 4d 41 52 59 20   INTEGER PRIMARY 
+|   3232: 4b 45 59 2c 20 63 30 2c 20 63 31 2c 20 63 32 29   KEY, c0, c1, c2)
+|   3248: 69 09 07 17 19 19 01 81 2d 74 61 62 6c 65 74 32   i.......-tablet2
+|   3264: 5f 69 64 78 74 32 5f 69 64 78 08 43 52 45 41 54   _idxt2_idx.CREAT
+|   3280: 45 20 54 41 42 4c 45 20 27 74 32 5f 69 64 78 27   E TABLE 't2_idx'
+|   3296: 28 73 65 67 69 64 2c 20 74 65 72 6d 2c 20 70 67   (segid, term, pg
+|   3312: 6e 6f 2c 20 50 52 49 4d 41 52 59 20 4b 45 59 28   no, PRIMARY KEY(
+|   3328: 73 65 67 69 64 2c 20 74 65 72 6d 29 29 20 57 49   segid, term)) WI
+|   3344: 54 48 4f 55 54 20 52 4f 57 49 44 55 08 07 17 1b   THOUT ROWIDU....
+|   3360: 1b 01 81 01 74 61 62 6c 65 74 32 5f 64 61 74 61   ....tablet2_data
+|   3376: 74 32 5f 64 61 74 61 07 43 52 45 41 54 45 20 54   t2_data.CREATE T
+|   3392: 41 42 4c 45 20 27 74 32 5f 64 61 74 61 27 28 69   ABLE 't2_data'(i
+|   3408: 64 20 49 4e 54 45 47 45 52 20 50 52 49 4d 41 52   d INTEGER PRIMAR
+|   3424: 59 20 4b 45 59 2c 20 62 6c 6f 63 6b 20 42 4c 4f   Y KEY, block BLO
+|   3440: 42 29 58 07 07 17 11 11 08 81 1d 74 61 62 6c 65   B)X........table
+|   3456: 74 32 74 32 43 52 45 41 54 45 20 56 49 52 54 55   t2t2CREATE VIRTU
+|   3472: 41 4c 20 54 41 42 4c 45 20 74 32 20 55 53 49 4e   AL TABLE t2 USIN
+|   3488: 47 20 66 74 73 35 28 27 61 27 2c 5b 62 5d 2c 22   G fts5('a',[b],.
+|   3504: 63 22 2c 64 65 74 61 69 6c 3d 6e 6f 6e 65 2c 63   c.,detail=none,c
+|   3520: 6f 6c 75 6d 6e 73 69 7a 65 3d 30 29 56 06 06 17   olumnsize=0)V...
+|   3536: 1f 1f 01 7d 74 61 62 6c 65 74 31 5f 63 6f 6e 66   ....tablet1_conf
+|   3552: 69 67 74 31 5f 63 6f 6e 66 69 67 06 43 52 45 41   igt1_config.CREA
+|   3568: 54 45 20 54 41 42 4c 45 20 27 74 31 5f 63 6f 6e   TE TABLE 't1_con
+|   3584: 66 69 67 27 28 6b 20 50 52 49 4d 41 52 59 20 4b   fig'(k PRIMARY K
+|   3600: 45 59 2c 20 76 29 20 57 49 54 48 4f 55 54 20 52   EY, v) WITHOUT R
+|   3616: 4f 57 49 44 5b 05 07 17 21 21 01 81 01 74 61 62   OWID[...!!...tab
+|   3632: 6c 65 74 31 5f 64 6f 63 73 69 7a 65 74 31 5f 64   let1_docsizet1_d
+|   3648: 6f 63 73 69 7a 65 05 43 52 45 41 54 45 20 54 41   ocsize.CREATE TA
+|   3664: 42 4c 45 20 27 74 31 5f 64 6f 63 73 69 7a 65 27   BLE 't1_docsize'
+|   3680: 28 69 64 20 49 4e 54 45 47 45 52 20 50 52 49 4d   (id INTEGER PRIM
+|   3696: 41 52 59 20 4b 45 59 2c 20 73 7a 20 42 4c 4f 42   ARY KEY, sz BLOB
+|   3712: 29 5e 04 07 17 21 21 01 81 07 74 61 62 6c 65 74   )^...!!...tablet
+|   3728: 31 5f 63 6f 6e 74 65 6f 74 74 31 5f 63 6f 6e 74   1_conteott1_cont
+|   3744: 65 6e 74 04 43 52 45 41 54 45 20 54 41 42 4c 45   ent.CREATE TABLE
+|   3760: 20 27 74 31 5f 63 6f 6e 74 65 6e 74 27 28 69 64    't1_content'(id
+|   3776: 20 49 4e 54 45 47 46 52 20 50 52 49 4d 41 52 59    INTEGFR PRIMARY
+|   3792: 20 4b 45 59 2c 20 63 30 2c 20 63 31 2c 20 63 32    KEY, c0, c1, c2
+|   3808: 29 69 03 07 17 19 19 01 81 2d 74 61 62 6c 65 74   )i.......-tablet
+|   3824: 31 5f 69 64 78 74 31 5f 69 64 78 03 43 52 45 41   1_idxt1_idx.CREA
+|   3840: 54 45 20 54 41 42 4c 45 20 27 74 31 5f 69 64 78   TE TABLE 't1_idx
+|   3856: 27 28 73 65 67 69 64 2c 20 74 65 72 6d 2c 20 70   '(segid, term, p
+|   3872: 67 6e 6f 2c 20 50 52 49 4d 41 52 59 20 4b 45 59   gno, PRIMARY KEY
+|   3888: 28 73 65 67 69 64 2c 20 74 65 72 6d 29 29 20 57   (segid, term)) W
+|   3904: 49 54 48 4f 55 54 20 52 4f 57 49 44 55 02 07 17   ITHOUT ROWIDU...
+|   3920: 1b 1b 01 81 01 74 61 62 6c 65 74 31 5f 64 61 74   .....tablet1_dat
+|   3936: 61 74 31 5f 64 61 74 61 02 43 52 45 41 54 45 20   at1_data.CREATE 
+|   3952: 54 41 42 4c 45 20 27 74 31 5f 64 61 74 61 27 28   TABLE 't1_data'(
+|   3968: 69 64 20 49 4e 54 45 47 45 52 20 50 52 49 4d 41   id INTEGER PRIMA
+|   3984: 52 59 20 4b 45 59 2c 20 62 6c 6f 63 6b 20 42 4c   RY KEY, block BL
+|   4000: 4f 42 29 5b 01 07 17 11 11 08 81 23 74 61 62 6c   OB)[.......#tabl
+|   4016: 65 74 31 74 31 43 52 45 41 54 45 20 56 49 52 54   et1t1CREATE VIRT
+|   4032: 55 41 4c 20 54 41 42 4c 45 20 74 31 20 55 53 49   UAL TABLE t1 USI
+|   4048: 4e 47 20 66 74 73 35 28 61 2c 62 20 75 6e 69 6e   NG fts5(a,b unin
+|   4064: 64 65 78 65 64 2c 63 2c 74 6f 6b 65 6e 69 7a 65   dexed,c,tokenize
+|   4080: 3d 22 70 6f 72 74 65 72 20 61 73 63 69 69 22 29   =.porter ascii.)
+| page 2 offset 4096
+|      0: 0d 0f 68 00 05 0f 13 00 0f e6 0f 13 0f a8 0f 7c   ..h............|
+|     16: 0f 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 00   .*..............
+|   3856: 00 00 00 15 0a 03 00 30 00 00 00 00 01 03 03 00   .......0........
+|   3872: 03 01 01 01 02 01 01 03 01 01 37 8c 80 80 80 80   ..........7.....
+|   3888: 01 03 00 74 00 00 00 2e 02 30 61 03 02 02 01 01   ...t.....0a.....
+|   3904: 62 03 02 03 01 01 63 03 02 04 01 01 67 03 06 01   b.....c.....g...
+|   3920: 02 02 01 01 68 03 06 01 02 03 01 01 69 03 06 01   ....h.......i...
+|   3936: 02 04 04 06 06 06 08 08 0f ef 00 14 2a 00 00 00   ............*...
+|   3952: 00 01 02 02 00 02 01 01 01 02 01 01 25 88 80 80   ............%...
+|   3968: 80 80 01 03 00 50 00 00 00 1f 02 30 67 02 08 02   .....P.....0g...
+|   3984: 01 02 02 01 01 68 02 08 03 01 02 03 01 01 69 02   .....h........i.
+|   4000: 08 04 01 02 04 04 09 09 37 84 80 80 80 80 01 03   ........7.......
+|   4016: 00 74 00 00 00 2e 02 30 61 01 02 02 01 01 62 01   .t.....0a.....b.
+|   4032: 02 03 01 01 63 01 02 04 01 01 67 01 06 01 02 01   ....c.....g.....
+|   4048: 01 01 68 01 06 01 02 03 01 01 69 01 06 01 02 04   ..h.......i.....
+|   4064: 04 06 06 06 08 08 07 01 03 00 14 03 09 00 09 00   ................
+|   4080: 00 00 11 24 00 00 00 00 01 01 01 00 01 01 01 01   ...$............
+| page 3 offset 8192
+|      0: 0a 00 00 00 03 0f ec 00 0f fa 0f f3 0f ec 00 00   ................
+|   4064: 00 00 00 00 00 00 00 00 00 00 00 00 06 04 01 0c   ................
+|   4080: 01 03 02 06 04 01 0c 01 02 02 05 04 09 0c 01 02   ................
+| page 4 offset 12288
+|      0: 0d 00 00 00 03 0f be 00 0f ea 0f d4 0f be 00 00   ................
+|   4016: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 14 03   ................
+|   4032: 05 00 17 17 17 61 20 62 20 63 67 20 68 20 69 67   .....a b cg h ig
+|   4048: 20 68 20 69 14 02 05 00 17 17 17 67 20 68 20 69    h i.......g h i
+|   4064: 61 20 62 20 63 67 20 68 20 69 14 01 05 00 17 17   a b cg h i......
+|   4080: 17 61 20 62 20 63 64 20 65 20 66 67 20 68 20 69   .a b cd e fg h i
+| page 5 offset 16384
+|      0: 0d 00 00 00 03 0f e8 00 0f f8 0f f0 0f e8 00 00   ................
+|   4064: 00 00 00 00 00 00 00 00 06 03 03 00 12 03 00 03   ................
+|   4080: 06 02 03 00 12 03 00 03 06 01 03 00 12 03 00 03   ................
+| page 6 offset 20480
+|      0: 0a 00 00 00 01 0f f4 00 0f f4 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 0b 03 1b 01 76 65 72 73 69 6f 6e 04   ........version.
+| page 7 offset 24576
+|      0: 0d 00 00 00 03 0f 9e 00 0f e6 0f ef 0f 9e 00 00   ................
+|   3984: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 84   ..............A.
+|   4000: 80 80 80 80 01 04 00 81 06 00 00 00 34 02 30 61   ............4.0a
+|   4016: 01 01 01 01 01 62 01 01 01 01 01 63 01 01 01 01   .....b.....c....
+|   4032: 01 64 01 01 01 65 01 01 01 66 01 01 01 67 01 01   .d...e...f...g..
+|   4048: 01 01 01 68 01 01 01 01 01 69 01 01 01 04 06 06   ...h.....i......
+|   4064: 06 04 04 04 06 06 07 01 03 00 14 03 09 09 09 0f   ................
+|   4080: 0a 03 00 24 00 00 00 00 01 01 01 00 01 01 01 01   ...$............
+| page 8 offset 28672
+|      0: 0a 00 00 00 01 0f fa 00 0f fa 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 00 00 00 00 00 00 05 04 09 0c 01 02   ................
+| page 9 offset 32768
+|      0: 0d 00 00 00 03 0f be 00 0f ea 0f d4 0f be 00 00   ................
+|   4016: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 14 03   ................
+|   4032: 05 00 17 17 17 61 20 62 20 63 67 20 68 20 69 67   .....a b cg h ig
+|   4048: 20 68 20 69 14 02 05 00 17 17 17 67 20 68 20 69    h i.......g h i
+|   4064: 61 20 62 20 63 67 20 68 20 69 14 01 05 00 17 17   a b cg h i......
+|   4080: 17 61 20 62 20 63 64 20 65 20 66 67 20 68 20 69   .a b cd e fg h i
+| page 10 offset 36864
+|      0: 0a 00 00 00 01 0f f4 00 0f f4 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 0b 03 1b 01 76 65 72 73 69 6f 6e 04   ........version.
+| end 4b6fc659283f2735616c.db
+}]} {}
+
+do_catchsql_test 47.1 {
+  SELECT snippet(t1, -1, '.', '..', '[', 50), 
+         highlight(t1, 2, '[', ']') FROM t1('g h') 
+  WHERE rank MATCH 'bm25(1.0, 1.0)' ORDER BY rank;
+} {1 {database disk image is malformed}}
+
+#--------------------------------------------------------------------------
+reset_db
+do_test 48.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 32768 pagesize 4096 filename crash-44a8305b4bd86f.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 00 00 00 00 08   .....@  ........
+|     32: 00 00 00 02 00 00 00 01 00 00 00 09 00 00 00 04   ................
+|     48: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00   ................
+|     96: 00 00 00 00 0d 0f c7 00 07 0d 92 00 0f 8d 0f 36   ...............6
+|    112: 0e cb 0e 6b 0e 0e 0d b6 0d 92 0d 92 00 00 00 00   ...k............
+|   3472: 00 00 22 08 06 17 11 11 01 31 74 61 62 6c 65 74   .........1tablet
+|   3488: 32 74 32 08 43 52 45 41 54 45 20 54 41 42 4c 45   2t2.CREATE TABLE
+|   3504: 20 74 32 28 78 29 56 07 06 17 1f 1f 01 7d 74 61    t2(x)V.......ta
+|   3520: 62 6c 65 74 31 5f 63 6f 6e 66 69 67 74 31 5f 63   blet1_configt1_c
+|   3536: 6f 6e 66 69 67 07 43 52 45 41 54 45 20 54 41 42   onfig.CREATE TAB
+|   3552: 4c 45 20 27 74 31 5f 63 6f 6e 66 69 67 27 28 6b   LE 't1_config'(k
+|   3568: 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20 76 29    PRIMARY KEY, v)
+|   3584: 20 57 49 54 48 4f 55 54 20 52 4f 57 49 44 5b 06    WITHOUT ROWID[.
+|   3600: 07 17 21 21 01 81 01 74 61 62 6c 65 74 31 5f 64   ..!!...tablet1_d
+|   3616: 6f 63 73 69 7a 65 74 31 5f 64 6f 63 73 69 7a 65   ocsizet1_docsize
+|   3632: 06 43 52 45 41 54 45 20 54 41 42 4c 45 20 27 74   .CREATE TABLE 't
+|   3648: 31 5f 64 6f 63 73 69 7a 65 27 28 69 64 20 49 4e   1_docsize'(id IN
+|   3664: 54 45 47 45 52 20 50 52 49 4d 41 52 59 20 4b 45   TEGER PRIMARY KE
+|   3680: 59 2c 20 73 7a 20 42 4c 4f 42 29 5e 05 07 17 21   Y, sz BLOB)^...!
+|   3696: 21 01 81 07 74 61 62 6c 65 74 31 5f 63 6f 6e 74   !...tablet1_cont
+|   3712: 65 6e 74 74 31 5f 63 6f 6e 74 65 6e 74 05 43 52   entt1_content.CR
+|   3728: 45 41 54 45 20 54 41 42 4c 45 20 27 74 31 5f 63   EATE TABLE 't1_c
+|   3744: 6f 6e 74 65 6e 74 27 28 69 64 20 49 4e 54 45 47   ontent'(id INTEG
+|   3760: 45 52 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20   ER PRIMARY KEY, 
+|   3776: 63 30 2c 20 63 31 2c 20 63 32 29 69 04 07 17 19   c0, c1, c2)i....
+|   3792: 19 01 81 2d 74 61 62 6c 65 74 31 5f 69 64 78 74   ...-tablet1_idxt
+|   3808: 31 5f 69 64 78 04 43 52 45 41 54 45 20 54 41 42   1_idx.CREATE TAB
+|   3824: 4c 45 20 27 74 31 5f 69 64 78 27 28 73 65 67 69   LE 't1_idx'(segi
+|   3840: 64 2c 20 74 65 72 6d 2c 20 70 67 6e 6f 2c 20 50   d, term, pgno, P
+|   3856: 52 49 4d 41 52 59 20 4b 45 59 28 73 65 67 69 64   RIMARY KEY(segid
+|   3872: 2c 20 74 65 72 6d 29 29 20 57 49 54 48 4f 55 54   , term)) WITHOUT
+|   3888: 20 52 4f 57 49 44 55 03 07 17 1b 1b 01 81 01 74    ROWIDU........t
+|   3904: 61 62 6c 65 74 31 5f 64 61 74 61 74 31 5f 64 61   ablet1_datat1_da
+|   3920: 74 61 03 43 52 45 41 54 45 20 54 41 42 4c 45 20   ta.CREATE TABLE 
+|   3936: 27 74 31 5f 64 61 74 61 27 28 69 64 20 49 4e 54   't1_data'(id INT
+|   3952: 45 47 45 52 20 50 52 49 4d 41 52 59 20 4b 45 59   EGER PRIMARY KEY
+|   3968: 2c 20 62 6c 6f 63 6b 20 42 4c 4f 42 29 38 02 06   , block BLOB)8..
+|   3984: 17 11 11 08 5f 74 61 62 6c 65 74 31 74 31 43 52   ...._tablet1t1CR
+|   4000: 45 41 54 45 20 56 49 52 54 55 41 4c 20 54 41 42   EATE VIRTUAL TAB
+|   4016: 4c 45 20 74 31 20 55 53 49 4e 47 20 66 74 73 35   LE t1 USING fts5
+|   4032: 28 61 2c 62 2c 63 29 00 00 00 39 00 00 00 00 00   (a,b,c)...9.....
+| page 3 offset 8192
+|      0: 0d 00 00 00 03 0c 94 00 0f e6 0f ef 0c 94 00 00   ................
+|   3216: 00 00 00 00 86 4a 84 80 80 80 80 01 04 00 8d 18   .....J..........
+|   3232: 00 00 03 2b 02 30 30 01 02 06 01 02 06 01 02 06   ...+.00.........
+|   3248: 1f 02 03 01 02 03 01 02 03 01 08 32 30 31 36 30   ...........20160
+|   3264: 36 30 39 01 02 07 01 02 07 01 02 07 01 01 34 01   609...........4.
+|   3280: 02 05 01 02 05 01 02 05 01 01 35 01 02 04 01 02   ..........5.....
+|   3296: 04 01 02 04 02 07 30 30 30 30 30 30 30 1c 02 04   ......0000000...
+|   3312: 01 02 04 01 02 04 01 06 62 69 6e 62 72 79 03 06   ........binbry..
+|   3328: 01 02 02 03 06 01 02 02 03 06 01 02 01 03 16 01   ................
+|   3344: 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01 02   ................
+|   3360: 02 03 06 01 02 02 03 06 01 02 02 03 06 01 02 02   ................
+|   3376: 03 04 71 02 02 03 06 01 02 02 01 08 63 6f 6d 70   ..q.........comp
+|   3392: 69 6c 65 72 01 02 02 01 02 02 01 02 02 01 06 64   iler...........d
+|   3408: 62 73 74 61 74 07 02 03 01 02 03 01 02 03 02 04   bstat...........
+|   3424: 65 62 75 67 04 02 02 01 02 02 01 02 02 01 06 65   ebug...........e
+|   3440: 6e 61 62 6c 65 07 02 02 01 02 02 01 02 02 01 02   nable...........
+|   3456: 02 01 02 02 01 02 02 01 02 02 01 02 02 01 03 02   ................
+|   3472: 01 02 02 01 02 02 01 02 02 01 02 02 01 02 02 01   ................
+|   3488: 02 02 01 02 02 01 02 02 01 02 02 01 02 02 01 02   ................
+|   3504: 02 01 02 02 02 08 78 74 65 6e 73 69 6f 6e 1f 02   ......xtension..
+|   3520: 04 01 02 04 01 02 04 01 04 66 74 73 34 0a 02 03   .........fts4...
+|   3536: 01 02 03 01 02 03 04 01 35 0d 02 03 01 02 03 01   ........5.......
+|   3552: 02 03 01 03 67 63 63 01 02 03 01 02 03 01 02 03   ....gcc.........
+|   3568: 02 06 65 6f 70 6f 6c 79 10 02 03 01 02 03 01 02   ..eopoly........
+|   3584: 03 01 05 6a 73 6f 6e 31 13 02 03 01 02 03 01 02   ...json1........
+|   3600: 03 01 04 6c 6f 61 64 1f 02 03 01 02 03 01 02 03   ...load.........
+|   3616: 01 03 6d 61 78 1c 02 02 01 02 02 01 02 02 02 05   ..max...........
+|   3632: 65 6d 6f 72 79 1c 02 03 01 02 03 01 02 03 04 04   emory...........
+|   3648: 73 79 73 35 16 02 03 01 02 03 01 02 03 01 06 6e   sys5...........n
+|   3664: 6f 63 61 73 65 02 06 01 02 02 03 06 01 02 02 03   ocase...........
+|   3680: 06 01 02 02 03 06 01 02 02 03 06 01 02 02 13 06   ................
+|   3696: 01 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01   ................
+|   3712: 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01 02   ................
+|   3728: 02 01 04 6f 6d 69 74 1f 02 02 01 02 02 01 02 02   ...omit.........
+|   3744: 01 05 72 74 72 65 65 19 02 03 01 02 03 01 02 03   ..rtree.........
+|   3760: 04 02 69 6d 01 06 01 02 02 03 06 01 02 02 03 06   ..im............
+|   3776: 01 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01   ................
+|   3792: 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01 02   ................
+|   3808: 02 03 06 01 02 02 03 06 01 02 02 03 06 01 02 02   ................
+|   3824: 01 0a 74 68 72 65 61 64 73 61 66 65 22 02 02 01   ..threadsafe....
+|   3840: 02 02 01 02 02 01 04 76 74 61 62 07 02 04 01 02   .......vtab.....
+|   3856: 04 01 02 04 01 01 78 01 06 01 01 02 01 06 01 01   ......x.........
+|   3872: 02 01 06 01 01 02 01 06 01 01 02 01 06 01 01 02   ................
+|   3888: 01 06 01 01 02 01 06 01 01 02 01 06 01 01 02 01   ................
+|   3904: 06 01 01 02 01 06 01 01 02 01 06 01 01 02 01 06   ................
+|   3920: 01 01 02 01 06 01 01 02 01 06 01 01 02 01 06 01   ................
+|   3936: 01 02 01 06 01 01 02 01 06 01 01 02 01 06 01 01   ................
+|   3952: 02 01 06 01 01 02 01 06 01 01 02 01 06 01 01 02   ................
+|   3968: 01 06 01 01 02 01 06 01 01 02 01 06 01 01 02 01   ................
+|   3984: 06 01 01 02 01 06 01 01 02 01 06 01 01 02 01 06   ................
+|   4000: 01 01 02 01 06 01 01 02 01 06 01 01 02 01 06 01   ................
+|   4016: 01 02 01 06 01 01 02 01 06 01 01 02 01 06 01 01   ................
+|   4032: 02 01 06 01 01 02 01 06 01 01 02 04 15 13 0c 0c   ................
+|   4048: 12 44 13 11 0f 47 13 0f 0c 0e 11 10 0f 0e 10 0f   .D...G..........
+|   4064: 44 0f 10 40 15 0f 07 01 03 00 14 24 5a 24 24 0f   D..@.......$Z$$.
+|   4080: 0a 03 00 24 00 00 00 00 01 01 01 00 01 01 01 01   ...$............
+| page 4 offset 12288
+|      0: 0a 00 00 00 01 0f fa 00 0f fa 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 00 00 00 00 00 00 05 04 09 0b 01 02   ................
+| page 5 offset 16384
+|      0: 0d 00 00 00 24 0c 0a 00 0f d8 0f af 0f 86 0f 74   ....$..........t
+|     16: 0f 61 0f 4e 0f 2f 0f 0f 0e ef 0e d7 0e be 0e a5   .a.N./..........
+|     32: 0e 8d 0e 74 0e 5b 0e 40 0e 24 0e 08 0d ef 0d d5   ...t.[.@.$......
+|     48: 0d bb 0d a0 0d 84 0d 68 0d 4f 0d 35 0d 1b 0c fb   .......h.O.5....
+|     64: 0c da 0c b9 0c 99 0c 78 0c 57 0c 3e 0c 24 0c 0a   .......x.W.>.$..
+|   3072: 00 00 00 00 00 00 00 00 00 00 18 24 05 00 25 0f   ...........$..%.
+|   3088: 19 54 48 52 45 41 44 53 41 46 45 3d 30 58 42 49   .THREADSAFE=0XBI
+|   3104: 4f 41 52 59 18 23 05 00 25 0f 19 54 48 52 45 41   OARY.#..%..THREA
+|   3120: 44 53 41 46 45 3d 30 58 4e 4f 43 41 53 45 17 22   DSAFE=0XNOCASE..
+|   3136: 05 00 25 0f 17 54 48 52 45 41 44 53 41 46 45 3d   ..%..THREADSAFE=
+|   3152: 30 58 52 54 52 49 4d 1f 21 05 00 33 0f 19 4f 4d   0XRTRIM.!..3..OM
+|   3168: 49 54 20 4c 4f 41 44 20 45 58 54 45 4e 53 49 4f   IT LOAD EXTENSIO
+|   3184: 4e 58 42 49 4e 41 52 59 1f 20 05 00 33 0f 19 4f   NXBINARY. ..3..O
+|   3200: 4d 49 54 20 4c 4f 41 44 20 45 58 54 45 4e 53 49   MIT LOAD EXTENSI
+|   3216: 4f 4e 58 4e 4f 43 41 53 45 1e 1f 05 00 33 0f 17   ONXNOCASE....3..
+|   3232: 4f 4d 49 54 20 4c 4f 41 44 20 45 58 54 45 4e 53   OMIT LOAD EXTENS
+|   3248: 49 4f 4e 58 52 54 52 49 4d 1f 1e 05 00 33 0f 19   IONXRTRIM....3..
+|   3264: 4d 41 58 20 4d 45 4d 4f 52 59 3d 35 30 30 30 30   MAX MEMORY=50000
+|   3280: 30 30 30 58 42 49 4e 41 52 59 1f 1d 05 00 33 0f   000XBINARY....3.
+|   3296: 19 4d 41 58 20 4d 45 4d 4f 52 59 3d 35 30 30 30   .MAX MEMORY=5000
+|   3312: 30 30 30 30 58 4e 4f 43 41 53 45 1e 1c 05 00 33   0000XNOCASE....3
+|   3328: 0f 17 4d 41 58 20 4d 45 4d 4f 52 59 3d 35 30 30   ..MAX MEMORY=500
+|   3344: 30 30 30 30 30 58 52 54 52 49 4d 18 1b 05 00 25   00000XRTRIM....%
+|   3360: 0f 19 45 4e 41 42 4c 45 20 52 54 52 45 45 58 42   ..ENABLE RTREEXB
+|   3376: 49 4e 41 52 59 18 1a 05 00 25 0f 19 45 4e 41 42   INARY....%..ENAB
+|   3392: 4c 45 20 52 54 52 46 45 58 4e 4f 43 41 53 45 17   LE RTRFEXNOCASE.
+|   3408: 19 05 00 25 0f 17 45 4e 41 42 4c 45 20 52 54 52   ...%..ENABLE RTR
+|   3424: 45 45 58 52 54 52 49 4d 1a 18 05 00 29 0f 19 45   EEXRTRIM....)..E
+|   3440: 4e 41 42 4c 45 20 4d 45 4d 53 59 53 35 58 42 49   NABLE MEMSYS5XBI
+|   3456: 4e 41 52 59 1a 17 05 00 29 0f 19 45 4e 41 42 4c   NARY....)..ENABL
+|   3472: 45 20 4d 45 4d 53 59 53 35 58 4e 4f 43 41 53 45   E MEMSYS5XNOCASE
+|   3488: 19 16 05 00 29 0f 17 45 4e 41 42 4c 45 20 4d 45   ....)..ENABLE ME
+|   3504: 4d 53 59 53 35 58 52 54 52 49 4d 18 15 05 00 25   MSYS5XRTRIM....%
+|   3520: 0f 19 45 4e 41 42 4c 45 20 4a 53 4f 4e 31 58 42   ..ENABLE JSON1XB
+|   3536: 49 4e 41 52 59 18 14 05 00 25 0f 19 45 4e 41 42   INARY....%..ENAB
+|   3552: 4c 45 20 4a 53 4f 4e 31 58 4e 4f 43 41 53 45 17   LE JSON1XNOCASE.
+|   3568: 13 05 00 25 0f 17 45 4e 41 42 4c 45 20 4a 53 4f   ...%..ENABLE JSO
+|   3584: 4e 31 58 52 54 52 49 4d 1a 12 05 00 29 0f 19 45   N1XRTRIM....)..E
+|   3600: 4e 41 42 4c 45 20 47 45 4f 50 4f 4c 59 57 42 49   NABLE GEOPOLYWBI
+|   3616: 4e 41 52 59 1a 11 05 00 29 0f 19 45 4e 41 42 4c   NARY....)..ENABL
+|   3632: 45 20 47 45 4f 50 4f 4c 59 58 4e 4f 42 41 53 45   E GEOPOLYXNOBASE
+|   3648: 19 10 05 00 29 0f 17 45 4e 41 42 4c 45 20 47 45   ....)..ENABLE GE
+|   3664: 4f 50 4f 4c 59 58 52 54 52 49 4d 17 0f 05 00 23   OPOLYXRTRIM....#
+|   3680: 0f 19 45 4e 41 42 4c 45 20 46 54 53 35 58 42 49   ..ENABLE FTS5XBI
+|   3696: 4e 41 52 59 17 0e 05 00 23 0f 19 45 4e 41 42 4c   NARY....#..ENABL
+|   3712: 45 20 46 54 53 35 58 4e 4f 43 41 53 45 16 0d 05   E FTS5XNOCASE...
+|   3728: 00 23 0f 17 45 4e 41 42 4c 45 20 46 54 53 35 58   .#..ENABLE FTS5X
+|   3744: 52 54 52 49 4d 17 0c 05 00 23 0f 19 45 4e 41 42   RTRIM....#..ENAB
+|   3760: 4c 45 20 46 54 53 34 58 42 49 4e 41 52 59 17 0b   LE FTS4XBINARY..
+|   3776: 05 00 23 0f 19 45 4e 41 42 4c 45 20 46 54 53 34   ..#..ENABLE FTS4
+|   3792: 58 4e 4f 43 41 53 45 16 0a 05 00 23 0f 17 45 4e   XNOCASE....#..EN
+|   3808: 41 42 4c 45 20 46 54 53 34 58 52 54 52 49 4d 1e   ABLE FTS4XRTRIM.
+|   3824: 09 05 00 31 0f 19 45 4e 41 42 4c 45 20 44 42 53   ...1..ENABLE DBS
+|   3840: 54 41 54 20 56 54 41 42 58 42 49 4e 41 52 59 1e   TAT VTABXBINARY.
+|   3856: 08 05 00 31 0f 19 45 4e 41 42 4c 45 20 44 42 53   ...1..ENABLE DBS
+|   3872: 54 41 54 20 56 54 41 42 58 4e 4f 43 41 53 45 1d   TAT VTABXNOCASE.
+|   3888: 07 05 00 31 0f 17 45 4e 41 42 4c 45 20 44 42 53   ...1..ENABLE DBS
+|   3904: 54 41 54 20 66 54 41 42 58 52 54 52 49 4d 11 06   TAT fTABXRTRIM..
+|   3920: 05 00 17 0f 19 44 45 42 55 47 58 42 49 4e 41 52   .....DEBUGXBINAR
+|   3936: 59 11 05 05 00 17 0f 19 44 45 42 55 47 58 4e 4f   Y.......DEBUGXNO
+|   3952: 43 41 53 45 10 04 05 00 17 0f 17 44 45 42 55 47   CASE.......DEBUG
+|   3968: 58 62 54 52 49 4d 27 03 05 00 43 0f 19 43 4f 4d   XbTRIM'...C..COM
+|   3984: 50 49 4c 45 52 3d 67 63 63 2d 35 2e 34 2e 30 20   PILER=gcc-5.4.0 
+|   4000: 32 30 31 36 30 36 30 39 52 02 49 4e 41 52 59 27   20160609R.INARY'
+|   4016: 02 05 00 43 0f 19 43 4f 4d 50 49 4c 45 52 3d 67   ...C..COMPILER=g
+|   4032: 63 63 2d 35 2e 34 2e 30 20 32 30 31 36 30 36 30   cc-5.4.0 2016060
+|   4048: 39 58 4e 4f 43 41 53 45 26 01 05 00 43 0f 17 43   9XNOCASE&...C..C
+|   4064: 4f 4d 50 49 4c 45 52 3d 67 63 63 2d 35 2e 34 2e   OMPILER=gcc-5.4.
+|   4080: 30 20 32 30 31 36 30 36 30 39 58 52 54 52 49 4d   0 20160609XRTRIM
+| page 6 offset 20480
+|      0: 0d 00 00 00 24 0e e0 00 0f f8 0f f0 0f e8 0f e0   ....$...........
+|     16: 0f d8 0f d0 0f c8 0f c0 0f b8 0f b0 0f a8 0f a0   ................
+|     32: 0f 98 0f 90 0f 88 0f 80 0f 78 0f 70 0f 68 0f 60   .........x.p.h.`
+|     48: 0f 58 0f 50 0f 48 0f 40 0f 38 0f 30 0f 28 0f 20   .X.P.H.@.8.0.(. 
+|     64: 0f 18 0f 10 0f 08 0f 00 0e f8 0e f0 0e e8 0e e0   ................
+|   3808: 06 24 03 00 12 02 01 01 06 23 03 00 12 02 01 01   .$.......#......
+|   3824: 06 22 03 00 12 02 01 01 06 21 03 00 12 03 01 01   .........!......
+|   3840: 06 20 03 00 12 03 01 01 06 1f 03 00 12 03 01 01   . ..............
+|   3856: 06 1e 03 00 12 03 01 01 06 1d 03 00 12 03 01 01   ................
+|   3872: 06 1c 03 00 12 03 01 01 06 1b 03 00 12 02 01 01   ................
+|   3888: 06 1a 03 00 12 02 01 01 06 19 03 00 12 02 01 01   ................
+|   3904: 06 18 03 00 12 02 01 01 06 17 03 00 12 02 01 01   ................
+|   3920: 06 16 03 00 12 02 01 01 06 15 03 00 12 02 01 01   ................
+|   3936: 06 14 03 00 12 02 01 01 06 13 03 00 12 02 01 01   ................
+|   3952: 06 12 03 00 12 02 01 01 06 11 03 00 12 02 01 01   ................
+|   3968: 06 10 03 00 12 02 01 01 06 0f 03 00 12 02 01 01   ................
+|   3984: 06 0e 03 00 12 02 01 01 06 0d 03 00 12 02 01 01   ................
+|   4000: 06 0c 03 00 12 02 01 01 06 0b 03 00 12 02 01 01   ................
+|   4016: 06 0a 03 00 12 02 01 01 06 09 03 00 12 03 01 01   ................
+|   4032: 06 08 03 00 12 03 01 01 06 07 03 00 12 03 01 01   ................
+|   4048: 06 06 03 00 12 01 01 01 06 05 03 00 12 01 01 01   ................
+|   4064: 06 04 03 00 12 01 01 01 06 03 03 00 12 06 01 01   ................
+|   4080: 06 02 03 00 12 06 01 01 06 01 03 00 12 06 01 01   ................
+| page 7 offset 24576
+|      0: 0a 00 00 00 01 0f f4 00 0f f4 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 0b 03 1b 01 76 65 72 73 69 6f 6e 04   ........version.
+| page 8 offset 28672
+|      0: 0d 00 00 00 03 0f d6 00 0f f4 0f e9 0f d6 00 00   ................
+|   4048: 00 00 00 00 00 00 11 03 02 2b 69 6e 74 65 67 72   .........+integr
+|   4064: 69 74 79 2d 63 68 65 63 6b 09 02 02 1b 72 65 62   ity-check....reb
+|   4080: 75 69 6c 64 0a 01 02 1d 6f 70 74 69 5d 69 71 a5   uild....opti]iq.
+| end crash-44a8305b4bd86f.db
+}]} {}
+
+do_catchsql_test 48.1 {
+  INSERT INTO t1(t1) VALUES('integrity-check');
+} {1 {database disk image is malformed}}
+
+#--------------------------------------------------------------------------
+reset_db
+do_test 49.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 40960 pagesize 4096 filename crash-fd87385402ecf5.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 00 00 00 00 0a   .....@  ........
+|     32: 00 00 00 00 00 00 00 00 00 00 00 0d 00 00 00 04   ................
+|     48: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00   ................
+|     96: 00 00 00 00 0d 00 00 00 0d 0b 6e 00 0f a3 0f 4c   ..........n....L
+|    112: 0e e1 0e 81 0e 24 0d cc 0d 72 0d 1b 0c b0 0c 50   .....$...r.....P
+|    128: 0b f8 0b b3 0b 6e 00 00 00 00 00 00 00 00 00 00   .....n..........
+|   2912: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 43 0d   ..............C.
+|   2928: 06 17 11 11 08 75 74 61 62 6c 65 74 34 74 34 43   .....utablet4t4C
+|   2944: 52 45 41 54 45 20 56 49 52 54 55 41 4c 20 54 41   REATE VIRTUAL TA
+|   2960: 42 4c 45 20 74 34 20 55 53 49 4e 47 20 66 74 73   BLE t4 USING fts
+|   2976: 35 76 6f 63 61 62 28 27 74 32 27 2c 20 27 72 6f   5vocab('t2', 'ro
+|   2992: 77 27 29 43 0c 06 17 11 11 08 75 74 61 62 6c 65   w')C......utable
+|   3008: 74 33 74 33 43 52 45 41 54 45 20 56 49 52 54 55   t3t3CREATE VIRTU
+|   3024: 41 4c 20 54 41 42 4c 45 20 74 33 20 55 53 49 4e   AL TABLE t3 USIN
+|   3040: 47 20 66 74 73 35 76 6f 63 61 62 28 27 74 31 27   G fts5vocab('t1'
+|   3056: 2c 20 27 72 6f 77 27 29 56 0b 06 17 1f 1f 01 7d   , 'row')V.......
+|   3072: 74 61 62 6c 65 74 32 5f 63 6f 6e 66 69 67 74 32   tablet2_configt2
+|   3088: 5f 63 6f 6e 66 69 67 0a 43 52 45 41 54 45 20 54   _config.CREATE T
+|   3104: 41 42 4c 45 20 27 74 32 5f 63 6f 6e 66 69 67 27   ABLE 't2_config'
+|   3120: 28 6b 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20   (k PRIMARY KEY, 
+|   3136: 76 29 20 57 49 54 48 4f 55 54 20 52 4f 57 49 44   v) WITHOUT ROWID
+|   3152: 5e 0a 07 17 21 21 01 81 07 74 61 62 6c 65 74 32   ^...!!...tablet2
+|   3168: 5f 63 6f 6e 74 65 6e 74 74 32 5f 63 6f 6e 74 65   _contentt2_conte
+|   3184: 6e 74 09 43 52 45 41 54 45 20 54 41 42 4c 45 20   nt.CREATE TABLE 
+|   3200: 27 74 32 5f 63 6f 6e 74 65 6e 74 27 28 69 64 20   't2_content'(id 
+|   3216: 49 4e 54 45 47 45 52 20 50 52 49 4d 41 52 59 20   INTEGER PRIMARY 
+|   3232: 4b 45 59 2c 20 63 30 2c 20 63 31 2c 20 63 32 29   KEY, c0, c1, c2)
+|   3248: 69 09 07 17 19 19 01 81 2d 74 61 62 6c 65 74 32   i.......-tablet2
+|   3264: 5f 69 64 78 74 32 5f 69 64 78 08 43 52 45 41 54   _idxt2_idx.CREAT
+|   3280: 45 20 54 41 42 4c 45 20 27 74 32 5f 69 64 78 27   E TABLE 't2_idx'
+|   3296: 28 73 65 67 69 64 2c 20 74 65 72 6d 2c 20 70 67   (segid, term, pg
+|   3312: 6e 6f 2c 20 50 52 49 4d 41 52 59 20 4b 45 59 28   no, PRIMARY KEY(
+|   3328: 73 65 67 69 64 2c 20 74 65 72 6d 29 29 20 57 49   segid, term)) WI
+|   3344: 54 48 4f 55 54 20 52 4f 57 49 44 55 08 07 17 1b   THOUT ROWIDU....
+|   3360: 1b 01 81 01 74 61 62 6c 65 74 32 5f 64 61 74 61   ....tablet2_data
+|   3376: 74 32 5f 64 61 74 61 07 43 52 45 41 54 45 20 54   t2_data.CREATE T
+|   3392: 41 42 4c 45 20 27 74 32 5f 64 61 74 61 27 28 69   ABLE 't2_data'(i
+|   3408: 64 20 49 4e 54 45 47 45 52 20 50 52 49 4d 41 52   d INTEGER PRIMAR
+|   3424: 59 20 4b 45 59 2c 20 62 6c 6f 63 6b 20 42 4c 4f   Y KEY, block BLO
+|   3440: 42 29 58 07 07 17 11 11 08 81 1d 74 61 62 6c 65   B)X........table
+|   3456: 74 32 74 32 43 52 45 41 54 45 20 56 49 52 54 55   t2t2CREATE VIRTU
+|   3472: 41 4c 20 54 41 42 4c 45 20 74 32 20 55 53 49 4e   AL TABLE t2 USIN
+|   3488: 47 20 66 74 73 35 28 27 61 27 2c 5b 62 5d 2c 22   G fts5('a',[b],.
+|   3504: 63 22 2c 64 65 74 61 69 6c 3d 6e 6f 6e 65 2c 63   c.,detail=none,c
+|   3520: 6f 6c 75 6d 6e 73 69 7a 65 3d 30 29 56 06 06 17   olumnsize=0)V...
+|   3536: 1f 1f 01 7d 74 61 62 6c 65 74 31 5f 63 6f 6e 66   ....tablet1_conf
+|   3552: 69 67 74 31 5f 63 6f 6e 66 69 67 06 43 52 45 41   igt1_config.CREA
+|   3568: 54 45 20 54 41 42 4c 45 20 27 74 31 5f 63 6f 6e   TE TABLE 't1_con
+|   3584: 66 69 67 27 28 6b 20 50 52 49 4d 41 52 59 20 4b   fig'(k PRIMARY K
+|   3600: 45 59 2c 20 76 29 20 57 49 54 48 4f 55 54 20 52   EY, v) WITHOUT R
+|   3616: 4f 57 49 44 5b 05 07 17 21 21 01 81 01 74 61 62   OWID[...!!...tab
+|   3632: 6c 65 74 31 5f 64 6f 63 73 69 7a 65 74 31 5f 64   let1_docsizet1_d
+|   3648: 6f 63 73 69 7a 65 05 43 52 45 41 54 45 20 54 41   ocsize.CREATE TA
+|   3664: 42 4c 45 20 27 74 31 5f 64 6f 63 73 69 7a 65 27   BLE 't1_docsize'
+|   3680: 28 69 64 20 49 4e 54 45 47 45 52 20 50 52 49 4d   (id INTEGER PRIM
+|   3696: 41 52 59 20 4b 45 59 2c 20 73 7a 20 42 4c 4f 42   ARY KEY, sz BLOB
+|   3712: 29 5e 04 07 17 21 21 01 81 07 74 61 62 6c 65 74   )^...!!...tablet
+|   3728: 31 5f 63 6f 6e 74 65 6e 74 74 31 5f 63 6f 6e 74   1_contentt1_cont
+|   3744: 65 6e 74 04 43 52 45 41 54 45 20 54 41 42 4c 45   ent.CREATE TABLE
+|   3760: 20 27 74 31 5f 63 6f 6e 74 65 6e 74 27 28 69 64    't1_content'(id
+|   3776: 20 49 4e 54 45 47 45 52 20 50 52 49 4d 41 52 59    INTEGER PRIMARY
+|   3792: 20 4b 45 59 2c 20 63 30 2c 20 63 31 2c 20 63 32    KEY, c0, c1, c2
+|   3808: 29 69 03 07 17 19 19 01 81 2d 74 61 62 6c 65 74   )i.......-tablet
+|   3824: 31 5f 69 64 78 74 31 5f 69 64 78 03 43 52 45 41   1_idxt1_idx.CREA
+|   3840: 54 45 20 54 41 42 4c 45 20 27 74 31 5f 69 64 78   TE TABLE 't1_idx
+|   3856: 27 28 73 65 67 69 64 2c 20 74 65 72 6d 2c 20 70   '(segid, term, p
+|   3872: 67 6e 6f 2c 20 50 52 49 4d 41 52 59 20 4b 45 59   gno, PRIMARY KEY
+|   3888: 28 73 65 67 69 64 2c 20 74 65 72 6d 29 29 20 57   (segid, term)) W
+|   3904: 49 54 48 4f 55 54 20 52 4f 57 49 44 55 02 07 17   ITHOUT ROWIDU...
+|   3920: 1b 1b 01 81 01 74 61 62 6c 65 74 31 5f 64 61 74   .....tablet1_dat
+|   3936: 61 74 31 5f 64 61 74 61 02 43 52 45 41 54 45 20   at1_data.CREATE 
+|   3952: 54 41 42 4c 45 20 27 74 31 5f 64 61 74 61 27 28   TABLE 't1_data'(
+|   3968: 69 64 20 49 4e 54 45 47 45 52 20 50 52 49 4d 41   id INTEGER PRIMA
+|   3984: 52 59 20 4b 45 59 2c 20 62 6c 6f 63 6b 20 42 4c   RY KEY, block BL
+|   4000: 4f 42 29 5b 01 07 17 11 11 08 81 23 74 61 62 6c   OB)[.......#tabl
+|   4016: 65 74 31 74 31 43 52 45 41 54 45 20 56 49 52 54   et1t1CREATE VIRT
+|   4032: 55 41 4c 20 54 41 42 4c 45 20 74 31 20 55 53 49   UAL TABLE t1 USI
+|   4048: 4e 47 20 66 74 73 35 28 61 2c 62 20 75 6e 69 6e   NG fts5(a,b unin
+|   4064: 64 65 78 65 64 2c 63 2c 74 6f 6b 65 6e 69 7a 65   dexed,c,tokenize
+|   4080: 3d 22 70 6f 72 74 65 72 20 61 73 63 69 69 22 29   =.porter ascii.)
+| page 2 offset 4096
+|      0: 0d 0f 68 00 05 0f 13 00 0f e6 0f 13 0f a8 0f 7c   ..h............|
+|     16: 0f 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 00   .*..............
+|   3856: 00 00 00 15 0a 03 00 30 00 00 00 00 01 03 03 00   .......0........
+|   3872: 03 01 01 01 02 01 01 03 01 01 37 8c 80 80 80 80   ..........7.....
+|   3888: 01 03 00 74 00 20 68 20 69 0d 00 00 00 03 0f e8   ...t. h i.......
+|   3904: 00 0f f8 0f f0 0f e8 00 00 00 00 00 00 00 00 00   ................
+| page 5 offset 16384
+|   4064: 00 00 00 00 00 00 00 00 06 03 03 00 12 03 00 00   ................
+|   4080: 60 20 30 d6 20 30 00 30 60 10 30 01 20 30 00 30   ` 0. 0.0`.0. 0.0
+| page 6 offset 20480
+|      0: a0 00 00 00 10 ff 40 00 ff 00 00 00 00 00 00 00   ......@.........
+|   4080: 00 00 00 00 0b 03 1b 01 76 65 72 73 69 6f 6e 04   ........version.
+| page 7 offset 24576
+|      0: 0d 00 00 00 03 0f 9e 00 0f e6 0f ef 0f 9e 00 00   ................
+|   3984: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 84   ..............A.
+|   4000: 80 80 80 80 01 04 00 81 06 00 00 00 34 02 30 61   ............4.0a
+|   4016: 01 01 00 00 00 00 00 00 00 00 00 11 87 89 06 26   ...............&
+|   4032: 01 64 01 01 01 65 01 01 01 66 01 01 01 67 01 01   .d...e...f...g..
+|   4048: 01 01 01 68 01 01 01 01 01 69 01 01 01 04 06 06   ...h.....i......
+|   4064: 06 04 44 00 06 06 07 01 03 00 14 03 09 09 09 0f   ..D.............
+|   4080: 0a 03 00 24 00 00 00 00 01 01 01 00 01 01 01 01   ...$............
+| page 8 offset 28672
+|      0: 0a 00 00 00 01 0f fa 00 0f fa 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 00 00 00 00 00 00 05 04 09 0c 01 02   ................
+| page 9 offset 32768
+|      0: 0d 00 00 00 9d 0f be 00 0f ea 0f d4 0f be 00 00   ................
+|   4016: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 14 03   ................
+|   4032: 05 00 17 17 17 61 20 62 20 63 67 20 68 20 69 67   .....a b cg h ig
+|   4048: 20 68 20 69 14 02 05 00 17 17 17 67 20 68 20 69    h i.......g h i
+|   4064: 61 20 62 20 63 67 20 68 20 69 14 01 05 00 17 17   a b cg h i......
+|   4080: 17 61 20 62 20 63 64 20 65 20 66 67 20 68 20 69   .a b cd e fg h i
+| page 10 offset 36864
+|      0: 0a 00 00 00 01 0f f4 00 0f f4 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 0b 03 1b 01 76 65 72 73 69 6f 6e 04   ........version.
+| end crash-fd87385402ecf5.db
+}]} {}
+
+do_catchsql_test 49.1 {
+  SELECT term FROM t4 WHERE term LIKE 'oase';
+} {1 {database disk image is malformed}}
+
+#--------------------------------------------------------------------------
+reset_db
+do_test 50.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 40960 pagesize 4096 filename crash-695bce8a3e107c.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 00 00 00 00 0a   .....@  ........
+|     32: 00 00 00 00 00 00 00 00 00 00 00 0d 00 00 00 04   ................
+|     48: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00   ................
+|     96: 00 00 00 00 0d 00 00 00 0d 0b 6e 00 0f a3 0f 4c   ..........n....L
+|    112: 0e e1 0e 81 0e 24 0d cc 0d 72 0d 1b 0c b0 0c 50   .....$...r.....P
+|    128: 0b f8 0b b3 0b 6e 00 00 00 00 00 00 00 00 00 00   .....n..........
+|   2912: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 43 0d   ..............C.
+|   2928: 06 17 11 11 08 75 74 61 62 6c 65 74 34 74 34 43   .....utablet4t4C
+|   2944: 52 45 41 54 45 20 56 49 52 54 55 41 4c 20 54 41   REATE VIRTUAL TA
+|   2960: 42 4c 45 20 74 34 20 55 53 49 4e 47 20 66 74 73   BLE t4 USING fts
+|   2976: 35 76 6f 63 61 62 28 27 74 32 27 2c 20 27 72 6f   5vocab('t2', 'ro
+|   2992: 77 27 29 43 0c 06 17 11 11 08 75 74 61 62 6c 65   w')C......utable
+|   3008: 74 33 74 33 43 52 45 41 54 45 20 56 49 52 54 55   t3t3CREATE VIRTU
+|   3024: 41 4c 20 54 41 42 4c 45 20 74 33 20 55 53 49 4e   AL TABLE t3 USIN
+|   3040: 47 20 66 74 73 35 76 6f 63 61 62 28 27 74 31 27   G fts5vocab('t1'
+|   3056: 2c 20 27 72 6f 77 27 29 56 0b 06 17 1f 1f 01 7d   , 'row')V.......
+|   3072: 74 61 62 6c 65 74 32 5f 63 6f 6e 66 69 67 74 32   tablet2_configt2
+|   3088: 5f 63 6f 6e 66 69 67 0a 43 52 45 41 54 45 20 54   _config.CREATE T
+|   3104: 41 42 4c 45 20 27 74 32 5f 63 6f 6e 66 69 67 27   ABLE 't2_config'
+|   3120: 28 6b 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20   (k PRIMARY KEY, 
+|   3136: 76 29 20 57 49 54 48 4f 55 54 20 52 4f 57 49 44   v) WITHOUT ROWID
+|   3152: 5e 0a 07 17 21 21 01 81 07 74 61 62 6c 65 74 32   ^...!!...tablet2
+|   3168: 5f 63 6f 6e 74 65 6e 74 74 32 5f 63 6f 6e 74 65   _contentt2_conte
+|   3184: 6e 74 09 43 52 45 41 54 45 20 54 41 42 4c 45 20   nt.CREATE TABLE 
+|   3200: 27 74 32 5f 63 6f 6e 74 65 6e 74 27 28 69 64 20   't2_content'(id 
+|   3216: 49 4e 54 45 47 45 52 20 50 52 49 4d 41 52 59 20   INTEGER PRIMARY 
+|   3232: 4b 45 59 2c 20 63 30 2c 20 63 31 2c 20 63 32 29   KEY, c0, c1, c2)
+|   3248: 69 09 07 17 19 19 01 81 2d 74 61 62 6c 65 74 32   i.......-tablet2
+|   3264: 5f 69 64 78 74 32 5f 69 64 78 08 43 52 45 41 54   _idxt2_idx.CREAT
+|   3280: 45 20 54 41 42 4c 45 20 27 74 32 5f 69 64 78 27   E TABLE 't2_idx'
+|   3296: 28 73 65 67 69 64 2c 20 74 65 72 6d 2c 20 70 67   (segid, term, pg
+|   3312: 6e 6f 2c 20 50 52 49 4d 41 52 59 20 4b 45 59 28   no, PRIMARY KEY(
+|   3328: 73 65 67 69 64 2c 20 74 65 72 6d 29 29 20 57 49   segid, term)) WI
+|   3344: 54 48 4f 55 54 20 52 4f 57 49 44 55 08 07 17 1b   THOUT ROWIDU....
+|   3360: 1b 01 81 01 74 61 62 6c 65 74 32 5f 64 61 74 61   ....tablet2_data
+|   3376: 74 32 5f 64 61 74 61 07 43 52 45 41 54 45 20 54   t2_data.CREATE T
+|   3392: 41 42 4c 45 20 27 74 32 5f 64 61 74 61 27 28 69   ABLE 't2_data'(i
+|   3408: 64 20 49 4e 54 45 47 45 52 20 50 52 49 4d 41 52   d INTEGER PRIMAR
+|   3424: 59 20 4b 45 59 2c 20 62 6c 6f 63 6b 20 42 4c 4f   Y KEY, block BLO
+|   3440: 42 29 58 07 07 17 11 11 08 81 1d 74 61 62 6c 65   B)X........table
+|   3456: 74 32 74 32 43 52 45 41 54 45 20 56 49 52 54 55   t2t2CREATE VIRTU
+|   3472: 41 4c 20 54 41 42 4c 45 20 74 32 20 55 53 49 4e   AL TABLE t2 USIN
+|   3488: 47 20 66 74 73 35 28 27 61 27 2c 5b 62 5d 2c 22   G fts5('a',[b],.
+|   3504: 63 22 2c 64 65 74 61 69 6c 3d 6e 6f 6e 65 2c 63   c.,detail=none,c
+|   3520: 6f 6c 75 6d 6e 73 69 7a 65 3d 30 29 56 06 06 17   olumnsize=0)V...
+|   3536: 1f 1f 01 7d 74 61 62 6c 65 74 31 5f 63 6f 6e 66   ....tablet1_conf
+|   3552: 69 67 74 31 5f 63 6f 6e 66 69 67 06 43 52 45 41   igt1_config.CREA
+|   3568: 54 45 20 54 41 42 4c 45 20 27 74 31 5f 63 6f 6e   TE TABLE 't1_con
+|   3584: 66 69 67 27 28 6b 20 50 52 49 4d 41 52 59 20 4b   fig'(k PRIMARY K
+|   3600: 45 59 2c 20 76 29 20 57 49 54 48 4f 55 54 20 52   EY, v) WITHOUT R
+|   3616: 4f 57 49 44 5b 05 07 17 21 21 01 81 01 74 61 62   OWID[...!!...tab
+|   3632: 6c 65 74 31 5f 64 6f 63 73 69 7a 65 74 31 5f 64   let1_docsizet1_d
+|   3648: 6f 63 73 69 7a 65 05 43 52 45 41 54 45 20 54 41   ocsize.CREATE TA
+|   3664: 42 4c 45 20 27 74 31 5f 64 6f 63 73 69 7a 65 27   BLE 't1_docsize'
+|   3680: 28 69 64 20 49 4e 54 45 47 45 52 20 50 52 49 4d   (id INTEGER PRIM
+|   3696: 41 52 59 20 4b 45 59 2c 20 73 7a 20 42 4c 4f 42   ARY KEY, sz BLOB
+|   3712: 29 5e 04 07 17 21 21 01 81 07 74 61 62 6c 65 74   )^...!!...tablet
+|   3728: 31 5f 63 6f 6e 74 65 6e 74 74 31 5f 63 6f 6e 74   1_contentt1_cont
+|   3744: 65 6e 74 04 43 52 45 41 54 45 20 54 41 42 4c 45   ent.CREATE TABLE
+|   3760: 20 27 74 31 5f 63 6f 6e 74 65 6e 74 27 28 69 64    't1_content'(id
+|   3776: 20 49 4e 54 45 47 45 52 20 50 52 49 4d 41 52 59    INTEGER PRIMARY
+|   3792: 20 4b 45 59 2c 20 63 30 2c 20 63 31 2c 20 63 32    KEY, c0, c1, c2
+|   3808: 29 69 03 07 17 19 19 01 81 2d 74 61 62 6c 65 74   )i.......-tablet
+|   3824: 31 5f 69 64 78 74 31 5f 69 64 78 03 43 52 45 41   1_idxt1_idx.CREA
+|   3840: 54 45 20 54 41 42 4c 45 20 27 74 31 5f 69 64 78   TE TABLE 't1_idx
+|   3856: 27 28 73 65 67 69 64 2c 20 74 65 72 6d 2c 20 70   '(segid, term, p
+|   3872: 67 6e 6f 2c 20 50 52 49 4d 41 52 59 20 4b 45 59   gno, PRIMARY KEY
+|   3888: 28 73 65 67 69 64 2c 20 74 65 72 6d 29 29 20 57   (segid, term)) W
+|   3904: 49 54 48 4f 55 54 20 52 4f 57 49 44 55 02 07 17   ITHOUT ROWIDU...
+|   3920: 1b 1b 01 81 01 74 61 62 6c 65 74 31 5f 64 61 74   .....tablet1_dat
+|   3936: 61 74 31 5f 64 61 74 61 02 43 52 45 41 54 45 20   at1_data.CREATE 
+|   3952: 54 41 42 4c 45 20 27 74 31 5f 64 61 74 61 27 28   TABLE 't1_data'(
+|   3968: 69 64 20 49 4e 54 45 47 45 52 20 50 52 49 4d 41   id INTEGER PRIMA
+|   3984: 52 59 20 4b 45 59 2c 20 62 6c 6f 63 6b 20 42 4c   RY KEY, block BL
+|   4000: 4f 42 29 5b 01 07 17 11 11 08 81 23 74 61 62 6c   OB)[.......#tabl
+|   4016: 65 74 31 74 31 43 52 45 41 54 45 20 56 49 52 54   et1t1CREATE VIRT
+|   4032: 55 41 4c 20 54 41 42 4c 45 20 74 31 20 55 53 49   UAL TABLE t1 USI
+|   4048: 4e 47 20 66 74 73 35 28 61 2c 62 20 75 6e 69 6e   NG fts5(a,b unin
+|   4064: 64 65 78 65 64 2c 63 2c 74 6f 6b 65 6e 69 7a 65   dexed,c,tokenize
+|   4080: 3d 22 70 6f 72 74 65 72 20 61 73 63 69 69 22 29   =.porter ascii.)
+| page 2 offset 4096
+|      0: 0d 0f 68 00 05 0f 13 00 0f e6 0f 13 0f a8 0f 7c   ..h............|
+|     16: 0f 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 00   .*..............
+|   3856: 00 00 00 15 0a 03 00 30 00 00 00 00 01 03 03 00   .......0........
+|   3872: 03 01 01 01 02 01 01 03 01 01 37 8c 80 80 80 80   ..........7.....
+|   3888: 01 03 00 74 00 20 68 20 69 0d 00 00 00 03 0f e8   ...t. h i.......
+|   3904: 00 0f f8 0f f0 0f e8 00 00 00 00 00 00 00 00 00   ................
+| page 5 offset 16384
+|   4064: 00 00 00 00 00 00 00 00 06 03 03 00 12 03 00 00   ................
+|   4080: 60 20 30 d6 20 30 00 30 60 10 30 01 20 30 00 30   ` 0. 0.0`.0. 0.0
+| page 6 offset 20480
+|      0: a0 00 00 00 10 ff 40 00 ff 00 00 00 00 00 00 00   ......@.........
+|   4080: 00 00 00 00 0b 03 1b 01 76 65 72 73 69 6f 6e 04   ........version.
+| page 7 offset 24576
+|      0: 0d 00 00 00 03 0f 9e 00 0f e6 0f ef 0f 9e 00 00   ................
+|   3984: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 84   ..............A.
+|   4000: 80 80 80 80 01 04 00 81 06 00 00 00 34 02 30 61   ............4.0a
+|   4016: 01 01 00 00 00 00 00 00 00 00 00 11 87 89 06 26   ...............&
+|   4032: 01 64 01 01 01 65 01 01 01 66 01 01 01 67 01 01   .d...e...f...g..
+|   4048: 01 01 01 68 01 01 01 01 01 69 01 01 01 04 06 06   ...h.....i......
+|   4064: 06 04 44 00 06 06 07 01 03 00 14 03 09 09 09 0f   ..D.............
+|   4080: 0a 03 00 24 00 00 00 00 01 01 01 00 01 01 01 01   ...$............
+| page 8 offset 28672
+|      0: 0a 00 00 00 01 0f fa 00 0f fa 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 00 00 00 00 00 00 05 04 09 0c 01 02   ................
+| page 9 offset 32768
+|      0: 0d 00 00 00 9d 0f be 00 0f ea 0f d4 0f be 00 00   ................
+|   4016: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 14 03   ................
+|   4032: 05 00 17 17 17 61 20 62 20 63 67 20 68 20 69 67   .....a b cg h ig
+|   4048: 20 68 20 69 14 02 05 00 17 17 17 67 20 68 20 69    h i.......g h i
+|   4064: 61 20 62 20 63 67 20 68 20 69 14 01 05 00 17 17   a b cg h i......
+|   4080: 17 61 20 62 20 63 64 20 65 20 66 67 20 68 20 69   .a b cd e fg h i
+| page 10 offset 36864
+|      0: 0a 00 00 00 01 0f f4 00 0f f4 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 0b 03 1b 01 76 65 72 73 69 6f 6e 04   ........version.
+| end crash-695bce8a3e107c.db
+}]} {}
+
+do_catchsql_test 50.1 {
+  SELECT term FROM t4 WHERE term LIKE '»as';
+} {1 {database disk image is malformed}}
+
+#-------------------------------------------------------------------------
+reset_db
+do_execsql_test 51.1 {
+BEGIN TRANSACTION;
+PRAGMA writable_schema=ON;
+CREATE VIRTUAL TABLE t1 USING fts5(a,b,c);
+CREATE TABLE IF NOT EXISTS 't1_data'(id INTEGER PRIMARY KEY, block BLOB);
+REPLACE INTO t1_data VALUES(1,X'2eb1182424');
+REPLACE INTO t1_data VALUES(10,X'000000000102080002010101020107');
+INSERT INTO t1_data VALUES(137438953473,X'0000032b0230300102060102060102061f0203010203010203010832303136303630390102070102070102070101340102050102050102050101350102040102040102040207303030303030301c023d010204010204010662696e6172790306010202030601020203060102020306010202030601020203060102020306010202030601020203060102020306010202030601020203060102020108636f6d70696c657201020201020201020201066462737461740702030102030102030204656275670402020102020102020107656e61626c6507020201020201020201020201020201020201020201020201020201020201020201020201020201020201020201020201020201020201020201020201020202087874656e73696f6e1f02040102040102040104667473340a02030102030102030401350d020301020301020301036763630102030102030102030206656f706f6c7910020301020301020301056a736f6e3113020301020301020301046c6f61641f020301020301020301036d61781c02020102020102020205656d6f72791c020301020301020304047379733516020301020301020301066e6f6361736502060102020306010202030601020213060102020306010202030601020203060102020306010202030601020203060102020306010202030601020201046f6d69741f0202010202010202010572747265651902030102030102030402696d010601020203060102020306010202030601020203060102020306010202030601020203060102020306010202030601020203060102020306010202010a7468726561647361666522020201020201020201047674616207020401020401020401017801060101020106010102010601010201060101020106010102010601010201060101020106010102010601010201060101020106010102010601010201060101020106010102010601010201060101020106010102010601010201060101020106010102ad060101020106010102010601010201060101020106010101010601010201060101020106010102010601010201060101020106010102010601010201060101020106010102010601010201060101020415130c0c124413110f47130efc0e11100f0e100f440f1040150f');
+INSERT INTO t1_data VALUES(274877906945,X'00000e96023030011a042319320d3b123d812b5a31120110446e581b66814a05010a4537814274010e8102815c810f3d0104846d01081581204401103741043c59416b44010a404655265301103f73811a11114213010a821235820f020135030484320201360104816a020162020484550302390301710a04824a020166030483690201670704837d0201690404822602016a0504825c02026b620504817502016f0904810d0303e79c88060482760201700a04826302017204048155020373c2be050481130201770204846202027962050482710202c2ba010482140203e58496070483330204e8b2b879010483710101310110545c0c814b0e3a6501082c815d5b011a2a0e2f0d765c3d686014061d0d0112810733112c2e82141101048313010e5c6f632e813e42010c811882370548010e19158146822f1f01104d364a708146135a010a237b0a55210201610904841703027678090481270201620304810002026374060484660202657a0704827602016601048351090483540301660704814b02016b03025f0304c582caba0204816602016c01025f0302cebc0904843e02016e0804821802016f0a04817503016f070483100201720304822c020484380201740404842e0102460201770104812f0204836c02027a6f040483110202cebc02048267040161020484650205d5bd62cebc0604845b0204f2a580880204842a0206f38184a179670502750204f696a3aa0a04814601013201063330390110812281378114600d010c03716c5e822d010e81226b542a814d010a72740f83000108813a1e0b010c5681046f812c010c07814a777328011664244219531b1a2f811e4a010c4d81557c7f1b0201300704810702013307048230010484050202367807048175020239710804832502016204026b0204814d020363306108048262020265650504817602026667070483150201690704832f0301360a04814d02016c08024702016d0304843e0303cfb2630204814002016e0804837503016203048416030370c2be0304821b02016f0604834b0201700504816b030175070210020273660604841c020676c2bac2b2640604830a02017704027d02017808048141010482700201790504811d0202c2ba0502470206ca8d73ecbab9010483340204f09e9ab504048367010133010c3e04814f82250114812e814b2e0411811305010c811337811e6e010c82085e2b0e5d010c61812054811c01148122451b0781050c813d010c17823762643e011e080c1720814a10364306143b0d33260112810f0c2a810c816b13010a8163810e470201370404811102056176c2aa36050481530202646e0904846202026a730404827402016b0a020c02036f616b0404830a0201750504820d02017605025e0201770a04820702027a73050482460202c2ba0604824a020483330203cba434040483200203cebc790304847e01013401124181442c1d091f81580108601d8336011081320a2b8125820001123b0b81158116811f070110078112817a817308010e6682410d810e2601122d0d6413378147351e01105081021d3525812d01128246510a622204054101105c1b620e81302b05020130020483480104822702013102027e020132030483270201350304844802023770030207020261710604823f0201640802570204830a020265770304831f020168070483210201690204825b02016f020481280704835402057037e18b8d0904810802017304048439030172020481440303c2bd6b0a02630201760202490804815e0201770304816e050483550201780704816902017a070483280207c2b2f093aabc780a0482240301b303024e0301bc0604837a0202cb800204834a0202cebc04048201040484410203d3ad770a04814f0202d5a508048371010135011630817e0f81040d2c041552010c813d3b7e8115010c40692182693a01121f810d810d0a32814701101d1d1f642281742e01068229240110811231810a387f4c01100f50810f8165810d0114811f26443152593c104a010e641e1a3357820e020132030481540201340204815402023778040207020163060481020204815b020164020483010201670a0481540304f0948f870904811a0201690704835502016d0604832203027b01022803017a0a025102016e020484260404816002026f690502680301720104834e02017208024f02021d020475e69c8e0504814c0202767602025f0302de870a04837b020178090483200104835003026a72090484400201790504837204022302017a0104836b0202c2aa0a0481070303bcc2b3090484370203c7866403027501013601087c158303011212814305813e7b0e090118141a1c49713a211e0c74630f010a59826d8113011203328166037781561a01101d7f1d2a1f822533010e820e070f7b40160110811f40292c813226010a2d20824a32010a81418158670201300304840a0201660404817d02016d0804826902016e080626817f0104820b02016f0404825a02017003023b020272750804840c0301760a04844d02017403025b020175080484200202766e060482360303c2ba6c030482220202c2aa0204810e0301b20204835703048421040484240301bc0802410202d2a1010482630204e1b18f3704048354010137010c08816337812f01101382211532424d39010881248123010e7724810267815f011081236029813e273301101b7b29812a5b813b01128150810324814b220b01060c8417010e165b6c81708117010a1782346f6c0201380804816803016b0604840102013908023f0201610204816c0201630302760201640304832604023e0204833902016502048203020266770804821a0201670a04830002026964080484500304f29e9eb70802250201700204811b0201710904832d0201730304826b05048403020174010481000205776a62c2b2050482630201790202260206c2b2eaaeb464050485020301b3080482480303bac7af0a0484550203c695650804822a0202ceb90a0481170202dbae05023f010138011819814a2703390a61090c6912011a21181304812523811b5f164e050114110f35128123423f810c010c817573817c03010e7182590c812b0401142503597e6e0e2f3a3759011252813a811a2b75091a010882162a31010e17450a81048279010858658208020231670a048205020361c2b906023b02016301048236020164050482520201650904833d0201670904811b0201690604825002026a7a0604837c02016e0204832002017002026d0302c789010481020201720504835e0201740604810002017502020a0702630302676306025f0303e4a0a70102640203786a75010484440201790104841402047ac2be72070481340207c2ba3766673576090482790301bd07048142010481600202c7b309027a0401740604823b0202d2bf0304830f0204e989a6300a02600204f4bd91b60702120101390106518369010e19254641823711010c258267288121010e817c810d2b17250110810a578133812f4c0110415681067b288121010e0881208119347101140b8131543c8100343d1101088203813e01100d742e3230820f3802013006048107020134080481440202356501021a02013808048147020162020482230201630304833c030162050483390206656cf093b5bd070484140202677303048502020769e3ad9669c2b90304847402016b0804836402016c0404841f02016d010481250904825202016e06025402016f0704842a0201700a04834a0201720a0483530201750304822e020676f097b18374030482140201780604833d0202c2b9010481550301be070483720204826f0202ca80060481630202d5a80504833f0101610114551047810e130a78660c011a364611206c0b13080705733d5501240f08070c090b0c20813d1471042e4351131e011204412d814f0913104201263036110d060b1f811a301b0f4e1a29092f181c012808071e221a2a81075b320503065a0f140c1a0a26011c07231d0e6f3715063b760c6b091501121111303e3a71566d6d010e0867814d816a0c01181e18240d41724d221b3f384b0201300204830b060483080302c2b30204837f0201310a026e020134050481560301730902690201360406827c0f0201370204825d06020a0201390904815b0304f3bfb2a70a04822c0201610404810e020262660604841a03017608025b02016309088112825f020164090482310201650a0484480302396f01025d02026774010482090302df9b06048321020168070661813303016f03048248020169030483610504814001048401010483460301300704824203016a0204824402016a0504813303021d03017209048412030277380804824502016c0104814c02036ec2ba0804835702016f0204811d030176020238020270360a04840d02017107048201030469ca99690602350201720304812d0104845e02017304022c02017409022b020175050484140302caaf0402410201760404831f020177010484180704845203026f6d04024b02017a030482660202c2aa0204810a0301b30a04817b0302bd76020483780302be6a0302440202c58207025e0202c69901027a0302ad77010483200206c993f099b183070484270203caa1660204841a0204f29788ac0804831d0204f4ba9f950504843c010162011c0e33810216341c2413042130780501184d373e53131f2f052907423e010c830e3781390e011c1320461f81041b811b041e15243d011e241b10816c310b130c3133033b0741011a11816d3139100c13140b395848011c580e411a06304306810a3138330d011a441707092c70140c1643813920010c73653581374f010c826c81210f0402013803024f07048172020161020481650204810c020162030483470301370404813602016307048379020483280201640304815501048176010481060201650104812a0104841f0201660504821f0201670302700201680804846403016b0a04831d0301700904845502016908025c02016a010483560904827602026b6306023402016c0404832602016d040484410204825702016e0504831603027831020482160302c2be0504827d02026f6a05048121020171030232020483220304845402023a0201720204845c0304846e03013607048224020174060484480201780704844303016f0604814f045807070a0707070707080709070709070808090a5c07080708080b07060a06080707070b0a0b0808070b0a0b0a55070b08080a0908080707060709070709070706080c060b07070c0a66070b08080609070607080c0909660b06070707080a0807070b0b0707080a0b07070d0607080c0908630707070b07070a070d060b0707090a07080b080a070809085f0707070c0706080706070809080f06080a5807070607060e070807080907070b070b060c0709090807690808070707070708070608070709070809070a0d0b07070809095b070707070707070c080d07070b06070707070c07080b0808811a0b08060706080a070a07080609070707080808071307070a0708070907060807090b06060707070b0707080708070707080c090a0a81080a0b07070b0f0b0706070707060b07070b07080808110b070707');
+INSERT INTO t1_data VALUES(274877906946,X'00000e880330627a020482240202c2aa0a04833f0301b30704844b0302b9650704824f0301ba0204845f0202c9820a0483640202d194060482300203e19cbd0904844b0203e691b4050483510205e78dadde9b0104821201016301142a6c033b8151085c094601140b813d49313f81110e1c011681163611221527257f5d38011c150f22811a0a3c12350631238117011c3e26420b402c1d81080c40150b2f01181c3143382640273d60132e070118663b1d162a1b0e2e8111393e0110821117310e52811c01141a2f49810181391f2b130112323c0305812a6f2e390201320204842702023334020481340201350202610201360304844603023362040484470203376a360a04826b02013808026203016f0704830d02013902025502016106088170827a0301320a04820403016c0404831502016204048327050484030201630a04814302016401048349020484760302430301640204845d02016504048249020367c2bd07020a0302cebc0902150201680a02500201690204846102016a06024c0301770504842b02016b0104830e0704811803023370040483580301710404845f02016c0504844f0204820d0204837f0302c2aa0104833702016d0104844c02016e0804834f03026c6a07025702046fecbd9a01023a020270330204830a0301740304837c020271350204811e0201720706833b310206736ef09289b70104832b020174070483290301320204827c02017608022802017806025b0302c2b30904835202027978080483040303c9b56f0904846a0202c2aa04048127050482120301b30504813a0301b901024204016a0704840c0202c5820704823c0202c999010482470202cebc0602400203db91670602730202dca7050482760203e1a3950304817e0203e786a702048273010164011a0612105b292b817c1211080d5a01147c1d420b35451c36811a011e0e168117081c0c2e051d474055192d011e02050a1c81180420250f815f300f21011c02316a37143321443a10042d54230112761428810e4750054101101805072b8215294e0116680f0f5381445a3e0b070901224e4a41210c361c281b101c43051325130f01185a1e19108106300f2e3f4538020130060481370202327305022002013405048168020335377a03021802013704027b02013804048260020161030882118101030263650904814d0201620604822502016303048419030135090483240201640602280301380404817e0201650404823c0304f097ac9f010482680201660a0267030566e2b6936f0104821c0201680704813302016b0604832002016c01026a0301610204843202016d0804845e03026d6d03023c020270730a04817f0304c2be797a0804832e020271710504835f02017203021b0201740204825a02017706027202017805048451010683572e03016e0a04814c0201790304811702017a080484450302c2b90204837b0202c2aa0604825b0303b273630104841c0301b9050485040301bc0a027b0303bd37680502670202c98b0204826b0203cfa1740504823a0203d199610202350203e3bf87040483570204f1baaba90504817301016501120b8104392d0d20180f011645213f292e4d0d082f8165011e0b400c07341b2329307f193338173a012055292409050c560a272a0f4403245718011a1c3a183f1c43264c3126060829012081208102043a044d0621650b180e150e011a066c030e513d7d265e1313130c0118171953040457347b114d191901261b1c060c26090d6f0d332a1519096e03101d1d012207342f1f2c7e2517251d0f310d2a17081e02013005020a02013308048247020135030483660201380704841b030132030482180201610102600604825f0304c2bdc2ba02023a02016209021f0201630604813002056663cebc610604841e0201670504816a0104842703037177310604833f03027872080482350201680604825e02016a040483320104840d02016b0304813f02026c6408020602016d070481590104837d03016c08020d02016e060484630301780404815c02016f0104826b0804825e02017008027b0302c2aa0504847c0201710404836d0201730402510302cebc08048338020375c7bf05048344020177010482660304822303026479070481630204786ec2ba0204814f0202796a0a04834f02017a01048407030484660604810603026561020483180204c2b278390504813d0301b304024f04026536010483110302b9330604813e0301be0304840b040484560202c4a702022d0206c6a5f7ada9990402350202c79f090481180202caa60502140204cebcc2bd080483320202db900a0481250205f4b5aa9079040484360204f7b985bd0204835e01016601128101285c096981190e01121f813f0d431a8135530114698102813228492f190a011260161881328101812601188155780d813257050c0b04060114161681340772811b5e25011c4505810e13290b253a0c0c0a1a4b011a3714133e1235812b136b062c0b011a6b591356810c3c240906250b1001148127810d413e0e81090d020231680504822c0302c2bc0204830c0201360104840c0303656a740902110302d1950504824f0201370902130201390a0482530303e0a9ae0904844c0201610804810d0201620a04810c03023039030481330302356902048268020163060483470201650504822d02016706048200030483560302713509025002026a79010484410804825902016c0504822002016e07020d0304843a02016f0204842d0201710304837604048361030482430201720904840f020173020482520804810b02017406068425320201760202420201780804845d02037979650704814802017a080481110301780804812c0202c2bd070484600202cebc0508813082410102770401610202250202ddb40302310205f19e9a937a030482410101670118365558195a0a062d0581260a011881068143330844041f0a1851011a2025141e1081204f550e077521011a193b1f58351912265681220821011812070528472f4e2f407f204a01124d1e1f811b810d7b4d01180f1d3481034a35580a12811f011c2303340d1470150778070c812331011620411939703c032915143f01104281116a3d323c6a0201350604842902013703023f0201390a04816e0201610604826402016202023f0201630a04843302016409048258020165020482620404814702016602061b833f0201670404827d03026369020227020169040483490301670604847602016a0604845d0404840902016c04024601088150822b010482350204830a0301690304844902016d0202710704820002016f03048509020482380304836603026e74010483580201700504817a020171020481080204826a0201720304837b0202410302160302c2b3080484550201730904816e020174040248010484280304834e020275730404836e020176060484720104815c02017709026a020178060275040483790201790504821501026c030170080483770304cfb269710704815102017a0204813303016f090483160202c2aa050481400301ba0804810b0401630804830d0301be0604844d0202c8a30a02110203cba0640204816a0202cebf060482420204e487856e030481080204ec97bd6d080484080205f09eb3a0770502260208f687999931ed878703048424010168011a12460e090c036e151b812e065501161708411982151738471f35011a2d1c0678340c1f04425c21200c010c2a087f255d4a011a0d0b6c33814a212c3a0a401b1e011c501f2381010a0481201c0c6012280118150b5228520e0a036c1c8123011a15810a060408030a81563f381601185b1b06212a143f332a60160e011a221b1e62411d2048090e0b0f5502033072350804826a020131020482530201320304823b0201330104814502033677380204813102026174020483540304dbbf6f620404835d0201620504846a0104831803017103048323020164060483740201660a02410201690102130104821402016a0504823f02016c0404832e02016d09022602026e640a04822702016f070482000301750402670201710304813106020d0202726304048220020173060484530201750504831e020483400302c2bd0704843a020177020483470203786371030483740201790904810002017a0302300202c2b9080483280301bc010481700303bd33720304825e0205c99973c2bd040483160203d5a6330a04842b0204e7b3b3300904813c0205f099a68f72090209010169011c21101d4b2d0e0e066b4253074c140118070a0910447556030833541d01163733816837402b3909122501183c5b1139102e2d430c662334011e27050f21621230323503332b6a0332011e1e07031843202e6e3c2850094d410c01163955220b16812d24521212011681250b0a3505460481176f011a2c09266b162968051c0a1481170116022e1e820c352037263a070201310104825d0602110303696869020484070201320204826e0201610304832203016f040232020162050642843f03048336020484540301370804833c03026c6105027a0203636165090483120201640502770304833e03017107022f0301780702470201650a04811e020167080238020168040481160102230404826b030170040483000201690304836f0302766c0304811402016b0504812e02026c6108027702016d0308827d81530604837302026e790904842602016f06048208020170060481680302320201710204812902017307048255020274320104822a02017506026803016e0a04821303017207025f0302c2b90504834a020177020483130201780604836b0402210301320604847302017a010483130202c2aa0804823c0301b9030482600301ba0104845304016c0504837e0202c3b8080484600204cf9d6379020483660202d3860704812e0203e3a4be0402560203e58784010481210204f09e95ac0102580204f5aea5890a023301016a01123428131a1f6c81445601141e227c1a7b5f1918810301182318812e17455605460d811c011a28820221311a6e12093f050a0c0120082c0b0f1362074457460c3b070d5132011c2143052a20133d160a358117591f01103136813b136e6247011c100e4c28060d16815a320a3e11070124462c03582e262d45110804113326040808070807080809090b81050708060708090607060907070b070e07070807060706070b08070f0807070709080708080c070706060808090c07060708080708080909811307070708060709080707070607070a060b070706070707080a080607060c070707080809070608080908090a812406070707070a0906070b0b0908070b07070b0607070b0608070608090b080a080f080a0608080b070b08070a080b0a810408080708080607090707080807070b070c070a070f070b080607090707080d06070b810b070607070607070b08070707070b14070a0f08070b0d08070e080b060a0a070a0707080707070709080a0a0a0e810f0907070709080a0b0707060a0707060807060a08070b08070907060807090b090a0a81140a09070706100707090a060607060e07070807070d08070a07070806070608070a070708070707080a0808090909');
+INSERT INTO t1_data VALUES(274877906947,X'00080e7f073c23110a1a18392f66090524183704276d6703306a320404824e030164080483520305c2bd7ac2bc0604815a0201360704833202016106021f020482400201630304822a0708817e8204030173040483500201640404824803016d0804824a03017709023002016606048367020268680a04815802016902088339811804027f0302656e0704834e0303d5a5370604816702036a3366090484470303c2ba660904826e02016b0904837c02016c07021403026c610604835802016d0204816802016e0104831202016f0104822f020270720602060201710704822202017206048174020273690204824602017409020c020175090482140201760a0482720301660404824403016a090484290201790404845703025d0203c2bc33040484620301bd0304824c020484540202c78607022403019a010482380202ca87070484390202d39d030485050203e184940404831b0203e6a881060483480203e8b18c0a04816d0203ee8d850104814801016b0110467257393c81272c011a053e815d3b190517064524521f011c3823590a8115372004313b1f3216011a5a20780b102d0804426916112c011a182f810781082d12137026161501221a180516811611051c131207811515173501180320112581062e05621c1407011c2d0e0617811522062208065a21520114582841621e6c203f1e2001161647411a272533815b1c2602013009048309020232630104835a0301720104817f0201330604836f0302ddb5080482560202347a07048102020135020483460104827b02043678ca800a04835f0201370404814b0104846002016103048246010482220301700204833f0201620404824d060481150201650304824f02016606088110834c0201670604821d0303c2be66010481790201680404843b030176050482270201690a04830e02016e0904844202016f040481010301630304822f020270640204822f03016e0704845802027177090482710206736ec2b2796a0104832e0306dab1d485377004048304020174050481700201750a0212020378627604048164030173080483190201790704833d0204823a02017a0506820e67030178070484530202c2b2060481500104823f020483030301b3020484310301bc04027e0402caaf0a026a0301be040482590204842e0202540202c79f0804824d0202cfa30804815a0204f29a92970204823301016c01140f63351a0a653b650d22011c09117a3e1538123537046a15043101141310082f49052f772b0c011c11121781583c2a5010133228241301287f3e0a2b1244080503060a100f413b4f0d070e2a01103e4e1f04814e7b1601183d0404052877111f230f811d01123a100f053e5c076910011a031732102381243d1b1727507301180e5d273e810803812e0f192a02013301048271070481330204821d020134080263020135060481280201610104830a0201640604826d020165060483050201670204841c0504841c0304841b0201680a04845602016a0104811c01024f030481080204813102016b0204837008024502016d0404836c04068207780301670704842302016f0404821203016d040484490301720404837e0201700104821d03048407030165050483050201720a04811602017307023502017407020503016f080484240302c2b90504821b020175090484090201770a088119822503026d6905048300020178030482680604812a0201790104830c0204833a0303d9a06806022002017a060482600203c2aa33030481560301b904020a0301bd0504820f0202d0b90904817c0202d3820202200202daa9080482030203de966e02024b0202df9d080484350204f098b0a20604845e01016d01220304456608322258060a031d4c38340f090112310c070e4238626e6601124a318109030513812f0118240d561e533742188113101b01160b24444b224d44814d4806011c05774e483410330d23541b28090401141f29062581131e221b6d011e81053a037a03320b0e4c24360d2310011a0e321d3c141825111d54637a1c0114093d3c2e58571a35293a0201350104840a03017701048330020136060217020138030483370201610a0482650201620504815e0201630704827701048201020164080483690201660804846703016904048113020167070483080201680504837d05022c0302cdb10a04815f0201690104833a0404824302026a360a04823b02016b0a04813502016d0504831a0204833803021a02026e360404825e02016f080484140201720304844b0404816603056ff09d899b0304823f020275390204816e0301780a04824202017604088308812703027902027770050482040201790104827e040482750204812902017a060483030304c2bdc2b30104836f0203c2aa62040484040301b903021c0302bd6b090484300301be0704814d0202c99402025603049a65656b090484020202ca92090482060203d19a730504844a0203d49f690804836e0202dfa8020482710204f09180860704822901016e011a0c0b8104243647521f43231f36011a2e1b33432c3d0b414905054d17011010573a6c0a816c1801160e063582340a5239050b06011a4481063d1b67250f2044200839012044591d1857291214135814101a1b361d011225067e8147111a4a4301166b13362e17195f3812186f01141c465b032b290406373301182a152a2281300f8107054e3f02023274080481770305c2bacf8168020481450201340604832f0201350704842e02013605020e0201380404841d0201610404810d020483750201620304812b020484230301610804834503026c6a0304816d0201630102380305613577337405048359020165040482720201660904826202066736f094b0af0a0482250201680104811f02016b0304847202016c0404822403016f0904822c0302c2b301025002016d0504817b01023f02016e020483090802040303e7bda10804832d02036f6b740404811402017005048419020484220202716506026303026b760904830a020172080482430304706c73620504825f02017308048413020174080481070201760104827f0204836e020477e7b89a0104840e02017a030483700206c2aa35657065050482740301b30804842b04046cc2be78090481040301b903020d0301bc010484260904813f0203c7a5620302330203c99f36050481010301a30704815b0202ca8b090483250202cdbb0604820a0202cebc0102170401380304842b0207eca2a6f29c87950904824001016f01221d17052b58101241060e3a201f1021633a0114816919811c142443100801280426080e2620042a812c531a490e121707131710011273432e493347811a340112195f671f46721c325e0118380c052b812822478107600b0116021c21821b2019263433040126021b05351b2a286b05181f071b5628111a330a012014533e073d0c0e5469141d1e2734050901220318051b44412803632e0642370e0a3a2b020131070481770201320a04812f0202346e04022b020136030483590304f09a81b60404834702016105048210020162030205030167010268020163010481540604820202048300020264310902420201650804834b02016703048247030365c6b602048205030573f098b890030481450201690204832802016a0a04826703016c0104825e02016b0604815e03016c03048334030677c2aa74c2bc09023d02016c0304823903027777060484540303df866c0104815b02016d0204811f0303796f7704020302016e0204814d07024a02016f0902680201700604840a0104831a0204835a020172070484440201730a023703026b660604830e030278790304815b0201750904822402017704025b020178030482350307f4b2a3896a343407026b0201790902720302633409020402017a020484590302dea004025f0202c2b20204816b050481200202de900402160204ee85a5770204822c0101700114143a0d391a60812d4e09011a2f313104201c372c3a3411321b011a268140144226334145050d1c4d01164e081f20671f088107237901186b123c1f6d07261e2b732e210116511116342a3d32376e083001106882257a0a17141101163039192b0c05812d735f3b01262a3e0841030b17181411051e0a18530e272b6d01182f322b260e24581d5381050f02013104048353020132050482370301690204843e02013302020d0201340104841f0201350a048139020137050482770201380204833a02016105025a0504832f0201620304836d020163050484100304832003016c030481290201640304837e020482490304822b010482290201660a04827002046964dc960204833102016c0704814502016d010482000201700104817e02037176760904821f020473eb91a708048152020174090482770201750404831e01063a825d03017a0904826a020276730a0254020177080260030277630104815c020178070481220202020301720804841202017a0204834c0202c2aa040484010301ba080482580202c6a3020481320203cdbf690502790202ce90070483140301bc030481470205d1a371cebc060481590203d2976a0404830c0203dfba6e0604814b01017101163732393b8120422f054b0e010e030b211d815d1c01165641757c080d81311d090e0112816581542d2313054301224e07121706516606080e39102d231c4b39010a2d81402d5e011a132527428114080d6e1111721c011a814a1a341538251023100d1c4c011e22182622623712411e38162a182d3b01142b67611981470f1f1f250201310a04824e0202336207048217020238730204815a0303cf886d06025a02033962620404833803016f0a04814e020161060483140302726d050483450301790904810c02036376690504811c02016403024d020165010483280802550301650904827f0304ebb8b561070482340201670302670301660804810e020168040482340201690704844d0302616404020f02016a030481060301700704827802016b070481240104814b0302c2bd0504816102016c0604837f03017a0404837902036dc2b90804810002016e0904821602016f0304812c03016401024b02017103048233060483600303e5848e04023a020172040481050305f3978aa06c070481151708070b070a0d0707070607080c080909090706080707070707070806070707070a090b070708080909090981140708070708080b0a0b0b070b070907090707070707070807080c0c070609070b0807100706070e08080a81110f06070707070f07120a0c070707070b0707060607080709080b0b080709060708070808080a810f0707060707070b070707070a080b08070e08070b0b08070c080f070a09060807070a080909080a810b080b070706070b0b0708060b07070c07070707070a0a09090b0708070a07070b0a070c070a060b080907080807070d8123070707070a0706060f070707090b07070707070b07080907080a060f070608080706070c060707070c070a810f07070706070707070a070b0713070a070707090a070c070706080a07070807080808070b0909810607080808090707080709060a070a060707070707070b080707090707060b0807');
+INSERT INTO t1_data VALUES(274877906948,X'00000e8a0330717304048359030134050481100203756371070482190201760704817b0301770804821d0201770204844d0201780204836c0404826103017504026a0202c2aa020482420301b305022c040267390602570301b9080481540301bc0102290206c99cf6b5aa80080481430202cebc02026e02048120010172011a1c2f15158108048125463f251d010811811539011412423105812181171549011847284a30234e5b33042632120118351e8113817d0f2b220d111901264f104a211004061d0a2a0b35121a0a2118341f011c81160a1b030d2a0610243e445f0c011c6f0c1e3b1768141e322717500b140110537f810169811625011a492847203e210f532c16480627020135020481780302caae0104811a020261330904846c0201620804812d0201630404814a0201650704837503017301048276020168050213020169010484540604842b0302796f0504833302016a0304831b02016b0604701302016d0604815302016e070483630204815202027071020481520201710104835b02037266700704843002027362040481490201740904817d020175020481040304f59e9c9407048218020176060484060204776dc2aa020483070201780504812503016601048159020279790704840502027a730904826c030178030482740202c2aa04023d010483540301bd06026b0203cab877010483290202cdbf060482410202cebc04025c0401690204827f04016c0904840e0202cf880104835d0203dfbe6c01025b0204f0aeb7b2030481680205f1a7b5bb390504826a010173011a22810d12415003071f81181839011a3220221511546d810012052b57011a0c4274300d154e81111f041e10011e293f4213051b2276560817312811170120092136122418370e4e782b3912080f3201262b3b340f222b0c09142a0822116a135c1c130c0114320c4e385a0d0415075f01163543340f06362381133c0c012224180981742048191d110e180e180d310f011a20632450281f043027114b034e0203316a61030482160201360104826e0201380a0484570201610104844d0504814a0201620904820f020164010481630304810403027761040258020165080481550302c9b70204827a0204677367690102660201680104831b020169020483760301720a04814502016a04020c02016b04023405023c030269630504840502016c08048463020170030482670202716d080482000201720304835c03016507024d020174030482520504821503016505048207020175040208030137060481710201760a04833d0201780404832302027a6f080481200202c2ba0204812c0301bd0404821e0205c3a66865730702540202c7890804816f0205cebcc7af730504815c0202d2930202540202db89020481160203e8b8a00304825d0205f0958db331070481620305989b8569780a04813d0204f69299a5020210010174011a7b3829100a4e511f1a281c17140114812626032c372634234c01140a520e815a810815200501123e4f3531042d57615b011a041f3e64070f1f1913274a20770114811d0f5d743e0634161c01162c2782130c1b810520280d01164a513110480b402b810d13011e522d08042c1146137012201e810512011a290903182c05301e5d811944290201390a04836d0301610104836e02016208027803036cc2bc07048261020263640a0481480301730704813602016408022b020165050484310301720702260301780402500203666d73070484470201670104825b02016a040481590304836702016c0304835601025e02016d060484110301340204813702016f04021802017006068336280201710304813507025902017201026508022903016d0604812f0201740304827e03016a010482440201750404834b02017604021a010484150504836a02057773c2b2380602520201780204823e0302cebc080484040303d2956403048171020179020484240204813c0202c2b303048307020484410301be0204816f030484250203c798680104843d03019c030482570204e19ea86a020482350302a0950a0482280204e5a4bc780304810e0101750126090a35030a03220a1731630f31252f0c4b1e31011e39200e3715282a03103b56090f6b1501121d4916246e6d460d6501162609380406361e816d203f011a22166008124f58202e182025150114390f3a25713f0e3f715c011a5a11191123466025710c313312011e3c191326811c1444055f1f5109051201143b106f1181000d068155012043381381020d81080d0603171824260a0201300404844a02013207024203026b390204833803066eeebabb35660604842102013308020302023f02013503048243020436716b66040481440201380a04843d020261690704836002016203048209030484670201630a04841d020264790104822b0201650502340302c2bd060484300201670202620201680704810d020169010484430104843402026b67040481540306eea3ad77c2aa0a04836702016c020258040482270104830a02016d0404824102036e716a0604843e02016f0104832a04020c0204836803036530650a04817402017005025b0301630604843d020171070275020273720404827002017504048133010484120301370102270201760104814f03026203016d0904844802017701048375080481220301660202330301700a04827f020378c2b2030484710202796806023c0301730704813d02017a0404815f0104817202048407010483390202c2b204026802048254040266640204831e0301b3090482230302b963060482010401750a0483290306ba35f2999dac09020f0203ca926e090483350203cdb4780302350202cebc0a020f0204d7a7696d010483100206f097bc996d71040481480101760114185b2258291610821c0e01160272173107154f5b813722011a81020c200e1826250d39811f07011a7911152a2a45131504422c81070120050d3f5b23342e3e4139032a3813042d0116592d1c15630c0c0a814649011c1a362f5c4a35511f0804033e372b01102981262a352e8205010e0b4b6282388106011e26810a2d125f361a12170d1721311e0201300204832b0201320104811b050483790201350204832202016404024c0202657a090483710202666307022703016c07048362030277750604842f0201670304843d0104844c0203686f7a07027202016a0102430204847502046ce0a2b20704810302016d0204827b02026e330804826c02016f0104835502017102027606026c020172060483490202736505048371020174030484130302387602025d02017502048345020376346b0904825c0201770904814b0303c2bd720804812b020178040483600201790804816402017a08026e0202c2b90704811c0301bd0504821e0204cdbcc7a108021a0202cfb8080481490204f09f96a50204842101017701180207232d37812d0c045c4a0a011a06163b3408171c52213a26592201206d08581605811a171e0c0a1347104914011282181324082b73320f01122f6e811d2c3d410a44011e551414206a092f133f333d150a3e0f011e235b170e37060627471b13373b3e27011a0e1e816b270c10102d53381045011a060e1e254d044932651234691e011a158138300a04810c0a8121071802013003027707048214020131080481370201320a04835502013304048271020538ceb369650802310201390a0481440202616c0502570302c7a104026c0201620804811c02016301048168020241020164040481560104820b020165080484460102400202686c060232020269670604827302016a0108810c826e0704824e02026b6c0604816902016c0304831c02016d0304811903016407022b02016e01022e0604845a030237780702040301710804815102016f0104842903017a0704826902017003048445020482080202713002024e0201720804822003016202022302017303048111010482790204812d03067479c39f66700a0210020174020229020175090484430301690604820402017606020202017a01021b0104843a0202c2b90604842b0301bd030484570202c69b0504815d0202c8a30a02240202ceb8090484690301bc0404832f0202df85020481230101780116812b0a16810e4b045a3b2a01205b1305811134092f62072343100f0f05011e5734152612030b4c4134123009361601121781653207780a6a0d01164a25210824138107738139011481341f088158060c8133010e5920193a4c2331011a0510358101231a1b3609702732011a2f07631610033436810256174c011a1342040a58110721378139101602033067750802720201320604834303017109048244020133090481700203366f79010483520201390404810902016301048411050483420201640a048432020265310704832b02026774040481000302d5b2010259020369756c0504832902016c07048365030233700904824102016d010482670404834c0504830c02016e0104831604048120030169090481750303eba6990104835f02016f0604834c030379c2ba0a0481560201700404815e06048256020174040482370201760a04820d0201770604811c02017a0404812e06020b0202c2b9030481660301bd0a04816c0301be030483620206c99b6d7777750304835b0206ceb0646b66610402490202d8bf030482250206e8bfbc626964080482510204f09c9a9e0404830f010179010e2081335661371c01220e4e2718124f0d0649812b0b0a063b040b011402741d1235810805211a011409161d732b8106325f6a01182e330325068107703728302b011e3723081c0d0a3f810c183e061b067f0106834a12011a044030185a1e810704220a0541011245602b0e421441817801144b03811a1a29614e224b02013003048139020132050485050304f09caba6010482230201350104822708048413020138020483430201610402230201620902440108812181070301300304815e020263710404831002016403048226010483660604823c020165010484510201670104816407048418030334c2b20a0481120201690404814c02016a010481500904810f02036b75610304836402016d01027902016f0304817b03056f6373cebc0a0483010201700104817d020171050482680104843b0302383203048128040807090707070b0608060707060c0b810e07080807070707060b080707070b0807090807070a070a07070808070b06090807070708080a0b81230907070b070b0707080907070706090807070807060b07060707070808070a080b0708090b0b09810a0707060908070607060609070b0a070706080a09070707070e0a0708090b0c0b09070a080a811a0706080c09070a07080b0708060806070b080c0e07090e09060706080b060a070b0607090707130b080708070b0908070a0c810d070b0706080707080b080a0a070807090708070707090709070706080709080a81170a0707070a070707070a0b0a07080d080707060a070707070b0707060f0b060707060a08070807080708810d0807070709070b070808070907080f0b070907090b0707070a0807070c0b080c0a810107070a0b07060c07080f070b09070b0906070b070b');
+INSERT INTO t1_data VALUES(274877906949,X'00000e5c033079720404826c0404833002021b03026f6b020482100201740904842e010484150303c2b36f0204840e0201760704826b02017708048273020578f48ba5b50a0481400201790904845902017a050483280304c2bac2bd0404841e0203c2aa680904843a0301bc070481100301be0304820304016a050481630202ca8103027b0202cb860604840d0204ceb56e370204832e0302bc740202520202cf8d07027e0205d8ae39c2aa0104813c0204e887b3770404816a0204f1bfb0970204832f01017a0118101e282f07045961813a193e011e69162f0d2b051c060f084460063053011e06810c20330d0733815c220515220c011210290a7e07810c3a18011a1f2f064a19155212472781047c010a123e45825501166c6062182718167131092f0112331b812c0b6e81470b01184f3a230d45261e271c36111701140a8128456b291248391a0201300104840d0204812502013401048318020137070483070201380904823b03016704026402013907023403016e060481380201610204812f0404824504045243020162050481150104824003016a0804827a020163070484590204817903017a02048209020164020484200203653077030482610302737601048424020166070481730201670304841e0504840e03016b0504825302016901048235010484400404841002016a010483680404845f02046bc2b97407023302026c7a0704812d02027161070209030378cebc0a021f020172040483750404815f0201730304813c030131020482040201740704824d0302793901027502017604048423020177040620813103048313020179030484540204833c04022503017a0904826302017a050483530203c2b2660404840f0307ba6272f397bd92010483070301be020482760202c6b9050482410203c9a3650604812c0202cbae020482180202d38c0704812f0204f096adb7070483490204f6a69c8b030484390102c2aa010c815e81147969010c811c827f0417010e81077a4c03815f010a2e8100820c010a810d148140010c0a7481201a13010c0b831525323d010a8206358129010c21637a33812701083c8340390301300504820a0304326939770404841c03016107048334030165030484150302696c0704810103016c0704812a03027178090481620301730504830e0301750504846303017802021c0301790304836803017a0604834e040135030482650302cdbf010483330304ceb23169070484090303e4849a0504817d0201b201088219744601082210832c010629846001121c8137182211816232010a81668122690108817281080110816a433581102f3e010e7481001b3481190106814e1b010e3646823a810e070301310504840b030161010481720301660604822f0301680804821003016a0704844803016b0104845b03016c0504823403026f700802340301710804826004026d3106024a03017509068458070301770a04836c04016b01021f0301790a0482790302c2b20a02270401b3040482130303ceae6e010484330302df9e040482100201b3010881656e750106820b50010e81434a27048153010a812b068122010843810c0401048211010a50817d812e010c811a8163810801061e832c010c811f81418101030163030481210301640504831102048104030482440301680a048202040271300404841303066b6576cebc6a0104843603026f7a08026d0303756a7808023e030176040483610301770704814403027973020484360302c2b906020c0401bc010484490401bd0804835c0302d38c0304846f0304eaae96750a0484020201b9010c3b824018322d010e0468315a5c817901067d583401060b810e010865118169010c0e07826b813a01066f8265010c3b8239633852010e61161e7030821b01068241210301350804843d0301620302480301690402610403e7a1910704812103016d080269030673c2bac2b36c090483070301760504821d02048454030278350702620302c2ba010483320304ca897a750804813b0401b5070482350303cebc6d050483120302d199020483020402ad660604840c0302d2a1010482550302daa30202340201ba01026d01085119826a010c2f5e82008110010882028221010481090108821b812d01068128460208810b8264010c810971812d440301310304820e0301320504825e05048221030333756d010482720301340502700301640604813d03016607020c0301690204823a03016b0104812203016c0704842103016d0304835f03016e0a04813c03016f0304834d030173060482660401710604810f0301740104843c0303d48174040482690201bc010482690108813c83290114090f816045242e148111010a810616822701048456010e2c81167a638115010a3a3b83204001067a8367010c8114127a2265010a824f7f5c230301300604833e0302616f020483560301640104827d090481280301650502150301660804841a03016804048221030169030481120301720104827803017606023d04016e020481700302c2aa0904836c0401ba090484100201bd01088240224f010843813674020a81185068620106822a44010e14154a8101825e010c19814a1b826c010c81221f81651b010a815a4d812c01082d7281160301300804843c030231300304836703013509048353030365c2bc0304814d0302667504027a0301670604831503016c09025d03016d03048178030172020483620301730104816b0402c2b30404823203017401027204016a08048451030175090237040177090481690301770302190301780a04823d03027a350a0481260302c2aa060481620401b3090481090304f098a1a30a04825d0201be010a0d730b816f010c821d81236c2b010c6f8208358119010681236801087d4e831e0108823c8235010667794b010683165e010e05812e3d3c820d010c81148123817403043531c2ba0204824c03083875c2bceba7957a03020803016302020804036dcebc0304814e0301640304843704033379790504823203016b08023603016d070481090304825804013707027a03016f080484530301710a04842203017809025e0304c2aa6135010481460401b90a04836b0401bc0704814f0306c6ab66e3afb9080482660103c39f350304821f0201b0050481110301680602030201b8040481310604810403016c0a024803017108024b0201be06048323030482650301300504812d0304f48990ae060482740103c491680a0483700301760a0481290201a7010484090202b177020482380201b3030482280102c5800602090301360104826a02018202048173040483780301370104814102018b090482730201930504810f0102c680020483790404830c020183020228020185030484400704820b02028d7a0a04821c0201920404835e02019507048437010484070301760204836102019a020214080483100303d795680504820602019e030481050201a30404820a05048436030177070484290201a50704843b0201a8060482690304816f03027735020483630202ab79050484430201b6060481050201b904024003016d070481130201bd090484350201bf06048361030163020481580102c781040484560201830604833a020286650404842a0301750a04821a020189070483370303e0b9b30904836602018c0104816c04020602021d030171050484570201960a04842d03016b0204821903016c04021e03016e0204845002019a0a04844402019d0704835103013103021702039f77750704827e0201a1090483340201a301022b0404831d0304616363750502520302cfb2040483720201a50a0481530202ad760902310201af0104811d0908816281390301640404843c0201b3080483240201bb030483480201bd040484290304840a0203bf646a0404843f03017a040482450102c89d05020f0201a1090483550201a3060483550201ab0904813203017a04024a0201ad030482210201b10204824302025d0303656577030483600202b46e010482240201b6090484410204bce39f9d020484570102c9870604813202018b0804843603017a06027102018d080481130204840c02018f0104836309026202029164020484430201930504816d0201970304843402039c6c73070483700201a0070483470201a203048262030364d7960a0484010201a80304832a060484390202a96a080481170303c69532090481440201ac040214020481180202ae770604832c0201b0090482300201b40804845a0201b5070482110302716f010482160201ba0504837b0201bb02048149030165050483250201bc07088105833002067f824d0302d19f0402330201bd04024d03017a0904814f0102ca800a048321020181040481580201820604821e020383693707048417020287630704840002018a0904834c0104835c02018b06022f02018c0704814702018d0704810a0104831a020490e7b38308048423020191020482510201920304832f030135030483710201950304833207026802019902026b02019b0904832a02019d09024c02019f0802210201a4010484080202a5710a0481680203a777670804831e0301790902100201ae0402700104834e0201af040484650202b673080484190201b705048221010483520201b808048465030167010484400104cb81cab90104834802018602048317020689777568cf920804842602018b0404817b020191050484200202a0720304833e0201a3040625827f0201a4030485080102cdb1070881408205020483700201b30404840e0202b735080482640201b80504815a0201b90a0482370206bb31cebc6c730304842f030133070483010103ce80370304826d0201900202770201ae0504844e0201b1050484080201b20904815f0201b3040483430201b40702600201b50804823b0201b90304846e0302c9a1070483300201ba0404844d0104847e0201bb050482780201bc010882378223010e811105814d8134010a8142823f2d0106811c52010a6e1814816b02088168824b010a438137812d011019060c6b812f811c010a81314e811b03033366660404825503013502048263030238620904820703016303048120040f080b0907070b07070a0907070707080a07070b0a0a81060b0707070606070f0b070b07070908070b070f0b090807080b07070707070c0e0707090d07080908080a0a50070a0707080708070706070707080a094d07070707070707070707080706070707090844070f07080c0708070708070707080a4707060609060c0b07080a07090808080737070b09060706070707070707070707094807080b0607070707060708074107080709070706070707080607060706070808070a460a0d06090709060b060707060a07070c0907060b06060b070a090707080707070b0707070c060b08070b070a09070b07070b08080706070707070807080707090d070707060707070609070a090807070d0707070b09070707070706070a0908070a0807060b0a080707090707090b08090a08070707080707070e07060708070709080b06070b0a0707070a06070606070809060a07080b07070a070c07070808070e070807070c07090607070707060707080b0743090708');
+INSERT INTO t1_data VALUES(274877906950,X'00040e1807020e0830cebc66f09f97b60604840703016b06021003016c0804835103016d0a0484050301710602560301730304822d030275770904834e0301770204824d0302797707022e0302c2b2070482640402bc6d0a025e0303c3a6370602530305cebc7768690a04823f0201be0504816f0301780a0482780201bf0a04833a0305f09e919a790a0483440103cf80340604827e0201810404823e0201830304843a0504837f0301780704834c02018407048139020186030881038372030178010231020187010481100201880204835b0204845a0104825a0201890204825c0604831802018a0704841502028c340304845e02018e0602180301390204833c0203936e770104820f0201940704823702039765630304847b020199080484110301710704821402029b650704827102019d0304845802019f0504845c0303e7ba880502690202a163090484160201a3060483020301680102470201a90a0482480201ab0104837f030482570201af050482190201b20a0481020201b30504842903026f64040483650203b873780704826d0201bb0704831c030177020481410102d0b0070482560202b17a050484460201b2040483400201b40402390202b671020484220202b777090483510201ba030481750202bb6301021e0202bc620a0484080201bd0204815d0201be060482470201bf040483340102d1800904825002028470050482290202876f06022202048872c5820104826202028b680504845d02018c0a027302018d0a0205020197090483210202986b0a02780201a3030481580201a70604835e020483670201a901048379060483780201ad0a04816b0201af010482310201b1080482020201b3060484610202b5640804814c03026e690304847c0201bb080482710201bd020482020201bf06048435010482590107d28b37c2ba61640104831702018d0704810b020393c5890204836e0201950602070305f6a5989a74040484450201970104813702029f790a04843f0202a57407027f0201a90504835b0202ab750502490202b9760a04827d0301780304826e0202bb6f060481780203bd7130050483630103d3866f09023602028a6c0604825302018c0304845302028e650404833a02028f6f0104821302039d356d090484320201a5020481130404813f0201ab0704835b0201b90a0482380201bd0904833c0201bf060484450302307604027f0102d491050483300201930a024603036bd291070483060201970704826702079b72c2b3356f730904844f02019d010482610201a10404814d0202a36b0502250203a5c7b3080483780201ab02023d0103d5a1640102260201a206026a0301660804813c0201a5030481180201a7050483360201a9040483510201aa060482020201ab0504811e0201bb090481680202bd740702160202be700304846d0102d6840a027d02068534f0988d910a0483730102d78f0404832804048462020390766601027802019202027405024b0201940a04834d020298770904815702039a6c6b0304846802049c73616e080483420201b0010481050202b565050481290206b67376c2aa640a0483280201b80704830e0102d89d0202150802720201a60602480202b073090481480201ba0204836f0102d9a50202670201b40a04822a030337c2b20a04820f0102da800604831c0201840604842802038636380804811e020188090484190201920504815402019a0304830c0201a301023d0201a6040481460201a8020484100201af0104842a0204825f0201b50304827c0201bb0804830f0105dbb878c2bc0502580107dc97e69eaf6764020259020299610104812902029d680502110202a0690a0483270203a56372030483540202a96a0204842c0205acf094abac0704821c0102dd92020483410203946d790304814f020395d7ac090228020296300404830302039b397809020a02029c770504833d0202a2700504821a0201ab010483400202b0760a04813a0201b2040483130203b3c7a10104833d0204b4e8a5a40604816f0201b90604830d0201ba090483630102de800904810a020281740a02380201880704826802018f030481670201900202790203916e710404833502019206048418020399ddba080481240202a3630a02250202b86e070481670204830d0201b90604811f0201bc070481530102df820102390201830304830102038e367901024f02039134620a0482080201920104814b020198030484790202a06b060481240201ba0802090201be08022f03023670010482170202bf6f01022d0103e0a1960304831d0302bb75060483700202a2900804817c0202a49e050485010202a6b2040482030202aa80040481720202abb30304843c0301ba0204833b0203aca677010481120206ae9f613566730504841e0202afa001020a0302a979080484060202b1a1010483730203b2a46a070482460301ba020484580203b39b610804834a0202b6a60304813b0202bfae0404837c0103e185930304845f02038889780a04826802028a85070484620301b90304826c020298a3070483270203af8962050484620202b5b7070481170202b8970602190202bd8f0a0482620103e2848f04021b0203afa861020484010301b70704824a0103e3828f05048214020284a50304812f0202909e0904824d020292b907026302049ba0336604020602029c8e0204840d0202ad860202750302a16a0802180202ae880602040202b480010483150202b7b1090483780202bdbf070482050103e480ab06020f0202889605024f020293b9030483310204968fdc93080483110202a295010484150202a69a0804844d0202a78e0a02080202aa9b0a04825f0203b2b8670402720203b5b764060482550204babacf87070481270202bd9b010481780206be9a6878696805021e0103e58bba0304821202049eab6a630a04827702029faf08024d0202a2b50a02400202a3af0704827c0203a4bd6f0504840c0202ad9d030485010202b1be040483780202b5b9060484500103e689b10404844602028abc0704811902038e98690802320203968b35090482680203979971010483060202b6a4030484050301be0a04833e0103e780a601048171020282be0304824d020286b105021b02028f960a048266020291be0804831c020299900204815502029ea70702400202a0ba040481410204a69e3870030481220202a9800602310202afb8020482170203b1af6d0802140203b5a06a0702740104e88c9a6c06048426020295bc05048326020296af0304846b02059cad72d4aa060484780205baa97364680404837b0103e983840104843902029a8a010481490203a1ac770504812c0301ba050483410202af8c0302620202b1af0302500103ea8fa60a023e020297b50904812e020298a90704825702039ea76b0304847f0202a59e080481460202a68e080482590204a9b1c6a8010481350203b38d75040482750203b89e6f0a0484030103eb828f0704824e020384837109048178020397b6690104821a02039e9e330704837f0203a68b73030484440203b980320804822c0103ec8fa80204814302039588760a04826902029bb80a024e0203afb6630802710203b4a268060483000103ed8cb50104811602029982060481550104ee8085760304834502028a870904845702028f8b04027602039da470030483040202a1a20504813c0202a8ae0504837f0202af9d0402570205b1b773d8b4080482120202bd880904832c0202be930104827b0104ef88ae680704835d0205a8ab63c2be06022e0203aaa16c080481090204adb779660804823f0202b8ae080484220203bb9165030481340106f08798b1636a0604824f0203908ea80404826203029f880402530303b4ad740a04833302039184b6090484650302acb3080483340302b1b703048272020a9281a23578f098b1893001048210030291a50404816803029d8f070483200302afa5080484440302b49f020481010303bd833603026a020393839a07024c0304a3ad6e300504842d0303abb16d0502660302adae0904830e02039481a406048164030386a16c070483530302b2a8050484320302bfb9080483170204958eb8720304832b0302b1ba090481200302babe05048209020496888b6708048358030293b4050483400304b4927a6f050483770204978b93320104810a03048fb9c7890704822803029ba702022a0302a39d060484490302a4be0a0484530302adaa0a026b0302af92040483700302b9bc0404821b02049884b56404048352030486b1716f0904827a030296b80904811d03049d9e797a060483390302a5a00a04844a0303b5856d0a04822e0302bcbd040483310303bd91740704845102039983a20a04816503039d8a330a02140303b9826b0404814e02069a8b8438687403026b0302a599010481740302a6ac0704840f0303b6896d0404831a0302b785010484370302bfac08027d02059b86b770610404845203028fbd020483550303a0be75090483620302a295040482390302b6970404813002039c97bb0a04841103059d8976c2be0604824e0302afbc05023c02039d87b40504825903028daf03048172030292be040482310302a0ab0502290303b2a16b03025d02039e929d050483040302a69f060484150302aa8607025502049f9f8b66020483160302a3be060481120203a8afad0904835e0204acb1af640204845b0204b282a47a040481610203baa68a010482490204bb9f8366060483130203bfa48f0704817c0104f18191920802220204828cad360a0482730203859c9a050481670204888eb23408025f020492ba9c3202026502049bb0bf7008021f02039f94a60104835c0203a6b496030482760203a98c960504824e0203acb7b8030483240203afa0b703023d0206b3a38c683972060483340203bbaaad0902070105f282848f790804833a020384b79f0a048170020590a98c616a0804843b02049a92be730904822f02039da18b080482530203a28f8f06048309070d06070706070807070807080b0707070b09070b07070906070f0b07080607090709070708070708080706070b070707080907070808070608080707080707070808070a0806060707070b0b07070707080807070b0d0709060b0708070707080708090808070808090b0707070707080609070d07070709060806070707070707070708070c0c08090708090a07080c070a0608070707090807090707070607070b07070a0c08070809080b08090808080808070807090a07070807070706090709070c070707070809070708060608070908080808080807090c07080809070908080909080708090807080809070908080709080707070808080807080a0808070808090a080b090a070708090808080908080909080709080708080807080a070808080a08080b0b0908090707070808080908080a0909090909090909090907080909080a0807090808070b08080a0a090a08090c090709090808100808080808080a0808090908080a08080a080a0a0a0708080708080a0a080a080908090908090b08080908070b08090808090b0709080807080908070a08090a0a090a09090a0909090909090909080c080b090b0a09');
+INSERT INTO t1_data VALUES(274877906951,X'000002020630f2abab907a060481130204b381af77040481790203bea6a6070484250108f380b5a33633737701048229020383be9f0404837102048495bf73070481060204938c9a6e0904823502039eb39201022302049fbb9f6c0a0481500204a3909e620404837d0204a9ac9a75020483110203bd8c850a048111030293ad0a048247030294b9040483550203bea4ac0702220105f483b5ab66030482440302bda306048141020584b2bb643804048142020586b1a8677a0204831d0205878c916c770804821f02038da1bf0704824302038f81bd0304825102039e91b20302420203b29b9403021f0203b3a1b10704825a0203b5afb4040481210204b98da0780a02060104f582b1b00404811002038f9fbc010482200302b8a406048419020394b7b80404834c02039bb5b005022b0203aa88b9060481390203aba48f0604842a0205af969438680602360203b88d8903026c0104f68386ad0904846702049aae8f79030483520203a8989a0604836c0203b18cb4070482260203b9a98d050483730203bebc870104824c0104f78283840804816703028db20302600303a8b46106020b020389b2a80104835002048e809339010481190205929193d0b409048253020393aebc0204816202059787b96f690704817202079b949dc78934620404817f02039db28b020483750205a288a7c7a3080482780203a5948d0204811a040b0a090e090a0a080a0a0a090808080b080b0b0b090908080909090a0908090809090a080a0a090909090a0708090a0b090b0d090b');
+CREATE TABLE IF NOT EXISTS 't1_idx'(segid, term, pgno, PRIMARY KEY(segid, term)) WITHOUT ROWID;
+INSERT INTO t1_idx VALUES(2,X'',2);
+INSERT INTO t1_idx VALUES(2,X'30627a',4);
+INSERT INTO t1_idx VALUES(2,X'306a32',6);
+INSERT INTO t1_idx VALUES(2,X'307173',8);
+INSERT INTO t1_idx VALUES(2,X'307972',10);
+INSERT INTO t1_idx VALUES(2,X'30cebc66',12);
+INSERT INTO t1_idx VALUES(2,X'30f2ab',14);
+CREATE TABLE IF NOT EXISTS 't1_content'(id INTEGER PRIMARY KEY, c0, c1,Öc2);
+INSERT INTO t1_content VALUES(1,'COMPILER=gcc-5.4.0 20160609','X','RTRIM');
+INSERT INTO t1_content VALUES(2,'COMPILER=gcc-5.4.0 20160609','X','NOCASE');
+INSERT INTO t1_content VALUES(3,'COMPILER=gcc-5.4.0 20160609','X','BINARY');
+INSERT INTO t1_content VALUES(4,'DEBUG','X','RTRIM');
+INSERT INTO t1_content VALUES(5,'DEBUG','X','NOCASE');
+INSERT INTO t1_content VALUES(6,'DEBUG','X','BINARY');
+INSERT INTO t1_content VALUES(7,'ENABLE DBSTAT VTAB','X','RTRIM');
+INSERT INTO t1_content VALUES(8,'ENABLE DBSTAT VTAB','X','NOCASE');
+INSERT INTO t1_content VALUES(9,'ENABLE DBSTAT VTAB','X','BINARY');
+INSERT INTO t1_content VALUES(10,'ENABLE FTS4','X','RTRIM');
+INSERT INTO t1_content VALUES(11,'ENABLE FTS4','X','NOCASE');
+INSERT INTO t1_content VALUES(12,'ENABLE FUS4','X','BINARY');
+INSERT INTO t1_content VALUES(0,NULL,NULL,NULL);
+INSERT INTO t1_content VALUES(33,'OMIT LOAD EXTENSION','X','BINARY');
+INSERT INTO t1_content VALUES(32,'OMIT LOAD EXTENSION','X','NOCASE');
+INSERT INTO t1_content VALUES(31,'OMYT LOAD EXTENSION','X','RTRIM');
+INSERT INTO t1_content VALUES(30,'MAX MEMORY=50000000','W','BINARY');
+INSERT INTO t1_content VALUES(29,'MAX MEMORY=50000000','X','NOCASE');
+INSERT INTO t1_content VALUES(28,'MAX MEMORY=50000000','X','RTRIM');
+INSERT INTO t1_content VALUES(27,'ENABLE RTREE','X','BINARY');
+INSERT INTO t1_content VALUES(26,'ENABLE RTREE','Y','NOCASE');
+INSERT INTO t1_content VALUES(25,'ENABLE RTREE','X','RTRIM');
+INSERT INTO t1_content VALUES(24,'ENABLE MEMSYS5','X','BINARY');
+INSERT INTO t1_content VALUES(23,'ENABLE MEMSYS5','X','NOCASE');
+INSERT INTO t1_content VALUES(22,'ENABLE MEMSYS5','X','RTRIM');
+INSERT INTO t1_content VALUES(21,'ENABLE JSON1','X','BINARY');
+INSERT INTO t1_content VALUES(20,'ENABLE JSON1','X','NOCASE');
+INSERT INTO t1_content VALUES(18,'ENABLE GEOPOLY','X','BINARY');
+INSERT INTO t1_content VALUES(17,'EOABLE GEOPOLY','X','NOCQSE');
+INSERT INTO t1_content VALUES(16,'ENABLE GEOPOLY','X','RTRIM');
+INSERT INTO t1_content VALUES(15,'ENABLE FTS5','X','BINARY');
+INSERT INTO t1_content VALUES(14,'ENABLE FTS5','X','NOCASE');
+CREATE TABLE IF NOT EXISTS 't1_docsize'(id INTEGER PRIMARY KEY, sz BLOB);
+CREATE TABLE IF NOT EXISTS 't1_config'(k PRIMARY KEY, v) WITHOUT ROWID;
+CREATE TABLE t2(x);
+INSERT INTO t2 VALUES('optimize');
+INSERT INTO t2 VALUES('rebuild');
+INSERT INTO t2 VALUES('integrity-check');
+PRAGMA writable_schema=OFF;
+COMMIT;
+} {}
+
+do_catchsql_test 51.1 {
+  SELECT max(rowid)==0 FROM t1('e*');
+} {0 0}
+
+#--------------------------------------------------------------------------
+reset_db
+do_test 52.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 40960 pagesize 4096 filename crash-2b92f77ddfe191.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 00 00 00 00 0a   .....@  ........
+|     32: 00 00 00 00 00 00 00 00 00 00 00 0d 00 00 00 04   ................
+|     48: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00   ................
+|     96: 00 00 00 00 0d 00 00 00 0d 0b 6e 00 0f a3 0f 4c   ..........n....L
+|    112: 0e e1 0e 81 0e 24 0d cc 0d 72 0d 1b 0c b0 0c 50   .....$...r.....P
+|    128: 0b f8 0b b3 0b 6e 00 00 00 00 00 00 00 00 00 00   .....n..........
+|   2912: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 43 0d   ..............C.
+|   2928: 06 17 11 11 08 75 74 61 62 6c 65 74 34 74 34 43   .....utablet4t4C
+|   2944: 52 45 41 54 45 20 56 49 52 54 55 41 4c 20 54 41   REATE VIRTUAL TA
+|   2960: 42 4c 45 20 74 34 20 55 53 49 4e 47 20 66 74 73   BLE t4 USING fts
+|   2976: 35 76 6f 63 61 62 28 27 74 32 27 2c 20 27 72 6f   5vocab('t2', 'ro
+|   2992: 77 27 29 43 0c 06 17 11 11 08 75 74 61 62 6c 65   w')C......utable
+|   3008: 74 33 74 33 43 52 45 41 54 45 20 56 49 52 54 55   t3t3CREATE VIRTU
+|   3024: 41 4c 20 54 41 42 4c 45 20 74 33 20 55 53 49 4e   AL TABLE t3 USIN
+|   3040: 47 20 66 74 73 35 76 6f 63 61 62 28 27 74 31 27   G fts5vocab('t1'
+|   3056: 2c 20 27 72 6f 77 27 29 56 0b 06 17 1f 1f 01 7d   , 'row')V.......
+|   3072: 74 61 62 6c 75 74 32 5f 63 6f 6e 66 69 67 74 32   tablut2_configt2
+|   3088: 5f 63 6f 6e 66 69 67 0a 43 52 45 41 54 45 20 54   _config.CREATE T
+|   3104: 41 42 4c 45 20 27 74 32 5f 63 6f 6e 66 69 67 27   ABLE 't2_config'
+|   3120: 28 6b 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20   (k PRIMARY KEY, 
+|   3136: 76 29 20 57 49 54 48 4f 55 54 20 52 4f 57 49 44   v) WITHOUT ROWID
+|   3152: 5e 0a 07 17 21 21 01 81 07 74 61 62 6c 65 74 32   ^...!!...tablet2
+|   3168: 5f 63 6f 6e 74 65 6e 74 74 32 5f 63 6f 6e 74 65   _contentt2_conte
+|   3184: 6e 74 09 43 52 45 41 54 45 20 54 41 42 4c 45 20   nt.CREATE TABLE 
+|   3200: 27 74 32 5f 63 6f 6e 74 65 6e 74 27 28 69 64 20   't2_content'(id 
+|   3216: 49 4e 54 45 47 45 52 20 50 52 49 4d 41 52 59 20   INTEGER PRIMARY 
+|   3232: 4b 45 59 2c 20 63 30 2c 20 63 31 2c 20 63 32 29   KEY, c0, c1, c2)
+|   3248: 69 09 07 17 19 19 01 81 2d 74 61 62 6c 65 74 32   i.......-tablet2
+|   3264: 5f 69 64 78 74 32 5f 69 64 78 08 43 52 45 41 54   _idxt2_idx.CREAT
+|   3280: 45 20 54 41 42 4c 45 20 27 74 32 5f 69 64 78 27   E TABLE 't2_idx'
+|   3296: 28 73 65 67 69 64 2c 20 74 65 72 6d 2c 20 70 67   (segid, term, pg
+|   3312: 6e 6f 2c 20 50 52 49 4d 41 52 59 20 4b 45 59 28   no, PRIMARY KEY(
+|   3328: 73 65 67 69 64 2c 20 74 65 72 6d 29 29 20 57 49   segid, term)) WI
+|   3344: 54 48 4f 55 54 20 52 4f 57 49 44 55 08 07 17 1b   THOUT ROWIDU....
+|   3360: 1b 01 81 01 74 61 62 6c 65 74 32 5f 64 61 74 61   ....tablet2_data
+|   3376: 74 32 5f 64 61 74 61 07 43 52 45 41 54 45 20 54   t2_data.CREATE T
+|   3392: 41 42 4c 45 20 27 74 32 5f 64 61 74 61 27 28 69   ABLE 't2_data'(i
+|   3408: 64 20 49 4e 54 45 47 45 52 20 50 52 49 4d 41 52   d INTEGER PRIMAR
+|   3424: 59 20 4b 45 59 2c 20 62 6c 6f 63 6b 20 42 4c 4f   Y KEY, block BLO
+|   3440: 42 29 58 07 07 17 11 11 08 81 1d 74 61 62 6c 65   B)X........table
+|   3456: 74 32 74 32 43 52 45 41 54 45 20 56 49 52 54 55   t2t2CREATE VIRTU
+|   3472: 41 4c 20 54 41 42 4c 45 20 74 32 20 55 53 49 4e   AL TABLE t2 USIN
+|   3488: 47 20 66 74 73 35 28 27 61 27 2c 5b 62 5d 2c 22   G fts5('a',[b],.
+|   3504: 63 22 2c 64 65 74 61 69 6c 3d 6e 6f 6e 65 2c 63   c.,detail=none,c
+|   3520: 6f 6c 75 6d 6e 73 69 7a 65 3d 30 29 56 06 06 17   olumnsize=0)V...
+|   3536: 1f 1f 01 7d 74 61 62 6c 65 74 31 5f 63 6f 6e 66   ....tablet1_conf
+|   3552: 69 67 74 31 5f 63 6f 6e 66 69 67 06 43 52 45 41   igt1_config.CREA
+|   3568: 54 45 20 54 41 42 4c 45 20 27 74 31 5f 63 6f 6e   TE TABLE 't1_con
+|   3584: 66 69 67 27 28 6b 20 50 52 49 4d 41 52 59 20 4b   fig'(k PRIMARY K
+|   3600: 45 59 2c 20 76 29 20 57 49 54 48 4f 55 54 20 52   EY, v) WITHOUT R
+|   3616: 4f 57 49 44 5b 05 07 17 21 21 01 81 01 74 61 62   OWID[...!!...tab
+|   3632: 6c 65 74 31 5f 64 6f 63 73 69 7a 65 74 31 5f 64   let1_docsizet1_d
+|   3648: e8 63 73 69 7a 65 05 43 52 45 41 54 45 20 54 41   .csize.CREATE TA
+|   3664: 42 4c 45 20 27 74 31 5f 64 6f 63 73 69 7a 65 27   BLE 't1_docsize'
+|   3680: 28 69 64 20 49 4e 54 45 47 45 52 20 50 52 49 4d   (id INTEGER PRIM
+|   3696: 41 52 59 20 4b 45 59 2c 20 73 7a 20 42 4c 4f 42   ARY KEY, sz BLOB
+|   3712: 29 5e 04 07 17 21 21 01 81 07 74 61 62 6c 65 74   )^...!!...tablet
+|   3728: 31 5f 63 6f 6e 74 65 6f 74 74 31 5f 63 6f 6e 74   1_conteott1_cont
+|   3744: 65 6e 74 04 43 52 45 41 54 45 20 54 41 42 4c 45   ent.CREATE TABLE
+|   3760: 20 27 74 31 5f 63 6f 6e 74 65 6e 74 27 28 69 64    't1_content'(id
+|   3776: 20 49 4e 54 45 47 45 52 20 50 52 49 4d 41 52 59    INTEGER PRIMARY
+|   3792: 20 4b 45 59 2c 20 63 30 2c 20 63 31 2c 20 63 32    KEY, c0, c1, c2
+|   3808: 29 69 03 07 17 19 19 01 81 2d 74 61 62 6c 65 74   )i.......-tablet
+|   3824: 31 5f 69 64 78 74 31 5f 69 64 78 03 43 52 45 41   1_idxt1_idx.CREA
+|   3840: 54 45 20 54 41 42 4c 45 20 27 74 31 5f 69 64 78   TE TABLE 't1_idx
+|   3856: 27 28 73 65 67 69 64 2c 20 74 65 72 6d 2c 20 70   '(segid, term, p
+|   3872: 67 6e 6f 2c 20 50 52 49 4d 41 52 59 20 4b 45 59   gno, PRIMARY KEY
+|   3888: 28 73 65 67 69 64 2c 20 74 65 72 6d 29 29 20 57   (segid, term)) W
+|   3904: 49 54 48 4f 55 54 20 52 4f 57 49 44 55 02 07 17   ITHOUT ROWIDU...
+|   3920: 1b 1b 01 81 01 74 61 62 6c 65 74 31 5f 64 61 74   .....tablet1_dat
+|   3936: 61 74 31 5f 64 61 74 61 02 43 52 45 41 54 45 20   at1_data.CREATE 
+|   3952: 54 41 42 4c 45 20 27 74 31 5f 64 61 74 61 27 28   TABLE 't1_data'(
+|   3968: 69 64 20 49 4e 54 45 47 45 52 20 50 52 49 4d 41   id INTEGER PRIMA
+|   3984: 52 59 20 4b 45 59 2c 20 62 6c 6f 63 6b 20 42 4c   RY KEY, block BL
+|   4000: 4f 42 29 5b 01 07 17 11 11 08 81 23 74 61 62 6c   OB)[.......#tabl
+|   4016: 65 74 31 74 31 43 52 45 41 54 45 20 56 49 52 54   et1t1CREATE VIRT
+|   4032: 55 41 4c 20 54 41 42 4c 45 20 74 31 20 55 53 49   UAL TABLE t1 USI
+|   4048: 4e 47 20 66 74 73 35 28 61 2c 62 20 75 6e 69 6e   NG fts5(a,b unin
+|   4064: 64 65 78 65 64 2c 63 2c 74 6f 6b 65 6e 69 7a 65   dexed,c,tokenize
+|   4080: 3d 22 70 6f 72 74 65 72 20 61 73 63 69 69 22 29   =.porter ascii.)
+| page 2 offset 4096
+|      0: 0d 0f 68 00 05 0f 13 00 0f e6 0f 13 0f a8 0f 7c   ..h............|
+|     16: 0f 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 00   .*..............
+|   3856: 00 00 00 15 0a 03 00 30 00 00 00 00 01 03 03 00   .......0........
+|   3872: 03 01 01 01 02 01 01 03 01 01 37 8c 80 80 80 80   ..........7.....
+|   3888: 01 03 00 74 00 00 00 2e 02 30 61 03 02 02 01 01   ...t.....0a.....
+|   3904: 62 03 02 03 01 01 63 03 02 04 01 01 67 03 08 c1   b.....c.....g...
+|   3920: 02 02 01 01 68 03 06 01 02 03 01 01 69 03 06 01   ....h.......i...
+|   3936: 02 04 04 06 06 06 08 08 0f ef 00 14 2a 00 00 00   ............*...
+|   3952: 00 01 02 02 00 02 01 01 01 02 01 01 25 88 80 80   ............%...
+|   3968: 80 80 01 03 00 50 00 00 00 1f 02 30 67 02 08 02   .....P.....0g...
+|   3984: 01 02 02 01 01 68 02 08 03 01 02 03 01 01 69 02   .....h........i.
+|   4000: 08 04 01 02 04 04 09 09 37 84 80 80 80 80 01 03   ........7.......
+|   4016: 00 74 00 14 00 2e 02 30 61 01 02 02 01 01 62 01   .t.....0a.....b.
+|   4032: 02 03 01 01 63 01 02 04 01 01 67 01 06 01 02 02   ....c.....g.....
+|   4048: 01 01 68 01 06 01 02 03 01 01 69 01 06 01 02 03   ..h.......i.....
+|   4064: f4 06 06 06 08 08 07 01 03 00 14 03 09 00 09 00   ................
+|   4080: 00 00 11 24 00 00 00 00 01 01 01 00 01 00 01 01   ...$............
+| page 3 offset 8192
+|      0: 0a 00 00 00 03 0f ec 00 0f fa 0f f3 0f ec 00 00   ................
+|   4064: 00 00 00 00 00 00 00 00 00 00 00 00 06 04 01 0c   ................
+|   4080: 01 03 02 06 04 01 0c 01 02 02 05 04 09 0c 01 02   ................
+| page 4 offset 12288
+|      0: 0d 00 00 00 03 0f be 00 0f ea 0f d4 0f be 00 00   ................
+|     16: 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00   ................
+|   4016: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 14 03   ................
+|   4032: 05 00 17 17 17 61 20 62 20 63 67 20 68 20 69 67   .....a b cg h ig
+|   4048: 20 68 20 69 14 02 05 00 17 17 17 67 20 68 20 69    h i.......g h i
+|   4064: 61 20 62 20 63 67 20 68 20 69 14 01 05 00 17 17   a b cg h i......
+|   4080: 17 61 20 62 20 63 64 20 65 20 66 67 20 68 20 69   .a b cd e fg h i
+| page 5 offset 16384
+|      0: 0d 00 00 00 03 0f e8 00 0f f8 0f f0 0f e8 00 00   ................
+|   4064: 00 00 00 00 00 00 00 00 06 03 03 00 12 03 00 03   ................
+|   4080: 06 02 03 00 12 03 00 03 06 01 04 00 12 03 00 03   ................
+| page 6 offset 20480
+|      0: 0a 00 00 00 01 0f f4 00 0f f4 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 0b 03 1b 01 76 65 72 73 69 6f 6e 04   ........version.
+| page 7 offset 24576
+|      0: 0d 00 00 00 03 0f 9e 00 0f e6 0f ef 0f 9e 00 00   ................
+|   3968: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 84   ..............A.
+|   3984: 80 80 80 80 01 04 00 81 06 00 00 00 34 02 30 61   ............4.0a
+|   4000: 01 01 01 01 01 62 01 01 01 01 01 63 01 01 01 01   .....b.....c....
+|   4016: 01 64 01 01 01 65 01 01 01 66 01 01 01 67 01 01   .d...e...f...g..
+|   4032: 01 01 01 68 01 01 01 01 01 69 01 01 01 04 06 06   ...h.....i......
+|   4048: 06 04 04 04 06 06 07 01 03 00 14 03 09 09 09 0f   ................
+|   4064: 0a 03 00 24 00 00 00 00 01 01 01 00 01 01 01 01   ...$............
+|   4080: 0a 00 00 00 01 0f fa 00 0f fa 00 00 00 00 00 00   ................
+| page 8 offset 28672
+|   4080: 00 00 00 00 00 00 00 00 00 00 05 04 09 0c 01 02   ................
+| page 9 offset 32768
+|      0: 0d 00 00 00 03 0f be 00 0f ea 0f d4 0f be 00 00   ................
+|   4016: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 14 03   ................
+|   4032: 05 00 17 17 17 61 20 62 20 63 67 20 68 20 69 67   .....a b cg h ig
+|   4048: 20 68 20 69 14 02 05 00 17 17 17 67 20 68 20 69    h i.......g h i
+|   4064: 61 20 62 20 63 67 20 68 20 69 14 01 05 00 17 17   a b cg h i......
+|   4080: 17 61 20 62 20 63 64 20 65 20 66 67 20 68 20 69   .a b cd e fg h i
+| page 10 offset 36864
+|      0: 0a 00 00 00 01 0f f4 00 0f f4 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 0b 03 1b 01 76 65 72 73 69 6f 6e 04   ........version.
+| end crash-2b92f77ddfe191.db
+}]} {}
+
+do_catchsql_test 52.1 {
+  SELECT fts5_decode(id, block) FROM t1_data;
+} {1 {database disk image is malformed}}
+
+#-------------------------------------------------------------------------
+reset_db
+do_test 53.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 24576 pagesize 4096 filename crash-dbe9b7614da103.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 00 00 00 00 06   .....@  ........
+|     32: 00 00 00 00 00 00 00 00 00 00 00 06 00 00 00 04   ................
+|     96: 00 00 00 00 0d 00 00 00 06 0e 0f 00 0f aa 0f 53   ...............S
+|    112: 0e e8 0e 8b 0e 33 0e 0f 00 00 00 00 00 00 00 00   .....3..........
+|   3584: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22   ................
+|   3600: 06 06 17 11 11 01 31 74 61 62 6c 65 62 62 62 62   ......1tablebbbb
+|   3616: 06 43 52 45 41 54 45 20 54 41 42 4c 45 20 62 62   .CREATE TABLE bb
+|   3632: 28 61 29 56 05 06 17 1f 1f 01 7d 74 61 62 6c 65   (a)V.......table
+|   3648: 74 31 5f 63 6f 6e 66 69 67 74 31 5f 63 6f 6e 66   t1_configt1_conf
+|   3664: 69 67 05 43 52 45 41 54 45 20 54 41 42 4c 45 20   ig.CREATE TABLE 
+|   3680: 27 74 31 5f 63 6f 6e 66 69 67 27 28 6b 20 50 52   't1_config'(k PR
+|   3696: 49 4d 41 52 59 20 4b 45 59 2c 20 76 29 20 57 49   IMARY KEY, v) WI
+|   3712: 54 48 4f 55 54 20 52 4f 57 49 44 5b 04 07 17 21   THOUT ROWID[...!
+|   3728: 21 01 81 01 74 61 62 6c 65 74 31 5f 64 6f 63 73   !...tablet1_docs
+|   3744: 69 7a 65 74 31 5f 64 6f 63 73 69 7a 65 04 43 52   izet1_docsize.CR
+|   3760: 45 41 54 45 20 54 41 42 4c 45 20 27 74 31 5f 64   EATE TABLE 't1_d
+|   3776: 6f 63 73 69 7a 65 27 28 69 64 20 49 4e 54 45 47   ocsize'(id INTEG
+|   3792: 45 52 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20   ER PRIMARY KEY, 
+|   3808: 73 7a 20 42 4c 4f 42 29 69 03 07 17 19 19 01 81   sz BLOB)i.......
+|   3824: 2d 74 61 62 6c 65 74 31 5f 69 64 78 74 31 5f 69   -tablet1_idxt1_i
+|   3840: 64 78 03 43 52 45 41 54 45 20 54 41 42 4c 45 20   dx.CREATE TABLE 
+|   3856: 27 74 31 5f 69 64 78 27 28 73 65 67 69 64 2c 20   't1_idx'(segid, 
+|   3872: 74 65 72 6d 2c 20 70 67 6e 6f 2c 20 50 52 49 4d   term, pgno, PRIM
+|   3888: 41 52 59 20 4b 45 59 28 73 65 67 69 64 2c 20 74   ARY KEY(segid, t
+|   3904: 65 72 6d 29 29 20 57 49 54 48 4f 55 54 20 52 4f   erm)) WITHOUT RO
+|   3920: 57 49 44 55 02 07 17 1b 1b 01 81 01 74 61 62 6b   WIDU........tabk
+|   3936: 65 74 31 5f 64 61 74 61 74 31 5f 64 61 74 61 02   et1_datat1_data.
+|   3952: 43 52 45 41 54 45 20 54 41 42 4c 45 20 27 74 31   CREATE TABLE 't1
+|   3968: 5f 64 61 74 61 27 28 69 64 20 49 4e 54 45 47 45   _data'(id INTEGE
+|   3984: 52 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20 62   R PRIMARY KEY, b
+|   4000: 6c 6f 63 6b 20 42 4c 4f 42 29 54 01 07 17 10 11   lock BLOB)T.....
+|   4016: 08 81 15 74 61 62 6c 65 74 31 74 31 43 52 45 41   ...tablet1t1CREA
+|   4032: 54 45 20 56 49 52 54 55 41 4c 20 54 41 42 4c 45   TE VIRTUAL TABLE
+|   4048: 20 74 31 20 55 53 49 4e 47 20 66 74 73 35 28 61    t1 USING fts5(a
+|   4064: 2c 62 2c 70 72 65 66 69 78 3d 22 31 2c 32 2c 33   ,b,prefix=.1,2,3
+|   4080: 2c 34 22 2c 20 63 6f 6e 74 65 6e 74 3d 22 22 29   ,4., content=..)
+| page 2 offset 4096
+|      0: 0d 0b 6a 00 37 09 4c 02 0f e7 09 4c 0f c6 0f a4   ..j.7.L....L....
+|     16: 0f 88 0f 6d 0f 4b 0f 2c 0f 0e 0e ec 0e cd 0e 2a   ...m.K.,.......*
+|     32: 0e 8e 0e 6c 0e 4b 0e 29 0e 08 0d e6 0d c4 0d b5   ...l.K.)........
+|     48: 0d 97 0d 76 0d 54 0e 31 0d 15 0c f3 0c d3 0c b5   ...v.T.1........
+|     64: 0c 95 0c 73 0c 54 0c 32 0c 10 0b ee 0b cc 0b b0   ...s.T.2........
+|     80: 0b 8d 0b 7e 0b 48 0b 2e 0b 0b 0a ef 0a cc 0a ad   ...~.H..........
+|     96: 0a 8c 0a 6d 0a 4d 0a 2b 0a 0c 09 ec 09 ca 09 a8   ...m.M.+........
+|    112: 09 86 09 63 0f f1 00 00 00 00 00 00 00 00 00 00   ...c............
+|   2368: 00 00 00 00 00 00 00 00 00 00 00 00 15 0a 03 00   ................
+|   2384: 30 00 00 00 01 01 03 35 00 03 01 01 12 02 01 12   0......5........
+|   2400: 03 01 11 1c 8c 80 80 80 80 10 03 00 3e 00 00 00   ............>...
+|   2416: 17 01 05 05 34 74 61 62 6c 03 02 03 01 04 77 68   ....4tabl.....wh
+|   2432: 65 72 03 02 06 09 1b 8c 80 80 80 80 0f 03 00 3c   er.............<
+|   2448: 00 00 00 16 05 34 66 74 73 34 03 02 02 01 04 6e   .....4fts4.....n
+|   2464: 75 6d 62 03 06 01 04 09 1b 8c 80 80 80 80 0e 03   umb.............
+|   2480: 00 3c 00 00 00 16 04 33 74 68 65 03 06 01 01 04   .<.....3the.....
+|   2496: 01 03 77 68 65 03 02 04 04 0a 1b 8c 80 80 80 80   ..whe...........
+|   2512: 0d 03 00 3c 00 00 00 16 04 33 6e 75 6d 03 06 01   ...<.....3num...
+|   2528: 01 05 01 03 74 61 62 03 02 03 04 0a 19 8c 80 80   ....tab.........
+|   2544: 80 80 0c 03 00 38 00 00 00 14 03 32 77 68 03 02   .....8.....2wh..
+|   2560: 04 00 04 33 66 74 73 03 02 02 04 07 18 8c 80 80   ...3fts.........
+|   2576: 80 80 0b 03 00 36 00 00 00 13 03 32 74 61 03 02   .....6.....2ta..
+|   2592: 03 02 01 68 03 06 01 01 04 04 07 1b 8c 80 80 80   ...h............
+|   2608: 80 0a 03 00 3c 00 00 00 16 03 32 6e 75 03 06 01   ....<.....2nu...
+|   2624: 01 05 01 02 6f 66 03 06 01 01 06 04 09 19 8c 80   ....of..........
+|   2640: 80 80 80 09 03 00 38 00 00 00 14 03 32 66 74 03   ......8.....2ft.
+|   2656: 02 02 01 02 69 73 03 06 01 01 03 04 07 18 8c 80   ....is..........
+|   2672: 80 80 80 08 03 00 36 00 00 00 13 02 31 74 03 08   ......6.....1t..
+|   2688: 03 01 01 04 01 01 77 03 02 04 04 09 1a 8c 80 80   ......w.........
+|   2704: 80 80 07 03 00 3a 00 00 00 15 02 31 6e 03 08 01   .....:.....1n...
+|   2720: 01 02 05 01 01 6f 03 06 01 01 06 04 09 18 8c 80   .....o..........
+|   2736: 80 80 80 06 03 00 36 00 00 00 13 04 02 31 66 03   ......6......1f.
+|   2752: 02 02 01 01 69 03 06 01 01 03 05 06 1c 8c 80 80   ....i...........
+|   2768: 80 80 05 03 00 3e 00 00 00 17 04 30 74 68 65 03   .....>.....0the.
+|   2784: 06 01 01 04 01 05 77 68 65 72 65 03 02 04 0a 15   ......where.....
+|   2800: 8c 80 80 80 80 04 03 00 30 00 00 00 11 01 01 06   ........0.......
+|   2816: 06 30 74 61 62 6c 65 03 02 03 07 1c 8c 80 80 80   .0table.........
+|   2832: 80 03 03 00 3e 00 00 00 17 07 30 6e 75 6d 62 65   ....>.....0numbe
+|   2848: 72 03 06 01 01 05 01 02 6f 66 03 06 04 0d 13 8c   r.......of......
+|   2864: 80 80 80 80 02 03 00 2c 00 00 00 0f 01 01 03 02   .......,........
+|   2880: 30 6e 03 06 01 01 02 07 1b 8c 80 80 80 80 01 03   0n..............
+|   2896: 00 3c 00 00 00 16 08 30 66 74 73 34 61 75 78 03   .<.....0fts4aux.
+|   2912: 02 02 01 02 69 73 03 06 04 0c 00 00 00 14 2a 00   ....is........*.
+|   2928: 00 00 01 01 02 24 00 02 01 01 12 02 01 12 08 88   .....$..........
+|   2944: 80 80 80 80 12 03 00 16 00 00 00 05 02 1c 88 80   ................
+|   2960: 80 80 80 11 03 00 3e 00 00 00 17 05 34 72 6f 77   ......>.....4row
+|   2976: 73 02 06 01 01 05 01 04 74 68 65 72 02 02 04 0b   s.......ther....
+|   2992: 15 88 80 80 80 80 10 03 00 30 00 00 00 11 02 01   .........0......
+|   3008: 01 07 05 34 62 65 74 77 02 02 04 08 1b 88 80 80   ...4betw........
+|   3024: 80 80 0f 03 00 3c 00 00 00 16 04 04 33 72 6f 77   .....<......3row
+|   3040: 02 06 01 01 05 01 03 74 68 65 02 08 05 0a 1b 88   .......the......
+|   3056: 80 80 80 80 0e 03 00 3c 00 00 00 16 01 01 02 04   .......<........
+|   3072: 33 61 72 65 02 02 03 01 03 62 65 74 02 02 07 08   3are.....bet....
+|   3088: 1b 88 80 80 80 80 0d 03 00 3c 00 00 00 16 03 32   .........<.....2
+|   3104: 74 68 02 08 02 01 01 07 00 04 33 61 6e 64 02 06   th........3and..
+|   3120: 04 0a 1b 89 80 80 80 80 0c 03 00 3c 00 00 00 16   ...........<....
+|   3136: 03 32 69 6e 02 06 01 01 06 01 02 72 6f 02 06 01   .2in.......ro...
+|   3152: 01 05 04 09 18 88 80 80 80 80 0b 03 00 36 00 00   .............6..
+|   3168: 00 13 02 03 32 61 72 02 02 03 01 02 62 65 02 02   ....2ar.....be..
+|   3184: 04 05 07 1b 88 80 80 80 80 0a 03 00 3c 00 00 00   ............<...
+|   3200: 16 02 31 74 02 08 02 01 01 07 00 03 32 61 6e 02   ..1t........2an.
+|   3216: 06 01 01 04 09 19 88 80 80 80 80 09 03 00 38 00   ..............8.
+|   3232: 00 00 14 02 31 6e 02 06 01 01 03 01 01 72 02 06   ....1n.......r..
+|   3248: 01 01 05 04 08 17 88 80 80 80 80 08 03 00 34 00   ..............4.
+|   3264: 00 00 12 02 31 62 02 02 04 01 01 69 02 06 01 01   ....1b.....i....
+|   3280: 06 04 06 19 88 80 80 80 80 07 03 00 38 00 00 00   ............8...
+|   3296: 14 04 02 31 32 02 02 05 01 01 61 02 08 03 01 01   ...12.....a.....
+|   3312: 02 05 06 1b 88 80 80 80 80 06 03 00 3c 00 00 00   ............<...
+|   3328: 16 06 30 74 68 65 72 65 02 02 02 00 02 31 31 02   ..0there.....11.
+|   3344: 06 01 01 04 0a 15 88 80 80 80 80 05 03 00 30 00   ..............0.
+|   3360: 00 00 11 01 01 05 04 30 74 68 65 02 06 01 01 07   .......0the.....
+|   3376: 07 1c 88 80 80 80 80 04 03 00 3e 00 00 00 17 01   ..........>.....
+|   3392: 01 06 02 30 6e 02 06 01 01 03 01 04 72 6f 77 73   ...0n.......rows
+|   3408: 02 06 07 08 1b 88 80 80 80 80 03 03 00 3c 00 00   .............<..
+|   3424: 00 16 08 30 62 65 74 77 65 65 6e 02 02 04 01 02   ...0between.....
+|   3440: 69 6e 02 06 04 0c 1a 88 80 80 80 80 02 03 00 3a   in.............:
+|   3456: 00 00 00 15 04 30 61 6e 64 02 06 01 01 02 02 02   .....0and.......
+|   3472: 72 65 02 02 03 04 0a 16 88 80 80 80 80 01 03 00   re..............
+|   3488: 34 00 00 00 12 02 30 31 02 06 01 01 04 01 01 32   4.....01.......2
+|   3504: 02 02 05 04 08 08 84 80 80 80 80 12 03 00 16 00   ................
+|   3520: 00 00 05 04 1b 84 80 80 80 80 11 03 00 3c 00 00   .............<..
+|   3536: 00 16 05 34 74 61 62 6c 01 06 01 01 05 02 03 65   ...4tabl.......e
+|   3552: 72 6d 01 02 04 0b 1b 84 80 80 80 80 10 03 00 3c   rm.............<
+|   3568: 00 00 00 16 05 34 65 61 63 68 01 02 03 01 04 70   .....4each.....p
+|   3584: 72 65 73 01 02 05 04 09 1a 84 80 80 80 80 0f 03   res.............
+|   3600: 00 3a 00 00 00 15 04 33 74 65 72 01 02 04 02 02   .:.....3ter.....
+|   3616: 68 65 01 06 01 01 03 04 08 1b 84 80 80 80 80 0e   he..............
+|   3632: 03 00 3c 00 00 00 16 04 33 70 72 65 01 02 05 01   ..<.....3pre....
+|   3648: 03 74 61 62 01 06 01 01 05 04 08 1a 84 80 80 80   .tab............
+|   3664: 80 0d 03 00 3a 00 00 00 15 04 33 66 6f 72 01 02   ....:.....3for..
+|   3680: 02 02 02 74 73 01 06 01 01 04 04 08 1b 84 80 80   ...ts...........
+|   3696: 80 80 0c 03 00 3c 00 00 00 16 03 32 74 68 01 06   .....<.....2th..
+|   3712: 01 01 03 00 04 33 65 61 63 01 02 03 04 09 18 84   .....3eac.......
+|   3728: 80 80 80 80 0b 03 00 36 00 00 00 13 03 32 74 61   .......6.....2ta
+|   3744: 01 06 01 01 05 02 01 65 01 02 04 04 09 19 84 70   .......e.......p
+|   3760: 80 80 80 0a 03 00 38 00 00 00 14 03 32 69 6e 01   ......8.....2in.
+|   3776: 06 01 01 02 01 02 70 72 01 02 05 04 09 18 84 80   ......pr........
+|   3792: 80 80 80 09 03 00 36 00 00 00 13 03 32 66 6f 01   ......6.....2fo.
+|   3808: 02 02 02 01 74 01 06 01 01 04 04 07 1b 84 80 80   ....t...........
+|   3824: 80 80 08 03 00 3c 00 00 00 16 02 31 74 01 0a 04   .....<.....1t...
+|   3840: 01 01 03 04 00 03 32 65 61 01 02 03 04 0a 17 84   ......2ea.......
+|   3856: 80 80 80 80 07 03 00 34 00 00 00 12 02 31 69 01   .......4.....1i.
+|   3872: 06 01 01 02 01 01 70 01 02 05 04 08 18 84 80 80   ......p.........
+|   3888: 80 80 06 03 00 36 00 00 00 03 02 31 65 01 02 03   .....6.....1e...
+|   3904: 01 01 66 02 08 02 01 01 04 04 06 1b 84 80 80 80   ..f.............
+|   3920: 80 05 03 00 3c 00 00 00 16 05 30 74 65 72 6d 01   ....<.....0term.
+|   3936: 02 04 02 02 68 65 01 06 01 01 03 04 09 14 84 80   ....he..........
+|   3952: 80 80 80 04 03 00 2e 00 00 00 10 06 30 74 61 62   ............0tab
+|   3968: 6c 65 01 06 01 01 05 04 15 84 80 80 80 80 03 03   le..............
+|   3984: 00 30 00 00 00 11 02 08 30 70 72 65 73 65 6e 74   .0......0present
+|   4000: 01 02 05 05 1b 84 80 80 80 80 02 03 00 3c 00 00   .............<..
+|   4016: 00 16 04 30 66 74 73 01 06 01 01 04 01 02 69 6e   ...0fts.......in
+|   4032: 01 06 01 01 04 0a 1a 84 80 80 80 80 01 03 00 3a   ...............:
+|   4048: 00 00 00 15 05 30 65 61 63 68 01 02 03 01 03 66   .....0each.....f
+|   4064: 6f 72 01 02 02 04 09 06 01 03 00 12 03 0b 0f 00   or..............
+|   4080: 00 08 8c 80 80 80 80 11 03 00 16 00 00 00 05 04   ................
+| page 3 offset 8192
+|      0: 0a 00 00 00 32 0e 4f 00 0f fa 0f f1 0f e9 0f e1   ....2.O.........
+|     16: 0f d8 0f d1 0f c9 0f c1 0f b9 0f b1 0f a9 0f a0   ................
+|     32: 0f 98 0f 90 0f 87 0f 80 0f 78 0f 71 0f 68 0f 5f   .........x.q.h._
+|     48: 0f 56 0f 4d 0f 41 0f 38 0f 2f 0f 26 0f 1d 0f 13   .V.M.A.8./.&....
+|     64: 0f 0a 0f 01 0e f7 0e ee 0e e6 0e dd 0e d6 0e cd   ................
+|     80: 0e c3 0e ba 0e b0 0e a8 0e 9f 0e 86 0e 8e 0e 85   ................
+|     96: 0e 7c 0e 73 0e 6a 0e 60 0e 58 0e 4f 00 00 00 00   .|.s.j.`.X.O....
+|   3648: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08   ................
+|   3664: 04 01 10 01 03 34 74 20 07 04 01 0e 01 03 34 1e   .....4t ......4.
+|   3680: 09 04 01 12 01 03 33 74 68 1c 08 04 01 10 01 03   ......3th.......
+|   3696: 33 6e 1a 08 04 01 10 01 03 32 77 18 08 04 01 10   3n.......2w.....
+|   3712: 01 03 32 74 16 08 04 01 10 01 03 32 6e 14 07 04   ..2t.......2n...
+|   3728: 01 0e 01 03 32 12 08 04 01 10 01 03 31 74 10 07   ....2.......1t..
+|   3744: f4 01 10 01 03 31 6e 0e 07 04 01 0e 01 03 31 0c   .....1n.......1.
+|   3760: 09 04 01 12 01 03 30 74 68 0a 08 04 01 10 01 03   ......0th.......
+|   3776: 30 74 08 09 04 01 12 01 03 30 6e 75 06 08 04 01   0t.......0nu....
+|   3792: 10 01 03 30 6e 04 06 04 01 0c 01 03 02 08 04 01   ...0n...........
+|   3808: 10 01 02 34 72 22 07 04 01 0e 01 02 34 20 08 04   ...4r.......4 ..
+|   3824: 01 10 01 02 33 72 1e 09 04 01 12 01 02 33 61 72   ....3r.......3ar
+|   3840: 1c 08 04 01 10 01 02 32 74 1a 08 04 01 10 01 02   .......2t.......
+|   3856: 32 69 18 09 04 01 12 01 02 32 61 72 16 08 04 01   2i.......2ar....
+|   3872: 10 01 02 31 74 14 08 04 01 10 01 02 31 6e 12 08   ...1t.......1n..
+|   3888: 04 01 10 01 02 31 62 10 08 04 01 10 01 02 31 32   .....1b.......12
+|   3904: 0e 0b 04 01 16 01 02 30 74 68 65 72 0c 08 04 01   .......0ther....
+|   3920: 10 01 02 30 74 0a 08 04 01 10 01 02 30 6e 08 08   ...0t.......0n..
+|   3936: 04 01 10 01 02 30 62 06 08 04 01 10 01 02 30 61   .....0b.......0a
+|   3952: 04 06 04 01 0c 01 02 02 07 04 09 10 01 34 74 22   .............4t.
+|   3968: 06 04 09 0e 01 34 20 08 04 09 12 01 33 74 65 1e   .....4 .....3te.
+|   3984: 07 04 09 10 01 33 70 1c 07 04 09 10 01 33 66 1a   .....3p......3f.
+|   4000: 08 04 09 12 01 32 74 68 18 07 04 09 10 01 32 74   .....2th......2t
+|   4016: 16 07 04 09 0f 01 32 69 14 07 04 09 10 01 32 66   ......2i......2f
+|   4032: 12 07 04 09 00 01 31 74 10 07 04 09 10 01 31 69   ......1t......1i
+|   4048: 0e 06 04 09 0e 01 31 0c 08 04 09 12 01 33 44 65   ......1......3De
+|   4064: 0a 07 04 09 10 01 30 74 08 07 04 09 10 01 30 75   ......0t......0u
+|   4080: 26 08 04 09 12 01 30 66 74 04 05 04 09 0c 01 02   &.....0ft.......
+| page 4 offset 12288
+|      0: 0d 00 00 00 03 0f eb 00 0f f9 0f f2 0f eb 00 00   ................
+|   4064: 00 00 00 00 00 00 00 00 00 00 00 05 03 03 00 10   ................
+|   4080: 03 05 05 02 03 00 10 04 06 05 01 03 00 10 04 04   ................
+| page 5 offset 16384
+|      0: 0a 00 00 00 02 0f eb 00 0f eb 0f f4 00 00 00 00   ................
+|   4064: 00 00 00 00 00 00 00 00 00 00 00 08 03 15 01 70   ...............p
+|   4080: 67 73 7a 08 0b 03 1b 01 76 65 72 73 69 6f 6e 04   gsz.....version.
+| page 6 offset 20480
+|      0: 0d 00 00 00 03 0f f2 00 0f 00 00 00 00 00 00 00   ................
+|   4080: 00 00 03 03 02 01 03 03 02 02 01 02 02 01 0c e9   ................
+| end crash-dbe9b7614da103.db
+}]} {}
+
+do_catchsql_test 53.1 {
+  WITH RECURSIVE c(x) AS (VALUES(1) UNION ALL SELECT x<>1 FROM c WHERE x<10)
+    INSERT INTO t1(a) SELECT randomblob(3000) FROM c;
+} {1 {database disk image is malformed}}
+
+#-------------------------------------------------------------------------
+reset_db
+do_test 54.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 24576 pagesize 4096 filename crash-03a1855566d9ae.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 00 00 00 00 06   .....@  ........
+|     32: 00 00 00 00 00 00 00 00 00 00 00 06 00 00 00 04   ................
+|     48: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00   ................
+|     96: 00 00 00 00 0d 00 00 00 06 0e 0f 00 0f aa 0f 53   ...............S
+|    112: 0e e8 0e 8b 0e 33 0e 0f 00 00 00 00 00 00 00 00   .....3..........
+|   3584: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22   ................
+|   3600: 06 06 17 11 11 01 31 74 61 62 6c 65 62 62 62 62   ......1tablebbbb
+|   3616: 06 43 52 45 41 54 45 20 54 41 42 4c 45 20 62 62   .CREATE TABLE bb
+|   3632: 28 61 29 56 05 06 17 1f 1f 01 7d 74 61 62 6c 65   (a)V.......table
+|   3648: 74 31 5f 63 2a 6e 66 69 67 74 31 5f 63 6f 6e 66   t1_c*nfigt1_conf
+|   3664: 69 67 05 43 52 45 41 54 45 20 54 41 42 4c 45 20   ig.CREATE TABLE 
+|   3680: 27 74 31 5f 63 6f 6e 66 69 67 27 28 6b 20 50 52   't1_config'(k PR
+|   3696: 49 4d 41 52 59 20 4b 45 59 2c 20 76 29 20 57 49   IMARY KEY, v) WI
+|   3712: 54 48 4f 55 54 20 52 4f 57 49 44 5b 04 07 17 21   THOUT ROWID[...!
+|   3728: 21 01 81 01 74 61 62 6c 65 74 31 5f 64 6f 73 73   !...tablet1_doss
+|   3744: 69 7a 65 74 31 5f 64 6f 63 73 69 7a 65 04 43 52   izet1_docsize.CR
+|   3760: 45 41 54 45 20 54 41 42 4c 45 20 27 74 31 5f 64   EATE TABLE 't1_d
+|   3776: 6f 63 73 69 7a 65 27 28 69 64 20 49 4e 54 45 47   ocsize'(id INTEG
+|   3792: 45 52 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20   ER PRIMARY KEY, 
+|   3808: 73 7a 20 42 4c 4f 42 29 69 03 07 17 19 19 01 81   sz BLOB)i.......
+|   3824: 2d 74 61 62 6c 65 74 31 5f 69 64 78 74 31 5f 69   -tablet1_idxt1_i
+|   3840: 64 78 03 43 52 45 41 54 45 20 54 41 42 4c 45 20   dx.CREATE TABLE 
+|   3856: 27 74 31 5f 69 64 78 27 28 73 65 67 69 64 2c 20   't1_idx'(segid, 
+|   3872: 74 65 72 6d 2c 20 70 67 6e 6f 2c 20 50 52 49 4d   term, pgno, PRIM
+|   3888: 41 52 59 20 4b 45 59 28 73 65 67 69 64 2c 20 74   ARY KEY(segid, t
+|   3904: 65 72 6d 29 29 20 57 49 54 48 4f 55 54 20 52 4f   erm)) WITHOUT RO
+|   3920: 57 49 44 55 02 07 17 1b 1b 01 81 01 74 61 62 6c   WIDU........tabl
+|   3936: 65 74 31 5f 64 61 74 61 74 31 5f 64 61 74 61 02   et1_datat1_data.
+|   3952: 43 52 45 41 54 45 20 54 41 42 4c 45 20 27 74 31   CREATE TABLE 't1
+|   3968: 5f 64 61 74 61 27 28 69 64 20 49 4e 54 45 47 45   _data'(id INTEGE
+|   3984: 52 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20 62   R PRIMARY KEY, b
+|   4000: 6c 6f 63 6b 20 42 4c 4f 42 29 54 01 07 17 11 11   lock BLOB)T.....
+|   4016: 08 81 15 74 61 62 6c 65 74 31 74 31 43 52 45 41   ...tablet1t1CREA
+|   4032: 54 45 20 56 49 52 54 55 41 4c 20 54 41 42 4c 45   TE VIRTUAL TABLE
+|   4048: 20 74 31 20 55 53 49 4e 47 20 66 74 73 35 28 61    t1 USING fts5(a
+|   4064: 2c 62 2c 70 72 65 66 69 78 3d 22 32 2c 32 2c 33   ,b,prefix=.2,2,3
+|   4080: 2c 34 22 2c 20 63 6f 6e 74 65 6e 74 3d 22 22 29   ,4., content=..)
+| page 2 offset 4096
+|      0: 0d 0b 6a 00 37 09 4c 02 0f e7 09 4c 0f c6 0f a4   ..j.7.L....L....
+|     16: 0f 88 0f 6d 0f 4b 0f 2c 0f 0e 0e ec 0e cd 0e ad   ...m.K.,........
+|     32: 0e 8e 0e 6c 0e 4b 0e 29 0e 08 0d e6 0d c4 0d b5   ...l.K.)........
+|     48: 0d 97 0d 76 0d 54 0d 31 0d 15 0c f3 0c d3 0c b5   ...v.T.1........
+|     64: 0c 95 0c 73 0c 54 0c 32 0c 10 0b ee 0b cd 0b b0   ...s.T.2........
+|     80: 0b 8d 0b 7e 0b 48 0b 2e 0b 0b 0a ef 0a cc 0a ad   ...~.H..........
+|     96: 0a 8c 0a 6d 0a 4d 0a 2b 0a 0c 09 ec 09 ca 09 a8   ...m.M.+........
+|    112: 09 86 09 63 0f f1 00 00 00 00 00 00 00 00 00 00   ...c............
+|   2368: 00 00 00 00 00 00 00 00 00 00 00 00 15 0a 03 00   ................
+|   2384: 30 00 00 00 01 01 03 35 00 03 01 01 12 02 01 12   0......5........
+|   2400: 03 01 11 1c 8c 80 80 80 80 10 03 00 3e 00 00 00   ............>...
+|   2416: 17 01 05 05 34 74 61 62 6c 03 02 03 01 04 77 68   ....4tabl.....wh
+|   2432: 65 72 03 02 06 09 1b 8c 80 80 80 80 0f 03 00 3c   er.............<
+|   2448: 00 00 00 16 05 34 66 74 73 34 03 02 02 01 04 6e   .....4fts4.....n
+|   2464: 75 6d 62 03 06 01 04 09 1b 8c 80 80 80 80 0e 03   umb.............
+|   2480: 00 3c 00 00 00 16 04 33 74 68 65 03 06 01 01 04   .<.....3the.....
+|   2496: 01 03 77 68 65 03 02 04 04 0a 1b 8c 80 80 80 80   ..whe...........
+|   2512: 0d 03 00 3c 00 00 00 16 04 33 6e 75 6d 03 06 01   ...<.....3num...
+|   2528: 01 05 01 03 74 61 62 05 62 03 04 0a 19 8c 80 80   ....tab.b.......
+|   2544: 80 80 0c 03 00 38 00 00 00 14 03 39 a7 68 03 02   .....8.....9.h..
+|   2560: 04 10 04 33 66 74 73 03 02 02 04 07 18 8c 80 80   ...3fts.........
+|   2576: 80 80 0b 03 00 36 00 00 00 13 03 32 74 61 03 02   .....6.....2ta..
+|   2592: 03 02 01 68 03 06 01 01 04 04 07 1b 8c 80 80 80   ...h............
+|   2608: 80 0a 03 00 3c 00 00 00 16 03 32 6e 75 03 06 01   ....<.....2nu...
+|   2624: 01 05 01 02 6f 66 03 06 01 01 06 04 09 19 8c 80   ....of..........
+|   2640: 80 80 80 09 03 00 38 00 00 00 14 03 32 66 74 03   ......8.....2ft.
+|   2656: 02 02 01 02 69 73 03 06 01 01 03 04 07 18 8c 80   ....is..........
+|   2672: 80 80 80 08 03 00 36 00 00 00 13 02 31 74 03 08   ......6.....1t..
+|   2688: 03 01 01 04 01 01 77 03 02 04 04 09 1a 8c 80 80   ......w.........
+|   2704: 80 80 07 03 00 3a ff 00 00 15 02 31 6e 03 08 01   .....:.....1n...
+|   2720: 01 02 05 01 01 6f 03 06 01 01 06 04 09 18 8c 80   .....o..........
+|   2736: 80 80 80 06 03 00 36 00 00 00 13 04 02 31 66 03   ......6......1f.
+|   2752: 02 02 01 01 69 03 06 01 01 03 05 06 1c 8c 80 80   ....i...........
+|   2768: 80 80 05 03 00 3e 00 00 00 17 04 30 74 68 65 03   .....>.....0the.
+|   2784: 06 01 01 04 01 05 77 68 65 72 65 03 02 04 0a 15   ......where.....
+|   2800: 8c 80 80 80 80 04 03 00 30 00 00 00 11 01 01 06   ........0.......
+|   2816: 06 30 74 61 62 6c cc 03 02 03 07 1c 8c 80 80 80   .0tabl..........
+|   2832: 80 03 03 00 3e 00 00 00 17 07 30 6e 75 6d 62 65   ....>.....0numbe
+|   2848: 72 03 06 01 01 05 01 02 6f 66 03 06 04 0d 13 8c   r.......of......
+|   2864: 80 80 80 80 02 03 00 2c 00 00 00 0f 01 01 03 02   .......,........
+|   2880: 30 6e 03 06 01 01 02 07 1b 8c 80 80 80 80 01 03   0n..............
+|   2896: 00 3c 00 00 00 16 08 30 66 74 73 34 61 75 78 03   .<.....0fts4aux.
+|   2912: 02 02 01 02 69 73 03 06 04 0c 00 00 00 14 2a 00   ....is........*.
+|   2928: 00 00 01 01 02 24 00 02 01 01 12 02 01 12 08 88   .....$..........
+|   2944: 80 80 80 80 12 03 00 16 00 00 00 05 02 1c 88 80   ................
+|   2960: 80 80 80 11 03 00 3e 00 00 00 17 05 34 72 6f 77   ......>.....4row
+|   2976: 73 02 06 01 01 05 01 04 74 68 65 72 02 02 04 0b   s.......ther....
+|   2992: 15 88 80 80 80 80 10 03 00 30 00 00 00 11 02 01   .........0......
+|   3008: 01 07 05 34 62 65 74 77 02 02 04 08 1b 88 80 80   ...4betw........
+|   3024: 80 80 0f 03 00 3c 00 00 00 16 04 04 33 72 6f 77   .....<......3row
+|   3040: 02 06 01 01 05 01 03 74 68 65 02 08 05 0a 1b 88   .......the......
+|   3056: 80 80 80 80 0e 03 05 0c 00 00 00 16 01 01 02 04   ................
+|   3072: 33 61 72 65 02 02 03 01 03 62 65 74 02 02 07 08   3are.....bet....
+|   3088: 1b 88 80 80 80 80 0d 03 00 3c 00 00 00 16 03 32   .........<.....2
+|   3104: 84 68 02 08 02 01 01 07 00 04 33 61 6e 64 02 06   .h........3and..
+|   3120: 04 0a 1b 88 80 80 80 80 0c 03 00 3c 00 00 00 16   ...........<....
+|   3136: 03 32 69 6e 02 06 01 01 06 01 02 72 6f 02 06 01   .2in.......ro...
+|   3152: 01 05 04 09 18 88 80 80 80 80 0b 03 00 36 00 00   .............6..
+|   3168: 00 13 02 03 32 61 72 02 02 03 01 02 62 65 02 02   ....2ar.....be..
+|   3184: 04 05 07 1b 88 80 80 80 80 0a 03 00 3c 00 00 00   ............<...
+|   3200: 16 02 31 74 02 08 02 01 01 07 00 03 32 61 6e 02   ..1t........2an.
+|   3216: 06 01 01 04 09 19 88 80 80 80 80 09 03 00 38 00   ..............8.
+|   3232: 00 00 14 02 31 6e 02 06 01 01 03 01 01 72 02 06   ....1n.......r..
+|   3248: 01 01 05 04 08 17 88 80 80 80 80 08 03 00 34 00   ..............4.
+|   3264: 00 00 12 02 31 62 02 02 04 01 01 69 02 06 01 01   ....1b.....i....
+|   3280: 06 04 06 19 88 80 80 80 80 07 03 00 38 00 00 00   ............8...
+|   3296: 14 04 02 31 32 02 02 05 01 01 61 02 08 03 01 01   ...12.....a.....
+|   3312: 02 05 06 1b 88 80 80 80 80 06 03 00 3c 00 00 00   ............<...
+|   3328: 16 06 30 74 68 65 72 65 02 12 02 00 02 31 31 02   ..0there.....11.
+|   3344: 06 11 01 04 0a 15 88 80 80 80 80 05 03 00 30 00   ..............0.
+|   3360: 00 00 11 01 01 05 04 30 74 68 65 02 06 01 01 07   .......0the.....
+|   3376: 07 1c 88 80 80 80 80 04 03 00 3e 00 00 00 17 01   ..........>.....
+|   3392: 01 06 02 30 6e 02 06 01 01 03 01 04 72 6f 77 73   ...0n.......rows
+|   3408: 02 06 07 08 1b 88 80 80 80 80 03 03 00 3c 00 00   .............<..
+|   3424: 00 16 08 30 62 65 74 77 65 65 6e 02 02 04 01 02   ...0between.....
+|   3440: 69 6e 02 06 04 0c 1a 88 80 80 80 80 02 03 00 3a   in.............:
+|   3456: 08 f0 00 15 04 30 61 6e 64 02 06 01 01 02 02 02   .....0and.......
+|   3472: 72 65 02 02 03 04 0a 17 88 80 80 80 80 01 03 00   re..............
+|   3488: 34 00 00 00 12 02 30 31 02 06 01 01 04 01 01 32   4.....01.......2
+|   3504: 02 02 06 04 08 08 84 80 80 80 80 12 03 00 16 00   ................
+|   3520: 00 00 05 04 1b 84 80 80 80 80 11 03 00 3c 00 00   .............<..
+|   3536: 00 16 05 34 74 61 62 6c 01 06 01 01 05 02 03 65   ...4tabl.......e
+|   3552: 72 6d 01 02 04 0b 1b 84 80 80 80 80 10 03 00 3c   rm.............<
+|   3568: 00 00 00 16 05 34 65 61 63 68 01 02 03 01 04 70   .....4each.....p
+|   3584: 72 65 73 01 02 05 04 09 1a 84 80 80 80 80 0f 03   res.............
+|   3600: 00 3a 00 00 00 15 04 33 74 65 72 01 02 04 02 02   .:.....3ter.....
+|   3616: 68 65 01 06 01 01 03 04 08 1b 84 80 80 80 80 0e   he..............
+|   3632: 03 00 3c 00 00 00 16 04 33 70 72 65 01 02 05 01   ..<.....3pre....
+|   3648: 03 74 61 62 01 06 01 01 05 04 08 1a 84 80 80 80   .tab............
+|   3664: 80 0d 03 00 3a 00 00 00 15 04 33 66 6f 72 01 02   ....:.....3for..
+|   3680: 02 02 02 74 73 01 06 01 01 04 04 08 1b 84 80 80   ...ts...........
+|   3696: 80 80 0c 03 00 3c 00 00 00 16 03 32 74 68 01 06   .....<.....2th..
+|   3712: 01 01 03 00 04 33 65 61 63 01 02 03 04 09 18 84   .....3eac.......
+|   3728: 80 80 80 80 0b 03 00 36 00 00 00 13 03 32 74 61   .......6.....2ta
+|   3744: 01 06 01 01 05 02 01 65 00 02 04 04 09 19 84 80   .......e........
+|   3760: 80 80 80 0a 03 00 38 00 00 00 14 03 32 69 6e 01   ......8.....2in.
+|   3776: 06 01 01 02 01 02 70 72 01 02 05 04 09 18 84 80   ......pr........
+|   3792: 80 80 80 09 03 00 36 00 00 00 13 03 32 66 6f 01   ......6.....2fo.
+|   3808: 02 02 02 01 74 01 06 01 01 04 04 07 1b 84 80 80   ....t...........
+|   3824: 80 80 08 03 00 3c 00 00 00 16 02 31 74 01 0a 04   .....<.....1t...
+|   3840: 01 01 03 04 00 03 32 65 61 01 02 03 04 0a 17 84   ......2ea.......
+|   3856: 80 80 80 80 07 03 00 34 00 00 00 12 02 31 69 01   .......4.....1i.
+|   3872: 06 01 01 02 de 01 70 01 02 05 04 08 18 84 80 80   ......p.........
+|   3888: 80 80 06 03 00 36 00 00 00 13 02 31 65 01 02 03   .....6.....1e...
+|   3904: 01 01 66 01 08 02 01 01 04 04 06 1b 84 80 80 80   ..f.............
+|   3920: 80 05 03 00 3c 00 00 00 16 05 30 74 65 72 6d 01   ....<.....0term.
+|   3936: 02 04 02 02 68 65 01 06 01 01 03 04 09 14 84 80   ....he..........
+|   3952: 80 80 80 04 03 00 2e 00 00 00 10 06 30 74 61 62   ............0tab
+|   3968: 6c 65 01 06 01 01 05 04 15 84 80 80 80 80 03 03   le..............
+|   3984: 00 30 00 00 00 11 02 08 30 70 72 65 73 65 6e 74   .0......0present
+|   4000: 01 02 05 05 1b 84 80 80 80 80 02 03 00 3c 00 00   .............<..
+|   4016: 00 16 04 30 66 74 73 01 06 01 01 04 01 02 69 6e   ...0fts.......in
+|   4032: 01 06 01 01 04 0a 1a 84 80 80 80 80 01 03 00 3a   ...............:
+|   4048: 00 00 00 15 05 30 65 61 63 68 00 f2 03 01 03 66   .....0each.....f
+|   4064: 6f 72 01 02 02 04 09 06 01 03 00 12 03 0b 0f 00   or..............
+|   4080: 00 08 8c 80 80 80 80 11 03 00 16 00 00 00 05 04   ................
+| page 3 offset 8192
+|      0: 0a 00 00 00 32 0e 4f 00 0f fa 0f f1 0f e9 0f e1   ....2.O.........
+|     16: 0f d8 0f d1 0f c9 0f c1 0f b9 0f b1 0f a9 0f a0   ................
+|     32: 0f 98 0f 90 0f 87 0f 80 0f 78 0f 71 0f 68 0f 5f   .........x.q.h._
+|     48: 0f 56 0f 4d 0f 41 0f 38 0f 2f 0f 26 0f 1d 0f 13   .V.M.A.8./.&....
+|     64: 0f 0a 0f 01 0e f7 0e ee 0e e6 0e dd 0e d6 0e cd   ................
+|     80: 0e c3 0e ba 0e b0 0e a8 0e 9f 0e 96 0e 8e 0e 85   ................
+|     96: 0e 7c 0e 73 0e 6a 0e 60 0e 58 0e 4f 00 00 00 00   .|.s.j.`.X.O....
+|   3648: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08   ................
+|   3664: 04 01 10 01 03 34 74 20 07 04 01 0e 01 03 34 1e   .....4t ......4.
+|   3680: 09 04 01 12 01 03 33 74 68 1c 08 04 01 10 01 03   ......3th.......
+|   3696: 33 6e 1a 08 04 01 10 01 03 32 77 18 08 04 01 10   3n.......2w.....
+|   3712: 01 03 32 74 16 08 04 01 10 01 03 32 6e 14 07 04   ..2t.......2n...
+|   3728: 01 0e 01 03 32 12 08 04 01 10 01 03 31 74 10 08   ....2.......1t..
+|   3744: 04 01 10 01 03 31 6e 0e 07 04 01 0e 01 03 31 0c   .....1n.......1.
+|   3760: 09 04 01 12 01 03 30 74 68 0a 08 04 01 10 01 03   ......0th.......
+|   3776: 30 74 08 09 04 01 12 01 03 30 6e 75 06 08 04 01   0t.......0nu....
+|   3792: 10 01 03 30 6e 04 06 04 01 0c 01 05 52 08 04 01   ...0n.......R...
+|   3808: 10 01 02 34 72 22 07 04 01 0e 01 02 34 20 08 04   ...4r.......4 ..
+|   3824: 01 10 01 02 33 72 1e 09 04 01 12 01 02 33 61 72   ....3r.......3ar
+|   3840: 1c 08 04 01 10 01 02 32 74 1a 08 04 01 10 b3 02   .......2t.......
+|   3856: 32 69 18 09 04 01 12 01 02 32 61 72 16 08 04 01   2i.......2ar....
+|   3872: 10 01 02 31 74 14 08 04 01 10 01 02 31 6e 12 08   ...1t.......1n..
+|   3888: 04 01 10 01 02 31 62 10 08 04 01 10 01 02 31 32   .....1b.......12
+|   3904: 0e 0b 04 01 16 01 02 30 74 68 65 72 0c 08 04 01   .......0ther....
+|   3920: 10 01 02 30 74 0a 08 04 01 10 01 02 30 6e 08 08   ...0t.......0n..
+|   3936: 04 01 10 01 02 30 62 06 08 04 01 10 01 02 30 61   .....0b.......0a
+|   3952: 04 06 04 01 0c 01 02 02 07 04 09 10 01 34 74 22   .............4t.
+|   3968: 06 04 09 0e 01 34 20 08 04 09 12 01 33 74 65 1e   .....4 .....3te.
+|   3984: 07 04 09 10 01 33 70 1c 07 f4 09 11 01 33 66 1a   .....3p......3f.
+|   4000: 08 04 09 12 01 32 74 68 18 07 04 09 10 01 32 e4   .....2th......2.
+|   4016: 16 07 04 09 10 01 32 69 14 07 04 09 10 01 32 66   ......2i......2f
+|   4032: 12 07 04 09 10 01 31 74 10 07 04 09 10 01 31 69   ......1t......1i
+|   4048: 0e 06 04 09 0e 01 31 0c 08 04 09 12 01 30 74 65   ......1......0te
+|   4064: 0a 07 04 09 10 01 30 74 08 07 04 09 10 01 30 70   ......0t......0p
+|   4080: 06 08 04 09 12 01 30 66 74 04 05 04 09 0c 01 02   ......0ft.......
+| page 4 offset 12288
+|      0: 0d 00 00 00 03 0f eb 00 0f f9 0f f2 0f eb 00 00   ................
+|   4064: 00 00 00 00 00 00 00 00 00 00 00 05 03 03 00 10   ................
+|   4080: 03 05 05 02 03 00 10 04 06 05 01 03 00 10 04 04   ................
+| page 5 offset 16384
+|      0: 0a 00 00 00 02 0f eb 00 0f eb 0f f4 00 00 00 00   ................
+|   4064: 00 00 00 00 00 00 00 00 00 00 00 08 03 15 01 70   ...............p
+|   4080: 67 73 7a 18 0b 03 1b 01 76 65 72 73 69 6f 6e 04   gsz.....version.
+| page 6 offset 20480
+|      0: 0d 00 00 00 03 0f f2 00 0f fc 0f f7 0f f2 00 00   ................
+|   4080: 00 00 23 03 02 01 03 03 02 02 01 02 02 00 f2 09   ..#.............
+| end crash-03a1855566d9ae.db
+}]} {}
+
+do_catchsql_test 54.1 {
+  SELECT rowid==-1 FROM t1('t*');
+} {0 {0 0 0}}
+
+#-------------------------------------------------------------------------
+reset_db
+do_test 55.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 32768 pagesize 4096 filename crash-b366b5ac0d3887.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 00 00 00 00 08   .....@  ........
+|     32: 00 00 00 02 00 00 00 05 90 00 00 09 00 00 00 04   ................
+|     96: 00 00 00 00 0d 0f c7 00 07 0d 92 00 0f 8d 0f 36   ...............6
+|    112: 0e cb 0e 6b 0e 0e 0d b6 0d 92 0d 92 00 00 00 00   ...k............
+|   3472: 00 00 22 08 06 17 11 11 01 31 74 61 62 6c 65 74   .........1tablet
+|   3488: 32 74 32 08 43 52 45 41 54 45 20 54 41 42 4c 45   2t2.CREATE TABLE
+|   3504: 20 74 32 28 78 29 56 07 06 17 1f 1f 01 7d 74 61    t2(x)V.......ta
+|   3520: 62 6c 65 74 31 5f 63 6f 6e 66 69 67 74 31 5f 63   blet1_configt1_c
+|   3536: 6f 6e 66 69 67 07 43 52 45 41 54 45 20 54 41 42   onfig.CREATE TAB
+|   3552: 4c 45 20 27 74 31 5f 63 6f 6e 66 69 67 27 28 6b   LE 't1_config'(k
+|   3568: 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20 76 29    PRIMARY KEY, v)
+|   3584: 20 57 49 54 48 4f 55 54 20 52 4f 57 49 44 5b 06    WITHOUT ROWID[.
+|   3600: 07 17 21 21 01 81 01 74 61 62 6c 65 74 31 5f 64   ..!!...tablet1_d
+|   3616: 6f 63 73 69 7a 65 74 31 5f 64 6f 63 73 69 7a 65   ocsizet1_docsize
+|   3632: 06 43 52 45 41 54 45 20 54 41 42 4c 45 20 27 74   .CREATE TABLE 't
+|   3648: 31 5f 64 6f 63 73 69 7a 65 27 28 69 64 20 49 4e   1_docsize'(id IN
+|   3664: 54 45 47 45 52 20 50 52 49 4d 41 52 59 20 4b 45   TEGER PRIMARY KE
+|   3680: 59 2c 20 73 7a 20 43 4c 4f 42 29 5e 05 07 17 21   Y, sz CLOB)^...!
+|   3696: 21 01 81 07 74 61 62 6c 65 74 31 5f 63 6f 6e 74   !...tablet1_cont
+|   3712: 65 6e 74 74 31 5f 63 6f 6e 74 65 6e 74 05 43 52   entt1_content.CR
+|   3728: 45 41 54 45 20 54 41 42 4c 45 20 27 74 31 5f 63   EATE TABLE 't1_c
+|   3744: 6f 6e 74 65 6e 74 27 28 69 64 20 49 4e 54 45 47   ontent'(id INTEG
+|   3760: 45 52 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20   ER PRIMARY KEY, 
+|   3776: 63 30 2c 20 63 31 2c 20 63 32 29 69 04 07 17 19   c0, c1, c2)i....
+|   3792: 19 01 81 2d 74 61 62 6c 65 74 32 5f 69 64 78 74   ...-tablet2_idxt
+|   3808: 31 5f 69 64 78 04 43 52 45 41 54 45 20 54 41 42   1_idx.CREATE TAB
+|   3824: 4c 45 20 27 74 31 5f 69 64 78 27 28 73 65 67 69   LE 't1_idx'(segi
+|   3840: 64 2c 20 74 65 72 6d 2c 20 70 67 6e 6f 2c 20 50   d, term, pgno, P
+|   3856: 52 49 4d 41 52 59 20 4b 45 59 28 73 65 67 69 64   RIMARY KEY(segid
+|   3872: 2c 20 74 65 72 6d 29 29 20 57 49 54 48 4f 55 54   , term)) WITHOUT
+|   3888: 20 52 4f 57 49 44 55 03 07 17 1b 1b 01 81 01 74    ROWIDU........t
+|   3904: 61 62 6c 65 74 31 5f 64 61 74 61 74 31 5f 64 61   ablet1_datat1_da
+|   3920: 74 61 03 43 52 45 41 54 45 20 54 41 42 4c 45 20   ta.CREATE TABLE 
+|   3936: 27 74 31 5f 64 61 74 61 27 28 69 64 20 49 4e 54   't1_data'(id INT
+|   3952: 45 47 45 52 20 50 52 49 4d 42 52 59 20 4b 45 59   EGER PRIMBRY KEY
+|   3968: 2c 20 62 6c 6f 63 6b 20 42 4c 4f 42 29 38 02 06   , block BLOB)8..
+|   3984: 17 11 11 08 5f 74 61 62 6c 65 74 31 74 31 43 52   ...._tablet1t1CR
+|   4000: 45 41 54 45 20 56 49 52 54 55 41 4c 20 54 41 42   EATE VIRTUAL TAB
+|   4016: 4c 45 20 74 31 20 55 53 49 4e 47 20 66 74 73 35   LE t1 USING fts5
+|   4032: 28 61 2c 62 2c 63 29 00 00 00 39 00 00 00 00 00   (a,b,c)...9.....
+| page 3 offset 8192
+|      0: 0d 00 00 00 03 0c 94 00 0f e6 0f ef 0c 94 00 00   ................
+|   3216: 00 00 00 00 86 4a 84 80 80 80 80 01 04 00 8d 18   .....J..........
+|   3232: 00 00 03 2b 02 30 30 01 02 06 01 02 06 01 02 06   ...+.00.........
+|   3248: 1f 02 03 01 02 03 01 02 03 01 08 32 30 31 36 30   ...........20160
+|   3264: 36 30 39 01 02 07 01 02 07 01 02 07 01 01 34 01   609...........4.
+|   3280: 02 05 01 02 05 01 02 05 01 01 35 01 02 04 01 02   ..........5.....
+|   3296: 04 01 02 04 02 07 30 30 30 30 30 30 30 1c 02 04   ......0000000...
+|   3312: 01 02 04 01 02 04 01 06 62 69 6e 61 72 79 03 06   ........binary..
+|   3328: 01 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01   ................
+|   3344: 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01 02   ................
+|   3360: 02 03 06 01 02 02 03 06 01 02 02 03 06 01 02 02   ................
+|   3376: 03 06 01 02 02 03 06 01 02 02 01 08 63 6f 6d 70   ............comp
+|   3392: 69 6c 65 72 01 02 02 01 02 02 f1 02 02 01 06 64   iler...........d
+|   3408: 62 73 74 61 74 07 02 03 01 02 03 01 02 03 02 04   bstat...........
+|   3424: 65 62 75 67 04 02 02 01 02 02 01 02 02 01 06 65   ebug...........e
+|   3440: 6e 61 62 6c 65 07 02 02 01 02 02 01 02 02 01 02   nable...........
+|   3456: 02 01 02 02 01 02 02 01 02 02 01 02 02 01 02 02   ................
+|   3472: 01 02 02 01 02 02 01 02 02 01 02 02 01 02 02 01   ................
+|   3488: 02 02 01 02 02 01 02 02 01 02 02 01 02 02 01 02   ................
+|   3504: 02 01 02 02 02 08 78 74 65 6e 73 69 6f 6e 1f 02   ......xtension..
+|   3520: 04 01 02 04 01 02 04 01 04 66 74 73 34 0a 02 03   .........fts4...
+|   3536: 01 02 03 01 02 03 04 01 35 0d 02 03 01 02 03 01   ........5.......
+|   3552: 02 03 01 03 67 63 63 01 02 03 01 02 03 01 02 03   ....gcc.........
+|   3568: 02 06 65 6f 70 6f 6c 79 10 02 03 01 02 03 01 02   ..eopoly........
+|   3584: 03 01 05 6a 73 6f 6e 31 13 02 03 01 02 03 01 02   ...json1........
+|   3600: 03 01 04 6c 6f 61 64 1f 02 03 01 02 03 01 02 03   ...load.........
+|   3616: 01 03 6d 61 78 1c 02 02 01 02 02 01 02 02 02 05   ..max...........
+|   3632: 65 6d 6f 72 79 1c 02 03 01 02 03 01 02 03 04 04   emory...........
+|   3648: 73 79 73 35 16 02 03 01 02 03 01 02 03 01 06 6e   sys5...........n
+|   3664: 6f 63 61 73 65 02 06 01 02 02 03 06 01 02 02 03   ocase...........
+|   3680: 06 01 02 02 03 06 01 02 02 03 06 01 02 02 03 06   ................
+|   3696: 01 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01   ................
+|   3712: 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01 02   ................
+|   3728: 02 01 04 6f 6d 69 74 1f 02 02 01 02 02 01 02 02   ...omit.........
+|   3744: 01 05 72 74 72 65 65 19 02 03 01 02 03 01 02 03   ..rtree.........
+|   3760: 04 02 69 6d 01 06 01 02 02 03 06 01 02 02 03 06   ..im............
+|   3776: 01 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01   ................
+|   3792: 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01 02   ................
+|   3808: 02 03 06 01 02 02 03 06 01 02 02 03 06 01 02 02   ................
+|   3824: 01 0a 74 68 72 65 61 64 73 61 66 65 22 02 02 01   ..threadsafe....
+|   3840: 02 02 01 02 02 01 04 76 74 61 62 07 02 04 01 02   .......vtab.....
+|   3856: 04 01 02 04 01 01 78 01 06 01 01 02 01 06 01 01   ......x.........
+|   3872: 02 01 06 01 01 02 01 06 01 01 02 01 06 01 01 02   ................
+|   3888: 01 06 01 01 02 01 06 01 01 02 01 06 01 01 02 01   ................
+|   3904: 06 01 01 02 01 06 01 01 02 01 06 01 01 02 01 06   ................
+|   3920: 01 01 02 01 06 01 01 02 01 06 01 01 02 01 06 01   ................
+|   3936: 01 02 01 06 01 01 02 01 06 01 01 02 01 06 01 01   ................
+|   3952: 02 01 06 01 01 02 01 06 01 01 02 08 d6 01 01 02   ................
+|   3968: 01 06 01 01 02 01 06 01 01 02 01 06 01 01 02 01   ................
+|   3984: 06 01 01 02 01 06 01 01 02 01 06 01 01 02 01 06   ................
+|   4000: 01 01 02 01 06 01 01 02 01 06 01 01 02 01 06 01   ................
+|   4016: 01 02 01 06 01 01 02 01 06 01 01 02 01 06 01 01   ................
+|   4032: 02 01 06 01 01 02 01 06 01 01 02 04 15 13 0c 0c   ................
+|   4048: 12 44 13 11 0f 47 13 0f 0c 0e 11 10 0f 0e 10 0f   .D...G..........
+|   4064: 44 0f 10 40 15 0f 07 01 03 00 14 24 5a 24 24 0f   D..@.......$Z$$.
+|   4080: 0a 03 00 24 00 00 00 00 01 01 01 00 01 01 01 01   ...$............
+| page 4 offset 12288
+|      0: 0a 00 00 00 01 0f fa 00 0f fa 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 00 00 00 00 00 00 05 04 09 0c 01 02   ................
+| page 5 offset 16384
+|      0: 0d 00 00 00 24 0c 0a 00 0f d8 0f af 0f 86 0f 74   ....$..........t
+|     16: 0f 61 0f 4e 0f 2f 0f 0f 0e ef 0e d7 0e be 0e a5   .a.N./..........
+|     32: 0e 8d 0e 74 0e 5b 0e 40 0e 24 0e 08 0d ef 0d d5   ...t.[.@.$......
+|     48: 0d bb 0d a0 0d 84 0d 68 0d 4f 0d 35 0d 1b 0c fb   .......h.O.5....
+|     64: 0c da 0c b9 0c 99 0c 78 0c 57 0c 3e 00 00 00 00   .......x.W.>....
+|   3072: 00 00 00 00 00 00 00 00 00 00 18 24 05 00 25 0f   ...........$..%.
+|   3088: 19 54 48 52 45 41 44 53 41 46 45 3d 30 58 42 49   .THREADSAFE=0XBI
+|   3104: 4e 41 52 59 18 23 05 00 25 0f 19 54 48 52 45 41   NARY.#..%..THREA
+|   3120: 44 53 41 46 45 3d 30 58 4e 4f 43 41 53 45 17 22   DSAFE=0XNOCASE..
+|   3136: 05 00 25 0f 17 54 48 52 45 41 44 53 41 46 45 3d   ..%..THREADSAFE=
+|   3152: 30 58 52 54 52 49 4d 1f 20 f5 00 33 0f 19 4f 4d   0XRTRIM. ..3..OM
+|   3168: 49 54 20 4c 4f 41 44 20 45 58 54 45 4e 53 49 4f   IT LOAD EXTENSIO
+|   3184: 4e 58 42 49 4e 41 52 59 1f 20 05 00 33 0f 19 4f   NXBINARY. ..3..O
+|   3200: 4d 49 54 20 4c 4f 41 44 20 45 58 54 45 4e 53 49   MIT LOAD EXTENSI
+|   3216: 4f 4e 58 4e 4f 43 41 53 45 1e 1f 05 00 33 0f 17   ONXNOCASE....3..
+|   3232: 4f 4d 49 54 20 4c 4f 41 44 20 45 58 54 45 4e 53   OMIT LOAD EXTENS
+|   3248: 49 4f 4e 58 52 54 52 49 4d 1f 1e 05 00 33 0f 19   IONXRTRIM....3..
+|   3264: 4c 41 58 20 4d 45 4d 4f 52 59 3d 35 30 30 30 30   LAX MEMORY=50000
+|   3280: 30 30 30 58 42 49 4e 41 52 59 1f 1d 05 00 33 0f   000XBINARY....3.
+|   3296: 19 4d 41 58 20 4d 45 4d 4f 52 59 3d 35 30 30 30   .MAX MEMORY=5000
+|   3312: 30 30 30 30 58 4e 4f 43 41 53 45 1e 1c 05 00 33   0000XNOCASE....3
+|   3328: 0f 17 4d 41 58 20 4d 45 4d 4f 52 59 3d 35 30 30   ..MAX MEMORY=500
+|   3344: 30 30 30 30 30 58 52 54 52 49 4d 18 1b 05 00 25   00000XRTRIM....%
+|   3360: 0f 19 45 4e 41 42 4c 45 20 52 54 52 45 45 58 42   ..ENABLE RTREEXB
+|   3376: 49 4e 41 52 59 18 1a 05 00 25 0f 19 45 4e 41 42   INARY....%..ENAB
+|   3392: 4c 45 20 52 54 52 45 45 58 4e 4f 43 41 53 45 17   LE RTREEXNOCASE.
+|   3408: 19 05 00 25 0f 17 45 4e 41 42 4c 45 20 52 54 52   ...%..ENABLE RTR
+|   3424: 45 45 58 52 54 52 49 4d 1a 18 05 00 29 0f 19 45   EEXRTRIM....)..E
+|   3440: 4e 41 42 4c 45 20 4d 45 4d 53 59 53 35 58 42 49   NABLE MEMSYS5XBI
+|   3456: 4e 41 52 59 1a 17 05 00 29 0f 19 45 4e 41 42 4c   NARY....)..ENABL
+|   3472: 45 20 4d 45 4d 53 59 53 35 58 4e 4f 43 41 53 45   E MEMSYS5XNOCASE
+|   3488: 19 16 05 00 29 0f 17 45 4e 41 42 4c 45 20 4d 45   ....)..ENABLE ME
+|   3504: 4d 53 59 53 35 58 52 54 52 49 4d 18 15 05 00 25   MSYS5XRTRIM....%
+|   3520: 0f 19 45 4e 41 42 4c 45 20 4a 53 4f 4e 31 58 42   ..ENABLE JSON1XB
+|   3536: 49 4e 41 52 59 18 14 05 00 25 0f 30 45 4e 41 42   INARY....%.0ENAB
+|   3552: 4c 45 20 4a 53 4f 4e 31 58 4e 4f 43 41 53 45 17   LE JSON1XNOCASE.
+|   3568: 13 05 00 25 0f 17 45 4e 41 42 4c 45 20 4a 53 4f   ...%..ENABLE JSO
+|   3584: 4e 31 58 52 54 52 49 4d 1a 12 05 00 29 0f 19 45   N1XRTRIM....)..E
+|   3600: 4e 41 42 4c 45 20 47 45 4f 50 4f 4c 59 58 42 49   NABLE GEOPOLYXBI
+|   3616: 4e 41 52 59 1a 11 05 00 29 0f 19 45 4e 41 42 4c   NARY....)..ENABL
+|   3632: 45 20 47 45 4f 50 4f 4c 59 58 4e 4f 43 41 53 45   E GEOPOLYXNOCASE
+|   3648: 19 10 05 00 29 0f 17 45 4e 41 42 4c 45 20 47 45   ....)..ENABLE GE
+|   3664: 4f 50 4f 4c 59 58 52 54 52 49 4d 17 0f 05 00 23   OPOLYXRTRIM....#
+|   3680: 0f 19 45 4e 41 42 4c 45 20 46 54 53 35 58 42 49   ..ENABLE FTS5XBI
+|   3696: 4e 41 52 59 17 0e 05 00 23 0f 19 45 4e 41 42 4c   NARY....#..ENABL
+|   3712: 45 20 46 54 53 35 58 4e 4f 43 41 53 45 16 0d 05   E FTS5XNOCASE...
+|   3728: 00 23 0f 17 45 4f 41 42 4c 45 20 46 54 53 35 58   .#..EOABLE FTS5X
+|   3744: 52 54 52 49 4d 17 0c 05 00 23 0f 19 45 4e 41 42   RTRIM....#..ENAB
+|   3760: 4c 45 20 46 54 53 34 58 42 49 4e 41 52 59 17 0b   LE FTS4XBINARY..
+|   3776: 05 00 23 0f 19 45 4e 41 42 4c 45 20 46 54 53 34   ..#..ENABLE FTS4
+|   3792: 58 4e 4f 43 41 53 45 16 0a 05 00 23 0f 17 45 4e   XNOCASE....#..EN
+|   3808: 41 42 4c 45 20 46 54 53 34 58 52 54 52 49 4d 1e   ABLE FTS4XRTRIM.
+|   3824: 09 05 00 31 0f 19 45 4e 41 42 4c 45 20 44 42 53   ...1..ENABLE DBS
+|   3840: 54 41 54 20 56 54 31 42 58 42 49 4e 41 52 59 1e   TAT VT1BXBINARY.
+|   3856: 08 05 00 31 0f 19 45 4e 41 42 4c 45 20 44 42 53   ...1..ENABLE DBS
+|   3872: 54 41 54 20 56 54 41 42 58 4e 4f 43 41 53 45 1d   TAT VTABXNOCASE.
+|   3888: 07 05 00 31 0f 17 45 4e 41 42 4c 45 20 44 42 53   ...1..ENABLE DBS
+|   3904: 54 41 54 20 56 54 41 42 58 52 54 52 49 4d 11 06   TAT VTABXRTRIM..
+|   3920: 05 00 17 0f 19 44 45 42 55 47 58 42 49 4e 41 52   .....DEBUGXBINAR
+|   3936: 59 11 15 05 00 17 0f 19 44 45 42 55 47 58 4e 4f   Y.......DEBUGXNO
+|   3952: 43 41 53 45 10 04 05 00 17 0f 17 44 45 42 55 47   CASE.......DEBUG
+|   3968: 58 42 54 52 49 4d 27 03 05 00 43 0f 19 43 4f 4d   XBTRIM'...C..COM
+|   3984: 50 49 4c 45 52 3d 67 63 63 2d 35 2e 34 2e 30 20   PILER=gcc-5.4.0 
+|   4000: 32 30 31 36 30 36 30 39 58 42 49 4e 41 52 59 27   20160609XBINARY'
+|   4016: 02 05 00 43 0f 19 43 4f 4d 50 49 4c 45 52 3d 67   ...C..COMPILER=g
+|   4032: 63 63 2d 35 2e 34 2e 30 20 32 30 31 36 30 36 30   cc-5.4.0 2016060
+|   4048: 39 58 4e 4f 43 41 53 45 26 01 05 00 43 0f 17 43   9XNOCASE&...C..C
+|   4064: 4f 4d 50 49 4c 45 52 3d 67 63 63 2d 35 2e 34 2e   OMPILER=gcc-5.4.
+|   4080: 30 20 32 30 31 36 30 36 30 39 58 52 54 52 49 4d   0 20160609XRTRIM
+| page 6 offset 20480
+|      0: 0d 00 00 00 24 0e e0 00 0f f8 0f f0 0f e8 0f e0   ....$...........
+|     16: 0f d8 0f d0 0f c8 0f c0 0f b8 0f b0 0f a8 0f a0   ................
+|     32: 0f 98 0f 90 0f 88 0f 80 0f 78 0f 70 1f 68 0f 60   .........x.p.h.`
+|     48: 0f 58 0f 50 0f 48 0f 40 0f 38 0f 30 0f 28 0f 20   .X.P.H.@.8.0.(. 
+|     64: 0f 18 0f 10 0f 08 0f 00 0e f8 0e f0 0e e8 0e e0   ................
+|   3808: 07 24 03 00 12 02 01 01 06 23 03 00 12 02 01 01   .$.......#......
+|   3824: 06 22 03 00 12 02 01 01 06 21 03 00 12 03 01 01   .........!......
+|   3840: 06 20 03 00 12 03 01 01 06 1f 03 00 12 03 01 01   . ..............
+|   3856: 06 1e 03 00 12 03 01 01 06 1d 03 00 12 03 01 01   ................
+|   3872: 06 1c 03 00 12 03 01 01 06 1b 03 00 12 02 01 01   ................
+|   3888: 06 1a 03 00 12 02 01 01 06 19 03 00 12 02 01 01   ................
+|   3904: 06 18 03 00 12 02 01 01 06 17 03 00 12 02 01 01   ................
+|   3920: 06 16 03 00 12 02 01 01 06 15 03 00 12 02 01 01   ................
+|   3936: 06 14 03 00 12 02 01 01 06 13 03 00 12 02 01 01   ................
+|   3952: 06 12 03 00 12 02 01 01 06 11 03 00 12 02 01 01   ................
+|   3968: 06 10 03 00 12 02 01 01 06 0f 03 00 12 02 01 01   ................
+|   3984: 06 0e 03 00 12 02 01 01 06 0d 03 00 12 02 01 01   ................
+|   4000: 06 0c 03 00 12 02 01 01 06 0b 03 00 12 02 01 01   ................
+|   4016: 06 0a 03 00 12 02 01 01 05 09 03 00 12 03 01 01   ................
+|   4032: 06 08 03 00 12 03 01 01 01 17 03 00 12 03 01 01   ................
+|   4048: 06 06 03 00 12 01 01 01 06 05 03 00 12 01 01 01   ................
+|   4064: 06 04 03 00 12 01 01 01 06 03 02 f0 12 06 01 01   ................
+|   4080: 06 02 03 00 13 06 01 01 06 01 03 00 12 06 01 01   ................
+| page 7 offset 24576
+|      0: 0a 00 00 00 01 0f f4 00 0f f4 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 0b 03 1b 01 76 65 72 73 69 6f 6e 04   ........version.
+| page 8 offset 28672
+|      0: 0d 00 00 00 03 0f d6 00 0f f4 0f e9 0f d6 00 00   ................
+|   4048: 00 00 00 00 00 00 11 03 02 2b 69 6e 74 65 77 72   .........+intewr
+|   4064: 69 74 79 2d 63 68 65 63 6b 09 02 02 1b 72 65 62   ity-check....reb
+|   4080: 75 69 6c 64 0a 01 02 1d 6f 70 74 69 6d 69 7a 65   uild....optimize
+| end crash-b366b5ac0d3887.db
+}]} {}
+
+do_execsql_test 55.1 {
+  SAVEPOINT one;
+  DELETE FROM t1 WHERE a MATCH 'ts';
+}
+
+do_execsql_test 55.2 {
+  ROLLBACK TO one;
+}
 
 sqlite3_fts5_may_be_corrupt 0
 finish_test
+

Index: ext/fts5/test/fts5first.test
==================================================================
--- ext/fts5/test/fts5first.test
+++ ext/fts5/test/fts5first.test
@@ -91,6 +91,5 @@
 
 do_catchsql_test 3.3 {
   SELECT * FROM x2('^a');
 } {1 {fts5: phrase queries are not supported (detail!=full)}}
 finish_test
-

Index: ext/fts5/test/fts5integrity.test
==================================================================
--- ext/fts5/test/fts5integrity.test
+++ ext/fts5/test/fts5integrity.test
@@ -69,10 +69,11 @@
 } {1 1 1 1 1}
 do_execsql_test 4.1 { 
   INSERT INTO aa(aa) VALUES('integrity-check'); 
 }
 
+sqlite3_db_config db DEFENSIVE 0
 do_catchsql_test 4.2 { 
   BEGIN;
     UPDATE aa_docsize SET sz = X'44' WHERE rowid = 3;
     INSERT INTO aa(aa) VALUES('integrity-check'); 
 } {1 {database disk image is malformed}}

ADDED   ext/fts5/test/fts5interrupt.test
Index: ext/fts5/test/fts5interrupt.test
==================================================================
--- /dev/null
+++ ext/fts5/test/fts5interrupt.test
@@ -0,0 +1,67 @@
+# 2019 Jan 4
+#
+# The author disclaims copyright to this source code.  In place of
+# a legal notice, here is a blessing:
+#
+#    May you do good and not evil.
+#    May you find forgiveness for yourself and forgive others.
+#    May you share freely, never taking more than you give.
+#
+#*************************************************************************
+# This file implements regression tests for SQLite library.  The
+# focus of this script is testing the FTS5 module.
+#
+
+source [file join [file dirname [info script]] fts5_common.tcl]
+set testprefix fts5interrupt
+
+# If SQLITE_ENABLE_FTS5 is not defined, omit this file.
+ifcapable !fts5 {
+  finish_test
+  return
+}
+
+do_execsql_test 1.0 {
+  CREATE VIRTUAL TABLE t1 USING fts5(a);
+  INSERT INTO t1(t1, rank) VALUES('pgsz', 40);
+}
+db_save_and_close
+
+proc progress_handler {args} {
+  incr ::progress_handler_delay -1
+  if {$::progress_handler_delay<=0} { return 1 } 
+  return 0
+}
+
+foreach {tn sql} {
+  1 { INSERT INTO t1(rowid, a) VALUES(0, 'z z z z') }
+  2 { COMMIT }
+} {
+  set bDone 0
+  for {set i 1} {$bDone==0} {incr i} {
+    do_test 1.$tn.$i {
+      db_restore_and_reopen
+      execsql {
+        BEGIN;
+          INSERT INTO t1(rowid, a) VALUES(1, 'a b c d');
+          INSERT INTO t1(rowid, a) VALUES(2, 'd e f g');
+          INSERT INTO t1(rowid, a) VALUES(3, 'h i j k');
+          INSERT INTO t1(rowid, a) VALUES(4, 'l m n o');
+      }
+  
+      set ::progress_handler_delay $i
+      db progress 1 progress_handler
+      set res [catchsql $sql]
+      db close
+      if {$res=="0 {}"} {
+        set bDone 1
+      } else {
+        if {$res!="1 interrupted"} { error "got: $res" }
+      }
+      set {} {}
+    } {}
+  }
+}
+
+finish_test
+

Index: ext/fts5/test/fts5rank.test
==================================================================
--- ext/fts5/test/fts5rank.test
+++ ext/fts5/test/fts5rank.test
@@ -161,6 +161,5 @@
 do_execsql_test 5.1 {
   SELECT rowid FROM ttt('word') WHERE rowid BETWEEN 30 AND 40 ORDER BY rank;
 } {30 31 32 33 34 35 36 37 38 39 40}
 
 finish_test
-

Index: ext/fts5/test/fts5rebuild.test
==================================================================
--- ext/fts5/test/fts5rebuild.test
+++ ext/fts5/test/fts5rebuild.test
@@ -37,10 +37,11 @@
 
 do_execsql_test 1.4 {
   INSERT INTO f1(f1) VALUES('integrity-check');
 } {}
 
+sqlite3_db_config db DEFENSIVE 0
 do_execsql_test 1.5 {
   DELETE FROM f1_data;
 } {}
 
 do_catchsql_test 1.6 {

Index: ext/fts5/test/fts5rowid.test
==================================================================
--- ext/fts5/test/fts5rowid.test
+++ ext/fts5/test/fts5rowid.test
@@ -68,10 +68,11 @@
 
 set res [db one {SELECT count(*) FROM x1_data}]
 do_execsql_test 2.3 {
   SELECT count(fts5_decode(rowid, block)) FROM x1_data;
 } $res
+sqlite3_db_config db DEFENSIVE 0
 do_execsql_test 2.4 {
   UPDATE x1_data SET block = X'';
   SELECT count(fts5_decode(rowid, block)) FROM x1_data;
 } $res
 

Index: ext/fts5/test/fts5tokenizer.test
==================================================================
--- ext/fts5/test/fts5tokenizer.test
+++ ext/fts5/test/fts5tokenizer.test
@@ -187,11 +187,11 @@
 do_catchsql_test 6.2 {
   CREATE VIRTUAL TABLE a3 USING fts5(x, y, tokenize = 'unicode61 a b');
 } {1 {error in tokenizer constructor}}
 do_catchsql_test 6.3 {
   CREATE VIRTUAL TABLE a3 USING fts5(
-    x, y, tokenize = 'unicode61 remove_diacritics 2'
+    x, y, tokenize = 'unicode61 remove_diacritics 3'
   );
 } {1 {error in tokenizer constructor}}
 do_catchsql_test 6.4 {
   CREATE VIRTUAL TABLE a3 USING fts5(
     x, y, tokenize = 'unicode61 remove_diacritics 10'

ADDED   ext/fts5/test/fts5umlaut.test
Index: ext/fts5/test/fts5umlaut.test
==================================================================
--- /dev/null
+++ ext/fts5/test/fts5umlaut.test
@@ -0,0 +1,65 @@
+# 2014 June 17
+#
+# The author disclaims copyright to this source code.  In place of
+# a legal notice, here is a blessing:
+#
+#    May you do good and not evil.
+#    May you find forgiveness for yourself and forgive others.
+#    May you share freely, never taking more than you give.
+#
+#*************************************************************************
+# This file implements regression tests for SQLite library.  The
+# focus of this script is testing the FTS5 module.
+#
+
+source [file join [file dirname [info script]] fts5_common.tcl]
+set testprefix fts5umlaut
+
+# If SQLITE_ENABLE_FTS5 is not defined, omit this file.
+ifcapable !fts5 {
+  finish_test
+  return
+}
+
+do_execsql_test 1.0 {
+  CREATE VIRTUAL TABLE t1 USING fts5(x);
+  CREATE VIRTUAL TABLE t2 USING fts5(
+      x, 
+      tokenize="unicode61 remove_diacritics 2"
+  );
+}
+
+foreach {tn q res1 res2} {
+  1 "Hà Nội"                  0 1
+  2 "Hà Noi"                  1 1
+  3 "Ha Noi"                  1 1
+  4 "Ha N\u1ed9i"             0 1
+  5 "Ha N\u006fi"             1 1
+  6 "Ha N\u006f\u0302i"       1 1
+  7 "Ha N\u006f\u0323\u0302i" 1 1
+} {
+  do_execsql_test 1.$tn.1 {
+    DELETE FROM t1;
+    INSERT INTO t1(rowid, x) VALUES (1, 'Ha Noi');
+    SELECT count(*) FROM t1($q)
+  } $res1
+  do_execsql_test 1.$tn.2 {
+    DELETE FROM t1;
+    INSERT INTO t1(rowid, x) VALUES (1, $q);
+    SELECT count(*) FROM t1('Ha Noi')
+  } $res1
+
+  do_execsql_test 1.$tn.2 {
+    DELETE FROM t2;
+    INSERT INTO t2(rowid, x) VALUES (1, 'Ha Noi');
+    SELECT count(*) FROM t2($q)
+  } $res2
+  do_execsql_test 1.$tn.2 {
+    DELETE FROM t2;
+    INSERT INTO t2(rowid, x) VALUES (1, $q);
+    SELECT count(*) FROM t2('Ha Noi')
+  } $res2
+}
+
+finish_test
+

Index: ext/fts5/test/fts5unicode3.test
==================================================================
--- ext/fts5/test/fts5unicode3.test
+++ ext/fts5/test/fts5unicode3.test
@@ -19,11 +19,11 @@
   finish_test
   return
 }
 
 proc fts3_unicode_path {file} {
-  file join [file dirname [info script]] .. .. fts3 unicode $file
+  file join .. [file dirname [info script]] .. .. fts3 unicode $file
 }
 
 source [fts3_unicode_path parseunicode.tcl]
 set testprefix fts5unicode3
 
@@ -34,28 +34,30 @@
 foreach x [an_load_unicodedata_text $UD] {
   set aNotAlnum($x) 1
 }
 
 foreach {y} [rd_load_unicodedata_text $UD] {
-  foreach {code ascii} $y {}
+  foreach {code ascii f} $y {}
   if {$ascii==""} {
     set int 0
   } else {
     binary scan $ascii c int
   }
-  set aDiacritic($code) $int
+  set aDiacritic($code,$f) $int
+  if {$f==0} { set aDiacritic($code,1) $int }
 }
 
 proc tcl_fold {i {bRemoveDiacritic 0}} {
   global tl_lookup_table
   global aDiacritic
+  set f [expr $bRemoveDiacritic==2]
 
   if {[info exists tl_lookup_table($i)]} {
     set i $tl_lookup_table($i)
   }
-  if {$bRemoveDiacritic && [info exists aDiacritic($i)]} {
-    set i $aDiacritic($i)
+  if {$bRemoveDiacritic && [info exists aDiacritic($i,$f)]} {
+    set i $aDiacritic($i,$f)
   }
   expr $i
 }
 db func tcl_fold tcl_fold
 
@@ -83,19 +85,29 @@
     SELECT i+1 FROM ii WHERE i<100000
   )
   SELECT count(*), min(i) FROM ii WHERE fts5_fold(i)!=CAST(tcl_fold(i) AS int);
 } {0 {}}
 
-do_execsql_test 1.2 {
+do_execsql_test 1.2.1 {
   WITH ii(i) AS (
     SELECT -1
     UNION ALL
     SELECT i+1 FROM ii WHERE i<100000
   )
   SELECT count(*), min(i) FROM ii 
   WHERE fts5_fold(i,1)!=CAST(tcl_fold(i,1) AS int);
 } {0 {}}
+
+do_execsql_test 1.2.2 {
+  WITH ii(i) AS (
+    SELECT -1
+    UNION ALL
+    SELECT i+1 FROM ii WHERE i<100000
+  )
+  SELECT count(*), min(i) FROM ii 
+  WHERE fts5_fold(i,2)!=CAST(tcl_fold(i,2) AS int);
+} {0 {}}
 
 do_execsql_test 1.3 {
   WITH ii(i) AS (
     SELECT -1
     UNION ALL

Index: ext/fts5/test/fts5update.test
==================================================================
--- ext/fts5/test/fts5update.test
+++ ext/fts5/test/fts5update.test
@@ -112,8 +112,46 @@
   }
 } {}
 do_execsql_test 2.2.integrity {
   INSERT INTO x2(x2) VALUES('integrity-check');
 }
+
+#-------------------------------------------------------------------------
+#
+do_execsql_test 3.0 {
+  CREATE VIRTUAL TABLE x3 USING fts5(x, detail=%DETAIL%);
+  INSERT INTO x3 VALUES('one');
+  INSERT INTO x3 VALUES('two');
+  INSERT INTO x3 VALUES('one');
+  INSERT INTO x3 VALUES('two');
+  INSERT INTO x3 VALUES('one');
+}
+
+do_test 3.1 {
+  db eval { SELECT * FROM x3('one') } {
+    db eval {
+      INSERT INTO x3(x3) VALUES('optimize');
+    }
+  }
+} {}
+
+do_execsql_test 4.0 {
+  CREATE VIRTUAL TABLE x4 USING fts5(a, detail=%DETAIL%);
+  INSERT INTO x4 VALUES('one two three');
+  INSERT INTO x4(rowid, a) VALUES('2', 'one two three');
+  INSERT INTO x4(rowid, a) VALUES('3.0', 'one two three');
+}
+do_catchsql_test 4.1 {
+  INSERT INTO x4(rowid, a) VALUES('four', 'one two three');
+} {1 {datatype mismatch}}
+
+do_catchsql_test 4.2 {
+  UPDATE x4 SET rowid = 'four' WHERE rowid=1;
+} {1 {datatype mismatch}}
+
 
 }
+
+reset_db
+do_catchsql_test 4.0 { CREATE VIRTUAL TABLE t1 USING fts5(a,b,c); } {0 {}}
+do_catchsql_test 4.1 { DELETE FROM t1 WHERE t1 MATCH 'f*'; } {0 {}}
 finish_test

Index: ext/fts5/test/fts5version.test
==================================================================
--- ext/fts5/test/fts5version.test
+++ ext/fts5/test/fts5version.test
@@ -34,13 +34,14 @@
 
 do_execsql_test 1.3 {
   SELECT rowid FROM t1 WHERE t1 MATCH 'a';
 } {1}
 
+sqlite3_db_config db DEFENSIVE 0
 do_execsql_test 1.4 {
   UPDATE t1_config set v=5 WHERE k='version';
-} 
+}
 
 do_test 1.5 {
   db close
   sqlite3 db test.db
   catchsql { SELECT * FROM t1 WHERE t1 MATCH 'a' }
@@ -51,13 +52,14 @@
   sqlite3 db test.db
   catchsql { INSERT INTO t1 VALUES('x y z') }
 } {1 {invalid fts5 file format (found 5, expected 4) - run 'rebuild'}}
 
 do_test 1.7 {
+  sqlite3_db_config db DEFENSIVE 0
   execsql { DELETE FROM t1_config WHERE k='version' }
   db close
   sqlite3 db test.db
   catchsql { SELECT * FROM t1 WHERE t1 MATCH 'a' }
 } {1 {invalid fts5 file format (found 0, expected 4) - run 'rebuild'}}
 
 
 finish_test

Index: ext/fts5/test/fts5vocab.test
==================================================================
--- ext/fts5/test/fts5vocab.test
+++ ext/fts5/test/fts5vocab.test
@@ -77,12 +77,12 @@
   1 col {} 0 {} 0
   2 doc {} 0 {} 0
   3 cnt {} 0 {} 0
 }
 
-do_execsql_test 1.2.1 { SELECT * FROM v1 } { }
-do_execsql_test 1.2.2 { SELECT * FROM v2 } { }
+do_execsql_test 1.2.1 { SELECT * FROM v1 } {}
+do_execsql_test 1.2.2 { SELECT * FROM v2 } {}
 
 do_execsql_test 1.3 {
   INSERT INTO t1 VALUES('x y z');
   INSERT INTO t1 VALUES('x x x');
 }
@@ -418,10 +418,11 @@
 if {[detail_is_none]} { set resc [row_to_col $resr] }
 
 do_execsql_test 8.1.1 { SELECT * FROM x1_r; } $resr
 do_execsql_test 8.1.2 { SELECT * FROM x1_c } $resc
 
+sqlite3_db_config db DEFENSIVE 0
 do_execsql_test 8.2 {
   PRAGMA writable_schema = 1;
   UPDATE sqlite_master 
   SET sql = 'CREATE VIRTUAL TABLE x1 USING fts5(a, detail=%DETAIL%)'
   WHERE name = 'x1';
@@ -476,9 +477,70 @@
 do_test 9.6 {
   set e2 [db eval { EXPLAIN SELECT * FROM rrr ORDER BY term DESC }]
   expr [lsearch $e2 SorterSort]<0
 } 0
 
+#-------------------------------------------------------------------------
+do_execsql_test 10.0 {
+  CREATE VIRTUAL TABLE ft USING fts5(a, b, c);
+  CREATE VIRTUAL TABLE t2 USING fts5vocab('ft','row');
+  CREATE VIRTUAL TABLE t3 USING fts5vocab('ft','row');
+}
+
+do_execsql_test 10.1 {
+  BEGIN;
+    INSERT INTO ft(b) VALUES('x y');
+}
+
+do_execsql_test 10.2 {
+  SELECT t2.term FROM t2;
+} {x y}
+
+do_execsql_test 10.3 {
+  SELECT t2.term, t3.term FROM t2, t3;
+} {x x x y y x y y}
+
+do_execsql_test 10.4 {
+  COMMIT;
+}
+
+do_execsql_test 10.5 {
+  BEGIN;
+    INSERT INTO ft(a) VALUES('1 2 3');
+    INSERT INTO ft(a) VALUES('4 5 6');
+    INSERT INTO ft(a) VALUES('1 2 3');
+    INSERT INTO ft(a) VALUES('4 5 6');
+    INSERT INTO ft(a) VALUES('1 2 3');
+    INSERT INTO ft(a) VALUES('4 5 6');
+}
+
+do_test 10.6 {
+  set res [list]
+  db eval { SELECT rowid FROM ft('4') } x {
+    db eval { SELECT * FROM t2 }
+    lappend res $x(rowid)
+  }
+  db eval COMMIT
+  set res
+} {3 5 7}
 
+do_execsql_test 10.6.1 {
+  SELECT * FROM t2 WHERE term<NULL;
+}
+do_execsql_test 10.6.2 {
+  SELECT * FROM t2 WHERE term>NULL;
+}
+do_execsql_test 10.6.3 {
+  SELECT * FROM t2 WHERE term=NULL;
+}
+do_execsql_test 10.7.1 {
+  SELECT * FROM t2 WHERE term<?;
+}
+do_execsql_test 10.7.2 {
+  SELECT * FROM t2 WHERE term>?;
+}
+do_execsql_test 10.7.3 {
+  SELECT * FROM t2 WHERE term=?;
+}
 
 finish_test
 

Index: ext/fts5/test/fts5vocab2.test
==================================================================
--- ext/fts5/test/fts5vocab2.test
+++ ext/fts5/test/fts5vocab2.test
@@ -11,11 +11,11 @@
 #
 # The tests in this file focus on testing the fts5vocab module.
 #
 
 source [file join [file dirname [info script]] fts5_common.tcl]
-set testprefix fts5vocab
+set testprefix fts5vocab2
 
 # If SQLITE_ENABLE_FTS5 is defined, omit this file.
 ifcapable !fts5 {
   finish_test
   return
@@ -78,12 +78,11 @@
 }
 
 do_execsql_test 1.5 {
   DELETE FROM t1;
   SELECT * FROM v1;
-} {
-}
+} {}
 
 #-------------------------------------------------------------------------
 #
 do_execsql_test 2.0 {
   DROP TABLE IF EXISTS t1;
@@ -141,12 +140,11 @@
 }
 
 do_execsql_test 2.5 {
   DELETE FROM t1;
   SELECT * FROM v1;
-} {
-}
+} {}
 
 #-------------------------------------------------------------------------
 #
 do_execsql_test 3.0 {
   DROP TABLE IF EXISTS t1;
@@ -200,10 +198,40 @@
 }
 
 do_execsql_test 3.5 {
   DELETE FROM t1;
   SELECT * FROM v1;
-} {
+} {}
+
+#-------------------------------------------------------------------------
+#
+reset_db
+do_execsql_test 4.0 {
+  CREATE VIRTUAL TABLE v1 USING fts5vocab(nosuchtable, col);
+}
+
+do_catchsql_test 4.1 {
+  SELECT * FROM v1 WHERE term=='nosuchterm';
+} {1 {no such fts5 table: main.nosuchtable}}
+
+do_execsql_test 4.2.1 {
+  CREATE TABLE nosuchtable(nosuchtable, y, z);
+}
+do_catchsql_test 4.2.2 {
+  SELECT * FROM v1 WHERE term=='nosuchterm';
+} {1 {no such fts5 table: main.nosuchtable}}
+
+ifcapable fts3 {
+  do_execsql_test 4.3.1 {
+    DROP TABLE nosuchtable;
+    CREATE VIRTUAL TABLE nosuchtable USING fts3(a, b);
+  } {}
+  do_catchsql_test 4.3.2 {
+    SELECT * FROM v1 WHERE term=='nosuchterm';
+  } {1 {no such fts5 table: main.nosuchtable}}
+  do_catchsql_test 4.3.3 {
+    INSERT INTO nosuchtable VALUES('id', '*id');
+    SELECT * FROM v1 WHERE term=='nosuchterm';
+  } {1 {no such fts5 table: main.nosuchtable}}
 }
 
 finish_test
-

Index: ext/misc/amatch.c
==================================================================
--- ext/misc/amatch.c
+++ ext/misc/amatch.c
@@ -617,11 +617,11 @@
   }else
   if( strcmp(zFrom,"?")==0 && strcmp(zTo,"")==0 ){
     if( p->rDel==0 || p->rDel>rCost ) p->rDel = rCost;
   }else
   {
-    pRule = sqlite3_malloc( sizeof(*pRule) + nFrom + nTo );
+    pRule = sqlite3_malloc64( sizeof(*pRule) + nFrom + nTo );
     if( pRule==0 ){
       rc = SQLITE_NOMEM;
     }else{
       memset(pRule, 0, sizeof(*pRule));
       pRule->zFrom = &pRule->zTo[nTo+1];
@@ -736,15 +736,15 @@
 **     'xyz'   becomes   xyz
 **     [pqr]   becomes   pqr
 **     `mno`   becomes   mno
 */
 static char *amatchDequote(const char *zIn){
-  int nIn;                        /* Size of input string, in bytes */
+  sqlite3_int64 nIn;              /* Size of input string, in bytes */
   char *zOut;                     /* Output (dequoted) string */
 
-  nIn = (int)strlen(zIn);
-  zOut = sqlite3_malloc(nIn+1);
+  nIn = strlen(zIn);
+  zOut = sqlite3_malloc64(nIn+1);
   if( zOut ){
     char q = zIn[0];              /* Quote character (if any ) */
 
     if( q!='[' && q!= '\'' && q!='"' && q!='`' ){
       memcpy(zOut, zIn, nIn+1);
@@ -1067,11 +1067,11 @@
       pOther = amatchAvlInsert(&pCur->pCost, &pWord->sCost);
       assert( pOther==0 ); (void)pOther;
     }
     return;
   }
-  pWord = sqlite3_malloc( sizeof(*pWord) + nBase + nTail - 1 );
+  pWord = sqlite3_malloc64( sizeof(*pWord) + nBase + nTail - 1 );
   if( pWord==0 ) return;
   memset(pWord, 0, sizeof(*pWord));
   pWord->rCost = rCost;
   pWord->iSeq = pCur->nWord++;
   amatchWriteCost(pWord);
@@ -1471,11 +1471,12 @@
   0,                      /* xRollback */
   0,                      /* xFindMethod */
   0,                      /* xRename */
   0,                      /* xSavepoint */
   0,                      /* xRelease */
-  0                       /* xRollbackTo */
+  0,                      /* xRollbackTo */
+  0                       /* xShadowName */
 };
 
 #endif /* SQLITE_OMIT_VIRTUALTABLE */
 
 /*

Index: ext/misc/btreeinfo.c
==================================================================
--- ext/misc/btreeinfo.c
+++ ext/misc/btreeinfo.c
@@ -409,10 +409,11 @@
     0,                           /* xFindMethod */
     0,                           /* xRename */
     0,                           /* xSavepoint */
     0,                           /* xRelease */
     0,                           /* xRollbackTo */
+    0                            /* xShadowName */
   };
   return sqlite3_create_module(db, "sqlite_btreeinfo", &binfo_module, 0);
 }
 
 #ifdef _WIN32

Index: ext/misc/closure.c
==================================================================
--- ext/misc/closure.c
+++ ext/misc/closure.c
@@ -420,15 +420,15 @@
 **     'xyz'   becomes   xyz
 **     [pqr]   becomes   pqr
 **     `mno`   becomes   mno
 */
 static char *closureDequote(const char *zIn){
-  int nIn;                        /* Size of input string, in bytes */
+  sqlite3_int64 nIn;              /* Size of input string, in bytes */
   char *zOut;                     /* Output (dequoted) string */
 
-  nIn = (int)strlen(zIn);
-  zOut = sqlite3_malloc(nIn+1);
+  nIn = strlen(zIn);
+  zOut = sqlite3_malloc64(nIn+1);
   if( zOut ){
     char q = zIn[0];              /* Quote character (if any ) */
 
     if( q!='[' && q!= '\'' && q!='"' && q!='`' ){
       memcpy(zOut, zIn, nIn+1);
@@ -936,11 +936,12 @@
   0,                      /* xRollback */
   0,                      /* xFindMethod */
   0,                      /* xRename */
   0,                      /* xSavepoint */
   0,                      /* xRelease */
-  0                       /* xRollbackTo */
+  0,                      /* xRollbackTo */
+  0                       /* xShadowName */
 };
 
 #endif /* SQLITE_OMIT_VIRTUALTABLE */
 
 /*

Index: ext/misc/completion.c
==================================================================
--- ext/misc/completion.c
+++ ext/misc/completion.c
@@ -466,11 +466,12 @@
   0,                         /* xRollback */
   0,                         /* xFindMethod */
   0,                         /* xRename */
   0,                         /* xSavepoint */
   0,                         /* xRelease */
-  0                          /* xRollbackTo */
+  0,                         /* xRollbackTo */
+  0                          /* xShadowName */
 };
 
 #endif /* SQLITE_OMIT_VIRTUALTABLE */
 
 int sqlite3CompletionVtabInit(sqlite3 *db){

Index: ext/misc/csv.c
==================================================================
--- ext/misc/csv.c
+++ ext/misc/csv.c
@@ -17,13 +17,13 @@
 **
 **    .load ./csv
 **    CREATE VIRTUAL TABLE temp.csv USING csv(filename=FILENAME);
 **    SELECT * FROM csv;
 **
-** The columns are named "c1", "c2", "c3", ... by default.  But the
-** application can define its own CREATE TABLE statement as an additional
-** parameter.  For example:
+** The columns are named "c1", "c2", "c3", ... by default.  Or the
+** application can define its own CREATE TABLE statement using the
+** schema= parameter, like this:
 **
 **    CREATE VIRTUAL TABLE temp.csv2 USING csv(
 **       filename = "../http.log",
 **       schema = "CREATE TABLE x(date,ipaddr,url,referrer,userAgent)"
 **    );
@@ -30,13 +30,13 @@
 **
 ** Instead of specifying a file, the text of the CSV can be loaded using
 ** the data= parameter.
 **
 ** If the columns=N parameter is supplied, then the CSV file is assumed to have
-** N columns.  If the columns parameter is omitted, the CSV file is opened
-** as soon as the virtual table is constructed and the first row of the CSV
-** is read in order to count the tables.
+** N columns.  If both the columns= and schema= parameters are omitted, then
+** the number and names of the columns is determined by the first line of
+** the CSV input.
 **
 ** Some extra debugging features (used for testing virtual tables) are available
 ** if this module is compiled with -DSQLITE_TEST.
 */
 #include <sqlite3ext.h>
@@ -434,10 +434,38 @@
     return 0;
   }
   return -1;
 }
 
+/* Check to see if the string is of the form:  "TAG = BOOLEAN" or just "TAG".
+** If it is, set *pValue to be the value of the boolean ("true" if there is
+** not "= BOOLEAN" component) and return non-zero.  If the input string
+** does not begin with TAG, return zero.
+*/
+static int csv_boolean_parameter(
+  const char *zTag,       /* Tag we are looking for */
+  int nTag,               /* Size of the tag in bytes */
+  const char *z,          /* Input parameter */
+  int *pValue             /* Write boolean value here */
+){
+  int b;
+  z = csv_skip_whitespace(z);
+  if( strncmp(zTag, z, nTag)!=0 ) return 0;
+  z = csv_skip_whitespace(z + nTag);
+  if( z[0]==0 ){
+    *pValue = 1;
+    return 1;
+  }
+  if( z[0]!='=' ) return 0;
+  z = csv_skip_whitespace(z+1);
+  b = csv_boolean(z);
+  if( b>=0 ){
+    *pValue = b;
+    return 1;
+  }
+  return 0;
+}
 
 /*
 ** Parameters:
 **    filename=FILENAME          Name of file containing CSV content
 **    data=TEXT                  Direct CSV content.
@@ -467,10 +495,11 @@
   int rc = SQLITE_OK;        /* Result code from this routine */
   int i, j;                  /* Loop counters */
 #ifdef SQLITE_TEST
   int tstFlags = 0;          /* Value for testflags=N parameter */
 #endif
+  int b;                     /* Value of a boolean parameter */
   int nCol = -99;            /* Value of the columns= parameter */
   CsvReader sRdr;            /* A CSV file reader used to store an error
                              ** message and/or to count the number of columns */
   static const char *azParam[] = {
      "filename", "data", "schema", 
@@ -491,25 +520,16 @@
       if( csv_string_parameter(&sRdr, azParam[j], z, &azPValue[j]) ) break;
     }
     if( j<sizeof(azParam)/sizeof(azParam[0]) ){
       if( sRdr.zErr[0] ) goto csvtab_connect_error;
     }else
-    if( (zValue = csv_parameter("header",6,z))!=0 ){
-      int x;
+    if( csv_boolean_parameter("header",6,z,&b) ){
       if( bHeader>=0 ){
         csv_errmsg(&sRdr, "more than one 'header' parameter");
         goto csvtab_connect_error;
       }
-      x = csv_boolean(zValue);
-      if( x==1 ){
-        bHeader = 1;
-      }else if( x==0 ){
-        bHeader = 0;
-      }else{
-        csv_errmsg(&sRdr, "unrecognized argument to 'header': %s", zValue);
-        goto csvtab_connect_error;
-      }
+      bHeader = b;
     }else
 #ifdef SQLITE_TEST
     if( (zValue = csv_parameter("testflags",9,z))!=0 ){
       tstFlags = (unsigned int)atoi(zValue);
     }else
@@ -519,57 +539,98 @@
         csv_errmsg(&sRdr, "more than one 'columns' parameter");
         goto csvtab_connect_error;
       }
       nCol = atoi(zValue);
       if( nCol<=0 ){
-        csv_errmsg(&sRdr, "must have at least one column");
+        csv_errmsg(&sRdr, "column= value must be positive");
         goto csvtab_connect_error;
       }
     }else
     {
-      csv_errmsg(&sRdr, "unrecognized parameter '%s'", z);
+      csv_errmsg(&sRdr, "bad parameter: '%s'", z);
       goto csvtab_connect_error;
     }
   }
   if( (CSV_FILENAME==0)==(CSV_DATA==0) ){
-    csv_errmsg(&sRdr, "must either filename= or data= but not both");
+    csv_errmsg(&sRdr, "must specify either filename= or data= but not both");
     goto csvtab_connect_error;
   }
-  if( nCol<=0 && csv_reader_open(&sRdr, CSV_FILENAME, CSV_DATA) ){
+
+  if( (nCol<=0 || bHeader==1)
+   && csv_reader_open(&sRdr, CSV_FILENAME, CSV_DATA)
+  ){
     goto csvtab_connect_error;
   }
   pNew = sqlite3_malloc( sizeof(*pNew) );
   *ppVtab = (sqlite3_vtab*)pNew;
   if( pNew==0 ) goto csvtab_connect_oom;
   memset(pNew, 0, sizeof(*pNew));
-  if( nCol>0 ){
+  if( CSV_SCHEMA==0 ){
+    sqlite3_str *pStr = sqlite3_str_new(0);
+    char *zSep = "";
+    int iCol = 0;
+    sqlite3_str_appendf(pStr, "CREATE TABLE x(");
+    if( nCol<0 && bHeader<1 ){
+      nCol = 0;
+      do{
+        csv_read_one_field(&sRdr);
+        nCol++;
+      }while( sRdr.cTerm==',' );
+    }
+    if( nCol>0 && bHeader<1 ){
+      for(iCol=0; iCol<nCol; iCol++){
+        sqlite3_str_appendf(pStr, "%sc%d TEXT", zSep, iCol);
+        zSep = ",";
+      }
+    }else{
+      do{
+        char *z = csv_read_one_field(&sRdr);
+        if( (nCol>0 && iCol<nCol) || (nCol<0 && bHeader) ){
+          sqlite3_str_appendf(pStr,"%s\"%w\" TEXT", zSep, z);
+          zSep = ",";
+          iCol++;
+        }
+      }while( sRdr.cTerm==',' );
+      if( nCol<0 ){
+        nCol = iCol;
+      }else{
+        while( iCol<nCol ){
+          sqlite3_str_appendf(pStr,"%sc%d TEXT", zSep, ++iCol);
+          zSep = ",";
+        }
+      }
+    }
     pNew->nCol = nCol;
-  }else{
+    sqlite3_str_appendf(pStr, ")");
+    CSV_SCHEMA = sqlite3_str_finish(pStr);
+    if( CSV_SCHEMA==0 ) goto csvtab_connect_oom;
+  }else if( nCol<0 ){
     do{
       csv_read_one_field(&sRdr);
       pNew->nCol++;
     }while( sRdr.cTerm==',' );
+  }else{
+    pNew->nCol = nCol;
   }
   pNew->zFilename = CSV_FILENAME;  CSV_FILENAME = 0;
   pNew->zData = CSV_DATA;          CSV_DATA = 0;
 #ifdef SQLITE_TEST
   pNew->tstFlags = tstFlags;
 #endif
-  pNew->iStart = bHeader==1 ? ftell(sRdr.in) : 0;
-  csv_reader_reset(&sRdr);
-  if( CSV_SCHEMA==0 ){
-    char *zSep = "";
-    CSV_SCHEMA = sqlite3_mprintf("CREATE TABLE x(");
-    if( CSV_SCHEMA==0 ) goto csvtab_connect_oom;
-    for(i=0; i<pNew->nCol; i++){
-      CSV_SCHEMA = sqlite3_mprintf("%z%sc%d TEXT",CSV_SCHEMA, zSep, i);
-      zSep = ",";
-    }
-    CSV_SCHEMA = sqlite3_mprintf("%z);", CSV_SCHEMA);
-  }
+  if( bHeader!=1 ){
+    pNew->iStart = 0;
+  }else if( pNew->zData ){
+    pNew->iStart = (int)sRdr.iIn;
+  }else{
+    pNew->iStart = (int)(ftell(sRdr.in) - sRdr.nIn + sRdr.iIn);
+  }
+  csv_reader_reset(&sRdr);
   rc = sqlite3_declare_vtab(db, CSV_SCHEMA);
-  if( rc ) goto csvtab_connect_error;
+  if( rc ){
+    csv_errmsg(&sRdr, "bad schema: '%s' - %s", CSV_SCHEMA, sqlite3_errmsg(db));
+    goto csvtab_connect_error;
+  }
   for(i=0; i<sizeof(azPValue)/sizeof(azPValue[0]); i++){
     sqlite3_free(azPValue[i]);
   }
   return SQLITE_OK;
 

Index: ext/misc/dbdump.c
==================================================================
--- ext/misc/dbdump.c
+++ ext/misc/dbdump.c
@@ -193,11 +193,11 @@
   if( rc ) return 0;
   while( sqlite3_step(pStmt)==SQLITE_ROW ){
     if( nCol>=nAlloc-2 ){
       char **azNew;
       nAlloc = nAlloc*2 + nCol + 10;
-      azNew = sqlite3_realloc(azCol, nAlloc*sizeof(azCol[0]));
+      azNew = sqlite3_realloc64(azCol, nAlloc*sizeof(azCol[0]));
       if( azNew==0 ) goto col_oom;
       azCol = azNew;
       azCol[0] = 0;
     }
     azCol[++nCol] = sqlite3_mprintf("%s", sqlite3_column_text(pStmt, 1));

Index: ext/misc/eval.c
==================================================================
--- ext/misc/eval.c
+++ ext/misc/eval.c
@@ -42,11 +42,11 @@
       char *zNew;
       p->nAlloc = p->nAlloc*2 + sz + p->szSep + 1;
       /* Using sqlite3_realloc64() would be better, but it is a recent
       ** addition and will cause a segfault if loaded by an older version
       ** of SQLite.  */
-      zNew = p->nAlloc<=0x7fffffff ? sqlite3_realloc(p->z, (int)p->nAlloc) : 0;
+      zNew = p->nAlloc<=0x7fffffff ? sqlite3_realloc64(p->z, p->nAlloc) : 0;
       if( zNew==0 ){
         sqlite3_free(p->z);
         memset(p, 0, sizeof(*p));
         return 1;
       }

Index: ext/misc/explain.c
==================================================================
--- ext/misc/explain.c
+++ ext/misc/explain.c
@@ -16,10 +16,14 @@
 ** Usage example:
 **
 **     .load ./explain
 **     SELECT p2 FROM explain('SELECT * FROM sqlite_master')
 **      WHERE opcode='OpenRead';
+**
+** This module was originally written to help simplify SQLite testing,
+** by providing an easier means of verifying certain patterns in the
+** generated bytecode.
 */
 #if !defined(SQLITEINT_H)
 #include "sqlite3ext.h"
 #endif
 SQLITE_EXTENSION_INIT1
@@ -230,26 +234,34 @@
 */
 static int explainBestIndex(
   sqlite3_vtab *tab,
   sqlite3_index_info *pIdxInfo
 ){
-  int i;
+  int i;                  /* Loop counter */
+  int idx = -1;           /* Index of a usable == constraint against SQL */
+  int unusable = 0;       /* True if there are unusable constraints on SQL */
 
-  pIdxInfo->estimatedCost = (double)1000000;
   pIdxInfo->estimatedRows = 500;
   for(i=0; i<pIdxInfo->nConstraint; i++){
     struct sqlite3_index_constraint *p = &pIdxInfo->aConstraint[i];
-    if( p->usable
-     && p->iColumn==EXPLN_COLUMN_SQL
-     && p->op==SQLITE_INDEX_CONSTRAINT_EQ
-    ){
-      pIdxInfo->estimatedCost = 10.0;
-      pIdxInfo->idxNum = 1;
-      pIdxInfo->aConstraintUsage[i].argvIndex = 1;
-      pIdxInfo->aConstraintUsage[i].omit = 1;
-      break;
-    }
+    if( p->iColumn!=EXPLN_COLUMN_SQL ) continue;
+    if( !p->usable ){
+      unusable = 1;
+    }else if( p->op==SQLITE_INDEX_CONSTRAINT_EQ ){
+      idx = i;
+    }
+  }
+  if( idx>=0 ){
+    /* There exists a usable == constraint against the SQL column */
+    pIdxInfo->estimatedCost = 10.0;
+    pIdxInfo->idxNum = 1;
+    pIdxInfo->aConstraintUsage[idx].argvIndex = 1;
+    pIdxInfo->aConstraintUsage[idx].omit = 1;
+  }else if( unusable ){
+    /* There are unusable constraints against the SQL column.  Do not allow
+    ** this plan to continue forward. */
+    return SQLITE_CONSTRAINT;
   }
   return SQLITE_OK;
 }
 
 /*
@@ -278,10 +290,11 @@
   0,                         /* xFindMethod */
   0,                         /* xRename */
   0,                         /* xSavepoint */
   0,                         /* xRelease */
   0,                         /* xRollbackTo */
+  0,                         /* xShadowName */
 };
 
 #endif /* SQLITE_OMIT_VIRTUALTABLE */
 
 int sqlite3ExplainVtabInit(sqlite3 *db){

Index: ext/misc/fileio.c
==================================================================
--- ext/misc/fileio.c
+++ ext/misc/fileio.c
@@ -104,30 +104,66 @@
 #endif
 #include <time.h>
 #include <errno.h>
 
 
+/*
+** Structure of the fsdir() table-valued function
+*/
+                 /*    0    1    2     3    4           5             */
 #define FSDIR_SCHEMA "(name,mode,mtime,data,path HIDDEN,dir HIDDEN)"
+#define FSDIR_COLUMN_NAME     0     /* Name of the file */
+#define FSDIR_COLUMN_MODE     1     /* Access mode */
+#define FSDIR_COLUMN_MTIME    2     /* Last modification time */
+#define FSDIR_COLUMN_DATA     3     /* File content */
+#define FSDIR_COLUMN_PATH     4     /* Path to top of search */
+#define FSDIR_COLUMN_DIR      5     /* Path is relative to this directory */
+
 
 /*
 ** Set the result stored by context ctx to a blob containing the 
-** contents of file zName.
+** contents of file zName.  Or, leave the result unchanged (NULL)
+** if the file does not exist or is unreadable.
+**
+** If the file exceeds the SQLite blob size limit, through an
+** SQLITE_TOOBIG error.
+**
+** Throw an SQLITE_IOERR if there are difficulties pulling the file
+** off of disk.
 */
 static void readFileContents(sqlite3_context *ctx, const char *zName){
   FILE *in;
-  long nIn;
+  sqlite3_int64 nIn;
   void *pBuf;
+  sqlite3 *db;
+  int mxBlob;
 
   in = fopen(zName, "rb");
-  if( in==0 ) return;
+  if( in==0 ){
+    /* File does not exist or is unreadable. Leave the result set to NULL. */
+    return;
+  }
   fseek(in, 0, SEEK_END);
   nIn = ftell(in);
   rewind(in);
-  pBuf = sqlite3_malloc( nIn );
-  if( pBuf && 1==fread(pBuf, nIn, 1, in) ){
-    sqlite3_result_blob(ctx, pBuf, nIn, sqlite3_free);
+  db = sqlite3_context_db_handle(ctx);
+  mxBlob = sqlite3_limit(db, SQLITE_LIMIT_LENGTH, -1);
+  if( nIn>mxBlob ){
+    sqlite3_result_error_code(ctx, SQLITE_TOOBIG);
+    fclose(in);
+    return;
+  }
+  pBuf = sqlite3_malloc64( nIn );
+  if( pBuf==0 ){
+    sqlite3_result_error_nomem(ctx);
+    fclose(in);
+    return;
+  }
+  if( 1==fread(pBuf, nIn, 1, in) ){
+    sqlite3_result_blob64(ctx, pBuf, nIn, sqlite3_free);
   }else{
+    sqlite3_result_error_code(ctx, SQLITE_IOERR);
     sqlite3_free(pBuf);
   }
   fclose(in);
 }
 
@@ -633,12 +669,12 @@
     /* Descend into this directory */
     int iNew = pCur->iLvl + 1;
     FsdirLevel *pLvl;
     if( iNew>=pCur->nLvl ){
       int nNew = iNew+1;
-      int nByte = nNew*sizeof(FsdirLevel);
-      FsdirLevel *aNew = (FsdirLevel*)sqlite3_realloc(pCur->aLvl, nByte);
+      sqlite3_int64 nByte = nNew*sizeof(FsdirLevel);
+      FsdirLevel *aNew = (FsdirLevel*)sqlite3_realloc64(pCur->aLvl, nByte);
       if( aNew==0 ) return SQLITE_NOMEM;
       memset(&aNew[pCur->nLvl], 0, sizeof(FsdirLevel)*(nNew-pCur->nLvl));
       pCur->aLvl = aNew;
       pCur->nLvl = nNew;
     }
@@ -693,40 +729,40 @@
   sqlite3_context *ctx,       /* First argument to sqlite3_result_...() */
   int i                       /* Which column to return */
 ){
   fsdir_cursor *pCur = (fsdir_cursor*)cur;
   switch( i ){
-    case 0: { /* name */
+    case FSDIR_COLUMN_NAME: {
       sqlite3_result_text(ctx, &pCur->zPath[pCur->nBase], -1, SQLITE_TRANSIENT);
       break;
     }
 
-    case 1: /* mode */
+    case FSDIR_COLUMN_MODE:
       sqlite3_result_int64(ctx, pCur->sStat.st_mode);
       break;
 
-    case 2: /* mtime */
+    case FSDIR_COLUMN_MTIME:
       sqlite3_result_int64(ctx, pCur->sStat.st_mtime);
       break;
 
-    case 3: { /* data */
+    case FSDIR_COLUMN_DATA: {
       mode_t m = pCur->sStat.st_mode;
       if( S_ISDIR(m) ){
         sqlite3_result_null(ctx);
 #if !defined(_WIN32) && !defined(WIN32)
       }else if( S_ISLNK(m) ){
         char aStatic[64];
         char *aBuf = aStatic;
-        int nBuf = 64;
+        sqlite3_int64 nBuf = 64;
         int n;
 
         while( 1 ){
           n = readlink(pCur->zPath, aBuf, nBuf);
           if( n<nBuf ) break;
           if( aBuf!=aStatic ) sqlite3_free(aBuf);
           nBuf = nBuf*2;
-          aBuf = sqlite3_malloc(nBuf);
+          aBuf = sqlite3_malloc64(nBuf);
           if( aBuf==0 ){
             sqlite3_result_error_nomem(ctx);
             return SQLITE_NOMEM;
           }
         }
@@ -735,10 +771,16 @@
         if( aBuf!=aStatic ) sqlite3_free(aBuf);
 #endif
       }else{
         readFileContents(ctx, pCur->zPath);
       }
+    }
+    case FSDIR_COLUMN_PATH:
+    default: {
+      /* The FSDIR_COLUMN_PATH and FSDIR_COLUMN_DIR are input parameters.
+      ** always return their values as NULL */
+      break;
     }
   }
   return SQLITE_OK;
 }
 
@@ -762,10 +804,13 @@
   return (pCur->zPath==0);
 }
 
 /*
 ** xFilter callback.
+**
+** idxNum==1   PATH parameter only
+** idxNum==2   Both PATH and DIR supplied
 */
 static int fsdirFilter(
   sqlite3_vtab_cursor *cur, 
   int idxNum, const char *idxStr,
   int argc, sqlite3_value **argv
@@ -814,44 +859,67 @@
 ** plan.
 **
 ** In this implementation idxNum is used to represent the
 ** query plan.  idxStr is unused.
 **
-** The query plan is represented by bits in idxNum:
+** The query plan is represented by values of idxNum:
 **
-**  (1)  start = $value  -- constraint exists
-**  (2)  stop = $value   -- constraint exists
-**  (4)  step = $value   -- constraint exists
-**  (8)  output in descending order
+**  (1)  The path value is supplied by argv[0]
+**  (2)  Path is in argv[0] and dir is in argv[1]
 */
 static int fsdirBestIndex(
   sqlite3_vtab *tab,
   sqlite3_index_info *pIdxInfo
 ){
   int i;                 /* Loop over constraints */
-  int idx4 = -1;
-  int idx5 = -1;
+  int idxPath = -1;      /* Index in pIdxInfo->aConstraint of PATH= */
+  int idxDir = -1;       /* Index in pIdxInfo->aConstraint of DIR= */
+  int seenPath = 0;      /* True if an unusable PATH= constraint is seen */
+  int seenDir = 0;       /* True if an unusable DIR= constraint is seen */
   const struct sqlite3_index_constraint *pConstraint;
 
   (void)tab;
   pConstraint = pIdxInfo->aConstraint;
   for(i=0; i<pIdxInfo->nConstraint; i++, pConstraint++){
-    if( pConstraint->usable==0 ) continue;
-    if( pConstraint->op!=SQLITE_INDEX_CONSTRAINT_EQ ) continue;
-    if( pConstraint->iColumn==4 ) idx4 = i;
-    if( pConstraint->iColumn==5 ) idx5 = i;
-  }
-
-  if( idx4<0 ){
-    pIdxInfo->idxNum = 0;
-    pIdxInfo->estimatedCost = (double)(((sqlite3_int64)1) << 50);
-  }else{
-    pIdxInfo->aConstraintUsage[idx4].omit = 1;
-    pIdxInfo->aConstraintUsage[idx4].argvIndex = 1;
-    if( idx5>=0 ){
-      pIdxInfo->aConstraintUsage[idx5].omit = 1;
-      pIdxInfo->aConstraintUsage[idx5].argvIndex = 2;
+    if( pConstraint->op!=SQLITE_INDEX_CONSTRAINT_EQ ) continue;
+    switch( pConstraint->iColumn ){
+      case FSDIR_COLUMN_PATH: {
+        if( pConstraint->usable ){
+          idxPath = i;
+          seenPath = 0;
+        }else if( idxPath<0 ){
+          seenPath = 1;
+        }
+        break;
+      }
+      case FSDIR_COLUMN_DIR: {
+        if( pConstraint->usable ){
+          idxDir = i;
+          seenDir = 0;
+        }else if( idxDir<0 ){
+          seenDir = 1;
+        }
+        break;
+      }
+    } 
+  }
+  if( seenPath || seenDir ){
+    /* If input parameters are unusable, disallow this plan */
+    return SQLITE_CONSTRAINT;
+  }
+
+  if( idxPath<0 ){
+    pIdxInfo->idxNum = 0;
+    /* The pIdxInfo->estimatedCost should have been initialized to a huge
+    ** number.  Leave it unchanged. */
+    pIdxInfo->estimatedRows = 0x7fffffff;
+  }else{
+    pIdxInfo->aConstraintUsage[idxPath].omit = 1;
+    pIdxInfo->aConstraintUsage[idxPath].argvIndex = 1;
+    if( idxDir>=0 ){
+      pIdxInfo->aConstraintUsage[idxDir].omit = 1;
+      pIdxInfo->aConstraintUsage[idxDir].argvIndex = 2;
       pIdxInfo->idxNum = 2;
       pIdxInfo->estimatedCost = 10.0;
     }else{
       pIdxInfo->idxNum = 1;
       pIdxInfo->estimatedCost = 100.0;
@@ -886,11 +954,12 @@
     0,                         /* xRollback */
     0,                         /* xFindMethod */
     0,                         /* xRename */
     0,                         /* xSavepoint */
     0,                         /* xRelease */
-    0                          /* xRollbackTo */
+    0,                         /* xRollbackTo */
+    0,                         /* xShadowName */
   };
 
   int rc = sqlite3_create_module(db, "fsdir", &fsdirModule, 0);
   return rc;
 }

Index: ext/misc/fuzzer.c
==================================================================
--- ext/misc/fuzzer.c
+++ ext/misc/fuzzer.c
@@ -335,11 +335,11 @@
         p->zClassName, FUZZER_MX_RULEID
     );
     rc = SQLITE_ERROR;    
   }else{
 
-    pRule = sqlite3_malloc( sizeof(*pRule) + nFrom + nTo );
+    pRule = sqlite3_malloc64( sizeof(*pRule) + nFrom + nTo );
     if( pRule==0 ){
       rc = SQLITE_NOMEM;
     }else{
       memset(pRule, 0, sizeof(*pRule));
       pRule->zFrom = pRule->zTo;
@@ -445,15 +445,15 @@
 **     'xyz'   becomes   xyz
 **     [pqr]   becomes   pqr
 **     `mno`   becomes   mno
 */
 static char *fuzzerDequote(const char *zIn){
-  int nIn;                        /* Size of input string, in bytes */
+  sqlite3_int64 nIn;              /* Size of input string, in bytes */
   char *zOut;                     /* Output (dequoted) string */
 
-  nIn = (int)strlen(zIn);
-  zOut = sqlite3_malloc(nIn+1);
+  nIn = strlen(zIn);
+  zOut = sqlite3_malloc64(nIn+1);
   if( zOut ){
     char q = zIn[0];              /* Quote character (if any ) */
 
     if( q!='[' && q!= '\'' && q!='"' && q!='`' ){
       memcpy(zOut, zIn, nIn+1);
@@ -511,14 +511,14 @@
     *pzErr = sqlite3_mprintf(
         "%s: wrong number of CREATE VIRTUAL TABLE arguments", zModule
     );
     rc = SQLITE_ERROR;
   }else{
-    int nModule;                  /* Length of zModule, in bytes */
+    sqlite3_int64 nModule;        /* Length of zModule, in bytes */
 
-    nModule = (int)strlen(zModule);
-    pNew = sqlite3_malloc( sizeof(*pNew) + nModule + 1);
+    nModule = strlen(zModule);
+    pNew = sqlite3_malloc64( sizeof(*pNew) + nModule + 1);
     if( pNew==0 ){
       rc = SQLITE_NOMEM;
     }else{
       char *zTab;                 /* Dequoted name of fuzzer data table */
 
@@ -870,11 +870,11 @@
 ){
   fuzzer_stem *pNew;
   fuzzer_rule *pRule;
   unsigned int h;
 
-  pNew = sqlite3_malloc( sizeof(*pNew) + (int)strlen(zWord) + 1 );
+  pNew = sqlite3_malloc64( sizeof(*pNew) + strlen(zWord) + 1 );
   if( pNew==0 ) return 0;
   memset(pNew, 0, sizeof(*pNew));
   pNew->zBasis = (char*)&pNew[1];
   pNew->nBasis = (fuzzer_len)strlen(zWord);
   memcpy(pNew->zBasis, zWord, pNew->nBasis+1);

Index: ext/misc/json1.c
==================================================================
--- ext/misc/json1.c
+++ ext/misc/json1.c
@@ -689,11 +689,11 @@
   u32 nNew;
   JsonNode *pNew;
   assert( pParse->nNode>=pParse->nAlloc );
   if( pParse->oom ) return -1;
   nNew = pParse->nAlloc*2 + 10;
-  pNew = sqlite3_realloc(pParse->aNode, sizeof(JsonNode)*nNew);
+  pNew = sqlite3_realloc64(pParse->aNode, sizeof(JsonNode)*nNew);
   if( pNew==0 ){
     pParse->oom = 1;
     return -1;
   }
   pParse->nAlloc = nNew;
@@ -963,11 +963,11 @@
 ** Compute the parentage of all nodes in a completed parse.
 */
 static int jsonParseFindParents(JsonParse *pParse){
   u32 *aUp;
   assert( pParse->aUp==0 );
-  aUp = pParse->aUp = sqlite3_malloc( sizeof(u32)*pParse->nNode );
+  aUp = pParse->aUp = sqlite3_malloc64( sizeof(u32)*pParse->nNode );
   if( aUp==0 ){
     pParse->oom = 1;
     return SQLITE_NOMEM;
   }
   jsonParseFillInParentage(pParse, 0, 0);
@@ -1025,11 +1025,11 @@
   if( pMatch ){
     pMatch->nErr = 0;
     pMatch->iHold = iMaxHold+1;
     return pMatch;
   }
-  p = sqlite3_malloc( sizeof(*p) + nJson + 1 );
+  p = sqlite3_malloc64( sizeof(*p) + nJson + 1 );
   if( p==0 ){
     sqlite3_result_error_nomem(pCtx);
     return 0;
   }
   memset(p, 0, sizeof(*p));
@@ -1992,10 +1992,13 @@
 #define JEACH_ATOM    3
 #define JEACH_ID      4
 #define JEACH_PARENT  5
 #define JEACH_FULLKEY 6
 #define JEACH_PATH    7
+/* The xBestIndex method assumes that the JSON and ROOT columns are
+** the last two columns in the table.  Should this ever changes, be
+** sure to update the xBestIndex method. */
 #define JEACH_JSON    8
 #define JEACH_ROOT    9
 
   UNUSED_PARAM(pzErr);
   UNUSED_PARAM(argv);
@@ -2249,39 +2252,58 @@
 */
 static int jsonEachBestIndex(
   sqlite3_vtab *tab,
   sqlite3_index_info *pIdxInfo
 ){
-  int i;
-  int jsonIdx = -1;
-  int rootIdx = -1;
+  int i;                     /* Loop counter or computed array index */
+  int aIdx[2];               /* Index of constraints for JSON and ROOT */
+  int unusableMask = 0;      /* Mask of unusable JSON and ROOT constraints */
+  int idxMask = 0;           /* Mask of usable == constraints JSON and ROOT */
   const struct sqlite3_index_constraint *pConstraint;
 
-  UNUSED_PARAM(tab);
-  pConstraint = pIdxInfo->aConstraint;
-  for(i=0; i<pIdxInfo->nConstraint; i++, pConstraint++){
-    if( pConstraint->usable==0 ) continue;
-    if( pConstraint->op!=SQLITE_INDEX_CONSTRAINT_EQ ) continue;
-    switch( pConstraint->iColumn ){
-      case JEACH_JSON:   jsonIdx = i;    break;
-      case JEACH_ROOT:   rootIdx = i;    break;
-      default:           /* no-op */     break;
-    }
-  }
-  if( jsonIdx<0 ){
-    pIdxInfo->idxNum = 0;
-    pIdxInfo->estimatedCost = 1e99;
-  }else{
-    pIdxInfo->estimatedCost = 1.0;
-    pIdxInfo->aConstraintUsage[jsonIdx].argvIndex = 1;
-    pIdxInfo->aConstraintUsage[jsonIdx].omit = 1;
-    if( rootIdx<0 ){
-      pIdxInfo->idxNum = 1;
-    }else{
-      pIdxInfo->aConstraintUsage[rootIdx].argvIndex = 2;
-      pIdxInfo->aConstraintUsage[rootIdx].omit = 1;
-      pIdxInfo->idxNum = 3;
+  /* This implementation assumes that JSON and ROOT are the last two
+  ** columns in the table */
+  assert( JEACH_ROOT == JEACH_JSON+1 );
+  UNUSED_PARAM(tab);
+  aIdx[0] = aIdx[1] = -1;
+  pConstraint = pIdxInfo->aConstraint;
+  for(i=0; i<pIdxInfo->nConstraint; i++, pConstraint++){
+    int iCol;
+    int iMask;
+    if( pConstraint->iColumn < JEACH_JSON ) continue;
+    iCol = pConstraint->iColumn - JEACH_JSON;
+    assert( iCol==0 || iCol==1 );
+    iMask = 1 << iCol;
+    if( pConstraint->usable==0 ){
+      unusableMask |= iMask;
+    }else if( pConstraint->op==SQLITE_INDEX_CONSTRAINT_EQ ){
+      aIdx[iCol] = i;
+      idxMask |= iMask;
+    }
+  }
+  if( (unusableMask & ~idxMask)!=0 ){
+    /* If there are any unusable constraints on JSON or ROOT, then reject
+    ** this entire plan */
+    return SQLITE_CONSTRAINT;
+  }
+  if( aIdx[0]<0 ){
+    /* No JSON input.  Leave estimatedCost at the huge value that it was
+    ** initialized to to discourage the query planner from selecting this
+    ** plan. */
+    pIdxInfo->idxNum = 0;
+  }else{
+    pIdxInfo->estimatedCost = 1.0;
+    i = aIdx[0];
+    pIdxInfo->aConstraintUsage[i].argvIndex = 1;
+    pIdxInfo->aConstraintUsage[i].omit = 1;
+    if( aIdx[1]<0 ){
+      pIdxInfo->idxNum = 1;  /* Only JSON supplied.  Plan 1 */
+    }else{
+      i = aIdx[1];
+      pIdxInfo->aConstraintUsage[i].argvIndex = 2;
+      pIdxInfo->aConstraintUsage[i].omit = 1;
+      pIdxInfo->idxNum = 3;  /* Both JSON and ROOT are supplied.  Plan 3 */
     }
   }
   return SQLITE_OK;
 }
 
@@ -2386,11 +2408,12 @@
   0,                         /* xRollback */
   0,                         /* xFindMethod */
   0,                         /* xRename */
   0,                         /* xSavepoint */
   0,                         /* xRelease */
-  0                          /* xRollbackTo */
+  0,                         /* xRollbackTo */
+  0                          /* xShadowName */
 };
 
 /* The methods of the json_tree virtual table. */
 static sqlite3_module jsonTreeModule = {
   0,                         /* iVersion */
@@ -2413,11 +2436,12 @@
   0,                         /* xRollback */
   0,                         /* xFindMethod */
   0,                         /* xRename */
   0,                         /* xSavepoint */
   0,                         /* xRelease */
-  0                          /* xRollbackTo */
+  0,                         /* xRollbackTo */
+  0                          /* xShadowName */
 };
 #endif /* SQLITE_OMIT_VIRTUALTABLE */
 
 /****************************************************************************
 ** The following routines are the only publically visible identifiers in this

Index: ext/misc/memstat.c
==================================================================
--- ext/misc/memstat.c
+++ ext/misc/memstat.c
@@ -141,11 +141,11 @@
     sqlite3_finalize(pStmt);
     return rc;
   }
   while( sqlite3_step(pStmt)==SQLITE_ROW ){
     char **az, *z;
-    az = sqlite3_realloc(pCur->azDb, sizeof(char*)*(pCur->nDb+1));
+    az = sqlite3_realloc64(pCur->azDb, sizeof(char*)*(pCur->nDb+1));
     if( az==0 ){
       memstatClearSchema(pCur);
       return SQLITE_NOMEM;
     }
     pCur->azDb = az;
@@ -393,10 +393,11 @@
   0,                         /* xFindMethod */
   0,                         /* xRename */
   0,                         /* xSavepoint */
   0,                         /* xRelease */
   0,                         /* xRollbackTo */
+  0,                         /* xShadowName */
 };
 
 #endif /* SQLITE_OMIT_VIRTUALTABLE */
 
 int sqlite3MemstatVtabInit(sqlite3 *db){

ADDED   ext/misc/memtrace.c
Index: ext/misc/memtrace.c
==================================================================
--- /dev/null
+++ ext/misc/memtrace.c
@@ -0,0 +1,107 @@
+/*
+** 2019-01-21
+**
+** The author disclaims copyright to this source code.  In place of
+** a legal notice, here is a blessing:
+**
+**    May you do good and not evil.
+**    May you find forgiveness for yourself and forgive others.
+**    May you share freely, never taking more than you give.
+**
+*************************************************************************
+**
+** This file implements an extension that uses the SQLITE_CONFIG_MALLOC
+** mechanism to add a tracing layer on top of SQLite.  If this extension
+** is registered prior to sqlite3_initialize(), it will cause all memory
+** allocation activities to be logged on standard output, or to some other
+** FILE specified by the initializer.
+**
+** This file needs to be compiled into the application that uses it.
+**
+** This extension is used to implement the --memtrace option of the
+** command-line shell.
+*/
+#include <assert.h>
+#include <string.h>
+#include <stdio.h>
+
+/* The original memory allocation routines */
+static sqlite3_mem_methods memtraceBase;
+static FILE *memtraceOut;
+
+/* Methods that trace memory allocations */
+static void *memtraceMalloc(int n){
+  if( memtraceOut ){
+    fprintf(memtraceOut, "MEMTRACE: allocate %d bytes\n", 
+            memtraceBase.xRoundup(n));
+  }
+  return memtraceBase.xMalloc(n);
+}
+static void memtraceFree(void *p){
+  if( p==0 ) return;
+  if( memtraceOut ){
+    fprintf(memtraceOut, "MEMTRACE: free %d bytes\n", memtraceBase.xSize(p));
+  }
+  memtraceBase.xFree(p);
+}
+static void *memtraceRealloc(void *p, int n){
+  if( p==0 ) return memtraceMalloc(n);
+  if( n==0 ){
+    memtraceFree(p);
+    return 0;
+  }
+  if( memtraceOut ){
+    fprintf(memtraceOut, "MEMTRACE: resize %d -> %d bytes\n",
+            memtraceBase.xSize(p), memtraceBase.xRoundup(n));
+  }
+  return memtraceBase.xRealloc(p, n);
+}
+static int memtraceSize(void *p){
+  return memtraceBase.xSize(p);
+}
+static int memtraceRoundup(int n){
+  return memtraceBase.xRoundup(n);
+}
+static int memtraceInit(void *p){
+  return memtraceBase.xInit(p);
+}
+static void memtraceShutdown(void *p){
+  memtraceBase.xShutdown(p);
+}
+
+/* The substitute memory allocator */
+static sqlite3_mem_methods ersaztMethods = {
+  memtraceMalloc,
+  memtraceFree,
+  memtraceRealloc,
+  memtraceSize,
+  memtraceRoundup,
+  memtraceInit,
+  memtraceShutdown
+};
+
+/* Begin tracing memory allocations to out. */
+int sqlite3MemTraceActivate(FILE *out){
+  int rc = SQLITE_OK;
+  if( memtraceBase.xMalloc==0 ){
+    rc = sqlite3_config(SQLITE_CONFIG_GETMALLOC, &memtraceBase);
+    if( rc==SQLITE_OK ){
+      rc = sqlite3_config(SQLITE_CONFIG_MALLOC, &ersaztMethods);
+    }
+  }
+  memtraceOut = out;
+  return rc;
+}
+
+/* Deactivate memory tracing */
+int sqlite3MemTraceDeactivate(void){
+  int rc = SQLITE_OK;
+  if( memtraceBase.xMalloc!=0 ){
+    rc = sqlite3_config(SQLITE_CONFIG_MALLOC, &memtraceBase);
+    if( rc==SQLITE_OK ){
+      memset(&memtraceBase, 0, sizeof(memtraceBase));
+    }
+  }
+  memtraceOut = 0;
+  return rc;
+}

Index: ext/misc/mmapwarm.c
==================================================================
--- ext/misc/mmapwarm.c
+++ ext/misc/mmapwarm.c
@@ -103,6 +103,5 @@
     if( rc==SQLITE_OK ) rc = rc2;
   }
 
   return rc;
 }
-

Index: ext/misc/nextchar.c
==================================================================
--- ext/misc/nextchar.c
+++ ext/misc/nextchar.c
@@ -83,11 +83,11 @@
     if( p->aResult[i]==c ) return;
   }
   if( p->nUsed+1 > p->nAlloc ){
     unsigned int *aNew;
     int n = p->nAlloc*2 + 30;
-    aNew = sqlite3_realloc(p->aResult, n*sizeof(unsigned int));
+    aNew = sqlite3_realloc64(p->aResult, n*sizeof(unsigned int));
     if( aNew==0 ){
       p->mallocFailed = 1;
       return;
     }else{
       p->aResult = aNew;
@@ -267,11 +267,11 @@
   findNextChars(&c);
   if( c.mallocFailed ){
     sqlite3_result_error_nomem(context);
   }else{
     unsigned char *pRes;
-    pRes = sqlite3_malloc( c.nUsed*4 + 1 );
+    pRes = sqlite3_malloc64( c.nUsed*4 + 1 );
     if( pRes==0 ){
       sqlite3_result_error_nomem(context);
     }else{
       int i;
       int n = 0;

Index: ext/misc/percentile.c
==================================================================
--- ext/misc/percentile.c
+++ ext/misc/percentile.c
@@ -149,11 +149,11 @@
   }
 
   /* Allocate and store the Y */
   if( p->nUsed>=p->nAlloc ){
     unsigned n = p->nAlloc*2 + 250;
-    double *a = sqlite3_realloc(p->a, sizeof(double)*n);
+    double *a = sqlite3_realloc64(p->a, sizeof(double)*n);
     if( a==0 ){
       sqlite3_free(p->a);
       memset(p, 0, sizeof(*p));
       sqlite3_result_error_nomem(pCtx);
       return;

ADDED   ext/misc/prefixes.c
Index: ext/misc/prefixes.c
==================================================================
--- /dev/null
+++ ext/misc/prefixes.c
@@ -0,0 +1,317 @@
+/*
+** 2018-04-19
+**
+** The author disclaims copyright to this source code.  In place of
+** a legal notice, here is a blessing:
+**
+**    May you do good and not evil.
+**    May you find forgiveness for yourself and forgive others.
+**    May you share freely, never taking more than you give.
+**
+*************************************************************************
+**
+** This file implements a table-valued function:
+**
+**      prefixes('abcdefg')
+**
+** The function has a single (non-HIDDEN) column named prefix that takes
+** on all prefixes of the string in its argument, including an empty string
+** and the input string itself.  The order of prefixes is from longest
+** to shortest.
+*/
+#if !defined(SQLITEINT_H)
+#include "sqlite3ext.h"
+#endif
+SQLITE_EXTENSION_INIT1
+#include <string.h>
+#include <assert.h>
+
+/* prefixes_vtab is a subclass of sqlite3_vtab which is
+** underlying representation of the virtual table
+*/
+typedef struct prefixes_vtab prefixes_vtab;
+struct prefixes_vtab {
+  sqlite3_vtab base;  /* Base class - must be first */
+  /* No additional fields are necessary */
+};
+
+/* prefixes_cursor is a subclass of sqlite3_vtab_cursor which will
+** serve as the underlying representation of a cursor that scans
+** over rows of the result
+*/
+typedef struct prefixes_cursor prefixes_cursor;
+struct prefixes_cursor {
+  sqlite3_vtab_cursor base;  /* Base class - must be first */
+  sqlite3_int64 iRowid;      /* The rowid */
+  char *zStr;                /* Original string to be prefixed */
+  int nStr;                  /* Length of the string in bytes */
+};
+
+/*
+** The prefixesConnect() method is invoked to create a new
+** template virtual table.
+**
+** Think of this routine as the constructor for prefixes_vtab objects.
+**
+** All this routine needs to do is:
+**
+**    (1) Allocate the prefixes_vtab object and initialize all fields.
+**
+**    (2) Tell SQLite (via the sqlite3_declare_vtab() interface) what the
+**        result set of queries against the virtual table will look like.
+*/
+static int prefixesConnect(
+  sqlite3 *db,
+  void *pAux,
+  int argc, const char *const*argv,
+  sqlite3_vtab **ppVtab,
+  char **pzErr
+){
+  prefixes_vtab *pNew;
+  int rc;
+
+  rc = sqlite3_declare_vtab(db,
+           "CREATE TABLE prefixes(prefix TEXT, original_string TEXT HIDDEN)"
+       );
+  if( rc==SQLITE_OK ){
+    pNew = sqlite3_malloc( sizeof(*pNew) );
+    *ppVtab = (sqlite3_vtab*)pNew;
+    if( pNew==0 ) return SQLITE_NOMEM;
+    memset(pNew, 0, sizeof(*pNew));
+  }
+  return rc;
+}
+
+/*
+** This method is the destructor for prefixes_vtab objects.
+*/
+static int prefixesDisconnect(sqlite3_vtab *pVtab){
+  prefixes_vtab *p = (prefixes_vtab*)pVtab;
+  sqlite3_free(p);
+  return SQLITE_OK;
+}
+
+/*
+** Constructor for a new prefixes_cursor object.
+*/
+static int prefixesOpen(sqlite3_vtab *p, sqlite3_vtab_cursor **ppCursor){
+  prefixes_cursor *pCur;
+  pCur = sqlite3_malloc( sizeof(*pCur) );
+  if( pCur==0 ) return SQLITE_NOMEM;
+  memset(pCur, 0, sizeof(*pCur));
+  *ppCursor = &pCur->base;
+  return SQLITE_OK;
+}
+
+/*
+** Destructor for a prefixes_cursor.
+*/
+static int prefixesClose(sqlite3_vtab_cursor *cur){
+  prefixes_cursor *pCur = (prefixes_cursor*)cur;
+  sqlite3_free(pCur->zStr);
+  sqlite3_free(pCur);
+  return SQLITE_OK;
+}
+
+
+/*
+** Advance a prefixes_cursor to its next row of output.
+*/
+static int prefixesNext(sqlite3_vtab_cursor *cur){
+  prefixes_cursor *pCur = (prefixes_cursor*)cur;
+  pCur->iRowid++;
+  return SQLITE_OK;
+}
+
+/*
+** Return values of columns for the row at which the prefixes_cursor
+** is currently pointing.
+*/
+static int prefixesColumn(
+  sqlite3_vtab_cursor *cur,   /* The cursor */
+  sqlite3_context *ctx,       /* First argument to sqlite3_result_...() */
+  int i                       /* Which column to return */
+){
+  prefixes_cursor *pCur = (prefixes_cursor*)cur;
+  switch( i ){
+    case 0:
+      sqlite3_result_text(ctx, pCur->zStr, pCur->nStr - (int)pCur->iRowid,
+                          0); 
+      break;
+    default:
+      sqlite3_result_text(ctx, pCur->zStr, pCur->nStr, 0);
+      break;
+  }
+  return SQLITE_OK;
+}
+
+/*
+** Return the rowid for the current row.  In this implementation, the
+** rowid is the same as the output value.
+*/
+static int prefixesRowid(sqlite3_vtab_cursor *cur, sqlite_int64 *pRowid){
+  prefixes_cursor *pCur = (prefixes_cursor*)cur;
+  *pRowid = pCur->iRowid;
+  return SQLITE_OK;
+}
+
+/*
+** Return TRUE if the cursor has been moved off of the last
+** row of output.
+*/
+static int prefixesEof(sqlite3_vtab_cursor *cur){
+  prefixes_cursor *pCur = (prefixes_cursor*)cur;
+  return pCur->iRowid>pCur->nStr;
+}
+
+/*
+** This method is called to "rewind" the prefixes_cursor object back
+** to the first row of output.  This method is always called at least
+** once prior to any call to prefixesColumn() or prefixesRowid() or 
+** prefixesEof().
+*/
+static int prefixesFilter(
+  sqlite3_vtab_cursor *pVtabCursor, 
+  int idxNum, const char *idxStr,
+  int argc, sqlite3_value **argv
+){
+  prefixes_cursor *pCur = (prefixes_cursor *)pVtabCursor;
+  sqlite3_free(pCur->zStr);
+  if( argc>0 ){
+    pCur->zStr = sqlite3_mprintf("%s", sqlite3_value_text(argv[0]));
+    pCur->nStr = pCur->zStr ? (int)strlen(pCur->zStr) : 0;
+  }else{
+    pCur->zStr = 0;
+    pCur->nStr = 0;
+  }
+  pCur->iRowid = 0;
+  return SQLITE_OK;
+}
+
+/*
+** SQLite will invoke this method one or more times while planning a query
+** that uses the virtual table.  This routine needs to create
+** a query plan for each invocation and compute an estimated cost for that
+** plan.
+*/
+static int prefixesBestIndex(
+  sqlite3_vtab *tab,
+  sqlite3_index_info *pIdxInfo
+){
+  /* Search for a usable equality constraint against column 1 
+  ** (original_string) and use it if at all possible */
+  int i;
+  const struct sqlite3_index_constraint *p;
+
+  for(i=0, p=pIdxInfo->aConstraint; i<pIdxInfo->nConstraint; i++, p++){
+    if( p->iColumn!=1 ) continue;
+    if( p->op!=SQLITE_INDEX_CONSTRAINT_EQ ) continue;
+    if( !p->usable ) continue;
+    pIdxInfo->aConstraintUsage[i].argvIndex = 1;
+    pIdxInfo->aConstraintUsage[i].omit = 1;
+    pIdxInfo->estimatedCost = (double)10;
+    pIdxInfo->estimatedRows = 10;
+    return SQLITE_OK;
+  }
+  pIdxInfo->estimatedCost = (double)1000000000;
+  pIdxInfo->estimatedRows = 1000000000;
+  return SQLITE_OK;
+}
+
+/*
+** This following structure defines all the methods for the 
+** virtual table.
+*/
+static sqlite3_module prefixesModule = {
+  /* iVersion    */ 0,
+  /* xCreate     */ 0,
+  /* xConnect    */ prefixesConnect,
+  /* xBestIndex  */ prefixesBestIndex,
+  /* xDisconnect */ prefixesDisconnect,
+  /* xDestroy    */ 0,
+  /* xOpen       */ prefixesOpen,
+  /* xClose      */ prefixesClose,
+  /* xFilter     */ prefixesFilter,
+  /* xNext       */ prefixesNext,
+  /* xEof        */ prefixesEof,
+  /* xColumn     */ prefixesColumn,
+  /* xRowid      */ prefixesRowid,
+  /* xUpdate     */ 0,
+  /* xBegin      */ 0,
+  /* xSync       */ 0,
+  /* xCommit     */ 0,
+  /* xRollback   */ 0,
+  /* xFindMethod */ 0,
+  /* xRename     */ 0,
+  /* xSavepoint  */ 0,
+  /* xRelease    */ 0,
+  /* xRollbackTo */ 0,
+  /* xShadowName */ 0
+};
+
+/*
+** This is a copy of the SQLITE_SKIP_UTF8(zIn) macro in sqliteInt.h.
+**
+** Assuming zIn points to the first byte of a UTF-8 character,
+** advance zIn to point to the first byte of the next UTF-8 character.
+*/
+#define PREFIX_SKIP_UTF8(zIn) {                        \
+  if( (*(zIn++))>=0xc0 ){                              \
+    while( (*zIn & 0xc0)==0x80 ){ zIn++; }             \
+  }                                                    \
+}
+
+/*
+** Implementation of function prefix_length(). This function accepts two
+** strings as arguments and returns the length in characters (not bytes), 
+** of the longest prefix shared by the two strings. For example:
+**
+**   prefix_length('abcdxxx', 'abcyy') == 3
+**   prefix_length('abcdxxx', 'bcyyy') == 0
+**   prefix_length('abcdxxx', 'ab')    == 2
+**   prefix_length('ab',      'abcd')  == 2
+**
+** This function assumes the input is well-formed utf-8. If it is not,
+** it is possible for this function to return -1.
+*/
+static void prefixLengthFunc(
+  sqlite3_context *ctx,
+  int nVal,
+  sqlite3_value **apVal
+){
+  int nByte;                      /* Number of bytes to compare */
+  int nRet = 0;                   /* Return value */
+  const unsigned char *zL = sqlite3_value_text(apVal[0]);
+  const unsigned char *zR = sqlite3_value_text(apVal[1]);
+  int nL = sqlite3_value_bytes(apVal[0]);
+  int nR = sqlite3_value_bytes(apVal[1]);
+  int i;
+
+  nByte = (nL > nR ? nL : nR);
+  for(i=0; i<nByte; i++){
+    if( zL[i]!=zR[i] ) break;
+    if( (zL[i] & 0xC0)!=0x80 ) nRet++;
+  }
+
+  if( (zL[i] & 0xC0)==0x80 ) nRet--;
+  sqlite3_result_int(ctx, nRet);
+}
+
+#ifdef _WIN32
+__declspec(dllexport)
+#endif
+int sqlite3_prefixes_init(
+  sqlite3 *db, 
+  char **pzErrMsg, 
+  const sqlite3_api_routines *pApi
+){
+  int rc = SQLITE_OK;
+  SQLITE_EXTENSION_INIT2(pApi);
+  rc = sqlite3_create_module(db, "prefixes", &prefixesModule, 0);
+  if( rc==SQLITE_OK ){
+    rc = sqlite3_create_function(
+        db, "prefix_length", 2, SQLITE_UTF8, 0, prefixLengthFunc, 0, 0
+    );
+  }
+  return rc;
+}

Index: ext/misc/regexp.c
==================================================================
--- ext/misc/regexp.c
+++ ext/misc/regexp.c
@@ -223,11 +223,11 @@
 
   if( pRe->nState<=(sizeof(aSpace)/(sizeof(aSpace[0])*2)) ){
     pToFree = 0;
     aStateSet[0].aState = aSpace;
   }else{
-    pToFree = sqlite3_malloc( sizeof(ReStateNumber)*2*pRe->nState );
+    pToFree = sqlite3_malloc64( sizeof(ReStateNumber)*2*pRe->nState );
     if( pToFree==0 ) return -1;
     aStateSet[0].aState = pToFree;
   }
   aStateSet[1].aState = &aStateSet[0].aState[pRe->nState];
   pNext = &aStateSet[1];
@@ -335,14 +335,14 @@
 /* Resize the opcode and argument arrays for an RE under construction.
 */
 static int re_resize(ReCompiled *p, int N){
   char *aOp;
   int *aArg;
-  aOp = sqlite3_realloc(p->aOp, N*sizeof(p->aOp[0]));
+  aOp = sqlite3_realloc64(p->aOp, N*sizeof(p->aOp[0]));
   if( aOp==0 ) return 1;
   p->aOp = aOp;
-  aArg = sqlite3_realloc(p->aArg, N*sizeof(p->aArg[0]));
+  aArg = sqlite3_realloc64(p->aArg, N*sizeof(p->aArg[0]));
   if( aArg==0 ) return 1;
   p->aArg = aArg;
   p->nAlloc = N;
   return 0;
 }

Index: ext/misc/series.c
==================================================================
--- ext/misc/series.c
+++ ext/misc/series.c
@@ -311,48 +311,49 @@
 */
 static int seriesBestIndex(
   sqlite3_vtab *tab,
   sqlite3_index_info *pIdxInfo
 ){
-  int i;                 /* Loop over constraints */
-  int idxNum = 0;        /* The query plan bitmask */
-  int startIdx = -1;     /* Index of the start= constraint, or -1 if none */
-  int stopIdx = -1;      /* Index of the stop= constraint, or -1 if none */
-  int stepIdx = -1;      /* Index of the step= constraint, or -1 if none */
-  int nArg = 0;          /* Number of arguments that seriesFilter() expects */
-
-  const struct sqlite3_index_constraint *pConstraint;
+  int i, j;              /* Loop over constraints */
+  int idxNum = 0;        /* The query plan bitmask */
+  int unusableMask = 0;  /* Mask of unusable constraints */
+  int nArg = 0;          /* Number of arguments that seriesFilter() expects */
+  int aIdx[3];           /* Constraints on start, stop, and step */
+  const struct sqlite3_index_constraint *pConstraint;
+
+  /* This implementation assumes that the start, stop, and step columns
+  ** are the last three columns in the virtual table. */
+  assert( SERIES_COLUMN_STOP == SERIES_COLUMN_START+1 );
+  assert( SERIES_COLUMN_STEP == SERIES_COLUMN_START+2 );
+  aIdx[0] = aIdx[1] = aIdx[2] = -1;
   pConstraint = pIdxInfo->aConstraint;
   for(i=0; i<pIdxInfo->nConstraint; i++, pConstraint++){
-    if( pConstraint->usable==0 ) continue;
-    if( pConstraint->op!=SQLITE_INDEX_CONSTRAINT_EQ ) continue;
-    switch( pConstraint->iColumn ){
-      case SERIES_COLUMN_START:
-        startIdx = i;
-        idxNum |= 1;
-        break;
-      case SERIES_COLUMN_STOP:
-        stopIdx = i;
-        idxNum |= 2;
-        break;
-      case SERIES_COLUMN_STEP:
-        stepIdx = i;
-        idxNum |= 4;
-        break;
-    }
-  }
-  if( startIdx>=0 ){
-    pIdxInfo->aConstraintUsage[startIdx].argvIndex = ++nArg;
-    pIdxInfo->aConstraintUsage[startIdx].omit= !SQLITE_SERIES_CONSTRAINT_VERIFY;
-  }
-  if( stopIdx>=0 ){
-    pIdxInfo->aConstraintUsage[stopIdx].argvIndex = ++nArg;
-    pIdxInfo->aConstraintUsage[stopIdx].omit = !SQLITE_SERIES_CONSTRAINT_VERIFY;
-  }
-  if( stepIdx>=0 ){
-    pIdxInfo->aConstraintUsage[stepIdx].argvIndex = ++nArg;
-    pIdxInfo->aConstraintUsage[stepIdx].omit = !SQLITE_SERIES_CONSTRAINT_VERIFY;
+    int iCol;    /* 0 for start, 1 for stop, 2 for step */
+    int iMask;   /* bitmask for those column */
+    if( pConstraint->iColumn<SERIES_COLUMN_START ) continue;
+    iCol = pConstraint->iColumn - SERIES_COLUMN_START;
+    assert( iCol>=0 && iCol<=2 );
+    iMask = 1 << iCol;
+    if( pConstraint->usable==0 ){
+      unusableMask |=  iMask;
+      continue;
+    }else if( pConstraint->op==SQLITE_INDEX_CONSTRAINT_EQ ){
+      idxNum |= iMask;
+      aIdx[iCol] = i;
+    }
+  }
+  for(i=0; i<3; i++){
+    if( (j = aIdx[i])>=0 ){
+      pIdxInfo->aConstraintUsage[j].argvIndex = ++nArg;
+      pIdxInfo->aConstraintUsage[j].omit = !SQLITE_SERIES_CONSTRAINT_VERIFY;
+    }
+  }
+  if( (unusableMask & ~idxNum)!=0 ){
+    /* The start, stop, and step columns are inputs.  Therefore if there
+    ** are unusable constraints on any of start, stop, or step then
+    ** this plan is unusable */
+    return SQLITE_CONSTRAINT;
   }
   if( (idxNum & 3)==3 ){
     /* Both start= and stop= boundaries are available.  This is the 
     ** the preferred case */
     pIdxInfo->estimatedCost = (double)(2 - ((idxNum&4)!=0));
@@ -363,11 +364,10 @@
     }
   }else{
     /* If either boundary is missing, we have to generate a huge span
     ** of numbers.  Make this case very expensive so that the query
     ** planner will work hard to avoid it. */
-    pIdxInfo->estimatedCost = (double)2147483647;
     pIdxInfo->estimatedRows = 2147483647;
   }
   pIdxInfo->idxNum = idxNum;
   return SQLITE_OK;
 }

Index: ext/misc/stmt.c
==================================================================
--- ext/misc/stmt.c
+++ ext/misc/stmt.c
@@ -264,10 +264,11 @@
   0,                         /* xFindMethod */
   0,                         /* xRename */
   0,                         /* xSavepoint */
   0,                         /* xRelease */
   0,                         /* xRollbackTo */
+  0,                         /* xShadowName */
 };
 
 #endif /* SQLITE_OMIT_VIRTUALTABLE */
 
 int sqlite3StmtVtabInit(sqlite3 *db){

Index: ext/misc/templatevtab.c
==================================================================
--- ext/misc/templatevtab.c
+++ ext/misc/templatevtab.c
@@ -246,11 +246,12 @@
   /* xRollback   */ 0,
   /* xFindMethod */ 0,
   /* xRename     */ 0,
   /* xSavepoint  */ 0,
   /* xRelease    */ 0,
-  /* xRollbackTo */ 0
+  /* xRollbackTo */ 0,
+  /* xShadowName */ 0
 };
 
 
 #ifdef _WIN32
 __declspec(dllexport)

Index: ext/misc/unionvtab.c
==================================================================
--- ext/misc/unionvtab.c
+++ ext/misc/unionvtab.c
@@ -248,15 +248,15 @@
 ** always returns NULL. Otherwise, it attempts to allocate and return
 ** a pointer to nByte bytes of zeroed memory. If the memory allocation
 ** is attempted but fails, NULL is returned and *pRc is set to 
 ** SQLITE_NOMEM.
 */
-static void *unionMalloc(int *pRc, int nByte){
+static void *unionMalloc(int *pRc, sqlite3_int64 nByte){
   void *pRet;
   assert( nByte>0 );
   if( *pRc==SQLITE_OK ){
-    pRet = sqlite3_malloc(nByte);
+    pRet = sqlite3_malloc64(nByte);
     if( pRet ){
       memset(pRet, 0, nByte);
     }else{
       *pRc = SQLITE_NOMEM;
     }
@@ -274,11 +274,11 @@
 ** set to SQLITE_NOMEM.
 */
 static char *unionStrdup(int *pRc, const char *zIn){
   char *zRet = 0;
   if( zIn ){
-    int nByte = (int)strlen(zIn) + 1;
+    sqlite3_int64 nByte = strlen(zIn) + 1;
     zRet = unionMalloc(pRc, nByte);
     if( zRet ){
       memcpy(zRet, zIn, nByte);
     }
   }
@@ -937,11 +937,11 @@
       UnionSrc *pSrc;
 
       /* Grow the pTab->aSrc[] array if required. */
       if( nAlloc<=pTab->nSrc ){
         int nNew = nAlloc ? nAlloc*2 : 8;
-        UnionSrc *aNew = (UnionSrc*)sqlite3_realloc(
+        UnionSrc *aNew = (UnionSrc*)sqlite3_realloc64(
             pTab->aSrc, nNew*sizeof(UnionSrc)
         );
         if( aNew==0 ){
           rc = SQLITE_NOMEM;
           break;
@@ -1348,11 +1348,12 @@
     0,                            /* xRollback */
     0,                            /* xFindMethod */
     0,                            /* xRename */
     0,                            /* xSavepoint */
     0,                            /* xRelease */
-    0                             /* xRollbackTo */
+    0,                            /* xRollbackTo */
+    0                             /* xShadowName */
   };
   int rc;
 
   rc = sqlite3_create_module(db, "unionvtab", &unionModule, 0);
   if( rc==SQLITE_OK ){

Index: ext/misc/vfslog.c
==================================================================
--- ext/misc/vfslog.c
+++ ext/misc/vfslog.c
@@ -274,11 +274,11 @@
     isJournal = 1;
   }else if( nName>12 
          && sqlite3_strglob("-mj??????9??", zFilename+nName-12)==0 ){
     return 0;  /* Do not log master journal files */
   }
-  pTemp = sqlite3_malloc( sizeof(*pLog)*2 + nName + 60 );
+  pTemp = sqlite3_malloc64( sizeof(*pLog)*2 + nName + 60 );
   if( pTemp==0 ) return 0;
   pMutex = sqlite3_mutex_alloc(SQLITE_MUTEX_STATIC_MASTER);
   sqlite3_mutex_enter(pMutex);
   for(pLog=allLogs; pLog; pLog=pLog->pNext){
     if( pLog->nFilename==nName && !memcmp(pLog->zFilename, zFilename, nName) ){

Index: ext/misc/vtablog.c
==================================================================
--- ext/misc/vtablog.c
+++ ext/misc/vtablog.c
@@ -490,10 +490,11 @@
   0,                         /* xFindMethod */
   0,                         /* xRename */
   0,                         /* xSavepoint */
   0,                         /* xRelease */
   0,                         /* xRollbackTo */
+  0,                         /* xShadowName */
 };
 
 #ifdef _WIN32
 __declspec(dllexport)
 #endif

Index: ext/misc/zipfile.c
==================================================================
--- ext/misc/zipfile.c
+++ ext/misc/zipfile.c
@@ -356,11 +356,11 @@
     nFile = (int)strlen(zFile)+1;
   }
 
   rc = sqlite3_declare_vtab(db, ZIPFILE_SCHEMA);
   if( rc==SQLITE_OK ){
-    pNew = (ZipfileTab*)sqlite3_malloc(nByte+nFile);
+    pNew = (ZipfileTab*)sqlite3_malloc64((sqlite3_int64)nByte+nFile);
     if( pNew==0 ) return SQLITE_NOMEM;
     memset(pNew, 0, nByte+nFile);
     pNew->db = db;
     pNew->aBuffer = (u8*)&pNew[1];
     if( zFile ){
@@ -804,11 +804,11 @@
   }else{
     aRead = (u8*)&aBlob[iOff];
   }
 
   if( rc==SQLITE_OK ){
-    int nAlloc;
+    sqlite3_int64 nAlloc;
     ZipfileEntry *pNew;
 
     int nFile = zipfileGetU16(&aRead[ZIPFILE_CDS_NFILE_OFF]);
     int nExtra = zipfileGetU16(&aRead[ZIPFILE_CDS_NFILE_OFF+2]);
     nExtra += zipfileGetU16(&aRead[ZIPFILE_CDS_NFILE_OFF+4]);
@@ -816,11 +816,11 @@
     nAlloc = sizeof(ZipfileEntry) + nExtra;
     if( aBlob ){
       nAlloc += zipfileGetU32(&aRead[ZIPFILE_CDS_SZCOMPRESSED_OFF]);
     }
 
-    pNew = (ZipfileEntry*)sqlite3_malloc(nAlloc);
+    pNew = (ZipfileEntry*)sqlite3_malloc64(nAlloc);
     if( pNew==0 ){
       rc = SQLITE_NOMEM;
     }else{
       memset(pNew, 0, sizeof(ZipfileEntry));
       rc = zipfileReadCDS(aRead, &pNew->cds);
@@ -979,15 +979,15 @@
 static int zipfileDeflate(
   const u8 *aIn, int nIn,         /* Input */
   u8 **ppOut, int *pnOut,         /* Output */
   char **pzErr                    /* OUT: Error message */
 ){
-  int nAlloc = (int)compressBound(nIn);
+  sqlite3_int64 nAlloc = compressBound(nIn);
   u8 *aOut;
   int rc = SQLITE_OK;
 
-  aOut = (u8*)sqlite3_malloc(nAlloc);
+  aOut = (u8*)sqlite3_malloc64(nAlloc);
   if( aOut==0 ){
     rc = SQLITE_NOMEM;
   }else{
     int res;
     z_stream str;
@@ -1056,11 +1056,11 @@
           u8 *aBuf;
           u8 *aFree = 0;
           if( pCsr->pCurrent->aData ){
             aBuf = pCsr->pCurrent->aData;
           }else{
-            aBuf = aFree = sqlite3_malloc(sz);
+            aBuf = aFree = sqlite3_malloc64(sz);
             if( aBuf==0 ){
               rc = SQLITE_NOMEM;
             }else{
               FILE *pFile = pCsr->pFile;
               if( pFile==0 ){
@@ -1294,29 +1294,30 @@
 static int zipfileBestIndex(
   sqlite3_vtab *tab,
   sqlite3_index_info *pIdxInfo
 ){
   int i;
+  int idx = -1;
+  int unusable = 0;
 
   for(i=0; i<pIdxInfo->nConstraint; i++){
     const struct sqlite3_index_constraint *pCons = &pIdxInfo->aConstraint[i];
-    if( pCons->usable==0 ) continue;
-    if( pCons->op!=SQLITE_INDEX_CONSTRAINT_EQ ) continue;
     if( pCons->iColumn!=ZIPFILE_F_COLUMN_IDX ) continue;
-    break;
+    if( pCons->usable==0 ){
+      unusable = 1;
+    }else if( pCons->op==SQLITE_INDEX_CONSTRAINT_EQ ){
+      idx = i;
+    }
   }
-
-  if( i<pIdxInfo->nConstraint ){
-    pIdxInfo->aConstraintUsage[i].argvIndex = 1;
-    pIdxInfo->aConstraintUsage[i].omit = 1;
+  if( idx>=0 ){
+    pIdxInfo->aConstraintUsage[idx].argvIndex = 1;
+    pIdxInfo->aConstraintUsage[idx].omit = 1;
     pIdxInfo->estimatedCost = 1000.0;
     pIdxInfo->idxNum = 1;
-  }else{
-    pIdxInfo->estimatedCost = (double)(((sqlite3_int64)1) << 50);
-    pIdxInfo->idxNum = 0;
+  }else if( unusable ){
+    return SQLITE_CONSTRAINT;
   }
-
   return SQLITE_OK;
 }
 
 static ZipfileEntry *zipfileNewEntry(const char *zPath){
   ZipfileEntry *pNew;
@@ -1894,18 +1895,18 @@
 };
 
 static int zipfileBufferGrow(ZipfileBuffer *pBuf, int nByte){
   if( pBuf->n+nByte>pBuf->nAlloc ){
     u8 *aNew;
-    int nNew = pBuf->n ? pBuf->n*2 : 512;
+    sqlite3_int64 nNew = pBuf->n ? pBuf->n*2 : 512;
     int nReq = pBuf->n + nByte;
 
     while( nNew<nReq ) nNew = nNew*2;
-    aNew = sqlite3_realloc(pBuf->a, nNew);
+    aNew = sqlite3_realloc64(pBuf->a, nNew);
     if( aNew==0 ) return SQLITE_NOMEM;
     pBuf->a = aNew;
-    pBuf->nAlloc = nNew;
+    pBuf->nAlloc = (int)nNew;
   }
   return SQLITE_OK;
 }
 
 /*
@@ -2092,11 +2093,11 @@
 ** xFinalize() callback for zipfile aggregate function.
 */
 void zipfileFinal(sqlite3_context *pCtx){
   ZipfileCtx *p;
   ZipfileEOCD eocd;
-  int nZip;
+  sqlite3_int64 nZip;
   u8 *aZip;
 
   p = (ZipfileCtx*)sqlite3_aggregate_context(pCtx, sizeof(ZipfileCtx));
   if( p==0 ) return;
   if( p->nEntry>0 ){
@@ -2105,18 +2106,18 @@
     eocd.nEntryTotal = (u16)p->nEntry;
     eocd.nSize = p->cds.n;
     eocd.iOffset = p->body.n;
 
     nZip = p->body.n + p->cds.n + ZIPFILE_EOCD_FIXED_SZ;
-    aZip = (u8*)sqlite3_malloc(nZip);
+    aZip = (u8*)sqlite3_malloc64(nZip);
     if( aZip==0 ){
       sqlite3_result_error_nomem(pCtx);
     }else{
       memcpy(aZip, p->body.a, p->body.n);
       memcpy(&aZip[p->body.n], p->cds.a, p->cds.n);
       zipfileSerializeEOCD(&eocd, &aZip[p->body.n + p->cds.n]);
-      sqlite3_result_blob(pCtx, aZip, nZip, zipfileFree);
+      sqlite3_result_blob(pCtx, aZip, (int)nZip, zipfileFree);
     }
   }
 
   sqlite3_free(p->body.a);
   sqlite3_free(p->cds.a);

Index: ext/rbu/rbu1.test
==================================================================
--- ext/rbu/rbu1.test
+++ ext/rbu/rbu1.test
@@ -668,6 +668,5 @@
   eval $destroy_vfs
 }
 
 
 finish_test
-

Index: ext/rbu/rbu10.test
==================================================================
--- ext/rbu/rbu10.test
+++ ext/rbu/rbu10.test
@@ -183,6 +183,5 @@
   list [catch { apply_rbu $rbu } msg] $msg
 } {0 SQLITE_DONE}
 
 
 finish_test
-

Index: ext/rbu/rbu11.test
==================================================================
--- ext/rbu/rbu11.test
+++ ext/rbu/rbu11.test
@@ -193,6 +193,5 @@
 do_test 4.7.2 {
   list [catch {rbu close} msg] $msg
 } {1 {SQLITE_ERROR - rbu_state mismatch error}}
 
 finish_test
-

Index: ext/rbu/rbu12.test
==================================================================
--- ext/rbu/rbu12.test
+++ ext/rbu/rbu12.test
@@ -230,6 +230,5 @@
   } [list $V1 $V2]
 
 }
 
 finish_test
-

Index: ext/rbu/rbu13.test
==================================================================
--- ext/rbu/rbu13.test
+++ ext/rbu/rbu13.test
@@ -60,6 +60,5 @@
   a == ( (b<<6) + (c<<5) + (d<<4) + (e<<3) + (f<<2) + (g<<1) + (h<<0) )
 } {128}
 
 
 finish_test
-

Index: ext/rbu/rbu14.test
==================================================================
--- ext/rbu/rbu14.test
+++ ext/rbu/rbu14.test
@@ -90,6 +90,5 @@
   integrity_check $tn.4
 }
 
 
 finish_test
-

Index: ext/rbu/rbu3.test
==================================================================
--- ext/rbu/rbu3.test
+++ ext/rbu/rbu3.test
@@ -201,7 +201,5 @@
 } 1
 
 do_test 6.1 { sqlite3rbu_internal_test } {}
 
 finish_test
-
-

Index: ext/rbu/rbu5.test
==================================================================
--- ext/rbu/rbu5.test
+++ ext/rbu/rbu5.test
@@ -298,9 +298,5 @@
   }
 }
 
 
 finish_test
-
-
-
-

Index: ext/rbu/rbu6.test
==================================================================
--- ext/rbu/rbu6.test
+++ ext/rbu/rbu6.test
@@ -98,6 +98,5 @@
   } {1 t1 5 hello}
 }
 
 
 finish_test
-

Index: ext/rbu/rbu7.test
==================================================================
--- ext/rbu/rbu7.test
+++ ext/rbu/rbu7.test
@@ -104,7 +104,5 @@
     3 2 f
   }
 }
 
 finish_test
-
-

Index: ext/rbu/rbu8.test
==================================================================
--- ext/rbu/rbu8.test
+++ ext/rbu/rbu8.test
@@ -70,6 +70,5 @@
 }
 integrity_check 1.3.3
 
 
 finish_test
-

Index: ext/rbu/rbu9.test
==================================================================
--- ext/rbu/rbu9.test
+++ ext/rbu/rbu9.test
@@ -123,6 +123,5 @@
   integrity_check 2.$tn.4
 }
 
 
 finish_test
-

Index: ext/rbu/rbuA.test
==================================================================
--- ext/rbu/rbuA.test
+++ ext/rbu/rbuA.test
@@ -78,6 +78,5 @@
   list [catch { rbu close } msg] $msg
 } {1 {SQLITE_ERROR - cannot update wal mode database}}
 
 
 finish_test
-

Index: ext/rbu/rbuB.test
==================================================================
--- ext/rbu/rbuB.test
+++ ext/rbu/rbuB.test
@@ -57,6 +57,5 @@
 db close
 sqlite3_shutdown
 test_sqlite3_log 
 sqlite3_initialize
 finish_test
-

Index: ext/rbu/rbuC.test
==================================================================
--- ext/rbu/rbuC.test
+++ ext/rbu/rbuC.test
@@ -137,6 +137,5 @@
 }
 
 
 
 finish_test
-

Index: ext/rbu/rbu_common.tcl
==================================================================
--- ext/rbu/rbu_common.tcl
+++ ext/rbu/rbu_common.tcl
@@ -84,25 +84,26 @@
     tmpdb close
   }
   set rc
 }
 
-proc do_rbu_vacuum_test {tn step} {
-  forcedelete state.db
-  uplevel [list do_test $tn.1 {
-    if {$step==0} { sqlite3rbu_vacuum rbu test.db state.db }
+proc do_rbu_vacuum_test {tn step {statedb state.db}} {
+  forcedelete $statedb
+  if {$statedb=="" && $step==1} breakpoint
+  uplevel [list do_test $tn.1 [string map [list %state% $statedb] {
+    if {$step==0} { sqlite3rbu_vacuum rbu test.db {%state%}}
     while 1 {
-      if {$step==1} { sqlite3rbu_vacuum rbu test.db state.db }
+      if {$step==1} { sqlite3rbu_vacuum rbu test.db {%state%}}
       set state [rbu state]
       check_prestep_state test.db $state
       set rc [rbu step]
       check_poststep_state $rc test.db $state
       if {$rc!="SQLITE_OK"} break
       if {$step==1} { rbu close }
     }
     rbu close
-  } {SQLITE_DONE}]
+  }] {SQLITE_DONE}]
 
   uplevel [list do_execsql_test $tn.2 {
     PRAGMA integrity_check
   } ok]
 }

Index: ext/rbu/rbucollate.test
==================================================================
--- ext/rbu/rbucollate.test
+++ ext/rbu/rbucollate.test
@@ -58,6 +58,5 @@
   db eval { SELECT * FROM t1 }
 } {a one 1 b two 2 c three 3}
 
 #forcedelete testrbu.db
 finish_test
-

Index: ext/rbu/rbucrash.test
==================================================================
--- ext/rbu/rbucrash.test
+++ ext/rbu/rbucrash.test
@@ -143,6 +143,5 @@
     do_rbu_crash_test 2.pre=$nPre.step=$is $nPre $is
   }
 }
 
 finish_test
-

Index: ext/rbu/rbucrash2.test
==================================================================
--- ext/rbu/rbucrash2.test
+++ ext/rbu/rbucrash2.test
@@ -101,6 +101,5 @@
     rbu close
   }
 }
 
 finish_test
-

Index: ext/rbu/rbudiff.test
==================================================================
--- ext/rbu/rbudiff.test
+++ ext/rbu/rbudiff.test
@@ -298,6 +298,5 @@
   }
 }
 
 
 finish_test
-

Index: ext/rbu/rbudor.test
==================================================================
--- ext/rbu/rbudor.test
+++ ext/rbu/rbudor.test
@@ -54,6 +54,5 @@
 do_execsql_test 1.4 {
   SELECT * FROM t1 
 } [list 1 $bigA 2 $bigB]
 
 finish_test
-

Index: ext/rbu/rbufault.test
==================================================================
--- ext/rbu/rbufault.test
+++ ext/rbu/rbufault.test
@@ -232,6 +232,5 @@
     }
   }
 }
 
 finish_test
-

Index: ext/rbu/rbufault2.test
==================================================================
--- ext/rbu/rbufault2.test
+++ ext/rbu/rbufault2.test
@@ -53,6 +53,5 @@
 
 
 
 
 finish_test
-

Index: ext/rbu/rbufault3.test
==================================================================
--- ext/rbu/rbufault3.test
+++ ext/rbu/rbufault3.test
@@ -93,6 +93,5 @@
   }
 
 }
 
 finish_test
-

Index: ext/rbu/rbufault4.test
==================================================================
--- ext/rbu/rbufault4.test
+++ ext/rbu/rbufault4.test
@@ -61,6 +61,5 @@
 }
 
 
 
 finish_test
-

Index: ext/rbu/rbufts.test
==================================================================
--- ext/rbu/rbufts.test
+++ ext/rbu/rbufts.test
@@ -129,6 +129,5 @@
 } {1 {SQLITE_ERROR - SQL logic error]}}
 
 
 
 finish_test
-

Index: ext/rbu/rbumulti.test
==================================================================
--- ext/rbu/rbumulti.test
+++ ext/rbu/rbumulti.test
@@ -170,6 +170,5 @@
 
 }
 
 
 finish_test
-

Index: ext/rbu/rbuprogress.test
==================================================================
--- ext/rbu/rbuprogress.test
+++ ext/rbu/rbuprogress.test
@@ -414,6 +414,5 @@
   }
 }
 
 
 finish_test
-

Index: ext/rbu/rburesume.test
==================================================================
--- ext/rbu/rburesume.test
+++ ext/rbu/rburesume.test
@@ -249,6 +249,5 @@
   } {60 ok}
   db2 close
 }
 
 finish_test
-

Index: ext/rbu/rbusave.test
==================================================================
--- ext/rbu/rbusave.test
+++ ext/rbu/rbusave.test
@@ -100,6 +100,5 @@
   SELECT * FROM t1;
   SELECT * FROM t2;
 } {1 one 1 3 3 3 4 4 4 1 one 1 3 3 3 4 4 4}
 
 finish_test
-

Index: ext/rbu/rbusplit.test
==================================================================
--- ext/rbu/rbusplit.test
+++ ext/rbu/rbusplit.test
@@ -90,6 +90,5 @@
     9 9 9
   }
 }
 
 finish_test
-

Index: ext/rbu/rbutemplimit.test
==================================================================
--- ext/rbu/rbutemplimit.test
+++ ext/rbu/rbutemplimit.test
@@ -124,6 +124,5 @@
   step_rbu_cachesize test.db test.db2 1000 10 1400000
 } {1 SQLITE_FULL}
 do_test 1.6.2 { info commands rbu } {}
 
 finish_test
-

Index: ext/rbu/rbuvacuum.test
==================================================================
--- ext/rbu/rbuvacuum.test
+++ ext/rbu/rbuvacuum.test
@@ -395,6 +395,5 @@
   list [catch { rbu close } msg] $msg
 } {0 SQLITE_DONE}
 
 catch { db close }
 finish_test
-

Index: ext/rbu/rbuvacuum2.test
==================================================================
--- ext/rbu/rbuvacuum2.test
+++ ext/rbu/rbuvacuum2.test
@@ -14,12 +14,15 @@
 # expected.
 #
 
 source [file join [file dirname [info script]] rbu_common.tcl]
 
-foreach step {0 1} {
-  set ::testprefix rbuvacuum2-$step
+foreach {step} {0 1} {
+foreach {ttt state} {
+  s state.db t test.db-vacuum n {}
+} {
+  set ::testprefix rbuvacuum2-$step$ttt
   
   #-------------------------------------------------------------------------
   # Test that a database that contains fts3 tables can be vacuumed.
   #
   ifcapable fts3 {
@@ -27,11 +30,11 @@
     do_execsql_test 1.1 {
       CREATE VIRTUAL TABLE t1 USING fts3(z, y);
       INSERT INTO t1 VALUES('fix this issue', 'at some point');
     }
   
-    do_rbu_vacuum_test 1.2 $step
+    do_rbu_vacuum_test 1.2 $step $state
   
     do_execsql_test 1.3 {
       SELECT * FROM t1;
     } {{fix this issue} {at some point}}
   
@@ -44,11 +47,11 @@
       INSERT INTO t1 VALUES('l h i', 'd e f');
       DELETE FROM t1 WHERE docid = 2;
       INSERT INTO t1 VALUES('a b c', 'x y z');
     }
 
-    do_rbu_vacuum_test 1.6 $step
+    do_rbu_vacuum_test 1.6 $step $state
     do_execsql_test 1.7 {
       INSERT INTO t1(t1) VALUES('integrity-check');
       SELECT * FROM t1;
     } {
       {fix this issue} {at some point}
@@ -65,11 +68,11 @@
     do_execsql_test 2.1 {
       CREATE VIRTUAL TABLE t1 USING fts5(z, y);
       INSERT INTO t1 VALUES('fix this issue', 'at some point');
     }
   
-    do_rbu_vacuum_test 2.2 $step
+    do_rbu_vacuum_test 2.2 $step $state
   
     do_execsql_test 2.3 {
       SELECT * FROM t1;
     } {{fix this issue} {at some point}}
   
@@ -82,11 +85,11 @@
       INSERT INTO t1 VALUES('l h i', 'd e f');
       DELETE FROM t1 WHERE rowid = 2;
       INSERT INTO t1 VALUES('a b c', 'x y z');
     }
 
-    do_rbu_vacuum_test 2.6 $step
+    do_rbu_vacuum_test 2.6 $step $state
     do_execsql_test 2.7 {
       INSERT INTO t1(t1) VALUES('integrity-check');
       SELECT * FROM t1;
     } {
       {fix this issue} {at some point}
@@ -105,11 +108,11 @@
       INSERT INTO rt VALUES(1, 45, 55);
       INSERT INTO rt VALUES(2, 50, 60);
       INSERT INTO rt VALUES(3, 55, 65);
     }
   
-    do_rbu_vacuum_test 3.2 $step
+    do_rbu_vacuum_test 3.2 $step $state
   
     do_execsql_test 3.3 {
       SELECT * FROM rt;
     } {1 45.0 55.0 2 50.0 60.0 3 55.0 65.0}
   
@@ -118,11 +121,11 @@
     } {1 2}
     do_execsql_test 3.4.2 {
       SELECT rowid FROM rt WHERE x2>59 AND x1 < 59
     } {2 3}
 
-    do_rbu_vacuum_test 3.5 $step
+    do_rbu_vacuum_test 3.5 $step $state
 
     do_execsql_test 3.6.1 {
       SELECT rowid FROM rt WHERE x2>51 AND x1 < 51
     } {1 2}
     do_execsql_test 3.6.2 {
@@ -145,19 +148,20 @@
     table t1 t1 2 {CREATE TABLE t1(a, b, c)}
     view v1 v1 0 {CREATE VIEW v1 AS SELECT * FROM t1}
     trigger tr1 t1 0 {CREATE TRIGGER tr1 AFTER INSERT ON t1 BEGIN SELECT 1; END}
     }
 
-    do_rbu_vacuum_test 4.3 $step
+    do_rbu_vacuum_test 4.3 $step $state
     do_execsql_test 4.4 {
       SELECT * FROM sqlite_master;
     } {
     table t1 t1 2 {CREATE TABLE t1(a, b, c)}
     view v1 v1 0 {CREATE VIEW v1 AS SELECT * FROM t1}
     trigger tr1 t1 0 {CREATE TRIGGER tr1 AFTER INSERT ON t1 BEGIN SELECT 1; END}
     }
   }
+}
 }
   
 #-------------------------------------------------------------------------
 # Test that passing a NULL value as the second argument to 
 # sqlite3rbu_vacuum() causes it to:
@@ -229,7 +233,11 @@
   while {[rbu step]!="SQLITE_DONE"} { rbu step }
   rbu close
   execsql { PRAGMA integrity_check }
 } {ok}
 
-finish_test
+do_test 6.4 {
+  sqlite3rbu_vacuum rbu test.db test.db-vactmp
+  list [catch { rbu close } msg] $msg
+} {1 SQLITE_MISUSE}
 
+finish_test

ADDED   ext/rbu/rbuvacuum3.test
Index: ext/rbu/rbuvacuum3.test
==================================================================
--- /dev/null
+++ ext/rbu/rbuvacuum3.test
@@ -0,0 +1,63 @@
+# 2019 Jan 3
+#
+# The author disclaims copyright to this source code.  In place of
+# a legal notice, here is a blessing:
+#
+#    May you do good and not evil.
+#    May you find forgiveness for yourself and forgive others.
+#    May you share freely, never taking more than you give.
+#
+#***********************************************************************
+#
+# This file contains tests for the RBU module. More specifically, it
+# contains tests to ensure that the sqlite3rbu_vacuum() API works as
+# expected.
+#
+
+source [file join [file dirname [info script]] rbu_common.tcl]
+set testprefix rbuvacuum3
+
+do_execsql_test 1.0 {
+  CREATE TABLE t1(a PRIMARY KEY, b, c);
+  CREATE INDEX i1b ON t1(b);
+  CREATE INDEX i1c ON t1(c);
+  
+  WITH s(i) AS (
+    VALUES(1) UNION ALL SELECT i+1 FROM s WHERE i<100
+  )
+  INSERT INTO t1 SELECT i, randomblob(100), randomblob(100) FROM s;
+}
+
+forcedelete state.db
+do_test 1.1 {
+  sqlite3rbu_vacuum rbu test.db state.db
+  while {1} {
+    set rc [rbu step]
+    if {$rc!="SQLITE_OK"} break
+    rbu savestate
+  }
+  rbu close
+} {SQLITE_DONE}
+
+do_test 1.2 {
+  sqlite3rbu_vacuum rbu test.db state.db
+  while {1} {
+    set rc [rbu step]
+    if {$rc!="SQLITE_OK"} break
+    rbu savestate
+  }
+  rbu close
+} {SQLITE_DONE}
+
+do_test 1.3 {
+  while {1} {
+    sqlite3rbu_vacuum rbu test.db state.db
+    set rc [rbu step]
+    if {$rc!="SQLITE_OK"} break
+    rbu savestate
+    rbu close
+  }
+  rbu close
+} {SQLITE_DONE}
+
+finish_test

Index: ext/rbu/sqlite3rbu.c
==================================================================
--- ext/rbu/sqlite3rbu.c
+++ ext/rbu/sqlite3rbu.c
@@ -2475,11 +2475,11 @@
           if( *zExtra++=='?' ) break;
         }
         if( *zExtra=='\0' ) zExtra = 0;
       }
 
-      zTarget = sqlite3_mprintf("file:%s-vacuum?rbu_memory=1%s%s", 
+      zTarget = sqlite3_mprintf("file:%s-vactmp?rbu_memory=1%s%s", 
           sqlite3_db_filename(p->dbRbu, "main"),
           (zExtra==0 ? "" : "&"), (zExtra==0 ? "" : zExtra)
       );
 
       if( zTarget==0 ){
@@ -3741,10 +3741,16 @@
 sqlite3rbu *sqlite3rbu_vacuum(
   const char *zTarget, 
   const char *zState
 ){
   if( zTarget==0 ){ return rbuMisuseError(); }
+  if( zState ){
+    int n = strlen(zState);
+    if( n>=7 && 0==memcmp("-vactmp", &zState[n-7], 7) ){
+      return rbuMisuseError();
+    }
+  }
   /* TODO: Check that both arguments are non-NULL */
   return openRbuHandle(0, zTarget, zState);
 }
 
 /*
@@ -3937,11 +3943,14 @@
   rc = p->rc;
 
   if( p->eStage==RBU_STAGE_OAL ){
     assert( rc!=SQLITE_DONE );
     if( rc==SQLITE_OK ) rc = sqlite3_exec(p->dbRbu, "COMMIT", 0, 0, 0);
-    if( rc==SQLITE_OK ) rc = sqlite3_exec(p->dbRbu, "BEGIN IMMEDIATE", 0, 0, 0);
+    if( rc==SQLITE_OK ){ 
+      const char *zBegin = rbuIsVacuum(p) ? "BEGIN" : "BEGIN IMMEDIATE";
+      rc = sqlite3_exec(p->dbRbu, zBegin, 0, 0, 0);
+    }
     if( rc==SQLITE_OK ) rc = sqlite3_exec(p->dbMain, "BEGIN IMMEDIATE", 0, 0,0);
   }
 
   p->rc = rc;
   return rc;

Index: ext/rbu/sqlite3rbu.h
==================================================================
--- ext/rbu/sqlite3rbu.h
+++ ext/rbu/sqlite3rbu.h
@@ -331,11 +331,15 @@
 **
 ** If the second argument passed to this function is NULL, then the
 ** name of the state database is "<database>-vacuum", where <database>
 ** is the name of the target database file. In this case, on UNIX, if the
 ** state database is not already present in the file-system, it is created
-** with the same permissions as the target db is made.
+** with the same permissions as the target db is made. 
+**
+** With an RBU vacuum, it is an SQLITE_MISUSE error if the name of the 
+** state database ends with "-vactmp". This name is reserved for internal 
+** use.
 **
 ** This function does not delete the state database after an RBU vacuum
 ** is completed, even if it created it. However, if the call to
 ** sqlite3rbu_close() returns any value other than SQLITE_OK, the contents
 ** of the state tables within the state database are zeroed. This way,

Index: ext/rbu/test_rbu.c
==================================================================
--- ext/rbu/test_rbu.c
+++ ext/rbu/test_rbu.c
@@ -271,10 +271,11 @@
     return TCL_ERROR;
   }
   zCmd = Tcl_GetString(objv[1]);
   zTarget = Tcl_GetString(objv[2]);
   if( objc==4 ) zStateDb = Tcl_GetString(objv[3]);
+  if( zStateDb && zStateDb[0]=='\0' ) zStateDb = 0;
 
   pRbu = sqlite3rbu_vacuum(zTarget, zStateDb);
   Tcl_CreateObjCommand(interp, zCmd, test_sqlite3rbu_cmd, (ClientData)pRbu, 0);
   Tcl_SetObjResult(interp, objv[1]);
   return TCL_OK;

Index: ext/repair/test/checkindex01.test
==================================================================
--- ext/repair/test/checkindex01.test
+++ ext/repair/test/checkindex01.test
@@ -345,7 +345,5 @@
   {} 1,1 {} 3,3
 }
 do_index_check_test 7.4 t7i4 {
   {} 1,1 {} 3,3
 }
-
-

Index: ext/rtree/geopoly.c
==================================================================
--- ext/rtree/geopoly.c
+++ ext/rtree/geopoly.c
@@ -121,10 +121,18 @@
 
 /* The size of a memory allocation needed for a GeoPoly object sufficient
 ** to hold N coordinate pairs.
 */
 #define GEOPOLY_SZ(N)  (sizeof(GeoPoly) + sizeof(GeoCoord)*2*((N)-4))
+
+/* Macros to access coordinates of a GeoPoly.
+** We have to use these macros, rather than just say p->a[i] in order
+** to silence (incorrect) UBSAN warnings if the array index is too large.
+*/
+#define GeoX(P,I)  (((GeoCoord*)(P)->a)[(I)*2])
+#define GeoY(P,I)  (((GeoCoord*)(P)->a)[(I)*2+1])
+
 
 /*
 ** State of a parse of a GeoJSON input.
 */
 typedef struct GeoParse GeoParse;
@@ -314,12 +322,13 @@
         int x = 1;
         p->nVertex = nVertex;
         memcpy(p->hdr, a, nByte);
         if( a[0] != *(unsigned char*)&x ){
           int ii;
-          for(ii=0; ii<nVertex*2; ii++){
-            geopolySwab32((unsigned char*)&p->a[ii]);
+          for(ii=0; ii<nVertex; ii++){
+            geopolySwab32((unsigned char*)&GeoX(p,ii));
+            geopolySwab32((unsigned char*)&GeoY(p,ii));
           }
           p->hdr[0] ^= 1;
         }
       }
     }
@@ -374,13 +383,13 @@
     sqlite3 *db = sqlite3_context_db_handle(context);
     sqlite3_str *x = sqlite3_str_new(db);
     int i;
     sqlite3_str_append(x, "[", 1);
     for(i=0; i<p->nVertex; i++){
-      sqlite3_str_appendf(x, "[%!g,%!g],", p->a[i*2], p->a[i*2+1]);
+      sqlite3_str_appendf(x, "[%!g,%!g],", GeoX(p,i), GeoY(p,i));
     }
-    sqlite3_str_appendf(x, "[%!g,%!g]]", p->a[0], p->a[1]);
+    sqlite3_str_appendf(x, "[%!g,%!g]]", GeoX(p,0), GeoY(p,0));
     sqlite3_result_text(context, sqlite3_str_finish(x), -1, sqlite3_free);
     sqlite3_free(p);
   }
 }
 
@@ -393,22 +402,24 @@
 static void geopolySvgFunc(
   sqlite3_context *context,
   int argc,
   sqlite3_value **argv
 ){
-  GeoPoly *p = geopolyFuncParam(context, argv[0], 0);
+  GeoPoly *p;
+  if( argc<1 ) return;
+  p = geopolyFuncParam(context, argv[0], 0);
   if( p ){
     sqlite3 *db = sqlite3_context_db_handle(context);
     sqlite3_str *x = sqlite3_str_new(db);
     int i;
     char cSep = '\'';
     sqlite3_str_appendf(x, "<polyline points=");
     for(i=0; i<p->nVertex; i++){
-      sqlite3_str_appendf(x, "%c%g,%g", cSep, p->a[i*2], p->a[i*2+1]);
+      sqlite3_str_appendf(x, "%c%g,%g", cSep, GeoX(p,i), GeoY(p,i));
       cSep = ' ';
     }
-    sqlite3_str_appendf(x, " %g,%g'", p->a[0], p->a[1]);
+    sqlite3_str_appendf(x, " %g,%g'", GeoX(p,0), GeoY(p,0));
     for(i=1; i<argc; i++){
       const char *z = (const char*)sqlite3_value_text(argv[i]);
       if( z && z[0] ){
         sqlite3_str_appendf(x, " %s", z);
       }
@@ -449,16 +460,16 @@
   double F = sqlite3_value_double(argv[6]);
   GeoCoord x1, y1, x0, y0;
   int ii;
   if( p ){
     for(ii=0; ii<p->nVertex; ii++){
-      x0 = p->a[ii*2];
-      y0 = p->a[ii*2+1];
+      x0 = GeoX(p,ii);
+      y0 = GeoY(p,ii);
       x1 = (GeoCoord)(A*x0 + B*y0 + E);
       y1 = (GeoCoord)(C*x0 + D*y0 + F);
-      p->a[ii*2] = x1;
-      p->a[ii*2+1] = y1;
+      GeoX(p,ii) = x1;
+      GeoY(p,ii) = y1;
     }
     sqlite3_result_blob(context, p->hdr, 
        4+8*p->nVertex, SQLITE_TRANSIENT);
     sqlite3_free(p);
   }
@@ -473,16 +484,16 @@
 */
 static double geopolyArea(GeoPoly *p){
   double rArea = 0.0;
   int ii;
   for(ii=0; ii<p->nVertex-1; ii++){
-    rArea += (p->a[ii*2] - p->a[ii*2+2])           /* (x0 - x1) */
-              * (p->a[ii*2+1] + p->a[ii*2+3])      /* (y0 + y1) */
+    rArea += (GeoX(p,ii) - GeoX(p,ii+1))           /* (x0 - x1) */
+              * (GeoY(p,ii) + GeoY(p,ii+1))        /* (y0 + y1) */
               * 0.5;
   }
-  rArea += (p->a[ii*2] - p->a[0])                  /* (xN - x0) */
-           * (p->a[ii*2+1] + p->a[1])              /* (yN + y0) */
+  rArea += (GeoX(p,ii) - GeoX(p,0))                /* (xN - x0) */
+           * (GeoY(p,ii) + GeoY(p,0))              /* (yN + y0) */
            * 0.5;
   return rArea;
 }
 
 /*
@@ -525,17 +536,17 @@
 ){
   GeoPoly *p = geopolyFuncParam(context, argv[0], 0);
   if( p ){
     if( geopolyArea(p)<0.0 ){
       int ii, jj;
-      for(ii=2, jj=p->nVertex*2 - 4; ii<jj; ii+=2, jj-=2){
-        GeoCoord t = p->a[ii];
-        p->a[ii] = p->a[jj];
-        p->a[jj] = t;
-        t = p->a[ii+1];
-        p->a[ii+1] = p->a[jj+1];
-        p->a[jj+1] = t;
+      for(ii=1, jj=p->nVertex-1; ii<jj; ii++, jj--){
+        GeoCoord t = GeoX(p,ii);
+        GeoX(p,ii) = GeoX(p,jj);
+        GeoX(p,jj) = t;
+        t = GeoY(p,ii);
+        GeoY(p,ii) = GeoY(p,jj);
+        GeoY(p,jj) = t;
       }
     }
     sqlite3_result_blob(context, p->hdr, 
        4+8*p->nVertex, SQLITE_TRANSIENT);
     sqlite3_free(p);
@@ -542,19 +553,19 @@
   }            
 }
 
 #define GEOPOLY_PI 3.1415926535897932385
 
-/* Fast approximation for cosine(X) for X between -0.5*pi and 2*pi
+/* Fast approximation for sine(X) for X between -0.5*pi and 2*pi
 */
-static double geopolyCosine(double r){
+static double geopolySine(double r){
   assert( r>=-0.5*GEOPOLY_PI && r<=2.0*GEOPOLY_PI );
   if( r>=1.5*GEOPOLY_PI ){
     r -= 2.0*GEOPOLY_PI;
   }
   if( r>=0.5*GEOPOLY_PI ){
-    return -geopolyCosine(r-GEOPOLY_PI);
+    return -geopolySine(r-GEOPOLY_PI);
   }else{
     double r2 = r*r;
     double r3 = r2*r;
     double r5 = r3*r2;
     return 0.9996949*r - 0.1656700*r3 + 0.0075134*r5;
@@ -591,12 +602,12 @@
   p->hdr[1] = 0;
   p->hdr[2] = (n>>8)&0xff;
   p->hdr[3] = n&0xff;
   for(i=0; i<n; i++){
     double rAngle = 2.0*GEOPOLY_PI*i/n;
-    p->a[i*2] = x - r*geopolyCosine(rAngle-0.5*GEOPOLY_PI);
-    p->a[i*2+1] = y + r*geopolyCosine(rAngle);
+    GeoX(p,i) = x - r*geopolySine(rAngle-0.5*GEOPOLY_PI);
+    GeoY(p,i) = y + r*geopolySine(rAngle);
   }
   sqlite3_result_blob(context, p->hdr, 4+8*n, SQLITE_TRANSIENT);
   sqlite3_free(p);
 }
 
@@ -629,17 +640,17 @@
   }else{
     p = geopolyFuncParam(context, pPoly, pRc);
   }
   if( p ){
     int ii;
-    mnX = mxX = p->a[0];
-    mnY = mxY = p->a[1];
+    mnX = mxX = GeoX(p,0);
+    mnY = mxY = GeoY(p,0);
     for(ii=1; ii<p->nVertex; ii++){
-      double r = p->a[ii*2];
+      double r = GeoX(p,ii);
       if( r<mnX ) mnX = (float)r;
       else if( r>mxX ) mxX = (float)r;
-      r = p->a[ii*2+1];
+      r = GeoY(p,ii);
       if( r<mnY ) mnY = (float)r;
       else if( r>mxY ) mxY = (float)r;
     }
     if( pRc ) *pRc = SQLITE_OK;
     if( aCoord==0 ){
@@ -655,18 +666,18 @@
       ii = 1;
       pOut->hdr[0] = *(unsigned char*)&ii;
       pOut->hdr[1] = 0;
       pOut->hdr[2] = 0;
       pOut->hdr[3] = 4;
-      pOut->a[0] = mnX;
-      pOut->a[1] = mnY;
-      pOut->a[2] = mxX;
-      pOut->a[3] = mnY;
-      pOut->a[4] = mxX;
-      pOut->a[5] = mxY;
-      pOut->a[6] = mnX;
-      pOut->a[7] = mxY;
+      GeoX(pOut,0) = mnX;
+      GeoY(pOut,0) = mnY;
+      GeoX(pOut,1) = mxX;
+      GeoY(pOut,1) = mnY;
+      GeoX(pOut,2) = mxX;
+      GeoY(pOut,2) = mxY;
+      GeoX(pOut,3) = mnX;
+      GeoY(pOut,3) = mxY;
     }else{
       sqlite3_free(p);
       aCoord[0].f = mnX;
       aCoord[1].f = mxX;
       aCoord[2].f = mnY;
@@ -800,18 +811,18 @@
   int v = 0;
   int cnt = 0;
   int ii;
   if( p1==0 ) return;
   for(ii=0; ii<p1->nVertex-1; ii++){
-    v = pointBeneathLine(x0,y0,p1->a[ii*2],p1->a[ii*2+1],
-                               p1->a[ii*2+2],p1->a[ii*2+3]);
+    v = pointBeneathLine(x0,y0,GeoX(p1,ii), GeoY(p1,ii),
+                               GeoX(p1,ii+1),GeoY(p1,ii+1));
     if( v==2 ) break;
     cnt += v;
   }
   if( v!=2 ){
-    v = pointBeneathLine(x0,y0,p1->a[ii*2],p1->a[ii*2+1],
-                               p1->a[0],p1->a[1]);
+    v = pointBeneathLine(x0,y0,GeoX(p1,ii), GeoY(p1,ii),
+                               GeoX(p1,0),  GeoY(p1,0));
   }
   if( v==2 ){
     sqlite3_result_int(context, 1);
   }else if( ((v+cnt)&1)==0 ){
     sqlite3_result_int(context, 0);
@@ -929,14 +940,14 @@
   unsigned char side      /* The side of pPoly */
 ){
   unsigned int i;
   GeoCoord *x;
   for(i=0; i<(unsigned)pPoly->nVertex-1; i++){
-    x = pPoly->a + (i*2);
+    x = &GeoX(pPoly,i);
     geopolyAddOneSegment(p, x[0], x[1], x[2], x[3], side, i);
   }
-  x = pPoly->a + (i*2);
+  x = &GeoX(pPoly,i);
   geopolyAddOneSegment(p, x[0], x[1], pPoly->a[0], pPoly->a[1], side, i);
 }
 
 /*
 ** Merge two lists of sorted events by X coordinate
@@ -1723,11 +1734,11 @@
   return 0;
 }
 
 
 static sqlite3_module geopolyModule = {
-  2,                          /* iVersion */
+  3,                          /* iVersion */
   geopolyCreate,              /* xCreate - create a table */
   geopolyConnect,             /* xConnect - connect to an existing table */
   geopolyBestIndex,           /* xBestIndex - Determine search strategy */
   rtreeDisconnect,            /* xDisconnect - Disconnect from a table */
   rtreeDestroy,               /* xDestroy - Drop a table */
@@ -1746,10 +1757,11 @@
   geopolyFindFunction,        /* xFindFunction - function overloading */
   rtreeRename,                /* xRename - rename the table */
   rtreeSavepoint,             /* xSavepoint */
   0,                          /* xRelease */
   0,                          /* xRollbackTo */
+  rtreeShadowName             /* xShadowName */
 };
 
 static int sqlite3_geopoly_init(sqlite3 *db){
   int rc = SQLITE_OK;
   static const struct {

Index: ext/rtree/rtree.c
==================================================================
--- ext/rtree/rtree.c
+++ ext/rtree/rtree.c
@@ -126,10 +126,13 @@
   u8 eCoordType;              /* RTREE_COORD_REAL32 or RTREE_COORD_INT32 */
   u8 nBytesPerCell;           /* Bytes consumed per cell */
   u8 inWrTrans;               /* True if inside write transaction */
   u8 nAux;                    /* # of auxiliary columns in %_rowid */
   u8 nAuxNotNull;             /* Number of initial not-null aux columns */
+#ifdef SQLITE_DEBUG
+  u8 bCorrupt;                /* Shadow table corruption detected */
+#endif
   int iDepth;                 /* Current depth of the r-tree structure */
   char *zDb;                  /* Name of database containing r-tree table */
   char *zName;                /* Name of r-tree table */ 
   u32 nBusy;                  /* Current number of users of this structure */
   i64 nRowEst;                /* Estimated number of rows in this table */
@@ -185,10 +188,19 @@
   typedef double RtreeDValue;              /* High accuracy coordinate */
   typedef float RtreeValue;                /* Low accuracy coordinate */
 # define RTREE_ZERO 0.0
 #endif
 
+/*
+** Set the Rtree.bCorrupt flag
+*/
+#ifdef SQLITE_DEBUG
+# define RTREE_IS_CORRUPT(X) ((X)->bCorrupt = 1)
+#else
+# define RTREE_IS_CORRUPT(X)
+#endif
+
 /*
 ** When doing a search of an r-tree, instances of the following structure
 ** record intermediate results from the tree walk.
 **
 ** The id is always a node-id.  For iLevel>=1 the id is the node-id of
@@ -551,12 +563,12 @@
 
 /*
 ** Given a node number iNode, return the corresponding key to use
 ** in the Rtree.aHash table.
 */
-static int nodeHash(i64 iNode){
-  return iNode % HASHSIZE;
+static unsigned int nodeHash(i64 iNode){
+  return ((unsigned)iNode) % HASHSIZE;
 }
 
 /*
 ** Search the node hash table for node iNode. If found, return a pointer
 ** to it. Otherwise, return 0.
@@ -597,11 +609,11 @@
 ** assigned a node number when nodeWrite() is called to write the
 ** node contents out to the database.
 */
 static RtreeNode *nodeNew(Rtree *pRtree, RtreeNode *pParent){
   RtreeNode *pNode;
-  pNode = (RtreeNode *)sqlite3_malloc(sizeof(RtreeNode) + pRtree->iNodeSize);
+  pNode = (RtreeNode *)sqlite3_malloc64(sizeof(RtreeNode) + pRtree->iNodeSize);
   if( pNode ){
     memset(pNode, 0, sizeof(RtreeNode) + pRtree->iNodeSize);
     pNode->zData = (u8 *)&pNode[1];
     pNode->nRef = 1;
     pRtree->nNodeRef++;
@@ -620,10 +632,22 @@
     sqlite3_blob *pBlob = pRtree->pNodeBlob;
     pRtree->pNodeBlob = 0;
     sqlite3_blob_close(pBlob);
   }
 }
+
+/*
+** Check to see if pNode is the same as pParent or any of the parents
+** of pParent.
+*/
+static int nodeInParentChain(const RtreeNode *pNode, const RtreeNode *pParent){
+  do{
+    if( pNode==pParent ) return 1;
+    pParent = pParent->pParent;
+  }while( pParent );
+  return 0;
+}
 
 /*
 ** Obtain a reference to an r-tree node.
 */
 static int nodeAcquire(
@@ -639,10 +663,14 @@
   ** increase its reference count and return it.
   */
   if( (pNode = nodeHashLookup(pRtree, iNode))!=0 ){
     assert( !pParent || !pNode->pParent || pNode->pParent==pParent );
     if( pParent && !pNode->pParent ){
+      if( nodeInParentChain(pNode, pParent) ){
+        RTREE_IS_CORRUPT(pRtree);
+        return SQLITE_CORRUPT_VTAB;
+      }
       pParent->nRef++;
       pNode->pParent = pParent;
     }
     pNode->nRef++;
     *ppNode = pNode;
@@ -669,13 +697,16 @@
   if( rc ){
     nodeBlobReset(pRtree);
     *ppNode = 0;
     /* If unable to open an sqlite3_blob on the desired row, that can only
     ** be because the shadow tables hold erroneous data. */
-    if( rc==SQLITE_ERROR ) rc = SQLITE_CORRUPT_VTAB;
+    if( rc==SQLITE_ERROR ){
+      rc = SQLITE_CORRUPT_VTAB;
+      RTREE_IS_CORRUPT(pRtree);
+    }
   }else if( pRtree->iNodeSize==sqlite3_blob_bytes(pRtree->pNodeBlob) ){
-    pNode = (RtreeNode *)sqlite3_malloc(sizeof(RtreeNode)+pRtree->iNodeSize);
+    pNode = (RtreeNode *)sqlite3_malloc64(sizeof(RtreeNode)+pRtree->iNodeSize);
     if( !pNode ){
       rc = SQLITE_NOMEM;
     }else{
       pNode->pParent = pParent;
       pNode->zData = (u8 *)&pNode[1];
@@ -684,11 +715,10 @@
       pNode->iNode = iNode;
       pNode->isDirty = 0;
       pNode->pNext = 0;
       rc = sqlite3_blob_read(pRtree->pNodeBlob, pNode->zData,
                              pRtree->iNodeSize, 0);
-      nodeReference(pParent);
     }
   }
 
   /* If the root node was just loaded, set pRtree->iDepth to the height
   ** of the r-tree structure. A height of zero means all data is stored on
@@ -698,10 +728,11 @@
   */
   if( pNode && iNode==1 ){
     pRtree->iDepth = readInt16(pNode->zData);
     if( pRtree->iDepth>RTREE_MAX_DEPTH ){
       rc = SQLITE_CORRUPT_VTAB;
+      RTREE_IS_CORRUPT(pRtree);
     }
   }
 
   /* If no error has occurred so far, check if the "number of entries"
   ** field on the node is too large. If so, set the return code to 
@@ -708,18 +739,21 @@
   ** SQLITE_CORRUPT_VTAB.
   */
   if( pNode && rc==SQLITE_OK ){
     if( NCELL(pNode)>((pRtree->iNodeSize-4)/pRtree->nBytesPerCell) ){
       rc = SQLITE_CORRUPT_VTAB;
+      RTREE_IS_CORRUPT(pRtree);
     }
   }
 
   if( rc==SQLITE_OK ){
     if( pNode!=0 ){
+      nodeReference(pParent);
       nodeHashInsert(pRtree, pNode);
     }else{
       rc = SQLITE_CORRUPT_VTAB;
+      RTREE_IS_CORRUPT(pRtree);
     }
     *ppNode = pNode;
   }else{
     if( pNode ){
       pRtree->nNodeRef--;
@@ -941,11 +975,11 @@
   pRtree->nBusy--;
   if( pRtree->nBusy==0 ){
     pRtree->inWrTrans = 0;
     assert( pRtree->nCursor==0 );
     nodeBlobReset(pRtree);
-    assert( pRtree->nNodeRef==0 );
+    assert( pRtree->nNodeRef==0 || pRtree->bCorrupt );
     sqlite3_finalize(pRtree->pWriteNode);
     sqlite3_finalize(pRtree->pDeleteNode);
     sqlite3_finalize(pRtree->pReadRowid);
     sqlite3_finalize(pRtree->pWriteRowid);
     sqlite3_finalize(pRtree->pDeleteRowid);
@@ -1000,11 +1034,11 @@
 static int rtreeOpen(sqlite3_vtab *pVTab, sqlite3_vtab_cursor **ppCursor){
   int rc = SQLITE_NOMEM;
   Rtree *pRtree = (Rtree *)pVTab;
   RtreeCursor *pCsr;
 
-  pCsr = (RtreeCursor *)sqlite3_malloc(sizeof(RtreeCursor));
+  pCsr = (RtreeCursor *)sqlite3_malloc64(sizeof(RtreeCursor));
   if( pCsr ){
     memset(pCsr, 0, sizeof(RtreeCursor));
     pCsr->base.pVtab = pVTab;
     rc = SQLITE_OK;
     pRtree->nCursor++;
@@ -1273,10 +1307,11 @@
     if( nodeGetRowid(pRtree, pNode, ii)==iRowid ){
       *piIndex = ii;
       return SQLITE_OK;
     }
   }
+  RTREE_IS_CORRUPT(pRtree);
   return SQLITE_CORRUPT_VTAB;
 }
 
 /*
 ** Return the index of the cell containing a pointer to node pNode
@@ -1366,11 +1401,11 @@
 ){
   int i, j;
   RtreeSearchPoint *pNew;
   if( pCur->nPoint>=pCur->nPointAlloc ){
     int nNew = pCur->nPointAlloc*2 + 8;
-    pNew = sqlite3_realloc(pCur->aPoint, nNew*sizeof(pCur->aPoint[0]));
+    pNew = sqlite3_realloc64(pCur->aPoint, nNew*sizeof(pCur->aPoint[0]));
     if( pNew==0 ) return 0;
     pCur->aPoint = pNew;
     pCur->nPointAlloc = nNew;
   }
   i = pCur->nPoint++;
@@ -1768,11 +1803,11 @@
     /* Normal case - r-tree scan. Set up the RtreeCursor.aConstraint array 
     ** with the configured constraints. 
     */
     rc = nodeAcquire(pRtree, 1, 0, &pRoot);
     if( rc==SQLITE_OK && argc>0 ){
-      pCsr->aConstraint = sqlite3_malloc(sizeof(RtreeConstraint)*argc);
+      pCsr->aConstraint = sqlite3_malloc64(sizeof(RtreeConstraint)*argc);
       pCsr->nConstraint = argc;
       if( !pCsr->aConstraint ){
         rc = SQLITE_NOMEM;
       }else{
         memset(pCsr->aConstraint, 0, sizeof(RtreeConstraint)*argc);
@@ -1913,24 +1948,24 @@
     && ((p->iColumn>0 && p->iColumn<=pRtree->nDim2)
         || p->op==SQLITE_INDEX_CONSTRAINT_MATCH)
     ){
       u8 op;
       switch( p->op ){
-        case SQLITE_INDEX_CONSTRAINT_EQ: op = RTREE_EQ; break;
-        case SQLITE_INDEX_CONSTRAINT_GT: op = RTREE_GT; break;
-        case SQLITE_INDEX_CONSTRAINT_LE: op = RTREE_LE; break;
-        case SQLITE_INDEX_CONSTRAINT_LT: op = RTREE_LT; break;
-        case SQLITE_INDEX_CONSTRAINT_GE: op = RTREE_GE; break;
-        default:
-          assert( p->op==SQLITE_INDEX_CONSTRAINT_MATCH );
-          op = RTREE_MATCH; 
-          break;
-      }
-      zIdxStr[iIdx++] = op;
-      zIdxStr[iIdx++] = (char)(p->iColumn - 1 + '0');
-      pIdxInfo->aConstraintUsage[ii].argvIndex = (iIdx/2);
-      pIdxInfo->aConstraintUsage[ii].omit = 1;
+        case SQLITE_INDEX_CONSTRAINT_EQ:    op = RTREE_EQ;    break;
+        case SQLITE_INDEX_CONSTRAINT_GT:    op = RTREE_GT;    break;
+        case SQLITE_INDEX_CONSTRAINT_LE:    op = RTREE_LE;    break;
+        case SQLITE_INDEX_CONSTRAINT_LT:    op = RTREE_LT;    break;
+        case SQLITE_INDEX_CONSTRAINT_GE:    op = RTREE_GE;    break;
+        case SQLITE_INDEX_CONSTRAINT_MATCH: op = RTREE_MATCH; break;
+        default:                            op = 0;           break;
+      }
+      if( op ){
+        zIdxStr[iIdx++] = op;
+        zIdxStr[iIdx++] = (char)(p->iColumn - 1 + '0');
+        pIdxInfo->aConstraintUsage[ii].argvIndex = (iIdx/2);
+        pIdxInfo->aConstraintUsage[ii].omit = 1;
+      }
     }
   }
 
   pIdxInfo->idxNum = 2;
   pIdxInfo->needToFreeIdxStr = 1;
@@ -1962,15 +1997,15 @@
     }
   }else
 #endif
   {
     switch( pRtree->nDim ){
-      case 5:  area  = p->aCoord[9].i - p->aCoord[8].i;
-      case 4:  area *= p->aCoord[7].i - p->aCoord[6].i;
-      case 3:  area *= p->aCoord[5].i - p->aCoord[4].i;
-      case 2:  area *= p->aCoord[3].i - p->aCoord[2].i;
-      default: area *= p->aCoord[1].i - p->aCoord[0].i;
+      case 5:  area  = (i64)p->aCoord[9].i - (i64)p->aCoord[8].i;
+      case 4:  area *= (i64)p->aCoord[7].i - (i64)p->aCoord[6].i;
+      case 3:  area *= (i64)p->aCoord[5].i - (i64)p->aCoord[4].i;
+      case 2:  area *= (i64)p->aCoord[3].i - (i64)p->aCoord[2].i;
+      default: area *= (i64)p->aCoord[1].i - (i64)p->aCoord[0].i;
     }
   }
   return area;
 }
 
@@ -2135,16 +2170,18 @@
   Rtree *pRtree,                    /* Rtree table */
   RtreeNode *pNode,                 /* Adjust ancestry of this node. */
   RtreeCell *pCell                  /* This cell was just inserted */
 ){
   RtreeNode *p = pNode;
+  int cnt = 0;
   while( p->pParent ){
     RtreeNode *pParent = p->pParent;
     RtreeCell cell;
     int iCell;
 
-    if( nodeParentIndex(pRtree, p, &iCell) ){
+    if( (++cnt)>1000 || nodeParentIndex(pRtree, p, &iCell)  ){
+      RTREE_IS_CORRUPT(pRtree);
       return SQLITE_CORRUPT_VTAB;
     }
 
     nodeGetCell(pRtree, pParent, iCell, &cell);
     if( !cellContains(pRtree, &cell, pCell) ){
@@ -2337,13 +2374,13 @@
 
   int iBestDim = 0;
   int iBestSplit = 0;
   RtreeDValue fBestMargin = RTREE_ZERO;
 
-  int nByte = (pRtree->nDim+1)*(sizeof(int*)+nCell*sizeof(int));
+  sqlite3_int64 nByte = (pRtree->nDim+1)*(sizeof(int*)+nCell*sizeof(int));
 
-  aaSorted = (int **)sqlite3_malloc(nByte);
+  aaSorted = (int **)sqlite3_malloc64(nByte);
   if( !aaSorted ){
     return SQLITE_NOMEM;
   }
 
   aSpare = &((int *)&aaSorted[pRtree->nDim])[pRtree->nDim*nCell];
@@ -2460,11 +2497,11 @@
   RtreeCell rightbbox;
 
   /* Allocate an array and populate it with a copy of pCell and 
   ** all cells from node pLeft. Then zero the original node.
   */
-  aCell = sqlite3_malloc((sizeof(RtreeCell)+sizeof(int))*(nCell+1));
+  aCell = sqlite3_malloc64((sizeof(RtreeCell)+sizeof(int))*(nCell+1));
   if( !aCell ){
     rc = SQLITE_NOMEM;
     goto splitnode_out;
   }
   aiUsed = (int *)&aCell[nCell+1];
@@ -2608,11 +2645,14 @@
         rc2 = nodeAcquire(pRtree, iNode, 0, &pChild->pParent);
       }
     }
     rc = sqlite3_reset(pRtree->pReadParent);
     if( rc==SQLITE_OK ) rc = rc2;
-    if( rc==SQLITE_OK && !pChild->pParent ) rc = SQLITE_CORRUPT_VTAB;
+    if( rc==SQLITE_OK && !pChild->pParent ){
+      RTREE_IS_CORRUPT(pRtree);
+      rc = SQLITE_CORRUPT_VTAB;
+    }
     pChild = pChild->pParent;
   }
   return rc;
 }
 
@@ -2748,11 +2788,11 @@
   n = (nCell+1)&(~1);
 
   /* Allocate the buffers used by this operation. The allocation is
   ** relinquished before this function returns.
   */
-  aCell = (RtreeCell *)sqlite3_malloc(n * (
+  aCell = (RtreeCell *)sqlite3_malloc64(n * (
     sizeof(RtreeCell)     +         /* aCell array */
     sizeof(int)           +         /* aOrder array */
     sizeof(int)           +         /* aSpare array */
     sizeof(RtreeDValue)             /* aDistance array */
   ));
@@ -2921,13 +2961,17 @@
   ** about to be deleted. 
   */
   if( rc==SQLITE_OK ){
     rc = findLeafNode(pRtree, iDelete, &pLeaf, 0);
   }
+
+#ifdef CORRUPT_DB
+  assert( pLeaf!=0 || rc!=SQLITE_OK || CORRUPT_DB );
+#endif
 
   /* Delete the cell in question from the leaf node. */
-  if( rc==SQLITE_OK ){
+  if( rc==SQLITE_OK && pLeaf ){
     int rc2;
     rc = nodeRowidIndex(pRtree, pLeaf, iDelete, &iCell);
     if( rc==SQLITE_OK ){
       rc = deleteCell(pRtree, pLeaf, iCell, 0);
     }
@@ -3195,11 +3239,11 @@
       rc2 = nodeRelease(pRtree, pLeaf);
       if( rc==SQLITE_OK ){
         rc = rc2;
       }
     }
-    if( pRtree->nAux ){
+    if( rc==SQLITE_OK && pRtree->nAux ){
       sqlite3_stmt *pUp = pRtree->pWriteAux;
       int jj;
       sqlite3_bind_int64(pUp, 1, *pRowid);
       for(jj=0; jj<pRtree->nAux; jj++){
         sqlite3_bind_value(pUp, jj+2, aData[pRtree->nDim2+3+jj]);
@@ -3323,12 +3367,28 @@
   }
 
   return rc;
 }
 
+
+/*
+** Return true if zName is the extension on one of the shadow tables used
+** by this module.
+*/
+static int rtreeShadowName(const char *zName){
+  static const char *azName[] = {
+    "node", "parent", "rowid"
+  };
+  unsigned int i;
+  for(i=0; i<sizeof(azName)/sizeof(azName[0]); i++){
+    if( sqlite3_stricmp(zName, azName[i])==0 ) return 1;
+  }
+  return 0;
+}
+
 static sqlite3_module rtreeModule = {
-  2,                          /* iVersion */
+  3,                          /* iVersion */
   rtreeCreate,                /* xCreate - create a table */
   rtreeConnect,               /* xConnect - connect to an existing table */
   rtreeBestIndex,             /* xBestIndex - Determine search strategy */
   rtreeDisconnect,            /* xDisconnect - Disconnect from a table */
   rtreeDestroy,               /* xDestroy - Drop a table */
@@ -3347,10 +3407,11 @@
   0,                          /* xFindFunction - function overloading */
   rtreeRename,                /* xRename - rename the table */
   rtreeSavepoint,             /* xSavepoint */
   0,                          /* xRelease */
   0,                          /* xRollbackTo */
+  rtreeShadowName             /* xShadowName */
 };
 
 static int rtreeSqlInit(
   Rtree *pRtree, 
   sqlite3 *db, 
@@ -3376,10 +3437,11 @@
     "INSERT OR REPLACE INTO '%q'.'%q_parent' VALUES(?1, ?2)",
     "DELETE FROM '%q'.'%q_parent' WHERE nodeno = ?1"
   };
   sqlite3_stmt **appStmt[N_STATEMENT];
   int i;
+  const int f = SQLITE_PREPARE_PERSISTENT|SQLITE_PREPARE_NO_VTAB;
 
   pRtree->db = db;
 
   if( isCreate ){
     char *zCreate;
@@ -3432,12 +3494,11 @@
        zFormat = "INSERT INTO\"%w\".\"%w_rowid\"(rowid,nodeno)VALUES(?1,?2)"
                   "ON CONFLICT(rowid)DO UPDATE SET nodeno=excluded.nodeno";
     }
     zSql = sqlite3_mprintf(zFormat, zDb, zPrefix);
     if( zSql ){
-      rc = sqlite3_prepare_v3(db, zSql, -1, SQLITE_PREPARE_PERSISTENT,
-                              appStmt[i], 0); 
+      rc = sqlite3_prepare_v3(db, zSql, -1, f, appStmt[i], 0); 
     }else{
       rc = SQLITE_NOMEM;
     }
     sqlite3_free(zSql);
   }
@@ -3463,12 +3524,11 @@
       sqlite3_str_appendf(p, " WHERE rowid=?1");
       zSql = sqlite3_str_finish(p);
       if( zSql==0 ){
         rc = SQLITE_NOMEM;
       }else{
-        rc = sqlite3_prepare_v3(db, zSql, -1, SQLITE_PREPARE_PERSISTENT,
-                                &pRtree->pWriteAux, 0); 
+        rc = sqlite3_prepare_v3(db, zSql, -1, f, &pRtree->pWriteAux, 0); 
         sqlite3_free(zSql);
       }
     }
   }
 
@@ -3540,10 +3600,11 @@
     rc = getIntFromStmt(db, zSql, &pRtree->iNodeSize);
     if( rc!=SQLITE_OK ){
       *pzErr = sqlite3_mprintf("%s", sqlite3_errmsg(db));
     }else if( pRtree->iNodeSize<(512-64) ){
       rc = SQLITE_CORRUPT_VTAB;
+      RTREE_IS_CORRUPT(pRtree);
       *pzErr = sqlite3_mprintf("undersize RTree blobs in \"%q_node\"",
                                pRtree->zName);
     }
   }
 
@@ -3595,11 +3656,11 @@
   sqlite3_vtab_config(db, SQLITE_VTAB_CONSTRAINT_SUPPORT, 1);
 
   /* Allocate the sqlite3_vtab structure */
   nDb = (int)strlen(argv[1]);
   nName = (int)strlen(argv[2]);
-  pRtree = (Rtree *)sqlite3_malloc(sizeof(Rtree)+nDb+nName+2);
+  pRtree = (Rtree *)sqlite3_malloc64(sizeof(Rtree)+nDb+nName+2);
   if( !pRtree ){
     return SQLITE_NOMEM;
   }
   memset(pRtree, 0, sizeof(Rtree)+nDb+nName+2);
   pRtree->nBusy = 1;
@@ -3863,12 +3924,11 @@
 ** this case.
 */
 static u8 *rtreeCheckGetNode(RtreeCheck *pCheck, i64 iNode, int *pnNode){
   u8 *pRet = 0;                   /* Return value */
 
-  assert( pCheck->rc==SQLITE_OK );
-  if( pCheck->pGetNode==0 ){
+  if( pCheck->rc==SQLITE_OK && pCheck->pGetNode==0 ){
     pCheck->pGetNode = rtreeCheckPrepare(pCheck,
         "SELECT data FROM %Q.'%q_node' WHERE nodeno=?", 
         pCheck->zDb, pCheck->zTab
     );
   }
@@ -3876,11 +3936,11 @@
   if( pCheck->rc==SQLITE_OK ){
     sqlite3_bind_int64(pCheck->pGetNode, 1, iNode);
     if( sqlite3_step(pCheck->pGetNode)==SQLITE_ROW ){
       int nNode = sqlite3_column_bytes(pCheck->pGetNode, 0);
       const u8 *pNode = (const u8*)sqlite3_column_blob(pCheck->pGetNode, 0);
-      pRet = sqlite3_malloc(nNode);
+      pRet = sqlite3_malloc64(nNode);
       if( pRet==0 ){
         pCheck->rc = SQLITE_NOMEM;
       }else{
         memcpy(pRet, pNode, nNode);
         *pnNode = nNode;
@@ -4309,16 +4369,16 @@
 ** out which elements of the R-Tree should be returned by the query.
 */
 static void geomCallback(sqlite3_context *ctx, int nArg, sqlite3_value **aArg){
   RtreeGeomCallback *pGeomCtx = (RtreeGeomCallback *)sqlite3_user_data(ctx);
   RtreeMatchArg *pBlob;
-  int nBlob;
+  sqlite3_int64 nBlob;
   int memErr = 0;
 
   nBlob = sizeof(RtreeMatchArg) + (nArg-1)*sizeof(RtreeDValue)
            + nArg*sizeof(sqlite3_value*);
-  pBlob = (RtreeMatchArg *)sqlite3_malloc(nBlob);
+  pBlob = (RtreeMatchArg *)sqlite3_malloc64(nBlob);
   if( !pBlob ){
     sqlite3_result_error_nomem(ctx);
   }else{
     int i;
     pBlob->iSize = nBlob;

Index: ext/rtree/rtree1.test
==================================================================
--- ext/rtree/rtree1.test
+++ ext/rtree/rtree1.test
@@ -644,8 +644,22 @@
   INSERT INTO rt1 VALUES(2, 2, 3, 'aux2');
   INSERT INTO rt1 VALUES(3, 3, 4, 'aux3');
   INSERT INTO rt1 VALUES(4, 4, 5, 'aux4');
   SELECT * FROM rt1 WHERE id IN (1, 2, 3, 4);
 } {1 1.0 2.0 aux1 2 2.0 3.0 aux2 3 3.0 4.0 aux3 4 4.0 5.0 aux4}
+
+reset_db
+do_execsql_test 17.0 {
+  CREATE VIRTUAL TABLE t1 USING rtree(id, x1 PRIMARY KEY, x2, y1, y2);
+  CREATE VIRTUAL TABLE t2 USING rtree(id, x1, x2, y1, y2 UNIQUE);
+}
+do_execsql_test 17.1 {
+  REINDEX t1;
+  REINDEX t2;
+} {}
+
+do_execsql_test 17.2 {
+  REINDEX;
+} {}
 
 expand_all_sql db
 finish_test

Index: ext/rtree/rtree6.test
==================================================================
--- ext/rtree/rtree6.test
+++ ext/rtree/rtree6.test
@@ -13,10 +13,11 @@
 
 if {![info exists testdir]} {
   set testdir [file join [file dirname [info script]] .. .. test]
 } 
 source $testdir/tester.tcl
+set testprefix rtree6
 
 ifcapable {!rtree || rtree_int_only} {
   finish_test
   return
 }
@@ -56,10 +57,13 @@
 } {}
 
 do_test rtree6-1.2 {
   rtree_strategy {SELECT * FROM t1 WHERE x1>10}
 } {E0}
+do_test rtree6-1.2.1 {
+  rtree_strategy {SELECT * FROM t1 WHERE x1>10 AND x2 LIKE '%x%'}
+} {E0}
 
 do_test rtree6-1.3 {
   rtree_strategy {SELECT * FROM t1 WHERE x1<10}
 } {C0}
 
@@ -161,8 +165,17 @@
     x1>0.5 AND x1>0.5 AND x1>0.5 AND x1>0.5 AND x1>0.5 AND x1>0.5 AND 
     x1>0.5 AND x1>0.5 AND x1>0.5 AND x1>0.5 AND x1>0.5 AND x1>0.5 AND 
     x1>0.5 AND x1>0.5 AND x1>0.5 AND x1>0.5 AND x1>0.5 AND x1>0.5 AND 
     x1>0.5 AND x1>0.5 AND x1>0.5 AND x1>0.5 AND x1>1.1
 } {}
+
+#-------------------------------------------------------------------------
+reset_db
+do_execsql_test 4.0 {
+  CREATE VIRTUAL TABLE t1 USING rtree(id,x0,x1,y0,y1);
+}
+do_execsql_test 4.1 {
+  DELETE FROM t1 WHERE x0>1 AND x1<2 OR y0<92;
+}
 
 expand_all_sql db
 finish_test

Index: ext/rtree/rtree8.test
==================================================================
--- ext/rtree/rtree8.test
+++ ext/rtree/rtree8.test
@@ -99,10 +99,11 @@
 # level, but the contents of the various tables used internally by an
 # r-tree table are inconsistent.
 #
 populate_t1 50
 do_execsql_test rtree8-2.1.1 { SELECT max(nodeno) FROM t1_node } {5}
+sqlite3_db_config db DEFENSIVE 0
 do_execsql_test rtree8-2.1.2 { DELETE FROM t1_node } {}
 for {set i 1} {$i <= 50} {incr i} {
   do_catchsql_test rtree8-2.1.3.$i { 
     SELECT * FROM t1 WHERE id = $i 
   } {1 {database disk image is malformed}}
@@ -119,10 +120,11 @@
   CREATE VIRTUAL TABLE t1 USING rtree_i32(id, x1, x2);
 } {}
 
 
 populate_t1 50
+sqlite3_db_config db DEFENSIVE 0
 do_execsql_test rtree8-2.2.1 {
   DELETE FROM t1_parent
 } {}
 do_catchsql_test rtree8-2.2.2 {
   DELETE FROM t1 WHERE id=25

Index: ext/rtree/rtreeA.test
==================================================================
--- ext/rtree/rtreeA.test
+++ ext/rtree/rtreeA.test
@@ -34,10 +34,11 @@
     set x2 [expr $i+5]
     set y2 [expr $i+5]
     execsql { INSERT INTO t1 VALUES($i, $i, $x2, $i, $y2) }
   }
   execsql COMMIT
+  sqlite3_db_config db DEFENSIVE 0
 }
 
 proc truncate_node {nodeno nTrunc} {
   set blob [db one {SELECT data FROM t1_node WHERE nodeno=$nodeno}]
   if {$nTrunc<0} {set nTrunc "end-$nTrunc"}
@@ -244,10 +245,11 @@
 # Truncated blobs in the _node table.
 #
 create_t1
 populate_t1
 sqlite3 db test.db
+sqlite3_db_config db DEFENSIVE 0
 do_execsql_test rtreeA-7.100 { 
   UPDATE t1_node SET data=x'' WHERE rowid=1;
 } {}
 do_catchsql_test rtreeA-7.110 {
   SELECT * FROM t1 WHERE x1>0 AND x1<100 AND x2>0 AND x2<100;
@@ -256,6 +258,5 @@
   sqlite3_extended_errcode db
 } {SQLITE_CORRUPT_VTAB}
 
 
 finish_test
-

Index: ext/rtree/rtreecheck.test
==================================================================
--- ext/rtree/rtreecheck.test
+++ ext/rtree/rtreecheck.test
@@ -59,10 +59,11 @@
     INSERT INTO r1 VALUES(2,  6, 6, 6, 6);  --  9
     INSERT INTO r1 VALUES(3,  7, 7, 7, 7);  -- 15
     INSERT INTO r1 VALUES(4,  8, 8, 8, 8);  -- 21
     INSERT INTO r1 VALUES(5,  9, 9, 9, 9);  -- 27
   "
+  sqlite3_db_config db DEFENSIVE 0
 }
 
 setup_simple_db
 do_execsql_test 2.1 { 
   SELECT rtreecheck('r1') 
@@ -110,10 +111,11 @@
   CREATE VIRTUAL TABLE r2 USING rtree_i32(id, x1, x2);
   INSERT INTO r2 VALUES(2, -1*(1<<31), -1*(1<<31)+5);
   SELECT rtreecheck('r2') 
 } {ok}
 
+sqlite3_db_config db DEFENSIVE 0
 do_execsql_test 3.2 {
   BEGIN;
     UPDATE r2_node SET data = X'123456';
     SELECT rtreecheck('r2')!="ok";
 } {1}
@@ -138,10 +140,11 @@
   WITH x(i) AS (
     SELECT 1 UNION ALL SELECT i+1 FROM x WHERE i<1000
   )
   INSERT INTO r3 SELECT i, i, i, i, i FROM x;
 }
+sqlite3_db_config db DEFENSIVE 0
 do_execsql_test 5.1 {
   BEGIN;
     UPDATE r3_node SET data = set_int32(data, 3, 5000);
     UPDATE r3_node SET data = set_int32(data, 4, 5000);
     SELECT rtreecheck('r3')=='ok'
@@ -153,6 +156,5 @@
     UPDATE r3_node SET data = set_int32(data, 4, 0);
     SELECT rtreecheck('r3')=='ok'
 } 0
 
 finish_test
-

ADDED   ext/rtree/rtreecirc.test
Index: ext/rtree/rtreecirc.test
==================================================================
--- /dev/null
+++ ext/rtree/rtreecirc.test
@@ -0,0 +1,66 @@
+# 2018 Dec 22
+#
+# The author disclaims copyright to this source code.  In place of
+# a legal notice, here is a blessing:
+#
+#    May you do good and not evil.
+#    May you find forgiveness for yourself and forgive others.
+#    May you share freely, never taking more than you give.
+#
+#*************************************************************************
+# This file implements regression tests for SQLite library.  The
+# focus of this script is testing the FTS5 module.
+#
+
+if {![info exists testdir]} {
+  set testdir [file join [file dirname [info script]] .. .. test]
+}
+source [file join [file dirname [info script]] rtree_util.tcl]
+source $testdir/tester.tcl
+set testprefix rtreecirc
+
+ifcapable !rtree {
+  finish_test
+  return
+}
+
+do_execsql_test 1.0 {
+  CREATE VIRTUAL TABLE rt USING rtree(id, x1, x2, y1, y2);
+  SELECT name FROM sqlite_master ORDER BY 1;
+} {
+  rt rt_node rt_parent rt_rowid
+}
+db_save_and_close
+
+foreach {tn schema sql} {
+  1 {
+    CREATE TRIGGER tr1 AFTER INSERT ON rt_node BEGIN
+      SELECT * FROM rt;
+    END;
+  } {
+    INSERT INTO rt VALUES(1, 2, 3, 4, 5);
+  }
+  2 {
+    CREATE TRIGGER tr1 AFTER INSERT ON rt_parent BEGIN
+      SELECT * FROM rt;
+    END;
+  } {
+    INSERT INTO rt VALUES(1, 2, 3, 4, 5);
+  }
+  3 {
+    CREATE TRIGGER tr1 AFTER INSERT ON rt_rowid BEGIN
+      SELECT * FROM rt;
+    END;
+  } {
+    INSERT INTO rt VALUES(1, 2, 3, 4, 5);
+  }
+} {
+  db_restore_and_reopen
+  do_execsql_test  1.1.$tn.1 $schema
+  do_catchsql_test 1.1.$tn.2 $sql {1 {no such table: main.rt}}
+  db close
+}
+
+
+finish_test
+

ADDED   ext/rtree/rtreefuzz001.test
Index: ext/rtree/rtreefuzz001.test
==================================================================
--- /dev/null
+++ ext/rtree/rtreefuzz001.test
@@ -0,0 +1,777 @@
+# 2012-12-21
+#
+# The author disclaims copyright to this source code.  In place of
+# a legal notice, here is a blessing:
+#
+#    May you do good and not evil.
+#    May you find forgiveness for yourself and forgive others.
+#    May you share freely, never taking more than you give.
+#
+#***********************************************************************
+#
+# Test cases for corrupt database files.
+
+if {![info exists testdir]} {
+  set testdir [file join [file dirname [info script]] .. .. test]
+} 
+source $testdir/tester.tcl
+
+ifcapable !deserialize||!rtree {
+  finish_test
+  return
+}
+database_may_be_corrupt
+
+do_test rtreefuzz001-100 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 24576 pagesize 4096 filename c1b.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 03 00 00 00 06   .....@  ........
+|     32: 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00 04   ................
+|     48: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00   ................
+|     80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03   ................
+|     96: 00 2e 30 38 0d 00 00 00 04 0e 9c 00 0f ad 0f 4f   ..08...........O
+|    112: 0e fc 0e 9c 00 00 00 00 00 00 00 00 00 00 00 00   ................
+|   3728: 00 00 00 00 00 00 00 00 00 00 00 00 5e 04 07 17   ............^...
+|   3744: 1f 1f 01 81 0b 74 61 62 6c 65 74 31 5f 70 61 72   .....tablet1_par
+|   3760: 65 6e 74 74 31 5f 70 61 72 65 6e 74 04 43 52 45   entt1_parent.CRE
+|   3776: 41 54 45 20 54 41 42 4c 45 20 22 74 31 5f 70 61   ATE TABLE .t1_pa
+|   3792: 72 66 6e 74 22 28 6e 6f 64 65 6e 6f 20 49 4e 54   rfnt.(nodeno INT
+|   3808: 45 47 45 52 20 50 52 49 4d 41 52 59 20 4b 45 59   EGER PRIMARY KEY
+|   3824: 2c 70 61 72 65 6e 74 6e 6f 64 65 29 51 03 06 17   ,parentnode)Q...
+|   3840: 1b 1b 01 7b 74 61 62 6c 65 74 31 5f 6e 6f 64 65   ....tablet1_node
+|   3856: 74 31 5f 6e 6f 64 65 03 43 52 45 41 54 45 20 54   t1_node.CREATE T
+|   3872: 41 42 4c 45 20 22 74 31 5f 6e 6f 64 65 22 28 6e   ABLE .t1_node.(n
+|   3888: 6f 64 65 6e 6f 20 49 4e 54 45 47 45 52 20 50 52   odeno INTEGER PR
+|   3904: 49 4d 41 52 59 20 4b 45 59 2c 64 61 74 61 29 5c   IMARY KEY,data).
+|   3920: 02 07 17 1d 1d 01 81 0b 74 61 62 6c 65 74 31 5f   ........tablet1_
+|   3936: 72 6f 77 69 64 74 31 5f 72 6f 77 69 64 02 43 52   rowidt1_rowid.CR
+|   3952: 45 41 54 45 20 54 41 42 4c 45 20 22 74 31 5f 72   EATE TABLE .t1_r
+|   3968: 6f 77 69 64 22 28 72 6f 77 69 64 20 49 4e 54 45   owid.(rowid INTE
+|   3984: 47 45 52 20 50 52 49 4d 41 52 59 20 4b 45 59 2c   GER PRIMARY KEY,
+|   4000: 6e 6f 64 65 6e 6f 2c 61 30 2c 61 31 29 51 01 07   nodeno,a0,a1)Q..
+|   4016: 17 11 11 08 81 0f 74 61 62 6c 65 74 31 74 31 43   ......tablet1t1C
+|   4032: 52 45 41 54 45 20 56 49 52 54 55 41 4c 20 54 41   REATE VIRTUAL TA
+|   4048: 42 4c 45 20 74 31 20 55 53 49 4e 47 20 72 74 72   BLE t1 USING rtr
+|   4064: 65 65 28 69 64 2c 78 30 2c 78 31 2c 79 30 2c 79   ee(id,x0,x1,y0,y
+|   4080: 31 2c 2b 6c 61 62 65 6c 2c 2b 6f 74 68 65 72 29   1,+label,+other)
+| page 2 offset 4096
+|      0: 0d 0c cd 00 74 08 75 01 0f e8 0c b3 0f d0 0f b7   ....t.u.........
+|     16: 0f 9e 0f 91 0f 81 0f 70 0f 5e 0f 4f 0f 39 0f 29   .......p.^.O.9.)
+|     32: 0f 18 0f 06 0e f7 0c 65 0e 58 0d c2 0d 2c 0c 25   .......e.X...,.%
+|     48: 0b 85 0a e5 0a 45 09 a5 09 05 0c 83 0c 93 0c a3   .....E..........
+|     64: 0f f0 0c 15 0b 75 0a d5 0a 35 09 95 08 f5 0e d8   .....u...5......
+|     80: 0e 42 0d ac 0d 16 0c 05 0b 65 0a c5 0a 25 09 85   .B.......e...%..
+|     96: 08 e5 0e c8 0e 32 0d 9c 0d 06 0b f5 0b 55 0a b5   .....2.......U..
+|    112: 0a 15 09 75 08 d5 0e b8 0e 22 0d 8c 0c f6 0b e5   ...u............
+|    128: 0b 45 0a a5 0a 05 09 65 08 c5 0e a8 0e 12 0d 7c   .E.....e.......|
+|    144: 0c e6 0b d5 0b 35 0a 95 09 f5 09 55 08 b5 0e 98   .....5.....U....
+|    160: 0e 02 0d 6c 0c d6 0b c5 0b 25 0a 85 09 e5 09 45   ...l.....%.....E
+|    176: 08 a5 0e 88 0d f2 0d 5c 0c 55 0b b5 0b 15 0a 75   .........U.....u
+|    192: 09 d5 09 35 08 95 0e 78 0d e2 0d 4c 0c 45 0b a5   ...5...x...L.E..
+|    208: 0b 05 0a 65 09 c5 09 25 08 85 0e 68 0d d2 0d 3c   ...e...%...h...<
+|    224: 0c 35 0b 95 0a f5 0a 55 09 b5 09 15 08 75 0c 75   .5.....U.....u.u
+|   2160: 00 00 00 00 00 0d 8e 75 05 00 01 1b 00 04 62 6f   .......u......bo
+|   2176: 78 2d 39 2c 39 0d 8e 11 05 00 01 1b 00 02 62 6f   x-9,9.........bo
+|   2192: 78 2d 39 2c 38 0d 8d 2d 05 00 01 1b 00 02 62 6f   x-9,8..-......bo
+|   2208: 78 2d 39 2c 37 0d 8c 49 05 00 01 1b 00 02 62 6f   x-9,7..I......bo
+|   2224: 78 2d 39 2c 36 0d 8b 65 05 00 01 1b 00 02 62 6f   x-9,6..e......bo
+|   2240: 78 2d 39 2c 35 0d 8b 01 05 00 01 1b 00 02 62 6f   x-9,5.........bo
+|   2256: 78 2d 39 2c 34 0d 8a 1d 05 00 01 1b 00 02 62 6f   x-9,4.........bo
+|   2272: 78 2d 39 2c 33 0d 89 39 05 00 01 1b 00 02 62 6f   x-9,3..9......bo
+|   2288: 78 2d 39 2c 32 0d 88 55 05 00 01 1b 00 02 62 6f   x-9,2..U......bo
+|   2304: 78 2d 39 2c 31 0d 87 71 05 00 01 1b 00 02 62 6f   x-9,1..q......bo
+|   2320: 78 2d 39 2c 30 0d 8e 74 05 00 01 1b 00 04 62 6f   x-9,0..t......bo
+|   2336: 78 2d 38 2c 39 0d 8e 10 05 00 01 1b 00 02 62 6f   x-8,9.........bo
+|   2352: 78 2d 38 2c 38 0d 8d 2c 05 00 01 1b 00 02 62 6f   x-8,8..,......bo
+|   2368: 78 2d 38 2c 37 0d 8c 48 05 00 01 1b 00 02 62 6f   x-8,7..H......bo
+|   2384: 78 2d 38 2c 36 0d 8b 64 05 00 01 1b 00 02 62 6f   x-8,6..d......bo
+|   2400: 78 2d 38 2c 35 0d 8b 00 05 00 01 1b 00 02 62 6f   x-8,5.........bo
+|   2416: 78 2d 38 2c 34 0d 8a 1c 05 00 01 1b 00 02 62 6f   x-8,4.........bo
+|   2432: 78 2d 38 2c 33 0d 89 38 05 00 01 1b 00 02 62 6f   x-8,3..8......bo
+|   2448: 78 2d 38 2c 32 0d 88 54 05 00 01 1b 00 02 62 6f   x-8,2..T......bo
+|   2464: 78 2d 38 2c 31 0d 87 70 05 00 01 1b 00 02 62 6f   x-8,1..p......bo
+|   2480: 78 2d 38 2c 30 0d 8e 73 05 00 01 1b 00 05 62 6f   x-8,0..s......bo
+|   2496: 78 2d 37 2c 39 0d 8e 0f 05 00 01 1b 00 05 62 6f   x-7,9.........bo
+|   2512: 78 2d 37 2c 38 0d 8d 2b 05 00 01 1b 00 05 62 6f   x-7,8..+......bo
+|   2528: 78 2d 37 2c 37 0d 8c 47 05 00 01 1b 00 05 62 6f   x-7,7..G......bo
+|   2544: 78 2d 37 2c 36 0d 8b 63 05 00 01 1b 00 05 62 6f   x-7,6..c......bo
+|   2560: 78 2d 37 2c 35 0d 8a 7f 05 00 01 1b 00 05 62 6f   x-7,5.........bo
+|   2576: 78 2d 37 2c 34 0d 8a 1b 05 00 01 1b 00 05 62 6f   x-7,4.........bo
+|   2592: 78 2d 37 2c 33 0d 89 37 05 00 01 1b 00 05 62 6f   x-7,3..7......bo
+|   2608: 78 2d 37 2c 32 0d 88 53 05 00 01 1b 00 05 62 6f   x-7,2..S......bo
+|   2624: 78 2d 37 2c 31 0d 87 6f 05 00 01 1b 00 05 62 6f   x-7,1..o......bo
+|   2640: 78 2d 37 2c 30 0d 8e 72 05 00 01 1b 00 04 62 6f   x-7,0..r......bo
+|   2656: 78 2d 36 2c 39 0d 8e 0e 05 00 01 1b 00 05 62 6f   x-6,9.........bo
+|   2672: 78 2d 36 2c 38 0d 8d 2a 05 00 01 1b 00 05 62 6f   x-6,8..*......bo
+|   2688: 78 2d 36 2c 37 0d 8c 46 05 00 01 1b 00 05 62 6f   x-6,7..F......bo
+|   2704: 78 2d 36 2c 36 0d 8b 62 05 00 01 1b 00 05 62 6f   x-6,6..b......bo
+|   2720: 78 2d 36 2c 35 0d 8a 7e 05 00 01 1b 00 05 62 6f   x-6,5..~......bo
+|   2736: 78 2d 36 2c 34 0d 8a 1a 05 00 01 1b 00 05 62 6f   x-6,4.........bo
+|   2752: 78 2d 36 2c 33 0d 89 36 05 00 01 1b 00 05 62 6f   x-6,3..6......bo
+|   2768: 78 2d 36 2c 32 0d 88 52 05 00 01 1b 00 05 62 6f   x-6,2..R......bo
+|   2784: 78 2d 36 2c 31 0d 87 6e 05 00 01 1b 00 05 62 6f   x-6,1..n......bo
+|   2800: 78 2d 36 2c 30 0d 8e 71 05 00 01 1b 00 04 62 6f   x-6,0..q......bo
+|   2816: 78 2d 35 2c 39 0d 8e 0d 05 00 01 1b 00 05 62 6f   x-5,9.........bo
+|   2832: 78 2d 35 2c 38 0d 8d 29 05 00 01 1b 00 05 62 6f   x-5,8..)......bo
+|   2848: 78 2d 35 2c 37 0d 8c 45 05 00 01 1b 00 05 62 6f   x-5,7..E......bo
+|   2864: 78 2d 35 2c 36 0d 8b 61 05 00 01 1b 00 05 62 6f   x-5,6..a......bo
+|   2880: 78 2d 35 2c 35 0d 8a 7d 05 00 01 1b 00 05 62 6f   x-5,5.........bo
+|   2896: 78 2d 35 2c 34 0d 8a 19 05 00 01 1b 00 05 62 6f   x-5,4.........bo
+|   2912: 78 2d 35 2c 33 0d 89 35 05 00 01 1b 00 05 62 6f   x-5,3..5......bo
+|   2928: 78 2d 35 2c 32 0d 88 51 05 00 01 1b 00 05 62 6f   x-5,2..Q......bo
+|   2944: 78 2d 35 2c 31 0d 87 6d 05 00 01 1b 00 05 62 6f   x-5,1..m......bo
+|   2960: 78 2d 35 2c 30 0d 8e 70 05 00 01 1b 00 04 62 6f   x-5,0..p......bo
+|   2976: 78 2d 34 2c 39 0d 8e 0c 05 00 01 1b 00 04 62 6f   x-4,9.........bo
+|   2992: 78 2d 34 2c 38 0d 8d 28 05 00 01 1b 00 04 62 6f   x-4,8..(......bo
+|   3008: 78 2d 34 2c 37 0d 8c 44 05 00 01 1b 00 04 62 6f   x-4,7..D......bo
+|   3024: 78 2d 34 2c 36 0d 8b 60 05 00 01 1b 00 02 62 6f   x-4,6..`......bo
+|   3040: 78 2d 34 2c 35 0d 8a 7c 05 00 01 1b 00 02 62 6f   x-4,5..|......bo
+|   3056: 78 2d 34 2c 34 0d 8a 18 05 00 01 1b 00 02 62 6f   x-4,4.........bo
+|   3072: 78 2d 34 2c 33 0d 89 34 05 00 01 1b 00 02 62 6f   x-4,3..4......bo
+|   3088: 78 2d 34 2c 32 0d 88 50 05 00 01 1b 00 02 62 6f   x-4,2..P......bo
+|   3104: 78 2d 34 2c 31 0d 87 6c 05 00 01 1b 00 02 62 6f   x-4,1..l......bo
+|   3120: 78 2d 34 2c 30 0d 8e 6f 05 00 01 1b 00 04 62 6f   x-4,0..o......bo
+|   3136: 78 2d 33 2c 39 0d 8e 0b 05 00 01 1b 00 04 62 6f   x-3,9.........bo
+|   3152: 78 2d 33 2c 38 0d 8d 27 05 00 01 1b 00 04 62 6f   x-3,8..'......bo
+|   3168: 78 2d 33 2c 37 0d 87 68 05 00 01 1b 00 03 62 6f   x-3,7..h......bo
+|   3184: 78 2d 30 2c 30 06 90 d9 80 80 81 84 4c 05 00 01   x-0,0.......L...
+|   3200: 00 00 03 0d 88 4c 05 00 01 1b 00 02 62 6f 78 2d   .....L......box-
+|   3216: 30 2c 31 0d 88 4d 05 00 01 1b 00 02 62 6f 78 2d   0,1..M......box-
+|   3232: 31 2c 31 0d 88 4e 05 00 01 1b 00 02 62 6f 78 2d   1,1..N......box-
+|   3248: 32 2c 31 17 01 05 00 01 2f 00 02 6c 6f 77 65 72   2,1...../..lower
+|   3264: 2d 6c 65 66 74 20 63 6f 72 6e 65 72 0d 0d 26 00   -left corner..&.
+|   3280: 09 00 01 00 00 04 0d 8c 43 05 00 01 1b 00 04 62   ........C......b
+|   3296: 6f 78 2d 33 2c 36 0d 8b 5f 05 00 01 1b 00 02 62   ox-3,6.._......b
+|   3312: 6f 78 2d 33 2c 35 0d 8a 7b 05 00 01 1b 00 02 62   ox-3,5.........b
+|   3328: 6f 78 2d 33 2c 34 0d 8a 17 05 00 01 1b 00 02 62   ox-3,4.........b
+|   3344: 6f 78 2d 33 2c 33 0d 89 33 05 00 01 1b 00 02 62   ox-3,3..3......b
+|   3360: 6f 78 2d 33 2c 32 0d bc 00 06 00 09 0d 87 6b 05   ox-3,2........k.
+|   3376: 00 01 1b 00 03 62 6f 78 2d 33 2c 30 0d 8e 6e 05   .....box-3,0..n.
+|   3392: 00 01 1b 00 04 62 6f 78 2d 32 2c 39 0d 8e 0a 05   .....box-2,9....
+|   3408: 00 01 1b 00 04 62 6f 78 2d 32 2c 38 0d 8d 26 05   .....box-2,8..&.
+|   3424: 00 01 1b 00 04 62 6f 78 2d 32 2c 37 0d 8c 42 05   .....box-2,7..B.
+|   3440: 00 01 1b 00 04 62 6f 78 2d 32 2c 36 0d 8b 5e 05   .....box-2,6..^.
+|   3456: 00 01 1b 00 02 62 6f 78 2d 32 2c 35 0d 8a 7a 05   .....box-2,5..z.
+|   3472: 00 01 1b 00 02 62 6f 78 2d 32 2c 34 0d 8a 16 05   .....box-2,4....
+|   3488: 00 01 1b 00 02 62 6f 78 2d 32 2c 33 0d 89 32 05   .....box-2,3..2.
+|   3504: 00 01 1b 00 02 62 6f 78 2d 32 2c 32 0e 52 00 06   .....box-2,2.R..
+|   3520: 00 09 0d 87 6a 05 00 01 1b 00 03 62 6f 78 2d 32   ....j......box-2
+|   3536: 2c 30 0d 8e 6d 05 00 01 1b 00 04 62 6f 78 2d 31   ,0..m......box-1
+|   3552: 2c 39 0d 8e 09 05 00 01 1b 00 04 62 6f 78 2d 31   ,9.........box-1
+|   3568: 2c 38 0d 8d 25 05 00 01 1b 00 04 62 6f 78 2d 31   ,8..%......box-1
+|   3584: 2c 37 0d 8c 41 05 00 01 1b 00 04 62 6f 78 2d 31   ,7..A......box-1
+|   3600: 2c 36 0d 8b 5d 05 00 01 1b 00 02 62 6f 78 2d 31   ,6..]......box-1
+|   3616: 2c 35 0d 8a 79 05 00 01 1b 00 02 62 6f 78 2d 31   ,5..y......box-1
+|   3632: 2c 34 0d 8a 15 05 00 01 1b 00 02 62 6f 78 2d 31   ,4.........box-1
+|   3648: 2c 33 0d 89 31 05 00 01 1b 00 02 62 6f 78 2d 31   ,3..1......box-1
+|   3664: 2c 32 0e e8 00 06 00 09 0d 87 69 05 00 01 1b 00   ,2........i.....
+|   3680: 03 62 6f 78 2d 31 2c 30 0d 8e 6c 05 00 01 1b 00   .box-1,0..l.....
+|   3696: 04 62 6f 78 2d 30 2c 39 0d 8e 08 05 00 01 1b 00   .box-0,9........
+|   3712: 04 62 6f 78 2d 30 2c 38 0d 8d 24 05 00 01 1b 00   .box-0,8..$.....
+|   3728: 04 62 6f 78 2d 30 2c 37 0d 8c 40 05 00 01 1b 00   .box-0,7..@.....
+|   3744: 04 62 6f 78 2d 30 2c 36 0d 8b 5c 05 00 01 1b 00   .box-0,6........
+|   3760: 02 62 6f 78 2d 30 2c 35 0d 8a 78 05 00 01 1b 00   .box-0,5..x.....
+|   3776: 02 62 6f 78 2d 30 2c 34 0d 8a 14 05 00 01 1b 00   .box-0,4........
+|   3792: 02 62 6f 78 2d 30 2c 33 0d 89 30 05 00 01 1b 00   .box-0,3..0.....
+|   3808: 02 62 6f 78 2d 30 2c 32 00 00 00 0f 00 09 1b 00   .box-0,2........
+|   3824: 62 6f 78 2d 30 2c 30 0d 0e 05 00 09 1d 00 74 6f   box-0,0.......to
+|   3840: 70 20 68 61 6c 66 10 0d 05 00 09 23 00 62 6f 74   p half.....#.bot
+|   3856: 74 6f 6d 20 68 61 6c 66 0f 0c 02 05 09 01 00 72   tom half.......r
+|   3872: 69 67 68 74 20 68 61 6c 66 0e 0b 05 00 09 1f 00   ight half.......
+|   3888: 6c 65 66 74 20 68 61 6c 66 14 0a 05 00 09 2b 00   left half.....+.
+|   3904: 74 68 65 20 77 68 6f 6c 65 20 74 68 69 6e 67 0d   the whole thing.
+|   3920: 09 05 00 09 1d 00 74 6f 70 20 65 64 67 65 10 08   ......top edge..
+|   3936: 05 00 09 23 00 62 6f 74 74 6f 6d 20 65 64 67 65   ...#.bottom edge
+|   3952: 0f 07 05 00 09 21 00 72 69 67 68 74 20 65 64 67   .....!.right edg
+|   3968: 65 0e 06 05 00 09 1f 00 6c 65 66 74 20 65 64 67   e.......left edg
+|   3984: 65 0b 05 05 00 09 19 00 63 65 6e 74 65 72 17 04   e.......center..
+|   4000: 05 00 09 31 00 75 70 70 65 72 2d 72 69 67 68 74   ...1.upper-right
+|   4016: 20 63 6f 72 6e 65 72 17 03 05 00 09 31 00 6c 6f    corner.....1.lo
+|   4032: 77 65 72 2d 72 69 67 68 74 20 63 6f 72 6e 65 72   wer-right corner
+|   4048: 16 02 05 00 09 2f 00 75 70 70 65 72 2d 6c 65 66   ...../.upper-lef
+|   4064: 74 20 63 6f 72 6e 65 72 06 00 05 00 01 00 00 03   t corner........
+|   4080: 0d 88 4f 05 00 01 1b 00 02 62 6f 78 2d 33 2c 31   ..O......box-3,1
+| page 3 offset 8192
+|      0: 05 00 00 00 01 0f fb 00 00 00 00 06 0f fb 00 00   ................
+|    384: 00 00 00 00 00 00 00 89 50 03 04 00 93 24 00 00   ........P....$..
+|    400: 00 11 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
+|    688: 00 00 00 00 42 c8 00 00 42 4c 00 00 42 00 00 00   ....B...BL..B...
+|    720: 03 eb 40 40 00 00 40 80 00 00 00 00 00 00 3f 80   ..@@..@.......?.
+|    736: 00 00 00 00 00 00 00 00 03 ea 40 00 00 00 40 40   ..........@...@@
+|    752: 00 00 00 00 00 00 3f 80 00 00 00 00 00 00 00 00   ......?.........
+|    768: 03 e9 3f 80 00 00 40 00 00 00 00 00 00 00 3f 80   ..?...@.......?.
+|    784: 00 00 00 00 00 00 00 00 03 e8 00 00 00 00 3f 80   ..............?.
+|    800: 00 00 00 00 00 00 3f 80 00 00 00 00 00 00 00 00   ......?.........
+|   1616: 00 00 00 00 00 00 00 00 00 00 89 50 02 04 00 93   ...........P....
+|   1632: 24 00 00 00 33 00 00 00 00 00 00 00 01 00 00 00   $...3...........
+|   1648: 00 41 20 00 00 00 00 00 00 41 0e 00 00 00 00 00   .A ......A......
+|   1664: 00 00 00 04 4f 40 40 00 00 40 80 00 00 3f 80 00   ....O@@..@...?..
+|   1680: 00 40 00 00 00 00 00 00 00 00 00 04 4e 40 00 00   .@..........N@..
+|   1696: 00 40 40 00 00 3f 80 00 00 40 00 00 00 00 00 00   .@@..?...@......
+|   1712: 00 00 00 04 4d 3f 80 00 00 40 00 00 00 3f 80 00   ....M?...@...?..
+|   1728: 00 40 00 00 00 00 00 00 00 00 00 04 4c 00 00 00   .@..........L...
+|   1744: 00 3f 80 00 00 3f 80 00 00 40 00 00 00 00 00 00   .?...?...@......
+|   1760: 00 00 00 04 b3 40 40 00 00 40 80 00 00 40 00 00   .....@@..@...@..
+|   1776: 00 40 40 00 00 00 00 00 00 00 00 04 b2 40 00 00   .@@..........@..
+|   1792: 00 40 40 00 00 40 00 00 00 40 40 00 00 00 00 00   .@@..@...@@.....
+|   1808: 00 00 00 04 b1 3f 80 00 00 40 00 00 00 40 00 00   .....?...@...@..
+|   1824: 00 40 40 00 00 00 00 00 00 00 00 04 b0 00 00 00   .@@.............
+|   1840: 00 3f 80 00 00 40 00 00 00 40 40 00 00 00 00 00   .?...@...@@.....
+|   1856: 00 00 00 05 17 40 40 00 00 40 80 00 00 40 40 00   .....@@..@...@@.
+|   1872: 00 40 80 00 00 00 00 00 00 00 00 05 16 40 00 00   .@...........@..
+|   1888: 00 40 40 00 00 40 40 00 00 40 80 00 00 00 00 00   .@@..@@..@......
+|   1904: 00 00 00 05 15 3f 80 00 00 40 00 00 00 40 40 00   .....?...@...@@.
+|   1920: 00 40 80 00 00 00 00 00 00 00 00 05 14 00 00 00   .@..............
+|   1936: 00 3f 80 00 00 40 40 00 00 40 80 00 00 00 00 00   .?...@@..@......
+|   1952: 00 00 00 05 7b 40 40 00 00 40 80 00 00 40 80 00   .....@@..@...@..
+|   1968: 00 40 a0 00 00 00 00 00 00 00 00 05 7a 40 00 00   .@..........z@..
+|   1984: 00 40 40 00 00 40 80 00 00 40 a0 00 00 00 00 00   .@@..@...@......
+|   2000: 00 00 00 05 79 3f 80 00 00 40 00 00 00 40 80 00   ....y?...@...@..
+|   2016: 00 40 a0 00 00 00 00 00 00 00 00 05 78 00 00 00   .@..........x...
+|   2032: 00 3f 80 00 00 40 80 00 00 40 a0 00 00 00 00 00   .?...@...@......
+|   2048: 00 00 00 05 df 40 40 00 00 40 80 00 00 40 a0 00   .....@@..@...@..
+|   2064: 00 40 c0 00 00 00 00 00 00 00 00 05 de 40 00 00   .@...........@..
+|   2080: 00 40 40 00 00 40 a0 00 00 40 c0 00 00 00 00 00   .@@..@...@......
+|   2096: 00 00 00 05 dd 3f 80 00 00 40 00 00 00 40 a0 00   .....?...@...@..
+|   2112: 00 40 c0 00 00 00 00 00 00 00 00 05 dc 00 00 00   .@..............
+|   2128: 00 3f 80 00 00 40 a0 00 00 40 c0 00 00 00 00 00   .?...@...@......
+|   2144: 00 00 00 06 43 40 40 00 00 40 80 00 00 40 c0 00   ....C@@..@...@..
+|   2160: 00 40 e0 00 00 00 00 00 00 00 00 06 42 40 00 00   .@..........B@..
+|   2176: 00 40 40 00 00 40 c0 00 00 40 e0 00 00 00 00 00   .@@..@...@......
+|   2192: 00 00 00 06 41 3f 80 00 00 40 00 00 00 40 c0 00   ....A?...@...@..
+|   2208: 00 40 e0 00 00 00 00 00 00 00 00 06 40 00 00 00   .@..........@...
+|   2224: 00 3f 80 00 00 40 c0 00 00 40 e0 00 00 00 00 00   .?...@...@......
+|   2240: 00 00 00 06 a7 40 40 00 00 40 80 00 00 40 e0 00   .....@@..@...@..
+|   2256: 00 41 00 00 00 00 00 00 00 00 00 06 a6 40 00 00   .A...........@..
+|   2272: 00 40 40 00 00 40 e0 00 00 41 00 00 00 00 00 00   .@@..@...A......
+|   2288: 00 00 00 06 a5 3f 80 00 00 40 00 00 00 40 e0 00   .....?...@...@..
+|   2304: 00 41 00 00 00 00 00 00 00 00 00 06 a4 00 00 00   .A..............
+|   2320: 00 3f 80 00 00 40 e0 00 00 41 00 00 00 00 00 00   .?...@...A......
+|   2336: 00 00 00 07 0a 40 00 00 00 40 40 00 00 41 00 00   .....@...@@..A..
+|   2352: 00 41 10 00 00 00 00 00 00 00 00 07 09 3f 80 00   .A...........?..
+|   2368: 00 40 00 00 00 41 00 00 00 41 10 00 00 00 00 00   .@...A...A......
+|   2384: 00 00 00 07 08 00 00 00 00 3f 80 00 00 41 00 00   .........?...A..
+|   2400: 00 41 10 00 00 00 00 00 00 00 00 07 6e 40 00 00   .A..........n@..
+|   2416: 00 40 40 00 00 41 10 00 00 41 20 00 00 00 00 00   .@@..A...A .....
+|   2432: 00 00 00 07 6d 3f 80 00 00 40 00 00 00 41 10 00   ....m?...@...A..
+|   2448: 00 41 20 00 00 00 00 00 00 00 00 07 6c 00 00 00   .A .........l...
+|   2464: 00 3f 80 00 00 41 10 00 00 41 20 00 00 00 00 00   .?...A...A .....
+|   2480: 00 00 00 07 0b 40 40 00 00 40 80 00 00 41 00 00   .....@@..@...A..
+|   2496: 00 41 10 00 00 00 00 00 00 00 00 07 6f 40 40 00   .A..........o@@.
+|   2512: 00 40 80 00 00 41 10 00 00 41 20 00 00 00 00 00   .@...A...A .....
+|   2528: 00 00 00 03 ec 40 80 00 00 40 a0 00 00 00 00 00   .....@...@......
+|   2544: 00 3f 80 00 00 00 00 00 00 00 00 04 50 40 80 00   .?..........P@..
+|   2560: 00 40 a0 00 00 3f 80 00 00 40 00 00 00 00 00 00   .@...?...@......
+|   2576: 00 00 00 04 b4 40 80 00 00 40 a0 00 00 40 00 00   .....@...@...@..
+|   2592: 00 40 40 00 00 00 00 00 00 00 00 05 18 40 80 00   .@@..........@..
+|   2608: 00 40 a0 00 00 40 40 00 00 40 80 00 00 00 00 00   .@...@@..@......
+|   2624: 00 00 00 05 7c 40 80 00 00 40 a0 00 00 40 80 00   ....|@...@...@..
+|   2640: 00 40 a0 00 00 00 00 00 00 00 00 05 e0 40 80 00   .@...........@..
+|   2656: 00 40 a0 00 00 40 a0 00 00 40 c0 00 00 00 00 00   .@...@...@......
+|   2672: 00 00 00 06 44 40 80 00 00 40 a0 00 00 40 c0 00   ....D@...@...@..
+|   2688: 00 40 e0 00 00 00 00 00 00 00 00 06 a8 40 80 00   .@...........@..
+|   2704: 00 40 a0 00 00 40 e0 00 00 41 00 00 00 00 00 00   .@...@...A......
+|   2720: 00 00 00 07 0c 40 80 00 00 40 a0 00 00 41 00 00   .....@...@...A..
+|   2736: 00 41 10 00 00 00 00 00 00 00 00 07 70 40 80 00   .A..........p@..
+|   2752: 00 40 a0 00 00 41 10 00 00 41 20 00 00 00 00 00   .@...A...A .....
+|   2768: 00 00 00 03 ed 40 a0 00 00 40 c0 00 00 00 00 00   .....@...@......
+|   2784: 00 3f 80 00 00 00 00 00 00 00 00 04 51 40 a0 00   .?..........Q@..
+|   2800: 00 40 c0 00 00 3f 80 00 00 40 00 00 00 00 00 00   .@...?...@......
+|   2816: 00 00 00 04 b5 40 a0 00 00 40 c0 00 00 40 00 00   .....@...@...@..
+|   2832: 00 40 40 00 00 00 00 00 00 00 00 05 19 40 a0 00   .@@..........@..
+|   2848: 00 40 c0 00 00 40 40 00 00 40 80 00 00 89 50 01   .@...@@..@....P.
+|   2864: 04 00 93 24 00 01 00 02 00 00 00 00 00 00 00 03   ...$............
+|   2880: 00 00 00 00 40 80 00 00 00 00 00 00 3f 80 00 00   ....@.......?...
+|   2896: 00 00 00 00 00 00 00 02 00 00 00 00 41 20 00 00   ............A ..
+|   2912: 00 00 00 00 41 20 00 00 00 00 00 00 00 00 00 00   ....A ..........
+|   4080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05 03   ................
+| page 4 offset 12288
+|      0: 0d 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00   ................
+| page 5 offset 16384
+|      0: 0d 00 00 00 03 01 87 00 0b 2d 06 5a 01 87 00 00   .........-.Z....
+|    384: 00 00 00 00 00 00 00 89 50 03 04 00 93 24 00 00   ........P....$..
+|    400: 00 11 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
+|    688: 00 00 00 00 42 c8 00 00 42 4c 00 00 42 00 00 00   ....B...BL..B...
+|    720: 03 eb 40 40 00 00 40 80 00 00 00 00 00 00 3f 80   ..@@..@.......?.
+|    736: 00 00 00 00 00 00 00 00 03 ea 40 00 00 00 40 40   ..........@...@@
+|    752: 00 00 00 00 00 00 3f 80 00 00 00 00 00 00 00 00   ......?.........
+|    768: 03 e9 3f 80 00 00 40 00 00 00 00 00 00 00 3f 80   ..?...@.......?.
+|    784: 00 00 00 00 00 00 00 00 03 e8 00 00 00 00 3f 80   ..............?.
+|    800: 00 00 00 00 00 00 3f 80 00 00 00 00 00 00 00 00   ......?.........
+|   1616: 00 00 00 00 00 00 00 00 00 00 89 50 02 04 00 93   ...........P....
+|   1632: 24 00 00 00 2d 00 00 00 00 00 00 04 4c 00 00 00   $...-.......L...
+|   1648: 00 3f 80 00 00 3f 80 00 00 40 00 00 00 00 00 00   .?...?...@......
+|   1664: 00 00 00 04 b0 00 00 00 00 3f 80 00 00 40 00 00   .........?...@..
+|   1680: 00 40 40 00 00 00 00 00 00 00 00 05 14 00 00 00   .@@.............
+|   1696: 00 3f 80 00 00 40 40 00 00 40 80 00 00 00 00 00   .?...@@..@......
+|   1712: 00 00 00 05 78 00 00 00 00 3f 80 00 00 40 80 00   ....x....?...@..
+|   1728: 00 40 a0 00 00 00 00 00 00 00 00 05 dc 00 00 00   .@..............
+|   1744: 00 3f 80 00 00 40 a0 00 00 40 c0 00 00 00 00 00   .?...@...@......
+|   1760: 00 00 00 00 01 00 00 00 00 41 20 00 00 00 00 00   .........A .....
+|   1776: 00 41 0e 00 00 00 00 00 00 00 00 04 4d 3f 80 00   .A..........M?..
+|   1792: 00 40 00 00 00 3f 80 00 00 40 00 00 00 00 00 00   .@...?...@......
+|   1808: 00 00 00 04 b1 3f 80 00 00 40 00 00 00 40 00 00   .....?...@...@..
+|   1824: 00 40 40 00 00 00 00 00 00 00 00 05 15 3f 80 00   .@@..........?..
+|   1840: 00 40 00 00 00 40 40 00 00 40 80 00 00 00 00 00   .@...@@..@......
+|   1856: 00 00 00 05 79 3f 80 00 00 40 00 00 00 40 80 00   ....y?...@...@..
+|   1872: 00 40 a0 00 00 00 00 00 00 00 00 05 dd 3f 80 00   .@...........?..
+|   1888: 00 40 00 00 00 40 a0 00 00 40 c0 00 00 00 00 00   .@...@...@......
+|   1904: 00 00 00 04 4e 40 00 00 00 40 40 00 00 3f 80 00   ....N@...@@..?..
+|   1920: 00 40 00 00 00 00 00 00 00 00 00 04 b2 40 00 00   .@...........@..
+|   1936: 00 40 40 00 00 40 00 00 00 40 40 00 00 00 00 00   .@@..@...@@.....
+|   1952: 00 00 00 05 16 40 00 00 00 40 40 00 00 40 40 00   .....@...@@..@@.
+|   1968: 00 40 80 00 00 00 00 00 00 00 00 05 7a 40 00 00   .@..........z@..
+|   1984: 00 40 40 00 00 40 80 00 00 40 a0 00 00 00 00 00   .@@..@...@......
+|   2000: 00 00 00 05 de 40 00 00 00 40 40 00 00 40 a0 00   .....@...@@..@..
+|   2016: 00 40 c0 00 00 00 00 00 00 00 00 04 4f 40 40 00   .@..........O@@.
+|   2032: 00 40 80 00 00 3f 80 00 00 40 00 00 00 00 00 00   .@...?...@......
+|   2048: 00 00 00 04 b3 40 40 00 00 40 80 00 00 40 00 00   .....@@..@...@..
+|   2064: 00 40 40 00 00 00 00 00 00 00 00 05 17 40 40 00   .@@..........@@.
+|   2080: 00 40 80 00 00 40 40 00 00 40 80 00 00 00 00 00   .@...@@..@......
+|   2096: 00 00 00 05 7b 40 40 00 00 40 80 00 00 40 80 00   .....@@..@...@..
+|   2112: 00 40 a0 00 00 00 00 00 00 00 00 05 df 40 40 00   .@...........@@.
+|   2128: 00 40 80 00 00 40 a0 00 00 40 c0 00 00 00 00 00   .@...@...@......
+|   2144: 00 00 00 03 ec 40 80 00 00 40 a0 00 00 00 00 00   .....@...@......
+|   2160: 00 3f 80 00 00 00 00 00 00 00 00 04 50 40 80 00   .?..........P@..
+|   2176: 00 40 a0 00 00 3f 80 00 00 40 00 00 00 00 00 00   .@...?...@......
+|   2192: 00 00 00 04 b4 40 80 00 00 40 a0 00 00 40 00 00   .....@...@...@..
+|   2208: 00 40 40 00 00 00 00 00 00 00 00 05 18 40 80 00   .@@..........@..
+|   2224: 00 40 a0 00 00 40 40 00 00 40 80 00 00 00 00 00   .@...@@..@......
+|   2240: 00 00 00 05 7c 40 80 00 00 40 a0 00 00 40 80 00   ....|@...@...@..
+|   2256: 00 40 a0 00 00 00 00 00 00 00 00 05 e0 40 80 00   .@...........@..
+|   2272: 00 40 a0 00 00 40 a0 00 00 40 c0 00 00 00 00 00   .@...@...@......
+|   2288: 00 00 00 03 f0 41 00 00 00 41 10 00 00 00 00 00   .....A...A......
+|   2304: 00 3f 80 00 00 00 00 00 00 00 00 04 54 41 00 00   .?..........TA..
+|   2320: 00 41 10 00 00 3f 80 00 00 40 00 00 00 00 00 00   .A...?...@......
+|   2336: 00 00 00 04 b8 41 00 00 00 41 10 00 00 40 00 00   .....A...A...@..
+|   2352: 00 40 40 00 00 00 00 00 00 00 00 05 1c 41 00 00   .@@..........A..
+|   2368: 00 41 10 00 00 40 40 00 00 40 80 00 00 00 00 00   .A...@@..@......
+|   2384: 00 00 00 05 80 41 00 00 00 41 10 00 00 40 80 00   .....A...A...@..
+|   2400: 00 40 a0 00 00 00 00 00 00 00 00 05 e4 41 00 00   .@...........A..
+|   2416: 00 41 10 00 00 40 a0 00 00 40 c0 00 00 00 00 00   .A...@...@......
+|   2432: 00 00 00 06 48 41 00 00 00 41 10 00 00 40 c0 00   ....HA...A...@..
+|   2448: 00 40 e0 00 00 00 00 00 00 00 00 06 ac 41 00 00   .@...........A..
+|   2464: 00 41 10 00 00 40 e0 00 00 41 00 00 00 00 00 00   .A...@...A......
+|   2480: 00 00 00 07 10 41 00 00 00 41 10 00 00 41 00 00   .....A...A...A..
+|   2496: 00 41 10 00 00 00 00 00 00 00 00 03 f1 41 10 00   .A...........A..
+|   2512: 00 41 20 00 00 00 00 00 00 3f 80 00 00 00 00 00   .A ......?......
+|   2528: 00 00 00 04 55 41 10 00 00 41 20 00 00 3f 80 00   ....UA...A ..?..
+|   2544: 00 40 00 00 00 00 00 00 00 00 00 04 b9 41 10 00   .@...........A..
+|   2560: 00 41 20 00 00 40 00 00 00 40 40 00 00 00 00 00   .A ..@...@@.....
+|   2576: 00 00 00 05 1d 41 10 00 00 41 20 00 00 40 40 00   .....A...A ..@@.
+|   2592: 00 40 80 00 00 00 00 00 00 00 00 05 81 41 10 00   .@...........A..
+|   2608: 00 41 20 00 00 40 80 00 00 40 a0 00 00 00 00 00   .A ..@...@......
+|   2624: 00 00 00 05 e5 41 10 00 00 41 20 00 00 40 a0 00   .....A...A ..@..
+|   2640: 00 40 c0 00 00 00 00 00 00 00 00 06 49 41 10 00   .@..........IA..
+|   2656: 00 41 20 00 00 40 c0 00 00 40 e0 00 00 00 00 00   .A ..@...@......
+|   2672: 00 00 00 06 ad 41 10 00 00 41 20 00 00 40 e0 00   .....A...A ..@..
+|   2688: 00 41 00 00 00 00 00 00 00 00 00 07 11 41 10 00   .A...........A..
+|   2704: 00 41 20 00 00 41 00 00 00 41 10 00 00 00 00 00   .A ..A...A......
+|   2848: 00 00 00 00 00 00 00 00 00 00 00 00 00 89 50 01   ..............P.
+|   2864: 04 00 93 24 00 01 00 04 00 00 00 00 00 00 00 03   ...$............
+|   2880: 00 00 00 00 40 80 00 00 00 00 00 00 3f 80 00 00   ....@.......?...
+|   2896: 00 00 00 00 00 00 00 02 00 00 00 00 41 20 00 00   ............A ..
+|   2912: 00 00 00 00 41 10 00 00 00 00 00 00 00 00 00 04   ....A...........
+|   2928: 00 00 00 00 41 20 00 00 40 c0 00 00 41 20 00 00   ....A ..@...A ..
+|   2944: 00 00 00 00 00 00 00 05 40 a0 00 00 41 00 00 00   ........@...A...
+|   2960: 00 00 00 00 41 20 00 00 00 00 00 00 00 00 00 00   ....A ..........
+| page 6 offset 20480
+|      0: 0d 00 00 00 02 06 5a 00 0b 2d 06 5a 00 00 00 00   ......Z..-.Z....
+|   1616: 00 00 00 00 00 00 00 00 00 00 89 50 05 04 00 93   ...........P....
+|   1632: 24 00 00 00 1c 00 00 00 00 00 00 03 ed 40 a0 00   $............@..
+|   1648: 00 40 c0 00 00 00 00 00 00 3f 80 00 00 00 00 00   .@.......?......
+|   1664: 00 00 00 04 51 40 a0 00 00 40 c0 00 00 3f 80 00   ....Q@...@...?..
+|   1680: 00 40 00 00 00 00 00 00 00 00 00 04 b5 40 a0 00   .@...........@..
+|   1696: 00 40 c0 00 00 40 00 00 00 40 40 00 00 00 00 00   .@...@...@@.....
+|   1712: 00 00 00 05 19 40 a0 00 00 40 c0 00 00 40 40 00   .....@...@...@@.
+|   1728: 00 40 80 00 00 00 00 00 00 00 00 05 7d 40 a0 00   .@...........@..
+|   1744: 00 40 c0 00 00 40 80 00 00 40 a0 00 00 00 00 00   .@...@...@......
+|   1760: 00 00 00 05 e1 40 a0 00 00 40 c0 00 00 40 a0 00   .....@...@...@..
+|   1776: 00 40 c0 00 00 00 00 00 00 00 00 06 45 40 a0 00   .@..........E@..
+|   1792: 00 40 c0 00 00 40 c0 00 00 40 e0 00 00 00 00 00   .@...@...@......
+|   1808: 00 00 00 06 a9 40 a0 00 00 40 c0 00 00 40 e0 00   .....@...@...@..
+|   1824: 00 41 00 00 00 00 00 00 00 00 00 07 0d 40 a0 00   .A...........@..
+|   1840: 00 40 c0 00 00 41 00 00 00 41 10 00 00 00 00 00   .@...A...A......
+|   1856: 00 00 00 03 ee 40 c0 00 00 40 e0 00 00 00 00 00   .....@...@......
+|   1872: 00 3f 80 00 00 00 00 00 00 00 00 04 52 40 c0 00   .?..........R@..
+|   1888: 00 40 e0 00 00 3f 80 00 00 40 00 00 00 00 00 00   .@...?...@......
+|   1904: 00 00 00 04 b6 40 c0 00 00 40 e0 00 00 40 00 00   .....@...@...@..
+|   1920: 00 40 40 00 00 00 00 00 00 00 00 05 1a 40 c0 00   .@@..........@..
+|   1936: 00 40 e0 00 00 40 40 00 00 40 80 00 00 00 00 00   .@...@@..@......
+|   1952: 00 00 00 05 7e 40 c0 00 00 40 e0 00 00 40 80 00   ....~@...@...@..
+|   1968: 00 40 a0 00 00 00 00 00 00 00 00 05 e2 40 c0 00   .@...........@..
+|   1984: 00 40 e0 00 00 40 a0 00 00 40 c0 00 00 00 00 00   .@...@...@......
+|   2000: 00 00 00 06 46 40 c0 00 00 40 e0 00 00 40 c0 00   ....F@...@...@..
+|   2016: 00 40 e0 00 00 00 00 00 00 00 00 06 aa 40 c0 00   .@...........@..
+|   2032: 00 40 e0 00 00 40 e0 00 00 41 00 00 00 00 00 00   .@...@...A......
+|   2048: 00 00 00 07 0e 40 c0 00 00 40 e0 00 00 41 00 00   .....@...@...A..
+|   2064: 00 41 10 00 00 00 00 00 00 00 00 03 ef 40 e0 00   .A...........@..
+|   2080: 00 41 00 00 00 00 00 00 00 3f 80 00 00 00 00 00   .A.......?......
+|   2096: 00 00 00 04 53 40 e0 00 00 41 00 00 00 3f 80 00   ....S@...A...?..
+|   2112: 00 40 00 00 00 00 00 00 00 00 00 04 b7 40 e0 00   .@...........@..
+|   2128: 00 41 00 00 00 40 00 00 00 40 40 00 00 00 00 00   .A...@...@@.....
+|   2144: 00 00 00 05 1b 40 e0 00 00 41 00 00 00 40 40 00   .....@...A...@@.
+|   2160: 00 40 80 00 00 00 00 00 00 00 00 05 7f 40 e0 00   .@...........@..
+|   2176: 00 41 00 00 00 40 80 00 00 40 a0 00 00 00 00 00   .A...@...@......
+|   2192: 00 00 00 05 e3 40 e0 00 00 41 00 00 00 40 a0 00   .....@...A...@..
+|   2208: 00 40 c0 00 00 00 00 00 00 00 00 06 47 40 e0 00   .@..........G@..
+|   2224: 00 41 00 00 00 40 c0 00 00 40 e0 00 00 00 00 00   .A...@...@......
+|   2240: 00 00 00 06 ab 40 e0 00 00 41 00 00 00 40 e0 00   .....@...A...@..
+|   2256: 00 41 00 00 00 00 00 00 00 00 00 07 0f 40 e0 00   .A...........@..
+|   2272: 00 41 00 00 00 41 00 00 00 41 10 00 00 00 00 00   .A...A...A......
+|   2288: 00 00 00 07 73 40 e0 00 00 41 00 00 00 41 10 00   ....s@...A...A..
+|   2304: 00 41 20 00 00 00 00 00 00 00 00 00 00 00 00 00   .A .............
+|   2848: 00 00 00 00 00 00 00 00 00 00 00 00 00 89 50 04   ..............P.
+|   2864: 04 00 93 24 00 00 00 18 00 00 00 00 00 00 06 43   ...$...........C
+|   2880: 40 40 00 00 40 80 00 00 40 c0 00 00 40 e0 00 00   @@..@...@...@...
+|   2896: 00 00 00 00 00 00 06 42 40 00 00 00 40 40 00 00   .......B@...@@..
+|   2912: 40 c0 00 00 40 e0 00 00 00 00 00 00 00 00 06 41   @...@..........A
+|   2928: 3f 80 00 00 40 00 00 00 40 c0 00 00 40 e0 00 00   ?...@...@...@...
+|   2944: 00 00 00 00 00 00 06 40 00 00 00 00 3f 80 00 00   .......@....?...
+|   2960: 40 c0 00 00 40 e0 00 00 00 00 00 00 00 00 06 44   @...@..........D
+|   2976: 40 80 00 00 40 a0 00 00 40 c0 00 00 40 e0 00 00   @...@...@...@...
+|   2992: 00 00 00 00 00 00 06 a7 40 40 00 00 40 80 00 00   ........@@..@...
+|   3008: 40 e0 00 00 41 00 00 00 00 00 00 00 00 00 06 a6   @...A...........
+|   3024: 40 00 00 00 40 40 00 00 40 e0 00 00 41 00 00 00   @...@@..@...A...
+|   3040: 00 00 00 00 00 00 06 a5 3f 80 00 00 40 00 00 00   ........?...@...
+|   3056: 40 e0 00 00 41 00 00 00 00 00 00 00 00 00 06 a4   @...A...........
+|   3072: 00 00 00 00 3f 80 00 00 40 e0 00 00 41 00 00 00   ....?...@...A...
+|   3088: 00 00 00 00 00 00 06 a8 40 80 00 00 40 a0 00 00   ........@...@...
+|   3104: 40 e0 00 00 41 00 00 00 00 00 00 00 00 00 07 0a   @...A...........
+|   3120: 40 00 00 00 40 40 00 00 41 00 00 00 41 10 00 00   @...@@..A...A...
+|   3136: 00 00 00 00 00 00 07 09 3f 80 00 00 40 00 00 00   ........?...@...
+|   3152: 41 00 00 00 41 10 00 00 00 00 00 00 00 00 07 08   A...A...........
+|   3168: 00 00 00 00 3f 80 00 00 41 00 00 00 41 10 00 00   ....?...A...A...
+|   3184: 00 00 00 00 00 00 07 0b 40 40 00 00 40 80 00 00   ........@@..@...
+|   3200: 41 00 00 00 41 10 00 00 00 00 00 00 00 00 07 0c   A...A...........
+|   3216: 40 80 00 00 40 a0 00 00 41 00 00 00 41 10 00 00   @...@...A...A...
+|   3232: 00 00 00 00 00 00 07 6e 40 00 00 00 40 40 00 00   .......n@...@@..
+|   3248: 41 10 00 00 41 20 00 00 00 00 00 00 00 00 07 6d   A...A .........m
+|   3264: 3f 80 00 00 40 00 00 00 41 10 00 00 41 20 00 00   ?...@...A...A ..
+|   3280: 00 00 00 00 00 00 07 6c 00 00 00 00 3f 80 00 00   .......l....?...
+|   3296: 41 10 00 00 41 20 00 00 00 00 00 00 00 00 07 6f   A...A .........o
+|   3312: 40 40 00 00 40 80 00 00 41 10 00 00 41 20 00 00   @@..@...A...A ..
+|   3328: 00 00 00 00 00 00 07 70 40 80 00 00 40 a0 00 00   .......p@...@...
+|   3344: 41 10 00 00 41 20 00 00 00 00 00 00 00 00 07 71   A...A .........q
+|   3360: 40 a0 00 00 40 c0 00 00 41 10 00 00 41 20 00 00   @...@...A...A ..
+|   3376: 00 00 00 00 00 00 07 72 40 c0 00 00 40 e0 00 00   .......r@...@...
+|   3392: 41 10 00 00 41 20 00 00 00 00 00 00 00 00 07 74   A...A .........t
+|   3408: 41 00 00 00 41 10 00 00 41 10 00 00 41 20 00 00   A...A...A...A ..
+|   3424: 00 00 00 00 00 00 07 75 41 10 00 00 41 20 00 00   .......uA...A ..
+|   3440: 41 10 00 00 41 20 00 00 00 00 00 00 00 00 00 00   A...A ..........
+| end c1b.db
+  }]
+  catchsql {
+     SELECT rtreecheck('t1');
+  }
+} {1 {SQL logic error}}
+
+do_test rtreefuzz001-200 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 16384 pagesize 4096 filename c3.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 00 00 00 00 04   .....@  ........
+|     32: 00 00 00 00 01 00 00 00 00 00 00 04 00 00 00 04   ................
+|     48: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00   ................
+|     96: 00 00 00 00 0d 00 00 00 04 0e 9c 00 0f ad 0f 4f   ...............O
+|    112: 0e fc 0e 9c 00 00 00 00 00 00 00 00 00 00 00 00   ................
+|   3728: 00 00 00 00 00 00 00 00 00 00 00 00 5e 04 07 17   ............^...
+|   3744: 1f 1f 01 81 0b 74 61 62 6c 65 74 31 5f 70 61 72   .....tablet1_par
+|   3760: 65 6e 74 74 31 5f 70 61 72 65 6e 74 04 43 52 45   entt1_parent.CRE
+|   3776: 41 54 45 20 54 41 42 4c 45 20 22 74 31 5f 70 61   ATE TABLE .t1_pa
+|   3792: 72 65 6e 74 22 28 6e 6f 64 65 6e 6f 20 49 4e 54   rent.(nodeno INT
+|   3808: 45 47 45 52 20 50 52 49 4d 41 52 59 20 4b 45 59   EGER PRIMARY KEY
+|   3824: 2c 70 61 72 65 6e 74 6e 6f 64 65 29 51 03 06 17   ,parentnode)Q...
+|   3840: 1b 1b 01 7b 74 61 62 6c 65 74 31 5f 6e 6f 64 65   ....tablet1_node
+|   3856: 74 31 5f 6e 6f 64 65 03 43 52 45 41 54 45 20 54   t1_node.CREATE T
+|   3872: 41 42 4c 45 20 22 74 31 5f 6e 6f 64 65 22 28 6e   ABLE .t1_node.(n
+|   3888: 6f 64 65 6e 6f 20 49 4e 54 45 47 45 52 20 50 52   odeno INTEGER PR
+|   3904: 49 4d 41 52 59 20 4b 45 59 2c 64 61 74 61 29 5c   IMARY KEY,data).
+|   3920: 02 07 17 1d 1d 01 81 0b 74 61 62 6c 65 74 31 5f   ........tablet1_
+|   3936: 72 6f 77 69 64 74 31 5f 72 6f 77 69 64 02 43 52   rowidt1_rowid.CR
+|   3952: 45 41 54 45 20 54 41 42 4c 45 20 22 74 31 5f 72   EATE TABLE .t1_r
+|   3968: 6f 77 69 64 22 28 72 6f 77 69 64 20 49 4e 54 45   owid.(rowid INTE
+|   3984: 47 45 52 20 50 52 49 4d 41 52 59 20 4b 45 59 2c   GER PRIMARY KEY,
+|   4000: 6e 6f 64 65 6e 6f 2c 61 30 2c 61 31 29 51 01 07   nodeno,a0,a1)Q..
+|   4016: 17 11 11 08 81 0f 74 61 62 6c 65 74 31 74 31 43   ......tablet1t1C
+|   4032: 52 45 41 54 45 20 56 49 52 54 55 41 4c 20 54 41   REATE VIRTUAL TA
+|   4048: 42 4c 45 20 74 31 20 55 53 49 4e 47 20 72 74 72   BLE t1 USING rtr
+|   4064: 65 65 28 69 64 2c 78 30 2c 78 31 2c 79 30 2c 79   ee(id,x0,x1,y0,y
+|   4080: 31 2c 2b 6c 61 62 65 6c 2c 2b 6f 74 68 65 72 29   1,+label,+other)
+| page 2 offset 4096
+|      0: 0d 00 00 00 0e 0e f7 00 0f e8 0f d0 0f b7 0f 9e   ................
+|     16: 0f 91 0f 81 0f 70 0f 5e 0f 4f 0f 39 0f 29 0f 18   .....p.^.O.9.)..
+|     32: 0f 06 0e f7 00 00 00 00 00 00 00 00 00 00 00 00   ................
+|   3824: 00 00 00 00 00 00 00 0d 0e 05 00 09 1d 00 74 6f   ..............to
+|   3840: 70 20 68 61 6c 66 10 0d 05 00 09 23 00 62 6f 74   p half.....#.bot
+|   3856: 74 6f 6d 20 68 61 6c 66 0f 0c 05 00 09 21 00 72   tom half.....!.r
+|   3872: 69 67 68 74 20 68 61 6c 66 0e 0b 05 00 09 1f 00   ight half.......
+|   3888: 6c 65 66 74 20 68 61 6c 66 14 0a 05 00 09 2b 00   left half.....+.
+|   3904: 74 68 65 20 77 68 6f 6c 65 20 74 68 69 6e 67 0d   the whole thing.
+|   3920: 09 05 00 09 1d 00 74 6f 70 20 65 64 67 65 10 08   ......top edge..
+|   3936: 05 00 09 23 00 62 6f 74 74 6f 6d 20 65 64 67 65   ...#.bottom edge
+|   3952: 0f 07 05 00 09 21 00 72 69 67 68 74 20 65 64 67   .....!.right edg
+|   3968: 65 0e 06 05 00 09 1f 00 6c 65 66 74 20 65 64 67   e.......left edg
+|   3984: 65 0b 05 05 00 09 19 00 63 65 6e 74 65 72 17 04   e.......center..
+|   4000: 05 00 09 31 00 75 70 70 65 72 2d 72 69 67 68 74   ...1.upper-right
+|   4016: 20 63 6f 72 6e 65 72 17 03 05 00 09 31 00 6c 6f    corner.....1.lo
+|   4032: 77 65 72 2d 72 69 67 68 74 27 60 f6 32 6e 65 72   wer-right'`.2ner
+|   4048: 16 02 05 00 09 2f 00 75 70 70 65 72 2d 6c 65 66   ...../.upper-lef
+|   4064: 74 20 63 6f 72 6e 65 72 16 01 05 00 09 2f 00 6c   t corner...../.l
+|   4080: 6f 77 65 72 2d 6c 65 66 74 20 63 6f 72 6e 65 72   ower-left corner
+| page 3 offset 8192
+|      0: 0d 00 00 00 02 0b 2d 00 0b 2d 00 00 00 00 00 00   ......-..-......
+|   2848: 00 00 00 00 00 00 00 00 00 00 00 00 00 89 50 01   ..............P.
+|   2864: 04 00 93 24 00 00 00 0e 00 00 00 00 00 00 00 01   ...$............
+|   2880: 00 00 00 00 41 20 00 00 00 00 00 00 41 20 01 00   ....A ......A ..
+|   2896: 00 00 00 00 00 00 00 02 00 00 00 00 41 00 00 04   ............A...
+|   2912: 2b 40 00 0c 42 c8 00 00 00 00 00 00 00 00 00 03   +@..B...........
+|   2928: 42 b4 00 00 42 c8 00 00 00 00 00 00 41 20 00 00   B...B.......A ..
+|   2944: 00 00 00 00 00 00 00 04 42 b4 00 00 42 c8 00 00   ........B...B...
+|   2960: 42 b4 00 00 42 c8 00 00 00 00 00 00 00 00 00 05   B...B...........
+|   2976: 42 20 00 00 42 70 00 00 42 20 00 00 42 70 00 00   B ..Bp..B ..Bp..
+|   2992: 00 00 00 00 00 00 00 60 00 00 00 04 0a 00 00 00   .......`........
+|   3008: 00 00 00 42 c8 00 00 00 00 00 00 00 00 00 07 42   ...B...........B
+|   3024: be 00 00 42 c8 00 00 00 00 00 00 42 c8 00 00 00   ...B.......B....
+|   3040: 00 00 00 00 00 00 08 00 00 00 00 42 c8 00 00 00   ...........B....
+|   3056: 00 00 00 40 a0 00 00 00 00 00 00 00 00 00 09 00   ...@............
+|   3072: 00 00 00 42 c8 00 00 42 be 00 00 42 c8 00 00 00   ...B...B...B....
+|   3088: 00 00 00 00 00 00 0a 00 00 00 00 42 c8 00 00 00   ...........B....
+|   3104: 00 00 00 42 c8 00 00 00 00 00 00 00 00 00 0b 00   ...B............
+|   3120: 00 00 00 42 48 00 00 00 00 00 04 2c 80 00 00 00   ...BH......,....
+|   3136: 00 00 00 00 00 00 c4 24 c0 00 04 2c 80 00 00 00   .......$...,....
+|   3152: 00 00 04 2c 80 00 00 00 00 00 00 00 00 00 d0 00   ...,............
+|   3168: 00 00 04 2c 80 00 00 00 00 00 04 24 80 00 00 00   ...,.......$....
+|   3184: 00 00 00 00 00 00 e0 00 00 00 04 2c 80 00 04 24   ...........,...$
+|   3200: c0 00 04 2c 00 00 00 00 00 00 00 00 00 00 00 00   ...,............
+| page 4 offset 12288
+|      0: 0d 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00   ................
+| end c3.db
+  }]
+  catchsql {
+    WITH RECURSIVE
+      c1(x) AS (VALUES(0) UNION ALL SELECT x+1 FROM c1 WHERE x<99),
+      c2(y) AS (VALUES(0) UNION ALL SELECT y+1 FROM c2 WHERE y<99)
+    INSERT INTO t1(id, x0,x1,y0,y1,label)
+      SELECT 1000+x+y*100, x, x+1, y, y+1, printf('box-%d,%d',x,y) FROM c1, c2;
+  }
+} {1 {database disk image is malformed}}
+do_test rtreefuzz001-210 {
+  catchsql {
+    SELECT rtreecheck('t1');
+  }
+} {/1 .*corrupt.*/}
+
+do_test rtreefuzz001-300 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 16384 pagesize 4096 filename c4.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 00 00 00 00 04   .....@  ........
+|     32: 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 04   ................
+|     96: 00 00 00 00 0d 00 00 00 04 0e 9c 00 0f ad 0f 4f   ...............O
+|    112: 0e fc 0e 9c 00 00 00 00 00 00 00 00 00 00 00 00   ................
+|   3728: 00 00 00 00 00 00 00 00 00 00 00 00 5e 04 07 17   ............^...
+|   3744: 1f 1f 01 81 0b 74 61 62 6c 65 74 31 5f 70 61 72   .....tablet1_par
+|   3760: 65 6e 74 74 31 5f 70 61 72 65 6e 74 04 43 52 45   entt1_parent.CRE
+|   3776: 41 54 45 20 54 41 42 4c 45 20 22 74 31 5f 70 61   ATE TABLE .t1_pa
+|   3792: 72 65 6e 74 22 28 6e 6f 64 65 6e 6f 20 49 4e 54   rent.(nodeno INT
+|   3808: 45 47 45 52 20 50 52 49 4d 41 52 59 20 4b 45 59   EGER PRIMARY KEY
+|   3824: 2c 70 61 72 65 6e 74 6e 6f 64 65 29 51 03 06 17   ,parentnode)Q...
+|   3840: 1b 1b 01 7b 74 61 62 6c 65 74 31 5f 6e 6f 64 65   ....tablet1_node
+|   3856: 74 31 5f 6e 6f 64 65 03 43 52 45 41 54 45 20 54   t1_node.CREATE T
+|   3872: 41 42 4c 45 20 22 74 31 5f 6e 6f 64 65 22 28 6e   ABLE .t1_node.(n
+|   3888: 6f 64 65 6e 6f 20 49 4e 54 45 47 45 52 20 50 52   odeno INTEGER PR
+|   3904: 49 4d 41 52 59 20 4b 45 59 2c 64 61 74 61 29 5c   IMARY KEY,data).
+|   3920: 02 07 17 1d 1d 01 81 0b 74 61 62 6c 65 74 31 5f   ........tablet1_
+|   3936: 72 6f 77 69 64 74 31 5f 72 6f 77 69 64 02 43 52   rowidt1_rowid.CR
+|   3952: 45 41 54 45 20 54 41 42 4c 45 20 22 74 31 5f 72   EATE TABLE .t1_r
+|   3968: 6f 77 69 64 22 28 72 6f 77 69 64 20 49 4e 54 45   owid.(rowid INTE
+|   3984: 47 45 72 20 50 52 49 4d 41 52 59 20 4b 45 59 2c   GEr PRIMARY KEY,
+|   4000: 6e 6f 64 65 6e 6f 2c 61 30 2c 61 31 29 51 01 07   nodeno,a0,a1)Q..
+|   4016: 17 11 11 08 81 0f 74 61 62 6c 65 74 31 74 31 43   ......tablet1t1C
+|   4032: 52 45 41 54 45 20 56 49 52 54 55 41 4c 20 54 41   REATE VIRTUAL TA
+|   4048: 42 4c 45 20 74 31 20 55 53 49 4e 47 20 72 74 72   BLE t1 USING rtr
+|   4064: 65 65 28 69 64 2c 78 30 2c 78 31 2c 79 30 2c 79   ee(id,x0,x1,y0,y
+|   4080: 31 2c 2b 6c 61 62 65 6c 2c 2b 6f 74 68 65 72 29   1,+label,+other)
+| page 2 offset 4096
+|      0: 0d 00 00 00 0e 0e f7 00 0f e8 0f 00 fb 70 f9 e0   .............p..
+|     16: f9 10 f8 10 f7 00 f5 e0 f4 f0 f3 90 f2 90 f1 80   ................
+|     32: f0 60 ef 00 00 00 00 00 00 00 00 00 00 00 00 00   .`..............
+|   3824: 00 00 00 00 00 00 00 0d 0e 05 00 09 1d 00 74 6f   ..............to
+|   3840: 70 20 68 61 6c 66 10 0d 05 00 09 23 00 62 6f 74   p half.....#.bot
+|   3856: 74 6f 6d 20 68 61 6c 66 0f 0c 05 00 09 21 00 72   tom half.....!.r
+|   3872: 69 67 68 74 20 68 61 6c 66 0e 0b 05 00 09 1f 00   ight half.......
+|   3888: 6c 65 66 74 20 68 61 6c 66 14 0a 05 00 09 2b 00   left half.....+.
+|   3904: 00 03 98 20 49 98 2f 6c 62 05 74 68 69 6e 67 0d   ... I./lb.thing.
+|   3920: 09 05 00 09 1d 00 74 6f 70 20 65 64 67 65 10 08   ......top edge..
+|   3936: 05 00 09 23 00 62 6f 74 74 6f 6d 20 65 64 67 65   ...#.bottom edge
+|   3952: 0f 07 05 00 09 21 00 72 69 67 68 74 20 65 64 67   .....!.right edg
+|   3968: 65 0e 06 05 00 09 1f 00 6c 65 66 74 20 65 64 67   e.......left edg
+|   3984: 65 0b 05 05 00 09 19 00 63 65 6e 74 65 72 17 04   e.......center..
+|   4000: 05 00 09 31 00 75 70 70 65 72 2d 72 69 67 68 74   ...1.upper-right
+|   4016: 20 63 6f 72 6e 65 72 17 03 05 00 09 31 00 6c 6f    corner.....1.lo
+|   4032: 77 65 72 2d 72 69 67 68 74 20 63 6f 72 6e 65 72   wer-right corner
+|   4048: 16 02 05 00 09 2f 00 75 70 70 65 72 2d 6c 65 66   ...../.upper-lef
+|   4064: 74 20 63 6f 72 6e 65 72 16 01 05 00 09 2f 00 6c   t corner...../.l
+|   4080: 6f 77 65 72 2d 6c 65 66 74 20 63 6f 72 6e 65 72   ower-left corner
+| page 3 offset 8192
+|      0: 0d 00 00 00 01 0b 2d 00 0b 2d 00 00 00 00 00 00   ......-..-......
+|   2848: 00 00 00 00 00 00 00 00 00 00 00 00 00 89 50 01   ..............P.
+|   2864: 04 00 93 24 00 00 00 0e 00 00 00 00 00 00 00 01   ...$............
+|   2880: 00 00 00 04 01 20 00 00 00 00 00 04 12 00 00 00   ..... ..........
+|   2896: 00 00 00 00 00 00 00 23 00 00 00 00 41 20 00 00   .......#....A ..
+|   2912: 42 b4 00 00 42 c8 00 00 00 00 00 00 00 00 00 03   B...B...........
+|   2928: 42 b4 00 00 42 c8 00 00 00 00 00 00 41 20 00 00   B...B.......A ..
+|   2944: 00 00 00 00 00 00 00 04 42 b4 00 00 42 c8 00 00   ........B...B...
+|   2960: 42 b4 00 00 42 c8 00 00 00 00 00 00 00 00 00 05   B...B...........
+|   2976: 42 20 00 00 42 70 00 00 42 20 00 00 42 70 00 00   B ..Bp..B ..Bp..
+|   2992: 00 00 00 00 00 00 00 06 00 00 00 00 40 a0 00 00   ............@...
+|   3008: 00 00 00 04 2c 80 00 00 00 00 00 00 00 00 00 74   ....,..........t
+|   3024: 2b e0 00 04 2c 80 00 04 2c 80 00 00 00 00 00 00   +...,...,.......
+|   3040: 00 00 00 80 00 00 00 04 2c 80 00 00 00 00 00 04   ........,.......
+|   3056: 0a 00 00 00 00 00 b0 80 00 00 04 2c 80 00 04 2b   ...........,...+
+|   3072: e0 00 04 2c 80 00 00 00 00 00 00 00 00 00 a0 00   ...,............
+|   3088: 00 00 04 2c 80 00 00 00 00 00 04 2c 80 00 00 00   ...,.......,....
+|   3104: 00 00 00 00 00 00 b0 00 00 00 04 24 80 00 00 00   ...........$....
+|   3120: 00 00 04 2c 80 00 00 00 00 00 00 00 50 00 91 f0   ...,........P...
+|   3136: 06 c6 56 67 42 06 86 16 c6 61 40 a0 50 00 92 b0   ..VgB....a@.P...
+|   3152: 07 46 86 52 07 76 86 f6 c6 52 07 46 86 96 e6 70   .F.R.v...R.F...p
+|   3168: d0 90 50 00 91 d0 07 46 f7 02 06 56 46 76 51 00   ..P....F...VFvQ.
+|   3184: 80 50 00 92 30 06 26 f7 47 46 f6 d2 06 56 46 76   .P..0.&.GF...VFv
+|   3200: 50 f0 70 50 00 92 10 07 26 96 76 87 42 06 56 46   P.pP....&.v.B.VF
+|   3216: 76 50 e0 60 50 00 91 f0 06 c6 56 67 42 06 56 46   vP.`P.....VgB.VF
+|   3232: 76 50 b0 50 50 00 91 90 06 36 56 e7 46 57 21 70   vP.PP....6V.FW!p
+|   3248: 40 50 00 93 10 07 57 07 06 57 22 d7 26 96 76 87   @P....W..W..&.v.
+|   3264: 42 06 36 f7 26 e6 57 21 70 30 50 00 93 10 06 c6   B.6.&.W!p0P.....
+|   3280: f7 76 57 22 d7 26 96 76 87 42 06 36 f7 26 e6 57   .vW..&.v.B.6.&.W
+|   3296: 21 60 20 50 00 92 f0 07 57 07 06 57 22 d6 c6 56   !` P....W..W...V
+|   3312: 60 00 00 c4 24 c0 00 04 2c 80 00 00 00 00 00 04   `...$...,.......
+|   3328: 2c 80 00 00 00 00 00 00 00 00 00 d0 00 00 00 04   ,...............
+|   3344: 2c 80 00 00 00 00 00 04 24 80 00 00 00 00 00 00   ,.......$.......
+|   3360: 00 00 00 e0 00 00 00 04 2c 80 00 04 24 c0 00 04   ........,...$...
+|   3376: 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ,...............
+| page 4 offset 12288
+|      0: 0d 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00   ................
+| end c4.db
+  }]
+  catchsql {
+    UPDATE t1 SET label='x';
+  }
+} {1 {rtree constraint failed: t1.(y0<=y1)}}
+do_test rtreefuzz001-310 {
+  catchsql {
+    SELECT rtreecheck('t1');
+  }
+} {/1 .*corrupt.*/}
+
+do_test rtreefuzz001-400 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 16384 pagesize 4096 filename c7.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 00 00 00 00 04   .....@  ........
+|     32: 00 00 00 00 01 00 00 00 00 00 00 04 00 00 00 04   ................
+|     48: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00   ................
+|     96: 00 00 00 00 0d 00 00 00 04 0e 9c 00 0f ad 0f 4f   ...............O
+|    112: 0e fc 0e 9c 00 00 00 00 00 00 00 00 00 00 00 00   ................
+|   3728: 00 00 00 00 00 00 00 00 00 00 00 00 5e 04 07 17   ............^...
+|   3744: 1f 1f 01 81 0b 74 61 62 6c 65 74 31 5f 70 61 72   .....tablet1_par
+|   3760: 65 6e 74 74 31 5f 70 61 72 65 6e 74 04 43 52 45   entt1_parent.CRE
+|   3776: 41 54 45 20 54 41 42 4c 45 20 22 74 31 5f 70 61   ATE TABLE .t1_pa
+|   3792: 72 65 6e 74 22 28 6e 6f 64 65 6e 6f 20 49 4e 54   rent.(nodeno INT
+|   3808: 45 47 45 52 20 50 52 49 4d 41 52 59 20 4b 45 59   EGER PRIMARY KEY
+|   3824: 2c 70 61 72 65 6e 74 6e 6f 64 65 29 51 03 06 17   ,parentnode)Q...
+|   3840: 1b 1b 01 7b 74 61 62 6c 65 74 31 5f 6e 6f 64 65   ....tablet1_node
+|   3856: 74 31 5f 6e 6f 64 65 03 43 52 45 41 54 45 20 54   t1_node.CREATE T
+|   3872: 41 42 4c 45 20 22 74 31 5f 6e 6f 64 65 22 28 6e   ABLE .t1_node.(n
+|   3888: 6f 64 65 6e 6f 20 49 4e 54 45 47 45 52 20 50 52   odeno INTEGER PR
+|   3904: 49 4d 41 52 59 20 4b 45 59 2c 64 61 74 61 29 5c   IMARY KEY,data).
+|   3920: 02 07 17 1d 1d 01 81 0b 74 61 62 6c 65 74 31 5f   ........tablet1_
+|   3936: 72 6f 77 69 64 74 31 5f 72 6f 77 69 64 02 43 52   rowidt1_rowid.CR
+|   3952: 45 41 54 45 20 54 41 42 4c 45 20 22 74 31 5f 72   EATE TABLE .t1_r
+|   3968: 6f 77 69 64 22 28 72 6f 77 69 64 20 49 4e 54 45   owid.(rowid INTE
+|   3984: 47 45 52 20 50 52 49 4d 41 52 59 20 4b 45 59 2c   GER PRIMARY KEY,
+|   4000: 6e 6f 64 65 6e 6f 2c 61 30 2c 61 31 29 51 01 07   nodeno,a0,a1)Q..
+|   4016: 17 11 11 08 81 0f 74 61 62 6c 65 74 31 74 31 43   ......tablet1t1C
+|   4032: 52 45 41 54 45 20 56 49 52 54 55 41 4c 20 54 41   REATE VIRTUAL TA
+|   4048: 42 4c 45 20 74 31 20 55 53 49 4e 47 20 72 74 72   BLE t1 USING rtr
+|   4064: 65 65 28 69 64 2c 78 30 2c 78 31 2c 79 30 2c 79   ee(id,x0,x1,y0,y
+|   4080: 31 2c 2b 6c 61 62 65 6c 2c 2b 6f 74 68 65 72 29   1,+label,+other)
+| page 2 offset 4096
+|      0: 0d 00 00 00 0e 0e f7 00 0f e8 0f d0 0f b7 0f 9e   ................
+|     16: 0f 91 0f 81 0f 70 0f 5e 0f 4f 0f 39 0f 29 0f 18   .....p.^.O.9.)..
+|     32: 0f 06 0e f7 00 00 00 00 00 00 00 00 00 00 00 00   ................
+|   3824: 00 00 00 00 00 00 00 0d 0e 05 00 09 1d 00 74 6f   ..............to
+|   3840: 70 20 68 61 6c 66 10 0d 05 00 09 23 00 62 6f 74   p half.....#.bot
+|   3856: 74 6f 6d 20 68 61 6c 66 0f 0c 05 00 09 21 00 72   tom half.....!.r
+|   3872: 69 67 68 74 20 68 61 6c 66 0e 0b 05 00 09 1f 00   ight half.......
+|   3888: 6c 65 66 74 20 68 61 6c 66 14 0a 05 00 09 2b 00   left half.....+.
+|   3904: 74 68 65 20 77 68 6f 6c 65 20 74 68 69 6e 67 0d   the whole thing.
+|   3920: 09 05 00 09 1d 00 74 6f 70 20 65 64 67 65 10 08   ......top edge..
+|   3936: 05 00 09 23 00 62 6f 74 74 6f 6d 20 65 64 67 65   ...#.bottom edge
+|   3952: 0f 07 05 00 09 21 00 72 69 67 68 74 20 65 64 67   .....!.right edg
+|   3968: 65 0e 06 05 00 09 1f 00 6c 65 66 74 20 65 64 67   e.......left edg
+|   3984: 65 0b 05 05 00 09 19 00 23 65 6e 74 65 72 17 04   e.......#enter..
+|   4000: 05 00 09 31 00 75 70 70 65 72 2d 72 69 67 68 74   ...1.upper-right
+|   4016: 20 63 6f 72 6e 65 72 17 03 05 00 09 31 00 6c 6f    corner.....1.lo
+|   4032: 77 65 72 2d 72 69 67 68 74 20 63 6f 72 6e 65 72   wer-right corner
+|   4048: 16 02 05 00 09 2f 00 75 70 70 65 72 2d 6c 65 66   ...../.upper-lef
+|   4064: 74 20 63 6f 72 6e 65 72 16 01 05 00 09 2f 00 6c   t corner...../.l
+|   4080: 6f 77 65 72 2d 6c 65 66 74 20 63 6f 72 6e 65 72   ower-left corner
+| page 3 offset 8192
+|      0: 0d 00 00 00 02 0b 2d 00 0b 2d 00 00 00 00 00 00   ......-..-......
+|   2848: 00 00 00 00 00 00 00 00 00 00 00 00 00 89 50 01   ..............P.
+|   2864: 04 00 93 24 00 00 00 00 00 00 00 00 08 00 00 00   ...$............
+|   2880: 00 42 c8 00 00 00 00 00 00 40 a0 00 00 00 00 00   .B.......@......
+|   2896: 00 00 00 00 42 c8 00 00 00 00 00 00 00 00 00 07   ....B...........
+|   2912: 42 be 00 00 42 c8 00 00 00 00 00 00 42 c8 00 00   B...B.......B...
+|   2928: 00 00 00 00 00 00 00 08 00 00 00 00 42 c8 00 00   ............B...
+|   2944: 00 00 00 00 40 a0 00 00 00 00 00 00 00 00 00 09   ....@...........
+|   2960: 00 00 00 00 42 c8 00 00 42 be 00 00 42 c8 00 00   ....B...B...B...
+|   2976: 00 00 00 00 00 00 00 0a 00 00 00 00 42 c8 00 00   ............B...
+|   2992: 00 00 00 00 42 c8 00 00 00 00 00 00 00 00 00 0b   ....B...........
+|   3008: 00 00 00 00 42 48 00 00 00 00 00 04 2c 80 00 00   ....BH......,...
+|   3024: 00 00 00 00 00 00 00 c4 00 00 00 00 00 42 c8 00   .............B..
+|   3040: 00 00 00 00 00 00 00 00 07 42 be 00 00 42 c8 00   .........B...B..
+|   3056: 00 00 00 00 00 42 c8 00 00 00 00 00 00 00 00 00   .....B..........
+|   3072: 08 00 00 00 00 42 c8 00 00 00 00 00 00 40 a0 00   .....B.......@..
+|   3088: 00 00 00 00 00 00 00 00 09 00 00 00 00 42 c8 00   .............B..
+|   3104: 00 42 be 00 00 42 c8 00 00 00 00 00 00 00 00 00   .B...B..........
+|   3120: 0a 00 00 00 00 42 c8 00 00 00 00 00 00 42 c8 00   .....B.......B..
+|   3136: 00 00 00 00 00 00 00 00 0b 00 00 00 00 42 48 00   .............BH.
+|   3152: 00 00 00 00 04 2c 80 00 00 00 00 00 00 00 00 00   .....,..........
+|   3168: c4 24 c0 00 04 2c 80 00 00 00 00 00 04 2c 80 00   .$...,.......,..
+|   3184: 00 00 00 00 00 00 00 00 d0 00 00 00 04 2c 80 00   .............,..
+|   3200: 00 00 00 00 04 24 80 00 00 00 00 00 00 00 00 00   .....$..........
+|   3216: e0 00 00 00 04 2c 80 00 04 24 c0 00 04 2c 00 00   .....,...$...,..
+| page 4 offset 12288
+|      0: 0d 00 00 00 00 10 00 00 00 00 00 00 0e 00 00 00   ................
+|     16: 00 42 c8 00 00 42 4c 00 00 42 c8 00 00 00 00 00   .B...BL..B......
+|     32: 00 00 00 0a 00 00 00 00 42 c8 00 00 00 00 00 00   ........B.......
+|     48: 42 c8 00 00 00 00 00 00 00 00 00 0b 00 00 00 00   B...............
+|     64: 42 48 00 00 00 00 00 04 2c 80 00 00 00 00 00 00   BH......,.......
+|     80: 00 00 00 c4 24 c0 00 04 2c 80 00 00 00 00 00 04   ....$...,.......
+|     96: 2c 80 00 00 00 00 00 00 00 00 00 d0 00 00 00 04   ,...............
+|    112: 2c 80 00 00 00 00 00 04 24 80 00 00 00 00 00 00   ,.......$.......
+|    128: 00 00 00 e0 00 00 00 04 2c 80 00 04 24 c0 00 04   ........,...$...
+|    144: 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ,...............
+| end c7.db
+  }]
+  catchsql {
+    WITH RECURSIVE
+      c1(x) AS (VALUES(0) UNION ALL SELECT x+1 FROM c1 WHERE x<8),
+      c2(y) AS (VALUES(0) UNION ALL SELECT y+1 FROM c2 WHERE y<5)
+    INSERT INTO t1(id, x0,x1,y0,y1,label)
+      SELECT 1000+x+y*100, x, x+1, y, y+1, printf('box-%d,%d',x,y) FROM c1, c2;
+  }
+} {1 {database disk image is malformed}}
+
+finish_test

Index: ext/rtree/sqlite3rtree.h
==================================================================
--- ext/rtree/sqlite3rtree.h
+++ ext/rtree/sqlite3rtree.h
@@ -94,11 +94,11 @@
   int iLevel;                       /* Level of current node or entry */
   int mxLevel;                      /* The largest iLevel value in the tree */
   sqlite3_int64 iRowid;             /* Rowid for current entry */
   sqlite3_rtree_dbl rParentScore;   /* Score of parent node */
   int eParentWithin;                /* Visibility of parent node */
-  int eWithin;                      /* OUT: Visiblity */
+  int eWithin;                      /* OUT: Visibility */
   sqlite3_rtree_dbl rScore;         /* OUT: Write the score here */
   /* The following fields are only available in 3.8.11 and later */
   sqlite3_value **apSqlParam;       /* Original SQL values of parameters */
 };
 

Index: ext/session/changeset.c
==================================================================
--- ext/session/changeset.c
+++ ext/session/changeset.c
@@ -40,21 +40,21 @@
 /*
 ** Read the content of a disk file into an in-memory buffer
 */
 static void readFile(const char *zFilename, int *pSz, void **ppBuf){
   FILE *f;
-  int sz;
+  sqlite3_int64 sz;
   void *pBuf;
   f = fopen(zFilename, "rb");
   if( f==0 ){
     fprintf(stderr, "cannot open \"%s\" for reading\n", zFilename);
     exit(1);
   }
   fseek(f, 0, SEEK_END);
-  sz = (int)ftell(f);
+  sz = ftell(f);
   rewind(f);
-  pBuf = sqlite3_malloc( sz ? sz : 1 );
+  pBuf = sqlite3_malloc64( sz ? sz : 1 );
   if( pBuf==0 ){
     fprintf(stderr, "cannot allocate %d to hold content of \"%s\"\n",
             sz, zFilename);
     exit(1);
   }

ADDED   ext/session/changesetfuzz.c
Index: ext/session/changesetfuzz.c
==================================================================
--- /dev/null
+++ ext/session/changesetfuzz.c
@@ -0,0 +1,1239 @@
+/*
+** 2018-11-01
+**
+** The author disclaims copyright to this source code.  In place of
+** a legal notice, here is a blessing:
+**
+**    May you do good and not evil.
+**    May you find forgiveness for yourself and forgive others.
+**    May you share freely, never taking more than you give.
+**
+*************************************************************************
+** This file contains code to implement the "changesetfuzz" command 
+** line utility for fuzzing changeset blobs without corrupting them.
+*/
+
+
+/************************************************************************
+** USAGE:
+**
+** This program may be invoked in two ways:
+**
+**   changesetfuzz INPUT
+**   changesetfuzz INPUT SEED N
+**
+** Argument INPUT must be the name of a file containing a binary changeset.
+** In the first form above, this program outputs a human-readable version
+** of the same changeset. This is chiefly for debugging.
+**
+** As well as changesets, this program can also dump and fuzz patchsets.
+** The term "changeset" is used for both patchsets and changesets from this
+** point on.
+**
+** In the second form, arguments SEED and N must both be integers. In this
+** case, this program writes N binary changesets to disk. Each output
+** changeset is a slightly modified - "fuzzed" - version of the input. 
+** The output changesets are written to files name "INPUT-$n", where $n is 
+** an integer between 0 and N-1, inclusive. Output changesets are always
+** well-formed. Parameter SEED is used to seed the PRNG - any two 
+** invocations of this program with the same SEED and input changeset create
+** the same N output changesets.
+**
+** The ways in which an input changeset may be fuzzed are as follows:
+**
+**   1. Any two values within the changeset may be exchanged.
+**
+**   2. Any TEXT, BLOB, INTEGER or REAL value within the changeset 
+**      may have a single bit of its content flipped.
+**
+**   3. Any value within a changeset may be replaced by a pseudo-randomly
+**      generated value.
+**
+** The above operations never set a PRIMARY KEY column to NULL. Nor do they
+** set any value to "undefined", or replace any "undefined" value with
+** another. Any such operation risks producing a changeset that is not 
+** well-formed.
+**
+**   4. A single change may be duplicated.
+**
+**   5. A single change may be removed, so long as this does not mean that
+**      there are zero changes following a table-header within the changeset.
+**
+**   6. A single change may have its type (INSERT, DELETE, UPDATE) changed.
+**      If an INSERT is changed to a DELETE (or vice versa), the type is
+**      simply changed - no other modifications are required. If an INSERT
+**      or DELETE is changed to an UPDATE, then the single record is duplicated
+**      (as both the old.* and new.* records of the new UPDATE change). If an
+**      UPDATE is changed to a DELETE or INSERT, the new.* record is discarded
+**      and any "undefined" fields replaced with pseudo-randomly generated
+**      values.
+**
+**   7. An UPDATE change that modifies N table columns may be modified so
+**      that it updates N-1 columns, so long as (N>1).
+**
+**   8. The "indirect" flag may be toggled for any change.
+**
+** Entire group of changes may also be operated on:
+**
+**   9. Duplicate an existing group.
+**
+**  10. Remove an existing group.
+**
+**  11. The positions of two groups may be exchanged.
+**
+** There are also schema changes:
+**
+**  12. A non-PK column may be added to a table. In this case a NULL 
+**      value is appended to all records.
+**
+**  13. A PK column may be added to a table. In this case a non-NULL 
+**      value is appended to all INSERT, DELETE and UPDATE old.* records.
+**      An "undefined" is appended to new.* UPDATE records.
+**
+**  14. A column may be removed from a table, provided that it is not the
+**      only PRIMARY KEY column in the table. In this case the corresponding
+**      field is removed from all records. In cases where this leaves an UPDATE
+**      with no non-PK, non-undefined fields, the entire change is removed.
+*/
+
+#include "sqlite3.h"
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <assert.h>
+#include <ctype.h>
+
+#define FUZZ_VALUE_SUB       1    /* Replace one value with a copy of another */
+#define FUZZ_VALUE_MOD       2    /* Modify content by 1 bit */
+#define FUZZ_VALUE_RND       3    /* Replace with pseudo-random value */
+
+#define FUZZ_CHANGE_DUP      4    /* Duplicate an existing change */
+#define FUZZ_CHANGE_DEL      5    /* Completely remove one change */
+#define FUZZ_CHANGE_TYPE     6    /* Change the type of one change */
+#define FUZZ_CHANGE_FIELD    7    /* Change an UPDATE to modify fewer columns */
+#define FUZZ_CHANGE_INDIRECT 8    /* Toggle the "indirect" flag of a change */
+
+#define FUZZ_GROUP_DUP       9    /* Duplicate a change group */
+#define FUZZ_GROUP_DEL      10    /* Delete an entire change group */
+#define FUZZ_GROUP_SWAP     11    /* Exchange the position of two groups */
+
+#define FUZZ_COLUMN_ADD     12     /* Add column to table definition */
+#define FUZZ_COLUMN_ADDPK   13     /* Add PK column to table definition */
+#define FUZZ_COLUMN_DEL     14     /* Remove column from table definition */
+
+
+
+typedef unsigned char u8;
+typedef sqlite3_uint64 u64;
+typedef sqlite3_int64 i64;
+typedef unsigned int u32;
+
+/*
+** Show a usage message on stderr then quit.
+*/
+static void usage(const char *argv0){
+  fprintf(stderr, "Usage: %s FILENAME ?SEED N?\n", argv0);
+  exit(1);
+}
+
+/*
+** Read the content of a disk file into an in-memory buffer
+*/
+static void fuzzReadFile(const char *zFilename, int *pSz, void **ppBuf){
+  FILE *f;
+  sqlite3_int64 sz;
+  void *pBuf;
+  f = fopen(zFilename, "rb");
+  if( f==0 ){
+    fprintf(stderr, "cannot open \"%s\" for reading\n", zFilename);
+    exit(1);
+  }
+  fseek(f, 0, SEEK_END);
+  sz = ftell(f);
+  rewind(f);
+  pBuf = sqlite3_malloc64( sz ? sz : 1 );
+  if( pBuf==0 ){
+    fprintf(stderr, "cannot allocate %d to hold content of \"%s\"\n",
+            sz, zFilename);
+    exit(1);
+  }
+  if( sz>0 ){
+    if( fread(pBuf, sz, 1, f)!=1 ){
+      fprintf(stderr, "cannot read all %d bytes of \"%s\"\n", sz, zFilename);
+      exit(1);
+    }
+    fclose(f);
+  }
+  *pSz = sz;
+  *ppBuf = pBuf;
+}
+
+/* 
+** Write the contents of buffer pBuf, size nBuf bytes, into file zFilename
+** on disk. zFilename, if it already exists, is clobbered.
+*/
+static void fuzzWriteFile(const char *zFilename, void *pBuf, int nBuf){
+  FILE *f;
+  f = fopen(zFilename, "wb");
+  if( f==0 ){
+    fprintf(stderr, "cannot open \"%s\" for writing\n", zFilename);
+    exit(1);
+  }
+  if( fwrite(pBuf, nBuf, 1, f)!=1 ){
+    fprintf(stderr, "cannot write to \"%s\"\n", zFilename);
+    exit(1);
+  }
+  fclose(f);
+}
+
+static int fuzzCorrupt(){
+  return SQLITE_CORRUPT;
+}
+
+/*************************************************************************
+** The following block is a copy of the implementation of SQLite function
+** sqlite3_randomness. This version has two important differences:
+**
+**   1. It always uses the same seed. So the sequence of random data output
+**      is the same for every run of the program.
+**
+**   2. It is not threadsafe.
+*/
+static struct sqlite3PrngType {
+  unsigned char i, j;             /* State variables */
+  unsigned char s[256];           /* State variables */
+} sqlite3Prng = {
+    0xAF, 0x28,
+  {
+    0x71, 0xF5, 0xB4, 0x6E, 0x80, 0xAB, 0x1D, 0xB8, 
+    0xFB, 0xB7, 0x49, 0xBF, 0xFF, 0x72, 0x2D, 0x14, 
+    0x79, 0x09, 0xE3, 0x78, 0x76, 0xB0, 0x2C, 0x0A, 
+    0x8E, 0x23, 0xEE, 0xDF, 0xE0, 0x9A, 0x2F, 0x67, 
+    0xE1, 0xBE, 0x0E, 0xA7, 0x08, 0x97, 0xEB, 0x77, 
+    0x78, 0xBA, 0x9D, 0xCA, 0x49, 0x4C, 0x60, 0x9A, 
+    0xF6, 0xBD, 0xDA, 0x7F, 0xBC, 0x48, 0x58, 0x52, 
+    0xE5, 0xCD, 0x83, 0x72, 0x23, 0x52, 0xFF, 0x6D, 
+    0xEF, 0x0F, 0x82, 0x29, 0xA0, 0x83, 0x3F, 0x7D, 
+    0xA4, 0x88, 0x31, 0xE7, 0x88, 0x92, 0x3B, 0x9B, 
+    0x3B, 0x2C, 0xC2, 0x4C, 0x71, 0xA2, 0xB0, 0xEA, 
+    0x36, 0xD0, 0x00, 0xF1, 0xD3, 0x39, 0x17, 0x5D, 
+    0x2A, 0x7A, 0xE4, 0xAD, 0xE1, 0x64, 0xCE, 0x0F, 
+    0x9C, 0xD9, 0xF5, 0xED, 0xB0, 0x22, 0x5E, 0x62, 
+    0x97, 0x02, 0xA3, 0x8C, 0x67, 0x80, 0xFC, 0x88, 
+    0x14, 0x0B, 0x15, 0x10, 0x0F, 0xC7, 0x40, 0xD4, 
+    0xF1, 0xF9, 0x0E, 0x1A, 0xCE, 0xB9, 0x1E, 0xA1, 
+    0x72, 0x8E, 0xD7, 0x78, 0x39, 0xCD, 0xF4, 0x5D, 
+    0x2A, 0x59, 0x26, 0x34, 0xF2, 0x73, 0x0B, 0xA0, 
+    0x02, 0x51, 0x2C, 0x03, 0xA3, 0xA7, 0x43, 0x13, 
+    0xE8, 0x98, 0x2B, 0xD2, 0x53, 0xF8, 0xEE, 0x91, 
+    0x7D, 0xE7, 0xE3, 0xDA, 0xD5, 0xBB, 0xC0, 0x92, 
+    0x9D, 0x98, 0x01, 0x2C, 0xF9, 0xB9, 0xA0, 0xEB, 
+    0xCF, 0x32, 0xFA, 0x01, 0x49, 0xA5, 0x1D, 0x9A, 
+    0x76, 0x86, 0x3F, 0x40, 0xD4, 0x89, 0x8F, 0x9C, 
+    0xE2, 0xE3, 0x11, 0x31, 0x37, 0xB2, 0x49, 0x28, 
+    0x35, 0xC0, 0x99, 0xB6, 0xD0, 0xBC, 0x66, 0x35, 
+    0xF7, 0x83, 0x5B, 0xD7, 0x37, 0x1A, 0x2B, 0x18, 
+    0xA6, 0xFF, 0x8D, 0x7C, 0x81, 0xA8, 0xFC, 0x9E, 
+    0xC4, 0xEC, 0x80, 0xD0, 0x98, 0xA7, 0x76, 0xCC, 
+    0x9C, 0x2F, 0x7B, 0xFF, 0x8E, 0x0E, 0xBB, 0x90, 
+    0xAE, 0x13, 0x06, 0xF5, 0x1C, 0x4E, 0x52, 0xF7
+  }
+};
+
+/* 
+** Generate and return single random byte 
+*/
+static unsigned char fuzzRandomByte(void){
+  unsigned char t;
+  sqlite3Prng.i++;
+  t = sqlite3Prng.s[sqlite3Prng.i];
+  sqlite3Prng.j += t;
+  sqlite3Prng.s[sqlite3Prng.i] = sqlite3Prng.s[sqlite3Prng.j];
+  sqlite3Prng.s[sqlite3Prng.j] = t;
+  t += sqlite3Prng.s[sqlite3Prng.i];
+  return sqlite3Prng.s[t];
+}
+
+/*
+** Return N random bytes.
+*/
+static void fuzzRandomBlob(int nBuf, unsigned char *zBuf){
+  int i;
+  for(i=0; i<nBuf; i++){
+    zBuf[i] = fuzzRandomByte();
+  }
+}
+
+/*
+** Return a random integer between 0 and nRange (not inclusive).
+*/
+static unsigned int fuzzRandomInt(unsigned int nRange){
+  unsigned int ret;
+  assert( nRange>0 );
+  fuzzRandomBlob(sizeof(ret), (unsigned char*)&ret);
+  return (ret % nRange);
+}
+
+static u64 fuzzRandomU64(){
+  u64 ret;
+  fuzzRandomBlob(sizeof(ret), (unsigned char*)&ret);
+  return ret;
+}
+
+static void fuzzRandomSeed(unsigned int iSeed){
+  int i;
+  for(i=0; i<256; i+=4){
+    sqlite3Prng.s[i] ^= ((iSeed >> 24) & 0xFF);
+    sqlite3Prng.s[i+1] ^= ((iSeed >> 16) & 0xFF);
+    sqlite3Prng.s[i+2] ^= ((iSeed >>  8) & 0xFF);
+    sqlite3Prng.s[i+3] ^= ((iSeed >>  0) & 0xFF);
+  }
+}
+/*
+** End of code for generating pseudo-random values.
+*************************************************************************/
+
+typedef struct FuzzChangeset FuzzChangeset;
+typedef struct FuzzChangesetGroup FuzzChangesetGroup;
+typedef struct FuzzChange FuzzChange;
+
+/* 
+** Object containing partially parsed changeset.
+*/
+struct FuzzChangeset {
+  int bPatchset;                  /* True for a patchset */
+  FuzzChangesetGroup **apGroup;   /* Array of groups in changeset */
+  int nGroup;                     /* Number of items in list pGroup */
+  u8 **apVal;                     /* Array of all values in changeset */
+  int nVal;                       /* Number of used slots in apVal[] */
+  int nChange;                    /* Number of changes in changeset */
+  int nUpdate;                    /* Number of UPDATE changes in changeset */
+};
+
+/* 
+** There is one object of this type for each change-group (table header)
+** in the input changeset.
+*/
+struct FuzzChangesetGroup {
+  const char *zTab;               /* Name of table */
+  int nCol;                       /* Number of columns in table */
+  u8 *aPK;                        /* PK array for this table */
+  u8 *aChange;                    /* Buffer containing array of changes */
+  int szChange;                   /* Size of buffer aChange[] in bytes */
+  int nChange;                    /* Number of changes in buffer aChange[] */
+};
+
+/*
+** Description of a fuzz change to be applied to a changeset.
+*/
+struct FuzzChange {
+  int eType;                      /* One of the FUZZ_* constants above */
+  int iChange;                    /* Change or UPDATE to modify */
+  int iGroup;                     /* Group to modify */
+  int iDelete;                    /* Field to remove (FUZZ_COLUMN_DEL) */
+  u8 *pSub1;                      /* Replace this value with pSub2 */
+  u8 *pSub2;                      /* And this one with pSub1 */
+  u8 aSub[128];                   /* Buffer for substitute value */
+  int iCurrent;                   /* Current change number */
+};
+
+/*
+** Allocate and return nByte bytes of zeroed memory.
+*/
+static void *fuzzMalloc(sqlite3_int64 nByte){
+  void *pRet = sqlite3_malloc64(nByte);
+  if( pRet ){
+    memset(pRet, 0, nByte);
+  }
+  return pRet;
+}
+
+/*
+** Free the buffer indicated by the first argument. This function is used
+** to free buffers allocated by fuzzMalloc().
+*/
+static void fuzzFree(void *p){
+  sqlite3_free(p);
+}
+
+/*
+** Argument p points to a buffer containing an SQLite varint that, assuming the
+** input is not corrupt, may be between 0 and 0x7FFFFFFF, inclusive. Before
+** returning, this function sets (*pnVal) to the value of that varint, and
+** returns the number of bytes of space that it takes up.
+*/
+static int fuzzGetVarint(u8 *p, int *pnVal){
+  int i;
+  sqlite3_uint64 nVal = 0;
+  for(i=0; i<9; i++){
+    nVal = (nVal<<7) + (p[i] & 0x7F);
+    if( (p[i] & 0x80)==0 ){
+      i++;
+      break;
+    }
+  }
+  *pnVal = (int)nVal;
+  return i;
+}
+
+/*
+** Write value nVal into the buffer indicated by argument p as an SQLite
+** varint. nVal is guaranteed to be between 0 and (2^21-1), inclusive.
+** Return the number of bytes written to buffer p.
+*/
+static int fuzzPutVarint(u8 *p, int nVal){
+  assert( nVal>0 && nVal<2097152 );
+  if( nVal<128 ){
+    p[0] = nVal;
+    return 1;
+  }
+  if( nVal<16384 ){
+    p[0] = ((nVal >> 7) & 0x7F) | 0x80;
+    p[1] = (nVal & 0x7F);
+    return 2;
+  }
+
+  p[0] = ((nVal >> 14) & 0x7F) | 0x80;
+  p[1] = ((nVal >> 7) & 0x7F) | 0x80;
+  p[2] = (nVal & 0x7F);
+  return 3;
+}
+
+/*
+** Read a 64-bit big-endian integer value from buffer aRec[]. Return
+** the value read.
+*/
+static i64 fuzzGetI64(u8 *aRec){
+  return (i64)(
+      (((u64)aRec[0]) << 56)
+    + (((u64)aRec[1]) << 48)
+    + (((u64)aRec[2]) << 40)
+    + (((u64)aRec[3]) << 32)
+    + (((u64)aRec[4]) << 24)
+    + (((u64)aRec[5]) << 16)
+    + (((u64)aRec[6]) <<  8)
+    + (((u64)aRec[7]) <<  0)
+  );
+}
+
+/*
+** Write value iVal to buffer aRec[] as an unsigned 64-bit big-endian integer.
+*/
+static void fuzzPutU64(u8 *aRec, u64 iVal){
+  aRec[0] = (iVal>>56) & 0xFF;
+  aRec[1] = (iVal>>48) & 0xFF;
+  aRec[2] = (iVal>>40) & 0xFF;
+  aRec[3] = (iVal>>32) & 0xFF;
+  aRec[4] = (iVal>>24) & 0xFF;
+  aRec[5] = (iVal>>16) & 0xFF;
+  aRec[6] = (iVal>> 8) & 0xFF;
+  aRec[7] = (iVal)     & 0xFF;
+}
+
+/*
+** Parse a single table-header from the input. Allocate a new change-group
+** object with the results. Return SQLITE_OK if successful, or an error code
+** otherwise.
+*/
+static int fuzzParseHeader(
+  FuzzChangeset *pParse,          /* Changeset parse object */
+  u8 **ppHdr,                     /* IN/OUT: Iterator */
+  u8 *pEnd,                       /* 1 byte past EOF */
+  FuzzChangesetGroup **ppGrp      /* OUT: New change-group object */
+){
+  int rc = SQLITE_OK;
+  FuzzChangesetGroup *pGrp;
+  u8 cHdr = (pParse->bPatchset ? 'P' : 'T');
+
+  assert( pEnd>(*ppHdr) );
+  pGrp = (FuzzChangesetGroup*)fuzzMalloc(sizeof(FuzzChangesetGroup));
+  if( !pGrp ){
+    rc = SQLITE_NOMEM;
+  }else{
+    u8 *p = *ppHdr;
+    if( p[0]!=cHdr ){
+      rc = fuzzCorrupt();
+    }else{
+      p++;
+      p += fuzzGetVarint(p, &pGrp->nCol);
+      pGrp->aPK = p;
+      p += pGrp->nCol;
+      pGrp->zTab = (const char*)p;
+      p = &p[strlen(p)+1];
+
+      if( p>=pEnd ){
+        rc = fuzzCorrupt();
+      }
+    }
+    *ppHdr = p;
+  }
+
+  if( rc!=SQLITE_OK ){
+    fuzzFree(pGrp);
+    pGrp = 0;
+  }
+
+  *ppGrp = pGrp;
+  return rc;
+}
+
+/*
+** Argument p points to a buffer containing a single changeset-record value. 
+** This function attempts to determine the size of the value in bytes. If
+** successful, it sets (*pSz) to the size and returns SQLITE_OK. Or, if the
+** buffer does not contain a valid value, SQLITE_CORRUPT is returned and
+** the final value of (*pSz) is undefined.
+*/
+static int fuzzChangeSize(u8 *p, int *pSz){
+  u8 eType = p[0];
+  switch( eType ){
+    case 0x00:                    /* undefined */
+    case 0x05:                    /* null */
+      *pSz = 1;
+      break;
+
+    case 0x01:                    /* integer */
+    case 0x02:                    /* real */
+      *pSz = 9;
+      break;
+
+    case 0x03:                    /* text */
+    case 0x04: {                  /* blob */
+      int nTxt;
+      int sz;
+      sz = fuzzGetVarint(&p[1], &nTxt);
+      *pSz = 1 + sz + nTxt;
+      break;
+    }
+
+    default:
+      return fuzzCorrupt();
+  }
+  return SQLITE_OK;
+}
+
+/*
+** When this function is called, (*ppRec) points to the start of a 
+** record in a changeset being parsed. This function adds entries
+** to the pParse->apVal[] array for all values and advances (*ppRec) 
+** to one byte past the end of the record. Argument pEnd points to
+** one byte past the end of the input changeset.
+**
+** Argument bPkOnly is true if the record being parsed is part of
+** a DELETE record in a patchset. In this case, all non-primary-key
+** fields have been omitted from the record.
+**
+** SQLITE_OK is returned if successful, or an SQLite error code otherwise.
+*/
+static int fuzzParseRecord(
+  u8 **ppRec,                     /* IN/OUT: Iterator */
+  u8 *pEnd,                       /* One byte after end of input data */
+  FuzzChangeset *pParse,          /* Changeset parse context */
+  int bPkOnly                     /* True if non-PK fields omitted */
+){
+  int rc = SQLITE_OK;
+  FuzzChangesetGroup *pGrp = pParse->apGroup[pParse->nGroup-1];
+  int i;
+  u8 *p = *ppRec;
+
+  for(i=0; rc==SQLITE_OK && i<pGrp->nCol; i++){
+    if( bPkOnly==0 || pGrp->aPK[i] ){
+      int sz;
+      if( p>=pEnd ) break;
+      if( (pParse->nVal & (pParse->nVal-1))==0 ){
+        int nNew = pParse->nVal ? pParse->nVal*2 : 4;
+        u8 **apNew = (u8**)sqlite3_realloc(pParse->apVal, nNew*sizeof(u8*));
+        if( apNew==0 ) return SQLITE_NOMEM;
+        pParse->apVal = apNew;
+      }
+      pParse->apVal[pParse->nVal++] = p;
+      rc = fuzzChangeSize(p, &sz);
+      p += sz;
+    }
+  }
+
+  if( rc==SQLITE_OK && i<pGrp->nCol ){
+    rc = fuzzCorrupt();
+  }
+
+  *ppRec = p;
+  return rc;
+}
+
+/*
+** Parse the array of changes starting at (*ppData) and add entries for
+** all values to the pParse->apVal[] array. Argument pEnd points to one byte
+** past the end of the input changeset. If successful, set (*ppData) to point
+** to one byte past the end of the change array and return SQLITE_OK.
+** Otherwise, return an SQLite error code. The final value of (*ppData) is
+** undefined in this case.
+*/
+static int fuzzParseChanges(u8 **ppData, u8 *pEnd, FuzzChangeset *pParse){
+  u8 cHdr = (pParse->bPatchset ? 'P' : 'T');
+  FuzzChangesetGroup *pGrp = pParse->apGroup[pParse->nGroup-1];
+  int rc = SQLITE_OK;
+  u8 *p = *ppData;
+
+  pGrp->aChange = p;
+  while( rc==SQLITE_OK && p<pEnd && p[0]!=cHdr ){
+    u8 eOp = p[0];
+    u8 bIndirect = p[1];
+
+    p += 2;
+    if( eOp==SQLITE_UPDATE ){
+      pParse->nUpdate++;
+      if( pParse->bPatchset==0 ){
+        rc = fuzzParseRecord(&p, pEnd, pParse, 0);
+      }
+    }else if( eOp!=SQLITE_INSERT && eOp!=SQLITE_DELETE ){
+      rc = fuzzCorrupt();
+    }
+    if( rc==SQLITE_OK ){
+      int bPkOnly = (eOp==SQLITE_DELETE && pParse->bPatchset);
+      rc = fuzzParseRecord(&p, pEnd, pParse, bPkOnly);
+    }
+    pGrp->nChange++;
+    pParse->nChange++;
+  }
+  pGrp->szChange = p - pGrp->aChange;
+
+  *ppData = p;
+  return rc;
+}
+
+/*
+** Parse the changeset stored in buffer pChangeset (nChangeset bytes in
+** size). If successful, write the results into (*pParse) and return
+** SQLITE_OK. Or, if an error occurs, return an SQLite error code. The
+** final state of (*pParse) is undefined in this case.
+*/
+static int fuzzParseChangeset(
+  u8 *pChangeset,                 /* Buffer containing changeset */
+  int nChangeset,                 /* Size of buffer in bytes */
+  FuzzChangeset *pParse           /* OUT: Results of parse */
+){
+  u8 *pEnd = &pChangeset[nChangeset];
+  u8 *p = pChangeset;
+  int rc = SQLITE_OK;
+
+  memset(pParse, 0, sizeof(FuzzChangeset));
+  if( nChangeset>0 ){
+    pParse->bPatchset = (pChangeset[0]=='P');
+  }
+
+  while( rc==SQLITE_OK && p<pEnd ){
+    FuzzChangesetGroup *pGrp = 0;
+
+    /* Read a table-header from the changeset */
+    rc = fuzzParseHeader(pParse, &p, pEnd, &pGrp);
+    assert( (rc==SQLITE_OK)==(pGrp!=0) );
+
+    /* If the table-header was successfully parsed, add the new change-group
+    ** to the array and parse the associated changes. */
+    if( rc==SQLITE_OK ){
+      FuzzChangesetGroup **apNew = (FuzzChangesetGroup**)sqlite3_realloc64(
+          pParse->apGroup, sizeof(FuzzChangesetGroup*)*(pParse->nGroup+1)
+      );
+      if( apNew==0 ){
+        rc = SQLITE_NOMEM;
+      }else{
+        apNew[pParse->nGroup] = pGrp;
+        pParse->apGroup = apNew;
+        pParse->nGroup++;
+      }
+      rc = fuzzParseChanges(&p, pEnd, pParse);
+    }
+  }
+
+  return rc;
+}
+
+/*
+** When this function is called, (*ppRec) points to the first byte of
+** a record that is part of change-group pGrp. This function attempts
+** to output a human-readable version of the record to stdout and advance
+** (*ppRec) to point to the first byte past the end of the record before
+** returning. If successful, SQLITE_OK is returned. Otherwise, an SQLite
+** error code.
+**
+** If parameter bPkOnly is non-zero, then all non-primary-key fields have
+** been omitted from the record. This occurs for records that are part
+** of DELETE changes in patchsets.
+*/
+static int fuzzPrintRecord(FuzzChangesetGroup *pGrp, u8 **ppRec, int bPKOnly){
+  int rc = SQLITE_OK;
+  u8 *p = *ppRec;
+  int i;
+  const char *zPre = " (";
+
+  for(i=0; i<pGrp->nCol; i++){
+    if( bPKOnly==0 || pGrp->aPK[i] ){
+      u8 eType = p++[0];
+      switch( eType ){
+        case 0x00:                    /* undefined */
+          printf("%sn/a", zPre);
+          break;
+
+        case 0x01: {                  /* integer */
+          sqlite3_int64 iVal = 0;
+          iVal = fuzzGetI64(p);
+          printf("%s%lld", zPre, iVal);
+          p += 8;
+          break;
+        }
+
+        case 0x02: {                  /* real */
+          sqlite3_int64 iVal = 0;
+          double fVal = 0.0;
+          iVal = fuzzGetI64(p);
+          memcpy(&fVal, &iVal, 8);
+          printf("%s%f", zPre, fVal);
+          p += 8;
+          break;
+        }
+
+        case 0x03:                    /* text */
+        case 0x04: {                  /* blob */
+          int nTxt;
+          int sz;
+          int i;
+          p += fuzzGetVarint(p, &nTxt);
+          printf("%s%s", zPre, eType==0x03 ? "'" : "X'");
+          for(i=0; i<nTxt; i++){
+            if( eType==0x03 ){
+              printf("%c", p[i]);
+            }else{
+              char aHex[16] = {'0', '1', '2', '3', '4', '5', '6', '7',
+                               '8', '9', 'A', 'B', 'C', 'D', 'E', 'F'
+              };
+              printf("%c", aHex[ p[i]>>4 ]);
+              printf("%c", aHex[ p[i] & 0x0F ]);
+            }
+          }
+          printf("'");
+          p += nTxt;
+          break;
+        }
+
+        case 0x05:                    /* null */
+          printf("%sNULL", zPre);
+          break;
+      }
+      zPre = ", ";
+    }
+  }
+  printf(")");
+
+  *ppRec = p;
+  return rc;
+}
+
+/*
+** Print a human-readable version of the table-header and all changes in the
+** change-group passed as the second argument.
+*/
+static void fuzzPrintGroup(FuzzChangeset *pParse, FuzzChangesetGroup *pGrp){
+  int i;
+  u8 *p;
+
+  /* The table header */
+  printf("TABLE:  %s nCol=%d aPK=", pGrp->zTab, pGrp->nCol);
+  for(i=0; i<pGrp->nCol; i++){
+    printf("%d", (int)pGrp->aPK[i]);
+  }
+  printf("\n");
+
+  /* The array of changes */
+  p = pGrp->aChange;
+  for(i=0; i<pGrp->nChange; i++){
+    u8 eType = p[0];
+    u8 bIndirect = p[1];
+    printf("%s (ind=%d):",
+        (eType==SQLITE_INSERT) ? "INSERT" :
+        (eType==SQLITE_DELETE ? "DELETE" : "UPDATE"),
+        bIndirect
+    );
+    p += 2;
+
+    if( pParse->bPatchset==0 && eType==SQLITE_UPDATE ){
+      fuzzPrintRecord(pGrp, &p, 0);
+    }
+    fuzzPrintRecord(pGrp, &p, eType==SQLITE_DELETE && pParse->bPatchset);
+    printf("\n");
+  }
+}
+
+/*
+** Initialize the object passed as the second parameter with details
+** of the change that will be attempted (type of change, to which part of the
+** changeset it applies etc.). If successful, return SQLITE_OK. Or, if an
+** error occurs, return an SQLite error code. 
+**
+** If a negative value is returned, then the selected change would have
+** produced a non-well-formed changeset. In this case the caller should
+** call this function again.
+*/
+static int fuzzSelectChange(FuzzChangeset *pParse, FuzzChange *pChange){
+  int iSub;
+
+  memset(pChange, 0, sizeof(FuzzChange));
+  pChange->eType = fuzzRandomInt(FUZZ_COLUMN_DEL) + 1;
+
+  assert( pChange->eType==FUZZ_VALUE_SUB
+       || pChange->eType==FUZZ_VALUE_MOD
+       || pChange->eType==FUZZ_VALUE_RND
+       || pChange->eType==FUZZ_CHANGE_DUP
+       || pChange->eType==FUZZ_CHANGE_DEL
+       || pChange->eType==FUZZ_CHANGE_TYPE
+       || pChange->eType==FUZZ_CHANGE_FIELD
+       || pChange->eType==FUZZ_CHANGE_INDIRECT
+       || pChange->eType==FUZZ_GROUP_DUP
+       || pChange->eType==FUZZ_GROUP_DEL
+       || pChange->eType==FUZZ_GROUP_SWAP
+       || pChange->eType==FUZZ_COLUMN_ADD
+       || pChange->eType==FUZZ_COLUMN_ADDPK
+       || pChange->eType==FUZZ_COLUMN_DEL
+  );
+
+  pChange->iGroup = fuzzRandomInt(pParse->nGroup);
+  pChange->iChange = fuzzRandomInt(pParse->nChange);
+  if( pChange->eType==FUZZ_CHANGE_FIELD ){
+    if( pParse->nUpdate==0 ) return -1;
+    pChange->iChange = fuzzRandomInt(pParse->nUpdate);
+  }
+
+  pChange->iDelete = -1;
+  if( pChange->eType==FUZZ_COLUMN_DEL ){
+    FuzzChangesetGroup *pGrp = pParse->apGroup[pChange->iGroup];
+    int i;
+    pChange->iDelete = fuzzRandomInt(pGrp->nCol);
+    for(i=pGrp->nCol-1; i>=0; i--){
+      if( pGrp->aPK[i] && pChange->iDelete!=i ) break;
+    }
+    if( i<0 ) return -1;
+  }
+
+  if( pChange->eType==FUZZ_GROUP_SWAP ){
+    FuzzChangesetGroup *pGrp;
+    int iGrp = pChange->iGroup;
+    if( pParse->nGroup==1 ) return -1;
+    while( iGrp==pChange->iGroup ){
+      iGrp = fuzzRandomInt(pParse->nGroup);
+    }
+    pGrp = pParse->apGroup[pChange->iGroup];
+    pParse->apGroup[pChange->iGroup] = pParse->apGroup[iGrp];
+    pParse->apGroup[iGrp] = pGrp;
+  }
+
+  if( pChange->eType==FUZZ_VALUE_SUB 
+   || pChange->eType==FUZZ_VALUE_MOD 
+   || pChange->eType==FUZZ_VALUE_RND 
+  ){
+    iSub = fuzzRandomInt(pParse->nVal);
+    pChange->pSub1 = pParse->apVal[iSub];
+    if( pChange->eType==FUZZ_VALUE_SUB ){
+      iSub = fuzzRandomInt(pParse->nVal);
+      pChange->pSub2 = pParse->apVal[iSub];
+    }else{
+      pChange->pSub2 = pChange->aSub;
+    }
+
+    if( pChange->eType==FUZZ_VALUE_RND ){
+      pChange->aSub[0] = (u8)(fuzzRandomInt(5) + 1);
+      switch( pChange->aSub[0] ){
+        case 0x01: {                  /* integer */
+          u64 iVal = fuzzRandomU64();
+          fuzzPutU64(&pChange->aSub[1], iVal);
+          break;
+        }
+
+        case 0x02: {                  /* real */
+          u64 iVal1 = fuzzRandomU64();
+          u64 iVal2 = fuzzRandomU64();
+          double d = (double)iVal1 / (double)iVal2;
+          memcpy(&iVal1, &d, sizeof(iVal1));
+          fuzzPutU64(&pChange->aSub[1], iVal1);
+          break;
+        }
+
+        case 0x03:                    /* text */
+        case 0x04: {                  /* blob */
+          int nByte = fuzzRandomInt(48);
+          pChange->aSub[1] = nByte;
+          fuzzRandomBlob(nByte, &pChange->aSub[2]);
+          if( pChange->aSub[0]==0x03 ){
+            int i;
+            for(i=0; i<nByte; i++){
+              pChange->aSub[2+i] &= 0x7F;
+            }
+          }
+          break;
+        }
+      }
+    }
+    if( pChange->eType==FUZZ_VALUE_MOD ){
+      int sz;
+      int iMod = -1;
+      fuzzChangeSize(pChange->pSub1, &sz);
+      memcpy(pChange->aSub, pChange->pSub1, sz);
+      switch( pChange->aSub[0] ){
+        case 0x01:
+        case 0x02:
+          iMod = fuzzRandomInt(8) + 1;
+          break;
+
+        case 0x03:                    /* text */
+        case 0x04: {                  /* blob */
+          int nByte;
+          int iFirst = 1 + fuzzGetVarint(&pChange->aSub[1], &nByte);
+          if( nByte>0 ){
+            iMod = fuzzRandomInt(nByte) + iFirst;
+          }
+          break;
+        }
+      }
+
+      if( iMod>=0 ){
+        u8 mask = (1 << fuzzRandomInt(8 - (pChange->aSub[0]==0x03)));
+        pChange->aSub[iMod] ^= mask;
+      }
+    }
+  }
+
+  return SQLITE_OK;
+}
+
+/*
+** Copy a single change from the input to the output changeset, making
+** any modifications specified by (*pFuzz).
+*/
+static int fuzzCopyChange(
+  FuzzChangeset *pParse,
+  int iGrp,
+  FuzzChange *pFuzz,
+  u8 **pp, u8 **ppOut             /* IN/OUT: Input and output pointers */
+){
+  int bPS = pParse->bPatchset;
+  FuzzChangesetGroup *pGrp = pParse->apGroup[iGrp];
+  u8 *p = *pp;
+  u8 *pOut = *ppOut;
+  u8 eType = p++[0];
+  int iRec;
+  int nRec = ((eType==SQLITE_UPDATE && !bPS) ? 2 : 1);
+  int iUndef = -1;
+  int nUpdate = 0;
+
+  u8 eNew = eType;
+  if( pFuzz->iCurrent==pFuzz->iChange && pFuzz->eType==FUZZ_CHANGE_TYPE ){
+    switch( eType ){
+      case SQLITE_INSERT:
+        eNew = SQLITE_DELETE;
+        break;
+      case SQLITE_DELETE:
+        eNew = SQLITE_UPDATE;
+        break;
+      case SQLITE_UPDATE:
+        eNew = SQLITE_INSERT;
+        break;
+    }
+  }
+
+  if( pFuzz->iCurrent==pFuzz->iChange 
+   && pFuzz->eType==FUZZ_CHANGE_FIELD && eType==SQLITE_UPDATE
+  ){
+    int sz;
+    int i;
+    int nDef = 0;
+    u8 *pCsr = p+1;
+    for(i=0; i<pGrp->nCol; i++){
+      if( pCsr[0] && pGrp->aPK[i]==0 ) nDef++;
+      fuzzChangeSize(pCsr, &sz);
+      pCsr += sz;
+    }
+    if( nDef<=1 ) return -1;
+    nDef = fuzzRandomInt(nDef);
+    pCsr = p+1;
+    for(i=0; i<pGrp->nCol; i++){
+      if( pCsr[0] && pGrp->aPK[i]==0 ){
+        if( nDef==0 ) iUndef = i;
+        nDef--;
+      }
+      fuzzChangeSize(pCsr, &sz);
+      pCsr += sz;
+    }
+  }
+
+  /* Copy the change type and indirect flag. If the fuzz mode is
+  ** FUZZ_CHANGE_INDIRECT, and the current change is the one selected for
+  ** fuzzing, invert the indirect flag.  */
+  *(pOut++) = eNew;
+  if( pFuzz->eType==FUZZ_CHANGE_INDIRECT && pFuzz->iCurrent==pFuzz->iChange ){
+    *(pOut++) = !(*(p++));
+  }else{
+    *(pOut++) = *(p++);
+  }
+
+  for(iRec=0; iRec<nRec; iRec++){
+    int i;
+
+    /* Copy the next record from the output to the input.
+    */
+    for(i=0; i<pGrp->nCol; i++){
+      int sz;
+      u8 *pCopy = p;
+
+      /* If this is a patchset, and the input is a DELETE, then the only
+      ** fields present are the PK fields. So, if this is not a PK, skip to 
+      ** the next column. If the current fuzz is FUZZ_CHANGE_TYPE, then
+      ** write a randomly selected value to the output.  */
+      if( bPS && eType==SQLITE_DELETE && pGrp->aPK[i]==0 ){
+        if( eType!=eNew ){
+          assert( eNew==SQLITE_UPDATE );
+          do {
+            pCopy = pParse->apVal[fuzzRandomInt(pParse->nVal)];
+          }while( pCopy[0]==0x00 );
+          fuzzChangeSize(pCopy, &sz);
+          memcpy(pOut, pCopy, sz);
+          pOut += sz;
+        }
+        continue;
+      }
+
+      if( p==pFuzz->pSub1 ){
+        pCopy = pFuzz->pSub2;
+      }else if( p==pFuzz->pSub2 ){
+        pCopy = pFuzz->pSub1;
+      }else if( i==iUndef ){
+        pCopy = "\0";
+      }
+
+      if( pCopy[0]==0x00 && eNew!=eType && eType==SQLITE_UPDATE && iRec==0 ){
+        while( pCopy[0]==0x00 ){
+          pCopy = pParse->apVal[fuzzRandomInt(pParse->nVal)];
+        }
+      }else if( p[0]==0x00 && pCopy[0]!=0x00 ){
+        return -1;
+      }else{
+        if( pGrp->aPK[i]>0 && pCopy[0]==0x05 ) return -1;
+      }
+
+      if( (pFuzz->iGroup!=iGrp || i!=pFuzz->iDelete)
+       && (eNew==eType || eType!=SQLITE_UPDATE || iRec==0)
+       && (eNew==eType || eNew!=SQLITE_DELETE || !bPS || pGrp->aPK[i])
+      ){
+        fuzzChangeSize(pCopy, &sz);
+        memcpy(pOut, pCopy, sz);
+        pOut += sz;
+        nUpdate += (pGrp->aPK[i]==0 && pCopy[0]!=0x00);
+      }
+
+      fuzzChangeSize(p, &sz);
+      p += sz;
+    }
+
+    if( iGrp==pFuzz->iGroup ){
+      if( pFuzz->eType==FUZZ_COLUMN_ADD ){
+        if( !bPS || eType!=SQLITE_DELETE ) *(pOut++) = 0x05;
+      }else if( pFuzz->eType==FUZZ_COLUMN_ADDPK ){
+        if( iRec==1 ){
+          *(pOut++) = 0x00;
+        }else{
+          u8 *pNew;
+          int szNew;
+          do {
+            pNew = pParse->apVal[fuzzRandomInt(pParse->nVal)];
+          }while( pNew[0]==0x00 || pNew[0]==0x05 );
+          fuzzChangeSize(pNew, &szNew);
+          memcpy(pOut, pNew, szNew);
+          pOut += szNew;
+        }
+      }
+    }
+  }
+
+  if( pFuzz->iCurrent==pFuzz->iChange ){
+    if( pFuzz->eType==FUZZ_CHANGE_DUP ){
+      int nByte = pOut - (*ppOut);
+      memcpy(pOut, *ppOut, nByte);
+      pOut += nByte;
+    }
+
+    if( pFuzz->eType==FUZZ_CHANGE_DEL ){
+      pOut = *ppOut;
+    }
+    if( eNew!=eType && eNew==SQLITE_UPDATE && !bPS ){
+      int i;
+      u8 *pCsr = (*ppOut) + 2;
+      for(i=0; i<pGrp->nCol; i++){
+        int sz;
+        u8 *pCopy = pCsr;
+        if( pGrp->aPK[i] ) pCopy = "\0";
+        fuzzChangeSize(pCopy, &sz);
+        memcpy(pOut, pCopy, sz);
+        pOut += sz;
+        fuzzChangeSize(pCsr, &sz);
+        pCsr += sz;
+      }
+    }
+  }
+
+  /* If a column is being deleted from this group, and this change was an 
+  ** UPDATE, and there are now no non-PK, non-undefined columns in the 
+  ** change, remove it altogether. */
+  if( pFuzz->eType==FUZZ_COLUMN_DEL && pFuzz->iGroup==iGrp 
+   && eType==SQLITE_UPDATE && nUpdate==0 
+  ){
+    pOut = *ppOut;
+  }
+
+  *pp = p;
+  *ppOut = pOut;
+  pFuzz->iCurrent += (eType==SQLITE_UPDATE || pFuzz->eType!=FUZZ_CHANGE_FIELD);
+  return SQLITE_OK;
+}
+
+/*
+** Fuzz the changeset parsed into object pParse and write the results 
+** to file zOut on disk. Argument pBuf points to a buffer that is guaranteed
+** to be large enough to hold the fuzzed changeset.
+**
+** Return SQLITE_OK if successful, or an SQLite error code if an error occurs.
+*/
+static int fuzzDoOneFuzz(
+  const char *zOut,               /* Filename to write modified changeset to */
+  u8 *pBuf,                       /* Buffer to use for modified changeset */
+  FuzzChangeset *pParse           /* Parse of input changeset */
+){
+  FuzzChange change;
+  int iGrp;
+  int rc = -1;
+
+  while( rc<0 ){
+    u8 *pOut = pBuf;
+    rc = fuzzSelectChange(pParse, &change);
+    for(iGrp=0; rc==SQLITE_OK && iGrp<pParse->nGroup; iGrp++){
+      FuzzChangesetGroup *pGrp = pParse->apGroup[iGrp];
+      int nTab = strlen(pGrp->zTab) + 1;
+      int j;
+      int nRep = 1;
+
+      /* If this is the group to delete for a FUZZ_GROUP_DEL change, jump to
+      ** the next group. Unless this is the only group in the changeset - in
+      ** that case this change cannot be applied.
+      **
+      ** Or, if this is a FUZZ_GROUP_DUP, set nRep to 2 to output two
+      ** copies of the group. */
+      if( change.iGroup==iGrp ){
+        if( change.eType==FUZZ_GROUP_DEL ){
+          if( pParse->nGroup==1 ) rc = -1;
+          continue;
+        }
+        else if( change.eType==FUZZ_GROUP_DUP ){
+          nRep = 2;
+        }
+      }
+
+      for(j=0; j<nRep; j++){
+        int i;
+        u8 *pSaved;
+        u8 *p = pGrp->aChange;
+        int nCol = pGrp->nCol;
+        int iPKDel = 0;
+        if( iGrp==change.iGroup ){
+          if( change.eType==FUZZ_COLUMN_ADD 
+           || change.eType==FUZZ_COLUMN_ADDPK 
+          ){
+            nCol++;
+          }else if( change.eType==FUZZ_COLUMN_DEL ){
+            nCol--;
+            iPKDel = pGrp->aPK[change.iDelete];
+          }
+        }
+
+        /* Output a table header */
+        pOut++[0] = pParse->bPatchset ? 'P' : 'T';
+        pOut += fuzzPutVarint(pOut, nCol);
+
+        for(i=0; i<pGrp->nCol; i++){
+          if( iGrp!=change.iGroup || i!=change.iDelete ){
+            u8 v = pGrp->aPK[i];
+            if( iPKDel && v>iPKDel ) v--;
+            *(pOut++) = v;
+          }
+        }
+        if( nCol>pGrp->nCol ){
+          if( change.eType==FUZZ_COLUMN_ADD ){
+            *(pOut++) = 0x00;
+          }else{
+            u8 max = 0;
+            for(i=0; i<pGrp->nCol; i++){
+              if( pGrp->aPK[i]>max ) max = pGrp->aPK[i];
+            }
+            *(pOut++) = max+1;
+          }
+        }
+        memcpy(pOut, pGrp->zTab, nTab);
+        pOut += nTab;
+
+        /* Output the change array. */
+        pSaved = pOut;
+        for(i=0; rc==SQLITE_OK && i<pGrp->nChange; i++){
+          rc = fuzzCopyChange(pParse, iGrp, &change, &p, &pOut);
+        }
+        if( pOut==pSaved ) rc = -1;
+      }
+    }
+    if( rc==SQLITE_OK ){
+      fuzzWriteFile(zOut, pBuf, pOut-pBuf);
+    }
+  }
+
+  return rc;
+}
+
+int main(int argc, char **argv){
+  int nRepeat = 0;                /* Number of output files */
+  int iSeed = 0;                  /* Value of PRNG seed */
+  const char *zInput;             /* Name of input file */
+  void *pChangeset = 0;           /* Input changeset */
+  int nChangeset = 0;             /* Size of input changeset in bytes */
+  int i;                          /* Current output file */
+  FuzzChangeset changeset;        /* Partially parsed changeset */
+  int rc;
+  u8 *pBuf = 0;
+
+  if( argc!=4 && argc!=2 ) usage(argv[0]);
+  zInput = argv[1];
+
+  fuzzReadFile(zInput, &nChangeset, &pChangeset);
+  rc = fuzzParseChangeset(pChangeset, nChangeset, &changeset);
+
+  if( rc==SQLITE_OK ){
+    if( argc==2 ){
+      for(i=0; i<changeset.nGroup; i++){
+        fuzzPrintGroup(&changeset, changeset.apGroup[i]);
+      }
+    }else{
+      pBuf = (u8*)fuzzMalloc((sqlite3_int64)nChangeset*2 + 1024);
+      if( pBuf==0 ){
+        rc = SQLITE_NOMEM;
+      }else{
+        iSeed = atoi(argv[2]);
+        nRepeat = atoi(argv[3]);
+        fuzzRandomSeed((unsigned int)iSeed);
+        for(i=0; rc==SQLITE_OK && i<nRepeat; i++){
+          char *zOut = sqlite3_mprintf("%s-%d", zInput, i);
+          rc = fuzzDoOneFuzz(zOut, pBuf, &changeset);
+          sqlite3_free(zOut);
+        }
+        fuzzFree(pBuf);
+      }
+    }
+  }
+
+  if( rc!=SQLITE_OK ){
+    fprintf(stderr, "error while processing changeset: %d\n", rc);
+  }
+
+  return rc;
+}

ADDED   ext/session/changesetfuzz1.test
Index: ext/session/changesetfuzz1.test
==================================================================
--- /dev/null
+++ ext/session/changesetfuzz1.test
@@ -0,0 +1,84 @@
+# 2018 November 08
+#
+# The author disclaims copyright to this source code.  In place of
+# a legal notice, here is a blessing:
+#
+#    May you do good and not evil.
+#    May you find forgiveness for yourself and forgive others.
+#    May you share freely, never taking more than you give.
+#
+#***********************************************************************
+#
+
+if {![info exists testdir]} {
+  set testdir [file join [file dirname [info script]] .. .. test]
+} 
+source [file join [file dirname [info script]] session_common.tcl]
+source $testdir/tester.tcl
+ifcapable !session {finish_test; return}
+set testprefix changesetfuzz1
+
+
+set CF [test_find_binary changesetfuzz]
+if {$CF==""} {
+  finish_test
+  return
+}
+
+proc writefile {zFile data} {
+  set fd [open $zFile w]
+  fconfigure $fd -translation binary -encoding binary
+  puts -nonewline $fd $data
+  close $fd
+}
+
+do_execsql_test 1.0 {
+  CREATE TABLE t1(a, b, c, d, PRIMARY KEY(c, d));
+  CREATE TABLE t2(a INTEGER PRIMARY KEY, b, c);
+
+  INSERT INTO t1 VALUES ('one', 'two', 'three', 'four'), 
+                        ('five', 'six', 'seven', 'eight'), 
+                        ('nine', 'ten', 'eleven', 'twelve');
+  INSERT INTO t2 VALUES (1, 2, 3), (4, 5, 6), (7, 8, 9);
+}
+
+set C [changeset_from_sql {
+  INSERT INTO t2 VALUES(10, 11, 12);
+  DELETE FROM t2 WHERE a=1;
+  UPDATE t1 SET b='forty-five' WHERE a='one';
+  UPDATE t1 SET a='twenty-nine', b='seventy' WHERE a='five';
+}]
+writefile c1.changeset $C
+
+do_test 1.1 {
+  for {set j 0} {$j < 200} {incr j} {
+    forcecopy c1.changeset input.changeset
+    for {set i 0} {$i < 6} {incr i} {
+      exec $CF input.changeset $i 1
+      exec $CF input.changeset-0
+      forcecopy input.changeset-0 input.changeset
+    }
+  }
+} {}
+
+set P [patchset_from_sql {
+  INSERT INTO t2 VALUES(13, 14, 15);
+  DELETE FROM t2 WHERE a=4;
+  UPDATE t1 SET b='thirteen' WHERE a='one';
+  UPDATE t1 SET a='ninety-seven', b='twenty' WHERE a='five';
+}]
+writefile p1.patchset $P
+do_test 1.2 {
+  for {set j 0} {$j < 200} {incr j} {
+    forcecopy p1.patchset input.patchset
+    for {set i 0} {$i < 6} {incr i} {
+      exec $CF input.patchset $i 1
+      exec $CF input.patchset-0
+      forcecopy input.patchset-0 input.patchset
+    }
+  }
+} {}
+
+
+finish_test
+

Index: ext/session/sessionC.test
==================================================================
--- ext/session/sessionC.test
+++ ext/session/sessionC.test
@@ -193,6 +193,5 @@
 } {1 1 3 3}
 
 
 
 finish_test
-

Index: ext/session/sessionD.test
==================================================================
--- ext/session/sessionD.test
+++ ext/session/sessionD.test
@@ -253,6 +253,5 @@
 do_catchsql_test 4.5.2 {
   SELECT * FROM ixua.i8;
 } {1 {no such table: ixua.i8}}
 
 finish_test
-

Index: ext/session/sessionE.test
==================================================================
--- ext/session/sessionE.test
+++ ext/session/sessionE.test
@@ -109,7 +109,5 @@
 
 
 S delete
 
 finish_test
-
-

Index: ext/session/sessionF.test
==================================================================
--- ext/session/sessionF.test
+++ ext/session/sessionF.test
@@ -290,6 +290,5 @@
   do_test 3.$tn { set res } [list {*}$result]
 }
 
 
 finish_test
-

Index: ext/session/sessionG.test
==================================================================
--- ext/session/sessionG.test
+++ ext/session/sessionG.test
@@ -246,6 +246,5 @@
 
 # db eval { SELECT * FROM t1 } { puts "$a || $b" }
 
 
 finish_test
-

Index: ext/session/sessionH.test
==================================================================
--- ext/session/sessionH.test
+++ ext/session/sessionH.test
@@ -34,6 +34,5 @@
   compare_db db db2
 } {}
 
 
 finish_test
-

Index: ext/session/session_speed_test.c
==================================================================
--- ext/session/session_speed_test.c
+++ ext/session/session_speed_test.c
@@ -354,7 +354,5 @@
   }
 
 
   return 0;
 }
-
-

Index: ext/session/sessionfault2.test
==================================================================
--- ext/session/sessionfault2.test
+++ ext/session/sessionfault2.test
@@ -280,6 +280,5 @@
   faultsim_test_result {0 {}} {1 SQLITE_NOMEM}
 }
 
 
 finish_test
-

Index: ext/session/sessionrebase.test
==================================================================
--- ext/session/sessionrebase.test
+++ ext/session/sessionrebase.test
@@ -472,6 +472,5 @@
   } $rebasable
 
   catch { R delete }
 }
 finish_test
-

Index: ext/session/sessionstat1.test
==================================================================
--- ext/session/sessionstat1.test
+++ ext/session/sessionstat1.test
@@ -306,6 +306,5 @@
   sqlite3changeset_apply db2 $C xConflict
   execsql { SELECT * FROM sqlite_stat1 ORDER BY 1,2 } db2
 } {t3 null 3}
 
 finish_test
-

Index: ext/session/sessionwor.test
==================================================================
--- ext/session/sessionwor.test
+++ ext/session/sessionwor.test
@@ -28,30 +28,73 @@
   forcedelete test.db test.db2
   sqlite3 db test.db
   sqlite3 db2 test.db2
 }
 
-
-do_execsql_test 1.0 {
-  CREATE TABLE t1(a PRIMARY KEY, b) WITHOUT ROWID;
-}
-
-do_iterator_test 1.1 t1 {
-  INSERT INTO t1 VALUES('one', 'two');
-} {
-  {INSERT t1 0 X. {} {t one t two}}
-}
-
-do_iterator_test 1.2 t1 {
-  UPDATE t1 SET b='three'
-} {
-  {UPDATE t1 0 X. {t one t two} {{} {} t three}}
-}
-
-do_iterator_test 1.3 t1 {
-  DELETE FROM t1;
-} {
-  {DELETE t1 0 X. {t one t three} {}}
+foreach {tn wo} {
+  1 ""
+  2 "WITHOUT ROWID"
+} {
+  reset_db
+
+  do_execsql_test 1.$tn.0 "CREATE TABLE t1(a PRIMARY KEY, b) $wo ;"
+  
+  do_iterator_test 1.$tn.1 t1 {
+    INSERT INTO t1 VALUES('one', 'two');
+  } {
+    {INSERT t1 0 X. {} {t one t two}}
+  }
+  
+  do_iterator_test 1.$tn.2 t1 {
+    UPDATE t1 SET b='three'
+  } {
+    {UPDATE t1 0 X. {t one t two} {{} {} t three}}
+  }
+  
+  do_iterator_test 1.$tn.3 t1 {
+    REPLACE INTO t1 VALUES('one', 'four');
+  } {
+    {UPDATE t1 0 X. {t one t three} {{} {} t four}}
+  }
+  
+  do_iterator_test 1.$tn.4 t1 {
+    DELETE FROM t1;
+  } {
+    {DELETE t1 0 X. {t one t four} {}}
+  }
+}
+
+foreach {tn wo} {
+  1 ""
+  2 "WITHOUT ROWID"
+} {
+  reset_db
+
+  do_execsql_test 2.$tn.0 "CREATE TABLE t1(a INTEGER PRIMARY KEY, b) $wo ;"
+  
+  do_iterator_test 1.1 t1 {
+    INSERT INTO t1 VALUES(1, 'two');
+  } {
+    {INSERT t1 0 X. {} {i 1 t two}}
+  }
+  
+  do_iterator_test 2.$tn.2 t1 {
+    UPDATE t1 SET b='three'
+  } {
+    {UPDATE t1 0 X. {i 1 t two} {{} {} t three}}
+  }
+  
+  do_iterator_test 2.$tn.3 t1 {
+    REPLACE INTO t1 VALUES(1, 'four');
+  } {
+    {UPDATE t1 0 X. {i 1 t three} {{} {} t four}}
+  }
+  
+  do_iterator_test 2.$tn.4 t1 {
+    DELETE FROM t1;
+  } {
+    {DELETE t1 0 X. {i 1 t four} {}}
+  }
 }
 
 finish_test
 

Index: ext/session/sqlite3session.c
==================================================================
--- ext/session/sqlite3session.c
+++ ext/session/sqlite3session.c
@@ -361,11 +361,11 @@
 ** SQLITE_NOMEM is returned.
 */
 static int sessionSerializeValue(
   u8 *aBuf,                       /* If non-NULL, write serialized value here */
   sqlite3_value *pValue,          /* Value to serialize */
-  int *pnWrite                    /* IN/OUT: Increment by bytes written */
+  sqlite3_int64 *pnWrite          /* IN/OUT: Increment by bytes written */
 ){
   int nByte;                      /* Size of serialized value in bytes */
 
   if( pValue ){
     int eType;                    /* Value type (SQLITE_NULL, TEXT etc.) */
@@ -902,11 +902,11 @@
   if( pTab->nChange==0 || pTab->nEntry>=(pTab->nChange/2) ){
     int i;
     SessionChange **apNew;
     int nNew = (pTab->nChange ? pTab->nChange : 128) * 2;
 
-    apNew = (SessionChange **)sqlite3_malloc(sizeof(SessionChange *) * nNew);
+    apNew = (SessionChange **)sqlite3_malloc64(sizeof(SessionChange *) * nNew);
     if( apNew==0 ){
       if( pTab->nChange==0 ){
         return SQLITE_ERROR;
       }
       return SQLITE_OK;
@@ -968,11 +968,11 @@
   u8 **pabPK                      /* OUT: Array of booleans - true for PK col */
 ){
   char *zPragma;
   sqlite3_stmt *pStmt;
   int rc;
-  int nByte;
+  sqlite3_int64 nByte;
   int nDbCol = 0;
   int nThis;
   int i;
   u8 *pAlloc = 0;
   char **azCol = 0;
@@ -1011,11 +1011,11 @@
   }
   rc = sqlite3_reset(pStmt);
 
   if( rc==SQLITE_OK ){
     nByte += nDbCol * (sizeof(const char *) + sizeof(u8) + 1);
-    pAlloc = sqlite3_malloc(nByte);
+    pAlloc = sqlite3_malloc64(nByte);
     if( pAlloc==0 ){
       rc = SQLITE_NOMEM;
     }
   }
   if( rc==SQLITE_OK ){
@@ -1152,11 +1152,11 @@
   SessionTable *pTab              /* Table that change applies to */
 ){
   int iHash; 
   int bNull = 0; 
   int rc = SQLITE_OK;
-  SessionStat1Ctx stat1 = {0};
+  SessionStat1Ctx stat1 = {{0,0,0,0,0},0};
 
   if( pSession->rc ) return;
 
   /* Load table details if required */
   if( sessionInitTable(pSession, pTab) ) return;
@@ -1209,11 +1209,11 @@
     if( pC==0 ){
       /* Create a new change object containing all the old values (if
       ** this is an SQLITE_UPDATE or SQLITE_DELETE), or just the PK
       ** values (if this is an INSERT). */
       SessionChange *pChange; /* New change object */
-      int nByte;              /* Number of bytes to allocate */
+      sqlite3_int64 nByte;    /* Number of bytes to allocate */
       int i;                  /* Used to iterate through columns */
   
       assert( rc==SQLITE_OK );
       pTab->nEntry++;
   
@@ -1234,11 +1234,11 @@
         rc = sessionSerializeValue(0, p, &nByte);
         if( rc!=SQLITE_OK ) goto error_out;
       }
   
       /* Allocate the change object */
-      pChange = (SessionChange *)sqlite3_malloc(nByte);
+      pChange = (SessionChange *)sqlite3_malloc64(nByte);
       if( !pChange ){
         rc = SQLITE_NOMEM;
         goto error_out;
       }else{
         memset(pChange, 0, sizeof(SessionChange));
@@ -1678,11 +1678,11 @@
 
   /* Zero the output value in case an error occurs. */
   *ppSession = 0;
 
   /* Allocate and populate the new session object. */
-  pNew = (sqlite3_session *)sqlite3_malloc(sizeof(sqlite3_session) + nDb + 1);
+  pNew = (sqlite3_session *)sqlite3_malloc64(sizeof(sqlite3_session) + nDb + 1);
   if( !pNew ) return SQLITE_NOMEM;
   memset(pNew, 0, sizeof(sqlite3_session));
   pNew->db = db;
   pNew->zDb = (char *)&pNew[1];
   pNew->bEnable = 1;
@@ -1797,11 +1797,11 @@
       if( 0==sqlite3_strnicmp(pTab->zName, zName, nName+1) ) break;
     }
 
     if( !pTab ){
       /* Allocate new SessionTable object. */
-      pTab = (SessionTable *)sqlite3_malloc(sizeof(SessionTable) + nName + 1);
+      pTab = (SessionTable *)sqlite3_malloc64(sizeof(SessionTable) + nName + 1);
       if( !pTab ){
         rc = SQLITE_NOMEM;
       }else{
         /* Populate the new SessionTable object and link it into the list.
         ** The new object must be linked onto the end of the list, not 
@@ -1857,11 +1857,11 @@
 ** before returning.
 */
 static void sessionAppendValue(SessionBuffer *p, sqlite3_value *pVal, int *pRc){
   int rc = *pRc;
   if( rc==SQLITE_OK ){
-    int nByte = 0;
+    sqlite3_int64 nByte = 0;
     rc = sessionSerializeValue(0, pVal, &nByte);
     sessionBufferGrow(p, nByte, &rc);
     if( rc==SQLITE_OK ){
       rc = sessionSerializeValue(&p->aBuf[p->nBuf], pVal, 0);
       p->nBuf += nByte;
@@ -2733,11 +2733,11 @@
 ){
   /* In theory this code could just pass SQLITE_TRANSIENT as the final
   ** argument to sqlite3ValueSetStr() and have the copy created 
   ** automatically. But doing so makes it difficult to detect any OOM
   ** error. Hence the code to create the copy externally. */
-  u8 *aCopy = sqlite3_malloc(nData+1);
+  u8 *aCopy = sqlite3_malloc64((sqlite3_int64)nData+1);
   if( aCopy==0 ) return SQLITE_NOMEM;
   memcpy(aCopy, aData, nData);
   sqlite3ValueSetStr(pVal, nData, (char*)aCopy, enc, sqlite3_free);
   return SQLITE_OK;
 }
@@ -3346,11 +3346,11 @@
 
       case SQLITE_UPDATE: {
         int iCol;
 
         if( 0==apVal ){
-          apVal = (sqlite3_value **)sqlite3_malloc(sizeof(apVal[0])*nCol*2);
+          apVal = (sqlite3_value **)sqlite3_malloc64(sizeof(apVal[0])*nCol*2);
           if( 0==apVal ){
             rc = SQLITE_NOMEM;
             goto finished_invert;
           }
           memset(apVal, 0, sizeof(apVal[0])*nCol*2);
@@ -4619,11 +4619,11 @@
 ){
   SessionChange *pNew = 0;
   int rc = SQLITE_OK;
 
   if( !pExist ){
-    pNew = (SessionChange *)sqlite3_malloc(sizeof(SessionChange) + nRec);
+    pNew = (SessionChange *)sqlite3_malloc64(sizeof(SessionChange) + nRec);
     if( !pNew ){
       return SQLITE_NOMEM;
     }
     memset(pNew, 0, sizeof(SessionChange));
     pNew->op = op2;
@@ -4652,12 +4652,12 @@
     }
   }else if( bRebase ){
     if( pExist->op==SQLITE_DELETE && pExist->bIndirect ){
       *ppNew = pExist;
     }else{
-      int nByte = nRec + pExist->nRecord + sizeof(SessionChange);
-      pNew = (SessionChange*)sqlite3_malloc(nByte);
+      sqlite3_int64 nByte = nRec + pExist->nRecord + sizeof(SessionChange);
+      pNew = (SessionChange*)sqlite3_malloc64(nByte);
       if( pNew==0 ){
         rc = SQLITE_NOMEM;
       }else{
         int i;
         u8 *a1 = pExist->aRecord;
@@ -4713,18 +4713,18 @@
     }else if( op1==SQLITE_INSERT && op2==SQLITE_DELETE ){
       sqlite3_free(pExist);
       assert( pNew==0 );
     }else{
       u8 *aExist = pExist->aRecord;
-      int nByte;
+      sqlite3_int64 nByte;
       u8 *aCsr;
 
       /* Allocate a new SessionChange object. Ensure that the aRecord[]
       ** buffer of the new object is large enough to hold any record that
       ** may be generated by combining the input records.  */
       nByte = sizeof(SessionChange) + pExist->nRecord + nRec;
-      pNew = (SessionChange *)sqlite3_malloc(nByte);
+      pNew = (SessionChange *)sqlite3_malloc64(nByte);
       if( !pNew ){
         sqlite3_free(pExist);
         return SQLITE_NOMEM;
       }
       memset(pNew, 0, sizeof(SessionChange));
@@ -4826,11 +4826,11 @@
         if( 0==sqlite3_strnicmp(pTab->zName, zNew, nNew+1) ) break;
       }
       if( !pTab ){
         SessionTable **ppTab;
 
-        pTab = sqlite3_malloc(sizeof(SessionTable) + nCol + nNew+1);
+        pTab = sqlite3_malloc64(sizeof(SessionTable) + nCol + nNew+1);
         if( !pTab ){
           rc = SQLITE_NOMEM;
           break;
         }
         memset(pTab, 0, sizeof(SessionTable));

Index: ext/session/sqlite3session.h
==================================================================
--- ext/session/sqlite3session.h
+++ ext/session/sqlite3session.h
@@ -546,11 +546,11 @@
 ** nul-terminated utf-8 encoded string containing the name of the table
 ** affected by the current change. The buffer remains valid until either
 ** sqlite3changeset_next() is called on the iterator or until the 
 ** conflict-handler function returns. If pnCol is not NULL, then *pnCol is 
 ** set to the number of columns in the table affected by the change. If
-** pbIncorrect is not NULL, then *pbIndirect is set to true (1) if the change
+** pbIndirect is not NULL, then *pbIndirect is set to true (1) if the change
 ** is an indirect change, or false (0) otherwise. See the documentation for
 ** [sqlite3session_indirect()] for a description of direct and indirect
 ** changes. Finally, if pOp is not NULL, then *pOp is set to one of 
 ** [SQLITE_INSERT], [SQLITE_DELETE] or [SQLITE_UPDATE], depending on the 
 ** type of change that the iterator currently points to.

Index: main.mk
==================================================================
--- main.mk
+++ main.mk
@@ -367,10 +367,11 @@
   $(TOP)/ext/misc/ieee754.c \
   $(TOP)/ext/misc/mmapwarm.c \
   $(TOP)/ext/misc/nextchar.c \
   $(TOP)/ext/misc/normalize.c \
   $(TOP)/ext/misc/percentile.c \
+  $(TOP)/ext/misc/prefixes.c \
   $(TOP)/ext/misc/regexp.c \
   $(TOP)/ext/misc/remember.c \
   $(TOP)/ext/misc/series.c \
   $(TOP)/ext/misc/spellfix.c \
   $(TOP)/ext/misc/totype.c \
@@ -394,10 +395,11 @@
   $(TOP)/src/date.c \
   $(TOP)/src/dbpage.c \
   $(TOP)/src/dbstat.c \
   $(TOP)/src/expr.c \
   $(TOP)/src/func.c \
+  $(TOP)/src/global.c \
   $(TOP)/src/insert.c \
   $(TOP)/src/wal.c \
   $(TOP)/src/main.c \
   $(TOP)/src/mem5.c \
   $(TOP)/src/os.c \
@@ -506,11 +508,12 @@
   $(TOP)/test/fuzzdata2.db \
   $(TOP)/test/fuzzdata3.db \
   $(TOP)/test/fuzzdata4.db \
   $(TOP)/test/fuzzdata5.db \
   $(TOP)/test/fuzzdata6.db \
-  $(TOP)/test/fuzzdata7.db
+  $(TOP)/test/fuzzdata7.db \
+  $(TOP)/test/fuzzdata8.db
 
 # Standard options to testfixture
 #
 TESTOPTS = --verbose=file --output=test-out.txt
 
@@ -527,10 +530,15 @@
 SHELL_OPT += -DSQLITE_INTROSPECTION_PRAGMAS
 FUZZERSHELL_OPT = -DSQLITE_ENABLE_JSON1
 FUZZCHECK_OPT = -DSQLITE_ENABLE_JSON1 -DSQLITE_ENABLE_MEMSYS5
 FUZZCHECK_OPT += -DSQLITE_MAX_MEMORY=50000000
 FUZZCHECK_OPT += -DSQLITE_PRINTF_PRECISION_LIMIT=1000
+FUZZCHECK_OPT += -DSQLITE_ENABLE_DESERIALIZE
+FUZZCHECK_OPT += -DSQLITE_ENABLE_FTS4
+FUZZCHECK_OPT += -DSQLITE_ENABLE_RTREE
+FUZZCHECK_OPT += -DSQLITE_ENABLE_GEOPOLY
+FUZZCHECK_OPT += -DSQLITE_ENABLE_DBSTAT_VTAB
 DBFUZZ_OPT =
 KV_OPT = -DSQLITE_THREADSAFE=0 -DSQLITE_DIRECT_OVERFLOW_READ
 ST_OPT = -DSQLITE_THREADSAFE=0
 
 # This is the default Makefile target.  The objects listed here
@@ -571,10 +579,24 @@
 dbfuzz$(EXE):	$(TOP)/test/dbfuzz.c sqlite3.c sqlite3.h
 	$(TCCX) -o dbfuzz$(EXE) -DSQLITE_THREADSAFE=0 -DSQLITE_OMIT_LOAD_EXTENSION \
 	  $(DBFUZZ_OPT) $(TOP)/test/dbfuzz.c sqlite3.c \
 	  $(TLIBS) $(THREADLIB)
 
+DBFUZZ2_OPTS = \
+  -DSQLITE_THREADSAFE=0 \
+  -DSQLITE_OMIT_LOAD_EXTENSION \
+  -DSQLITE_ENABLE_DESERIALIZE \
+  -DSQLITE_DEBUG \
+  -DSQLITE_ENABLE_DBSTAT_VTAB \
+  -DSQLITE_ENABLE_RTREE \
+  -DSQLITE_ENABLE_FTS4 \
+  -DSQLITE_ENABLE_FTS5
+
+dbfuzz2$(EXE):	$(TOP)/test/dbfuzz2.c sqlite3.c sqlite3.h
+	$(TCCX) -I. -g -O0 -DSTANDALONE -o dbfuzz2$(EXE) \
+	  $(DBFUZZ2_OPTS) $(TOP)/test/dbfuzz2.c sqlite3.c  $(TLIBS) $(THREADLIB)
+
 fuzzcheck$(EXE):	$(TOP)/test/fuzzcheck.c sqlite3.c sqlite3.h $(TOP)/test/ossfuzz.c
 	$(TCCX) -o fuzzcheck$(EXE) -DSQLITE_THREADSAFE=0 -DSQLITE_OMIT_LOAD_EXTENSION \
 		-DSQLITE_ENABLE_MEMSYS5 $(FUZZCHECK_OPT) -DSQLITE_OSS_FUZZ \
 		$(TOP)/test/fuzzcheck.c $(TOP)/test/ossfuzz.c sqlite3.c $(TLIBS) $(THREADLIB)
 
@@ -716,10 +738,11 @@
 	$(TOP)/ext/misc/completion.c \
 	$(TOP)/ext/misc/sqlar.c \
 	$(TOP)/ext/expert/sqlite3expert.c \
 	$(TOP)/ext/expert/sqlite3expert.h \
 	$(TOP)/ext/misc/zipfile.c \
+	$(TOP)/ext/misc/memtrace.c \
         $(TOP)/src/test_windirent.c
 
 shell.c:	$(SHELL_SRC) $(TOP)/tool/mkshellc.tcl
 	tclsh $(TOP)/tool/mkshellc.tcl >shell.c
 
@@ -973,10 +996,13 @@
 	$(MKSHLIB) $(TOP)/src/test_loadext.c -o $(TEST_EXTENSION)
 
 extensiontest: testfixture$(EXE) $(TEST_EXTENSION)
 	./testfixture$(EXE) $(TOP)/test/loadext.test
 
+dbtotxt$(EXE):	$(TOP)/tool/dbtotxt.c
+	$(TCC) -o dbtotxt$(EXE) $(TOP)/tool/dbtotxt.c
+
 showdb$(EXE):	$(TOP)/tool/showdb.c sqlite3.o
 	$(TCC) -DSQLITE_THREADSAFE=0 -DSQLITE_OMIT_LOAD_EXTENSION -o showdb$(EXE) \
 		$(TOP)/tool/showdb.c sqlite3.o $(THREADLIB)
 
 showstat4$(EXE):	$(TOP)/tool/showstat4.c sqlite3.o
@@ -991,14 +1017,22 @@
 	$(TCC) -DSQLITE_THREADSAFE=0 -DSQLITE_OMIT_LOAD_EXTENSION -o showwal$(EXE) \
 		$(TOP)/tool/showwal.c sqlite3.o $(THREADLIB)
 
 showshm$(EXE):	$(TOP)/tool/showshm.c
 	$(TCC) -o showshm$(EXE) $(TOP)/tool/showshm.c
+
+index_usage$(EXE): $(TOP)/tool/index_usage.c sqlite3.o
+	$(TCC) -DSQLITE_THREADSAFE=0 -DSQLITE_OMIT_DEPRECATED $(SHELL_OPTS) -o index_usage$(EXE) \
+		$(TOP)/tool/index_usage.c sqlite3.o $(THREADLIB)
 
 changeset$(EXE):	$(TOP)/ext/session/changeset.c sqlite3.o
 	$(TCC) -DSQLITE_THREADSAFE=0 -DSQLITE_OMIT_LOAD_EXTENSION -o changeset$(EXE) \
 		$(TOP)/ext/session/changeset.c sqlite3.o $(THREADLIB)
+
+changesetfuzz$(EXE):	$(TOP)/ext/session/changesetfuzz.c sqlite3.o
+	$(TCC) -DSQLITE_THREADSAFE=0 -DSQLITE_OMIT_LOAD_EXTENSION -o changesetfuzz$(EXE) \
+		$(TOP)/ext/session/changesetfuzz.c sqlite3.o $(THREADLIB)
 
 fts3view$(EXE):	$(TOP)/ext/fts3/tool/fts3view.c sqlite3.o
 	$(TCC) -DSQLITE_THREADSAFE=0 -DSQLITE_OMIT_LOAD_EXTENSION -o fts3view$(EXE) \
 		$(TOP)/ext/fts3/tool/fts3view.c sqlite3.o $(THREADLIB)
 

Index: src/alter.c
==================================================================
--- src/alter.c
+++ src/alter.c
@@ -26,13 +26,20 @@
 ** If the table is a system table, this function leaves an error message
 ** in pParse->zErr (system tables may not be altered) and returns non-zero.
 **
 ** Or, if zName is not a system table, zero is returned.
 */
-static int isSystemTable(Parse *pParse, const char *zName){
-  if( 0==sqlite3StrNICmp(zName, "sqlite_", 7) ){
-    sqlite3ErrorMsg(pParse, "table %s may not be altered", zName);
+static int isAlterableTable(Parse *pParse, Table *pTab){
+  if( 0==sqlite3StrNICmp(pTab->zName, "sqlite_", 7) 
+#ifndef SQLITE_OMIT_VIRTUALTABLE
+   || ( (pTab->tabFlags & TF_Shadow) 
+     && (pParse->db->flags & SQLITE_Defensive)
+     && pParse->db->nVdbeExec==0
+   )
+#endif
+  ){
+    sqlite3ErrorMsg(pParse, "table %s may not be altered", pTab->zName);
     return 1;
   }
   return 0;
 }
 
@@ -124,11 +131,11 @@
   }
 
   /* Make sure it is not a system table being altered, or a reserved name
   ** that the table is being renamed to.
   */
-  if( SQLITE_OK!=isSystemTable(pParse, pTab->zName) ){
+  if( SQLITE_OK!=isAlterableTable(pParse, pTab) ){
     goto exit_rename_table;
   }
   if( SQLITE_OK!=sqlite3CheckObjectName(pParse, zName) ){ goto
     exit_rename_table;
   }
@@ -422,11 +429,11 @@
   /* Make sure this is not an attempt to ALTER a view. */
   if( pTab->pSelect ){
     sqlite3ErrorMsg(pParse, "Cannot add a column to a view");
     goto exit_begin_add_column;
   }
-  if( SQLITE_OK!=isSystemTable(pParse, pTab->zName) ){
+  if( SQLITE_OK!=isAlterableTable(pParse, pTab) ){
     goto exit_begin_add_column;
   }
 
   assert( pTab->addColOffset>0 );
   iDb = sqlite3SchemaToIndex(db, pTab->pSchema);
@@ -524,11 +531,11 @@
   /* Locate the table to be altered */
   pTab = sqlite3LocateTableItem(pParse, 0, &pSrc->a[0]);
   if( !pTab ) goto exit_rename_column;
 
   /* Cannot alter a system table */
-  if( SQLITE_OK!=isSystemTable(pParse, pTab->zName) ) goto exit_rename_column;
+  if( SQLITE_OK!=isAlterableTable(pParse, pTab) ) goto exit_rename_column;
   if( SQLITE_OK!=isRealTable(pParse, pTab) ) goto exit_rename_column;
 
   /* Which schema holds the table to be altered */  
   iSchema = sqlite3SchemaToIndex(db, pTab->pSchema);
   assert( iSchema>=0 );
@@ -665,14 +672,20 @@
 #else
 # define renameTokenCheckAll(x,y)
 #endif
 
 /*
-** Add a new RenameToken object mapping parse tree element pPtr into
-** token *pToken to the Parse object currently under construction.
+** Remember that the parser tree element pPtr was created using
+** the token pToken.
+**
+** In other words, construct a new RenameToken object and add it
+** to the list of RenameToken objects currently being built up
+** in pParse->pRename.
 **
-** Return a copy of pPtr.
+** The pPtr argument is returned so that this routine can be used
+** with tail recursion in tokenExpr() routine, for a small performance
+** improvement.
 */
 void *sqlite3RenameTokenMap(Parse *pParse, void *pPtr, Token *pToken){
   RenameToken *pNew;
   assert( pPtr || pParse->db->mallocFailed );
   renameTokenCheckAll(pParse, pPtr);
@@ -771,19 +784,36 @@
       pCtx->nList++;
       break;
     }
   }
 }
+
+/*
+** Iterate through the Select objects that are part of WITH clauses attached
+** to select statement pSelect.
+*/
+static void renameWalkWith(Walker *pWalker, Select *pSelect){
+  if( pSelect->pWith ){
+    int i;
+    for(i=0; i<pSelect->pWith->nCte; i++){
+      Select *p = pSelect->pWith->a[i].pSelect;
+      NameContext sNC;
+      memset(&sNC, 0, sizeof(sNC));
+      sNC.pParse = pWalker->pParse;
+      sqlite3SelectPrep(sNC.pParse, p, &sNC);
+      sqlite3WalkSelect(pWalker, p);
+    }
+  }
+}
 
 /*
 ** This is a Walker select callback. It does nothing. It is only required
 ** because without a dummy callback, sqlite3WalkExpr() and similar do not
 ** descend into sub-select statements.
 */
 static int renameColumnSelectCb(Walker *pWalker, Select *p){
-  UNUSED_PARAMETER(pWalker);
-  UNUSED_PARAMETER(p);
+  renameWalkWith(pWalker, p);
   return WRC_Continue;
 }
 
 /*
 ** This is a Walker expression callback.
@@ -929,11 +959,10 @@
   p->db = db;
   p->nQueryLoop = 1;
   rc = sqlite3RunParser(p, zSql, &zErr);
   assert( p->zErrMsg==0 );
   assert( rc!=SQLITE_OK || zErr==0 );
-  assert( (0!=p->pNewTable) + (0!=p->pNewIndex) + (0!=p->pNewTrigger)<2 );
   p->zErrMsg = zErr;
   if( db->mallocFailed ) rc = SQLITE_NOMEM;
   if( rc==SQLITE_OK 
    && p->pNewTable==0 && p->pNewIndex==0 && p->pNewTrigger==0 
   ){
@@ -1112,10 +1141,11 @@
           if( rc==SQLITE_OK ){
             rc = sqlite3ResolveExprNames(&sNC, pUpsert->pUpsertTargetWhere);
           }
           sNC.ncFlags = 0;
         }
+        sNC.pSrcList = 0;
       }
     }
   }
   return rc;
 }
@@ -1149,15 +1179,19 @@
 ** Free the contents of Parse object (*pParse). Do not free the memory
 ** occupied by the Parse object itself.
 */
 static void renameParseCleanup(Parse *pParse){
   sqlite3 *db = pParse->db;
+  Index *pIdx;
   if( pParse->pVdbe ){
     sqlite3VdbeFinalize(pParse->pVdbe);
   }
   sqlite3DeleteTable(db, pParse->pNewTable);
-  if( pParse->pNewIndex ) sqlite3FreeIndex(db, pParse->pNewIndex);
+  while( (pIdx = pParse->pNewIndex)!=0 ){
+    pParse->pNewIndex = pIdx->pNext;
+    sqlite3FreeIndex(db, pIdx);
+  }
   sqlite3DeleteTrigger(db, pParse->pNewTrigger);
   sqlite3DbFree(db, pParse->zErrMsg);
   renameTokenFree(db, pParse->pRename);
   sqlite3ParserReset(pParse);
 }
@@ -1180,19 +1214,12 @@
 ** Do a column rename operation on the CREATE statement given in zSql.
 ** The iCol-th column (left-most is 0) of table zTable is renamed from zCol
 ** into zNew.  The name should be quoted if bQuote is true.
 **
 ** This function is used internally by the ALTER TABLE RENAME COLUMN command.
-** Though accessible to application code, it is not intended for use by
-** applications.  The existance of this function, and the way it works,
-** is subject to change without notice.
-**
-** If any of the parameters are out-of-bounds, then simply return NULL.
-** An out-of-bounds parameter can only occur when the application calls
-** this function directly.  The parameters will always be well-formed when
-** this routine is invoked by the bytecode for a legitimate ALTER TABLE
-** statement.
+** It is only accessible to SQL created using sqlite3NestedParse().  It is
+** not reachable from ordinary SQL passed into sqlite3_prepare().
 */
 static void renameColumnFunc(
   sqlite3_context *context,
   int NotUsed,
   sqlite3_value **argv
@@ -1270,10 +1297,13 @@
           renameTokenFind(&sParse, &sCtx, (void*)&sParse.pNewTable->iPKey);
         }
         sqlite3WalkExprList(&sWalker, sParse.pNewTable->pCheck);
         for(pIdx=sParse.pNewTable->pIndex; pIdx; pIdx=pIdx->pNext){
           sqlite3WalkExprList(&sWalker, pIdx->aColExpr);
+        }
+        for(pIdx=sParse.pNewIndex; pIdx; pIdx=pIdx->pNext){
+          sqlite3WalkExprList(&sWalker, pIdx->aColExpr);
         }
       }
 
       for(pFKey=sParse.pNewTable->pFKey; pFKey; pFKey=pFKey->pNextFrom){
         for(i=0; i<pFKey->nCol; i++){
@@ -1357,16 +1387,21 @@
 */
 static int renameTableSelectCb(Walker *pWalker, Select *pSelect){
   int i;
   RenameCtx *p = pWalker->u.pRename;
   SrcList *pSrc = pSelect->pSrc;
+  if( pSrc==0 ){
+    assert( pWalker->pParse->db->mallocFailed );
+    return WRC_Abort;
+  }
   for(i=0; i<pSrc->nSrc; i++){
     struct SrcList_item *pItem = &pSrc->a[i];
     if( pItem->pTab==p->pTab ){
       renameTokenFind(pWalker->pParse, p, pItem->zName);
     }
   }
+  renameWalkWith(pWalker, pSelect);
 
   return WRC_Continue;
 }
 
 
@@ -1442,11 +1477,11 @@
             sqlite3WalkSelect(&sWalker, pTab->pSelect);
           }
         }else{
           /* Modify any FK definitions to point to the new table. */
 #ifndef SQLITE_OMIT_FOREIGN_KEY
-          if( db->flags & SQLITE_ForeignKeys ){
+          if( isLegacy==0 || (db->flags & SQLITE_ForeignKeys) ){
             FKey *pFKey;
             for(pFKey=pTab->pFKey; pFKey; pFKey=pFKey->pNextFrom){
               if( sqlite3_stricmp(pFKey->zTo, zOld)==0 ){
                 renameTokenFind(&sParse, &sCtx, (void*)pFKey->zTo);
               }
@@ -1596,12 +1631,12 @@
 /*
 ** Register built-in functions used to help implement ALTER TABLE
 */
 void sqlite3AlterFunctions(void){
   static FuncDef aAlterTableFuncs[] = {
-    FUNCTION(sqlite_rename_column,  9, 0, 0, renameColumnFunc),
-    FUNCTION(sqlite_rename_table,  7, 0, 0, renameTableFunc),
-    FUNCTION(sqlite_rename_test,  5, 0, 0, renameTableTest),
+    INTERNAL_FUNCTION(sqlite_rename_column, 9, renameColumnFunc),
+    INTERNAL_FUNCTION(sqlite_rename_table,  7, renameTableFunc),
+    INTERNAL_FUNCTION(sqlite_rename_test,   5, renameTableTest),
   };
   sqlite3InsertBuiltinFuncs(aAlterTableFuncs, ArraySize(aAlterTableFuncs));
 }
 #endif  /* SQLITE_ALTER_TABLE */

Index: src/analyze.c
==================================================================
--- src/analyze.c
+++ src/analyze.c
@@ -1154,11 +1154,11 @@
     VdbeCoverage(v);
     sqlite3VdbeAddOp2(v, OP_Integer, 0, regChng);
     addrNextRow = sqlite3VdbeCurrentAddr(v);
 
     if( nColTest>0 ){
-      int endDistinctTest = sqlite3VdbeMakeLabel(v);
+      int endDistinctTest = sqlite3VdbeMakeLabel(pParse);
       int *aGotoChng;               /* Array of jump instruction addresses */
       aGotoChng = sqlite3DbMallocRawNN(db, sizeof(int)*nColTest);
       if( aGotoChng==0 ) continue;
 
       /*

Index: src/attach.c
==================================================================
--- src/attach.c
+++ src/attach.c
@@ -98,11 +98,11 @@
     if( pVfs==0 ) return;
     pNew = &db->aDb[db->init.iDb];
     if( pNew->pBt ) sqlite3BtreeClose(pNew->pBt);
     pNew->pBt = 0;
     pNew->pSchema = 0;
-    rc = sqlite3BtreeOpen(pVfs, "x", db, &pNew->pBt, 0, SQLITE_OPEN_MAIN_DB);
+    rc = sqlite3BtreeOpen(pVfs, "x\0", db, &pNew->pBt, 0, SQLITE_OPEN_MAIN_DB);
   }else{
     /* This is a real ATTACH
     **
     ** Check for the following errors:
     **
@@ -153,12 +153,12 @@
       return;
     }
     assert( pVfs );
     flags |= SQLITE_OPEN_MAIN_DB;
     rc = sqlite3BtreeOpen(pVfs, zPath, db, &pNew->pBt, 0, flags);
-    sqlite3_free( zPath );
     db->nDb++;
+    pNew->zDbSName = sqlite3DbStrDup(db, zName);
   }
   db->noSharedCache = 0;
   if( rc==SQLITE_CONSTRAINT ){
     rc = SQLITE_ERROR;
     zErrDyn = sqlite3MPrintf(db, "database is already attached");
@@ -182,11 +182,10 @@
                       PAGER_SYNCHRONOUS_FULL | (db->flags & PAGER_FLAGS_MASK));
 #endif
     sqlite3BtreeLeave(pNew->pBt);
   }
   pNew->safety_level = SQLITE_DEFAULT_SYNCHRONOUS+1;
-  if( !REOPEN_AS_MEMDB(db) ) pNew->zDbSName = sqlite3DbStrDup(db, zName);
   if( rc==SQLITE_OK && pNew->zDbSName==0 ){
     rc = SQLITE_NOMEM_BKPT;
   }
 
 
@@ -210,19 +209,23 @@
         zKey = (char *)sqlite3_value_blob(argv[2]);
         rc = sqlite3CodecAttach(db, db->nDb-1, zKey, nKey);
         break;
 
       case SQLITE_NULL:
-        /* No key specified.  Use the key from the main database */
-        sqlite3CodecGetKey(db, 0, (void**)&zKey, &nKey);
-        if( nKey || sqlite3BtreeGetOptimalReserve(db->aDb[0].pBt)>0 ){
-          rc = sqlite3CodecAttach(db, db->nDb-1, zKey, nKey);
+        /* No key specified.  Use the key from URI filename, or if none,
+        ** use the key from the main database. */
+        if( sqlite3CodecQueryParameters(db, zName, zPath)==0 ){
+          sqlite3CodecGetKey(db, 0, (void**)&zKey, &nKey);
+          if( nKey || sqlite3BtreeGetOptimalReserve(db->aDb[0].pBt)>0 ){
+            rc = sqlite3CodecAttach(db, db->nDb-1, zKey, nKey);
+          }
         }
         break;
     }
   }
 #endif
+  sqlite3_free( zPath );
 
   /* If the file was opened successfully, read the schema for the new database.
   ** If this fails, or if opening the file failed, then close the file and 
   ** remove the entry from the db->aDb[] array. i.e. put everything back the
   ** way we found it.

Index: src/btree.c
==================================================================
--- src/btree.c
+++ src/btree.c
@@ -658,17 +658,23 @@
 
   if( pCur->curIntKey ){
     /* Only the rowid is required for a table btree */
     pCur->nKey = sqlite3BtreeIntegerKey(pCur);
   }else{
-    /* For an index btree, save the complete key content */
+    /* For an index btree, save the complete key content. It is possible
+    ** that the current key is corrupt. In that case, it is possible that
+    ** the sqlite3VdbeRecordUnpack() function may overread the buffer by
+    ** up to the size of 1 varint plus 1 8-byte value when the cursor 
+    ** position is restored. Hence the 17 bytes of padding allocated 
+    ** below. */
     void *pKey;
     pCur->nKey = sqlite3BtreePayloadSize(pCur);
-    pKey = sqlite3Malloc( pCur->nKey );
+    pKey = sqlite3Malloc( pCur->nKey + 9 + 8 );
     if( pKey ){
       rc = sqlite3BtreePayload(pCur, 0, (int)pCur->nKey, pKey);
       if( rc==SQLITE_OK ){
+        memset(((u8*)pKey)+pCur->nKey, 0, 9+8);
         pCur->pKey = pKey;
       }else{
         sqlite3_free(pKey);
       }
     }else{
@@ -796,15 +802,16 @@
 ){
   int rc;                    /* Status code */
   UnpackedRecord *pIdxKey;   /* Unpacked index key */
 
   if( pKey ){
+    KeyInfo *pKeyInfo = pCur->pKeyInfo;
     assert( nKey==(i64)(int)nKey );
-    pIdxKey = sqlite3VdbeAllocUnpackedRecord(pCur->pKeyInfo);
+    pIdxKey = sqlite3VdbeAllocUnpackedRecord(pKeyInfo);
     if( pIdxKey==0 ) return SQLITE_NOMEM_BKPT;
-    sqlite3VdbeRecordUnpack(pCur->pKeyInfo, (int)nKey, pKey, pIdxKey);
-    if( pIdxKey->nField==0 ){
+    sqlite3VdbeRecordUnpack(pKeyInfo, (int)nKey, pKey, pIdxKey);
+    if( pIdxKey->nField==0 || pIdxKey->nField>pKeyInfo->nAllField ){
       rc = SQLITE_CORRUPT_BKPT;
       goto moveto_done;
     }
   }else{
     pIdxKey = 0;
@@ -836,11 +843,11 @@
   rc = btreeMoveto(pCur, pCur->pKey, pCur->nKey, 0, &skipNext);
   if( rc==SQLITE_OK ){
     sqlite3_free(pCur->pKey);
     pCur->pKey = 0;
     assert( pCur->eState==CURSOR_VALID || pCur->eState==CURSOR_INVALID );
-    pCur->skipNext |= skipNext;
+    if( skipNext ) pCur->skipNext = skipNext;
     if( pCur->skipNext && pCur->eState==CURSOR_VALID ){
       pCur->eState = CURSOR_SKIPNEXT;
     }
   }
   return rc;
@@ -906,11 +913,10 @@
     return rc;
   }
   if( pCur->eState!=CURSOR_VALID ){
     *pDifferentRow = 1;
   }else{
-    assert( pCur->skipNext==0 );
     *pDifferentRow = 0;
   }
   return SQLITE_OK;
 }
 
@@ -989,10 +995,17 @@
   iPtrmap = PTRMAP_PAGENO(pBt, key);
   rc = sqlite3PagerGet(pBt->pPager, iPtrmap, &pDbPage, 0);
   if( rc!=SQLITE_OK ){
     *pRC = rc;
     return;
+  }
+  if( ((char*)sqlite3PagerGetExtra(pDbPage))[0]!=0 ){
+    /* The first byte of the extra data is the MemPage.isInit byte.
+    ** If that byte is set, it means this page is also being used
+    ** as a btree page. */
+    *pRC = SQLITE_CORRUPT_BKPT;
+    goto ptrmap_exit;
   }
   offset = PTRMAP_PTROFFSET(iPtrmap, key);
   if( offset<0 ){
     *pRC = SQLITE_CORRUPT_BKPT;
     goto ptrmap_exit;
@@ -1052,11 +1065,11 @@
 }
 
 #else /* if defined SQLITE_OMIT_AUTOVACUUM */
   #define ptrmapPut(w,x,y,z,rc)
   #define ptrmapGet(w,x,y,z) SQLITE_OK
-  #define ptrmapPutOvflPtr(x, y, rc)
+  #define ptrmapPutOvflPtr(x, y, z, rc)
 #endif
 
 /*
 ** Given a btree page and a cell index (0 means the first cell on
 ** the page, 1 means the second cell, and so forth) return a pointer
@@ -1345,21 +1358,28 @@
 }
 #endif
 
 #ifndef SQLITE_OMIT_AUTOVACUUM
 /*
-** If the cell pCell, part of page pPage contains a pointer
-** to an overflow page, insert an entry into the pointer-map
-** for the overflow page.
+** The cell pCell is currently part of page pSrc but will ultimately be part
+** of pPage.  (pSrc and pPager are often the same.)  If pCell contains a
+** pointer to an overflow page, insert an entry into the pointer-map for
+** the overflow page that will be valid after pCell has been moved to pPage.
 */
-static void ptrmapPutOvflPtr(MemPage *pPage, u8 *pCell, int *pRC){
+static void ptrmapPutOvflPtr(MemPage *pPage, MemPage *pSrc, u8 *pCell,int *pRC){
   CellInfo info;
   if( *pRC ) return;
   assert( pCell!=0 );
   pPage->xParseCell(pPage, pCell, &info);
   if( info.nLocal<info.nPayload ){
-    Pgno ovfl = get4byte(&pCell[info.nSize-4]);
+    Pgno ovfl;
+    if( SQLITE_WITHIN(pSrc->aDataEnd, pCell, pCell+info.nLocal) ){
+      testcase( pSrc!=pPage );
+      *pRC = SQLITE_CORRUPT_BKPT;
+      return;
+    }
+    ovfl = get4byte(&pCell[info.nSize-4]);
     ptrmapPut(pPage->pBt, ovfl, PTRMAP_OVERFLOW1, pPage->pgno, pRC);
   }
 }
 #endif
 
@@ -1410,23 +1430,18 @@
   ** two (or one) blocks of cells using memmove() and add the required
   ** offsets to each pointer in the cell-pointer array than it is to 
   ** reconstruct the entire page.  */
   if( (int)data[hdr+7]<=nMaxFrag ){
     int iFree = get2byte(&data[hdr+1]);
+
+    /* If the initial freeblock offset were out of bounds, that would
+    ** have been detected by btreeInitPage() when it was computing the
+    ** number of free bytes on the page. */
+    assert( iFree<=usableSize-4 );
     if( iFree ){
       int iFree2 = get2byte(&data[iFree]);
-
-      /* pageFindSlot() has already verified that free blocks are sorted
-      ** in order of offset within the page, and that no block extends
-      ** past the end of the page. Provided the two free slots do not 
-      ** overlap, this guarantees that the memmove() calls below will not
-      ** overwrite the usableSize byte buffer, even if the database page
-      ** is corrupt.  */
-      assert( iFree2==0 || iFree2>iFree );
-      assert( iFree+get2byte(&data[iFree+2]) <= usableSize );
-      assert( iFree2==0 || iFree2+get2byte(&data[iFree2+2]) <= usableSize );
-
+      if( iFree2>usableSize-4 ) return SQLITE_CORRUPT_PAGE(pPage);
       if( 0==iFree2 || (data[iFree2]==0 && data[iFree2+1]==0) ){
         u8 *pEnd = &data[cellOffset + nCell*2];
         u8 *pAddr;
         int sz2 = 0;
         int sz = get2byte(&data[iFree+2]);
@@ -1433,13 +1448,13 @@
         int top = get2byte(&data[hdr+5]);
         if( top>=iFree ){
           return SQLITE_CORRUPT_PAGE(pPage);
         }
         if( iFree2 ){
-          assert( iFree+sz<=iFree2 ); /* Verified by pageFindSlot() */
+          if( iFree+sz>iFree2 ) return SQLITE_CORRUPT_PAGE(pPage);
           sz2 = get2byte(&data[iFree2+2]);
-          assert( iFree+sz+sz2+iFree2-(iFree+sz) <= usableSize );
+          if( iFree2+sz2 > usableSize ) return SQLITE_CORRUPT_PAGE(pPage);
           memmove(&data[iFree+sz+sz2], &data[iFree+sz], iFree2-(iFree+sz));
           sz += sz2;
         }
         cbrk = top+sz;
         assert( cbrk+(iFree-top) <= usableSize );
@@ -2990,13 +3005,13 @@
 ** is returned if we run out of memory. 
 */
 static int lockBtree(BtShared *pBt){
   int rc;              /* Result code from subfunctions */
   MemPage *pPage1;     /* Page 1 of the database file */
-  int nPage;           /* Number of pages in the database */
-  int nPageFile = 0;   /* Number of pages in the database file */
-  int nPageHeader;     /* Number of pages in the database according to hdr */
+  u32 nPage;           /* Number of pages in the database */
+  u32 nPageFile = 0;   /* Number of pages in the database file */
+  u32 nPageHeader;     /* Number of pages in the database according to hdr */
 
   assert( sqlite3_mutex_held(pBt->mutex) );
   assert( pBt->pPage1==0 );
   rc = sqlite3PagerSharedLock(pBt->pPager);
   if( rc!=SQLITE_OK ) return rc;
@@ -3005,11 +3020,11 @@
 
   /* Do some checking to help insure the file we opened really is
   ** a valid database file. 
   */
   nPage = nPageHeader = get4byte(28+(u8*)pPage1->aData);
-  sqlite3PagerPagecount(pBt->pPager, &nPageFile);
+  sqlite3PagerPagecount(pBt->pPager, (int*)&nPageFile);
   if( nPage==0 || memcmp(24+(u8*)pPage1->aData, 92+(u8*)pPage1->aData,4)!=0 ){
     nPage = nPageFile;
   }
   if( (pBt->db->flags & SQLITE_ResetDatabase)!=0 ){
     nPage = 0;
@@ -3086,10 +3101,11 @@
      || pageSize>SQLITE_MAX_PAGE_SIZE 
      || pageSize<=256 
     ){
       goto page1_init_failed;
     }
+    pBt->btsFlags |= BTS_PAGESIZE_FIXED;
     assert( (pageSize & 7)==0 );
     /* EVIDENCE-OF: R-59310-51205 The "reserved space" size in the 1-byte
     ** integer at offset 20 is the number of bytes of space at the end of
     ** each page to reserve for extensions. 
     **
@@ -3476,11 +3492,11 @@
   nCell = pPage->nCell;
 
   for(i=0; i<nCell; i++){
     u8 *pCell = findCell(pPage, i);
 
-    ptrmapPutOvflPtr(pPage, pCell, &rc);
+    ptrmapPutOvflPtr(pPage, pPage, pCell, &rc);
 
     if( !pPage->leaf ){
       Pgno childPgno = get4byte(pCell);
       ptrmapPut(pBt, childPgno, PTRMAP_BTREE, pgno, &rc);
     }
@@ -4402,10 +4418,11 @@
     btreeReleaseAllCursorPages(pCur);
     unlockBtreeIfUnused(pBt);
     sqlite3_free(pCur->aOverflow);
     sqlite3_free(pCur->pKey);
     sqlite3BtreeLeave(pBtree);
+    pCur->pBtree = 0;
   }
   return SQLITE_OK;
 }
 
 /*
@@ -4499,10 +4516,29 @@
   assert( cursorHoldsMutex(pCur) );
   assert( pCur->eState==CURSOR_VALID );
   getCellInfo(pCur);
   return pCur->info.nPayload;
 }
+
+/*
+** Return an upper bound on the size of any record for the table
+** that the cursor is pointing into.
+**
+** This is an optimization.  Everything will still work if this
+** routine always returns 2147483647 (which is the largest record
+** that SQLite can handle) or more.  But returning a smaller value might
+** prevent large memory allocations when trying to interpret a
+** corrupt datrabase.
+**
+** The current implementation merely returns the size of the underlying
+** database file.
+*/
+sqlite3_int64 sqlite3BtreeMaxRecordSize(BtCursor *pCur){
+  assert( cursorHoldsMutex(pCur) );
+  assert( pCur->eState==CURSOR_VALID );
+  return pCur->pBt->pageSize * (sqlite3_int64)pCur->pBt->nPage;
+}
 
 /*
 ** Given the page number of an overflow page in the database (parameter
 ** ovfl), this function finds the page number of the next page in the 
 ** linked list of overflow pages. If possible, it uses the auto-vacuum
@@ -4756,13 +4792,10 @@
         offset -= ovflSize;
       }else{
         /* Need to read this page properly. It contains some of the
         ** range of data that is being read (eOp==0) or written (eOp!=0).
         */
-#ifdef SQLITE_DIRECT_OVERFLOW_READ
-        sqlite3_file *fd;      /* File from which to do direct overflow read */
-#endif
         int a = amt;
         if( a + offset > ovflSize ){
           a = ovflSize - offset;
         }
 
@@ -4769,11 +4802,11 @@
 #ifdef SQLITE_DIRECT_OVERFLOW_READ
         /* If all the following are true:
         **
         **   1) this is a read operation, and 
         **   2) data is required from the start of this overflow page, and
-        **   3) there is no open write-transaction, and
+        **   3) there are no dirty pages in the page-cache
         **   4) the database is file-backed, and
         **   5) the page is not in the WAL file
         **   6) at least 4 bytes have already been read into the output buffer 
         **
         ** then data can be read directly from the database file into the
@@ -4780,15 +4813,14 @@
         ** output buffer, bypassing the page-cache altogether. This speeds
         ** up loading large records that span many overflow pages.
         */
         if( eOp==0                                             /* (1) */
          && offset==0                                          /* (2) */
-         && pBt->inTransaction==TRANS_READ                     /* (3) */
-         && (fd = sqlite3PagerFile(pBt->pPager))->pMethods     /* (4) */
-         && 0==sqlite3PagerUseWal(pBt->pPager, nextPage)       /* (5) */
+         && sqlite3PagerDirectReadOk(pBt->pPager, nextPage)    /* (3,4,5) */
          && &pBuf[-4]>=pBufStart                               /* (6) */
         ){
+          sqlite3_file *fd = sqlite3PagerFile(pBt->pPager);
           u8 aSave[4];
           u8 *aWrite = &pBuf[-4];
           assert( aWrite>=pBufStart );                         /* due to (6) */
           memcpy(aSave, aWrite, 4);
           rc = sqlite3OsRead(fd, aWrite, a+4, (i64)pBt->pageSize*(nextPage-1));
@@ -5318,11 +5350,11 @@
       }
       /* If the requested key is one more than the previous key, then
       ** try to get there using sqlite3BtreeNext() rather than a full
       ** binary search.  This is an optimization only.  The correct answer
       ** is still obtained without this case, only a little more slowely */
-      if( pCur->info.nKey+1==intKey && !pCur->skipNext ){
+      if( pCur->info.nKey+1==intKey ){
         *pRes = 0;
         rc = sqlite3BtreeNext(pCur, 0);
         if( rc==SQLITE_OK ){
           getCellInfo(pCur);
           if( pCur->info.nKey==intKey ){
@@ -5460,11 +5492,11 @@
           nCell = (int)pCur->info.nKey;
           testcase( nCell<0 );   /* True if key size is 2^32 or more */
           testcase( nCell==0 );  /* Invalid key size:  0x80 0x80 0x00 */
           testcase( nCell==1 );  /* Invalid key size:  0x80 0x80 0x01 */
           testcase( nCell==2 );  /* Minimum legal index key size */
-          if( nCell<2 ){
+          if( nCell<2 || nCell/pCur->pBt->usableSize>pCur->pBt->nPage ){
             rc = SQLITE_CORRUPT_PAGE(pPage);
             goto moveto_finish;
           }
           pCellKey = sqlite3Malloc( nCell+18 );
           if( pCellKey==0 ){
@@ -5592,28 +5624,22 @@
   int rc;
   int idx;
   MemPage *pPage;
 
   assert( cursorOwnsBtShared(pCur) );
-  assert( pCur->skipNext==0 || pCur->eState!=CURSOR_VALID );
   if( pCur->eState!=CURSOR_VALID ){
     assert( (pCur->curFlags & BTCF_ValidOvfl)==0 );
     rc = restoreCursorPosition(pCur);
     if( rc!=SQLITE_OK ){
       return rc;
     }
     if( CURSOR_INVALID==pCur->eState ){
       return SQLITE_DONE;
     }
-    if( pCur->skipNext ){
-      assert( pCur->eState==CURSOR_VALID || pCur->eState==CURSOR_SKIPNEXT );
+    if( pCur->eState==CURSOR_SKIPNEXT ){
       pCur->eState = CURSOR_VALID;
-      if( pCur->skipNext>0 ){
-        pCur->skipNext = 0;
-        return SQLITE_OK;
-      }
-      pCur->skipNext = 0;
+      if( pCur->skipNext>0 ) return SQLITE_OK;
     }
   }
 
   pPage = pCur->pPage;
   idx = ++pCur->ix;
@@ -5664,11 +5690,10 @@
 int sqlite3BtreeNext(BtCursor *pCur, int flags){
   MemPage *pPage;
   UNUSED_PARAMETER( flags );  /* Used in COMDB2 but not native SQLite */
   assert( cursorOwnsBtShared(pCur) );
   assert( flags==0 || flags==1 );
-  assert( pCur->skipNext==0 || pCur->eState!=CURSOR_VALID );
   pCur->info.nSize = 0;
   pCur->curFlags &= ~(BTCF_ValidNKey|BTCF_ValidOvfl);
   if( pCur->eState!=CURSOR_VALID ) return btreeNext(pCur);
   pPage = pCur->pPage;
   if( (++pCur->ix)>=pPage->nCell ){
@@ -5705,11 +5730,10 @@
 static SQLITE_NOINLINE int btreePrevious(BtCursor *pCur){
   int rc;
   MemPage *pPage;
 
   assert( cursorOwnsBtShared(pCur) );
-  assert( pCur->skipNext==0 || pCur->eState!=CURSOR_VALID );
   assert( (pCur->curFlags & (BTCF_AtLast|BTCF_ValidOvfl|BTCF_ValidNKey))==0 );
   assert( pCur->info.nSize==0 );
   if( pCur->eState!=CURSOR_VALID ){
     rc = restoreCursorPosition(pCur);
     if( rc!=SQLITE_OK ){
@@ -5716,18 +5740,13 @@
       return rc;
     }
     if( CURSOR_INVALID==pCur->eState ){
       return SQLITE_DONE;
     }
-    if( pCur->skipNext ){
-      assert( pCur->eState==CURSOR_VALID || pCur->eState==CURSOR_SKIPNEXT );
+    if( CURSOR_SKIPNEXT==pCur->eState ){
       pCur->eState = CURSOR_VALID;
-      if( pCur->skipNext<0 ){
-        pCur->skipNext = 0;
-        return SQLITE_OK;
-      }
-      pCur->skipNext = 0;
+      if( pCur->skipNext<0 ) return SQLITE_OK;
     }
   }
 
   pPage = pCur->pPage;
   assert( pPage->isInit );
@@ -5758,11 +5777,10 @@
   return rc;
 }
 int sqlite3BtreePrevious(BtCursor *pCur, int flags){
   assert( cursorOwnsBtShared(pCur) );
   assert( flags==0 || flags==1 );
-  assert( pCur->skipNext==0 || pCur->eState!=CURSOR_VALID );
   UNUSED_PARAMETER( flags );  /* Used in COMDB2 but not native SQLite */
   pCur->curFlags &= ~(BTCF_AtLast|BTCF_ValidOvfl|BTCF_ValidNKey);
   pCur->info.nSize = 0;
   if( pCur->eState!=CURSOR_VALID
    || pCur->ix==0
@@ -6094,11 +6112,11 @@
       *ppPage = 0;
     }
     TRACE(("ALLOCATE: %d from end of file\n", *pPgno));
   }
 
-  assert( *pPgno!=PENDING_BYTE_PAGE(pBt) );
+  assert( CORRUPT_DB || *pPgno!=PENDING_BYTE_PAGE(pBt) );
 
 end_allocate_page:
   releasePage(pTrunk);
   releasePage(pPrevTrunk);
   assert( rc!=SQLITE_OK || sqlite3PagerPageRefcount((*ppPage)->pDbPage)<=1 );
@@ -6649,13 +6667,20 @@
     ** if it returns successfully */
     assert( idx >= 0 );
     assert( idx >= pPage->cellOffset+2*pPage->nCell+2 || CORRUPT_DB );
     assert( idx+sz <= (int)pPage->pBt->usableSize );
     pPage->nFree -= (u16)(2 + sz);
-    memcpy(&data[idx], pCell, sz);
     if( iChild ){
+      /* In a corrupt database where an entry in the cell index section of
+      ** a btree page has a value of 3 or less, the pCell value might point
+      ** as many as 4 bytes in front of the start of the aData buffer for
+      ** the source page.  Make sure this does not cause problems by not
+      ** reading the first 4 bytes */
+      memcpy(&data[idx+4], pCell+4, sz-4);
       put4byte(&data[idx], iChild);
+    }else{
+      memcpy(&data[idx], pCell, sz);
     }
     pIns = pPage->aCellIdx + i*2;
     memmove(pIns+2, pIns, 2*(pPage->nCell - i));
     put2byte(pIns, idx);
     pPage->nCell++;
@@ -6665,26 +6690,102 @@
 #ifndef SQLITE_OMIT_AUTOVACUUM
     if( pPage->pBt->autoVacuum ){
       /* The cell may contain a pointer to an overflow page. If so, write
       ** the entry for the overflow page into the pointer map.
       */
-      ptrmapPutOvflPtr(pPage, pCell, pRC);
+      ptrmapPutOvflPtr(pPage, pPage, pCell, pRC);
     }
 #endif
   }
 }
 
+/*
+** The following parameters determine how many adjacent pages get involved
+** in a balancing operation.  NN is the number of neighbors on either side
+** of the page that participate in the balancing operation.  NB is the
+** total number of pages that participate, including the target page and
+** NN neighbors on either side.
+**
+** The minimum value of NN is 1 (of course).  Increasing NN above 1
+** (to 2 or 3) gives a modest improvement in SELECT and DELETE performance
+** in exchange for a larger degradation in INSERT and UPDATE performance.
+** The value of NN appears to give the best results overall.
+**
+** (Later:) The description above makes it seem as if these values are
+** tunable - as if you could change them and recompile and it would all work.
+** But that is unlikely.  NB has been 3 since the inception of SQLite and
+** we have never tested any other value.
+*/
+#define NN 1             /* Number of neighbors on either side of pPage */
+#define NB 3             /* (NN*2+1): Total pages involved in the balance */
+
 /*
 ** A CellArray object contains a cache of pointers and sizes for a
 ** consecutive sequence of cells that might be held on multiple pages.
+**
+** The cells in this array are the divider cell or cells from the pParent
+** page plus up to three child pages.  There are a total of nCell cells.
+**
+** pRef is a pointer to one of the pages that contributes cells.  This is
+** used to access information such as MemPage.intKey and MemPage.pBt->pageSize
+** which should be common to all pages that contribute cells to this array.
+**
+** apCell[] and szCell[] hold, respectively, pointers to the start of each
+** cell and the size of each cell.  Some of the apCell[] pointers might refer
+** to overflow cells.  In other words, some apCel[] pointers might not point
+** to content area of the pages.
+**
+** A szCell[] of zero means the size of that cell has not yet been computed.
+**
+** The cells come from as many as four different pages:
+**
+**             -----------
+**             | Parent  |
+**             -----------
+**            /     |     \
+**           /      |      \
+**  ---------   ---------   ---------
+**  |Child-1|   |Child-2|   |Child-3|
+**  ---------   ---------   ---------
+**
+** The order of cells is in the array is for an index btree is:
+**
+**       1.  All cells from Child-1 in order
+**       2.  The first divider cell from Parent
+**       3.  All cells from Child-2 in order
+**       4.  The second divider cell from Parent
+**       5.  All cells from Child-3 in order
+**
+** For a table-btree (with rowids) the items 2 and 4 are empty because
+** content exists only in leaves and there are no divider cells.
+**
+** For an index btree, the apEnd[] array holds pointer to the end of page
+** for Child-1, the Parent, Child-2, the Parent (again), and Child-3,
+** respectively. The ixNx[] array holds the number of cells contained in
+** each of these 5 stages, and all stages to the left.  Hence:
+**
+**    ixNx[0] = Number of cells in Child-1.
+**    ixNx[1] = Number of cells in Child-1 plus 1 for first divider.
+**    ixNx[2] = Number of cells in Child-1 and Child-2 + 1 for 1st divider.
+**    ixNx[3] = Number of cells in Child-1 and Child-2 + both divider cells
+**    ixNx[4] = Total number of cells.
+**
+** For a table-btree, the concept is similar, except only apEnd[0]..apEnd[2]
+** are used and they point to the leaf pages only, and the ixNx value are:
+**
+**    ixNx[0] = Number of cells in Child-1.
+**    ixNx[1] = Number of cells in Child-1 and Child-2 + 1 for 1st divider.
+**    ixNx[2] = Number of cells in Child-1 and Child-2 + both divider cells
 */
 typedef struct CellArray CellArray;
 struct CellArray {
   int nCell;              /* Number of cells in apCell[] */
   MemPage *pRef;          /* Reference page */
   u8 **apCell;            /* All cells begin balanced */
   u16 *szCell;            /* Local size of all cells in apCell[] */
+  u8 *apEnd[NB*2];        /* MemPage.aDataEnd values */
+  int ixNx[NB*2];         /* Index of at which we move to the next apEnd[] */
 };
 
 /*
 ** Make sure the cell sizes at idx, idx+1, ..., idx+N-1 have been
 ** computed.
@@ -6731,40 +6832,63 @@
 **
 ** The MemPage.nFree field is invalidated by this function. It is the 
 ** responsibility of the caller to set it correctly.
 */
 static int rebuildPage(
-  MemPage *pPg,                   /* Edit this page */
+  CellArray *pCArray,             /* Content to be added to page pPg */
+  int iFirst,                     /* First cell in pCArray to use */
   int nCell,                      /* Final number of cells on page */
-  u8 **apCell,                    /* Array of cells */
-  u16 *szCell                     /* Array of cell sizes */
+  MemPage *pPg                    /* The page to be reconstructed */
 ){
   const int hdr = pPg->hdrOffset;          /* Offset of header on pPg */
   u8 * const aData = pPg->aData;           /* Pointer to data for pPg */
   const int usableSize = pPg->pBt->usableSize;
   u8 * const pEnd = &aData[usableSize];
-  int i;
+  int i = iFirst;                 /* Which cell to copy from pCArray*/
+  u32 j;                          /* Start of cell content area */
+  int iEnd = i+nCell;             /* Loop terminator */
   u8 *pCellptr = pPg->aCellIdx;
   u8 *pTmp = sqlite3PagerTempSpace(pPg->pBt->pPager);
   u8 *pData;
+  int k;                          /* Current slot in pCArray->apEnd[] */
+  u8 *pSrcEnd;                    /* Current pCArray->apEnd[k] value */
 
-  i = get2byte(&aData[hdr+5]);
-  memcpy(&pTmp[i], &aData[i], usableSize - i);
+  assert( i<iEnd );
+  j = get2byte(&aData[hdr+5]);
+  if( NEVER(j>(u32)usableSize) ){ j = 0; }
+  memcpy(&pTmp[j], &aData[j], usableSize - j);
+
+  for(k=0; pCArray->ixNx[k]<=i && ALWAYS(k<NB*2); k++){}
+  pSrcEnd = pCArray->apEnd[k];
 
   pData = pEnd;
-  for(i=0; i<nCell; i++){
-    u8 *pCell = apCell[i];
+  while( 1/*exit by break*/ ){
+    u8 *pCell = pCArray->apCell[i];
+    u16 sz = pCArray->szCell[i];
+    assert( sz>0 );
     if( SQLITE_WITHIN(pCell,aData,pEnd) ){
+      if( ((uptr)(pCell+sz))>(uptr)pEnd ) return SQLITE_CORRUPT_BKPT;
       pCell = &pTmp[pCell - aData];
+    }else if( (uptr)(pCell+sz)>(uptr)pSrcEnd
+           && (uptr)(pCell)<(uptr)pSrcEnd
+    ){
+      return SQLITE_CORRUPT_BKPT;
     }
-    pData -= szCell[i];
+
+    pData -= sz;
     put2byte(pCellptr, (pData - aData));
     pCellptr += 2;
     if( pData < pCellptr ) return SQLITE_CORRUPT_BKPT;
-    memcpy(pData, pCell, szCell[i]);
-    assert( szCell[i]==pPg->xCellSize(pPg, pCell) || CORRUPT_DB );
-    testcase( szCell[i]!=pPg->xCellSize(pPg,pCell) );
+    memcpy(pData, pCell, sz);
+    assert( sz==pPg->xCellSize(pPg, pCell) || CORRUPT_DB );
+    testcase( sz!=pPg->xCellSize(pPg,pCell) );
+    i++;
+    if( i>=iEnd ) break;
+    if( pCArray->ixNx[k]<=i ){
+      k++;
+      pSrcEnd = pCArray->apEnd[k];
+    }
   }
 
   /* The pPg->nFree field is now set incorrectly. The caller will fix it. */
   pPg->nCell = nCell;
   pPg->nOverflow = 0;
@@ -6775,16 +6899,15 @@
   aData[hdr+7] = 0x00;
   return SQLITE_OK;
 }
 
 /*
-** Array apCell[] contains nCell pointers to b-tree cells. Array szCell
-** contains the size in bytes of each such cell. This function attempts to 
-** add the cells stored in the array to page pPg. If it cannot (because 
-** the page needs to be defragmented before the cells will fit), non-zero
-** is returned. Otherwise, if the cells are added successfully, zero is
-** returned.
+** The pCArray objects contains pointers to b-tree cells and the cell sizes.
+** This function attempts to add the cells stored in the array to page pPg.
+** If it cannot (because the page needs to be defragmented before the cells
+** will fit), non-zero is returned. Otherwise, if the cells are added
+** successfully, zero is returned.
 **
 ** Argument pCellptr points to the first entry in the cell-pointer array
 ** (part of page pPg) to populate. After cell apCell[0] is written to the
 ** page body, a 16-bit offset is written to pCellptr. And so on, for each
 ** cell in the array. It is the responsibility of the caller to ensure
@@ -6802,22 +6925,27 @@
 ** cells in apCell[], then the cells do not fit and non-zero is returned.
 */
 static int pageInsertArray(
   MemPage *pPg,                   /* Page to add cells to */
   u8 *pBegin,                     /* End of cell-pointer array */
-  u8 **ppData,                    /* IN/OUT: Page content -area pointer */
+  u8 **ppData,                    /* IN/OUT: Page content-area pointer */
   u8 *pCellptr,                   /* Pointer to cell-pointer area */
   int iFirst,                     /* Index of first cell to add */
   int nCell,                      /* Number of cells to add to pPg */
   CellArray *pCArray              /* Array of cells */
 ){
-  int i;
-  u8 *aData = pPg->aData;
-  u8 *pData = *ppData;
-  int iEnd = iFirst + nCell;
+  int i = iFirst;                 /* Loop counter - cell index to insert */
+  u8 *aData = pPg->aData;         /* Complete page */
+  u8 *pData = *ppData;            /* Content area.  A subset of aData[] */
+  int iEnd = iFirst + nCell;      /* End of loop. One past last cell to ins */
+  int k;                          /* Current slot in pCArray->apEnd[] */
+  u8 *pEnd;                       /* Maximum extent of cell data */
   assert( CORRUPT_DB || pPg->hdrOffset==0 );    /* Never called on page 1 */
-  for(i=iFirst; i<iEnd; i++){
+  if( iEnd<=iFirst ) return 0;
+  for(k=0; pCArray->ixNx[k]<=i && ALWAYS(k<NB*2); k++){}
+  pEnd = pCArray->apEnd[k];
+  while( 1 /*Exit by break*/ ){
     int sz, rc;
     u8 *pSlot;
     sz = cachedCellSize(pCArray, i);
     if( (aData[1]==0 && aData[2]==0) || (pSlot = pageFindSlot(pPg,sz,&rc))==0 ){
       if( (pData - pBegin)<sz ) return 1;
@@ -6828,24 +6956,37 @@
     ** database.  But they might for a corrupt database.  Hence use memmove()
     ** since memcpy() sends SIGABORT with overlapping buffers on OpenBSD */
     assert( (pSlot+sz)<=pCArray->apCell[i]
          || pSlot>=(pCArray->apCell[i]+sz)
          || CORRUPT_DB );
+    if( (uptr)(pCArray->apCell[i]+sz)>(uptr)pEnd
+     && (uptr)(pCArray->apCell[i])<(uptr)pEnd
+    ){
+      assert( CORRUPT_DB );
+      (void)SQLITE_CORRUPT_BKPT;
+      return 1;
+    }
     memmove(pSlot, pCArray->apCell[i], sz);
     put2byte(pCellptr, (pSlot - aData));
     pCellptr += 2;
+    i++;
+    if( i>=iEnd ) break;
+    if( pCArray->ixNx[k]<=i ){
+      k++;
+      pEnd = pCArray->apEnd[k];
+    }
   }
   *ppData = pData;
   return 0;
 }
 
 /*
-** Array apCell[] contains nCell pointers to b-tree cells. Array szCell 
-** contains the size in bytes of each such cell. This function adds the
-** space associated with each cell in the array that is currently stored 
-** within the body of pPg to the pPg free-list. The cell-pointers and other
-** fields of the page are not updated.
+** The pCArray object contains pointers to b-tree cells and their sizes.
+**
+** This function adds the space associated with each cell in the array
+** that is currently stored within the body of pPg to the pPg free-list.
+** The cell-pointers and other fields of the page are not updated.
 **
 ** This function returns the total number of cells added to the free-list.
 */
 static int pageFreeArray(
   MemPage *pPg,                   /* Page to edit */
@@ -6891,13 +7032,13 @@
   }
   return nRet;
 }
 
 /*
-** apCell[] and szCell[] contains pointers to and sizes of all cells in the
-** pages being balanced.  The current page, pPg, has pPg->nCell cells starting
-** with apCell[iOld].  After balancing, this page should hold nNew cells
+** pCArray contains pointers to and sizes of all cells in the page being
+** balanced.  The current page, pPg, has pPg->nCell cells starting with
+** pCArray->apCell[iOld].  After balancing, this page should hold nNew cells
 ** starting at apCell[iNew].
 **
 ** This routine makes the necessary adjustments to pPg so that it contains
 ** the correct cells after being balanced.
 **
@@ -6925,26 +7066,31 @@
   u8 *pTmp = sqlite3PagerTempSpace(pPg->pBt->pPager);
   memcpy(pTmp, aData, pPg->pBt->usableSize);
 #endif
 
   /* Remove cells from the start and end of the page */
+  assert( nCell>=0 );
   if( iOld<iNew ){
     int nShift = pageFreeArray(pPg, iOld, iNew-iOld, pCArray);
+    if( nShift>nCell ) return SQLITE_CORRUPT_BKPT;
     memmove(pPg->aCellIdx, &pPg->aCellIdx[nShift*2], nCell*2);
     nCell -= nShift;
   }
   if( iNewEnd < iOldEnd ){
-    nCell -= pageFreeArray(pPg, iNewEnd, iOldEnd - iNewEnd, pCArray);
+    int nTail = pageFreeArray(pPg, iNewEnd, iOldEnd - iNewEnd, pCArray);
+    assert( nCell>=nTail );
+    nCell -= nTail;
   }
 
   pData = &aData[get2byteNotZero(&aData[hdr+5])];
   if( pData<pBegin ) goto editpage_fail;
 
   /* Add cells to the start of the page */
   if( iNew<iOld ){
     int nAdd = MIN(nNew,iOld-iNew);
     assert( (iOld-iNew)<nNew || nCell==0 || CORRUPT_DB );
+    assert( nAdd>=0 );
     pCellptr = pPg->aCellIdx;
     memmove(&pCellptr[nAdd*2], pCellptr, nCell*2);
     if( pageInsertArray(
           pPg, pBegin, &pData, pCellptr,
           iNew, nAdd, pCArray
@@ -6955,10 +7101,11 @@
   /* Add any overflow cells */
   for(i=0; i<pPg->nOverflow; i++){
     int iCell = (iOld + pPg->aiOvfl[i]) - iNew;
     if( iCell>=0 && iCell<nNew ){
       pCellptr = &pPg->aCellIdx[iCell * 2];
+      assert( nCell>=iCell );
       memmove(&pCellptr[2], pCellptr, (nCell - iCell) * 2);
       nCell++;
       if( pageInsertArray(
             pPg, pBegin, &pData, pCellptr,
             iCell+iNew, 1, pCArray
@@ -6965,10 +7112,11 @@
       ) ) goto editpage_fail;
     }
   }
 
   /* Append cells to the end of the page */
+  assert( nCell>=0 );
   pCellptr = &pPg->aCellIdx[nCell*2];
   if( pageInsertArray(
         pPg, pBegin, &pData, pCellptr,
         iNew+nCell, nNew-nCell, pCArray
   ) ) goto editpage_fail;
@@ -6993,27 +7141,12 @@
 
   return SQLITE_OK;
  editpage_fail:
   /* Unable to edit this page. Rebuild it from scratch instead. */
   populateCellCache(pCArray, iNew, nNew);
-  return rebuildPage(pPg, nNew, &pCArray->apCell[iNew], &pCArray->szCell[iNew]);
-}
-
-/*
-** The following parameters determine how many adjacent pages get involved
-** in a balancing operation.  NN is the number of neighbors on either side
-** of the page that participate in the balancing operation.  NB is the
-** total number of pages that participate, including the target page and
-** NN neighbors on either side.
-**
-** The minimum value of NN is 1 (of course).  Increasing NN above 1
-** (to 2 or 3) gives a modest improvement in SELECT and DELETE performance
-** in exchange for a larger degradation in INSERT and UPDATE performance.
-** The value of NN appears to give the best results overall.
-*/
-#define NN 1             /* Number of neighbors on either side of pPage */
-#define NB (NN*2+1)      /* Total pages involved in the balance */
+  return rebuildPage(pCArray, iNew, nNew, pPg);
+}
 
 
 #ifndef SQLITE_OMIT_QUICKBALANCE
 /*
 ** This version of balance() handles the common special case where
@@ -7046,12 +7179,11 @@
 
   assert( sqlite3_mutex_held(pPage->pBt->mutex) );
   assert( sqlite3PagerIswriteable(pParent->pDbPage) );
   assert( pPage->nOverflow==1 );
 
-  /* This error condition is now caught prior to reaching this function */
-  if( NEVER(pPage->nCell==0) ) return SQLITE_CORRUPT_BKPT;
+  if( pPage->nCell==0 ) return SQLITE_CORRUPT_BKPT;  /* dbfuzz001.test */
 
   /* Allocate a new page. This page will become the right-sibling of 
   ** pPage. Make the parent page writable, so that the new divider cell
   ** may be inserted. If both these operations are successful, proceed.
   */
@@ -7061,16 +7193,26 @@
 
     u8 *pOut = &pSpace[4];
     u8 *pCell = pPage->apOvfl[0];
     u16 szCell = pPage->xCellSize(pPage, pCell);
     u8 *pStop;
+    CellArray b;
 
     assert( sqlite3PagerIswriteable(pNew->pDbPage) );
-    assert( pPage->aData[0]==(PTF_INTKEY|PTF_LEAFDATA|PTF_LEAF) );
+    assert( CORRUPT_DB || pPage->aData[0]==(PTF_INTKEY|PTF_LEAFDATA|PTF_LEAF) );
     zeroPage(pNew, PTF_INTKEY|PTF_LEAFDATA|PTF_LEAF);
-    rc = rebuildPage(pNew, 1, &pCell, &szCell);
-    if( NEVER(rc) ) return rc;
+    b.nCell = 1;
+    b.pRef = pPage;
+    b.apCell = &pCell;
+    b.szCell = &szCell;
+    b.apEnd[0] = pPage->aDataEnd;
+    b.ixNx[0] = 2;
+    rc = rebuildPage(&b, 0, 1, pNew);
+    if( NEVER(rc) ){
+      releasePage(pNew);
+      return rc;
+    }
     pNew->nFree = pBt->usableSize - pNew->cellOffset - 2 - szCell;
 
     /* If this is an auto-vacuum database, update the pointer map
     ** with entries for the new page, and any pointer from the 
     ** cell on the page to an overflow page. If either of these
@@ -7081,11 +7223,11 @@
     ** rollback, undoing any changes made to the parent page.
     */
     if( ISAUTOVACUUM ){
       ptrmapPut(pBt, pgnoNew, PTRMAP_BTREE, pParent->pgno, &rc);
       if( szCell>pNew->minLocal ){
-        ptrmapPutOvflPtr(pNew, pCell, &rc);
+        ptrmapPutOvflPtr(pNew, pNew, pCell, &rc);
       }
     }
   
     /* Create a divider cell to insert into pParent. The divider cell
     ** consists of a 4-byte page number (the page number of pPage) and
@@ -7304,14 +7446,10 @@
   b.apCell = 0;
   pBt = pParent->pBt;
   assert( sqlite3_mutex_held(pBt->mutex) );
   assert( sqlite3PagerIswriteable(pParent->pDbPage) );
 
-#if 0
-  TRACE(("BALANCE: begin page %d child of %d\n", pPage->pgno, pParent->pgno));
-#endif
-
   /* At this point pParent may have at most one overflow cell. And if
   ** this overflow cell is present, it must be the cell with 
   ** index iParentIdx. This scenario comes about when this function
   ** is called (indirectly) from sqlite3BtreeDelete().
   */
@@ -7548,12 +7686,19 @@
   **              the right of the i-th sibling page.
   ** usableSpace: Number of bytes of space available on each sibling.
   ** 
   */
   usableSpace = pBt->usableSize - 12 + leafCorrection;
-  for(i=0; i<nOld; i++){
+  for(i=k=0; i<nOld; i++, k++){
     MemPage *p = apOld[i];
+    b.apEnd[k] = p->aDataEnd;
+    b.ixNx[k] = cntOld[i];
+    if( !leafData ){
+      k++;
+      b.apEnd[k] = pParent->aDataEnd;
+      b.ixNx[k] = cntOld[i]+1;
+    }
     szNew[i] = usableSpace - p->nFree;
     for(j=0; j<p->nOverflow; j++){
       szNew[i] += 2 + p->xCellSize(p, p->apOvfl[j]);
     }
     cntNew[i] = cntOld[i];
@@ -7773,21 +7918,22 @@
   ** associated with the right-child of each sibling may also need to be 
   ** updated. This happens below, after the sibling pages have been 
   ** populated, not here.
   */
   if( ISAUTOVACUUM ){
-    MemPage *pNew = apNew[0];
+    MemPage *pOld;
+    MemPage *pNew = pOld = apNew[0];
     u8 *aOld = pNew->aData;
     int cntOldNext = pNew->nCell + pNew->nOverflow;
     int usableSize = pBt->usableSize;
     int iNew = 0;
     int iOld = 0;
 
     for(i=0; i<b.nCell; i++){
       u8 *pCell = b.apCell[i];
       if( i==cntOldNext ){
-        MemPage *pOld = (++iOld)<nNew ? apNew[iOld] : apOld[iOld];
+        pOld = (++iOld)<nNew ? apNew[iOld] : apOld[iOld];
         cntOldNext += pOld->nCell + pOld->nOverflow + !leafData;
         aOld = pOld->aData;
       }
       if( i==cntNew[iNew] ){
         pNew = apNew[++iNew];
@@ -7806,11 +7952,11 @@
       ){
         if( !leafCorrection ){
           ptrmapPut(pBt, get4byte(pCell), PTRMAP_BTREE, pNew->pgno, &rc);
         }
         if( cachedCellSize(&b,i)>pNew->minLocal ){
-          ptrmapPutOvflPtr(pNew, pCell, &rc);
+          ptrmapPutOvflPtr(pNew, pOld, pCell, &rc);
         }
         if( rc ) goto balance_cleanup;
       }
     }
   }
@@ -8230,11 +8376,15 @@
       iAmt = nData;
     }
     if( memcmp(pDest, ((u8*)pX->pData) + iOffset, iAmt)!=0 ){
       int rc = sqlite3PagerWrite(pPage->pDbPage);
       if( rc ) return rc;
-      memcpy(pDest, ((u8*)pX->pData) + iOffset, iAmt);
+      /* In a corrupt database, it is possible for the source and destination
+      ** buffers to overlap.  This is harmless since the database is already
+      ** corrupt but it does cause valgrind and ASAN warnings.  So use
+      ** memmove(). */
+      memmove(pDest, ((u8*)pX->pData) + iOffset, iAmt);
     }
   }
   return SQLITE_OK;
 }
 
@@ -8625,10 +8775,11 @@
   ** will be left in CURSOR_SKIPNEXT state pointing to the entry immediately
   ** before or after the deleted entry. In this case set bSkipnext to true.  */
   if( bPreserve ){
     if( !pPage->leaf 
      || (pPage->nFree+cellSizePtr(pPage,pCell)+2)>(int)(pBt->usableSize*2/3)
+     || pPage->nCell==1  /* See dbfuzz001.test for a test case */
     ){
       /* A b-tree rebalance will be required after deleting this entry.
       ** Save the cursor key.  */
       rc = saveCursorKey(pCur);
       if( rc ) return rc;
@@ -9403,22 +9554,22 @@
       checkAppendMsg(pCheck, "failed to get page %d", iPage);
       break;
     }
     pOvflData = (unsigned char *)sqlite3PagerGetData(pOvflPage);
     if( isFreeList ){
-      int n = get4byte(&pOvflData[4]);
+      u32 n = (u32)get4byte(&pOvflData[4]);
 #ifndef SQLITE_OMIT_AUTOVACUUM
       if( pCheck->pBt->autoVacuum ){
         checkPtrmap(pCheck, iPage, PTRMAP_FREEPAGE, 0);
       }
 #endif
-      if( n>(int)pCheck->pBt->usableSize/4-2 ){
+      if( n>pCheck->pBt->usableSize/4-2 ){
         checkAppendMsg(pCheck,
            "freelist leaf count too big on page %d", iPage);
         N--;
       }else{
-        for(i=0; i<n; i++){
+        for(i=0; i<(int)n; i++){
           Pgno iFreePage = get4byte(&pOvflData[8+i*4]);
 #ifndef SQLITE_OMIT_AUTOVACUUM
           if( pCheck->pBt->autoVacuum ){
             checkPtrmap(pCheck, iFreePage, PTRMAP_FREEPAGE, 0);
           }
@@ -9791,11 +9942,11 @@
   int *pnErr    /* Write number of errors seen to this variable */
 ){
   Pgno i;
   IntegrityCk sCheck;
   BtShared *pBt = p->pBt;
-  int savedDbFlags = pBt->db->flags;
+  u64 savedDbFlags = pBt->db->flags;
   char zErr[100];
   VVA_ONLY( int nRef );
 
   sqlite3BtreeEnter(p);
   assert( p->inTrans>TRANS_NONE && pBt->inTransaction>TRANS_NONE );
@@ -9858,11 +10009,11 @@
       "incremental_vacuum enabled with a max rootpage of zero"
     );
   }
 #endif
   testcase( pBt->db->flags & SQLITE_CellSizeCk );
-  pBt->db->flags &= ~SQLITE_CellSizeCk;
+  pBt->db->flags &= ~(u64)SQLITE_CellSizeCk;
   for(i=0; (int)i<nRoot && sCheck.mxErr; i++){
     i64 notUsed;
     if( aRoot[i]==0 ) continue;
 #ifndef SQLITE_OMIT_AUTOVACUUM
     if( pBt->autoVacuum && aRoot[i]>1 ){

Index: src/btree.h
==================================================================
--- src/btree.h
+++ src/btree.h
@@ -313,10 +313,11 @@
 i64 sqlite3BtreeOffset(BtCursor*);
 #endif
 int sqlite3BtreePayload(BtCursor*, u32 offset, u32 amt, void*);
 const void *sqlite3BtreePayloadFetch(BtCursor*, u32 *pAmt);
 u32 sqlite3BtreePayloadSize(BtCursor*);
+sqlite3_int64 sqlite3BtreeMaxRecordSize(BtCursor*);
 
 char *sqlite3BtreeIntegrityCheck(Btree*, int *aRoot, int nRoot, int, int*);
 struct Pager *sqlite3BtreePager(Btree*);
 i64 sqlite3BtreeRowCountEst(BtCursor*);
 

Index: src/btreeInt.h
==================================================================
--- src/btreeInt.h
+++ src/btreeInt.h
@@ -492,13 +492,20 @@
 **
 ** Fields in this structure are accessed under the BtShared.mutex
 ** found at self->pBt->mutex. 
 **
 ** skipNext meaning:
-**    eState==SKIPNEXT && skipNext>0:  Next sqlite3BtreeNext() is no-op.
-**    eState==SKIPNEXT && skipNext<0:  Next sqlite3BtreePrevious() is no-op.
-**    eState==FAULT:                   Cursor fault with skipNext as error code.
+** The meaning of skipNext depends on the value of eState:
+**
+**   eState            Meaning of skipNext
+**   VALID             skipNext is meaningless and is ignored
+**   INVALID           skipNext is meaningless and is ignored
+**   SKIPNEXT          sqlite3BtreeNext() is a no-op if skipNext>0 and
+**                     sqlite3BtreePrevious() is no-op if skipNext<0.
+**   REQUIRESEEK       restoreCursorPosition() restores the cursor to
+**                     eState=SKIPNEXT if skipNext!=0
+**   FAULT             skipNext holds the cursor fault error code.
 */
 struct BtCursor {
   u8 eState;                /* One of the CURSOR_XXX constants (see below) */
   u8 curFlags;              /* zero or more BTCF_* flags defined below */
   u8 curPagerFlags;         /* Flags to send to sqlite3PagerGet() */

Index: src/build.c
==================================================================
--- src/build.c
+++ src/build.c
@@ -225,11 +225,11 @@
   /* Get the VDBE program ready for execution
   */
   if( v && pParse->nErr==0 && !db->mallocFailed ){
     /* A minimum of one cursor is required if autoincrement is used
     *  See ticket [a696379c1f08866] */
-    if( pParse->pAinc!=0 && pParse->nTab==0 ) pParse->nTab = 1;
+    assert( pParse->pAinc==0 || pParse->nTab>0 );
     sqlite3VdbeMakeReady(v, pParse);
     pParse->rc = SQLITE_DONE;
   }else{
     pParse->rc = SQLITE_ERROR;
   }
@@ -352,30 +352,36 @@
     return 0;
   }
 
   p = sqlite3FindTable(db, zName, zDbase);
   if( p==0 ){
-    const char *zMsg = flags & LOCATE_VIEW ? "no such view" : "no such table";
 #ifndef SQLITE_OMIT_VIRTUALTABLE
     /* If zName is the not the name of a table in the schema created using
     ** CREATE, then check to see if it is the name of an virtual table that
     ** can be an eponymous virtual table. */
-    Module *pMod = (Module*)sqlite3HashFind(&db->aModule, zName);
-    if( pMod==0 && sqlite3_strnicmp(zName, "pragma_", 7)==0 ){
-      pMod = sqlite3PragmaVtabRegister(db, zName);
-    }
-    if( pMod && sqlite3VtabEponymousTableInit(pParse, pMod) ){
-      return pMod->pEpoTab;
+    if( pParse->disableVtab==0 ){
+      Module *pMod = (Module*)sqlite3HashFind(&db->aModule, zName);
+      if( pMod==0 && sqlite3_strnicmp(zName, "pragma_", 7)==0 ){
+        pMod = sqlite3PragmaVtabRegister(db, zName);
+      }
+      if( pMod && sqlite3VtabEponymousTableInit(pParse, pMod) ){
+        return pMod->pEpoTab;
+      }
     }
 #endif
-    if( (flags & LOCATE_NOERR)==0 ){
-      if( zDbase ){
-        sqlite3ErrorMsg(pParse, "%s: %s.%s", zMsg, zDbase, zName);
-      }else{
-        sqlite3ErrorMsg(pParse, "%s: %s", zMsg, zName);
-      }
-      pParse->checkSchema = 1;
+    if( flags & LOCATE_NOERR ) return 0;
+    pParse->checkSchema = 1;
+  }else if( IsVirtual(p) && pParse->disableVtab ){
+    p = 0;
+  }
+
+  if( p==0 ){
+    const char *zMsg = flags & LOCATE_VIEW ? "no such view" : "no such table";
+    if( zDbase ){
+      sqlite3ErrorMsg(pParse, "%s: %s.%s", zMsg, zDbase, zName);
+    }else{
+      sqlite3ErrorMsg(pParse, "%s: %s", zMsg, zName);
     }
   }
 
   return p;
 }
@@ -541,22 +547,27 @@
 ** "main" and "temp") for a single database connection.
 */
 void sqlite3ResetAllSchemasOfConnection(sqlite3 *db){
   int i;
   sqlite3BtreeEnterAll(db);
-  assert( db->nSchemaLock==0 );
   for(i=0; i<db->nDb; i=(i?i+1:2)){
     Db *pDb = &db->aDb[i];
     if( pDb->pSchema ){
-      sqlite3SchemaClear(pDb->pSchema);
+      if( db->nSchemaLock==0 ){
+        sqlite3SchemaClear(pDb->pSchema);
+      }else{
+        DbSetProperty(db, i, DB_ResetWanted);
+      }
     }
   }
   sqlite3SchemaClear(db->aDb[1].pSchema);
   db->mDbFlags &= ~(DBFLAG_SchemaChange|DBFLAG_SchemaKnownOk);
   sqlite3VtabUnlockList(db);
   sqlite3BtreeLeaveAll(db);
-  sqlite3CollapseDatabaseArray(db);
+  if( db->nSchemaLock==0 ){
+    sqlite3CollapseDatabaseArray(db);
+  }
 }
 
 /*
 ** This routine is called when a commit occurs.
 */
@@ -629,16 +640,10 @@
   /* Delete any foreign keys attached to this table. */
   sqlite3FkDelete(db, pTable);
 
   /* Delete the Table structure itself.
   */
-#ifdef SQLITE_ENABLE_NORMALIZE
-  if( pTable->pColHash ){
-    sqlite3HashClear(pTable->pColHash);
-    sqlite3_free(pTable->pColHash);
-  }
-#endif
   sqlite3DeleteColumnNames(db, pTable);
   sqlite3DbFree(db, pTable->zName);
   sqlite3DbFree(db, pTable->zColAff);
   sqlite3SelectDelete(db, pTable->pSelect);
   sqlite3ExprListDelete(db, pTable->pCheck);
@@ -1892,10 +1897,40 @@
     pPk->nColumn = pTab->nCol;
   }
   recomputeColumnsNotIndexed(pPk);
 }
 
+#ifndef SQLITE_OMIT_VIRTUALTABLE
+/*
+** Return true if zName is a shadow table name in the current database
+** connection.
+**
+** zName is temporarily modified while this routine is running, but is
+** restored to its original value prior to this routine returning.
+*/
+static int isShadowTableName(sqlite3 *db, char *zName){
+  char *zTail;                  /* Pointer to the last "_" in zName */
+  Table *pTab;                  /* Table that zName is a shadow of */
+  Module *pMod;                 /* Module for the virtual table */
+
+  zTail = strrchr(zName, '_');
+  if( zTail==0 ) return 0;
+  *zTail = 0;
+  pTab = sqlite3FindTable(db, zName, 0);
+  *zTail = '_';
+  if( pTab==0 ) return 0;
+  if( !IsVirtual(pTab) ) return 0;
+  pMod = (Module*)sqlite3HashFind(&db->aModule, pTab->azModuleArg[0]);
+  if( pMod==0 ) return 0;
+  if( pMod->pModule->iVersion<3 ) return 0;
+  if( pMod->pModule->xShadowName==0 ) return 0;
+  return pMod->pModule->xShadowName(zTail+1);
+}
+#else
+# define isShadowTableName(x,y) 0
+#endif /* ifndef SQLITE_OMIT_VIRTUALTABLE */
+
 /*
 ** This routine is called to report the final ")" that terminates
 ** a CREATE TABLE statement.
 **
 ** The table structure that other action routines have been building
@@ -1930,10 +1965,14 @@
     return;
   }
   assert( !db->mallocFailed );
   p = pParse->pNewTable;
   if( p==0 ) return;
+
+  if( pSelect==0 && isShadowTableName(db, p->zName) ){
+    p->tabFlags |= TF_Shadow;
+  }
 
   /* If the db->init.busy is 1 it means we are reading the SQL off the
   ** "sqlite_master" or "sqlite_temp_master" table on the disk.
   ** So do not write to the disk again.  Extract the root page number
   ** for the table from the db->init.newTnum field.  (The page number
@@ -2597,10 +2636,11 @@
   /* Remove the table entry from SQLite's internal schema and modify
   ** the schema cookie.
   */
   if( IsVirtual(pTab) ){
     sqlite3VdbeAddOp4(v, OP_VDestroy, iDb, 0, 0, pTab->zName, 0);
+    sqlite3MayAbort(pParse);
   }
   sqlite3VdbeAddOp4(v, OP_DropTable, iDb, 0, 0, pTab->zName, 0);
   sqlite3ChangeCookie(pParse, iDb);
   sqliteViewResetAll(db, iDb);
 }
@@ -3426,10 +3466,15 @@
           if( pIdx->onError==OE_Default ){
             pIdx->onError = pIndex->onError;
           }
         }
         if( idxType==SQLITE_IDXTYPE_PRIMARYKEY ) pIdx->idxType = idxType;
+        if( IN_RENAME_OBJECT ){
+          pIndex->pNext = pParse->pNewIndex;
+          pParse->pNewIndex = pIndex;
+          pIndex = 0;
+        }
         goto exit_create_index;
       }
     }
   }
 
@@ -3441,21 +3486,26 @@
     assert( pParse->nErr==0 );
     if( db->init.busy ){
       Index *p;
       assert( !IN_SPECIAL_PARSE );
       assert( sqlite3SchemaMutexHeld(db, 0, pIndex->pSchema) );
+      if( pTblName!=0 ){
+        pIndex->tnum = db->init.newTnum;
+        if( sqlite3IndexHasDuplicateRootPage(pIndex) ){
+          sqlite3ErrorMsg(pParse, "invalid rootpage");
+          pParse->rc = SQLITE_CORRUPT_BKPT;
+          goto exit_create_index;
+        }
+      }
       p = sqlite3HashInsert(&pIndex->pSchema->idxHash, 
           pIndex->zName, pIndex);
       if( p ){
         assert( p==pIndex );  /* Malloc must have failed */
         sqlite3OomFault(db);
         goto exit_create_index;
       }
       db->mDbFlags |= DBFLAG_SchemaChange;
-      if( pTblName!=0 ){
-        pIndex->tnum = db->init.newTnum;
-      }
     }
 
     /* If this is the initial CREATE INDEX statement (or CREATE TABLE if the
     ** index is an implied index for a UNIQUE or PRIMARY KEY constraint) then
     ** emit code to allocate the index rootpage on disk and make an entry for
@@ -3778,10 +3828,22 @@
     if( sqlite3StrICmp(pList->a[i].zName, zName)==0 ) return i;
   }
   return -1;
 }
 
+/*
+** Maximum size of a SrcList object.
+** The SrcList object is used to represent the FROM clause of a
+** SELECT statement, and the query planner cannot deal with more
+** than 64 tables in a join.  So any value larger than 64 here
+** is sufficient for most uses.  Smaller values, like say 10, are
+** appropriate for small and memory-limited applications.
+*/
+#ifndef SQLITE_MAX_SRCLIST
+# define SQLITE_MAX_SRCLIST 200
+#endif
+
 /*
 ** Expand the space allocated for the given SrcList object by
 ** creating nExtra new slots beginning at iStart.  iStart is zero based.
 ** New slots are zeroed.
 **
@@ -3794,15 +3856,16 @@
 ** If the iStart argument had been 1 instead of 2, then the result
 ** would have been:  A, nil, nil, nil, B.  To prepend the new slots,
 ** the iStart value would be 0.  The result then would
 ** be: nil, nil, nil, A, B.
 **
-** If a memory allocation fails the SrcList is unchanged.  The
-** db->mallocFailed flag will be set to true.
+** If a memory allocation fails or the SrcList becomes too large, leave
+** the original SrcList unchanged, return NULL, and leave an error message
+** in pParse.
 */
 SrcList *sqlite3SrcListEnlarge(
-  sqlite3 *db,       /* Database connection to notify of OOM errors */
+  Parse *pParse,     /* Parsing context into which errors are reported */
   SrcList *pSrc,     /* The SrcList to be enlarged */
   int nExtra,        /* Number of new slots to add to pSrc->a[] */
   int iStart         /* Index in pSrc->a[] of first new slot */
 ){
   int i;
@@ -3816,15 +3879,23 @@
   /* Allocate additional space if needed */
   if( (u32)pSrc->nSrc+nExtra>pSrc->nAlloc ){
     SrcList *pNew;
     int nAlloc = pSrc->nSrc*2+nExtra;
     int nGot;
+    sqlite3 *db = pParse->db;
+
+    if( pSrc->nSrc+nExtra>=SQLITE_MAX_SRCLIST ){
+      sqlite3ErrorMsg(pParse, "too many FROM clause terms, max: %d",
+                      SQLITE_MAX_SRCLIST);
+      return 0;
+    }
+    if( nAlloc>SQLITE_MAX_SRCLIST ) nAlloc = SQLITE_MAX_SRCLIST;
     pNew = sqlite3DbRealloc(db, pSrc,
                sizeof(*pSrc) + (nAlloc-1)*sizeof(pSrc->a[0]) );
     if( pNew==0 ){
       assert( db->mallocFailed );
-      return pSrc;
+      return 0;
     }
     pSrc = pNew;
     nGot = (sqlite3DbMallocSize(db, pNew) - sizeof(*pSrc))/sizeof(pSrc->a[0])+1;
     pSrc->nAlloc = nGot;
   }
@@ -3849,11 +3920,12 @@
 
 /*
 ** Append a new table name to the given SrcList.  Create a new SrcList if
 ** need be.  A new entry is created in the SrcList even if pTable is NULL.
 **
-** A SrcList is returned, or NULL if there is an OOM error.  The returned
+** A SrcList is returned, or NULL if there is an OOM error or if the
+** SrcList grows to large.  The returned
 ** SrcList might be the same as the SrcList that was input or it might be
 ** a new one.  If an OOM error does occurs, then the prior value of pList
 ** that is input to this routine is automatically freed.
 **
 ** If pDatabase is not null, it means that the table has an optional
@@ -3880,31 +3952,36 @@
 **
 ** Both pTable and pDatabase are assumed to be quoted.  They are dequoted
 ** before being added to the SrcList.
 */
 SrcList *sqlite3SrcListAppend(
-  sqlite3 *db,        /* Connection to notify of malloc failures */
+  Parse *pParse,      /* Parsing context, in which errors are reported */
   SrcList *pList,     /* Append to this SrcList. NULL creates a new SrcList */
   Token *pTable,      /* Table to append */
   Token *pDatabase    /* Database of the table */
 ){
   struct SrcList_item *pItem;
+  sqlite3 *db;
   assert( pDatabase==0 || pTable!=0 );  /* Cannot have C without B */
-  assert( db!=0 );
+  assert( pParse!=0 );
+  assert( pParse->db!=0 );
+  db = pParse->db;
   if( pList==0 ){
-    pList = sqlite3DbMallocRawNN(db, sizeof(SrcList) );
+    pList = sqlite3DbMallocRawNN(pParse->db, sizeof(SrcList) );
     if( pList==0 ) return 0;
     pList->nAlloc = 1;
     pList->nSrc = 1;
     memset(&pList->a[0], 0, sizeof(pList->a[0]));
     pList->a[0].iCursor = -1;
   }else{
-    pList = sqlite3SrcListEnlarge(db, pList, 1, pList->nSrc);
-  }
-  if( db->mallocFailed ){
-    sqlite3SrcListDelete(db, pList);
-    return 0;
+    SrcList *pNew = sqlite3SrcListEnlarge(pParse, pList, 1, pList->nSrc);
+    if( pNew==0 ){
+      sqlite3SrcListDelete(db, pList);
+      return 0;
+    }else{
+      pList = pNew;
+    }
   }
   pItem = &pList->a[pList->nSrc-1];
   if( pDatabase && pDatabase->z==0 ){
     pDatabase = 0;
   }
@@ -3989,11 +4066,11 @@
     sqlite3ErrorMsg(pParse, "a JOIN clause is required before %s", 
       (pOn ? "ON" : "USING")
     );
     goto append_from_error;
   }
-  p = sqlite3SrcListAppend(db, p, pTable, pDatabase);
+  p = sqlite3SrcListAppend(pParse, p, pTable, pDatabase);
   if( p==0 ){
     goto append_from_error;
   }
   assert( p->nSrc>0 );
   pItem = &p->a[p->nSrc-1];
@@ -4378,17 +4455,19 @@
 ** Recompute all indices of pTab that use the collating sequence pColl.
 ** If pColl==0 then recompute all indices of pTab.
 */
 #ifndef SQLITE_OMIT_REINDEX
 static void reindexTable(Parse *pParse, Table *pTab, char const *zColl){
-  Index *pIndex;              /* An index associated with pTab */
+  if( !IsVirtual(pTab) ){
+    Index *pIndex;              /* An index associated with pTab */
 
-  for(pIndex=pTab->pIndex; pIndex; pIndex=pIndex->pNext){
-    if( zColl==0 || collationMatch(zColl, pIndex) ){
-      int iDb = sqlite3SchemaToIndex(pParse->db, pTab->pSchema);
-      sqlite3BeginWriteOperation(pParse, 0, iDb);
-      sqlite3RefillIndex(pParse, pIndex, -1);
+    for(pIndex=pTab->pIndex; pIndex; pIndex=pIndex->pNext){
+      if( zColl==0 || collationMatch(zColl, pIndex) ){
+        int iDb = sqlite3SchemaToIndex(pParse->db, pTab->pSchema);
+        sqlite3BeginWriteOperation(pParse, 0, iDb);
+        sqlite3RefillIndex(pParse, pIndex, -1);
+      }
     }
   }
 }
 #endif
 

Index: src/callback.c
==================================================================
--- src/callback.c
+++ src/callback.c
@@ -334,11 +334,11 @@
 
 /*
 ** Search a FuncDefHash for a function with the given name.  Return
 ** a pointer to the matching FuncDef if found, or 0 if there is no match.
 */
-static FuncDef *functionSearch(
+FuncDef *sqlite3FunctionSearch(
   int h,               /* Hash of the name */
   const char *zFunc    /* Name of function */
 ){
   FuncDef *p;
   for(p=sqlite3BuiltinFunctions.a[h]; p; p=p->u.pHash){
@@ -346,25 +346,10 @@
       return p;
     }
   }
   return 0;
 }
-#ifdef SQLITE_ENABLE_NORMALIZE
-FuncDef *sqlite3FunctionSearchN(
-  int h,               /* Hash of the name */
-  const char *zFunc,   /* Name of function */
-  int nFunc            /* Length of the name */
-){
-  FuncDef *p;
-  for(p=sqlite3BuiltinFunctions.a[h]; p; p=p->u.pHash){
-    if( sqlite3StrNICmp(p->zName, zFunc, nFunc)==0 ){
-      return p;
-    }
-  }
-  return 0;
-}
-#endif /* SQLITE_ENABLE_NORMALIZE */
 
 /*
 ** Insert a new FuncDef into a FuncDefHash hash table.
 */
 void sqlite3InsertBuiltinFuncs(
@@ -376,11 +361,11 @@
     FuncDef *pOther;
     const char *zName = aDef[i].zName;
     int nName = sqlite3Strlen30(zName);
     int h = SQLITE_FUNC_HASH(zName[0], nName);
     assert( zName[0]>='a' && zName[0]<='z' );
-    pOther = functionSearch(h, zName);
+    pOther = sqlite3FunctionSearch(h, zName);
     if( pOther ){
       assert( pOther!=&aDef[i] && pOther->pNext!=&aDef[i] );
       aDef[i].pNext = pOther->pNext;
       pOther->pNext = &aDef[i];
     }else{
@@ -454,11 +439,11 @@
   ** So we must not search for built-ins when creating a new function.
   */ 
   if( !createFlag && (pBest==0 || (db->mDbFlags & DBFLAG_PreferBuiltin)!=0) ){
     bestScore = 0;
     h = SQLITE_FUNC_HASH(sqlite3UpperToLower[(u8)zName[0]], nName);
-    p = functionSearch(h, zName);
+    p = sqlite3FunctionSearch(h, zName);
     while( p ){
       int score = matchQuality(p, nArg, enc);
       if( score>bestScore ){
         pBest = p;
         bestScore = score;

Index: src/dbpage.c
==================================================================
--- src/dbpage.c
+++ src/dbpage.c
@@ -117,13 +117,12 @@
   for(i=0; i<pIdxInfo->nConstraint; i++){
     struct sqlite3_index_constraint *p = &pIdxInfo->aConstraint[i];
     if( p->iColumn!=DBPAGE_COLUMN_SCHEMA ) continue;
     if( p->op!=SQLITE_INDEX_CONSTRAINT_EQ ) continue;
     if( !p->usable ){
-      /* No solution.  Use the default SQLITE_BIG_DBL cost */
-      pIdxInfo->estimatedRows = 0x7fffffff;
-      return SQLITE_OK;
+      /* No solution. */
+      return SQLITE_CONSTRAINT;
     }
     iPlan = 2;
     pIdxInfo->aConstraintUsage[i].argvIndex = 1;
     pIdxInfo->aConstraintUsage[i].omit = 1;
     break;
@@ -405,11 +404,12 @@
     0,                            /* xFindMethod */
     0,                            /* xRename */
     0,                            /* xSavepoint */
     0,                            /* xRelease */
     0,                            /* xRollbackTo */
+    0                             /* xShadowName */
   };
   return sqlite3_create_module(db, "sqlite_dbpage", &dbpage_module, 0);
 }
 #elif defined(SQLITE_ENABLE_DBPAGE_VTAB)
 int sqlite3DbpageRegister(sqlite3 *db){ return SQLITE_OK; }
 #endif /* SQLITE_ENABLE_DBSTAT_VTAB */

Index: src/dbstat.c
==================================================================
--- src/dbstat.c
+++ src/dbstat.c
@@ -192,21 +192,19 @@
 ** idxNum is normally 0, but will be 1 if a schema=? constraint exists.
 */
 static int statBestIndex(sqlite3_vtab *tab, sqlite3_index_info *pIdxInfo){
   int i;
 
-  pIdxInfo->estimatedCost = 1.0e6;  /* Initial cost estimate */
-
   /* Look for a valid schema=? constraint.  If found, change the idxNum to
   ** 1 and request the value of that constraint be sent to xFilter.  And
   ** lower the cost estimate to encourage the constrained version to be
   ** used.
   */
   for(i=0; i<pIdxInfo->nConstraint; i++){
-    if( pIdxInfo->aConstraint[i].usable==0 ) continue;
-    if( pIdxInfo->aConstraint[i].op!=SQLITE_INDEX_CONSTRAINT_EQ ) continue;
     if( pIdxInfo->aConstraint[i].iColumn!=10 ) continue;
+    if( pIdxInfo->aConstraint[i].usable==0 ) return SQLITE_CONSTRAINT;
+    if( pIdxInfo->aConstraint[i].op!=SQLITE_INDEX_CONSTRAINT_EQ ) continue;
     pIdxInfo->idxNum = 1;
     pIdxInfo->estimatedCost = 1.0;
     pIdxInfo->aConstraintUsage[i].argvIndex = 1;
     pIdxInfo->aConstraintUsage[i].omit = 1;
     break;
@@ -395,10 +393,11 @@
         assert( nPayload>=(u32)nLocal );
         assert( nLocal<=(nUsable-35) );
         if( nPayload>(u32)nLocal ){
           int j;
           int nOvfl = ((nPayload - nLocal) + nUsable-4 - 1) / (nUsable - 4);
+          if( iOff+nLocal>nUsable ) goto statPageIsCorrupt;
           pCell->nLastOvfl = (nPayload-nLocal) - (nOvfl-1) * (nUsable-4);
           pCell->nOvfl = nOvfl;
           pCell->aOvfl = sqlite3_malloc64(sizeof(u32)*nOvfl);
           if( pCell->aOvfl==0 ) return SQLITE_NOMEM_BKPT;
           pCell->aOvfl[0] = sqlite3Get4byte(&aData[iOff+nLocal]);
@@ -530,10 +529,14 @@
       if( pCsr->iPage==0 ) return statNext(pCursor);
       pCsr->iPage--;
       goto statNextRestart; /* Tail recursion */
     }
     pCsr->iPage++;
+    if( pCsr->iPage>=ArraySize(pCsr->aPage) ){
+      statResetCsr(pCsr);
+      return SQLITE_CORRUPT_BKPT;
+    }
     assert( p==&pCsr->aPage[pCsr->iPage-1] );
 
     if( p->iCell==p->nCell ){
       p[1].iPgno = p->iRightChildPg;
     }else{
@@ -601,11 +604,10 @@
 ){
   StatCursor *pCsr = (StatCursor *)pCursor;
   StatTable *pTab = (StatTable*)(pCursor->pVtab);
   char *zSql;
   int rc = SQLITE_OK;
-  char *zMaster;
 
   if( idxNum==1 ){
     const char *zDbase = (const char*)sqlite3_value_text(argv[0]);
     pCsr->iDb = sqlite3FindDbName(pTab->db, zDbase);
     if( pCsr->iDb<0 ){
@@ -617,17 +619,16 @@
     pCsr->iDb = pTab->iDb;
   }
   statResetCsr(pCsr);
   sqlite3_finalize(pCsr->pStmt);
   pCsr->pStmt = 0;
-  zMaster = pCsr->iDb==1 ? "sqlite_temp_master" : "sqlite_master";
   zSql = sqlite3_mprintf(
       "SELECT 'sqlite_master' AS name, 1 AS rootpage, 'table' AS type"
       "  UNION ALL  "
       "SELECT name, rootpage, type"
-      "  FROM \"%w\".%s WHERE rootpage!=0"
-      "  ORDER BY name", pTab->db->aDb[pCsr->iDb].zDbSName, zMaster);
+      "  FROM \"%w\".sqlite_master WHERE rootpage!=0"
+      "  ORDER BY name", pTab->db->aDb[pCsr->iDb].zDbSName);
   if( zSql==0 ){
     return SQLITE_NOMEM_BKPT;
   }else{
     rc = sqlite3_prepare_v2(pTab->db, zSql, -1, &pCsr->pStmt, 0);
     sqlite3_free(zSql);
@@ -718,11 +719,12 @@
     0,                            /* xFindMethod */
     0,                            /* xRename */
     0,                            /* xSavepoint */
     0,                            /* xRelease */
     0,                            /* xRollbackTo */
+    0                             /* xShadowName */
   };
   return sqlite3_create_module(db, "dbstat", &dbstat_module, 0);
 }
 #elif defined(SQLITE_ENABLE_DBSTAT_VTAB)
 int sqlite3DbstatRegister(sqlite3 *db){ return SQLITE_OK; }
 #endif /* SQLITE_ENABLE_DBSTAT_VTAB */

Index: src/delete.c
==================================================================
--- src/delete.c
+++ src/delete.c
@@ -41,37 +41,54 @@
   if( sqlite3IndexedByLookup(pParse, pItem) ){
     pTab = 0;
   }
   return pTab;
 }
+
+/* Return true if table pTab is read-only.
+**
+** A table is read-only if any of the following are true:
+**
+**   1) It is a virtual table and no implementation of the xUpdate method
+**      has been provided
+**
+**   2) It is a system table (i.e. sqlite_master), this call is not
+**      part of a nested parse and writable_schema pragma has not 
+**      been specified
+**
+**   3) The table is a shadow table, the database connection is in
+**      defensive mode, and the current sqlite3_prepare()
+**      is for a top-level SQL statement.
+*/
+static int tabIsReadOnly(Parse *pParse, Table *pTab){
+  sqlite3 *db;
+  if( IsVirtual(pTab) ){
+    return sqlite3GetVTable(pParse->db, pTab)->pMod->pModule->xUpdate==0;
+  }
+  if( (pTab->tabFlags & (TF_Readonly|TF_Shadow))==0 ) return 0;
+  db = pParse->db;
+  if( (pTab->tabFlags & TF_Readonly)!=0 ){
+    return sqlite3WritableSchema(db)==0 && pParse->nested==0;
+  }
+  assert( pTab->tabFlags & TF_Shadow );
+  return (db->flags & SQLITE_Defensive)!=0 
+#ifndef SQLITE_OMIT_VIRTUALTABLE
+          && db->pVtabCtx==0
+#endif
+          && db->nVdbeExec==0;
+}
 
 /*
 ** Check to make sure the given table is writable.  If it is not
 ** writable, generate an error message and return 1.  If it is
 ** writable return 0;
 */
 int sqlite3IsReadOnly(Parse *pParse, Table *pTab, int viewOk){
-  /* A table is not writable under the following circumstances:
-  **
-  **   1) It is a virtual table and no implementation of the xUpdate method
-  **      has been provided, or
-  **   2) It is a system table (i.e. sqlite_master), this call is not
-  **      part of a nested parse and writable_schema pragma has not 
-  **      been specified.
-  **
-  ** In either case leave an error message in pParse and return non-zero.
-  */
-  if( ( IsVirtual(pTab) 
-     && sqlite3GetVTable(pParse->db, pTab)->pMod->pModule->xUpdate==0 )
-   || ( (pTab->tabFlags & TF_Readonly)!=0
-     && sqlite3WritableSchema(pParse->db)==0
-     && pParse->nested==0)
-  ){
+  if( tabIsReadOnly(pParse, pTab) ){
     sqlite3ErrorMsg(pParse, "table %s may not be modified", pTab->zName);
     return 1;
   }
-
 #ifndef SQLITE_OMIT_VIEW
   if( !viewOk && pTab->pSelect ){
     sqlite3ErrorMsg(pParse,"cannot modify %s because it is a view",pTab->zName);
     return 1;
   }
@@ -98,11 +115,11 @@
   Select *pSel;
   SrcList *pFrom;
   sqlite3 *db = pParse->db;
   int iDb = sqlite3SchemaToIndex(db, pView->pSchema);
   pWhere = sqlite3ExprDup(db, pWhere, 0);
-  pFrom = sqlite3SrcListAppend(db, 0, 0, 0);
+  pFrom = sqlite3SrcListAppend(pParse, 0, 0, 0);
   if( pFrom ){
     assert( pFrom->nSrc==1 );
     pFrom->a[0].zName = sqlite3DbStrDup(db, pView->zName);
     pFrom->a[0].zDatabase = sqlite3DbStrDup(db, db->aDb[iDb].zDbSName);
     assert( pFrom->a[0].pOn==0 );
@@ -498,11 +515,11 @@
     }
   
     /* If this DELETE cannot use the ONEPASS strategy, this is the 
     ** end of the WHERE loop */
     if( eOnePass!=ONEPASS_OFF ){
-      addrBypass = sqlite3VdbeMakeLabel(v);
+      addrBypass = sqlite3VdbeMakeLabel(pParse);
     }else{
       sqlite3WhereEnd(pWInfo);
     }
   
     /* Unless this is a view, open cursors for the table we are 
@@ -687,11 +704,11 @@
                          iDataCur, iIdxCur, iPk, (int)nPk));
 
   /* Seek cursor iCur to the row to delete. If this row no longer exists 
   ** (this can happen if a trigger program has already deleted it), do
   ** not attempt to delete it or fire any DELETE triggers.  */
-  iLabel = sqlite3VdbeMakeLabel(v);
+  iLabel = sqlite3VdbeMakeLabel(pParse);
   opSeek = HasRowid(pTab) ? OP_NotExists : OP_NotFound;
   if( eMode==ONEPASS_OFF ){
     sqlite3VdbeAddOp4Int(v, opSeek, iDataCur, iLabel, iPk, nPk);
     VdbeCoverageIf(v, opSeek==OP_NotExists);
     VdbeCoverageIf(v, opSeek==OP_NotFound);
@@ -893,11 +910,11 @@
   int regBase;
   int nCol;
 
   if( piPartIdxLabel ){
     if( pIdx->pPartIdxWhere ){
-      *piPartIdxLabel = sqlite3VdbeMakeLabel(v);
+      *piPartIdxLabel = sqlite3VdbeMakeLabel(pParse);
       pParse->iSelfTab = iDataCur + 1;
       sqlite3ExprIfFalseDup(pParse, pIdx->pPartIdxWhere, *piPartIdxLabel, 
                             SQLITE_JUMPIFNULL);
       pParse->iSelfTab = 0;
     }else{

Index: src/expr.c
==================================================================
--- src/expr.c
+++ src/expr.c
@@ -139,12 +139,12 @@
   CollSeq *pColl = 0;
   Expr *p = pExpr;
   while( p ){
     int op = p->op;
     if( p->flags & EP_Generic ) break;
-    if( (op==TK_AGG_COLUMN || op==TK_COLUMN
-          || op==TK_REGISTER || op==TK_TRIGGER)
+    if( op==TK_REGISTER ) op = p->op2;
+    if( (op==TK_AGG_COLUMN || op==TK_COLUMN || op==TK_TRIGGER)
      && p->y.pTab!=0
     ){
       /* op==TK_REGISTER && p->y.pTab!=0 happens when pExpr was originally
       ** a TK_COLUMN but was previously evaluated and cached in a register */
       int j = p->iColumn;
@@ -156,11 +156,11 @@
     }
     if( op==TK_CAST || op==TK_UPLUS ){
       p = p->pLeft;
       continue;
     }
-    if( op==TK_COLLATE || (op==TK_REGISTER && p->op2==TK_COLLATE) ){
+    if( op==TK_COLLATE ){
       pColl = sqlite3GetCollSeq(pParse, ENC(db), 0, p->u.zToken);
       break;
     }
     if( p->flags & EP_Collate ){
       if( p->pLeft && (p->pLeft->flags & EP_Collate)!=0 ){
@@ -463,10 +463,11 @@
     }
     assert( pRet==0 || pRet->iTable==0 );
   }else{
     if( pVector->op==TK_VECTOR ) pVector = pVector->x.pList->a[iField].pExpr;
     pRet = sqlite3ExprDup(pParse->db, pVector, 0);
+    sqlite3RenameTokenRemap(pParse, pRet, pVector);
   }
   return pRet;
 }
 
 /*
@@ -479,11 +480,11 @@
 */
 static int exprCodeSubselect(Parse *pParse, Expr *pExpr){
   int reg = 0;
 #ifndef SQLITE_OMIT_SUBQUERY
   if( pExpr->op==TK_SELECT ){
-    reg = sqlite3CodeSubselect(pParse, pExpr, 0, 0);
+    reg = sqlite3CodeSubselect(pParse, pExpr);
   }
 #endif
   return reg;
 }
 
@@ -551,11 +552,11 @@
   int nLeft = sqlite3ExprVectorSize(pLeft);
   int i;
   int regLeft = 0;
   int regRight = 0;
   u8 opx = op;
-  int addrDone = sqlite3VdbeMakeLabel(v);
+  int addrDone = sqlite3VdbeMakeLabel(pParse);
 
   if( nLeft!=sqlite3ExprVectorSize(pRight) ){
     sqlite3ErrorMsg(pParse, "row value misused");
     return;
   }
@@ -778,12 +779,11 @@
         pNew->u.zToken = (char*)&pNew[1];
         assert( pToken->z!=0 || pToken->n==0 );
         if( pToken->n ) memcpy(pNew->u.zToken, pToken->z, pToken->n);
         pNew->u.zToken[pToken->n] = 0;
         if( dequote && sqlite3Isquote(pNew->u.zToken[0]) ){
-          if( pNew->u.zToken[0]=='"' ) pNew->flags |= EP_DblQuoted;
-          sqlite3Dequote(pNew->u.zToken);
+          sqlite3DequoteExpr(pNew);
         }
       }
     }
 #if SQLITE_MAX_EXPR_DEPTH>0
     pNew->nHeight = 1;
@@ -848,11 +848,11 @@
   int op,                 /* Expression opcode */
   Expr *pLeft,            /* Left operand */
   Expr *pRight            /* Right operand */
 ){
   Expr *p;
-  if( op==TK_AND && pParse->nErr==0 ){
+  if( op==TK_AND && pParse->nErr==0 && !IN_RENAME_OBJECT ){
     /* Take advantage of short-circuit false optimization for AND */
     p = sqlite3ExprAnd(pParse->db, pLeft, pRight);
   }else{
     p = sqlite3DbMallocRawNN(pParse->db, sizeof(Expr));
     if( p ){
@@ -1096,10 +1096,20 @@
 static int exprStructSize(Expr *p){
   if( ExprHasProperty(p, EP_TokenOnly) ) return EXPR_TOKENONLYSIZE;
   if( ExprHasProperty(p, EP_Reduced) ) return EXPR_REDUCEDSIZE;
   return EXPR_FULLSIZE;
 }
+
+/*
+** Copy the complete content of an Expr node, taking care not to read
+** past the end of the structure for a reduced-size version of the source
+** Expr.
+*/
+static void exprNodeCopy(Expr *pDest, Expr *pSrc){
+  memset(pDest, 0, sizeof(Expr));
+  memcpy(pDest, pSrc, exprStructSize(pSrc));
+}
 
 /*
 ** The dupedExpr*Size() routines each return the number of bytes required
 ** to store a copy of an expression or expression tree.  They differ in
 ** how much of the tree is measured.
@@ -1327,10 +1337,40 @@
   return pRet;
 }
 #else
 # define withDup(x,y) 0
 #endif
+
+#ifndef SQLITE_OMIT_WINDOWFUNC
+/*
+** The gatherSelectWindows() procedure and its helper routine
+** gatherSelectWindowsCallback() are used to scan all the expressions
+** an a newly duplicated SELECT statement and gather all of the Window
+** objects found there, assembling them onto the linked list at Select->pWin.
+*/
+static int gatherSelectWindowsCallback(Walker *pWalker, Expr *pExpr){
+  if( pExpr->op==TK_FUNCTION && pExpr->y.pWin!=0 ){
+    assert( ExprHasProperty(pExpr, EP_WinFunc) );
+    pExpr->y.pWin->pNextWin = pWalker->u.pSelect->pWin;
+    pWalker->u.pSelect->pWin = pExpr->y.pWin;
+  }
+  return WRC_Continue;
+}
+static int gatherSelectWindowsSelectCallback(Walker *pWalker, Select *p){
+  return p==pWalker->u.pSelect ? WRC_Continue : WRC_Prune;
+}
+static void gatherSelectWindows(Select *p){
+  Walker w;
+  w.xExprCallback = gatherSelectWindowsCallback;
+  w.xSelectCallback = gatherSelectWindowsSelectCallback;
+  w.xSelectCallback2 = 0;
+  w.pParse = 0;
+  w.u.pSelect = p;
+  sqlite3WalkSelect(&w, p);
+}
+#endif
+
 
 /*
 ** The following group of routines make deep copies of expressions,
 ** expression lists, ID lists, and select statements.  The copies can
 ** be deleted (by being passed to their respective ...Delete() routines)
@@ -1495,10 +1535,11 @@
     pNew->nSelectRow = p->nSelectRow;
     pNew->pWith = withDup(db, p->pWith);
 #ifndef SQLITE_OMIT_WINDOWFUNC
     pNew->pWin = 0;
     pNew->pWinDefn = sqlite3WindowListDup(db, p->pWinDefn);
+    if( p->pWin ) gatherSelectWindows(pNew);
 #endif
     pNew->selId = p->selId;
     *pp = pNew;
     pp = &pNew->pPrior;
     pNext = pNew;
@@ -1627,10 +1668,13 @@
     ** the RHS and LHS sizes match during code generation. */
     pFirst->iTable = pColumns->nId;
   }
 
 vector_append_error:
+  if( IN_RENAME_OBJECT ){
+    sqlite3RenameExprUnmap(pParse, pExpr);
+  }
   sqlite3ExprDelete(db, pExpr);
   sqlite3IdListDelete(db, pColumns);
   return pList;
 }
 
@@ -1770,12 +1814,13 @@
 ** then convert it into an TK_TRUEFALSE term.  Return non-zero if
 ** the conversion happened, and zero if the expression is unaltered.
 */
 int sqlite3ExprIdToTrueFalse(Expr *pExpr){
   assert( pExpr->op==TK_ID || pExpr->op==TK_STRING );
-  if( sqlite3StrICmp(pExpr->u.zToken, "true")==0
-   || sqlite3StrICmp(pExpr->u.zToken, "false")==0
+  if( !ExprHasProperty(pExpr, EP_Quoted)
+   && (sqlite3StrICmp(pExpr->u.zToken, "true")==0
+       || sqlite3StrICmp(pExpr->u.zToken, "false")==0)
   ){
     pExpr->op = TK_TRUEFALSE;
     return 1;
   }
   return 0;
@@ -2080,11 +2125,13 @@
 ** will likely result in an incorrect answer.  So when in doubt, return
 ** TRUE.
 */
 int sqlite3ExprCanBeNull(const Expr *p){
   u8 op;
-  while( p->op==TK_UPLUS || p->op==TK_UMINUS ){ p = p->pLeft; }
+  while( p->op==TK_UPLUS || p->op==TK_UMINUS ){
+    p = p->pLeft;
+  }
   op = p->op;
   if( op==TK_REGISTER ) op = p->op2;
   switch( op ){
     case TK_INTEGER:
     case TK_STRING:
@@ -2147,18 +2194,10 @@
   if( sqlite3StrICmp(z, "_ROWID_")==0 ) return 1;
   if( sqlite3StrICmp(z, "ROWID")==0 ) return 1;
   if( sqlite3StrICmp(z, "OID")==0 ) return 1;
   return 0;
 }
-#ifdef SQLITE_ENABLE_NORMALIZE
-int sqlite3IsRowidN(const char *z, int n){
-  if( sqlite3StrNICmp(z, "_ROWID_", n)==0 ) return 1;
-  if( sqlite3StrNICmp(z, "ROWID", n)==0 ) return 1;
-  if( sqlite3StrNICmp(z, "OID", n)==0 ) return 1;
-  return 0;
-}
-#endif
 
 /*
 ** pX is the RHS of an IN operator.  If pX is a SELECT statement 
 ** that can be simplified to a direct table access, then return
 ** a pointer to the SELECT statement.  If pX is not a SELECT statement,
@@ -2324,11 +2363,12 @@
 int sqlite3FindInIndex(
   Parse *pParse,             /* Parsing context */
   Expr *pX,                  /* The right-hand side (RHS) of the IN operator */
   u32 inFlags,               /* IN_INDEX_LOOP, _MEMBERSHIP, and/or _NOOP_OK */
   int *prRhsHasNull,         /* Register holding NULL status.  See notes */
-  int *aiMap                 /* Mapping from Index fields to RHS fields */
+  int *aiMap,                /* Mapping from Index fields to RHS fields */
+  int *piTab                 /* OUT: index to use */
 ){
   Select *p;                            /* SELECT to the right of IN operator */
   int eType = 0;                        /* Type of RHS table. IN_INDEX_* */
   int iTab = pParse->nTab++;            /* Cursor of the RHS table */
   int mustBeUnique;                     /* True if RHS must be unique */
@@ -2419,10 +2459,11 @@
         /* Search for an existing index that will work for this IN operator */
         for(pIdx=pTab->pIndex; pIdx && eType==0; pIdx=pIdx->pNext){
           Bitmask colUsed;      /* Columns of the index used */
           Bitmask mCol;         /* Mask for the current column */
           if( pIdx->nColumn<nExpr ) continue;
+          if( pIdx->pPartIdxWhere!=0 ) continue;
           /* Maximum nColumn is BMS-2, not BMS-1, so that we can compute
           ** BITMASK(nExpr) without overflowing */
           testcase( pIdx->nColumn==BMS-2 );
           testcase( pIdx->nColumn==BMS-1 );
           if( pIdx->nColumn>=BMS-1 ) continue;
@@ -2515,21 +2556,24 @@
         eType = IN_INDEX_ROWID;
       }
     }else if( prRhsHasNull ){
       *prRhsHasNull = rMayHaveNull = ++pParse->nMem;
     }
-    sqlite3CodeSubselect(pParse, pX, rMayHaveNull, eType==IN_INDEX_ROWID);
+    assert( pX->op==TK_IN );
+    sqlite3CodeRhsOfIN(pParse, pX, iTab, eType==IN_INDEX_ROWID);
+    if( rMayHaveNull ){
+      sqlite3SetHasNullFlag(v, iTab, rMayHaveNull);
+    }
     pParse->nQueryLoop = savedNQueryLoop;
-  }else{
-    pX->iTable = iTab;
   }
 
   if( aiMap && eType!=IN_INDEX_INDEX_ASC && eType!=IN_INDEX_INDEX_DESC ){
     int i, n;
     n = sqlite3ExprVectorSize(pX->pLeft);
     for(i=0; i<n; i++) aiMap[i] = i;
   }
+  *piTab = iTab;
   return eType;
 }
 #endif
 
 #ifndef SQLITE_OMIT_SUBQUERY
@@ -2599,52 +2643,256 @@
   {
     sqlite3ErrorMsg(pParse, "row value misused");
   }
 }
 
+#ifndef SQLITE_OMIT_SUBQUERY
 /*
-** Generate code for scalar subqueries used as a subquery expression, EXISTS,
-** or IN operators.  Examples:
+** Generate code that will construct an ephemeral table containing all terms
+** in the RHS of an IN operator.  The IN operator can be in either of two
+** forms:
 **
-**     (SELECT a FROM b)          -- subquery
-**     EXISTS (SELECT a FROM b)   -- EXISTS subquery
 **     x IN (4,5,11)              -- IN operator with list on right-hand side
 **     x IN (SELECT a FROM b)     -- IN operator with subquery on the right
 **
-** The pExpr parameter describes the expression that contains the IN
-** operator or subquery.
-**
-** If parameter isRowid is non-zero, then expression pExpr is guaranteed
-** to be of the form "<rowid> IN (?, ?, ?)", where <rowid> is a reference
-** to some integer key column of a table B-Tree. In this case, use an
-** intkey B-Tree to store the set of IN(...) values instead of the usual
-** (slower) variable length keys B-Tree.
-**
-** If rMayHaveNull is non-zero, that means that the operation is an IN
-** (not a SELECT or EXISTS) and that the RHS might contains NULLs.
-** All this routine does is initialize the register given by rMayHaveNull
-** to NULL.  Calling routines will take care of changing this register
-** value to non-NULL if the RHS is NULL-free.
-**
-** For a SELECT or EXISTS operator, return the register that holds the
-** result.  For a multi-column SELECT, the result is stored in a contiguous
-** array of registers and the return value is the register of the left-most
-** result column.  Return 0 for IN operators or if an error occurs.
+** The pExpr parameter is the IN operator.  The cursor number for the
+** constructed ephermeral table is returned.  The first time the ephemeral
+** table is computed, the cursor number is also stored in pExpr->iTable,
+** however the cursor number returned might not be the same, as it might
+** have been duplicated using OP_OpenDup.
+**
+** If parameter isRowid is non-zero, then LHS of the IN operator is guaranteed
+** to be a non-null integer. In this case, the ephemeral table can be an
+** table B-Tree that keyed by only integers.  The more general cases uses
+** an index B-Tree which can have arbitrary keys, but is slower to both
+** read and write.
+**
+** If the LHS expression ("x" in the examples) is a column value, or
+** the SELECT statement returns a column value, then the affinity of that
+** column is used to build the index keys. If both 'x' and the
+** SELECT... statement are columns, then numeric affinity is used
+** if either column has NUMERIC or INTEGER affinity. If neither
+** 'x' nor the SELECT... statement are columns, then numeric affinity
+** is used.
+*/
+void sqlite3CodeRhsOfIN(
+  Parse *pParse,          /* Parsing context */
+  Expr *pExpr,            /* The IN operator */
+  int iTab,               /* Use this cursor number */
+  int isRowid             /* If true, LHS is a rowid */
+){
+  int addrOnce = 0;           /* Address of the OP_Once instruction at top */
+  int addr;                   /* Address of OP_OpenEphemeral instruction */
+  Expr *pLeft;                /* the LHS of the IN operator */
+  KeyInfo *pKeyInfo = 0;      /* Key information */
+  int nVal;                   /* Size of vector pLeft */
+  Vdbe *v;                    /* The prepared statement under construction */
+
+  v = pParse->pVdbe;
+  assert( v!=0 );
+
+  /* The evaluation of the IN must be repeated every time it
+  ** is encountered if any of the following is true:
+  **
+  **    *  The right-hand side is a correlated subquery
+  **    *  The right-hand side is an expression list containing variables
+  **    *  We are inside a trigger
+  **
+  ** If all of the above are false, then we can compute the RHS just once
+  ** and reuse it many names.
+  */
+  if( !ExprHasProperty(pExpr, EP_VarSelect) && pParse->iSelfTab==0 ){
+    /* Reuse of the RHS is allowed */
+    /* If this routine has already been coded, but the previous code
+    ** might not have been invoked yet, so invoke it now as a subroutine. 
+    */
+    if( ExprHasProperty(pExpr, EP_Subrtn) ){
+      addrOnce = sqlite3VdbeAddOp0(v, OP_Once); VdbeCoverage(v);
+      if( ExprHasProperty(pExpr, EP_xIsSelect) ){
+        ExplainQueryPlan((pParse, 0, "REUSE LIST SUBQUERY %d",
+              pExpr->x.pSelect->selId));
+      }
+      sqlite3VdbeAddOp2(v, OP_Gosub, pExpr->y.sub.regReturn,
+                        pExpr->y.sub.iAddr);
+      sqlite3VdbeAddOp2(v, OP_OpenDup, iTab, pExpr->iTable);
+      sqlite3VdbeJumpHere(v, addrOnce);
+      return;
+    }
+
+    /* Begin coding the subroutine */
+    ExprSetProperty(pExpr, EP_Subrtn);
+    pExpr->y.sub.regReturn = ++pParse->nMem;
+    pExpr->y.sub.iAddr =
+      sqlite3VdbeAddOp2(v, OP_Integer, 0, pExpr->y.sub.regReturn) + 1;
+    VdbeComment((v, "return address"));
+
+    addrOnce = sqlite3VdbeAddOp0(v, OP_Once); VdbeCoverage(v);
+  }
+
+  /* Check to see if this is a vector IN operator */
+  pLeft = pExpr->pLeft;
+  nVal = sqlite3ExprVectorSize(pLeft);
+  assert( !isRowid || nVal==1 );
+
+  /* Construct the ephemeral table that will contain the content of
+  ** RHS of the IN operator.
+  */
+  pExpr->iTable = iTab;
+  addr = sqlite3VdbeAddOp2(v, OP_OpenEphemeral, 
+      pExpr->iTable, (isRowid?0:nVal));
+#ifdef SQLITE_ENABLE_EXPLAIN_COMMENTS
+  if( ExprHasProperty(pExpr, EP_xIsSelect) ){
+    VdbeComment((v, "Result of SELECT %u", pExpr->x.pSelect->selId));
+  }else{
+    VdbeComment((v, "RHS of IN operator"));
+  }
+#endif
+  pKeyInfo = isRowid ? 0 : sqlite3KeyInfoAlloc(pParse->db, nVal, 1);
+
+  if( ExprHasProperty(pExpr, EP_xIsSelect) ){
+    /* Case 1:     expr IN (SELECT ...)
+    **
+    ** Generate code to write the results of the select into the temporary
+    ** table allocated and opened above.
+    */
+    Select *pSelect = pExpr->x.pSelect;
+    ExprList *pEList = pSelect->pEList;
+
+    ExplainQueryPlan((pParse, 1, "%sLIST SUBQUERY %d",
+        addrOnce?"":"CORRELATED ", pSelect->selId
+    ));
+    assert( !isRowid );
+    /* If the LHS and RHS of the IN operator do not match, that
+    ** error will have been caught long before we reach this point. */
+    if( ALWAYS(pEList->nExpr==nVal) ){
+      SelectDest dest;
+      int i;
+      sqlite3SelectDestInit(&dest, SRT_Set, iTab);
+      dest.zAffSdst = exprINAffinity(pParse, pExpr);
+      pSelect->iLimit = 0;
+      testcase( pSelect->selFlags & SF_Distinct );
+      testcase( pKeyInfo==0 ); /* Caused by OOM in sqlite3KeyInfoAlloc() */
+      if( sqlite3Select(pParse, pSelect, &dest) ){
+        sqlite3DbFree(pParse->db, dest.zAffSdst);
+        sqlite3KeyInfoUnref(pKeyInfo);
+        return;
+      }
+      sqlite3DbFree(pParse->db, dest.zAffSdst);
+      assert( pKeyInfo!=0 ); /* OOM will cause exit after sqlite3Select() */
+      assert( pEList!=0 );
+      assert( pEList->nExpr>0 );
+      assert( sqlite3KeyInfoIsWriteable(pKeyInfo) );
+      for(i=0; i<nVal; i++){
+        Expr *p = sqlite3VectorFieldSubexpr(pLeft, i);
+        pKeyInfo->aColl[i] = sqlite3BinaryCompareCollSeq(
+            pParse, p, pEList->a[i].pExpr
+        );
+      }
+    }
+  }else if( ALWAYS(pExpr->x.pList!=0) ){
+    /* Case 2:     expr IN (exprlist)
+    **
+    ** For each expression, build an index key from the evaluation and
+    ** store it in the temporary table. If <expr> is a column, then use
+    ** that columns affinity when building index keys. If <expr> is not
+    ** a column, use numeric affinity.
+    */
+    char affinity;            /* Affinity of the LHS of the IN */
+    int i;
+    ExprList *pList = pExpr->x.pList;
+    struct ExprList_item *pItem;
+    int r1, r2, r3;
+    affinity = sqlite3ExprAffinity(pLeft);
+    if( !affinity ){
+      affinity = SQLITE_AFF_BLOB;
+    }
+    if( pKeyInfo ){
+      assert( sqlite3KeyInfoIsWriteable(pKeyInfo) );
+      pKeyInfo->aColl[0] = sqlite3ExprCollSeq(pParse, pExpr->pLeft);
+    }
+
+    /* Loop through each expression in <exprlist>. */
+    r1 = sqlite3GetTempReg(pParse);
+    r2 = sqlite3GetTempReg(pParse);
+    if( isRowid ) sqlite3VdbeAddOp4(v, OP_Blob, 0, r2, 0, "", P4_STATIC);
+    for(i=pList->nExpr, pItem=pList->a; i>0; i--, pItem++){
+      Expr *pE2 = pItem->pExpr;
+      int iValToIns;
+
+      /* If the expression is not constant then we will need to
+      ** disable the test that was generated above that makes sure
+      ** this code only executes once.  Because for a non-constant
+      ** expression we need to rerun this code each time.
+      */
+      if( addrOnce && !sqlite3ExprIsConstant(pE2) ){
+        sqlite3VdbeChangeToNoop(v, addrOnce);
+        addrOnce = 0;
+      }
+
+      /* Evaluate the expression and insert it into the temp table */
+      if( isRowid && sqlite3ExprIsInteger(pE2, &iValToIns) ){
+        sqlite3VdbeAddOp3(v, OP_InsertInt, iTab, r2, iValToIns);
+      }else{
+        r3 = sqlite3ExprCodeTarget(pParse, pE2, r1);
+        if( isRowid ){
+          sqlite3VdbeAddOp2(v, OP_MustBeInt, r3,
+                            sqlite3VdbeCurrentAddr(v)+2);
+          VdbeCoverage(v);
+          sqlite3VdbeAddOp3(v, OP_Insert, iTab, r2, r3);
+        }else{
+          sqlite3VdbeAddOp4(v, OP_MakeRecord, r3, 1, r2, &affinity, 1);
+          sqlite3VdbeAddOp4Int(v, OP_IdxInsert, iTab, r2, r3, 1);
+        }
+      }
+    }
+    sqlite3ReleaseTempReg(pParse, r1);
+    sqlite3ReleaseTempReg(pParse, r2);
+  }
+  if( pKeyInfo ){
+    sqlite3VdbeChangeP4(v, addr, (void *)pKeyInfo, P4_KEYINFO);
+  }
+  if( addrOnce ){
+    sqlite3VdbeJumpHere(v, addrOnce);
+    /* Subroutine return */
+    sqlite3VdbeAddOp1(v, OP_Return, pExpr->y.sub.regReturn);
+    sqlite3VdbeChangeP1(v, pExpr->y.sub.iAddr-1, sqlite3VdbeCurrentAddr(v)-1);
+  }
+}
+#endif /* SQLITE_OMIT_SUBQUERY */
+
+/*
+** Generate code for scalar subqueries used as a subquery expression
+** or EXISTS operator:
+**
+**     (SELECT a FROM b)          -- subquery
+**     EXISTS (SELECT a FROM b)   -- EXISTS subquery
+**
+** The pExpr parameter is the SELECT or EXISTS operator to be coded.
+**
+** The register that holds the result.  For a multi-column SELECT, 
+** the result is stored in a contiguous array of registers and the
+** return value is the register of the left-most result column.
+** Return 0 if an error occurs.
 */
 #ifndef SQLITE_OMIT_SUBQUERY
-int sqlite3CodeSubselect(
-  Parse *pParse,          /* Parsing context */
-  Expr *pExpr,            /* The IN, SELECT, or EXISTS operator */
-  int rHasNullFlag,       /* Register that records whether NULLs exist in RHS */
-  int isRowid             /* If true, LHS of IN operator is a rowid */
-){
-  int jmpIfDynamic = -1;                      /* One-time test address */
-  int rReg = 0;                           /* Register storing resulting */
-  Vdbe *v = sqlite3GetVdbe(pParse);
-  if( NEVER(v==0) ) return 0;
-
-  /* The evaluation of the IN/EXISTS/SELECT must be repeated every time it
+int sqlite3CodeSubselect(Parse *pParse, Expr *pExpr){
+  int addrOnce = 0;           /* Address of OP_Once at top of subroutine */
+  int rReg = 0;               /* Register storing resulting */
+  Select *pSel;               /* SELECT statement to encode */
+  SelectDest dest;            /* How to deal with SELECT result */
+  int nReg;                   /* Registers to allocate */
+  Expr *pLimit;               /* New limit expression */
+
+  Vdbe *v = pParse->pVdbe;
+  assert( v!=0 );
+  testcase( pExpr->op==TK_EXISTS );
+  testcase( pExpr->op==TK_SELECT );
+  assert( pExpr->op==TK_EXISTS || pExpr->op==TK_SELECT );
+  assert( ExprHasProperty(pExpr, EP_xIsSelect) );
+  pSel = pExpr->x.pSelect;
+
+  /* The evaluation of the EXISTS/SELECT must be repeated every time it
   ** is encountered if any of the following is true:
   **
   **    *  The right-hand side is a correlated subquery
   **    *  The right-hand side is an expression list containing variables
   **    *  We are inside a trigger
@@ -2651,212 +2899,74 @@
   **
   ** If all of the above are false, then we can run this code just once
   ** save the results, and reuse the same result on subsequent invocations.
   */
   if( !ExprHasProperty(pExpr, EP_VarSelect) ){
-    jmpIfDynamic = sqlite3VdbeAddOp0(v, OP_Once); VdbeCoverage(v);
-  }
-
-  switch( pExpr->op ){
-    case TK_IN: {
-      int addr;                   /* Address of OP_OpenEphemeral instruction */
-      Expr *pLeft = pExpr->pLeft; /* the LHS of the IN operator */
-      KeyInfo *pKeyInfo = 0;      /* Key information */
-      int nVal;                   /* Size of vector pLeft */
-      
-      nVal = sqlite3ExprVectorSize(pLeft);
-      assert( !isRowid || nVal==1 );
-
-      /* Whether this is an 'x IN(SELECT...)' or an 'x IN(<exprlist>)'
-      ** expression it is handled the same way.  An ephemeral table is 
-      ** filled with index keys representing the results from the 
-      ** SELECT or the <exprlist>.
-      **
-      ** If the 'x' expression is a column value, or the SELECT...
-      ** statement returns a column value, then the affinity of that
-      ** column is used to build the index keys. If both 'x' and the
-      ** SELECT... statement are columns, then numeric affinity is used
-      ** if either column has NUMERIC or INTEGER affinity. If neither
-      ** 'x' nor the SELECT... statement are columns, then numeric affinity
-      ** is used.
-      */
-      pExpr->iTable = pParse->nTab++;
-      addr = sqlite3VdbeAddOp2(v, OP_OpenEphemeral, 
-          pExpr->iTable, (isRowid?0:nVal));
-      pKeyInfo = isRowid ? 0 : sqlite3KeyInfoAlloc(pParse->db, nVal, 1);
-
-      if( ExprHasProperty(pExpr, EP_xIsSelect) ){
-        /* Case 1:     expr IN (SELECT ...)
-        **
-        ** Generate code to write the results of the select into the temporary
-        ** table allocated and opened above.
-        */
-        Select *pSelect = pExpr->x.pSelect;
-        ExprList *pEList = pSelect->pEList;
-
-        ExplainQueryPlan((pParse, 1, "%sLIST SUBQUERY",
-            jmpIfDynamic>=0?"":"CORRELATED "
-        ));
-        assert( !isRowid );
-        /* If the LHS and RHS of the IN operator do not match, that
-        ** error will have been caught long before we reach this point. */
-        if( ALWAYS(pEList->nExpr==nVal) ){
-          SelectDest dest;
-          int i;
-          sqlite3SelectDestInit(&dest, SRT_Set, pExpr->iTable);
-          dest.zAffSdst = exprINAffinity(pParse, pExpr);
-          pSelect->iLimit = 0;
-          testcase( pSelect->selFlags & SF_Distinct );
-          testcase( pKeyInfo==0 ); /* Caused by OOM in sqlite3KeyInfoAlloc() */
-          if( sqlite3Select(pParse, pSelect, &dest) ){
-            sqlite3DbFree(pParse->db, dest.zAffSdst);
-            sqlite3KeyInfoUnref(pKeyInfo);
-            return 0;
-          }
-          sqlite3DbFree(pParse->db, dest.zAffSdst);
-          assert( pKeyInfo!=0 ); /* OOM will cause exit after sqlite3Select() */
-          assert( pEList!=0 );
-          assert( pEList->nExpr>0 );
-          assert( sqlite3KeyInfoIsWriteable(pKeyInfo) );
-          for(i=0; i<nVal; i++){
-            Expr *p = sqlite3VectorFieldSubexpr(pLeft, i);
-            pKeyInfo->aColl[i] = sqlite3BinaryCompareCollSeq(
-                pParse, p, pEList->a[i].pExpr
-            );
-          }
-        }
-      }else if( ALWAYS(pExpr->x.pList!=0) ){
-        /* Case 2:     expr IN (exprlist)
-        **
-        ** For each expression, build an index key from the evaluation and
-        ** store it in the temporary table. If <expr> is a column, then use
-        ** that columns affinity when building index keys. If <expr> is not
-        ** a column, use numeric affinity.
-        */
-        char affinity;            /* Affinity of the LHS of the IN */
-        int i;
-        ExprList *pList = pExpr->x.pList;
-        struct ExprList_item *pItem;
-        int r1, r2, r3;
-        affinity = sqlite3ExprAffinity(pLeft);
-        if( !affinity ){
-          affinity = SQLITE_AFF_BLOB;
-        }
-        if( pKeyInfo ){
-          assert( sqlite3KeyInfoIsWriteable(pKeyInfo) );
-          pKeyInfo->aColl[0] = sqlite3ExprCollSeq(pParse, pExpr->pLeft);
-        }
-
-        /* Loop through each expression in <exprlist>. */
-        r1 = sqlite3GetTempReg(pParse);
-        r2 = sqlite3GetTempReg(pParse);
-        if( isRowid ) sqlite3VdbeAddOp4(v, OP_Blob, 0, r2, 0, "", P4_STATIC);
-        for(i=pList->nExpr, pItem=pList->a; i>0; i--, pItem++){
-          Expr *pE2 = pItem->pExpr;
-          int iValToIns;
-
-          /* If the expression is not constant then we will need to
-          ** disable the test that was generated above that makes sure
-          ** this code only executes once.  Because for a non-constant
-          ** expression we need to rerun this code each time.
-          */
-          if( jmpIfDynamic>=0 && !sqlite3ExprIsConstant(pE2) ){
-            sqlite3VdbeChangeToNoop(v, jmpIfDynamic);
-            jmpIfDynamic = -1;
-          }
-
-          /* Evaluate the expression and insert it into the temp table */
-          if( isRowid && sqlite3ExprIsInteger(pE2, &iValToIns) ){
-            sqlite3VdbeAddOp3(v, OP_InsertInt, pExpr->iTable, r2, iValToIns);
-          }else{
-            r3 = sqlite3ExprCodeTarget(pParse, pE2, r1);
-            if( isRowid ){
-              sqlite3VdbeAddOp2(v, OP_MustBeInt, r3,
-                                sqlite3VdbeCurrentAddr(v)+2);
-              VdbeCoverage(v);
-              sqlite3VdbeAddOp3(v, OP_Insert, pExpr->iTable, r2, r3);
-            }else{
-              sqlite3VdbeAddOp4(v, OP_MakeRecord, r3, 1, r2, &affinity, 1);
-              sqlite3VdbeAddOp4Int(v, OP_IdxInsert, pExpr->iTable, r2, r3, 1);
-            }
-          }
-        }
-        sqlite3ReleaseTempReg(pParse, r1);
-        sqlite3ReleaseTempReg(pParse, r2);
-      }
-      if( pKeyInfo ){
-        sqlite3VdbeChangeP4(v, addr, (void *)pKeyInfo, P4_KEYINFO);
-      }
-      break;
-    }
-
-    case TK_EXISTS:
-    case TK_SELECT:
-    default: {
-      /* Case 3:    (SELECT ... FROM ...)
-      **     or:    EXISTS(SELECT ... FROM ...)
-      **
-      ** For a SELECT, generate code to put the values for all columns of
-      ** the first row into an array of registers and return the index of
-      ** the first register.
-      **
-      ** If this is an EXISTS, write an integer 0 (not exists) or 1 (exists)
-      ** into a register and return that register number.
-      **
-      ** In both cases, the query is augmented with "LIMIT 1".  Any 
-      ** preexisting limit is discarded in place of the new LIMIT 1.
-      */
-      Select *pSel;                         /* SELECT statement to encode */
-      SelectDest dest;                      /* How to deal with SELECT result */
-      int nReg;                             /* Registers to allocate */
-      Expr *pLimit;                         /* New limit expression */
-
-      testcase( pExpr->op==TK_EXISTS );
-      testcase( pExpr->op==TK_SELECT );
-      assert( pExpr->op==TK_EXISTS || pExpr->op==TK_SELECT );
-      assert( ExprHasProperty(pExpr, EP_xIsSelect) );
-
-      pSel = pExpr->x.pSelect;
-      ExplainQueryPlan((pParse, 1, "%sSCALAR SUBQUERY",
-            jmpIfDynamic>=0?"":"CORRELATED "));
-      nReg = pExpr->op==TK_SELECT ? pSel->pEList->nExpr : 1;
-      sqlite3SelectDestInit(&dest, 0, pParse->nMem+1);
-      pParse->nMem += nReg;
-      if( pExpr->op==TK_SELECT ){
-        dest.eDest = SRT_Mem;
-        dest.iSdst = dest.iSDParm;
-        dest.nSdst = nReg;
-        sqlite3VdbeAddOp3(v, OP_Null, 0, dest.iSDParm, dest.iSDParm+nReg-1);
-        VdbeComment((v, "Init subquery result"));
-      }else{
-        dest.eDest = SRT_Exists;
-        sqlite3VdbeAddOp2(v, OP_Integer, 0, dest.iSDParm);
-        VdbeComment((v, "Init EXISTS result"));
-      }
-      pLimit = sqlite3ExprAlloc(pParse->db, TK_INTEGER,&sqlite3IntTokens[1], 0);
-      if( pSel->pLimit ){
-        sqlite3ExprDelete(pParse->db, pSel->pLimit->pLeft);
-        pSel->pLimit->pLeft = pLimit;
-      }else{
-        pSel->pLimit = sqlite3PExpr(pParse, TK_LIMIT, pLimit, 0);
-      }
-      pSel->iLimit = 0;
-      if( sqlite3Select(pParse, pSel, &dest) ){
-        return 0;
-      }
-      rReg = dest.iSDParm;
-      ExprSetVVAProperty(pExpr, EP_NoReduce);
-      break;
-    }
-  }
-
-  if( rHasNullFlag ){
-    sqlite3SetHasNullFlag(v, pExpr->iTable, rHasNullFlag);
-  }
-
-  if( jmpIfDynamic>=0 ){
-    sqlite3VdbeJumpHere(v, jmpIfDynamic);
+    /* If this routine has already been coded, then invoke it as a
+    ** subroutine. */
+    if( ExprHasProperty(pExpr, EP_Subrtn) ){
+      ExplainQueryPlan((pParse, 0, "REUSE SUBQUERY %d", pSel->selId));
+      sqlite3VdbeAddOp2(v, OP_Gosub, pExpr->y.sub.regReturn,
+                        pExpr->y.sub.iAddr);
+      return pExpr->iTable;
+    }
+
+    /* Begin coding the subroutine */
+    ExprSetProperty(pExpr, EP_Subrtn);
+    pExpr->y.sub.regReturn = ++pParse->nMem;
+    pExpr->y.sub.iAddr =
+      sqlite3VdbeAddOp2(v, OP_Integer, 0, pExpr->y.sub.regReturn) + 1;
+    VdbeComment((v, "return address"));
+
+    addrOnce = sqlite3VdbeAddOp0(v, OP_Once); VdbeCoverage(v);
+  }
+  
+  /* For a SELECT, generate code to put the values for all columns of
+  ** the first row into an array of registers and return the index of
+  ** the first register.
+  **
+  ** If this is an EXISTS, write an integer 0 (not exists) or 1 (exists)
+  ** into a register and return that register number.
+  **
+  ** In both cases, the query is augmented with "LIMIT 1".  Any 
+  ** preexisting limit is discarded in place of the new LIMIT 1.
+  */
+  ExplainQueryPlan((pParse, 1, "%sSCALAR SUBQUERY %d",
+        addrOnce?"":"CORRELATED ", pSel->selId));
+  nReg = pExpr->op==TK_SELECT ? pSel->pEList->nExpr : 1;
+  sqlite3SelectDestInit(&dest, 0, pParse->nMem+1);
+  pParse->nMem += nReg;
+  if( pExpr->op==TK_SELECT ){
+    dest.eDest = SRT_Mem;
+    dest.iSdst = dest.iSDParm;
+    dest.nSdst = nReg;
+    sqlite3VdbeAddOp3(v, OP_Null, 0, dest.iSDParm, dest.iSDParm+nReg-1);
+    VdbeComment((v, "Init subquery result"));
+  }else{
+    dest.eDest = SRT_Exists;
+    sqlite3VdbeAddOp2(v, OP_Integer, 0, dest.iSDParm);
+    VdbeComment((v, "Init EXISTS result"));
+  }
+  pLimit = sqlite3ExprAlloc(pParse->db, TK_INTEGER,&sqlite3IntTokens[1], 0);
+  if( pSel->pLimit ){
+    sqlite3ExprDelete(pParse->db, pSel->pLimit->pLeft);
+    pSel->pLimit->pLeft = pLimit;
+  }else{
+    pSel->pLimit = sqlite3PExpr(pParse, TK_LIMIT, pLimit, 0);
+  }
+  pSel->iLimit = 0;
+  if( sqlite3Select(pParse, pSel, &dest) ){
+    return 0;
+  }
+  pExpr->iTable = rReg = dest.iSDParm;
+  ExprSetVVAProperty(pExpr, EP_NoReduce);
+  if( addrOnce ){
+    sqlite3VdbeJumpHere(v, addrOnce);
+
+    /* Subroutine return */
+    sqlite3VdbeAddOp1(v, OP_Return, pExpr->y.sub.regReturn);
+    sqlite3VdbeChangeP1(v, pExpr->y.sub.iAddr-1, sqlite3VdbeCurrentAddr(v)-1);
   }
 
   return rReg;
 }
 #endif /* SQLITE_OMIT_SUBQUERY */
@@ -2929,10 +3039,11 @@
   int destStep2;        /* Where to jump when NULLs seen in step 2 */
   int destStep6 = 0;    /* Start of code for Step 6 */
   int addrTruthOp;      /* Address of opcode that determines the IN is true */
   int destNotNull;      /* Jump here if a comparison is not true in step 6 */
   int addrTop;          /* Top of the step-6 loop */ 
+  int iTab = 0;         /* Index to use */
 
   pLeft = pExpr->pLeft;
   if( sqlite3ExprCheckIN(pParse, pExpr) ) return;
   zAff = exprINAffinity(pParse, pExpr);
   nVector = sqlite3ExprVectorSize(pExpr->pLeft);
@@ -2940,19 +3051,20 @@
       pParse->db, nVector*(sizeof(int) + sizeof(char)) + 1
   );
   if( pParse->db->mallocFailed ) goto sqlite3ExprCodeIN_oom_error;
 
   /* Attempt to compute the RHS. After this step, if anything other than
-  ** IN_INDEX_NOOP is returned, the table opened ith cursor pExpr->iTable 
+  ** IN_INDEX_NOOP is returned, the table opened with cursor iTab
   ** contains the values that make up the RHS. If IN_INDEX_NOOP is returned,
   ** the RHS has not yet been coded.  */
   v = pParse->pVdbe;
   assert( v!=0 );       /* OOM detected prior to this routine */
   VdbeNoopComment((v, "begin IN expr"));
   eType = sqlite3FindInIndex(pParse, pExpr,
                              IN_INDEX_MEMBERSHIP | IN_INDEX_NOOP_OK,
-                             destIfFalse==destIfNull ? 0 : &rRhsHasNull, aiMap);
+                             destIfFalse==destIfNull ? 0 : &rRhsHasNull,
+                             aiMap, &iTab);
 
   assert( pParse->nErr || nVector==1 || eType==IN_INDEX_EPH
        || eType==IN_INDEX_INDEX_ASC || eType==IN_INDEX_INDEX_DESC 
   );
 #ifdef SQLITE_DEBUG
@@ -2994,11 +3106,11 @@
   ** This is step (1) in the in-operator.md optimized algorithm.
   */
   if( eType==IN_INDEX_NOOP ){
     ExprList *pList = pExpr->x.pList;
     CollSeq *pColl = sqlite3ExprCollSeq(pParse, pExpr->pLeft);
-    int labelOk = sqlite3VdbeMakeLabel(v);
+    int labelOk = sqlite3VdbeMakeLabel(pParse);
     int r2, regToFree;
     int regCkNull = 0;
     int ii;
     assert( !ExprHasProperty(pExpr, EP_xIsSelect) );
     if( destIfNull!=destIfFalse ){
@@ -3038,11 +3150,11 @@
   ** We will then skip the binary search of the RHS.
   */
   if( destIfNull==destIfFalse ){
     destStep2 = destIfFalse;
   }else{
-    destStep2 = destStep6 = sqlite3VdbeMakeLabel(v);
+    destStep2 = destStep6 = sqlite3VdbeMakeLabel(pParse);
   }
   for(i=0; i<nVector; i++){
     Expr *p = sqlite3VectorFieldSubexpr(pExpr->pLeft, i);
     if( sqlite3ExprCanBeNull(p) ){
       sqlite3VdbeAddOp2(v, OP_IsNull, rLhs+i, destStep2);
@@ -3056,23 +3168,23 @@
   */
   if( eType==IN_INDEX_ROWID ){
     /* In this case, the RHS is the ROWID of table b-tree and so we also
     ** know that the RHS is non-NULL.  Hence, we combine steps 3 and 4
     ** into a single opcode. */
-    sqlite3VdbeAddOp3(v, OP_SeekRowid, pExpr->iTable, destIfFalse, rLhs);
+    sqlite3VdbeAddOp3(v, OP_SeekRowid, iTab, destIfFalse, rLhs);
     VdbeCoverage(v);
     addrTruthOp = sqlite3VdbeAddOp0(v, OP_Goto);  /* Return True */
   }else{
     sqlite3VdbeAddOp4(v, OP_Affinity, rLhs, nVector, 0, zAff, nVector);
     if( destIfFalse==destIfNull ){
       /* Combine Step 3 and Step 5 into a single opcode */
-      sqlite3VdbeAddOp4Int(v, OP_NotFound, pExpr->iTable, destIfFalse,
+      sqlite3VdbeAddOp4Int(v, OP_NotFound, iTab, destIfFalse,
                            rLhs, nVector); VdbeCoverage(v);
       goto sqlite3ExprCodeIN_finished;
     }
     /* Ordinary Step 3, for the case where FALSE and NULL are distinct */
-    addrTruthOp = sqlite3VdbeAddOp4Int(v, OP_Found, pExpr->iTable, 0,
+    addrTruthOp = sqlite3VdbeAddOp4Int(v, OP_Found, iTab, 0,
                                       rLhs, nVector); VdbeCoverage(v);
   }
 
   /* Step 4.  If the RHS is known to be non-NULL and we did not find
   ** an match on the search above, then the result must be FALSE.
@@ -3093,14 +3205,14 @@
   **
   ** For a scalar LHS, it is sufficient to check just the first row
   ** of the RHS.
   */
   if( destStep6 ) sqlite3VdbeResolveLabel(v, destStep6);
-  addrTop = sqlite3VdbeAddOp2(v, OP_Rewind, pExpr->iTable, destIfFalse);
+  addrTop = sqlite3VdbeAddOp2(v, OP_Rewind, iTab, destIfFalse);
   VdbeCoverage(v);
   if( nVector>1 ){
-    destNotNull = sqlite3VdbeMakeLabel(v);
+    destNotNull = sqlite3VdbeMakeLabel(pParse);
   }else{
     /* For nVector==1, combine steps 6 and 7 by immediately returning
     ** FALSE if the first comparison is not NULL */
     destNotNull = destIfFalse;
   }
@@ -3108,20 +3220,20 @@
     Expr *p;
     CollSeq *pColl;
     int r3 = sqlite3GetTempReg(pParse);
     p = sqlite3VectorFieldSubexpr(pLeft, i);
     pColl = sqlite3ExprCollSeq(pParse, p);
-    sqlite3VdbeAddOp3(v, OP_Column, pExpr->iTable, i, r3);
+    sqlite3VdbeAddOp3(v, OP_Column, iTab, i, r3);
     sqlite3VdbeAddOp4(v, OP_Ne, rLhs+i, destNotNull, r3,
                       (void*)pColl, P4_COLLSEQ);
     VdbeCoverage(v);
     sqlite3ReleaseTempReg(pParse, r3);
   }
   sqlite3VdbeAddOp2(v, OP_Goto, 0, destIfNull);
   if( nVector>1 ){
     sqlite3VdbeResolveLabel(v, destNotNull);
-    sqlite3VdbeAddOp2(v, OP_Next, pExpr->iTable, addrTop+1);
+    sqlite3VdbeAddOp2(v, OP_Next, iTab, addrTop+1);
     VdbeCoverage(v);
 
     /* Step 7:  If we reach this point, we know that the result must
     ** be false. */
     sqlite3VdbeAddOp2(v, OP_Goto, 0, destIfFalse);
@@ -3316,11 +3428,11 @@
     *piFreeable = 0;
     if( p->op==TK_SELECT ){
 #if SQLITE_OMIT_SUBQUERY
       iResult = 0;
 #else
-      iResult = sqlite3CodeSubselect(pParse, p, 0, 0);
+      iResult = sqlite3CodeSubselect(pParse, p);
 #endif
     }else{
       int i;
       iResult = pParse->nMem+1;
       pParse->nMem += nResult;
@@ -3661,11 +3773,11 @@
       /* Attempt a direct implementation of the built-in COALESCE() and
       ** IFNULL() functions.  This avoids unnecessary evaluation of
       ** arguments past the first non-NULL argument.
       */
       if( pDef->funcFlags & SQLITE_FUNC_COALESCE ){
-        int endCoalesce = sqlite3VdbeMakeLabel(v);
+        int endCoalesce = sqlite3VdbeMakeLabel(pParse);
         assert( nFarg>=2 );
         sqlite3ExprCode(pParse, pFarg->a[0].pExpr, target);
         for(i=1; i<nFarg; i++){
           sqlite3VdbeAddOp2(v, OP_NotNull, target, endCoalesce);
           VdbeCoverage(v);
@@ -3790,18 +3902,18 @@
       testcase( op==TK_EXISTS );
       testcase( op==TK_SELECT );
       if( op==TK_SELECT && (nCol = pExpr->x.pSelect->pEList->nExpr)!=1 ){
         sqlite3SubselectError(pParse, nCol, 1);
       }else{
-        return sqlite3CodeSubselect(pParse, pExpr, 0, 0);
+        return sqlite3CodeSubselect(pParse, pExpr);
       }
       break;
     }
     case TK_SELECT_COLUMN: {
       int n;
       if( pExpr->pLeft->iTable==0 ){
-        pExpr->pLeft->iTable = sqlite3CodeSubselect(pParse, pExpr->pLeft, 0, 0);
+        pExpr->pLeft->iTable = sqlite3CodeSubselect(pParse, pExpr->pLeft);
       }
       assert( pExpr->iTable==0 || pExpr->pLeft->op==TK_SELECT );
       if( pExpr->iTable
        && pExpr->iTable!=(n = sqlite3ExprVectorSize(pExpr->pLeft)) 
       ){
@@ -3809,12 +3921,12 @@
                                 pExpr->iTable, n);
       }
       return pExpr->pLeft->iTable + pExpr->iColumn;
     }
     case TK_IN: {
-      int destIfFalse = sqlite3VdbeMakeLabel(v);
-      int destIfNull = sqlite3VdbeMakeLabel(v);
+      int destIfFalse = sqlite3VdbeMakeLabel(pParse);
+      int destIfNull = sqlite3VdbeMakeLabel(pParse);
       sqlite3VdbeAddOp2(v, OP_Null, 0, target);
       sqlite3ExprCodeIN(pParse, pExpr, destIfFalse, destIfNull);
       sqlite3VdbeAddOp2(v, OP_Integer, 1, target);
       sqlite3VdbeResolveLabel(v, destIfFalse);
       sqlite3VdbeAddOp2(v, OP_AddImm, target, 0);
@@ -3950,13 +4062,13 @@
       assert( !ExprHasProperty(pExpr, EP_xIsSelect) && pExpr->x.pList );
       assert(pExpr->x.pList->nExpr > 0);
       pEList = pExpr->x.pList;
       aListelem = pEList->a;
       nExpr = pEList->nExpr;
-      endLabel = sqlite3VdbeMakeLabel(v);
+      endLabel = sqlite3VdbeMakeLabel(pParse);
       if( (pX = pExpr->pLeft)!=0 ){
-        tempX = *pX;
+        exprNodeCopy(&tempX, pX);
         testcase( pX->op==TK_COLUMN );
         exprToRegister(&tempX, exprCodeVector(pParse, &tempX, &regFree1));
         testcase( regFree1==0 );
         memset(&opCompare, 0, sizeof(opCompare));
         opCompare.op = TK_EQ;
@@ -3973,11 +4085,11 @@
           assert( pTest!=0 );
           opCompare.pRight = aListelem[i].pExpr;
         }else{
           pTest = aListelem[i].pExpr;
         }
-        nextCase = sqlite3VdbeMakeLabel(v);
+        nextCase = sqlite3VdbeMakeLabel(pParse);
         testcase( pTest->op==TK_COLUMN );
         sqlite3ExprIfFalse(pParse, pTest, nextCase, SQLITE_JUMPIFNULL);
         testcase( aListelem[i+1].pExpr->op==TK_COLUMN );
         sqlite3ExprCode(pParse, aListelem[i+1].pExpr, target);
         sqlite3VdbeGoto(v, endLabel);
@@ -4273,17 +4385,16 @@
   Expr compLeft;    /* The  x>=y  term */
   Expr compRight;   /* The  x<=z  term */
   Expr exprX;       /* The  x  subexpression */
   int regFree1 = 0; /* Temporary use register */
 
-
   memset(&compLeft, 0, sizeof(Expr));
   memset(&compRight, 0, sizeof(Expr));
   memset(&exprAnd, 0, sizeof(Expr));
 
   assert( !ExprHasProperty(pExpr, EP_xIsSelect) );
-  exprX = *pExpr->pLeft;
+  exprNodeCopy(&exprX, pExpr->pLeft);
   exprAnd.op = TK_AND;
   exprAnd.pLeft = &compLeft;
   exprAnd.pRight = &compRight;
   compLeft.op = TK_GE;
   compLeft.pLeft = &exprX;
@@ -4342,11 +4453,11 @@
   if( NEVER(v==0) )     return;  /* Existence of VDBE checked by caller */
   if( NEVER(pExpr==0) ) return;  /* No way this can happen */
   op = pExpr->op;
   switch( op ){
     case TK_AND: {
-      int d2 = sqlite3VdbeMakeLabel(v);
+      int d2 = sqlite3VdbeMakeLabel(pParse);
       testcase( jumpIfNull==0 );
       sqlite3ExprIfFalse(pParse, pExpr->pLeft, d2,jumpIfNull^SQLITE_JUMPIFNULL);
       sqlite3ExprIfTrue(pParse, pExpr->pRight, dest, jumpIfNull);
       sqlite3VdbeResolveLabel(v, d2);
       break;
@@ -4428,11 +4539,11 @@
       exprCodeBetween(pParse, pExpr, dest, sqlite3ExprIfTrue, jumpIfNull);
       break;
     }
 #ifndef SQLITE_OMIT_SUBQUERY
     case TK_IN: {
-      int destIfFalse = sqlite3VdbeMakeLabel(v);
+      int destIfFalse = sqlite3VdbeMakeLabel(pParse);
       int destIfNull = jumpIfNull ? dest : destIfFalse;
       sqlite3ExprCodeIN(pParse, pExpr, destIfFalse, destIfNull);
       sqlite3VdbeGoto(v, dest);
       sqlite3VdbeResolveLabel(v, destIfFalse);
       break;
@@ -4515,11 +4626,11 @@
       sqlite3ExprIfFalse(pParse, pExpr->pLeft, dest, jumpIfNull);
       sqlite3ExprIfFalse(pParse, pExpr->pRight, dest, jumpIfNull);
       break;
     }
     case TK_OR: {
-      int d2 = sqlite3VdbeMakeLabel(v);
+      int d2 = sqlite3VdbeMakeLabel(pParse);
       testcase( jumpIfNull==0 );
       sqlite3ExprIfTrue(pParse, pExpr->pLeft, d2, jumpIfNull^SQLITE_JUMPIFNULL);
       sqlite3ExprIfFalse(pParse, pExpr->pRight, dest, jumpIfNull);
       sqlite3VdbeResolveLabel(v, d2);
       break;
@@ -4599,11 +4710,11 @@
 #ifndef SQLITE_OMIT_SUBQUERY
     case TK_IN: {
       if( jumpIfNull ){
         sqlite3ExprCodeIN(pParse, pExpr, dest, dest);
       }else{
-        int destIfNull = sqlite3VdbeMakeLabel(v);
+        int destIfNull = sqlite3VdbeMakeLabel(pParse);
         sqlite3ExprCodeIN(pParse, pExpr, dest, destIfNull);
         sqlite3VdbeResolveLabel(v, destIfNull);
       }
       break;
     }
@@ -4720,11 +4831,11 @@
     if( (pA->flags&pB->flags&EP_IntValue)!=0 && pA->u.iValue==pB->u.iValue ){
       return 0;
     }
     return 2;
   }
-  if( pA->op!=pB->op ){
+  if( pA->op!=pB->op || pA->op==TK_RAISE ){
     if( pA->op==TK_COLLATE && sqlite3ExprCompare(pParse, pA->pLeft,pB,iTab)<2 ){
       return 1;
     }
     if( pB->op==TK_COLLATE && sqlite3ExprCompare(pParse, pA,pB->pLeft,iTab)<2 ){
       return 1;
@@ -4746,25 +4857,29 @@
       assert( ExprHasProperty(pA,EP_WinFunc)==ExprHasProperty(pB,EP_WinFunc) );
       if( ExprHasProperty(pA,EP_WinFunc) ){
         if( sqlite3WindowCompare(pParse,pA->y.pWin,pB->y.pWin)!=0 ) return 2;
       }
 #endif
+    }else if( pA->op==TK_NULL ){
+      return 0;
     }else if( pA->op==TK_COLLATE ){
       if( sqlite3_stricmp(pA->u.zToken,pB->u.zToken)!=0 ) return 2;
-    }else if( strcmp(pA->u.zToken,pB->u.zToken)!=0 ){
+    }else if( ALWAYS(pB->u.zToken!=0) && strcmp(pA->u.zToken,pB->u.zToken)!=0 ){
       return 2;
     }
   }
   if( (pA->flags & EP_Distinct)!=(pB->flags & EP_Distinct) ) return 2;
-  if( ALWAYS((combinedFlags & EP_TokenOnly)==0) ){
+  if( (combinedFlags & EP_TokenOnly)==0 ){
     if( combinedFlags & EP_xIsSelect ) return 2;
     if( (combinedFlags & EP_FixedCol)==0
      && sqlite3ExprCompare(pParse, pA->pLeft, pB->pLeft, iTab) ) return 2;
     if( sqlite3ExprCompare(pParse, pA->pRight, pB->pRight, iTab) ) return 2;
     if( sqlite3ExprListCompare(pA->x.pList, pB->x.pList, iTab) ) return 2;
-    assert( (combinedFlags & EP_Reduced)==0 );
-    if( pA->op!=TK_STRING && pA->op!=TK_TRUEFALSE ){
+    if( pA->op!=TK_STRING
+     && pA->op!=TK_TRUEFALSE
+     && (combinedFlags & EP_Reduced)==0
+    ){
       if( pA->iColumn!=pB->iColumn ) return 2;
       if( pA->iTable!=pB->iTable 
        && (pA->iTable!=iTab || NEVER(pB->iTable>=0)) ) return 2;
     }
   }
@@ -4869,18 +4984,20 @@
   if( ExprHasProperty(pExpr, EP_FromJoin) ) return WRC_Prune;
   switch( pExpr->op ){
     case TK_ISNOT:
     case TK_NOT:
     case TK_ISNULL:
+    case TK_NOTNULL:
     case TK_IS:
     case TK_OR:
     case TK_CASE:
     case TK_IN:
     case TK_FUNCTION:
       testcase( pExpr->op==TK_ISNOT );
       testcase( pExpr->op==TK_NOT );
       testcase( pExpr->op==TK_ISNULL );
+      testcase( pExpr->op==TK_NOTNULL );
       testcase( pExpr->op==TK_IS );
       testcase( pExpr->op==TK_OR );
       testcase( pExpr->op==TK_CASE );
       testcase( pExpr->op==TK_IN );
       testcase( pExpr->op==TK_FUNCTION );
@@ -5250,10 +5367,11 @@
   w.xExprCallback = analyzeAggregate;
   w.xSelectCallback = analyzeAggregatesInSelect;
   w.xSelectCallback2 = analyzeAggregatesInSelectEnd;
   w.walkerDepth = 0;
   w.u.pNC = pNC;
+  w.pParse = 0;
   assert( pNC->pSrcList!=0 );
   sqlite3WalkExpr(&w, pExpr);
 }
 
 /*

Index: src/fkey.c
==================================================================
--- src/fkey.c
+++ src/fkey.c
@@ -327,11 +327,11 @@
   int isIgnore          /* If true, pretend pTab contains all NULL values */
 ){
   int i;                                    /* Iterator variable */
   Vdbe *v = sqlite3GetVdbe(pParse);         /* Vdbe to add code to */
   int iCur = pParse->nTab - 1;              /* Cursor number to use */
-  int iOk = sqlite3VdbeMakeLabel(v);        /* jump here if parent key found */
+  int iOk = sqlite3VdbeMakeLabel(pParse);   /* jump here if parent key found */
 
   sqlite3VdbeVerifyAbortable(v,
     (!pFKey->isDeferred
       && !(pParse->db->flags & SQLITE_DeferFKs)
       && !pParse->pToplevel 
@@ -600,12 +600,15 @@
   **
   **     $current_rowid!=rowid
   **     NOT( $current_a==a AND $current_b==b AND ... )
   **
   ** The first form is used for rowid tables.  The second form is used
-  ** for WITHOUT ROWID tables.  In the second form, the primary key is
-  ** (a,b,...)
+  ** for WITHOUT ROWID tables. In the second form, the *parent* key is
+  ** (a,b,...). Either the parent or primary key could be used to 
+  ** uniquely identify the current row, but the parent key is more convenient
+  ** as the required values have already been loaded into registers
+  ** by the caller.
   */
   if( pTab==pFKey->pFrom && nIncr>0 ){
     Expr *pNe;                    /* Expression (pLeft != pRight) */
     Expr *pLeft;                  /* Value from parent table row */
     Expr *pRight;                 /* Column ref to child table */
@@ -613,18 +616,17 @@
       pLeft = exprTableRegister(pParse, pTab, regData, -1);
       pRight = exprTableColumn(db, pTab, pSrc->a[0].iCursor, -1);
       pNe = sqlite3PExpr(pParse, TK_NE, pLeft, pRight);
     }else{
       Expr *pEq, *pAll = 0;
-      Index *pPk = sqlite3PrimaryKeyIndex(pTab);
       assert( pIdx!=0 );
-      for(i=0; i<pPk->nKeyCol; i++){
+      for(i=0; i<pIdx->nKeyCol; i++){
         i16 iCol = pIdx->aiColumn[i];
         assert( iCol>=0 );
         pLeft = exprTableRegister(pParse, pTab, regData, iCol);
-        pRight = exprTableColumn(db, pTab, pSrc->a[0].iCursor, iCol);
-        pEq = sqlite3PExpr(pParse, TK_EQ, pLeft, pRight);
+        pRight = sqlite3Expr(db, TK_ID, pTab->aCol[iCol].zName);
+        pEq = sqlite3PExpr(pParse, TK_IS, pLeft, pRight);
         pAll = sqlite3ExprAnd(db, pAll, pEq);
       }
       pNe = sqlite3PExpr(pParse, TK_NOT, pAll, 0);
     }
     pWhere = sqlite3ExprAnd(db, pWhere, pNe);
@@ -725,11 +727,11 @@
       FKey *p;
       for(p=pTab->pFKey; p; p=p->pNextFrom){
         if( p->isDeferred || (db->flags & SQLITE_DeferFKs) ) break;
       }
       if( !p ) return;
-      iSkip = sqlite3VdbeMakeLabel(v);
+      iSkip = sqlite3VdbeMakeLabel(pParse);
       sqlite3VdbeAddOp2(v, OP_FkIfZero, 1, iSkip); VdbeCoverage(v);
     }
 
     pParse->disableTriggers = 1;
     sqlite3DeleteFrom(pParse, sqlite3SrcListDup(db, pName, 0), 0, 0, 0);
@@ -1010,11 +1012,11 @@
     }
     assert( aiCol || pFKey->nCol==1 );
 
     /* Create a SrcList structure containing the child table.  We need the
     ** child table as a SrcList for sqlite3WhereBegin() */
-    pSrc = sqlite3SrcListAppend(db, 0, 0, 0);
+    pSrc = sqlite3SrcListAppend(pParse, 0, 0, 0);
     if( pSrc ){
       struct SrcList_item *pItem = pSrc->a;
       pItem->pTab = pFKey->pFrom;
       pItem->zName = pFKey->pFrom->zName;
       pItem->pTab->nTabRef++;
@@ -1287,11 +1289,11 @@
       if( pRaise ){
         pRaise->affinity = OE_Abort;
       }
       pSelect = sqlite3SelectNew(pParse, 
           sqlite3ExprListAppend(pParse, 0, pRaise),
-          sqlite3SrcListAppend(db, 0, &tFrom, 0),
+          sqlite3SrcListAppend(pParse, 0, &tFrom, 0),
           pWhere,
           0, 0, 0, 0, 0
       );
       pWhere = 0;
     }

Index: src/func.c
==================================================================
--- src/func.c
+++ src/func.c
@@ -199,10 +199,11 @@
   int nHaystack;
   int nNeedle;
   int typeHaystack, typeNeedle;
   int N = 1;
   int isText;
+  unsigned char firstChar;
 
   UNUSED_PARAMETER(argc);
   typeHaystack = sqlite3_value_type(argv[0]);
   typeNeedle = sqlite3_value_type(argv[1]);
   if( typeHaystack==SQLITE_NULL || typeNeedle==SQLITE_NULL ) return;
@@ -217,11 +218,14 @@
       zHaystack = sqlite3_value_text(argv[0]);
       zNeedle = sqlite3_value_text(argv[1]);
       isText = 1;
     }
     if( zNeedle==0 || (nHaystack && zHaystack==0) ) return;
-    while( nNeedle<=nHaystack && memcmp(zHaystack, zNeedle, nNeedle)!=0 ){
+    firstChar = zNeedle[0];
+    while( nNeedle<=nHaystack
+       && (zHaystack[0]!=firstChar || memcmp(zHaystack, zNeedle, nNeedle)!=0)
+    ){
       N++;
       do{
         nHaystack--;
         zHaystack++;
       }while( isText && (zHaystack[0]&0xc0)==0x80 );
@@ -508,15 +512,15 @@
 static void randomBlob(
   sqlite3_context *context,
   int argc,
   sqlite3_value **argv
 ){
-  int n;
+  sqlite3_int64 n;
   unsigned char *p;
   assert( argc==1 );
   UNUSED_PARAMETER(argc);
-  n = sqlite3_value_int(argv[0]);
+  n = sqlite3_value_int64(argv[0]);
   if( n<1 ){
     n = 1;
   }
   p = contextMalloc(context, n);
   if( p ){

Index: src/global.c
==================================================================
--- src/global.c
+++ src/global.c
@@ -187,10 +187,17 @@
 #ifndef SQLITE_DEFAULT_LOOKASIDE
 # define SQLITE_DEFAULT_LOOKASIDE 1200,100
 #endif
 
 
+/* The default maximum size of an in-memory database created using
+** sqlite3_deserialize()
+*/
+#ifndef SQLITE_MEMDB_DEFAULT_MAXSIZE
+# define SQLITE_MEMDB_DEFAULT_MAXSIZE 1073741824
+#endif
+
 /*
 ** The following singleton contains the global configuration for
 ** the SQLite library.
 */
 SQLITE_WSD struct Sqlite3Config sqlite3Config = {
@@ -234,16 +241,20 @@
 #endif
 #ifdef SQLITE_VDBE_COVERAGE
    0,                         /* xVdbeBranch */
    0,                         /* pVbeBranchArg */
 #endif
+#ifdef SQLITE_ENABLE_DESERIALIZE
+   SQLITE_MEMDB_DEFAULT_MAXSIZE,   /* mxMemdbSize */
+#endif
 #ifndef SQLITE_UNTESTABLE
    0,                         /* xTestCallback */
 #endif
    0,                         /* bLocaltimeFault */
+   0,                         /* bInternalFunctions */
    0x7ffffffe,                /* iOnceResetThreshold */
-   SQLITE_DEFAULT_SORTERREF_SIZE   /* szSorterRef */
+   SQLITE_DEFAULT_SORTERREF_SIZE,   /* szSorterRef */
 };
 
 /*
 ** Hash table for global functions - functions common to all
 ** database connections.  After initialization, this table is

Index: src/hash.c
==================================================================
--- src/hash.c
+++ src/hash.c
@@ -62,24 +62,10 @@
     h += sqlite3UpperToLower[c];
     h *= 0x9e3779b1;
   }
   return h;
 }
-#ifdef SQLITE_ENABLE_NORMALIZE
-static unsigned int strHashN(const char *z, int n){
-  unsigned int h = 0;
-  int i;
-  for(i=0; i<n; i++){
-    /* Knuth multiplicative hashing.  (Sorting & Searching, p. 510).
-    ** 0x9e3779b1 is 2654435761 which is the closest prime number to
-    ** (2**32)*golden_ratio, where golden_ratio = (sqrt(5) - 1)/2. */
-    h += sqlite3UpperToLower[z[i]];
-    h *= 0x9e3779b1;
-  }
-  return h;
-}
-#endif /* SQLITE_ENABLE_NORMALIZE */
 
 
 /* Link pNew element into the hash table pH.  If pEntry!=0 then also
 ** insert pNew into the pEntry hash bucket.
 */
@@ -187,44 +173,10 @@
     }
     elem = elem->next;
   }
   return &nullElement;
 }
-#ifdef SQLITE_ENABLE_NORMALIZE
-static HashElem *findElementWithHashN(
-  const Hash *pH,     /* The pH to be searched */
-  const char *pKey,   /* The key we are searching for */
-  int nKey,           /* Number of key bytes to use */
-  unsigned int *pHash /* Write the hash value here */
-){
-  HashElem *elem;                /* Used to loop thru the element list */
-  int count;                     /* Number of elements left to test */
-  unsigned int h;                /* The computed hash */
-  static HashElem nullElement = { 0, 0, 0, 0 };
-
-  if( pH->ht ){   /*OPTIMIZATION-IF-TRUE*/
-    struct _ht *pEntry;
-    h = strHashN(pKey, nKey) % pH->htsize;
-    pEntry = &pH->ht[h];
-    elem = pEntry->chain;
-    count = pEntry->count;
-  }else{
-    h = 0;
-    elem = pH->first;
-    count = pH->count;
-  }
-  if( pHash ) *pHash = h;
-  while( count-- ){
-    assert( elem!=0 );
-    if( sqlite3StrNICmp(elem->pKey,pKey,nKey)==0 ){ 
-      return elem;
-    }
-    elem = elem->next;
-  }
-  return &nullElement;
-}
-#endif /* SQLITE_ENABLE_NORMALIZE */
 
 /* Remove a single entry from the hash table given a pointer to that
 ** element and a hash on the element's key.
 */
 static void removeElementGivenHash(
@@ -265,18 +217,10 @@
 void *sqlite3HashFind(const Hash *pH, const char *pKey){
   assert( pH!=0 );
   assert( pKey!=0 );
   return findElementWithHash(pH, pKey, 0)->data;
 }
-#ifdef SQLITE_ENABLE_NORMALIZE
-void *sqlite3HashFindN(const Hash *pH, const char *pKey, int nKey){
-  assert( pH!=0 );
-  assert( pKey!=0 );
-  assert( nKey>=0 );
-  return findElementWithHashN(pH, pKey, nKey, 0)->data;
-}
-#endif /* SQLITE_ENABLE_NORMALIZE */
 
 /* Insert an element into the hash table pH.  The key is pKey
 ** and the data is "data".
 **
 ** If no element exists with a matching key, then a new

Index: src/insert.c
==================================================================
--- src/insert.c
+++ src/insert.c
@@ -317,10 +317,11 @@
     aOp[5].p3 = memId;
     aOp[6].p1 = memId;
     aOp[7].p2 = memId+2;
     aOp[7].p1 = memId;
     aOp[10].p2 = memId;
+    if( pParse->nTab==0 ) pParse->nTab = 1;
   }
 }
 
 /*
 ** Update the maximum rowid for an autoincrement calculation.
@@ -823,10 +824,15 @@
       pParse->nMem += pIdx->nColumn;
     }
   }
 #ifndef SQLITE_OMIT_UPSERT
   if( pUpsert ){
+    if( IsVirtual(pTab) ){
+      sqlite3ErrorMsg(pParse, "UPSERT not implemented for virtual table \"%s\"",
+              pTab->zName);
+      goto insert_cleanup;
+    }
     pTabList->a[0].iCursor = iDataCur;
     pUpsert->pUpsertSrc = pTabList;
     pUpsert->regData = regData;
     pUpsert->iDataCur = iDataCur;
     pUpsert->iIdxCur = iIdxCur;
@@ -863,11 +869,11 @@
     VdbeCoverage(v);
   }
 
   /* Run the BEFORE and INSTEAD OF triggers, if there are any
   */
-  endOfLoop = sqlite3VdbeMakeLabel(v);
+  endOfLoop = sqlite3VdbeMakeLabel(pParse);
   if( tmask & TRIGGER_BEFORE ){
     int regCols = sqlite3GetTempRange(pParse, pTab->nCol+1);
 
     /* build the NEW.* reference row.  Note that if there is an INTEGER
     ** PRIMARY KEY into which a NULL is being inserted, that NULL will be
@@ -945,20 +951,16 @@
       if( useTempTable ){
         sqlite3VdbeAddOp3(v, OP_Column, srcTab, ipkColumn, regRowid);
       }else if( pSelect ){
         sqlite3VdbeAddOp2(v, OP_Copy, regFromSelect+ipkColumn, regRowid);
       }else{
-        VdbeOp *pOp;
-        sqlite3ExprCode(pParse, pList->a[ipkColumn].pExpr, regRowid);
-        pOp = sqlite3VdbeGetOp(v, -1);
-        assert( pOp!=0 );
-        if( pOp->opcode==OP_Null && !IsVirtual(pTab) ){
+        Expr *pIpk = pList->a[ipkColumn].pExpr;
+        if( pIpk->op==TK_NULL && !IsVirtual(pTab) ){
+          sqlite3VdbeAddOp3(v, OP_NewRowid, iDataCur, regRowid, regAutoinc);
           appendFlag = 1;
-          pOp->opcode = OP_NewRowid;
-          pOp->p1 = iDataCur;
-          pOp->p2 = regRowid;
-          pOp->p3 = regAutoinc;
+        }else{
+          sqlite3ExprCode(pParse, pList->a[ipkColumn].pExpr, regRowid);
         }
       }
       /* If the PRIMARY KEY expression is NULL, then use OP_NewRowid
       ** to generate a unique primary key value.
       */
@@ -1349,11 +1351,24 @@
     if( onError==OE_Replace && pTab->aCol[i].pDflt==0 ){
       onError = OE_Abort;
     }
     assert( onError==OE_Rollback || onError==OE_Abort || onError==OE_Fail
         || onError==OE_Ignore || onError==OE_Replace );
+    addr1 = 0;
     switch( onError ){
+      case OE_Replace: {
+        assert( onError==OE_Replace );
+        addr1 = sqlite3VdbeMakeLabel(pParse);
+        sqlite3VdbeAddOp2(v, OP_NotNull, regNewData+1+i, addr1);
+          VdbeCoverage(v);
+        sqlite3ExprCode(pParse, pTab->aCol[i].pDflt, regNewData+1+i);
+        sqlite3VdbeAddOp2(v, OP_NotNull, regNewData+1+i, addr1);
+          VdbeCoverage(v);
+        onError = OE_Abort;
+        /* Fall through into the OE_Abort case to generate code that runs
+        ** if both the input and the default value are NULL */
+      }
       case OE_Abort:
         sqlite3MayAbort(pParse);
         /* Fall through */
       case OE_Rollback:
       case OE_Fail: {
@@ -1362,23 +1377,17 @@
         sqlite3VdbeAddOp3(v, OP_HaltIfNull, SQLITE_CONSTRAINT_NOTNULL, onError,
                           regNewData+1+i);
         sqlite3VdbeAppendP4(v, zMsg, P4_DYNAMIC);
         sqlite3VdbeChangeP5(v, P5_ConstraintNotNull);
         VdbeCoverage(v);
-        break;
-      }
-      case OE_Ignore: {
-        sqlite3VdbeAddOp2(v, OP_IsNull, regNewData+1+i, ignoreDest);
-        VdbeCoverage(v);
+        if( addr1 ) sqlite3VdbeResolveLabel(v, addr1);
         break;
       }
       default: {
-        assert( onError==OE_Replace );
-        addr1 = sqlite3VdbeAddOp1(v, OP_NotNull, regNewData+1+i);
-           VdbeCoverage(v);
-        sqlite3ExprCode(pParse, pTab->aCol[i].pDflt, regNewData+1+i);
-        sqlite3VdbeJumpHere(v, addr1);
+        assert( onError==OE_Ignore );
+        sqlite3VdbeAddOp2(v, OP_IsNull, regNewData+1+i, ignoreDest);
+        VdbeCoverage(v);
         break;
       }
     }
   }
 
@@ -1397,11 +1406,11 @@
       ){
         /* The check constraints do not reference any of the columns being
         ** updated so there is no point it verifying the check constraint */
         continue;
       }
-      allOk = sqlite3VdbeMakeLabel(v);
+      allOk = sqlite3VdbeMakeLabel(pParse);
       sqlite3VdbeVerifyAbortable(v, onError);
       sqlite3ExprIfTrue(pParse, pExpr, allOk, SQLITE_JUMPIFNULL);
       if( onError==OE_Ignore ){
         sqlite3VdbeGoto(v, ignoreDest);
       }else{
@@ -1464,11 +1473,11 @@
 
   /* If rowid is changing, make sure the new rowid does not previously
   ** exist in the table.
   */
   if( pkChng && pPk==0 ){
-    int addrRowidOk = sqlite3VdbeMakeLabel(v);
+    int addrRowidOk = sqlite3VdbeMakeLabel(pParse);
 
     /* Figure out what action to take in case of a rowid collision */
     onError = pTab->keyConf;
     if( overrideError!=OE_Default ){
       onError = overrideError;
@@ -1614,11 +1623,11 @@
       addrUniqueOk = upsertJump+1;
       upsertBypass = sqlite3VdbeGoto(v, 0);
       VdbeComment((v, "Skip upsert subroutine"));
       sqlite3VdbeJumpHere(v, upsertJump);
     }else{
-      addrUniqueOk = sqlite3VdbeMakeLabel(v);
+      addrUniqueOk = sqlite3VdbeMakeLabel(pParse);
     }
     if( bAffinityDone==0 && (pUpIdx==0 || pUpIdx==pIdx) ){
       sqlite3TableAffinity(v, pTab, regNewData+1);
       bAffinityDone = 1;
     }
@@ -1697,11 +1706,15 @@
     **   (1) The conflict resolution algorithm is REPLACE
     **   (2) The table is a WITHOUT ROWID table
     **   (3) There are no secondary indexes on the table
     **   (4) No delete triggers need to be fired if there is a conflict
     **   (5) No FK constraint counters need to be updated if a conflict occurs.
-    */ 
+    **
+    ** This is not possible for ENABLE_PREUPDATE_HOOK builds, as the row
+    ** must be explicitly deleted in order to ensure any pre-update hook
+    ** is invoked.  */ 
+#ifndef SQLITE_ENABLE_PREUPDATE_HOOK
     if( (ix==0 && pIdx->pNext==0)                   /* Condition 3 */
      && pPk==pIdx                                   /* Condition 2 */
      && onError==OE_Replace                         /* Condition 1 */
      && ( 0==(db->flags&SQLITE_RecTriggers) ||      /* Condition 4 */
           0==sqlite3TriggersExist(pParse, pTab, TK_DELETE, 0, 0))
@@ -1709,10 +1722,11 @@
          (0==pTab->pFKey && 0==sqlite3FkReferences(pTab)))
     ){
       sqlite3VdbeResolveLabel(v, addrUniqueOk);
       continue;
     }
+#endif /* ifndef SQLITE_ENABLE_PREUPDATE_HOOK */
 
     /* Check to see if the new index entry will be unique */
     sqlite3VdbeVerifyAbortable(v, onError);
     sqlite3VdbeAddOp4Int(v, OP_NoConflict, iThisCur, addrUniqueOk,
                          regIdx, pIdx->nKeyCol); VdbeCoverage(v);
@@ -1822,11 +1836,11 @@
     if( regR!=regIdx ) sqlite3ReleaseTempRange(pParse, regR, nPkField);
   }
 
   /* If the IPK constraint is a REPLACE, run it last */
   if( ipkTop ){
-    sqlite3VdbeGoto(v, ipkTop+1);
+    sqlite3VdbeGoto(v, ipkTop);
     VdbeComment((v, "Do IPK REPLACE"));
     sqlite3VdbeJumpHere(v, ipkBottom);
   }
 
   *pbMayReplace = seenReplace;
@@ -2192,11 +2206,12 @@
   pItem = pSelect->pSrc->a;
   pSrc = sqlite3LocateTableItem(pParse, 0, pItem);
   if( pSrc==0 ){
     return 0;   /* FROM clause does not contain a real table */
   }
-  if( pSrc==pDest ){
+  if( pSrc->tnum==pDest->tnum && pSrc->pSchema==pDest->pSchema ){
+    testcase( pSrc!=pDest ); /* Possible due to bad sqlite_master.rootpage */
     return 0;   /* tab1 and tab2 may not be the same table */
   }
   if( HasRowid(pDest)!=HasRowid(pSrc) ){
     return 0;   /* source and destination must both be WITHOUT ROWID or not */
   }

Index: src/legacy.c
==================================================================
--- src/legacy.c
+++ src/legacy.c
@@ -44,11 +44,11 @@
   if( zSql==0 ) zSql = "";
 
   sqlite3_mutex_enter(db->mutex);
   sqlite3Error(db, SQLITE_OK);
   while( rc==SQLITE_OK && zSql[0] ){
-    int nCol;
+    int nCol = 0;
     char **azVals = 0;
 
     pStmt = 0;
     rc = sqlite3_prepare_v2(db, zSql, -1, &pStmt, &zLeftover);
     assert( rc==SQLITE_OK || pStmt==0 );
@@ -58,13 +58,11 @@
     if( !pStmt ){
       /* this happens for a comment or white-space */
       zSql = zLeftover;
       continue;
     }
-
     callbackIsInit = 0;
-    nCol = sqlite3_column_count(pStmt);
 
     while( 1 ){
       int i;
       rc = sqlite3_step(pStmt);
 
@@ -71,10 +69,11 @@
       /* Invoke the callback function if required */
       if( xCallback && (SQLITE_ROW==rc || 
           (SQLITE_DONE==rc && !callbackIsInit
                            && db->flags&SQLITE_NullCallback)) ){
         if( !callbackIsInit ){
+          nCol = sqlite3_column_count(pStmt);
           azCols = sqlite3DbMallocRaw(db, (2*nCol+1)*sizeof(const char*));
           if( azCols==0 ){
             goto exec_out;
           }
           for(i=0; i<nCol; i++){

Index: src/loadext.c
==================================================================
--- src/loadext.c
+++ src/loadext.c
@@ -82,10 +82,11 @@
 # define sqlite3_create_module 0
 # define sqlite3_create_module_v2 0
 # define sqlite3_declare_vtab 0
 # define sqlite3_vtab_config 0
 # define sqlite3_vtab_on_conflict 0
+# define sqlite3_vtab_collation 0
 #endif
 
 #ifdef SQLITE_OMIT_SHARED_CACHE
 # define sqlite3_enable_shared_cache 0
 #endif
@@ -647,11 +648,11 @@
 int sqlite3_enable_load_extension(sqlite3 *db, int onoff){
   sqlite3_mutex_enter(db->mutex);
   if( onoff ){
     db->flags |= SQLITE_LoadExtension|SQLITE_LoadExtFunc;
   }else{
-    db->flags &= ~(SQLITE_LoadExtension|SQLITE_LoadExtFunc);
+    db->flags &= ~(u64)(SQLITE_LoadExtension|SQLITE_LoadExtFunc);
   }
   sqlite3_mutex_leave(db->mutex);
   return SQLITE_OK;
 }
 

Index: src/main.c
==================================================================
--- src/main.c
+++ src/main.c
@@ -651,10 +651,17 @@
       sqlite3GlobalConfig.szSorterRef = (u32)iVal;
       break;
     }
 #endif /* SQLITE_ENABLE_SORTER_REFERENCES */
 
+#ifdef SQLITE_ENABLE_DESERIALIZE
+    case SQLITE_CONFIG_MEMDB_MAXSIZE: {
+      sqlite3GlobalConfig.mxMemdbSize = va_arg(ap, sqlite3_int64);
+      break;
+    }
+#endif /* SQLITE_ENABLE_DESERIALIZE */
+
     default: {
       rc = SQLITE_ERROR;
       break;
     }
   }
@@ -841,15 +848,15 @@
       rc = SQLITE_ERROR; /* IMP: R-42790-23372 */
       for(i=0; i<ArraySize(aFlagOp); i++){
         if( aFlagOp[i].op==op ){
           int onoff = va_arg(ap, int);
           int *pRes = va_arg(ap, int*);
-          u32 oldFlags = db->flags;
+          u64 oldFlags = db->flags;
           if( onoff>0 ){
             db->flags |= aFlagOp[i].mask;
           }else if( onoff==0 ){
-            db->flags &= ~aFlagOp[i].mask;
+            db->flags &= ~(u64)aFlagOp[i].mask;
           }
           if( oldFlags!=db->flags ){
             sqlite3ExpirePreparedStatements(db, 0);
           }
           if( pRes ){
@@ -1309,11 +1316,11 @@
   sqlite3BtreeLeaveAll(db);
 
   /* Any deferred constraint violations have now been resolved. */
   db->nDeferredCons = 0;
   db->nDeferredImmCons = 0;
-  db->flags &= ~SQLITE_DeferFKs;
+  db->flags &= ~(u64)SQLITE_DeferFKs;
 
   /* If one has been configured, invoke the rollback-hook callback */
   if( db->xRollbackCallback && (inTrans || !db->autoCommit) ){
     db->xRollbackCallback(db->pRollbackArg);
   }
@@ -2051,10 +2058,12 @@
 #endif
   sqlite3_mutex_enter(db->mutex);
   pOld = db->pProfileArg;
   db->xProfile = xProfile;
   db->pProfileArg = pArg;
+  db->mTrace &= SQLITE_TRACE_NONLEGACY_MASK;
+  if( db->xProfile ) db->mTrace |= SQLITE_TRACE_XPROFILE;
   sqlite3_mutex_leave(db->mutex);
   return pOld;
 }
 #endif /* SQLITE_OMIT_DEPRECATED */
 #endif /* SQLITE_OMIT_TRACE */
@@ -2402,11 +2411,11 @@
   sqlite3_mutex_enter(db->mutex);
   if( db->mallocFailed ){
     z = sqlite3ErrStr(SQLITE_NOMEM_BKPT);
   }else{
     testcase( db->pErr==0 );
-    z = (char*)sqlite3_value_text(db->pErr);
+    z = db->errCode ? (char*)sqlite3_value_text(db->pErr) : 0;
     assert( !db->mallocFailed );
     if( z==0 ){
       z = sqlite3ErrStr(db->errCode);
     }
   }
@@ -2932,10 +2941,44 @@
   *pFlags = flags;
   *pzFile = zFile;
   return rc;
 }
 
+#if defined(SQLITE_HAS_CODEC)
+/*
+** Process URI filename query parameters relevant to the SQLite Encryption
+** Extension.  Return true if any of the relevant query parameters are
+** seen and return false if not.
+*/
+int sqlite3CodecQueryParameters(
+  sqlite3 *db,           /* Database connection */
+  const char *zDb,       /* Which schema is being created/attached */
+  const char *zUri       /* URI filename */
+){
+  const char *zKey;
+  if( (zKey = sqlite3_uri_parameter(zUri, "hexkey"))!=0 && zKey[0] ){
+    u8 iByte;
+    int i;
+    char zDecoded[40];
+    for(i=0, iByte=0; i<sizeof(zDecoded)*2 && sqlite3Isxdigit(zKey[i]); i++){
+      iByte = (iByte<<4) + sqlite3HexToInt(zKey[i]);
+      if( (i&1)!=0 ) zDecoded[i/2] = iByte;
+    }
+    sqlite3_key_v2(db, zDb, zDecoded, i/2);
+    return 1;
+  }else if( (zKey = sqlite3_uri_parameter(zUri, "key"))!=0 ){
+    sqlite3_key_v2(db, zDb, zKey, sqlite3Strlen30(zKey));
+    return 1;
+  }else if( (zKey = sqlite3_uri_parameter(zUri, "textkey"))!=0 ){
+    sqlite3_key_v2(db, zDb, zKey, -1);
+    return 1;
+  }else{
+    return 0;
+  }
+}
+#endif
+
 
 /*
 ** This routine does the work of opening a database on behalf of
 ** sqlite3_open() and sqlite3_open16(). The database filename "zFilename"  
 ** is UTF-8 encoded.
@@ -3061,10 +3104,13 @@
 #if defined(SQLITE_ENABLE_FTS3_TOKENIZER)
                  | SQLITE_Fts3Tokenizer
 #endif
 #if defined(SQLITE_ENABLE_QPSG)
                  | SQLITE_EnableQPSG
+#endif
+#if defined(SQLITE_DEFAULT_DEFENSIVE)
+                 | SQLITE_Defensive
 #endif
       ;
   sqlite3HashInit(&db->aCollSeq);
 #ifndef SQLITE_OMIT_VIRTUALTABLE
   sqlite3HashInit(&db->aModule);
@@ -3274,29 +3320,16 @@
     void *pArg = sqlite3GlobalConfig.pSqllogArg;
     sqlite3GlobalConfig.xSqllog(pArg, db, zFilename, 0);
   }
 #endif
 #if defined(SQLITE_HAS_CODEC)
-  if( rc==SQLITE_OK ){
-    const char *zKey;
-    if( (zKey = sqlite3_uri_parameter(zOpen, "hexkey"))!=0 && zKey[0] ){
-      u8 iByte;
-      int i;
-      char zDecoded[40];
-      for(i=0, iByte=0; i<sizeof(zDecoded)*2 && sqlite3Isxdigit(zKey[i]); i++){
-        iByte = (iByte<<4) + sqlite3HexToInt(zKey[i]);
-        if( (i&1)!=0 ) zDecoded[i/2] = iByte;
-      }
-      sqlite3_key_v2(db, 0, zDecoded, i/2);
-    }else if( (zKey = sqlite3_uri_parameter(zOpen, "key"))!=0 ){
-      sqlite3_key_v2(db, 0, zKey, sqlite3Strlen30(zKey));
-    }
-  }
+  if( rc==SQLITE_OK ) sqlite3CodecQueryParameters(db, 0, zOpen);
 #endif
   sqlite3_free(zOpen);
   return rc & 0xff;
 }
+
 
 /*
 ** Open a new database handle.
 */
 int sqlite3_open(
@@ -3949,18 +3982,29 @@
       break;
     }
 
     /*   sqlite3_test_control(SQLITE_TESTCTRL_LOCALTIME_FAULT, int onoff);
     **
-    ** If parameter onoff is non-zero, configure the wrappers so that all
-    ** subsequent calls to localtime() and variants fail. If onoff is zero,
-    ** undo this setting.
+    ** If parameter onoff is non-zero, subsequent calls to localtime()
+    ** and its variants fail. If onoff is zero, undo this setting.
     */
     case SQLITE_TESTCTRL_LOCALTIME_FAULT: {
       sqlite3GlobalConfig.bLocaltimeFault = va_arg(ap, int);
       break;
     }
+
+    /*   sqlite3_test_control(SQLITE_TESTCTRL_INTERNAL_FUNCS, int onoff);
+    **
+    ** If parameter onoff is non-zero, internal-use-only SQL functions
+    ** are visible to ordinary SQL.  This is useful for testing but is
+    ** unsafe because invalid parameters to those internal-use-only functions
+    ** can result in crashes or segfaults.
+    */
+    case SQLITE_TESTCTRL_INTERNAL_FUNCTIONS: {
+      sqlite3GlobalConfig.bInternalFunctions = va_arg(ap, int);
+      break;
+    }
 
     /*   sqlite3_test_control(SQLITE_TESTCTRL_NEVER_CORRUPT, int);
     **
     ** Set or clear a flag that indicates that the database file is always well-
     ** formed and never corrupt.  This flag is clear by default, indicating that

Index: src/memdb.c
==================================================================
--- src/memdb.c
+++ src/memdb.c
@@ -32,11 +32,12 @@
 
 /* An open file */
 struct MemFile {
   sqlite3_file base;              /* IO methods */
   sqlite3_int64 sz;               /* Size of the file */
-  sqlite3_int64 szMax;            /* Space allocated to aData */
+  sqlite3_int64 szAlloc;          /* Space allocated to aData */
+  sqlite3_int64 szMax;            /* Maximum allowed size of the file */
   unsigned char *aData;           /* content of the file */
   int nMmap;                      /* Number of memory mapped pages */
   unsigned mFlags;                /* Flags */
   int eLock;                      /* Most recent lock against this file */
 };
@@ -158,14 +159,19 @@
 static int memdbEnlarge(MemFile *p, sqlite3_int64 newSz){
   unsigned char *pNew;
   if( (p->mFlags & SQLITE_DESERIALIZE_RESIZEABLE)==0 || p->nMmap>0 ){
     return SQLITE_FULL;
   }
+  if( newSz>p->szMax ){
+    return SQLITE_FULL;
+  }
+  newSz *= 2;
+  if( newSz>p->szMax ) newSz = p->szMax;
   pNew = sqlite3_realloc64(p->aData, newSz);
   if( pNew==0 ) return SQLITE_NOMEM;
   p->aData = pNew;
-  p->szMax = newSz;
+  p->szAlloc = newSz;
   return SQLITE_OK;
 }
 
 /*
 ** Write data to an memdb-file.
@@ -175,14 +181,15 @@
   const void *z,
   int iAmt,
   sqlite_int64 iOfst
 ){
   MemFile *p = (MemFile *)pFile;
+  if( NEVER(p->mFlags & SQLITE_DESERIALIZE_READONLY) ) return SQLITE_READONLY;
   if( iOfst+iAmt>p->sz ){
     int rc;
-    if( iOfst+iAmt>p->szMax
-     && (rc = memdbEnlarge(p, (iOfst+iAmt)*2))!=SQLITE_OK
+    if( iOfst+iAmt>p->szAlloc
+     && (rc = memdbEnlarge(p, iOfst+iAmt))!=SQLITE_OK
     ){
       return rc;
     }
     if( iOfst>p->sz ) memset(p->aData+p->sz, 0, iOfst-p->sz);
     p->sz = iOfst+iAmt;
@@ -224,10 +231,15 @@
 /*
 ** Lock an memdb-file.
 */
 static int memdbLock(sqlite3_file *pFile, int eLock){
   MemFile *p = (MemFile *)pFile;
+  if( eLock>SQLITE_LOCK_SHARED 
+   && (p->mFlags & SQLITE_DESERIALIZE_READONLY)!=0
+  ){
+    return SQLITE_READONLY;
+  }
   p->eLock = eLock;
   return SQLITE_OK;
 }
 
 #if 0 /* Never used because memdbAccess() always returns false */
@@ -247,10 +259,23 @@
   MemFile *p = (MemFile *)pFile;
   int rc = SQLITE_NOTFOUND;
   if( op==SQLITE_FCNTL_VFSNAME ){
     *(char**)pArg = sqlite3_mprintf("memdb(%p,%lld)", p->aData, p->sz);
     rc = SQLITE_OK;
+  }
+  if( op==SQLITE_FCNTL_SIZE_LIMIT ){
+    sqlite3_int64 iLimit = *(sqlite3_int64*)pArg;
+    if( iLimit<p->sz ){
+      if( iLimit<0 ){
+        iLimit = p->szMax;
+      }else{
+        iLimit = p->sz;
+      }
+    }
+    p->szMax = iLimit;
+    *(sqlite3_int64*)pArg = iLimit;
+    rc = SQLITE_OK;
   }
   return rc;
 }
 
 #if 0  /* Not used because of SQLITE_IOCAP_POWERSAFE_OVERWRITE */
@@ -278,12 +303,16 @@
   sqlite3_int64 iOfst,
   int iAmt,
   void **pp
 ){
   MemFile *p = (MemFile *)pFile;
-  p->nMmap++;
-  *pp = (void*)(p->aData + iOfst);
+  if( iOfst+iAmt>p->sz ){
+    *pp = 0;
+  }else{
+    p->nMmap++;
+    *pp = (void*)(p->aData + iOfst);
+  }
   return SQLITE_OK;
 }
 
 /* Release a memory-mapped page */
 static int memdbUnfetch(sqlite3_file *pFile, sqlite3_int64 iOfst, void *pPage){
@@ -309,10 +338,11 @@
   memset(p, 0, sizeof(*p));
   p->mFlags = SQLITE_DESERIALIZE_RESIZEABLE | SQLITE_DESERIALIZE_FREEONCLOSE;
   assert( pOutFlags!=0 );  /* True because flags==SQLITE_OPEN_MAIN_DB */
   *pOutFlags = flags | SQLITE_OPEN_MEMORY;
   p->base.pMethods = &memdb_io_methods;
+  p->szMax = sqlite3GlobalConfig.mxMemdbSize;
   return SQLITE_OK;
 }
 
 #if 0 /* Only used to delete rollback journals, master journals, and WAL
       ** files, none of which exist in memdb.  So this routine is never used */
@@ -558,11 +588,15 @@
   if( p==0 ){
     rc = SQLITE_ERROR;
   }else{
     p->aData = pData;
     p->sz = szDb;
+    p->szAlloc = szBuf;
     p->szMax = szBuf;
+    if( p->szMax<sqlite3GlobalConfig.mxMemdbSize ){
+      p->szMax = sqlite3GlobalConfig.mxMemdbSize;
+    }
     p->mFlags = mFlags;
     rc = SQLITE_OK;
   }
 
 end_deserialize:

Index: src/os_win.c
==================================================================
--- src/os_win.c
+++ src/os_win.c
@@ -282,12 +282,11 @@
 #endif
 #if SQLITE_MAX_MMAP_SIZE>0
   int nFetchOut;                /* Number of outstanding xFetch references */
   HANDLE hMap;                  /* Handle for accessing memory mapping */
   void *pMapRegion;             /* Area memory mapped */
-  sqlite3_int64 mmapSize;       /* Usable size of mapped region */
-  sqlite3_int64 mmapSizeActual; /* Actual size of mapped region */
+  sqlite3_int64 mmapSize;       /* Size of mapped region */
   sqlite3_int64 mmapSizeMax;    /* Configured FCNTL_MMAP_SIZE value */
 #endif
 };
 
 /*
@@ -2904,10 +2903,30 @@
   winFile *pFile = (winFile*)id;  /* File handle object */
   int rc = SQLITE_OK;             /* Return code for this function */
   DWORD lastErrno;
 #if SQLITE_MAX_MMAP_SIZE>0
   sqlite3_int64 oldMmapSize;
+  if( pFile->nFetchOut>0 ){
+    /* File truncation is a no-op if there are outstanding memory mapped
+    ** pages.  This is because truncating the file means temporarily unmapping
+    ** the file, and that might delete memory out from under existing cursors.
+    **
+    ** This can result in incremental vacuum not truncating the file,
+    ** if there is an active read cursor when the incremental vacuum occurs.
+    ** No real harm comes of this - the database file is not corrupted,
+    ** though some folks might complain that the file is bigger than it
+    ** needs to be.
+    **
+    ** The only feasible work-around is to defer the truncation until after
+    ** all references to memory-mapped content are closed.  That is doable,
+    ** but involves adding a few branches in the common write code path which
+    ** could slow down normal operations slightly.  Hence, we have decided for
+    ** now to simply make trancations a no-op if there are pending reads.  We
+    ** can maybe revisit this decision in the future.
+    */
+    return SQLITE_OK;
+  }
 #endif
 
   assert( pFile );
   SimulateIOError(return SQLITE_IOERR_TRUNCATE);
   OSTRACE(("TRUNCATE pid=%lu, pFile=%p, file=%p, size=%lld, lock=%d\n",
@@ -4332,13 +4351,13 @@
 */
 #if SQLITE_MAX_MMAP_SIZE>0
 static int winUnmapfile(winFile *pFile){
   assert( pFile!=0 );
   OSTRACE(("UNMAP-FILE pid=%lu, pFile=%p, hMap=%p, pMapRegion=%p, "
-           "mmapSize=%lld, mmapSizeActual=%lld, mmapSizeMax=%lld\n",
+           "mmapSize=%lld, mmapSizeMax=%lld\n",
            osGetCurrentProcessId(), pFile, pFile->hMap, pFile->pMapRegion,
-           pFile->mmapSize, pFile->mmapSizeActual, pFile->mmapSizeMax));
+           pFile->mmapSize, pFile->mmapSizeMax));
   if( pFile->pMapRegion ){
     if( !osUnmapViewOfFile(pFile->pMapRegion) ){
       pFile->lastErrno = osGetLastError();
       OSTRACE(("UNMAP-FILE pid=%lu, pFile=%p, pMapRegion=%p, "
                "rc=SQLITE_IOERR_MMAP\n", osGetCurrentProcessId(), pFile,
@@ -4346,11 +4365,10 @@
       return winLogError(SQLITE_IOERR_MMAP, pFile->lastErrno,
                          "winUnmapfile1", pFile->zPath);
     }
     pFile->pMapRegion = 0;
     pFile->mmapSize = 0;
-    pFile->mmapSizeActual = 0;
   }
   if( pFile->hMap!=NULL ){
     if( !osCloseHandle(pFile->hMap) ){
       pFile->lastErrno = osGetLastError();
       OSTRACE(("UNMAP-FILE pid=%lu, pFile=%p, hMap=%p, rc=SQLITE_IOERR_MMAP\n",
@@ -4457,11 +4475,10 @@
                osGetCurrentProcessId(), pFd, sqlite3ErrName(rc)));
       return SQLITE_OK;
     }
     pFd->pMapRegion = pNew;
     pFd->mmapSize = nMap;
-    pFd->mmapSizeActual = nMap;
   }
 
   OSTRACE(("MAP-FILE pid=%lu, pFile=%p, rc=SQLITE_OK\n",
            osGetCurrentProcessId(), pFd));
   return SQLITE_OK;
@@ -5259,11 +5276,10 @@
   pFile->zPath = zName;
 #if SQLITE_MAX_MMAP_SIZE>0
   pFile->hMap = NULL;
   pFile->pMapRegion = 0;
   pFile->mmapSize = 0;
-  pFile->mmapSizeActual = 0;
   pFile->mmapSizeMax = sqlite3GlobalConfig.szMmap;
 #endif
 
   OpenCounter(+1);
   return rc;

Index: src/pager.c
==================================================================
--- src/pager.c
+++ src/pager.c
@@ -823,23 +823,34 @@
 **
 **   if( pPager->jfd->pMethods ){ ...
 */
 #define isOpen(pFd) ((pFd)->pMethods!=0)
 
+#ifdef SQLITE_DIRECT_OVERFLOW_READ
 /*
-** Return true if this pager uses a write-ahead log to read page pgno.
-** Return false if the pager reads pgno directly from the database.
+** Return true if page pgno can be read directly from the database file
+** by the b-tree layer. This is the case if:
+**
+**   * the database file is open,
+**   * there are no dirty pages in the cache, and
+**   * the desired page is not currently in the wal file.
 */
-#if !defined(SQLITE_OMIT_WAL) && defined(SQLITE_DIRECT_OVERFLOW_READ)
-int sqlite3PagerUseWal(Pager *pPager, Pgno pgno){
-  u32 iRead = 0;
-  int rc;
-  if( pPager->pWal==0 ) return 0;
-  rc = sqlite3WalFindFrame(pPager->pWal, pgno, &iRead);
-  return rc || iRead;
+int sqlite3PagerDirectReadOk(Pager *pPager, Pgno pgno){
+  if( pPager->fd->pMethods==0 ) return 0;
+  if( sqlite3PCacheIsDirty(pPager->pPCache) ) return 0;
+#ifndef SQLITE_OMIT_WAL
+  if( pPager->pWal ){
+    u32 iRead = 0;
+    int rc;
+    rc = sqlite3WalFindFrame(pPager->pWal, pgno, &iRead);
+    return (rc==SQLITE_OK && iRead==0);
+  }
+#endif
+  return 1;
 }
 #endif
+
 #ifndef SQLITE_OMIT_WAL
 # define pagerUseWal(x) ((x)->pWal!=0)
 #else
 # define pagerUseWal(x) 0
 # define pagerRollbackWal(x) 0
@@ -3826,11 +3837,14 @@
 int sqlite3PagerMaxPageCount(Pager *pPager, int mxPage){
   if( mxPage>0 ){
     pPager->mxPgno = mxPage;
   }
   assert( pPager->eState!=PAGER_OPEN );      /* Called only by OP_MaxPgcnt */
-  assert( pPager->mxPgno>=pPager->dbSize );  /* OP_MaxPgcnt enforces this */
+  /* assert( pPager->mxPgno>=pPager->dbSize ); */
+  /* OP_MaxPgcnt ensures that the parameter passed to this function is not
+  ** less than the total number of valid pages in the database. But this
+  ** may be less than Pager.dbSize, and so the assert() above is not valid */
   return pPager->mxPgno;
 }
 
 /*
 ** The following set of routines are used to disable the simulated
@@ -7019,12 +7033,15 @@
   void *(*xCodec)(void*,void*,Pgno,int),
   void (*xCodecSizeChng)(void*,int,int),
   void (*xCodecFree)(void*),
   void *pCodec
 ){
-  pager_reset(pPager);
-  if( pPager->xCodecFree ) pPager->xCodecFree(pPager->pCodec);
+  if( pPager->xCodecFree ){
+    pPager->xCodecFree(pPager->pCodec);
+  }else{
+    pager_reset(pPager);
+  }
   pPager->xCodec = pPager->memDb ? 0 : xCodec;
   pPager->xCodecSizeChng = xCodecSizeChng;
   pPager->xCodecFree = xCodecFree;
   pPager->pCodec = pCodec;
   setGetterMethod(pPager);

Index: src/pager.h
==================================================================
--- src/pager.h
+++ src/pager.h
@@ -177,22 +177,21 @@
   int sqlite3PagerCheckpoint(Pager *pPager, sqlite3*, int, int*, int*);
   int sqlite3PagerWalSupported(Pager *pPager);
   int sqlite3PagerWalCallback(Pager *pPager);
   int sqlite3PagerOpenWal(Pager *pPager, int *pisOpen);
   int sqlite3PagerCloseWal(Pager *pPager, sqlite3*);
-# ifdef SQLITE_DIRECT_OVERFLOW_READ
-  int sqlite3PagerUseWal(Pager *pPager, Pgno);
-# endif
 # ifdef SQLITE_ENABLE_SNAPSHOT
   int sqlite3PagerSnapshotGet(Pager *pPager, sqlite3_snapshot **ppSnapshot);
   int sqlite3PagerSnapshotOpen(Pager *pPager, sqlite3_snapshot *pSnapshot);
   int sqlite3PagerSnapshotRecover(Pager *pPager);
   int sqlite3PagerSnapshotCheck(Pager *pPager, sqlite3_snapshot *pSnapshot);
   void sqlite3PagerSnapshotUnlock(Pager *pPager);
 # endif
-#else
-# define sqlite3PagerUseWal(x,y) 0
+#endif
+
+#ifdef SQLITE_DIRECT_OVERFLOW_READ
+  int sqlite3PagerDirectReadOk(Pager *pPager, Pgno pgno);
 #endif
 
 #ifdef SQLITE_ENABLE_ZIPVFS
   int sqlite3PagerWalFramesize(Pager *pPager);
 #endif

Index: src/parse.y
==================================================================
--- src/parse.y
+++ src/parse.y
@@ -662,10 +662,16 @@
         struct SrcList_item *pNew = &A->a[A->nSrc-1];
         struct SrcList_item *pOld = F->a;
         pNew->zName = pOld->zName;
         pNew->zDatabase = pOld->zDatabase;
         pNew->pSelect = pOld->pSelect;
+        if( pOld->fg.isTabFunc ){
+          pNew->u1.pFuncArg = pOld->u1.pFuncArg;
+          pOld->u1.pFuncArg = 0;
+          pOld->fg.isTabFunc = 0;
+          pNew->fg.isTabFunc = 1;
+        }
         pOld->zName = pOld->zDatabase = 0;
         pOld->pSelect = 0;
       }
       sqlite3SrcListDelete(pParse->db, F);
     }else{
@@ -682,30 +688,30 @@
 dbnm(A) ::= DOT nm(X). {A = X;}
 
 %type fullname {SrcList*}
 %destructor fullname {sqlite3SrcListDelete(pParse->db, $$);}
 fullname(A) ::= nm(X).  {
-  A = sqlite3SrcListAppend(pParse->db,0,&X,0);
+  A = sqlite3SrcListAppend(pParse,0,&X,0);
   if( IN_RENAME_OBJECT && A ) sqlite3RenameTokenMap(pParse, A->a[0].zName, &X);
 }
 fullname(A) ::= nm(X) DOT nm(Y). {
-  A = sqlite3SrcListAppend(pParse->db,0,&X,&Y);
+  A = sqlite3SrcListAppend(pParse,0,&X,&Y);
   if( IN_RENAME_OBJECT && A ) sqlite3RenameTokenMap(pParse, A->a[0].zName, &Y);
 }
 
 %type xfullname {SrcList*}
 %destructor xfullname {sqlite3SrcListDelete(pParse->db, $$);}
 xfullname(A) ::= nm(X).  
-   {A = sqlite3SrcListAppend(pParse->db,0,&X,0); /*A-overwrites-X*/}
+   {A = sqlite3SrcListAppend(pParse,0,&X,0); /*A-overwrites-X*/}
 xfullname(A) ::= nm(X) DOT nm(Y).  
-   {A = sqlite3SrcListAppend(pParse->db,0,&X,&Y); /*A-overwrites-X*/}
+   {A = sqlite3SrcListAppend(pParse,0,&X,&Y); /*A-overwrites-X*/}
 xfullname(A) ::= nm(X) DOT nm(Y) AS nm(Z).  {
-   A = sqlite3SrcListAppend(pParse->db,0,&X,&Y); /*A-overwrites-X*/
+   A = sqlite3SrcListAppend(pParse,0,&X,&Y); /*A-overwrites-X*/
    if( A ) A->a[0].zAlias = sqlite3NameFromToken(pParse->db, &Z);
 }
 xfullname(A) ::= nm(X) AS nm(Z). {  
-   A = sqlite3SrcListAppend(pParse->db,0,&X,0); /*A-overwrites-X*/
+   A = sqlite3SrcListAppend(pParse,0,&X,0); /*A-overwrites-X*/
    if( A ) A->a[0].zAlias = sqlite3NameFromToken(pParse->db, &Z);
 }
 
 %type joinop {int}
 joinop(X) ::= COMMA|JOIN.              { X = JT_INNER; }
@@ -818,10 +824,14 @@
 //
 %ifdef SQLITE_ENABLE_UPDATE_DELETE_LIMIT
 cmd ::= with DELETE FROM xfullname(X) indexed_opt(I) where_opt(W) 
         orderby_opt(O) limit_opt(L). {
   sqlite3SrcListIndexedBy(pParse, X, &I);
+#ifndef SQLITE_ENABLE_UPDATE_DELETE_LIMIT
+  sqlite3ExprListDelete(pParse->db, O); O = 0;
+  sqlite3ExprDelete(pParse->db, L); L = 0;
+#endif
   sqlite3DeleteFrom(pParse,X,W,O,L);
 }
 %endif
 %ifndef SQLITE_ENABLE_UPDATE_DELETE_LIMIT
 cmd ::= with DELETE FROM xfullname(X) indexed_opt(I) where_opt(W). {
@@ -947,12 +957,11 @@
       p->iColumn = 0;
       p->u.zToken = (char*)&p[1];
       memcpy(p->u.zToken, t.z, t.n);
       p->u.zToken[t.n] = 0;
       if( sqlite3Isquote(p->u.zToken[0]) ){
-        if( p->u.zToken[0]=='"' ) p->flags |= EP_DblQuoted;
-        sqlite3Dequote(p->u.zToken);
+        sqlite3DequoteExpr(p);
       }
 #if SQLITE_MAX_EXPR_DEPTH>0
       p->nHeight = 1;
 #endif  
       if( IN_RENAME_OBJECT ){
@@ -1159,12 +1168,14 @@
       **      expr1 NOT IN ()
       **
       ** simplify to constants 0 (false) and 1 (true), respectively,
       ** regardless of the value of expr1.
       */
-      sqlite3ExprDelete(pParse->db, A);
-      A = sqlite3ExprAlloc(pParse->db, TK_INTEGER,&sqlite3IntTokens[N],1);
+      if( IN_RENAME_OBJECT==0 ){
+        sqlite3ExprDelete(pParse->db, A);
+        A = sqlite3ExprAlloc(pParse->db, TK_INTEGER,&sqlite3IntTokens[N],1);
+      }
     }else if( Y->nExpr==1 ){
       /* Expressions of the form:
       **
       **      expr1 IN (?1)
       **      expr1 NOT IN (?2)
@@ -1209,11 +1220,11 @@
     A = sqlite3PExpr(pParse, TK_IN, A, 0);
     sqlite3PExprAddSelect(pParse, A, Y);
     if( N ) A = sqlite3PExpr(pParse, TK_NOT, A, 0);
   }
   expr(A) ::= expr(A) in_op(N) nm(Y) dbnm(Z) paren_exprlist(E). [IN] {
-    SrcList *pSrc = sqlite3SrcListAppend(pParse->db, 0,&Y,&Z);
+    SrcList *pSrc = sqlite3SrcListAppend(pParse, 0,&Y,&Z);
     Select *pSelect = sqlite3SelectNew(pParse, 0,pSrc,0,0,0,0,0,0);
     if( E )  sqlite3SrcListFuncArgs(pParse, pSelect ? pSrc : 0, E);
     A = sqlite3PExpr(pParse, TK_IN, A, 0);
     sqlite3PExprAddSelect(pParse, A, pSelect);
     if( N ) A = sqlite3PExpr(pParse, TK_NOT, A, 0);
@@ -1280,11 +1291,11 @@
 ///////////////////////////// The CREATE INDEX command ///////////////////////
 //
 cmd ::= createkw(S) uniqueflag(U) INDEX ifnotexists(NE) nm(X) dbnm(D)
         ON nm(Y) LP sortlist(Z) RP where_opt(W). {
   sqlite3CreateIndex(pParse, &X, &D, 
-                     sqlite3SrcListAppend(pParse->db,0,&Y,0), Z, U,
+                     sqlite3SrcListAppend(pParse,0,&Y,0), Z, U,
                       &S, W, SQLITE_SO_ASC, NE, SQLITE_IDXTYPE_APPDEF);
   if( IN_RENAME_OBJECT && pParse->pNewIndex ){
     sqlite3RenameTokenMap(pParse, pParse->pNewIndex->zName, &Y);
   }
 }
@@ -1359,12 +1370,16 @@
 
 ///////////////////////////// The VACUUM command /////////////////////////////
 //
 %ifndef SQLITE_OMIT_VACUUM
 %ifndef SQLITE_OMIT_ATTACH
-cmd ::= VACUUM.                {sqlite3Vacuum(pParse,0);}
-cmd ::= VACUUM nm(X).          {sqlite3Vacuum(pParse,&X);}
+%type vinto {Expr*}
+%destructor vinto {sqlite3ExprDelete(pParse->db, $$);}
+cmd ::= VACUUM vinto(Y).                {sqlite3Vacuum(pParse,0,Y);}
+cmd ::= VACUUM nm(X) vinto(Y).          {sqlite3Vacuum(pParse,&X,Y);}
+vinto(A) ::= INTO expr(X).              {A = X;}
+vinto(A) ::= .                          {A = 0;}
 %endif  SQLITE_OMIT_ATTACH
 %endif  SQLITE_OMIT_VACUUM
 
 ///////////////////////////// The PRAGMA command /////////////////////////////
 //

Index: src/pcache.c
==================================================================
--- src/pcache.c
+++ src/pcache.c
@@ -853,10 +853,19 @@
   int nDirty = 0;
   int nCache = numberOfCachePages(pCache);
   for(pDirty=pCache->pDirty; pDirty; pDirty=pDirty->pDirtyNext) nDirty++;
   return nCache ? (int)(((i64)nDirty * 100) / nCache) : 0;
 }
+
+#ifdef SQLITE_DIRECT_OVERFLOW_READ
+/* 
+** Return true if there are one or more dirty pages in the cache. Else false.
+*/
+int sqlite3PCacheIsDirty(PCache *pCache){
+  return (pCache->pDirty!=0);
+}
+#endif
 
 #if defined(SQLITE_CHECK_PAGES) || defined(SQLITE_DEBUG)
 /*
 ** For all dirty pages currently in the cache, invoke the specified
 ** callback. This is only used if the SQLITE_CHECK_PAGES macro is

Index: src/pcache.h
==================================================================
--- src/pcache.h
+++ src/pcache.h
@@ -180,7 +180,11 @@
 int sqlite3HeaderSizePcache(void);
 int sqlite3HeaderSizePcache1(void);
 
 /* Number of dirty pages as a percentage of the configured cache size */
 int sqlite3PCachePercentDirty(PCache*);
+
+#ifdef SQLITE_DIRECT_OVERFLOW_READ
+int sqlite3PCacheIsDirty(PCache *pCache);
+#endif
 
 #endif /* _PCACHE_H_ */

Index: src/pcache1.c
==================================================================
--- src/pcache1.c
+++ src/pcache1.c
@@ -100,14 +100,16 @@
   u8 isAnchor;                   /* This is the PGroup.lru element */
   PgHdr1 *pNext;                 /* Next in hash table chain */
   PCache1 *pCache;               /* Cache that currently owns this page */
   PgHdr1 *pLruNext;              /* Next in LRU list of unpinned pages */
   PgHdr1 *pLruPrev;              /* Previous in LRU list of unpinned pages */
+                                 /* NB: pLruPrev is only valid if pLruNext!=0 */
 };
 
 /*
-** A page is pinned if it is no on the LRU list
+** A page is pinned if it is not on the LRU list.  To be "pinned" means
+** that the page is in active use and must not be deallocated.
 */
 #define PAGE_IS_PINNED(p)    ((p)->pLruNext==0)
 #define PAGE_IS_UNPINNED(p)  ((p)->pLruNext!=0)
 
 /* Each page cache (or PCache) belongs to a PGroup.  A PGroup is a set 
@@ -164,10 +166,11 @@
   int bPurgeable;                     /* True if cache is purgeable */
   unsigned int nMin;                  /* Minimum number of pages reserved */
   unsigned int nMax;                  /* Configured "cache_size" value */
   unsigned int n90pct;                /* nMax*9/10 */
   unsigned int iMaxKey;               /* Largest key seen since xTruncate() */
+  unsigned int nPurgeableDummy;       /* pnPurgeable points here when not used*/
 
   /* Hash table of all pages. The following variables may only be accessed
   ** when the accessor is holding the PGroup mutex.
   */
   unsigned int nRecyclable;           /* Number of pages in the LRU list */
@@ -473,10 +476,13 @@
 ** Malloc function used by SQLite to obtain space from the buffer configured
 ** using sqlite3_config(SQLITE_CONFIG_PAGECACHE) option. If no such buffer
 ** exists, this function falls back to sqlite3Malloc().
 */
 void *sqlite3PageMalloc(int sz){
+  /* During rebalance operations on a corrupt database file, it is sometimes
+  ** (rarely) possible to overread the temporary page buffer by a few bytes.
+  ** Enlarge the allocation slightly so that this does not cause problems. */
   return pcache1Alloc(sz);
 }
 
 /*
 ** Free an allocated buffer obtained from sqlite3PageMalloc().
@@ -567,11 +573,12 @@
   assert( pPage->pLruPrev );
   assert( sqlite3_mutex_held(pPage->pCache->pGroup->mutex) );
   pPage->pLruPrev->pLruNext = pPage->pLruNext;
   pPage->pLruNext->pLruPrev = pPage->pLruPrev;
   pPage->pLruNext = 0;
-  pPage->pLruPrev = 0;
+  /* pPage->pLruPrev = 0;
+  ** No need to clear pLruPrev as it is never accessed if pLruNext is 0 */
   assert( pPage->isAnchor==0 );
   assert( pPage->pCache->pGroup->lru.isAnchor==1 );
   pPage->pCache->nRecyclable--;
   return pPage;
 }
@@ -777,12 +784,11 @@
       pCache->nMin = 10;
       pGroup->nMinPage += pCache->nMin;
       pGroup->mxPinned = pGroup->nMaxPage + 10 - pGroup->nMinPage;
       pCache->pnPurgeable = &pGroup->nPurgeable;
     }else{
-      static unsigned int dummyCurrentPage;
-      pCache->pnPurgeable = &dummyCurrentPage;
+      pCache->pnPurgeable = &pCache->nPurgeableDummy;
     }
     pcache1LeaveMutex(pGroup);
     if( pCache->nHash==0 ){
       pcache1Destroy((sqlite3_pcache*)pCache);
       pCache = 0;
@@ -905,12 +911,13 @@
     unsigned int h = iKey % pCache->nHash;
     pCache->nPage++;
     pPage->iKey = iKey;
     pPage->pNext = pCache->apHash[h];
     pPage->pCache = pCache;
-    pPage->pLruPrev = 0;
     pPage->pLruNext = 0;
+    /* pPage->pLruPrev = 0;
+    ** No need to clear pLruPrev since it is not accessed when pLruNext==0 */
     *(void **)pPage->page.pExtra = 0;
     pCache->apHash[h] = pPage;
     if( iKey>pCache->iMaxKey ){
       pCache->iMaxKey = iKey;
     }
@@ -1066,11 +1073,11 @@
   pcache1EnterMutex(pGroup);
 
   /* It is an error to call this function if the page is already 
   ** part of the PGroup LRU list.
   */
-  assert( pPage->pLruPrev==0 && pPage->pLruNext==0 );
+  assert( pPage->pLruNext==0 );
   assert( PAGE_IS_PINNED(pPage) );
 
   if( reuseUnlikely || pGroup->nPurgeable>pGroup->nMaxPage ){
     pcache1RemoveFromHash(pPage, 1);
   }else{

Index: src/pragma.c
==================================================================
--- src/pragma.c
+++ src/pragma.c
@@ -814,11 +814,11 @@
         sqlite3BtreeSetSpillSize(pDb->pBt, size);
       }
       if( sqlite3GetBoolean(zRight, size!=0) ){
         db->flags |= SQLITE_CacheSpill;
       }else{
-        db->flags &= ~SQLITE_CacheSpill;
+        db->flags &= ~(u64)SQLITE_CacheSpill;
       }
       setAllPagerFlags(db);
     }
     break;
   }
@@ -1084,16 +1084,17 @@
   */
   case PragTyp_TABLE_INFO: if( zRight ){
     Table *pTab;
     pTab = sqlite3LocateTable(pParse, LOCATE_NOERR, zRight, zDb);
     if( pTab ){
+      int iTabDb = sqlite3SchemaToIndex(db, pTab->pSchema);
       int i, k;
       int nHidden = 0;
       Column *pCol;
       Index *pPk = sqlite3PrimaryKeyIndex(pTab);
       pParse->nMem = 7;
-      sqlite3CodeVerifySchema(pParse, iDb);
+      sqlite3CodeVerifySchema(pParse, iTabDb);
       sqlite3ViewGetColumnNames(pParse, pTab);
       for(i=0, pCol=pTab->aCol; i<pTab->nCol; i++, pCol++){
         int isHidden = IsHiddenColumn(pCol);
         if( isHidden && pPragma->iArg==0 ){
           nHidden++;
@@ -1150,10 +1151,11 @@
   case PragTyp_INDEX_INFO: if( zRight ){
     Index *pIdx;
     Table *pTab;
     pIdx = sqlite3FindIndex(db, zRight, zDb);
     if( pIdx ){
+      int iIdxDb = sqlite3SchemaToIndex(db, pIdx->pSchema);
       int i;
       int mx;
       if( pPragma->iArg ){
         /* PRAGMA index_xinfo (newer version with more rows and columns) */
         mx = pIdx->nColumn;
@@ -1162,11 +1164,11 @@
         /* PRAGMA index_info (legacy version) */
         mx = pIdx->nKeyCol;
         pParse->nMem = 3;
       }
       pTab = pIdx->pTable;
-      sqlite3CodeVerifySchema(pParse, iDb);
+      sqlite3CodeVerifySchema(pParse, iIdxDb);
       assert( pParse->nMem<=pPragma->nPragCName );
       for(i=0; i<mx; i++){
         i16 cnum = pIdx->aiColumn[i];
         sqlite3VdbeMultiLoad(v, 1, "iisX", i, cnum,
                              cnum<0 ? 0 : pTab->aCol[cnum].zName);
@@ -1186,12 +1188,13 @@
     Index *pIdx;
     Table *pTab;
     int i;
     pTab = sqlite3FindTable(db, zRight, zDb);
     if( pTab ){
+      int iTabDb = sqlite3SchemaToIndex(db, pTab->pSchema);
       pParse->nMem = 5;
-      sqlite3CodeVerifySchema(pParse, iDb);
+      sqlite3CodeVerifySchema(pParse, iTabDb);
       for(pIdx=pTab->pIndex, i=0; pIdx; pIdx=pIdx->pNext, i++){
         const char *azOrigin[] = { "c", "u", "pk" };
         sqlite3VdbeMultiLoad(v, 1, "isisi",
            i,
            pIdx->zName,
@@ -1234,10 +1237,11 @@
     HashElem *j;
     FuncDef *p;
     pParse->nMem = 2;
     for(i=0; i<SQLITE_FUNC_HASH_SZ; i++){
       for(p=sqlite3BuiltinFunctions.a[i]; p; p=p->u.pHash ){
+        if( p->funcFlags & SQLITE_FUNC_INTERNAL ) continue;
         sqlite3VdbeMultiLoad(v, 1, "si", p->zName, 1);
       }
     }
     for(j=sqliteHashFirst(&db->aFunc); j; j=sqliteHashNext(j)){
       p = (FuncDef*)sqliteHashData(j);
@@ -1275,13 +1279,14 @@
     Table *pTab;
     pTab = sqlite3FindTable(db, zRight, zDb);
     if( pTab ){
       pFK = pTab->pFKey;
       if( pFK ){
+        int iTabDb = sqlite3SchemaToIndex(db, pTab->pSchema);
         int i = 0; 
         pParse->nMem = 8;
-        sqlite3CodeVerifySchema(pParse, iDb);
+        sqlite3CodeVerifySchema(pParse, iTabDb);
         while(pFK){
           int j;
           for(j=0; j<pFK->nCol; j++){
             sqlite3VdbeMultiLoad(v, 1, "iissssss",
                    i,
@@ -1322,36 +1327,38 @@
 
     regResult = pParse->nMem+1;
     pParse->nMem += 4;
     regKey = ++pParse->nMem;
     regRow = ++pParse->nMem;
-    sqlite3CodeVerifySchema(pParse, iDb);
     k = sqliteHashFirst(&db->aDb[iDb].pSchema->tblHash);
     while( k ){
+      int iTabDb;
       if( zRight ){
         pTab = sqlite3LocateTable(pParse, 0, zRight, zDb);
         k = 0;
       }else{
         pTab = (Table*)sqliteHashData(k);
         k = sqliteHashNext(k);
       }
       if( pTab==0 || pTab->pFKey==0 ) continue;
-      sqlite3TableLock(pParse, iDb, pTab->tnum, 0, pTab->zName);
+      iTabDb = sqlite3SchemaToIndex(db, pTab->pSchema);
+      sqlite3CodeVerifySchema(pParse, iTabDb);
+      sqlite3TableLock(pParse, iTabDb, pTab->tnum, 0, pTab->zName);
       if( pTab->nCol+regRow>pParse->nMem ) pParse->nMem = pTab->nCol + regRow;
-      sqlite3OpenTable(pParse, 0, iDb, pTab, OP_OpenRead);
+      sqlite3OpenTable(pParse, 0, iTabDb, pTab, OP_OpenRead);
       sqlite3VdbeLoadString(v, regResult, pTab->zName);
       for(i=1, pFK=pTab->pFKey; pFK; i++, pFK=pFK->pNextFrom){
         pParent = sqlite3FindTable(db, pFK->zTo, zDb);
         if( pParent==0 ) continue;
         pIdx = 0;
-        sqlite3TableLock(pParse, iDb, pParent->tnum, 0, pParent->zName);
+        sqlite3TableLock(pParse, iTabDb, pParent->tnum, 0, pParent->zName);
         x = sqlite3FkLocateIndex(pParse, pParent, pFK, &pIdx, 0);
         if( x==0 ){
           if( pIdx==0 ){
-            sqlite3OpenTable(pParse, i, iDb, pParent, OP_OpenRead);
+            sqlite3OpenTable(pParse, i, iTabDb, pParent, OP_OpenRead);
           }else{
-            sqlite3VdbeAddOp3(v, OP_OpenRead, i, pIdx->tnum, iDb);
+            sqlite3VdbeAddOp3(v, OP_OpenRead, i, pIdx->tnum, iTabDb);
             sqlite3VdbeSetP4KeyInfo(pParse, pIdx);
           }
         }else{
           k = 0;
           break;
@@ -1367,11 +1374,11 @@
         aiCols = 0;
         if( pParent ){
           x = sqlite3FkLocateIndex(pParse, pParent, pFK, &pIdx, &aiCols);
           assert( x==0 );
         }
-        addrOk = sqlite3VdbeMakeLabel(v);
+        addrOk = sqlite3VdbeMakeLabel(pParse);
 
         /* Generate code to read the child key values into registers
         ** regRow..regRow+n. If any of the child key values are NULL, this 
         ** row cannot cause an FK violation. Jump directly to addrOk in 
         ** this case. */
@@ -1412,23 +1419,10 @@
   }
   break;
 #endif /* !defined(SQLITE_OMIT_TRIGGER) */
 #endif /* !defined(SQLITE_OMIT_FOREIGN_KEY) */
 
-#ifndef NDEBUG
-  case PragTyp_PARSER_TRACE: {
-    if( zRight ){
-      if( sqlite3GetBoolean(zRight, 0) ){
-        sqlite3ParserTrace(stdout, "parser: ");
-      }else{
-        sqlite3ParserTrace(0, 0);
-      }
-    }
-  }
-  break;
-#endif
-
   /* Reinstall the LIKE and GLOB functions.  The variant of LIKE
   ** used will be case sensitive or not depending on the RHS.
   */
   case PragTyp_CASE_SENSITIVE_LIKE: {
     if( zRight ){
@@ -1587,12 +1581,12 @@
         }
         /* Verify CHECK constraints */
         if( pTab->pCheck && (db->flags & SQLITE_IgnoreChecks)==0 ){
           ExprList *pCheck = sqlite3ExprListDup(db, pTab->pCheck, 0);
           if( db->mallocFailed==0 ){
-            int addrCkFault = sqlite3VdbeMakeLabel(v);
-            int addrCkOk = sqlite3VdbeMakeLabel(v);
+            int addrCkFault = sqlite3VdbeMakeLabel(pParse);
+            int addrCkOk = sqlite3VdbeMakeLabel(pParse);
             char *zErr;
             int k;
             pParse->iSelfTab = iDataCur + 1;
             for(k=pCheck->nExpr-1; k>0; k--){
               sqlite3ExprIfFalse(pParse, pCheck->a[k].pExpr, addrCkFault, 0);
@@ -1611,11 +1605,11 @@
         }
         if( !isQuick ){ /* Omit the remaining tests for quick_check */
           /* Validate index entries for the current row */
           for(j=0, pIdx=pTab->pIndex; pIdx; pIdx=pIdx->pNext, j++){
             int jmp2, jmp3, jmp4, jmp5;
-            int ckUniq = sqlite3VdbeMakeLabel(v);
+            int ckUniq = sqlite3VdbeMakeLabel(pParse);
             if( pPk==pIdx ) continue;
             r1 = sqlite3GenerateIndexKey(pParse, pIdx, iDataCur, 0, 0, &jmp3,
                                          pPrior, r1);
             pPrior = pIdx;
             sqlite3VdbeAddOp2(v, OP_AddImm, 8+j, 1);/* increment entry count */
@@ -1632,11 +1626,11 @@
             sqlite3VdbeJumpHere(v, jmp2);
             /* For UNIQUE indexes, verify that only one entry exists with the
             ** current key.  The entry is unique if (1) any column is NULL
             ** or (2) the next entry has a different key */
             if( IsUniqueIndex(pIdx) ){
-              int uniqOk = sqlite3VdbeMakeLabel(v);
+              int uniqOk = sqlite3VdbeMakeLabel(pParse);
               int jmp6;
               int kk;
               for(kk=0; kk<pIdx->nKeyCol; kk++){
                 int iCol = pIdx->aiColumn[kk];
                 assert( iCol!=XN_ROWID && iCol<pTab->nCol );
@@ -2475,11 +2469,12 @@
   0,                           /* xRollback - rollback transaction */
   0,                           /* xFindFunction - function overloading */
   0,                           /* xRename - rename the table */
   0,                           /* xSavepoint */
   0,                           /* xRelease */
-  0                            /* xRollbackTo */
+  0,                           /* xRollbackTo */
+  0                            /* xShadowName */
 };
 
 /*
 ** Check to see if zTabName is really the name of a pragma.  If it is,
 ** then register an eponymous virtual table for that pragma and return

Index: src/pragma.h
==================================================================
--- src/pragma.h
+++ src/pragma.h
@@ -47,12 +47,11 @@
 #define PragTyp_WAL_CHECKPOINT                39
 #define PragTyp_ACTIVATE_EXTENSIONS           40
 #define PragTyp_HEXKEY                        41
 #define PragTyp_KEY                           42
 #define PragTyp_LOCK_STATUS                   43
-#define PragTyp_PARSER_TRACE                  44
-#define PragTyp_STATS                         45
+#define PragTyp_STATS                         44
 
 /* Property flags associated with various pragma. */
 #define PragFlg_NeedSchema 0x01 /* Force schema load before running */
 #define PragFlg_NoColumns  0x02 /* OP_ResultRow called with zero columns */
 #define PragFlg_NoColumns1 0x04 /* zero columns if RHS argument is present */
@@ -209,15 +208,17 @@
   /* ePragFlg:  */ PragFlg_Result0,
   /* ColNames:  */ 0, 0,
   /* iArg:      */ 0 },
 #endif
 #if !defined(SQLITE_OMIT_FLAG_PRAGMAS)
+#if !defined(SQLITE_OMIT_DEPRECATED)
  {/* zName:     */ "count_changes",
   /* ePragTyp:  */ PragTyp_FLAG,
   /* ePragFlg:  */ PragFlg_Result0|PragFlg_NoColumns1,
   /* ColNames:  */ 0, 0,
   /* iArg:      */ SQLITE_CountRows },
+#endif
 #endif
 #if !defined(SQLITE_OMIT_PAGER_PRAGMAS) && SQLITE_OS_WIN
  {/* zName:     */ "data_store_directory",
   /* ePragTyp:  */ PragTyp_DATA_STORE_DIRECTORY,
   /* ePragFlg:  */ PragFlg_NoColumns1,
@@ -236,16 +237,18 @@
   /* ePragTyp:  */ PragTyp_DATABASE_LIST,
   /* ePragFlg:  */ PragFlg_NeedSchema|PragFlg_Result0,
   /* ColNames:  */ 35, 3,
   /* iArg:      */ 0 },
 #endif
-#if !defined(SQLITE_OMIT_PAGER_PRAGMAS) && !defined(SQLITE_OMIT_DEPRECATED)
+#if !defined(SQLITE_OMIT_PAGER_PRAGMAS)
+#if !defined(SQLITE_OMIT_DEPRECATED)
  {/* zName:     */ "default_cache_size",
   /* ePragTyp:  */ PragTyp_DEFAULT_CACHE_SIZE,
   /* ePragFlg:  */ PragFlg_NeedSchema|PragFlg_Result0|PragFlg_SchemaReq|PragFlg_NoColumns1,
   /* ColNames:  */ 45, 1,
   /* iArg:      */ 0 },
+#endif
 #endif
 #if !defined(SQLITE_OMIT_FLAG_PRAGMAS)
 #if !defined(SQLITE_OMIT_FOREIGN_KEY) && !defined(SQLITE_OMIT_TRIGGER)
  {/* zName:     */ "defer_foreign_keys",
   /* ePragTyp:  */ PragTyp_FLAG,
@@ -253,15 +256,17 @@
   /* ColNames:  */ 0, 0,
   /* iArg:      */ SQLITE_DeferFKs },
 #endif
 #endif
 #if !defined(SQLITE_OMIT_FLAG_PRAGMAS)
+#if !defined(SQLITE_OMIT_DEPRECATED)
  {/* zName:     */ "empty_result_callbacks",
   /* ePragTyp:  */ PragTyp_FLAG,
   /* ePragFlg:  */ PragFlg_Result0|PragFlg_NoColumns1,
   /* ColNames:  */ 0, 0,
   /* iArg:      */ SQLITE_NullCallback },
+#endif
 #endif
 #if !defined(SQLITE_OMIT_UTF16)
  {/* zName:     */ "encoding",
   /* ePragTyp:  */ PragTyp_ENCODING,
   /* ePragFlg:  */ PragFlg_Result0|PragFlg_NoColumns1,
@@ -297,15 +302,19 @@
   /* ePragFlg:  */ PragFlg_ReadOnly|PragFlg_Result0,
   /* ColNames:  */ 0, 0,
   /* iArg:      */ BTREE_FREE_PAGE_COUNT },
 #endif
 #if !defined(SQLITE_OMIT_FLAG_PRAGMAS)
+#if !defined(SQLITE_OMIT_DEPRECATED)
  {/* zName:     */ "full_column_names",
   /* ePragTyp:  */ PragTyp_FLAG,
   /* ePragFlg:  */ PragFlg_Result0|PragFlg_NoColumns1,
   /* ColNames:  */ 0, 0,
   /* iArg:      */ SQLITE_FullColNames },
+#endif
+#endif
+#if !defined(SQLITE_OMIT_FLAG_PRAGMAS)
  {/* zName:     */ "fullfsync",
   /* ePragTyp:  */ PragTyp_FLAG,
   /* ePragFlg:  */ PragFlg_Result0|PragFlg_NoColumns1,
   /* ColNames:  */ 0, 0,
   /* iArg:      */ SQLITE_FullFSync },
@@ -459,16 +468,18 @@
   /* ePragTyp:  */ PragTyp_PAGE_SIZE,
   /* ePragFlg:  */ PragFlg_Result0|PragFlg_SchemaReq|PragFlg_NoColumns1,
   /* ColNames:  */ 0, 0,
   /* iArg:      */ 0 },
 #endif
-#if defined(SQLITE_DEBUG) && !defined(SQLITE_OMIT_PARSER_TRACE)
+#if !defined(SQLITE_OMIT_FLAG_PRAGMAS)
+#if defined(SQLITE_DEBUG)
  {/* zName:     */ "parser_trace",
-  /* ePragTyp:  */ PragTyp_PARSER_TRACE,
-  /* ePragFlg:  */ 0,
+  /* ePragTyp:  */ PragTyp_FLAG,
+  /* ePragFlg:  */ PragFlg_Result0|PragFlg_NoColumns1,
   /* ColNames:  */ 0, 0,
-  /* iArg:      */ 0 },
+  /* iArg:      */ SQLITE_ParserTrace },
+#endif
 #endif
 #if defined(SQLITE_INTROSPECTION_PRAGMAS)
  {/* zName:     */ "pragma_list",
   /* ePragTyp:  */ PragTyp_PRAGMA_LIST,
   /* ePragFlg:  */ PragFlg_Result0,
@@ -528,15 +539,17 @@
   /* ePragFlg:  */ PragFlg_Result0,
   /* ColNames:  */ 0, 0,
   /* iArg:      */ 0 },
 #endif
 #if !defined(SQLITE_OMIT_FLAG_PRAGMAS)
+#if !defined(SQLITE_OMIT_DEPRECATED)
  {/* zName:     */ "short_column_names",
   /* ePragTyp:  */ PragTyp_FLAG,
   /* ePragFlg:  */ PragFlg_Result0|PragFlg_NoColumns1,
   /* ColNames:  */ 0, 0,
   /* iArg:      */ SQLITE_ShortColNames },
+#endif
 #endif
  {/* zName:     */ "shrink_memory",
   /* ePragTyp:  */ PragTyp_SHRINK_MEMORY,
   /* ePragFlg:  */ PragFlg_NoColumns,
   /* ColNames:  */ 0, 0,

Index: src/prepare.c
==================================================================
--- src/prepare.c
+++ src/prepare.c
@@ -61,10 +61,23 @@
   }
   if( zRoot ) for(i=0; zRoot[i]; i++) cksum += (cksum<<3) + zRoot[i];
   if( zSql ) for(i=0; zSql[i]; i++) cksum += (cksum<<3) + zSql[i];
   pData->cksum = cksum;
 }
+
+/*
+** Check to see if any sibling index (another index on the same table)
+** of pIndex has the same root page number, and if it does, return true.
+** This would indicate a corrupt schema.
+*/
+int sqlite3IndexHasDuplicateRootPage(Index *pIndex){
+  Index *p;
+  for(p=pIndex->pTable->pIndex; p; p=p->pNext){
+    if( p->tnum==pIndex->tnum && p!=pIndex ) return 1;
+  }
+  return 0;
+}
 
 /*
 ** This is the callback routine for the code that initializes the
 ** database.  See sqlite3Init() below for additional information.
 ** This routine is also called from the OP_ParseSchema opcode of the VDBE.
@@ -83,10 +96,11 @@
 
   assert( argc==3 );
   UNUSED_PARAMETER2(NotUsed, argc);
   assert( sqlite3_mutex_held(db->mutex) );
   DbClearProperty(db, iDb, DB_Empty);
+  pData->nInitRow++;
   if( db->mallocFailed ){
     corruptSchema(pData, argv[0], 0);
     return 1;
   }
 
@@ -136,19 +150,16 @@
     ** been created when we processed the CREATE TABLE.  All we have
     ** to do here is record the root page number for that index.
     */
     Index *pIndex;
     pIndex = sqlite3FindIndex(db, argv[0], db->aDb[iDb].zDbSName);
-    if( pIndex==0 ){
-      /* This can occur if there exists an index on a TEMP table which
-      ** has the same name as another index on a permanent index.  Since
-      ** the permanent table is hidden by the TEMP table, we can also
-      ** safely ignore the index on the permanent table.
-      */
-      /* Do Nothing */;
-    }else if( sqlite3GetInt32(argv[1], &pIndex->tnum)==0 ){
-      corruptSchema(pData, argv[0], "invalid rootpage");
+    if( pIndex==0
+     || sqlite3GetInt32(argv[1],&pIndex->tnum)==0
+     || pIndex->tnum<2
+     || sqlite3IndexHasDuplicateRootPage(pIndex)
+    ){
+      corruptSchema(pData, argv[0], pIndex?"invalid rootpage":"orphan index");
     }
   }
 
   if( iDb!=1 && (db->openFlags & SQLITE_OPEN_REUSE_SCHEMA) ){
     schemaUpdateChecksum(pData, argv[0], argv[1], argv[2]);
@@ -212,10 +223,11 @@
   initData.db = db;
   initData.iDb = iDb;
   initData.rc = SQLITE_OK;
   initData.pzErrMsg = pzErrMsg;
   initData.mInitFlags = mFlags;
+  initData.nInitRow = 0;
   sqlite3InitCallback(&initData, 3, (char **)azArg, 0);
   if( initData.rc ){
     rc = initData.rc;
     goto error_out;
   }
@@ -328,11 +340,11 @@
   ** clear the legacy_file_format pragma flag so that a VACUUM will
   ** not downgrade the database and thus invalidate any descending
   ** indices that the user might have created.
   */
   if( iDb==0 && meta[BTREE_FILE_FORMAT-1]>=4 ){
-    db->flags &= ~SQLITE_LegacyFileFmt;
+    db->flags &= ~(u64)SQLITE_LegacyFileFmt;
   }
 
   /* Read the schema information out of the schema tables
   */
   assert( db->init.busy );
@@ -584,10 +596,11 @@
   */
   if( prepFlags & SQLITE_PREPARE_PERSISTENT ){
     sParse.disableLookaside++;
     db->lookaside.bDisable++;
   }
+  sParse.disableVtab = (prepFlags & SQLITE_PREPARE_NO_VTAB)!=0;
 
   /* Check to verify that it is possible to get a read lock on all
   ** database schemas.  The inability to get a read lock indicates that
   ** some other database connection is holding a write-lock, which in
   ** turn means that the other connection has made uncommitted changes
@@ -762,297 +775,10 @@
   assert( (rc&db->errMask)==rc );
   sqlite3_mutex_leave(db->mutex);
   return rc;
 }
 
-#ifdef SQLITE_ENABLE_NORMALIZE
-/*
-** Checks if the specified token is a table, column, or function name,
-** based on the databases associated with the statement being prepared.
-** If the function fails, zero is returned and pRc is filled with the
-** error code.
-*/
-static int shouldTreatAsIdentifier(
-  sqlite3 *db,        /* Database handle. */
-  const char *zToken, /* Pointer to start of token to be checked */
-  int nToken,         /* Length of token to be checked */
-  int *pRc            /* Pointer to error code upon failure */
-){
-  int bFound = 0;     /* Non-zero if token is an identifier name. */
-  int i, j;           /* Database and column loop indexes. */
-  Schema *pSchema;    /* Schema for current database. */
-  Hash *pHash;        /* Hash table of tables for current database. */
-  HashElem *e;        /* Hash element for hash table iteration. */
-  Table *pTab;        /* Database table for columns being checked. */
-
-  if( sqlite3IsRowidN(zToken, nToken) ){
-    return 1;
-  }
-  if( nToken>0 ){
-    int hash = SQLITE_FUNC_HASH(sqlite3UpperToLower[(u8)zToken[0]], nToken);
-    if( sqlite3FunctionSearchN(hash, zToken, nToken) ) return 1;
-  }
-  assert( db!=0 );
-  sqlite3_mutex_enter(db->mutex);
-  sqlite3BtreeEnterAll(db);
-  for(i=0; i<db->nDb; i++){
-    pHash = &db->aFunc;
-    if( sqlite3HashFindN(pHash, zToken, nToken) ){
-      bFound = 1;
-      break;
-    }
-    pSchema = db->aDb[i].pSchema;
-    if( pSchema==0 ) continue;
-    pHash = &pSchema->tblHash;
-    if( sqlite3HashFindN(pHash, zToken, nToken) ){
-      bFound = 1;
-      break;
-    }
-    for(e=sqliteHashFirst(pHash); e; e=sqliteHashNext(e)){
-      pTab = sqliteHashData(e);
-      if( pTab==0 ) continue;
-      pHash = pTab->pColHash;
-      if( pHash==0 ){
-        pTab->pColHash = pHash = sqlite3_malloc(sizeof(Hash));
-        if( pHash ){
-          sqlite3HashInit(pHash);
-          for(j=0; j<pTab->nCol; j++){
-            Column *pCol = &pTab->aCol[j];
-            sqlite3HashInsert(pHash, pCol->zName, pCol);
-          }
-        }else{
-          *pRc = SQLITE_NOMEM_BKPT;
-          bFound = 0;
-          goto done;
-        }
-      }
-      if( pHash && sqlite3HashFindN(pHash, zToken, nToken) ){
-        bFound = 1;
-        goto done;
-      }
-    }
-  }
-done:
-  sqlite3BtreeLeaveAll(db);
-  sqlite3_mutex_leave(db->mutex);
-  return bFound;
-}
-
-/*
-** Attempt to estimate the final output buffer size needed for the fully
-** normalized version of the specified SQL string.  This should take into
-** account any potential expansion that could occur (e.g. via IN clauses
-** being expanded, etc).  This size returned is the total number of bytes
-** including the NUL terminator.
-*/
-static int estimateNormalizedSize(
-  const char *zSql, /* The original SQL string */
-  int nSql,         /* Length of original SQL string */
-  u8 prepFlags      /* The flags passed to sqlite3_prepare_v3() */
-){
-  int nOut = nSql + 4;
-  const char *z = zSql;
-  while( nOut<nSql*5 ){
-    while( z[0]!=0 && z[0]!='I' && z[0]!='i' ){ z++; }
-    if( z[0]==0 ) break;
-    z++;
-    if( z[0]!='N' && z[0]!='n' ) break;
-    z++;
-    while( sqlite3Isspace(z[0]) ){ z++; }
-    if( z[0]!='(' ) break;
-    z++;
-    nOut += 5; /* ?,?,? */
-  }
-  return nOut;
-}
-
-/*
-** Copy the current token into the output buffer while dealing with quoted
-** identifiers.  By default, all letters will be converted into lowercase.
-** If the bUpper flag is set, uppercase will be used.  The piOut argument
-** will be used to update the target index into the output string.
-*/
-static void copyNormalizedToken(
-  const char *zSql, /* The original SQL string */
-  int iIn,          /* Current index into the original SQL string */
-  int nToken,       /* Number of bytes in the current token */
-  int tokenFlags,   /* Flags returned by the tokenizer */
-  char *zOut,       /* The output string */
-  int *piOut        /* Pointer to target index into the output string */
-){
-  int bQuoted = tokenFlags & SQLITE_TOKEN_QUOTED;
-  int bKeyword = tokenFlags & SQLITE_TOKEN_KEYWORD;
-  int j = *piOut, k = 0;
-  for(; k<nToken; k++){
-    if( bQuoted ){
-      if( k==0 && iIn>0 ){
-        zOut[j++] = '"';
-        continue;
-      }else if( k==nToken-1 ){
-        zOut[j++] = '"';
-        continue;
-      }
-    }
-    if( bKeyword ){
-      zOut[j++] = sqlite3Toupper(zSql[iIn+k]);
-    }else{
-      zOut[j++] = sqlite3Tolower(zSql[iIn+k]);
-    }
-  }
-  *piOut = j;
-}
-
-/*
-** Perform normalization of the SQL contained in the prepared statement and
-** store the result in the zNormSql field.  The schema for the associated
-** databases are consulted while performing the normalization in order to
-** determine if a token appears to be an identifier.  All identifiers are
-** left intact in the normalized SQL and all literals are replaced with a
-** single '?'.
-*/
-void sqlite3Normalize(
-  Vdbe *pVdbe,      /* VM being reprepared */
-  const char *zSql, /* The original SQL string */
-  int nSql,         /* Size of the input string in bytes */
-  u8 prepFlags      /* The flags passed to sqlite3_prepare_v3() */
-){
-  sqlite3 *db;           /* Database handle. */
-  char *z;               /* The output string */
-  int nZ;                /* Size of the output string in bytes */
-  int i;                 /* Next character to read from zSql[] */
-  int j;                 /* Next character to fill in on z[] */
-  int tokenType = 0;     /* Type of the next token */
-  int prevTokenType = 0; /* Type of the previous token, except spaces */
-  int n;                 /* Size of the next token */
-  int nParen = 0;        /* Nesting level of parenthesis */
-  Hash inHash;           /* Table of parenthesis levels to output index. */
-
-  db = sqlite3VdbeDb(pVdbe);
-  assert( db!=0 );
-  assert( pVdbe->zNormSql==0 );
-  if( zSql==0 ) return;
-  nZ = estimateNormalizedSize(zSql, nSql, prepFlags);
-  z = sqlite3DbMallocRawNN(db, nZ);
-  if( z==0 ) return;
-  sqlite3HashInit(&inHash);
-  for(i=j=0; i<nSql && zSql[i]; i+=n){
-    int flags = 0;
-    if( tokenType!=TK_SPACE ) prevTokenType = tokenType;
-    n = sqlite3GetTokenNormalized((unsigned char*)zSql+i, &tokenType, &flags);
-    switch( tokenType ){
-      case TK_SPACE: {
-        break;
-      }
-      case TK_ILLEGAL: {
-        sqlite3DbFree(db, z);
-        sqlite3HashClear(&inHash);
-        return;
-      }
-      case TK_STRING:
-      case TK_INTEGER:
-      case TK_FLOAT:
-      case TK_VARIABLE:
-      case TK_BLOB: {
-        z[j++] = '?';
-        break;
-      }
-      case TK_LP:
-      case TK_RP: {
-        if( tokenType==TK_LP ){
-          nParen++;
-          if( prevTokenType==TK_IN ){
-            assert( nParen<nSql );
-            sqlite3HashInsert(&inHash, zSql+nParen, SQLITE_INT_TO_PTR(j));
-          }
-        }else{
-          int jj;
-          assert( nParen<nSql );
-          jj = SQLITE_PTR_TO_INT(sqlite3HashFind(&inHash, zSql+nParen));
-          if( jj>0 ){
-            sqlite3HashInsert(&inHash, zSql+nParen, 0);
-            assert( jj+6<nZ );
-            memcpy(z+jj+1, "?,?,?", 5);
-            j = jj+6;
-            assert( nZ-1-j>=0 );
-            assert( nZ-1-j<nZ );
-            memset(z+j, 0, nZ-1-j);
-          }
-          nParen--;
-        }
-        assert( nParen>=0 );
-        /* Fall through */
-      }
-      case TK_MINUS:
-      case TK_SEMI:
-      case TK_PLUS:
-      case TK_STAR:
-      case TK_SLASH:
-      case TK_REM:
-      case TK_EQ:
-      case TK_LE:
-      case TK_NE:
-      case TK_LSHIFT:
-      case TK_LT:
-      case TK_RSHIFT:
-      case TK_GT:
-      case TK_GE:
-      case TK_BITOR:
-      case TK_CONCAT:
-      case TK_COMMA:
-      case TK_BITAND:
-      case TK_BITNOT:
-      case TK_DOT:
-      case TK_IN:
-      case TK_IS:
-      case TK_NOT:
-      case TK_NULL:
-      case TK_ID: {
-        if( tokenType==TK_NULL ){
-          if( prevTokenType==TK_IS || prevTokenType==TK_NOT ){
-            /* NULL is a keyword in this case, not a literal value */
-          }else{
-            /* Here the NULL is a literal value */
-            z[j++] = '?';
-            break;
-          }
-        }
-        if( j>0 && sqlite3IsIdChar(z[j-1]) && sqlite3IsIdChar(zSql[i]) ){
-          z[j++] = ' ';
-        }
-        if( tokenType==TK_ID ){
-          int i2 = i, n2 = n, rc = SQLITE_OK;
-          if( nParen>0 ){
-            assert( nParen<nSql );
-            sqlite3HashInsert(&inHash, zSql+nParen, 0);
-          }
-          if( flags&SQLITE_TOKEN_QUOTED ){ i2++; n2-=2; }
-          if( shouldTreatAsIdentifier(db, zSql+i2, n2, &rc)==0 ){
-            if( rc!=SQLITE_OK ){
-              sqlite3DbFree(db, z);
-              sqlite3HashClear(&inHash);
-              return;
-            }
-            if( sqlite3_keyword_check(zSql+i2, n2)==0 ){
-              z[j++] = '?';
-              break;
-            }
-          }
-        }
-        copyNormalizedToken(zSql, i, n, flags, z, &j);
-        break;
-      }
-    }
-  }
-  assert( j<nZ && "one" );
-  while( j>0 && z[j-1]==' ' ){ j--; }
-  if( j>0 && z[j-1]!=';' ){ z[j++] = ';'; }
-  z[j] = 0;
-  assert( j<nZ && "two" );
-  pVdbe->zNormSql = z;
-  sqlite3HashClear(&inHash);
-}
-#endif /* SQLITE_ENABLE_NORMALIZE */
 
 /*
 ** Rerun the compilation of a statement after a schema change.
 **
 ** If the statement is successfully recompiled, return SQLITE_OK. Otherwise,

Index: src/printf.c
==================================================================
--- src/printf.c
+++ src/printf.c
@@ -153,10 +153,31 @@
 static char *getTextArg(PrintfArguments *p){
   if( p->nArg<=p->nUsed ) return 0;
   return (char*)sqlite3_value_text(p->apArg[p->nUsed++]);
 }
 
+/*
+** Allocate memory for a temporary buffer needed for printf rendering.
+**
+** If the requested size of the temp buffer is larger than the size
+** of the output buffer in pAccum, then cause an SQLITE_TOOBIG error.
+** Do the size check before the memory allocation to prevent rogue
+** SQL from requesting large allocations using the precision or width
+** field of the printf() function.
+*/
+static char *printfTempBuf(sqlite3_str *pAccum, sqlite3_int64 n){
+  char *z;
+  if( n>pAccum->nAlloc && n>pAccum->mxAlloc ){
+    setStrAccumError(pAccum, SQLITE_TOOBIG);
+    return 0;
+  }
+  z = sqlite3DbMallocRaw(pAccum->db, n);
+  if( z==0 ){
+    setStrAccumError(pAccum, SQLITE_NOMEM);
+  }
+  return z;
+}
 
 /*
 ** On machines with a small stack size, you can redefine the
 ** SQLITE_PRINT_BUF_SIZE to be something smaller, if desired.
 */
@@ -235,10 +256,13 @@
     }
     /* Find out what flags are present */
     flag_leftjustify = flag_prefix = cThousand =
      flag_alternateform = flag_altform2 = flag_zeropad = 0;
     done = 0;
+    width = 0;
+    flag_long = 0;
+    precision = -1;
     do{
       switch( c ){
         case '-':   flag_leftjustify = 1;     break;
         case '+':   flag_prefix = '+';        break;
         case ' ':   flag_prefix = ' ';        break;
@@ -245,84 +269,97 @@
         case '#':   flag_alternateform = 1;   break;
         case '!':   flag_altform2 = 1;        break;
         case '0':   flag_zeropad = 1;         break;
         case ',':   cThousand = ',';          break;
         default:    done = 1;                 break;
+        case 'l': {
+          flag_long = 1;
+          c = *++fmt;
+          if( c=='l' ){
+            c = *++fmt;
+            flag_long = 2;
+          }
+          done = 1;
+          break;
+        }
+        case '1': case '2': case '3': case '4': case '5':
+        case '6': case '7': case '8': case '9': {
+          unsigned wx = c - '0';
+          while( (c = *++fmt)>='0' && c<='9' ){
+            wx = wx*10 + c - '0';
+          }
+          testcase( wx>0x7fffffff );
+          width = wx & 0x7fffffff;
+#ifdef SQLITE_PRINTF_PRECISION_LIMIT
+          if( width>SQLITE_PRINTF_PRECISION_LIMIT ){
+            width = SQLITE_PRINTF_PRECISION_LIMIT;
+          }
+#endif
+          if( c!='.' && c!='l' ){
+            done = 1;
+          }else{
+            fmt--;
+          }
+          break;
+        }
+        case '*': {
+          if( bArgList ){
+            width = (int)getIntArg(pArgList);
+          }else{
+            width = va_arg(ap,int);
+          }
+          if( width<0 ){
+            flag_leftjustify = 1;
+            width = width >= -2147483647 ? -width : 0;
+          }
+#ifdef SQLITE_PRINTF_PRECISION_LIMIT
+          if( width>SQLITE_PRINTF_PRECISION_LIMIT ){
+            width = SQLITE_PRINTF_PRECISION_LIMIT;
+          }
+#endif
+          if( (c = fmt[1])!='.' && c!='l' ){
+            c = *++fmt;
+            done = 1;
+          }
+          break;
+        }
+        case '.': {
+          c = *++fmt;
+          if( c=='*' ){
+            if( bArgList ){
+              precision = (int)getIntArg(pArgList);
+            }else{
+              precision = va_arg(ap,int);
+            }
+            if( precision<0 ){
+              precision = precision >= -2147483647 ? -precision : -1;
+            }
+            c = *++fmt;
+          }else{
+            unsigned px = 0;
+            while( c>='0' && c<='9' ){
+              px = px*10 + c - '0';
+              c = *++fmt;
+            }
+            testcase( px>0x7fffffff );
+            precision = px & 0x7fffffff;
+          }
+#ifdef SQLITE_PRINTF_PRECISION_LIMIT
+          if( precision>SQLITE_PRINTF_PRECISION_LIMIT ){
+            precision = SQLITE_PRINTF_PRECISION_LIMIT;
+          }
+#endif
+          if( c=='l' ){
+            --fmt;
+          }else{
+            done = 1;
+          }
+          break;
+        }
       }
     }while( !done && (c=(*++fmt))!=0 );
-    /* Get the field width */
-    if( c=='*' ){
-      if( bArgList ){
-        width = (int)getIntArg(pArgList);
-      }else{
-        width = va_arg(ap,int);
-      }
-      if( width<0 ){
-        flag_leftjustify = 1;
-        width = width >= -2147483647 ? -width : 0;
-      }
-      c = *++fmt;
-    }else{
-      unsigned wx = 0;
-      while( c>='0' && c<='9' ){
-        wx = wx*10 + c - '0';
-        c = *++fmt;
-      }
-      testcase( wx>0x7fffffff );
-      width = wx & 0x7fffffff;
-    }
-    assert( width>=0 );
-#ifdef SQLITE_PRINTF_PRECISION_LIMIT
-    if( width>SQLITE_PRINTF_PRECISION_LIMIT ){
-      width = SQLITE_PRINTF_PRECISION_LIMIT;
-    }
-#endif
-
-    /* Get the precision */
-    if( c=='.' ){
-      c = *++fmt;
-      if( c=='*' ){
-        if( bArgList ){
-          precision = (int)getIntArg(pArgList);
-        }else{
-          precision = va_arg(ap,int);
-        }
-        c = *++fmt;
-        if( precision<0 ){
-          precision = precision >= -2147483647 ? -precision : -1;
-        }
-      }else{
-        unsigned px = 0;
-        while( c>='0' && c<='9' ){
-          px = px*10 + c - '0';
-          c = *++fmt;
-        }
-        testcase( px>0x7fffffff );
-        precision = px & 0x7fffffff;
-      }
-    }else{
-      precision = -1;
-    }
-    assert( precision>=(-1) );
-#ifdef SQLITE_PRINTF_PRECISION_LIMIT
-    if( precision>SQLITE_PRINTF_PRECISION_LIMIT ){
-      precision = SQLITE_PRINTF_PRECISION_LIMIT;
-    }
-#endif
-
-
-    /* Get the conversion type modifier */
-    if( c=='l' ){
-      flag_long = 1;
-      c = *++fmt;
-      if( c=='l' ){
-        flag_long = 2;
-        c = *++fmt;
-      }
-    }else{
-      flag_long = 0;
-    }
+
     /* Fetch the info entry for the field */
     infop = &fmtinfo[0];
     xtype = etINVALID;
     for(idx=0; idx<ArraySize(fmtinfo); idx++){
       if( c==fmtinfo[idx].fmttype ){
@@ -403,16 +440,15 @@
         }
         if( precision<etBUFSIZE-10-etBUFSIZE/3 ){
           nOut = etBUFSIZE;
           zOut = buf;
         }else{
-          u64 n = (u64)precision + 10 + precision/3;
-          zOut = zExtra = sqlite3Malloc( n );
-          if( zOut==0 ){
-            setStrAccumError(pAccum, SQLITE_NOMEM);
-            return;
-          }
+          u64 n;
+          n = (u64)precision + 10;
+          if( cThousand ) n += precision/3;
+          zOut = zExtra = printfTempBuf(pAccum, n);
+          if( zOut==0 ) return;
           nOut = (int)n;
         }
         bufpt = &zOut[nOut-1];
         if( xtype==etORDINAL ){
           static const char zOrd[] = "thstndrd";
@@ -527,16 +563,16 @@
         if( xtype==etEXP ){
           e2 = 0;
         }else{
           e2 = exp;
         }
-        if( MAX(e2,0)+(i64)precision+(i64)width > etBUFSIZE - 15 ){
-          bufpt = zExtra 
-              = sqlite3Malloc( MAX(e2,0)+(i64)precision+(i64)width+15 );
-          if( bufpt==0 ){
-            setStrAccumError(pAccum, SQLITE_NOMEM);
-            return;
+        {
+          i64 szBufNeeded;           /* Size of a temporary buffer needed */
+          szBufNeeded = MAX(e2,0)+(i64)precision+(i64)width+15;
+          if( szBufNeeded > etBUFSIZE ){
+            bufpt = zExtra = printfTempBuf(pAccum, szBufNeeded);
+            if( bufpt==0 ) return;
           }
         }
         zOut = bufpt;
         nsd = 16 + flag_altform2*10;
         flag_dp = (precision>0 ?1:0) | flag_alternateform | flag_altform2;
@@ -756,15 +792,12 @@
           }
         }
         needQuote = !isnull && xtype==etSQLESCAPE2;
         n += i + 3;
         if( n>etBUFSIZE ){
-          bufpt = zExtra = sqlite3Malloc( n );
-          if( bufpt==0 ){
-            setStrAccumError(pAccum, SQLITE_NOMEM);
-            return;
-          }
+          bufpt = zExtra = printfTempBuf(pAccum, n);
+          if( bufpt==0 ) return;
         }else{
           bufpt = buf;
         }
         j = 0;
         if( needQuote ) bufpt[j++] = q;

Index: src/resolve.c
==================================================================
--- src/resolve.c
+++ src/resolve.c
@@ -78,11 +78,10 @@
   if( pDup!=0 ){
     if( zType[0]!='G' ) incrAggFunctionDepth(pDup, nSubquery);
     if( pExpr->op==TK_COLLATE ){
       pDup = sqlite3ExprAddCollateString(pParse, pDup, pExpr->u.zToken);
     }
-    ExprSetProperty(pDup, EP_Alias);
 
     /* Before calling sqlite3ExprDelete(), set the EP_Static flag. This 
     ** prevents ExprDelete() from deleting the Expr structure itself,
     ** allowing it to be repopulated by the memcpy() on the following line.
     ** The pExpr->u.zToken might point into memory that will be freed by the
@@ -472,10 +471,29 @@
   ** fields are not changed in any context.
   */
   if( cnt==0 && zTab==0 ){
     assert( pExpr->op==TK_ID );
     if( ExprHasProperty(pExpr,EP_DblQuoted) ){
+      /* If a double-quoted identifier does not match any known column name,
+      ** then treat it as a string.
+      **
+      ** This hack was added in the early days of SQLite in a misguided attempt
+      ** to be compatible with MySQL 3.x, which used double-quotes for strings.
+      ** I now sorely regret putting in this hack. The effect of this hack is
+      ** that misspelled identifier names are silently converted into strings
+      ** rather than causing an error, to the frustration of countless
+      ** programmers. To all those frustrated programmers, my apologies.
+      **
+      ** Someday, I hope to get rid of this hack. Unfortunately there is
+      ** a huge amount of legacy SQL that uses it. So for now, we just
+      ** issue a warning.
+      */
+      sqlite3_log(SQLITE_WARNING,
+        "double-quoted string literal: \"%w\"", zCol);
+#ifdef SQLITE_ENABLE_NORMALIZE
+      sqlite3VdbeAddDblquoteStr(db, pParse->pVdbe, zCol);
+#endif
       pExpr->op = TK_STRING;
       pExpr->y.pTab = 0;
       return WRC_Prune;
     }
     if( sqlite3ExprIdToTrueFalse(pExpr) ){
@@ -769,10 +787,19 @@
           ** sqlite_version() that might change over time cannot be used
           ** in an index. */
           notValid(pParse, pNC, "non-deterministic functions",
                    NC_IdxExpr|NC_PartIdx);
         }
+        if( (pDef->funcFlags & SQLITE_FUNC_INTERNAL)!=0
+         && pParse->nested==0
+         && sqlite3Config.bInternalFunctions==0
+        ){
+          /* Internal-use-only functions are disallowed unless the
+          ** SQL is being compiled using sqlite3NestedParse() */
+          no_such_func = 1;
+          pDef = 0;
+        }
       }
 
       if( 0==IN_RENAME_OBJECT ){
 #ifndef SQLITE_OMIT_WINDOWFUNC
         assert( is_agg==0 || (pDef->funcFlags & SQLITE_FUNC_MINMAX)
@@ -829,14 +856,14 @@
       sqlite3WalkExprList(pWalker, pList);
       if( is_agg ){
 #ifndef SQLITE_OMIT_WINDOWFUNC
         if( pExpr->y.pWin ){
           Select *pSel = pNC->pWinSelect;
+          sqlite3WindowUpdate(pParse, pSel->pWinDefn, pExpr->y.pWin, pDef);
           sqlite3WalkExprList(pWalker, pExpr->y.pWin->pPartition);
           sqlite3WalkExprList(pWalker, pExpr->y.pWin->pOrderBy);
           sqlite3WalkExpr(pWalker, pExpr->y.pWin->pFilter);
-          sqlite3WindowUpdate(pParse, pSel->pWinDefn, pExpr->y.pWin, pDef);
           if( 0==pSel->pWin 
            || 0==sqlite3WindowCompare(pParse, pSel->pWin, pExpr->y.pWin) 
           ){
             pExpr->y.pWin->pNextWin = pSel->pWin;
             pSel->pWin = pExpr->y.pWin;
@@ -1109,36 +1136,57 @@
           return 1;
         }
       }else{
         iCol = resolveAsName(pParse, pEList, pE);
         if( iCol==0 ){
-          pDup = sqlite3ExprDup(db, pE, 0);
+          /* Now test if expression pE matches one of the values returned
+          ** by pSelect. In the usual case this is done by duplicating the 
+          ** expression, resolving any symbols in it, and then comparing
+          ** it against each expression returned by the SELECT statement.
+          ** Once the comparisons are finished, the duplicate expression
+          ** is deleted.
+          **
+          ** Or, if this is running as part of an ALTER TABLE operation,
+          ** resolve the symbols in the actual expression, not a duplicate.
+          ** And, if one of the comparisons is successful, leave the expression
+          ** as is instead of transforming it to an integer as in the usual
+          ** case. This allows the code in alter.c to modify column
+          ** refererences within the ORDER BY expression as required.  */
+          if( IN_RENAME_OBJECT ){
+            pDup = pE;
+          }else{
+            pDup = sqlite3ExprDup(db, pE, 0);
+          }
           if( !db->mallocFailed ){
             assert(pDup);
             iCol = resolveOrderByTermToExprList(pParse, pSelect, pDup);
           }
-          sqlite3ExprDelete(db, pDup);
+          if( !IN_RENAME_OBJECT ){
+            sqlite3ExprDelete(db, pDup);
+          }
         }
       }
       if( iCol>0 ){
         /* Convert the ORDER BY term into an integer column number iCol,
         ** taking care to preserve the COLLATE clause if it exists */
-        Expr *pNew = sqlite3Expr(db, TK_INTEGER, 0);
-        if( pNew==0 ) return 1;
-        pNew->flags |= EP_IntValue;
-        pNew->u.iValue = iCol;
-        if( pItem->pExpr==pE ){
-          pItem->pExpr = pNew;
-        }else{
-          Expr *pParent = pItem->pExpr;
-          assert( pParent->op==TK_COLLATE );
-          while( pParent->pLeft->op==TK_COLLATE ) pParent = pParent->pLeft;
-          assert( pParent->pLeft==pE );
-          pParent->pLeft = pNew;
-        }
-        sqlite3ExprDelete(db, pE);
-        pItem->u.x.iOrderByCol = (u16)iCol;
+        if( !IN_RENAME_OBJECT ){
+          Expr *pNew = sqlite3Expr(db, TK_INTEGER, 0);
+          if( pNew==0 ) return 1;
+          pNew->flags |= EP_IntValue;
+          pNew->u.iValue = iCol;
+          if( pItem->pExpr==pE ){
+            pItem->pExpr = pNew;
+          }else{
+            Expr *pParent = pItem->pExpr;
+            assert( pParent->op==TK_COLLATE );
+            while( pParent->pLeft->op==TK_COLLATE ) pParent = pParent->pLeft;
+            assert( pParent->pLeft==pE );
+            pParent->pLeft = pNew;
+          }
+          sqlite3ExprDelete(db, pE);
+          pItem->u.x.iOrderByCol = (u16)iCol;
+        }
         pItem->done = 1;
       }else{
         moreToDo = 1;
       }
     }
@@ -1482,10 +1530,21 @@
               "the GROUP BY clause");
           return WRC_Abort;
         }
       }
     }
+
+    if( IN_RENAME_OBJECT ){
+      Window *pWin;
+      for(pWin=p->pWinDefn; pWin; pWin=pWin->pNextWin){
+        if( sqlite3ResolveExprListNames(&sNC, pWin->pOrderBy)
+         || sqlite3ResolveExprListNames(&sNC, pWin->pPartition)
+        ){
+          return WRC_Abort;
+        }
+      }
+    }
 
     /* If this is part of a compound SELECT, check that it has the right
     ** number of expressions in the select list. */
     if( p->pNext && p->pEList->nExpr!=p->pNext->pEList->nExpr ){
       sqlite3SelectWrongNumTermsError(pParse, p->pNext);
@@ -1633,38 +1692,47 @@
   w.u.pNC = pOuterNC;
   sqlite3WalkSelect(&w, p);
 }
 
 /*
-** Resolve names in expressions that can only reference a single table:
+** Resolve names in expressions that can only reference a single table
+** or which cannot reference any tables at all.  Examples:
 **
-**    *   CHECK constraints
-**    *   WHERE clauses on partial indices
+**    (1)   CHECK constraints
+**    (2)   WHERE clauses on partial indices
+**    (3)   Expressions in indexes on expressions
+**    (4)   Expression arguments to VACUUM INTO.
 **
-** The Expr.iTable value for Expr.op==TK_COLUMN nodes of the expression
-** is set to -1 and the Expr.iColumn value is set to the column number.
+** In all cases except (4), the Expr.iTable value for Expr.op==TK_COLUMN
+** nodes of the expression is set to -1 and the Expr.iColumn value is
+** set to the column number.  In case (4), TK_COLUMN nodes cause an error.
 **
 ** Any errors cause an error message to be set in pParse.
 */
-void sqlite3ResolveSelfReference(
+int sqlite3ResolveSelfReference(
   Parse *pParse,      /* Parsing context */
-  Table *pTab,        /* The table being referenced */
-  int type,           /* NC_IsCheck or NC_PartIdx or NC_IdxExpr */
+  Table *pTab,        /* The table being referenced, or NULL */
+  int type,           /* NC_IsCheck or NC_PartIdx or NC_IdxExpr, or 0 */
   Expr *pExpr,        /* Expression to resolve.  May be NULL. */
   ExprList *pList     /* Expression list to resolve.  May be NULL. */
 ){
   SrcList sSrc;                   /* Fake SrcList for pParse->pNewTable */
   NameContext sNC;                /* Name context for pParse->pNewTable */
+  int rc;
 
-  assert( type==NC_IsCheck || type==NC_PartIdx || type==NC_IdxExpr );
+  assert( type==0 || pTab!=0 );
+  assert( type==NC_IsCheck || type==NC_PartIdx || type==NC_IdxExpr || pTab==0 );
   memset(&sNC, 0, sizeof(sNC));
   memset(&sSrc, 0, sizeof(sSrc));
-  sSrc.nSrc = 1;
-  sSrc.a[0].zName = pTab->zName;
-  sSrc.a[0].pTab = pTab;
-  sSrc.a[0].iCursor = -1;
+  if( pTab ){
+    sSrc.nSrc = 1;
+    sSrc.a[0].zName = pTab->zName;
+    sSrc.a[0].pTab = pTab;
+    sSrc.a[0].iCursor = -1;
+  }
   sNC.pParse = pParse;
   sNC.pSrcList = &sSrc;
   sNC.ncFlags = type;
-  if( sqlite3ResolveExprNames(&sNC, pExpr) ) return;
-  if( pList ) sqlite3ResolveExprListNames(&sNC, pList);
+  if( (rc = sqlite3ResolveExprNames(&sNC, pExpr))!=SQLITE_OK ) return rc;
+  if( pList ) rc = sqlite3ResolveExprListNames(&sNC, pList);
+  return rc;
 }

Index: src/select.c
==================================================================
--- src/select.c
+++ src/select.c
@@ -629,11 +629,11 @@
     regBase = pParse->nMem + 1;
     pParse->nMem += nBase;
   }
   assert( pSelect->iOffset==0 || pSelect->iLimit!=0 );
   iLimit = pSelect->iOffset ? pSelect->iOffset+1 : pSelect->iLimit;
-  pSort->labelDone = sqlite3VdbeMakeLabel(v);
+  pSort->labelDone = sqlite3VdbeMakeLabel(pParse);
   sqlite3ExprCodeExprList(pParse, pSort->pOrderBy, regBase, regOrigData,
                           SQLITE_ECEL_DUP | (regOrigData? SQLITE_ECEL_REF : 0));
   if( bSeq ){
     sqlite3VdbeAddOp2(v, OP_Sequence, pSort->iECursor, regBase+nExpr);
   }
@@ -668,11 +668,11 @@
     testcase( pKI->nAllField > pKI->nKeyField+2 );
     pOp->p4.pKeyInfo = sqlite3KeyInfoFromExprList(pParse,pSort->pOrderBy,nOBSat,
                                            pKI->nAllField-pKI->nKeyField-1);
     addrJmp = sqlite3VdbeCurrentAddr(v);
     sqlite3VdbeAddOp3(v, OP_Jump, addrJmp+1, 0, addrJmp+1); VdbeCoverage(v);
-    pSort->labelBkOut = sqlite3VdbeMakeLabel(v);
+    pSort->labelBkOut = sqlite3VdbeMakeLabel(pParse);
     pSort->regReturn = ++pParse->nMem;
     sqlite3VdbeAddOp2(v, OP_Gosub, pSort->regReturn, pSort->labelBkOut);
     sqlite3VdbeAddOp1(v, OP_ResetSorter, pSort->iECursor);
     if( iLimit ){
       sqlite3VdbeAddOp2(v, OP_IfNot, iLimit, pSort->labelDone);
@@ -1415,11 +1415,11 @@
   int nColumn,      /* Number of columns of data */
   SelectDest *pDest /* Write the sorted results here */
 ){
   Vdbe *v = pParse->pVdbe;                     /* The prepared statement */
   int addrBreak = pSort->labelDone;            /* Jump here to exit loop */
-  int addrContinue = sqlite3VdbeMakeLabel(v);  /* Jump here for next cycle */
+  int addrContinue = sqlite3VdbeMakeLabel(pParse);/* Jump here for next cycle */
   int addr;                       /* Top of output loop. Jump for Next. */
   int addrOnce = 0;
   int iTab;
   ExprList *pOrderBy = pSort->pOrderBy;
   int eDest = pDest->eDest;
@@ -1455,11 +1455,16 @@
   if( eDest==SRT_Output || eDest==SRT_Coroutine || eDest==SRT_Mem ){
     regRowid = 0;
     regRow = pDest->iSdst;
   }else{
     regRowid = sqlite3GetTempReg(pParse);
-    regRow = sqlite3GetTempRange(pParse, nColumn);
+    if( eDest==SRT_EphemTab || eDest==SRT_Table ){
+      regRow = sqlite3GetTempReg(pParse);
+      nColumn = 0;
+    }else{
+      regRow = sqlite3GetTempRange(pParse, nColumn);
+    }
   }
   nKey = pOrderBy->nExpr - pSort->nOBSat;
   if( pSort->sortFlags & SORTFLAG_UseSorter ){
     int regSortOut = ++pParse->nMem;
     iSortTab = pParse->nTab++;
@@ -1535,10 +1540,11 @@
     }
   }
   switch( eDest ){
     case SRT_Table:
     case SRT_EphemTab: {
+      sqlite3VdbeAddOp3(v, OP_Column, iSortTab, nKey+bSeq, regRow);
       sqlite3VdbeAddOp2(v, OP_NewRowid, iParm, regRowid);
       sqlite3VdbeAddOp3(v, OP_Insert, iParm, regRow, regRowid);
       sqlite3VdbeChangeP5(v, OPFLAG_APPEND);
       break;
     }
@@ -2075,19 +2081,19 @@
 ** the result set of that SELECT.
 */
 Table *sqlite3ResultSetOfSelect(Parse *pParse, Select *pSelect){
   Table *pTab;
   sqlite3 *db = pParse->db;
-  int savedFlags;
+  u64 savedFlags;
 
   savedFlags = db->flags;
-  db->flags &= ~SQLITE_FullColNames;
+  db->flags &= ~(u64)SQLITE_FullColNames;
   db->flags |= SQLITE_ShortColNames;
   sqlite3SelectPrep(pParse, pSelect, 0);
+  db->flags = savedFlags;
   if( pParse->nErr ) return 0;
   while( pSelect->pPrior ) pSelect = pSelect->pPrior;
-  db->flags = savedFlags;
   pTab = sqlite3DbMallocZero(db, sizeof(Table) );
   if( pTab==0 ){
     return 0;
   }
   /* The sqlite3ResultSetOfSelect() is only used n contexts where lookaside
@@ -2327,11 +2333,11 @@
 
   /* Obtain authorization to do a recursive query */
   if( sqlite3AuthCheck(pParse, SQLITE_RECURSIVE, 0, 0, 0) ) return;
 
   /* Process the LIMIT and OFFSET clauses, if they exist */
-  addrBreak = sqlite3VdbeMakeLabel(v);
+  addrBreak = sqlite3VdbeMakeLabel(pParse);
   p->nSelectRow = 320;  /* 4 billion rows */
   computeLimitRegisters(pParse, p, addrBreak);
   pLimit = p->pLimit;
   regLimit = p->iLimit;
   regOffset = p->iOffset;
@@ -2397,11 +2403,11 @@
     sqlite3VdbeAddOp2(v, OP_RowData, iQueue, regCurrent);
   }
   sqlite3VdbeAddOp1(v, OP_Delete, iQueue);
 
   /* Output the single row in Current */
-  addrCont = sqlite3VdbeMakeLabel(v);
+  addrCont = sqlite3VdbeMakeLabel(pParse);
   codeOffset(v, regOffset, addrCont);
   selectInnerLoop(pParse, p, iCurrent,
       0, 0, pDest, addrCont, addrBreak);
   if( regLimit ){
     sqlite3VdbeAddOp2(v, OP_DecrJumpZero, regLimit, addrBreak);
@@ -2705,12 +2711,12 @@
         */
         assert( unionTab==dest.iSDParm || dest.eDest!=priorOp );
         if( dest.eDest!=priorOp ){
           int iCont, iBreak, iStart;
           assert( p->pEList );
-          iBreak = sqlite3VdbeMakeLabel(v);
-          iCont = sqlite3VdbeMakeLabel(v);
+          iBreak = sqlite3VdbeMakeLabel(pParse);
+          iCont = sqlite3VdbeMakeLabel(pParse);
           computeLimitRegisters(pParse, p, iBreak);
           sqlite3VdbeAddOp2(v, OP_Rewind, unionTab, iBreak); VdbeCoverage(v);
           iStart = sqlite3VdbeCurrentAddr(v);
           selectInnerLoop(pParse, p, unionTab,
                           0, 0, &dest, iCont, iBreak);
@@ -2774,12 +2780,12 @@
   
         /* Generate code to take the intersection of the two temporary
         ** tables.
         */
         assert( p->pEList );
-        iBreak = sqlite3VdbeMakeLabel(v);
-        iCont = sqlite3VdbeMakeLabel(v);
+        iBreak = sqlite3VdbeMakeLabel(pParse);
+        iCont = sqlite3VdbeMakeLabel(pParse);
         computeLimitRegisters(pParse, p, iBreak);
         sqlite3VdbeAddOp2(v, OP_Rewind, tab1, iBreak); VdbeCoverage(v);
         r1 = sqlite3GetTempReg(pParse);
         iStart = sqlite3VdbeAddOp2(v, OP_RowData, tab1, r1);
         sqlite3VdbeAddOp4Int(v, OP_NotFound, tab2, iCont, r1, 0);
@@ -2905,11 +2911,11 @@
   Vdbe *v = pParse->pVdbe;
   int iContinue;
   int addr;
 
   addr = sqlite3VdbeCurrentAddr(v);
-  iContinue = sqlite3VdbeMakeLabel(v);
+  iContinue = sqlite3VdbeMakeLabel(pParse);
 
   /* Suppress duplicates for UNION, EXCEPT, and INTERSECT 
   */
   if( regPrev ){
     int addr1, addr2;
@@ -3142,12 +3148,12 @@
   assert( p->pOrderBy!=0 );
   assert( pKeyDup==0 ); /* "Managed" code needs this.  Ticket #3382. */
   db = pParse->db;
   v = pParse->pVdbe;
   assert( v!=0 );       /* Already thrown the error if VDBE alloc failed */
-  labelEnd = sqlite3VdbeMakeLabel(v);
-  labelCmpr = sqlite3VdbeMakeLabel(v);
+  labelEnd = sqlite3VdbeMakeLabel(pParse);
+  labelCmpr = sqlite3VdbeMakeLabel(pParse);
 
 
   /* Patch up the ORDER BY clause
   */
   op = p->op;  
@@ -3459,10 +3465,11 @@
           ifNullRow.op = TK_IF_NULL_ROW;
           ifNullRow.pLeft = pCopy;
           ifNullRow.iTable = pSubst->iNewTable;
           pCopy = &ifNullRow;
         }
+        testcase( ExprHasProperty(pCopy, EP_Subquery) );
         pNew = sqlite3ExprDup(db, pCopy, 0);
         if( pNew && pSubst->isLeftJoin ){
           ExprSetProperty(pNew, EP_CanBeNull);
         }
         if( pNew && ExprHasProperty(pExpr,EP_FromJoin) ){
@@ -3951,15 +3958,13 @@
     if( pSrc ){
       assert( pParent==p );  /* First time through the loop */
       jointype = pSubitem->fg.jointype;
     }else{
       assert( pParent!=p );  /* 2nd and subsequent times through the loop */
-      pSrc = pParent->pSrc = sqlite3SrcListAppend(db, 0, 0, 0);
-      if( pSrc==0 ){
-        assert( db->mallocFailed );
-        break;
-      }
+      pSrc = sqlite3SrcListAppend(pParse, 0, 0, 0);
+      if( pSrc==0 ) break;
+      pParent->pSrc = pSrc;
     }
 
     /* The subquery uses a single slot of the FROM clause of the outer
     ** query.  If the subquery has more than one element in its FROM clause,
     ** then expand the outer query to make space for it to hold all elements
@@ -3974,14 +3979,13 @@
     ** block of code will expand the outer query FROM clause to 4 slots.
     ** The middle slot is expanded to two slots in order to make space
     ** for the two elements in the FROM clause of the subquery.
     */
     if( nSubSrc>1 ){
-      pParent->pSrc = pSrc = sqlite3SrcListEnlarge(db, pSrc, nSubSrc-1,iFrom+1);
-      if( db->mallocFailed ){
-        break;
-      }
+      pSrc = sqlite3SrcListEnlarge(pParse, pSrc, nSubSrc-1,iFrom+1);
+      if( pSrc==0 ) break;
+      pParent->pSrc = pSrc;
     }
 
     /* Transfer the FROM clause terms from the subquery into the
     ** outer query.
     */
@@ -4023,11 +4027,12 @@
       }
       assert( pParent->pOrderBy==0 );
       pParent->pOrderBy = pOrderBy;
       pSub->pOrderBy = 0;
     }
-    pWhere = sqlite3ExprDup(db, pSub->pWhere, 0);
+    pWhere = pSub->pWhere;
+    pSub->pWhere = 0;
     if( isLeftJoin>0 ){
       setJoinExpr(pWhere, iNewParent);
     }
     pParent->pWhere = sqlite3ExprAnd(db, pWhere, pParent->pWhere);
     if( db->mallocFailed==0 ){
@@ -5326,11 +5331,11 @@
     }else{
       nArg = 0;
       regAgg = 0;
     }
     if( pF->iDistinct>=0 ){
-      addrNext = sqlite3VdbeMakeLabel(v);
+      addrNext = sqlite3VdbeMakeLabel(pParse);
       testcase( nArg==0 );  /* Error condition */
       testcase( nArg>1 );   /* Also an error */
       codeDistinct(pParse, pF->iDistinct, addrNext, 1, regAgg);
     }
     if( pF->pFunc->funcFlags & SQLITE_FUNC_NEEDCOLL ){
@@ -5462,18 +5467,23 @@
   SrcList *pTabList,           /* Search for self-joins in this FROM clause */
   struct SrcList_item *pThis   /* Search for prior reference to this subquery */
 ){
   struct SrcList_item *pItem;
   for(pItem = pTabList->a; pItem<pThis; pItem++){
+    Select *pS1;
     if( pItem->pSelect==0 ) continue;
     if( pItem->fg.viaCoroutine ) continue;
     if( pItem->zName==0 ) continue;
     if( sqlite3_stricmp(pItem->zDatabase, pThis->zDatabase)!=0 ) continue;
     if( sqlite3_stricmp(pItem->zName, pThis->zName)!=0 ) continue;
-    if( sqlite3ExprCompare(0, 
-          pThis->pSelect->pWhere, pItem->pSelect->pWhere, -1) 
-    ){
+    pS1 = pItem->pSelect;
+    if( pThis->pSelect->selId!=pS1->selId ){
+      /* The query flattener left two different CTE tables with identical
+      ** names in the same FROM clause. */
+      continue;
+    }
+    if( sqlite3ExprCompare(0, pThis->pSelect->pWhere, pS1->pWhere, -1) ){
       /* The view was modified by some other optimization such as
       ** pushDownWhereTerms() */
       continue;
     }
     return pItem;
@@ -5826,26 +5836,16 @@
     /* Generate code for all sub-queries in the FROM clause
     */
     pSub = pItem->pSelect;
     if( pSub==0 ) continue;
 
-    /* Sometimes the code for a subquery will be generated more than
-    ** once, if the subquery is part of the WHERE clause in a LEFT JOIN,
-    ** for example.  In that case, do not regenerate the code to manifest
-    ** a view or the co-routine to implement a view.  The first instance
-    ** is sufficient, though the subroutine to manifest the view does need
-    ** to be invoked again. */
-    if( pItem->addrFillSub ){
-      if( pItem->fg.viaCoroutine==0 ){
-        /* The subroutine that manifests the view might be a one-time routine,
-        ** or it might need to be rerun on each iteration because it
-        ** encodes a correlated subquery. */
-        testcase( sqlite3VdbeGetOp(v, pItem->addrFillSub)->opcode==OP_Once );
-        sqlite3VdbeAddOp2(v, OP_Gosub, pItem->regReturn, pItem->addrFillSub);
-      }
-      continue;
-    }
+    /* The code for a subquery should only be generated once, though it is
+    ** technically harmless for it to be generated multiple times. The
+    ** following assert() will detect if something changes to cause
+    ** the same subquery to be coded multiple times, as a signal to the
+    ** developers to try to optimize the situation. */
+    assert( pItem->addrFillSub==0 );
 
     /* Increment Parse.nHeight by the height of the largest expression
     ** tree referred to by this, the parent select. The child select
     ** may contain expression trees of at most
     ** (SQLITE_MAX_EXPR_DEPTH-Parse.nHeight) height. This is a bit
@@ -6029,11 +6029,11 @@
     sqlite3VdbeAddOp2(v, OP_OpenEphemeral, pDest->iSDParm, pEList->nExpr);
   }
 
   /* Set the limiter.
   */
-  iEnd = sqlite3VdbeMakeLabel(v);
+  iEnd = sqlite3VdbeMakeLabel(pParse);
   if( (p->selFlags & SF_FixedLimit)==0 ){
     p->nSelectRow = 320;  /* 4 billion rows */
   }
   computeLimitRegisters(pParse, p, iEnd);
   if( p->iLimit==0 && sSort.addrSortIndex>=0 ){
@@ -6096,13 +6096,13 @@
     }
 
     assert( p->pEList==pEList );
 #ifndef SQLITE_OMIT_WINDOWFUNC
     if( pWin ){
-      int addrGosub = sqlite3VdbeMakeLabel(v);
-      int iCont = sqlite3VdbeMakeLabel(v);
-      int iBreak = sqlite3VdbeMakeLabel(v);
+      int addrGosub = sqlite3VdbeMakeLabel(pParse);
+      int iCont = sqlite3VdbeMakeLabel(pParse);
+      int iBreak = sqlite3VdbeMakeLabel(pParse);
       int regGosub = ++pParse->nMem;
 
       sqlite3WindowCodeStep(pParse, p, pWInfo, regGosub, addrGosub);
 
       sqlite3VdbeAddOp2(v, OP_Goto, 0, iBreak);
@@ -6173,11 +6173,11 @@
     if( sqlite3ExprListCompare(pGroupBy, sSort.pOrderBy, -1)==0 ){
       orderByGrp = 1;
     }
  
     /* Create a label to jump to when we want to abort the query */
-    addrEnd = sqlite3VdbeMakeLabel(v);
+    addrEnd = sqlite3VdbeMakeLabel(pParse);
 
     /* Convert TK_COLUMN nodes into TK_AGG_COLUMN and make entries in
     ** sAggInfo for all TK_AGG_FUNCTION nodes in expressions of the
     ** SELECT statement.
     */
@@ -6262,13 +6262,13 @@
       /* Initialize memory locations used by GROUP BY aggregate processing
       */
       iUseFlag = ++pParse->nMem;
       iAbortFlag = ++pParse->nMem;
       regOutputRow = ++pParse->nMem;
-      addrOutputRow = sqlite3VdbeMakeLabel(v);
+      addrOutputRow = sqlite3VdbeMakeLabel(pParse);
       regReset = ++pParse->nMem;
-      addrReset = sqlite3VdbeMakeLabel(v);
+      addrReset = sqlite3VdbeMakeLabel(pParse);
       iAMem = pParse->nMem + 1;
       pParse->nMem += pGroupBy->nExpr;
       iBMem = pParse->nMem + 1;
       pParse->nMem += pGroupBy->nExpr;
       sqlite3VdbeAddOp2(v, OP_Integer, 0, iAbortFlag);

Index: src/shell.c.in
==================================================================
--- src/shell.c.in
+++ src/shell.c.in
@@ -136,10 +136,13 @@
 #  define access(f,m) _access((f),(m))
 # endif
 # ifndef unlink
 #  define unlink _unlink
 # endif
+# ifndef strdup
+#  define strdup _strdup
+# endif
 # undef popen
 # define popen _popen
 # undef pclose
 # define pclose _pclose
 #else
@@ -935,10 +938,11 @@
 #endif
 INCLUDE ../ext/misc/shathree.c
 INCLUDE ../ext/misc/fileio.c
 INCLUDE ../ext/misc/completion.c
 INCLUDE ../ext/misc/appendvfs.c
+INCLUDE ../ext/misc/memtrace.c
 #ifdef SQLITE_HAVE_ZLIB
 INCLUDE ../ext/misc/zipfile.c
 INCLUDE ../ext/misc/sqlar.c
 #endif
 INCLUDE ../ext/expert/sqlite3expert.h
@@ -1000,18 +1004,22 @@
 struct ShellState {
   sqlite3 *db;           /* The database */
   u8 autoExplain;        /* Automatically turn on .explain mode */
   u8 autoEQP;            /* Run EXPLAIN QUERY PLAN prior to seach SQL stmt */
   u8 autoEQPtest;        /* autoEQP is in test mode */
+  u8 autoEQPtrace;       /* autoEQP is in trace mode */
   u8 statsOn;            /* True to display memory stats before each finalize */
   u8 scanstatsOn;        /* True to display scan stats before each finalize */
   u8 openMode;           /* SHELL_OPEN_NORMAL, _APPENDVFS, or _ZIPFILE */
   u8 doXdgOpen;          /* Invoke start/open/xdg-open in output_reset() */
   u8 nEqpLevel;          /* Depth of the EQP output graph */
+  u8 eTraceType;         /* SHELL_TRACE_* value for type of trace */
   unsigned mEqpLines;    /* Mask of veritical lines in the EQP output graph */
   int outCount;          /* Revert to stdout when reaching zero */
   int cnt;               /* Number of records displayed so far */
+  int lineno;            /* Line number of last line read from in */
+  FILE *in;              /* Read commands from this stream */
   FILE *out;             /* Write results here */
   FILE *traceOut;        /* Output for sqlite3_trace() */
   int nErr;              /* Number of errors seen */
   int mode;              /* An output mode setting */
   int modePrior;         /* Saved mode */
@@ -1018,11 +1026,15 @@
   int cMode;             /* temporary output mode for the current query */
   int normalMode;        /* Output mode before ".explain on" */
   int writableSchema;    /* True if PRAGMA writable_schema=ON */
   int showHeader;        /* True to show column names in List or Column mode */
   int nCheck;            /* Number of ".check" commands run */
+  unsigned nProgress;    /* Number of progress callbacks encountered */
+  unsigned mxProgress;   /* Maximum progress callbacks before failing */
+  unsigned flgProgress;  /* Flags for the progress callback */
   unsigned shellFlgs;    /* Various flags */
+  sqlite3_int64 szMax;   /* --maxsize argument to .open */
   char *zDestTable;      /* Name of destination table when MODE_Insert */
   char *zTempFile;       /* Temporary file that might need deleting */
   char zTestcase[30];    /* Name of current test case */
   char colSeparator[20]; /* Column separator character for several modes */
   char rowSeparator[20]; /* Row separator character for MODE_Ascii */
@@ -1063,11 +1075,25 @@
 #define SHELL_OPEN_NORMAL      1      /* Normal database file */
 #define SHELL_OPEN_APPENDVFS   2      /* Use appendvfs */
 #define SHELL_OPEN_ZIPFILE     3      /* Use the zipfile virtual table */
 #define SHELL_OPEN_READONLY    4      /* Open a normal database read-only */
 #define SHELL_OPEN_DESERIALIZE 5      /* Open using sqlite3_deserialize() */
-#define SHELL_OPEN_REUSESCHEMA 6      /* Open for schema reuse */
+#define SHELL_OPEN_HEXDB       6      /* Use "dbtotxt" output as data source */
+#define SHELL_OPEN_REUSESCHEMA 7      /* Open for schema reuse */
+
+/* Allowed values for ShellState.eTraceType
+*/
+#define SHELL_TRACE_PLAIN      0      /* Show input SQL text */
+#define SHELL_TRACE_EXPANDED   1      /* Show expanded SQL text */
+#define SHELL_TRACE_NORMALIZED 2      /* Show normalized SQL text */
+
+/* Bits in the ShellState.flgProgress variable */
+#define PROGRESS_QUIET   0x01         /* Omit announcing every progress callback */
+#define PROGRESS_RESET   0x02         /* Reset the count when the progres
+                                      ** callback limit is reached, and for each
+                                      ** top-level SQL statement */
+#define PROGRESS_ONCE    0x04         /* Cancel the --limit after firing once */
 
 /*
 ** These are the allowed shellFlgs values
 */
 #define SHFLG_Pagecache      0x00000001 /* The --pagecache option is used */
@@ -1764,10 +1790,28 @@
     p->sGraph.zPrefix[0] = 0;
     eqp_render_level(p, 0);
     eqp_reset(p);
   }
 }
+
+/*
+** Progress handler callback.
+*/
+static int progress_handler(void *pClientData) {
+  ShellState *p = (ShellState*)pClientData;
+  p->nProgress++;
+  if( p->nProgress>=p->mxProgress && p->mxProgress>0 ){
+    raw_printf(p->out, "Progress limit reached (%u)\n", p->nProgress);
+    if( p->flgProgress & PROGRESS_RESET ) p->nProgress = 0;
+    if( p->flgProgress & PROGRESS_ONCE ) p->mxProgress = 0;
+    return 1;
+  }
+  if( (p->flgProgress & PROGRESS_QUIET)==0 ){
+    raw_printf(p->out, "Progress %u\n", p->nProgress);
+  }
+  return 0;
+}
 
 /*
 ** This is the callback routine that the shell
 ** invokes for each row of a query result.
 */
@@ -3369,10 +3413,11 @@
 #ifndef SQLITE_OMIT_AUTHORIZATION
   ".auth ON|OFF             Show authorizer callbacks",
 #endif
   ".backup ?DB? FILE        Backup DB (default \"main\") to FILE",
   "       --append            Use the appendvfs",
+  "       --async             Write to FILE without a journal and without fsync()",
   ".bail on|off             Stop after hitting an error.  Default OFF",
   ".binary on|off           Turn binary output on or off.  Default OFF",
   ".cd DIRECTORY            Change the working directory to DIRECTORY",
   ".changes on|off          Show number of rows changed by SQL",
   ".check GLOB              Fail if output since .testcase does not match",
@@ -3384,11 +3429,17 @@
   "   Options:",
   "     --preserve-rowids      Include ROWID values in the output",
   "     --newlines             Allow unescaped newline characters in output",
   "   TABLE is LIKE pattern for the tables to dump",
   ".echo on|off             Turn command echo on or off",
-  ".eqp on|off|full         Enable or disable automatic EXPLAIN QUERY PLAN",
+  ".eqp on|off|full|...     Enable or disable automatic EXPLAIN QUERY PLAN",
+  "   Other Modes:",
+#ifdef SQLITE_DEBUG
+  "      test                  Show raw EXPLAIN QUERY PLAN output",
+  "      trace                 Like \"full\" but also enable \"PRAGMA vdbe_trace\"",
+#endif
+  "      trigger               Like \"full\" but also show trigger bytecode",
   ".excel                   Display the output of next command in a spreadsheet",
   ".exit ?CODE?             Exit this program with return-code CODE",
   ".expert                  EXPERIMENTAL. Suggest indexes for specified queries",
 /* Because explain mode comes on automatically now, the ".explain" mode
 ** is removed from the help screen.  It is still supported for legacy, however */
@@ -3435,17 +3486,24 @@
   ".open ?OPTIONS? ?FILE?   Close existing database and reopen FILE",
   "     Options:",
   "        --append        Use appendvfs to append database to the end of FILE",
 #ifdef SQLITE_ENABLE_DESERIALIZE
   "        --deserialize   Load into memory useing sqlite3_deserialize()",
+  "        --hexdb         Load the output of \"dbtotxt\" as an in-memory database",
+  "        --maxsize N     Maximum size for --hexdb or --deserialized database",
 #endif
   "        --new           Initialize FILE to an empty database",
   "        --readonly      Open FILE readonly",
   "        --zip           FILE is a ZIP archive",
   ".output ?FILE?           Send output to FILE or stdout if FILE is omitted",
   "     If FILE begins with '|' then open it as a pipe.",
   ".print STRING...         Print literal STRING",
+  ".progress N              Invoke progress handler after every N opcodes",
+  "   --limit N                 Interrupt after N progress callbacks",
+  "   --once                    Do no more than one progress interrupt",
+  "   --quiet|-q                No output except at interrupts",
+  "   --reset                   Reset the count for each input and interrupt",
   ".prompt MAIN CONTINUE    Replace the standard prompts",
   ".quit                    Exit this program",
   ".read FILE               Read input from FILE",
   ".restore ?DB? FILE       Restore content of DB (default \"main\") from FILE",
   ".save FILE               Write in-memory database into FILE",
@@ -3491,11 +3549,26 @@
 #endif
   ".tables ?TABLE?          List names of tables matching LIKE pattern TABLE",
   ".testcase NAME           Begin redirecting output to 'testcase-out.txt'",
   ".timeout MS              Try opening locked tables for MS milliseconds",
   ".timer on|off            Turn SQL timer on or off",
-  ".trace FILE|off          Output each SQL statement as it is run",
+#ifndef SQLITE_OMIT_TRACE
+  ".trace ?OPTIONS?         Output each SQL statement as it is run",
+  "    FILE                    Send output to FILE",
+  "    stdout                  Send output to stdout",
+  "    stderr                  Send output to stderr",
+  "    off                     Disable tracing",
+  "    --expanded              Expand query parameters",
+#ifdef SQLITE_ENABLE_NORMALIZE
+  "    --normalized            Normal the SQL statements",
+#endif
+  "    --plain                 Show SQL as it is input",
+  "    --stmt                  Trace statement execution (SQLITE_TRACE_STMT)",
+  "    --profile               Profile statements (SQLITE_TRACE_PROFILE)",
+  "    --row                   Trace each row (SQLITE_TRACE_ROW)",
+  "    --close                 Trace connection close (SQLITE_TRACE_CLOSE)",
+#endif /* SQLITE_OMIT_TRACE */
   ".vfsinfo ?AUX?           Information about the top-level VFS",
   ".vfslist                 List all available VFSes",
   ".vfsname ?AUX?           Print the name of the VFS stack",
   ".width NUM1 NUM2 ...     Set column widths for \"column\" mode",
   "     Negative values right-justify",
@@ -3569,11 +3642,11 @@
   }
   return n;
 }
 
 /* Forward reference */
-static int process_input(ShellState *p, FILE *in);
+static int process_input(ShellState *p);
 
 /*
 ** Read the content of file zName into memory obtained from sqlite3_malloc64()
 ** and return a pointer to the buffer. The caller is responsible for freeing
 ** the memory.
@@ -3699,10 +3772,98 @@
   }
   fclose(f);
   return rc;  
 }
 
+#ifdef SQLITE_ENABLE_DESERIALIZE
+/*
+** Reconstruct an in-memory database using the output from the "dbtotxt"
+** program.  Read content from the file in p->zDbFilename.  If p->zDbFilename
+** is 0, then read from standard input.
+*/
+static unsigned char *readHexDb(ShellState *p, int *pnData){
+  unsigned char *a = 0;
+  int nLine;
+  int n = 0;
+  int pgsz = 0;
+  int iOffset = 0;
+  int j, k;
+  int rc;
+  FILE *in;
+  unsigned char x[16];
+  char zLine[1000];
+  if( p->zDbFilename ){
+    in = fopen(p->zDbFilename, "r");
+    if( in==0 ){
+      utf8_printf(stderr, "cannot open \"%s\" for reading\n", p->zDbFilename);
+      return 0;
+    }
+    nLine = 0;
+  }else{
+    in = p->in;
+    nLine = p->lineno;
+  }
+  *pnData = 0;
+  nLine++;
+  if( fgets(zLine, sizeof(zLine), in)==0 ) goto readHexDb_error;
+  rc = sscanf(zLine, "| size %d pagesize %d", &n, &pgsz);
+  if( rc!=2 ) goto readHexDb_error;
+  if( n<=0 ) goto readHexDb_error;
+  a = sqlite3_malloc( n );
+  if( a==0 ){
+    utf8_printf(stderr, "Out of memory!\n");
+    goto readHexDb_error;
+  }
+  memset(a, 0, n);
+  if( pgsz<512 || pgsz>65536 || (pgsz & (pgsz-1))!=0 ){
+    utf8_printf(stderr, "invalid pagesize\n");
+    goto readHexDb_error;
+  }
+  for(nLine++; fgets(zLine, sizeof(zLine), in)!=0; nLine++){
+    rc = sscanf(zLine, "| page %d offset %d", &j, &k);
+    if( rc==2 ){
+      iOffset = k;
+      continue;
+    }
+    if( strncmp(zLine, "| end ", 6)==0 ){
+      break;
+    }
+    rc = sscanf(zLine,"| %d: %hhx %hhx %hhx %hhx %hhx %hhx %hhx %hhx"
+                      "  %hhx %hhx %hhx %hhx %hhx %hhx %hhx %hhx",
+                &j, &x[0], &x[1], &x[2], &x[3], &x[4], &x[5], &x[6], &x[7],
+                &x[8], &x[9], &x[10], &x[11], &x[12], &x[13], &x[14], &x[15]);
+    if( rc==17 ){
+      k = iOffset+j;
+      if( k+16<=n ){
+        memcpy(a+k, x, 16);
+      }
+    }
+  }
+  *pnData = n;
+  if( in!=p->in ){
+    fclose(in);
+  }else{
+    p->lineno = nLine;
+  }
+  return a;
+
+readHexDb_error:
+  if( in!=stdin ){
+    fclose(in);
+  }else{
+    while( fgets(zLine, sizeof(zLine), p->in)!=0 ){
+      nLine++;
+      if(strncmp(zLine, "| end ", 6)==0 ) break;
+    }
+    p->lineno = nLine;
+  }
+  sqlite3_free(a);
+  utf8_printf(stderr,"Error on line %d of --hexdb input\n", nLine);
+  return 0;
+}
+#endif /* SQLITE_ENABLE_DESERIALIZE */
+
 /* Flags for open_db().
 **
 ** The default behavior of open_db() is to exit(1) if the database fails to
 ** open.  The OPEN_DB_KEEPALIVE flag changes that so that it prints an error
 ** but still returns without calling exit.
@@ -3732,10 +3893,11 @@
       case SHELL_OPEN_APPENDVFS: {
         sqlite3_open_v2(p->zDbFilename, &p->db, 
            SQLITE_OPEN_READWRITE|SQLITE_OPEN_CREATE, "apndvfs");
         break;
       }
+      case SHELL_OPEN_HEXDB:
       case SHELL_OPEN_DESERIALIZE: {
         sqlite3_open(0, &p->db);
         break;
       }
       case SHELL_OPEN_ZIPFILE: {
@@ -3759,11 +3921,14 @@
     }
     globalDb = p->db;
     if( p->db==0 || SQLITE_OK!=sqlite3_errcode(p->db) ){
       utf8_printf(stderr,"Error: unable to open database \"%s\": %s\n",
           p->zDbFilename, sqlite3_errmsg(p->db));
-      if( openFlags & OPEN_DB_KEEPALIVE ) return;
+      if( openFlags & OPEN_DB_KEEPALIVE ){
+        sqlite3_open(":memory:", &p->db);
+        return;
+      }
       exit(1);
     }
 #ifndef SQLITE_OMIT_LOAD_EXTENSION
     sqlite3_enable_load_extension(p->db, 1);
 #endif
@@ -3791,19 +3956,33 @@
          "CREATE VIRTUAL TABLE zip USING zipfile(%Q);", p->zDbFilename);
       sqlite3_exec(p->db, zSql, 0, 0, 0);
       sqlite3_free(zSql);
     }
 #ifdef SQLITE_ENABLE_DESERIALIZE
-    else if( p->openMode==SHELL_OPEN_DESERIALIZE ){
+    else
+    if( p->openMode==SHELL_OPEN_DESERIALIZE || p->openMode==SHELL_OPEN_HEXDB ){
+      int rc;
       int nData = 0;
-      unsigned char *aData = (unsigned char*)readFile(p->zDbFilename, &nData);
-      int rc = sqlite3_deserialize(p->db, "main", aData, nData, nData,
+      unsigned char *aData;
+      if( p->openMode==SHELL_OPEN_DESERIALIZE ){
+        aData = (unsigned char*)readFile(p->zDbFilename, &nData);
+      }else{
+        aData = readHexDb(p, &nData);
+        if( aData==0 ){
+          utf8_printf(stderr, "Error in hexdb input\n");
+          return;
+        }
+      }
+      rc = sqlite3_deserialize(p->db, "main", aData, nData, nData,
                    SQLITE_DESERIALIZE_RESIZEABLE |
                    SQLITE_DESERIALIZE_FREEONCLOSE);
       if( rc ){
         utf8_printf(stderr, "Error: sqlite3_deserialize() returns %d\n", rc);
       }
+      if( p->szMax>0 ){
+        sqlite3_file_control(p->db, "main", SQLITE_FCNTL_SIZE_LIMIT, &p->szMax);
+      }
     }
 #endif
   }
 }
 
@@ -4003,28 +4182,64 @@
     }
   }
   return f;
 }
 
-#if !defined(SQLITE_OMIT_TRACE) && !defined(SQLITE_OMIT_FLOATING_POINT)
+#ifndef SQLITE_OMIT_TRACE
 /*
 ** A routine for handling output from sqlite3_trace().
 */
 static int sql_trace_callback(
-  unsigned mType,
-  void *pArg,
-  void *pP,
-  void *pX
+  unsigned mType,         /* The trace type */
+  void *pArg,             /* The ShellState pointer */
+  void *pP,               /* Usually a pointer to sqlite_stmt */
+  void *pX                /* Auxiliary output */
 ){
-  FILE *f = (FILE*)pArg;
-  UNUSED_PARAMETER(mType);
-  UNUSED_PARAMETER(pP);
-  if( f ){
-    const char *z = (const char*)pX;
-    int i = strlen30(z);
-    while( i>0 && z[i-1]==';' ){ i--; }
-    utf8_printf(f, "%.*s;\n", i, z);
+  ShellState *p = (ShellState*)pArg;
+  sqlite3_stmt *pStmt;
+  const char *zSql;
+  int nSql;
+  if( p->traceOut==0 ) return 0;
+  if( mType==SQLITE_TRACE_CLOSE ){
+    utf8_printf(p->traceOut, "-- closing database connection\n");
+    return 0;
+  }
+  if( mType!=SQLITE_TRACE_ROW && ((const char*)pX)[0]=='-' ){
+    zSql = (const char*)pX;
+  }else{
+    pStmt = (sqlite3_stmt*)pP;
+    switch( p->eTraceType ){
+      case SHELL_TRACE_EXPANDED: {
+        zSql = sqlite3_expanded_sql(pStmt);
+        break;
+      }
+#ifdef SQLITE_ENABLE_NORMALIZE
+      case SHELL_TRACE_NORMALIZED: {
+        zSql = sqlite3_normalized_sql(pStmt);
+        break;
+      }
+#endif
+      default: {
+        zSql = sqlite3_sql(pStmt);
+        break;
+      }
+    }
+  }
+  if( zSql==0 ) return 0;
+  nSql = strlen30(zSql);
+  while( nSql>0 && zSql[nSql-1]==';' ){ nSql--; }
+  switch( mType ){
+    case SQLITE_TRACE_ROW:
+    case SQLITE_TRACE_STMT: {
+      utf8_printf(p->traceOut, "%.*s;\n", nSql, zSql);
+      break;
+    }
+    case SQLITE_TRACE_PROFILE: {
+      sqlite3_int64 nNanosec = *(sqlite3_int64*)pX;
+      utf8_printf(p->traceOut, "%.*s; -- %lld ns\n", nSql, zSql, nNanosec);
+      break;
+    }
   }
   return 0;
 }
 #endif
 
@@ -5587,11 +5802,11 @@
     rc = arExecSql(pAr, zSql2);
     sqlite3_free(zSql2);
   }
 end_ar_transaction:
   if( rc!=SQLITE_OK ){
-    arExecSql(pAr, "ROLLBACK TO ar; RELEASE ar;");
+    sqlite3_exec(pAr->db, "ROLLBACK TO ar; RELEASE ar;", 0, 0, 0);
   }else{
     rc = arExecSql(pAr, "RELEASE ar;");
     if( pAr->bZip && pAr->zFile ){
       zSql = sqlite3_mprintf("DROP TABLE %s", zTemp);
       arExecSql(pAr, zSql);
@@ -5786,17 +6001,21 @@
     const char *zDestFile = 0;
     const char *zDb = 0;
     sqlite3 *pDest;
     sqlite3_backup *pBackup;
     int j;
+    int bAsync = 0;
     const char *zVfs = 0;
     for(j=1; j<nArg; j++){
       const char *z = azArg[j];
       if( z[0]=='-' ){
         if( z[1]=='-' ) z++;
         if( strcmp(z, "-append")==0 ){
           zVfs = "apndvfs";
+        }else
+        if( strcmp(z, "-async")==0 ){
+          bAsync = 1;
         }else
         {
           utf8_printf(stderr, "unknown option: %s\n", azArg[j]);
           return 1;
         }
@@ -5804,11 +6023,11 @@
         zDestFile = azArg[j];
       }else if( zDb==0 ){
         zDb = zDestFile;
         zDestFile = azArg[j];
       }else{
-        raw_printf(stderr, "Usage: .backup ?DB? ?--append? FILENAME\n");
+        raw_printf(stderr, "Usage: .backup ?DB? ?OPTIONS? FILENAME\n");
         return 1;
       }
     }
     if( zDestFile==0 ){
       raw_printf(stderr, "missing FILENAME argument on .backup\n");
@@ -5820,10 +6039,14 @@
     if( rc!=SQLITE_OK ){
       utf8_printf(stderr, "Error: cannot open \"%s\"\n", zDestFile);
       close_db(pDest);
       return 1;
     }
+    if( bAsync ){
+      sqlite3_exec(pDest, "PRAGMA synchronous=OFF; PRAGMA journal_mode=OFF;",
+                   0, 0, 0);
+    }
     open_db(p, 0);
     pBackup = sqlite3_backup_init(pDest, "main", p->db, zDb);
     if( pBackup==0 ){
       utf8_printf(stderr, "Error: %s\n", sqlite3_errmsg(pDest));
       close_db(pDest);
@@ -6085,22 +6308,34 @@
   }else
 
   if( c=='e' && strncmp(azArg[0], "eqp", n)==0 ){
     if( nArg==2 ){
       p->autoEQPtest = 0;
+      if( p->autoEQPtrace ){
+        if( p->db ) sqlite3_exec(p->db, "PRAGMA vdbe_trace=OFF;", 0, 0, 0);
+        p->autoEQPtrace = 0;
+      }
       if( strcmp(azArg[1],"full")==0 ){
         p->autoEQP = AUTOEQP_full;
       }else if( strcmp(azArg[1],"trigger")==0 ){
         p->autoEQP = AUTOEQP_trigger;
+#ifdef SQLITE_DEBUG
       }else if( strcmp(azArg[1],"test")==0 ){
         p->autoEQP = AUTOEQP_on;
         p->autoEQPtest = 1;
+      }else if( strcmp(azArg[1],"trace")==0 ){
+        p->autoEQP = AUTOEQP_full;
+        p->autoEQPtrace = 1;
+        open_db(p, 0);
+        sqlite3_exec(p->db, "SELECT name FROM sqlite_master LIMIT 1", 0, 0, 0);
+        sqlite3_exec(p->db, "PRAGMA vdbe_trace=ON;", 0, 0, 0);
+#endif
       }else{
         p->autoEQP = (u8)booleanValue(azArg[1]);
       }
     }else{
-      raw_printf(stderr, "Usage: .eqp off|on|trigger|full\n");
+      raw_printf(stderr, "Usage: .eqp off|on|trace|trigger|full\n");
       rc = 1;
     }
   }else
 
   if( c=='e' && strncmp(azArg[0], "exit", n)==0 ){
@@ -6670,10 +6905,11 @@
     p->db = 0;
     p->zDbFilename = 0;
     sqlite3_free(p->zFreeOnClose);
     p->zFreeOnClose = 0;
     p->openMode = SHELL_OPEN_UNSPEC;
+    p->szMax = 0;
     /* Check for command-line arguments */
     for(iName=1; iName<nArg && azArg[iName][0]=='-'; iName++){
       const char *z = azArg[iName];
       if( optionMatch(z,"new") ){
         newFlag = 1;
@@ -6689,20 +6925,24 @@
         p->openMode = SHELL_OPEN_REUSESCHEMA;
       }else if( z[0]=='-' ){
 #ifdef SQLITE_ENABLE_DESERIALIZE
       }else if( optionMatch(z, "deserialize") ){
         p->openMode = SHELL_OPEN_DESERIALIZE;
-#endif
+      }else if( optionMatch(z, "hexdb") ){
+        p->openMode = SHELL_OPEN_HEXDB;
+      }else if( optionMatch(z, "maxsize") && iName+1<nArg ){
+        p->szMax = integerValue(azArg[++iName]);
+#endif /* SQLITE_ENABLE_DESERIALIZE */
       }else if( z[0]=='-' ){
         utf8_printf(stderr, "unknown option: %s\n", z);
         rc = 1;
         goto meta_command_exit;
       }
     }
     /* If a filename is specified, try to open it first */
     zNewFilename = nArg>iName ? sqlite3_mprintf("%s", azArg[iName]) : 0;
-    if( zNewFilename ){
+    if( zNewFilename || p->openMode==SHELL_OPEN_HEXDB ){
       if( newFlag ) shellDeleteFile(zNewFilename);
       p->zDbFilename = zNewFilename;
       open_db(p, OPEN_DB_KEEPALIVE);
       if( p->db==0 ){
         utf8_printf(stderr, "Error: cannot open '%s'\n", zNewFilename);
@@ -6799,10 +7039,54 @@
       if( i>1 ) raw_printf(p->out, " ");
       utf8_printf(p->out, "%s", azArg[i]);
     }
     raw_printf(p->out, "\n");
   }else
+
+  if( c=='p' && n>=3 && strncmp(azArg[0], "progress", n)==0 ){
+    int i;
+    int n = 0;
+    p->flgProgress = 0;
+    p->mxProgress = 0;
+    p->nProgress = 0;
+    for(i=1; i<nArg; i++){
+      const char *z = azArg[i];
+      if( z[0]=='-' ){
+        z++;
+        if( z[0]=='-' ) z++;
+        if( strcmp(z,"quiet")==0 || strcmp(z,"q")==0 ){
+          p->flgProgress |= PROGRESS_QUIET;
+          continue;
+        }
+        if( strcmp(z,"reset")==0 ){
+          p->flgProgress |= PROGRESS_RESET;
+          continue;
+        }
+        if( strcmp(z,"once")==0 ){
+          p->flgProgress |= PROGRESS_ONCE;
+          continue;
+        }
+        if( strcmp(z,"limit")==0 ){
+          if( i+1>=nArg ){
+            utf8_printf(stderr, "Error: missing argument on --limit\n");
+            rc = 1;
+            goto meta_command_exit;
+          }else{
+            p->mxProgress = (int)integerValue(azArg[++i]);
+          }
+          continue;
+        }
+        utf8_printf(stderr, "Error: unknown option: \"%s\"\n", azArg[i]);
+        rc = 1;
+        goto meta_command_exit;
+      }else{
+        n = (int)integerValue(z);
+      }
+    }
+    open_db(p, 0);
+    sqlite3_progress_handler(p->db, n, progress_handler, p);
+  }else
 
   if( c=='p' && strncmp(azArg[0], "prompt", n)==0 ){
     if( nArg >= 2) {
       strncpy(mainPrompt,azArg[1],(int)ArraySize(mainPrompt)-1);
     }
@@ -6814,24 +7098,27 @@
   if( c=='q' && strncmp(azArg[0], "quit", n)==0 ){
     rc = 2;
   }else
 
   if( c=='r' && n>=3 && strncmp(azArg[0], "read", n)==0 ){
-    FILE *alt;
+    FILE *inSaved = p->in;
+    int savedLineno = p->lineno;
     if( nArg!=2 ){
       raw_printf(stderr, "Usage: .read FILE\n");
       rc = 1;
       goto meta_command_exit;
     }
-    alt = fopen(azArg[1], "rb");
-    if( alt==0 ){
+    p->in = fopen(azArg[1], "rb");
+    if( p->in==0 ){
       utf8_printf(stderr,"Error: cannot open \"%s\"\n", azArg[1]);
       rc = 1;
     }else{
-      rc = process_input(p, alt);
-      fclose(alt);
+      rc = process_input(p);
+      fclose(p->in);
     }
+    p->in = inSaved;
+    p->lineno = savedLineno;
   }else
 
   if( c=='r' && n>=3 && strncmp(azArg[0], "restore", n)==0 ){
     const char *zSrcFile;
     const char *zDb;
@@ -7684,10 +7971,11 @@
     /*{ "benign_malloc_hooks",SQLITE_TESTCTRL_BENIGN_MALLOC_HOOKS, ""          },*/
     /*{ "bitvec_test",        SQLITE_TESTCTRL_BITVEC_TEST,   ""                },*/
       { "byteorder",          SQLITE_TESTCTRL_BYTEORDER,     ""                   },
     /*{ "fault_install",      SQLITE_TESTCTRL_FAULT_INSTALL, ""                }, */
       { "imposter",           SQLITE_TESTCTRL_IMPOSTER,   "SCHEMA ON/OFF ROOTPAGE"},
+      { "internal_functions", SQLITE_TESTCTRL_INTERNAL_FUNCTIONS, "BOOLEAN"       },
       { "localtime_fault",    SQLITE_TESTCTRL_LOCALTIME_FAULT,"BOOLEAN"           },
       { "never_corrupt",      SQLITE_TESTCTRL_NEVER_CORRUPT, "BOOLEAN"            },
       { "optimizations",      SQLITE_TESTCTRL_OPTIMIZATIONS, "DISABLE-MASK"       },
 #ifdef YYCOVERAGE
       { "parser_coverage",    SQLITE_TESTCTRL_PARSER_COVERAGE, ""                 },
@@ -7778,10 +8066,11 @@
           break;
 
         /* sqlite3_test_control(int, int) */
         case SQLITE_TESTCTRL_ASSERT:
         case SQLITE_TESTCTRL_ALWAYS:
+        case SQLITE_TESTCTRL_INTERNAL_FUNCTIONS:
           if( nArg==3 ){
             int opt = booleanValue(azArg[2]);
             rc2 = sqlite3_test_control(testctrl, opt);
             isOk = 1;
           }
@@ -7843,27 +8132,59 @@
       raw_printf(stderr, "Usage: .timer on|off\n");
       rc = 1;
     }
   }else
 
+#ifndef SQLITE_OMIT_TRACE
   if( c=='t' && strncmp(azArg[0], "trace", n)==0 ){
+    int mType = 0;
+    int jj;
     open_db(p, 0);
-    if( nArg!=2 ){
-      raw_printf(stderr, "Usage: .trace FILE|off\n");
-      rc = 1;
-      goto meta_command_exit;
-    }
-    output_file_close(p->traceOut);
-    p->traceOut = output_file_open(azArg[1], 0);
-#if !defined(SQLITE_OMIT_TRACE) && !defined(SQLITE_OMIT_FLOATING_POINT)
+    for(jj=1; jj<nArg; jj++){
+      const char *z = azArg[jj];
+      if( z[0]=='-' ){
+        if( optionMatch(z, "expanded") ){
+          p->eTraceType = SHELL_TRACE_EXPANDED;
+        }
+#ifdef SQLITE_ENABLE_NORMALIZE
+        else if( optionMatch(z, "normalized") ){
+          p->eTraceType = SHELL_TRACE_NORMALIZED;
+        }
+#endif
+        else if( optionMatch(z, "plain") ){
+          p->eTraceType = SHELL_TRACE_PLAIN;
+        }
+        else if( optionMatch(z, "profile") ){
+          mType |= SQLITE_TRACE_PROFILE;
+        }
+        else if( optionMatch(z, "row") ){
+          mType |= SQLITE_TRACE_ROW;
+        }
+        else if( optionMatch(z, "stmt") ){
+          mType |= SQLITE_TRACE_STMT;
+        }
+        else if( optionMatch(z, "close") ){
+          mType |= SQLITE_TRACE_CLOSE;
+        }
+        else {
+          raw_printf(stderr, "Unknown option \"%s\" on \".trace\"\n", z);
+          rc = 1;
+          goto meta_command_exit;
+        }
+      }else{
+        output_file_close(p->traceOut);
+        p->traceOut = output_file_open(azArg[1], 0);
+      }
+    }
     if( p->traceOut==0 ){
       sqlite3_trace_v2(p->db, 0, 0, 0);
     }else{
-      sqlite3_trace_v2(p->db, SQLITE_TRACE_STMT, sql_trace_callback,p->traceOut);
+      if( mType==0 ) mType = SQLITE_TRACE_STMT;
+      sqlite3_trace_v2(p->db, mType, sql_trace_callback, p);
     }
-#endif
   }else
+#endif /* !defined(SQLITE_OMIT_TRACE) */
 
 #if SQLITE_USER_AUTHENTICATION
   if( c=='u' && strncmp(azArg[0], "user", n)==0 ){
     if( nArg<2 ){
       raw_printf(stderr, "Usage: .user SUBCOMMAND ...\n");
@@ -8072,11 +8393,11 @@
 ** the shell is compiled with SQLITE_OMIT_COMPLETE.  The default assumes
 ** any arbitrary text is a complete SQL statement.  This is not very
 ** user-friendly, but it does seem to work.
 */
 #ifdef SQLITE_OMIT_COMPLETE
-int sqlite3_complete(const char *zSql){ return 1; }
+#define sqlite3_complete(x) 1
 #endif
 
 /*
 ** Return true if zSql is a complete SQL statement.  Return false if it
 ** ends in the middle of a string literal or C-style comment.
@@ -8098,10 +8419,11 @@
   int rc;
   char *zErrMsg = 0;
 
   open_db(p, 0);
   if( ShellHasFlag(p,SHFLG_Backslash) ) resolve_backslashes(zSql);
+  if( p->flgProgress & PROGRESS_RESET ) p->nProgress = 0;
   BEGIN_TIMER;
   rc = shell_exec(p, zSql, &zErrMsg);
   END_TIMER;
   if( rc || zErrMsg ){
     char zPrefix[100];
@@ -8134,35 +8456,35 @@
 ** is saved only if input is interactive.  An interrupt signal will
 ** cause this routine to exit immediately, unless input is interactive.
 **
 ** Return the number of errors.
 */
-static int process_input(ShellState *p, FILE *in){
+static int process_input(ShellState *p){
   char *zLine = 0;          /* A single input line */
   char *zSql = 0;           /* Accumulated SQL text */
   int nLine;                /* Length of current line */
   int nSql = 0;             /* Bytes of zSql[] used */
   int nAlloc = 0;           /* Allocated zSql[] space */
   int nSqlPrior = 0;        /* Bytes of zSql[] used by prior line */
   int rc;                   /* Error code */
   int errCnt = 0;           /* Number of errors seen */
-  int lineno = 0;           /* Current line number */
   int startline = 0;        /* Line number for start of current input */
 
-  while( errCnt==0 || !bail_on_error || (in==0 && stdin_is_interactive) ){
+  p->lineno = 0;
+  while( errCnt==0 || !bail_on_error || (p->in==0 && stdin_is_interactive) ){
     fflush(p->out);
-    zLine = one_input_line(in, zLine, nSql>0);
+    zLine = one_input_line(p->in, zLine, nSql>0);
     if( zLine==0 ){
       /* End of input */
-      if( in==0 && stdin_is_interactive ) printf("\n");
+      if( p->in==0 && stdin_is_interactive ) printf("\n");
       break;
     }
     if( seenInterrupt ){
-      if( in!=0 ) break;
+      if( p->in!=0 ) break;
       seenInterrupt = 0;
     }
-    lineno++;
+    p->lineno++;
     if( nSql==0 && _all_whitespace(zLine) ){
       if( ShellHasFlag(p, SHFLG_Echo) ) printf("%s\n", zLine);
       continue;
     }
     if( zLine && (zLine[0]=='.' || zLine[0]=='#') && nSql==0 ){
@@ -8190,20 +8512,20 @@
     if( nSql==0 ){
       int i;
       for(i=0; zLine[i] && IsSpace(zLine[i]); i++){}
       assert( nAlloc>0 && zSql!=0 );
       memcpy(zSql, zLine+i, nLine+1-i);
-      startline = lineno;
+      startline = p->lineno;
       nSql = nLine-i;
     }else{
       zSql[nSql++] = '\n';
       memcpy(zSql+nSql, zLine, nLine+1);
       nSql += nLine;
     }
     if( nSql && line_contains_semicolon(&zSql[nSqlPrior], nSql-nSqlPrior)
                 && sqlite3_complete(zSql) ){
-      errCnt += runOneSqlLine(p, zSql, in, startline);
+      errCnt += runOneSqlLine(p, zSql, p->in, startline);
       nSql = 0;
       if( p->outCount ){
         output_reset(p);
         p->outCount = 0;
       }else{
@@ -8213,11 +8535,11 @@
       if( ShellHasFlag(p, SHFLG_Echo) ) printf("%s\n", zSql);
       nSql = 0;
     }
   }
   if( nSql && !_all_whitespace(zSql) ){
-    errCnt += runOneSqlLine(p, zSql, in, startline);
+    errCnt += runOneSqlLine(p, zSql, p->in, startline);
   }
   free(zSql);
   free(zLine);
   return errCnt>0;
 }
@@ -8302,11 +8624,12 @@
   const char *sqliterc_override   /* Name of config file. NULL to use default */
 ){
   char *home_dir = NULL;
   const char *sqliterc = sqliterc_override;
   char *zBuf = 0;
-  FILE *in = NULL;
+  FILE *inSaved = p->in;
+  int savedLineno = p->lineno;
 
   if (sqliterc == NULL) {
     home_dir = find_home_dir(0);
     if( home_dir==0 ){
       raw_printf(stderr, "-- warning: cannot find home directory;"
@@ -8314,18 +8637,20 @@
       return;
     }
     zBuf = sqlite3_mprintf("%s/.sqliterc",home_dir);
     sqliterc = zBuf;
   }
-  in = fopen(sqliterc,"rb");
-  if( in ){
+  p->in = fopen(sqliterc,"rb");
+  if( p->in ){
     if( stdin_is_interactive ){
       utf8_printf(stderr,"-- Loading resources from %s\n",sqliterc);
     }
-    process_input(p,in);
-    fclose(in);
+    process_input(p);
+    fclose(p->in);
   }
+  p->in = inSaved;
+  p->lineno = savedLineno;
   sqlite3_free(zBuf);
 }
 
 /*
 ** Show available command line options
@@ -8339,10 +8664,13 @@
   "   -bail                stop after hitting an error\n"
   "   -batch               force batch I/O\n"
   "   -column              set output mode to 'column'\n"
   "   -cmd COMMAND         run \"COMMAND\" before reading stdin\n"
   "   -csv                 set output mode to 'csv'\n"
+#if defined(SQLITE_ENABLE_DESERIALIZE)
+  "   -deserialize         open the database using sqlite3_deserialize()\n"
+#endif
   "   -echo                print commands before execution\n"
   "   -init FILENAME       read/process named file\n"
   "   -[no]header          turn headers on or off\n"
 #if defined(SQLITE_ENABLE_MEMSYS3) || defined(SQLITE_ENABLE_MEMSYS5)
   "   -heap SIZE           Size of heap for memsys3 or memsys5\n"
@@ -8351,10 +8679,14 @@
   "   -html                set output mode to HTML\n"
   "   -interactive         force interactive I/O\n"
   "   -line                set output mode to 'line'\n"
   "   -list                set output mode to 'list'\n"
   "   -lookaside SIZE N    use N entries of SZ bytes for lookaside memory\n"
+#if defined(SQLITE_ENABLE_DESERIALIZE)
+  "   -maxsize N           maximum size for a --deserialize database\n"
+#endif
+  "   -memtrace            trace all memory allocations and deallocations\n"
   "   -mmap N              default mmap size set to N\n"
 #ifdef SQLITE_ENABLE_MULTIPLEX
   "   -multiplex           enable the multiplexor VFS\n"
 #endif
   "   -newline SEP         set output row separator. Default: '\\n'\n"
@@ -8661,10 +8993,12 @@
     }else if( strcmp(z,"-append")==0 ){
       data.openMode = SHELL_OPEN_APPENDVFS;
 #ifdef SQLITE_ENABLE_DESERIALIZE
     }else if( strcmp(z,"-deserialize")==0 ){
       data.openMode = SHELL_OPEN_DESERIALIZE;
+    }else if( strcmp(z,"-maxsize")==0 && i+1<argc ){
+      data.szMax = integerValue(argv[++i]);
 #endif
     }else if( strcmp(z,"-readonly")==0 ){
       data.openMode = SHELL_OPEN_READONLY;
     }else if( strcmp(z,"-reuseschema")==0 ){
       data.openMode = SHELL_OPEN_REUSESCHEMA;
@@ -8672,10 +9006,12 @@
     }else if( strncmp(z, "-A",2)==0 ){
       /* All remaining command-line arguments are passed to the ".archive"
       ** command, so ignore them */
       break;
 #endif
+    }else if( strcmp(z, "-memtrace")==0 ){
+      sqlite3MemTraceActivate(stderr);
     }
   }
   verify_uninitialized();
 
 
@@ -8762,10 +9098,12 @@
     }else if( strcmp(z,"-append")==0 ){
       data.openMode = SHELL_OPEN_APPENDVFS;
 #ifdef SQLITE_ENABLE_DESERIALIZE
     }else if( strcmp(z,"-deserialize")==0 ){
       data.openMode = SHELL_OPEN_DESERIALIZE;
+    }else if( strcmp(z,"-maxsize")==0 && i+1<argc ){
+      data.szMax = integerValue(argv[++i]);
 #endif
     }else if( strcmp(z,"-readonly")==0 ){
       data.openMode = SHELL_OPEN_READONLY;
     }else if( strcmp(z,"-reuseschema")==0 ){
       data.openMode = SHELL_OPEN_REUSESCHEMA;
@@ -8819,10 +9157,12 @@
     }else if( strcmp(z,"-pagecache")==0 ){
       i+=2;
     }else if( strcmp(z,"-lookaside")==0 ){
       i+=2;
     }else if( strcmp(z,"-mmap")==0 ){
+      i++;
+    }else if( strcmp(z,"-memtrace")==0 ){
       i++;
 #ifdef SQLITE_ENABLE_SORTER_REFERENCES
     }else if( strcmp(z,"-sorterref")==0 ){
       i++;
 #endif
@@ -8937,18 +9277,20 @@
 #if HAVE_READLINE || HAVE_EDITLINE
       rl_attempted_completion_function = readline_completion;
 #elif HAVE_LINENOISE
       linenoiseSetCompletionCallback(linenoise_completion);
 #endif
-      rc = process_input(&data, 0);
+      data.in = 0;
+      rc = process_input(&data);
       if( zHistory ){
         shell_stifle_history(2000);
         shell_write_history(zHistory);
         free(zHistory);
       }
     }else{
-      rc = process_input(&data, stdin);
+      data.in = stdin;
+      rc = process_input(&data);
     }
   }
   set_table_name(&data, 0);
   if( data.db ){
     session_close_all(&data);

Index: src/sqlite.h.in
==================================================================
--- src/sqlite.h.in
+++ src/sqlite.h.in
@@ -823,10 +823,19 @@
 ** current transaction.  This hint is not guaranteed to be accurate but it
 ** is often close.  The underlying VFS might choose to preallocate database
 ** file space based on this hint in order to help writes to the database
 ** file run faster.
 **
+** <li>[[SQLITE_FCNTL_SIZE_LIMIT]]
+** The [SQLITE_FCNTL_SIZE_LIMIT] opcode is used by in-memory VFS that
+** implements [sqlite3_deserialize()] to set an upper bound on the size
+** of the in-memory database.  The argument is a pointer to a [sqlite3_int64].
+** If the integer pointed to is negative, then it is filled in with the
+** current limit.  Otherwise the limit is set to the larger of the value
+** of the integer pointed to and the current database size.  The integer
+** pointed to is set to the new limit.
+**
 ** <li>[[SQLITE_FCNTL_CHUNK_SIZE]]
 ** The [SQLITE_FCNTL_CHUNK_SIZE] opcode is used to request that the VFS
 ** extends and truncates the database file in chunks of a size specified
 ** by the user. The fourth argument to [sqlite3_file_control()] should 
 ** point to an integer (type int) containing the new chunk-size to use
@@ -1131,10 +1140,11 @@
 #define SQLITE_FCNTL_BEGIN_ATOMIC_WRITE     31
 #define SQLITE_FCNTL_COMMIT_ATOMIC_WRITE    32
 #define SQLITE_FCNTL_ROLLBACK_ATOMIC_WRITE  33
 #define SQLITE_FCNTL_LOCK_TIMEOUT           34
 #define SQLITE_FCNTL_DATA_VERSION           35
+#define SQLITE_FCNTL_SIZE_LIMIT             36
 
 /* deprecated names */
 #define SQLITE_GET_LOCKPROXYFILE      SQLITE_FCNTL_GET_LOCKPROXYFILE
 #define SQLITE_SET_LOCKPROXYFILE      SQLITE_FCNTL_SET_LOCKPROXYFILE
 #define SQLITE_LAST_ERRNO             SQLITE_FCNTL_LAST_ERRNO
@@ -1972,10 +1982,21 @@
 ** from the database as records are returned in sorted order. The default
 ** value for this option is to never use this optimization. Specifying a 
 ** negative value for this option restores the default behaviour.
 ** This option is only available if SQLite is compiled with the
 ** [SQLITE_ENABLE_SORTER_REFERENCES] compile-time option.
+**
+** [[SQLITE_CONFIG_MEMDB_MAXSIZE]]
+** <dt>SQLITE_CONFIG_MEMDB_MAXSIZE
+** <dd>The SQLITE_CONFIG_MEMDB_MAXSIZE option accepts a single parameter
+** [sqlite3_int64] parameter which is the default maximum size for an in-memory
+** database created using [sqlite3_deserialize()].  This default maximum
+** size can be adjusted up or down for individual databases using the
+** [SQLITE_FCNTL_SIZE_LIMIT] [sqlite3_file_control|file-control].  If this
+** configuration setting is never used, then the default maximum is determined
+** by the [SQLITE_MEMDB_DEFAULT_MAXSIZE] compile-time option.  If that
+** compile-time option is not set, then the default maximum is 1073741824.
 ** </dl>
 */
 #define SQLITE_CONFIG_SINGLETHREAD  1  /* nil */
 #define SQLITE_CONFIG_MULTITHREAD   2  /* nil */
 #define SQLITE_CONFIG_SERIALIZED    3  /* nil */
@@ -2002,10 +2023,11 @@
 #define SQLITE_CONFIG_PCACHE_HDRSZ        24  /* int *psz */
 #define SQLITE_CONFIG_PMASZ               25  /* unsigned int szPma */
 #define SQLITE_CONFIG_STMTJRNL_SPILL      26  /* int nByte */
 #define SQLITE_CONFIG_SMALL_MALLOC        27  /* boolean */
 #define SQLITE_CONFIG_SORTERREF_SIZE      28  /* int nByte */
+#define SQLITE_CONFIG_MEMDB_MAXSIZE       29  /* sqlite3_int64 */
 
 /*
 ** CAPI3REF: Database Connection Configuration Options
 **
 ** These constants are the available integer configuration options that
@@ -2017,10 +2039,11 @@
 ** the call worked.  ^The [sqlite3_db_config()] interface will return a
 ** non-zero [error code] if a discontinued or unsupported configuration option
 ** is invoked.
 **
 ** <dl>
+** [[SQLITE_DBCONFIG_LOOKASIDE]]
 ** <dt>SQLITE_DBCONFIG_LOOKASIDE</dt>
 ** <dd> ^This option takes three additional arguments that determine the 
 ** [lookaside memory allocator] configuration for the [database connection].
 ** ^The first argument (the third parameter to [sqlite3_db_config()] is a
 ** pointer to a memory buffer to use for lookaside memory.
@@ -2039,10 +2062,11 @@
 ** [sqlite3_db_status](D,[SQLITE_CONFIG_LOOKASIDE],...) is zero.
 ** Any attempt to change the lookaside memory configuration when lookaside
 ** memory is in use leaves the configuration unchanged and returns 
 ** [SQLITE_BUSY].)^</dd>
 **
+** [[SQLITE_DBCONFIG_ENABLE_FKEY]]
 ** <dt>SQLITE_DBCONFIG_ENABLE_FKEY</dt>
 ** <dd> ^This option is used to enable or disable the enforcement of
 ** [foreign key constraints].  There should be two additional arguments.
 ** The first argument is an integer which is 0 to disable FK enforcement,
 ** positive to enable FK enforcement or negative to leave FK enforcement
@@ -2049,10 +2073,11 @@
 ** unchanged.  The second parameter is a pointer to an integer into which
 ** is written 0 or 1 to indicate whether FK enforcement is off or on
 ** following this call.  The second parameter may be a NULL pointer, in
 ** which case the FK enforcement setting is not reported back. </dd>
 **
+** [[SQLITE_DBCONFIG_ENABLE_TRIGGER]]
 ** <dt>SQLITE_DBCONFIG_ENABLE_TRIGGER</dt>
 ** <dd> ^This option is used to enable or disable [CREATE TRIGGER | triggers].
 ** There should be two additional arguments.
 ** The first argument is an integer which is 0 to disable triggers,
 ** positive to enable triggers or negative to leave the setting unchanged.
@@ -2059,10 +2084,11 @@
 ** The second parameter is a pointer to an integer into which
 ** is written 0 or 1 to indicate whether triggers are disabled or enabled
 ** following this call.  The second parameter may be a NULL pointer, in
 ** which case the trigger setting is not reported back. </dd>
 **
+** [[SQLITE_DBCONFIG_ENABLE_FTS3_TOKENIZER]]
 ** <dt>SQLITE_DBCONFIG_ENABLE_FTS3_TOKENIZER</dt>
 ** <dd> ^This option is used to enable or disable the two-argument
 ** version of the [fts3_tokenizer()] function which is part of the
 ** [FTS3] full-text search engine extension.
 ** There should be two additional arguments.
@@ -2072,10 +2098,11 @@
 ** The second parameter is a pointer to an integer into which
 ** is written 0 or 1 to indicate whether fts3_tokenizer is disabled or enabled
 ** following this call.  The second parameter may be a NULL pointer, in
 ** which case the new setting is not reported back. </dd>
 **
+** [[SQLITE_DBCONFIG_ENABLE_LOAD_EXTENSION]]
 ** <dt>SQLITE_DBCONFIG_ENABLE_LOAD_EXTENSION</dt>
 ** <dd> ^This option is used to enable or disable the [sqlite3_load_extension()]
 ** interface independently of the [load_extension()] SQL function.
 ** The [sqlite3_enable_load_extension()] API enables or disables both the
 ** C-API [sqlite3_load_extension()] and the SQL function [load_extension()].
@@ -2089,19 +2116,20 @@
 ** is written 0 or 1 to indicate whether [sqlite3_load_extension()] interface
 ** is disabled or enabled following this call.  The second parameter may
 ** be a NULL pointer, in which case the new setting is not reported back.
 ** </dd>
 **
-** <dt>SQLITE_DBCONFIG_MAINDBNAME</dt>
+** [[SQLITE_DBCONFIG_MAINDBNAME]] <dt>SQLITE_DBCONFIG_MAINDBNAME</dt>
 ** <dd> ^This option is used to change the name of the "main" database
 ** schema.  ^The sole argument is a pointer to a constant UTF8 string
 ** which will become the new schema name in place of "main".  ^SQLite
 ** does not make a copy of the new main schema name string, so the application
 ** must ensure that the argument passed into this DBCONFIG option is unchanged
 ** until after the database connection closes.
 ** </dd>
 **
+** [[SQLITE_DBCONFIG_NO_CKPT_ON_CLOSE]] 
 ** <dt>SQLITE_DBCONFIG_NO_CKPT_ON_CLOSE</dt>
 ** <dd> Usually, when a database in wal mode is closed or detached from a 
 ** database handle, SQLite checks if this will mean that there are now no 
 ** connections at all to the database. If so, it performs a checkpoint 
 ** operation before closing the connection. This option may be used to
@@ -2111,11 +2139,11 @@
 ** The second parameter is a pointer to an integer
 ** into which is written 0 or 1 to indicate whether checkpoints-on-close
 ** have been disabled - 0 if they are not disabled, 1 if they are.
 ** </dd>
 **
-** <dt>SQLITE_DBCONFIG_ENABLE_QPSG</dt>
+** [[SQLITE_DBCONFIG_ENABLE_QPSG]] <dt>SQLITE_DBCONFIG_ENABLE_QPSG</dt>
 ** <dd>^(The SQLITE_DBCONFIG_ENABLE_QPSG option activates or deactivates
 ** the [query planner stability guarantee] (QPSG).  When the QPSG is active,
 ** a single SQL query statement will always use the same algorithm regardless
 ** of values of [bound parameters].)^ The QPSG disables some query optimizations
 ** that look at the values of bound parameters, which can make some queries
@@ -2127,11 +2155,11 @@
 ** unchanged. The second parameter is a pointer to an integer into which
 ** is written 0 or 1 to indicate whether the QPSG is disabled or enabled
 ** following this call.
 ** </dd>
 **
-** <dt>SQLITE_DBCONFIG_TRIGGER_EQP</dt>
+** [[SQLITE_DBCONFIG_TRIGGER_EQP]] <dt>SQLITE_DBCONFIG_TRIGGER_EQP</dt>
 ** <dd> By default, the output of EXPLAIN QUERY PLAN commands does not 
 ** include output for any operations performed by trigger programs. This
 ** option is used to set or clear (the default) a flag that governs this
 ** behavior. The first parameter passed to this operation is an integer -
 ** positive to enable output for trigger programs, or zero to disable it,
@@ -2139,11 +2167,11 @@
 ** The second parameter is a pointer to an integer into which is written 
 ** 0 or 1 to indicate whether output-for-triggers has been disabled - 0 if 
 ** it is not disabled, 1 if it is.  
 ** </dd>
 **
-** <dt>SQLITE_DBCONFIG_RESET_DATABASE</dt>
+** [[SQLITE_DBCONFIG_RESET_DATABASE]] <dt>SQLITE_DBCONFIG_RESET_DATABASE</dt>
 ** <dd> Set the SQLITE_DBCONFIG_RESET_DATABASE flag and then run
 ** [VACUUM] in order to reset a database back to an empty database
 ** with no schema and no content. The following process works even for
 ** a badly corrupted database file:
 ** <ol>
@@ -2159,32 +2187,21 @@
 ** </ol>
 ** Because resetting a database is destructive and irreversible, the
 ** process requires the use of this obscure API and multiple steps to help
 ** ensure that it does not happen by accident.
 **
-** <dt>SQLITE_DBCONFIG_DEFENSIVE</dt>
-** <dd>The SQLITE_DBCONFIG_DEFENSIVE option actives or deactivates the
+** [[SQLITE_DBCONFIG_DEFENSIVE]] <dt>SQLITE_DBCONFIG_DEFENSIVE</dt>
+** <dd>The SQLITE_DBCONFIG_DEFENSIVE option activates or deactivates the
 ** "defensive" flag for a database connection.  When the defensive
-** flag is enabled, some obscure features of SQLite are disabled in order
-** to reduce the attack surface. Applications that run untrusted SQL
-** can activate this flag to reduce the risk of zero-day exploits.
-** <p>
-** Features disabled by the defensive flag include:
+** flag is enabled, language features that allow ordinary SQL to 
+** deliberately corrupt the database file are disabled.  The disabled
+** features include but are not limited to the following:
 ** <ul>
-** <li>The [PRAGMA writable_schema=ON] statement.
-** <li>Writes to the [sqlite_dbpage] virtual table.
+** <li> The [PRAGMA writable_schema=ON] statement.
+** <li> Writes to the [sqlite_dbpage] virtual table.
+** <li> Direct writes to [shadow tables].
 ** </ul>
-** New restrictions may be added in future releases.
-** <p>
-** To be clear: It should never be possible for hostile SQL to cause
-** arbitrary memory reads, memory leaks, buffer overflows, assertion
-** faults, arbitrary code execution, crashes, or other mischief, regardless
-** of the value of the defensive flag.  Any occurrance of these problems
-** is considered a serious bug and will be fixed promptly.  It is not
-** necessary to enable the defensive flag in order to make SQLite secure
-** against attack. The defensive flag merely provides an additional layer
-** of defense against unknown vulnerabilities.
 ** </dd>
 ** </dl>
 */
 #define SQLITE_DBCONFIG_MAINDBNAME            1000 /* const char* */
 #define SQLITE_DBCONFIG_LOOKASIDE             1001 /* void* int int */
@@ -2996,13 +3013,13 @@
 ** the original statement text and an estimate of wall-clock time
 ** of how long that statement took to run.  ^The profile callback
 ** time is in units of nanoseconds, however the current implementation
 ** is only capable of millisecond resolution so the six least significant
 ** digits in the time are meaningless.  Future versions of SQLite
-** might provide greater resolution on the profiler callback.  The
-** sqlite3_profile() function is considered experimental and is
-** subject to change in future versions of SQLite.
+** might provide greater resolution on the profiler callback.  Invoking
+** either [sqlite3_trace()] or [sqlite3_trace_v2()] will cancel the
+** profile callback.
 */
 SQLITE_DEPRECATED void *sqlite3_trace(sqlite3*,
    void(*xTrace)(void*,const char*), void*);
 SQLITE_DEPRECATED void *sqlite3_profile(sqlite3*,
    void(*xProfile)(void*,const char*,sqlite3_uint64), void*);
@@ -3412,10 +3429,12 @@
 ** If F is a NULL pointer, then sqlite3_uri_parameter(F,P) returns NULL and
 ** sqlite3_uri_boolean(F,P,B) returns B.  If F is not a NULL pointer and
 ** is not a database file pathname pointer that SQLite passed into the xOpen
 ** VFS method, then the behavior of this routine is undefined and probably
 ** undesirable.
+**
+** See the [URI filename] documentation for additional information.
 */
 const char *sqlite3_uri_parameter(const char *zFilename, const char *zParam);
 int sqlite3_uri_boolean(const char *zFile, const char *zParam, int bDefault);
 sqlite3_int64 sqlite3_uri_int64(const char*, const char*, sqlite3_int64);
 
@@ -3634,22 +3653,27 @@
 ** [sqlite3_finalize()] relatively soon. The current implementation acts
 ** on this hint by avoiding the use of [lookaside memory] so as not to
 ** deplete the limited store of lookaside memory. Future versions of
 ** SQLite may act on this hint differently.
 **
-** [[SQLITE_PREPARE_NORMALIZE]] ^(<dt>SQLITE_PREPARE_NORMALIZE</dt>
-** <dd>The SQLITE_PREPARE_NORMALIZE flag indicates that a normalized
-** representation of the SQL statement should be calculated and then
-** associated with the prepared statement, which can be obtained via
-** the [sqlite3_normalized_sql()] interface.  The semantics used to
-** normalize a SQL statement are unspecified and subject to change.
-** At a minimum, literal values will be replaced with suitable
-** placeholders.
+** [[SQLITE_PREPARE_NORMALIZE]] <dt>SQLITE_PREPARE_NORMALIZE</dt>
+** <dd>The SQLITE_PREPARE_NORMALIZE flag is a no-op. This flag used
+** to be required for any prepared statement that wanted to use the
+** [sqlite3_normalized_sql()] interface.  However, the
+** [sqlite3_normalized_sql()] interface is now available to all
+** prepared statements, regardless of whether or not they use this
+** flag.
+**
+** [[SQLITE_PREPARE_NO_VTAB]] <dt>SQLITE_PREPARE_NO_VTAB</dt>
+** <dd>The SQLITE_PREPARE_NO_VTAB flag causes the SQL compiler
+** to return an error (error code SQLITE_ERROR) if the statement uses
+** any virtual tables.
 ** </dl>
 */
 #define SQLITE_PREPARE_PERSISTENT              0x01
 #define SQLITE_PREPARE_NORMALIZE               0x02
+#define SQLITE_PREPARE_NO_VTAB                 0x04
 
 /*
 ** CAPI3REF: Compiling An SQL Statement
 ** KEYWORDS: {SQL statement compiler}
 ** METHOD: sqlite3
@@ -6322,10 +6346,13 @@
   /* The methods above are in version 1 of the sqlite_module object. Those 
   ** below are for version 2 and greater. */
   int (*xSavepoint)(sqlite3_vtab *pVTab, int);
   int (*xRelease)(sqlite3_vtab *pVTab, int);
   int (*xRollbackTo)(sqlite3_vtab *pVTab, int);
+  /* The methods above are in versions 1 and 2 of the sqlite_module object.
+  ** Those below are for version 3 and greater. */
+  int (*xShadowName)(const char*);
 };
 
 /*
 ** CAPI3REF: Virtual Table Indexing Information
 ** KEYWORDS: sqlite3_index_info
@@ -7244,10 +7271,11 @@
 #define SQLITE_TESTCTRL_ALWAYS                  13
 #define SQLITE_TESTCTRL_RESERVE                 14
 #define SQLITE_TESTCTRL_OPTIMIZATIONS           15
 #define SQLITE_TESTCTRL_ISKEYWORD               16  /* NOT USED */
 #define SQLITE_TESTCTRL_SCRATCHMALLOC           17  /* NOT USED */
+#define SQLITE_TESTCTRL_INTERNAL_FUNCTIONS      17
 #define SQLITE_TESTCTRL_LOCALTIME_FAULT         18
 #define SQLITE_TESTCTRL_EXPLAIN_STMT            19  /* NOT USED */
 #define SQLITE_TESTCTRL_ONCE_RESET_THRESHOLD    19
 #define SQLITE_TESTCTRL_NEVER_CORRUPT           20
 #define SQLITE_TESTCTRL_VDBE_COVERAGE           21
@@ -8656,10 +8684,11 @@
 ** These macros define the various options to the
 ** [sqlite3_vtab_config()] interface that [virtual table] implementations
 ** can use to customize and optimize their behavior.
 **
 ** <dl>
+** [[SQLITE_VTAB_CONSTRAINT_SUPPORT]]
 ** <dt>SQLITE_VTAB_CONSTRAINT_SUPPORT
 ** <dd>Calls of the form
 ** [sqlite3_vtab_config](db,SQLITE_VTAB_CONSTRAINT_SUPPORT,X) are supported,
 ** where X is an integer.  If X is zero, then the [virtual table] whose
 ** [xCreate] or [xConnect] method invoked [sqlite3_vtab_config()] does not

Index: src/sqliteInt.h
==================================================================
--- src/sqliteInt.h
+++ src/sqliteInt.h
@@ -1357,14 +1357,17 @@
 
 #ifndef SQLITE_OMIT_DEPRECATED
 /* This is an extra SQLITE_TRACE macro that indicates "legacy" tracing
 ** in the style of sqlite3_trace()
 */
-#define SQLITE_TRACE_LEGACY  0x80
+#define SQLITE_TRACE_LEGACY          0x40     /* Use the legacy xTrace */
+#define SQLITE_TRACE_XPROFILE        0x80     /* Use the legacy xProfile */
 #else
-#define SQLITE_TRACE_LEGACY  0
+#define SQLITE_TRACE_LEGACY          0
+#define SQLITE_TRACE_XPROFILE        0
 #endif /* SQLITE_OMIT_DEPRECATED */
+#define SQLITE_TRACE_NONLEGACY_MASK  0x0f     /* Normal flags */
 
 
 /*
 ** Each database connection is an instance of the following structure.
 */
@@ -1419,12 +1422,14 @@
   int nVDestroy;                /* Number of active OP_VDestroy operations */
   int nExtension;               /* Number of loaded extensions */
   void **aExtension;            /* Array of shared library handles */
   int (*xTrace)(u32,void*,void*,void*);     /* Trace function */
   void *pTraceArg;                          /* Argument to the trace function */
+#ifndef SQLITE_OMIT_DEPRECATED
   void (*xProfile)(void*,const char*,u64);  /* Profiling function */
   void *pProfileArg;                        /* Argument to profile function */
+#endif
   void *pCommitArg;                 /* Argument to xCommitCallback() */
   int (*xCommitCallback)(void*);    /* Invoked at every commit. */
   void *pRollbackArg;               /* Argument to xRollbackCallback() */
   void (*xRollbackCallback)(void*); /* Invoked at every commit. */
   void *pUpdateArg;
@@ -1553,10 +1558,11 @@
 #define SQLITE_SqlTrace       HI(0x0001)  /* Debug print SQL as it executes */
 #define SQLITE_VdbeListing    HI(0x0002)  /* Debug listings of VDBE progs */
 #define SQLITE_VdbeTrace      HI(0x0004)  /* True to trace VDBE execution */
 #define SQLITE_VdbeAddopTrace HI(0x0008)  /* Trace sqlite3VdbeAddOp() calls */
 #define SQLITE_VdbeEQP        HI(0x0010)  /* Debug EXPLAIN QUERY PLAN */
+#define SQLITE_ParserTrace    HI(0x0020)  /* PRAGMA parser_trace=ON */
 #endif
 
 /*
 ** Allowed values for sqlite3.mDbFlags
 */
@@ -1688,12 +1694,13 @@
 #define SQLITE_FUNC_MINMAX   0x1000 /* True for min() and max() aggregates */
 #define SQLITE_FUNC_SLOCHNG  0x2000 /* "Slow Change". Value constant during a
                                     ** single query - might change over time */
 #define SQLITE_FUNC_AFFINITY 0x4000 /* Built-in affinity() function */
 #define SQLITE_FUNC_OFFSET   0x8000 /* Built-in sqlite_offset() function */
-#define SQLITE_FUNC_WINDOW  0x10000 /* Built-in window-only function */
-#define SQLITE_FUNC_WINDOW_SIZE  0x20000  /* Requires partition size as arg. */
+#define SQLITE_FUNC_WINDOW   0x00010000 /* Built-in window-only function */
+#define SQLITE_FUNC_WINDOW_SIZE 0x20000 /* Requires partition size as arg. */
+#define SQLITE_FUNC_INTERNAL 0x00040000 /* For use by NestedParse() only */
 
 /*
 ** The following three macros, FUNCTION(), LIKEFUNC() and AGGREGATE() are
 ** used to create the initializers for the FuncDef structures.
 **
@@ -1765,14 +1772,17 @@
   {nArg, SQLITE_UTF8|(nc*SQLITE_FUNC_NEEDCOLL), \
    SQLITE_INT_TO_PTR(arg), 0, xStep,xFinal,xValue,0,#zName, {0}}
 #define AGGREGATE2(zName, nArg, arg, nc, xStep, xFinal, extraFlags) \
   {nArg, SQLITE_UTF8|(nc*SQLITE_FUNC_NEEDCOLL)|extraFlags, \
    SQLITE_INT_TO_PTR(arg), 0, xStep,xFinal,xFinal,0,#zName, {0}}
-
 #define WAGGREGATE(zName, nArg, arg, nc, xStep, xFinal, xValue, xInverse, f) \
   {nArg, SQLITE_UTF8|(nc*SQLITE_FUNC_NEEDCOLL)|f, \
    SQLITE_INT_TO_PTR(arg), 0, xStep,xFinal,xValue,xInverse,#zName, {0}}
+#define INTERNAL_FUNCTION(zName, nArg, xFunc) \
+  {nArg, SQLITE_FUNC_INTERNAL|SQLITE_UTF8|SQLITE_FUNC_CONSTANT, \
+   0, 0, xFunc, 0, 0, 0, #zName, {0} }
+
 
 /*
 ** All current savepoints are stored in a linked list starting at
 ** sqlite3.pSavepoint. The first element in the list is the most recently
 ** opened savepoint. Savepoints are added to the list by the vdbe
@@ -1953,13 +1963,10 @@
 ** by an instance of the following structure.
 */
 struct Table {
   char *zName;         /* Name of the table or view */
   Column *aCol;        /* Information about each column */
-#ifdef SQLITE_ENABLE_NORMALIZE
-  Hash *pColHash;      /* All columns indexed by name */
-#endif
   Index *pIndex;       /* List of SQL indexes on this table. */
   Select *pSelect;     /* NULL for tables.  Points to definition if a view. */
   FKey *pFKey;         /* Linked list of all foreign keys in this table */
   char *zColAff;       /* String defining the affinity of each column */
   ExprList *pCheck;    /* All CHECK constraints */
@@ -2006,10 +2013,11 @@
 #define TF_NoVisibleRowid  0x0040    /* No user-visible "rowid" column */
 #define TF_OOOHidden       0x0080    /* Out-of-Order hidden columns */
 #define TF_StatsUsed       0x0100    /* Query planner decisions affected by
                                      ** Index.aiRowLogEst[] values */
 #define TF_HasNotNull      0x0200    /* Contains NOT NULL constraints */
+#define TF_Shadow          0x0400    /* True for a shadow table */
 
 /*
 ** Test to see whether or not a table is a virtual table.  This is
 ** done as a macro so that it will be optimized out when virtual
 ** table support is omitted from the build.
@@ -2241,11 +2249,11 @@
   int tnum;                /* DB Page containing root of this index */
   LogEst szIdxRow;         /* Estimated average row size in bytes */
   u16 nKeyCol;             /* Number of columns forming the key */
   u16 nColumn;             /* Number of columns stored in the index */
   u8 onError;              /* OE_Abort, OE_Ignore, OE_Replace, or OE_None */
-  unsigned idxType:2;      /* 1==UNIQUE, 2==PRIMARY KEY, 0==CREATE INDEX */
+  unsigned idxType:2;      /* 0:Normal 1:UNIQUE, 2:PRIMARY KEY, 3:IPK */
   unsigned bUnordered:1;   /* Use this index for == or IN queries only */
   unsigned uniqNotNull:1;  /* True if UNIQUE and NOT NULL for all columns */
   unsigned isResized:1;    /* True if resizeIndexObject() has been called */
   unsigned isCovering:1;   /* True if this is a covering index */
   unsigned noSkipScan:1;   /* Do not try to use skip-scan if true */
@@ -2266,10 +2274,11 @@
 ** Allowed values for Index.idxType
 */
 #define SQLITE_IDXTYPE_APPDEF      0   /* Created using CREATE INDEX */
 #define SQLITE_IDXTYPE_UNIQUE      1   /* Implements a UNIQUE constraint */
 #define SQLITE_IDXTYPE_PRIMARYKEY  2   /* Is the PRIMARY KEY for the table */
+#define SQLITE_IDXTYPE_IPK         3   /* INTEGER PRIMARY KEY index */
 
 /* Return true if index X is a PRIMARY KEY index */
 #define IsPrimaryKeyIndex(X)  ((X)->idxType==SQLITE_IDXTYPE_PRIMARYKEY)
 
 /* Return true if index X is a UNIQUE index */
@@ -2483,10 +2492,14 @@
   AggInfo *pAggInfo;     /* Used by TK_AGG_COLUMN and TK_AGG_FUNCTION */
   union {
     Table *pTab;           /* TK_COLUMN: Table containing column. Can be NULL
                            ** for a column of an index on an expression */
     Window *pWin;          /* TK_FUNCTION: Window definition for the func */
+    struct {               /* TK_IN, TK_SELECT, and TK_EXISTS */
+      int iAddr;             /* Subroutine entry address */
+      int regReturn;         /* Register used to hold return address */
+    } sub;
   } y;
 };
 
 /*
 ** The following are the meanings of bits in the Expr.flags field.
@@ -2514,10 +2527,12 @@
 #define EP_CanBeNull 0x100000 /* Can be null despite NOT NULL constraint */
 #define EP_Subquery  0x200000 /* Tree contains a TK_SELECT operator */
 #define EP_Alias     0x400000 /* Is an alias for a result set column */
 #define EP_Leaf      0x800000 /* Expr.pLeft, .pRight, .u.pSelect all NULL */
 #define EP_WinFunc  0x1000000 /* TK_FUNCTION with Expr.y.pWin set */
+#define EP_Subrtn   0x2000000 /* Uses Expr.y.sub. TK_IN, _SELECT, or _EXISTS */
+#define EP_Quoted   0x4000000 /* TK_ID was originally quoted */
 
 /*
 ** The EP_Propagate mask is a set of properties that automatically propagate
 ** upwards into parent nodes.
 */
@@ -3057,20 +3072,21 @@
   u8 isMultiWrite;     /* True if statement may modify/insert multiple rows */
   u8 mayAbort;         /* True if statement may throw an ABORT exception */
   u8 hasCompound;      /* Need to invoke convertCompoundSelectToSubquery() */
   u8 okConstFactor;    /* OK to factor out constants */
   u8 disableLookaside; /* Number of times lookaside has been disabled */
+  u8 disableVtab;      /* Disable all virtual tables for this parse */
   int nRangeReg;       /* Size of the temporary register block */
   int iRangeReg;       /* First register in temporary register block */
   int nErr;            /* Number of errors seen */
   int nTab;            /* Number of previously allocated VDBE cursors */
   int nMem;            /* Number of memory cells used so far */
-  int nOpAlloc;        /* Number of slots allocated for Vdbe.aOp[] */
   int szOpAlloc;       /* Bytes of memory space allocated for Vdbe.aOp[] */
   int iSelfTab;        /* Table associated with an index on expr, or negative
                        ** of the base register during check-constraint eval */
-  int nLabel;          /* Number of labels used */
+  int nLabel;          /* The *negative* of the number of labels used */
+  int nLabelAlloc;     /* Number of slots in aLabel */
   int *aLabel;         /* Space to hold the labels */
   ExprList *pConstExpr;/* Constant expressions */
   Token constraintName;/* Name of the constraint currently being parsed */
   yDbMask writeMask;   /* Start a write transaction on these databases */
   yDbMask cookieMask;  /* Bitmask of schema verified databases */
@@ -3126,11 +3142,13 @@
 #endif
   VList *pVList;            /* Mapping between variable names and numbers */
   Vdbe *pReprepare;         /* VM being reprepared (sqlite3Reprepare()) */
   const char *zTail;        /* All SQL text past the last semicolon parsed */
   Table *pNewTable;         /* A table being constructed by CREATE TABLE */
-  Index *pNewIndex;         /* An index being constructed by CREATE INDEX */
+  Index *pNewIndex;         /* An index being constructed by CREATE INDEX.
+                            ** Also used to hold redundant UNIQUE constraints
+                            ** during a RENAME COLUMN */
   Trigger *pNewTrigger;     /* Trigger under construct by a CREATE TRIGGER */
   const char *zAuthContext; /* The 6th parameter to db->xAuth callbacks */
 #ifndef SQLITE_OMIT_VIRTUALTABLE
   Token sArg;               /* Complete text of a module argument */
   Table **apVtabLock;       /* Pointer to virtual tables needing locking */
@@ -3354,10 +3372,11 @@
   sqlite3 *db;        /* The database being initialized */
   char **pzErrMsg;    /* Error message stored here */
   int iDb;            /* 0 for main database.  1 for TEMP, 2.. for ATTACHed */
   int rc;             /* Result code stored here */
   u32 mInitFlags;     /* Flags controlling error messages */
+  u32 nInitRow;       /* Number of rows processed */
   u64 cksum;          /* Schema checksum for REUSE_SCHEMA mode */
 } InitData;
 
 /*
 ** Allowed values for mInitFlags
@@ -3415,14 +3434,18 @@
   ** operation.  Set the callback using SQLITE_TESTCTRL_VDBE_COVERAGE.
   */
   void (*xVdbeBranch)(void*,unsigned iSrcLine,u8 eThis,u8 eMx);  /* Callback */
   void *pVdbeBranchArg;                                     /* 1st argument */
 #endif
+#ifdef SQLITE_ENABLE_DESERIALIZE
+  sqlite3_int64 mxMemdbSize;        /* Default max memdb size */
+#endif
 #ifndef SQLITE_UNTESTABLE
   int (*xTestCallback)(int);        /* Invoked by sqlite3FaultSim() */
 #endif
   int bLocaltimeFault;              /* True to fail localtime() calls */
+  int bInternalFunctions;           /* Internal SQL functions are visible */
   int iOnceResetThreshold;          /* When to reset OP_Once counters */
   u32 szSorterRef;                  /* Min size in bytes to use sorter-refs */
 };
 
 /*
@@ -3802,10 +3825,11 @@
 
 
 void sqlite3SetString(char **, sqlite3*, const char*);
 void sqlite3ErrorMsg(Parse*, const char*, ...);
 void sqlite3Dequote(char*);
+void sqlite3DequoteExpr(Expr*);
 void sqlite3TokenInit(Token*,char*);
 int sqlite3KeywordCode(const unsigned char*, int);
 int sqlite3RunParser(Parse*, const char*, char **);
 void sqlite3FinishCoding(Parse*);
 int sqlite3GetTempReg(Parse*);
@@ -3830,10 +3854,11 @@
 void sqlite3ExprListSetSortOrder(ExprList*,int);
 void sqlite3ExprListSetName(Parse*,ExprList*,Token*,int);
 void sqlite3ExprListSetSpan(Parse*,ExprList*,const char*,const char*);
 void sqlite3ExprListDelete(sqlite3*, ExprList*);
 u32 sqlite3ExprListFlags(const ExprList*);
+int sqlite3IndexHasDuplicateRootPage(Index*);
 int sqlite3Init(sqlite3*, char**);
 int sqlite3InitCallback(void*, int, char**, char**);
 int sqlite3InitOne(sqlite3*, int, char**, u32);
 void sqlite3Pragma(Parse*,Token*,Token*,Token*,int);
 #ifndef SQLITE_OMIT_VIRTUALTABLE
@@ -3863,10 +3888,15 @@
 void sqlite3AddDefaultValue(Parse*,Expr*,const char*,const char*);
 void sqlite3AddCollateType(Parse*, Token*);
 void sqlite3EndTable(Parse*,Token*,Token*,u8,Select*);
 int sqlite3ParseUri(const char*,const char*,unsigned int*,
                     sqlite3_vfs**,char**,char **);
+#ifdef SQLITE_HAS_CODEC
+  int sqlite3CodecQueryParameters(sqlite3*,const char*,const char*);
+#else
+# define sqlite3CodecQueryParameters(A,B,C) 0
+#endif
 Btree *sqlite3DbNameToBtree(sqlite3*,const char*);
 
 #ifdef SQLITE_UNTESTABLE
 # define sqlite3FaultSim(X) SQLITE_OK
 #else
@@ -3915,12 +3945,12 @@
 #endif
 void sqlite3Insert(Parse*, SrcList*, Select*, IdList*, int, Upsert*);
 void *sqlite3ArrayAllocate(sqlite3*,void*,int,int*,int*);
 IdList *sqlite3IdListAppend(Parse*, IdList*, Token*);
 int sqlite3IdListIndex(IdList*,const char*);
-SrcList *sqlite3SrcListEnlarge(sqlite3*, SrcList*, int, int);
-SrcList *sqlite3SrcListAppend(sqlite3*, SrcList*, Token*, Token*);
+SrcList *sqlite3SrcListEnlarge(Parse*, SrcList*, int, int);
+SrcList *sqlite3SrcListAppend(Parse*, SrcList*, Token*, Token*);
 SrcList *sqlite3SrcListAppendFromTerm(Parse*, SrcList*, Token*, Token*,
                                       Token*, Select*, Expr*, IdList*);
 void sqlite3SrcListIndexedBy(Parse *, SrcList *, Token *);
 void sqlite3SrcListFuncArgs(Parse*, SrcList*, ExprList*);
 int sqlite3IndexedByLookup(Parse *, struct SrcList_item *);
@@ -3983,12 +4013,12 @@
 Table *sqlite3LocateTable(Parse*,u32 flags,const char*, const char*);
 Table *sqlite3LocateTableItem(Parse*,u32 flags,struct SrcList_item *);
 Index *sqlite3FindIndex(sqlite3*,const char*, const char*);
 void sqlite3UnlinkAndDeleteTable(sqlite3*,int,const char*);
 void sqlite3UnlinkAndDeleteIndex(sqlite3*,int,const char*);
-void sqlite3Vacuum(Parse*,Token*);
-int sqlite3RunVacuum(char**, sqlite3*, int);
+void sqlite3Vacuum(Parse*,Token*,Expr*);
+int sqlite3RunVacuum(char**, sqlite3*, int, sqlite3_value*);
 char *sqlite3NameFromToken(sqlite3*, Token*);
 int sqlite3ExprCompare(Parse*,Expr*, Expr*, int);
 int sqlite3ExprCompareSkip(Expr*, Expr*, int);
 int sqlite3ExprListCompare(ExprList*, ExprList*, int);
 int sqlite3ExprImpliesExpr(Parse*,Expr*, Expr*, int);
@@ -4022,13 +4052,10 @@
 #endif
 int sqlite3ExprIsInteger(Expr*, int*);
 int sqlite3ExprCanBeNull(const Expr*);
 int sqlite3ExprNeedsNoAffinityChange(const Expr*, char);
 int sqlite3IsRowid(const char*);
-#ifdef SQLITE_ENABLE_NORMALIZE
-int sqlite3IsRowidN(const char*, int);
-#endif
 void sqlite3GenerateRowDelete(
     Parse*,Table*,Trigger*,int,int,int,i16,u8,u8,u8,int);
 void sqlite3GenerateRowIndexDelete(Parse*, Table*, int, int, int*, int);
 int sqlite3GenerateIndexKey(Parse*, Index*, int, int, int, int*,Index*,int);
 void sqlite3ResolvePartIdxLabel(Parse*,int);
@@ -4051,13 +4078,11 @@
 Expr *sqlite3ExprDup(sqlite3*,Expr*,int);
 ExprList *sqlite3ExprListDup(sqlite3*,ExprList*,int);
 SrcList *sqlite3SrcListDup(sqlite3*,SrcList*,int);
 IdList *sqlite3IdListDup(sqlite3*,IdList*);
 Select *sqlite3SelectDup(sqlite3*,Select*,int);
-#ifdef SQLITE_ENABLE_NORMALIZE
-FuncDef *sqlite3FunctionSearchN(int,const char*,int);
-#endif
+FuncDef *sqlite3FunctionSearch(int,const char*);
 void sqlite3InsertBuiltinFuncs(FuncDef*,int);
 FuncDef *sqlite3FindFunction(sqlite3*,const char*,int,u8,u8);
 void sqlite3RegisterBuiltinFunctions(void);
 void sqlite3RegisterDateTimeFunctions(void);
 void sqlite3RegisterPerConnectionBuiltinFunctions(sqlite3*);
@@ -4258,23 +4283,21 @@
 void sqlite3Reindex(Parse*, Token*, Token*);
 void sqlite3AlterFunctions(void);
 void sqlite3AlterRenameTable(Parse*, SrcList*, Token*);
 void sqlite3AlterRenameColumn(Parse*, SrcList*, Token*, Token*);
 int sqlite3GetToken(const unsigned char *, int *);
-#ifdef SQLITE_ENABLE_NORMALIZE
-int sqlite3GetTokenNormalized(const unsigned char *, int *, int *);
-#endif
 void sqlite3NestedParse(Parse*, const char*, ...);
 void sqlite3ExpirePreparedStatements(sqlite3*, int);
-int sqlite3CodeSubselect(Parse*, Expr *, int, int);
+void sqlite3CodeRhsOfIN(Parse*, Expr*, int, int);
+int sqlite3CodeSubselect(Parse*, Expr*);
 void sqlite3SelectPrep(Parse*, Select*, NameContext*);
 void sqlite3SelectWrongNumTermsError(Parse *pParse, Select *p);
 int sqlite3MatchSpanName(const char*, const char*, const char*, const char*);
 int sqlite3ResolveExprNames(NameContext*, Expr*);
 int sqlite3ResolveExprListNames(NameContext*, ExprList*);
 void sqlite3ResolveSelectNames(Parse*, Select*, NameContext*);
-void sqlite3ResolveSelfReference(Parse*,Table*,int,Expr*,ExprList*);
+int sqlite3ResolveSelfReference(Parse*,Table*,int,Expr*,ExprList*);
 int sqlite3ResolveOrderGroupBy(Parse*, Select*, ExprList*, const char*);
 void sqlite3ColumnDefault(Vdbe *, Table *, int, int);
 void sqlite3AlterFinishAddColumn(Parse *, Token *);
 void sqlite3AlterBeginAddColumn(Parse *, SrcList *);
 void *sqlite3RenameTokenMap(Parse*, void*, Token*);
@@ -4425,11 +4448,11 @@
 sqlite3_int64 sqlite3StmtCurrentTime(sqlite3_context*);
 int sqlite3VdbeParameterIndex(Vdbe*, const char*, int);
 int sqlite3TransferBindings(sqlite3_stmt *, sqlite3_stmt *);
 void sqlite3ParserReset(Parse*);
 #ifdef SQLITE_ENABLE_NORMALIZE
-void sqlite3Normalize(Vdbe*, const char*, int, u8);
+char *sqlite3Normalize(Vdbe*, const char*);
 #endif
 int sqlite3Reprepare(Vdbe*);
 void sqlite3ExprListCheckLength(Parse*, ExprList*, const char*);
 CollSeq *sqlite3BinaryCompareCollSeq(Parse *, Expr *, Expr *);
 int sqlite3TempInMemory(const sqlite3*);
@@ -4521,11 +4544,11 @@
 ** Allowed flags for the 3rd parameter to sqlite3FindInIndex().
 */
 #define IN_INDEX_NOOP_OK     0x0001  /* OK to return IN_INDEX_NOOP */
 #define IN_INDEX_MEMBERSHIP  0x0002  /* IN operator used for membership test */
 #define IN_INDEX_LOOP        0x0004  /* IN operator used as a loop */
-int sqlite3FindInIndex(Parse *, Expr *, u32, int*, int*);
+int sqlite3FindInIndex(Parse *, Expr *, u32, int*, int*, int*);
 
 int sqlite3JournalOpen(sqlite3_vfs *, const char *, sqlite3_file *, int, int);
 int sqlite3JournalSize(sqlite3_vfs *);
 #if defined(SQLITE_ENABLE_ATOMIC_WRITE) \
  || defined(SQLITE_ENABLE_BATCH_ATOMIC_WRITE)

Index: src/tclsqlite.c
==================================================================
--- src/tclsqlite.c
+++ src/tclsqlite.c
@@ -2416,52 +2416,79 @@
     }
     break;
   }
 
   /*
-  **     $db deserialize ?DATABASE? VALUE
+  **     $db deserialize ?-maxsize N? ?-readonly BOOL? ?DATABASE? VALUE
   **
   ** Reopen DATABASE (default "main") using the content in $VALUE
   */
   case DB_DESERIALIZE: {
 #ifndef SQLITE_ENABLE_DESERIALIZE
     Tcl_AppendResult(interp, "MEMDB not available in this build",
                      (char*)0);
     rc = TCL_ERROR;
 #else
-    const char *zSchema;
-    Tcl_Obj *pValue;
+    const char *zSchema = 0;
+    Tcl_Obj *pValue = 0;
     unsigned char *pBA;
     unsigned char *pData;
     int len, xrc;
-    
-    if( objc==3 ){
-      zSchema = 0;
-      pValue = objv[2];
-    }else if( objc==4 ){
-      zSchema = Tcl_GetString(objv[2]);
-      pValue = objv[3];
-    }else{
+    sqlite3_int64 mxSize = 0;
+    int i;
+    int isReadonly = 0;
+
+
+    if( objc<3 ){
       Tcl_WrongNumArgs(interp, 2, objv, "?DATABASE? VALUE");
       rc = TCL_ERROR;
       break;
     }
+    for(i=2; i<objc-1; i++){
+      const char *z = Tcl_GetString(objv[i]);
+      if( strcmp(z,"-maxsize")==0 && i<objc-2 ){
+        rc = Tcl_GetWideIntFromObj(interp, objv[++i], &mxSize);
+        if( rc ) goto deserialize_error;
+        continue;
+      }
+      if( strcmp(z,"-readonly")==0 && i<objc-2 ){
+        rc = Tcl_GetBooleanFromObj(interp, objv[++i], &isReadonly);
+        if( rc ) goto deserialize_error;
+        continue;
+      }
+      if( zSchema==0 && i==objc-2 && z[0]!='-' ){
+        zSchema = z;
+        continue;
+      }
+      Tcl_AppendResult(interp, "unknown option: ", z, (char*)0);
+      rc = TCL_ERROR;
+      goto deserialize_error;
+    }
+    pValue = objv[objc-1];
     pBA = Tcl_GetByteArrayFromObj(pValue, &len);
     pData = sqlite3_malloc64( len );
     if( pData==0 && len>0 ){
       Tcl_AppendResult(interp, "out of memory", (char*)0);
       rc = TCL_ERROR;
     }else{
+      int flags;
       if( len>0 ) memcpy(pData, pBA, len);
-      xrc = sqlite3_deserialize(pDb->db, zSchema, pData, len, len,
-                SQLITE_DESERIALIZE_FREEONCLOSE |
-                SQLITE_DESERIALIZE_RESIZEABLE);
+      if( isReadonly ){
+        flags = SQLITE_DESERIALIZE_FREEONCLOSE | SQLITE_DESERIALIZE_READONLY;
+      }else{
+        flags = SQLITE_DESERIALIZE_FREEONCLOSE | SQLITE_DESERIALIZE_RESIZEABLE;
+      }
+      xrc = sqlite3_deserialize(pDb->db, zSchema, pData, len, len, flags);
       if( xrc ){
         Tcl_AppendResult(interp, "unable to set MEMDB content", (char*)0);
         rc = TCL_ERROR;
       }
+      if( mxSize>0 ){
+        sqlite3_file_control(pDb->db, zSchema,SQLITE_FCNTL_SIZE_LIMIT,&mxSize);
+      }
     }
+deserialize_error:
 #endif
     break; 
   }
 
   /*

Index: src/test1.c
==================================================================
--- src/test1.c
+++ src/test1.c
@@ -6327,11 +6327,11 @@
 }
 
 /*
 ** tclcmd:  database_may_be_corrupt
 **
-** Indicate that database files might be corrupt.  In other words, set the normal
+** Indicate that database files might be corrupt. In other words, set the normal
 ** state of operation.
 */
 static int SQLITE_TCLAPI database_may_be_corrupt(
   ClientData clientData, /* Pointer to sqlite3_enable_XXX function */
   Tcl_Interp *interp,    /* The TCL interpreter that invoked this command */
@@ -6342,12 +6342,13 @@
   return TCL_OK;
 }
 /*
 ** tclcmd:  database_never_corrupt
 **
-** Indicate that database files are always well-formed.  This enables extra assert()
-** statements that test conditions that are always true for well-formed databases.
+** Indicate that database files are always well-formed. This enables
+** extra assert() statements that test conditions that are always true
+** for well-formed databases.
 */
 static int SQLITE_TCLAPI database_never_corrupt(
   ClientData clientData, /* Pointer to sqlite3_enable_XXX function */
   Tcl_Interp *interp,    /* The TCL interpreter that invoked this command */
   int objc,              /* Number of arguments */
@@ -6709,13 +6710,14 @@
 ){
   struct Verb {
     const char *zName;
     int i;
   } aVerb[] = {
-    { "SQLITE_TESTCTRL_LOCALTIME_FAULT", SQLITE_TESTCTRL_LOCALTIME_FAULT }, 
-    { "SQLITE_TESTCTRL_SORTER_MMAP",     SQLITE_TESTCTRL_SORTER_MMAP     }, 
-    { "SQLITE_TESTCTRL_IMPOSTER",        SQLITE_TESTCTRL_IMPOSTER        },
+    { "SQLITE_TESTCTRL_LOCALTIME_FAULT",    SQLITE_TESTCTRL_LOCALTIME_FAULT }, 
+    { "SQLITE_TESTCTRL_SORTER_MMAP",        SQLITE_TESTCTRL_SORTER_MMAP     }, 
+    { "SQLITE_TESTCTRL_IMPOSTER",           SQLITE_TESTCTRL_IMPOSTER        },
+    { "SQLITE_TESTCTRL_INTERNAL_FUNCTIONS", SQLITE_TESTCTRL_INTERNAL_FUNCTIONS},
   };
   int iVerb;
   int iFlag;
   int rc;
 
@@ -6729,18 +6731,19 @@
   );
   if( rc!=TCL_OK ) return rc;
 
   iFlag = aVerb[iVerb].i;
   switch( iFlag ){
+    case SQLITE_TESTCTRL_INTERNAL_FUNCTIONS:
     case SQLITE_TESTCTRL_LOCALTIME_FAULT: {
       int val;
       if( objc!=3 ){
         Tcl_WrongNumArgs(interp, 2, objv, "ONOFF");
         return TCL_ERROR;
       }
       if( Tcl_GetBooleanFromObj(interp, objv[2], &val) ) return TCL_ERROR;
-      sqlite3_test_control(SQLITE_TESTCTRL_LOCALTIME_FAULT, val);
+      sqlite3_test_control(iFlag, val);
       break;
     }
 
     case SQLITE_TESTCTRL_SORTER_MMAP: {
       int val;
@@ -7136,10 +7139,11 @@
   extern int sqlite3_fileio_init(sqlite3*,char**,const sqlite3_api_routines*);
   extern int sqlite3_fuzzer_init(sqlite3*,char**,const sqlite3_api_routines*);
   extern int sqlite3_ieee_init(sqlite3*,char**,const sqlite3_api_routines*);
   extern int sqlite3_nextchar_init(sqlite3*,char**,const sqlite3_api_routines*);
   extern int sqlite3_percentile_init(sqlite3*,char**,const sqlite3_api_routines*);
+  extern int sqlite3_prefixes_init(sqlite3*,char**,const sqlite3_api_routines*);
   extern int sqlite3_regexp_init(sqlite3*,char**,const sqlite3_api_routines*);
   extern int sqlite3_remember_init(sqlite3*,char**,const sqlite3_api_routines*);
   extern int sqlite3_series_init(sqlite3*,char**,const sqlite3_api_routines*);
   extern int sqlite3_spellfix_init(sqlite3*,char**,const sqlite3_api_routines*);
   extern int sqlite3_totype_init(sqlite3*,char**,const sqlite3_api_routines*);
@@ -7161,10 +7165,11 @@
     { "fileio",                sqlite3_fileio_init               },
     { "fuzzer",                sqlite3_fuzzer_init               },
     { "ieee754",               sqlite3_ieee_init                 },
     { "nextchar",              sqlite3_nextchar_init             },
     { "percentile",            sqlite3_percentile_init           },
+    { "prefixes",              sqlite3_prefixes_init             },
     { "regexp",                sqlite3_regexp_init               },
     { "remember",              sqlite3_remember_init             },
     { "series",                sqlite3_series_init               },
     { "spellfix",              sqlite3_spellfix_init             },
     { "totype",                sqlite3_totype_init               },
@@ -7635,10 +7640,83 @@
     rc = sqlite3_mmap_warm(db, zDb);
     Tcl_SetObjResult(interp, Tcl_NewStringObj(sqlite3ErrName(rc), -1));
     return TCL_OK;
   }
 }
+
+/*
+** Usage:  decode_hexdb TEXT
+**
+** Example:   db deserialize [decode_hexdb $output_of_dbtotxt]
+**
+** This routine returns a byte-array for an SQLite database file that
+** is constructed from a text input which is the output of the "dbtotxt"
+** utility.
+*/
+static int SQLITE_TCLAPI test_decode_hexdb(
+  void * clientData,
+  Tcl_Interp *interp,
+  int objc,
+  Tcl_Obj *CONST objv[]
+){
+  const char *zIn = 0;
+  unsigned char *a = 0;
+  int n = 0;
+  int lineno = 0;
+  int i, iNext;
+  int iOffset = 0;
+  int j, k;
+  int rc;
+  unsigned char x[16];
+  if( objc!=2 ){
+    Tcl_WrongNumArgs(interp, 1, objv, "HEXDB");
+    return TCL_ERROR;
+  }
+  zIn = Tcl_GetString(objv[1]);
+  for(i=0; zIn[i]; i=iNext){
+    lineno++;
+    for(iNext=i; zIn[iNext] && zIn[iNext]!='\n'; iNext++){}
+    if( zIn[iNext]=='\n' ) iNext++;
+    while( zIn[i]==' ' || zIn[i]=='\t' ){ i++; }
+    if( a==0 ){
+      int pgsz;
+      rc = sscanf(zIn+i, "| size %d pagesize %d", &n, &pgsz);
+      if( rc!=2 ) continue;
+      if( n<512 ){
+        Tcl_AppendResult(interp, "bad 'size' field", (void*)0);
+        return TCL_ERROR;
+      }
+      a = malloc( n );
+      if( a==0 ){
+        Tcl_AppendResult(interp, "out of memory", (void*)0);
+        return TCL_ERROR;
+      }
+      memset(a, 0, n);
+      continue;
+    }
+    rc = sscanf(zIn+i, "| page %d offset %d", &j, &k);
+    if( rc==2 ){
+      iOffset = k;
+      continue;
+    }
+    rc = sscanf(zIn+i,"| %d: %hhx %hhx %hhx %hhx %hhx %hhx %hhx %hhx"
+                      "  %hhx %hhx %hhx %hhx %hhx %hhx %hhx %hhx",
+                &j, &x[0], &x[1], &x[2], &x[3], &x[4], &x[5], &x[6], &x[7],
+                &x[8], &x[9], &x[10], &x[11], &x[12], &x[13], &x[14], &x[15]);
+    if( rc==17 ){
+      k = iOffset+j;
+      if( k+16<=n ){
+        memcpy(a+k, x, 16);
+      }
+      continue;
+    }
+  }
+  Tcl_SetObjResult(interp, Tcl_NewByteArrayObj(a, n));
+  free(a);
+  return TCL_OK;
+}
+
 
 /*
 ** Register commands with the TCL interpreter.
 */
 int Sqlitetest1_Init(Tcl_Interp *interp){
@@ -7915,10 +7993,11 @@
 #endif
      { "sqlite3_delete_database", test_delete_database,    0 },
      { "atomic_batch_write",      test_atomic_batch_write, 0 },
      { "sqlite3_mmap_warm",       test_mmap_warm,          0 },
      { "sqlite3_config_sorterref", test_config_sorterref,   0 },
+     { "decode_hexdb",             test_decode_hexdb,       0 },
   };
   static int bitmask_size = sizeof(Bitmask)*8;
   static int longdouble_size = sizeof(LONGDOUBLE_TYPE);
   int i;
   extern int sqlite3_sync_count, sqlite3_fullsync_count;

Index: src/test_vfs.c
==================================================================
--- src/test_vfs.c
+++ src/test_vfs.c
@@ -226,15 +226,17 @@
 static int tvfsResultCode(Testvfs *p, int *pRc){
   struct errcode {
     int eCode;
     const char *zCode;
   } aCode[] = {
-    { SQLITE_OK,     "SQLITE_OK"     },
-    { SQLITE_ERROR,  "SQLITE_ERROR"  },
-    { SQLITE_IOERR,  "SQLITE_IOERR"  },
-    { SQLITE_LOCKED, "SQLITE_LOCKED" },
-    { SQLITE_BUSY,   "SQLITE_BUSY"   },
+    { SQLITE_OK,       "SQLITE_OK"     },
+    { SQLITE_ERROR,    "SQLITE_ERROR"  },
+    { SQLITE_IOERR,    "SQLITE_IOERR"  },
+    { SQLITE_LOCKED,   "SQLITE_LOCKED" },
+    { SQLITE_BUSY,     "SQLITE_BUSY"   },
+    { SQLITE_READONLY, "SQLITE_READONLY"   },
+    { SQLITE_READONLY_CANTINIT, "SQLITE_READONLY_CANTINIT"   },
   };
 
   const char *z;
   int i;
 
@@ -863,11 +865,11 @@
 
   /* Connect the TestvfsBuffer to the new TestvfsShm handle and return. */
   pFd->pNext = pBuffer->pFile;
   pBuffer->pFile = pFd;
   pFd->pShm = pBuffer;
-  return SQLITE_OK;
+  return rc;
 }
 
 static void tvfsAllocPage(TestvfsBuffer *p, int iPage, int pgsz){
   assert( iPage<TESTVFS_MAX_PAGES );
   if( p->aPage[iPage]==0 ){
@@ -916,11 +918,13 @@
   }
 
   if( rc==SQLITE_OK && isWrite && !pFd->pShm->aPage[iPage] ){
     tvfsAllocPage(pFd->pShm, iPage, pgsz);
   }
-  *pp = (void volatile *)pFd->pShm->aPage[iPage];
+  if( rc==SQLITE_OK || rc==SQLITE_READONLY ){
+    *pp = (void volatile *)pFd->pShm->aPage[iPage];
+  }
 
   return rc;
 }
 
 
@@ -1560,12 +1564,119 @@
 
  bad_args:
   Tcl_WrongNumArgs(interp, 1, objv, "VFSNAME ?-noshm BOOL? ?-fullshm BOOL? ?-default BOOL? ?-mxpathname INT? ?-szosfile INT? ?-iversion INT?");
   return TCL_ERROR;
 }
+
+extern int getDbPointer(Tcl_Interp *interp, const char *zA, sqlite3 **ppDb);
+extern const char *sqlite3ErrName(int);
+
+/*
+** tclcmd: vfs_shmlock DB DBNAME (shared|exclusive) (lock|unlock) OFFSET N
+*/
+static int SQLITE_TCLAPI test_vfs_shmlock(
+  void * clientData,
+  Tcl_Interp *interp,
+  int objc,
+  Tcl_Obj *CONST objv[]
+){
+  const char *azArg1[] = {"shared", "exclusive", 0};
+  const char *azArg2[] = {"lock", "unlock", 0};
+  sqlite3 *db = 0;
+  int rc = SQLITE_OK;
+  const char *zDbname = 0;
+  int iArg1 = 0;
+  int iArg2 = 0;
+  int iOffset = 0;
+  int n = 0;
+  sqlite3_file *pFd;
+
+  if( objc!=7 ){
+    Tcl_WrongNumArgs(interp, 1, objv, 
+        "DB DBNAME (shared|exclusive) (lock|unlock) OFFSET N"
+    );
+    return TCL_ERROR;
+  }
+
+  zDbname = Tcl_GetString(objv[2]);
+  if( getDbPointer(interp, Tcl_GetString(objv[1]), &db) 
+   || Tcl_GetIndexFromObj(interp, objv[3], azArg1, "ARG", 0, &iArg1) 
+   || Tcl_GetIndexFromObj(interp, objv[4], azArg2, "ARG", 0, &iArg2) 
+   || Tcl_GetIntFromObj(interp, objv[5], &iOffset)
+   || Tcl_GetIntFromObj(interp, objv[6], &n)
+  ){
+    return TCL_ERROR;
+  }
+
+  sqlite3_file_control(db, zDbname, SQLITE_FCNTL_FILE_POINTER, (void*)&pFd);
+  if( pFd==0 ){
+    return TCL_ERROR;
+  }
+  rc = pFd->pMethods->xShmLock(pFd, iOffset, n, 
+      (iArg1==0 ? SQLITE_SHM_SHARED : SQLITE_SHM_EXCLUSIVE)
+    | (iArg2==0 ? SQLITE_SHM_LOCK : SQLITE_SHM_UNLOCK)
+  );
+  Tcl_SetObjResult(interp, Tcl_NewStringObj(sqlite3ErrName(rc), -1));
+  return TCL_OK;
+}
+
+static int SQLITE_TCLAPI test_vfs_set_readmark(
+  void * clientData,
+  Tcl_Interp *interp,
+  int objc,
+  Tcl_Obj *CONST objv[]
+){
+  sqlite3 *db = 0;
+  int rc = SQLITE_OK;
+  const char *zDbname = 0;
+  int iSlot = 0;
+  int iVal = -1;
+  sqlite3_file *pFd;
+  void volatile *pShm = 0;
+  u32 *aShm;
+  int iOff;
+
+  if( objc!=4 && objc!=5 ){
+    Tcl_WrongNumArgs(interp, 1, objv, "DB DBNAME SLOT ?VALUE?");
+    return TCL_ERROR;
+  }
+
+  zDbname = Tcl_GetString(objv[2]);
+  if( getDbPointer(interp, Tcl_GetString(objv[1]), &db) 
+   || Tcl_GetIntFromObj(interp, objv[3], &iSlot)
+   || (objc==5 && Tcl_GetIntFromObj(interp, objv[4], &iVal))
+  ){
+    return TCL_ERROR;
+  }
+
+  sqlite3_file_control(db, zDbname, SQLITE_FCNTL_FILE_POINTER, (void*)&pFd);
+  if( pFd==0 ){
+    return TCL_ERROR;
+  }
+  rc = pFd->pMethods->xShmMap(pFd, 0, 32*1024, 0, &pShm);
+  if( rc!=SQLITE_OK ){
+    Tcl_SetObjResult(interp, Tcl_NewStringObj(sqlite3ErrName(rc), -1));
+    return TCL_ERROR;
+  }
+  if( pShm==0 ){
+    Tcl_AppendResult(interp, "*-shm is not yet mapped", 0);
+    return TCL_ERROR;
+  }
+  aShm = (u32*)pShm;
+  iOff = 12*2+1+iSlot;
+
+  if( objc==5 ){
+    aShm[iOff] = iVal;
+  }
+  Tcl_SetObjResult(interp, Tcl_NewIntObj(aShm[iOff]));
+
+  return TCL_OK;
+}
 
 int Sqlitetestvfs_Init(Tcl_Interp *interp){
   Tcl_CreateObjCommand(interp, "testvfs", testvfs_cmd, 0, 0);
+  Tcl_CreateObjCommand(interp, "vfs_shmlock", test_vfs_shmlock, 0, 0);
+  Tcl_CreateObjCommand(interp, "vfs_set_readmark", test_vfs_set_readmark, 0, 0);
   return TCL_OK;
 }
 
 #endif

Index: src/tokenize.c
==================================================================
--- src/tokenize.c
+++ src/tokenize.c
@@ -543,77 +543,10 @@
   while( IdChar(z[i]) ){ i++; }
   *tokenType = TK_ID;
   return i;
 }
 
-#ifdef SQLITE_ENABLE_NORMALIZE
-/*
-** Return the length (in bytes) of the token that begins at z[0].
-** Store the token type in *tokenType before returning.  If flags has
-** SQLITE_TOKEN_NORMALIZE flag enabled, use the identifier token type
-** for keywords.  Add SQLITE_TOKEN_QUOTED to flags if the token was
-** actually a quoted identifier.  Add SQLITE_TOKEN_KEYWORD to flags
-** if the token was recognized as a keyword; this is useful when the
-** SQLITE_TOKEN_NORMALIZE flag is used, because it enables the caller
-** to differentiate between a keyword being treated as an identifier
-** (for normalization purposes) and an actual identifier.
-*/
-int sqlite3GetTokenNormalized(
-  const unsigned char *z,
-  int *tokenType,
-  int *flags
-){
-  int n;
-  unsigned char iClass = aiClass[*z];
-  if( iClass==CC_KYWD ){
-    int i;
-    for(i=1; aiClass[z[i]]<=CC_KYWD; i++){}
-    if( IdChar(z[i]) ){
-      /* This token started out using characters that can appear in keywords,
-      ** but z[i] is a character not allowed within keywords, so this must
-      ** be an identifier instead */
-      i++;
-      while( IdChar(z[i]) ){ i++; }
-      *tokenType = TK_ID;
-      return i;
-    }
-    *tokenType = TK_ID;
-    n = keywordCode((char*)z, i, tokenType);
-    /* If the token is no longer considered to be an identifier, then it is a
-    ** keyword of some kind.  Make the token back into an identifier and then
-    ** set the SQLITE_TOKEN_KEYWORD flag.  Several non-identifier tokens are
-    ** used verbatim, including IN, IS, NOT, and NULL. */
-    switch( *tokenType ){
-      case TK_ID: {
-        /* do nothing, handled by caller */
-        break;
-      }
-      case TK_IN:
-      case TK_IS:
-      case TK_NOT:
-      case TK_NULL: {
-        *flags |= SQLITE_TOKEN_KEYWORD;
-        break;
-      }
-      default: {
-        *tokenType = TK_ID;
-        *flags |= SQLITE_TOKEN_KEYWORD;
-        break;
-      }
-    }
-  }else{
-    n = sqlite3GetToken(z, tokenType);
-    /* If the token is considered to be an identifier and the character class
-    ** of the first character is a quote, set the SQLITE_TOKEN_QUOTED flag. */
-    if( *tokenType==TK_ID && (iClass==CC_QUOTE || iClass==CC_QUOTE2) ){
-      *flags |= SQLITE_TOKEN_QUOTED;
-    }
-  }
-  return n;
-}
-#endif /* SQLITE_ENABLE_NORMALIZE */
-
 /*
 ** Run the parser on the given SQL string.  The parser structure is
 ** passed in.  An SQLITE_ status code is returned.  If an error occurs
 ** then an and attempt is made to write an error message into 
 ** memory obtained from sqlite3_malloc() and to make *pzErrMsg point to that
@@ -637,11 +570,18 @@
     db->u1.isInterrupted = 0;
   }
   pParse->rc = SQLITE_OK;
   pParse->zTail = zSql;
   assert( pzErrMsg!=0 );
-  /* sqlite3ParserTrace(stdout, "parser: "); */
+#ifdef SQLITE_DEBUG
+  if( db->flags & SQLITE_ParserTrace ){
+    printf("parser: [[[%s]]]\n", zSql);
+    sqlite3ParserTrace(stdout, "parser: ");
+  }else{
+    sqlite3ParserTrace(0, 0);
+  }
+#endif
 #ifdef sqlite3Parser_ENGINEALWAYSONSTACK
   pEngine = &sEngine;
   sqlite3ParserInit(pEngine, pParse);
 #else
   pEngine = sqlite3ParserAlloc(sqlite3Malloc, pParse);
@@ -779,5 +719,140 @@
     sqlite3DeleteTable(db, p);
   }
   assert( nErr==0 || pParse->rc!=SQLITE_OK );
   return nErr;
 }
+
+
+#ifdef SQLITE_ENABLE_NORMALIZE
+/*
+** Insert a single space character into pStr if the current string
+** ends with an identifier
+*/
+static void addSpaceSeparator(sqlite3_str *pStr){
+  if( pStr->nChar && sqlite3IsIdChar(pStr->zText[pStr->nChar-1]) ){
+    sqlite3_str_append(pStr, " ", 1);
+  }
+}
+
+/*
+** Compute a normalization of the SQL given by zSql[0..nSql-1].  Return
+** the normalization in space obtained from sqlite3DbMalloc().  Or return
+** NULL if anything goes wrong or if zSql is NULL.
+*/
+char *sqlite3Normalize(
+  Vdbe *pVdbe,       /* VM being reprepared */
+  const char *zSql   /* The original SQL string */
+){
+  sqlite3 *db;       /* The database connection */
+  int i;             /* Next unread byte of zSql[] */
+  int n;             /* length of current token */
+  int tokenType;     /* type of current token */
+  int prevType = 0;  /* Previous non-whitespace token */
+  int nParen;        /* Number of nested levels of parentheses */
+  int iStartIN;      /* Start of RHS of IN operator in z[] */
+  int nParenAtIN;    /* Value of nParent at start of RHS of IN operator */
+  int j;             /* Bytes of normalized SQL generated so far */
+  sqlite3_str *pStr; /* The normalized SQL string under construction */
+
+  db = sqlite3VdbeDb(pVdbe);
+  tokenType = -1;
+  nParen = iStartIN = nParenAtIN = 0;
+  pStr = sqlite3_str_new(db);
+  assert( pStr!=0 );  /* sqlite3_str_new() never returns NULL */
+  for(i=0; zSql[i] && pStr->accError==0; i+=n){
+    if( tokenType!=TK_SPACE ){
+      prevType = tokenType;
+    }
+    n = sqlite3GetToken((unsigned char*)zSql+i, &tokenType);
+    if( NEVER(n<=0) ) break;
+    switch( tokenType ){
+      case TK_SPACE: {
+        break;
+      }
+      case TK_NULL: {
+        if( prevType==TK_IS || prevType==TK_NOT ){
+          sqlite3_str_append(pStr, " NULL", 5);
+          break;
+        }
+        /* Fall through */
+      }
+      case TK_STRING:
+      case TK_INTEGER:
+      case TK_FLOAT:
+      case TK_VARIABLE:
+      case TK_BLOB: {
+        sqlite3_str_append(pStr, "?", 1);
+        break;
+      }
+      case TK_LP: {
+        nParen++;
+        if( prevType==TK_IN ){
+          iStartIN = pStr->nChar;
+          nParenAtIN = nParen;
+        }
+        sqlite3_str_append(pStr, "(", 1);
+        break;
+      }
+      case TK_RP: {
+        if( iStartIN>0 && nParen==nParenAtIN ){
+          assert( pStr->nChar>=iStartIN );
+          pStr->nChar = iStartIN+1;
+          sqlite3_str_append(pStr, "?,?,?", 5);
+          iStartIN = 0;
+        }
+        nParen--;
+        sqlite3_str_append(pStr, ")", 1);
+        break;
+      }
+      case TK_ID: {
+        iStartIN = 0;
+        j = pStr->nChar;
+        if( sqlite3Isquote(zSql[i]) ){
+          char *zId = sqlite3DbStrNDup(db, zSql+i, n);
+          int nId;
+          int eType = 0;
+          if( zId==0 ) break;
+          sqlite3Dequote(zId);
+          if( zSql[i]=='"' && sqlite3VdbeUsesDoubleQuotedString(pVdbe, zId) ){
+            sqlite3_str_append(pStr, "?", 1);
+            sqlite3DbFree(db, zId);
+            break;
+          }
+          nId = sqlite3Strlen30(zId);
+          if( sqlite3GetToken((u8*)zId, &eType)==nId && eType==TK_ID ){
+            addSpaceSeparator(pStr);
+            sqlite3_str_append(pStr, zId, nId);
+          }else{
+            sqlite3_str_appendf(pStr, "\"%w\"", zId);
+          }
+          sqlite3DbFree(db, zId);
+        }else{
+          addSpaceSeparator(pStr);
+          sqlite3_str_append(pStr, zSql+i, n);
+        }
+        while( j<pStr->nChar ){
+          pStr->zText[j] = sqlite3Tolower(pStr->zText[j]);
+          j++;
+        }
+        break;
+      }
+      case TK_SELECT: {
+        iStartIN = 0;
+        /* fall through */
+      }
+      default: {
+        if( sqlite3IsIdChar(zSql[i]) ) addSpaceSeparator(pStr);
+        j = pStr->nChar;
+        sqlite3_str_append(pStr, zSql+i, n);
+        while( j<pStr->nChar ){
+          pStr->zText[j] = sqlite3Toupper(pStr->zText[j]);
+          j++;
+        }
+        break;
+      }
+    }
+  }
+  if( tokenType!=TK_SEMI ) sqlite3_str_append(pStr, ";", 1);
+  return sqlite3_str_finish(pStr);
+}
+#endif /* SQLITE_ENABLE_NORMALIZE */

Index: src/treeview.c
==================================================================
--- src/treeview.c
+++ src/treeview.c
@@ -136,11 +136,12 @@
       sqlite3_str_appendf(&x, " %s.%s", pItem->zDatabase, pItem->zName);
     }else if( pItem->zName ){
       sqlite3_str_appendf(&x, " %s", pItem->zName);
     }
     if( pItem->pTab ){
-      sqlite3_str_appendf(&x, " tabname=%Q", pItem->pTab->zName);
+      sqlite3_str_appendf(&x, " tab=%Q nCol=%d ptr=%p",
+           pItem->pTab->zName, pItem->pTab->nCol, pItem->pTab);
     }
     if( pItem->zAlias ){
       sqlite3_str_appendf(&x, " (AS %s)", pItem->zAlias);
     }
     if( pItem->fg.jointype & JT_LEFT ){

Index: src/trigger.c
==================================================================
--- src/trigger.c
+++ src/trigger.c
@@ -730,11 +730,11 @@
 ){
   sqlite3 *db = pParse->db;
   int iDb;             /* Index of the database to use */
   SrcList *pSrc;       /* SrcList to be returned */
 
-  pSrc = sqlite3SrcListAppend(db, 0, 0, 0);
+  pSrc = sqlite3SrcListAppend(pParse, 0, 0, 0);
   if( pSrc ){
     assert( pSrc->nSrc>0 );
     pSrc->a[pSrc->nSrc-1].zName = sqlite3DbStrDup(db, pStep->zTarget);
     iDb = sqlite3SchemaToIndex(db, pStep->pTrig->pSchema);
     if( iDb==0 || iDb>=2 ){
@@ -915,10 +915,11 @@
   pSubParse->pTriggerTab = pTab;
   pSubParse->pToplevel = pTop;
   pSubParse->zAuthContext = pTrigger->zName;
   pSubParse->eTriggerOp = pTrigger->op;
   pSubParse->nQueryLoop = pParse->nQueryLoop;
+  pSubParse->disableVtab = pParse->disableVtab;
 
   v = sqlite3GetVdbe(pSubParse);
   if( v ){
     VdbeComment((v, "Start: %s.%s (%s %s%s%s ON %s)", 
       pTrigger->zName, onErrorText(orconf),
@@ -942,11 +943,11 @@
     if( pTrigger->pWhen ){
       pWhen = sqlite3ExprDup(db, pTrigger->pWhen, 0);
       if( SQLITE_OK==sqlite3ResolveExprNames(&sNC, pWhen) 
        && db->mallocFailed==0 
       ){
-        iEndTrigger = sqlite3VdbeMakeLabel(v);
+        iEndTrigger = sqlite3VdbeMakeLabel(pSubParse);
         sqlite3ExprIfFalse(pSubParse, pWhen, iEndTrigger, SQLITE_JUMPIFNULL);
       }
       sqlite3ExprDelete(db, pWhen);
     }
 

Index: src/update.c
==================================================================
--- src/update.c
+++ src/update.c
@@ -352,10 +352,11 @@
 
   /* There is one entry in the aRegIdx[] array for each index on the table
   ** being updated.  Fill in aRegIdx[] with a register number that will hold
   ** the key for accessing each index.
   */
+  if( onError==OE_Replace ) bReplace = 1;
   for(j=0, pIdx=pTab->pIndex; pIdx; pIdx=pIdx->pNext, j++){
     int reg;
     if( chngKey || hasFK>1 || pIdx==pPk
      || indexWhereClauseMightChange(pIdx,aXRef,chngRowid)
     ){
@@ -365,13 +366,11 @@
       reg = 0;
       for(i=0; i<pIdx->nKeyCol; i++){
         if( indexColumnIsBeingUpdated(pIdx, i, aXRef, chngRowid) ){
           reg = ++pParse->nMem;
           pParse->nMem += pIdx->nColumn;
-          if( (onError==OE_Replace)
-           || (onError==OE_Default && pIdx->onError==OE_Replace) 
-          ){
+          if( onError==OE_Default && pIdx->onError==OE_Replace ){
             bReplace = 1;
           }
           break;
         }
       }
@@ -439,11 +438,11 @@
     goto update_cleanup;
   }
 #endif
 
   /* Jump to labelBreak to abandon further processing of this UPDATE */
-  labelContinue = labelBreak = sqlite3VdbeMakeLabel(v);
+  labelContinue = labelBreak = sqlite3VdbeMakeLabel(pParse);
 
   /* Not an UPSERT.  Normal processing.  Begin by
   ** initialize the count of updated rows */
   if( (db->flags&SQLITE_CountRows)!=0
    && !pParse->pTriggerTab
@@ -574,17 +573,17 @@
         assert( pPk );
         sqlite3VdbeAddOp4Int(v, OP_NotFound, iDataCur, labelBreak, regKey,nKey);
         VdbeCoverage(v);
       }
       if( eOnePass!=ONEPASS_SINGLE ){
-        labelContinue = sqlite3VdbeMakeLabel(v);
+        labelContinue = sqlite3VdbeMakeLabel(pParse);
       }
       sqlite3VdbeAddOp2(v, OP_IsNull, pPk ? regKey : regOldRowid, labelBreak);
       VdbeCoverageIf(v, pPk==0);
       VdbeCoverageIf(v, pPk!=0);
     }else if( pPk ){
-      labelContinue = sqlite3VdbeMakeLabel(v);
+      labelContinue = sqlite3VdbeMakeLabel(pParse);
       sqlite3VdbeAddOp2(v, OP_Rewind, iEph, labelBreak); VdbeCoverage(v);
       addrTop = sqlite3VdbeAddOp2(v, OP_RowData, iEph, regKey);
       sqlite3VdbeAddOp4Int(v, OP_NotFound, iDataCur, labelContinue, regKey, 0);
       VdbeCoverage(v);
     }else{

Index: src/util.c
==================================================================
--- src/util.c
+++ src/util.c
@@ -236,11 +236,11 @@
 **
 ** The return value is -1 if no dequoting occurs or the length of the
 ** dequoted string, exclusive of the zero terminator, if dequoting does
 ** occur.
 **
-** 2002-Feb-14: This routine is extended to remove MS-Access style
+** 2002-02-14: This routine is extended to remove MS-Access style
 ** brackets from around identifiers.  For example:  "[a-b-c]" becomes
 ** "a-b-c".
 */
 void sqlite3Dequote(char *z){
   char quote;
@@ -261,10 +261,15 @@
     }else{
       z[j++] = z[i];
     }
   }
   z[j] = 0;
+}
+void sqlite3DequoteExpr(Expr *p){
+  assert( sqlite3Isquote(p->u.zToken[0]) );
+  p->flags |= p->u.zToken[0]=='"' ? EP_Quoted|EP_DblQuoted : EP_Quoted;
+  sqlite3Dequote(p->u.zToken);
 }
 
 /*
 ** Generate a Token object from a string
 */

Index: src/vacuum.c
==================================================================
--- src/vacuum.c
+++ src/vacuum.c
@@ -100,20 +100,20 @@
 ** not work if other processes are attached to the original database.
 ** And a power loss in between deleting the original and renaming the
 ** transient would cause the database file to appear to be deleted
 ** following reboot.
 */
-void sqlite3Vacuum(Parse *pParse, Token *pNm){
+void sqlite3Vacuum(Parse *pParse, Token *pNm, Expr *pInto){
   Vdbe *v = sqlite3GetVdbe(pParse);
   int iDb = 0;
-  if( v==0 ) return;
+  if( v==0 ) goto build_vacuum_end;
   if( pNm ){
 #ifndef SQLITE_BUG_COMPATIBLE_20160819
     /* Default behavior:  Report an error if the argument to VACUUM is
     ** not recognized */
     iDb = sqlite3TwoPartName(pParse, pNm, pNm, &pNm);
-    if( iDb<0 ) return;
+    if( iDb<0 ) goto build_vacuum_end;
 #else
     /* When SQLITE_BUG_COMPATIBLE_20160819 is defined, unrecognized arguments
     ** to VACUUM are silently ignored.  This is a back-out of a bug fix that
     ** occurred on 2016-08-19 (https://www.sqlite.org/src/info/083f9e6270).
     ** The buggy behavior is required for binary compatibility with some
@@ -121,43 +121,65 @@
     iDb = sqlite3FindDb(pParse->db, pNm);
     if( iDb<0 ) iDb = 0;
 #endif
   }
   if( iDb!=1 ){
+    int iIntoReg = 0;
     sqlite3SchemaWritable(pParse, iDb);
-    sqlite3VdbeAddOp1(v, OP_Vacuum, iDb);
+    if( pInto && sqlite3ResolveSelfReference(pParse,0,0,pInto,0)==0 ){
+      iIntoReg = ++pParse->nMem;
+      sqlite3ExprCode(pParse, pInto, iIntoReg);
+    }
+    sqlite3VdbeAddOp2(v, OP_Vacuum, iDb, iIntoReg);
     sqlite3VdbeUsesBtree(v, iDb);
   }
+build_vacuum_end:
+  sqlite3ExprDelete(pParse->db, pInto);
   return;
 }
 
 /*
 ** This routine implements the OP_Vacuum opcode of the VDBE.
 */
-int sqlite3RunVacuum(char **pzErrMsg, sqlite3 *db, int iDb){
+int sqlite3RunVacuum(
+  char **pzErrMsg,        /* Write error message here */
+  sqlite3 *db,            /* Database connection */
+  int iDb,                /* Which attached DB to vacuum */
+  sqlite3_value *pOut     /* Write results here, if not NULL */
+){
   int rc = SQLITE_OK;     /* Return code from service routines */
   Btree *pMain;           /* The database being vacuumed */
   Btree *pTemp;           /* The temporary database we vacuum into */
-  u16 saved_mDbFlags;     /* Saved value of db->mDbFlags */
-  u32 saved_flags;        /* Saved value of db->flags */
+  u32 saved_mDbFlags;     /* Saved value of db->mDbFlags */
+  u64 saved_flags;        /* Saved value of db->flags */
   int saved_nChange;      /* Saved value of db->nChange */
   int saved_nTotalChange; /* Saved value of db->nTotalChange */
   u8 saved_mTrace;        /* Saved trace settings */
   Db *pDb = 0;            /* Database to detach at end of vacuum */
   int isMemDb;            /* True if vacuuming a :memory: database */
   int nRes;               /* Bytes of reserved space at the end of each page */
   int nDb;                /* Number of attached databases */
   const char *zDbMain;    /* Schema name of database to vacuum */
+  const char *zOut;       /* Name of output file */
 
   if( !db->autoCommit ){
     sqlite3SetString(pzErrMsg, db, "cannot VACUUM from within a transaction");
     return SQLITE_ERROR;
   }
   if( db->nVdbeActive>1 ){
     sqlite3SetString(pzErrMsg, db,"cannot VACUUM - SQL statements in progress");
     return SQLITE_ERROR;
   }
+  if( pOut ){
+    if( sqlite3_value_type(pOut)!=SQLITE_TEXT ){
+      sqlite3SetString(pzErrMsg, db, "non-text filename");
+      return SQLITE_ERROR;
+    }
+    zOut = (const char*)sqlite3_value_text(pOut);
+  }else{
+    zOut = "";
+  }
 
   /* Save the current value of the database flags so that it can be 
   ** restored before returning. Then set the writable-schema flag, and
   ** disable CHECK and foreign key constraints.  */
   saved_flags = db->flags;
@@ -165,11 +187,12 @@
   saved_nChange = db->nChange;
   saved_nTotalChange = db->nTotalChange;
   saved_mTrace = db->mTrace;
   db->flags |= SQLITE_WriteSchema | SQLITE_IgnoreChecks;
   db->mDbFlags |= DBFLAG_PreferBuiltin | DBFLAG_Vacuum;
-  db->flags &= ~(SQLITE_ForeignKeys | SQLITE_ReverseOrder | SQLITE_CountRows);
+  db->flags &= ~(u64)(SQLITE_ForeignKeys | SQLITE_ReverseOrder
+                   | SQLITE_Defensive | SQLITE_CountRows);
   db->mTrace = 0;
 
   zDbMain = db->aDb[iDb].zDbSName;
   pMain = db->aDb[iDb].pBt;
   isMemDb = sqlite3PagerIsMemdb(sqlite3BtreePager(pMain));
@@ -187,23 +210,25 @@
   ** empty.  Only the journal header is written.  Apparently it takes more
   ** time to parse and run the PRAGMA to turn journalling off than it does
   ** to write the journal header file.
   */
   nDb = db->nDb;
-  rc = execSql(db, pzErrMsg, "ATTACH''AS vacuum_db");
+  rc = execSqlF(db, pzErrMsg, "ATTACH %Q AS vacuum_db", zOut);
   if( rc!=SQLITE_OK ) goto end_of_vacuum;
   assert( (db->nDb-1)==nDb );
   pDb = &db->aDb[nDb];
   assert( strcmp(pDb->zDbSName,"vacuum_db")==0 );
   pTemp = pDb->pBt;
-
-  /* The call to execSql() to attach the temp database has left the file
-  ** locked (as there was more than one active statement when the transaction
-  ** to read the schema was concluded. Unlock it here so that this doesn't
-  ** cause problems for the call to BtreeSetPageSize() below.  */
-  sqlite3BtreeCommit(pTemp);
-
+  if( pOut ){
+    sqlite3_file *id = sqlite3PagerFile(sqlite3BtreePager(pTemp));
+    i64 sz = 0;
+    if( id->pMethods!=0 && (sqlite3OsFileSize(id, &sz)!=SQLITE_OK || sz>0) ){
+      rc = SQLITE_ERROR;
+      sqlite3SetString(pzErrMsg, db, "output file already exists");
+      goto end_of_vacuum;
+    }
+  }
   nRes = sqlite3BtreeGetOptimalReserve(pMain);
 
   /* A VACUUM cannot change the pagesize of an encrypted database. */
 #ifdef SQLITE_HAS_CODEC
   if( db->nextPagesize ){
@@ -223,11 +248,11 @@
   ** file. This is done before the sqlite3BtreeGetPageSize(pMain) call below,
   ** to ensure that we do not try to change the page-size on a WAL database.
   */
   rc = execSql(db, pzErrMsg, "BEGIN");
   if( rc!=SQLITE_OK ) goto end_of_vacuum;
-  rc = sqlite3BtreeBeginTrans(pMain, 2, 0);
+  rc = sqlite3BtreeBeginTrans(pMain, pOut==0 ? 2 : 0, 0);
   if( rc!=SQLITE_OK ) goto end_of_vacuum;
 
   /* Do not attempt to change the page size for a WAL database */
   if( sqlite3PagerGetJournalMode(sqlite3BtreePager(pMain))
                                                ==PAGER_JOURNALMODE_WAL ){
@@ -318,11 +343,11 @@
        BTREE_USER_VERSION,       0,  /* Preserve the user version */
        BTREE_APPLICATION_ID,     0,  /* Preserve the application id */
     };
 
     assert( 1==sqlite3BtreeIsInTrans(pTemp) );
-    assert( 1==sqlite3BtreeIsInTrans(pMain) );
+    assert( pOut!=0 || 1==sqlite3BtreeIsInTrans(pMain) );
 
     /* Copy Btree meta values */
     for(i=0; i<ArraySize(aCopy); i+=2){
       /* GetMeta() and UpdateMeta() cannot fail in this context because
       ** we already have page 1 loaded into cache and marked dirty. */
@@ -329,21 +354,27 @@
       sqlite3BtreeGetMeta(pMain, aCopy[i], &meta);
       rc = sqlite3BtreeUpdateMeta(pTemp, aCopy[i], meta+aCopy[i+1]);
       if( NEVER(rc!=SQLITE_OK) ) goto end_of_vacuum;
     }
 
-    rc = sqlite3BtreeCopyFile(pMain, pTemp);
+    if( pOut==0 ){
+      rc = sqlite3BtreeCopyFile(pMain, pTemp);
+    }
     if( rc!=SQLITE_OK ) goto end_of_vacuum;
     rc = sqlite3BtreeCommit(pTemp);
     if( rc!=SQLITE_OK ) goto end_of_vacuum;
 #ifndef SQLITE_OMIT_AUTOVACUUM
-    sqlite3BtreeSetAutoVacuum(pMain, sqlite3BtreeGetAutoVacuum(pTemp));
+    if( pOut==0 ){
+      sqlite3BtreeSetAutoVacuum(pMain, sqlite3BtreeGetAutoVacuum(pTemp));
+    }
 #endif
   }
 
   assert( rc==SQLITE_OK );
-  rc = sqlite3BtreeSetPageSize(pMain, sqlite3BtreeGetPageSize(pTemp), nRes,1);
+  if( pOut==0 ){
+    rc = sqlite3BtreeSetPageSize(pMain, sqlite3BtreeGetPageSize(pTemp), nRes,1);
+  }
 
 end_of_vacuum:
   /* Restore the original value of db->flags */
   db->init.iDb = 0;
   db->mDbFlags = saved_mDbFlags;

Index: src/vdbe.c
==================================================================
--- src/vdbe.c
+++ src/vdbe.c
@@ -238,10 +238,15 @@
       ROUND8(sizeof(VdbeCursor)) + 2*sizeof(u32)*nField + 
       (eCurType==CURTYPE_BTREE?sqlite3BtreeCursorSize():0);
 
   assert( iCur>=0 && iCur<p->nCursor );
   if( p->apCsr[iCur] ){ /*OPTIMIZATION-IF-FALSE*/
+    /* Before calling sqlite3VdbeFreeCursor(), ensure the isEphemeral flag
+    ** is clear. Otherwise, if this is an ephemeral cursor created by 
+    ** OP_OpenDup, the cursor will not be closed and will still be part
+    ** of a BtShared.pCursor list.  */
+    p->apCsr[iCur]->isEphemeral = 0;
     sqlite3VdbeFreeCursor(p, p->apCsr[iCur]);
     p->apCsr[iCur] = 0;
   }
   if( SQLITE_OK==sqlite3VdbeMemClearAndResize(pMem, nByte) ){
     p->apCsr[iCur] = pCx = (VdbeCursor*)pMem->z;
@@ -378,10 +383,11 @@
 ** accordingly.
 */
 static u16 SQLITE_NOINLINE computeNumericType(Mem *pMem){
   assert( (pMem->flags & (MEM_Int|MEM_Real))==0 );
   assert( (pMem->flags & (MEM_Str|MEM_Blob))!=0 );
+  ExpandBlob(pMem);
   if( sqlite3AtoF(pMem->z, &pMem->u.r, pMem->n, pMem->enc)==0 ){
     return 0;
   }
   if( sqlite3Atoi64(pMem->z, &pMem->u.i, pMem->n, pMem->enc)==0 ){
     return MEM_Int;
@@ -1576,12 +1582,12 @@
         if( rA==(double)0 ) goto arithmetic_result_is_null;
         rB /= rA;
         break;
       }
       default: {
-        iA = (i64)rA;
-        iB = (i64)rB;
+        iA = sqlite3VdbeIntValue(pIn1);
+        iB = sqlite3VdbeIntValue(pIn2);
         if( iA==0 ) goto arithmetic_result_is_null;
         if( iA==-1 ) iA = 1;
         rB = (double)(iB % iA);
         break;
       }
@@ -1923,11 +1929,12 @@
       ** OP_Eq or OP_Ne) then take the jump or not depending on whether
       ** or not both operands are null.
       */
       assert( pOp->opcode==OP_Eq || pOp->opcode==OP_Ne );
       assert( (flags1 & MEM_Cleared)==0 );
-      assert( (pOp->p5 & SQLITE_JUMPIFNULL)==0 );
+      assert( (pOp->p5 & SQLITE_JUMPIFNULL)==0 || CORRUPT_DB );
+      testcase( (pOp->p5 & SQLITE_JUMPIFNULL)!=0 );
       if( (flags1&flags3&MEM_Null)!=0
        && (flags3&MEM_Cleared)==0
       ){
         res = 0;  /* Operands are equal */
       }else{
@@ -3607,11 +3614,12 @@
   if( pCx==0 ) goto no_mem;
   pCx->nullRow = 1;
   pCx->isEphemeral = 1;
   pCx->pKeyInfo = pOrig->pKeyInfo;
   pCx->isTable = pOrig->isTable;
-  rc = sqlite3BtreeCursor(pOrig->pBtx, MASTER_ROOT, BTREE_WRCSR,
+  pCx->pgnoRoot = pOrig->pgnoRoot;
+  rc = sqlite3BtreeCursor(pOrig->pBtx, pCx->pgnoRoot, BTREE_WRCSR,
                           pCx->pKeyInfo, pCx->uc.pCursor);
   /* The sqlite3BtreeCursor() routine can only fail for the first cursor
   ** opened for a database.  Since there is already an open cursor when this
   ** opcode is run, the sqlite3BtreeCursor() cannot fail */
   assert( rc==SQLITE_OK );
@@ -3624,10 +3632,13 @@
 **
 ** Open a new cursor P1 to a transient table.
 ** The cursor is always opened read/write even if 
 ** the main database is read-only.  The ephemeral
 ** table is deleted automatically when the cursor is closed.
+**
+** If the cursor P1 is already opened on an ephemeral table, the table
+** is cleared (all content is erased).
 **
 ** P2 is the number of columns in the ephemeral table.
 ** The cursor points to a BTree table if P4==0 and to a BTree index
 ** if P4 is not 0.  If P4 is not NULL, it points to a KeyInfo structure
 ** that defines the format of keys in the index.
@@ -3656,45 +3667,54 @@
       SQLITE_OPEN_EXCLUSIVE |
       SQLITE_OPEN_DELETEONCLOSE |
       SQLITE_OPEN_TRANSIENT_DB;
   assert( pOp->p1>=0 );
   assert( pOp->p2>=0 );
-  pCx = allocateCursor(p, pOp->p1, pOp->p2, -1, CURTYPE_BTREE);
-  if( pCx==0 ) goto no_mem;
-  pCx->nullRow = 1;
-  pCx->isEphemeral = 1;
-  rc = sqlite3BtreeOpen(db->pVfs, 0, db, &pCx->pBtx, 
-                        BTREE_OMIT_JOURNAL | BTREE_SINGLE | pOp->p5, vfsFlags);
-  if( rc==SQLITE_OK ){
-    rc = sqlite3BtreeBeginTrans(pCx->pBtx, 1, 0);
-  }
-  if( rc==SQLITE_OK ){
-    /* If a transient index is required, create it by calling
-    ** sqlite3BtreeCreateTable() with the BTREE_BLOBKEY flag before
-    ** opening it. If a transient table is required, just use the
-    ** automatically created table with root-page 1 (an BLOB_INTKEY table).
-    */
-    if( (pCx->pKeyInfo = pKeyInfo = pOp->p4.pKeyInfo)!=0 ){
-      int pgno;
-      assert( pOp->p4type==P4_KEYINFO );
-      rc = sqlite3BtreeCreateTable(pCx->pBtx, &pgno, BTREE_BLOBKEY | pOp->p5); 
-      if( rc==SQLITE_OK ){
-        assert( pgno==MASTER_ROOT+1 );
-        assert( pKeyInfo->db==db );
-        assert( pKeyInfo->enc==ENC(db) );
-        rc = sqlite3BtreeCursor(pCx->pBtx, pgno, BTREE_WRCSR,
-                                pKeyInfo, pCx->uc.pCursor);
-      }
-      pCx->isTable = 0;
-    }else{
-      rc = sqlite3BtreeCursor(pCx->pBtx, MASTER_ROOT, BTREE_WRCSR,
-                              0, pCx->uc.pCursor);
-      pCx->isTable = 1;
-    }
-  }
-  if( rc ) goto abort_due_to_error;
-  pCx->isOrdered = (pOp->p5!=BTREE_UNORDERED);
+  pCx = p->apCsr[pOp->p1];
+  if( pCx ){
+    /* If the ephermeral table is already open, erase all existing content
+    ** so that the table is empty again, rather than creating a new table. */
+    rc = sqlite3BtreeClearTable(pCx->pBtx, pCx->pgnoRoot, 0);
+  }else{
+    pCx = allocateCursor(p, pOp->p1, pOp->p2, -1, CURTYPE_BTREE);
+    if( pCx==0 ) goto no_mem;
+    pCx->nullRow = 1;
+    pCx->isEphemeral = 1;
+    rc = sqlite3BtreeOpen(db->pVfs, 0, db, &pCx->pBtx, 
+                          BTREE_OMIT_JOURNAL | BTREE_SINGLE | pOp->p5,
+                          vfsFlags);
+    if( rc==SQLITE_OK ){
+      rc = sqlite3BtreeBeginTrans(pCx->pBtx, 1, 0);
+    }
+    if( rc==SQLITE_OK ){
+      /* If a transient index is required, create it by calling
+      ** sqlite3BtreeCreateTable() with the BTREE_BLOBKEY flag before
+      ** opening it. If a transient table is required, just use the
+      ** automatically created table with root-page 1 (an BLOB_INTKEY table).
+      */
+      if( (pCx->pKeyInfo = pKeyInfo = pOp->p4.pKeyInfo)!=0 ){
+        assert( pOp->p4type==P4_KEYINFO );
+        rc = sqlite3BtreeCreateTable(pCx->pBtx, (int*)&pCx->pgnoRoot,
+                                     BTREE_BLOBKEY | pOp->p5); 
+        if( rc==SQLITE_OK ){
+          assert( pCx->pgnoRoot==MASTER_ROOT+1 );
+          assert( pKeyInfo->db==db );
+          assert( pKeyInfo->enc==ENC(db) );
+          rc = sqlite3BtreeCursor(pCx->pBtx, pCx->pgnoRoot, BTREE_WRCSR,
+                                  pKeyInfo, pCx->uc.pCursor);
+        }
+        pCx->isTable = 0;
+      }else{
+        pCx->pgnoRoot = MASTER_ROOT;
+        rc = sqlite3BtreeCursor(pCx->pBtx, MASTER_ROOT, BTREE_WRCSR,
+                                0, pCx->uc.pCursor);
+        pCx->isTable = 1;
+      }
+    }
+    pCx->isOrdered = (pOp->p5!=BTREE_UNORDERED);
+  }
+  if( rc ) goto abort_due_to_error;
   break;
 }
 
 /* Opcode: SorterOpen P1 P2 P3 P4 *
 **
@@ -4340,11 +4360,11 @@
   assert( (pIn3->flags & MEM_Int)!=0 || pOp->opcode==OP_SeekRowid );
   assert( pOp->p1>=0 && pOp->p1<p->nCursor );
   pC = p->apCsr[pOp->p1];
   assert( pC!=0 );
 #ifdef SQLITE_DEBUG
-  pC->seekOp = OP_SeekRowid;
+  if( pOp->opcode==OP_SeekRowid ) pC->seekOp = OP_SeekRowid;
 #endif
   assert( pC->isTable );
   assert( pC->eCurType==CURTYPE_BTREE );
   pCrsr = pC->uc.pCursor;
   assert( pCrsr!=0 );
@@ -5248,11 +5268,11 @@
   /* The Next opcode is only used after SeekGT, SeekGE, Rewind, and Found.
   ** The Prev opcode is only used after SeekLT, SeekLE, and Last. */
   assert( pOp->opcode!=OP_Next
        || pC->seekOp==OP_SeekGT || pC->seekOp==OP_SeekGE
        || pC->seekOp==OP_Rewind || pC->seekOp==OP_Found 
-       || pC->seekOp==OP_NullRow);
+       || pC->seekOp==OP_NullRow|| pC->seekOp==OP_SeekRowid);
   assert( pOp->opcode!=OP_Prev
        || pC->seekOp==OP_SeekLT || pC->seekOp==OP_SeekLE
        || pC->seekOp==OP_Last 
        || pC->seekOp==OP_NullRow);
 
@@ -5778,13 +5798,20 @@
       rc = SQLITE_NOMEM_BKPT;
     }else{
       assert( db->init.busy==0 );
       db->init.busy = 1;
       initData.rc = SQLITE_OK;
+      initData.nInitRow = 0;
       assert( !db->mallocFailed );
       rc = sqlite3_exec(db, zSql, sqlite3InitCallback, &initData, 0);
       if( rc==SQLITE_OK ) rc = initData.rc;
+      if( rc==SQLITE_OK && initData.nInitRow==0 ){
+        /* The OP_ParseSchema opcode with a non-NULL P4 argument should parse
+        ** at least one SQL statement. Any less than that indicates that
+        ** the sqlite_master table is corrupt. */
+        rc = SQLITE_CORRUPT_BKPT;
+      }
       sqlite3DbFreeNN(db, zSql);
       db->init.busy = 0;
     }
   }
   if( rc ){
@@ -6143,10 +6170,21 @@
   memset(pFrame->aOnce, 0, (pProgram->nOp + 7)/8);
   p->aOp = aOp = pProgram->aOp;
   p->nOp = pProgram->nOp;
 #ifdef SQLITE_ENABLE_STMT_SCANSTATUS
   p->anExec = 0;
+#endif
+#ifdef SQLITE_DEBUG
+  /* Verify that second and subsequent executions of the same trigger do not
+  ** try to reuse register values from the first use. */
+  {
+    int i;
+    for(i=0; i<p->nMem; i++){
+      aMem[i].pScopyFrom = 0;  /* Prevent false-positive AboutToChange() errs */
+      aMem[i].flags |= MEM_Undefined; /* Cause a fault if this reg is reused */
+    }
+  }
 #endif
   pOp = &aOp[-1];
 
   break;
 }
@@ -6682,18 +6720,23 @@
   break;
 };
 #endif /* SQLITE_OMIT_PRAGMA */
 
 #if !defined(SQLITE_OMIT_VACUUM) && !defined(SQLITE_OMIT_ATTACH)
-/* Opcode: Vacuum P1 * * * *
+/* Opcode: Vacuum P1 P2 * * *
 **
 ** Vacuum the entire database P1.  P1 is 0 for "main", and 2 or more
 ** for an attached database.  The "temp" database may not be vacuumed.
+**
+** If P2 is not zero, then it is a register holding a string which is
+** the file into which the result of vacuum should be written.  When
+** P2 is zero, the vacuum overwrites the original database.
 */
 case OP_Vacuum: {
   assert( p->readOnly==0 );
-  rc = sqlite3RunVacuum(&p->zErrMsg, db, pOp->p1);
+  rc = sqlite3RunVacuum(&p->zErrMsg, db, pOp->p1,
+                        pOp->p2 ? &aMem[pOp->p2] : 0);
   if( rc ) goto abort_due_to_error;
   break;
 }
 #endif
 
@@ -6841,10 +6884,11 @@
 */
 case OP_VDestroy: {
   db->nVDestroy++;
   rc = sqlite3VtabCallDestroy(db, pOp->p1, pOp->p4.z);
   db->nVDestroy--;
+  assert( p->errorAction==OE_Abort && p->usesStmtJournal );
   if( rc ) goto abort_due_to_error;
   break;
 }
 #endif /* SQLITE_OMIT_VIRTUALTABLE */
 
@@ -7084,11 +7128,11 @@
   testcase( pName->enc==SQLITE_UTF16BE );
   testcase( pName->enc==SQLITE_UTF16LE );
   rc = sqlite3VdbeChangeEncoding(pName, SQLITE_UTF8);
   if( rc ) goto abort_due_to_error;
   rc = pVtab->pModule->xRename(pVtab, pName->z);
-  if( isLegacy==0 ) db->flags &= ~SQLITE_LegacyAlter;
+  if( isLegacy==0 ) db->flags &= ~(u64)SQLITE_LegacyAlter;
   sqlite3VtabImportErrmsg(p, pVtab);
   p->expired = 0;
   if( rc ) goto abort_due_to_error;
   break;
 }

Index: src/vdbe.h
==================================================================
--- src/vdbe.h
+++ src/vdbe.h
@@ -154,16 +154,15 @@
 #   define COLNAME_N      2      /* Store the name and decltype */
 # endif
 #endif
 
 /*
-** The following macro converts a relative address in the p2 field
-** of a VdbeOp structure into a negative number so that 
-** sqlite3VdbeAddOpList() knows that the address is relative.  Calling
-** the macro again restores the address.
+** The following macro converts a label returned by sqlite3VdbeMakeLabel()
+** into an index into the Parse.aLabel[] array that contains the resolved
+** address of that label.
 */
-#define ADDR(X)  (-1-(X))
+#define ADDR(X)  (~(X))
 
 /*
 ** The makefile scans the vdbe.c source file and creates the "opcodes.h"
 ** header file that defines a number for each opcode used by the VDBE.
 */
@@ -213,10 +212,16 @@
 # define ExplainQueryPlanParent(P)  sqlite3VdbeExplainParent(P)
 #else
 # define ExplainQueryPlan(P)
 # define ExplainQueryPlanPop(P)
 # define ExplainQueryPlanParent(P) 0
+# define sqlite3ExplainBreakpoint(A,B) /*no-op*/
+#endif
+#if defined(SQLITE_DEBUG) && !defined(SQLITE_OMIT_EXPLAIN)
+  void sqlite3ExplainBreakpoint(const char*,const char*);
+#else
+# define sqlite3ExplainBreakpoint(A,B) /*no-op*/
 #endif
 void sqlite3VdbeAddParseSchemaOp(Parse*,int,char*);
 void sqlite3VdbeChangeOpcode(Vdbe*, u32 addr, u8);
 void sqlite3VdbeChangeP1(Vdbe*, u32 addr, int P1);
 void sqlite3VdbeChangeP2(Vdbe*, u32 addr, int P2);
@@ -228,11 +233,11 @@
 void sqlite3VdbeChangeP4(Vdbe*, int addr, const char *zP4, int N);
 void sqlite3VdbeAppendP4(Vdbe*, void *pP4, int p4type);
 void sqlite3VdbeSetP4KeyInfo(Parse*, Index*);
 void sqlite3VdbeUsesBtree(Vdbe*, int);
 VdbeOp *sqlite3VdbeGetOp(Vdbe*, int);
-int sqlite3VdbeMakeLabel(Vdbe*);
+int sqlite3VdbeMakeLabel(Parse*);
 void sqlite3VdbeRunOnlyOnce(Vdbe*);
 void sqlite3VdbeReusable(Vdbe*);
 void sqlite3VdbeDelete(Vdbe*);
 void sqlite3VdbeClearObject(sqlite3*,Vdbe*);
 void sqlite3VdbeMakeReady(Vdbe*,Parse*);
@@ -249,10 +254,14 @@
 int sqlite3VdbeSetColName(Vdbe*, int, int, const char *, void(*)(void*));
 void sqlite3VdbeCountChanges(Vdbe*);
 sqlite3 *sqlite3VdbeDb(Vdbe*);
 u8 sqlite3VdbePrepareFlags(Vdbe*);
 void sqlite3VdbeSetSql(Vdbe*, const char *z, int n, u8);
+#ifdef SQLITE_ENABLE_NORMALIZE
+void sqlite3VdbeAddDblquoteStr(sqlite3*,Vdbe*,const char*);
+int sqlite3VdbeUsesDoubleQuotedString(Vdbe*,const char*);
+#endif
 void sqlite3VdbeSwap(Vdbe*,Vdbe*);
 VdbeOp *sqlite3VdbeTakeOpArray(Vdbe*, int*, int*);
 sqlite3_value *sqlite3VdbeGetBoundValue(Vdbe*, int, u8);
 void sqlite3VdbeSetVarmask(Vdbe*, int);
 #ifndef SQLITE_OMIT_TRACE

Index: src/vdbeInt.h
==================================================================
--- src/vdbeInt.h
+++ src/vdbeInt.h
@@ -333,19 +333,35 @@
 /* A bitfield type for use inside of structures.  Always follow with :N where
 ** N is the number of bits.
 */
 typedef unsigned bft;  /* Bit Field Type */
 
+/* The ScanStatus object holds a single value for the
+** sqlite3_stmt_scanstatus() interface.
+*/
 typedef struct ScanStatus ScanStatus;
 struct ScanStatus {
   int addrExplain;                /* OP_Explain for loop */
   int addrLoop;                   /* Address of "loops" counter */
   int addrVisit;                  /* Address of "rows visited" counter */
   int iSelectID;                  /* The "Select-ID" for this loop */
   LogEst nEst;                    /* Estimated output rows per loop */
   char *zName;                    /* Name of table or index */
 };
+
+/* The DblquoteStr object holds the text of a double-quoted
+** string for a prepared statement.  A linked list of these objects
+** is constructed during statement parsing and is held on Vdbe.pDblStr.
+** When computing a normalized SQL statement for an SQL statement, that
+** list is consulted for each double-quoted identifier to see if the
+** identifier should really be a string literal.
+*/
+typedef struct DblquoteStr DblquoteStr;
+struct DblquoteStr {
+  DblquoteStr *pNextStr;   /* Next string literal in the list */
+  char z[8];               /* Dequoted value for the string */
+};
 
 /*
 ** An instance of the virtual machine.  This structure contains the complete
 ** state of the virtual machine.
 **
@@ -362,32 +378,33 @@
   int nCursor;            /* Number of slots in apCsr[] */
   u32 cacheCtr;           /* VdbeCursor row cache generation counter */
   int pc;                 /* The program counter */
   int rc;                 /* Value to return */
   int nChange;            /* Number of db changes made since last reset */
-  int iStatement;         /* Statement number (or 0 if has not opened stmt) */
+  int iStatement;         /* Statement number (or 0 if has no opened stmt) */
   i64 iCurrentTime;       /* Value of julianday('now') for this statement */
   i64 nFkConstraint;      /* Number of imm. FK constraints this VM */
   i64 nStmtDefCons;       /* Number of def. constraints when stmt started */
   i64 nStmtDefImmCons;    /* Number of def. imm constraints when stmt started */
+  Mem *aMem;              /* The memory locations */
+  Mem **apArg;            /* Arguments to currently executing user function */
+  VdbeCursor **apCsr;     /* One element of this array for each open cursor */
+  Mem *aVar;              /* Values for the OP_Variable opcode. */
 
   /* When allocating a new Vdbe object, all of the fields below should be
   ** initialized to zero or NULL */
 
   Op *aOp;                /* Space to hold the virtual machine's program */
-  Mem *aMem;              /* The memory locations */
-  Mem **apArg;            /* Arguments to currently executing user function */
+  int nOp;                /* Number of instructions in the program */
+  int nOpAlloc;           /* Slots allocated for aOp[] */
   Mem *aColName;          /* Column names to return */
   Mem *pResultSet;        /* Pointer to an array of results */
   char *zErrMsg;          /* Error message written here */
-  VdbeCursor **apCsr;     /* One element of this array for each open cursor */
-  Mem *aVar;              /* Values for the OP_Variable opcode. */
   VList *pVList;          /* Name of variables */
 #ifndef SQLITE_OMIT_TRACE
   i64 startTime;          /* Time when query started - used for profiling */
 #endif
-  int nOp;                /* Number of instructions in the program */
 #ifdef SQLITE_DEBUG
   int rcApp;              /* errcode set by sqlite3_result_error_code() */
   u32 nWrite;             /* Number of write operations that have occurred */
 #endif
   u16 nResColumn;         /* Number of columns in one row of the result set */
@@ -406,10 +423,11 @@
   yDbMask lockMask;       /* Subset of btreeMask that requires a lock */
   u32 aCounter[7];        /* Counters used by sqlite3_stmt_status() */
   char *zSql;             /* Text of the SQL statement that generated this */
 #ifdef SQLITE_ENABLE_NORMALIZE
   char *zNormSql;         /* Normalization of the associated SQL statement */
+  DblquoteStr *pDblStr;   /* List of double-quoted string literals */
 #endif
   void *pFree;            /* Free this when deleting the vdbe */
   VdbeFrame *pFrame;      /* Parent frame */
   VdbeFrame *pDelFrame;   /* List of frame objects to free on VM reset */
   int nFrame;             /* Number of frames in pFrame list */
@@ -469,11 +487,13 @@
 
 int sqlite2BtreeKeyCompare(BtCursor *, const void *, int, int, int *);
 int sqlite3VdbeIdxKeyCompare(sqlite3*,VdbeCursor*,UnpackedRecord*,int*);
 int sqlite3VdbeIdxRowid(sqlite3*, BtCursor*, i64*);
 int sqlite3VdbeExec(Vdbe*);
+#ifndef SQLITE_OMIT_EXPLAIN
 int sqlite3VdbeList(Vdbe*);
+#endif
 int sqlite3VdbeHalt(Vdbe*);
 int sqlite3VdbeChangeEncoding(Mem *, int);
 int sqlite3VdbeMemTooBig(Mem*);
 int sqlite3VdbeMemCopy(Mem*, const Mem*);
 void sqlite3VdbeMemShallowCopy(Mem*, const Mem*, int);
@@ -508,11 +528,13 @@
 void sqlite3VdbeMemRelease(Mem *p);
 int sqlite3VdbeMemFinalize(Mem*, FuncDef*);
 #ifndef SQLITE_OMIT_WINDOWFUNC
 int sqlite3VdbeMemAggValue(Mem*, Mem*, FuncDef*);
 #endif
+#ifndef SQLITE_OMIT_EXPLAIN
 const char *sqlite3OpcodeName(int);
+#endif
 int sqlite3VdbeMemGrow(Mem *pMem, int n, int preserve);
 int sqlite3VdbeMemClearAndResize(Mem *pMem, int n);
 int sqlite3VdbeCloseStatement(Vdbe *, int);
 #ifdef SQLITE_DEBUG
 int sqlite3VdbeFrameIsValid(VdbeFrame*);

Index: src/vdbeapi.c
==================================================================
--- src/vdbeapi.c
+++ src/vdbeapi.c
@@ -60,18 +60,20 @@
 */
 static SQLITE_NOINLINE void invokeProfileCallback(sqlite3 *db, Vdbe *p){
   sqlite3_int64 iNow;
   sqlite3_int64 iElapse;
   assert( p->startTime>0 );
-  assert( db->xProfile!=0 || (db->mTrace & SQLITE_TRACE_PROFILE)!=0 );
+  assert( (db->mTrace & (SQLITE_TRACE_PROFILE|SQLITE_TRACE_XPROFILE))!=0 );
   assert( db->init.busy==0 );
   assert( p->zSql!=0 );
   sqlite3OsCurrentTimeInt64(db->pVfs, &iNow);
   iElapse = (iNow - p->startTime)*1000000;
+#ifndef SQLITE_OMIT_DEPRECATED  	
   if( db->xProfile ){
     db->xProfile(db->pProfileArg, p->zSql, iElapse);
   }
+#endif
   if( db->mTrace & SQLITE_TRACE_PROFILE ){
     db->xTrace(SQLITE_TRACE_PROFILE, db->pTraceArg, p, (void*)&iElapse);
   }
   p->startTime = 0;
 }
@@ -581,11 +583,11 @@
   if( db->mallocFailed ){
     p->rc = SQLITE_NOMEM;
     return SQLITE_NOMEM_BKPT;
   }
 
-  if( p->pc<=0 && p->expired ){
+  if( p->pc<0 && p->expired ){
     p->rc = SQLITE_SCHEMA;
     rc = SQLITE_ERROR;
     goto end_of_step;
   }
   if( p->pc<0 ){
@@ -600,11 +602,11 @@
     assert( db->nVdbeWrite>0 || db->autoCommit==0 
         || (db->nDeferredCons==0 && db->nDeferredImmCons==0)
     );
 
 #ifndef SQLITE_OMIT_TRACE
-    if( (db->xProfile || (db->mTrace & SQLITE_TRACE_PROFILE)!=0)
+    if( (db->mTrace & (SQLITE_TRACE_PROFILE|SQLITE_TRACE_XPROFILE))!=0
         && !db->init.busy && p->zSql ){
       sqlite3OsCurrentTimeInt64(db->pVfs, &p->startTime);
     }else{
       assert( p->startTime==0 );
     }
@@ -627,20 +629,22 @@
     db->nVdbeExec++;
     rc = sqlite3VdbeExec(p);
     db->nVdbeExec--;
   }
 
+  if( rc!=SQLITE_ROW ){
 #ifndef SQLITE_OMIT_TRACE
-  /* If the statement completed successfully, invoke the profile callback */
-  if( rc!=SQLITE_ROW ) checkProfileCallback(db, p);
+    /* If the statement completed successfully, invoke the profile callback */
+    checkProfileCallback(db, p);
 #endif
 
-  if( rc==SQLITE_DONE && db->autoCommit ){
-    assert( p->rc==SQLITE_OK );
-    p->rc = doWalCallbacks(db);
-    if( p->rc!=SQLITE_OK ){
-      rc = SQLITE_ERROR;
+    if( rc==SQLITE_DONE && db->autoCommit ){
+      assert( p->rc==SQLITE_OK );
+      p->rc = doWalCallbacks(db);
+      if( p->rc!=SQLITE_OK ){
+        rc = SQLITE_ERROR;
+      }
     }
   }
 
   db->errCode = rc;
   if( SQLITE_NOMEM==sqlite3ApiExit(p->db, p->rc) ){
@@ -656,13 +660,13 @@
   */
   assert( rc==SQLITE_ROW  || rc==SQLITE_DONE   || rc==SQLITE_ERROR 
        || (rc&0xff)==SQLITE_BUSY || rc==SQLITE_MISUSE
   );
   assert( (p->rc!=SQLITE_ROW && p->rc!=SQLITE_DONE) || p->rc==p->rcApp );
-  if( (p->prepFlags & SQLITE_PREPARE_SAVESQL)!=0 
-   && rc!=SQLITE_ROW 
-   && rc!=SQLITE_DONE 
+  if( rc!=SQLITE_ROW 
+   && rc!=SQLITE_DONE
+   && (p->prepFlags & SQLITE_PREPARE_SAVESQL)!=0
   ){
     /* If this statement was prepared using saved SQL and an 
     ** error has occurred, then return the error code in p->rc to the
     ** caller. Set the error code in the database handle to the same value.
     */ 
@@ -1280,11 +1284,11 @@
   }
   i--;
   pVar = &p->aVar[i];
   sqlite3VdbeMemRelease(pVar);
   pVar->flags = MEM_Null;
-  sqlite3Error(p->db, SQLITE_OK);
+  p->db->errCode = SQLITE_OK;
 
   /* If the bit corresponding to this variable in Vdbe.expmask is set, then 
   ** binding a new value to this variable invalidates the current query plan.
   **
   ** IMPLEMENTATION-OF: R-48440-37595 If the specific value bound to host
@@ -1706,11 +1710,17 @@
 /*
 ** Return the normalized SQL associated with a prepared statement.
 */
 const char *sqlite3_normalized_sql(sqlite3_stmt *pStmt){
   Vdbe *p = (Vdbe *)pStmt;
-  return p ? p->zNormSql : 0;
+  if( p==0 ) return 0;
+  if( p->zNormSql==0 && ALWAYS(p->zSql!=0) ){
+    sqlite3_mutex_enter(p->db->mutex);
+    p->zNormSql = sqlite3Normalize(p, p->zSql);
+    sqlite3_mutex_leave(p->db->mutex);
+  }
+  return p->zNormSql;
 }
 #endif /* SQLITE_ENABLE_NORMALIZE */
 
 #ifdef SQLITE_ENABLE_PREUPDATE_HOOK
 /*

Index: src/vdbeaux.c
==================================================================
--- src/vdbeaux.c
+++ src/vdbeaux.c
@@ -34,11 +34,11 @@
   p->magic = VDBE_MAGIC_INIT;
   p->pParse = pParse;
   pParse->pVdbe = p;
   assert( pParse->aLabel==0 );
   assert( pParse->nLabel==0 );
-  assert( pParse->nOpAlloc==0 );
+  assert( p->nOpAlloc==0 );
   assert( pParse->szOpAlloc==0 );
   sqlite3VdbeAddOp2(p, OP_Init, 0, 1);
   return p;
 }
 
@@ -62,18 +62,48 @@
   if( (prepFlags & SQLITE_PREPARE_SAVESQL)==0 ){
     p->expmask = 0;
   }
   assert( p->zSql==0 );
   p->zSql = sqlite3DbStrNDup(p->db, z, n);
+}
+
+#ifdef SQLITE_ENABLE_NORMALIZE
+/*
+** Add a new element to the Vdbe->pDblStr list.
+*/
+void sqlite3VdbeAddDblquoteStr(sqlite3 *db, Vdbe *p, const char *z){
+  if( p ){
+    int n = sqlite3Strlen30(z);
+    DblquoteStr *pStr = sqlite3DbMallocRawNN(db,
+                            sizeof(*pStr)+n+1-sizeof(pStr->z));
+    if( pStr ){
+      pStr->pNextStr = p->pDblStr;
+      p->pDblStr = pStr;
+      memcpy(pStr->z, z, n+1);
+    }
+  }
+}
+#endif
+
 #ifdef SQLITE_ENABLE_NORMALIZE
-  assert( p->zNormSql==0 );
-  if( p->zSql && (prepFlags & SQLITE_PREPARE_NORMALIZE)!=0 ){
-    sqlite3Normalize(p, p->zSql, n, prepFlags);
-    assert( p->zNormSql!=0 || p->db->mallocFailed );
+/*
+** zId of length nId is a double-quoted identifier.  Check to see if
+** that identifier is really used as a string literal.
+*/
+int sqlite3VdbeUsesDoubleQuotedString(
+  Vdbe *pVdbe,            /* The prepared statement */
+  const char *zId         /* The double-quoted identifier, already dequoted */
+){
+  DblquoteStr *pStr;
+  assert( zId!=0 );
+  if( pVdbe->pDblStr==0 ) return 0;
+  for(pStr=pVdbe->pDblStr; pStr; pStr=pStr->pNextStr){
+    if( strcmp(zId, pStr->z)==0 ) return 1;
   }
+  return 0;
+}
 #endif
-}
 
 /*
 ** Swap all content between two VDBE structures.
 */
 void sqlite3VdbeSwap(Vdbe *pA, Vdbe *pB){
@@ -90,11 +120,11 @@
   pA->pPrev = pB->pPrev;
   pB->pPrev = pTmp;
   zTmp = pA->zSql;
   pA->zSql = pB->zSql;
   pB->zSql = zTmp;
-#ifdef SQLITE_ENABLE_NORMALIZE
+#if 0
   zTmp = pA->zNormSql;
   pA->zNormSql = pB->zNormSql;
   pB->zNormSql = zTmp;
 #endif
   pB->expmask = pA->expmask;
@@ -107,11 +137,11 @@
 ** Resize the Vdbe.aOp array so that it is at least nOp elements larger 
 ** than its current size. nOp is guaranteed to be less than or equal
 ** to 1024/sizeof(Op).
 **
 ** If an out-of-memory error occurs while resizing the array, return
-** SQLITE_NOMEM. In this case Vdbe.aOp and Parse.nOpAlloc remain 
+** SQLITE_NOMEM. In this case Vdbe.aOp and Vdbe.nOpAlloc remain 
 ** unchanged (this is so that any opcodes already allocated can be 
 ** correctly deallocated along with the rest of the Vdbe).
 */
 static int growOpArray(Vdbe *v, int nOp){
   VdbeOp *pNew;
@@ -123,13 +153,13 @@
   ** during testing only.  With SQLITE_TEST_REALLOC_STRESS grow the op array
   ** by the minimum* amount required until the size reaches 512.  Normal
   ** operation (without SQLITE_TEST_REALLOC_STRESS) is to double the current
   ** size of the op array or add 1KB of space, whichever is smaller. */
 #ifdef SQLITE_TEST_REALLOC_STRESS
-  int nNew = (p->nOpAlloc>=512 ? p->nOpAlloc*2 : p->nOpAlloc+nOp);
+  int nNew = (v->nOpAlloc>=512 ? v->nOpAlloc*2 : v->nOpAlloc+nOp);
 #else
-  int nNew = (p->nOpAlloc ? p->nOpAlloc*2 : (int)(1024/sizeof(Op)));
+  int nNew = (v->nOpAlloc ? v->nOpAlloc*2 : (int)(1024/sizeof(Op)));
   UNUSED_PARAMETER(nOp);
 #endif
 
   /* Ensure that the size of a VDBE does not grow too large */
   if( nNew > p->db->aLimit[SQLITE_LIMIT_VDBE_OP] ){
@@ -136,15 +166,15 @@
     sqlite3OomFault(p->db);
     return SQLITE_NOMEM;
   }
 
   assert( nOp<=(1024/sizeof(Op)) );
-  assert( nNew>=(p->nOpAlloc+nOp) );
+  assert( nNew>=(v->nOpAlloc+nOp) );
   pNew = sqlite3DbRealloc(p->db, v->aOp, nNew*sizeof(Op));
   if( pNew ){
     p->szOpAlloc = sqlite3DbMallocSize(p->db, pNew);
-    p->nOpAlloc = p->szOpAlloc/sizeof(Op);
+    v->nOpAlloc = p->szOpAlloc/sizeof(Op);
     v->aOp = pNew;
   }
   return (pNew ? SQLITE_OK : SQLITE_NOMEM_BKPT);
 }
 
@@ -174,23 +204,23 @@
 ** Use the sqlite3VdbeResolveLabel() function to fix an address and
 ** the sqlite3VdbeChangeP4() function to change the value of the P4
 ** operand.
 */
 static SQLITE_NOINLINE int growOp3(Vdbe *p, int op, int p1, int p2, int p3){
-  assert( p->pParse->nOpAlloc<=p->nOp );
+  assert( p->nOpAlloc<=p->nOp );
   if( growOpArray(p, 1) ) return 1;
-  assert( p->pParse->nOpAlloc>p->nOp );
+  assert( p->nOpAlloc>p->nOp );
   return sqlite3VdbeAddOp3(p, op, p1, p2, p3);
 }
 int sqlite3VdbeAddOp3(Vdbe *p, int op, int p1, int p2, int p3){
   int i;
   VdbeOp *pOp;
 
   i = p->nOp;
   assert( p->magic==VDBE_MAGIC_INIT );
   assert( op>=0 && op<0xff );
-  if( p->pParse->nOpAlloc<=i ){
+  if( p->nOpAlloc<=i ){
     return growOp3(p, op, p1, p2, p3);
   }
   p->nOp++;
   pOp = &p->aOp[i];
   pOp->opcode = (u8)op;
@@ -318,17 +348,33 @@
   pOp = sqlite3VdbeGetOp(pParse->pVdbe, pParse->addrExplain);
   return pOp->p2;
 }
 
 /*
-** Add a new OP_Explain opcode.
+** Set a debugger breakpoint on the following routine in order to
+** monitor the EXPLAIN QUERY PLAN code generation.
+*/
+#if defined(SQLITE_DEBUG)
+void sqlite3ExplainBreakpoint(const char *z1, const char *z2){
+  (void)z1;
+  (void)z2;
+}
+#endif
+
+/*
+** Add a new OP_ opcode.
 **
 ** If the bPush flag is true, then make this opcode the parent for
 ** subsequent Explains until sqlite3VdbeExplainPop() is called.
 */
 void sqlite3VdbeExplain(Parse *pParse, u8 bPush, const char *zFmt, ...){
-  if( pParse->explain==2 ){
+#ifndef SQLITE_DEBUG
+  /* Always include the OP_Explain opcodes if SQLITE_DEBUG is defined.
+  ** But omit them (for performance) during production builds */
+  if( pParse->explain==2 )
+#endif
+  {
     char *zMsg;
     Vdbe *v;
     va_list ap;
     int iThis;
     va_start(ap, zFmt);
@@ -336,18 +382,22 @@
     va_end(ap);
     v = pParse->pVdbe;
     iThis = v->nOp;
     sqlite3VdbeAddOp4(v, OP_Explain, iThis, pParse->addrExplain, 0,
                       zMsg, P4_DYNAMIC);
-    if( bPush) pParse->addrExplain = iThis;
+    sqlite3ExplainBreakpoint(bPush?"PUSH":"", sqlite3VdbeGetOp(v,-1)->p4.z);
+    if( bPush){
+      pParse->addrExplain = iThis;
+    }
   }
 }
 
 /*
 ** Pop the EXPLAIN QUERY PLAN stack one level.
 */
 void sqlite3VdbeExplainPop(Parse *pParse){
+  sqlite3ExplainBreakpoint("POP", 0);
   pParse->addrExplain = sqlite3VdbeExplainParent(pParse);
 }
 #endif /* SQLITE_OMIT_EXPLAIN */
 
 /*
@@ -410,44 +460,62 @@
 ** the label into the resolved address.
 **
 ** The VDBE knows that a P2 value is a label because labels are
 ** always negative and P2 values are suppose to be non-negative.
 ** Hence, a negative P2 value is a label that has yet to be resolved.
+** (Later:) This is only true for opcodes that have the OPFLG_JUMP
+** property.
 **
-** Zero is returned if a malloc() fails.
+** Variable usage notes:
+**
+**     Parse.aLabel[x]     Stores the address that the x-th label resolves
+**                         into.  For testing (SQLITE_DEBUG), unresolved
+**                         labels stores -1, but that is not required.
+**     Parse.nLabelAlloc   Number of slots allocated to Parse.aLabel[]
+**     Parse.nLabel        The *negative* of the number of labels that have
+**                         been issued.  The negative is stored because
+**                         that gives a performance improvement over storing
+**                         the equivalent positive value.
 */
-int sqlite3VdbeMakeLabel(Vdbe *v){
-  Parse *p = v->pParse;
-  int i = p->nLabel++;
-  assert( v->magic==VDBE_MAGIC_INIT );
-  if( (i & (i-1))==0 ){
-    p->aLabel = sqlite3DbReallocOrFree(p->db, p->aLabel, 
-                                       (i*2+1)*sizeof(p->aLabel[0]));
-  }
-  if( p->aLabel ){
-    p->aLabel[i] = -1;
-  }
-  return ADDR(i);
+int sqlite3VdbeMakeLabel(Parse *pParse){
+  return --pParse->nLabel;
 }
 
 /*
 ** Resolve label "x" to be the address of the next instruction to
 ** be inserted.  The parameter "x" must have been obtained from
 ** a prior call to sqlite3VdbeMakeLabel().
 */
+static SQLITE_NOINLINE void resizeResolveLabel(Parse *p, Vdbe *v, int j){
+  int nNewSize = 10 - p->nLabel;
+  p->aLabel = sqlite3DbReallocOrFree(p->db, p->aLabel,
+                     nNewSize*sizeof(p->aLabel[0]));
+  if( p->aLabel==0 ){
+    p->nLabelAlloc = 0;
+  }else{
+#ifdef SQLITE_DEBUG
+    int i;
+    for(i=p->nLabelAlloc; i<nNewSize; i++) p->aLabel[i] = -1;
+#endif
+    p->nLabelAlloc = nNewSize;
+    p->aLabel[j] = v->nOp;
+  }
+}
 void sqlite3VdbeResolveLabel(Vdbe *v, int x){
   Parse *p = v->pParse;
   int j = ADDR(x);
   assert( v->magic==VDBE_MAGIC_INIT );
-  assert( j<p->nLabel );
+  assert( j<-p->nLabel );
   assert( j>=0 );
-  if( p->aLabel ){
 #ifdef SQLITE_DEBUG
-    if( p->db->flags & SQLITE_VdbeAddopTrace ){
-      printf("RESOLVE LABEL %d to %d\n", x, v->nOp);
-    }
+  if( p->db->flags & SQLITE_VdbeAddopTrace ){
+    printf("RESOLVE LABEL %d to %d\n", x, v->nOp);
+  }
 #endif
+  if( p->nLabelAlloc + p->nLabel < 0 ){
+    resizeResolveLabel(p,v,j);
+  }else{
     assert( p->aLabel[j]==(-1) ); /* Labels may only be resolved once */
     p->aLabel[j] = v->nOp;
   }
 }
 
@@ -568,12 +636,13 @@
   sIter.v = v;
 
   while( (pOp = opIterNext(&sIter))!=0 ){
     int opcode = pOp->opcode;
     if( opcode==OP_Destroy || opcode==OP_VUpdate || opcode==OP_VRename 
+     || opcode==OP_VDestroy
      || ((opcode==OP_Halt || opcode==OP_HaltIfNull) 
-      && ((pOp->p1&0xff)==SQLITE_CONSTRAINT && pOp->p2==OE_Abort))
+      && ((pOp->p1)!=SQLITE_OK && pOp->p2==OE_Abort))
     ){
       hasAbort = 1;
       break;
     }
     if( opcode==OP_CreateBtree && pOp->p3==BTREE_INTKEY ) hasCreateTable = 1;
@@ -718,11 +787,11 @@
           if( pOp->p2<0 ){
             /* The mkopcodeh.tcl script has so arranged things that the only
             ** non-jump opcodes less than SQLITE_MX_JUMP_CODE are guaranteed to
             ** have non-negative values for P2. */
             assert( (sqlite3OpcodeProperty[pOp->opcode] & OPFLG_JUMP)!=0 );
-            assert( ADDR(pOp->p2)<pParse->nLabel );
+            assert( ADDR(pOp->p2)<-pParse->nLabel );
             pOp->p2 = aLabel[ADDR(pOp->p2)];
           }
           break;
         }
       }
@@ -757,11 +826,11 @@
 ** fail due to a OOM fault and hence that the return value from
 ** sqlite3VdbeAddOpList() will always be non-NULL.
 */
 #if defined(SQLITE_DEBUG) && !defined(SQLITE_TEST_REALLOC_STRESS)
 void sqlite3VdbeVerifyNoMallocRequired(Vdbe *p, int N){
-  assert( p->nOp + N <= p->pParse->nOpAlloc );
+  assert( p->nOp + N <= p->nOpAlloc );
 }
 #endif
 
 /*
 ** Verify that the VM passed as the only argument does not contain
@@ -829,11 +898,11 @@
 ){
   int i;
   VdbeOp *pOut, *pFirst;
   assert( nOp>0 );
   assert( p->magic==VDBE_MAGIC_INIT );
-  if( p->nOp + nOp > p->pParse->nOpAlloc && growOpArray(p, nOp) ){
+  if( p->nOp + nOp > p->nOpAlloc && growOpArray(p, nOp) ){
     return 0;
   }
   pFirst = pOut = &p->aOp[p->nOp];
   for(i=0; i<nOp; i++, aOp++, pOut++){
     pOut->opcode = aOp->opcode;
@@ -2151,23 +2220,31 @@
   **
   ** This two-pass approach that reuses as much memory as possible from
   ** the leftover memory at the end of the opcode array.  This can significantly
   ** reduce the amount of memory held by a prepared statement.
   */
-  do {
-    x.nNeeded = 0;
-    p->aMem = allocSpace(&x, p->aMem, nMem*sizeof(Mem));
-    p->aVar = allocSpace(&x, p->aVar, nVar*sizeof(Mem));
-    p->apArg = allocSpace(&x, p->apArg, nArg*sizeof(Mem*));
-    p->apCsr = allocSpace(&x, p->apCsr, nCursor*sizeof(VdbeCursor*));
+  x.nNeeded = 0;
+  p->aMem = allocSpace(&x, 0, nMem*sizeof(Mem));
+  p->aVar = allocSpace(&x, 0, nVar*sizeof(Mem));
+  p->apArg = allocSpace(&x, 0, nArg*sizeof(Mem*));
+  p->apCsr = allocSpace(&x, 0, nCursor*sizeof(VdbeCursor*));
 #ifdef SQLITE_ENABLE_STMT_SCANSTATUS
-    p->anExec = allocSpace(&x, p->anExec, p->nOp*sizeof(i64));
+  p->anExec = allocSpace(&x, 0, p->nOp*sizeof(i64));
 #endif
-    if( x.nNeeded==0 ) break;
+  if( x.nNeeded ){
     x.pSpace = p->pFree = sqlite3DbMallocRawNN(db, x.nNeeded);
     x.nFree = x.nNeeded;
-  }while( !db->mallocFailed );
+    if( !db->mallocFailed ){
+      p->aMem = allocSpace(&x, p->aMem, nMem*sizeof(Mem));
+      p->aVar = allocSpace(&x, p->aVar, nVar*sizeof(Mem));
+      p->apArg = allocSpace(&x, p->apArg, nArg*sizeof(Mem*));
+      p->apCsr = allocSpace(&x, p->apCsr, nCursor*sizeof(VdbeCursor*));
+#ifdef SQLITE_ENABLE_STMT_SCANSTATUS
+      p->anExec = allocSpace(&x, p->anExec, p->nOp*sizeof(i64));
+#endif
+    }
+  }
 
   p->pVList = pParse->pVList;
   pParse->pVList =  0;
   p->explain = pParse->explain;
   if( db->mallocFailed ){
@@ -2855,11 +2932,11 @@
           sqlite3RollbackAll(db, SQLITE_OK);
           p->nChange = 0;
         }else{
           db->nDeferredCons = 0;
           db->nDeferredImmCons = 0;
-          db->flags &= ~SQLITE_DeferFKs;
+          db->flags &= ~(u64)SQLITE_DeferFKs;
           sqlite3CommitInternalChanges(db);
         }
       }else{
         sqlite3RollbackAll(db, SQLITE_OK);
         p->nChange = 0;
@@ -3170,10 +3247,17 @@
   vdbeFreeOpArray(db, p->aOp, p->nOp);
   sqlite3DbFree(db, p->aColName);
   sqlite3DbFree(db, p->zSql);
 #ifdef SQLITE_ENABLE_NORMALIZE
   sqlite3DbFree(db, p->zNormSql);
+  {
+    DblquoteStr *pThis, *pNext;
+    for(pThis=p->pDblStr; pThis; pThis=pNext){
+      pNext = pThis->pNextStr;
+      sqlite3DbFree(db, pThis);
+    }
+  }
 #endif
 #ifdef SQLITE_ENABLE_STMT_SCANSTATUS
   {
     int i;
     for(i=0; i<p->nScan; i++){
@@ -3710,11 +3794,11 @@
   int nKey,              /* Size of the binary record */
   const void *pKey,      /* The binary record */
   UnpackedRecord *p      /* Populate this structure before returning. */
 ){
   const unsigned char *aKey = (const unsigned char *)pKey;
-  int d; 
+  u32 d; 
   u32 idx;                        /* Offset in aKey[] to read from */
   u16 u;                          /* Unsigned loop counter */
   u32 szHdr;
   Mem *pMem = p->aMem;
 
@@ -3721,11 +3805,11 @@
   p->default_rc = 0;
   assert( EIGHT_BYTE_ALIGNMENT(pMem) );
   idx = getVarint32(aKey, szHdr);
   d = szHdr;
   u = 0;
-  while( idx<szHdr && d<=nKey ){
+  while( idx<szHdr && d<=(u32)nKey ){
     u32 serial_type;
 
     idx += getVarint32(&aKey[idx], serial_type);
     pMem->enc = pKeyInfo->enc;
     pMem->db = pKeyInfo->db;
@@ -3734,10 +3818,17 @@
     pMem->z = 0;
     d += sqlite3VdbeSerialGet(&aKey[d], serial_type, pMem);
     pMem++;
     if( (++u)>=p->nField ) break;
   }
+  if( d>(u32)nKey && u ){
+    assert( CORRUPT_DB );
+    /* In a corrupt record entry, the last pMem might have been set up using 
+    ** uninitialized memory. Overwrite its value with NULL, to prevent
+    ** warnings from MSAN. */
+    sqlite3VdbeMemSetNull(pMem-1);
+  }
   assert( u<=pKeyInfo->nKeyField + 1 );
   p->nField = u;
 }
 
 #ifdef SQLITE_DEBUG
@@ -3799,12 +3890,12 @@
     ** a buffer overread.  The "d1+serial_type1+2" subexpression will
     ** always be greater than or equal to the amount of required key space.
     ** Use that approximation to avoid the more expensive call to
     ** sqlite3VdbeSerialTypeLen() in the common case.
     */
-    if( d1+serial_type1+2>(u32)nKey1
-     && d1+sqlite3VdbeSerialTypeLen(serial_type1)>(u32)nKey1 
+    if( d1+(u64)serial_type1+2>(u64)nKey1
+     && d1+(u64)sqlite3VdbeSerialTypeLen(serial_type1)>(u64)nKey1 
     ){
       break;
     }
 
     /* Extract the values to be compared.
@@ -3811,11 +3902,12 @@
     */
     d1 += sqlite3VdbeSerialGet(&aKey1[d1], serial_type1, &mem1);
 
     /* Do the comparison
     */
-    rc = sqlite3MemCompare(&mem1, &pPKey2->aMem[i], pKeyInfo->aColl[i]);
+    rc = sqlite3MemCompare(&mem1, &pPKey2->aMem[i],
+                           pKeyInfo->nAllField>i ? pKeyInfo->aColl[i] : 0);
     if( rc!=0 ){
       assert( mem1.szMalloc==0 );  /* See comment below */
       if( pKeyInfo->aSortOrder[i] ){
         rc = -rc;  /* Invert the result for DESC sort order. */
       }
@@ -4167,16 +4259,16 @@
     i = 1;
     pRhs++;
   }else{
     idx1 = getVarint32(aKey1, szHdr1);
     d1 = szHdr1;
-    if( d1>(unsigned)nKey1 ){ 
-      pPKey2->errCode = (u8)SQLITE_CORRUPT_BKPT;
-      return 0;  /* Corruption */
-    }
     i = 0;
   }
+  if( d1>(unsigned)nKey1 ){ 
+    pPKey2->errCode = (u8)SQLITE_CORRUPT_BKPT;
+    return 0;  /* Corruption */
+  }
 
   VVA_ONLY( mem1.szMalloc = 0; ) /* Only needed by assert() statements */
   assert( pPKey2->pKeyInfo->nAllField>=pPKey2->nField 
        || CORRUPT_DB );
   assert( pPKey2->pKeyInfo->aSortOrder!=0 );
@@ -4242,14 +4334,16 @@
         rc = +1;
       }else{
         mem1.n = (serial_type - 12) / 2;
         testcase( (d1+mem1.n)==(unsigned)nKey1 );
         testcase( (d1+mem1.n+1)==(unsigned)nKey1 );
-        if( (d1+mem1.n) > (unsigned)nKey1 ){
+        if( (d1+mem1.n) > (unsigned)nKey1
+         || (pKeyInfo = pPKey2->pKeyInfo)->nAllField<=i
+        ){
           pPKey2->errCode = (u8)SQLITE_CORRUPT_BKPT;
           return 0;                /* Corruption */
-        }else if( (pKeyInfo = pPKey2->pKeyInfo)->aColl[i] ){
+        }else if( pKeyInfo->aColl[i] ){
           mem1.enc = pKeyInfo->enc;
           mem1.db = pKeyInfo->db;
           mem1.flags = MEM_Str;
           mem1.z = (char*)&aKey1[d1];
           rc = vdbeCompareMemString(

Index: src/vdbemem.c
==================================================================
--- src/vdbemem.c
+++ src/vdbemem.c
@@ -241,11 +241,11 @@
 **
 ** Return SQLITE_OK on success or an error code (probably SQLITE_NOMEM)
 ** if unable to complete the resizing.
 */
 int sqlite3VdbeMemClearAndResize(Mem *pMem, int szNew){
-  assert( szNew>0 );
+  assert( CORRUPT_DB || szNew>0 );
   assert( (pMem->flags & MEM_Dyn)==0 || pMem->szMalloc==0 );
   if( pMem->szMalloc<szNew ){
     return sqlite3VdbeMemGrow(pMem, szNew, 0);
   }
   assert( (pMem->flags & MEM_Dyn)==0 );
@@ -1122,10 +1122,13 @@
   u32 amt,          /* Number of bytes to return. */
   Mem *pMem         /* OUT: Return data in this Mem structure. */
 ){
   int rc;
   pMem->flags = MEM_Null;
+  if( sqlite3BtreeMaxRecordSize(pCur)<offset+amt ){
+    return SQLITE_CORRUPT_BKPT;
+  }
   if( SQLITE_OK==(rc = sqlite3VdbeMemClearAndResize(pMem, amt+1)) ){
     rc = sqlite3BtreePayload(pCur, offset, amt, pMem->z);
     if( rc==SQLITE_OK ){
       pMem->z[amt] = 0;   /* Overrun area used when reading malformed records */
       pMem->flags = MEM_Blob;
@@ -1528,13 +1531,15 @@
   else if( op==TK_FUNCTION && pCtx!=0 ){
     rc = valueFromFunction(db, pExpr, enc, affinity, &pVal, pCtx);
   }
 #endif
   else if( op==TK_TRUEFALSE ){
-     pVal = valueNew(db, pCtx);
-     pVal->flags = MEM_Int;
-     pVal->u.i = pExpr->u.zToken[4]==0;
+    pVal = valueNew(db, pCtx);
+    if( pVal ){
+      pVal->flags = MEM_Int;
+      pVal->u.i = pExpr->u.zToken[4]==0;
+    }
   }
 
   *ppVal = pVal;
   return rc;
 

Index: src/vtab.c
==================================================================
--- src/vtab.c
+++ src/vtab.c
@@ -999,10 +999,11 @@
     for(i=0; rc==SQLITE_OK && i<db->nVTrans; i++){
       VTable *pVTab = db->aVTrans[i];
       const sqlite3_module *pMod = pVTab->pMod->pModule;
       if( pVTab->pVtab && pMod->iVersion>=2 ){
         int (*xMethod)(sqlite3_vtab *, int);
+        sqlite3VtabLock(pVTab);
         switch( op ){
           case SAVEPOINT_BEGIN:
             xMethod = pMod->xSavepoint;
             pVTab->iSavepoint = iSavepoint+1;
             break;
@@ -1014,10 +1015,11 @@
             break;
         }
         if( xMethod && pVTab->iSavepoint>iSavepoint ){
           rc = xMethod(pVTab->pVtab, iSavepoint);
         }
+        sqlite3VtabUnlock(pVTab);
       }
     }
   }
   return rc;
 }

Index: src/walker.c
==================================================================
--- src/walker.c
+++ src/walker.c
@@ -15,10 +15,26 @@
 #include "sqliteInt.h"
 #include <stdlib.h>
 #include <string.h>
 
 
+#if !defined(SQLITE_OMIT_WINDOWFUNC)
+/*
+** Walk all expressions linked into the list of Window objects passed
+** as the second argument.
+*/
+static int walkWindowList(Walker *pWalker, Window *pList){
+  Window *pWin;
+  for(pWin=pList; pWin; pWin=pWin->pNextWin){
+    if( sqlite3WalkExprList(pWalker, pWin->pOrderBy) ) return WRC_Abort;
+    if( sqlite3WalkExprList(pWalker, pWin->pPartition) ) return WRC_Abort;
+    if( sqlite3WalkExpr(pWalker, pWin->pFilter) ) return WRC_Abort;
+  }
+  return WRC_Continue;
+}
+#endif
+
 /*
 ** Walk an expression tree.  Invoke the callback once for each node
 ** of the expression, while descending.  (In other words, the callback
 ** is invoked before visiting children.)
 **
@@ -54,14 +70,11 @@
       }else if( pExpr->x.pList ){
         if( sqlite3WalkExprList(pWalker, pExpr->x.pList) ) return WRC_Abort;
       }
 #ifndef SQLITE_OMIT_WINDOWFUNC
       if( ExprHasProperty(pExpr, EP_WinFunc) ){
-        Window *pWin = pExpr->y.pWin;
-        if( sqlite3WalkExprList(pWalker, pWin->pPartition) ) return WRC_Abort;
-        if( sqlite3WalkExprList(pWalker, pWin->pOrderBy) ) return WRC_Abort;
-        if( sqlite3WalkExpr(pWalker, pWin->pFilter) ) return WRC_Abort;
+        if( walkWindowList(pWalker, pExpr->y.pWin) ) return WRC_Abort;
       }
 #endif
     }
     break;
   }
@@ -97,10 +110,20 @@
   if( sqlite3WalkExpr(pWalker, p->pWhere) ) return WRC_Abort;
   if( sqlite3WalkExprList(pWalker, p->pGroupBy) ) return WRC_Abort;
   if( sqlite3WalkExpr(pWalker, p->pHaving) ) return WRC_Abort;
   if( sqlite3WalkExprList(pWalker, p->pOrderBy) ) return WRC_Abort;
   if( sqlite3WalkExpr(pWalker, p->pLimit) ) return WRC_Abort;
+#if !defined(SQLITE_OMIT_WINDOWFUNC) && !defined(SQLITE_OMIT_ALTERTABLE)
+  {
+    Parse *pParse = pWalker->pParse;
+    if( pParse && IN_RENAME_OBJECT ){
+      int rc = walkWindowList(pWalker, p->pWinDefn);
+      assert( rc==WRC_Continue );
+      return rc;
+    }
+  }
+#endif
   return WRC_Continue;
 }
 
 /*
 ** Walk the parse trees associated with all subqueries in the

Index: src/where.c
==================================================================
--- src/where.c
+++ src/where.c
@@ -307,10 +307,21 @@
     k = 0;
     pScan->iEquiv++;
   }
   return 0;
 }
+
+/*
+** This is whereScanInit() for the case of an index on an expression.
+** It is factored out into a separate tail-recursion subroutine so that
+** the normal whereScanInit() routine, which is a high-runner, does not
+** need to push registers onto the stack as part of its prologue.
+*/
+static SQLITE_NOINLINE WhereTerm *whereScanInitIndexExpr(WhereScan *pScan){
+  pScan->idxaff = sqlite3ExprAffinity(pScan->pIdxExpr);
+  return whereScanNext(pScan);
+}
 
 /*
 ** Initialize a WHERE clause scanner object.  Return a pointer to the
 ** first match.  Return NULL if there are no matches.
 **
@@ -340,31 +351,33 @@
   pScan->pOrigWC = pWC;
   pScan->pWC = pWC;
   pScan->pIdxExpr = 0;
   pScan->idxaff = 0;
   pScan->zCollName = 0;
+  pScan->opMask = opMask;
+  pScan->k = 0;
+  pScan->aiCur[0] = iCur;
+  pScan->nEquiv = 1;
+  pScan->iEquiv = 1;
   if( pIdx ){
     int j = iColumn;
     iColumn = pIdx->aiColumn[j];
     if( iColumn==XN_EXPR ){
       pScan->pIdxExpr = pIdx->aColExpr->a[j].pExpr;
       pScan->zCollName = pIdx->azColl[j];
+      pScan->aiColumn[0] = XN_EXPR;
+      return whereScanInitIndexExpr(pScan);
     }else if( iColumn==pIdx->pTable->iPKey ){
       iColumn = XN_ROWID;
     }else if( iColumn>=0 ){
       pScan->idxaff = pIdx->pTable->aCol[iColumn].affinity;
       pScan->zCollName = pIdx->azColl[j];
     }
   }else if( iColumn==XN_EXPR ){
     return 0;
   }
-  pScan->opMask = opMask;
-  pScan->k = 0;
-  pScan->aiCur[0] = iCur;
   pScan->aiColumn[0] = iColumn;
-  pScan->nEquiv = 1;
-  pScan->iEquiv = 1;
   return whereScanNext(pScan);
 }
 
 /*
 ** Search for a term in the WHERE clause that is of the form "X <op> <expr>"
@@ -835,11 +848,11 @@
     VdbeComment((v, "next row of %s", pTabItem->pTab->zName));
   }else{
     addrTop = sqlite3VdbeAddOp1(v, OP_Rewind, pLevel->iTabCur); VdbeCoverage(v);
   }
   if( pPartial ){
-    iContinue = sqlite3VdbeMakeLabel(v);
+    iContinue = sqlite3VdbeMakeLabel(pParse);
     sqlite3ExprIfFalse(pParse, pPartial, iContinue, SQLITE_JUMPIFNULL);
     pLoop->wsFlags |= WHERE_PARTIALIDX;
   }
   regRecord = sqlite3GetTempReg(pParse);
   regBase = sqlite3GenerateIndexKey(
@@ -852,10 +865,11 @@
     sqlite3VdbeChangeP2(v, addrCounter, regBase+n);
     testcase( pParse->db->mallocFailed );
     translateColumnToCopy(pParse, addrTop, pLevel->iTabCur,
                           pTabItem->regResult, 1);
     sqlite3VdbeGoto(v, addrTop);
+    pTabItem->fg.viaCoroutine = 0;
   }else{
     sqlite3VdbeAddOp2(v, OP_Next, pLevel->iTabCur, addrTop+1); VdbeCoverage(v);
   }
   sqlite3VdbeChangeP5(v, SQLITE_STMTSTATUS_AUTOINDEX);
   sqlite3VdbeJumpHere(v, addrTop);
@@ -1029,13 +1043,15 @@
 ** The table object reference passed as the second argument to this function
 ** must represent a virtual table. This function invokes the xBestIndex()
 ** method of the virtual table with the sqlite3_index_info object that
 ** comes in as the 3rd argument to this function.
 **
-** If an error occurs, pParse is populated with an error message and a
-** non-zero value is returned. Otherwise, 0 is returned and the output
-** part of the sqlite3_index_info structure is left populated.
+** If an error occurs, pParse is populated with an error message and an
+** appropriate error code is returned.  A return of SQLITE_CONSTRAINT from
+** xBestIndex is not considered an error.  SQLITE_CONSTRAINT indicates that
+** the current configuration of "unusable" flags in sqlite3_index_info can
+** not result in a valid plan.
 **
 ** Whether or not an error is returned, it is the responsibility of the
 ** caller to eventually free p->idxStr if p->needToFreeIdxStr indicates
 ** that this is required.
 */
@@ -1045,11 +1061,11 @@
 
   TRACE_IDX_INPUTS(p);
   rc = pVtab->pModule->xBestIndex(pVtab, p);
   TRACE_IDX_OUTPUTS(p);
 
-  if( rc!=SQLITE_OK ){
+  if( rc!=SQLITE_OK && rc!=SQLITE_CONSTRAINT ){
     if( rc==SQLITE_NOMEM ){
       sqlite3OomFault(pParse->db);
     }else if( !pVtab->zErrMsg ){
       sqlite3ErrorMsg(pParse, "%s", sqlite3ErrStr(rc));
     }else{
@@ -1056,23 +1072,11 @@
       sqlite3ErrorMsg(pParse, "%s", pVtab->zErrMsg);
     }
   }
   sqlite3_free(pVtab->zErrMsg);
   pVtab->zErrMsg = 0;
-
-#if 0
-  /* This error is now caught by the caller.
-  ** Search for "xBestIndex malfunction" below */
-  for(i=0; i<p->nConstraint; i++){
-    if( !p->aConstraint[i].usable && p->aConstraintUsage[i].argvIndex>0 ){
-      sqlite3ErrorMsg(pParse, 
-          "table %s: xBestIndex returned an invalid plan", pTab->zName);
-    }
-  }
-#endif
-
-  return pParse->nErr;
+  return rc;
 }
 #endif /* !defined(SQLITE_OMIT_VIRTUALTABLE) */
 
 #ifdef SQLITE_ENABLE_STAT3_OR_STAT4
 /*
@@ -2217,11 +2221,11 @@
     }
   }
   rc = whereLoopXfer(db, p, pTemplate);
   if( (p->wsFlags & WHERE_VIRTUALTABLE)==0 ){
     Index *pIndex = p->u.btree.pIndex;
-    if( pIndex && pIndex->tnum==0 ){
+    if( pIndex && pIndex->idxType==SQLITE_IDXTYPE_IPK ){
       p->u.btree.pIndex = 0;
     }
   }
   return rc;
 }
@@ -2384,12 +2388,12 @@
 ** When this function is called, pBuilder->pNew->nOut contains the 
 ** number of rows expected to be visited by filtering using the nEq 
 ** terms only. If it is modified, this value is restored before this 
 ** function returns.
 **
-** If pProbe->tnum==0, that means pIndex is a fake index used for the
-** INTEGER PRIMARY KEY.
+** If pProbe->idxType==SQLITE_IDXTYPE_IPK, that means pIndex is 
+** a fake index used for the INTEGER PRIMARY KEY.
 */
 static int whereLoopAddBtreeIndex(
   WhereLoopBuilder *pBuilder,     /* The WhereLoop factory */
   struct SrcList_item *pSrc,      /* FROM clause term being analyzed */
   Index *pProbe,                  /* An index on pSrc */
@@ -2885,10 +2889,11 @@
     sPk.aiColumn = &aiColumnPk;
     sPk.aiRowLogEst = aiRowEstPk;
     sPk.onError = OE_Replace;
     sPk.pTable = pTab;
     sPk.szIdxRow = pTab->szTabRow;
+    sPk.idxType = SQLITE_IDXTYPE_IPK;
     aiRowEstPk[0] = pTab->nRowLogEst;
     aiRowEstPk[1] = 0;
     pFirst = pSrc->pTab->pIndex;
     if( pSrc->fg.notIndexed==0 ){
       /* The real indices of the table are only considered if the
@@ -2975,11 +2980,11 @@
     pNew->nOut = rSize;
     pNew->u.btree.pIndex = pProbe;
     b = indexMightHelpWithOrderBy(pBuilder, pProbe, pSrc->iCursor);
     /* The ONEPASS_DESIRED flags never occurs together with ORDER BY */
     assert( (pWInfo->wctrlFlags & WHERE_ONEPASS_DESIRED)==0 || b==0 );
-    if( pProbe->tnum<=0 ){
+    if( pProbe->idxType==SQLITE_IDXTYPE_IPK ){
       /* Integer primary key index */
       pNew->wsFlags = WHERE_IPK;
 
       /* Full table scan */
       pNew->iSortIdx = b ? iSortIdx : 0;
@@ -3141,11 +3146,21 @@
   pIdxInfo->idxFlags = 0;
   pIdxInfo->colUsed = (sqlite3_int64)pSrc->colUsed;
 
   /* Invoke the virtual table xBestIndex() method */
   rc = vtabBestIndex(pParse, pSrc->pTab, pIdxInfo);
-  if( rc ) return rc;
+  if( rc ){
+    if( rc==SQLITE_CONSTRAINT ){
+      /* If the xBestIndex method returns SQLITE_CONSTRAINT, that means
+      ** that the particular combination of parameters provided is unusable.
+      ** Make no entries in the loop table.
+      */
+      WHERETRACE(0xffff, ("  ^^^^--- non-viable plan rejected!\n"));
+      return SQLITE_OK;
+    }
+    return rc;
+  }
 
   mxTerm = -1;
   assert( pNew->nLSlot>=nConstraint );
   for(i=0; i<nConstraint; i++) pNew->aLTerm[i] = 0;
   pNew->u.vtab.omitMask = 0;
@@ -4641,11 +4656,11 @@
   pWInfo->pOrderBy = pOrderBy;
   pWInfo->pWhere = pWhere;
   pWInfo->pResultSet = pResultSet;
   pWInfo->aiCurOnePass[0] = pWInfo->aiCurOnePass[1] = -1;
   pWInfo->nLevel = nTabList;
-  pWInfo->iBreak = pWInfo->iContinue = sqlite3VdbeMakeLabel(v);
+  pWInfo->iBreak = pWInfo->iContinue = sqlite3VdbeMakeLabel(pParse);
   pWInfo->wctrlFlags = wctrlFlags;
   pWInfo->iLimit = iAuxArg;
   pWInfo->savedNQueryLoop = pParse->nQueryLoop;
   memset(&pWInfo->nOBSat, 0, 
          offsetof(WhereInfo,sWC) - offsetof(WhereInfo,nOBSat));
@@ -4915,13 +4930,14 @@
   */
   assert( (wctrlFlags & WHERE_ONEPASS_DESIRED)==0 || pWInfo->nLevel==1 );
   if( (wctrlFlags & WHERE_ONEPASS_DESIRED)!=0 ){
     int wsFlags = pWInfo->a[0].pWLoop->wsFlags;
     int bOnerow = (wsFlags & WHERE_ONEROW)!=0;
+    assert( !(wsFlags & WHERE_VIRTUALTABLE) || IsVirtual(pTabList->a[0].pTab) );
     if( bOnerow || (
         0!=(wctrlFlags & WHERE_ONEPASS_MULTIROW)
-     && 0==(wsFlags & WHERE_VIRTUALTABLE)
+     && !IsVirtual(pTabList->a[0].pTab)
      && (0==(wsFlags & WHERE_MULTI_OR) || (wctrlFlags & WHERE_DUPLICATES_OK))
     )){
       pWInfo->eOnePass = bOnerow ? ONEPASS_SINGLE : ONEPASS_MULTI;
       if( HasRowid(pTabList->a[0].pTab) && (wsFlags & WHERE_IDX_ONLY) ){
         if( wctrlFlags & WHERE_ONEPASS_MULTIROW ){
@@ -5072,11 +5088,11 @@
 #endif
     addrExplain = sqlite3WhereExplainOneScan(
         pParse, pTabList, pLevel, wctrlFlags
     );
     pLevel->addrBody = sqlite3VdbeCurrentAddr(v);
-    notReady = sqlite3WhereCodeOneLoopStart(pWInfo, ii, notReady);
+    notReady = sqlite3WhereCodeOneLoopStart(pParse,v,pWInfo,ii,pLevel,notReady);
     pWInfo->iContinue = pLevel->addrCont;
     if( (wsFlags&WHERE_MULTI_OR)==0 && (wctrlFlags&WHERE_OR_SUBCLAUSE)==0 ){
       sqlite3WhereAddScanStatus(v, pTabList, pLevel, addrExplain);
     }
   }
@@ -5256,10 +5272,33 @@
       testcase( pParse->db->mallocFailed );
       translateColumnToCopy(pParse, pLevel->addrBody, pLevel->iTabCur,
                             pTabItem->regResult, 0);
       continue;
     }
+
+#ifdef SQLITE_ENABLE_EARLY_CURSOR_CLOSE
+    /* Close all of the cursors that were opened by sqlite3WhereBegin.
+    ** Except, do not close cursors that will be reused by the OR optimization
+    ** (WHERE_OR_SUBCLAUSE).  And do not close the OP_OpenWrite cursors
+    ** created for the ONEPASS optimization.
+    */
+    if( (pTab->tabFlags & TF_Ephemeral)==0
+     && pTab->pSelect==0
+     && (pWInfo->wctrlFlags & WHERE_OR_SUBCLAUSE)==0
+    ){
+      int ws = pLoop->wsFlags;
+      if( pWInfo->eOnePass==ONEPASS_OFF && (ws & WHERE_IDX_ONLY)==0 ){
+        sqlite3VdbeAddOp1(v, OP_Close, pTabItem->iCursor);
+      }
+      if( (ws & WHERE_INDEXED)!=0
+       && (ws & (WHERE_IPK|WHERE_AUTO_INDEX))==0 
+       && pLevel->iIdxCur!=pWInfo->aiCurOnePass[1]
+      ){
+        sqlite3VdbeAddOp1(v, OP_Close, pLevel->iIdxCur);
+      }
+    }
+#endif
 
     /* If this scan uses an index, make VDBE code substitutions to read data
     ** from the index instead of from the table where possible.  In some cases
     ** this optimization prevents the table from ever being read, which can
     ** yield a significant performance boost.

Index: src/whereInt.h
==================================================================
--- src/whereInt.h
+++ src/whereInt.h
@@ -505,12 +505,15 @@
 );
 #else
 # define sqlite3WhereAddScanStatus(a, b, c, d) ((void)d)
 #endif
 Bitmask sqlite3WhereCodeOneLoopStart(
+  Parse *pParse,       /* Parsing context */
+  Vdbe *v,             /* Prepared statement under construction */
   WhereInfo *pWInfo,   /* Complete information about the WHERE clause */
   int iLevel,          /* Which level of pWInfo->a[] should be coded */
+  WhereLevel *pLevel,  /* The current level pointer */
   Bitmask notReady     /* Which tables are currently available */
 );
 
 /* whereexpr.c: */
 void sqlite3WhereClauseInit(WhereClause*,WhereInfo*);

Index: src/wherecode.c
==================================================================
--- src/wherecode.c
+++ src/wherecode.c
@@ -211,10 +211,11 @@
     }else{
       sqlite3_str_append(&str, " (~1 row)", 9);
     }
 #endif
     zMsg = sqlite3StrAccumFinish(&str);
+    sqlite3ExplainBreakpoint("",zMsg);
     ret = sqlite3VdbeAddOp4(v, OP_Explain, sqlite3VdbeCurrentAddr(v),
                             pParse->addrExplain, 0, zMsg,P4_DYNAMIC);
   }
   return ret;
 }
@@ -536,38 +537,38 @@
     for(i=iEq;i<pLoop->nLTerm; i++){
       assert( pLoop->aLTerm[i]!=0 );
       if( pLoop->aLTerm[i]->pExpr==pX ) nEq++;
     }
 
+    iTab = 0;
     if( (pX->flags & EP_xIsSelect)==0 || pX->x.pSelect->pEList->nExpr==1 ){
-      eType = sqlite3FindInIndex(pParse, pX, IN_INDEX_LOOP, 0, 0);
+      eType = sqlite3FindInIndex(pParse, pX, IN_INDEX_LOOP, 0, 0, &iTab);
     }else{
       sqlite3 *db = pParse->db;
       pX = removeUnindexableInClauseTerms(pParse, iEq, pLoop, pX);
 
       if( !db->mallocFailed ){
         aiMap = (int*)sqlite3DbMallocZero(pParse->db, sizeof(int)*nEq);
-        eType = sqlite3FindInIndex(pParse, pX, IN_INDEX_LOOP, 0, aiMap);
-        pTerm->pExpr->iTable = pX->iTable;
+        eType = sqlite3FindInIndex(pParse, pX, IN_INDEX_LOOP, 0, aiMap, &iTab);
+        pTerm->pExpr->iTable = iTab;
       }
       sqlite3ExprDelete(db, pX);
       pX = pTerm->pExpr;
     }
 
     if( eType==IN_INDEX_INDEX_DESC ){
       testcase( bRev );
       bRev = !bRev;
     }
-    iTab = pX->iTable;
     sqlite3VdbeAddOp2(v, bRev ? OP_Last : OP_Rewind, iTab, 0);
     VdbeCoverageIf(v, bRev);
     VdbeCoverageIf(v, !bRev);
     assert( (pLoop->wsFlags & WHERE_MULTI_OR)==0 );
 
     pLoop->wsFlags |= WHERE_IN_ABLE;
     if( pLevel->u.in.nIn==0 ){
-      pLevel->addrNxt = sqlite3VdbeMakeLabel(v);
+      pLevel->addrNxt = sqlite3VdbeMakeLabel(pParse);
     }
 
     i = pLevel->u.in.nIn;
     pLevel->u.in.nIn += nEq;
     pLevel->u.in.aInLoop =
@@ -1074,11 +1075,13 @@
   assert( nReg>0 );
   if( p && sqlite3ExprIsVector(p) ){
 #ifndef SQLITE_OMIT_SUBQUERY
     if( (p->flags & EP_xIsSelect) ){
       Vdbe *v = pParse->pVdbe;
-      int iSelect = sqlite3CodeSubselect(pParse, p, 0, 0);
+      int iSelect;
+      assert( p->op==TK_SELECT );
+      iSelect = sqlite3CodeSubselect(pParse, p);
       sqlite3VdbeAddOp3(v, OP_Copy, iSelect, iReg, nReg-1);
     }else
 #endif
     {
       int i;
@@ -1160,47 +1163,41 @@
 /*
 ** Generate code for the start of the iLevel-th loop in the WHERE clause
 ** implementation described by pWInfo.
 */
 Bitmask sqlite3WhereCodeOneLoopStart(
+  Parse *pParse,       /* Parsing context */
+  Vdbe *v,             /* Prepared statement under construction */
   WhereInfo *pWInfo,   /* Complete information about the WHERE clause */
   int iLevel,          /* Which level of pWInfo->a[] should be coded */
+  WhereLevel *pLevel,  /* The current level pointer */
   Bitmask notReady     /* Which tables are currently available */
 ){
   int j, k;            /* Loop counters */
   int iCur;            /* The VDBE cursor for the table */
   int addrNxt;         /* Where to jump to continue with the next IN case */
-  int omitTable;       /* True if we use the index only */
   int bRev;            /* True if we need to scan in reverse order */
-  WhereLevel *pLevel;  /* The where level to be coded */
   WhereLoop *pLoop;    /* The WhereLoop object being coded */
   WhereClause *pWC;    /* Decomposition of the entire WHERE clause */
   WhereTerm *pTerm;               /* A WHERE clause term */
-  Parse *pParse;                  /* Parsing context */
   sqlite3 *db;                    /* Database connection */
-  Vdbe *v;                        /* The prepared stmt under constructions */
   struct SrcList_item *pTabItem;  /* FROM clause term being coded */
   int addrBrk;                    /* Jump here to break out of the loop */
   int addrHalt;                   /* addrBrk for the outermost loop */
   int addrCont;                   /* Jump here to continue with next cycle */
   int iRowidReg = 0;        /* Rowid is stored in this register, if not zero */
   int iReleaseReg = 0;      /* Temp register to free before returning */
   Index *pIdx = 0;          /* Index used by loop (if any) */
   int iLoop;                /* Iteration of constraint generator loop */
 
-  pParse = pWInfo->pParse;
-  v = pParse->pVdbe;
   pWC = &pWInfo->sWC;
   db = pParse->db;
-  pLevel = &pWInfo->a[iLevel];
   pLoop = pLevel->pWLoop;
   pTabItem = &pWInfo->pTabList->a[pLevel->iFrom];
   iCur = pTabItem->iCursor;
   pLevel->notReady = notReady & ~sqlite3WhereGetMask(&pWInfo->sMaskSet, iCur);
   bRev = (pWInfo->revMask>>iLevel)&1;
-  omitTable = (pLoop->wsFlags & WHERE_IDX_ONLY)!=0 
-           && (pWInfo->wctrlFlags & WHERE_OR_SUBCLAUSE)==0;
   VdbeModuleComment((v, "Begin WHERE-loop%d: %s",iLevel,pTabItem->pTab->zName));
 
   /* Create labels for the "break" and "continue" instructions
   ** for the current loop.  Jump to addrBrk to break out of a loop.
   ** Jump to cont to go immediately to the next iteration of the
@@ -1209,12 +1206,12 @@
   ** When there is an IN operator, we also have a "addrNxt" label that
   ** means to continue with the next IN value combination.  When
   ** there are no IN operators in the constraints, the "addrNxt" label
   ** is the same as "addrBrk".
   */
-  addrBrk = pLevel->addrBrk = pLevel->addrNxt = sqlite3VdbeMakeLabel(v);
-  addrCont = pLevel->addrCont = sqlite3VdbeMakeLabel(v);
+  addrBrk = pLevel->addrBrk = pLevel->addrNxt = sqlite3VdbeMakeLabel(pParse);
+  addrCont = pLevel->addrCont = sqlite3VdbeMakeLabel(pParse);
 
   /* If this is the right table of a LEFT OUTER JOIN, allocate and
   ** initialize a memory cell that records if this table matches any
   ** row of the left table of the join.
   */
@@ -1337,11 +1334,10 @@
     */
     assert( pLoop->u.btree.nEq==1 );
     pTerm = pLoop->aLTerm[0];
     assert( pTerm!=0 );
     assert( pTerm->pExpr!=0 );
-    assert( omitTable==0 );
     testcase( pTerm->wtFlags & TERM_VIRTUAL );
     iReleaseReg = ++pParse->nMem;
     iRowidReg = codeEqualityTerm(pParse, pTerm, pLevel, 0, bRev, iReleaseReg);
     if( iRowidReg!=iReleaseReg ) sqlite3ReleaseTempReg(pParse, iReleaseReg);
     addrNxt = pLevel->addrNxt;
@@ -1356,11 +1352,10 @@
     int testOp = OP_Noop;
     int start;
     int memEndValue = 0;
     WhereTerm *pStart, *pEnd;
 
-    assert( omitTable==0 );
     j = 0;
     pStart = pEnd = 0;
     if( pLoop->wsFlags & WHERE_BTM_LIMIT ) pStart = pLoop->aLTerm[j++];
     if( pLoop->wsFlags & WHERE_TOP_LIMIT ) pEnd = pLoop->aLTerm[j++];
     assert( pStart!=0 || pEnd!=0 );
@@ -1520,10 +1515,12 @@
     int op;                      /* Instruction opcode */
     char *zStartAff;             /* Affinity for start of range constraint */
     char *zEndAff = 0;           /* Affinity for end of range constraint */
     u8 bSeekPastNull = 0;        /* True to seek past initial nulls */
     u8 bStopAtNull = 0;          /* Add condition to terminate at NULLs */
+    int omitTable;               /* True if we use the index only */
+
 
     pIdx = pLoop->u.btree.pIndex;
     iIdxCur = pLevel->iIdxCur;
     assert( nEq>=pLoop->nSkip );
 
@@ -1721,10 +1718,12 @@
     if( pLoop->wsFlags & WHERE_IN_EARLYOUT ){
       sqlite3VdbeAddOp2(v, OP_SeekHit, iIdxCur, 1);
     }
 
     /* Seek the table cursor, if required */
+    omitTable = (pLoop->wsFlags & WHERE_IDX_ONLY)!=0 
+           && (pWInfo->wctrlFlags & WHERE_OR_SUBCLAUSE)==0;
     if( omitTable ){
       /* pIdx is a covering index.  No need to access the main table. */
     }else if( HasRowid(pIdx->pTable) ){
       if( (pWInfo->wctrlFlags & WHERE_SEEK_TABLE) || (
           (pWInfo->wctrlFlags & WHERE_SEEK_UNIQ_TABLE) 
@@ -1831,11 +1830,11 @@
     int iCovCur = pParse->nTab++;  /* Cursor used for index scans (if any) */
 
     int regReturn = ++pParse->nMem;           /* Register used with OP_Gosub */
     int regRowset = 0;                        /* Register for RowSet object */
     int regRowid = 0;                         /* Register holding rowid */
-    int iLoopBody = sqlite3VdbeMakeLabel(v);  /* Start of loop body */
+    int iLoopBody = sqlite3VdbeMakeLabel(pParse);/* Start of loop body */
     int iRetInit;                             /* Address of regReturn init */
     int untestedTerms = 0;             /* Some terms not completely tested */
     int ii;                            /* Loop counter */
     u16 wctrlFlags;                    /* Flags for sub-WHERE clause */
     Expr *pAndExpr = 0;                /* An ".. AND (...)" expression */
@@ -1947,10 +1946,11 @@
         if( pAndExpr ){
           pAndExpr->pLeft = pOrExpr;
           pOrExpr = pAndExpr;
         }
         /* Loop through table entries that match term pOrTerm. */
+        ExplainQueryPlan((pParse, 1, "INDEX %d", ii+1));
         WHERETRACE(0xffff, ("Subplan for OR-clause:\n"));
         pSubWInfo = sqlite3WhereBegin(pParse, pOrTab, pOrExpr, 0, 0,
                                       wctrlFlags, iCovCur);
         assert( pSubWInfo || pParse->nErr || db->mallocFailed );
         if( pSubWInfo ){
@@ -2050,10 +2050,11 @@
             pCov = 0;
           }
 
           /* Finish the loop through table entries that match term pOrTerm. */
           sqlite3WhereEnd(pSubWInfo);
+          ExplainQueryPlanPop(pParse);
         }
       }
     }
     ExplainQueryPlanPop(pParse);
     pLevel->u.pCovidx = pCov;

Index: src/whereexpr.c
==================================================================
--- src/whereexpr.c
+++ src/whereexpr.c
@@ -775,10 +775,11 @@
     ** will be recorded in iCursor and iColumn.  There might not be any
     ** such table and column.  Set okToChngToIN if an appropriate table
     ** and column is found but leave okToChngToIN false if not found.
     */
     for(j=0; j<2 && !okToChngToIN; j++){
+      Expr *pLeft = 0;
       pOrTerm = pOrWc->a;
       for(i=pOrWc->nTerm-1; i>=0; i--, pOrTerm++){
         assert( pOrTerm->eOperator & WO_EQ );
         pOrTerm->wtFlags &= ~TERM_OR_OK;
         if( pOrTerm->leftCursor==iCursor ){
@@ -798,10 +799,11 @@
           assert( pOrTerm->wtFlags & (TERM_COPIED|TERM_VIRTUAL) );
           continue;
         }
         iColumn = pOrTerm->u.leftColumn;
         iCursor = pOrTerm->leftCursor;
+        pLeft = pOrTerm->pExpr->pLeft;
         break;
       }
       if( i<0 ){
         /* No candidate table+column was found.  This can only occur
         ** on the second iteration */
@@ -817,11 +819,13 @@
       okToChngToIN = 1;
       for(; i>=0 && okToChngToIN; i--, pOrTerm++){
         assert( pOrTerm->eOperator & WO_EQ );
         if( pOrTerm->leftCursor!=iCursor ){
           pOrTerm->wtFlags &= ~TERM_OR_OK;
-        }else if( pOrTerm->u.leftColumn!=iColumn ){
+        }else if( pOrTerm->u.leftColumn!=iColumn || (iColumn==XN_EXPR 
+               && sqlite3ExprCompare(pParse, pOrTerm->pExpr->pLeft, pLeft, -1)
+        )){
           okToChngToIN = 0;
         }else{
           int affLeft, affRight;
           /* If the right-hand side is also a column, then the affinities
           ** of both right and left sides must be such that no type

Index: src/window.c
==================================================================
--- src/window.c
+++ src/window.c
@@ -821,12 +821,11 @@
     }
 
     pSub = sqlite3SelectNew(
         pParse, pSublist, pSrc, pWhere, pGroupBy, pHaving, pSort, 0, 0
     );
-    p->pSrc = sqlite3SrcListAppend(db, 0, 0, 0);
-    assert( p->pSrc || db->mallocFailed );
+    p->pSrc = sqlite3SrcListAppend(pParse, 0, 0, 0);
     if( p->pSrc ){
       p->pSrc->a[0].pSelect = pSub;
       sqlite3SrcListAssignCursors(pParse, p->pSrc);
       if( sqlite3ExpandSubquery(pParse, &p->pSrc->a[0]) ){
         rc = SQLITE_NOMEM;
@@ -879,10 +878,11 @@
 ** integer will be caught later.  But it is important not to leave
 ** variable values in the expression tree.
 */
 static Expr *sqlite3WindowOffsetExpr(Parse *pParse, Expr *pExpr){
   if( 0==sqlite3ExprIsConstant(pExpr) ){
+    if( IN_RENAME_OBJECT ) sqlite3RenameExprUnmap(pParse, pExpr);
     sqlite3ExprDelete(pParse->db, pExpr);
     pExpr = sqlite3ExprAlloc(pParse->db, TK_NULL, 0, 0);
   }
   return pExpr;
 }
@@ -1073,10 +1073,11 @@
   VdbeCoverageIf(v, eCond==2);
   sqlite3VdbeAddOp3(v, aOp[eCond], regZero, sqlite3VdbeCurrentAddr(v)+2, reg);
   VdbeCoverageNeverNullIf(v, eCond==0);
   VdbeCoverageNeverNullIf(v, eCond==1);
   VdbeCoverageNeverNullIf(v, eCond==2);
+  sqlite3MayAbort(pParse);
   sqlite3VdbeAddOp2(v, OP_Halt, SQLITE_ERROR, OE_Abort);
   sqlite3VdbeAppendP4(v, (void*)azErr[eCond], P4_STATIC);
   sqlite3ReleaseTempReg(pParse, regZero);
 }
 
@@ -1328,11 +1329,11 @@
     FuncDef *pFunc = pWin->pFunc;
     if( pFunc->zName==nth_valueName
      || pFunc->zName==first_valueName
     ){
       int csr = pWin->csrApp;
-      int lbl = sqlite3VdbeMakeLabel(v);
+      int lbl = sqlite3VdbeMakeLabel(pParse);
       int tmpReg = sqlite3GetTempReg(pParse);
       sqlite3VdbeAddOp2(v, OP_Null, 0, pWin->regResult);
 
       if( pFunc->zName==nth_valueName ){
         sqlite3VdbeAddOp3(v, OP_Column, pMWin->iEphCsr, pWin->iArgCol+1,tmpReg);
@@ -1351,11 +1352,11 @@
     }
     else if( pFunc->zName==leadName || pFunc->zName==lagName ){
       int nArg = pWin->pOwner->x.pList->nExpr;
       int iEph = pMWin->iEphCsr;
       int csr = pWin->csrApp;
-      int lbl = sqlite3VdbeMakeLabel(v);
+      int lbl = sqlite3VdbeMakeLabel(pParse);
       int tmpReg = sqlite3GetTempReg(pParse);
 
       if( nArg<3 ){
         sqlite3VdbeAddOp2(v, OP_Null, 0, pWin->regResult);
       }else{
@@ -1612,12 +1613,12 @@
        || pMWin->eEnd==TK_PRECEDING 
   );
 
   /* Allocate register and label for the "flush_partition" sub-routine. */
   regFlushPart = ++pParse->nMem;
-  lblFlushPart = sqlite3VdbeMakeLabel(v);
-  lblFlushDone = sqlite3VdbeMakeLabel(v);
+  lblFlushPart = sqlite3VdbeMakeLabel(pParse);
+  lblFlushDone = sqlite3VdbeMakeLabel(pParse);
 
   regStart = ++pParse->nMem;
   regEnd = ++pParse->nMem;
 
   windowPartitionCache(pParse, p, pWInfo, regFlushPart, lblFlushPart, &regSize);
@@ -1723,11 +1724,11 @@
 
   if( pMWin->eStart==TK_CURRENT 
    || pMWin->eStart==TK_PRECEDING 
    || pMWin->eStart==TK_FOLLOWING 
   ){
-    int lblSkipInverse = sqlite3VdbeMakeLabel(v);;
+    int lblSkipInverse = sqlite3VdbeMakeLabel(pParse);;
     if( pMWin->eStart==TK_PRECEDING ){
       sqlite3VdbeAddOp3(v, OP_IfPos, regStart, lblSkipInverse, 1);
       VdbeCoverage(v);
     }
     if( pMWin->eStart==TK_FOLLOWING ){
@@ -1888,17 +1889,17 @@
        || (pMWin->eStart==TK_UNBOUNDED && pMWin->eEnd==TK_UNBOUNDED) 
        || (pMWin->eStart==TK_CURRENT && pMWin->eEnd==TK_CURRENT) 
        || (pMWin->eStart==TK_CURRENT && pMWin->eEnd==TK_UNBOUNDED) 
   );
 
-  lblEmpty = sqlite3VdbeMakeLabel(v);
+  lblEmpty = sqlite3VdbeMakeLabel(pParse);
   regNewPeer = pParse->nMem+1;
   pParse->nMem += nPeer;
 
   /* Allocate register and label for the "flush_partition" sub-routine. */
   regFlushPart = ++pParse->nMem;
-  lblFlushPart = sqlite3VdbeMakeLabel(v);
+  lblFlushPart = sqlite3VdbeMakeLabel(pParse);
 
   csrLead = pParse->nTab++;
   regCtr = ++pParse->nMem;
 
   windowPartitionCache(pParse, p, pWInfo, regFlushPart, lblFlushPart, &regSize);
@@ -2131,10 +2132,11 @@
   if( ALWAYS(p) ){
     pNew = sqlite3DbMallocZero(db, sizeof(Window));
     if( pNew ){
       pNew->zName = sqlite3DbStrDup(db, p->zName);
       pNew->pFilter = sqlite3ExprDup(db, p->pFilter, 0);
+      pNew->pFunc = p->pFunc;
       pNew->pPartition = sqlite3ExprListDup(db, p->pPartition, 0);
       pNew->pOrderBy = sqlite3ExprListDup(db, p->pOrderBy, 0);
       pNew->eType = p->eType;
       pNew->eEnd = p->eEnd;
       pNew->eStart = p->eStart;

Index: test/alter.test
==================================================================
--- test/alter.test
+++ test/alter.test
@@ -682,10 +682,11 @@
 
 #--------------------------------------------------------------------------
 # alter-9.X - Special test: Make sure the sqlite_rename_column() and
 # rename_table() functions do not crash when handed bad input.
 #
+sqlite3_test_control SQLITE_TESTCTRL_INTERNAL_FUNCTIONS 1
 do_test alter-9.1 {
   execsql {SELECT SQLITE_RENAME_COLUMN(0,0,0,0,0,0,0,0,0)}
 } {{}}
 foreach {tn sql} {
     1 { SELECT SQLITE_RENAME_TABLE(0,0,0,0,0,0,0) }
@@ -694,10 +695,18 @@
 } {
   do_test alter-9.2.$tn {
     catch { execsql $sql }
   } 1
 }
+sqlite3_test_control SQLITE_TESTCTRL_INTERNAL_FUNCTIONS 0
+
+# If the INTERNAL_FUNCTIONS test-control is disabled (which is the default),
+# then the sqlite_rename_table() SQL function is not accessible to ordinary SQL.
+#
+do_catchsql_test alter-9.3 {
+  SELECT sqlite_rename_table(0,0,0,0,0,0,0);
+} {1 {no such function: sqlite_rename_table}}
 
 #------------------------------------------------------------------------
 # alter-10.X - Make sure ALTER TABLE works with multi-byte UTF-8 characters 
 # in the names.
 #

Index: test/alter2.test
==================================================================
--- test/alter2.test
+++ test/alter2.test
@@ -62,10 +62,11 @@
 #
 proc alter_table {tbl sql {file_format 2}} {
   sqlite3 dbat test.db
   set s [string map {' ''} $sql]
   set t [string map {' ''} $tbl]
+  sqlite3_db_config dbat DEFENSIVE 0
   dbat eval [subst {
     PRAGMA writable_schema = 1;
     UPDATE sqlite_master SET sql = '$s' WHERE name = '$t' AND type = 'table';
     PRAGMA writable_schema = 0;
   }]
@@ -89,10 +90,11 @@
 
 
 #-----------------------------------------------------------------------
 # Some basic tests to make sure short rows are handled.
 #
+sqlite3_db_config db DEFENSIVE 0
 do_test alter2-1.1 {
   execsql {
     CREATE TABLE abc(a, b);
     INSERT INTO abc VALUES(1, 2);
     INSERT INTO abc VALUES(3, 4);

Index: test/altercol.test
==================================================================
--- test/altercol.test
+++ test/altercol.test
@@ -551,10 +551,11 @@
   DROP TRIGGER tr1;
   CREATE INDEX x1i ON x1(i);
   SELECT sql FROM sqlite_master WHERE name='x1i';
 } {{CREATE INDEX x1i ON x1(i)}}
 
+sqlite3_db_config db DEFENSIVE 0
 do_execsql_test 13.1.4 {
   PRAGMA writable_schema = 1;
   UPDATE sqlite_master SET sql = 'CREATE INDEX x1i ON x1(j)' WHERE name='x1i';
 } {}
 
@@ -615,10 +616,11 @@
 }
 
 #-------------------------------------------------------------------------
 # Passing invalid parameters directly to sqlite_rename_column().
 #
+sqlite3_test_control SQLITE_TESTCTRL_INTERNAL_FUNCTIONS 1
 do_execsql_test 14.1 {
   CREATE TABLE ddd(sql, type, object, db, tbl, icol, znew, bquote);
   INSERT INTO ddd VALUES(
       'CREATE TABLE x1(i INTEGER, t TEXT)',
       'table', 'x1', 'main', 'x1', -1, 'zzz', 0
@@ -637,10 +639,19 @@
 do_execsql_test 14.2 {
   SELECT 
   sqlite_rename_column(sql, type, object, db, tbl, icol, znew, bquote, 0)
   FROM ddd;
 } {{} {} {} {}}
+sqlite3_test_control SQLITE_TESTCTRL_INTERNAL_FUNCTIONS 0
+
+# If the INTERNAL_FUNCTIONS test-control is disabled (which is the default)
+# then the sqlite_rename_table() SQL function is not accessible to
+# ordinary SQL.
+#
+do_catchsql_test 14.3 {
+  SELECT sqlite_rename_column(0,0,0,0,0,0,0,0,0);
+} {1 {no such function: sqlite_rename_column}}
 
 #-------------------------------------------------------------------------
 #
 reset_db
 do_execsql_test 15.0 {
@@ -765,8 +776,34 @@
   SELECT sql FROM sqlite_master WHERE name = 'v2';
 } {
   {CREATE VIEW v2(e) AS SELECT coalesce(t2.c,t1.f) FROM t1, t2 WHERE t1.b=t2.d}
 }
 
+# 2019-01-08: https://www.sqlite.org/src/tktview/bc8d94f0fbd633fd9a051e3
+#
+# ALTER TABLE RENAME COLUMN does not work for tables that have redundant
+# UNIQUE constraints.
+#
+sqlite3 db :memory:
+do_execsql_test 20.100 {
+  CREATE TABLE t1(aaa,b,c,UNIQUE(aaA),PRIMARY KEY(aAa),UNIQUE(aAA));
+  ALTER TABLE t1 RENAME aaa TO bbb;
+  SELECT sql FROM sqlite_master WHERE name='t1';
+} {{CREATE TABLE t1(bbb,b,c,UNIQUE(bbb),PRIMARY KEY(bbb),UNIQUE(bbb))}}
+do_execsql_test 20.105 {
+  DROP TABLE t1;
+  CREATE TABLE t1(aaa,b,c,UNIQUE(aaA),PRIMARY KEY(aAa),UNIQUE(aAA))WITHOUT ROWID;
+  ALTER TABLE t1 RENAME aaa TO bbb;
+  SELECT sql FROM sqlite_master WHERE name='t1';
+} {{CREATE TABLE t1(bbb,b,c,UNIQUE(bbb),PRIMARY KEY(bbb),UNIQUE(bbb))WITHOUT ROWID}}
+do_execsql_test 20.110 {
+  DROP TABLE t1;
+  CREATE TABLE t1(aa UNIQUE,bb UNIQUE,cc UNIQUE,UNIQUE(aA),PRIMARY KEY(bB),UNIQUE(cC));
+  ALTER TABLE t1 RENAME aa TO xx;
+  ALTER TABLE t1 RENAME bb TO yy;
+  ALTER TABLE t1 RENAME cc TO zz;
+  SELECT sql FROM sqlite_master WHERE name='t1';
+} {{CREATE TABLE t1(xx UNIQUE,yy UNIQUE,zz UNIQUE,UNIQUE(xx),PRIMARY KEY(yy),UNIQUE(zz))}}
+
 
 
 finish_test

Index: test/alterlegacy.test
==================================================================
--- test/alterlegacy.test
+++ test/alterlegacy.test
@@ -465,6 +465,5 @@
   ALTER TABLE t1 RENAME TO tt1;
 }
 
 
 finish_test
-

Index: test/altertab.test
==================================================================
--- test/altertab.test
+++ test/altertab.test
@@ -238,15 +238,17 @@
     ), (
         'main', NULL, 'ddd', 'eee', 0
     );
   } {}
   
+  sqlite3_test_control SQLITE_TESTCTRL_INTERNAL_FUNCTIONS 1
   do_execsql_test 7.2 {
     SELECT 
     sqlite_rename_table(db, 0, 0, sql, zOld, zNew, bTemp)
     FROM ddd;
   } {{} {} {}}
+  sqlite3_test_control SQLITE_TESTCTRL_INTERNAL_FUNCTIONS 0
 }
 
 #-------------------------------------------------------------------------
 #
 reset_db
@@ -501,8 +503,60 @@
 
 do_execsql_test 15.5 {
   SELECT sql FROM sqlite_master WHERE name = 'y';
 } {{CREATE VIEW y AS SELECT f2 AS f1 FROM x}}
 
+#-------------------------------------------------------------------------
+# Test that it is not possible to rename a shadow table in DEFENSIVE mode.
+#
+ifcapable fts3 {
+  proc vtab_command {method args} {
+    switch -- $method {
+      xConnect {
+        if {[info exists ::vtab_connect_sql]} {
+          execsql $::vtab_connect_sql
+        }
+        return "CREATE TABLE t1(a, b, c)"
+      }
+
+      xBestIndex {
+        set clist [lindex $args 0]
+        if {[llength $clist]!=1} { error "unexpected constraint list" }
+        catch { array unset C }
+        array set C [lindex $clist 0]
+        if {$C(usable)} {
+          return "omit 0 cost 0 rows 1 idxnum 555 idxstr eq!"
+        } else {
+          return "cost 1000000 rows 0 idxnum 0 idxstr scan..."
+        }
+      }
+    }
+
+    return {}
+  }
+
+  register_tcl_module db
+
+  sqlite3_db_config db DEFENSIVE 1
+
+  do_execsql_test 16.0 {
+    CREATE VIRTUAL TABLE y1 USING fts3;
+  }
+
+  do_catchsql_test 16.1 {
+    INSERT INTO y1_segments VALUES(1, X'1234567890');
+  } {1 {table y1_segments may not be modified}}
+
+  do_catchsql_test 16.2 {
+    ALTER TABLE y1_segments RENAME TO abc;
+  } {1 {table y1_segments may not be altered}}
+
+  do_execsql_test 16.3 {
+    ALTER TABLE y1 RENAME TO z1;
+  }
+
+  do_execsql_test 16.4 {
+    SELECT * FROM z1_segments;
+  }
+}
 
 finish_test
-

Index: test/altertab2.test
==================================================================
--- test/altertab2.test
+++ test/altertab2.test
@@ -10,11 +10,11 @@
 #*************************************************************************
 #
 
 set testdir [file dirname $argv0]
 source $testdir/tester.tcl
-set testprefix altertab
+set testprefix altertab2
 
 # If SQLITE_OMIT_ALTERTABLE is defined, omit this file.
 ifcapable !altertable {
   finish_test
   return
@@ -39,8 +39,312 @@
     INSERT INTO rr VALUES('in', 'tcl');
     SELECT * FROM ffff;
   } {hello world in tcl}
 }
 
+#-------------------------------------------------------------------------
+# Check that table names that appear in REFERENCES clauses are updated
+# when a table is renamed unless:
+#
+#   a) "PRAGMA legacy_alter_table" is true, and
+#   b) "PRAGMA foreign_keys" is false.
+#
+do_execsql_test 2.0 {
+  CREATE TABLE p1(a PRIMARY KEY, b);
+  CREATE TABLE c1(x REFERENCES p1);
+  CREATE TABLE c2(x, FOREIGN KEY (x) REFERENCES p1);
+  CREATE TABLE c3(x, FOREIGN KEY (x) REFERENCES p1(a));
+}
+
+do_execsql_test 2.1 {
+  ALTER TABLE p1 RENAME TO p2;
+  SELECT sql FROM sqlite_master WHERE name LIKE 'c%';
+} {
+  {CREATE TABLE c1(x REFERENCES "p2")}
+  {CREATE TABLE c2(x, FOREIGN KEY (x) REFERENCES "p2")}
+  {CREATE TABLE c3(x, FOREIGN KEY (x) REFERENCES "p2"(a))}
+}
+
+do_execsql_test 2.2 {
+  PRAGMA legacy_alter_table = 1;
+  ALTER TABLE p2 RENAME TO p3;
+  SELECT sql FROM sqlite_master WHERE name LIKE 'c%';
+} {
+  {CREATE TABLE c1(x REFERENCES "p2")}
+  {CREATE TABLE c2(x, FOREIGN KEY (x) REFERENCES "p2")}
+  {CREATE TABLE c3(x, FOREIGN KEY (x) REFERENCES "p2"(a))}
+}
+
+do_execsql_test 2.3 {
+  ALTER TABLE p3 RENAME TO p2;
+  PRAGMA foreign_keys = 1;
+  ALTER TABLE p2 RENAME TO p3;
+  SELECT sql FROM sqlite_master WHERE name LIKE 'c%';
+} {
+  {CREATE TABLE c1(x REFERENCES "p3")}
+  {CREATE TABLE c2(x, FOREIGN KEY (x) REFERENCES "p3")}
+  {CREATE TABLE c3(x, FOREIGN KEY (x) REFERENCES "p3"(a))}
+}
+
+#-------------------------------------------------------------------------
+# Table name in WITH clauses that are part of views or triggers.
+#
+foreach {tn schema} {
+  1 {
+    CREATE TABLE log_entry(col1, y);
+    CREATE INDEX i1 ON log_entry(col1);
+  }
+
+  2 {
+    CREATE TABLE t1(a, b, c);
+    CREATE TABLE t2(x);
+    CREATE TABLE log_entry(col1);
+    CREATE TRIGGER tr1 AFTER INSERT ON t1 BEGIN
+      INSERT INTO t2 SELECT col1 FROM log_entry;
+    END;
+  }
+
+  3 {
+    CREATE TABLE t1(a, b, c);
+    CREATE TABLE t2(x);
+    CREATE TABLE log_entry(col1);
+    CREATE TRIGGER tr1 AFTER INSERT ON t1 BEGIN
+      INSERT INTO t2
+        WITH xyz(x) AS (SELECT col1 FROM log_entry)
+        SELECT x FROM xyz;
+    END;
+  }
+
+  4 {
+    CREATE TABLE log_entry(col1);
+    CREATE VIEW ttt AS
+        WITH xyz(x) AS (SELECT col1 FROM log_entry)
+        SELECT x FROM xyz;
+  }
+} {
+  reset_db
+  do_execsql_test 3.$tn.1 $schema
+  set expect [db eval "SELECT sql FROM sqlite_master"]
+  set expect [string map {log_entry {"newname"}} $expect]
+
+  do_execsql_test 3.$tn.2 {
+    ALTER TABLE log_entry RENAME TO newname;
+    SELECT sql FROM sqlite_master;
+  } $expect
+
+  reset_db
+  do_execsql_test 3.$tn.3 $schema
+  set expect [db eval "SELECT sql FROM sqlite_master"]
+  set expect [string map {col1 newname} $expect]
+
+  do_execsql_test 3.$tn.4 {
+    ALTER TABLE log_entry RENAME col1 TO newname;
+    SELECT sql FROM sqlite_master;
+  } $expect
+}
+
+#-------------------------------------------------------------------------
+reset_db
+do_execsql_test 4.0 {
+  CREATE TABLE t1(a,b,c,d,e,f);
+  CREATE TRIGGER r1 AFTER INSERT ON t1 WHEN new.a NOT NULL BEGIN
+    UPDATE t1 SET (c,d)=(a,b);
+  END;
+}
+
+do_execsql_test 4.1 {
+  ALTER TABLE t1 RENAME TO t1x;
+  SELECT sql FROM sqlite_master WHERE type = 'trigger';
+} {
+{CREATE TRIGGER r1 AFTER INSERT ON "t1x" WHEN new.a NOT NULL BEGIN
+    UPDATE "t1x" SET (c,d)=(a,b);
+  END}
+}
+
+do_execsql_test 4.2 {
+  ALTER TABLE t1x RENAME a TO aaa;
+  SELECT sql FROM sqlite_master WHERE type = 'trigger';
+} {
+{CREATE TRIGGER r1 AFTER INSERT ON "t1x" WHEN new.aaa NOT NULL BEGIN
+    UPDATE "t1x" SET (c,d)=(aaa,b);
+  END}
+}
+
+do_execsql_test 4.3 {
+  ALTER TABLE t1x RENAME d TO ddd;
+  SELECT sql FROM sqlite_master WHERE type = 'trigger';
+} {
+{CREATE TRIGGER r1 AFTER INSERT ON "t1x" WHEN new.aaa NOT NULL BEGIN
+    UPDATE "t1x" SET (c,ddd)=(aaa,b);
+  END}
+}
+
+#-------------------------------------------------------------------------
+do_execsql_test 5.0 {
+  CREATE TABLE t2(a);
+  CREATE TRIGGER r2 AFTER INSERT ON t2 WHEN new.a NOT NULL BEGIN
+    SELECT a, sum(a) OVER w1 FROM t2
+      WINDOW w1 AS (
+        PARTITION BY a ORDER BY a 
+        ROWS BETWEEN 2 PRECEDING AND 3 FOLLOWING
+      ),
+      w2 AS (
+        PARTITION BY a
+        ORDER BY rowid ROWS BETWEEN CURRENT ROW AND UNBOUNDED FOLLOWING
+      );
+  END;
+} {}
+
+do_execsql_test 5.0.1 {
+  INSERT INTO t2 VALUES(1);
+} {}
+
+do_execsql_test 5.1 {
+  ALTER TABLE t2 RENAME TO t2x;
+  SELECT sql FROM sqlite_master WHERE name = 'r2';
+} {
+  {CREATE TRIGGER r2 AFTER INSERT ON "t2x" WHEN new.a NOT NULL BEGIN
+    SELECT a, sum(a) OVER w1 FROM "t2x"
+      WINDOW w1 AS (
+        PARTITION BY a ORDER BY a 
+        ROWS BETWEEN 2 PRECEDING AND 3 FOLLOWING
+      ),
+      w2 AS (
+        PARTITION BY a
+        ORDER BY rowid ROWS BETWEEN CURRENT ROW AND UNBOUNDED FOLLOWING
+      );
+  END}
+}
+
+do_execsql_test 5.2 {
+  ALTER TABLE t2x RENAME a TO aaaa;
+  SELECT sql FROM sqlite_master WHERE name = 'r2';
+} {
+  {CREATE TRIGGER r2 AFTER INSERT ON "t2x" WHEN new.aaaa NOT NULL BEGIN
+    SELECT aaaa, sum(aaaa) OVER w1 FROM "t2x"
+      WINDOW w1 AS (
+        PARTITION BY aaaa ORDER BY aaaa 
+        ROWS BETWEEN 2 PRECEDING AND 3 FOLLOWING
+      ),
+      w2 AS (
+        PARTITION BY aaaa
+        ORDER BY rowid ROWS BETWEEN CURRENT ROW AND UNBOUNDED FOLLOWING
+      );
+  END}
+}
+
+do_execsql_test 5.3 {
+  INSERT INTO t2x VALUES(1);
+} {}
+
+#-------------------------------------------------------------------------
+
+do_execsql_test 6.0 {
+  CREATE TABLE t3(a,b,c,d);
+  CREATE TRIGGER r3 AFTER INSERT ON t3 WHEN new.a NOT NULL BEGIN
+    SELECT a,b,c FROM t3 EXCEPT SELECT a,b,c FROM t3 ORDER BY a;
+    SELECT rowid, * FROM t3;
+  END;
+} {}
+
+do_execsql_test 6.1 {
+  ALTER TABLE t3 RENAME TO t3x;
+  SELECT sql FROM sqlite_master WHERE name = 'r3';
+} {
+  {CREATE TRIGGER r3 AFTER INSERT ON "t3x" WHEN new.a NOT NULL BEGIN
+    SELECT a,b,c FROM "t3x" EXCEPT SELECT a,b,c FROM "t3x" ORDER BY a;
+    SELECT rowid, * FROM "t3x";
+  END}
+}
+
+do_execsql_test 6.2 {
+  ALTER TABLE t3x RENAME a TO abcd;
+  SELECT sql FROM sqlite_master WHERE name = 'r3';
+} {
+  {CREATE TRIGGER r3 AFTER INSERT ON "t3x" WHEN new.abcd NOT NULL BEGIN
+    SELECT abcd,b,c FROM "t3x" EXCEPT SELECT abcd,b,c FROM "t3x" ORDER BY abcd;
+    SELECT rowid, * FROM "t3x";
+  END}
+}
+
+#-------------------------------------------------------------------------
+reset_db
+
+do_execsql_test 7.0 {
+  CREATE TABLE t1(a,b,c,d,e,f);
+  INSERT INTO t1 VALUES(1,2,3,4,5,6);
+  CREATE TABLE t2(x,y,z);
+}
+
+do_execsql_test 7.1 {
+  SELECT a,b,c FROM t1 UNION SELECT d,e,f FROM t1 ORDER BY b,c;
+} {1 2 3 4 5 6}
+
+do_execsql_test 7.2 {
+  CREATE TRIGGER r1 AFTER INSERT ON t1 BEGIN
+    INSERT INTO t2
+    SELECT a,b,c FROM t1 UNION SELECT d,e,f FROM t1 ORDER BY b,c;
+  END;
+  INSERT INTO t1 VALUES(2,3,4,5,6,7);
+  SELECT * FROM t2;
+} {1 2 3  2 3 4  4 5 6  5 6 7}
+
+do_execsql_test 7.3 {
+  ALTER TABLE t1 RENAME TO xyzzy;
+  SELECT sql FROM sqlite_master WHERE name='r1'
+} {
+  {CREATE TRIGGER r1 AFTER INSERT ON "xyzzy" BEGIN
+    INSERT INTO t2
+    SELECT a,b,c FROM "xyzzy" UNION SELECT d,e,f FROM "xyzzy" ORDER BY b,c;
+  END}
+}
+
+do_execsql_test 7.3 {
+  ALTER TABLE xyzzy RENAME c TO ccc;
+  SELECT sql FROM sqlite_master WHERE name='r1'
+} {
+  {CREATE TRIGGER r1 AFTER INSERT ON "xyzzy" BEGIN
+    INSERT INTO t2
+    SELECT a,b,ccc FROM "xyzzy" UNION SELECT d,e,f FROM "xyzzy" ORDER BY b,ccc;
+  END}
+}
+
+#-------------------------------------------------------------------------
+reset_db
+do_execsql_test 8.0 {
+  CREATE TABLE t1(a, b, c); 
+  CREATE TABLE t2(a, b, c); 
+  CREATE TABLE t3(d, e, f);
+  CREATE VIEW v1 AS SELECT * FROM t1;
+  CREATE TRIGGER tr AFTER INSERT ON t3 BEGIN
+    UPDATE t2 SET a = new.d;
+    SELECT a, b, c FROM v1;
+  END;
+}
+
+do_execsql_test 8.1 {
+  INSERT INTO t3 VALUES(1, 2, 3);
+}
+
+# The following ALTER TABLE fails as if column "t1.a" is renamed the "a"
+# in the "SELECT a, b, c FROM v1" within the trigger can no longer be
+# resolved. But at one point there was a bug allowing the ALTER TABLE
+# succeed. Which meant the subsequent INSERT statement would fail.
+do_catchsql_test 8.2 {
+  ALTER TABLE t1 RENAME a TO aaa;
+} {1 {error in trigger tr after rename: no such column: a}}
+do_execsql_test 8.3 {
+  INSERT INTO t3 VALUES(4, 5, 6);
+}
+
+do_execsql_test 8.1 {
+  CREATE TABLE t4(a, b);
+  CREATE VIEW v4 AS SELECT * FROM t4 WHERE (a=1 AND 0) OR b=2;
+}
+do_execsql_test 8.2 {
+  ALTER TABLE t4 RENAME a TO c;
+  SELECT sql FROM sqlite_master WHERE name = 'v4'
+} {{CREATE VIEW v4 AS SELECT * FROM t4 WHERE (c=1 AND 0) OR b=2}}
 
 finish_test
+
 

ADDED   test/altertab3.test
Index: test/altertab3.test
==================================================================
--- /dev/null
+++ test/altertab3.test
@@ -0,0 +1,86 @@
+# 2019 January 23
+#
+# The author disclaims copyright to this source code.  In place of
+# a legal notice, here is a blessing:
+#
+#    May you do good and not evil.
+#    May you find forgiveness for yourself and forgive others.
+#    May you share freely, never taking more than you give.
+#
+#*************************************************************************
+#
+
+set testdir [file dirname $argv0]
+source $testdir/tester.tcl
+set testprefix altertab3
+
+# If SQLITE_OMIT_ALTERTABLE is defined, omit this file.
+ifcapable !altertable {
+  finish_test
+  return
+}
+
+do_execsql_test 1.0 {
+  CREATE TABLE t1(a, b);
+  CREATE TRIGGER tr1 AFTER INSERT ON t1 BEGIN
+    SELECT sum(b) OVER w FROM t1 WINDOW w AS (ORDER BY a);
+  END;
+}
+
+do_execsql_test 1.1 {
+  ALTER TABLE t1 RENAME a TO aaa;
+}
+
+do_execsql_test 1.2 {
+  SELECT sql FROM sqlite_master WHERE name='tr1'
+} {{CREATE TRIGGER tr1 AFTER INSERT ON t1 BEGIN
+    SELECT sum(b) OVER w FROM t1 WINDOW w AS (ORDER BY aaa);
+  END}}
+
+do_execsql_test 1.3 {
+  INSERT INTO t1 VALUES(1, 2);
+}
+
+#-------------------------------------------------------------------------
+reset_db
+do_execsql_test 2.0 {
+  CREATE TABLE t1(a,b,c);
+  CREATE TABLE t2(a,b,c);
+  CREATE TRIGGER r1 AFTER INSERT ON t1 WHEN new.a NOT NULL BEGIN
+    SELECT a,b, a name FROM t1 
+      INTERSECT 
+    SELECT a,b,c FROM t1 WHERE b>='d' ORDER BY name;
+    SELECT new.c;
+  END;
+}
+
+do_execsql_test 2.1 {
+  ALTER TABLE t1 RENAME TO t1x;
+  SELECT sql FROM sqlite_master WHERE name = 'r1';
+} {{CREATE TRIGGER r1 AFTER INSERT ON "t1x" WHEN new.a NOT NULL BEGIN
+    SELECT a,b, a name FROM "t1x" 
+      INTERSECT 
+    SELECT a,b,c FROM "t1x" WHERE b>='d' ORDER BY name;
+    SELECT new.c;
+  END}}
+
+#-------------------------------------------------------------------------
+reset_db
+do_execsql_test 3.0 {
+  CREATE TABLE t1(a, b, c, d);
+  CREATE VIEW v1 AS SELECT * FROM t1 WHERE a=1 OR (b IN ());
+}
+
+do_execsql_test 3.1 {
+  ALTER TABLE t1 RENAME b TO bbb;
+}
+
+do_execsql_test 3.2 {
+  SELECT sql FROM sqlite_master WHERE name = 'v1'
+} {{CREATE VIEW v1 AS SELECT * FROM t1 WHERE a=1 OR (bbb IN ())}}
+
+
+
+finish_test
+
+

Index: test/analyze.test
==================================================================
--- test/analyze.test
+++ test/analyze.test
@@ -348,10 +348,11 @@
 
 # This test corrupts the database file so it must be the last test
 # in the series.
 #
 do_test analyze-5.99 {
+  sqlite3_db_config db DEFENSIVE 0
   execsql {
     PRAGMA writable_schema=on;
     UPDATE sqlite_master SET sql='nonsense' WHERE name='sqlite_stat1';
   }
   db close

Index: test/attach.test
==================================================================
--- test/attach.test
+++ test/attach.test
@@ -724,13 +724,14 @@
         DELETE FROM t1 WHERE x<(SELECT min(x) FROM temp.t6);
       END;
     } db2
   } {1 {trigger r5 cannot reference objects in database temp}}
 } ;# endif subquery
-ifcapable json1 {
+ifcapable json1&&vtab {
   do_test attach-5.10 {
     db close
+    catch {db2 close}
     forcedelete test.db
     sqlite3 db test.db
     db eval {
       CREATE TABLE t1(x);
       CREATE TABLE t2(a,b);

Index: test/autoinc.test
==================================================================
--- test/autoinc.test
+++ test/autoinc.test
@@ -695,10 +695,11 @@
 #
 do_test autoinc-12.1 {
   db close
   forcedelete test.db
   sqlite3 db test.db
+  sqlite3_db_config db DEFENSIVE 0
   db eval {
     CREATE TABLE fake_sequence(name TEXT PRIMARY KEY,seq) WITHOUT ROWID;
     PRAGMA writable_schema=on;
     UPDATE sqlite_master SET
      sql=replace(sql,'fake_','sqlite_'),
@@ -716,10 +717,11 @@
 } {1 {database disk image is malformed}}
 do_test autoinc-12.2 {
   db close
   forcedelete test.db
   sqlite3 db test.db
+  sqlite3_db_config db DEFENSIVE 0
   db eval {
    CREATE TABLE t1(a INTEGER PRIMARY KEY AUTOINCREMENT, b TEXT);
    INSERT INTO t1(b) VALUES('one');
    PRAGMA writable_schema=on;
    UPDATE sqlite_master SET
@@ -742,10 +744,11 @@
 }
 do_test autoinc-12.3 {
   db close
   forcedelete test.db
   sqlite3 db test.db
+  sqlite3_db_config db DEFENSIVE 0
   db eval {
    CREATE TABLE t1(a INTEGER PRIMARY KEY AUTOINCREMENT, b TEXT);
    INSERT INTO t1(b) VALUES('one');
    PRAGMA writable_schema=on;
    UPDATE sqlite_master SET
@@ -770,10 +773,11 @@
   }
   set root1 [db one {SELECT rootpage FROM sqlite_master
                      WHERE name='sqlite_sequence'}]
   set root2 [db one {SELECT rootpage FROM sqlite_master
                      WHERE name='fake'}]
+  sqlite3_db_config db DEFENSIVE 0
   db eval {
    PRAGMA writable_schema=on;
    UPDATE sqlite_master SET rootpage=$root2
     WHERE name='sqlite_sequence';
    UPDATE sqlite_master SET rootpage=$root1
@@ -789,10 +793,11 @@
 breakpoint
 do_test autoinc-12.5 {
   db close
   forcedelete test.db
   sqlite3 db test.db
+  sqlite3_db_config db DEFENSIVE 0
   db eval {
     CREATE TABLE t1(a INTEGER PRIMARY KEY AUTOINCREMENT, b TEXT);
     INSERT INTO t1(b) VALUES('one');
     PRAGMA writable_schema=on;
     UPDATE sqlite_master SET
@@ -808,10 +813,11 @@
 } {1 {database disk image is malformed}}
 do_test autoinc-12.6 {
   db close
   forcedelete test.db
   sqlite3 db test.db
+  sqlite3_db_config db DEFENSIVE 0
   db eval {
     CREATE TABLE t1(a INTEGER PRIMARY KEY AUTOINCREMENT, b TEXT);
     INSERT INTO t1(b) VALUES('one');
     PRAGMA writable_schema=on;
     UPDATE sqlite_master SET
@@ -829,10 +835,11 @@
 } {0 ok}
 do_test autoinc-12.7 {
   db close
   forcedelete test.db
   sqlite3 db test.db
+  sqlite3_db_config db DEFENSIVE 0
   db eval {
     CREATE TABLE t1(a INTEGER PRIMARY KEY AUTOINCREMENT, b TEXT);
     INSERT INTO t1(b) VALUES('one');
     PRAGMA writable_schema=on;
     UPDATE sqlite_master SET

Index: test/autoindex1.test
==================================================================
--- test/autoindex1.test
+++ test/autoindex1.test
@@ -182,30 +182,30 @@
   SELECT b FROM t501
    WHERE t501.a IN (SELECT x FROM t502 WHERE y=?);
 } {
   QUERY PLAN
   |--SEARCH TABLE t501 USING INTEGER PRIMARY KEY (rowid=?)
-  `--LIST SUBQUERY
+  `--LIST SUBQUERY xxxxxx
      `--SCAN TABLE t502
 }
 do_eqp_test autoindex1-501 {
   SELECT b FROM t501
    WHERE t501.a IN (SELECT x FROM t502 WHERE y=t501.b);
 } {
   QUERY PLAN
   |--SCAN TABLE t501
-  `--CORRELATED LIST SUBQUERY
+  `--CORRELATED LIST SUBQUERY xxxxxx
      `--SEARCH TABLE t502 USING AUTOMATIC COVERING INDEX (y=?)
 }
 do_eqp_test autoindex1-502 {
   SELECT b FROM t501
    WHERE t501.a=123
      AND t501.a IN (SELECT x FROM t502 WHERE y=t501.b);
 } {
   QUERY PLAN
   |--SEARCH TABLE t501 USING INTEGER PRIMARY KEY (rowid=?)
-  `--CORRELATED LIST SUBQUERY
+  `--CORRELATED LIST SUBQUERY xxxxxx
      `--SCAN TABLE t502
 }
 
 # The following code checks a performance regression reported on the
 # mailing list on 2010-10-19.  The problem is that the nRowEst field
@@ -278,11 +278,11 @@
 } {
   QUERY PLAN
   |--MATERIALIZE xxxxxx
   |  |--SCAN TABLE sheep AS s
   |  |--SEARCH TABLE flock_owner AS prev USING INDEX sqlite_autoindex_flock_owner_1 (flock_no=? AND owner_change_date<?)
-  |  `--CORRELATED SCALAR SUBQUERY
+  |  `--CORRELATED SCALAR SUBQUERY xxxxxx
   |     `--SEARCH TABLE flock_owner AS later USING COVERING INDEX sqlite_autoindex_flock_owner_1 (flock_no=? AND owner_change_date>? AND owner_change_date<?)
   |--SCAN TABLE sheep AS x USING INDEX sheep_reg_flock_index
   `--SEARCH SUBQUERY xxxxxx AS y USING AUTOMATIC COVERING INDEX (sheep_no=?)
 }
 

Index: test/bestindex3.test
==================================================================
--- test/bestindex3.test
+++ test/bestindex3.test
@@ -88,21 +88,25 @@
 do_eqp_test 1.3 {
   SELECT * FROM t1 WHERE a = 'abc' OR b = 'def';
 } {
   QUERY PLAN
   `--MULTI-INDEX OR
-     |--SCAN TABLE t1 VIRTUAL TABLE INDEX 0:a EQ ?
-     `--SCAN TABLE t1 VIRTUAL TABLE INDEX 0:b EQ ?
+     |--INDEX 1
+     |  `--SCAN TABLE t1 VIRTUAL TABLE INDEX 0:a EQ ?
+     `--INDEX 2
+        `--SCAN TABLE t1 VIRTUAL TABLE INDEX 0:b EQ ?
 }
 
 do_eqp_test 1.4 {
   SELECT * FROM t1 WHERE a LIKE 'abc%' OR b = 'def';
 } {
   QUERY PLAN
   `--MULTI-INDEX OR
-     |--SCAN TABLE t1 VIRTUAL TABLE INDEX 0:a LIKE ?
-     `--SCAN TABLE t1 VIRTUAL TABLE INDEX 0:b EQ ?
+     |--INDEX 1
+     |  `--SCAN TABLE t1 VIRTUAL TABLE INDEX 0:a LIKE ?
+     `--INDEX 2
+        `--SCAN TABLE t1 VIRTUAL TABLE INDEX 0:b EQ ?
 }
 
 do_execsql_test 1.5 {
   CREATE TABLE ttt(a, b, c);
 
@@ -148,12 +152,14 @@
   do_eqp_test 2.2 {
     SELECT * FROM t2 WHERE x LIKE 'abc%' OR y = 'def'
   } [string map {"\n  " \n} {
     QUERY PLAN
     `--MULTI-INDEX OR
-       |--SEARCH TABLE t2 USING INDEX t2x (x>? AND x<?)
-       `--SEARCH TABLE t2 USING INDEX t2y (y=?)
+       |--INDEX 1
+       |  `--SEARCH TABLE t2 USING INDEX t2x (x>? AND x<?)
+       `--INDEX 2
+          `--SEARCH TABLE t2 USING INDEX t2y (y=?)
   }]
 }
 
 #-------------------------------------------------------------------------
 # Test that any PRIMARY KEY within a sqlite3_decl_vtab() CREATE TABLE 

Index: test/bestindex4.test
==================================================================
--- test/bestindex4.test
+++ test/bestindex4.test
@@ -153,21 +153,23 @@
 do_execsql_test 2.0 {
   CREATE VIRTUAL TABLE x1 USING tcl(vtab_command);
   CREATE TABLE t1 (x INT PRIMARY KEY);
 } {}
 
-do_execsql_test 2.1 {
-  EXPLAIN QUERY PLAN SELECT * FROM t1, x1 WHERE x1.d=t1.x;
+do_eqp_test 2.1 {
+  SELECT * FROM t1, x1 WHERE x1.d=t1.x;
 } {
-  3 0 0 {SCAN TABLE x1 VIRTUAL TABLE INDEX 0:}
-  7 0 0 {SEARCH TABLE t1 USING COVERING INDEX sqlite_autoindex_t1_1 (x=?)}
+  QUERY PLAN
+  |--SCAN TABLE x1 VIRTUAL TABLE INDEX 0:
+  `--SEARCH TABLE t1 USING COVERING INDEX sqlite_autoindex_t1_1 (x=?)
 }
 
-do_execsql_test 2.2 {
-  EXPLAIN QUERY PLAN SELECT * FROM t1, x1(t1.x)
+do_eqp_test 2.2 {
+  SELECT * FROM t1, x1(t1.x)
 } {
-  3 0 0 {SCAN TABLE t1} 
-  5 0 0 {SCAN TABLE x1 VIRTUAL TABLE INDEX 555:}
+  QUERY PLAN
+  |--SCAN TABLE t1
+  `--SCAN TABLE x1 VIRTUAL TABLE INDEX 555:
 }
 
 
 finish_test

Index: test/bestindex5.test
==================================================================
--- test/bestindex5.test
+++ test/bestindex5.test
@@ -245,6 +245,5 @@
 
 do_execsql_test 3.5 { SELECT rowid, * FROM t4 WHERE rowid!=1 OR x!='245'; } {}
 
 
 finish_test
-

Index: test/btree02.test
==================================================================
--- test/btree02.test
+++ test/btree02.test
@@ -19,36 +19,44 @@
 
 load_static_extension db eval
 do_execsql_test btree02-100 {
   CREATE TABLE t1(a TEXT, ax INTEGER, b INT, PRIMARY KEY(a,ax)) WITHOUT ROWID;
   WITH RECURSIVE c(i) AS (VALUES(1) UNION ALL SELECT i+1 FROM c WHERE i<10)
-    INSERT INTO t1(a,ax,b) SELECT printf('%02x',i), random(), i FROM c;
+    INSERT INTO t1(a,ax,b) SELECT printf('%02x',i+160), random(), i FROM c;
   CREATE INDEX t1a ON t1(a);
   CREATE TABLE t2(x,y);
   CREATE TABLE t3(cnt);
   WITH RECURSIVE c(i) AS (VALUES(1) UNION ALL SELECT i+1 FROM c WHERE i<4)
     INSERT INTO t3(cnt) SELECT i FROM c;
   SELECT count(*) FROM t1;
 } {10}
+
+proc showt1 {} {
+  puts -nonewline "t1: "
+  puts [db eval {SELECT printf('(%s,%s)',quote(a),quote(b)) FROM t1}]
+}
+
 do_test btree02-110 {
   db eval BEGIN
   set i 0
+  # showt1
   db eval {SELECT a, ax, b, cnt FROM t1 CROSS JOIN t3 WHERE b IS NOT NULL} {
-    if {$a==""} {set a 0}
-    if {$b==""} {set b 0}    
+    if {$a==""} continue
     db eval {INSERT INTO t2(x,y) VALUES($b,$cnt)}
     # puts "a,b,cnt = ($a,$b,$cnt)"
     incr i
     if {$i%2==1} {
       set bx [expr {$b+1000}]
-      # puts "INSERT ($a),$bx"
+      #  puts "INSERT ($a),$bx"
       db eval {INSERT INTO t1(a,ax,b) VALUES(printf('(%s)',$a),random(),$bx)}
+      # showt1
     } else {
       # puts "DELETE a=$a"
       db eval {DELETE FROM t1 WHERE a=$a}
+      # showt1
     }
     db eval {COMMIT; BEGIN}
   }  
   db one {COMMIT; SELECT count(*) FROM t1;}
-} {27}
+} {10}
 
 finish_test

Index: test/capi3.test
==================================================================
--- test/capi3.test
+++ test/capi3.test
@@ -739,10 +739,11 @@
     }
     db close
   } {}
   do_test capi3-8.2 {
     sqlite3 db test.db
+    sqlite3_db_config db DEFENSIVE 0
     execsql {
       PRAGMA writable_schema=ON;
       INSERT INTO sqlite_master VALUES(NULL,NULL,NULL,NULL,NULL);
     }
     db close
@@ -757,10 +758,11 @@
     # Build a 5-field row record. The first field is a string 'table', and
     # subsequent fields are all NULL.
     db close
     forcedelete test.db test.db-journal
     sqlite3 db test.db
+    sqlite3_db_config db DEFENSIVE 0
     execsql {
       CREATE TABLE t1(a);
       PRAGMA writable_schema=ON;
       INSERT INTO sqlite_master VALUES('table',NULL,NULL,NULL,NULL);
     }

Index: test/capi3c.test
==================================================================
--- test/capi3c.test
+++ test/capi3c.test
@@ -684,10 +684,11 @@
     }
     db close
   } {}
   do_test capi3c-8.2 {
     sqlite3 db test.db
+    sqlite3_db_config db DEFENSIVE 0
     execsql {
       PRAGMA writable_schema=ON;
       INSERT INTO sqlite_master VALUES(NULL,NULL,NULL,NULL,NULL);
     }
     db close
@@ -702,10 +703,11 @@
     # Build a 5-field row record. The first field is a string 'table', and
     # subsequent fields are all NULL.
     db close
     forcedelete test.db test.db-journal
     sqlite3 db test.db
+    sqlite3_db_config db DEFENSIVE 0
     execsql {
       CREATE TABLE t1(a);
       PRAGMA writable_schema=ON;
       INSERT INTO sqlite_master VALUES('table',NULL,NULL,NULL,NULL);
     }

Index: test/conflict.test
==================================================================
--- test/conflict.test
+++ test/conflict.test
@@ -11,11 +11,10 @@
 # This file implements regression tests for SQLite library.
 #
 # This file implements tests for the conflict resolution extension
 # to SQLite.
 #
-# $Id: conflict.test,v 1.32 2009/04/30 09:10:38 danielk1977 Exp $
 
 set testdir [file dirname $argv0]
 source $testdir/tester.tcl
 
 ifcapable !conflict {
@@ -822,7 +821,18 @@
     COMMIT;
     SELECT * FROM t13;
   }
 } {1 3}
 
+
+# Ticket https://www.sqlite.org/src/tktview/e6f1f2e34dceeb1ed61531c7e9
+# Verify that it is not possible to sneak a NULL value into a NOT NULL
+# column using REPLACE.
+#
+do_catchsql_test conflict-14.1 {
+  DROP TABLE IF EXISTS t1;
+  CREATE TABLE t1(x NOT NULL DEFAULT NULL);
+  REPLACE INTO t1 DEFAULT VALUES;
+} {1 {NOT NULL constraint failed: t1.x}}
+
 
 finish_test

Index: test/corrupt.test
==================================================================
--- test/corrupt.test
+++ test/corrupt.test
@@ -130,10 +130,11 @@
 } {}
 do_test corrupt-3.2 {
   set t1_r [execsql {SELECT rootpage FROM sqlite_master WHERE name = 't1i1'}]
   set t1i1_r [execsql {SELECT rootpage FROM sqlite_master WHERE name = 't1'}]
   set cookie [expr [execsql {PRAGMA schema_version}] + 1]
+  sqlite3_db_config db DEFENSIVE 0
   execsql "
     PRAGMA writable_schema = 1;
     UPDATE sqlite_master SET rootpage = $t1_r WHERE name = 't1';
     UPDATE sqlite_master SET rootpage = $t1i1_r WHERE name = 't1i1';
     PRAGMA writable_schema = 0;

Index: test/corrupt2.test
==================================================================
--- test/corrupt2.test
+++ test/corrupt2.test
@@ -131,10 +131,11 @@
   forcedelete corrupt.db
   forcedelete corrupt.db-journal
   forcecopy test.db corrupt.db
 
   sqlite3 db2 corrupt.db 
+  sqlite3_db_config db2 DEFENSIVE 0
   execsql "
     $::presql
     CREATE INDEX a1 ON abc(a);
     CREATE INDEX a2 ON abc(b);
     PRAGMA writable_schema = 1;
@@ -263,10 +264,11 @@
   catch {db close}
   forcedelete corrupt.db
   forcedelete corrupt.db-journal
 
   sqlite3 db corrupt.db 
+  sqlite3_db_config db DEFENSIVE 0
   db eval $::presql
   eval $A(-tclprep)
   db eval $A(-sqlprep)
   db close
 

Index: test/corrupt5.test
==================================================================
--- test/corrupt5.test
+++ test/corrupt5.test
@@ -31,10 +31,11 @@
 }
 
 # Create a database with a freelist containing at least two pages.
 #
 do_test corrupt5-1.1 {
+  sqlite3_db_config db DEFENSIVE 0
   execsql {
     CREATE TABLE t1(a,b,c);
     CREATE INDEX i1 ON t1(a,b);
     PRAGMA writable_schema=ON;
     UPDATE sqlite_master SET name=NULL, sql=NULL WHERE name='i1';

Index: test/corruptI.test
==================================================================
--- test/corruptI.test
+++ test/corruptI.test
@@ -220,10 +220,11 @@
   INSERT INTO t1 VALUES('a', 'A');
   INSERT INTO t1 VALUES('b', 'A');
   INSERT INTO t1 VALUES('c', 'A');
   SELECT name FROM sqlite_master;
 } {t1 sqlite_autoindex_t1_1}
+sqlite3_db_config db DEFENSIVE 0
 do_execsql_test 7.1 {
   PRAGMA writable_schema = 1;
   DELETE FROM sqlite_master WHERE name = 'sqlite_autoindex_t1_1';
 }
 do_test 7.2 {

Index: test/corruptK.test
==================================================================
--- test/corruptK.test
+++ test/corruptK.test
@@ -141,11 +141,11 @@
     CREATE TABLE t2(a, b, c);
     CREATE TABLE t3(a, b, c);
     CREATE TABLE t4(a, b, c);
     CREATE TABLE t5(a, b, c);
   }
-  
+  sqlite3_db_config db DEFENSIVE 0
   do_execsql_test 3.2 {
     UPDATE sqlite_dbpage SET data = hex2blob('
    000: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00 SQLite format 3.
    010: 04 00 01 01 20 40 20 20 00 00 3e d9 00 00 00 06 .... @  ..>.....
    020: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 04 ................

ADDED   test/corruptL.test
Index: test/corruptL.test
==================================================================
--- /dev/null
+++ test/corruptL.test
@@ -0,0 +1,725 @@
+# 2019-01-11
+#
+# The author disclaims copyright to this source code.  In place of
+# a legal notice, here is a blessing:
+#
+#    May you do good and not evil.
+#    May you find forgiveness for yourself and forgive others.
+#    May you share freely, never taking more than you give.
+#
+#***********************************************************************
+#
+
+set testdir [file dirname $argv0]
+source $testdir/tester.tcl
+set testprefix corruptL
+
+database_may_be_corrupt
+
+#-------------------------------------------------------------------------
+reset_db
+do_test 1.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 356352 pagesize 4096 filename crash-acaae0347204ae.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 00 d0 00 00 00   .....@  ........
+|     32: 40 00 ea 00 00 00 00 00 00 40 00 00 00 40 00 00   @........@...@..
+|     96: 00 00 00 00 0d 00 00 00 04 0e 9c 00 0f ad 0f 4f   ...............O
+|    112: 0e fc 0e 9c 00 00 00 00 00 00 00 00 00 00 00 00   ................
+|   3728: 00 00 00 00 00 00 00 00 00 00 00 00 5e 04 07 17   ............^...
+|   3744: 1f 1f 01 81 0b 74 61 62 6c 65 74 31 5f 70 61 72   .....tablet1_par
+|   3760: 65 6e 74 74 31 5f 70 61 72 65 6e 74 04 43 52 45   entt1_parent.CRE
+|   3776: 41 54 45 20 54 41 42 4c 45 20 22 74 31 5f 70 61   ATE TABLE .t1_pa
+|   3792: 72 65 6e 74 22 28 6e 6f 64 65 6e 6f 20 49 4e 54   rent.(nodeno INT
+|   3808: 45 47 45 52 20 50 52 49 4d 41 52 59 20 4b 45 59   EGER PRIMARY KEY
+|   3824: 2c 70 61 72 65 6e 74 6e 6f 64 65 29 51 03 06 17   ,parentnode)Q...
+|   3840: 1b 1b 01 7b 74 61 62 6c 65 74 31 5f 6e 6f 64 65   ....tablet1_node
+|   3856: 74 31 5f 6e 6f 64 65 03 43 52 45 41 54 45 20 54   t1_node.CREATE T
+|   3872: 41 42 4c 45 20 22 74 31 5f 6e 6f 64 65 22 28 6e   ABLE .t1_node.(n
+|   3888: 6f 64 65 6e 6f 20 49 4e 54 45 47 45 52 20 50 52   odeno INTEGER PR
+|   3904: 49 4d 41 52 59 20 4b 45 59 2c 64 61 74 61 29 5c   IMARY KEY,data).
+|   3920: 02 07 17 1d 1d 01 81 0b 74 61 62 6c 65 74 31 5f   ........tablet1_
+|   3936: 72 6f 77 69 64 74 31 5f 72 6f 77 69 64 02 43 52   rowidt1_rowid.CR
+|   3952: 45 41 54 45 20 54 41 42 4c 45 20 22 74 31 5f 72   EATE TABLE .t1_r
+|   3968: 6f 77 69 64 22 28 72 6f 77 69 64 20 49 4e 54 45   owid.(rowid INTE
+|   3984: 47 45 52 20 50 52 49 4d 41 52 59 20 4b 45 59 2c   GER PRIMARY KEY,
+|   4000: 6e 6f 64 65 6e 6f 2c 61 30 2c 61 31 29 51 01 07   nodeno,a0,a1)Q..
+|   4016: 17 11 11 08 81 0f 74 61 62 6c 65 74 31 74 31 43   ......tablet1t1C
+|   4032: 52 45 41 54 45 20 56 49 52 54 55 41 4c 20 54 41   REATE VIRTUAL TA
+|   4048: 42 4c 45 20 74 31 20 55 53 49 4e 47 20 72 74 72   BLE t1 USING rtr
+|   4064: 65 65 28 69 64 2c 78 30 20 50 52 49 4d 41 52 59   ee(id,x0 PRIMARY
+|   4080: 20 4b 45 59 2c 70 61 72 65 6e 74 6e 6f 64 65 29    KEY,parentnode)
+| page 2 offset 4096
+|      0: 51 03 06 17 1b 1b 01 7b 74 61 62 6c 65 74 31 5f   Q.......tablet1_
+|     16: 6e 6f 64 65 74 31 5f 6e 6f 64 65 03 43 52 45 41   nodet1_node.CREA
+|     32: 54 45 20 54 41 42 4c 45 20 22 74 31 5f 6e 6f 64   TE TABLE .t1_nod
+|     48: 65 22 28 6e 6f 64 65 6e 6f 20 49 4e 54 45 47 45   e.(nodeno INTEGE
+|     64: 52 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 64 61   R PRIMARY KEY,da
+|     80: 74 61 29 5c 02 07 17 1d 1d 01 81 0b 74 61 62 6c   ta).........tabl
+|     96: 65 74 31 5f 72 6f 77 69 64 74 31 5f 72 6f 77 69   et1_rowidt1_rowi
+|    112: 64 02 43 52 45 41 54 45 20 54 41 42 4c 45 00 00   d.CREATE TABLE..
+|    128: 01 0a 02 00 00 00 01 0e 0d 00 00 00 00 24 0e 0d   .............$..
+|    144: 0c 1a 06 85 50 46 60 27 70 08 00 00 00 00 00 00   ....PF`'p.......
+|   3824: 00 00 00 00 00 00 00 0d 0e 05 00 09 1d 00 74 6f   ..............to
+|   3840: 79 20 68 61 6c 66 10 0d 05 00 09 23 00 62 6f 74   y half.....#.bot
+|   3856: 74 6f 6d 20 68 61 6c 66 0f 0c 05 00 09 21 00 72   tom half.....!.r
+|   3872: 69 67 68 74 20 68 61 6c 66 0e 0b 05 00 09 1f 00   ight half.......
+|   3888: 6c 65 66 74 20 43 15 f6 e6 f6 46 50 34 35 24 54   left C....FP45$T
+|   3904: 15 44 52 05 44 14 24 c4 52 02 27 43 15 f6 e6 f6   .DR.D.$.R.'C....
+|   3920: 46 52 22 8e 6f 64 65 6e 6f 20 49 4e 54 45 47 45   FR..odeno INTEGE
+|   3936: 52 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 64 61   R PRIMARY KEY,da
+|   3952: 74 61 29 5c 02 07 17 1d 1d 01 81 0b 74 61 62 6c   ta).........tabl
+|   3968: 65 74 31 5f 72 6f 74 74 6f 6d 20 65 64 67 65 0f   et1_rottom edge.
+|   3984: 07 05 00 09 21 00 72 69 67 68 74 20 65 64 67 65   ....!.right edge
+|   4000: 0e 06 05 00 09 1f 00 6c 65 66 74 20 65 64 67 65   .......left edge
+|   4016: 0b 05 05 00 09 19 00 63 65 6e 74 65 72 17 04 05   .......center...
+|   4032: 00 09 31 00 75 70 70 65 72 2d 72 69 67 68 74 20   ..1.upper-right 
+|   4048: 63 6f 72 6e 65 72 17 03 05 00 09 31 00 6c 6f 77   corner.....1.low
+|   4064: 65 72 2d 72 69 67 68 74 20 63 6f 72 6e 65 72 16   er-right corner.
+|   4080: 02 05 00 09 2f 00 75 70 70 65 72 2d 6c 65 66 74   ..../.upper-left
+| page 3 offset 8192
+|      0: 20 63 6f 72 6e 65 72 16 01 05 00 09 2f 01 8c 6f    corner...../..o
+|     16: 77 65 72 2d 6c 53 51 4c 69 74 65 20 66 6f 72 6d   wer-lSQLite form
+|     32: 61 74 20 33 00 10 00 01 01 00 40 20 20 00 00 00   at 3......@  ...
+|     48: 00 00 00 00 2f 00 00 0d eb 13 00 00 00 03 00 00   ..../...........
+|     64: 00 04 00 00 00 00 00 00 00 06 00 00 00 01 00 00   ................
+|     80: 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00   ................
+| page 6 offset 20480
+|    128: 00 00 00 00 00 00 00 00 97 3d 04 ae 7c 01 00 00   .........=..|...
+|    624: 00 00 00 00 00 00 21 97 3d 04 ae 7c 01 00 00 00   ......!.=..|....
+|   1120: 00 00 00 00 00 20 97 3d 04 ae 7c 01 00 00 00 00   ..... .=..|.....
+|   1616: 00 00 00 00 1f 97 3d 04 ae 7c 01 00 00 00 00 00   ......=..|......
+|   2112: 00 00 00 1e 97 3d 04 ae 7c 01 00 00 00 00 00 00   .....=..|.......
+|   2608: 00 00 1d 97 d3 d0 4a e7 c0 00 00 00 00 00 00 00   ......J.........
+|   3088: 00 00 00 00 00 00 00 00 00 00 00 00 01 f3 00 00   ................
+|   3600: 23 97 3d 04 ae 7c 01 00 00 00 00 00 00 00 00 00   #.=..|..........
+|   4080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 26   ...............&
+| page 8 offset 28672
+|      0: 0d 00 00 00 01 04 30 00 04 30 00 00 00 00 00 00   ......0..0......
+|   1072: 97 4d 1e 14 00 ae 7c 00 00 00 00 00 00 00 00 00   .M....|.........
+|   1088: 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03   ................
+| page 10 offset 36864
+|      0: 0d 00 00 00 01 04 30 00 04 30 00 00 00 00 00 00   ......0..0......
+|   1072: 9a ee c1 80 fd 78 1f ce 1b ae eb b4 00 00 00 00   .....x..........
+|   1088: 13 20 ff 20 00 70 00 00 00 60 50 00 00 00 11 e0   . . .p...`P.....
+|   1104: 00 00 00 70 00 00 00 60 50 05 35 14 c6 97 46 52   ...p...`P.5...FR
+|   1120: 06 66 f7 26 d6 17 42 03 30 01 00 00 10 10 04 02   .f.&..B.0.......
+|   1136: 02 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00   .........@......
+|   1152: 00 00 00 00 00 40 00 00 00 40 00 00 00 00 00 00   .....@...@......
+|   4080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05   ................
+| page 12 offset 45056
+|      0: 0d 00 00 00 01 04 30 00 04 30 e1 b4 30 97 4d 46   ......0..0..0.MF
+|     16: 14 00 ae 7c 00 00 00 00 00 00 00 03 00 00 43 00   ...|..........C.
+| page 47 offset 188416
+|   2512: 00 00 00 00 00 00 00 00 be 00 00 00 00 00 00 00   ................
+| page 87 offset 352256
+|   2512: 00 00 00 00 00 00 00 00 aa 00 00 00 00 00 00 00   ................
+| end crash-acaae0347204ae.db
+}]} {}
+
+do_catchsql_test 1.1 {
+  PRAGMA cell_size_check = off;
+  DROP INDEX t1x1;
+} {1 {no such index: t1x1}}
+
+do_catchsql_test 1.2 {
+  SELECT sum(s+length(b)) FROM t1 WHERE a IN (110,10,150) AND q IS NULL;
+} {1 {no such table: t1}}
+
+do_catchsql_test 1.3 {
+  REINDEX t1;
+} {1 {unable to identify the object to be reindexed}}
+
+#-------------------------------------------------------------------------
+reset_db
+do_test 2.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 20480 pagesize 4096 filename crash.txt.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 00 00 00 00 05   .....@  ........
+|     32: 00 00 00 00 00 00 00 00 00 00 00 05 00 00 00 04   ................
+|     48: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00   ................
+|     96: 00 00 00 00 0d 00 00 00 05 0e 55 00 0f 74 0f 3c   ..........U..t.<
+|    112: 0e f9 0e d1 0e 55 00 00 00 00 00 00 00 00 00 00   .....U..........
+|   3664: 00 00 00 00 00 7a 05 07 15 11 11 08 81 63 76 69   .....z.......cvi
+|   3680: 65 77 76 31 76 31 43 52 45 41 54 45 20 56 49 45   ewv1v1CREATE VIE
+|   3696: 57 20 76 31 28 78 2c 79 29 20 41 53 0a 53 45 4c   W v1(x,y) AS.SEL
+|   3712: 45 43 54 20 74 31 2e 62 2c 74 32 2e 62 20 46 52   ECT t1.b,t2.b FR
+|   3728: 4f 4d 20 74 31 2c 74 32 20 57 48 45 52 45 20 74   OM t1,t2 WHERE t
+|   3744: 31 2e 61 3d 74 32 2e 61 20 47 52 4f 55 50 20 42   1.a=t2.a GROUP B
+|   3760: 59 20 31 20 48 41 56 49 4e 47 20 74 32 2e 63 20   Y 1 HAVING t2.c 
+|   3776: 4e 4f 54 20 4e 55 4c 4c 0a 4c 49 4d 49 54 20 31   NOT NULL.LIMIT 1
+|   3792: 30 26 04 06 17 11 11 01 39 74 61 62 6c 65 74 32   0&......9tablet2
+|   3808: 74 32 05 43 52 45 41 54 45 20 54 41 42 4c 45 20   t2.CREATE TABLE 
+|   3824: 74 32 28 61 2c 62 2c 63 29 41 03 06 17 15 11 01   t2(a,b,c)A......
+|   3840: 6b 69 6e 64 65 78 74 31 78 31 74 31 04 43 52 45   kindext1x1t1.CRE
+|   3856: 41 54 45 20 49 4e 44 45 58 20 73 31 78 31 20 4f   ATE INDEX s1x1 O
+|   3872: 4e 20 74 31 28 64 29 20 57 48 45 52 45 20 65 65   N t1(d) WHERE ee
+|   3888: 20 49 53 20 4e 4f 54 20 4e 55 4c 4c 36 02 06 17    IS NOT NULL6...
+|   3904: 17 11 01 53 69 6e 64 65 78 74 31 61 62 63 74 31   ...Sindext1abct1
+|   3920: 03 43 52 45 41 54 45 20 49 4e 44 45 58 20 74 31   .CREATE INDEX t1
+|   3936: 61 62 63 20 4f 4e 20 74 31 28 61 2c 62 2c 63 2b   abc ON t1(a,b,c+
+|   3952: 64 2b 65 29 81 09 01 07 17 11 11 01 81 7d 74 61   d+e)..........ta
+|   3968: 62 6c 65 74 31 74 31 02 43 52 45 41 54 45 20 54   blet1t1.CREATE T
+|   3984: 41 42 4c 45 20 74 31 28 61 2c 62 2c 63 2c 64 2c   ABLE t1(a,b,c,d,
+|   4000: 65 2c 66 2c 67 2c 68 2c 6a 2c 6a 6a 2c 6a 6a 6a   e,f,g,h,j,jj,jjj
+|   4016: 2c 6b 2c 61 61 2c 62 62 2c 63 63 2c 64 64 2c 65   ,k,aa,bb,cc,dd,e
+|   4032: 65 20 44 45 46 41 55 4c 54 20 33 2e 31 34 2c 0a   e DEFAULT 3.14,.
+|   4048: 66 66 20 44 45 46 41 55 4c 54 28 27 68 69 63 63   ff DEFAULT('hicc
+|   4064: 75 70 27 29 2c 67 67 20 4e 4f 54 20 4e 55 4c 4c   up'),gg NOT NULL
+|   4080: 20 44 45 46 41 55 4c 54 28 66 61 6c 73 65 29 29    DEFAULT(false))
+| page 2 offset 4096
+|      0: 0d 00 00 00 0a 0e 7b 00 0f dc 0f b6 0f 8f 0f 68   ...............h
+|     16: 0f 41 0f 1a 0e f3 0e cb 0e a3 0e 7b 00 00 00 00   .A..............
+|   3696: 00 00 00 00 00 00 00 00 00 00 00 26 0a 14 01 01   ...........&....
+|   3712: 02 08 00 00 00 00 00 00 00 00 00 00 00 00 07 19   ................
+|   3728: 08 09 5a 00 b4 40 09 1e b8 51 eb 85 1f 68 69 63   ..Z..@...Q...hic
+|   3744: 63 75 70 26 09 14 01 01 02 08 00 00 00 00 00 00   cup&............
+|   3760: 00 00 00 00 00 00 07 19 08 08 50 00 a0 40 09 1e   ..........P..@..
+|   3776: b8 51 eb 85 1f 68 69 63 63 75 70 26 08 14 01 01   .Q...hiccup&....
+|   3792: 02 08 00 00 00 00 00 00 00 00 00 00 00 00 07 19   ................
+|   3808: 08 07 46 00 8c 40 09 1e b8 51 eb 85 1f 68 69 63   ..F..@...Q...hic
+|   3824: 63 75 70 25 07 14 01 01 01 08 00 00 00 00 00 00   cup%............
+|   3840: 00 00 00 00 00 00 07 b9 08 06 3c 78 40 09 1e b8   ..........<x@...
+|   3856: 51 eb 85 1f 68 69 63 63 75 70 25 06 14 01 00 01   Q...hiccup%.....
+|   3872: 08 00 00 00 00 00 00 00 00 00 00 00 00 07 19 08   ................
+|   3888: 05 32 64 40 09 1e b8 51 eb 85 1f 68 69 63 63 75   .2d@...Q...hiccu
+|   3904: 70 25 05 14 01 01 01 08 00 00 00 00 00 00 00 00   p%..............
+|   3920: 00 00 00 00 07 19 08 04 28 50 40 09 1e b8 51 eb   ........(P@...Q.
+|   3936: 85 1f 68 69 63 63 75 70 25 04 14 01 01 01 08 00   ..hiccup%.......
+|   3952: 00 00 00 00 00 00 00 00 00 00 00 07 19 08 03 1e   ................
+|   3968: 3c 40 09 1e b8 51 eb 85 1f 68 69 63 63 75 70 25   <@...Q...hiccup%
+|   3984: 03 14 01 01 01 08 00 00 00 00 00 00 00 00 00 00   ................
+|   4000: 00 00 07 19 08 02 14 28 40 09 1e b8 51 eb 85 1f   .......(@...Q...
+|   4016: 68 69 63 63 75 70 24 02 14 09 01 01 08 00 00 00   hiccup$.........
+|   4032: 00 00 00 00 00 00 00 00 00 07 19 08 0a 14 40 09   ..............@.
+|   4048: 1e b8 51 eb 85 1f 68 69 63 63 75 70 22 01 14 08   ..Q...hiccup....
+|   4064: 08 08 07 ff ff ff ff ff ff 00 00 00 00 00 00 07   ................
+|   4080: 19 08 40 09 1e b8 51 eb 85 1f 68 69 63 63 75 70   ..@...Q...hiccup
+| page 3 offset 8192
+|      0: 0a 00 00 00 0a 0f aa 00 0f fa 0f f2 0f e9 0f e0   ................
+|     16: 0f d7 0f ce 0f c5 0f bc 0e b3 0f aa 00 00 00 00   ................
+|   4000: 00 00 00 00 00 00 00 00 00 00 08 05 01 01 00 01   ................
+|   4016: 09 5a 0a 08 05 01 01 00 01 08 50 09 08 05 01 01   .Z........P.....
+|   4032: 00 01 07 46 08 08 05 01 01 00 01 06 3c 07 08 05   ...F........<...
+|   4048: 01 01 00 01 05 32 06 08 05 01 01 00 01 04 28 05   .....2........(.
+|   4064: 08 05 01 01 00 01 03 1e 04 08 05 01 01 00 01 02   ................
+|   4080: 14 03 07 05 09 01 00 01 0a 02 05 05 08 08 00 09   ................
+| page 4 offset 12288
+|      0: 0a 00 00 00 0a 0f cf 00 0f fc 0f f7 0f f2 0f ed   ................
+|     16: 0f e8 0f e3 0f de 0f d9 0f d4 0f cf 00 00 00 00   ................
+|   4032: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04   ................
+|   4048: 03 08 01 0a 04 03 08 01 09 04 03 08 01 08 04 03   ................
+|   4064: 08 01 07 04 03 08 01 06 04 03 08 01 05 04 03 08   ................
+|   4080: 01 04 04 03 08 01 13 04 03 08 01 02 03 03 08 09   ................
+| page 5 offset 16384
+|      0: 0d 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00   ................
+| end crash.txt.db
+}]} {}
+
+do_execsql_test 2.1 {
+  INSERT INTO t1(b) VALUES(X'a0fee3669f9fddefc5cba913e4225d4b6ce2b04f26b87fad3ee6f9b7d90a1ea62a169bf41e5d32707a6ca5c3d05e4bde05c9d89eaaa8c50e74333d2e9fcd7dfe95528a3a016aac1102d825c5cd70cf99d8a88e0ea7f798d4334386518b7ad359beb168b93aba059a2a3bd93112d65b44c12b9904ea786b204d80531cdf0504bf9b203dbe927061974caf7b9f30cbc3397b61f802e732012a6663d41c3607d6f1c0dbcfd489adac05ca500c0b04439d894cd93a840159225ef73b627e178b9f84b3ffe66cf22a963a8368813ff7961fc47f573211ccec95e0220dcbb3bf429f4a50ba54d7a53784ac51bfef346e6ac8ae0d0e7c3175946e62ba2b');
+}
+
+do_catchsql_test 2.2 {
+  SELECT b,c FROM t1 ORDER BY a;
+} {1 {database disk image is malformed}}
+
+#-------------------------------------------------------------------------
+reset_db
+do_execsql_test 3.0 {
+  CREATE TABLE t1(a, b, c, d INTEGER PRIMARY KEY);
+  CREATE TABLE t2(a, b, c, d INTEGER PRIMARY KEY);
+
+  INSERT INTO t1(a, b, c, d) VALUES (1, 2, 3, 100), (4, 5, 6, 101);
+  INSERT INTO t2(a, b, c, d) VALUES (1, 100, 3, 1000), (4, 101, 6, 1001);
+
+  CREATE INDEX t1a ON t1(a);
+  CREATE INDEX t2a ON t2(a, b, c);
+
+  PRAGMA writable_schema = 1;
+  UPDATE sqlite_master SET sql = 'CREATE INDEX t2a ON t2(a)' WHERE name='t2a';
+}
+
+db close
+sqlite3 db test.db
+
+do_catchsql_test 3.1 {
+  INSERT INTO t1 SELECT * FROM t2;
+} {1 {database disk image is malformed}}
+
+#-------------------------------------------------------------------------
+reset_db
+do_test 4.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 4096 pagesize 512 filename crash-6b48ba69806134.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 02 00 01 01 00 40 20 20 00 ff ff ff ff 00 00 07   .....@  ........
+|     32: 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 04   ................
+|     48: 00 00 00 00 00 00 00 05 00 eb 00 01 00 00 00 00   ................
+|     80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c   ................
+|     96: 00 2e 2c 50 0d 00 00 00 06 01 06 00 01 da 01 b0   ..,P............
+|    112: 05 56 01 86 01 2a 01 06 00 00 00 00 00 00 00 00   .V...*..........
+|    128: 00 ff 00 00 ff ff ff e1 00 00 00 00 00 00 00 00   ................
+|    144: 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00   ................
+|    160: 00 00 00 00 00 00 00 00 f2 00 00 00 00 00 00 00   ................
+|    176: 00 00 f9 ff ff ff ff ff ff ff 00 00 00 00 00 fb   ................
+|    208: 00 00 00 00 00 00 00 00 1e 00 00 00 fe 00 00 00   ................
+|    224: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ca 00   ................
+|    256: 00 00 00 00 ef ff 22 07 06 17 11 11 01 31 74 61   .............1ta
+|    272: 62 6c 65 74 38 38 74 04 43 52 45 41 54 45 20 54   blet88t.CREATE T
+|    288: 41 42 4c 45 20 74 34 28 87 29 2a 06 06 17 13 11   ABLE t4(.)*.....
+|    304: 01 3f 69 4f 64 65 78 74 33 78 74 33 05 43 52 45   .?iOdext3xt3.CRE
+|    320: 41 54 45 20 49 6e 44 45 58 20 74 33 78 20 4f 4e   ATE InDEX t3x ON
+|    336: 20 74 33 28 78 29 2e 04 06 17 15 11 01 45 69 6e    t3(x).......Ein
+|    352: 64 65 2e 74 32 63 64 74 3d 05 43 52 45 41 54 45   de.t2cdt=.CREATE
+|    368: 20 49 4e 44 45 58 20 74 32 63 64 20 4f 4e 20 74    INDEX t2cd ON t
+|    384: 32 28 0a 0c 44 29 28 05 06 17 11 11 01 3d 74 61   2(..D)(......=ta
+|    400: 62 6c 65 d4 33 74 33 04 43 52 45 41 54 45 20 54   ble.3t3.CREATE T
+|    416: 41 42 4c 45 20 74 33 28 63 2c 78 2c 65 2c 66 29   ABLE t3(c,x,e,f)
+|    432: 28 02 06 17 11 11 01 3d 74 61 62 6c 65 74 32 74   (......=tablet2t
+|    448: 32 03 43 52 45 41 54 45 20 54 41 42 4c 45 20 74   2.CREATE TABLE t
+|    464: 32 28 63 2c 64 2c 65 2c 66 29 24 01 06 17 11 11   2(c,d,e,f)$.....
+|    480: 01 35 74 60 62 6c 65 74 31 74 31 02 43 52 45 41   .5t`blet1t1.CREA
+|    496: 54 45 20 54 41 42 4c 45 20 74 30 28 61 2c 62 29   TE TABLE t0(a,b)
+| page 2 offset 512
+|      0: 0d 00 ff 11 04 01 cf 00 01 fa 01 f3 01 de 01 cf   ................
+|     32: 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 13   ................
+|     48: 00 00 00 00 00 00 00 00 00 00 00 01 00 20 00 00   ............. ..
+|     64: 00 00 00 00 00 00 f8 ff ff ff 00 00 00 00 00 00   ................
+|    160: 01 64 00 00 00 00 00 80 ff ff ff 00 00 00 00 00   .d..............
+|    176: 00 00 00 00 00 00 00 00 1f 00 00 00 00 00 00 03   ................
+|    192: 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00   ..@.............
+|    288: 00 00 00 00 00 00 ff ff ff e9 00 00 00 00 00 00   ................
+|    336: 01 00 00 ff ff 00 00 00 00 00 00 00 00 00 00 00   ................
+|    368: 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ...............
+|    384: 00 de ff 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
+|    464: 00 00 00 00 00 13 76 65 6e 65 69 67 68 74 13 03   ......veneight..
+|    480: 03 40 07 07 14 00 54 45 20 49 4e 44 45 58 20 74   .@....TE INDEX t
+|    496: 32 63 64 20 4f 4e 20 74 32 28 0a 0c 44 09 01 02   2cd ON t2(..D...
+| page 3 offset 1024
+|      0: 0d 00 00 00 48 01 54 00 01 f7 01 ec 01 c5 01 aa   ....H.T.........
+|     16: 30 34 28 87 29 2a 06 06 17 13 11 01 3f 69 4f 64   04(.)*......?iOd
+|     32: 65 79 74 33 78 74 33 6d 6d 6d 6d 6d 6d 7d 6d 6d   eyt3xt3mmmmmm.mm
+|     48: 6d 41 6d 6d 6d 6d 6d 6d 6d 6d 6d 6d 6d 6d 6d 6d   mAmmmmmmmmmmmmmm
+|     64: 6d 6d 6d 6d 6d 6d 6d 6d 6d 6d 6d 66 6d 6d 6d 6d   mmmmmmmmmmmfmmmm
+|     80: 6d 4e 6d 6d 6d 6d 6d 6d 6d 6d 6d 6d 6d 6d 6d 6d   mNmmmmmmmmmmmmmm
+|     96: 6d 6d 6d 6d 6d 6d 6d 6d 6d 6d 6d 6d 6d 6d 6d 6d   mmmmmmmmmmmmmmmm
+|    112: 6d 6d 6d 6d 6d 6d 6d 6d 6d 6d 6d 6d 6d 6d 6d 6d   mmmmmmmmmmmmmmmm
+|    128: 6d 6d 6d 6d 6d 00 00 00 00 00 00 00 00 00 00 00   mmmmm...........
+|    160: 80 00 00 00 00 00 00 03 00 00 00 ff e4 00 00 00   ................
+|    208: 00 00 00 00 00 00 00 00 00 00 00 00 00 c5 00 00   ................
+|    240: 14 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00   ................
+|    256: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0f ec   ................
+|    304: 00 00 00 00 19 08 05 17 17 17 17 65 69 67 68 74   ...........eight
+|    320: 65 69 67 68 74 73 65 00 00 00 00 00 00 00 00 00   eightse.........
+|    336: 00 00 00 00 19 08 05 17 17 17 17 65 69 67 68 74   ...........eight
+|    352: 65 69 67 68 74 73 65 01 65 6e 00 00 00 10 25 07   eightse.en....%.
+|    368: 07 6e 25 07 07 07 40 18 00 00 00 00 00 00 40 18   .n%...@.......@.
+|    384: 00 00 00 00 00 00 40 14 00 00 00 00 00 00 40 14   ......@.......@.
+|    400: 00 00 00 00 00 00 09 06 05 01 01 01 01 04 04 03   ................
+|    416: 03 07 05 05 01 01 09 09 02 02 19 04 05 17 17 17   ................
+|    432: 17 10 65 76 65 6e 65 69 67 68 74 65 69 67 68 74   ..eveneighteight
+|    448: 73 65 76 65 6e 25 03 05 07 07 07 07 40 14 00 00   seven%......@...
+|    464: 00 00 00 00 40 18 00 00 00 00 00 00 40 18 00 00   ....@.......@...
+|    480: 00 00 00 00 40 14 00 00 00 00 e8 f6 09 02 00 00   ....@...........
+|    496: 00 00 00 00 00 00 00 00 00 00 64 00 00 00 00 02   ..........d.....
+| page 4 offset 1536
+|      0: 0d 00 00 00 00 02 00 00 00 00 00 00 00 00 00 fa   ................
+|     16: 1f a1 07 00 00 00 00 00 01 00 00 00 00 00 00 00   ................
+|     32: 00 00 00 00 00 00 00 00 00 00 00 00 00 73 69 6d   .............sim
+|     48: 70 6c 65 00 00 00 00 00 00 00 00 00 00 00 00 00   ple.............
+|     80: 00 00 00 00 00 10 00 00 00 00 00 00 01 00 00 00   ................
+|     96: 00 00 00 00 00 00 00 00 00 00 00 00 00 fe ff ff   ................
+|    112: ff 00 00 00 00 00 00 00 00 00 00 00 4a 00 00 00   ............J...
+|    144: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00   ................
+|    176: e5 ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00   ................
+|    208: 00 00 00 00 00 00 00 00 00 00 36 36 00 00 00 00   ..........66....
+|    240: 00 00 00 6c 00 00 00 00 00 00 00 00 00 00 00 00   ...l............
+|    256: 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
+|    320: 00 00 00 00 00 00 00 00 01 00 00 02 00 80 00 00   ................
+|    336: 00 00 00 00 00 19 08 05 17 17 17 17 65 69 67 68   ............eigh
+|    352: 74 65 69 67 68 74 73 65 76 65 6e 73 65 76 65 6e   teightsevenseven
+|    368: 25 07 05 07 07 07 07 40 18 00 00 00 00 00 00 40   %......@.......@
+|    384: 18 00 20 00 00 00 40 00 14 00 00 00 00 00 00 40   .. ...@........@
+|    400: 14 00 00 00 00 00 1c 09 06 05 01 01 01 01 04 04   ................
+|    416: 03 03 07 05 05 01 01 00 00 00 00 00 00 00 00 00   ................
+|    448: 74 73 65 76 65 6e 00 80 ff ff 00 00 00 00 00 aa   tseven..........
+|    464: 00 9e 00 00 00 00 00 00 00 00 00 00 00 70 6f 72   .............por
+|    480: 74 65 72 00 00 00 00 00 00 00 00 00 00 00 00 00   ter.............
+|    496: 00 00 00 00 00 00 29 00 00 00 00 00 00 00 00 00   ......).........
+| page 5 offset 2048
+|      0: 0a 00 00 00 08 01 96 00 01 fa 01 c5 01 f2 01 bc   ................
+|     16: 01 dc 01 a6 01 96 01 cc 00 00 00 00 00 00 00 00   ................
+|    112: 00 00 00 09 00 00 00 00 01 00 00 00 00 00 00 00   ................
+|    160: 74 72 69 67 62 ff ff ff ff fc 00 00 00 00 00 00   trigb...........
+|    240: 00 00 00 00 00 00 00 00 00 00 ff 00 00 00 00 00   ................
+|    256: e5 ff ff ff 00 00 54 00 00 00 00 00 00 00 00 00   ......T.........
+|    304: 00 00 00 00 00 00 09 00 00 00 00 00 00 00 00 00   ................
+|    400: 00 00 00 00 00 09 00 00 00 00 01 00 00 00 00 00   ................
+|    448: 00 00 74 72 69 67 62 ff ff ff ff fc 00 00 07 05   ..trigb.........
+|    464: 05 01 01 09 09 02 02 19 04 05 17 17 17 17 10 65   ...............e
+|    480: 76 65 6e 65 69 67 68 74 65 40 18 00 00 00 00 01   veneighte@......
+|    496: 02 03 07 04 01 01 01 03 04 02 05 04 09 01 ff fd   ................
+| end crash-6b48ba69806134.db
+}]} {}
+
+do_catchsql_test 4.1 {
+  INSERT INTO t3 SELECT * FROM t2;
+} {1 {database disk image is malformed}}
+
+
+#-------------------------------------------------------------------------
+reset_db
+do_test 5.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 192512 pagesize 4096 filename crash-9ae5502296c949.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 00 00 00 00 2f   .....@  ......./
+|     32: 00 00 00 1b 00 00 00 13 00 00 00 03 00 00 00 04   ................
+|     48: 00 00 00 00 00 00 00 06 00 00 00 01 00 00 00 00   ................
+|     64: 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00   ................
+|     96: 00 00 00 00 0d 00 00 00 04 0e e2 00 0f 96 0f 44   ...............D
+|    112: 0f 10 0e e2 00 00 00 00 00 00 00 00 00 00 00 00   ................
+|   3808: 00 00 2c 04 06 17 15 11 01 41 69 6e 64 65 78 74   ..,......Aindext
+|   3824: 31 78 32 74 31 06 43 52 45 41 54 45 20 49 4e 44   1x2t1.CREATE IND
+|   3840: 45 58 20 74 31 78 32 20 4f 4e 20 74 31 28 62 29   EX t1x2 ON t1(b)
+|   3856: 32 03 06 17 15 11 01 4d 69 6e 64 65 78 74 31 78   2......Mindext1x
+|   3872: 31 74 31 05 43 52 45 41 54 45 20 49 4e 44 45 58   1t1.CREATE INDEX
+|   3888: 20 74 31 78 31 20 4f 4e 20 74 31 28 67 2b 68 2c    t1x1 ON t1(g+h,
+|   3904: 6a 2c 6b 29 50 02 06 17 2b 2b 01 59 74 61 62 6c   j,k)P...++.Ytabl
+|   3920: 65 73 71 6c 69 74 65 5f 73 65 71 75 65 6e 63 65   esqlite_sequence
+|   3936: 73 71 6c 69 74 65 5f 73 65 71 75 65 6e 63 65 04   sqlite_sequence.
+|   3952: 43 52 45 41 54 45 20 54 41 42 4c 45 20 73 71 6c   CREATE TABLE sql
+|   3968: 69 74 65 5f 73 65 71 75 65 6e 63 65 28 6e 61 6d   ite_sequence(nam
+|   3984: 65 2c 73 65 71 29 68 01 07 17 11 11 01 81 3b 74   e,seq)h.......;t
+|   4000: 61 62 6c 65 74 31 74 31 03 43 52 45 41 54 45 20   ablet1t1.CREATE 
+|   4016: 54 41 42 4c 45 20 74 31 28 61 20 49 4e 54 45 47   TABLE t1(a INTEG
+|   4032: 45 52 20 50 52 49 4d 41 52 59 20 4b 45 59 20 41   ER PRIMARY KEY A
+|   4048: 55 54 4f 49 4e 43 52 45 4d 45 4e 54 2c 0a 62 2c   UTOINCREMENT,.b,
+|   4064: 63 2c 64 2c 65 2c 66 2c 67 2c 68 2c 6a 2c 6b 2c   c,d,e,f,g,h,j,k,
+|   4080: 6c 2c 6d 2c 6e 2c 6f 2c 70 2c 71 2c 72 2c 73 29   l,m,n,o,p,q,r,s)
+| page 2 offset 4096
+|      0: 01 00 00 00 00 01 00 00 00 00 01 00 00 00 00 01   ................
+|     16: 00 00 00 00 02 10 00 00 00 05 00 00 00 03 02 00   ................
+|     32: 00 00 00 05 00 00 00 03 02 00 00 00 00 05 00 00   ................
+|     48: 00 03 02 00 00 00 00 05 00 00 00 03 02 00 00 00   ................
+|     64: 00 05 00 00 00 03 02 00 00 00 00 05 00 00 00 03   ................
+|     80: 02 00 00 00 00 05 00 00 00 03 02 00 00 00 00 05   ................
+|     96: 00 00 00 03 02 00 00 00 00 05 00 00 00 03 05 00   ................
+|    112: 00 00 03 03 00 00 00 23 02 00 00 00 00 03 00 00   .......#........
+|    128: 00 23 02 00 00 00 00 03 00 00 00 23 02 00 00 00   .#.........#....
+|    144: 00 03 00 00 00 23 02 00 00 00 00 03 00 00 00 23   .....#.........#
+|    160: 05 00 00 00 06 05 00 00 00 06 02 00 00 00 00 03   ................
+|    176: 00 00 00 06 02 00 00 00 00 03 00 00 00 24 02 00   .............$..
+|    192: 00 00 00 03 00 00 00 24 02 00 00 00 00 03 00 00   .......$........
+|    208: 00 24 02 00 00 00 00 02 00 00 00 00 03 00 00 00   .$..............
+|    224: 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   $...............
+| page 3 offset 8192
+|      0: 05 00 00 00 09 0f d0 00 00 00 00 19 0f fb 0f f6   ................
+|     16: 0f f1 0f ec 0f e7 0f e2 0f dc 0f d6 0f d0 0f a0   ................
+|     32: 0f a0 0f a0 0f a0 0f a0 0f a0 0f a0 0f a0 0f a0   ................
+|   1072: 00 97 4c 0a 14 00 ae 7c 00 00 00 00 00 00 00 00   ..L....|........
+|   1088: 00 00 00 00 00 00 00 09 00 00 00 00 00 00 00 00   ................
+|   4000: 0f ac 00 06 00 00 00 00 00 30 00 00 00 00 00 00   .........0......
+|   4048: 00 00 00 16 81 2a 00 00 00 14 81 16 00 00 00 12   .....*..........
+|   4064: 81 02 00 00 00 10 6e 00 00 00 0e 5a 00 00 00 0c   ......n....Z....
+|   4080: 46 00 00 00 0a 32 00 00 00 08 1e 00 00 00 18 0a   F....2..........
+| page 4 offset 12288
+|      0: 0d 00 00 00 01 0f f7 00 0f f7 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 00 00 00 07 01 03 11 02 74 31 00 be   ............t1..
+| page 5 offset 16384
+|      0: 0a 0f 7c 00 0a 0f 74 00 0f f9 0f eb 0f dd 0f cf   ..|...t.........
+|     16: 0f c1 0f b3 0f a4 0f 94 0f 84 0f 74 0f 74 0f 74   ...........t.t.t
+|     32: 0f 74 0f 74 0f 74 0f 74 0f 74 0f 74 0f 74 00 00   .t.t.t.t.t.t.t..
+|   3952: 00 00 00 00 07 05 00 00 00 02 00 be 0f 8c 00 08   ................
+|   3968: 00 00 00 00 07 05 00 00 00 02 00 aa 0f 9c 00 08   ................
+|   3984: 00 00 00 00 07 05 00 00 00 02 00 96 0f ac 00 08   ................
+|   4000: 00 00 00 00 07 05 00 00 00 02 00 82 0f ba 00 07   ................
+|   4016: 00 00 00 06 05 00 00 00 01 6e 0f c8 00 07 00 00   .........n......
+|   4032: 00 06 05 00 00 00 01 5a 0f d6 00 07 00 00 00 06   .......Z........
+|   4048: 05 00 00 00 01 46 0f e4 00 07 00 00 00 06 05 00   .....F..........
+|   4064: 00 00 01 32 0f f2 00 07 00 00 00 06 05 00 00 00   ...2............
+|   4080: 01 1e 00 00 00 07 00 00 00 06 05 00 00 00 01 0a   ................
+| page 6 offset 20480
+|      0: 02 00 00 00 01 0e 0d 00 00 00 00 24 0e 0d 0c 1a   ...........$....
+|     16: 06 55 04 66 02 77 00 88 00 00 00 00 00 00 00 00   .U.f.w..........
+|    128: 00 00 00 00 00 00 00 00 97 3d 04 ae 7c 01 00 00   .........=..|...
+|    624: 00 00 00 00 00 00 21 97 3d 04 ae 7c 01 00 00 00   ......!.=..|....
+|   1120: 00 00 00 00 00 20 97 3d 04 ae 7c 01 00 00 00 00   ..... .=..|.....
+|   1616: 00 00 00 00 1f 97 3d 04 ae 7c 01 00 00 00 00 00   ......=..|......
+|   2112: 00 00 00 1e 97 3d 04 ae 7c 01 00 00 00 00 00 00   .....=..|.......
+|   2608: 00 00 1d 97 3d 04 ae 7c 01 00 00 00 00 00 00 00   ....=..|........
+|   3088: 00 00 00 00 00 00 00 00 00 00 00 00 01 f3 00 00   ................
+|   3600: 23 97 3d 04 ae 7c 01 00 00 00 00 00 00 00 00 00   #.=..|..........
+|   4080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 26   ...............&
+| page 8 offset 28672
+|      0: 0d 00 00 00 01 04 30 00 04 30 00 00 00 00 00 00   ......0..0......
+|   1072: 97 4d 1e 14 00 ae 7c 00 00 00 00 00 00 00 00 00   .M....|.........
+|   1088: 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03   ................
+| page 10 offset 36864
+|    256: 0d 00 00 00 01 04 30 00 04 30 00 00 00 00 00 00   ......0..0......
+|   1072: 97 4d 32 14 00 ae 7c 00 00 00 00 00 00 00 00 00   .M2...|.........
+|   1088: 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05   ................
+| page 12 offset 45056
+|      0: 0d 00 00 00 01 04 30 00 04 30 00 00 00 00 00 00   ......0..0......
+|   1072: 97 4d 46 14 00 ae 7c 00 00 00 00 00 00 00 00 00   .MF...|.........
+|   1088: 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07   ................
+| page 14 offset 53248
+|      0: 0d 00 00 00 01 04 30 00 04 30 00 00 00 00 00 00   ......0..0......
+|   1072: 97 4d 5a 14 00 ae 7c 00 00 00 00 00 00 00 00 00   .MZ...|.........
+|   1088: 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 09   ................
+| page 16 offset 61440
+|      0: 0d 00 00 00 01 04 30 00 04 30 00 00 00 00 00 00   ......0..0......
+|   1072: 97 4d 6e 14 00 ae 7c 00 00 00 00 00 00 00 00 00   .Mn...|.........
+|   1088: 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0b   ................
+| page 18 offset 69632
+|      0: 0d 00 00 00 01 04 2f 00 04 2f 00 00 00 00 00 00   ....../../......
+|   1056: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 97   ................
+|   1072: 4d 81 02 14 00 ae 7c 00 00 00 00 00 00 00 00 00   M.....|.........
+|   1088: 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0d   ................
+| page 20 offset 77824
+|      0: 0d 00 00 00 01 04 2f 00 04 2f 00 00 00 00 00 00   ....../../......
+|   1056: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 97   ................
+|   1072: 4d 81 16 14 00 ae 7c 00 00 00 00 00 00 00 00 00   M.....|.........
+|   1088: 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0f   ................
+| page 22 offset 86016
+|      0: 0d 00 00 00 01 04 2f 00 04 2f 00 00 00 00 00 00   ....../../......
+|   1056: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 97   ................
+|   1072: 4d 81 2a 14 00 ae 7c 00 00 00 00 00 00 00 00 00   M.*...|.........
+|   1088: 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11   ................
+| page 24 offset 94208
+|      0: 0d 00 00 00 01 04 31 00 04 31 00 00 00 00 00 00   ......1..1......
+|   1072: 00 97 4c 0a 14 00 ae 7c 00 00 00 00 00 00 00 00   ..L....|........
+|   1088: 00 00 00 00 00 00 00 09 00 00 00 00 00 00 00 00   ................
+| page 25 offset 98304
+|      0: 0d 00 00 00 01 04 2f 00 04 2f 00 00 00 00 00 00   ....../../......
+|   1056: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 97   ................
+|   1072: 4d 81 3e 14 00 ae 7c 00 00 00 00 00 00 00 00 00   M.>...|.........
+|   1088: 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 13   ................
+| page 26 offset 102400
+|   2512: 00 00 00 00 00 00 00 0a 00 00 00 00 00 00 00 00   ................
+| page 27 offset 106496
+|      0: 00 00 00 00 00 00 00 12 00 00 00 07 00 00 00 1d   ................
+|     16: 00 00 00 09 00 00 00 1f 00 00 00 0b 00 00 00 21   ...............!
+|     32: 00 00 00 0d 00 00 00 25 00 00 00 0f 00 00 00 19   .......%........
+|     48: 00 00 00 11 00 00 00 29 00 00 00 13 00 00 00 2b   .......).......+
+|     64: 00 00 00 15 00 00 00 2d 00 00 00 2e 00 00 00 17   .......-........
+| page 28 offset 110592
+|   2512: 00 00 00 00 00 00 00 1e 00 00 00 00 00 00 00 00   ................
+| page 30 offset 118784
+|   2512: 00 00 00 00 00 00 00 32 00 00 00 00 00 00 00 00   .......2........
+| page 32 offset 126976
+|   2512: 00 00 00 00 00 00 00 46 00 00 00 00 00 00 00 00   .......F........
+| page 34 offset 135168
+|   2512: 00 00 00 00 00 00 00 5a 00 00 00 00 00 00 00 00   .......Z........
+| page 35 offset 139264
+|      0: 0a 08 44 00 05 02 77 00 0e 11 0a 33 06 55 02 77   ..D...w....3.U.w
+|     16: 04 66 00 88 00 88 00 88 00 00 00 00 00 00 00 00   .f..............
+|    128: 00 00 00 00 00 00 00 00 04 66 01 ef 00 00 00 00   .........f......
+|    624: 00 00 00 00 00 00 00 97 3d 04 ae 7c 01 00 00 00   ........=..|....
+|   1120: 00 00 00 00 00 20 97 3d 04 ae 7c 01 00 00 00 00   ..... .=..|.....
+|   1616: 00 00 00 00 22 97 3d 04 ae 7c 01 00 00 00 00 00   ......=..|......
+|   2112: 00 00 00 1e 0c 22 01 ef 00 00 00 00 00 00 00 00   ................
+|   2608: 00 00 00 97 3d 04 ae 7c 01 00 00 00 00 00 00 00   ....=..|........
+|   3104: 00 1c 00 00 01 ef 00 00 00 00 00 00 00 00 00 00   ................
+|   3600: 00 97 3d 04 ae 7c 01 00 00 00 00 00 00 00 00 00   ..=..|..........
+|   4080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a   ................
+| page 36 offset 143360
+|      0: 0a 08 44 00 04 02 77 00 06 55 02 77 04 66 0e 11   ..D...w..U.w.f..
+|     16: 00 88 00 88 00 88 0e 11 00 00 00 00 00 00 00 00   ................
+|    128: 00 00 00 00 00 00 00 00 04 76 01 ef 00 00 00 00   .........v......
+|    624: 00 00 00 00 00 00 00 97 3e 04 ae 7c 02 00 00 00   ........>..|....
+|   1120: 00 00 00 00 00 2a 97 3e 04 ae 7c 02 00 00 00 00   .....*.>..|.....
+|   1616: 00 00 00 00 2c 97 3e 04 ae 7c 02 00 00 00 00 00   ....,.>..|......
+|   2112: 00 00 00 28 00 00 05 cd 00 00 00 00 00 00 00 00   ...(............
+|   3600: 00 97 3e 04 ae 7c 02 00 00 00 00 00 00 00 00 00   ..>..|..........
+|   4080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2f   .............../
+| page 38 offset 151552
+|   2512: 00 00 00 00 00 00 00 6e 00 00 00 00 00 00 00 00   .......n........
+| page 40 offset 159744
+|   2512: 00 00 00 00 00 00 00 00 82 00 00 00 00 00 00 00   ................
+| page 42 offset 167936
+|   2512: 00 00 00 00 00 00 00 00 96 00 00 00 00 00 00 00   ................
+| page 44 offset 176128
+|   2512: 00 00 00 00 00 00 00 00 aa 00 00 00 00 00 00 00   ................
+| page 47 offset 188416
+|   2512: 00 00 00 00 00 00 00 00 be 00 00 00 00 00 00 00   ................
+| end crash-9ae5502296c949.db
+}]} {}
+
+do_catchsql_test 5.1 {
+  INSERT INTO t1(b) VALUES(zeroblob(40000));
+} {1 {database disk image is malformed}}
+
+do_catchsql_test 5.2 {
+  DROP INDEX t1x2;
+} {0 {}}
+
+do_catchsql_test 5.3 {
+  INSERT INTO t1(b) VALUES(zeroblob(40000));
+} {1 {database disk image is malformed}}
+
+#-------------------------------------------------------------------------
+reset_db
+do_test 6.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 20480 pagesize 4096 filename crash-d260f001fa015c.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 00 00 00 00 05   .....@  ........
+|     32: 00 00 00 00 00 ff ff f0 00 00 00 02 00 00 00 04   ................
+|     48: 00 00 00 00 00 00 00 64 00 00 00 01 00 00 00 00   .......d........
+|     96: 00 00 00 00 0d 0f f8 00 04 0e ce 00 0f 4c 0f d3   .............L..
+|    112: 0e fa 0e ce 00 00 00 00 00 00 00 00 00 00 00 00   ................
+|   3776: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2a 04   ..............*.
+|   3792: 06 17 13 11 01 3f 69 6e 64 65 78 74 31 62 74 31   .....?indext1bt1
+|   3808: 05 43 52 45 41 54 45 20 49 4e 44 45 58 20 74 31   .CREATE INDEX t1
+|   3824: 62 20 4f 4e 20 74 31 28 62 29 50 03 06 17 2b 2b   b ON t1(b)P...++
+|   3840: 01 59 74 61 62 6c 65 73 71 6c 69 74 65 5f 73 65   .Ytablesqlite_se
+|   3856: 71 75 65 6e 63 65 73 71 6c 69 74 65 5f 73 65 71   quencesqlite_seq
+|   3872: 75 65 6e 63 65 04 43 52 45 41 54 45 20 54 41 42   uence.CREATE TAB
+|   3888: 4c 45 20 73 71 6c 69 74 65 5f 73 65 71 75 65 6e   LE sqlite_sequen
+|   3904: 63 65 28 6e 61 6d 65 2c 73 65 71 29 81 04 01 07   ce(name,seq)....
+|   3920: 17 11 11 01 81 73 74 61 c2 6c 65 74 31 74 31 02   .....sta.let1t1.
+|   3936: 43 52 45 41 54 45 20 54 41 42 4c 45 20 74 31 28   CREATE TABLE t1(
+|   3952: 61 20 52 45 41 4c 20 4e 4f 54 20 4e 55 4c 4c 20   a REAL NOT NULL 
+|   3968: 44 45 46 41 55 4c 54 28 32 35 2b 33 32 29 2c 62   DEFAULT(25+32),b
+|   3984: 20 46 4c 4f 41 54 2c 63 20 44 4f 55 42 4c 45 20    FLOAT,c DOUBLE 
+|   4000: 55 4e 49 51 55 45 2c 0a 64 20 43 4c 4f 42 2c 65   UNIQUE,.d CLOB,e
+|   4016: 20 49 4e 54 45 47 45 52 20 50 52 49 4d 41 52 59    INTEGER PRIMARY
+|   4032: 20 4b 45 59 20 41 55 54 4f 49 4e 43 52 45 4d 45    KEY AUTOINCREME
+|   4048: 4e 54 29 23 02 06 17 37 11 01 00 69 6e 64 65 78   NT)#...7...index
+|   4064: 73 71 6c 69 74 65 5f 61 75 74 6f 69 6e 64 65 78   sqlite_autoindex
+|   4080: 5f 74 31 5f 31 74 31 05 00 00 00 08 00 00 00 00   _t1_1t1.........
+| page 2 offset 4096
+|      0: 0d 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00   ................
+| page 3 offset 8192
+|      0: 0a 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00   ................
+| page 4 offset 12288
+|      0: 0d 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00   ................
+| page 5 offset 16384
+|      0: 0a 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00   ................
+| end crash-d260f001fa015c.db
+}]} {}
+
+do_catchsql_test 6.1 {
+  BEGIN;
+    INSERT INTO t1(b) VALUES(1);
+    INSERT INTO t1(b) VALUES(2);
+  COMMIT;
+} {1 {malformed database schema (t1b) - invalid rootpage}}
+
+#-------------------------------------------------------------------------
+reset_db
+do_test 7.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 20480 pagesize 4096 filename crash-8391315d75edff.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 00 00 00 00 05   .....@  ........
+|     32: 00 00 00 00 00 00 00 00 00 00 00 05 00 00 00 04   ................
+|     48: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00   ................
+|     96: 00 00 00 00 0d 00 00 00 05 0e 55 00 0f 74 0f 3c   ..........U..t.<
+|    112: 0e f9 0e d1 0e 55 00 00 00 00 00 00 00 00 00 00   .....U..........
+|   3664: 00 00 00 00 00 7a 05 07 15 11 11 08 81 63 76 69   .....z.......cvi
+|   3680: 65 77 76 31 76 31 43 52 45 41 54 45 20 56 49 45   ewv1v1CREATE VIE
+|   3696: 57 20 76 31 28 78 2c 69 29 20 41 53 0a 53 45 4c   W v1(x,i) AS.SEL
+|   3712: 45 43 54 20 74 31 2e 62 2c 74 32 2e 62 20 46 52   ECT t1.b,t2.b FR
+|   3728: 4f 4d 20 74 31 2c 74 32 20 57 48 45 52 45 20 74   OM t1,t2 WHERE t
+|   3744: 31 2e 61 3d 74 32 2e 61 20 47 52 4f 55 50 20 42   1.a=t2.a GROUP B
+|   3760: 59 20 31 20 48 41 56 49 4e 47 20 74 32 2e 63 20   Y 1 HAVING t2.c 
+|   3776: 4e 4f 54 20 4e 55 4c 4c 0a 4c 49 4d 49 54 20 31   NOT NULL.LIMIT 1
+|   3792: 30 26 04 06 17 11 11 01 39 74 61 62 6c 65 74 32   0&......9tablet2
+|   3808: 74 32 05 43 52 45 41 54 45 20 54 41 42 4c 45 20   t2.CREATE TABLE 
+|   3824: 74 32 28 61 2c 62 2c 63 29 41 03 06 17 15 11 01   t2(a,b,c)A......
+|   3840: 6b 69 6e 64 65 78 74 31 78 31 74 31 03 43 52 45   kindext1x1t1.CRE
+|   3856: 41 54 45 20 49 4e 44 45 58 20 74 31 78 31 20 4f   ATE INDEX t1x1 O
+|   3872: 4e 20 74 31 28 64 29 20 57 48 45 52 45 20 65 65   N t1(d) WHERE ee
+|   3888: 20 49 53 20 4e 4f 54 20 4e 55 4c 4c 36 02 06 17    IS NOT NULL6...
+|   3904: 17 11 01 53 69 6e 64 65 78 74 31 61 62 63 74 31   ...Sindext1abct1
+|   3920: 03 43 52 45 41 54 45 20 49 4e 44 45 58 20 74 31   .CREATE INDEX t1
+|   3936: 61 62 63 20 4f 4e 20 74 31 28 61 2c 62 2c 63 2b   abc ON t1(a,b,c+
+|   3952: 64 2b 65 29 81 09 01 07 17 11 11 01 81 7d 74 61   d+e)..........ta
+|   3968: 62 6c 65 74 31 74 31 02 43 52 45 41 54 45 20 54   blet1t1.CREATE T
+|   3984: 41 42 4c 45 20 74 31 28 61 2c 62 2c 63 2c 64 2c   ABLE t1(a,b,c,d,
+|   4000: 65 2c 66 2c 67 2c 68 2c 6a 2c 6a 6a 2c 6a 6a 6a   e,f,g,h,j,jj,jjj
+|   4016: 2c 6b 2c 61 61 2c 62 69 8c 63 63 2c 64 64 2c 65   ,k,aa,bi.cc,dd,e
+|   4032: 65 20 44 45 46 41 55 4c 54 20 33 2e 31 34 2c 0a   e DEFAULT 3.14,.
+|   4048: 66 66 20 44 45 46 41 55 4c 54 28 27 68 69 63 63   ff DEFAULT('hicc
+|   4064: 75 70 27 29 2c 67 67 20 4e 4f 54 20 4e 55 4c 4c   up'),gg NOT NULL
+|   4080: 20 44 45 46 41 55 4c 54 28 66 61 6c 73 65 29 29    DEFAULT(false))
+| page 2 offset 4096
+|      0: 0d 00 00 00 0a 0e 7b 00 0f dc 0f b6 0f 8f 0f 68   ...............h
+|     16: 0f 41 0f 1a 0e f3 0e cb 0e a3 0e 22 00 00 00 00   .A..............
+|   3696: 00 00 00 00 00 00 00 00 00 00 00 26 0a 14 01 01   ...........&....
+|   3712: 02 08 00 00 00 00 00 00 00 00 00 00 00 00 07 19   ................
+|   3728: 08 09 5a 00 b4 40 09 1e b8 51 eb 95 1f 68 69 63   ..Z..@...Q...hic
+|   3744: 63 75 70 26 09 14 01 01 02 08 00 00 00 00 00 00   cup&............
+|   3760: 00 00 00 00 00 00 07 19 08 08 50 00 a0 40 09 1e   ..........P..@..
+|   3776: b8 51 eb 85 1f 68 69 63 63 74 70 26 08 14 01 01   .Q...hicctp&....
+|   3792: 03 08 00 00 00 00 00 00 00 00 00 00 00 00 07 19   ................
+|   3808: 08 07 46 00 8c 40 09 1e b8 51 eb 85 1f 68 69 63   ..F..@...Q...hic
+|   3824: 63 75 70 25 07 14 01 01 01 08 00 00 00 00 00 00   cup%............
+|   3840: 00 00 00 00 00 10 07 19 08 06 3c 78 40 09 1e b8   ..........<x@...
+|   3856: 51 eb 85 1f 68 69 63 63 75 70 25 06 14 01 01 01   Q...hiccup%.....
+|   3872: 08 00 00 00 00 00 00 00 00 00 00 00 00 07 19 08   ................
+|   3888: 05 32 64 40 09 1e b8 51 eb 85 1f 68 69 63 63 75   .2d@...Q...hiccu
+|   3904: 70 25 05 14 01 01 01 08 00 00 00 00 00 00 00 00   p%..............
+|   3920: 00 00 00 00 07 19 08 04 28 50 40 09 1e b8 51 eb   ........(P@...Q.
+|   3936: 85 1f 68 69 63 63 75 70 25 04 14 01 00 f1 08 00   ..hiccup%.......
+|   3952: 00 00 00 00 00 00 00 00 00 00 00 07 19 08 03 1e   ................
+|   3968: 3c 40 09 1e b8 51 eb 85 1f 68 69 63 63 75 70 25   <@...Q...hiccup%
+|   3984: 03 14 01 01 01 08 00 00 00 00 00 00 00 00 00 00   ................
+|   4000: 00 00 07 19 08 02 14 28 40 09 1e b8 51 eb 85 1f   .......(@...Q...
+|   4016: 68 69 63 63 75 70 24 02 14 09 01 01 08 00 00 00   hiccup$.........
+|   4032: 00 00 00 00 00 00 00 00 00 07 19 08 0a 14 40 09   ..............@.
+|   4048: 1e b8 51 eb 85 1f 68 69 63 63 75 70 22 01 14 08   ..Q...hiccup....
+|   4064: 08 08 08 00 00 00 00 00 00 00 00 00 00 00 00 07   ................
+|   4080: 19 08 40 09 1e b8 51 eb 85 1f 68 69 63 63 75 70   ..@...Q...hiccup
+| page 3 offset 8192
+|      0: 0a 00 00 00 0a 0f aa 00 0f fa 0f f2 0f e9 0f e0   ................
+|     16: 0f d7 0f ce 0f c5 0f bc 0f b3 0f aa 00 00 00 00   ................
+|   4000: 00 00 00 00 00 00 00 00 00 00 08 05 01 01 00 01   ................
+|   4016: 09 5a 0a d8 05 01 01 00 01 08 50 09 08 05 01 01   .Z........P.....
+|   4032: 00 01 07 46 08 08 05 01 01 00 01 06 3c 07 08 05   ...F........<...
+|   4048: 01 01 00 01 05 32 06 08 05 01 01 00 01 04 28 05   .....2........(.
+|   4064: 08 05 01 02 60 01 03 1e 04 08 05 01 01 00 01 02   ....`...........
+|   4080: 14 03 07 05 09 01 00 01 0a 02 05 05 08 08 00 09   ................
+| page 4 offset 12288
+|      0: 0a 00 00 00 0a 0f cf 00 0f fc 0f f7 0f f2 0f ed   ................
+|     16: 0f e8 0f e3 0f de 0f d9 0f d4 0f cf 00 00 00 00   ................
+|   4032: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04   ................
+|   4048: 03 08 01 0a 04 03 08 01 09 04 03 08 01 08 04 03   ................
+|   4064: 08 01 07 04 03 08 01 06 04 03 08 01 05 04 03 08   ................
+|   4080: 01 04 04 03 08 01 03 04 03 08 01 02 03 03 08 09   ................
+| page 5 offset 16384
+|      0: 0d 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00   ................
+| end crash-8391315d75edff.db
+}]} {}
+
+do_catchsql_test 7.1 {
+  SELECT * FROM sqlite_master;
+} {1 {malformed database schema (t1x1) - invalid rootpage}}
+
+finish_test

Index: test/cost.test
==================================================================
--- test/cost.test
+++ test/cost.test
@@ -56,13 +56,16 @@
   WHERE b IS NULL OR c IS NULL OR d IS NULL 
   ORDER BY a;
 } {
   QUERY PLAN
   |--MULTI-INDEX OR
-  |  |--SEARCH TABLE t5 USING INDEX t5b (b=?)
-  |  |--SEARCH TABLE t5 USING INDEX t5c (c=?)
-  |  `--SEARCH TABLE t5 USING INDEX t5d (d=?)
+  |  |--INDEX 1
+  |  |  `--SEARCH TABLE t5 USING INDEX t5b (b=?)
+  |  |--INDEX 2
+  |  |  `--SEARCH TABLE t5 USING INDEX t5c (c=?)
+  |  `--INDEX 3
+  |     `--SEARCH TABLE t5 USING INDEX t5d (d=?)
   `--USE TEMP B-TREE FOR ORDER BY
 }
 
 #-------------------------------------------------------------------------
 # If there is no likelihood() or stat3 data, SQLite assumes that a closed
@@ -122,12 +125,14 @@
 do_eqp_test 6.2 {
   SELECT a FROM t3 WHERE (b BETWEEN 2 AND 4) OR c=100 ORDER BY a
 } {
   QUERY PLAN
   |--MULTI-INDEX OR
-  |  |--SEARCH TABLE t3 USING INDEX t3i1 (b>? AND b<?)
-  |  `--SEARCH TABLE t3 USING INDEX t3i2 (c=?)
+  |  |--INDEX 1
+  |  |  `--SEARCH TABLE t3 USING INDEX t3i1 (b>? AND b<?)
+  |  `--INDEX 2
+  |     `--SEARCH TABLE t3 USING INDEX t3i2 (c=?)
   `--USE TEMP B-TREE FOR ORDER BY
 }
 
 #-------------------------------------------------------------------------
 #
@@ -147,12 +152,14 @@
      WHERE (b>=950 AND b<=1010) OR (b IS NULL AND c NOT NULL)
   ORDER BY a
 } {
   QUERY PLAN
   |--MULTI-INDEX OR
-  |  |--SEARCH TABLE t1 USING INDEX t1b (b>? AND b<?)
-  |  `--SEARCH TABLE t1 USING INDEX t1b (b=?)
+  |  |--INDEX 1
+  |  |  `--SEARCH TABLE t1 USING INDEX t1b (b>? AND b<?)
+  |  `--INDEX 2
+  |     `--SEARCH TABLE t1 USING INDEX t1b (b=?)
   `--USE TEMP B-TREE FOR ORDER BY
 }
 
 do_eqp_test 7.3 {
   SELECT rowid FROM t1

Index: test/countofview.test
==================================================================
--- test/countofview.test
+++ test/countofview.test
@@ -39,6 +39,5 @@
     select c from t2 union all select f from t3
   )
 } {3}
 
 finish_test
-

Index: test/csv01.test
==================================================================
--- test/csv01.test
+++ test/csv01.test
@@ -35,10 +35,67 @@
   SELECT * FROM t1 WHERE c1='10';
 } {9 10 11 12}
 do_execsql_test 1.2 {
   SELECT rowid FROM t1;
 } {1 2 3 4}
+
+do_execsql_test 1.3 {
+  DROP TABLE temp.t1;
+  CREATE VIRTUAL TABLE temp.t1 USING csv(
+    data=
+'a,b,"mix-bloom-eel","soft opinion"
+1,2,3,4
+5,6,7,8
+9,10,11,12
+13,14,15,16
+',
+    header=1
+  );
+  SELECT * FROM t1 WHERE "soft opinion"=12;
+} {9 10 11 12}
+do_execsql_test 1.4 {
+  SELECT name FROM pragma_table_xinfo('t1');
+} {a b mix-bloom-eel {soft opinion}}
+
+do_execsql_test 1.5 {
+  DROP TABLE temp.t1;
+  CREATE VIRTUAL TABLE temp.t1 USING csv(
+    data=
+'a,b,"mix-bloom-eel","soft opinion"
+1,2,3,4
+5,6,7,8
+9,10,11,12
+13,14,15,16
+',
+    header=false
+  );
+  SELECT * FROM t1 WHERE c1='b';
+} {a b mix-bloom-eel {soft opinion}}
+do_execsql_test 1.6 {
+  SELECT name FROM pragma_table_xinfo('t1');
+} {c0 c1 c2 c3}
+
+do_execsql_test 1.7 {
+  DROP TABLE temp.t1;
+  CREATE VIRTUAL TABLE temp.t1 USING csv(
+    data=
+'a,b,"mix-bloom-eel","soft opinion"
+1,2,3,4
+5,6,7,8
+9,10,11,12
+13,14,15,16
+',
+    header,
+    schema='CREATE TABLE x(x0,x1,x2,x3,x4)',
+    columns=5
+  );
+  SELECT * FROM t1 WHERE x1='6';
+} {5 6 7 8 {}}
+do_execsql_test 1.8 {
+  SELECT name FROM pragma_table_xinfo('t1');
+} {x0 x1 x2 x3 x4}
+
 
 do_execsql_test 2.0 {
   DROP TABLE t1;
   CREATE VIRTUAL TABLE temp.t2 USING csv(
     data=
@@ -105,11 +162,11 @@
     columns=4,
     schema=
       'CREATE TABLE t3(a,b,c,d,PRIMARY KEY(a,b)) WITHOUT ROWID',
     testflags=1
   );
-} {1 {vtable constructor failed: t4}}
+} {1 {bad schema: 'CREATE TABLE t3(a,b,c,d,PRIMARY KEY(a,b)) WITHOUT ROWID' - not an error}}
 
 # WITHOUT ROWID tables with a single-column PRIMARY KEY may be writable.
 do_catchsql_test 4.1 {
   DROP TABLE IF EXISTS t4;
   CREATE VIRTUAL TABLE temp.t4 USING csv_wr(
@@ -136,11 +193,11 @@
       columns=4,
       schema=
       'CREATE TABLE t3(a,b,c,d) WITHOUT ROWID',
       testflags=1
       );
-} {1 {vtable constructor failed: t5}}
+} {1 {bad schema: 'CREATE TABLE t3(a,b,c,d) WITHOUT ROWID' - PRIMARY KEY missing on table t3}}
 
 # 2018-04-24
 # Memory leak reported on the sqlite-users mailing list by Ralf Junker.
 #
 do_catchsql_test 4.3 {
@@ -155,6 +212,29 @@
 do_execsql_test 4.4 {
   CREATE VIRTUAL TABLE temp.trent USING csv(data='1');
   SELECT * FROM trent;
 } {1}
 
+# 2018-12-26
+# Bug report on the mailing list
+#
+forcedelete csv01.csv
+set fd [open csv01.csv wb]
+puts $fd "a,b,c,d\r\n1,2,3,4\r\none,two,three,four\r\n5,6,7,8"
+close $fd
+do_execsql_test 5.1 {
+  CREATE VIRTUAL TABLE t5_1 USING csv(filename='csv01.csv');
+  SELECT name FROM temp.pragma_table_info('t5_1');
+} {c0 c1 c2 c3}
+do_execsql_test 5.2 {
+  SELECT *, '|' FROM t5_1;
+} {a b c d | 1 2 3 4 | one two three four | 5 6 7 8 |}
+do_execsql_test 5.3 {
+  DROP TABLE t5_1;
+  CREATE VIRTUAL TABLE t5_1 USING csv(filename='csv01.csv', header);
+  SELECT name FROM temp.pragma_table_info('t5_1');
+} {a b c d}
+do_execsql_test 5.4 {
+  SELECT *, '|' FROM t5_1;
+} {1 2 3 4 | one two three four | 5 6 7 8 |}
+
 finish_test

ADDED   test/dbfuzz001.test
Index: test/dbfuzz001.test
==================================================================
--- /dev/null
+++ test/dbfuzz001.test
@@ -0,0 +1,360 @@
+# 2012-12-13
+#
+# The author disclaims copyright to this source code.  In place of
+# a legal notice, here is a blessing:
+#
+#    May you do good and not evil.
+#    May you find forgiveness for yourself and forgive others.
+#    May you share freely, never taking more than you give.
+#
+#***********************************************************************
+#
+# Test cases for corrupt database files.
+
+set testdir [file dirname $argv0]
+source $testdir/tester.tcl
+
+ifcapable !deserialize {
+  finish_test
+  return
+}
+database_may_be_corrupt
+
+# In the following database file, there is 384 bytes of free space
+# on page 8 that does not appear on the freeblock list.
+#
+do_test dbfuzz001-100 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+    | size 5632 pagesize 512 filename c4.db
+    | page 1 offset 0
+    |      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+    |     16: 02 00 01 01 00 40 20 20 00 00 00 02 00 00 00 0b   .....@  ........
+    |     32: 00 00 00 06 00 00 00 01 00 00 00 28 00 00 00 04   ...........(....
+    |     48: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00   ................
+    |     80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02   ................
+    |     96: 00 2e 30 38 0d 00 00 00 06 01 06 00 01 da 01 b0   ..08............
+    |    112: 01 56 01 86 01 2a 01 06 00 00 00 00 00 00 00 00   .V...*..........
+    |    256: 00 00 00 00 00 00 22 07 06 17 11 11 01 31 74 61   ......"......1ta
+    |    272: 62 6c 65 74 34 74 34 07 43 52 45 41 54 45 20 54   blet4t4.CREATE T
+    |    288: 41 42 4c 45 20 74 34 28 78 29 2a 06 06 17 13 11   ABLE t4(x)*.....
+    |    304: 01 3f 69 6e 64 65 78 00 00 00 00 00 00 00 00 00   .?index.........
+    |    336: 20 74 33 28 78 29 2e 04 06 17 15 11 01 45 69 6e    t3(x).......Ein
+    |    352: 64 65 78 74 32 63 64 74 32 05 43 52 45 41 54 45   dext2cdt2.CREATE
+    |    368: 20 49 4e 44 45 58 20 74 32 63 64 20 4f 4e 20 74    INDEX t2cd ON t
+    |    384: 32 28 63 2c 64 29 28 05 06 17 11 11 01 3d 74 61   2(c,d)(......=ta
+    |    400: 62 6c 65 74 33 74 33 04 43 52 45 41 54 45 20 54   blet3t3.CREATE T
+    |    416: 41 42 4c 45 20 74 33 28 63 2c 78 2c 65 2c 66 29   ABLE t3(c,x,e,f)
+    |    432: 28 02 06 17 11 11 01 3d 74 61 62 6c 65 74 32 74   (......=tablet2t
+    |    448: 32 03 43 52 45 41 54 45 20 54 41 42 4c 45 20 74   2.CREATE TABLE t
+    |    464: 32 28 63 2c 64 2c 65 2c 66 29 24 01 06 17 11 11   2(c,d,e,f)$.....
+    |    480: 01 35 74 61 62 6c 65 74 31 74 31 02 43 52 45 41   .5tablet1t1.CREA
+    |    496: 54 45 20 54 41 42 4c 45 20 74 31 28 61 2c 62 29   TE TABLE t1(a,b)
+    | page 2 offset 512
+    |      0: 0d 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00   ................
+    | page 3 offset 1024
+    |      0: 0d 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00   ................
+    | page 4 offset 1536
+    |      0: 05 00 00 00 03 01 f1 00 00 00 00 0b 01 fb 01 f6   ................
+    |     16: 01 f1 00 16 00 00 09 06 05 01 01 01 01 04 04 03   ................
+    |     32: 03 07 05 05 01 01 09 09 02 02 19 04 05 17 17 17   ................
+    |     48: 17 73 65 76 65 6e 65 69 67 68 74 65 69 67 68 74   .seveneighteight
+    |     64: 73 65 76 65 6e 25 03 05 07 07 07 07 40 14 00 00   seven%......@...
+    |     80: 00 00 00 00 40 18 00 00 00 00 00 00 40 18 00 00   ....@.......@...
+    |     96: 00 00 00 00 40 14 00 00 00 00 00 00 09 02 05 01   ....@...........
+    |    112: 01 01 01 03 04 04 03 07 01 05 09 01 01 09 02 02   ................
+    |    352: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a   ................
+    |    496: 00 00 00 00 0a 3e 00 00 00 09 21 00 00 00 08 06   .....>....!.....
+    | page 5 offset 2048
+    |      0: 0a 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00   ................
+    | page 7 offset 3072
+    |      0: 0d 00 00 00 08 01 c2 00 01 fb 01 f6 01 f1 01 ec   ................
+    |     16: 01 e0 01 d4 01 cb 01 c2 00 00 00 00 00 00 00 00   ................
+    |     96: 00 00 00 00 13 00 00 00 00 00 00 00 00 00 00 00   ................
+    |    224: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02   ................
+    |    288: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03   ................
+    |    448: 00 00 07 08 02 17 65 69 67 68 74 07 07 02 17 65   ......eight....e
+    |    464: 69 67 68 74 0a 06 02 07 40 18 00 00 00 00 00 00   ight....@.......
+    |    480: 0a 05 02 07 40 18 00 00 00 00 00 00 03 04 02 01   ....@...........
+    |    496: 04 03 03 02 01 04 03 02 02 01 02 03 01 02 01 02   ................
+    | page 8 offset 3584
+    |      0: 0d 00 21 00 01 00 16 00 00 16 00 16 00 16 00 16   ..!.............
+    |     16: 00 16 00 16 00 00 09 06 05 01 01 01 01 04 04 03   ................
+    |     32: 03 00 00 00 5f 01 09 09 02 02 00 00 00 56 17 17   ...._........V..
+    |     48: 17 73 65 76 65 6e 65 69 67 68 74 65 69 67 68 74   .seveneighteight
+    |     64: 73 65 76 65 6e 00 00 00 3b 07 07 07 40 14 00 00   seven...;...@...
+    |     80: 00 00 00 00 40 18 00 00 00 00 00 00 40 18 00 00   ....@.......@...
+    |     96: 00 00 00 00 40 14 00 00 00 00 00 00 00 00 00 14   ....@...........
+    |    112: 01 01 01 03 04 04 03 00 00 00 09 01 01 09 02 02   ................
+    |    352: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a   ................
+    | page 9 offset 4096
+    |      0: 0d 00 00 00 1b 00 47 00 01 d9 01 be 01 af 01 a0   ......G.........
+    |     16: 01 91 01 82 01 73 01 64 01 55 01 46 01 37 01 28   .....s.d.U.F.7.(
+    |     32: 01 19 01 0a 00 fb 00 ec 00 dd 00 ce 00 bf 00 b0   ................
+    |     48: 00 a1 00 92 00 83 00 74 00 65 00 56 00 47 00 00   .......t.e.V.G..
+    |     64: 00 00 00 00 00 00 00 0d 21 00 00 48 01 54 00 01   ........!..H.T..
+    |     80: f7 01 ec 01 c5 01 0d 20 00 00 48 01 54 00 01 f7   ....... ..H.T...
+    |     96: 01 ec 01 c5 01 0d 1f 00 00 48 01 54 00 01 f7 01   .........H.T....
+    |    112: ec 01 c5 01 0d 1e 00 00 48 01 54 00 01 f7 01 ec   ........H.T.....
+    |    128: 01 c5 01 0d 1d 00 00 48 01 54 00 01 f7 01 ec 01   .......H.T......
+    |    144: c5 01 0d 1c 00 00 48 01 54 00 01 f7 01 ec 01 c5   ......H.T.......
+    |    160: 01 0d 1b 00 00 48 01 54 00 01 f7 01 ec 01 c5 01   .....H.T........
+    |    176: 0d 1a 00 00 48 01 54 00 01 f7 01 ec 01 c5 01 0d   ....H.T.........
+    |    192: 19 00 00 48 01 54 00 01 f7 01 ec 01 c5 01 0d 18   ...H.T..........
+    |    208: 00 00 48 01 54 00 01 f7 01 ec 01 c5 01 0d 17 00   ..H.T...........
+    |    224: 00 48 01 54 00 01 f7 01 ec 01 c5 01 0d 16 00 00   .H.T............
+    |    240: 48 01 54 00 01 f7 01 ec 01 c5 01 0d 15 00 00 48   H.T............H
+    |    256: 01 54 00 01 f7 01 ec 01 c5 01 0d 14 00 00 48 01   .T............H.
+    |    272: 54 00 01 f7 01 ec 01 c5 01 0d 13 00 00 48 01 54   T............H.T
+    |    288: 00 01 f7 01 ec 01 c5 01 0d 12 00 00 48 01 54 00   ............H.T.
+    |    304: 01 f7 01 ec 01 c5 01 0d 11 00 00 48 01 54 00 01   ...........H.T..
+    |    320: f7 01 ec 01 c5 01 0d 10 00 00 48 01 54 00 01 f7   ..........H.T...
+    |    336: 01 ec 01 c5 01 0d 0f 00 00 48 01 54 00 01 f7 01   .........H.T....
+    |    352: ec 01 c5 01 0d 0e 00 00 48 01 54 00 01 f7 01 ec   ........H.T.....
+    |    368: 01 c5 01 0d 0d 00 00 48 01 54 00 01 f7 01 ec 01   .......H.T......
+    |    384: c5 01 0d 0c 00 00 48 01 54 00 01 f7 01 ec 01 c5   ......H.T.......
+    |    400: 01 0d 0b 00 00 48 01 54 00 01 f7 01 ec 01 c5 01   .....H.T........
+    |    416: 0d 0a 00 00 48 01 54 00 01 f7 01 ec 01 c5 01 0d   ....H.T.........
+    |    432: 09 00 00 48 01 54 00 01 f7 01 ec 01 c5 01 19 08   ...H.T..........
+    |    448: 05 17 17 17 17 65 69 67 68 74 65 69 67 68 74 73   .....eighteights
+    |    464: 65 76 65 6e 73 65 76 65 6e 25 07 05 07 07 07 07   evenseven%......
+    |    480: 40 18 00 00 00 00 00 00 40 18 00 00 00 00 00 00   @.......@.......
+    |    496: 40 14 00 00 00 00 00 00 40 14 00 00 00 00 00 00   @.......@.......
+    | page 10 offset 4608
+    |      0: 0d 00 00 00 1d 00 4d 00 01 f1 01 e2 01 d3 01 c4   ......M.........
+    |     16: 01 b5 01 a6 01 97 01 88 01 79 01 6a 01 5b 01 4c   .........y.j.[.L
+    |     32: 01 3d 01 2e 01 1f 01 10 01 01 00 f2 00 e3 00 d4   .=..............
+    |     48: 00 c5 00 b6 00 a7 00 98 00 89 00 7a 00 6b 00 5c   ...........z.k.\
+    |     64: 00 4d 00 00 00 00 00 00 00 00 00 00 00 0d 3e 00   .M............>.
+    |     80: 00 48 01 54 00 01 f7 01 ec 01 c5 01 0d 3d 00 00   .H.T.........=..
+    |     96: 48 01 54 00 01 f7 01 ec 01 c5 01 0d 3c 00 00 48   H.T.........<..H
+    |    112: 01 54 00 01 f7 01 ec 01 c5 01 0d 3b 00 00 48 01   .T.........;..H.
+    |    128: 54 00 01 f7 01 ec 01 c5 01 0d 3a 00 00 48 01 54   T.........:..H.T
+    |    144: 00 01 f7 01 ec 01 c5 01 0d 39 00 00 48 01 54 00   .........9..H.T.
+    |    160: 01 f7 01 ec 01 c5 01 0d 38 00 00 48 01 54 00 01   ........8..H.T..
+    |    176: f7 01 ec 01 c5 01 0d 37 00 00 48 01 54 00 01 f7   .......7..H.T...
+    |    192: 01 ec 01 c5 01 0d 36 00 00 48 01 54 00 01 f7 01   ......6..H.T....
+    |    208: ec 01 c5 01 0d 35 00 00 48 01 54 00 01 f7 01 ec   .....5..H.T.....
+    |    224: 01 c5 01 0d 34 00 00 48 01 54 00 01 f7 01 ec 01   ....4..H.T......
+    |    240: c5 01 0d 33 00 00 48 01 54 00 01 f7 01 ec 01 c5   ...3..H.T.......
+    |    256: 01 0d 32 00 00 48 01 54 00 01 f7 01 ec 01 c5 01   ..2..H.T........
+    |    272: 0d 31 00 00 48 01 54 00 01 f7 01 ec 01 c5 01 0d   .1..H.T.........
+    |    288: 30 00 00 48 01 54 00 01 f7 01 ec 01 c5 01 0d 2f   0..H.T........./
+    |    304: 00 00 48 01 54 00 01 f7 01 ec 01 c5 01 0d 2e 00   ..H.T...........
+    |    320: 00 48 01 54 00 01 f7 01 ec 01 c5 01 0d 2d 00 00   .H.T.........-..
+    |    336: 48 01 54 00 01 f7 01 ec 01 c5 01 0d 2c 00 00 48   H.T.........,..H
+    |    352: 01 54 00 01 f7 01 ec 01 c5 01 0d 2b 00 00 48 01   .T.........+..H.
+    |    368: 54 00 01 f7 01 ec 01 c5 01 0d 2a 00 00 48 01 54   T.........*..H.T
+    |    384: 00 01 f7 01 ec 01 c5 01 0d 29 00 00 48 01 54 00   .........)..H.T.
+    |    400: 01 f7 01 ec 01 c5 01 0d 28 00 00 48 01 54 00 01   ........(..H.T..
+    |    416: f7 01 ec 01 c5 01 0d 27 00 00 48 01 54 00 01 f7   .......'..H.T...
+    |    432: 01 ec 01 c5 01 0d 26 00 00 48 01 54 00 01 f7 01   ......&..H.T....
+    |    448: ec 01 c5 01 0d 25 00 00 48 01 54 00 01 f7 01 ec   .....%..H.T.....
+    |    464: 01 c5 01 0d 24 00 00 48 01 54 00 01 f7 01 ec 01   ....$..H.T......
+    |    480: c5 01 0d 23 00 00 48 01 54 00 01 f7 01 ec 01 c5   ...#..H.T.......
+    |    496: 01 0d 22 00 00 48 01 54 00 01 f7 01 ec 01 c5 01   .."..H.T........
+    | page 11 offset 5120
+    |      0: 0d 00 00 00 0a 01 6a 00 01 f1 01 e2 01 d3 01 c4   ......j.........
+    |     16: 01 b5 01 a6 01 97 01 88 01 79 01 6a 00 00 00 00   .........y.j....
+    |    352: 00 00 00 00 00 00 00 00 00 00 0d 48 00 00 48 01   ...........H..H.
+    |    368: 54 00 01 f7 01 ec 01 c5 01 0d 47 00 00 48 01 54   T.........G..H.T
+    |    384: 00 01 f7 01 ec 01 c5 01 0d 46 00 00 48 01 54 00   .........F..H.T.
+    |    400: 01 f7 01 ec 01 c5 01 0d 45 00 00 48 01 54 00 01   ........E..H.T..
+    |    416: f7 01 ec 01 c5 01 0d 44 00 00 48 01 54 00 01 f7   .......D..H.T...
+    |    432: 01 ec 01 c5 01 0d 43 00 00 48 01 54 00 01 f7 01   ......C..H.T....
+    |    448: ec 01 c5 01 0d 42 00 00 48 01 54 00 01 f7 01 ec   .....B..H.T.....
+    |    464: 01 c5 01 0d 41 00 00 48 01 54 00 01 f7 01 ec 01   ....A..H.T......
+    |    480: c5 01 0d 40 00 00 48 01 54 00 01 f7 01 ec 01 c5   ...@..H.T.......
+    |    496: 01 0d 3f 00 00 48 01 54 00 01 f7 01 ec 01 c5 01   ..?..H.T........
+    | end c4.db
+  }]
+  db eval {PRAGMA writable_schema=on; PRAGMA integrity_check}
+} {/Fragmentation of 384 bytes reported as 0 on page 8/}
+
+# The DELETE query below deletes the very last cell from page 8.
+# Prior to a certain fix to sqlite3BtreeDelete() and because of the
+# corruption to the freeblock list on page 8, this would fail to
+# cause a rebalance operation, which would leave the btree in a weird
+# state that would lead to segfaults and or assertion faults.
+#
+do_execsql_test dbfuzz001-110 {
+  DELETE FROM t3 WHERE x IS NOT NULL AND +rowid=6;
+} {}
+
+# This is a dbfuzz2-generate test case that can cause a page with
+# pPage->nCell==0 to enter the balancer.
+#
+do_test dbfuzz001-200 {
+  db deserialize [decode_hexdb {
+    | size 3076 pagesize 512 filename c03.db
+    | page 1 offset 0
+    |      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+    |     16: 02 00 01 01 00 40 20 20 00 00 00 0c 00 00 00 07   .....@  ........
+    |     32: 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 04   ................
+    |     48: 00 00 00 00 00 00 00 03 e8 00 00 01 00 00 00 00   ................
+    |     80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c   ................
+    |     96: 00 2e 2c 50 0d 00 00 00 06 01 06 00 01 da 01 b0   ..,P............
+    |    112: 01 56 01 86 01 2a 01 06 00 00 00 00 00 00 00 00   .V...*..........
+    |    128: 00 00 00 00 00 00 00 00 ef 00 00 00 00 00 00 00   ................
+    |    192: 00 7f 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
+    |    224: 00 00 00 00 00 00 00 00 00 00 00 00 00 ff e9 00   ................
+    |    256: 00 00 00 00 00 00 22 07 06 17 11 11 01 31 74 61   ......"......1ta
+    |    272: 62 6c 65 74 34 74 34 07 43 52 45 41 54 45 20 54   blet4t4.CREATE T
+    |    288: 41 42 4c 45 20 74 34 28 78 29 2a 06 06 17 13 11   ABLE t4(x)*.....
+    |    304: 01 3f 69 6e 64 65 78 74 33 78 74 33 06 43 52 45   .?indext3xt3.CRE
+    |    320: 41 54 45 20 49 4e 44 45 58 20 74 33 64 20 4f 4e   ATE INDEX t3d ON
+    |    336: 20 74 33 28 78 29 2e 04 06 17 15 11 01 45 69 6e    t3(x).......Ein
+    |    352: 64 65 78 74 32 63 64 74 32 05 43 52 45 41 54 45   dext2cdt2.CREATE
+    |    368: 20 49 4e 44 45 58 20 74 32 63 64 20 4f 4e 20 74    INDEX t2cd ON t
+    |    384: 32 28 63 2c 64 29 28 05 06 17 11 11 01 3d 74 61   2(c,d)(......=ta
+    |    400: 62 6c 65 74 33 74 33 04 43 52 45 41 54 45 20 54   blet3t3.CREATE T
+    |    416: 41 42 4c 45 20 74 33 28 63 2c 78 2c 65 2c 66 29   ABLE t3(c,x,e,f)
+    |    432: 28 02 06 17 11 11 01 3d 74 61 62 6c 65 74 32 74   (......=tablet2t
+    |    448: 32 03 43 52 45 41 54 45 20 54 41 42 4c 45 20 74   2.CREATE TABLE t
+    |    464: 32 28 63 2c 64 2c 65 2c 66 29 24 01 06 17 11 11   2(c,d,e,f)$.....
+    |    480: 01 35 74 61 62 6c 65 74 31 74 31 02 43 52 45 41   .5tablet1t1.CREA
+    |    496: 54 45 20 54 41 42 4c 45 20 74 31 28 61 2c 62 29   TE TABLE t1(a,b)
+    | page 2 offset 512
+    |      0: 0d 00 00 00 04 01 cf 00 01 fa 01 f3 01 de 01 cf   ................
+    |    176: 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
+    |    256: 00 00 14 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
+    |    368: 00 00 00 00 00 00 00 00 00 00 00 00 1e 00 00 00   ................
+    |    416: 00 00 00 1b 00 00 00 00 04 00 00 00 00 00 00 00   ................
+    |    448: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0d   ................
+    |    464: 04 03 17 17 73 65 76 65 6e 65 69 67 68 74 13 03   ....seveneight..
+    |    480: 03 07 07 40 14 00 00 00 00 00 00 40 18 00 00 00   ...@.......@....
+    |    496: 00 00 00 05 02 03 01 01 03 04 04 01 03 09 01 02   ................
+    | page 3 offset 1024
+    |      0: 0d 00 00 00 08 01 54 00 01 f7 01 ec 01 c5 01 aa   ......T.........
+    |     16: 01 a1 01 96 01 6f 01 54 00 00 00 00 00 00 00 00   .....o.T........
+    |     32: 00 00 00 00 00 00 00 03 e8 00 00 00 00 00 00 00   ................
+    |    336: 00 00 00 00 19 08 05 16 17 17 17 65 69 67 68 74   ...........eight
+    |    352: 65 69 67 68 74 73 65 76 65 6e 73 65 76 ff ff ff   eightsevensev...
+    |    368: 0e 05 07 07 07 07 40 18 00 00 00 00 00 00 40 18   ......@.......@.
+    |    384: 00 00 00 00 00 00 40 14 00 00 00 00 00 00 40 14   ......@.......@.
+    |    400: 00 00 00 00 00 00 09 06 05 01 01 01 01 04 04 03   ................
+    |    416: 03 07 05 05 01 01 09 09 02 02 19 04 05 17 17 17   ................
+    |    432: 17 73 65 6f 65 6e 65 69 67 68 74 65 69 67 68 74   .seoeneighteight
+    |    448: 73 65 76 65 6e 25 03 05 07 07 07 07 40 14 00 00   seven%......@...
+    |    464: 00 00 00 00 40 18 00 00 00 00 00 00 40 18 00 00   ....@.......@...
+    |    480: 00 00 00 00 40 14 00 00 00 00 00 00 09 02 05 01   ....@...........
+    |    496: 01 01 01 03 04 04 03 07 01 05 09 01 01 09 02 02   ................
+    | page 4 offset 1536
+    |      0: 0d 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00   ................
+    |    160: 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00   ................
+    |    336: 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 00   ............ ...
+    | page 5 offset 2048
+    |      0: 0a 00 00 00 08 01 96 00 01 fa 01 c4 01 f2 01 bc   ................
+    |     16: 01 dc 01 a6 01 96 01 cc 00 00 00 00 00 00 00 00   ................
+    |     48: 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00   ................
+    |    288: 00 00 00 00 00 00 00 00 00 64 00 00 00 2b 00 00   .........d...+..
+    |    400: 00 00 00 00 00 00 0f 04 17 17 01 65 69 67 68 74   ...........eight
+    |    416: 65 69 6f 68 74 08 15 04 07 07 01 40 18 00 00 00   eioht......@....
+    |    432: 00 00 00 40 18 00 00 00 00 00 00 07 07 04 01 01   ...@............
+    |    448: 01 04 04 06 07 04 01 01 01 02 02 05 0f 04 17 17   ................
+    |    464: 01 73 65 76 65 6e 65 69 67 68 74 04 15 04 07 07   .seveneight.....
+    |    480: 01 40 14 00 00 00 00 00 00 40 18 00 00 00 00 00   .@.......@......
+    |    496: 00 03 07 04 01 01 01 03 04 02 05 04 09 01 09 02   ................
+    | page 6 offset 2560
+    |      0: 0a 00 00 00 00 02 00 00 00 00 00 00 00 0d 00 00   ................
+    |     16: 00 08 01 c2 00 01 fb 01 f6 01 f1 01 ec 01 e0 01   ................
+    |     32: d4 01 cb 01 c2 00 00 00 00 00 00 00 00 00 00 00   ................
+    |    160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00   ................
+    |    448: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07   ................
+    |    464: 08 02 17 65 69 67 68 74 07 07 02 17 65 69 67 68   ...eight....eigh
+    |    480: 74 0a 06 02 07 40 18 00 00 00 00 00 00 0a 05 02   t....@..........
+    |    496: 07 40 18 00 04 02 01 04 03 03 02 01 04 03 02 02   .@..............
+    | end x/c03.db
+  }]
+  catchsql {INSERT INTO t3 SELECT * FROM t2;}
+} {1 {database disk image is malformed}}
+
+
+do_test dbfuzz001-110 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 3584 pagesize 512 filename x/c02.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 02 00 01 01 00 40 20 20 00 00 00 0c 00 00 00 07   .....@  ........
+|     32: 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 04   ................
+|     48: 00 00 00 00 00 00 00 04 00 00 00 01 00 00 00 00   ................
+|     80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c   ................
+|     96: 00 2e 2c 50 0d 00 00 00 06 01 06 00 01 da 01 b0   ..,P............
+|    112: 01 56 01 86 01 2a 01 06 00 00 00 00 00 00 00 00   .V...*..........
+|    256: 00 00 00 00 00 00 22 07 06 17 11 11 01 31 74 61   ......"......1ta
+|    272: 62 6c 65 74 34 74 34 07 43 52 45 41 54 45 20 54   blet4t4.CREATE T
+|    288: 41 42 4c 45 20 74 34 28 78 29 2a 06 06 17 13 11   ABLE t4(x)*.....
+|    304: 01 3f 69 6e 64 65 78 74 33 78 74 33 05 43 52 45   .?indext3xt3.CRE
+|    320: 41 54 45 20 49 4e 44 45 58 20 74 33 78 20 4f 4e   ATE INDEX t3x ON
+|    336: 20 74 33 28 78 29 2e 04 06 17 15 11 01 45 69 6e    t3(x).......Ein
+|    352: 64 65 78 74 32 63 64 74 32 05 43 52 45 41 54 45   dext2cdt2.CREATE
+|    368: 20 49 4e 44 45 58 20 74 32 63 64 20 4f 4e 20 74    INDEX t2cd ON t
+|    384: 32 28 63 2c 64 29 28 05 06 17 11 11 01 3d 74 61   2(c,d)(......=ta
+|    400: 62 6c 65 74 33 74 33 07 43 52 45 41 54 45 20 54   blet3t3.CREATE T
+|    416: 41 42 4c 45 20 74 33 28 63 2c 78 2c 65 2c 66 29   ABLE t3(c,x,e,f)
+|    432: 28 02 06 17 11 11 01 3d 74 61 74 65 6c 03 62 74   (......=tatel.bt
+|    448: 32 32 43 52 45 41 54 45 20 54 41 42 4c 45 20 74   22CREATE TABLE t
+|    464: 32 28 63 2c 64 2c 65 2c 66 29 24 01 06 17 11 11   2(c,d,e,f)$.....
+|    480: 01 35 74 61 62 6c 65 74 31 74 31 02 43 52 45 41   .5tablet1t1.CREA
+|    496: 54 45 20 54 41 42 4c 45 20 74 31 28 61 2c 62 29   TE TABLE t1(a,b)
+| page 2 offset 512
+|      0: 0d 00 00 00 04 01 cf 00 01 fa 01 f3 01 de 01 cf   ................
+|    160: 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00   .. .............
+|    448: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0d   ................
+|    464: 04 03 17 17 73 65 76 65 6e 65 69 67 68 74 13 03   ....seveneight..
+|    480: 03 07 07 40 14 00 00 00 00 00 00 40 18 00 00 00   ...@.......@....
+|    496: 00 00 00 05 02 03 01 01 03 04 04 01 03 09 01 02   ................
+| page 3 offset 1024
+|      0: 0d 00 00 00 08 01 54 00 01 f7 01 ec 01 c5 01 aa   ......T.........
+|     16: 01 a1 01 96 01 6f 01 54 00 00 00 00 00 00 00 00   .....o.T........
+|    112: 00 00 dd 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
+|    336: 00 00 00 00 19 08 05 17 17 17 17 65 69 67 68 74   ...........eight
+|    352: 65 69 67 68 74 73 65 76 65 6e 73 65 76 65 6e 25   eightsevenseven%
+|    368: 07 05 07 07 07 07 40 18 00 00 00 00 00 00 40 18   ......@.......@.
+|    384: 00 00 00 00 00 00 40 14 00 00 00 00 00 00 40 14   ......@.......@.
+|    400: 00 00 00 00 00 00 09 06 05 01 01 01 01 04 04 03   ................
+|    416: 03 07 05 05 01 01 09 09 02 02 19 04 05 17 17 17   ................
+|    432: 17 73 65 76 65 6e 65 69 67 68 74 65 69 67 68 74   .seveneighteight
+|    448: 73 65 76 65 6e 25 03 05 07 07 07 07 40 14 00 00   seven%......@...
+|    464: 00 00 00 00 40 18 00 00 00 00 00 00 40 18 00 00   ....@.......@...
+|    480: 00 00 00 00 40 14 00 00 00 00 00 00 09 02 05 01   ....@...........
+|    496: 01 01 01 03 04 04 03 07 01 05 09 01 01 09 02 02   ................
+| page 4 offset 1536
+|      0: 0d 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00   ................
+|    192: 00 00 00 00 00 00 7f 00 00 00 00 00 00 00 00 00   ................
+|    208: 00 e5 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
+| page 5 offset 2048
+|      0: 0a 00 00 00 08 01 96 00 01 fa 01 c4 01 f2 01 bc   ................
+|     16: 01 dc 01 a6 01 96 01 cc 00 00 00 00 00 00 00 00   ................
+|    240: 00 00 00 00 00 00 00 00 00 00 00 00 00 0e 00 00   ................
+|    400: 00 00 00 00 00 00 0f 04 17 07 01 65 69 67 68 74   ...........eight
+|    416: 65 69 67 68 74 08 15 04 07 07 01 40 18 00 00 00   eight......@....
+|    432: 00 00 00 40 18 00 00 00 00 00 00 07 07 04 01 01   ...@............
+|    448: 01 04 04 06 07 04 01 01 01 02 02 05 0f 04 17 17   ................
+|    464: 01 73 65 76 65 6e 65 69 67 68 74 04 15 04 07 07   .seveneight.....
+|    480: 01 40 14 00 00 00 00 00 00 40 18 00 00 00 00 00   .@.......@......
+|    496: 00 03 07 04 01 01 01 03 04 02 05 04 09 01 09 02   ................
+| page 6 offset 2560
+|      0: 0a 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00   ................
+|    464: 00 00 00 00 00 00 00 00 00 00 7f 00 00 00 00 00   ................
+| page 7 offset 3072
+|      0: 0d 00 00 00 08 01 c2 00 01 fb 01 f6 01 f1 01 ec   ................
+|     16: 01 e0 01 d4 01 cb 01 c2 00 00 00 00 00 00 00 00   ................
+|    448: 00 00 07 08 02 17 65 69 67 68 74 07 07 02 17 65   ......eight....e
+|    464: 69 67 68 74 0a 06 02 07 40 18 00 00 00 00 00 00   ight....@.......
+|    480: 0a 05 02 07 40 18 00 00 00 00 00 00 03 04 02 01   ....@...........
+|    496: 04 03 03 02 01 04 03 02 02 01 02 03 01 02 01 02   ................
+| end x/c02.db
+  }]
+} {}
+
+do_catchsql_test dbfuzz001-120 {
+  PRAGMA integrity_check;
+} {1 {database disk image is malformed}}
+
+do_catchsql_test dbfuzz001-130 {
+  DELETE FROM t3 WHERE x IN (SELECT x FROM t4);
+} {1 {database disk image is malformed}}
+
+finish_test

Index: test/dbfuzz2.c
==================================================================
--- test/dbfuzz2.c
+++ test/dbfuzz2.c
@@ -41,10 +41,12 @@
 #include <stdlib.h>
 #include <string.h>
 #include <stdarg.h>
 #include <ctype.h>
 #include <stdint.h>
+#include <sys/time.h>
+#include <sys/resource.h>
 #include "sqlite3.h"
 
 /*
 ** This is the is the SQL that is run against the database.
 */
@@ -62,38 +64,140 @@
 };
 
 /* Output verbosity level.  0 means complete silence */
 int eVerbosity = 0;
 
+/* True to activate PRAGMA vdbe_debug=on */
+static int bVdbeDebug = 0;
+
+/* Maximum size of the in-memory database file */
+static sqlite3_int64 szMax = 104857600;
+
+/***** Copy/paste from ext/misc/memtrace.c ***************************/
+/* The original memory allocation routines */
+static sqlite3_mem_methods memtraceBase;
+static FILE *memtraceOut;
+
+/* Methods that trace memory allocations */
+static void *memtraceMalloc(int n){
+  if( memtraceOut ){
+    fprintf(memtraceOut, "MEMTRACE: allocate %d bytes\n", 
+            memtraceBase.xRoundup(n));
+  }
+  return memtraceBase.xMalloc(n);
+}
+static void memtraceFree(void *p){
+  if( p==0 ) return;
+  if( memtraceOut ){
+    fprintf(memtraceOut, "MEMTRACE: free %d bytes\n", memtraceBase.xSize(p));
+  }
+  memtraceBase.xFree(p);
+}
+static void *memtraceRealloc(void *p, int n){
+  if( p==0 ) return memtraceMalloc(n);
+  if( n==0 ){
+    memtraceFree(p);
+    return 0;
+  }
+  if( memtraceOut ){
+    fprintf(memtraceOut, "MEMTRACE: resize %d -> %d bytes\n",
+            memtraceBase.xSize(p), memtraceBase.xRoundup(n));
+  }
+  return memtraceBase.xRealloc(p, n);
+}
+static int memtraceSize(void *p){
+  return memtraceBase.xSize(p);
+}
+static int memtraceRoundup(int n){
+  return memtraceBase.xRoundup(n);
+}
+static int memtraceInit(void *p){
+  return memtraceBase.xInit(p);
+}
+static void memtraceShutdown(void *p){
+  memtraceBase.xShutdown(p);
+}
+
+/* The substitute memory allocator */
+static sqlite3_mem_methods ersaztMethods = {
+  memtraceMalloc,
+  memtraceFree,
+  memtraceRealloc,
+  memtraceSize,
+  memtraceRoundup,
+  memtraceInit,
+  memtraceShutdown
+};
+
+/* Begin tracing memory allocations to out. */
+int sqlite3MemTraceActivate(FILE *out){
+  int rc = SQLITE_OK;
+  if( memtraceBase.xMalloc==0 ){
+    rc = sqlite3_config(SQLITE_CONFIG_GETMALLOC, &memtraceBase);
+    if( rc==SQLITE_OK ){
+      rc = sqlite3_config(SQLITE_CONFIG_MALLOC, &ersaztMethods);
+    }
+  }
+  memtraceOut = out;
+  return rc;
+}
+
+/* Deactivate memory tracing */
+int sqlite3MemTraceDeactivate(void){
+  int rc = SQLITE_OK;
+  if( memtraceBase.xMalloc!=0 ){
+    rc = sqlite3_config(SQLITE_CONFIG_MALLOC, &memtraceBase);
+    if( rc==SQLITE_OK ){
+      memset(&memtraceBase, 0, sizeof(memtraceBase));
+    }
+  }
+  memtraceOut = 0;
+  return rc;
+}
+/***** End copy/paste from ext/misc/memtrace.c ***************************/
+
 /* libFuzzer invokes this routine with fuzzed database files (in aData).
 ** This routine run SQLite against the malformed database to see if it
 ** can provoke a failure or malfunction.
 */
 int LLVMFuzzerTestOneInput(const uint8_t *aData, size_t nByte){
   unsigned char *a;
   sqlite3 *db;
   int rc;
   int i;
+  sqlite3_int64 x;
+  char *zErr = 0;
 
   if( eVerbosity>=1 ){
     printf("************** nByte=%d ***************\n", (int)nByte);
     fflush(stdout);
   }
+  if( sqlite3_initialize() ) return 0;
   rc = sqlite3_open(0, &db);
   if( rc ) return 1;
   a = sqlite3_malloc64(nByte+1);
   if( a==0 ) return 1;
   memcpy(a, aData, nByte);
   sqlite3_deserialize(db, "main", a, nByte, nByte,
         SQLITE_DESERIALIZE_RESIZEABLE |
         SQLITE_DESERIALIZE_FREEONCLOSE);
+  x = szMax;
+  sqlite3_file_control(db, "main", SQLITE_FCNTL_SIZE_LIMIT, &x);
+  if( bVdbeDebug ){
+    sqlite3_exec(db, "PRAGMA vdbe_debug=ON", 0, 0, 0);
+  }
   for(i=0; i<sizeof(azSql)/sizeof(azSql[0]); i++){
     if( eVerbosity>=1 ){
       printf("%s\n", azSql[i]);
       fflush(stdout);
     }
-    sqlite3_exec(db, azSql[i], 0, 0, 0);
+    zErr = 0;
+    rc = sqlite3_exec(db, azSql[i], 0, 0, &zErr);
+    if( rc && eVerbosity>=1 ){
+      printf("-- rc=%d zErr=%s\n", rc, zErr);
+    }
+    sqlite3_free(zErr);
   }
   rc = sqlite3_close(db);
   if( rc!=SQLITE_OK ){
     fprintf(stdout, "sqlite3_close() returns %d\n", rc);
   }
@@ -105,34 +209,145 @@
             sqlite3_memory_used(), nAlloc);
     exit(1);
   }
   return 0;
 }
+
+/*
+** Return the number of "v" characters in a string.  Return 0 if there
+** are any characters in the string other than "v".
+*/
+static int numberOfVChar(const char *z){
+  int N = 0;
+  while( z[0] && z[0]=='v' ){
+    z++;
+    N++;
+  }
+  return z[0]==0 ? N : 0;
+}
 
 /* libFuzzer invokes this routine once when the executable starts, to
 ** process the command-line arguments.
 */
 int LLVMFuzzerInitialize(int *pArgc, char ***pArgv){
-  int i, j;
+  int i, j, n;
   int argc = *pArgc;
-  char **newArgv;
   char **argv = *pArgv;
-  newArgv = malloc( sizeof(char*)*(argc+1) );
-  if( newArgv==0 ) return 0;
-  newArgv[0] = argv[0];
   for(i=j=1; i<argc; i++){
     char *z = argv[i];
     if( z[0]=='-' ){
       z++;
       if( z[0]=='-' ) z++;
-      if( strcmp(z,"v")==0 ){
-        eVerbosity++;
+      if( z[0]=='v' && (n = numberOfVChar(z))>0 ){
+        eVerbosity += n;
+        continue;
+      }
+      if( strcmp(z,"vdbe-debug")==0 ){
+        bVdbeDebug = 1;
+        continue;
+      }
+      if( strcmp(z,"memtrace")==0 ){
+        sqlite3MemTraceActivate(stdout);
+        continue;
+      }
+      if( strcmp(z,"mem")==0 ){
+        bVdbeDebug = 1;
+        continue;
+      }
+      if( strcmp(z,"max-db-size")==0 ){
+        if( i+1==argc ){
+          fprintf(stderr, "missing argument to %s\n", argv[i]);
+          exit(1);
+        }
+        szMax = strtol(argv[++i], 0, 0);
+        continue;
+      }
+      if( strcmp(z,"max-stack")==0
+       || strcmp(z,"max-data")==0
+       || strcmp(z,"max-as")==0
+      ){
+        struct rlimit x,y;
+        int resource = RLIMIT_STACK;
+        char *zType = "RLIMIT_STACK";
+        if( i+1==argc ){
+          fprintf(stderr, "missing argument to %s\n", argv[i]);
+          exit(1);
+        }
+        if( z[4]=='d' ){
+          resource = RLIMIT_DATA;
+          zType = "RLIMIT_DATA";
+        }
+        if( z[4]=='a' ){
+          resource = RLIMIT_AS;
+          zType = "RLIMIT_AS";
+        }
+        memset(&x,0,sizeof(x));
+        getrlimit(resource, &x);
+        y.rlim_cur = atoi(argv[++i]);
+        y.rlim_max = x.rlim_cur;
+        setrlimit(resource, &y);
+        memset(&y,0,sizeof(y));
+        getrlimit(resource, &y);
+        printf("%s changed from %d to %d\n", 
+               zType, (int)x.rlim_cur, (int)y.rlim_cur);
         continue;
       }
     }
-    newArgv[j++] = argv[i];
+    argv[j++] = argv[i];
   }
-  newArgv[j] = 0;
-  *pArgv = newArgv;
+  argv[j] = 0;
   *pArgc = j;
   return 0;
 }
+
+#ifdef STANDALONE
+/*
+** Read an entire file into memory.  Space to hold the file comes
+** from malloc().
+*/
+static unsigned char *readFile(const char *zName, int *pnByte){
+  FILE *in = fopen(zName, "rb");
+  long nIn;
+  size_t nRead;
+  unsigned char *pBuf;
+  if( in==0 ) return 0;
+  fseek(in, 0, SEEK_END);
+  nIn = ftell(in);
+  rewind(in);
+  pBuf = malloc( nIn+1 );
+  if( pBuf==0 ){ fclose(in); return 0; }
+  nRead = fread(pBuf, nIn, 1, in);
+  fclose(in);
+  if( nRead!=1 ){
+    free(pBuf);
+    return 0;
+  }
+  pBuf[nIn] = 0;
+  if( pnByte ) *pnByte = nIn;
+  return pBuf;
+}
+#endif /* STANDALONE */
+
+#ifdef STANDALONE
+int main(int argc, char **argv){
+  int i;
+  LLVMFuzzerInitialize(&argc, &argv);
+  for(i=1; i<argc; i++){
+    unsigned char *pIn;
+    int nIn;
+    pIn = readFile(argv[i], &nIn);
+    if( pIn ){
+      LLVMFuzzerTestOneInput((const uint8_t*)pIn, (size_t)nIn);
+      free(pIn);
+    }
+  }
+  if( eVerbosity>0 ){
+    struct rusage x;
+    printf("SQLite %s\n", sqlite3_sourceid());
+    memset(&x, 0, sizeof(x));
+    if( getrusage(RUSAGE_SELF, &x)==0 ){
+      printf("Maximum RSS = %ld KB\n", x.ru_maxrss);
+    }
+  }
+  return 0;
+}
+#endif /*STANDALONE*/

Index: test/dbpage.test
==================================================================
--- test/dbpage.test
+++ test/dbpage.test
@@ -19,10 +19,11 @@
 ifcapable !vtab||!compound {
   finish_test
   return
 }
 
+sqlite3_db_config db DEFENSIVE 0
 do_test 100 {
   execsql {
     PRAGMA auto_vacuum=0;
     PRAGMA page_size=4096;
     PRAGMA journal_mode=WAL;

Index: test/default.test
==================================================================
--- test/default.test
+++ test/default.test
@@ -104,10 +104,11 @@
 # in the sqlite_master table, for backwards compatibility.
 #
 db close
 forcedelete test.db
 sqlite3 db test.db
+sqlite3_db_config db DEFENSIVE 0
 do_execsql_test default-4.0 {
   CREATE TABLE t1(a TEXT, b TEXT DEFAULT(99));
   PRAGMA writable_schema=ON;
   UPDATE sqlite_master SET sql='CREATE TABLE t1(a TEXT, b TEXT DEFAULT(:xyz))';
 } {}

Index: test/e_fkey.test
==================================================================
--- test/e_fkey.test
+++ test/e_fkey.test
@@ -2795,16 +2795,18 @@
   }
 } {{CREATE TABLE c(b REFERENCES "parent"(a))}}
 do_test e_fkey-61.2.2 {
   execsql {
     PRAGMA foreign_keys = OFF;
+    PRAGMA legacy_alter_table = ON;
     ALTER TABLE p RENAME TO parent;
     SELECT sql FROM sqlite_master WHERE name = 'c';
   }
 } {{CREATE TABLE c(b REFERENCES p(a))}}
 do_test e_fkey-61.2.3 {
   execsql { PRAGMA foreign_keys = ON }
+  execsql { PRAGMA legacy_alter_table = OFF }
 } {}
 
 do_test e_fkey-61.3.1 {
   drop_all_tables
   execsql {

Index: test/e_fts3.test
==================================================================
--- test/e_fts3.test
+++ test/e_fts3.test
@@ -675,10 +675,11 @@
 ddl_test   10.1.1 { CREATE VIRTUAL TABLE ta USING fts3 }
 write_test 10.1.2 ta_content { 
   INSERT INTO ta VALUES('During a summer vacation in 1790') }
 write_test 10.1.3 ta_content {
   INSERT INTO ta VALUES('Wordsworth went on a walking tour') }
+sqlite3_db_config db DEFENSIVE 0
 write_test 10.1.4 ta_content { DELETE FROM ta_content WHERE rowid = 2 }
 read_test  10.1.5 {
   SELECT * FROM ta WHERE ta MATCH 'summer'
 } {{During a summer vacation in 1790}}
 error_test 10.1.6 {

Index: test/e_reindex.test
==================================================================
--- test/e_reindex.test
+++ test/e_reindex.test
@@ -42,10 +42,11 @@
 # recreate indices from scratch.
 #
 #    Test this by corrupting some database indexes, running REINDEX, and
 #    observing that the corruption is gone.
 #
+sqlite3_db_config db DEFENSIVE 0
 do_execsql_test e_reindex-1.1 {
   INSERT INTO t1 VALUES(1, 2);
   INSERT INTO t1 VALUES(3, 4);
   INSERT INTO t1 VALUES(5, 6);
 
@@ -55,10 +56,11 @@
   DELETE FROM sqlite_master WHERE type = 'index';
 } {}
 
 db close
 sqlite3 db test.db
+sqlite3_db_config db DEFENSIVE 0
 do_execsql_test e_reindex-1.2 {
   DELETE FROM t1 WHERE a = 3;
   INSERT INTO t1 VALUES(7, 8);
   INSERT INTO t1 VALUES(9, 10);
   PRAGMA writable_schema = 1;

Index: test/e_select.test
==================================================================
--- test/e_select.test
+++ test/e_select.test
@@ -165,29 +165,27 @@
 
   0101.1  "SELECT count(*), max(a) FROM t1 GROUP BY b" {1 a 1 c 1 b}
   0102.1  "SELECT count(*), max(a) FROM t1 GROUP BY b HAVING count(*)=1" {
     1 a 1 c 1 b
   }
-  0102.2  "SELECT count(*), max(a) FROM t1 GROUP BY b HAVING count(*)=2" { }
+  0102.2  "SELECT count(*), max(a) FROM t1 GROUP BY b HAVING count(*)=2" {}
 
   1101.1  "SELECT DISTINCT count(*), max(a) FROM t1 GROUP BY b" {1 a 1 c 1 b}
   1102.1  "SELECT DISTINCT count(*), max(a) FROM t1 
            GROUP BY b HAVING count(*)=1" {
     1 a 1 c 1 b
   }
   1102.2  "SELECT DISTINCT count(*), max(a) FROM t1 
-           GROUP BY b HAVING count(*)=2" { 
-  }
+           GROUP BY b HAVING count(*)=2" {}
 
   2101.1  "SELECT ALL count(*), max(a) FROM t1 GROUP BY b" {1 a 1 c 1 b}
   2102.1  "SELECT ALL count(*), max(a) FROM t1 
            GROUP BY b HAVING count(*)=1" {
     1 a 1 c 1 b
   }
   2102.2  "SELECT ALL count(*), max(a) FROM t1 
-           GROUP BY b HAVING count(*)=2" { 
-  }
+           GROUP BY b HAVING count(*)=2" {}
 
   0011.1  "SELECT 1, 2, 3 WHERE 1 GROUP BY 2" {1 2 3}
   0012.1  "SELECT 1, 2, 3 WHERE 0 GROUP BY 2 HAVING count(*)=1" {}
   0012.2  "SELECT 1, 2, 3 WHERE 0 GROUP BY 2 HAVING count(*)>1" {}
 
@@ -202,29 +200,28 @@
 
   0111.1  "SELECT count(*), max(a) FROM t1 WHERE a='a' GROUP BY b" {1 a}
   0112.1  "SELECT count(*), max(a) FROM t1 
            WHERE a='c' GROUP BY b HAVING count(*)=1" {1 c}
   0112.2  "SELECT count(*), max(a) FROM t1 
-           WHERE 0 GROUP BY b HAVING count(*)=2" { }
+           WHERE 0 GROUP BY b HAVING count(*)=2" {}
   1111.1  "SELECT DISTINCT count(*), max(a) FROM t1 WHERE a<'c' GROUP BY b" 
           {1 a 1 b}
   1112.1  "SELECT DISTINCT count(*), max(a) FROM t1 WHERE a>'a'
            GROUP BY b HAVING count(*)=1" {
     1 c 1 b
   }
   1112.2  "SELECT DISTINCT count(*), max(a) FROM t1 WHERE 0
-           GROUP BY b HAVING count(*)=2" { 
-  }
+           GROUP BY b HAVING count(*)=2" {}
 
   2111.1  "SELECT ALL count(*), max(a) FROM t1 WHERE b>'one' GROUP BY b" 
           {1 c 1 b}
   2112.1  "SELECT ALL count(*), max(a) FROM t1 WHERE a!='b'
            GROUP BY b HAVING count(*)=1" {
     1 a 1 c
   }
   2112.2  "SELECT ALL count(*), max(a) FROM t1 
-           WHERE 0 GROUP BY b HAVING count(*)=2" { }
+           WHERE 0 GROUP BY b HAVING count(*)=2" {}
 }
 
 
 # -- syntax diagram result-column
 #

Index: test/eqp.test
==================================================================
--- test/eqp.test
+++ test/eqp.test
@@ -43,22 +43,26 @@
 do_eqp_test 1.2 {
   SELECT * FROM t2, t1 WHERE t1.a=1 OR t1.b=2;
 } {
   QUERY PLAN
   |--MULTI-INDEX OR
-  |  |--SEARCH TABLE t1 USING INDEX i1 (a=?)
-  |  `--SEARCH TABLE t1 USING INDEX i2 (b=?)
+  |  |--INDEX 1
+  |  |  `--SEARCH TABLE t1 USING INDEX i1 (a=?)
+  |  `--INDEX 2
+  |     `--SEARCH TABLE t1 USING INDEX i2 (b=?)
   `--SCAN TABLE t2
 }
 do_eqp_test 1.3 {
   SELECT * FROM t2 CROSS JOIN t1 WHERE t1.a=1 OR t1.b=2;
 } {
   QUERY PLAN
   |--SCAN TABLE t2
   `--MULTI-INDEX OR
-     |--SEARCH TABLE t1 USING INDEX i1 (a=?)
-     `--SEARCH TABLE t1 USING INDEX i2 (b=?)
+     |--INDEX 1
+     |  `--SEARCH TABLE t1 USING INDEX i1 (a=?)
+     `--INDEX 2
+        `--SEARCH TABLE t1 USING INDEX i2 (b=?)
 }
 do_eqp_test 1.3 {
   SELECT a FROM t1 ORDER BY a
 } {
   QUERY PLAN
@@ -223,36 +227,36 @@
 do_eqp_test 3.1.1 {
   SELECT (SELECT x FROM t1 AS sub) FROM t1;
 } {
   QUERY PLAN
   |--SCAN TABLE t1
-  `--SCALAR SUBQUERY
+  `--SCALAR SUBQUERY xxxxxx
      `--SCAN TABLE t1 AS sub
 }
 do_eqp_test 3.1.2 {
   SELECT * FROM t1 WHERE (SELECT x FROM t1 AS sub);
 } {
   QUERY PLAN
   |--SCAN TABLE t1
-  `--SCALAR SUBQUERY
+  `--SCALAR SUBQUERY xxxxxx
      `--SCAN TABLE t1 AS sub
 }
 do_eqp_test 3.1.3 {
   SELECT * FROM t1 WHERE (SELECT x FROM t1 AS sub ORDER BY y);
 } {
   QUERY PLAN
   |--SCAN TABLE t1
-  `--SCALAR SUBQUERY
+  `--SCALAR SUBQUERY xxxxxx
      |--SCAN TABLE t1 AS sub
      `--USE TEMP B-TREE FOR ORDER BY
 }
 do_eqp_test 3.1.4 {
   SELECT * FROM t1 WHERE (SELECT x FROM t2 ORDER BY x);
 } {
   QUERY PLAN
   |--SCAN TABLE t1
-  `--SCALAR SUBQUERY
+  `--SCALAR SUBQUERY xxxxxx
      `--SCAN TABLE t2 USING COVERING INDEX t2i1
 }
 
 det 3.2.1 {
   SELECT * FROM (SELECT * FROM t1 ORDER BY x LIMIT 10) ORDER BY y LIMIT 5
@@ -284,27 +288,27 @@
 det 3.3.1 {
   SELECT * FROM t1 WHERE y IN (SELECT y FROM t2)
 } {
   QUERY PLAN
   |--SCAN TABLE t1
-  `--LIST SUBQUERY
+  `--LIST SUBQUERY xxxxxx
      `--SCAN TABLE t2
 }
 det 3.3.2 {
   SELECT * FROM t1 WHERE y IN (SELECT y FROM t2 WHERE t1.x!=t2.x)
 } {
   QUERY PLAN
   |--SCAN TABLE t1
-  `--CORRELATED LIST SUBQUERY
+  `--CORRELATED LIST SUBQUERY xxxxxx
      `--SCAN TABLE t2
 }
 det 3.3.3 {
   SELECT * FROM t1 WHERE EXISTS (SELECT y FROM t2 WHERE t1.x!=t2.x)
 } {
   QUERY PLAN
   |--SCAN TABLE t1
-  `--CORRELATED SCALAR SUBQUERY
+  `--CORRELATED SCALAR SUBQUERY xxxxxx
      `--SCAN TABLE t2
 }
 
 #-------------------------------------------------------------------------
 # Test cases eqp-4.* - tests for composite select statements.
@@ -811,11 +815,11 @@
 } {
   QUERY PLAN
   |--MATERIALIZE xxxxxx
   |  |--SCAN TABLE forumpost AS x USING INDEX forumthread
   |  |--USING ROWID SEARCH ON TABLE private FOR IN-OPERATOR
-  |  |--CORRELATED SCALAR SUBQUERY
+  |  |--CORRELATED SCALAR SUBQUERY xxxxxx
   |  |  |--SEARCH TABLE forumpost USING COVERING INDEX forumthread (froot=?)
   |  |  `--USING ROWID SEARCH ON TABLE private FOR IN-OPERATOR
   |  `--USE TEMP B-TREE FOR ORDER BY
   |--SCAN SUBQUERY xxxxxx
   |--SEARCH TABLE blob USING INTEGER PRIMARY KEY (rowid=?)

Index: test/fallocate.test
==================================================================
--- test/fallocate.test
+++ test/fallocate.test
@@ -68,10 +68,19 @@
     set {} 1024
   }
 } {1024}
 do_test fallocate-1.8 { execsql { COMMIT } } {}
 
+do_test fallocate-1.8 {
+  set nPg [db one {PRAGMA page_count}]
+  set nFile [expr [file size test.db] / 1024]
+  list [expr $nPg<100] [expr $nFile>100]
+} {1 1}
+
+do_execsql_test fallocate-1.9 {
+  PRAGMA max_page_count = 100;
+} {100}
 
 #-------------------------------------------------------------------------
 # The following tests - fallocate-2.* - test that things work in WAL
 # mode as well.
 #

Index: test/fkey2.test
==================================================================
--- test/fkey2.test
+++ test/fkey2.test
@@ -985,19 +985,21 @@
   proc test_rename_parent {zCreate zOld zNew} {
     db eval {SELECT sqlite_rename_table(
         'main', 'table', 't1', $zCreate, $zOld, $zNew, 0
     )}
   }
+  sqlite3_test_control SQLITE_TESTCTRL_INTERNAL_FUNCTIONS 1
   do_test fkey2-14.2.1.1 {
     test_rename_parent {CREATE TABLE t1(a REFERENCES t2)} t2 t3
   } {{CREATE TABLE t1(a REFERENCES "t3")}}
   do_test fkey2-14.2.1.2 {
     test_rename_parent {CREATE TABLE t1(a REFERENCES t2)} t4 t3
   } {{CREATE TABLE t1(a REFERENCES t2)}}
   do_test fkey2-14.2.1.3 {
     test_rename_parent {CREATE TABLE t1(a REFERENCES "t2")} t2 t3
   } {{CREATE TABLE t1(a REFERENCES "t3")}}
+  sqlite3_test_control SQLITE_TESTCTRL_INTERNAL_FUNCTIONS 0
   
   # Test ALTER TABLE RENAME TABLE a bit.
   #
   do_test fkey2-14.2.2.1 {
     drop_all_tables
@@ -1066,19 +1068,21 @@
       PRAGMA foreign_keys = on;
       SELECT sql FROM temp.sqlite_master WHERE name='t2';
     }
   } {{CREATE TABLE t2(a, b, c REFERENCES t1, d DEFAULT NULL REFERENCES t1, e REFERENCES t1 DEFAULT NULL, h DEFAULT 'text' REFERENCES t1)}}
 
+  sqlite3_test_control SQLITE_TESTCTRL_INTERNAL_FUNCTIONS 1
   do_test fkey2-14.2tmp.1.1 {
     test_rename_parent {CREATE TABLE t1(a REFERENCES t2)} t2 t3
   } {{CREATE TABLE t1(a REFERENCES "t3")}}
   do_test fkey2-14.2tmp.1.2 {
     test_rename_parent {CREATE TABLE t1(a REFERENCES t2)} t4 t3
   } {{CREATE TABLE t1(a REFERENCES t2)}}
   do_test fkey2-14.2tmp.1.3 {
     test_rename_parent {CREATE TABLE t1(a REFERENCES "t2")} t2 t3
   } {{CREATE TABLE t1(a REFERENCES "t3")}}
+  sqlite3_test_control SQLITE_TESTCTRL_INTERNAL_FUNCTIONS 0
   
   # Test ALTER TABLE RENAME TABLE a bit.
   #
   do_test fkey2-14.2tmp.2.1 {
     drop_all_tables
@@ -1148,19 +1152,21 @@
       PRAGMA foreign_keys = on;
       SELECT sql FROM aux.sqlite_master WHERE name='t2';
     }
   } {{CREATE TABLE t2(a, b, c REFERENCES t1, d DEFAULT NULL REFERENCES t1, e REFERENCES t1 DEFAULT NULL, h DEFAULT 'text' REFERENCES t1)}}
 
+  sqlite3_test_control SQLITE_TESTCTRL_INTERNAL_FUNCTIONS 1
   do_test fkey2-14.2aux.1.1 {
     test_rename_parent {CREATE TABLE t1(a REFERENCES t2)} t2 t3
   } {{CREATE TABLE t1(a REFERENCES "t3")}}
   do_test fkey2-14.2aux.1.2 {
     test_rename_parent {CREATE TABLE t1(a REFERENCES t2)} t4 t3
   } {{CREATE TABLE t1(a REFERENCES t2)}}
   do_test fkey2-14.2aux.1.3 {
     test_rename_parent {CREATE TABLE t1(a REFERENCES "t2")} t2 t3
   } {{CREATE TABLE t1(a REFERENCES "t3")}}
+  sqlite3_test_control SQLITE_TESTCTRL_INTERNAL_FUNCTIONS 0
   
   # Test ALTER TABLE RENAME TABLE a bit.
   #
   do_test fkey2-14.2aux.2.1 {
     drop_all_tables

Index: test/fkey8.test
==================================================================
--- test/fkey8.test
+++ test/fkey8.test
@@ -162,6 +162,40 @@
 
 do_catchsql_test 2.3.1 {
   DELETE FROM p3 WHERE a=1
 } {1 {FOREIGN KEY constraint failed}}
 
+
+do_execsql_test 3.0 {
+  PRAGMA foreign_keys=ON;
+  CREATE TABLE t2(
+    a PRIMARY KEY, b, c, d, e,
+      FOREIGN KEY(b, c) REFERENCES t2(d, e)
+  ) WITHOUT ROWID;
+  CREATE UNIQUE INDEX idx ON t2(d, e);
+
+  INSERT INTO t2 VALUES(1, 'one', 'one', 'one', 'one'); -- row is parent of self
+  INSERT INTO t2 VALUES(2, 'one', 'one', 'one', NULL);  -- parent is row 1
+}
+
+do_catchsql_test 3.1 {
+  DELETE FROM t2 WHERE a=1;
+} {1 {FOREIGN KEY constraint failed}}
+
+do_execsql_test 4.0 {
+  CREATE TABLE t1 (
+      c1 PRIMARY KEY,
+      c2 NUMERIC,
+      FOREIGN KEY(c1) REFERENCES t1(c2)
+      ) WITHOUT ROWID ;
+  CREATE INDEX t1c1 ON t1(c1);
+  CREATE UNIQUE INDEX t1c1unique ON t1(c2);
+}
+do_catchsql_test 4.1 {
+  INSERT OR REPLACE INTO t1 VALUES(10000, 20000);
+} {1 {FOREIGN KEY constraint failed}}
+do_execsql_test 4.2 {
+  INSERT OR REPLACE INTO t1 VALUES(20000, 20000);
+}
+
 finish_test
+

Index: test/fts3_common.tcl
==================================================================
--- test/fts3_common.tcl
+++ test/fts3_common.tcl
@@ -41,10 +41,14 @@
 #   fts3_doclist TBL TERM WHERE
 #     Todo.
 #
 #
 #
+
+ifcapable fts3 {
+  sqlite3_fts3_may_be_corrupt 0 
+}
 
 #-------------------------------------------------------------------------
 # USAGE: fts3_build_db_1 SWITCHES N
 #
 # Build a sample FTS table in the database opened by database connection 

Index: test/fts3aa.test
==================================================================
--- test/fts3aa.test
+++ test/fts3aa.test
@@ -248,7 +248,18 @@
 }
 do_execsql_test 9.2 {
   CREATE VIRTUAL TABLE t10 USING fts3(<, b, c);
 }
 
+do_execsql_test 10.0 {
+  CREATE VIRTUAL TABLE z1 USING fts3;
+  INSERT INTO z1 VALUES('one two three'),('four one five'),('six two five');
+  CREATE TRIGGER z1r1 AFTER DELETE ON z1_content BEGIN
+    DELETE FROM z1;
+  END;
+}
+do_catchsql_test 10.1 {
+  DELETE FROM z1;
+} {1 {SQL logic error}}
+
 expand_all_sql db
 finish_test

Index: test/fts3auto.test
==================================================================
--- test/fts3auto.test
+++ test/fts3auto.test
@@ -132,10 +132,11 @@
 }
 
 #    fts3_zero_long_segments TABLE ?LIMIT?
 #
 proc fts3_zero_long_segments {tbl limit} {
+  sqlite3_db_config db DEFENSIVE 0
   execsql " 
     UPDATE ${tbl}_segments 
     SET block = zeroblob(length(block)) 
     WHERE length(block)>$limit
   "

Index: test/fts3aux2.test
==================================================================
--- test/fts3aux2.test
+++ test/fts3aux2.test
@@ -138,7 +138,31 @@
   FROM terms WHERE term>='e' AND term<'seven' AND languageid=2
 } {
   eight * 1 1 2    eight 1 1 1 2 
   five * 1 1 2     five 0 1 1 2 
 }
+
+#-------------------------------------------------------------------------
+do_execsql_test 2.0 {
+  CREATE VIRTUAL TABLE ft USING fts3();
+  INSERT INTO ft VALUES('a_234567890123456789');
+  INSERT INTO ft VALUES('b_234567890123456789');
+  INSERT INTO ft VALUES('c_234567890123456789');
+  CREATE VIRTUAL TABLE t2 USING fts4aux(ft);
+}
+
+do_execsql_test 2.1 {
+  SELECT term FROM t2 WHERE term=X'625f323334353637383930313233343536373839';
+}
+
+do_execsql_test 2.2 {
+  SELECT term FROM t2 WHERE term<X'625f003334353637383930313233343536373839';
+} {
+  234567890123456789 234567890123456789 a a b b
+}
+
+do_execsql_test 2.3 {
+  SELECT term FROM t2 WHERE term=X'625f003334353637383930313233343536373839';
+}
+
 
 finish_test

Index: test/fts3corrupt.test
==================================================================
--- test/fts3corrupt.test
+++ test/fts3corrupt.test
@@ -21,10 +21,11 @@
 
 # Test that a doclist with a length field that indicates that the doclist
 # extends past the end of the node on which it resides is correctly identified
 # as database corruption.
 #
+sqlite3_db_config db DEFENSIVE 0
 do_execsql_test 1.0 {
   CREATE VIRTUAL TABLE t1 USING fts3;
   INSERT INTO t1 VALUES('hello');
 } {}
 do_test fts3corrupt-1.1 {

Index: test/fts3corrupt2.test
==================================================================
--- test/fts3corrupt2.test
+++ test/fts3corrupt2.test
@@ -47,10 +47,11 @@
    "ajfqz aethlgir aclcx aowlyvetby aproqm afjlqtkv anebfy akzrcpfrrvw"
    "aoledfotm aiwlfm aeejlaej anz abgbvk aktfn aayoh anpywgdvgz"
    "acvmldguld asdvz aqb aeomsyzyu aggylhprbdz asrfkwz auipybpsn agsnszzfb"
 }
 
+sqlite3_db_config db DEFENSIVE 0
 do_test fts3corrupt2-1.0 {
   execsql BEGIN
   execsql { CREATE VIRTUAL TABLE t2 USING FTS3(a, b); }
   execsql { INSERT INTO t2(t2) VALUES('nodesize=32') }
   foreach d $data {

Index: test/fts3corrupt3.test
==================================================================
--- test/fts3corrupt3.test
+++ test/fts3corrupt3.test
@@ -31,10 +31,11 @@
   COMMIT;
 }
 do_execsql_test 1.1 {
   SELECT quote(root) from t1_segdir;
 } {X'00036F6E6509010200010200010200'}
+sqlite3_db_config db DEFENSIVE 0
 do_execsql_test 1.2 {
   UPDATE t1_segdir SET root = X'00036F6E650EFFFFFFFFFFFFFFFFFFFFFFFF0200';
 }
 do_catchsql_test 1.3 {
   SELECT rowid FROM t1 WHERE t1 MATCH 'one'

Index: test/fts3corrupt4.test
==================================================================
--- test/fts3corrupt4.test
+++ test/fts3corrupt4.test
@@ -14,17 +14,20 @@
 # $Id: fts3aa.test,v 1.1 2007/08/20 17:38:42 shess Exp $
 #
 
 set testdir [file dirname $argv0]
 source $testdir/tester.tcl
+source $testdir/fts3_common.tcl
 set testprefix fts3corrupt4
 
 # If SQLITE_ENABLE_FTS3 is defined, omit this file.
 ifcapable !fts3 {
   finish_test
   return
 }
+
+sqlite3_fts3_may_be_corrupt 1
 
 do_execsql_test 1.0 {
   BEGIN;
     CREATE VIRTUAL TABLE ft USING fts3;
     INSERT INTO ft VALUES('aback');
@@ -38,10 +41,11 @@
 
 do_execsql_test 1.1 {
   SELECT quote(root) FROM ft_segdir;
 } {X'0005616261636B03010200030266740302020003046E646F6E03030200'}
 
+sqlite3_db_config db DEFENSIVE 0
 do_execsql_test 1.2 {
   UPDATE ft_segdir SET root = blob(
     '0005616261636B03010200 FFFFFFFF0702 66740302020003046E646F6E03030200'
   );
 }
@@ -81,10 +85,11 @@
 do_execsql_test 2.2 {
   SELECT quote(block) FROM ft_segments WHERE blockid=2
 } {X'00056162633130031F0200'}
 
 db func blob blob
+sqlite3_db_config db DEFENSIVE 0
 do_execsql_test 2.3.1 {
   UPDATE ft_segments SET block = 
     blob('00056162633130031F0200 FFFFFFFF07FF55 66740302020003046E646F6E03030200')
     WHERE blockid=2;
 } {}
@@ -131,17 +136,2921 @@
 do_execsql_test 3.1 {
   SELECT quote(root) FROM ft_segdir
 } {X'0101056162633132040136030132030136'}
 
 db func blob blob
+sqlite3_db_config db DEFENSIVE 0
 do_execsql_test 3.2 {
   UPDATE ft_segdir 
   SET root = blob('0101056162633132FFFFFFFF070236030132030136');
 }
 
 do_catchsql_test 3.1 {
   SELECT * FROM ft WHERE ft MATCH 'abc20'
 } {1 {database disk image is malformed}}
 
-finish_test
+#-------------------------------------------------------------------------
+reset_db
+do_execsql_test 4.0 {
+  CREATE VIRTUAL TABLE t1 USING fts3();
+  INSERT INTO t1 VALUES('one two three');
+  UPDATE t1_segdir SET start_block = 1;
+}
+
+do_catchsql_test 4.1 { 
+  SELECT * FROM t1 WHERE t1 MATCH 'one'; 
+} {1 {database disk image is malformed}}
+do_catchsql_test 4.2 { 
+  SELECT * FROM t1 WHERE t1 MATCH 'two'; 
+} {1 {database disk image is malformed}}
+do_catchsql_test 4.3 { 
+  SELECT * FROM t1 WHERE t1 MATCH 'three'; 
+} {1 {database disk image is malformed}}
+do_execsql_test 4.4 {
+  INSERT INTO t1(t1) VALUES('optimize');
+}
+
+#-------------------------------------------------------------------------
+reset_db
+do_test 5.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 24576 pagesize 4096 filename c15.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 00 00 00 00 04   .....@  ........
+|     32: 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 04   ................
+|     48: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00   ................
+|     96: 00 00 00 00 0d 0e f9 00 06 0d ec 00 0f cd 0f 69   ...............i
+|    112: 0f 01 0e 10 0e c6 0d ec 00 00 00 00 00 00 00 00   ................
+|   3552: 00 00 00 00 00 00 00 00 00 00 00 00 22 06 06 17   ................
+|   3568: 11 11 01 31 74 61 62 6c 65 74 32 74 32 06 43 52   ...1tablet2t2.CR
+|   3584: 45 41 54 45 20 54 41 42 4c 45 20 74 32 28 78 29   EATE TABLE t2(x)
+|   3600: 81 33 04 07 17 1f 1f 01 82 35 74 61 62 6c 65 74   .3.......5tablet
+|   3616: 31 5f 73 65 67 64 69 72 74 31 5f 73 65 67 64 69   1_segdirt1_segdi
+|   3632: 72 04 43 52 45 41 54 45 20 54 41 42 4c 45 20 27   r.CREATE TABLE '
+|   3648: 74 31 5f 73 65 67 64 69 72 27 28 6c 65 76 65 6c   t1_segdir'(level
+|   3664: 20 49 4e 54 45 47 45 52 2c 69 64 78 20 49 4e 54    INTEGER,idx INT
+|   3680: 45 47 45 52 2c 73 74 61 72 74 5f 62 6c 6f 63 6b   EGER,start_block
+|   3696: 20 49 4e 54 45 47 45 52 2c 6c 65 61 76 65 73 5f    INTEGER,leaves_
+|   3712: 65 6e 64 5f 62 6c 6f 63 6b 20 49 4e 54 45 47 45   end_block INTEGE
+|   3728: 52 2c 65 6e 64 5f 62 6c 6f 63 6b 20 49 4e 54 45   R,end_block INTE
+|   3744: 47 45 52 2c 72 6f 6f 74 20 42 4c 4f 42 2c 50 52   GER,root BLOB,PR
+|   3760: 49 4d 41 52 59 20 4b 45 59 28 6c 65 76 65 6c 2c   IMARY KEY(level,
+|   3776: 20 69 64 78 29 29 31 05 06 17 45 1f 01 00 69 6e    idx))1...E...in
+|   3792: 64 65 78 73 71 6c 69 74 65 5f 61 75 74 6f 69 6e   dexsqlite_autoin
+|   3808: 64 65 79 5f 74 31 5f 73 65 67 64 69 72 5f 31 74   dey_t1_segdir_1t
+|   3824: 31 5f 73 65 67 64 69 72 05 00 00 00 08 00 00 00   1_segdir........
+|   3840: 00 66 03 07 17 23 23 01 81 13 74 61 62 6c 65 74   .f...##...tablet
+|   3856: 31 5f 73 65 67 6d 65 6e 74 73 74 31 5f 73 65 67   1_segmentst1_seg
+|   3872: 6d 65 6e 74 73 03 43 52 45 41 54 45 20 54 41 42   ments.CREATE TAB
+|   3888: 4c 45 20 27 74 31 5f 73 65 67 6d 65 6e 74 73 27   LE 't1_segments'
+|   3904: 28 62 6c 6f 63 6b 69 64 20 49 4e 54 45 47 45 52   (blockid INTEGER
+|   3920: 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20 62 6c    PRIMARY KEY, bl
+|   3936: 6f 63 6b 20 42 4c 4f 42 29 62 02 07 17 21 21 01   ock BLOB)b...!!.
+|   3952: 81 0f 74 61 62 6c 65 74 31 5f 63 6f 6e 74 65 6e   ..tablet1_conten
+|   3968: 74 74 31 5f 63 6f 6e 74 65 6e 74 02 43 52 45 41   tt1_content.CREA
+|   3984: 54 45 20 54 41 42 4c 45 20 27 74 31 5f 63 6f 6e   TE TABLE 't1_con
+|   4000: 74 65 6e 74 27 28 64 6f 63 69 64 20 49 4e 54 45   tent'(docid INTE
+|   4016: 47 45 52 20 50 52 49 4d 41 52 59 20 4b 45 59 2c   GER PRIMARY KEY,
+|   4032: 20 27 63 30 63 6f 6e 74 65 6e 74 27 29 31 01 06    'c0content')1..
+|   4048: 17 11 11 08 51 74 61 62 6c 65 74 31 74 31 43 52   ....Qtablet1t1CR
+|   4064: 45 41 54 45 20 56 49 52 54 55 41 4c 20 54 41 42   EATE VIRTUAL TAB
+|   4080: 4c 45 20 74 31 20 55 53 49 4e 47 20 66 74 73 33   LE t1 USING fts3
+| page 2 offset 4096
+|      0: 0d 00 00 00 03 0f e0 00 0f f6 0f ec 0f e0 00 00   ................
+|   4064: 0a 03 03 00 1b 61 62 61 6e 64 6f 6e 08 02 03 00   .....abandon....
+|   4080: 17 61 62 61 66 74 08 01 03 00 17 61 62 61 63 6b   .abaft.....aback
+| page 3 offset 8192
+|      0: 0d 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00   ................
+| page 4 offset 12288
+|      0: 0d 00 00 00 01 0f d6 00 0f d6 00 00 00 00 00 00   ................
+|   4048: 00 00 00 00 00 00 28 01 07 08 08 08 08 15 46 30   ......(.......F0
+|   4064: 20 32 39 00 05 61 62 61 63 6b 03 01 02 00 03 02    29..aback......
+|   4080: 66 74 03 02 02 00 03 04 6e 64 6f 60 30 30 20 00   ft......ndo`00 .
+| page 5 offset 16384
+|      0: a0 00 00 00 10 ff b0 00 ff fb 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 00 00 00 00 00 00 00 04 04 08 08 09   ................
+| page 6 offset 20480
+|      0: 0d 00 00 00 05 0f b8 00 0f f4 0f e9 0f d6 0f c7   ................
+|     16: 0f b8 27 74 31 5f 63 6f 6e 74 65 6e 74 27 28 64   ..'t1_content'(d
+|     32: 6f 63 69 64 20 49 4e 54 45 47 45 52 20 50 52 49   ocid INTEGER PRI
+|     48: 4d 41 52 59 20 4b 45 59 2c 20 27 63 30 63 6f 6e   MARY KEY, 'c0con
+|     64: 74 65 6e 74 27 29 31 01 06 17 11 11 08 51 74 61   tent')1......Qta
+|     80: 62 6c 65 74 31 74 31 43 52 45 41 54 45 20 56 49   blet1t1CREATE VI
+|     96: 52 54 55 41 4c 20 54 41 42 4c 45 20 74 31 20 55   RTUAL TABLE t1 U
+|    112: 53 49 4e 47 20 66 74 73 33 0d 00 00 00 03 0f e0   SING fts3.......
+|    128: 00 0f f6 0f ec 0f e0 00 00 00 00 00 00 00 00 00   ................
+|   4016: 00 00 00 00 00 00 00 00 0d 05 02 23 61 75 74 6f   ...........#auto
+|   4032: 6d 65 72 67 65 3d 35 0d 04 02 23 6d 65 72 67 65   merge=5...#merge
+|   4048: 3d 31 30 30 2c 38 11 03 02 2b 69 6e 74 65 67 72   =100,8...+integr
+|   4064: 69 74 79 2d 63 68 65 63 6b 09 02 02 1b 72 65 62   ity-check....reb
+|   4080: 75 69 6c 64 0a 01 02 1d 6f 70 74 69 6d 69 7a 65   uild....optimize
+| end c15.db
+}]} {}
+
+do_catchsql_test 5.1 {
+  SELECT * FROM t1 WHERE t1 MATCH 'abandon';
+} {1 {malformed database schema (sqlite_autoindey_t1_segdir_1) - orphan index}}
+
+
+#-------------------------------------------------------------------------
+reset_db
+database_may_be_corrupt
+do_execsql_test 6.0 {
+  CREATE VIRTUAL TABLE Table0 USING fts3();
+  INSERT INTO Table0_segdir VALUES(1,NULL,1,NULL,NULL,NULL);
+}
+
+do_catchsql_test 6.1 {
+  SELECT * FROM Table0 WHERE Table0 MATCH 'a';
+} {0 {}}
+
+do_catchsql_test 6.2 {
+  INSERT INTO Table0(Table0) VALUES('optimize');
+} {0 {}}
+
+#-------------------------------------------------------------------------
+reset_db
+do_test 7.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 32768 pagesize 4096 filename crash-04bb6e7c811ce9.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 00 00 00 00 07   .....@  ........
+|     32: 00 00 00 00 00 00 00 00 00 00 00 06 00 00 00 04   ................
+|     48: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00   ................
+|     96: 00 00 00 00 0d 0e ef 00 07 0d 4d 00 0f bd 0f 5f   ..........M...._
+|    112: 0e f7 0e 06 0e bc 0d a4 0d 4d 00 00 00 00 00 00   .........M......
+|   3392: 00 00 00 00 00 00 00 00 00 00 00 00 00 55 07 07   .............U..
+|   3408: 17 1b 1b 01 81 01 74 61 62 6c 65 74 31 5f 73 74   ......tablet1_st
+|   3424: 61 74 74 31 5f 73 74 61 74 07 43 52 45 41 54 45   att1_stat.CREATE
+|   3440: 20 54 41 42 4c 45 20 27 74 31 5f 73 74 61 74 27    TABLE 't1_stat'
+|   3456: 28 69 64 20 49 4e 54 45 47 45 52 20 50 52 49 4d   (id INTEGER PRIM
+|   3472: 41 52 59 20 4b 45 59 2c 20 76 61 6c 75 65 20 42   ARY KEY, value B
+|   3488: 4c 4f 42 29 60 06 07 17 21 21 01 81 0b 74 61 62   LOB)`...!!...tab
+|   3504: 6c 65 74 31 5f 64 6f 63 73 69 7a 65 74 31 5f 64   let1_docsizet1_d
+|   3520: 6f 63 73 69 7a 65 06 43 52 45 41 54 45 20 54 41   ocsize.CREATE TA
+|   3536: 42 4c 45 20 27 74 31 5f 64 6f 63 73 69 7a 65 27   BLE 't1_docsize'
+|   3552: 28 64 6f 63 69 64 20 49 4e 54 45 47 45 52 20 50   (docid INTEGER P
+|   3568: 52 49 4d 41 52 59 20 4b 45 59 2c 20 73 69 7a 65   RIMARY KEY, size
+|   3584: 20 42 4c 4f 42 29 81 33 04 07 17 1f 1f 01 82 35    BLOB).3.......5
+|   3600: 74 61 62 6c 65 74 31 5f 73 65 67 64 69 72 74 31   tablet1_segdirt1
+|   3616: 5f 73 65 67 64 69 72 04 43 52 45 41 54 45 20 54   _segdir.CREATE T
+|   3632: 41 42 4c 45 20 27 74 31 5f 73 65 67 64 69 72 27   ABLE 't1_segdir'
+|   3648: 28 6c 65 76 65 6c 20 49 4e 54 45 47 45 52 2c 69   (level INTEGER,i
+|   3664: 64 78 20 49 4e 54 45 47 45 52 2c 73 74 61 72 74   dx INTEGER,start
+|   3680: 5f 62 6c 6f 63 6b 20 49 4e 54 45 47 45 52 2c 6c   _block INTEGER,l
+|   3696: 65 61 76 65 73 5f 65 6e 64 5f 62 6c 6f 63 6b 20   eaves_end_block 
+|   3712: 49 4e 54 45 47 45 52 2c 65 6e 64 5f 62 6c 6f 63   INTEGER,end_bloc
+|   3728: 6b 20 49 4e 54 45 47 45 52 2c 72 6f 6f 74 20 42   k INTEGER,root B
+|   3744: 4c 4f 42 2c 50 52 49 4d 41 52 59 20 4b 45 59 28   LOB,PRIMARY KEY(
+|   3760: 6c 65 76 65 6c 2c 20 69 64 78 29 29 31 05 06 17   level, idx))1...
+|   3776: 45 1f 01 00 69 6e 64 65 78 73 71 6c 69 74 65 5f   E...indexsqlite_
+|   3792: 61 75 74 6f 69 6e 64 65 78 5f 74 31 5f 73 65 67   autoindex_t1_seg
+|   3808: 64 69 72 5f 31 74 31 5f 73 65 67 64 69 72 05 00   dir_1t1_segdir..
+|   3824: 00 00 08 00 00 00 00 66 03 07 17 23 23 01 81 13   .......f...##...
+|   3840: 74 61 62 6c 65 74 31 5f 73 65 67 6d 65 6e 74 73   tablet1_segments
+|   3856: 74 31 5f 73 65 67 6d 65 6e 74 73 03 43 52 45 41   t1_segments.CREA
+|   3872: 54 45 20 54 41 42 4c 45 20 27 74 31 5f 73 65 67   TE TABLE 't1_seg
+|   3888: 6d 65 6e 74 73 27 28 62 6c 6f 63 6b 69 64 20 49   ments'(blockid I
+|   3904: 4e 54 45 47 45 52 20 50 52 49 4d 41 52 59 20 4b   NTEGER PRIMARY K
+|   3920: 45 59 2c 20 62 6c 6f 63 6b 20 42 4c 4f 42 29 5c   EY, block BLOB).
+|   3936: 02 07 17 21 21 01 81 03 74 61 62 6c 65 74 31 5f   ...!!...tablet1_
+|   3952: 63 6f 6e 74 65 6e 74 74 31 5f 63 6f 6e 74 65 6e   contentt1_conten
+|   3968: 74 02 43 52 45 41 54 45 20 54 41 42 4c 45 20 27   t.CREATE TABLE '
+|   3984: 74 31 5f 63 6f 6e 74 65 6e 74 27 28 64 6f 63 69   t1_content'(doci
+|   4000: 64 20 49 4e 54 45 47 45 52 20 50 52 49 4d 41 52   d INTEGER PRIMAR
+|   4016: 59 20 4b 45 59 2c 20 27 63 30 61 27 29 41 01 06   Y KEY, 'c0a')A..
+|   4032: 17 11 11 08 71 74 61 62 6c 65 74 31 74 31 43 52   ....qtablet1t1CR
+|   4048: 45 41 54 45 20 56 49 52 54 55 41 4c 20 54 41 42   EATE VIRTUAL TAB
+|   4064: 4c 45 20 74 31 20 55 53 49 4e 47 20 66 74 73 34   LE t1 USING fts4
+|   4080: 28 61 2c 70 72 65 66 69 78 3d 27 31 2c 32 27 29   (a,prefix='1,2')
+| page 2 offset 4096
+|      0: 0d 00 00 00 08 0e 1f 00 0f c4 0f 7c 0f 34 0f 07   ...........|.4..
+|     16: 0e c3 0e 97 0e 63 0e 1f 00 00 00 00 00 00 00 00   .....c..........
+|   3600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 42   ...............B
+|   3616: 08 04 00 81 09 73 75 6e 74 20 69 6e 20 63 75 6c   .....sunt in cul
+|   3632: 70 61 20 71 75 69 20 6f 66 66 69 63 69 61 20 64   pa qui officia d
+|   3648: 65 73 65 72 75 6e 74 20 6d 6f 6c 6c 69 74 20 61   eserunt mollit a
+|   3664: 6e 69 6d 20 69 64 20 65 73 74 20 6c 61 62 6f 72   nim id est labor
+|   3680: 75 6d 2e 32 07 03 00 6b 45 78 63 65 70 74 65 75   um.2...kExcepteu
+|   3696: 72 20 73 69 6e 74 20 6f 63 63 61 65 63 67 42 06   r sint occaecgB.
+|   3712: 37 57 06 96 46 17 46 17 42 06 e6 f6 e2 07 07 26   7W..F.F.B......&
+|   3728: f6 96 46 56 e7 42 c2 a0 60 30 05 b6 36 96 c6 c7   ..FV.B..`0..6...
+|   3744: 56 d2 06 46 f6 c6 f7 26 52 06 57 52 06 67 56 7c   V..F...&R.WR.gV|
+|   3760: 65 3f 04 20 6e 75 6c 6c 61 20 70 61 72 69 61 74   e?. nulla pariat
+|   3776: 75 72 2e 42 05 04 00 81 09 44 75 69 73 20 61 75   ur.B.....Duis au
+|   3792: 74 65 20 69 72 75 72 65 20 64 6f 6c 6f 72 20 69   te irure dolor i
+|   3808: 6e 20 72 65 70 72 65 68 65 6e 64 65 72 69 74 20   n reprehenderit 
+|   3824: 69 6e 20 76 6f 6c 75 70 74 61 74 65 20 76 65 6c   in voluptate vel
+|   3840: 69 74 20 65 73 73 65 2b 04 03 00 5d 6e 69 73 69   it esse+...]nisi
+|   3856: 20 75 74 20 61 6c 69 71 75 69 70 20 65 78 20 65    ut aliquip ex e
+|   3872: 61 20 63 6f 6d 6d 6f 64 6f 20 63 6f 6e 73 65 71   a commodo conseq
+|   3888: 75 61 74 2e 46 03 04 00 81 11 55 74 20 65 6e 69   uat.F.....Ut eni
+|   3904: 6d 20 61 64 20 6d 69 6e 69 6d 20 76 65 6e 69 61   m ad minim venia
+|   3920: 6d 2c 20 71 75 69 73 20 6e 6f 73 74 72 75 64 20   m, quis nostrud 
+|   3936: 65 78 65 72 63 69 74 61 74 69 6f 6e 20 75 6c 6c   exercitation ull
+|   3952: 61 6d 63 6f 20 6c 61 62 6f 72 69 73 46 02 04 00   amco laborisF...
+|   3968: 81 11 73 65 64 20 64 6f 20 65 69 75 73 6d 6f 64   ..sed do eiusmod
+|   3984: 20 74 65 6d 70 6f 72 20 69 6e 63 69 64 69 64 75    tempor incididu
+|   4000: 6e 74 20 75 74 20 6c 61 62 6f 72 65 20 65 74 20   nt ut labore et 
+|   4016: 64 6f 6c 6f 72 65 20 6d 61 67 6e 61 20 61 6c 69   dolore magna ali
+|   4032: 71 75 61 2e 3a 01 03 00 7b 4c 6f 72 65 6d 20 69   qua.:....Lorem i
+|   4048: 70 73 75 6d 20 64 6f 6c 6f 72 20 73 69 72 12 29   psum dolor sir.)
+|   4064: 0d 65 74 2c 20 63 6f 6e 73 65 63 74 65 74 75 72   .et, consectetur
+|   4080: 20 61 64 69 70 69 73 63 69 6e 67 20 65 6c 69 74    adipiscing elit
+| page 3 offset 8192
+|      0: 0d 00 00 00 00 10 30 00 10 17 50 30 80 20 00 00   ......0...P0. ..
+|     16: 27 46 50 30 20 50 00 00 27 56 c0 30 30 a0 00 10   'FP0 P..'V.00...
+|     32: 17 40 90 20 70 00 10 20 00 10 30 00 00 27 66 50   .@. p.. ..0..'fP
+|     48: 60 30 60 00 20 a0 00 10 16 f0 30 50 90 08 20 a0   `0`. .....0P.. .
+|     64: 20 80 20 80 80 81 78 40 20 40 03 02 03 23 53 10    . ...x@ @...#S.
+|     80: 00 16 11 30 10 60 40 00 10 c0 00 10 40 00 00 00   ...0.`@.....@...
+|     96: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 24   ..............x$
+|    112: 41 71 83 37 10 27 97 60 10 40 00 00 16 41 10 10   Aq.7.'.`.@...A..
+|    128: 40 00 10 30 90 00 30 20 50 00 10 30 00 20 70 00   @..0..0 P..0. p.
+|    144: 00 16 51 b0 10 90 00 10 40 70 00 10 30 80 00 10   ..Q.....@p..0...
+|    160: 50 30 00 10 b0 00 10 40 00 10 20 00 10 b0 00 00   P0.....@.. .....
+|    176: 16 60 30 60 50 00 00 16 90 f0 10 30 00 10 60 00   .`0`P......0..`.
+|    192: 30 40 40 40 00 30 30 90 00 00 16 c0 c0 10 20 00   0@@@.00....... .
+|    208: 10 80 00 10 b0 00 50 c0 00 00 16 d0 90 20 b0 00   ......P...... ..
+|    224: 10 50 00 50 80 00 00 16 e0 c0 30 80 00 10 20 00   .P.P......0... .
+|    240: 20 60 00 10 60 00 00 16 f0 60 70 40 00 10 60 00    `..`....`p@..`.
+|    256: 00 17 00 60 60 70 00 10 70 00 00 17 10 60 30 70   ...``p..p....`0p
+|    272: 00 50 50 00 00 17 20 30 50 70 00 00 17 30 c0 10   .PP... 0Pp...0..
+|    288: 50 00 10 20 00 50 30 00 10 20 00 00 17 40 30 20   P.. .P0.. ...@0 
+|    304: 50 00 00 17 50 a0 20 70 00 10 20 a0 00 10 30 00   P...P. p.. ...0.
+|    320: 00 17 60 70 30 60 00 20 90 30 08 52 60 10 80 80   ..`p0`. .0.R`...
+|    336: 80 80 81 78 a3 e3 02 03 63 63 50 00 26 16 40 30   ...x....ccP.&.@0
+|    352: 30 40 00 20 86 97 06 97 36 36 96 e6 70 30 10 80   0@. ....66..p0..
+|    368: 00 10 56 c6 97 17 56 10 30 20 c0 00 50 26 97 00   ..V...V.0 ..P&..
+|    384: 30 40 40 00 10 36 d6 57 40 30 10 60 00 10 36 e6   0@@..6.W@0.`..6.
+|    400: 96 d0 30 80 90 00 10 37 57 46 50 30 50 30 00 00   ..0....7WFP0P0..
+|    416: 66 36 96 c6 c7 56 d0 30 60 20 00 10 66 f6 d6 d6   f6...V.0` ..f...
+|    432: f6 46 f0 30 40 70 00 20 96 e7 36 56 37 46 57 47   .F.0@p. ..6V7FWG
+|    448: 57 20 30 10 70 00 50 47 17 56 17 40 30 40 80 00   W 0.p.PG.V.@0@..
+|    464: 10 47 56 c7 06 10 30 80 40 00 20 77 06 96 46 17   .GV...0.@. w..F.
+|    480: 46 17 40 30 70 50 00 00 86 46 57 36 57 27 56 e7   F.@0pP...FW6W'V.
+|    496: 40 30 80 70 00 10 16 f0 30 20 30 00 20 36 c6 f7   @0.p....0 0. 6..
+|    512: 20 60 10 40 00 40 50 00 50 16 50 60 20 a0 00 40    `.@.@P.P.P` ..@
+|    528: 30 00 10 37 56 97 30 30 50 20 00 00 26 56 10 30   0..7V.00P ..&V.0
+|    544: 40 60 00 10 66 97 57 36 d6 f6 40 30 20 40 00 10   @`..f.W6..@0 @..
+|    560: 36 c6 97 40 30 10 90 00 15 35 14 c6 97 46 52 06   6..@0....5...FR.
+|    576: 66 f7 26 d6 17 42 03 30 01 00 00 10 10 04 02 02   f.&..B.0........
+|    592: 00 00 00 00 00 00 00 00 70 00 00 00 00 00 00 00   ........p.......
+|    608: 00 00 00 00 60 00 00 00 40 00 00 00 00 00 00 00   ....`...@.......
+| page 4 offset 12288
+|      0: 0d 00 00 00 03 0a a6 00 0d 57 0c 4a 0a a6 00 00   .........W.J....
+|   2720: 00 00 00 00 00 00 83 21 03 08 02 08 08 08 17 86   .......!........
+|   2736: 30 08 00 30 20 34 30 32 00 02 61 64 06 01 08 00   0..0 402..ad....
+|   2752: 02 04 00 01 01 6c 06 02 0c 00 02 04 00 01 01 6d   .....l.........m
+|   2768: 03 01 06 00 01 01 6e 03 08 00 00 91 01 75 03 05   ......n......u..
+|   2784: 03 00 00 02 63 69 03 06 02 00 01 01 6f 07 01 07   ....ci......o...
+|   2800: 00 03 07 03 00 01 01 75 06 07 05 00 01 04 00 00   .......u........
+|   2816: 02 64 65 03 08 07 00 01 01 6f 0d 01 04 00 01 03   .de......o......
+|   2832: 09 00 03 05 00 01 03 00 01 01 75 03 05 02 00 00   ..........u.....
+|   2848: 02 65 61 03 04 06 00 01 01 69 03 02 04 00 01 01   .ea......i......
+|   2864: 6c 03 01 09 00 01 01 6e 30 03 03 00 01 01 73 06   l......n0.....s.
+|   2880: 05 0b 00 03 0b 00 01 01 74 03 02 09 00 01 01 75   ........t......u
+|   2896: 03 06 04 00 01 01 78 09 03 09 00 01 05 00 03 02   ......x.........
+|   2912: 00 00 02 66 75 03 06 05 00 00 02 69 64 03 08 0a   ...fu......id...
+|   2928: 00 01 01 6e 0a 02 06 00 03 06 04 00 03 03 00 01   ...n............
+|   2944: 01 70 03 01 03 00 01 01 72 03 05 04 00 00 02 6c   .p......r......l
+|   2960: 61 09 02 08 00 01 0b 00 05 0c 00 01 01 6f 03 01   a............o..
+|   2976: 02 00 00 02 6d 61 03 02 0b 00 01 01 69 03 03 05   ....ma......i...
+|   2992: 00 01 01 6f 03 08 08 00 00 02 6e 69 03 04 02 00   ...o......ni....
+|   3008: 01 01 6f 06 03 08 00 04 06 00 01 01 75 03 06 06   ..o.........u...
+|   3024: 00 00 02 6f 63 03 07 04 00 01 01 66 03 08 06 00   ...oc......f....
+|   3040: 00 02 70 61 03 06 07 00 01 01 72 03 07 07 00 00   ..pa......r.....
+|   3056: 02 71 75 06 03 07 00 05 05 00 00 02 72 65 03 05   .qu.........re..
+|   3072: 07 00 00 02 73 65 03 02 02 00 01 01 69 06 01 05   ....se......i...
+|   3088: 00 06 03 00 01 01 75 03 08 02 00 00 02 74 65 03   ......u......te.
+|   3104: 02 05 00 00 02 75 6c 03 03 0a 00 01 01 74 09 02   .....ul......t..
+|   3120: 07 00 01 02 00 01 03 00 00 02 76 65 06 03 06 00   ..........ve....
+|   3136: 02 0a 00 01 01 6f 03 05 09 00 82 0a 02 08 02 08   .....o..........
+|   3152: 08 08 17 84 02 04 00 30 20 32 35 31 00 01 61 13   .......0 251..a.
+|   3168: 01 06 04 00 01 0c 00 01 04 00 01 04 00 01 03 00   ................
+|   3184: 03 09 00 00 01 63 10 01 07 00 03 07 03 00 02 02   .....c..........
+|   3200: 00 01 05 00 01 04 00 00 01 64 11 01 04 00 01 03   .........d......
+|   3216: 09 00 03 02 05 00 01 03 00 02 07 00 00 01 65 1b   ..............e.
+|   3232: 01 09 00 01 04 01 70 00 03 01 80 00 05 03 00 01   ......p.........
+|   3248: 0b 00 01 04 00 01 02 00 01 0b 00 00 01 66 03 06   .............f..
+|   3264: 05 00 00 01 69 0f 01 03 00 01 06 00 03 04 04 04   ....i...........
+|   3280: 00 03 03 09 00 00 01 6c 0c 01 02 00 01 08 00 01   .......l........
+|   3296: 0b 00 05 0c 00 00 01 6d 09 02 0b 00 01 05 00 05   .......m........
+|   3312: 08 00 00 01 6e 0c 03 08 00 01 02 00 02 06 00 01   ....n...........
+|   3328: 06 00 00 01 6f 06 07 04 00 01 06 00 00 01 70 06   ....o.........p.
+|   3344: 06 07 00 01 07 00 00 01 71 06 03 07 00 05 05 00   ........q.......
+|   3360: 00 01 72 03 05 07 00 00 01 73 0c 01 05 00 01 02   ..r......s......
+|   3376: 00 05 03 00 01 02 00 00 01 74 03 02 05 00 00 01   .........t......
+|   3392: 75 0a 02 07 00 01 02 0a 00 01 03 00 00 01 76 07   u.............v.
+|   3408: 03 06 00 02 09 03 00 85 26 01 08 08 08 08 08 17   ........&.......
+|   3424: 8a 3e 30 20 36 36 35 00 02 61 64 03 03 04 00 02   .>0 665..ad.....
+|   3440: 08 69 70 69 73 63 69 6e 67 03 01 08 00 01 05 6c   .ipiscing......l
+|   3456: 69 71 75 61 03 02 0c 00 05 02 69 70 03 04 04 00   iqua......ip....
+|   3472: 01 03 6d 65 74 03 01 06 00 01 03 6e 69 6d 03 08   ..met......nim..
+|   3488: 09 00 01 03 75 74 65 03 05 03 00 00 06 63 69 6c   ....ute......cil
+|   3504: 6c 75 6d 03 06 02 00 01 06 6f 6d 6d 6f 64 6f 03   lum......ommodo.
+|   3520: 04 07 00 02 09 6e 73 65 63 74 65 74 75 72 03 01   .....nsectetur..
+|   3536: 07 00 05 04 71 75 61 74 03 04 08 00 01 04 75 6c   ....quat......ul
+|   3552: 70 61 03 08 04 00 02 07 70 69 64 61 74 61 74 03   pa......pidatat.
+|   3568: 07 05 00 00 08 64 65 73 65 72 75 6e 74 03 08 07   .....deserunt...
+|   3584: 00 01 01 6f 03 02 03 00 02 03 6c 6f 72 06 01 04   ...o......lor...
+|   3600: 00 04 05 00 05 01 65 06 02 0a 00 04 03 00 01 03   ......e.........
+|   3616: 75 69 73 03 05 02 00 00 02 65 61 03 04 06 00 01   uis......ea.....
+|   3632: 06 69 75 73 6d 6f 64 03 02 04 00 01 03 6c 69 74   .iusmod......lit
+|   3648: 03 01 09 00 01 03 6e 69 6d 03 03 03 00 01 03 73   ......nim......s
+|   3664: 73 65 03 05 0b 00 02 01 74 03 08 0b 00 01 01 74   se......t......t
+|   3680: 03 02 09 00 01 01 75 03 06 04 00 01 01 78 03 04   ......u......x..
+|   3696: 05 00 02 07 63 65 70 74 65 75 72 03 07 02 00 02   ....cepteur.....
+|   3712: 0a 65 72 63 69 74 61 74 69 6f 6e 03 03 09 00 00   .ercitation.....
+|   3728: 06 66 75 67 69 61 74 03 06 05 00 00 02 69 64 03   .fugiat......id.
+|   3744: 08 0a 00 01 01 6e 07 05 06 04 00 03 03 00 02 08   .....n..........
+|   3760: 63 69 64 69 64 75 6e 74 03 02 06 00 01 04 70 73   cididunt......ps
+|   3776: 75 6d 03 01 03 00 01 04 72 75 72 65 03 05 04 00   um......rure....
+|   3792: 00 06 6c 61 62 6f 72 65 03 02 08 00 05 02 69 73   ..labore......is
+|   3808: 03 03 0b 00 05 02 75 6d 03 08 0c 00 01 04 6f 72   ......um......or
+|   3824: 65 6d 03 01 02 00 00 05 6d 61 67 6e 61 03 02 0b   em......magna...
+|   3840: 00 01 04 69 6e 69 6d 03 03 05 00 01 05 6f 6c 6c   ...inim......oll
+|   3856: 69 74 03 08 08 00 00 04 6e 69 73 69 03 04 02 00   it......nisi....
+|   3872: 01 02 6f 6e 03 07 06 00 02 05 73 74 72 75 64 03   ..on......strud.
+|   3888: 03 08 00 01 04 75 6c 6c 61 03 06 06 00 00 08 6f   .....ulla......o
+|   3904: 63 63 61 65 63 61 74 03 07 04 00 01 06 66 66 69   ccaecat......ffi
+|   3920: 63 69 61 03 08 06 00 00 08 70 61 72 69 61 74 75   cia......pariatu
+|   3936: 72 03 06 07 00 01 07 72 6f 69 64 65 6e 74 03 07   r......roident..
+|   3952: 07 00 00 03 71 75 69 03 08 05 00 03 01 73 03 03   ....qui......s..
+|   3968: 07 00 00 0d 72 65 70 72 65 68 65 6e 64 65 72 69   ....reprehenderi
+|   3984: 74 03 05 07 00 00 03 73 65 64 03 02 02 00 01 03   t......sed......
+|   4000: 69 6e 74 03 07 03 00 02 01 74 03 01 05 00 01 03   int......t......
+|   4016: 75 6e 74 03 08 02 00 00 06 74 65 6d 70 6f 72 03   unt......tempor.
+|   4032: 02 05 00 00 07 75 6c 6c 61 6d 63 6f 03 03 0a 00   .....ullamco....
+|   4048: 01 01 74 09 02 07 00 01 02 00 01 03 00 00 05 76   ..t............v
+|   4064: 65 6c 69 74 03 05 0a 00 02 04 6e 69 61 6d 03 03   elit......niam..
+|   4080: 06 00 01 08 6f 6c 75 70 74 61 74 65 03 05 09 00   ....oluptate....
+| page 5 offset 16384
+|      0: 0a 00 00 00 03 0f eb 00 0f fb 0f f3 0f eb 00 00   ................
+|   4064: 00 00 00 00 00 00 00 00 00 00 00 07 04 02 08 01   ................
+|   4080: 08 00 03 07 04 02 08 01 04 00 02 04 04 08 08 09   ................
+| page 6 offset 20480
+|      0: 0d 00 00 00 08 0f d0 00 0f fa 0f f4 0f ee 0f e8   ................
+|     16: 0f e2 0f dc 0f d6 0f d0 00 00 00 00 00 00 00 00   ................
+|   4048: 04 08 03 00 0e 0b 04 07 03 00 0e 06 04 06 03 00   ................
+|   4064: 0e 06 04 05 03 00 0e 0a 04 04 03 00 0e 07 04 03   ................
+|   4080: 03 00 0e 0a 04 02 03 00 0e 0b 04 01 03 00 0e 08   ................
+| page 7 offset 24576
+|      0: 0d 00 00 00 01 0f f7 00 0f f7 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 00 00 00 07 00 03 00 14 08 45 b5 03   .............E..
+| page 8 offset 28672
+|      0: 6f ee cd e1 f1 ee 1a ca be ed ee ec de ac f1 cb   o...............
+|     16: f1 ee 1a ce de ee f1 ee 0a cc de ed ae 90 87 88   ................
+|     32: ec 5e dc ec fc 11 72 32 75 0a da be ec ed eb de   .^....r2u.......
+|     48: ce c1 aa e0 ae ec 1f c1 ee 99 c2 aa e0 a9 ad 15   ................
+|     64: 0e ec ab ef 1e e0 48 ad 15 04 24 80 00 00 00 00   ......H...$.....
+|     80: 00 00 00 00 e0 00 00 00 04 2c 80 00 10 42 4e c1   .........,...BN.
+|     96: 20 4b 45 59 2c 6e 6f 64 65 6e 6f 2c 61 30 29 46    KEY,nodeno,a0)F
+|    112: 02 06 17 11 11 08 7b 74 61 62 6c 65 74 31 74 31   .......tablet1t1
+|    128: 43 52 45 41 54 e1 ec eb ea eb eb ac ee ce be de   CREAT...........
+|    144: ee f1 ee 1a ca ba de 47 80 30 00 14 90 47 70 30   .......G.0...Gp0
+|    160: 00 11 60 47 60 30 00 15 f0 47 50 30 00 10 f0 47   ..`G`0...GP0...G
+|    176: 40 30 00 11 f0 47 45 20 30 00 11 d0 45 10 30 00   @0...GE 0...E.0.
+|    192: 12 10 45 00 30 00 14 e0 44 f0 30 00 11 e0 44 e0   ..E.0...D.0...D.
+|    208: 30 00 12 a0 44 d0 30 00 15 e0 44 c0 30 00 10 40   0...D.0...D.0..@
+|    224: 44 b0 30 00 15 10 44 a0 30 00 14 c0 44 90 30 00   D.0...D.0...D.0.
+|    240: 16 20 44 80 30 00 52 45 41 54 45 20 54 41 42 4c   . D.0.REATE TABL
+|    256: 45 20 27 74 31 5f 63 6f 6e 74 65 6e 74 27 28 69   E 't1_content'(i
+|    272: 64 20 49 4e 54 45 47 45 52 20 50 52 49 4d 41 52   d INTEGER PRIMAR
+|    288: 59 20 4b 45 59 2c 20 63 30 29 69 03 07 17 19 19   Y KEY, c0)i.....
+|    304: 01 81 2d 74 61 62 6c 65 74 31 5f 69 64 78 74 31   ..-tablet1_idxt1
+|    320: 5f 69 64 78 03 43 52 45 41 54 45 20 54 41 42 4c   _idx.CREATE TABL
+|    336: 45 20 27 70 31 5f 69 64 78 03 6e 69 6d 03 03 03   E 'p1_idx.nim...
+|    352: 00 01 03 73 73 65 03 05 0b 00 02 01 74 03 08 0b   ...sse......t...
+|    368: 00 01 01 74 03 02 09 00 01 01 75 03 06 04 00 01   ...t......u.....
+|    384: 01 78 03 04 05 00 02 07 63 65 70 74 65 75 72 03   .x......cepteur.
+|    400: 07 02 00 02 0a 65 72 63 69 74 61 74 69 6f 6e 03   .....ercitation.
+|    416: 03 09 00 00 06 66 75 67 69 61 74 03 06 05 00 00   .....fugiat.....
+|    432: 02 69 64 03 08 0a 00 01 01 6e 07 05 06 04 00 03   .id......n......
+|    448: 03 00 02 08 63 69 64 69 64 75 6e 74 03 02 06 00   ....cididunt....
+|    464: 01 04 70 73 75 6d 03 01 03 00 01 04 72 75 72 65   ..psum......rure
+|    480: 03 05 04 00 00 06 6c 61 62 6f 72 65 03 02 08 00   ......labore....
+|    496: 05 02 69 73 03 03 0b 00 05 02 75 6d 03 08 0c 00   ..is......um....
+|    512: 01 04 6f 72 65 6d 03 01 02 00 00 05 6d 61 67 6e   ..orem......magn
+|    528: 61 03 02 0b 00 01 04 69 6e 69 6d 03 03 05 00 01   a......inim.....
+|    544: 05 6f 6c 6c 69 74 03 08 08 00 00 04 6e 69 73 69   .ollit......nisi
+|    560: 03 04 02 00 01 02 6f 6e 03 07 06 00 02 05 73 74   ......on......st
+|    576: 72 75 64 03 03 08 00 01 04 75 6c 6c 61 03 06 06   rud......ulla...
+|    592: 00 00 08 6f 63 63 61 65 63 61 74 03 07 04 00 01   ...occaecat.....
+|    608: 06 66 66 69 63 69 61 03 08 06 00 00 08 70 61 72   .fficia......par
+|    624: 69 61 74 75 72 03 06 07 00 01 07 72 6f ed ce de   iatur......ro...
+|    640: 69 64 65 6e 74 03 07 07 00 00 03 71 75 69 03 08   ident......qui..
+|    656: 05 00 03 01 73 03 03 07 00 00 0d 72 65 70 72 65   ....s......repre
+|    672: 68 65 6e 64 65 72 69 74 03 05 07 00 00 03 73 65   henderit......se
+|    688: 64 03 02 02 00 01 03 69 6e 74 03 07 03 00 02 01   d......int......
+|    704: 74 03 01 05 00 01 03 75 6e 74 03 08 02 00 00 06   t......unt......
+|    720: 74 65 6d 70 6f 72 03 02 05 00 00 07 75 6c 6c 61   tempor......ulla
+|    736: 6d 63 6f 03 03 0a 00 01 01 74 09 02 07 00 01 02   mco......t......
+|    752: 00 01 03 00 00 05 76 65 6c 69 74 03 05 0a 00 02   ......velit.....
+|    768: 04 6e 69 61 6d 03 03 06 00 01 08 6f 6c 75 70 74   .niam......olupt
+|    784: 61 74 65 03 05 09 00 0a 00 00 00 03 0f eb 00 0f   ate.............
+|    800: fb 0f f3 0f eb 00 00 00 00 00 00 00 00 00 00 00   ................
+| end crash-04bb6e7c811ce9.db
+}]} {}
+
+do_catchsql_test 7.1 {
+  SELECT matchinfo(t1,'y') FROM t1 WHERE t1 MATCH 'e*';
+} {1 {database disk image is malformed}}
+
+#-------------------------------------------------------------------------
+reset_db
+do_test 8.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 28672 pagesize 4096 filename crash-7948058d822acb.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 00 00 00 00 07   .....@  ........
+|     32: 00 00 00 00 00 00 00 00 00 00 00 06 00 00 00 04   ................
+|     48: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00   ................
+|     96: 00 00 00 00 0d 0e ef 00 07 0d 4d 00 0f bd 0f 5f   ..........M...._
+|    112: 0e f7 0e 06 0e bc 0d a4 0d 4d 00 00 00 00 00 00   .........M......
+|   3392: 00 00 00 00 00 00 00 00 00 00 00 00 00 55 07 07   .............U..
+|   3408: 17 1b 1b 01 81 01 74 61 62 6c 65 74 31 5f 73 74   ......tablet1_st
+|   3424: 61 74 74 31 5f 73 74 61 74 07 43 52 45 41 54 45   att1_stat.CREATE
+|   3440: 20 54 41 42 4c 45 20 27 74 31 5f 73 74 61 74 27    TABLE 't1_stat'
+|   3456: 28 69 64 20 49 4e 54 45 47 45 52 20 50 52 49 4d   (id INTEGER PRIM
+|   3472: 41 52 59 20 4b 45 59 2c 20 76 61 6c 75 65 20 42   ARY KEY, value B
+|   3488: 4c 4f 42 29 60 06 07 17 21 21 01 81 0b 74 61 62   LOB)`...!!...tab
+|   3504: 6c 65 74 31 5f 64 6f 63 73 69 7a 65 74 31 5f 64   let1_docsizet1_d
+|   3520: 6f 63 73 69 7a 65 06 43 52 45 41 54 45 20 54 41   ocsize.CREATE TA
+|   3536: 42 4c 45 20 27 74 31 5f 64 6f 63 73 69 7a 65 27   BLE 't1_docsize'
+|   3552: 28 64 6f 63 69 64 20 49 4e 54 45 47 45 52 20 50   (docid INTEGER P
+|   3568: 52 49 4d 41 52 59 20 4b 45 59 2c 20 73 69 7a 65   RIMARY KEY, size
+|   3584: 20 42 4c 4f 42 29 81 33 04 07 17 1f 1f 01 82 35    BLOB).3.......5
+|   3600: 74 61 62 6c 65 74 31 5f 73 65 67 64 69 72 74 31   tablet1_segdirt1
+|   3616: 5f 73 65 67 64 69 72 04 43 52 45 41 54 45 20 54   _segdir.CREATE T
+|   3632: 41 42 4c 45 20 27 74 31 5f 73 65 67 64 69 72 27   ABLE 't1_segdir'
+|   3648: 28 6c 65 76 65 6c 20 49 4e 54 45 47 45 52 2c 69   (level INTEGER,i
+|   3664: 64 78 20 49 4e 54 45 47 45 52 2c 73 74 61 72 74   dx INTEGER,start
+|   3680: 5f 62 6c 6f 63 6b 20 49 4e 54 45 47 45 52 2c 6c   _block INTEGER,l
+|   3696: 65 61 76 65 73 5f 65 6e 64 5f 62 6c 6f 63 6b 20   eaves_end_block 
+|   3712: 49 4e 54 45 47 45 52 2c 65 6e 64 5f 62 6c 6f 63   INTEGER,end_bloc
+|   3728: 6b 20 49 4e 54 45 47 45 52 2c 72 6f 6f 74 20 42   k INTEGER,root B
+|   3744: 4c 4f 42 2c 50 52 49 4d 41 52 59 20 4b 45 59 28   LOB,PRIMARY KEY(
+|   3760: 6c 65 76 65 6c 2c 20 69 64 78 29 29 31 05 06 17   level, idx))1...
+|   3776: 45 1f 01 00 69 6e 64 65 78 73 71 6c 69 74 65 5f   E...indexsqlite_
+|   3792: 61 75 74 6f 69 6e 64 65 78 5f 74 31 5f 73 65 67   autoindex_t1_seg
+|   3808: 64 69 72 5f 31 74 31 5f 73 65 67 64 69 72 05 00   dir_1t1_segdir..
+|   3824: 00 00 08 00 00 00 00 66 03 07 17 23 23 01 81 13   .......f...##...
+|   3840: 74 61 62 6c 65 74 31 5f 73 65 67 6d 65 6e 74 73   tablet1_segments
+|   3856: 74 31 5f 73 65 67 6d 65 6e 74 73 03 43 52 45 41   t1_segments.CREA
+|   3872: 54 45 20 54 41 42 4c 45 20 27 74 31 5f 73 65 67   TE TABLE 't1_seg
+|   3888: 6d 65 6e 74 73 27 28 62 6c 6f 63 6b 69 64 20 49   ments'(blockid I
+|   3904: 4e 54 45 47 45 52 20 50 52 49 4d 41 52 59 20 4b   NTEGER PRIMARY K
+|   3920: 45 59 2c 20 62 6c 6f 63 6b 20 42 4c 4f 42 29 5c   EY, block BLOB).
+|   3936: 02 07 17 21 21 01 81 03 74 61 62 6c 65 74 31 5f   ...!!...tablet1_
+|   3952: 63 6f 6e 74 65 6e 74 74 31 5f 63 6f 6e 74 65 6e   contentt1_conten
+|   3968: 74 02 43 52 45 41 54 45 20 54 41 42 4c 45 20 27   t.CREATE TABLE '
+|   3984: 74 31 5f 63 6f 6e 74 65 6e 74 27 28 64 6f 63 69   t1_content'(doci
+|   4000: 64 20 49 4e 54 45 47 45 52 20 50 52 49 4d 41 52   d INTEGER PRIMAR
+|   4016: 59 20 4b 45 59 2c 20 27 63 30 61 27 29 41 01 06   Y KEY, 'c0a')A..
+|   4032: 17 11 11 08 71 74 61 62 6c 65 74 31 74 31 43 52   ....qtablet1t1CR
+|   4048: 45 41 54 45 20 56 49 52 54 55 41 4c 20 54 41 42   EATE VIRTUAL TAB
+|   4064: 4c 45 20 74 31 20 55 53 49 4e 47 20 66 74 73 34   LE t1 USING fts4
+|   4080: 28 61 2c 70 72 65 66 69 78 3d 27 31 2c 32 27 29   (a,prefix='1,2')
+| page 2 offset 4096
+|      0: 0d 00 00 00 08 0e 1f 00 0f c4 0f 7c 0f 34 0f 07   ...........|.4..
+|     16: 0e c3 0e 97 0e 63 0e 1f 00 00 00 00 00 00 00 00   .....c..........
+|   3600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 42   ...............B
+|   3616: 08 04 00 81 09 73 75 6e 74 20 69 6e 20 63 75 6c   .....sunt in cul
+|   3632: 70 61 20 71 75 69 20 6f 66 66 69 63 69 61 20 64   pa qui officia d
+|   3648: 65 73 65 72 75 6e 74 20 6d 6f 6c 6c 69 74 20 61   eserunt mollit a
+|   3664: 6e 69 6d 20 69 64 20 65 73 74 20 6c 61 62 6f 72   nim id est labor
+|   3680: 75 6d 2e 32 07 03 00 6b 45 78 63 65 70 74 65 75   um.2...kExcepteu
+|   3696: 72 20 73 69 6e 74 20 6f 63 63 61 65 63 67 42 06   r sint occaecgB.
+|   3712: 37 57 06 96 46 17 46 17 42 06 e6 f6 e2 07 07 26   7W..F.F.B......&
+|   3728: f6 96 46 56 e7 42 c2 a0 60 30 05 b6 36 96 c6 c7   ..FV.B..`0..6...
+|   3744: 56 d2 06 46 f6 c6 f7 26 52 06 57 52 06 67 56 7c   V..F...&R.WR.gV|
+|   3760: 65 3f 04 20 6e 75 6c 6c 61 20 70 61 72 69 61 74   e?. nulla pariat
+|   3776: 75 72 2e 42 05 04 00 81 09 44 75 69 73 20 61 75   ur.B.....Duis au
+|   3792: 74 65 20 69 72 75 72 65 20 64 6f 6c 6f 72 20 69   te irure dolor i
+|   3808: 6e 20 72 65 70 72 65 68 65 6e 64 65 72 69 74 20   n reprehenderit 
+|   3824: 69 6e 20 76 6f 6c 75 70 74 61 74 65 20 76 65 6c   in voluptate vel
+|   3840: 69 74 20 65 73 73 65 2b 04 03 00 5d 6e 69 73 69   it esse+...]nisi
+|   3856: 20 75 74 20 61 7c 69 71 75 69 70 20 65 78 20 65    ut a|iquip ex e
+|   3872: 61 20 63 6f 6d 6d 6f 64 6f 20 63 6f 6e 73 65 71   a commodo conseq
+|   3888: 75 61 74 2e 46 03 04 00 81 11 55 74 20 65 6e 69   uat.F.....Ut eni
+|   3904: 6d 20 61 64 20 6d 69 6e 69 6d 20 76 65 6e 69 61   m ad minim venia
+|   3920: 6d 2c 20 71 75 69 73 20 6e 6f 73 74 72 75 64 20   m, quis nostrud 
+|   3936: 65 78 65 72 63 69 74 61 74 69 6f 6e 20 75 6c 6c   exercitation ull
+|   3952: 61 6d 63 6f 20 6c 61 62 6f 72 69 73 46 02 04 00   amco laborisF...
+|   3968: 81 11 73 65 64 20 64 6f 20 65 69 75 73 6d 6f 64   ..sed do eiusmod
+|   3984: 20 74 65 6d 70 6f 72 20 69 6e 63 69 64 69 64 75    tempor incididu
+|   4000: 6e 74 20 75 74 20 6c 61 62 6f 72 65 20 65 74 20   nt ut labore et 
+|   4016: 64 6f 6c 6f 72 65 20 6d 61 67 6e 61 20 61 6c 69   dolore magna ali
+|   4032: 71 75 61 2e 3a 01 03 00 7b 4c 6f 72 65 6d 20 69   qua.:....Lorem i
+|   4048: 70 73 75 6d 20 64 6f 6c 6f 72 20 73 69 74 20 61   psum dolor sit a
+|   4064: 6d 65 74 2c 20 63 6f 6e 73 65 63 74 65 74 75 72   met, consectetur
+|   4080: 20 61 64 69 70 69 73 63 69 6e 67 20 65 6c 69 74    adipiscing elit
+| page 3 offset 8192
+|      0: 0d 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00   ................
+| page 4 offset 12288
+|      0: 0d 00 00 00 03 0a a6 00 0d 57 0c 4a 0a a6 00 00   .........W.J....
+|   2720: 00 00 00 00 00 00 83 21 03 08 02 08 08 08 17 86   .......!........
+|   2736: 30 08 00 30 20 34 30 32 00 02 61 64 06 01 08 00   0..0 402..ad....
+|   2752: 02 04 00 01 01 6c 06 02 0c 00 02 04 00 01 01 6d   .....l.........m
+|   2768: 03 01 06 00 01 01 6e 03 08 00 00 91 01 75 03 05   ......n......u..
+|   2784: 03 00 00 02 63 69 03 06 02 00 01 01 6f 07 01 07   ....ci......o...
+|   2800: 00 03 07 03 00 01 01 75 06 07 05 00 01 04 00 00   .......u........
+|   2816: 02 64 65 03 08 07 00 01 01 6f 0d 01 04 00 01 03   .de......o......
+|   2832: 09 00 03 05 00 01 03 00 01 01 75 03 05 02 00 00   ..........u.....
+|   2848: 02 65 61 03 04 06 00 01 01 69 03 02 04 00 01 01   .ea......i......
+|   2864: 6c 03 01 09 00 01 01 6e 30 03 03 00 01 01 73 06   l......n0.....s.
+|   2880: 05 0b 00 03 0b 00 01 01 74 03 02 09 00 01 01 75   ........t......u
+|   2896: 03 06 04 00 01 01 78 09 03 09 00 01 05 00 03 02   ......x.........
+|   2912: 00 00 02 66 75 03 06 05 00 00 02 69 64 03 08 0a   ...fu......id...
+|   2928: 00 01 01 6e 0a 02 06 00 03 06 04 00 03 03 00 01   ...n............
+|   2944: 01 70 03 01 03 00 01 01 72 03 05 04 00 00 02 6c   .p......r......l
+|   2960: 61 09 02 08 00 01 0b 00 05 0c 00 01 01 6f 03 01   a............o..
+|   2976: 02 00 00 02 6d 61 03 02 0b 00 01 01 69 03 03 05   ....ma......i...
+|   2992: 00 01 01 6f 03 08 08 00 00 02 6e 69 03 04 02 00   ...o......ni....
+|   3008: 01 01 6f 06 03 08 00 04 06 00 01 01 75 03 06 06   ..o.........u...
+|   3024: 00 00 02 6f 63 03 07 04 00 01 01 66 03 08 06 00   ...oc......f....
+|   3040: 00 02 70 61 03 06 07 00 01 01 72 03 07 07 00 00   ..pa......r.....
+|   3056: 02 71 75 06 03 07 00 05 05 00 00 02 72 65 03 05   .qu.........re..
+|   3072: 07 00 00 02 73 65 03 02 02 00 01 01 69 06 01 05   ....se......i...
+|   3088: 00 06 03 00 01 01 75 03 08 02 00 00 02 74 65 03   ......u......te.
+|   3104: 02 05 00 00 02 75 6c 03 03 0a 00 01 01 74 09 02   .....ul......t..
+|   3120: 07 00 01 02 00 01 03 00 00 02 76 65 06 03 06 00   ..........ve....
+|   3136: 02 0a 00 01 01 6f 03 05 09 00 82 0a 02 08 02 08   .....o..........
+|   3152: 08 08 17 84 02 04 00 30 20 32 35 31 00 01 61 13   .......0 251..a.
+|   3168: 01 06 04 00 01 0c 00 01 04 00 01 04 00 01 03 00   ................
+|   3184: 03 09 00 00 01 63 10 01 07 00 03 07 03 00 02 02   .....c..........
+|   3200: 00 01 05 00 01 04 00 00 01 64 11 01 04 00 01 03   .........d......
+|   3216: 09 00 03 02 05 00 01 03 00 02 07 00 00 01 65 1b   ..............e.
+|   3232: 01 09 00 01 04 07 00 01 03 00 80 00 15 03 00 01   ................
+|   3248: 0b 00 01 04 00 01 02 00 01 0b 00 00 01 66 03 06   .............f..
+|   3264: 05 00 00 01 69 0f 01 03 00 01 06 00 03 04 04 04   ....i...........
+|   3280: 00 03 03 09 00 00 01 6c 0c 01 02 00 01 08 00 01   .......l........
+|   3296: 0b 00 05 0c 00 00 01 6d 09 02 0b 00 01 05 00 05   .......m........
+|   3312: 08 00 00 01 6e 0c 03 08 00 01 02 00 02 06 00 01   ....n...........
+|   3328: 06 00 00 01 6f 06 07 04 00 01 06 00 00 01 70 06   ....o.........p.
+|   3344: 06 07 00 01 07 00 00 01 71 06 03 07 00 05 05 00   ........q.......
+|   3360: 00 01 72 03 05 07 00 00 01 73 0c 01 05 00 01 02   ..r......s......
+|   3376: 00 05 03 00 01 02 00 00 01 74 03 02 05 00 00 01   .........t......
+|   3392: 75 0a 02 07 00 01 02 0a 00 01 03 00 00 01 76 07   u.............v.
+|   3408: 03 06 00 02 09 03 00 85 26 01 08 08 08 08 08 17   ........&.......
+|   3424: 8a 3e 30 20 36 36 35 00 02 61 64 03 03 04 00 02   .>0 665..ad.....
+|   3440: 08 69 70 69 73 63 69 6e 67 03 01 08 00 01 05 6c   .ipiscing......l
+|   3456: 69 71 75 61 03 02 0c 00 05 02 69 70 03 04 04 00   iqua......ip....
+|   3472: 01 03 6d 65 74 03 01 06 00 01 03 6e 69 6d 03 08   ..met......nim..
+|   3488: 09 00 01 03 75 74 65 03 05 03 00 00 06 63 69 6c   ....ute......cil
+|   3504: 6c 75 6d 03 06 02 00 01 06 6f 6d 6d 6f 64 6f 03   lum......ommodo.
+|   3520: 04 07 00 02 09 6e 73 65 63 74 65 74 75 72 03 01   .....nsectetur..
+|   3536: 07 00 05 04 71 75 61 74 03 04 08 00 01 04 75 6c   ....quat......ul
+|   3552: 70 61 03 08 04 00 02 07 70 69 64 61 74 61 74 03   pa......pidatat.
+|   3568: 07 05 00 00 08 64 65 73 65 72 75 6e 74 03 08 07   .....deserunt...
+|   3584: 00 01 01 6f 03 02 03 00 02 03 6c 6f 72 06 01 04   ...o......lor...
+|   3600: 00 40 05 00 05 01 65 06 02 0a 00 04 03 00 01 03   .@....e.........
+|   3616: 75 69 73 03 05 02 00 00 02 65 61 03 04 06 00 01   uis......ea.....
+|   3632: 06 69 75 73 6d 6f 64 03 02 04 00 01 03 6c 69 74   .iusmod......lit
+|   3648: 03 01 09 00 01 03 6e 69 6d 03 03 03 00 01 03 73   ......nim......s
+|   3664: 73 65 03 05 0b 00 02 01 74 03 08 0b 00 01 01 74   se......t......t
+|   3680: 03 02 09 00 01 01 75 03 06 04 00 01 01 78 03 04   ......u......x..
+|   3696: 05 00 02 07 63 65 70 74 65 75 72 03 07 02 00 02   ....cepteur.....
+|   3712: 0a 65 72 63 69 74 61 74 69 6f 6e 03 03 09 00 00   .ercitation.....
+|   3728: 06 66 75 67 69 61 74 03 06 05 00 00 02 69 64 03   .fugiat......id.
+|   3744: 08 0a 00 01 01 6e 07 05 06 04 00 03 03 00 02 08   .....n..........
+|   3760: 63 69 64 69 64 75 6e 74 03 02 06 00 01 04 70 73   cididunt......ps
+|   3776: 75 6d 03 01 03 00 01 04 72 75 72 65 03 05 04 00   um......rure....
+|   3792: 00 06 6c 61 62 6f 72 65 03 02 08 00 05 02 69 73   ..labore......is
+|   3808: 03 03 0b 00 05 02 75 6d 03 08 0c 00 01 04 6f 72   ......um......or
+|   3824: 65 6d 03 01 02 00 00 05 6d 61 67 6e 61 03 02 0b   em......magna...
+|   3840: 00 01 04 69 6e 69 6d 03 03 05 00 01 05 6f 6c 6c   ...inim......oll
+|   3856: 69 74 03 08 08 00 00 04 6e 69 73 69 03 04 02 00   it......nisi....
+|   3872: 01 02 6f 6e 03 07 06 00 02 05 73 74 72 75 64 03   ..on......strud.
+|   3888: 03 08 00 01 04 75 6c 6c 61 03 06 06 00 00 08 6f   .....ulla......o
+|   3904: 63 63 61 65 63 61 74 03 07 04 00 01 06 66 66 69   ccaecat......ffi
+|   3920: 63 69 61 03 08 06 00 00 08 70 61 72 69 61 74 75   cia......pariatu
+|   3936: 72 03 06 07 00 01 07 72 6f 69 64 65 6e 74 03 07   r......roident..
+|   3952: 07 00 00 03 71 75 69 03 08 05 00 03 01 73 03 03   ....qui......s..
+|   3968: 07 00 00 0d 72 65 70 72 65 68 65 6e 64 65 72 69   ....reprehenderi
+|   3984: 74 03 05 07 00 00 03 73 65 64 03 02 02 00 01 03   t......sed......
+|   4000: 69 6e 74 03 07 03 00 02 01 74 03 01 05 00 01 03   int......t......
+|   4016: 75 6e 74 03 08 02 00 00 06 74 65 6d 70 6f 72 03   unt......tempor.
+|   4032: 02 05 00 00 07 75 6c 6c 61 6d 63 6f 03 03 0a 00   .....ullamco....
+|   4048: 01 01 74 09 02 07 00 01 02 00 01 03 00 00 05 76   ..t............v
+|   4064: 65 6c 69 74 03 05 0a 00 02 04 6e 69 61 6d 03 03   elit......niam..
+|   4080: 06 00 01 08 6f 6c 75 70 74 61 74 65 03 05 09 00   ....oluptate....
+| page 5 offset 16384
+|      0: 0a 00 00 00 03 0f eb 00 0f fb 0f f3 0f eb 00 00   ................
+|   4064: 00 00 00 00 00 00 00 00 00 00 00 07 04 02 08 01   ................
+|   4080: 08 00 03 07 04 02 08 01 04 00 02 04 04 08 08 09   ................
+| page 6 offset 20480
+|      0: 0d 00 00 00 08 0f d0 00 0f fa 0f f4 0f ee 0f e8   ................
+|     16: 0f e2 0f dc 0f d6 0f d0 00 00 00 00 00 00 00 00   ................
+|   4048: 04 08 03 00 0e 0b 04 07 03 00 0e 06 04 06 03 00   ................
+|   4064: 0e 06 04 05 03 00 0e 0a 04 04 03 00 0e 07 04 03   ................
+|   4080: 03 00 0e 0a 04 02 03 00 0e 0b 04 01 03 00 0e 08   ................
+| page 7 offset 24576
+|      0: 0d 00 00 00 01 0f f7 00 0f f7 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 00 00 00 07 00 03 00 14 08 45 b5 03   .............E..
+| end crash-7948058d822acb.db
+}]} {}
+
+do_catchsql_test 8.1 {
+  SELECT matchinfo(t1,'x') FROM t1 WHERE t1 MATCH 'e*';
+} {1 {database disk image is malformed}}
+
+#-------------------------------------------------------------------------
+reset_db
+do_test 9.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 28672 pagesize 4096 filename crash-e1c6cbfdf643e9.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 00 00 00 00 07   .....@  ........
+|     32: 00 00 00 02 00 00 00 01 00 00 00 07 00 00 00 04   ................
+|     48: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00   ................
+|     96: 00 00 00 00 0d 0e b1 00 06 0d a4 00 0f 8d 0f 21   ...............!
+|    112: 0e b9 0d c8 0e 7e 0d a4 0d a4 00 00 00 00 00 00   .....~..........
+|   3488: 00 00 00 00 22 07 06 17 11 11 01 31 74 61 62 6c   ...........1tabl
+|   3504: 65 74 32 74 32 07 43 52 45 41 54 45 20 54 41 42   et2t2.CREATE TAB
+|   3520: 4c 45 20 74 32 28 78 29 81 33 05 07 17 1f 1f 01   LE t2(x).3......
+|   3536: 82 35 74 61 62 6c 65 74 31 5f 73 65 67 64 69 72   .5tablet1_segdir
+|   3552: 74 31 5f 73 65 67 64 69 72 05 43 52 45 41 54 45   t1_segdir.CREATE
+|   3568: 20 54 41 42 4c 45 20 27 74 31 5f 73 65 67 64 69    TABLE 't1_segdi
+|   3584: 72 27 28 6c 65 76 65 6c 20 49 4e 54 45 47 45 52   r'(level INTEGER
+|   3600: 2c 69 64 78 20 49 4e 54 45 47 45 52 2c 73 74 61   ,idx INTEGER,sta
+|   3616: 72 74 5f 62 6c 6f 63 6b 20 49 4e 54 45 47 45 52   rt_block INTEGER
+|   3632: 2c 6c 65 61 76 65 73 5f 65 6e 64 5f 62 6c 6f 63   ,leaves_end_bloc
+|   3648: 6b 20 49 4e 54 45 47 45 52 2c 65 6e 64 5f 62 6c   k INTEGER,end_bl
+|   3664: 6f 63 6b 20 49 4e 54 45 47 45 52 2c 72 6f 6f 74   ock INTEGER,root
+|   3680: 20 42 4c 4f 42 2c 50 52 49 4d 41 52 59 20 4b 45    BLOB,PRIMARY KE
+|   3696: 59 28 6c 65 76 65 6c 2c 20 69 64 78 29 29 31 06   Y(level, idx))1.
+|   3712: 06 17 45 1f 01 00 69 6e 64 65 78 73 71 6c 69 74   ..E...indexsqlit
+|   3728: 65 5f 61 75 74 6f 69 6e 64 65 78 5f 74 31 5f 73   e_autoindex_t1_s
+|   3744: 65 67 64 69 72 5f 31 74 31 5f 73 65 67 64 69 72   egdir_1t1_segdir
+|   3760: 06 0f c7 00 08 00 00 00 00 66 04 07 17 23 23 01   .........f...##.
+|   3776: 81 13 74 61 62 6c 65 74 31 5f 73 65 67 6d 65 6e   ..tablet1_segmen
+|   3792: 74 73 74 31 5f 73 65 67 6d 65 6e 74 73 04 43 52   tst1_segments.CR
+|   3808: 45 41 54 45 20 54 41 42 4c 45 20 27 74 31 5f 73   EATE TABLE 't1_s
+|   3824: 65 67 6d 65 6e 74 73 27 28 62 6c 6f 63 6b 69 64   egments'(blockid
+|   3840: 20 49 4e 54 45 47 45 52 20 50 52 49 4d 41 52 59    INTEGER PRIMARY
+|   3856: 20 4b 45 59 2c 20 62 6c 6f 63 6b 20 42 4c 4f 42    KEY, block BLOB
+|   3872: 29 6a 03 07 17 21 21 01 81 1f 74 61 62 6c 65 74   )j...!!...tablet
+|   3888: 31 5f 63 6f 6e 74 65 6e 74 74 31 5f 63 6f 6e 74   1_contentt1_cont
+|   3904: 65 6e 74 03 43 52 45 41 54 45 20 54 41 42 4c 45   ent.CREATE TABLE
+|   3920: 20 27 74 31 5f 63 6f 6e 74 65 6e 74 27 28 64 6f    't1_content'(do
+|   3936: 63 69 64 20 49 4e 54 45 47 45 52 20 50 52 49 4d   cid INTEGER PRIM
+|   3952: 41 52 59 20 4b 45 59 2c 20 27 63 30 61 27 2c 20   ARY KEY, 'c0a', 
+|   3968: 27 63 31 62 27 2c 20 27 63 32 63 27 29 38 02 06   'c1b', 'c2c')8..
+|   3984: 17 11 11 08 5f 74 61 62 6c 65 74 31 74 31 43 52   ...._tablet1t1CR
+|   4000: 45 41 54 45 20 56 49 52 54 55 41 4c 20 54 41 42   EATE VIRTUAL TAB
+|   4016: 4c 45 20 74 31 20 55 53 49 4e 47 20 66 74 73 33   LE t1 USING fts3
+|   4032: 28 61 2c 62 2c 63 29 00 00 00 39 00 00 00 00 00   (a,b,c)...9.....
+| page 3 offset 8192
+|      0: 0d 00 00 00 25 0b 48 00 0f d8 0f af 0f 86 0f 74   ....%.H........t
+|     16: 0f 61 0f 4e 0f 2f 0f 0f 0e ef 0e d7 0e be 0e a5   .a.N./..........
+|     32: 0e 8d 0e 74 0e 5b 0e 40 0e 24 0e 08 0d ef 0d d5   ...t.[.@.$......
+|     48: 0d bb 0d a0 0d 84 0d 68 0d 4f 0d 35 0d 1b 0c fb   .......h.O.5....
+|     64: 0c da 0c b9 0c 99 0c 78 0c 57 0c 3e 0c 24 0c 0a   .......x.W.>.$..
+|     80: 0b 48 00 00 00 00 00 00 00 00 00 00 00 00 00 00   .H..............
+|   2880: 00 00 00 00 00 00 00 00 81 3f 25 06 00 82 7f 00   .........?%.....
+|   2896: 00 43 4f 4d 50 49 4c 45 52 3d 67 63 63 2d 35 2e   .COMPILER=gcc-5.
+|   2912: 34 2e 30 20 32 30 31 36 30 36 30 39 20 44 45 42   4.0 20160609 DEB
+|   2928: 55 47 20 45 4e 41 42 4c 45 20 44 42 53 54 41 54   UG ENABLE DBSTAT
+|   2944: 20 56 54 41 42 20 45 4e 41 42 4c 45 20 46 54 53    VTAB ENABLE FTS
+|   2960: 34 20 45 4e 41 42 4c 45 20 46 54 53 35 20 45 4e   4 ENABLE FTS5 EN
+|   2976: 41 42 4c 45 20 47 45 4f 50 4f 4c 59 20 45 4e 41   ABLE GEOPOLY ENA
+|   2992: 42 4c 45 20 4a 53 4f 4e 31 20 45 4e 41 42 4c 45   BLE JSON1 ENABLE
+|   3008: 20 4d 45 4d 53 59 53 35 20 45 4e 41 42 4c 45 20    MEMSYS5 ENABLE 
+|   3024: 52 54 52 45 45 20 4d 41 58 20 4d 45 4d 4f 52 59   RTREE MAX MEMORY
+|   3040: 3d 35 30 30 30 30 30 30 30 20 4f 4d 49 54 20 4c   =50000000 OMIT L
+|   3056: 4f 41 44 20 45 58 54 45 4e 53 49 4f 4e 20 54 48   OAD EXTENSION TH
+|   3072: 52 45 41 44 53 41 46 45 3d 30 18 24 05 00 25 0f   READSAFE=0.$..%.
+|   3088: 19 54 48 52 45 41 44 53 41 46 45 3d 30 58 42 49   .THREADSAFE=0XBI
+|   3104: 4e 41 52 59 18 23 05 00 25 0f 19 54 48 52 45 41   NARY.#..%..THREA
+|   3120: 44 53 41 46 45 3d 30 58 4e 4f 43 41 53 45 17 22   DSAFE=0XNOCASE..
+|   3136: 05 00 25 0f 17 54 48 52 45 41 44 53 41 46 45 3d   ..%..THREADSAFE=
+|   3152: 30 58 52 54 52 49 4d 1f 21 05 00 33 0f 19 4f 4d   0XRTRIM.!..3..OM
+|   3168: 49 54 20 4c 4f 41 44 20 35 58 54 45 4e 53 49 4f   IT LOAD 5XTENSIO
+|   3184: 4e 58 42 49 4e 41 52 59 1f 20 05 00 33 0f 19 4f   NXBINARY. ..3..O
+|   3200: 4d 49 54 20 4c 4f 41 44 20 45 58 54 45 4e 53 49   MIT LOAD EXTENSI
+|   3216: 4f 4e 58 4e 4f 43 41 53 45 1e 1f 05 00 33 0f 17   ONXNOCASE....3..
+|   3232: 4f 4d 49 54 20 4c 4f 41 44 20 45 58 54 45 4e 53   OMIT LOAD EXTENS
+|   3248: 49 4f 4e 58 52 54 52 49 4d 1f 1e 05 00 33 0f 19   IONXRTRIM....3..
+|   3264: 4d 41 58 20 4d 45 4d 4f 52 59 3d 35 30 30 30 30   MAX MEMORY=50000
+|   3280: 30 30 30 58 42 49 4e 41 52 59 1f 1d 05 00 33 0f   000XBINARY....3.
+|   3296: 19 4d 41 58 20 4d 45 4d 4f 52 59 3d 35 30 30 30   .MAX MEMORY=5000
+|   3312: 30 30 30 30 58 4e 4f 43 41 53 45 1e 1c 05 00 33   0000XNOCASE....3
+|   3328: 0f 17 4d 41 58 20 4d 45 4d 4f 52 59 3d 35 30 30   ..MAX MEMORY=500
+|   3344: 30 30 30 30 30 58 52 54 52 49 4d 18 1b 05 00 25   00000XRTRIM....%
+|   3360: 0f 19 45 4e 41 42 4c 45 20 52 54 52 45 45 58 42   ..ENABLE RTREEXB
+|   3376: 49 4e 41 52 59 18 1a 05 00 25 0f 19 45 4e 41 42   INARY....%..ENAB
+|   3392: 4c 45 20 52 54 52 45 45 58 4e 4f 43 41 53 45 17   LE RTREEXNOCASE.
+|   3408: 19 05 00 25 0f 17 45 4e 41 42 4c 45 20 52 54 52   ...%..ENABLE RTR
+|   3424: 45 45 58 52 54 52 49 4d 1a 18 05 00 29 0f 19 45   EEXRTRIM....)..E
+|   3440: 4e 41 42 4c 45 20 4d 45 4d 53 59 53 35 58 42 49   NABLE MEMSYS5XBI
+|   3456: 4e 41 52 59 1a 17 05 00 29 0f 19 45 4e 41 42 4c   NARY....)..ENABL
+|   3472: 45 20 4d 45 4d 53 59 53 35 58 4e 4f 43 41 53 45   E MEMSYS5XNOCASE
+|   3488: 19 16 05 00 29 0f 17 45 4e 41 42 4c 45 20 4d 45   ....)..ENABLE ME
+|   3504: 4d 53 59 53 35 58 52 54 52 49 4d 18 15 05 00 25   MSYS5XRTRIM....%
+|   3520: 0f 19 45 4e 41 42 4c 45 20 4a 53 4f 4e 31 58 42   ..ENABLE JSON1XB
+|   3536: 49 4e 41 52 59 18 14 05 00 25 0f 19 45 4e 41 42   INARY....%..ENAB
+|   3552: 4c 45 20 4a 53 4f 4e 31 58 4e 4f 43 41 53 45 17   LE JSON1XNOCASE.
+|   3568: 13 05 00 25 1f 17 45 4e 41 42 4c 45 20 4a 53 4f   ...%..ENABLE JSO
+|   3584: 4e 31 58 52 54 52 49 4d 1a 12 05 00 29 0f 19 45   N1XRTRIM....)..E
+|   3600: 4e 41 42 4c 45 20 47 45 4f 50 4f 4c 59 58 42 49   NABLE GEOPOLYXBI
+|   3616: 4e 41 52 59 1a 11 05 00 29 0f 19 45 4e 41 42 4c   NARY....)..ENABL
+|   3632: 45 20 47 45 4f 50 4f 4c 59 58 4e 4f 43 41 53 45   E GEOPOLYXNOCASE
+|   3648: 19 10 05 00 29 0f 17 45 4e 41 42 4c 45 20 47 45   ....)..ENABLE GE
+|   3664: 4f 50 4f 4c 59 58 52 54 52 49 4d 17 0f 05 00 23   OPOLYXRTRIM....#
+|   3680: 0f 19 45 4e 41 42 4c 45 20 46 54 53 35 58 42 49   ..ENABLE FTS5XBI
+|   3696: 4e 41 52 59 17 0e 05 00 23 0f 19 45 4e 41 42 4c   NARY....#..ENABL
+|   3712: 45 20 46 54 53 35 58 4e 4f 43 41 53 45 16 0d 05   E FTS5XNOCASE...
+|   3728: 00 23 0f 17 44 4e 41 42 4c 45 20 46 54 53 35 58   .#..DNABLE FTS5X
+|   3744: 52 54 52 49 4d 17 0c 05 00 23 0f 19 45 4e 41 42   RTRIM....#..ENAB
+|   3760: 4c 45 20 46 54 53 34 58 42 49 4e 41 52 59 17 0b   LE FTS4XBINARY..
+|   3776: 05 00 23 0f 19 45 4e 41 42 4c 45 20 46 54 53 34   ..#..ENABLE FTS4
+|   3792: 58 4e 4f 43 41 53 45 16 0a 05 00 23 0f 17 45 4e   XNOCASE....#..EN
+|   3808: 41 42 4c 45 20 46 54 53 34 58 52 54 52 49 4d 1e   ABLE FTS4XRTRIM.
+|   3824: 09 05 00 31 0f 19 45 4e 41 42 4c 45 20 44 42 53   ...1..ENABLE DBS
+|   3840: 54 41 54 20 56 54 41 42 58 42 49 4e 41 52 59 1e   TAT VTABXBINARY.
+|   3856: 08 05 00 31 0f 19 45 4e 41 42 4c 45 20 44 42 53   ...1..ENABLE DBS
+|   3872: 54 41 54 20 56 54 41 42 58 4e 4f 43 41 53 45 1d   TAT VTABXNOCASE.
+|   3888: 07 05 00 31 0f 17 45 4e 41 42 4c 45 20 44 42 53   ...1..ENABLE DBS
+|   3904: 54 41 54 20 56 54 41 42 58 52 54 52 49 4d 11 06   TAT VTABXRTRIM..
+|   3920: 05 00 17 0f 19 44 45 42 55 47 58 42 49 4e 41 52   .....DEBUGXBINAR
+|   3936: 59 11 05 05 00 17 0f 19 44 45 42 55 47 58 4e 4f   Y.......DEBUGXNO
+|   3952: 43 41 53 45 10 04 05 00 17 0f 17 44 45 42 55 47   CASE.......DEBUG
+|   3968: 58 52 54 52 49 4d 27 03 05 00 43 0f 19 43 4f 4d   XRTRIM'...C..COM
+|   3984: 50 49 4c 45 52 3d 67 63 63 2d 35 2e 34 2e 30 20   PILER=gcc-5.4.0 
+|   4000: 32 30 31 36 30 36 30 39 58 42 49 4e 41 52 59 27   20160609XBINARY'
+|   4016: 02 05 00 43 0f 19 43 4f 4d 50 49 4c 45 52 3d 67   ...C..COMPILER=g
+|   4032: 63 63 2d 35 2e 34 2e 30 20 32 30 31 36 30 36 30   cc-5.4.0 2016060
+|   4048: 39 58 4e 4f 43 41 53 45 26 01 05 00 43 0f 17 43   9XNOCASE&...C..C
+|   4064: 4f 4d 50 49 4c 45 52 3d 67 63 63 2d 35 2e 34 2e   OMPILER=gcc-5.4.
+|   4080: 30 20 32 30 31 36 30 36 30 39 58 52 54 52 49 4d   0 20160609XRTRIM
+| page 4 offset 12288
+|      0: 0d 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00   ................
+| page 5 offset 16384
+|      0: 0d 00 00 00 02 0b a0 00 0c ad 0b a0 00 00 00 00   ................
+|   2976: 82 0a 02 08 08 09 08 08 17 84 06 30 20 32 35 33   ...........0 253
+|   2992: 00 01 30 04 25 06 1b 00 00 08 32 30 31 36 30 36   ..0.%.....201606
+|   3008: 30 39 03 25 07 00 00 01 34 03 25 05 00 00 01 35   09.%....4.%....5
+|   3024: 03 25 04 00 01 07 30 30 30 30 30 30 30 03 25 1a   .%....0000000.%.
+|   3040: 00 00 08 63 6f 6d 70 69 6c 65 72 03 25 02 00 00   ...compiler.%...
+|   3056: 06 64 62 73 74 61 74 03 25 0a 00 01 04 65 62 75   .dbstat.%....ebu
+|   3072: 67 03 25 08 00 00 06 65 6e 61 62 6c 65 09 25 09   g.%....enable.%.
+|   3088: 05 04 04 04 04 04 00 01 08 78 74 65 6e 73 69 6f   .........xtensio
+|   3104: 6e 03 25 1d 00 00 04 66 74 73 34 03 25 0d 00 03   n.%....fts4.%...
+|   3120: 01 35 03 25 0f 00 00 03 67 63 63 03 25 03 00 01   .5.%....gcc.%...
+|   3136: 06 65 6f 70 6f 6c 79 03 25 11 00 00 05 6a 73 6f   .eopoly.%....jso
+|   3152: 6e 31 03 25 13 00 00 04 6c 6f 61 64 03 25 1c 00   n1.%....load.%..
+|   3168: 00 03 6d 61 78 03 25 18 00 01 05 65 6d 6f 72 79   ..max.%....emory
+|   3184: 03 25 19 00 03 04 73 79 73 35 03 25 15 00 00 04   .%....sys5.%....
+|   3200: 6f 6d 69 74 03 25 1b 00 00 05 72 74 72 65 65 03   omit.%....rtree.
+|   3216: 25 17 00 00 0a 74 68 72 65 61 64 73 61 66 65 03   %....threadsafe.
+|   3232: 25 1e 00 00 04 76 74 61 62 03 25 0b 00 86 50 01   %....vtab.%...P.
+|   3248: 08 08 08 08 08 17 8d 12 30 20 38 33 35 00 01 30   ........0 835..0
+|   3264: 12 01 06 00 01 06 00 01 06 00 1f 03 00 01 03 00   ................
+|   3280: 01 03 00 00 08 32 30 31 36 30 36 30 39 09 01 07   .....20160609...
+|   3296: 00 01 07 00 01 07 00 00 01 34 09 01 05 00 01 05   .........4......
+|   3312: 00 01 05 00 00 01 35 09 01 04 00 01 04 00 01 04   ......5.........
+|   3328: 00 01 07 30 30 30 30 30 30 30 09 1c 04 00 01 04   ...0000000......
+|   3344: 00 01 04 00 00 06 62 69 6e 61 72 79 3c 03 01 02   ......binary<...
+|   3360: 02 00 03 01 02 02 00 03 01 02 02 00 03 01 02 02   ................
+|   3376: 00 03 01 02 02 00 03 01 02 02 00 03 01 02 02 00   ................
+|   3392: 03 01 02 02 00 03 01 02 02 00 03 01 02 02 00 03   ................
+|   3408: 01 02 02 00 03 01 02 02 00 00 08 63 6f 6d 70 69   ...........compi
+|   3424: 6c 65 72 09 01 02 00 01 02 00 01 02 00 00 06 64   ler............d
+|   3440: 62 73 74 61 74 09 07 03 00 01 03 00 01 03 00 01   bstat...........
+|   3456: 04 65 62 75 67 09 04 02 00 01 02 00 01 02 00 00   .ebug...........
+|   3472: 06 65 6e 61 62 6c 65 3f 07 02 00 01 02 00 01 02   .enable?........
+|   3488: 00 01 02 00 01 02 00 01 02 00 01 02 00 01 02 00   ................
+|   3504: 01 02 00 01 02 00 01 02 00 01 02 00 01 01 00 01   ................
+|   3520: 02 00 01 02 00 01 02 00 01 02 00 01 02 00 01 02   ................
+|   3536: 00 01 02 00 01 02 00 01 08 78 74 65 6e 73 69 6f   .........xtensio
+|   3552: 6e 09 1f 04 00 01 04 00 01 04 00 00 04 66 74 73   n............fts
+|   3568: 34 09 0a 03 00 01 03 00 01 03 00 03 01 35 09 0d   4............5..
+|   3584: 03 00 01 03 00 01 03 00 00 03 67 63 63 09 01 03   ..........gcc...
+|   3600: 00 01 03 00 01 03 00 01 06 65 6f 70 6f 6c 79 09   .........eopoly.
+|   3616: 10 03 00 01 03 00 01 03 00 00 05 6a 73 6f 6e 31   ...........json1
+|   3632: 09 13 03 00 01 03 00 01 03 00 00 04 6c 6f 61 64   ............load
+|   3648: 09 1f 03 00 01 03 00 01 03 00 00 03 6d 61 78 09   ............max.
+|   3664: 1c 02 00 01 02 00 01 02 00 01 05 65 6d 6f 72 79   ...........emory
+|   3680: 09 1c 03 00 01 03 00 01 03 00 03 04 73 79 73 35   ............sys5
+|   3696: 09 16 03 00 01 03 00 01 03 00 00 06 6e 6f 63 61   ............noca
+|   3712: 73 65 3c 02 01 02 02 00 03 01 02 02 00 03 01 02   se<.............
+|   3728: 02 00 03 01 02 02 00 03 01 02 02 00 03 01 02 02   ................
+|   3744: 00 03 01 02 02 00 03 01 02 02 00 03 01 02 02 00   ................
+|   3760: 03 01 02 02 00 03 01 02 02 00 03 01 02 02 00 00   ................
+|   3776: 04 6f 6d 69 74 09 1f 02 00 01 02 00 01 02 00 00   .omit...........
+|   3792: 05 72 74 72 65 65 09 19 03 00 01 03 00 01 03 00   .rtree..........
+|   3808: 03 02 69 6d 3c 01 01 02 02 00 03 01 02 02 00 03   ..im<...........
+|   3824: 01 02 02 00 03 01 02 02 00 03 01 02 02 00 03 01   ................
+|   3840: 02 02 00 03 01 02 02 00 03 01 02 02 00 03 01 02   ................
+|   3856: 02 00 03 01 02 02 00 03 01 02 02 00 03 01 02 02   ................
+|   3872: 00 00 0a 74 68 72 65 61 64 73 61 66 65 09 22 02   ...threadsafe...
+|   3888: 00 01 02 00 0a 12 00 00 04 76 74 61 62 09 07 04   .........vtab...
+|   3904: 00 01 04 00 01 04 00 00 01 78 b4 01 01 01 01 02   .........x......
+|   3920: 00 01 01 01 02 00 01 01 01 02 00 01 01 01 02 00   ................
+|   3936: 01 01 01 02 00 01 01 01 02 00 01 01 01 02 00 01   ................
+|   3952: 01 01 02 00 01 01 01 02 00 01 01 01 02 00 01 01   ................
+|   3968: 01 02 00 01 01 01 02 00 01 01 01 02 00 01 01 01   ................
+|   3984: 02 00 01 01 01 02 00 01 01 01 02 00 01 01 01 02   ................
+|   4000: 00 01 01 01 02 00 01 01 01 02 00 01 01 01 02 00   ................
+|   4016: 01 01 01 02 00 01 01 01 02 00 01 01 01 02 00 01   ................
+|   4032: 01 01 02 00 01 01 01 02 00 01 01 01 02 00 01 01   ................
+|   4048: 01 02 00 01 01 01 02 00 01 01 01 02 00 01 01 01   ................
+|   4064: 02 00 01 01 01 02 00 01 01 01 02 00 01 01 01 02   ................
+|   4080: 00 01 01 01 02 00 01 01 01 02 00 01 01 01 02 00   ................
+| page 6 offset 20480
+|      0: 0a 00 00 00 02 0f f5 00 0f fb 0f f5 00 00 00 00   ................
+|   4080: 00 00 00 00 00 05 04 08 09 01 02 04 04 08 08 09   ................
+| page 7 offset 24576
+|      0: 0d 00 00 00 05 0f b8 00 0f f4 0f e9 0f d6 0f c7   ................
+|     16: 0f b8 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
+|   4016: 00 00 00 00 00 00 00 00 0d 05 02 23 61 75 74 6f   ...........#auto
+|   4032: 6d 65 72 67 65 3d 35 0d 04 02 23 6d 65 72 67 65   merge=5...#merge
+|   4048: 3d 31 30 30 2c 38 11 03 02 2b 69 6e 74 65 67 72   =100,8...+integr
+|   4064: 69 74 79 2d 63 68 65 63 6b 09 02 02 1b 72 65 62   ity-check....reb
+|   4080: 75 69 6c 64 0a 01 02 1d 6f 70 74 69 6d 69 7a 65   uild....optimize
+| end crash-e1c6cbfdf643e9.db
+}]} {}
+
+do_execsql_test 9.1 {
+  SELECT count(*) FROM t1 WHERE t1 MATCH '"json1 enable"';
+} {1}
+
+#-------------------------------------------------------------------------
+reset_db
+do_test 10.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 28672 pagesize 4096 filename crash-c3a971f0061039.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 00 00 00 00 07   .....@  ........
+|     32: 00 00 00 02 00 00 00 01 00 00 00 07 00 00 00 04   ................
+|     48: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00   ................
+|     96: 00 00 00 00 0d 0e b1 00 06 0d a4 00 0f 8d 0f 21   ...............!
+|    112: 0e b9 0d c8 0e 7e 0d a4 0d a4 00 00 00 00 00 00   .....~..........
+|   3488: 00 00 00 00 22 07 06 17 11 11 01 31 74 61 62 6c   ...........1tabl
+|   3504: 65 74 32 74 32 07 43 52 45 41 54 45 20 54 41 42   et2t2.CREATE TAB
+|   3520: 4c 45 20 74 32 28 78 29 81 33 05 07 17 1f 1f 01   LE t2(x).3......
+|   3536: 82 35 74 61 62 6c 65 74 31 5f 73 65 67 64 69 72   .5tablet1_segdir
+|   3552: 74 31 5f 73 65 67 64 69 72 05 43 52 45 41 54 45   t1_segdir.CREATE
+|   3568: 20 54 41 42 4c 45 20 27 74 31 5f 73 65 67 64 69    TABLE 't1_segdi
+|   3584: 72 27 28 6c 65 76 65 6c 20 49 4e 54 45 47 45 52   r'(level INTEGER
+|   3600: 2c 69 64 78 20 49 4e 54 45 47 45 52 2c 73 74 61   ,idx INTEGER,sta
+|   3616: 72 74 5f 62 6c 6f 63 6b 20 49 4e 54 45 47 45 52   rt_block INTEGER
+|   3632: 2c 6c 65 61 76 65 73 5f 65 6e 64 5f 62 6c 6f 63   ,leaves_end_bloc
+|   3648: 6b 20 49 4e 54 45 47 45 52 2c 65 6e 64 5f 62 6c   k INTEGER,end_bl
+|   3664: 6f 63 6b 20 49 4e 54 45 47 45 52 2c 72 6f 6f 74   ock INTEGER,root
+|   3680: 20 42 4c 4f 42 2c 50 52 49 4d 41 52 59 20 4b 45    BLOB,PRIMARY KE
+|   3696: 59 28 6c 65 76 65 6c 2c 20 69 64 78 29 29 31 06   Y(level, idx))1.
+|   3712: 06 17 45 1f 01 00 69 6e 64 65 78 73 71 6c 69 74   ..E...indexsqlit
+|   3728: 65 5f 61 75 74 6f 69 6e 64 65 78 5f 74 31 5f 73   e_autoindex_t1_s
+|   3744: 65 67 64 69 72 5f 31 74 31 5f 73 65 67 64 69 72   egdir_1t1_segdir
+|   3760: 06 0f c7 00 08 00 00 00 00 66 04 07 17 23 23 01   .........f...##.
+|   3776: 81 13 74 61 62 6c 65 74 31 5f 73 65 67 6d 65 6e   ..tablet1_segmen
+|   3792: 74 73 74 31 5f 73 65 67 6d 65 6e 74 73 04 43 52   tst1_segments.CR
+|   3808: 45 41 54 45 20 54 41 42 4c 45 20 27 74 31 5f 73   EATE TABLE 't1_s
+|   3824: 65 67 6d 65 6e 74 73 27 28 62 6c 6f 63 6b 69 64   egments'(blockid
+|   3840: 20 49 4e 54 45 47 45 52 20 50 52 49 4d 41 52 59    INTEGER PRIMARY
+|   3856: 20 4b 45 59 2c 20 62 6c 6f 63 6b 20 42 4c 4f 42    KEY, block BLOB
+|   3872: 29 6a 03 07 17 21 21 01 81 1f 74 61 62 6c 65 74   )j...!!...tablet
+|   3888: 31 5f 63 6f 6e 74 65 6e 74 74 31 5f 63 6f 6e 74   1_contentt1_cont
+|   3904: 65 6e 74 03 43 52 45 41 54 45 20 54 41 42 4c 45   ent.CREATE TABLE
+|   3920: 20 27 74 31 5f 63 6f 6e 74 65 6e 74 27 28 64 6f    't1_content'(do
+|   3936: 63 69 64 20 49 4e 54 45 47 45 52 20 50 52 49 4d   cid INTEGER PRIM
+|   3952: 41 52 59 30 4b 45 59 2c 20 27 63 30 61 27 2c 20   ARY0KEY, 'c0a', 
+|   3968: 27 63 31 62 27 2c 20 27 63 32 63 27 29 38 02 06   'c1b', 'c2c')8..
+|   3984: 17 11 11 08 5f 74 61 62 6c 65 74 31 74 31 43 52   ...._tablet1t1CR
+|   4000: 45 41 54 45 20 56 49 52 54 55 41 4c 20 54 41 42   EATE VIRTUAL TAB
+|   4016: 4c 45 20 74 31 20 55 53 49 4e 47 20 66 74 73 33   LE t1 USING fts3
+|   4032: 28 61 2c 62 2c 63 29 00 00 00 39 00 00 00 00 00   (a,b,c)...9.....
+| page 3 offset 8192
+|      0: 0d 00 00 00 25 0b 48 00 0f d8 0f af 0f 86 0f 74   ....%.H........t
+|     16: 0f 61 0f 4e 0f 2f 0f 0f 0e ef 0e d7 0e be 0e a5   .a.N./..........
+|     32: 0e 8d 0e 74 0e 5b 0e 40 0e 24 0e 08 0d ef 0d d5   ...t.[.@.$......
+|     48: 0d bb 0d a0 0d 84 0d 68 0d 4f 0d 35 0d 1b 0c fb   .......h.O.5....
+|     64: 0c da 0c b9 0c 99 0c 78 0c 57 0c 3e 0c 24 0c 0a   .......x.W.>.$..
+|     80: 0b 48 00 00 00 00 00 00 00 00 00 00 00 00 00 00   .H..............
+|   2880: 00 00 00 00 00 00 00 00 81 3f 25 06 00 82 7f 00   .........?%.....
+|   2896: 00 43 4f 4d 50 49 4c 45 52 3d 67 63 63 2d 35 2e   .COMPILER=gcc-5.
+|   2912: 34 2e 30 20 32 30 31 36 30 36 30 39 20 44 45 42   4.0 20160609 DEB
+|   2928: 55 47 20 45 4e 41 42 4c 45 20 44 42 53 54 41 54   UG ENABLE DBSTAT
+|   2944: 20 56 54 41 42 20 45 4e 41 42 4c 45 20 46 54 53    VTAB ENABLE FTS
+|   2960: 34 20 45 4e 41 42 4c 45 20 46 54 53 35 20 45 4e   4 ENABLE FTS5 EN
+|   2976: 41 42 4c 45 20 47 45 4f 50 4f 4c 59 20 45 4e 41   ABLE GEOPOLY ENA
+|   2992: 42 4c 45 20 4a 53 4f 4e 31 20 45 4e 41 42 4c 45   BLE JSON1 ENABLE
+|   3008: 20 4d 45 4d 53 59 53 35 20 45 4e 41 42 4c 45 1f    MEMSYS5 ENABLE.
+|   3024: 52 54 52 45 45 20 4d 41 58 20 4d 45 4d 4f 52 59   RTREE MAX MEMORY
+|   3040: 3d 35 30 30 30 30 30 30 30 20 4f 4d 49 54 20 4c   =50000000 OMIT L
+|   3056: 4f 41 44 20 45 58 54 45 4e 53 49 4f 4e 20 54 48   OAD EXTENSION TH
+|   3072: 52 45 41 44 53 41 46 45 3d 30 18 24 05 00 25 0f   READSAFE=0.$..%.
+|   3088: 19 54 48 52 45 41 44 53 41 46 45 3d 30 58 42 49   .THREADSAFE=0XBI
+|   3104: 4e 41 52 59 18 23 05 00 25 0f 19 54 48 52 45 41   NARY.#..%..THREA
+|   3120: 44 53 41 46 45 3d 30 58 4e 4f 43 41 53 45 17 22   DSAFE=0XNOCASE..
+|   3136: 05 00 25 0f 17 54 48 52 45 41 44 53 41 46 45 3d   ..%..THREADSAFE=
+|   3152: 30 58 52 54 52 49 4d 1f 21 05 00 33 0f 19 4f 4d   0XRTRIM.!..3..OM
+|   3168: 49 54 20 4c 4f 41 44 20 45 58 54 45 4e 53 49 4f   IT LOAD EXTENSIO
+|   3184: 4e 58 43 49 4e 41 52 59 1f 20 05 00 33 0f 19 4f   NXCINARY. ..3..O
+|   3200: 4d 49 54 20 4c 4f 41 44 20 45 58 54 45 4e 53 49   MIT LOAD EXTENSI
+|   3216: 4f 4e 58 4e 4f 43 41 53 45 1e 1f 05 00 33 0f 17   ONXNOCASE....3..
+|   3232: 4f 4d 49 54 20 4c 4f 41 44 20 45 58 54 45 4e 53   OMIT LOAD EXTENS
+|   3248: 49 4f 4e 58 52 54 52 49 4d 1f 1e 05 00 33 0f 19   IONXRTRIM....3..
+|   3264: 4d 41 58 20 4d 45 4d 4f 52 59 3d 35 30 30 30 30   MAX MEMORY=50000
+|   3280: 30 30 30 58 42 49 4e 41 52 59 1f 1d 05 00 33 0f   000XBINARY....3.
+|   3296: 19 4d 41 58 20 4d 45 4d 4f 52 59 3d 35 30 30 30   .MAX MEMORY=5000
+|   3312: 30 30 30 30 58 4e 4f 43 41 53 45 1e 1c 05 00 33   0000XNOCASE....3
+|   3328: 0f 17 4d 41 58 20 4d 45 4d 4f 52 59 3d 35 30 30   ..MAX MEMORY=500
+|   3344: 30 30 30 30 30 58 52 54 52 49 4d 18 1b 05 00 25   00000XRTRIM....%
+|   3360: 0f 19 45 4e 41 42 4c 45 20 52 54 52 45 45 58 42   ..ENABLE RTREEXB
+|   3376: 49 4e 41 52 59 18 1a 05 00 25 0f 19 45 4e 41 42   INARY....%..ENAB
+|   3392: 4c 45 20 52 54 52 45 45 58 4e 4f 43 41 53 45 17   LE RTREEXNOCASE.
+|   3408: 19 05 00 25 0f 17 45 4e 41 42 4c 45 20 52 54 52   ...%..ENABLE RTR
+|   3424: 45 45 58 52 54 52 49 4d 1a 18 05 00 29 0f 19 45   EEXRTRIM....)..E
+|   3440: 4e 41 42 4c 45 20 4d 45 4d 53 59 53 35 58 42 49   NABLE MEMSYS5XBI
+|   3456: 4e 41 52 59 1a 17 05 00 29 0f 19 45 4e 41 42 4c   NARY....)..ENABL
+|   3472: 45 20 4d 45 4d 53 59 53 35 58 4e 4f 43 41 53 45   E MEMSYS5XNOCASE
+|   3488: 19 16 05 00 29 0f 17 45 4e 41 42 4c 45 20 4d 45   ....)..ENABLE ME
+|   3504: 4d 53 59 53 35 58 52 54 52 49 4d 18 15 09 00 25   MSYS5XRTRIM....%
+|   3520: 0f 19 45 4e 41 42 4c 45 20 4a 53 4f 4e 31 58 42   ..ENABLE JSON1XB
+|   3536: 49 4e 41 52 59 18 14 05 00 25 0f 19 45 4e 41 42   INARY....%..ENAB
+|   3552: 4c 45 20 4a 53 4f 4e 31 58 4e 4f 43 41 53 45 17   LE JSON1XNOCASE.
+|   3568: 13 05 00 25 0f 17 45 4e 41 42 4c 45 20 4a 53 4f   ...%..ENABLE JSO
+|   3584: 4e 31 58 52 54 52 49 4d 1a 12 05 00 29 0f 19 45   N1XRTRIM....)..E
+|   3600: 4e 41 42 4c 45 20 47 45 4f 50 4f 4c 59 58 42 49   NABLE GEOPOLYXBI
+|   3616: 4e 41 52 59 1a 11 05 00 29 0f 19 45 4e 41 42 4c   NARY....)..ENABL
+|   3632: 45 20 47 45 4f 50 4f 4c 59 58 4e 4f 43 41 53 45   E GEOPOLYXNOCASE
+|   3648: 19 10 05 00 29 0f 17 45 4e 41 42 4c 46 20 47 45   ....)..ENABLF GE
+|   3664: 4f 50 4f 4c 59 58 52 54 52 49 4d 17 0f 05 00 23   OPOLYXRTRIM....#
+|   3680: 0f 19 45 4e 41 42 4c 45 20 46 54 53 35 58 42 49   ..ENABLE FTS5XBI
+|   3696: 4e 41 52 59 17 0e 05 00 23 0f 19 45 4e 41 42 4c   NARY....#..ENABL
+|   3712: 45 20 46 54 53 35 58 4e 4f 43 41 53 45 16 0d 05   E FTS5XNOCASE...
+|   3728: 00 23 0f 17 45 4e 41 42 4c 45 20 46 54 53 35 58   .#..ENABLE FTS5X
+|   3744: 52 54 52 49 4d 17 0c 05 00 23 0f 19 45 4e 41 42   RTRIM....#..ENAB
+|   3760: 4c 45 20 46 54 53 34 58 42 49 4e 41 52 59 17 0b   LE FTS4XBINARY..
+|   3776: 05 00 23 0f 19 45 4e 41 42 4c 45 20 46 54 53 34   ..#..ENABLE FTS4
+|   3792: 58 4e 4f 43 41 53 45 16 0a 05 00 23 0f 17 45 4e   XNOCASE....#..EN
+|   3808: 41 42 4c 45 20 46 54 53 34 58 52 54 52 49 4d 1e   ABLE FTS4XRTRIM.
+|   3824: 09 05 00 31 0f 19 45 4e 41 42 4c 45 20 44 42 53   ...1..ENABLE DBS
+|   3840: 54 41 54 20 56 54 41 42 58 42 49 4e 41 52 59 1e   TAT VTABXBINARY.
+|   3856: 08 05 00 31 0f 19 45 4e 41 42 4c 45 20 44 42 53   ...1..ENABLE DBS
+|   3872: 54 41 54 20 56 54 41 42 58 4e 4f 43 41 53 45 1d   TAT VTABXNOCASE.
+|   3888: 07 05 00 31 0f 17 45 4e 41 42 4c 45 20 44 42 53   ...1..ENABLE DBS
+|   3904: 54 41 54 20 56 54 41 42 58 52 54 52 49 4d 11 06   TAT VTABXRTRIM..
+|   3920: 05 00 17 0f 19 44 45 42 55 47 58 42 49 4e 41 52   .....DEBUGXBINAR
+|   3936: 59 11 05 05 00 17 0f 19 44 45 42 55 47 58 4e 4f   Y.......DEBUGXNO
+|   3952: 43 41 53 45 10 04 05 00 17 0f 17 44 45 42 55 47   CASE.......DEBUG
+|   3968: 58 52 54 52 49 4d 27 03 05 00 43 0f 19 43 4f 4d   XRTRIM'...C..COM
+|   3984: 50 49 4c 45 52 3d 67 63 63 2d 35 2e 34 2e 30 20   PILER=gcc-5.4.0 
+|   4000: 32 30 31 36 30 36 30 39 58 42 49 4e 41 52 59 27   20160609XBINARY'
+|   4016: 02 05 00 43 0f 19 43 4f 4d 50 49 4c 45 52 3d 67   ...C..COMPILER=g
+|   4032: 63 63 2d 35 2e 34 2e 30 20 32 30 31 36 30 36 30   cc-5.4.0 2016060
+|   4048: 39 58 4e 4f 43 41 53 45 26 01 05 00 43 0f 17 43   9XNOCASE&...C..C
+|   4064: 4f 4d 50 49 4c 45 52 3d 67 63 63 2d 35 2e 34 2e   OMPILER=gcc-5.4.
+|   4080: 30 20 32 30 31 36 30 36 30 39 58 52 54 52 49 4d   0 20160609XRTRIM
+| page 4 offset 12288
+|      0: 0d 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00   ................
+| page 5 offset 16384
+|      0: 0d 00 00 00 02 0b a0 00 0c ad 0b a0 00 00 00 00   ................
+|   2976: 82 0a 02 08 08 09 08 08 17 84 06 30 20 32 35 33   ...........0 253
+|   2992: 00 01 30 04 25 06 1b 00 00 08 32 30 31 36 30 36   ..0.%.....201606
+|   3008: 30 39 03 25 07 00 00 01 34 03 25 05 00 00 01 35   09.%....4.%....5
+|   3024: 03 25 04 00 01 07 30 30 30 30 30 30 30 03 25 1a   .%....0000000.%.
+|   3040: 00 00 08 63 6f 6d 70 69 6c 65 72 03 25 02 00 00   ...compiler.%...
+|   3056: 06 64 62 73 74 61 74 03 25 0a 00 01 04 65 62 75   .dbstat.%....ebu
+|   3072: 67 03 25 08 00 00 06 65 6e 61 62 6c 65 09 25 09   g.%....enable.%.
+|   3088: 05 04 04 04 04 04 00 01 08 78 74 65 6e 73 69 6f   .........xtensio
+|   3104: 6e 03 25 1d 00 00 04 66 74 73 34 03 25 0d 00 03   n.%....fts4.%...
+|   3120: 01 35 03 25 0f 00 00 03 67 63 63 03 25 03 00 01   .5.%....gcc.%...
+|   3136: 06 65 6f 70 6f 6c 79 03 25 11 00 00 05 6a 73 6f   .eopoly.%....jso
+|   3152: 6e 31 03 25 13 00 00 04 6c 6f 61 64 03 25 1c 00   n1.%....load.%..
+|   3168: 00 03 6d 61 78 03 25 18 00 01 05 65 6d 6f 72 79   ..max.%....emory
+|   3184: 03 25 19 00 03 04 73 79 73 35 03 25 15 00 00 04   .%....sys5.%....
+|   3200: 6f 6d 69 74 03 25 1b 00 00 05 72 74 72 65 65 03   omit.%....rtree.
+|   3216: 25 17 00 00 0a 74 68 72 65 61 64 73 61 66 65 03   %....threadsafe.
+|   3232: 25 1e 00 00 04 76 74 61 62 03 25 0b 00 86 50 01   %....vtab.%...P.
+|   3248: 08 08 08 08 09 17 8d 12 30 20 38 33 35 00 01 30   ........0 835..0
+|   3264: 12 01 06 00 01 06 00 01 06 00 1f 03 00 01 03 00   ................
+|   3280: 01 03 00 00 08 32 30 31 36 30 36 30 39 09 01 07   .....20160609...
+|   3296: 00 01 07 00 01 07 00 00 01 34 09 01 05 00 01 05   .........4......
+|   3312: 00 01 05 00 00 01 35 09 01 04 00 01 04 00 01 04   ......5.........
+|   3328: 00 01 07 30 30 30 30 30 30 30 09 1c 04 00 01 04   ...0000000......
+|   3344: 00 01 04 00 00 06 62 69 6e 61 72 79 3c 03 01 02   ......binary<...
+|   3360: 02 00 03 01 02 02 00 03 01 02 02 00 03 01 02 02   ................
+|   3376: 00 03 01 02 02 00 03 01 02 02 00 03 01 02 02 00   ................
+|   3392: 03 01 02 02 00 03 01 02 02 00 03 01 02 02 00 03   ................
+|   3408: 01 02 02 00 03 01 02 02 00 00 08 63 6f 6d 70 69   ...........compi
+|   3424: 6c 65 72 09 01 02 00 01 02 00 01 02 00 00 06 64   ler............d
+|   3440: 62 73 74 61 74 09 07 03 00 01 03 00 01 03 00 01   bstat...........
+|   3456: 04 65 62 75 67 09 04 02 00 01 02 00 01 02 00 00   .ebug...........
+|   3472: 06 65 6e 61 62 6c 65 3f 07 02 00 01 02 00 01 02   .enable?........
+|   3488: 00 01 02 00 01 02 00 01 02 00 01 02 00 01 02 00   ................
+|   3504: 01 02 00 01 02 00 01 02 00 01 02 00 01 02 00 01   ................
+|   3520: 02 00 01 02 00 01 02 00 01 02 00 01 02 00 01 02   ................
+|   3536: 00 01 02 00 01 02 00 01 08 78 74 65 6e 73 69 6f   .........xtensio
+|   3552: 6e 09 1f 04 00 01 04 00 01 04 00 00 04 66 74 73   n............fts
+|   3568: 34 09 0a 03 00 01 03 00 01 03 00 03 01 35 09 0d   4............5..
+|   3584: 03 00 01 03 00 01 03 00 00 03 67 63 63 09 01 03   ..........gcc...
+|   3600: 00 01 03 00 01 03 00 01 06 65 6f 70 6f 6c 79 09   .........eopoly.
+|   3616: 10 03 00 01 03 00 01 03 00 00 05 6a 73 6f 6e 31   ...........json1
+|   3632: 09 13 03 00 01 03 00 01 03 00 00 04 6c 6f 61 64   ............load
+|   3648: 09 1f 03 00 01 03 00 01 03 00 00 03 6d 61 78 09   ............max.
+|   3664: 1c 02 00 01 02 00 01 02 00 01 05 65 6d 6f 72 79   ...........emory
+|   3680: 09 1c 03 00 01 03 00 01 03 00 03 04 73 79 73 35   ............sys5
+|   3696: 09 16 03 00 01 03 00 01 03 00 00 06 6e 6f 63 61   ............noca
+|   3712: 73 65 3c 02 01 02 02 00 03 01 02 02 00 03 01 02   se<.............
+|   3728: 02 00 03 01 02 02 00 03 01 02 02 00 03 01 02 02   ................
+|   3744: 00 03 01 02 02 00 03 01 02 02 00 03 01 02 02 00   ................
+|   3760: 03 01 02 02 00 03 01 02 02 00 03 01 02 02 00 00   ................
+|   3776: 04 6f 6d 69 74 09 1f 02 00 01 02 00 01 02 00 00   .omit...........
+|   3792: 05 72 74 72 65 65 09 19 03 00 01 03 00 01 03 00   .rtree..........
+|   3808: 03 02 69 6d 3c 01 01 02 02 00 03 01 02 02 00 03   ..im<...........
+|   3824: 01 02 02 00 03 01 02 02 00 03 01 02 02 00 03 01   ................
+|   3840: 02 02 00 03 01 02 02 00 03 01 02 02 00 03 01 02   ................
+|   3856: 02 00 03 01 02 02 00 03 01 02 02 00 03 01 02 02   ................
+|   3872: 00 00 0a 74 68 72 65 61 64 73 61 66 65 09 22 02   ...threadsafe...
+|   3888: 00 01 02 00 02 02 00 00 04 76 74 61 62 09 07 04   .........vtab...
+|   3904: 00 01 04 00 01 04 00 00 01 78 b4 01 01 01 01 02   .........x......
+|   3920: 00 01 01 01 02 00 01 01 01 02 00 01 01 01 02 00   ................
+|   3936: 01 01 01 02 00 01 01 01 02 00 01 01 01 02 00 01   ................
+|   3952: 01 01 02 00 01 01 01 02 00 01 01 01 02 00 01 01   ................
+|   3968: 01 02 00 01 01 01 02 00 01 01 01 02 00 01 01 01   ................
+|   3984: 02 00 01 01 01 02 00 01 01 01 02 00 01 01 01 02   ................
+|   4000: 10 01 01 01 02 00 01 01 01 02 00 01 01 01 02 00   ................
+|   4016: 01 01 01 02 00 01 01 01 02 00 01 01 01 02 00 01   ................
+|   4032: 01 01 02 00 01 01 01 02 00 01 01 01 02 00 01 01   ................
+|   4048: 01 02 00 01 01 01 02 00 01 01 01 02 00 01 01 01   ................
+|   4064: 02 00 01 01 02 02 00 01 01 01 02 00 01 01 01 02   ................
+|   4080: 00 01 01 01 02 00 01 01 01 02 00 01 01 01 02 00   ................
+| page 6 offset 20480
+|      0: 0a 00 00 00 02 0f f5 00 0f fb 0f f5 00 00 00 00   ................
+|   4080: 00 00 00 00 00 05 04 08 09 01 02 04 04 08 08 09   ................
+| page 7 offset 24576
+|      0: 0d 00 00 00 05 0f b8 00 0f f4 0f e9 0f d6 0f c7   ................
+|     16: 0f b8 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
+|   4016: 00 00 00 00 00 00 00 00 0d 05 02 23 61 75 74 6f   ...........#auto
+|   4032: 6d 65 72 67 65 3d 35 0d 04 02 23 6d 65 72 67 65   merge=5...#merge
+|   4048: 3d 31 30 30 2c 38 11 03 02 2b 69 6e 74 65 67 72   =100,8...+integr
+|   4064: 69 74 79 2d 63 68 65 63 6b 09 02 02 1b 72 65 62   ity-check....reb
+|   4080: 75 69 6c 64 0a 01 02 1d 6f 70 74 69 6d 69 7a 65   uild....optimize
+| end crash-c3a971f0061039.db
+}]} {}
+
+do_catchsql_test 10.1 {
+  WITH RECURSIVE c(x) AS (VALUES(1) UNION ALL SELECT x+1 FROM c WHERE x<100)
+    INSERT OR IGNORE INTO t1(a,c) SELECT x,null FROM c
+    UNION ALL SELECT 180-x,printf('[%,d]',x*-5844627) FROM c;
+} {0 {}}
+
+do_catchsql_test 10.3 {
+  INSERT INTO t1(t1) VALUES('optimize');
+} {1 {database disk image is malformed}}
+
+#-------------------------------------------------------------------------
+reset_db
+do_test 11.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 28672 pagesize 4096 filename crash-843cb8447eaf14.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 00 00 00 00 07   .....@  ........
+|     32: 00 00 00 02 00 00 00 01 00 00 00 07 00 00 00 04   ................
+|     48: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00   ................
+|     96: 00 00 00 00 0d 0e b1 00 06 0d a4 00 0f 8d 0f 21   ...............!
+|    112: 0e b9 0d c8 0e 7e 0d a4 0d a4 00 00 00 00 00 00   .....~..........
+|   3488: 00 00 00 00 22 07 06 17 11 11 01 31 74 61 62 6c   ...........1tabl
+|   3504: 65 74 32 74 32 07 43 52 45 41 54 45 20 54 41 42   et2t2.CREATE TAB
+|   3520: 4c 45 20 74 32 28 78 29 81 33 05 07 17 1f 1f 01   LE t2(x).3......
+|   3536: 82 35 74 61 62 6c 65 74 31 5f 73 65 67 64 69 72   .5tablet1_segdir
+|   3552: 74 31 5f 73 65 67 64 69 72 05 43 52 45 41 54 45   t1_segdir.CREATE
+|   3568: 20 54 41 42 4c 45 20 27 74 31 5f 73 65 67 64 69    TABLE 't1_segdi
+|   3584: 72 27 28 6c 65 76 65 6c 20 49 4e 54 45 47 45 52   r'(level INTEGER
+|   3600: 2c 69 64 78 20 49 4e 54 45 47 45 52 2c 73 74 61   ,idx INTEGER,sta
+|   3616: 72 74 5f 62 6c 6f 63 6b 20 49 4e 54 45 47 45 52   rt_block INTEGER
+|   3632: 2c 6c 65 61 76 65 73 5f 65 6e 64 5f 62 6c 6f 63   ,leaves_end_bloc
+|   3648: 6b 20 49 4e 54 45 47 45 52 2c 65 6e 64 5f 62 6c   k INTEGER,end_bl
+|   3664: 6f 63 6b 20 49 4e 54 45 47 45 52 2c 72 6f 6f 74   ock INTEGER,root
+|   3680: 20 42 4c 4f 42 2c 50 52 49 4d 41 52 59 20 4b 45    BLOB,PRIMARY KE
+|   3696: 59 28 6c 65 76 65 6c 2c 20 69 64 78 29 29 31 06   Y(level, idx))1.
+|   3712: 06 17 45 1f 01 00 69 6e 64 65 78 73 71 6c 69 74   ..E...indexsqlit
+|   3728: 65 5f 61 75 74 6f 69 6e 64 65 78 5f 74 31 5f 73   e_autoindex_t1_s
+|   3744: 65 67 64 69 72 5f 31 74 31 5f 73 65 67 64 69 72   egdir_1t1_segdir
+|   3760: 06 0f c7 00 08 00 00 00 00 66 04 07 17 23 23 01   .........f...##.
+|   3776: 81 13 74 61 62 6c 65 74 31 5f 73 65 67 6d 65 6e   ..tablet1_segmen
+|   3792: 74 73 74 31 5f 73 65 67 6d 65 6e 74 73 04 43 52   tst1_segments.CR
+|   3808: 45 41 54 45 20 54 41 42 4c 45 20 27 74 31 5f 73   EATE TABLE 't1_s
+|   3824: 65 67 6d 65 6e 74 73 27 28 62 6c 6f 63 6b 69 64   egments'(blockid
+|   3840: 20 49 4e 54 45 47 45 52 20 50 52 49 4d 41 52 59    INTEGER PRIMARY
+|   3856: 20 4b 45 59 2c 20 62 6c 6f 63 6b 20 42 4c 4f 42    KEY, block BLOB
+|   3872: 29 6a 03 07 17 21 21 01 81 1f 74 61 62 6c 65 74   )j...!!...tablet
+|   3888: 31 5f 63 6f 6e 74 65 6e 74 74 31 5f 63 6f 6e 74   1_contentt1_cont
+|   3904: 65 6e 74 03 43 52 45 41 54 45 20 54 41 42 4c 45   ent.CREATE TABLE
+|   3920: 20 27 74 31 5f 63 6f 6e 74 65 6e 74 27 28 64 6f    't1_content'(do
+|   3936: 63 69 64 20 49 4e 54 45 47 45 52 20 50 52 49 4d   cid INTEGER PRIM
+|   3952: 41 52 59 20 4b 45 59 2c 20 27 63 30 61 27 2c 20   ARY KEY, 'c0a', 
+|   3968: 27 63 31 62 27 2c 20 27 63 32 63 27 29 38 02 06   'c1b', 'c2c')8..
+|   3984: 17 11 11 08 5f 74 61 62 6c 65 74 31 74 31 43 52   ...._tablet1t1CR
+|   4000: 45 41 54 45 20 56 49 52 54 55 41 4c 20 54 41 42   EATE VIRTUAL TAB
+|   4016: 4c 45 20 74 31 20 55 53 49 4e 47 20 66 74 73 33   LE t1 USING fts3
+|   4032: 28 61 2c 62 2c 63 29 00 00 00 39 00 00 00 00 00   (a,b,c)...9.....
+| page 3 offset 8192
+|      0: 0d 00 00 00 25 0b 48 00 0f d8 0f af 0f 86 0f 74   ....%.H........t
+|     16: 0f 61 0f 4e 0f 2f 0f 0f 0e ef 0e d7 0e be 0e a5   .a.N./..........
+|     32: 0e 8d 0e 74 0e 5b 0e 40 0e 24 0e 08 0d ef 0d d4   ...t.[.@.$......
+|     48: dd bb 0d a0 0d 84 0d 68 0d 4f 0d 35 0d 1b 0c fb   .......h.O.5....
+|     64: 0c da 0c b9 35 99 0c 78 0c 57 0c 3e 0c 24 0c 0a   ....5..x.W.>.$..
+|     80: 0b 48 00 00 00 00 00 00 00 00 00 00 00 00 00 00   .H..............
+|   2880: 00 00 00 00 00 00 00 00 81 3f 25 06 00 82 7f 00   .........?%.....
+|   2896: 00 43 4f 4d 50 49 4c 45 52 3d 67 63 63 2d 35 2e   .COMPILER=gcc-5.
+|   2912: 34 2e 30 20 32 30 31 36 30 36 30 39 20 44 45 42   4.0 20160609 DEB
+|   2928: 55 47 20 45 4e 41 42 4c 45 20 44 42 53 54 41 54   UG ENABLE DBSTAT
+|   2944: 20 56 54 41 42 20 45 4e 41 42 4c 45 20 46 54 53    VTAB ENABLE FTS
+|   2960: 34 20 45 4e 41 42 4c 45 20 46 54 53 35 20 45 4e   4 ENABLE FTS5 EN
+|   2976: 41 42 4c 45 20 47 45 4f 50 4f 4c 59 20 45 4e 41   ABLE GEOPOLY ENA
+|   2992: 42 4c 45 20 4a 53 4f 4e 31 20 45 4e 41 42 4c 45   BLE JSON1 ENABLE
+|   3008: 20 4d 45 4d 53 59 53 35 20 45 4e 41 42 4c 45 20    MEMSYS5 ENABLE 
+|   3024: 52 54 52 45 45 20 4d 41 58 20 4d 45 4d 4f 52 59   RTREE MAX MEMORY
+|   3040: 3d 35 30 30 30 30 30 30 30 20 4f 4d 49 54 20 4c   =50000000 OMIT L
+|   3056: 4f 41 44 20 45 58 54 45 4e 53 49 4f 4e 20 54 48   OAD EXTENSION TH
+|   3072: 52 45 41 44 53 41 46 45 3d 30 18 24 05 00 25 0f   READSAFE=0.$..%.
+|   3088: 19 54 48 52 45 41 44 53 41 46 45 3d 30 58 42 49   .THREADSAFE=0XBI
+|   3104: 4e 41 52 59 18 23 05 00 25 0f 19 54 48 52 45 41   NARY.#..%..THREA
+|   3120: 44 53 41 46 45 3d 30 58 4e 4f 43 41 53 45 17 22   DSAFE=0XNOCASE..
+|   3136: 05 00 25 0f 17 54 48 52 45 41 44 53 41 46 45 3d   ..%..THREADSAFE=
+|   3152: 30 58 52 54 52 49 4d 1f 21 05 00 33 0f 19 4f 4d   0XRTRIM.!..3..OM
+|   3168: 49 54 20 4c 4f 41 44 20 45 58 54 45 4e 53 49 4f   IT LOAD EXTENSIO
+|   3184: 4e 58 42 49 4e 41 52 59 1f 20 05 00 33 0f 19 4f   NXBINARY. ..3..O
+|   3200: 4d 49 54 20 4c 4f 41 44 20 45 58 54 45 4e 53 49   MIT LOAD EXTENSI
+|   3216: 4f 4e 58 4e 4f 43 41 53 45 1e 1f 05 00 33 0f 17   ONXNOCASE....3..
+|   3232: 4f 4d 49 54 20 4c 4f 41 44 20 45 58 54 45 4e 53   OMIT LOAD EXTENS
+|   3248: 49 4f 4e 58 52 54 52 49 4d 1f 1e 05 00 33 0f 19   IONXRTRIM....3..
+|   3264: 4d 41 58 20 4d 45 4d 4f 52 59 3d 35 30 30 30 30   MAX MEMORY=50000
+|   3280: 30 30 30 58 42 49 4e 41 52 59 1f 1d 05 00 33 0f   000XBINARY....3.
+|   3296: 19 4d 41 58 20 4d 45 4d 4f 52 59 3d 35 30 30 30   .MAX MEMORY=5000
+|   3312: 30 30 30 30 58 4e 4f 43 41 53 45 1e 1c 05 00 33   0000XNOCASE....3
+|   3328: 0f 17 4d 41 58 20 4d 45 4d 4f 52 59 3d 35 30 30   ..MAX MEMORY=500
+|   3344: 30 30 30 30 30 58 52 54 52 49 4d 18 1b 05 00 25   00000XRTRIM....%
+|   3360: 0f 19 45 4e 41 42 4c 45 20 52 54 52 45 45 58 42   ..ENABLE RTREEXB
+|   3376: 49 4e 41 52 59 18 1a 05 00 25 0f 19 45 4e 41 42   INARY....%..ENAB
+|   3392: 4c 45 20 52 54 52 45 45 58 4e 4f 43 41 53 45 17   LE RTREEXNOCASE.
+|   3408: 19 05 00 25 0f 17 45 4e 41 42 4c 45 20 52 54 52   ...%..ENABLE RTR
+|   3424: 45 45 58 52 54 52 49 4d 1a 18 05 00 29 0f 19 45   EEXRTRIM....)..E
+|   3440: 4e 41 42 4c 45 20 4d 45 4d 53 59 53 35 58 42 49   NABLE MEMSYS5XBI
+|   3456: 4e 41 52 59 1a 17 05 00 29 0f 19 45 4e 41 42 4c   NARY....)..ENABL
+|   3472: 45 20 4d 45 4d 53 59 53 35 58 4e 4f 43 41 53 45   E MEMSYS5XNOCASE
+|   3488: 19 16 05 00 29 0f 17 45 4e 41 42 4c 45 20 4d 45   ....)..ENABLE ME
+|   3504: 4d 53 59 53 35 58 52 54 52 49 4d 18 15 05 00 25   MSYS5XRTRIM....%
+|   3520: 0f 19 45 4e 41 42 4c 45 20 4a 53 4f 4e 31 58 42   ..ENABLE JSON1XB
+|   3536: 49 4e 41 52 59 18 14 05 00 25 0f 19 45 4e 41 42   INARY....%..ENAB
+|   3552: 4c 45 20 4a 53 4f 4e 31 58 4e 4f 43 41 53 45 17   LE JSON1XNOCASE.
+|   3568: 13 05 00 25 0f 17 45 4e 41 42 4c 45 20 4a 53 4f   ...%..ENABLE JSO
+|   3584: 4e 31 58 52 54 52 49 4d 1a 12 05 00 29 0f 19 45   N1XRTRIM....)..E
+|   3600: 4e 41 42 4c 45 20 47 45 4f 50 4f 4c 59 58 42 49   NABLE GEOPOLYXBI
+|   3616: 4e 41 52 59 1a 11 05 00 29 0f 19 45 4e 41 42 4c   NARY....)..ENABL
+|   3632: 45 20 47 45 4f 50 4f 4c 59 58 4e 4f 43 41 53 45   E GEOPOLYXNOCASE
+|   3648: 19 10 05 00 29 0f 17 45 4e 41 42 4c 45 20 47 45   ....)..ENABLE GE
+|   3664: 4f 50 4f 4c 59 58 52 54 52 49 4d 17 0f 05 00 23   OPOLYXRTRIM....#
+|   3680: 0f 19 45 4e 41 42 4c 45 20 46 54 53 35 58 42 49   ..ENABLE FTS5XBI
+|   3696: 4e 41 52 59 17 0e 05 00 23 0f 19 45 4e 41 42 4c   NARY....#..ENABL
+|   3712: 45 20 46 54 53 35 58 4e 4f 43 41 53 45 16 0d 05   E FTS5XNOCASE...
+|   3728: 00 23 0f 17 45 4e 41 42 4c 45 20 46 54 53 35 58   .#..ENABLE FTS5X
+|   3744: 52 54 52 49 4d 17 0c 05 00 23 0f 19 45 4e 41 42   RTRIM....#..ENAB
+|   3760: 4c 45 20 46 54 53 34 58 42 49 4e 41 52 59 17 0b   LE FTS4XBINARY..
+|   3776: 05 00 23 0f 19 45 4e 41 42 4c 45 20 46 54 53 34   ..#..ENABLE FTS4
+|   3792: 58 4e 4f 43 41 53 45 16 0a 05 00 23 0f 17 45 4e   XNOCASE....#..EN
+|   3808: 41 42 4c 45 20 46 54 53 34 58 52 54 52 49 4d 1e   ABLE FTS4XRTRIM.
+|   3824: 09 05 00 31 0f 19 45 4e 41 42 4c 45 20 44 42 53   ...1..ENABLE DBS
+|   3840: 54 41 54 20 56 54 41 42 58 42 49 4e 41 52 59 1e   TAT VTABXBINARY.
+|   3856: 08 05 00 31 0f 19 45 4e 41 42 4c 45 20 44 42 53   ...1..ENABLE DBS
+|   3872: 54 41 54 20 56 54 41 42 58 4e 4f 43 41 53 45 1d   TAT VTABXNOCASE.
+|   3888: 07 05 00 31 0f 17 45 4e 41 42 4c 45 20 44 42 53   ...1..ENABLE DBS
+|   3904: 54 41 54 20 56 54 41 42 58 52 54 52 49 4d 11 06   TAT VTABXRTRIM..
+|   3920: 05 00 17 0f 19 44 45 42 55 47 58 42 49 4e 41 52   .....DEBUGXBINAR
+|   3936: 59 11 05 05 00 17 0f 19 44 45 42 55 47 58 4e 4f   Y.......DEBUGXNO
+|   3952: 43 41 53 45 10 04 05 00 17 0f 17 44 45 42 55 47   CASE.......DEBUG
+|   3968: 58 52 54 52 49 4d 27 03 05 00 43 0f 19 43 4f 4d   XRTRIM'...C..COM
+|   3984: 50 49 4c 45 52 3d 67 63 63 2d 35 2e 34 2e 30 20   PILER=gcc-5.4.0 
+|   4000: 32 30 31 36 30 36 30 39 58 42 49 4e 41 52 59 27   20160609XBINARY'
+|   4016: 02 05 00 43 0f 19 43 4f 4d 50 49 4c 45 52 3d 67   ...C..COMPILER=g
+|   4032: 63 63 2d 35 2e 34 2e 30 20 32 30 31 36 30 36 30   cc-5.4.0 2016060
+|   4048: 39 58 4e 4f 43 41 53 45 26 01 05 00 43 0f 17 43   9XNOCASE&...C..C
+|   4064: 4f 4d 50 49 4c 45 52 3d 67 63 63 2d 35 2e 34 2e   OMPILER=gcc-5.4.
+|   4080: 30 20 32 30 31 36 30 36 30 39 58 52 54 52 49 4d   0 20160609XRTRIM
+| page 4 offset 12288
+|      0: 0d 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00   ................
+| page 5 offset 16384
+|      0: 0d 00 00 00 02 0b a0 00 0c ad 0b a0 00 00 00 00   ................
+|   2976: 82 0a 02 08 08 09 08 08 17 84 06 30 20 32 35 33   ...........0 253
+|   2992: 00 01 30 04 25 06 1b 00 00 08 32 30 31 36 30 36   ..0.%.....201606
+|   3008: 30 39 03 25 07 00 00 01 34 03 25 05 00 00 01 35   09.%....4.%....5
+|   3024: 03 25 04 00 01 07 30 30 30 30 30 30 30 03 25 1a   .%....0000000.%.
+|   3040: 00 00 08 63 6f 6d 70 69 6c 65 72 03 25 02 00 00   ...compiler.%...
+|   3056: 06 64 62 73 74 61 74 03 25 0a 00 01 04 65 62 75   .dbstat.%....ebu
+|   3072: 67 03 25 08 00 00 06 65 6e 61 62 6c 65 09 25 09   g.%....enable.%.
+|   3088: 05 04 04 04 04 04 00 01 08 78 74 65 6e 73 69 6f   .........xtensio
+|   3104: 6e 03 25 1d 00 00 04 66 74 73 34 03 25 0d 00 03   n.%....fts4.%...
+|   3120: 01 35 03 25 0f 00 00 03 67 63 63 03 25 03 00 01   .5.%....gcc.%...
+|   3136: 06 65 6f 70 6f 6c 79 03 25 11 00 00 05 6a 73 6f   .eopoly.%....jso
+|   3152: 6e 31 03 25 13 00 00 04 6c 6f 61 64 03 25 1c 00   n1.%....load.%..
+|   3168: 00 03 6d 61 78 03 25 18 00 01 05 65 6d 6f 72 79   ..max.%....emory
+|   3184: 03 25 19 00 03 04 73 79 73 35 03 25 15 00 00 04   .%....sys5.%....
+|   3200: 6f 6d 69 74 03 25 1b 00 00 05 72 74 72 65 65 03   omit.%....rtree.
+|   3216: 25 17 00 00 0a 74 68 72 65 61 64 73 61 66 65 03   %....threadsafe.
+|   3232: 25 1e 00 00 04 76 74 61 62 03 25 0b 00 86 50 01   %....vtab.%...P.
+|   3248: 08 08 08 08 08 17 8d 12 30 20 38 33 35 00 01 30   ........0 835..0
+|   3264: 12 01 06 00 01 06 00 01 06 00 1f 03 00 01 03 00   ................
+|   3280: 01 03 00 00 08 32 30 31 36 30 36 30 39 09 01 07   .....20160609...
+|   3296: 00 01 07 00 01 07 00 00 01 34 09 01 05 00 01 05   .........4......
+|   3312: 00 01 05 00 00 01 35 09 01 04 00 01 04 00 01 04   ......5.........
+|   3328: 00 01 07 30 30 30 30 30 30 30 09 1c 04 00 01 04   ...0000000......
+|   3344: 00 01 04 00 00 06 62 69 6e 61 72 79 3c 03 01 02   ......binary<...
+|   3360: 02 00 03 01 02 02 00 03 01 02 02 00 03 01 02 02   ................
+|   3376: 00 03 01 02 02 00 03 01 02 02 00 03 01 02 02 00   ................
+|   3392: 03 01 02 02 00 03 01 02 02 00 03 01 02 02 00 03   ................
+|   3408: 01 02 02 00 03 01 02 02 00 00 08 63 6f 6d 70 69   ...........compi
+|   3424: 6c 65 72 09 01 02 00 01 02 00 01 02 00 00 06 64   ler............d
+|   3440: 62 73 74 61 74 09 07 03 00 01 03 00 01 03 00 01   bstat...........
+|   3456: 04 65 62 75 67 09 04 02 00 01 02 00 01 02 00 00   .ebug...........
+|   3472: 06 65 6e 61 62 6c 65 3f 07 02 00 01 02 00 01 02   .enable?........
+|   3488: 00 01 02 00 01 02 00 01 02 00 01 02 00 01 02 00   ................
+|   3504: 01 02 00 01 02 00 01 02 00 01 02 00 01 01 00 01   ................
+|   3520: 02 00 01 02 00 01 02 00 01 02 00 01 02 00 01 02   ................
+|   3536: 00 01 02 00 01 02 00 01 08 78 74 65 6e 73 69 6f   .........xtensio
+|   3552: 6e 09 1f 04 00 01 04 00 01 04 00 00 04 66 74 73   n............fts
+|   3568: 34 09 0a 03 00 01 03 00 01 03 00 03 01 35 09 0d   4............5..
+|   3584: 03 00 01 03 00 01 03 00 00 03 67 63 63 09 01 03   ..........gcc...
+|   3600: 00 01 03 00 01 03 00 01 06 65 6f 70 6f 6c 79 09   .........eopoly.
+|   3616: 10 03 00 01 03 00 01 03 00 00 05 6a 73 6f 6e 31   ...........json1
+|   3632: 09 13 03 00 01 03 00 01 03 00 00 04 6c 6f 61 64   ............load
+|   3648: 09 1f 03 00 01 03 00 01 03 00 00 03 6d 61 78 09   ............max.
+|   3664: 1c 02 00 01 02 00 01 02 00 01 05 65 6d 6f 72 79   ...........emory
+|   3680: 09 1c 03 00 01 03 00 01 03 00 03 04 73 79 73 35   ............sys5
+|   3696: 09 16 03 00 01 03 00 01 03 00 00 06 6e 6f 63 61   ............noca
+|   3712: 73 65 3c 02 01 02 02 00 03 01 02 02 00 03 01 02   se<.............
+|   3728: 02 00 03 01 02 02 00 03 01 02 02 00 03 01 02 02   ................
+|   3744: 00 03 01 02 02 00 03 01 02 02 00 03 01 02 02 00   ................
+|   3760: 03 01 02 02 00 03 01 02 02 00 03 01 02 02 00 00   ................
+|   3776: 04 6f 6d 69 74 09 1f 02 00 01 02 00 01 02 00 00   .omit...........
+|   3792: 05 72 74 72 65 65 09 19 03 00 01 03 00 01 03 00   .rtree..........
+|   3808: 03 02 69 6d 3c 01 01 02 02 00 03 01 02 02 00 03   ..im<...........
+|   3824: 01 02 02 00 03 01 02 02 00 03 01 02 02 00 03 01   ................
+|   3840: 02 02 00 03 01 02 02 00 03 01 a2 02 00 03 01 02   ................
+|   3856: 02 00 03 01 02 02 00 03 01 02 02 00 03 01 02 02   ................
+|   3872: 00 00 0a 74 68 72 65 61 64 73 61 66 65 09 22 02   ...threadsafe...
+|   3888: 00 01 02 00 01 02 00 00 04 76 74 61 62 09 07 04   .........vtab...
+|   3904: 00 01 04 00 01 04 00 00 01 78 b4 01 01 01 01 02   .........x......
+|   3920: 00 01 01 01 02 00 01 01 01 02 00 01 01 01 02 00   ................
+|   3936: 01 01 01 02 00 01 01 01 02 00 01 01 01 02 00 01   ................
+|   3952: 01 01 02 00 01 01 01 02 00 01 01 01 02 00 01 01   ................
+|   3968: 01 02 00 01 01 01 02 00 01 01 01 02 00 01 01 01   ................
+|   3984: 02 00 01 01 01 02 00 01 01 01 02 00 01 01 01 02   ................
+|   4000: 00 01 01 01 02 00 01 01 01 02 00 01 01 01 02 00   ................
+|   4016: 01 01 01 02 00 01 01 01 02 00 01 01 01 02 00 01   ................
+|   4032: 01 01 02 00 01 01 01 02 00 01 01 01 02 00 01 01   ................
+|   4048: 01 02 00 01 01 01 02 00 01 01 01 02 00 01 01 01   ................
+|   4064: 02 00 01 01 01 02 00 01 01 01 02 00 01 01 01 02   ................
+|   4080: 00 01 01 01 02 00 01 01 01 02 00 01 01 01 02 00   ................
+| page 6 offset 20480
+|      0: 0a 00 00 00 02 0f f5 00 0f fb 0f f5 00 00 00 00   ................
+|   4080: 00 00 00 00 00 05 04 08 09 01 02 04 04 08 08 09   ................
+| page 7 offset 24576
+|      0: 0d 00 00 00 05 0f b8 00 0f f4 0f e9 0f d6 0f c7   ................
+|     16: 0f b8 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
+|   4016: 00 00 00 00 00 00 00 00 0d 05 02 23 61 75 74 6f   ...........#auto
+|   4032: 6d 65 72 67 65 3d 35 0d 04 02 23 6d 65 72 67 65   merge=5...#merge
+|   4048: 3d 31 30 30 2c 38 11 03 02 2b 69 6e 74 65 67 72   =100,8...+integr
+|   4064: 69 74 79 2d 63 68 65 63 6b 09 02 02 1b 72 65 62   ity-check....reb
+|   4080: 75 69 6c 64 0a 01 02 1d 6f 70 74 69 6d 69 7a 65   uild....optimize
+| end crash-843cb8447eaf14.db
+}]} {}
+
+do_catchsql_test 11.1 {
+  SELECT rowid, quote(matchinfo(t1,'pcxybs')) FROM t1 WHERE t1 MATCH 'e*'
+} {1 {database disk image is malformed}}
+
+#-------------------------------------------------------------------------
+reset_db
+do_test 12.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 28672 pagesize 4096 filename c81b.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 01 00 00 00 07   .....@  ........
+|     32: 00 00 00 02 00 00 00 01 00 00 00 01 00 00 00 04   ................
+|     48: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00   ................
+|     80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01   ................
+|     96: 00 2e 30 38 0d 0e b1 00 06 0d a4 00 0f 8d 0f 21   ..08...........!
+|    112: 0e b9 0d c8 0e 7e 0d a4 0d a4 00 00 00 00 00 00   .....~..........
+|   3488: 00 00 00 00 22 07 06 17 11 11 01 31 74 61 62 6c   ...........1tabl
+|   3504: 65 74 32 74 32 07 43 52 45 41 54 45 20 54 41 42   et2t2.CREATE TAB
+|   3520: 4c 45 20 74 32 28 78 29 81 33 05 07 17 1f 1f 01   LE t2(x).3......
+|   3536: 82 35 74 61 62 6c 65 74 31 5f 73 65 67 64 69 72   .5tablet1_segdir
+|   3552: 74 31 5f 73 65 67 64 69 72 05 43 52 45 41 54 45   t1_segdir.CREATE
+|   3568: 20 54 41 42 4c 45 20 27 74 31 5f 73 65 67 64 69    TABLE 't1_segdi
+|   3584: 72 27 28 6c 65 76 65 6c 20 49 4e 54 45 47 45 52   r'(level INTEGER
+|   3600: 2c 69 64 78 20 49 4e 54 45 47 45 52 2c 73 74 61   ,idx INTEGER,sta
+|   3616: 72 74 5f 62 6c 6f 63 6b 20 49 4e 54 45 47 45 52   rt_block INTEGER
+|   3632: 2c 6c 65 61 76 65 73 5f 65 6e 64 5f 62 6c 6f 63   ,leaves_end_bloc
+|   3648: 6b 20 49 4e 54 45 47 45 52 2c 65 6e 64 5f 62 6c   k INTEGER,end_bl
+|   3664: 6f 63 6b 20 49 4e 54 45 47 45 62 2c 72 6f 6f 74   ock INTEGEb,root
+|   3680: 20 42 4c 4f 42 2c 50 52 49 4d 41 52 59 20 4b 45    BLOB,PRIMARY KE
+|   3696: 59 28 6c 65 76 65 6c 2c 20 69 64 78 29 29 31 06   Y(level, idx))1.
+|   3712: 06 17 45 1f 01 00 69 6e 64 65 78 73 71 6c 69 74   ..E...indexsqlit
+|   3728: 65 5f 61 75 74 6f 69 6e 64 65 78 5f 74 31 5f 73   e_autoindex_t1_s
+|   3744: 65 67 64 69 72 5f 31 74 31 5f 73 65 67 64 69 72   egdir_1t1_segdir
+|   3760: 06 0f c7 00 08 00 00 00 00 66 04 07 17 23 23 01   .........f...##.
+|   3776: 81 13 74 61 62 6c 65 74 31 5f 73 65 67 6d 65 6e   ..tablet1_segmen
+|   3792: 74 73 74 31 5f 73 65 67 6d 65 6e 74 73 04 43 52   tst1_segments.CR
+|   3808: 45 41 54 45 20 54 41 42 4c 45 20 27 74 31 5f 73   EATE TABLE 't1_s
+|   3824: 65 67 6d 65 6e 74 73 27 28 62 6c 6f 63 6b 69 64   egments'(blockid
+|   3840: 20 49 4e 54 45 47 45 52 20 50 52 49 4d 41 52 59    INTEGER PRIMARY
+|   3856: 20 4b 45 59 2c 20 62 6c 6f 63 6b 20 42 4c 4f 42    KEY, block BLOB
+|   3872: 29 6a 03 07 17 21 21 01 81 1f 74 61 62 6c 65 74   )j...!!...tablet
+|   3888: 31 5f 63 6f 6e 74 65 6e 74 74 31 5f 63 6f 6e 74   1_contentt1_cont
+|   3904: 65 6e 74 03 43 52 45 41 54 45 20 54 41 42 4c 45   ent.CREATE TABLE
+|   3920: 20 27 74 31 5f 63 6f 6e 74 65 6e 74 27 28 64 6f    't1_content'(do
+|   3936: 63 69 64 20 49 4e 54 45 47 45 52 20 50 52 49 4d   cid INTEGER PRIM
+|   3952: 41 52 59 20 4b 45 59 2c 20 27 63 30 61 27 2c 20   ARY KEY, 'c0a', 
+|   3968: 27 63 31 62 27 2c 20 27 63 32 63 27 29 38 02 06   'c1b', 'c2c')8..
+|   3984: 17 11 11 08 5f 74 61 62 6c 65 74 31 74 31 43 52   ...._tablet1t1CR
+|   4000: 45 41 54 45 20 56 49 52 54 55 41 4c 20 54 41 42   EATE VIRTUAL TAB
+|   4016: 4c 45 20 74 31 20 55 53 49 4e 47 20 66 74 73 33   LE t1 USING fts3
+|   4032: 28 61 2c 62 2c 63 29 00 00 00 39 00 00 00 00 00   (a,b,c)...9.....
+| page 3 offset 8192
+|      0: 0d 00 00 00 25 0b 48 00 0f d8 0f af 0f 86 0f 74   ....%.H........t
+|     16: 0f 61 0f 4e 0f 2f 0f 0f 0e ef 0e d7 0e be 0e a5   .a.N./..........
+|     32: 0e 8d 0e 74 0e 5b 0e 40 0e 24 0e 08 0d ef 0d d5   ...t.[.@.$......
+|     48: 0d bb 0d a0 0d 84 0d 68 0d 4f 0d 35 0d 1b 0c fb   .......h.O.5....
+|     64: 0c da 0c b9 0c 99 0c 78 0c 57 0c 3e 0c 24 0c 0a   .......x.W.>.$..
+|     80: 0b 48 00 00 00 00 00 00 00 00 00 00 00 00 00 00   .H..............
+|   2880: 00 00 00 00 00 00 00 00 81 3f 25 06 00 82 7f 00   .........?%.....
+|   2896: 00 43 4f 4d 50 49 4c 45 52 3d 67 63 63 2d 35 2e   .COMPILER=gcc-5.
+|   2912: 34 2e 30 20 32 30 31 36 30 36 30 39 20 44 45 42   4.0 20160609 DEB
+|   2928: 55 47 20 45 4e 41 42 4c 45 20 44 42 53 54 41 54   UG ENABLE DBSTAT
+|   2944: 20 56 54 41 42 20 45 4e 41 42 4c 45 20 46 54 53    VTAB ENABLE FTS
+|   2960: 34 20 45 4e 41 42 4c 45 20 46 54 53 35 20 45 4e   4 ENABLE FTS5 EN
+|   2976: 41 42 4c 45 20 47 45 4f 50 4f 4c 59 20 46 4e 41   ABLE GEOPOLY FNA
+|   2992: 42 4c 45 20 4a 53 4f 4e 31 20 45 4e 41 42 4c 45   BLE JSON1 ENABLE
+|   3008: 20 4d 45 4d 53 59 53 35 20 45 4e 41 42 4c 45 20    MEMSYS5 ENABLE 
+|   3024: 52 54 52 45 45 20 4d 41 58 20 4d 45 4d 4f 52 59   RTREE MAX MEMORY
+|   3040: 3d 35 30 30 30 30 30 30 30 20 4f 4d 49 54 20 4c   =50000000 OMIT L
+|   3056: 4f 41 44 20 45 58 54 45 4e 53 49 4f 4e 20 54 48   OAD EXTENSION TH
+|   3072: 52 45 41 44 53 41 46 45 3d 30 18 24 05 00 0f 25   READSAFE=0.$...%
+|   3088: 19 58 54 48 52 45 41 44 53 41 46 45 3d 30 42 49   .XTHREADSAFE=0BI
+|   3104: 4e 41 52 59 18 23 05 00 0f 25 19 58 54 48 52 45   NARY.#...%.XTHRE
+|   3120: 41 44 53 41 46 45 3d 30 4e 4f 43 41 53 45 17 22   ADSAFE=0NOCASE..
+|   3136: 05 00 0f 25 17 58 54 48 52 45 41 44 53 41 46 45   ...%.XTHREADSAFE
+|   3152: 3d 30 52 54 52 49 4d 1f 21 05 00 0f 33 19 58 4f   =0RTRIM.!...3.XO
+|   3168: 4d 49 54 20 4c 4f 41 44 20 45 58 54 45 4e 53 49   MIT LOAD EXTENSI
+|   3184: 4f 4e 42 49 4e 41 52 59 1f 20 05 00 0f 33 19 58   ONBINARY. ...3.X
+|   3200: 4f 4d 49 54 20 4c 4f 41 44 20 45 58 54 45 4e 53   OMIT LOAD EXTENS
+|   3216: 49 4f 4e 4e 4f 43 41 53 45 1e 1f 05 00 0f 33 17   IONNOCASE.....3.
+|   3232: 58 4f 4d 49 54 20 4c 4f 41 44 20 45 58 54 45 4e   XOMIT LOAD EXTEN
+|   3248: 53 49 4f 4e 52 54 52 49 4d 1f 1e 05 00 0f 33 19   SIONRTRIM.....3.
+|   3264: 58 4d 41 58 20 4d 45 4d 4f 52 59 3d 35 30 30 30   XMAX MEMORY=5000
+|   3280: 30 30 30 30 42 49 4e 41 52 59 1f 1d 05 00 0f 33   0000BINARY.....3
+|   3296: 19 58 4d 41 58 20 4d 45 4d 4f 52 59 3d 35 30 30   .XMAX MEMORY=500
+|   3312: 30 30 30 30 30 4e 4f 43 41 53 45 1e 1c 05 00 0f   00000NOCASE.....
+|   3328: 33 17 58 4d 41 58 20 4d 45 4d 4f 52 59 3d 35 30   3.XMAX MEMORY=50
+|   3344: 30 30 30 30 30 30 52 54 52 49 4d 18 1b 05 00 0f   000000RTRIM.....
+|   3360: 25 19 58 45 4e 41 42 4c 45 20 52 54 52 45 45 42   %.XENABLE RTREEB
+|   3376: 49 4e 41 52 59 18 1a 05 00 0f 25 19 58 45 4e 41   INARY.....%.XENA
+|   3392: 42 4c 45 20 52 54 52 45 45 4e 4f 43 41 53 45 17   BLE RTREENOCASE.
+|   3408: 19 05 00 0f 25 17 58 45 4e 41 42 4c 45 20 52 54   ....%.XENABLE RT
+|   3424: 52 45 45 52 54 52 49 4d 1a 18 05 00 0f 29 19 58   REERTRIM.....).X
+|   3440: 45 4e 41 42 4c 45 20 4d 45 4d 53 59 53 35 42 49   ENABLE MEMSYS5BI
+|   3456: 4e 41 52 59 1a 17 05 00 0f 29 19 58 45 4e 41 42   NARY.....).XENAB
+|   3472: 4c 45 20 4d 45 4d 53 59 53 35 4e 4f 43 41 53 45   LE MEMSYS5NOCASE
+|   3488: 19 16 05 00 0f 29 17 58 45 4e 41 42 4c 45 20 4d   .....).XENABLE M
+|   3504: 45 4d 53 59 53 35 52 54 52 49 4d 18 15 05 00 0f   EMSYS5RTRIM.....
+|   3520: 25 19 58 45 4e 41 42 4c 45 20 4a 53 4f 4e 31 42   %.XENABLE JSON1B
+|   3536: 49 4e 41 52 59 18 14 05 00 0f 25 19 58 45 4e 41   INARY.....%.XENA
+|   3552: 42 4c 45 20 4a 53 4f 4e 31 4e 4f 43 41 53 45 17   BLE JSON1NOCASE.
+|   3568: 13 05 00 0f 25 17 58 45 4e 41 42 4c 45 20 4a 53   ....%.XENABLE JS
+|   3584: 4f 4e 31 52 54 52 49 4d 1a 12 05 00 0f 29 19 58   ON1RTRIM.....).X
+|   3600: 45 4e 41 42 4c 45 20 47 45 4f 50 4f 4c 59 42 49   ENABLE GEOPOLYBI
+|   3616: 4e 41 52 59 1a 11 05 00 0f 29 19 58 45 4e 41 1e   NARY.....).XENA.
+|   3632: 4c 45 20 47 45 4f 50 4f 4c 59 4e 4f 43 41 53 45   LE GEOPOLYNOCASE
+|   3648: 19 10 05 00 0f 29 17 58 45 4e 41 42 4c 45 20 47   .....).XENABLE G
+|   3664: 45 4f 50 4f 4c 59 52 54 52 49 4d 17 0f 05 00 0f   EOPOLYRTRIM.....
+|   3680: 23 19 58 45 4e 41 42 4c 45 20 46 54 53 35 42 49   #.XENABLE FTS5BI
+|   3696: 4e 41 52 59 17 0e 05 00 0f 23 19 58 55 4e 41 42   NARY.....#.XUNAB
+|   3712: 4c 45 20 46 54 53 35 4e 4f 43 41 53 45 16 0d 05   LE FTS5NOCASE...
+|   3728: 00 0f 23 17 58 45 4e 41 42 4c 45 20 46 54 53 35   ..#.XENABLE FTS5
+|   3744: 52 54 52 49 4d 17 0c 05 00 0f 23 19 58 45 4e 41   RTRIM.....#.XENA
+|   3760: 42 4c 45 20 46 54 53 34 42 49 4e 41 52 59 17 0b   BLE FTS4BINARY..
+|   3776: 05 00 0f 23 19 58 45 4e 41 42 4c 45 20 46 54 53   ...#.XENABLE FTS
+|   3792: 35 4e 4f 43 40 53 45 16 0a 05 00 0f 23 17 58 45   5NOC@SE.....#.XE
+|   3808: 4e 41 42 4c 45 20 46 54 53 34 52 54 52 49 4d 1e   NABLE FTS4RTRIM.
+|   3824: 09 05 00 0f 31 19 58 45 4e 41 42 4c 35 20 44 42   ....1.XENABL5 DB
+|   3840: 53 54 41 54 20 56 54 41 42 42 49 4e 41 52 59 1e   STAT VTABBINARY.
+|   3856: 08 05 00 0f 31 19 58 45 4e 41 42 4c 45 20 44 42   ....1.XENABLE DB
+|   3872: 53 54 41 54 20 56 54 41 42 4e 4f 43 41 53 45 1d   STAT VTABNOCASE.
+|   3888: 07 05 00 0f 31 17 58 45 4e 41 42 4c 45 20 44 42   ....1.XENABLE DB
+|   3904: 53 54 41 54 20 56 54 41 42 52 54 52 49 4d 11 06   STAT VTABRTRIM..
+|   3920: 05 00 0f 17 19 58 44 45 42 55 47 42 49 4e 41 52   .....XDEBUGBINAR
+|   3936: 59 11 05 05 00 0f 17 19 58 44 45 42 55 47 4e 4f   Y.......XDEBUGNO
+|   3952: 43 41 53 45 10 04 05 00 0f 17 17 58 44 45 42 55   CASE.......XDEBU
+|   3968: 47 52 54 52 49 4d 27 03 05 00 0f 43 19 58 43 4f   GRTRIM'....C.XCO
+|   3984: 4d 50 49 4c 45 52 3d 67 63 63 2d 35 2e 34 2e 30   MPILER=gcc-5.4.0
+|   4000: 20 32 30 31 36 30 36 30 39 42 49 4e 41 52 59 27    20160609BINARY'
+|   4016: 02 05 00 0f 43 19 58 43 4f 4d 50 49 4c 45 52 3d   ....C.XCOMPILER=
+|   4032: 67 63 63 2d 35 2e 34 2e 30 20 32 30 31 36 30 36   gcc-5.4.0 201606
+|   4048: 30 39 4e 4f 43 41 53 45 26 01 05 00 0f 43 17 58   09NOCASE&....C.X
+|   4064: 43 4f 4d 50 49 4c 45 52 3d 67 63 63 2d 35 2e 34   COMPILER=gcc-5.4
+|   4080: 2e 30 20 32 30 31 36 30 36 30 39 52 54 52 49 4d   .0 20160609RTRIM
+| page 4 offset 12288
+|      0: 0d 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00   ................
+| page 5 offset 16384
+|      0: 0d 00 00 00 03 07 bb 00 0c ad 0b a0 07 bb 00 00   ................
+|   1968: 00 00 00 00 00 00 00 00 00 00 00 87 62 03 08 08   ............b...
+|   1984: 01 08 08 17 8f 34 02 30 20 39 38 30 00 01 30 1e   .....4.0 980..0.
+|   2000: 01 01 01 06 00 01 01 01 06 00 01 01 01 06 00 1f   ................
+|   2016: 01 01 03 00 01 01 01 03 00 01 01 01 03 00 00 08   ................
+|   2032: 32 30 31 36 30 36 30 39 0f 01 01 01 07 00 01 01   20160609........
+|   2048: 01 07 00 01 01 01 07 00 00 01 34 0f 01 01 01 05   ..........4.....
+|   2064: 00 01 01 01 05 00 01 01 01 05 00 00 01 35 0f 01   .............5..
+|   2080: 01 01 04 00 01 01 01 04 00 01 01 01 04 00 01 07   ................
+|   2096: 30 30 30 30 30 30 30 0f 1c 01 01 04 00 01 01 01   0000000.........
+|   2112: 04 00 01 01 01 04 00 00 06 62 69 6e 61 72 79 3c   .........binary<
+|   2128: 03 01 02 02 00 03 01 02 02 00 03 01 02 02 00 03   ................
+|   2144: 01 02 02 00 03 01 02 02 00 03 01 02 02 00 03 01   ................
+|   2160: 02 02 00 03 01 02 02 00 03 01 02 02 00 03 01 02   ................
+|   2176: 02 00 03 01 02 02 00 03 01 02 02 00 00 08 63 6f   ..............co
+|   2192: 6d 70 69 6c 65 72 0f 01 01 01 02 00 01 01 01 02   mpiler..........
+|   2208: 00 01 01 01 02 00 00 06 64 62 73 74 61 74 0f 07   ........dbstat..
+|   2224: 01 01 03 00 01 01 01 03 00 01 01 01 03 00 01 04   ................
+|   2240: 65 62 75 67 0f 04 01 01 02 00 01 01 01 02 00 01   ebug............
+|   2256: 01 01 02 00 00 03 65 6e 61 05 11 01 01 02 00 03   ......ena.......
+|   2272: 03 62 6c 35 05 09 01 01 02 00 05 01 65 5a 07 01   .bl5........eZ..
+|   2288: 01 02 00 01 01 01 02 00 02 01 01 02 00 01 01 01   ................
+|   2304: 02 00 01 01 01 02 00 01 01 01 02 00 02 01 01 02   ................
+|   2320: 00 01 01 01 02 00 02 01 01 02 00 01 01 01 02 00   ................
+|   2336: 01 01 01 02 00 01 01 01 02 00 01 01 01 02 00 01   ................
+|   2352: 01 01 02 00 01 01 01 02 00 01 01 01 02 00 01 01   ................
+|   2368: 01 02 00 01 01 01 02 00 01 08 78 74 65 6e 73 69   ..........xtensi
+|   2384: 6f 6e 0f 1f 01 01 04 00 01 01 01 04 00 01 01 01   on..............
+|   2400: 04 00 00 04 66 74 73 34 0a 0a 01 01 03 00 02 01   ....fts4........
+|   2416: 01 03 00 03 01 35 14 0b 01 01 03 00 02 01 01 03   .....5..........
+|   2432: 00 01 01 01 03 00 01 01 01 03 00 00 03 67 63 63   .............gcc
+|   2448: 0f 01 01 01 03 00 01 01 01 03 00 01 01 01 03 00   ................
+|   2464: 01 06 65 6f 70 6f 6c 79 0f 10 01 01 03 00 01 01   ..eopoly........
+|   2480: 01 04 00 01 01 01 03 00 00 05 6a 73 6f 6e 31 0f   ..........json1.
+|   2496: 13 01 01 03 00 01 01 01 03 00 01 01 01 03 00 00   ................
+|   2512: 02 6c 65 05 11 01 01 03 00 01 03 6f 61 64 0f 1f   .le........oad..
+|   2528: 01 01 03 00 01 01 01 03 00 01 01 01 03 00 00 03   ................
+|   2544: 6d 61 78 0f 1c 01 01 02 00 01 01 01 02 00 01 01   max.............
+|   2560: 01 02 00 01 05 65 6d 6f 72 79 0f 1c 01 01 03 00   .....emory......
+|   2576: 01 01 01 03 00 01 01 01 03 00 03 04 73 79 73 35   ............sys5
+|   2592: 0f 16 01 01 03 00 01 01 01 03 00 01 01 01 03 00   ................
+|   2608: 00 03 6e 6f 63 05 0b 01 02 02 00 03 03 61 73 65   ..noc........ase
+|   2624: 37 02 01 02 02 00 03 01 02 02 00 03 01 02 02 00   7...............
+|   2640: 06 01 02 02 00 03 01 02 02 00 03 01 02 02 00 03   ................
+|   2656: 01 02 02 00 03 01 02 02 00 03 01 02 02 00 03 01   ................
+|   2672: 02 02 00 03 01 02 02 00 00 04 6f 6d 69 74 0f 1f   ..........omit..
+|   2688: 01 01 02 00 01 01 01 02 00 01 01 01 02 00 00 05   ................
+|   2704: 72 74 72 65 65 0f 19 01 01 03 00 01 01 01 03 00   rtree...........
+|   2720: 01 01 01 03 00 03 02 69 6d 3c 01 01 02 02 00 03   .......im<......
+|   2736: 01 02 02 00 03 01 02 02 00 03 01 02 02 00 03 01   ................
+|   2752: 02 02 00 03 01 02 02 00 03 01 02 02 00 03 01 02   ................
+|   2768: 02 00 03 01 02 02 00 03 01 02 02 00 03 01 02 02   ................
+|   2784: 00 03 01 02 02 00 00 02 73 65 05 0b 01 02 03 00   ........se......
+|   2800: 00 0a 74 68 72 65 61 64 73 61 66 65 0f 22 01 01   ..threadsafe....
+|   2816: 02 00 01 01 01 02 00 01 01 01 02 00 00 06 75 6e   ..............un
+|   2832: 61 62 6c 65 05 0e 01 01 02 00 00 04 76 74 61 62   able........vtab
+|   2848: 0f 07 01 01 04 00 01 01 01 04 00 01 01 01 04 00   ................
+|   2864: 00 01 78 6c 01 02 00 01 02 00 01 02 00 01 02 00   ..xl............
+|   2880: 01 02 00 01 02 00 01 02 00 01 02 00 01 02 00 01   ................
+|   2896: 02 00 01 02 00 01 02 00 01 02 00 01 02 00 01 02   ................
+|   2912: 00 01 02 00 01 02 00 01 02 00 01 02 00 01 02 00   ................
+|   2928: 01 02 00 01 02 00 01 02 00 01 02 00 01 02 00 01   ................
+|   2944: 02 00 01 02 00 01 02 00 01 02 00 01 02 00 01 02   ................
+|   2960: 00 01 02 00 01 02 00 01 02 00 01 02 00 01 02 00   ................
+|   2976: 82 0a 02 08 08 09 08 08 17 84 06 30 20 32 35 33   ...........0 253
+|   2992: 00 01 30 04 25 06 1b 00 00 08 32 30 31 36 30 36   ..0.%.....201606
+|   3008: 30 39 03 25 07 00 00 01 34 03 25 05 00 00 01 35   09.%....4.%....5
+|   3024: 03 25 04 00 01 07 30 30 30 30 30 30 30 03 25 1a   .%....0000000.%.
+|   3040: 00 00 08 63 6f 6d 70 69 6c 65 72 03 25 02 00 00   ...compiler.%...
+|   3056: 06 64 62 73 74 61 74 03 25 0a 00 01 04 65 62 75   .dbstat.%....ebu
+|   3072: 67 03 25 08 00 00 06 65 6e 61 62 6c 65 09 25 09   g.%....enable.%.
+|   3088: 05 04 04 04 04 04 00 01 08 78 74 65 6e 73 69 6f   .........xtensio
+|   3104: 6e 03 25 1d 00 00 04 66 74 73 34 03 25 0d 00 03   n.%....fts4.%...
+|   3120: 11 35 03 25 0f 00 00 03 67 63 63 03 25 03 00 01   .5.%....gcc.%...
+|   3136: 06 65 6f 70 6f 6c 79 03 25 11 00 00 05 6a 73 6f   .eopoly.%....jso
+|   3152: 6e 31 03 25 13 00 00 04 6c 6f 61 64 03 25 1c 00   n1.%....load.%..
+|   3168: 00 03 6d 61 78 03 25 18 00 01 05 65 6d 6f 72 79   ..max.%....emory
+|   3184: 03 25 19 00 03 04 73 79 73 35 03 25 15 00 00 04   .%....sys5.%....
+|   3200: 6f 6d 69 74 03 25 1b 00 00 05 72 74 72 65 65 03   omit.%....rtree.
+|   3216: 25 17 00 00 0a 74 68 72 65 61 64 73 61 66 65 03   %....threadsafe.
+|   3232: 25 1e 00 00 04 76 74 61 62 03 25 0b 00 86 50 01   %....vtab.%...P.
+|   3248: 08 08 08 08 08 17 8d 12 30 20 38 33 35 00 01 30   ........0 835..0
+|   3264: 12 00 f6 00 01 06 00 01 06 00 1f 03 00 01 03 00   ................
+|   3280: 01 03 00 00 08 32 30 31 36 30 36 30 39 09 01 07   .....20160609...
+|   3296: 00 01 07 00 01 07 00 00 01 34 09 01 05 00 01 05   .........4......
+|   3312: 00 01 05 00 00 01 35 09 01 04 00 01 04 00 01 04   ......5.........
+|   3328: 00 01 07 30 30 30 30 30 30 30 09 1c 04 00 01 04   ...0000000......
+|   3344: 00 01 04 00 00 06 62 69 6e 61 72 79 3c 03 01 02   ......binary<...
+|   3360: 02 00 03 01 02 02 00 03 01 02 02 00 03 01 02 02   ................
+|   3376: 00 03 01 02 02 00 03 01 02 02 00 03 01 02 02 00   ................
+|   3392: 03 01 02 02 00 03 01 02 02 00 03 01 02 02 00 03   ................
+|   3408: 01 02 02 00 03 01 02 02 00 00 08 63 6f 6d 70 69   ...........compi
+|   3424: 6c 65 72 09 01 02 00 01 02 00 01 02 00 00 06 64   ler............d
+|   3440: 62 73 74 61 74 09 07 03 00 01 03 00 01 03 00 01   bstat...........
+|   3456: 04 65 62 75 67 09 04 02 00 01 02 00 01 02 00 00   .ebug...........
+|   3472: 06 65 6e 61 62 6c 65 3f 07 02 00 01 02 00 01 01   .enable?........
+|   3488: 00 01 02 00 01 02 00 01 02 00 01 02 00 01 02 00   ................
+|   3504: 01 02 00 01 02 00 01 02 00 01 02 00 01 02 10 01   ................
+|   3520: 02 00 01 02 00 01 02 00 01 02 00 01 02 00 01 02   ................
+|   3536: 00 01 02 00 01 02 00 01 08 78 74 65 6e 73 69 6f   .........xtensio
+|   3552: 6e 09 1f 04 00 01 04 00 01 04 00 00 04 66 74 73   n............fts
+|   3568: 34 09 0a 03 00 01 03 00 01 03 00 03 01 35 09 0d   4............5..
+|   3584: 03 00 01 03 00 01 03 00 00 03 67 63 63 09 01 03   ..........gcc...
+|   3600: 00 01 03 00 01 03 00 01 06 65 6f 70 6f 6c 79 09   .........eopoly.
+|   3616: 10 03 00 01 03 00 01 03 00 00 05 6a 73 6f 6e 31   ...........json1
+|   3632: 09 13 03 00 01 03 00 01 03 00 00 04 6c 6f 61 64   ............load
+|   3648: 09 1f 03 00 01 03 00 01 03 00 00 03 6d 61 78 09   ............max.
+|   3664: 1c 02 00 01 02 00 01 02 00 01 05 65 6d 6f 72 79   ...........emory
+|   3680: 09 1c 03 00 01 03 00 01 03 00 03 04 73 79 73 35   ............sys5
+|   3696: 09 16 03 00 01 03 00 01 03 00 00 06 6e 6f 63 61   ............noca
+|   3712: 73 65 3c 02 01 02 02 00 03 01 02 02 00 03 01 02   se<.............
+|   3728: 02 00 03 01 02 02 00 03 01 02 02 00 03 01 02 02   ................
+|   3744: 00 03 01 02 02 00 03 01 02 02 00 03 01 02 02 00   ................
+|   3760: 03 01 02 02 00 03 01 02 02 00 03 01 02 02 00 00   ................
+|   3776: 04 6f 6d 69 74 09 1f 02 00 01 02 00 01 02 00 00   .omit...........
+|   3792: 05 72 74 72 65 65 09 19 03 00 01 03 00 01 03 00   .rtree..........
+|   3808: 03 02 69 6d 3c 01 01 02 02 00 03 01 02 02 00 03   ..im<...........
+|   3824: 01 02 02 00 03 01 02 02 00 03 01 02 02 00 03 01   ................
+|   3840: 02 02 00 03 01 02 02 00 03 01 02 02 00 03 01 02   ................
+|   3856: 02 00 03 01 02 02 00 03 01 02 02 00 03 01 02 02   ................
+|   3872: 00 00 0a 74 68 72 65 61 64 73 61 66 65 09 22 02   ...threadsafe...
+|   3888: 00 01 02 00 02 02 00 00 04 76 74 61 62 09 07 04   .........vtab...
+|   3904: 00 01 04 00 01 04 00 00 01 78 b4 01 01 01 01 02   .........x......
+|   3920: 00 01 01 01 02 00 01 01 01 02 00 01 01 01 02 00   ................
+|   3936: 01 01 01 02 00 01 01 01 02 00 01 01 01 02 00 01   ................
+|   3952: 01 01 02 00 01 01 01 02 00 01 01 01 02 00 01 01   ................
+|   3968: 01 02 00 01 01 01 02 00 01 01 01 02 00 01 01 01   ................
+|   3984: 02 00 01 01 01 02 00 01 01 01 02 00 01 01 01 02   ................
+|   4000: 00 01 01 01 02 00 01 01 01 02 00 01 01 01 02 00   ................
+|   4016: 01 01 01 02 00 01 01 01 02 00 01 01 01 02 00 01   ................
+|   4032: 01 01 02 00 01 01 01 02 00 01 01 01 02 00 01 01   ................
+|   4048: 01 02 00 01 01 01 02 00 01 01 01 02 00 01 01 01   ................
+|   4064: 02 00 01 01 01 02 00 01 01 01 02 00 01 01 01 02   ................
+|   4080: 00 01 01 01 02 00 01 01 01 02 00 01 01 01 02 00   ................
+| page 6 offset 20480
+|      0: 0a 00 00 00 03 0f ee 00 0f fb 0f f5 0f ee 00 00   ................
+|   4064: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06 04   ................
+|   4080: 08 01 01 02 03 05 04 08 09 01 02 04 04 08 08 09   ................
+| page 7 offset 24576
+|      0: 0d 00 00 00 05 0f b8 00 0f f4 0f e9 0f d6 0f c7   ................
+|     16: 0f b8 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
+|   4016: 00 00 00 00 00 00 00 00 0d 05 02 23 61 75 74 6f   ...........#auto
+|   4032: 6d 65 72 67 65 3d 35 0c f4 02 23 6d 65 72 67 65   merge=5...#merge
+|   4048: 3d 31 30 30 2c 38 11 03 02 2b 69 6e 74 65 67 72   =100,8...+integr
+|   4064: 69 74 79 2d 63 68 65 63 6b 09 02 02 1b 72 65 62   ity-check....reb
+|   4080: 75 69 6c 64 0a 01 02 1d 6f 70 74 69 6d 69 7a 65   uild....optimize
+| end c81b.db
+}]} {}
+
+do_catchsql_test 12.1 {
+  SELECT rowid, quote(matchinfo(t1,'pcxybspcxybs')) 
+  FROM t1 WHERE t1 MATCH 'e*e*'
+} {1 {database disk image is malformed}}
+
+#-------------------------------------------------------------------------
+reset_db
+do_test 13.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 28672 pagesize 4096 filename crash-c666cfde112dee.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 00 00 00 00 07   .....@  ........
+|     32: 00 00 00 02 00 00 00 01 00 00 00 07 00 00 00 04   ................
+|     48: 00 00 00 00 00 00 00 07 00 00 00 01 00 00 00 00   ................
+|     96: 00 00 00 00 0d 0e b1 00 06 0d a4 00 0f 8d 0f 21   ...............!
+|    112: 0e b9 0d c8 0e 7e 0d a4 0d a4 00 00 00 00 00 00   .....~..........
+|   3488: 00 00 00 00 22 07 06 17 11 11 01 31 74 61 62 6c   ...........1tabl
+|   3504: 65 74 32 74 32 07 43 52 45 41 54 45 20 54 41 42   et2t2.CREATE TAB
+|   3520: 4c 45 20 74 32 28 78 29 81 33 05 07 17 1f 1f 01   LE t2(x).3......
+|   3536: 82 35 74 61 62 6c 65 74 31 5f 73 65 67 64 69 72   .5tablet1_segdir
+|   3552: 74 31 5f 73 65 67 64 69 72 05 43 52 45 41 54 45   t1_segdir.CREATE
+|   3568: 20 54 41 42 4c 45 20 27 74 31 5f 73 65 67 64 69    TABLE 't1_segdi
+|   3584: 72 27 28 6c 65 76 65 6c 20 49 4e 54 45 47 45 52   r'(level INTEGER
+|   3600: 2c 69 64 78 20 49 4e 54 45 47 45 52 2c 73 74 61   ,idx INTEGER,sta
+|   3616: 72 74 5f 62 6c 6f 63 6b 20 49 4e 54 45 47 45 52   rt_block INTEGER
+|   3632: 2c 6c 65 61 76 65 73 5f 65 6e 64 5f 62 6c 6f 63   ,leaves_end_bloc
+|   3648: 6b 20 49 4e 54 45 47 45 52 2c 65 6e 64 5f 62 6c   k INTEGER,end_bl
+|   3664: 6f 63 6b 20 49 4e 54 45 47 45 62 2c 72 6f 6f 74   ock INTEGEb,root
+|   3680: 20 42 4c 4f 42 2c 50 52 49 4d 41 52 59 20 4b 45    BLOB,PRIMARY KE
+|   3696: 59 28 6c 65 76 65 6c 2c 20 69 64 78 29 29 31 06   Y(level, idx))1.
+|   3712: 06 17 45 1f 01 00 69 6e 64 65 78 73 71 6c 69 74   ..E...indexsqlit
+|   3728: 65 5f 61 75 74 6f 69 6e 64 65 78 5f 74 31 5f 73   e_autoindex_t1_s
+|   3744: 65 67 64 69 72 5f 31 74 31 5f 73 65 67 64 69 72   egdir_1t1_segdir
+|   3760: 06 0f c7 00 08 00 00 00 00 66 04 07 17 23 23 01   .........f...##.
+|   3776: 81 13 74 61 62 6c 65 74 31 5f 73 65 67 6d 65 6e   ..tablet1_segmen
+|   3792: 74 73 74 31 5f 73 65 67 6d 65 6e 74 73 04 43 52   tst1_segments.CR
+|   3808: 45 41 54 45 20 54 41 42 4c 45 20 27 74 31 5f 73   EATE TABLE 't1_s
+|   3824: 65 67 6d 65 6e 74 73 27 28 62 6c 6f 63 6b 69 64   egments'(blockid
+|   3840: 20 49 4e 54 45 47 45 52 20 50 52 49 4d 41 52 59    INTEGER PRIMARY
+|   3856: 20 4b 45 59 2c 20 62 6c 6f 63 6b 20 42 4c 4f 42    KEY, block BLOB
+|   3872: 29 6a 03 07 17 21 21 01 81 1f 74 61 62 6c 65 74   )j...!!...tablet
+|   3888: 31 5f 63 6f 6e 74 65 6e 74 74 31 5f 63 6f 6e 74   1_contentt1_cont
+|   3904: 65 6e 74 03 43 52 45 41 54 45 20 54 41 42 4c 45   ent.CREATE TABLE
+|   3920: 20 27 74 31 5f 63 6f 6e 74 65 6e 74 27 28 64 6f    't1_content'(do
+|   3936: 63 69 64 20 49 4e 54 45 47 45 52 20 50 52 49 4d   cid INTEGER PRIM
+|   3952: 41 52 59 20 4b 45 59 2c 20 27 63 30 61 27 2c 20   ARY KEY, 'c0a', 
+|   3968: 27 63 31 62 27 2c 20 27 63 32 63 27 29 38 02 06   'c1b', 'c2c')8..
+|   3984: 17 11 11 08 5f 74 61 62 6c 65 74 31 74 31 43 52   ...._tablet1t1CR
+|   4000: 45 41 54 45 20 56 49 52 54 55 41 4c 20 54 41 42   EATE VIRTUAL TAB
+|   4016: 4c 45 20 74 31 20 55 53 49 4e 47 20 66 74 73 33   LE t1 USING fts3
+|   4032: 28 61 2c 62 2c 63 29 00 00 00 39 00 00 00 00 00   (a,b,c)...9.....
+| page 3 offset 8192
+|      0: 0d 00 00 00 25 0b 48 00 0f d8 0f af 0f 86 0f 74   ....%.H........t
+|     16: 0f 61 0f 4e 0f 2f 0f 0f 0e ef 0e d7 0e be 0e a5   .a.N./..........
+|     32: 0e 8d 0e 74 0e 5b 0e 40 0e 24 0e 08 0d ef 0d d5   ...t.[.@.$......
+|     48: 0d bb 0d a0 0d 84 0d 68 0d 4f 0d 35 0d 1b 0c fb   .......h.O.5....
+|     64: 0c da 0c b9 0c 99 0c 78 0c 57 0c 3e 0c 24 0c 0a   .......x.W.>.$..
+|     80: 0b 48 00 00 00 00 00 00 00 00 00 00 00 00 00 00   .H..............
+|   2880: 00 00 00 00 00 00 00 00 81 3f 25 06 00 82 7f 00   .........?%.....
+|   2896: 00 43 4f 4d 50 49 4c 45 52 3d 67 63 63 2d 35 2e   .COMPILER=gcc-5.
+|   2912: 34 23 00 20 32 30 31 36 30 36 30 39 20 44 45 42   4#. 20160609 DEB
+|   2928: 55 47 20 45 4e 41 42 4c 45 20 44 42 53 54 41 54   UG ENABLE DBSTAT
+|   2944: 20 56 54 41 42 20 45 4e 41 42 4c 45 20 46 54 53    VTAB ENABLE FTS
+|   2960: 34 20 45 4e 41 42 4c 45 20 46 54 53 35 20 45 4e   4 ENABLE FTS5 EN
+|   2976: 41 42 4c 45 20 47 45 4f 50 4f 4c 59 20 45 4e 41   ABLE GEOPOLY ENA
+|   2992: 42 4c 45 20 4a 53 4f 4e 31 20 45 4e 41 42 4c 45   BLE JSON1 ENABLE
+|   3008: 20 4d 45 4d 53 59 53 35 20 45 4e 41 42 4c 45 20    MEMSYS5 ENABLE 
+|   3024: 52 54 52 45 45 20 4d 41 58 20 4d 45 4d 4f 52 59   RTREE MAX MEMORY
+|   3040: 3d 35 30 30 30 30 30 30 30 20 4f 4d 49 54 20 4c   =50000000 OMIT L
+|   3056: 4f 41 44 20 45 58 54 45 4e 53 49 4f 4e 20 54 48   OAD EXTENSION TH
+|   3072: 52 45 41 44 53 41 46 45 3d 30 18 24 05 00 25 0f   READSAFE=0.$..%.
+|   3088: 19 54 48 52 45 41 44 53 41 46 45 3d 30 58 42 49   .THREADSAFE=0XBI
+|   3104: 4e 41 52 59 18 23 05 00 25 0f 19 54 48 52 45 41   NARY.#..%..THREA
+|   3120: 44 53 41 46 45 3d 30 58 4e 4f 43 41 53 45 17 22   DSAFE=0XNOCASE..
+|   3136: 05 00 25 0f 17 54 48 52 45 41 44 53 41 46 45 3d   ..%..THREADSAFE=
+|   3152: 30 58 52 54 52 49 4d 1f 21 05 00 33 0f 19 4f 4d   0XRTRIM.!..3..OM
+|   3168: 49 54 20 4c 4f 41 44 20 45 58 54 45 4e 53 49 4f   IT LOAD EXTENSIO
+|   3184: 4e 58 42 49 4e 41 52 59 1f 20 05 00 33 0f 19 4f   NXBINARY. ..3..O
+|   3200: 4d 49 54 20 4c 4f 41 44 20 45 58 54 45 4e 53 49   MIT LOAD EXTENSI
+|   3216: 4f 4e 58 4e 4f 43 41 53 45 1e 1f 05 00 33 0f 17   ONXNOCASE....3..
+|   3232: 4f 4d 49 54 20 4c 4f 41 44 20 45 58 54 45 4e 53   OMIT LOAD EXTENS
+|   3248: 49 4f 4e 58 52 54 52 49 4d 1f 1e 05 00 33 0f 19   IONXRTRIM....3..
+|   3264: 4d 41 58 20 4d 45 4d 4f 52 59 3d 35 30 30 30 30   MAX MEMORY=50000
+|   3280: 30 30 30 58 42 49 4e 41 52 59 1f 1d 05 00 33 0f   000XBINARY....3.
+|   3296: 19 4d 41 58 20 4d 45 4d 4f 52 59 3d 35 30 30 30   .MAX MEMORY=5000
+|   3312: 30 30 30 30 58 4e 4f 43 41 53 45 1e 1c 05 00 33   0000XNOCASE....3
+|   3328: 0f 17 4d 41 58 20 4d 45 4d 4f 52 59 3d 35 30 30   ..MAX MEMORY=500
+|   3344: 30 30 30 30 30 58 52 54 53 49 4d 18 1b 05 00 25   00000XRTSIM....%
+|   3360: 0f 19 45 4e 41 42 4c 45 20 52 54 52 45 45 58 42   ..ENABLE RTREEXB
+|   3376: 49 4e 41 52 59 18 1a 05 00 25 0f 19 45 4e 41 42   INARY....%..ENAB
+|   3392: 4c 45 20 52 54 52 45 45 58 4e 4f 43 41 53 45 17   LE RTREEXNOCASE.
+|   3408: 19 05 00 25 0f 17 45 4e 41 42 4c 45 20 52 54 52   ...%..ENABLE RTR
+|   3424: 45 45 58 52 54 52 49 4d 1a 18 05 00 29 0f 19 45   EEXRTRIM....)..E
+|   3440: 4e 41 42 4c 45 20 4d 45 4d 53 59 53 35 58 42 49   NABLE MEMSYS5XBI
+|   3456: 4e 41 52 59 1a 17 05 00 29 0f 19 45 4e 41 42 4c   NARY....)..ENABL
+|   3472: 45 20 4d 45 4d 53 59 53 35 58 4e 4f 43 41 53 45   E MEMSYS5XNOCASE
+|   3488: 19 16 05 00 29 0f 17 45 4e 41 42 4c 45 20 4d 45   ....)..ENABLE ME
+|   3504: 4d 53 59 53 35 58 52 54 52 49 4d 18 15 05 00 25   MSYS5XRTRIM....%
+|   3520: 0f 19 45 4e 41 42 4c 45 20 4a 53 4f 4e 31 58 42   ..ENABLE JSON1XB
+|   3536: 49 4e 41 52 59 18 14 05 00 25 0f 19 45 4e 41 42   INARY....%..ENAB
+|   3552: 4c 45 20 4a 53 4f 4e 31 58 4e 4f 43 41 53 45 17   LE JSON1XNOCASE.
+|   3568: 13 05 00 25 0f 17 45 4e 41 52 4c 45 20 4a 53 4f   ...%..ENARLE JSO
+|   3584: 4e 31 58 52 54 52 49 4d 1a 12 05 00 29 0f 19 45   N1XRTRIM....)..E
+|   3600: 4e 41 42 4c 45 20 47 45 4f 50 4f 4c 59 58 42 49   NABLE GEOPOLYXBI
+|   3616: 4e 41 52 59 1a 11 05 00 29 0f 19 45 4e 41 1e 4c   NARY....)..ENA.L
+|   3632: 45 20 47 45 4f 50 4f 4c 59 58 4e 4f 43 41 53 45   E GEOPOLYXNOCASE
+|   3648: 19 10 05 00 29 0f 17 45 4e 41 42 4c 45 20 47 45   ....)..ENABLE GE
+|   3664: 4f 50 4f 4c 59 58 52 54 52 49 4d 17 0f 05 00 23   OPOLYXRTRIM....#
+|   3680: 0f 19 45 4e 41 42 4c 45 20 46 54 53 35 58 42 49   ..ENABLE FTS5XBI
+|   3696: 4e 41 52 59 17 0e 05 00 23 0f 19 45 4e 41 42 4c   NARY....#..ENABL
+|   3712: 45 20 46 54 53 35 58 4e 4f 43 41 53 45 16 0d 05   E FTS5XNOCASE...
+|   3728: 00 23 0f 17 45 4e 41 42 4c 45 20 46 54 59 e5 58   .#..ENABLE FTY.X
+|   3744: 52 54 52 49 4d 17 0c 05 00 23 0f 19 45 4e 41 42   RTRIM....#..ENAB
+|   3760: 4c 45 20 46 54 53 34 58 42 49 4e 41 52 59 17 0b   LE FTS4XBINARY..
+|   3776: 05 00 23 0f 19 45 4e 41 42 4c 45 20 46 54 53 35   ..#..ENABLE FTS5
+|   3792: 58 4e 4f 43 40 53 45 16 0a 05 00 23 0f 17 45 4e   XNOC@SE....#..EN
+|   3808: 41 42 4c 45 20 46 54 53 34 58 52 54 52 49 4d 1e   ABLE FTS4XRTRIM.
+|   3824: 09 05 00 31 0f 19 45 4e 41 42 4c 45 20 44 42 53   ...1..ENABLE DBS
+|   3840: 54 41 54 20 56 54 41 42 58 42 49 4e 41 52 59 1e   TAT VTABXBINARY.
+|   3856: 08 05 00 31 0f 19 45 4e 41 42 4c 45 20 44 42 53   ...1..ENABLE DBS
+|   3872: 54 41 54 20 56 54 41 42 58 4e 4f 43 41 53 45 1d   TAT VTABXNOCASE.
+|   3888: 07 05 00 31 0f 17 45 4e 41 42 4c 45 20 44 42 53   ...1..ENABLE DBS
+|   3904: 54 41 54 20 56 54 41 42 58 52 54 52 49 4d 11 06   TAT VTABXRTRIM..
+|   3920: 05 00 17 0f 19 44 45 42 55 47 58 42 49 4e 41 52   .....DEBUGXBINAR
+|   3936: 59 11 05 05 00 17 0f 19 44 45 42 55 47 58 4e 4f   Y.......DEBUGXNO
+|   3952: 43 41 53 45 10 04 05 00 17 0f 17 44 45 42 55 47   CASE.......DEBUG
+|   3968: 58 52 54 52 49 4d 27 03 05 00 43 0f 19 43 4f 4d   XRTRIM'...C..COM
+|   3984: 50 49 4c 45 52 3d 67 63 63 2d 35 2e 34 2e 30 20   PILER=gcc-5.4.0 
+|   4000: 32 30 31 36 30 36 30 39 58 42 49 4e 41 52 59 27   20160609XBINARY'
+|   4016: 02 05 00 43 0f 19 43 4f 4d 50 49 4c 45 52 3d 67   ...C..COMPILER=g
+|   4032: 63 63 2d 35 2e 34 2f 30 20 32 30 31 36 30 36 30   cc-5.4/0 2016060
+|   4048: 39 58 4e 4f 43 41 53 45 26 01 05 00 43 0f 17 43   9XNOCASE&...C..C
+|   4064: 4f 4d 50 49 4c 45 52 3d 67 63 63 2d 35 2e 34 2e   OMPILER=gcc-5.4.
+|   4080: 30 20 32 30 31 36 30 36 30 39 58 52 54 52 49 4d   0 20160609XRTRIM
+| page 4 offset 12288
+|      0: 0d 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00   ................
+| page 5 offset 16384
+|      0: 0d 00 00 00 02 0b a0 00 0c ad 0b a0 00 00 00 00   ................
+|   2976: 82 0a 02 08 08 09 08 08 17 84 06 30 20 32 35 33   ...........0 253
+|   2992: 00 01 30 04 25 06 1b 00 00 08 32 30 31 36 30 36   ..0.%.....201606
+|   3008: 30 39 03 25 07 00 00 01 34 03 25 05 00 00 01 35   09.%....4.%....5
+|   3024: 03 25 04 00 01 07 30 30 30 30 30 30 30 03 25 1a   .%....0000000.%.
+|   3040: 00 00 08 63 6f 6d 70 69 6c 65 72 03 25 02 00 00   ...compiler.%...
+|   3056: 06 64 62 73 74 61 74 03 25 0a 00 01 04 65 62 75   .dbstat.%....ebu
+|   3072: 67 03 25 08 00 00 06 65 6e 61 62 6c 65 09 25 09   g.%....enable.%.
+|   3088: 05 04 04 04 04 04 00 01 08 78 74 65 6e 73 69 6f   .........xtensio
+|   3104: 6e 03 25 1d 00 00 04 66 74 73 34 03 25 0d 00 03   n.%....fts4.%...
+|   3120: 01 35 03 25 0f 00 00 03 67 63 63 03 25 03 00 01   .5.%....gcc.%...
+|   3136: 06 65 6f 70 6f 6c 79 03 25 11 00 00 05 6a 73 6f   .eopoly.%....jso
+|   3152: 6e 31 03 25 13 41 00 04 6c 6f 61 64 03 25 1c 00   n1.%.A..load.%..
+|   3168: 00 03 6d 61 78 03 25 18 00 01 05 65 6d 6f 72 79   ..max.%....emory
+|   3184: 03 25 19 00 03 04 73 79 73 35 03 25 15 00 00 04   .%....sys5.%....
+|   3200: 6f 6d 69 74 03 25 1b 00 00 05 72 74 72 65 65 03   omit.%....rtree.
+|   3216: 25 17 00 00 0a 74 68 72 65 61 64 73 61 66 65 03   %....threadsafe.
+|   3232: 25 1e 00 00 04 76 74 61 62 03 25 0b 00 86 50 01   %....vtab.%...P.
+|   3248: 08 08 08 08 08 17 8d 12 30 20 38 33 35 00 01 30   ........0 835..0
+|   3264: 12 01 06 00 01 06 00 01 06 00 1f 03 00 01 03 00   ................
+|   3280: 01 03 00 00 08 32 30 31 36 30 36 30 39 09 01 07   .....20160609...
+|   3296: 00 01 07 00 01 07 00 00 01 34 09 01 05 00 01 05   .........4......
+|   3312: 00 01 05 00 00 01 35 09 01 04 00 01 04 00 01 04   ......5.........
+|   3328: 00 01 07 30 30 30 30 30 30 30 09 1c 04 00 01 04   ...0000000......
+|   3344: 00 01 04 00 00 06 62 69 6e 61 72 79 3c 03 02 02   ......binary<...
+|   3360: 02 00 03 01 02 02 00 03 01 02 02 00 03 01 02 02   ................
+|   3376: 00 03 01 02 02 00 03 01 02 02 00 03 01 02 02 00   ................
+|   3392: 03 01 02 02 00 03 01 02 02 00 03 01 02 02 00 03   ................
+|   3408: 01 02 02 00 03 01 02 02 00 00 08 63 6f 6d 70 69   ...........compi
+|   3424: 6c 65 72 09 01 02 00 01 02 00 01 02 00 00 06 64   ler............d
+|   3440: 62 73 74 61 74 09 f2 03 00 01 03 00 01 03 00 01   bstat...........
+|   3456: 04 65 62 75 67 09 04 02 00 01 02 00 01 02 00 00   .ebug...........
+|   3472: 06 65 6e 61 62 6c 65 3f 07 02 00 01 02 00 01 02   .enable?........
+|   3488: 00 01 02 00 01 02 00 01 02 00 01 02 00 57 02 00   .............W..
+|   3504: 01 02 00 01 01 00 01 02 00 01 02 00 01 02 10 01   ................
+|   3520: 02 00 01 02 00 01 02 00 01 02 00 01 02 00 01 02   ................
+|   3536: 00 01 02 00 01 02 00 01 08 78 74 64 6e 73 69 6f   .........xtdnsio
+|   3552: 6e 09 1f 04 00 01 04 00 01 03 00 00 04 66 74 73   n............fts
+|   3568: 34 09 0a 03 00 01 03 00 01 03 00 03 01 35 09 0d   4............5..
+|   3584: 03 00 01 03 00 01 03 00 00 03 57 63 63 09 01 03   ..........Wcc...
+|   3600: 00 01 03 00 01 03 00 01 06 65 6f 70 6f 6c 79 09   .........eopoly.
+|   3616: 10 03 00 01 03 00 01 03 00 00 05 6a 73 6f 6e 31   ...........json1
+|   3632: 09 13 03 00 01 03 00 01 03 00 00 04 6c 6f 61 64   ............load
+|   3648: 09 1f 03 00 01 03 00 01 03 00 00 03 6d 61 78 09   ............max.
+|   3664: 1c 02 00 01 02 00 01 02 00 01 05 65 6d 6f 72 79   ...........emory
+|   3680: 09 1c 03 00 01 03 00 01 03 00 03 04 73 79 73 35   ............sys5
+|   3696: 09 16 03 00 01 03 00 01 03 00 00 06 6e 6f 63 61   ............noca
+|   3712: 73 65 3c 02 01 02 02 00 03 01 02 02 00 03 01 02   se<.............
+|   3728: 02 00 03 01 02 02 00 03 01 02 02 00 03 01 02 02   ................
+|   3744: 00 03 01 02 02 00 03 01 02 02 00 03 01 02 02 00   ................
+|   3760: 03 01 02 02 00 03 01 02 02 00 03 01 02 02 00 00   ................
+|   3776: 04 6f 6d 69 74 09 1f 02 00 01 02 00 01 02 00 00   .omit...........
+|   3792: 05 72 74 72 65 65 09 19 03 00 01 03 00 01 03 00   .rtree..........
+|   3808: 03 02 69 6d 3c 01 01 02 02 00 03 01 02 02 00 03   ..im<...........
+|   3824: 01 02 02 00 03 01 02 02 00 03 01 02 02 00 03 01   ................
+|   3840: 02 02 00 03 01 02 02 00 03 01 02 02 00 03 01 02   ................
+|   3856: 02 00 03 01 02 02 00 03 01 02 02 00 03 01 02 02   ................
+|   3872: 00 00 0a 74 68 72 65 61 64 73 61 66 65 09 22 02   ...threadsafe...
+|   3888: 00 01 02 00 02 02 00 00 04 76 74 61 62 09 07 04   .........vtab...
+|   3904: 00 01 04 00 01 04 00 00 01 78 b4 01 01 01 01 02   .........x......
+|   3920: 00 01 01 01 02 00 01 01 01 02 00 01 01 01 02 00   ................
+|   3936: 01 01 01 02 00 01 01 01 02 00 01 01 01 02 00 01   ................
+|   3952: 01 01 02 00 01 01 01 02 00 01 01 01 02 00 01 01   ................
+|   3968: 01 02 00 01 01 01 02 00 01 01 01 02 00 01 01 01   ................
+|   3984: 02 00 01 01 01 02 00 01 01 01 02 00 01 01 01 02   ................
+|   4000: 00 01 01 01 02 00 01 01 01 02 00 01 01 01 02 00   ................
+|   4016: 01 01 01 02 00 01 01 01 02 00 01 01 01 02 00 01   ................
+|   4032: 01 01 02 00 01 01 01 02 00 01 01 01 02 00 01 01   ................
+|   4048: 01 02 00 01 01 01 02 00 01 01 01 02 00 01 01 01   ................
+|   4064: 02 00 01 01 01 02 00 01 01 01 02 00 01 01 01 02   ................
+|   4080: 00 01 01 01 02 00 01 01 01 02 00 01 01 01 02 00   ................
+| page 6 offset 20480
+|      0: 0a 00 00 00 02 0f f5 00 0f fb 0f f5 00 00 00 00   ................
+|   4080: 00 00 00 00 00 05 04 08 09 01 02 04 04 08 08 09   ................
+| page 7 offset 24576
+|      0: 0d 00 00 00 05 0f b8 00 0f f4 0f e9 0f d6 0f c7   ................
+|     16: 0f b8 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
+|   4016: 00 00 00 00 00 00 00 00 0d 05 02 23 61 75 74 6f   ...........#auto
+|   4032: 6d 65 72 67 65 3d 35 0d 04 02 23 6d 65 72 67 65   merge=5...#merge
+|   4048: 3d 31 30 30 2c 38 11 03 02 2b 69 6e 74 65 67 72   =100,8...+integr
+|   4064: 69 74 79 2d 63 68 65 63 6b 09 02 02 1b 72 65 62   ity-check....reb
+|   4080: 75 69 6c 64 0a 01 02 1d 6f 70 74 69 6d 69 7a 65   uild....optimize
+| end crash-c666cfde112dee.db
+}]} {}
+
+do_catchsql_test 13.1 {
+  SELECT quote(matchinfo(t1,'pcxybs'))==0 FROM t1 WHERE b MATCH 'e*';
+} {0 {0 0}}
+
+#-------------------------------------------------------------------------
+reset_db
+do_test 14.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 28672 pagesize 4096 filename crash-f7b636a855e1d2.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 00 00 00 00 07   .....@  ........
+|     32: 00 00 00 00 00 00 00 00 00 00 00 06 00 00 00 04   ................
+|     48: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00   ................
+|     96: 00 00 00 00 0d 0e ef 00 07 0d 4d 00 0f bd 0f 5f   ..........M...._
+|    112: 0e f7 0e 06 0e bc 0d a4 0d 4d 00 00 00 00 00 00   .........M......
+|   3392: 00 00 00 00 00 00 00 00 00 00 00 00 00 55 07 07   .............U..
+|   3408: 17 1b 1b 01 81 01 74 61 62 6c 65 74 31 5f 73 74   ......tablet1_st
+|   3424: 61 74 74 31 5f 73 74 61 74 07 43 52 45 41 54 45   att1_stat.CREATE
+|   3440: 20 54 41 42 4c 45 20 27 74 31 5f 73 74 61 74 27    TABLE 't1_stat'
+|   3456: 28 69 64 20 49 4e 54 45 47 45 52 20 50 52 49 4d   (id INTEGER PRIM
+|   3472: 41 52 59 20 4b 45 59 2c 20 76 61 6c 75 65 20 42   ARY KEY, value B
+|   3488: 4c 4f 42 29 60 06 07 17 21 21 01 81 0b 74 61 62   LOB)`...!!...tab
+|   3504: 6c 65 74 31 5f 64 6f 63 73 69 7a 65 74 31 5f 64   let1_docsizet1_d
+|   3520: 6f 63 73 69 7a 65 06 43 52 45 41 54 45 20 54 41   ocsize.CREATE TA
+|   3536: 42 4c 45 20 27 74 31 5f 64 6f 63 73 69 7a 65 27   BLE 't1_docsize'
+|   3552: 28 64 6f 63 69 64 20 49 4e 54 45 47 45 52 20 50   (docid INTEGER P
+|   3568: 52 49 4d 41 52 59 20 4b 45 59 2c 20 73 69 7a 65   RIMARY KEY, size
+|   3584: 20 42 4c 4f 42 29 81 33 04 07 17 1f 1f 01 82 35    BLOB).3.......5
+|   3600: 74 61 62 6c 65 74 31 5f 73 65 67 64 69 72 74 31   tablet1_segdirt1
+|   3616: 5f 73 65 67 64 69 25 04 43 52 45 41 54 45 20 54   _segdi%.CREATE T
+|   3632: 41 42 4c 45 20 27 74 31 5f 73 65 67 64 69 72 27   ABLE 't1_segdir'
+|   3648: 28 6c 65 76 65 6c 20 49 4e 54 45 47 45 52 2c 69   (level INTEGER,i
+|   3664: 64 78 20 49 4e 54 45 47 45 52 2c 73 74 61 72 74   dx INTEGER,start
+|   3680: 5f 62 6c 6f 63 6b 20 49 4e 54 45 47 45 52 2c 6c   _block INTEGER,l
+|   3696: 65 61 76 65 73 5f 65 6e 64 5f 62 6c 6f 63 6b 20   eaves_end_block 
+|   3712: 49 4e 54 45 47 45 52 2c 65 6e 64 5f 62 6c 6f 63   INTEGER,end_bloc
+|   3728: 6b 20 49 4e 54 45 47 45 52 2c 72 6f 6f 74 20 42   k INTEGER,root B
+|   3744: 4c 4f 42 2c 50 52 49 4d 41 52 59 20 4b 45 59 28   LOB,PRIMARY KEY(
+|   3760: 6c 65 76 65 6c 2c 20 69 64 78 29 29 31 05 06 17   level, idx))1...
+|   3776: 45 1f 01 00 69 6e 64 65 78 73 71 6c 69 74 65 5f   E...indexsqlite_
+|   3792: 61 75 74 6f 69 6e 64 65 78 5f 74 31 5f 73 65 67   autoindex_t1_seg
+|   3808: 64 69 72 5f 31 74 31 5f 73 65 67 64 69 72 05 00   dir_1t1_segdir..
+|   3824: 00 00 08 00 00 00 00 66 03 07 17 23 23 01 81 13   .......f...##...
+|   3840: 74 61 62 6c 65 74 31 5f 73 65 67 6d 65 6e 74 73   tablet1_segments
+|   3856: 74 31 5f 73 65 67 6d 65 6e 74 73 03 43 52 45 41   t1_segments.CREA
+|   3872: 54 45 20 54 41 42 4c 45 20 27 74 31 5f 73 65 67   TE TABLE 't1_seg
+|   3888: 6d 65 6e 74 73 27 28 62 6c 6f 63 6b 69 64 20 49   ments'(blockid I
+|   3904: 4e 54 45 47 45 52 20 50 52 49 4d 41 52 59 20 4b   NTEGER PRIMARY K
+|   3920: 45 59 2c 20 62 6c 6f 63 6b 20 42 4c 4f 42 29 5c   EY, block BLOB).
+|   3936: 02 07 17 21 21 01 81 03 74 61 62 6c 65 74 31 5f   ...!!...tablet1_
+|   3952: 63 6f 6e 74 65 6e 74 74 31 5f 63 6f 6e 74 65 6e   contentt1_conten
+|   3968: 74 02 43 52 45 41 54 45 20 54 41 42 4c 45 20 27   t.CREATE TABLE '
+|   3984: 74 31 5f 63 6f 6e 74 65 6e 74 27 28 64 6f 63 69   t1_content'(doci
+|   4000: 64 20 49 4e 54 45 47 45 52 20 50 52 49 4d 41 52   d INTEGER PRIMAR
+|   4016: 59 20 4b 45 59 2c 20 27 63 30 61 27 29 41 01 06   Y KEY, 'c0a')A..
+|   4032: 17 11 11 08 71 74 61 62 6c 65 74 31 74 31 43 52   ....qtablet1t1CR
+|   4048: 45 41 54 45 20 56 49 52 54 55 41 4c 20 54 41 42   EATE VIRTUAL TAB
+|   4064: 4c 45 20 74 31 20 55 53 49 4e 47 20 66 74 73 34   LE t1 USING fts4
+|   4080: 28 61 2c 70 72 65 66 69 78 3d 27 31 2c 32 27 29   (a,prefix='1,2')
+| page 2 offset 4096
+|      0: 0d 00 00 00 08 0e 1f 00 0f c4 0f 7c 0f 34 0f 07   ...........|.4..
+|     16: 0e c3 0e 97 0e 63 0e 1f 00 00 00 00 00 00 00 00   .....c..........
+|   3600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 42   ...............B
+|   3616: 08 04 00 81 09 73 75 6e 74 20 69 6e 20 63 75 6c   .....sunt in cul
+|   3632: 70 61 20 71 75 69 20 6f 66 66 69 63 69 61 20 64   pa qui officia d
+|   3648: 65 73 65 72 75 6e 74 20 6d 6f 6c 6c 69 74 20 61   eserunt mollit a
+|   3664: 6e 69 6d 20 69 64 20 65 73 74 20 6c 61 62 6f 72   nim id est labor
+|   3680: 75 6d 2e 32 07 03 01 6b 45 78 63 65 70 74 65 75   um.2...kExcepteu
+|   3696: 72 20 73 69 6e 74 20 6f 63 63 61 65 63 61 74 20   r sint occaecat 
+|   3712: 63 75 70 69 64 61 74 61 74 20 6e 6f 6e 20 70 72   cupidatat non pr
+|   3728: 6f 69 64 65 6e 74 2c 2a 06 03 00 5b 63 69 6c 6c   oident,*...[cill
+|   3744: 75 6d 20 64 6f 6c 6f 72 65 20 65 75 20 66 75 67   um dolore eu fug
+|   3760: 69 61 74 20 6e 75 6c 6c 61 20 70 61 72 69 61 74   iat nulla pariat
+|   3776: 75 72 2e 43 05 04 00 81 09 44 75 69 73 20 61 75   ur.C.....Duis au
+|   3792: 74 65 20 69 72 75 72 65 20 64 6f 6c 6f 72 20 69   te irure dolor i
+|   3808: 6e 20 72 65 70 72 65 68 65 6e 64 65 72 69 74 20   n reprehenderit 
+|   3824: 69 6e 20 76 6f 6c 75 70 74 61 74 65 20 76 65 6c   in voluptate vel
+|   3840: 69 74 20 65 73 73 65 2b 14 03 00 5d 6e 69 73 69   it esse+...]nisi
+|   3856: 20 75 74 20 61 6c 69 71 75 69 70 20 65 78 20 65    ut aliquip ex e
+|   3872: 61 20 63 6f 6d 6d 6f 64 6f 20 63 6f 6e 73 65 71   a commodo conseq
+|   3888: 75 61 74 2e 46 03 04 00 81 11 55 74 20 65 6e 69   uat.F.....Ut eni
+|   3904: 6d 20 61 64 20 6d 69 6e 69 6d 20 76 65 6e 69 61   m ad minim venia
+|   3920: 6d 2c 20 71 75 69 73 20 6e 6f 73 74 72 75 64 20   m, quis nostrud 
+|   3936: 65 78 65 72 63 69 74 61 74 69 6f 6e 20 75 6c 6c   exercitation ull
+|   3952: 61 6d 63 6f 20 6c 61 62 6f 72 69 73 46 02 04 00   amco laborisF...
+|   3968: 81 11 73 65 64 20 64 6f 20 65 69 75 73 6d 6f 64   ..sed do eiusmod
+|   3984: 20 74 65 6d 70 6f 72 20 69 6e 63 69 64 69 64 75    tempor incididu
+|   4000: 6e 74 20 75 74 20 6c 61 62 6f 72 65 20 65 74 20   nt ut labore et 
+|   4016: 64 6f 6c 6f 72 65 20 6d 61 67 6e 61 20 61 6c 69   dolore magna ali
+|   4032: 71 75 61 2e 3a 01 03 00 7b 4c 6f 72 65 6d 20 69   qua.:....Lorem i
+|   4048: 70 73 75 6d 20 64 6f 6c 6f 72 20 73 69 74 20 61   psum dolor sit a
+|   4064: 6d 65 74 2c 20 63 6f 6e 73 65 63 74 65 74 75 72   met, consectetur
+|   4080: 20 61 64 69 70 69 73 63 69 6e 67 20 65 6c 69 74    adipiscing elit
+| page 3 offset 8192
+|      0: 0d 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00   ................
+| page 4 offset 12288
+|      0: 0d 00 00 00 03 0a a6 00 0d 57 0c 4a 0a a6 00 00   .........W.J....
+|   2720: 00 00 00 00 00 00 83 21 03 08 02 08 08 08 17 86   .......!........
+|   2736: 30 08 00 30 20 34 30 32 00 02 61 64 06 01 08 00   0..0 402..ad....
+|   2752: 02 04 00 01 01 6c 06 02 0c 00 02 04 00 01 01 6d   .....l.........m
+|   2768: 03 01 06 00 01 01 6e 03 08 09 00 01 01 75 03 05   ......n......u..
+|   2784: 03 00 00 02 63 69 03 06 01 00 01 01 6f 07 01 07   ....ci......o...
+|   2800: 00 03 07 03 00 01 01 75 06 07 05 00 01 04 00 00   .......u........
+|   2816: 02 64 65 03 08 07 00 01 01 6f 0d 01 04 00 01 03   .de......o......
+|   2832: 09 00 03 05 00 01 03 00 01 01 75 03 05 02 00 00   ..........u.....
+|   2848: 02 65 61 03 04 06 00 01 01 69 03 02 04 00 01 01   .ea......i......
+|   2864: 6c 03 01 09 00 01 01 6e 03 03 03 00 01 01 73 06   l......n......s.
+|   2880: 05 0b 00 03 0b 00 01 01 74 03 02 09 00 01 01 75   ........t......u
+|   2896: 03 06 04 00 01 01 78 09 03 09 00 01 05 00 03 02   ......x.........
+|   2912: 00 00 02 66 75 03 06 05 00 00 02 69 64 03 08 0a   ...fu......id...
+|   2928: 00 01 01 6e 0a 02 06 00 03 06 04 00 03 03 00 01   ...n............
+|   2944: 01 70 03 01 13 00 01 01 72 03 05 04 00 00 02 6c   .p......r......l
+|   2960: 61 09 02 08 00 01 0b 00 05 0c 00 01 01 6f 03 01   a............o..
+|   2976: 02 00 00 02 6d 61 03 02 0b 00 01 01 69 03 04 05   ....ma......i...
+|   2992: 00 01 01 6f 03 08 08 00 00 02 6e 69 03 04 02 00   ...o......ni....
+|   3008: 01 01 6f 06 03 08 00 04 06 00 01 01 75 03 06 06   ..o.........u...
+|   3024: 00 00 02 6f 63 03 07 04 00 01 01 66 03 08 06 00   ...oc......f....
+|   3040: 00 02 70 61 03 06 07 00 01 01 72 03 07 07 00 00   ..pa......r.....
+|   3056: 02 71 75 06 03 07 00 05 05 00 00 02 72 65 03 05   .qu.........re..
+|   3072: 07 00 00 02 73 65 03 02 02 00 01 01 69 06 01 05   ....se......i...
+|   3088: 00 06 03 00 01 01 75 03 08 02 00 00 02 74 65 03   ......u......te.
+|   3104: 03 05 00 00 02 75 6c 03 03 0a 00 01 01 74 09 02   .....ul......t..
+|   3120: 07 00 01 02 00 01 03 00 00 02 76 65 06 03 06 00   ..........ve....
+|   3136: 02 0a 00 01 01 6f 03 05 09 00 82 0a 02 08 02 08   .....o..........
+|   3152: 08 08 17 84 02 04 00 30 20 32 35 31 00 01 61 13   .......0 251..a.
+|   3168: 01 06 04 00 01 0c 00 01 04 00 01 04 00 01 03 00   ................
+|   3184: 03 09 00 00 01 63 10 01 07 00 03 07 03 00 02 02   .....c..........
+|   3200: 00 01 05 00 01 04 00 00 01 64 11 01 04 00 01 03   .........d......
+|   3216: 09 00 03 02 05 00 01 03 00 02 07 00 00 01 65 1b   ..............e.
+|   3232: 01 09 00 01 04 07 00 01 03 08 00 01 05 03 00 01   ................
+|   3248: 0b 00 01 04 00 01 02 00 01 0b 00 00 01 66 03 06   .............f..
+|   3264: 05 00 00 01 69 0f 01 03 00 01 06 00 03 04 04 04   ....i...........
+|   3280: 00 03 03 09 00 00 01 6c 0c 01 02 00 01 08 00 01   .......l........
+|   3296: 0b 00 05 0c 00 00 01 6d 09 02 0b 00 01 05 00 05   .......m........
+|   3312: 08 00 00 01 6e 0c 03 08 00 01 02 00 02 06 00 01   ....n...........
+|   3328: 06 00 00 01 6f 06 07 04 00 01 06 00 00 01 70 06   ....o.........p.
+|   3344: 06 07 00 01 07 00 00 01 71 06 03 07 00 05 05 00   ........q.......
+|   3360: 00 01 72 03 05 08 00 00 01 73 0c 01 05 00 01 02   ..r......s......
+|   3376: 00 05 03 00 01 02 00 00 01 74 03 02 05 00 00 01   .........t......
+|   3392: 75 0a 02 07 00 01 02 0a 00 01 03 00 00 01 76 07   u.............v.
+|   3408: 03 06 00 02 09 03 00 85 26 01 08 08 08 08 08 17   ........&.......
+|   3424: 8a 3e 30 20 36 36 35 00 02 61 64 03 03 04 00 02   .>0 665..ad.....
+|   3440: 08 69 70 69 73 63 69 6e 67 03 01 08 00 01 05 6c   .ipiscing......l
+|   3456: 69 71 75 61 03 02 0c 00 05 02 69 70 03 04 04 00   iqua......ip....
+|   3472: 01 03 6d 65 74 03 01 06 00 01 03 6e 69 6d 03 08   ..met......nim..
+|   3488: 09 00 01 03 75 74 65 03 05 03 00 00 06 63 69 6c   ....ute......cil
+|   3504: 6c 75 6d 03 06 02 00 01 06 6f 6d 6d 6f 64 6f 03   lum......ommodo.
+|   3520: 04 07 00 02 09 6e 73 65 63 74 65 74 75 72 03 01   .....nsectetur..
+|   3536: 07 00 05 04 71 75 61 74 03 04 08 00 01 04 75 6c   ....quat......ul
+|   3552: 70 61 03 08 04 00 02 07 70 69 64 61 74 61 74 03   pa......pidatat.
+|   3568: 07 05 00 00 08 64 65 73 65 72 75 6e 74 03 08 07   .....deserunt...
+|   3584: 00 01 01 6f 03 02 03 00 02 03 6c 6f 72 06 01 04   ...o......lor...
+|   3600: 00 04 05 00 05 01 65 06 02 0a 00 04 03 00 01 03   ......e.........
+|   3616: 75 69 73 03 05 02 00 00 02 65 61 03 04 06 00 01   uis......ea.....
+|   3632: 06 69 75 73 6d 6f 64 03 02 04 00 01 03 6c 69 74   .iusmod......lit
+|   3648: 03 01 09 00 01 03 6e 69 6d 03 03 03 00 01 03 73   ......nim......s
+|   3664: 73 65 03 05 0b 00 02 01 73 03 08 0b 00 01 01 74   se......s......t
+|   3680: 03 02 09 00 01 01 75 03 06 04 00 01 01 78 03 04   ......u......x..
+|   3696: 05 00 02 07 63 65 70 74 65 75 72 03 07 02 00 02   ....cepteur.....
+|   3712: 0a 65 72 63 69 74 61 74 69 6f 6e 03 03 09 00 00   .ercitation.....
+|   3728: 06 66 75 67 69 61 74 03 06 05 00 00 02 69 64 03   .fugiat......id.
+|   3744: 08 0a 00 01 01 6e 07 05 06 04 00 03 03 00 02 08   .....n..........
+|   3760: 63 69 64 69 64 75 6e 74 03 02 06 00 01 04 70 73   cididunt......ps
+|   3776: 75 6d 03 01 03 00 01 04 72 75 72 65 03 05 04 00   um......rure....
+|   3792: 00 06 6c 61 62 6f 72 65 03 02 08 00 05 02 69 73   ..labore......is
+|   3808: 03 03 0b 00 05 02 75 6d 03 08 0c 00 01 04 6f 72   ......um......or
+|   3824: 65 6d 03 01 02 00 00 05 6d 61 67 6e 61 03 02 0b   em......magna...
+|   3840: 00 01 04 69 6e 69 6d 03 03 05 00 01 05 6f 6c 6c   ...inim......oll
+|   3856: 69 74 03 08 08 00 00 04 6e 69 73 69 03 04 02 00   it......nisi....
+|   3872: 01 02 6f 6e 03 07 06 00 02 05 73 74 72 75 64 03   ..on......strud.
+|   3888: 03 08 00 01 04 75 6c 6c 61 03 06 06 00 00 08 6f   .....ulla......o
+|   3904: 63 63 61 65 63 61 74 03 07 04 00 01 06 66 66 69   ccaecat......ffi
+|   3920: 63 69 61 03 08 06 00 00 08 70 61 72 69 61 74 75   cia......pariatu
+|   3936: 72 03 06 07 00 01 07 72 6f 69 64 65 6e 74 03 07   r......roident..
+|   3952: 07 00 00 03 71 75 69 03 08 05 00 03 01 73 03 03   ....qui......s..
+|   3968: 07 00 00 0d 72 65 70 72 65 68 65 6e 64 65 72 69   ....reprehenderi
+|   3984: 74 03 05 07 00 00 03 73 65 64 03 02 02 00 01 03   t......sed......
+|   4000: 69 6e 74 03 07 03 00 02 01 74 03 01 05 00 01 03   int......t......
+|   4016: 75 6e 74 03 08 02 00 00 06 74 65 6d 70 6f 72 03   unt......tempor.
+|   4032: 02 05 00 00 07 75 6c 6c 61 6d 63 6f 03 03 0a 00   .....ullamco....
+|   4048: 01 01 74 09 02 07 00 01 02 00 01 03 00 00 05 76   ..t............v
+|   4064: 65 6c 69 74 03 05 0a 00 02 04 6e 69 61 6d 03 03   elit......niam..
+|   4080: 06 00 01 08 6f 6c 75 70 74 61 74 65 03 05 09 00   ....oluptate....
+| page 5 offset 16384
+|      0: 0a 00 00 00 03 0f eb 00 0f fb 0f f3 0f eb 00 00   ................
+|   4064: 00 00 00 00 00 00 00 00 00 00 00 07 04 02 08 01   ................
+|   4080: 08 00 03 07 04 02 08 01 04 00 02 04 04 08 08 09   ................
+| page 6 offset 20480
+|      0: 0d 00 00 00 08 0f d0 00 0f fa 0f f4 0f ee 0f e8   ................
+|     16: 0f e2 0f dc 0f d6 0f d0 00 00 00 00 00 00 00 00   ................
+|   4048: 04 08 03 00 0e 0b 04 07 03 00 0e 06 04 06 03 00   ................
+|   4064: 0e 06 04 05 03 00 0e 0a 04 04 03 00 0e 07 04 03   ................
+|   4080: 03 00 0e 0a 04 02 03 00 0e 0b 04 01 03 00 0e 08   ................
+| page 7 offset 24576
+|      0: 0d 00 00 00 01 0f f7 00 0f f7 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 00 00 00 07 00 03 00 14 08 45 b5 03   .............E..
+| end crash-f7b636a855e1d2.db
+}]} {}
+
+do_execsql_test 14.1 {
+  WITH RECURSIVE c(x) AS (VALUES(1) UNION ALL SELECT x+1 FROM c WHERE x<10)
+    INSERT INTO t1(a) SELECT randomblob(3000) FROM c;
+}
+
+do_catchsql_test 14.2 {
+  INSERT INTO t1(t1) VALUES('optimize');
+} {1 {database disk image is malformed}}
+
+#-------------------------------------------------------------------------
+reset_db
+do_execsql_test 15.0 {
+  CREATE VIRTUAL TABLE t1 USING fts3(a, content="");
+  INSERT INTO t1_segdir VALUES(0,0,0,0,'0 665',X'000261640303040002086970697363696e670301080001056c6971756103020c00050269700304040001036d65740301060001036e6a6d03080900010375746503050300000663696c6c756d0306020001066f6d6d6f646f0304070002096e736563746574757203010700050471756174030408000104756c7061030804000207706964617461740307050000086465736572756e740308070001016f0302030002036c6f720601040004050005016506020a00040300010375697303050200000265610304060001066975736d6f640302040001036c69740301090001036e696d13030300010373736503050b0002017403080b0001017403020900010175030604000101780304050002076365707465757203070100020a65726369746174696f6e030309000006667567696174030605000002696403080a0001016e070506040003030002086369646964756e740302060001047073756d030103000104727572650305040000066c61626f7265030208000502697303030b000502756d03080c0001046f72656d0301020000056d61676e6103020b000104696e696d0303050001056f6c6c69740308080000046e6973690304020001026f6e0307060002057374727564030308000104756c6c610306060000086f636361656361740307040001066666696369610308060000087061726961747572030607000107726f6964656e740307070000037175690308050003017303030700000d726570726568656e6465726974030507000003736564030202000103696e7403070300020174030105000103756e7403080200000674656d706f72030205000007756c6c616d636f03030a0001017409020700010200010300000576656c697403050a0002046e69616d0303060001086f6c75707461746503050900');
+}
+
+do_execsql_test 15.1 {
+  SELECT quote(matchinfo(t1, t1 ))==0 FROM t1 WHERE t1 MATCH 'e*';
+} {0 0 0 0 0 0}
+
+#-------------------------------------------------------------------------
+reset_db
+do_test 16.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 28672 pagesize 4096 filename crash-de7e8cb026385a.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 00 00 00 00 07   .....@  ........
+|     32: 00 00 00 00 00 00 00 00 00 00 00 06 00 00 00 04   ................
+|     48: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00   ................
+|     96: 00 00 00 00 0d 0e ef 00 07 0d 4d 00 0f bd 0f 5f   ..........M...._
+|    112: 0e f7 0e 06 0e bc 0d a4 0d 4d 00 00 00 00 00 00   .........M......
+|   3392: 00 00 00 00 00 00 00 00 00 00 00 00 00 55 07 07   .............U..
+|   3408: 17 1b 1b 01 81 01 74 61 62 6c 65 74 31 5f 73 74   ......tablet1_st
+|   3424: 61 74 74 31 5f 73 74 61 74 07 43 52 45 41 54 45   att1_stat.CREATE
+|   3440: 20 54 41 42 4c 45 20 27 74 31 5f 73 74 61 74 27    TABLE 't1_stat'
+|   3456: 28 69 64 20 49 af 54 45 47 45 52 20 50 52 49 4d   (id I.TEGER PRIM
+|   3472: 41 52 59 20 4b 45 59 2c 20 76 61 6c 75 65 20 42   ARY KEY, value B
+|   3488: 4c 4f 42 29 60 06 07 17 21 21 01 81 0b 74 61 62   LOB)`...!!...tab
+|   3504: 6c 65 74 31 5f 64 6f 63 73 69 7a 65 74 31 5f 64   let1_docsizet1_d
+|   3520: 6f 63 73 69 7a 65 06 43 52 45 41 54 45 20 54 41   ocsize.CREATE TA
+|   3536: 42 4c 45 20 27 74 31 5f 64 6f 63 73 69 7a 65 27   BLE 't1_docsize'
+|   3552: 28 64 6f 63 69 64 20 49 4e 54 45 47 45 52 20 50   (docid INTEGER P
+|   3568: 52 49 4d 41 52 59 20 4b 45 59 2c 20 73 69 7a 65   RIMARY KEY, size
+|   3584: 20 42 4c 4f 42 29 81 33 04 07 17 1f 1f 01 82 35    BLOB).3.......5
+|   3600: 74 61 62 6c 65 74 31 5f 73 65 67 64 69 72 74 31   tablet1_segdirt1
+|   3616: 5f 73 65 67 64 69 72 04 43 52 45 41 54 45 20 54   _segdir.CREATE T
+|   3632: 41 42 4c 45 20 27 74 31 5f 73 65 67 64 69 72 27   ABLE 't1_segdir'
+|   3648: 28 6c 65 76 65 6c 20 49 4e 54 45 47 45 52 2c 69   (level INTEGER,i
+|   3664: 64 78 20 49 4e 54 45 47 45 52 2c 73 74 61 72 74   dx INTEGER,start
+|   3680: 5f 62 6c 6f 63 6b 20 49 4e 54 45 47 45 52 2c 6c   _block INTEGER,l
+|   3696: 65 61 76 65 73 5f 65 6e 64 5f 62 6c 6f 63 6b 20   eaves_end_block 
+|   3712: 49 4e 54 45 47 45 52 2c 65 6e 64 5f 62 6c 6f 63   INTEGER,end_bloc
+|   3728: 6b 20 49 4e 54 45 47 45 52 2c 72 6f 6f 74 20 42   k INTEGER,root B
+|   3744: 4c 4f 42 2c 50 52 49 4d 41 52 59 20 4b 45 59 28   LOB,PRIMARY KEY(
+|   3760: 6c 65 76 65 6c 2c 20 69 64 78 29 29 31 05 06 17   level, idx))1...
+|   3776: 45 1f 01 00 69 6e 64 65 78 73 71 6c 69 74 65 5f   E...indexsqlite_
+|   3792: 61 75 74 6f 69 6e 64 65 78 5f 74 31 5f 73 65 67   autoindex_t1_seg
+|   3808: 64 69 72 5f 31 74 31 5f 73 65 67 64 69 72 05 00   dir_1t1_segdir..
+|   3824: 00 00 08 00 00 00 00 66 03 07 17 23 23 01 81 13   .......f...##...
+|   3840: 74 61 62 6c 65 74 31 5f 73 65 67 6d 65 6e 74 73   tablet1_segments
+|   3856: 74 31 5f 73 65 67 6d 65 6e 74 73 03 43 52 45 41   t1_segments.CREA
+|   3872: 54 45 20 54 41 42 4c 45 20 27 74 31 5f 73 65 67   TE TABLE 't1_seg
+|   3888: 6d 65 6e 74 73 27 28 62 6c 6f 63 6b 69 64 20 49   ments'(blockid I
+|   3904: 4e 54 45 47 45 52 20 50 52 49 4d 41 52 59 20 4b   NTEGER PRIMARY K
+|   3920: 45 59 2c 20 62 6c 6f 63 6b 20 42 4c 4f 42 29 5c   EY, block BLOB).
+|   3936: 02 07 17 21 21 01 81 03 74 61 62 6c 65 74 31 5f   ...!!...tablet1_
+|   3952: 63 6f 6e 74 65 6e 74 74 31 5f 63 6f 6e 74 65 6e   contentt1_conten
+|   3968: 74 02 43 52 45 41 54 45 20 54 41 42 4c 45 20 27   t.CREATE TABLE '
+|   3984: 74 31 5f 63 6f 6e 74 65 6e 74 27 28 64 6f 63 69   t1_content'(doci
+|   4000: 64 20 49 4e 54 45 47 45 52 20 50 52 49 4d 41 52   d INTEGER PRIMAR
+|   4016: 59 20 4b 45 59 2c 20 27 63 30 61 27 29 41 01 06   Y KEY, 'c0a')A..
+|   4032: 17 11 11 08 71 74 61 62 6c 65 74 31 74 31 43 52   ....qtablet1t1CR
+|   4048: 45 41 54 45 20 56 49 52 54 55 41 4c 20 54 41 42   EATE VIRTUAL TAB
+|   4064: 4c 45 20 74 31 20 55 53 49 4e 47 20 66 74 73 34   LE t1 USING fts4
+|   4080: 28 61 2c 70 72 65 66 69 78 3d 27 31 2c 32 27 29   (a,prefix='1,2')
+| page 2 offset 4096
+|      0: 0d 00 00 00 08 0e 1f 00 0f c4 0f 7c 0f 34 0f 07   ...........|.4..
+|     16: 0e c3 0e 97 0e 63 0e 1f 00 00 00 00 00 00 00 00   .....c..........
+|   3600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 42   ...............B
+|   3616: 08 04 00 81 09 73 75 6e 74 20 69 6e 20 63 75 6c   .....sunt in cul
+|   3632: 70 61 20 71 75 69 20 6f 66 66 69 63 69 61 20 64   pa qui officia d
+|   3648: 65 73 65 72 75 6e 74 20 6d 6f 6c 6c 69 74 20 61   eserunt mollit a
+|   3664: 6e 69 6d 20 69 64 20 65 73 74 20 6c 61 62 6f 72   nim id est labor
+|   3680: 75 6d 2e 32 07 03 00 6b 45 78 63 65 70 74 65 75   um.2...kExcepteu
+|   3696: 72 20 73 69 6e 74 20 6f 63 63 61 65 63 61 74 20   r sint occaecat 
+|   3712: 63 75 70 69 64 61 74 61 74 20 6e 6f 6e 20 70 72   cupidatat non pr
+|   3728: 6f 69 64 65 6e 74 2c 2a 06 03 00 5b 63 69 6c 6c   oident,*...[cill
+|   3744: 75 6d 20 64 6f 6c 6f 72 65 20 65 75 20 66 75 67   um dolore eu fug
+|   3760: 69 61 74 20 6e 75 6c 6c 61 20 70 61 72 69 61 74   iat nulla pariat
+|   3776: 75 72 2e 42 05 04 00 81 09 44 75 69 73 20 61 75   ur.B.....Duis au
+|   3792: 74 65 20 69 72 75 72 65 21 64 6f 6c 6f 72 20 69   te irure!dolor i
+|   3808: 6e 20 72 65 70 72 65 68 65 6e 64 65 72 69 74 20   n reprehenderit 
+|   3824: 69 6e 20 76 6f 6c 75 70 74 61 74 65 20 76 65 6c   in voluptate vel
+|   3840: 69 74 20 65 73 74 65 2b 04 03 00 5d 6e 69 73 69   it este+...]nisi
+|   3856: 20 75 74 20 61 6c 69 71 75 69 70 20 65 78 20 65    ut aliquip ex e
+|   3872: 61 20 63 6f 6d 6d 6f 64 6f 20 63 6f 6e 73 65 71   a commodo conseq
+|   3888: 75 61 74 2e 46 03 04 00 81 11 55 74 20 65 6e 69   uat.F.....Ut eni
+|   3904: 6d 20 61 64 20 6d 69 6e 69 6d 20 76 65 6e 69 61   m ad minim venia
+|   3920: 6d 2c 20 71 75 69 73 20 6e 6f 73 74 72 75 64 20   m, quis nostrud 
+|   3936: 65 78 65 72 63 69 74 61 74 69 6f 6e 20 75 6c 6c   exercitation ull
+|   3952: 61 6d 63 6f 20 6c 61 62 6f 72 69 73 46 02 04 00   amco laborisF...
+|   3968: 81 11 73 65 64 20 64 6f 20 65 69 75 73 6d 6f 64   ..sed do eiusmod
+|   3984: 20 74 65 6d 70 6f 72 20 69 6e 63 69 64 69 64 75    tempor incididu
+|   4000: 6e 74 20 75 74 20 6c 61 62 6f 72 65 20 65 74 20   nt ut labore et 
+|   4016: 64 6f 6c 6f 72 65 20 6d 61 67 6e 61 20 51 6c 69   dolore magna Qli
+|   4032: 71 75 61 2e 3a 01 03 00 7b 4c 6f 72 65 6d 20 69   qua.:....Lorem i
+|   4048: 70 73 75 6d 20 64 6f 6c 6f 72 20 73 69 74 e5 61   psum dolor sit.a
+|   4064: 6d 65 74 2c 20 63 6f 6e 73 65 63 74 65 74 75 72   met, consectetur
+|   4080: 20 61 64 69 70 69 73 63 69 6e 67 20 65 6c 69 74    adipiscing elit
+| page 3 offset 8192
+|      0: 0d 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00   ................
+| page 4 offset 12288
+|      0: 0d 00 00 00 03 0a a6 00 0d 57 0c 4a 0a a6 00 00   .........W.J....
+|   2720: 00 00 00 00 00 00 83 21 03 08 02 08 08 08 17 86   .......!........
+|   2736: 30 08 00 30 20 34 30 32 00 02 61 64 06 01 08 00   0..0 402..ad....
+|   2752: 02 04 00 01 01 6c 06 02 0c 00 02 04 00 01 01 6d   .....l.........m
+|   2768: 03 01 06 00 01 01 6e 03 08 09 00 01 01 75 03 05   ......n......u..
+|   2784: 03 00 00 02 63 69 03 06 02 00 01 01 6f 07 01 07   ....ci......o...
+|   2800: 00 03 07 03 00 01 01 75 06 07 05 00 01 04 00 00   .......u........
+|   2816: 02 64 65 03 08 07 00 01 01 6f 0d 01 04 00 01 03   .de......o......
+|   2832: 09 00 03 05 00 01 03 00 01 01 75 03 05 02 00 00   ..........u.....
+|   2848: 02 65 61 03 04 06 00 01 01 69 03 02 04 00 01 01   .ea......i......
+|   2864: 6c 03 01 09 00 01 01 6e 03 03 03 00 01 01 73 06   l......n......s.
+|   2880: 05 0b 00 03 0b 00 01 01 74 03 02 09 00 01 01 75   ........t......u
+|   2896: 03 06 04 00 01 01 78 09 03 09 00 01 05 00 03 02   ......x.........
+|   2912: 00 00 02 66 75 03 06 05 00 00 02 69 64 03 08 0a   ...fu......id...
+|   2928: 00 01 01 6e 0a 02 06 00 03 06 04 00 03 03 00 01   ...n............
+|   2944: 01 70 03 01 03 00 01 01 72 03 05 04 00 00 02 6c   .p......r......l
+|   2960: 61 09 02 08 00 01 0b 00 05 0c 00 01 01 6f 03 01   a............o..
+|   2976: 02 00 00 02 6d 61 03 02 0b 00 01 01 69 03 03 05   ....ma......i...
+|   2992: 00 01 01 6f 03 08 08 00 00 02 6e 69 03 04 02 00   ...o......ni....
+|   3008: 01 01 6f 06 03 08 00 04 06 00 01 01 75 03 06 06   ..o.........u...
+|   3024: 00 00 02 6f 63 03 07 04 00 01 01 66 03 08 06 00   ...oc......f....
+|   3040: 00 02 70 61 03 06 07 00 01 01 72 03 07 07 00 00   ..pa......r.....
+|   3056: 02 71 75 06 03 07 00 05 05 00 00 02 72 65 03 05   .qu.........re..
+|   3072: 07 00 00 02 73 65 03 02 02 00 01 01 69 06 01 05   ....se......i...
+|   3088: 00 06 03 00 01 01 75 03 08 02 00 00 02 74 65 03   ......u......te.
+|   3104: 02 05 00 00 02 75 6c 03 03 0a 00 01 01 74 09 02   .....ul......t..
+|   3120: 07 00 01 02 00 01 03 00 00 02 76 65 06 03 06 00   ..........ve....
+|   3136: 02 0a 00 01 01 6f 03 05 09 00 82 0a 02 08 12 08   .....o..........
+|   3152: 08 08 17 84 02 04 00 30 20 32 35 31 00 01 61 23   .......0 251..a#
+|   3168: 01 06 04 00 01 0c 00 01 04 00 01 04 00 01 03 00   ................
+|   3184: 03 09 00 00 01 63 10 01 07 00 03 07 03 00 02 02   .....c..........
+|   3200: 00 01 05 00 01 04 00 00 01 64 11 01 04 00 01 03   .........d......
+|   3216: 09 00 03 02 05 00 01 13 00 02 07 00 00 01 65 1b   ..............e.
+|   3232: 01 09 00 01 04 07 00 01 03 08 00 01 05 03 00 01   ................
+|   3248: 0b 00 01 04 00 01 02 00 01 0b 00 00 01 66 03 06   .............f..
+|   3264: 05 00 00 01 69 0f 01 03 00 01 06 00 03 04 04 04   ....i...........
+|   3280: 00 03 03 09 00 00 01 6c 0c 01 02 00 01 08 00 01   .......l........
+|   3296: 0b 00 05 0c 00 10 01 6d 09 02 0b 00 01 05 00 05   .......m........
+|   3312: 08 00 00 01 6e 0c 03 08 00 01 02 00 02 06 00 01   ....n...........
+|   3328: 06 00 00 01 6f 06 07 04 00 01 06 00 00 01 70 06   ....o.........p.
+|   3344: 06 07 00 01 07 00 00 01 71 06 03 07 00 05 05 00   ........q.......
+|   3360: 00 01 72 03 05 07 00 00 01 73 0c 01 05 00 01 02   ..r......s......
+|   3376: 00 05 03 00 01 02 00 00 01 74 03 02 05 00 00 01   .........t......
+|   3392: 75 0a 02 07 00 01 02 0a 00 01 03 00 00 01 76 07   u.............v.
+|   3408: 03 06 00 02 09 03 00 85 26 01 08 08 08 08 08 17   ........&.......
+|   3424: 8a 3e 30 20 36 36 35 00 02 61 64 03 03 04 00 02   .>0 665..ad.....
+|   3440: 08 69 70 69 73 63 69 6e 67 03 01 08 00 01 05 6c   .ipiscing......l
+|   3456: 69 71 75 61 03 02 0c 00 05 02 69 70 03 04 04 00   iqua......ip....
+|   3472: 01 03 6d 65 74 03 01 06 00 01 03 6e 69 6d 03 08   ..met......nim..
+|   3488: 09 00 01 03 75 74 65 03 05 03 00 00 06 63 69 6c   ....ute......cil
+|   3504: 6c 75 6d 03 06 02 00 01 06 6f 6d 6d 6f 64 6f 03   lum......ommodo.
+|   3520: 04 07 00 02 09 6e 73 65 63 74 65 74 75 72 03 01   .....nsectetur..
+|   3536: 07 00 05 04 71 75 61 74 03 04 08 00 01 04 75 6c   ....quat......ul
+|   3552: 70 61 03 08 04 00 02 07 70 69 64 61 74 61 74 03   pa......pidatat.
+|   3568: 07 05 00 00 08 64 65 73 65 72 75 6e 74 03 08 07   .....deserunt...
+|   3584: 00 01 01 6f 03 02 03 00 02 03 6c 6f 72 06 01 04   ...o......lor...
+|   3600: 00 04 05 00 05 01 65 06 02 0a 00 04 03 00 01 03   ......e.........
+|   3616: 75 69 73 03 05 02 00 00 02 65 61 03 04 06 00 01   uis......ea.....
+|   3632: 06 69 75 73 6d 6f 64 03 02 04 00 01 03 6c 69 74   .iusmod......lit
+|   3648: 03 01 09 00 01 03 6e 69 6d 03 03 03 00 01 03 73   ......nim......s
+|   3664: 73 65 03 05 0b 00 02 01 74 03 08 0b 00 01 01 74   se......t......t
+|   3680: 03 02 09 00 01 01 75 03 06 04 00 01 01 78 03 04   ......u......x..
+|   3696: 05 00 02 07 63 65 70 74 65 75 72 03 07 02 00 02   ....cepteur.....
+|   3712: 0a 65 72 63 69 74 61 74 69 6f 6e 03 03 09 00 00   .ercitation.....
+|   3728: 06 66 75 67 69 61 74 03 06 05 00 00 02 69 64 03   .fugiat......id.
+|   3744: 08 0a 00 01 01 6e 07 05 06 04 00 03 03 00 02 08   .....n..........
+|   3760: 63 69 64 69 64 75 7e 74 03 02 06 00 01 04 70 73   cididu~t......ps
+|   3776: 75 6d 03 01 03 00 01 03 72 75 72 65 03 05 04 00   um......rure....
+|   3792: 00 06 6c 61 62 6f 72 65 03 02 08 00 05 02 69 73   ..labore......is
+|   3808: 03 03 0b 00 05 02 75 6d 03 08 0c 00 01 04 6f 72   ......um......or
+|   3824: 65 6d 03 01 02 00 00 05 6d 61 67 6e 61 03 02 0b   em......magna...
+|   3840: 00 01 04 69 6e 69 6d 03 03 05 00 01 05 6f 6c 6c   ...inim......oll
+|   3856: 69 74 03 08 08 00 00 04 6e 69 73 69 03 04 02 00   it......nisi....
+|   3872: 01 02 6f 6e 03 07 06 00 02 05 73 74 72 75 64 03   ..on......strud.
+|   3888: 03 08 00 01 04 75 6c 6c 61 03 06 06 00 00 08 6f   .....ulla......o
+|   3904: 63 63 61 65 63 61 74 03 07 04 00 01 06 66 66 69   ccaecat......ffi
+|   3920: 63 69 61 03 08 06 00 00 08 70 61 72 69 61 74 75   cia......pariatu
+|   3936: 72 03 06 07 00 01 07 72 6f 69 64 65 6e 74 03 07   r......roident..
+|   3952: 07 00 00 03 71 75 69 03 08 05 00 03 01 73 03 03   ....qui......s..
+|   3968: 07 00 00 0d 72 65 70 72 65 68 65 6e 64 65 72 69   ....reprehenderi
+|   3984: 74 03 05 07 00 00 03 73 65 64 03 02 02 00 01 03   t......sed......
+|   4000: 69 6e 74 03 07 03 00 02 01 74 03 01 05 00 01 03   int......t......
+|   4016: 75 6e 74 03 08 02 00 00 06 74 65 6d 70 6f 72 03   unt......tempor.
+|   4032: 02 05 00 00 07 75 6c 6c 61 6d 63 6f 03 03 0a 00   .....ullamco....
+|   4048: 01 01 74 09 02 07 00 01 02 00 01 03 00 00 05 76   ..t............v
+|   4064: 65 6c 69 74 03 05 0a 00 02 04 6e 69 61 6d 03 03   elit......niam..
+|   4080: 06 00 01 08 6f 6c 75 70 74 61 74 65 03 05 09 00   ....oluptate....
+| page 5 offset 16384
+|      0: 0a 00 00 00 03 0f eb 00 0f fb 0f f3 0f eb 00 00   ................
+|   4064: 00 00 00 00 00 00 00 00 00 00 00 07 04 02 08 01   ................
+|   4080: 08 00 03 07 04 02 08 03 a4 00 02 04 04 08 08 09   ................
+| page 6 offset 20480
+|      0: 0d 00 00 00 08 0f d0 00 0f fa 0f f4 0f ee 0f e8   ................
+|     16: 0f e2 0f dc 0f d6 0f d0 00 00 00 00 00 00 00 00   ................
+|   4048: 04 08 03 00 0e 0b 04 07 03 00 0e 06 04 06 03 00   ................
+|   4064: 0e 06 04 05 03 00 0e 0a 04 04 03 00 0e 07 04 03   ................
+|   4080: 03 00 0e 0a 04 02 03 00 0e 0b 04 01 03 00 0e 08   ................
+| page 7 offset 24576
+|      0: 0d 00 00 00 01 0f f7 00 0f f7 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 00 00 00 07 00 03 00 14 08 45 b5 03   .............E..
+| end crash-de7e8cb026385a.db
+}]} {}
+
+do_catchsql_test 16.1 {
+  INSERT INTO t1(t1) VALUES('optimize');
+} {0 {}}
+
+#-------------------------------------------------------------------------
+reset_db
+do_test 17.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+.open --hexdb
+| size 28672 pagesize 4096 filename crash-f15972acf5bc1c.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 00 00 00 00 07   .....@  ........
+|     32: 00 00 00 02 00 00 00 01 00 00 00 07 00 00 00 04   ................
+|     48: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00   ................
+|     96: 00 00 00 00 0d 0e b1 00 06 0d a4 00 0f 8d 0f 21   ...............!
+|    112: 0e b9 0d c8 0e 7e 0d a4 0d a4 00 00 00 00 00 00   .....~..........
+|   3488: 00 00 00 00 22 07 06 17 11 11 01 31 74 61 62 6c   ...........1tabl
+|   3504: 65 74 32 74 32 07 43 52 45 41 54 45 20 54 41 42   et2t2.CREATE TAB
+|   3520: 4c 45 20 74 32 28 78 29 81 33 05 07 17 1f 1f 01   LE t2(x).3......
+|   3536: 82 35 74 61 62 6c 65 74 31 5f 73 65 67 64 69 72   .5tablet1_segdir
+|   3552: 74 31 5f 73 65 67 64 69 72 05 43 52 45 41 54 45   t1_segdir.CREATE
+|   3568: 20 54 41 42 4c 45 20 27 74 31 5f 73 65 67 64 69    TABLE 't1_segdi
+|   3584: 72 27 28 6c 65 76 65 6c 20 49 4e 54 45 47 45 52   r'(level INTEGER
+|   3600: 2c 69 64 78 20 49 4e 54 45 47 45 52 2c 73 74 61   ,idx INTEGER,sta
+|   3616: 72 74 5f 62 6c 6f 63 6b 20 49 4e 54 45 47 45 52   rt_block INTEGER
+|   3632: 2c 6c 65 61 76 65 73 5f 65 6e 64 5f 62 6c 6f 63   ,leaves_end_bloc
+|   3648: 6b 20 49 4e 54 45 47 45 52 2c 65 6e 64 5f 62 6c   k INTEGER,end_bl
+|   3664: 6f 63 6b 20 49 4e 54 45 47 45 52 2c 72 6f 6f 74   ock INTEGER,root
+|   3680: 20 42 4c 4f 42 2c 50 52 49 4d 41 52 59 20 4b 45    BLOB,PRIMARY KE
+|   3696: 59 28 6c 65 76 65 6c 2c 20 69 64 78 29 29 31 06   Y(level, idx))1.
+|   3712: 06 17 45 1f 01 00 69 6e 64 65 78 73 71 6c 69 74   ..E...indexsqlit
+|   3728: 65 5f 61 75 74 6f 69 6e 64 65 78 5f 74 31 5f 73   e_autoindex_t1_s
+|   3744: 65 67 64 69 72 5f 31 74 31 5f 73 65 67 64 69 72   egdir_1t1_segdir
+|   3760: 06 0f c7 00 08 00 00 00 00 66 04 07 17 23 23 01   .........f...##.
+|   3776: 81 13 74 61 62 6c 65 74 31 5f 73 65 67 6d 65 6e   ..tablet1_segmen
+|   3792: 74 73 74 31 5f 73 65 67 6d 65 6e 74 73 04 43 52   tst1_segments.CR
+|   3808: 45 41 54 45 20 54 41 42 4c 45 20 27 74 31 5f 73   EATE TABLE 't1_s
+|   3824: 65 67 6d 65 6e 74 73 27 28 62 6c 6f 63 6b 69 64   egments'(blockid
+|   3840: 20 49 4e 54 45 47 45 52 20 50 52 49 4d 41 52 59    INTEGER PRIMARY
+|   3856: 20 4b 45 59 2c 20 62 6c 6f 63 6b 20 42 4c 4f 42    KEY, block BLOB
+|   3872: 29 6a 03 07 17 21 21 01 81 1f 74 61 62 6c 65 74   )j...!!...tablet
+|   3888: 31 5f 63 6f 6e 74 65 6e 74 74 31 5f 63 6f 6e 74   1_contentt1_cont
+|   3904: 65 6e 74 03 43 52 45 41 54 45 20 54 41 42 4c 45   ent.CREATE TABLE
+|   3920: 20 27 74 31 5f 63 6f 6e 74 65 6e 74 27 28 64 6f    't1_content'(do
+|   3936: 63 69 64 20 49 4e 54 45 47 45 52 20 50 52 49 4d   cid INTEGER PRIM
+|   3952: 41 52 59 20 4b 45 59 2c 20 27 63 30 61 27 2c 20   ARY KEY, 'c0a', 
+|   3968: 27 63 31 62 27 2c 20 27 63 32 63 27 29 38 02 06   'c1b', 'c2c')8..
+|   3984: 17 11 11 08 5f 74 61 62 6c 65 74 31 74 31 43 52   ...._tablet1t1CR
+|   4000: 45 41 54 45 20 56 49 52 54 55 41 4c 20 54 41 42   EATE VIRTUAL TAB
+|   4016: 4c 45 20 74 31 20 55 53 49 4e 47 20 66 74 73 33   LE t1 USING fts3
+|   4032: 28 61 2c 62 2c 63 29 00 00 00 39 00 00 00 00 00   (a,b,c)...9.....
+| page 3 offset 8192
+|      0: 0d 00 00 00 25 0b 48 00 0f d8 0f af 0f 86 0f 74   ....%.H........t
+|     16: 0f 61 0f 4e 0f 2f 0f 0f 0e ef 0e d7 0e be 0e a5   .a.N./..........
+|     32: 0e 8d 0e 74 0e 5b 0e 40 0e 24 0e 08 0d ef 0d d5   ...t.[.@.$......
+|     48: 0d bb 0d a0 0d 84 03 28 0d 4f 0d 35 0d 1b 0c fb   .......(.O.5....
+|     64: 0c da 0c b9 0c 99 0c 78 0c 57 0c 3e 0c 24 0c 0a   .......x.W.>.$..
+|     80: 0b 48 00 00 00 00 00 00 00 00 00 00 00 00 00 00   .H..............
+|   2880: 00 00 00 00 00 00 00 00 81 3f 25 06 00 72 7f 00   .........?%..r..
+|   2896: 00 43 4f 4d 50 49 4c 45 52 3d 67 63 63 2d 35 2e   .COMPILER=gcc-5.
+|   2912: 34 2e 30 20 32 30 31 36 30 36 30 39 20 44 45 42   4.0 20160609 DEB
+|   2928: 55 47 20 45 4e 41 42 4c 45 20 44 42 53 54 41 54   UG ENABLE DBSTAT
+|   2944: 20 56 54 41 42 20 45 4e 41 42 4c 45 20 46 54 53    VTAB ENABLE FTS
+|   2960: 34 20 45 4e 41 42 4c 45 20 46 54 53 35 20 45 4e   4 ENABLE FTS5 EN
+|   2976: 41 42 4c 45 20 47 45 4f 50 4f 4c 59 20 45 4e 41   ABLE GEOPOLY ENA
+|   2992: 42 4c 45 20 4a 53 4f 4e 31 20 45 4e 41 42 4c 45   BLE JSON1 ENABLE
+|   3008: 20 4d 45 4d 53 59 53 35 20 45 4e 41 42 4c 45 20    MEMSYS5 ENABLE 
+|   3024: 52 54 52 45 45 20 4d 41 58 20 4d 45 4d 4f 52 59   RTREE MAX MEMORY
+|   3040: 3d 35 30 30 30 30 30 30 30 20 4f 4d 49 54 20 4c   =50000000 OMIT L
+|   3056: 4f 41 43 20 45 58 54 45 4e 53 49 4f 4e 20 54 48   OAC EXTENSION TH
+|   3072: 52 45 41 44 53 41 46 45 3d 30 18 24 05 00 25 0f   READSAFE=0.$..%.
+|   3088: 19 54 48 52 45 41 44 53 41 46 45 3d 30 58 42 49   .THREADSAFE=0XBI
+|   3104: 4e 41 52 59 18 23 05 00 25 0f 19 54 48 52 45 41   NARY.#..%..THREA
+|   3120: 44 53 41 46 45 3d 30 58 4e 4f 43 41 53 45 17 22   DSAFE=0XNOCASE..
+|   3136: 05 00 25 0f 17 54 48 52 45 41 44 53 41 46 45 3d   ..%..THREADSAFE=
+|   3152: 30 58 52 54 52 49 4d 1f 21 05 00 33 0f 19 4f 4d   0XRTRIM.!..3..OM
+|   3168: 49 54 20 4c 4f 41 44 20 45 58 54 45 4e 53 49 4f   IT LOAD EXTENSIO
+|   3184: 4e 58 42 49 4e 41 52 59 1f 20 05 00 33 0f 19 4f   NXBINARY. ..3..O
+|   3200: 4d 49 54 20 4c 4f 41 44 20 45 58 54 45 4e 53 49   MIT LOAD EXTENSI
+|   3216: 4f 4e 58 4e 4f 43 41 53 45 1e 1f 05 00 33 0f 17   ONXNOCASE....3..
+|   3232: 4f 4d 49 54 20 4c 4f 41 44 20 45 58 54 45 4e 53   OMIT LOAD EXTENS
+|   3248: 49 4f 4e 58 52 54 52 49 4d 1f 1e 05 00 33 0f 19   IONXRTRIM....3..
+|   3264: 4d 41 58 20 4d 45 4d 4f 52 59 3d 35 30 30 30 30   MAX MEMORY=50000
+|   3280: 30 30 30 58 42 49 4e 41 52 59 1f 1d 05 00 33 0f   000XBINARY....3.
+|   3296: 19 4d 41 58 20 4d 45 4d 4f 52 59 3d 35 30 30 30   .MAX MEMORY=5000
+|   3312: 30 30 30 30 58 4e 4f 43 41 53 45 1e 1c 05 00 33   0000XNOCASE....3
+|   3328: 0f 17 4d 41 58 20 4d 45 4d 4f 52 59 3d 35 30 30   ..MAX MEMORY=500
+|   3344: 30 30 30 30 30 58 52 54 52 49 4d 18 1b 05 00 25   00000XRTRIM....%
+|   3360: 0f 19 45 4e 41 42 4c 45 20 52 54 52 45 45 58 42   ..ENABLE RTREEXB
+|   3376: 49 4e 41 52 59 18 1a 05 00 25 0f 19 45 4e 41 42   INARY....%..ENAB
+|   3392: 4c 45 20 52 54 52 45 45 58 4e 4f 43 41 53 45 17   LE RTREEXNOCASE.
+|   3408: 19 05 00 25 0f 17 45 4e 41 42 4c 45 20 52 54 52   ...%..ENABLE RTR
+|   3424: 45 45 58 52 54 52 49 4d 1a 18 05 00 29 0f 19 45   EEXRTRIM....)..E
+|   3440: 4e 41 42 4c 45 20 4d 45 4d 53 59 53 35 58 42 49   NABLE MEMSYS5XBI
+|   3456: 4e 41 52 59 1a 17 05 00 29 0f 19 45 4e 41 42 4c   NARY....)..ENABL
+|   3472: 45 20 4d 45 4d 53 59 53 35 58 4e 4f 43 41 53 45   E MEMSYS5XNOCASE
+|   3488: 19 16 05 00 29 0f 17 45 4e 41 42 4c 45 20 4d 45   ....)..ENABLE ME
+|   3504: 4d 53 59 53 35 58 52 54 52 49 4d 18 14 05 00 25   MSYS5XRTRIM....%
+|   3520: 0f 19 45 4e 41 42 4c 45 20 4a 53 4f 4e 31 58 42   ..ENABLE JSON1XB
+|   3536: 49 4e 41 52 59 18 14 05 00 25 0f 19 45 4e 41 42   INARY....%..ENAB
+|   3552: 4c 45 20 4a 53 4f 4e 31 58 4e 4f 43 41 53 45 17   LE JSON1XNOCASE.
+|   3568: 13 05 00 25 0f 17 45 4e 41 42 4c 45 20 4a 53 4f   ...%..ENABLE JSO
+|   3584: 4e 31 58 52 54 52 49 4d 1a 12 05 00 29 0f 19 45   N1XRTRIM....)..E
+|   3600: 4e 41 42 4c 45 20 47 45 4f 50 4f 4c 59 58 42 49   NABLE GEOPOLYXBI
+|   3616: 4e 41 52 59 1a 11 05 00 29 0f 19 45 4e 41 42 4c   NARY....)..ENABL
+|   3632: 45 20 47 45 4f 50 4f 4c 59 58 4e 4f 43 41 53 45   E GEOPOLYXNOCASE
+|   3648: 19 10 05 00 29 0f 17 45 4e 41 42 4c 45 20 47 45   ....)..ENABLE GE
+|   3664: 4f 50 4f 4c 59 58 52 54 52 49 4d 17 0f 05 00 23   OPOLYXRTRIM....#
+|   3680: 0f 19 45 4e 41 42 4c 45 20 46 54 53 35 58 42 49   ..ENABLE FTS5XBI
+|   3696: 4e 41 52 59 17 0e 05 00 23 0f 19 45 4e 41 42 4c   NARY....#..ENABL
+|   3712: 45 20 46 54 53 35 58 4e 4f 43 41 53 45 16 0d 05   E FTS5XNOCASE...
+|   3728: 00 23 0f 17 45 4e 41 42 4c 45 20 46 54 53 35 58   .#..ENABLE FTS5X
+|   3744: 52 54 52 49 4d 17 0c 05 00 23 0f 19 45 4e 41 42   RTRIM....#..ENAB
+|   3760: 4c 45 20 46 54 53 34 58 42 49 4e 41 52 59 17 0b   LE FTS4XBINARY..
+|   3776: 05 00 23 0f 19 45 4e 41 42 4c 45 20 46 54 53 34   ..#..ENABLE FTS4
+|   3792: 58 4e 4f 43 41 53 45 16 0a 05 00 23 0f 17 45 4e   XNOCASE....#..EN
+|   3808: 41 42 4c 45 20 46 54 53 34 58 52 54 52 49 4d 1e   ABLE FTS4XRTRIM.
+|   3824: 09 05 00 31 0f 19 45 4e 41 42 4c 45 20 44 42 53   ...1..ENABLE DBS
+|   3840: 54 41 54 20 56 54 41 42 58 42 49 4e 41 52 59 1e   TAT VTABXBINARY.
+|   3856: 08 05 00 31 0f 19 45 4e 41 42 4c 45 20 44 42 53   ...1..ENABLE DBS
+|   3872: 54 41 54 20 56 54 41 42 58 4e 4f 43 41 53 45 1d   TAT VTABXNOCASE.
+|   3888: 07 05 00 31 0f 17 45 4e 41 42 4c 45 20 44 42 53   ...1..ENABLE DBS
+|   3904: 54 41 54 20 56 54 41 42 58 52 54 52 49 4d 11 06   TAT VTABXRTRIM..
+|   3920: 05 00 17 0f 19 44 45 42 55 47 58 42 49 4e 41 52   .....DEBUGXBINAR
+|   3936: 59 11 05 05 00 17 0e 19 44 45 42 55 47 58 4e 4f   Y.......DEBUGXNO
+|   3952: 43 41 53 45 10 04 05 00 17 0f 17 44 45 42 55 47   CASE.......DEBUG
+|   3968: 58 52 54 52 49 4d 27 03 05 00 43 0f 19 43 4f 4d   XRTRIM'...C..COM
+|   3984: 50 49 4c 45 52 3d 67 63 63 2d 35 2e 34 2e 30 20   PILER=gcc-5.4.0 
+|   4000: 32 30 31 36 30 36 30 39 58 42 49 4e 41 52 59 27   20160609XBINARY'
+|   4016: 02 05 00 43 0f 19 43 4f 4d 50 49 4c 45 52 3d 67   ...C..COMPILER=g
+|   4032: 63 63 2d 35 2e 34 2e 30 20 32 30 31 36 30 36 30   cc-5.4.0 2016060
+|   4048: 39 58 4e 4f 43 41 53 45 26 01 05 00 43 0f 17 43   9XNOCASE&...C..C
+|   4064: 4f 4d 50 49 4c 45 52 3d 67 63 63 2d 35 2e 34 2e   OMPILER=gcc-5.4.
+|   4080: 30 20 32 30 31 36 30 36 30 39 58 52 54 52 49 4d   0 20160609XRTRIM
+| page 4 offset 12288
+|      0: 0d 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00   ................
+| page 5 offset 16384
+|      0: 0d 00 00 00 02 0b a0 00 0c ad 0b a0 00 00 00 00   ................
+|   2976: 82 0a 02 08 08 09 08 08 17 84 06 30 20 32 35 33   ...........0 253
+|   2992: 00 01 30 04 25 06 1b 00 00 08 32 30 31 36 30 36   ..0.%.....201606
+|   3008: 30 39 03 25 07 00 00 01 34 03 25 05 00 00 01 35   09.%....4.%....5
+|   3024: 03 25 04 00 01 07 30 30 30 30 30 30 30 03 25 1a   .%....0000000.%.
+|   3040: 00 00 08 63 6f 6d 70 69 6c 65 72 03 25 02 00 00   ...compiler.%...
+|   3056: 06 64 62 73 74 61 74 03 25 0a 00 01 04 65 62 75   .dbstat.%....ebu
+|   3072: 67 03 25 08 00 00 06 65 6e 61 62 6c 65 09 25 09   g.%....enable.%.
+|   3088: 05 04 04 04 04 04 00 01 08 78 74 65 6e 73 69 6f   .........xtensio
+|   3104: 6e 03 25 1d 00 00 04 66 74 73 34 03 25 0d 00 03   n.%....fts4.%...
+|   3120: 01 35 03 25 0f 00 00 03 67 63 63 03 25 03 00 01   .5.%....gcc.%...
+|   3136: 06 65 6f 70 6f 6c 79 03 25 11 00 00 05 6a 73 6f   .eopoly.%....jso
+|   3152: 6e 31 03 25 13 00 00 04 6c 6f 61 64 03 25 1c 00   n1.%....load.%..
+|   3168: 00 03 6d 61 78 03 25 18 00 01 05 65 6d 6f 72 79   ..max.%....emory
+|   3184: 03 25 19 00 03 04 73 79 73 4d 03 25 15 00 00 04   .%....sysM.%....
+|   3200: 6f 6d 69 74 03 25 1b 00 00 05 72 74 72 65 65 03   omit.%....rtree.
+|   3216: 25 17 00 00 0a 74 68 72 65 61 64 73 61 66 65 03   %....threadsafe.
+|   3232: 25 0e 00 00 04 76 74 61 62 03 25 0b 00 86 50 01   %....vtab.%...P.
+|   3248: 08 08 08 08 08 17 8d 12 30 20 38 33 35 00 01 30   ........0 835..0
+|   3264: 12 01 06 00 01 06 00 01 06 00 1f 03 00 01 03 00   ................
+|   3280: 01 03 00 00 08 32 30 31 36 30 36 30 39 09 01 07   .....20160609...
+|   3296: 00 01 07 00 01 07 00 00 01 34 09 01 05 00 01 05   .........4......
+|   3312: 00 01 05 00 00 01 35 09 01 04 00 01 04 00 01 04   ......5.........
+|   3328: 00 01 07 30 30 30 30 30 30 30 09 1c 04 00 01 04   ...0000000......
+|   3344: 00 01 04 00 00 06 62 69 6e 61 72 79 3c 03 01 02   ......binary<...
+|   3360: 02 00 03 01 02 02 00 03 01 02 02 00 03 01 02 02   ................
+|   3376: 00 03 01 02 02 00 03 01 02 02 00 03 01 02 02 00   ................
+|   3392: 03 01 02 02 00 03 01 02 02 00 03 01 02 02 00 03   ................
+|   3408: 01 02 02 00 03 01 02 02 00 00 08 63 6f 6d 70 69   ...........compi
+|   3424: 6c 65 72 09 01 02 00 01 02 00 01 02 00 00 06 64   ler............d
+|   3440: 62 73 74 61 74 09 07 03 00 01 03 00 01 03 00 01   bstat...........
+|   3456: 04 65 62 75 67 09 04 02 00 01 02 00 01 02 00 00   .ebug...........
+|   3472: 06 65 6e 61 62 6c 65 3f 07 02 00 01 02 00 01 02   .enable?........
+|   3488: 00 01 02 00 01 02 00 01 02 00 01 02 00 01 02 00   ................
+|   3504: 01 02 00 01 02 00 01 02 00 01 02 00 01 02 00 01   ................
+|   3520: 02 00 01 02 00 01 02 00 01 02 00 01 02 00 01 02   ................
+|   3536: 00 01 02 00 01 02 00 01 08 78 74 65 6e 73 69 6f   .........xtensio
+|   3552: 6e 09 1f 04 00 01 04 00 01 04 00 00 04 66 74 73   n............fts
+|   3568: 34 09 0a 03 00 01 03 00 01 03 00 03 01 35 09 0d   4............5..
+|   3584: 03 00 01 03 00 01 03 00 00 03 67 63 63 09 01 03   ..........gcc...
+|   3600: 00 01 03 00 01 03 00 01 06 65 6f 70 6f 6c 79 09   .........eopoly.
+|   3616: 10 03 00 01 03 00 01 03 00 00 05 6a 73 6f 6e 31   ...........json1
+|   3632: 09 13 03 00 01 03 00 01 03 00 00 04 6c 6f 61 64   ............load
+|   3648: 09 1f 03 00 01 03 00 01 03 00 00 03 6d 61 78 09   ............max.
+|   3664: 1c 02 00 01 02 00 01 02 00 01 05 65 6d 6f 72 79   ...........emory
+|   3680: 09 1c 03 00 01 03 00 01 03 00 03 04 73 79 73 35   ............sys5
+|   3696: 09 16 03 00 01 03 00 01 03 00 00 06 6e 6f 63 61   ............noca
+|   3712: 73 65 3c 02 01 02 02 00 03 01 02 02 00 03 01 02   se<.............
+|   3728: 02 00 03 01 02 02 00 03 01 02 02 00 03 01 02 02   ................
+|   3744: 00 03 01 02 02 00 03 01 02 02 00 03 01 02 02 00   ................
+|   3760: 03 01 02 02 00 03 01 02 02 00 03 01 02 02 00 00   ................
+|   3776: 04 6f 6d 69 74 09 1f 02 00 01 02 00 01 02 00 00   .omit...........
+|   3792: 05 72 74 72 65 65 09 19 03 00 01 03 00 01 03 00   .rtree..........
+|   3808: 03 02 69 6d 3c 01 01 02 02 00 03 01 02 02 00 03   ..im<...........
+|   3824: 01 02 02 00 03 01 02 02 00 03 01 02 02 00 03 01   ................
+|   3840: 02 02 00 03 01 02 02 00 03 01 02 02 00 03 01 02   ................
+|   3856: 02 00 03 01 02 02 00 03 01 02 02 00 03 01 02 02   ................
+|   3872: 00 00 0a 74 68 72 65 61 64 73 61 66 65 09 22 02   ...threadsafe...
+|   3888: 00 01 02 00 01 02 00 00 04 76 74 61 62 09 07 04   .........vtab...
+|   3904: 00 01 04 00 01 04 00 00 01 78 b4 01 01 01 01 02   .........x......
+|   3920: 00 01 01 01 02 00 01 01 01 02 00 01 01 01 02 00   ................
+|   3936: 01 01 01 02 00 01 01 01 02 00 01 01 01 02 00 01   ................
+|   3952: 01 01 02 00 01 01 01 02 00 01 01 01 02 00 01 01   ................
+|   3968: 01 02 00 01 01 01 02 00 01 01 01 02 00 01 01 01   ................
+|   3984: 02 00 01 01 01 02 00 01 01 01 02 00 01 01 01 02   ................
+|   4000: 00 01 01 01 02 00 01 01 01 02 00 01 01 01 02 00   ................
+|   4016: 01 01 01 02 00 01 01 01 02 00 01 01 01 02 00 01   ................
+|   4032: 01 01 02 00 01 01 01 02 00 01 01 01 02 00 01 01   ................
+|   4048: 01 02 00 01 01 01 02 00 01 01 01 02 00 01 01 01   ................
+|   4064: 02 00 01 01 01 02 00 01 01 01 02 00 01 01 01 02   ................
+|   4080: 00 01 01 01 02 00 01 01 01 02 00 01 01 01 02 00   ................
+| page 6 offset 20480
+|      0: 0a 00 00 00 02 0f f5 00 0f fb 0f f5 00 00 00 00   ................
+|   4080: 00 00 00 00 00 05 04 08 09 01 02 04 04 08 08 09   ................
+| page 7 offset 24576
+|      0: 0d 00 00 00 05 0f b8 00 0f f4 0f e9 10 d6 0f c7   ................
+|     16: 0f b8 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
+|   4016: 00 00 00 00 00 00 00 00 0d 05 02 23 61 75 74 6f   ...........#auto
+|   4032: 6d 65 72 67 65 3d 35 0d 04 02 23 6d 65 72 67 65   merge=5...#merge
+|   4048: 3d 31 30 30 2c 38 11 03 02 2b 69 6e 74 65 67 72   =100,8...+integr
+|   4064: 69 74 79 2d 63 68 65 63 6b 09 02 02 1b 72 65 62   ity-check....reb
+|   4080: 75 69 6c 64 0a 01 02 1d 6f 70 74 69 6d 69 7a 65   uild....optimize
+| end crash-f15972acf5bc1c.db
+}]} {}
+
+breakpoint
+do_execsql_test 17.1 {
+  BEGIN;
+    INSERT INTO t1(t1) SELECT x FROM t2;
+    UPDATE t1 SET b=quote(zeroblob(200)) WHERE a MATCH 'thread*';
+}
+
+do_catchsql_test 17.2 {
+  DROP TABLE IF EXISTS t1;
+} {1 {SQL logic error}}
+
+do_execsql_test 17.3 {
+  INSERT INTO t1(t1) VALUES('optimize');
+}
+
+do_catchsql_test 17.4 {
+  DROP TABLE IF EXISTS t1;
+} {1 {SQL logic error}}
+
+#-------------------------------------------------------------------------
+reset_db
+do_test 18.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 32768 pagesize 4096 filename crash-4ce32d0608aff1.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 00 00 00 00 07   .....@  ........
+|     32: 00 00 00 02 00 00 00 01 00 00 00 07 00 00 00 04   ................
+|     48: 00 00 00 00 00 00 00 07 00 00 00 01 00 00 00 00   ................
+|     96: 00 00 00 00 0d 0e b1 00 06 0d a4 00 0f 8d 0f 21   ...............!
+|    112: 0e b9 0d c8 0e 7e 0d a4 0d a4 00 00 00 00 00 00   .....~..........
+|   3488: 00 00 00 00 22 07 06 17 11 11 01 31 74 61 62 6c   ...........1tabl
+|   3504: 65 74 32 74 32 07 43 52 45 41 54 45 20 54 41 42   et2t2.CREATE TAB
+|   3520: 4c 45 20 74 32 28 78 29 81 33 05 07 17 1f 1f 01   LE t2(x).3......
+|   3536: 82 35 74 61 62 6c 65 74 31 5f 73 65 67 64 69 72   .5tablet1_segdir
+|   3552: 74 31 5f 73 65 67 64 69 72 05 43 52 45 41 54 45   t1_segdir.CREATE
+|   3568: 20 54 41 42 4c 45 20 27 74 31 5f 73 65 67 64 69    TABLE 't1_segdi
+|   3584: 72 27 28 6c 65 76 65 6c 20 49 4e 54 45 47 45 52   r'(level INTEGER
+|   3600: 2c 69 64 78 20 49 4e 54 45 47 45 52 2c 73 74 61   ,idx INTEGER,sta
+|   3616: 72 74 5f 62 6c 6f 63 6b 20 49 4e 54 45 47 45 52   rt_block INTEGER
+|   3632: 2c 6c 65 61 76 65 73 5f 65 6e 64 5f 62 6c 6f 63   ,leaves_end_bloc
+|   3648: 6b 20 49 4e 54 45 47 45 52 2c 65 6e 64 5f 62 6c   k INTEGER,end_bl
+|   3664: 6f 63 6b 20 49 4e 54 45 47 45 62 2c 72 6f 6f 74   ock INTEGEb,root
+|   3680: 20 42 4c 4f 42 2c 50 52 49 4d 41 52 59 20 4b 45    BLOB,PRIMARY KE
+|   3696: 59 28 6c 65 76 65 6c 2c 20 69 64 78 29 29 31 06   Y(level, idx))1.
+|   3712: 06 17 45 1f 01 00 69 6e 64 65 78 73 71 6c 69 74   ..E...indexsqlit
+|   3728: 65 5f 61 75 74 6f 69 6e 64 65 78 5f 74 31 5f 73   e_autoindex_t1_s
+|   3744: 65 67 64 69 72 5f 31 74 31 5f 73 65 67 64 69 72   egdir_1t1_segdir
+|   3760: 06 0f c7 00 08 00 00 00 00 66 04 07 17 23 23 01   .........f...##.
+|   3776: 81 13 74 61 62 6c 65 74 31 5f 73 65 67 6d 65 6e   ..tablet1_segmen
+|   3792: 74 73 74 31 5f 73 65 67 6d 65 6e 74 73 04 43 52   tst1_segments.CR
+|   3808: 45 41 54 45 20 54 41 42 4c 45 20 27 74 31 5f 73   EATE TABLE 't1_s
+|   3824: 65 67 6d 65 6e 74 73 27 28 62 6c 6f 63 6b 69 64   egments'(blockid
+|   3840: 20 49 4e 54 45 47 45 52 20 50 52 49 4d 41 52 59    INTEGER PRIMARY
+|   3856: 20 4b 45 59 2c 20 62 6c 6f 63 6b 20 42 4c 4f 42    KEY, block BLOB
+|   3872: 29 6a 03 07 17 21 21 01 81 1f 74 61 62 6c 65 74   )j...!!...tablet
+|   3888: 31 5f 63 6f 6e 74 65 6e 74 74 31 5f 63 6f 6e 74   1_contentt1_cont
+|   3904: 65 6e 74 03 43 52 45 41 54 45 20 54 41 42 4c 45   ent.CREATE TABLE
+|   3920: 20 27 74 31 5f 63 6f 6e 74 65 6e 74 27 28 64 6f    't1_content'(do
+|   3936: 63 69 64 20 49 4e 54 45 47 45 52 20 50 52 49 4d   cid INTEGER PRIM
+|   3952: 41 52 59 20 4b 45 59 2c 20 27 63 30 61 27 2c 20   ARY KEY, 'c0a', 
+|   3968: 27 63 31 62 27 2c 20 27 63 32 63 27 29 38 02 06   'c1b', 'c2c')8..
+|   3984: 17 11 11 08 5f 74 61 62 6c 65 74 31 74 31 43 52   ...._tablet1t1CR
+|   4000: 45 41 54 45 20 56 49 52 54 55 41 4c 20 54 41 42   EATE VIRTUAL TAB
+|   4016: 4c 45 20 74 31 20 55 53 49 4e 47 20 66 74 73 33   LE t1 USING fts3
+|   4032: 28 61 2c 62 2c 63 29 00 00 00 39 00 00 00 00 00   (a,b,c)...9.....
+| page 3 offset 8192
+|      0: 0d 00 00 00 25 0b 48 00 0f d8 0f af 0f 86 0f 74   ....%.H........t
+|     16: 0f 61 0f 4e 0f 2f 0f 0f 0e ef 0e d7 0e be 0e a5   .a.N./..........
+|     32: 0e 8d 0e 74 0e 5b 0e 40 0e 24 0e 08 0d ef 0d d5   ...t.[.@.$......
+|     48: 0d bb 0d a0 0d 84 0d 68 0d 4f 0d 35 0d 1b 0c fb   .......h.O.5....
+|     64: 0c da 0c b9 0c 99 0c 78 0c 57 0c 3e 0c 24 0c 0a   .......x.W.>.$..
+|     80: 0b 48 00 00 00 00 00 00 00 00 00 00 00 00 00 00   .H..............
+|   2880: 00 00 00 00 00 00 00 00 81 3f 25 06 00 82 7f 00   .........?%.....
+|   2896: 00 43 4f 4d 50 49 4c 45 52 3d 67 63 63 2d 35 2e   .COMPILER=gcc-5.
+|   2912: 34 23 00 20 32 30 31 36 30 36 30 39 20 44 45 42   4#. 20160609 DEB
+|   2928: 55 47 20 45 4e 41 42 4c 45 20 44 42 53 54 41 54   UG ENABLE DBSTAT
+|   2944: 20 56 54 41 42 20 45 4e 41 42 4c 45 20 46 54 53    VTAB ENABLE FTS
+|   2960: 34 20 45 4e 41 42 4c 45 20 46 54 53 35 20 45 4e   4 ENABLE FTS5 EN
+|   2976: 41 42 4c 45 20 47 45 4f 50 4f 4c 59 20 45 4e 41   ABLE GEOPOLY ENA
+|   2992: 42 4c 45 20 4a 53 4f 4e 31 20 45 4e 41 42 4c 45   BLE JSON1 ENABLE
+|   3008: 20 4d 45 4d 53 59 53 35 20 45 4e 41 42 4c 45 20    MEMSYS5 ENABLE 
+|   3024: 52 54 52 45 45 20 4d 41 58 20 4d 45 4d 4f 52 59   RTREE MAX MEMORY
+|   3040: 3d 35 30 30 30 30 30 30 30 20 4f 4d 49 54 20 4c   =50000000 OMIT L
+|   3056: 4f 41 44 20 45 58 54 45 4e 53 49 4f 4e 20 54 48   OAD EXTENSION TH
+|   3072: 52 45 41 44 53 41 46 45 3d 30 18 24 05 00 25 0f   READSAFE=0.$..%.
+|   3088: 19 54 48 52 45 41 44 53 41 46 45 3d 30 58 42 49   .THREADSAFE=0XBI
+|   3104: 4e 41 52 59 18 23 05 00 25 0f 19 54 48 52 45 41   NARY.#..%..THREA
+|   3120: 44 53 41 46 45 3d 30 58 4e 4f 43 41 53 45 17 22   DSAFE=0XNOCASE..
+|   3136: 05 00 25 0f 17 54 48 52 45 41 44 53 41 46 45 3d   ..%..THREADSAFE=
+|   3152: 30 58 52 54 52 49 4d 1f 21 05 00 33 0f 19 4f 4d   0XRTRIM.!..3..OM
+|   3168: 49 54 20 4c 4f 41 44 20 45 58 54 45 4e 53 49 4f   IT LOAD EXTENSIO
+|   3184: 4e 58 42 49 4e 41 52 59 1f 20 05 00 33 0f 19 4f   NXBINARY. ..3..O
+|   3200: 4d 49 54 20 4c 4f 41 44 20 45 58 54 45 4e 53 49   MIT LOAD EXTENSI
+|   3216: 4f 4e 58 4e 4f 43 41 53 45 1e 1f 05 00 33 0f 17   ONXNOCASE....3..
+|   3232: 4f 4d 49 54 20 4c 4f 41 44 20 45 58 54 45 4e 53   OMIT LOAD EXTENS
+|   3248: 49 4f 4e 58 52 54 52 49 4d 1f 1e 05 00 33 0f 19   IONXRTRIM....3..
+|   3264: 4d 41 58 20 4d 45 4d 4f 52 59 3d 35 30 30 30 30   MAX MEMORY=50000
+|   3280: 30 30 30 58 42 49 4e 41 52 59 1f 1d 05 00 33 0f   000XBINARY....3.
+|   3296: 19 4d 41 58 20 4d 45 4d 4f 52 59 3d 35 30 30 30   .MAX MEMORY=5000
+|   3312: 30 30 30 30 58 4e 4f 43 41 53 45 1e 1c 05 00 33   0000XNOCASE....3
+|   3328: 0f 17 4d 41 58 20 4d 45 4d 4f 52 59 3d 35 30 30   ..MAX MEMORY=500
+|   3344: 30 30 30 30 30 58 52 54 53 49 4d 18 1b 05 00 25   00000XRTSIM....%
+|   3360: 0f 19 45 4e 41 42 4c 45 20 52 54 52 45 45 58 42   ..ENABLE RTREEXB
+|   3376: 49 4e 41 52 59 18 1a 05 00 25 0f 19 45 4e 41 42   INARY....%..ENAB
+|   3392: 4c 45 20 52 54 52 45 45 58 4e 4f 43 41 53 45 17   LE RTREEXNOCASE.
+|   3408: 19 05 00 25 0f 17 45 4e 41 42 4c 45 20 52 54 52   ...%..ENABLE RTR
+|   3424: 45 45 58 52 54 52 49 4d 1a 18 05 00 29 0f 19 45   EEXRTRIM....)..E
+|   3440: 4e 41 42 4c 45 20 4d 45 4d 53 59 53 35 58 42 49   NABLE MEMSYS5XBI
+|   3456: 4e 41 52 59 1a 17 05 00 29 0f 19 45 4e 41 42 4c   NARY....)..ENABL
+|   3472: 45 20 4d 45 4d 53 59 53 35 58 4e 4f 43 41 53 45   E MEMSYS5XNOCASE
+|   3488: 19 16 05 00 29 0f 17 45 4e 41 42 4c 45 20 4d 45   ....)..ENABLE ME
+|   3504: 4d 53 59 53 35 58 52 54 52 49 4d 18 15 05 00 25   MSYS5XRTRIM....%
+|   3520: 0f 19 45 4e 41 42 4c 45 20 4a 53 4f 4e 31 58 42   ..ENABLE JSON1XB
+|   3536: 49 4e 41 52 59 18 14 05 00 25 0f 19 45 4e 41 42   INARY....%..ENAB
+|   3552: 4c 45 20 4a 53 4f 4e 31 58 4e 4f 43 41 53 45 17   LE JSON1XNOCASE.
+|   3568: 13 05 00 25 0f 17 45 4e 41 52 4c 45 20 4a 53 4f   ...%..ENARLE JSO
+|   3584: 4e 31 58 52 54 52 49 4d 1a 12 05 00 29 0f 19 45   N1XRTRIM....)..E
+|   3600: 4e 41 42 4c 45 20 47 45 4f 50 4f 4c 59 58 42 49   NABLE GEOPOLYXBI
+|   3616: 4e 41 52 59 1a 11 05 00 29 0f 19 45 4e 41 1e 4c   NARY....)..ENA.L
+|   3632: 45 20 47 45 4f 50 4f 4c 59 58 4e 4f 43 41 53 45   E GEOPOLYXNOCASE
+|   3648: 19 10 05 00 29 0f 17 45 4e 41 42 4c 45 20 47 55   ....)..ENABLE GU
+|   3664: 4f 50 4f 4c 59 58 52 54 52 49 4d 17 0f 05 00 23   OPOLYXRTRIM....#
+|   3680: 0f 19 45 4e 41 42 4c 45 20 46 54 53 35 58 42 49   ..ENABLE FTS5XBI
+|   3696: 4e 41 52 59 17 0e 05 00 23 0f 19 45 4e 41 42 4c   NARY....#..ENABL
+|   3712: 45 20 46 54 53 35 58 4e 4f 43 41 53 45 16 0d 05   E FTS5XNOCASE...
+|   3728: 00 23 0f 17 45 4e 41 42 4c 45 20 46 54 59 e5 58   .#..ENABLE FTY.X
+|   3744: 52 54 52 49 4d 17 0c 05 00 23 0f 19 45 4e 41 42   RTRIM....#..ENAB
+|   3760: 4c 45 20 46 54 53 34 58 42 49 4e 41 52 59 17 0b   LE FTS4XBINARY..
+|   3776: 05 00 23 0f 19 45 4e 41 42 4c 45 20 46 54 53 35   ..#..ENABLE FTS5
+|   3792: 58 4e 4f 43 40 53 45 16 0a 05 00 23 0f 17 45 4e   XNOC@SE....#..EN
+|   3808: 41 42 4c 45 20 46 54 53 34 58 52 54 52 49 4d 1e   ABLE FTS4XRTRIM.
+|   3824: 09 05 00 31 0f 19 45 4e 41 42 4c 45 20 44 42 53   ...1..ENABLE DBS
+|   3840: 54 41 54 20 56 54 41 42 58 42 49 4e 41 52 59 1e   TAT VTABXBINARY.
+|   3856: 08 05 00 31 0f 19 45 4e 41 42 4c 45 20 44 42 53   ...1..ENABLE DBS
+|   3872: 54 41 54 20 56 54 41 42 58 4e 4f 43 41 53 45 1d   TAT VTABXNOCASE.
+|   3888: 07 05 00 31 0f 17 45 4e 41 42 4c 45 20 44 42 53   ...1..ENABLE DBS
+|   3904: 54 41 54 20 56 54 41 42 58 52 54 52 49 4d 11 06   TAT VTABXRTRIM..
+|   3920: 05 00 17 0f 19 44 45 42 55 47 58 42 49 4e 41 52   .....DEBUGXBINAR
+|   3936: 59 11 05 05 00 17 0f 19 44 45 42 55 47 58 4e 4f   Y.......DEBUGXNO
+|   3952: 43 41 53 45 10 04 05 00 17 0f 17 44 45 42 55 47   CASE.......DEBUG
+|   3968: 58 52 54 52 49 4d 27 03 05 00 43 0f 19 43 4f 4d   XRTRIM'...C..COM
+|   3984: 50 49 4c 45 52 3d 67 63 63 2d 35 2e 34 2e 30 20   PILER=gcc-5.4.0 
+|   4000: 32 30 31 36 30 36 30 39 58 42 49 4e 41 52 59 27   20160609XBINARY'
+|   4016: 02 05 00 43 0f 19 43 4f 4d 50 49 4c 45 52 3d 67   ...C..COMPILER=g
+|   4032: 63 63 25 75 2e 34 2f 30 20 32 30 31 36 30 36 30   cc%u.4/0 2016060
+|   4048: 39 58 4e 4f 43 41 53 45 26 01 05 00 43 0f 17 43   9XNOCASE&...C..C
+|   4064: 4f 4d 50 49 4c 45 52 3d 67 63 63 2d 35 2e 34 2e   OMPILER=gcc-5.4.
+|   4080: 30 20 32 30 31 36 30 36 30 39 58 52 54 52 49 4d   0 20160609XRTRIM
+| page 4 offset 12288
+|      0: 0d 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00   ................
+| page 5 offset 16384
+|      0: 0d 00 00 00 02 0b a0 00 0c ad 0b a0 00 00 00 00   ................
+|   2976: 82 0a 02 08 08 09 08 08 17 84 06 30 20 32 35 33   ...........0 253
+|   2992: 00 01 30 04 25 06 1b 00 00 08 32 30 31 36 30 36   ..0.%.....201606
+|   3008: 30 39 03 25 07 00 00 01 34 03 25 05 00 00 01 35   09.%....4.%....5
+|   3024: 03 25 04 00 01 07 30 30 30 30 30 30 30 03 25 1a   .%....0000000.%.
+|   3040: 00 00 08 63 6f 6d 70 69 6c 65 72 03 25 02 00 00   ...compiler.%...
+|   3056: 06 64 62 73 74 61 74 03 25 0a 00 01 04 65 62 75   .dbstat.%....ebu
+|   3072: 67 03 25 08 00 00 06 65 6e 61 62 6c 65 09 25 09   g.%....enable.%.
+|   3088: 05 04 04 04 04 04 00 01 08 78 74 65 6e 73 69 6f   .........xtensio
+|   3104: 6e 03 25 1d 00 00 04 66 74 73 34 03 25 0d 00 03   n.%....fts4.%...
+|   3120: 01 35 03 25 0f 00 00 03 67 63 63 03 25 03 00 01   .5.%....gcc.%...
+|   3136: 06 65 6f 70 6f 6c 79 03 25 11 00 00 05 6a 73 6f   .eopoly.%....jso
+|   3152: 6e 31 03 25 13 41 00 04 6c 6f 61 64 03 25 1c 00   n1.%.A..load.%..
+|   3168: 00 03 6d 61 78 03 25 18 00 01 05 65 6d 6f 72 79   ..max.%....emory
+|   3184: 03 25 19 00 03 04 73 79 73 35 03 25 15 00 00 04   .%....sys5.%....
+|   3200: 6f 6d 69 74 03 25 1b 00 00 05 72 74 72 65 65 03   omit.%....rtree.
+|   3216: 25 17 00 00 0a 74 68 72 65 61 64 73 61 56 65 03   %....threadsaVe.
+|   3232: 25 1e 00 00 04 76 74 61 62 03 25 0b 00 86 50 01   %....vtab.%...P.
+|   3248: 08 08 08 08 08 17 8d 12 30 20 38 33 35 00 01 30   ........0 835..0
+|   3264: 12 01 06 00 01 06 00 01 06 00 1f 03 00 01 03 00   ................
+|   3280: 01 03 00 00 08 32 30 31 36 30 36 30 39 09 01 07   .....20160609...
+|   3296: 00 01 07 00 01 07 00 00 01 34 09 01 05 00 01 05   .........4......
+|   3312: 00 01 05 00 00 01 35 09 01 04 00 01 04 00 01 04   ......5.........
+|   3328: 00 01 07 30 30 30 30 30 30 30 09 1c 04 00 01 04   ...0000000......
+|   3344: 00 01 04 00 00 06 62 69 6e 61 72 79 3c 03 02 02   ......binary<...
+|   3360: 02 00 03 01 02 02 00 03 01 02 02 00 03 01 02 02   ................
+|   3376: 00 03 01 02 02 00 03 01 02 02 00 03 01 02 02 00   ................
+|   3392: 03 01 02 02 00 03 01 02 02 00 03 01 02 02 00 03   ................
+|   3408: 01 02 02 00 03 01 02 02 00 00 08 63 6f 6d 70 69   ...........compi
+|   3424: 6c 65 72 09 01 02 00 01 02 00 01 02 00 00 06 64   ler............d
+|   3440: 62 73 74 61 74 09 f2 03 00 01 03 00 01 03 00 01   bstat...........
+|   3456: 04 65 62 75 67 09 04 02 00 01 02 00 01 02 00 00   .ebug...........
+|   3472: 06 65 6e 61 62 6c 65 3f 07 02 00 01 02 00 01 02   .enable?........
+|   3488: 00 01 02 00 01 02 00 01 02 00 01 02 00 57 02 00   .............W..
+|   3504: 01 02 00 01 01 00 01 02 00 11 02 00 01 02 10 01   ................
+|   3520: 02 00 01 02 00 01 02 00 01 02 00 01 02 00 01 02   ................
+|   3536: 00 01 02 00 01 02 00 01 08 78 74 64 6e 73 69 6f   .........xtdnsio
+|   3552: 6e 09 1f 04 00 01 04 00 01 03 00 00 04 66 74 73   n............fts
+|   3568: 34 09 0a 03 00 01 03 00 01 03 00 03 01 35 09 0d   4............5..
+|   3584: 03 00 01 03 00 01 03 00 00 03 57 63 63 09 01 03   ..........Wcc...
+|   3600: 00 01 03 00 01 03 00 01 06 65 6f 70 6f 6c 79 09   .........eopoly.
+|   3616: 10 03 00 01 03 00 01 03 00 00 05 6a 73 6f 6e 31   ...........json1
+|   3632: 09 13 03 00 01 03 00 01 03 00 00 04 6c 6f 61 64   ............load
+|   3648: 09 1f 03 00 01 03 00 01 03 00 00 03 6d 61 78 09   ............max.
+|   3664: 1c 02 00 01 02 00 01 02 00 01 05 65 6d 6f 72 79   ...........emory
+|   3680: 09 1c 03 00 01 03 00 01 03 00 03 04 73 79 73 35   ............sys5
+|   3696: 09 16 03 00 01 03 00 01 03 00 00 06 6e 6f 63 61   ............noca
+|   3712: 73 65 3c 02 01 02 02 00 03 01 02 02 00 03 01 02   se<.............
+|   3728: 02 00 03 01 02 02 00 03 01 02 02 00 03 01 02 02   ................
+|   3744: 00 03 01 02 02 00 03 01 02 02 00 03 01 02 02 00   ................
+|   3760: 03 01 02 02 00 03 01 02 02 00 03 01 02 02 00 00   ................
+|   3776: 04 6f 6d 69 74 09 1f 02 00 01 02 00 01 02 00 00   .omit...........
+|   3792: 05 72 74 72 65 65 09 19 03 00 01 03 00 01 03 00   .rtree..........
+|   3808: 03 02 69 6d 3c 01 01 02 02 00 03 01 02 02 00 03   ..im<...........
+|   3824: 01 02 02 00 03 01 02 02 00 03 01 02 02 00 03 01   ................
+|   3840: 02 02 00 03 01 02 02 00 03 01 02 02 00 03 01 02   ................
+|   3856: 02 00 03 01 02 02 00 03 01 02 02 00 03 01 02 02   ................
+|   3872: 00 00 0a 74 68 72 65 61 64 73 61 66 65 09 22 02   ...threadsafe...
+|   3888: 00 01 02 00 02 02 00 00 04 76 74 61 62 09 07 04   .........vtab...
+|   3904: 00 01 04 00 01 04 00 00 01 78 b4 01 01 01 01 02   .........x......
+|   3920: 00 01 01 01 02 00 01 01 01 02 00 01 01 01 02 00   ................
+|   3936: 01 01 01 02 00 01 01 01 02 00 01 01 01 02 00 01   ................
+|   3952: 01 01 02 00 01 01 01 02 00 01 01 01 02 00 01 01   ................
+|   3968: 01 02 00 01 01 01 02 00 01 01 01 02 00 01 01 01   ................
+|   3984: 02 00 01 01 01 02 00 01 01 01 02 00 01 01 01 02   ................
+|   4000: 00 01 01 01 02 00 01 01 01 02 00 01 01 01 02 00   ................
+|   4016: 01 01 01 02 00 01 01 01 02 00 01 01 01 02 00 01   ................
+|   4032: 01 01 02 00 01 01 01 02 00 01 01 01 02 00 01 01   ................
+|   4048: 01 02 00 01 01 01 02 00 01 01 01 02 00 01 01 01   ................
+|   4064: 02 00 01 01 01 02 00 01 01 01 02 00 01 01 01 02   ................
+|   4080: 00 01 01 01 02 00 01 01 01 02 00 01 01 01 02 00   ................
+| page 6 offset 20480
+|      0: 0a 00 00 00 02 0f f5 00 0f fb 0f f5 00 00 00 00   ................
+|   4080: 00 00 00 00 00 05 04 08 09 01 02 04 04 08 08 09   ................
+| page 7 offset 24576
+|      0: 0d 00 00 00 05 0f b8 00 0f f4 0f e9 0f d6 0f c7   ................
+|     16: 0f b8 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
+|   4064: 00 00 00 00 00 0d 05 02 23 61 75 74 6f 6d 65 72   ........#automer
+|   4080: 67 65 3d 35 0d 04 02 23 6d 65 72 67 65 3d 31 30   ge=5...#merge=10
+| page 8 offset 28672
+|      0: 30 2c 38 11 03 02 2b 69 6e 74 65 67 72 69 74 79   0,8...+integrity
+|     16: 2d 63 68 65 63 6b 09 02 02 1b 72 65 62 75 69 6c   -check....rebuil
+|     32: 64 0a 01 02 1d 6f 70 74 69 6d 69 7a 65 00 00 00   d....optimize...
+| end crash-4ce32d0608aff1.db
+}]} {}
+
+do_catchsql_test 18.1 {
+  SELECT quote(matchinfo(t1,'pcxybs'))==0 FROM t1 WHERE b MATCH 'e*';
+} {0 0}
+
+#-------------------------------------------------------------------------
+reset_db
+do_test 19.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 28672 pagesize 4096 filename crash-526ea445f41c02.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 00 00 00 00 07   .....@  ........
+|     32: 00 00 00 02 00 00 00 01 00 00 00 07 00 00 00 04   ................
+|     48: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00   ................
+|     96: 00 00 00 00 0d 0e b1 00 06 0d a4 00 0f 8d 0f 21   ...............!
+|    112: 0e b9 0d c8 0e 7e 0d a4 00 00 00 00 00 00 00 00   .....~..........
+|   3488: 00 00 00 00 22 07 06 17 11 11 01 31 74 61 62 6c   ...........1tabl
+|   3504: 65 74 32 74 32 07 43 52 45 41 54 45 20 54 41 42   et2t2.CREATE TAB
+|   3520: 4c 45 20 74 32 28 78 29 81 33 05 07 17 1f 1f 01   LE t2(x).3......
+|   3536: 82 35 74 61 62 6c 65 74 31 5f 73 65 67 64 69 72   .5tablet1_segdir
+|   3552: 74 31 5f 73 65 67 64 69 72 05 43 52 45 41 54 45   t1_segdir.CREATE
+|   3568: 20 54 41 42 4c 45 20 27 74 31 5f 73 65 67 64 69    TABLE 't1_segdi
+|   3584: 72 27 28 6c 65 76 65 6c 20 49 4e 54 45 47 45 52   r'(level INTEGER
+|   3600: 2c 69 64 78 20 49 4e 54 45 47 45 52 2c 73 74 61   ,idx INTEGER,sta
+|   3616: 72 74 5f 62 6c 6f 63 6b 20 49 4e 54 45 47 45 52   rt_block INTEGER
+|   3632: 2c 6c 65 61 76 65 73 5f 65 6e 64 5f 62 6c 6f 63   ,leaves_end_bloc
+|   3648: 6b 20 49 4e 54 45 47 45 52 2c 65 6e 64 5f 62 6c   k INTEGER,end_bl
+|   3664: 6f 63 6b 20 49 4e 54 45 47 45 52 2c 72 6f 6f 74   ock INTEGER,root
+|   3680: 20 42 4c 4f 42 2c 50 52 49 4d 41 52 59 20 4b 45    BLOB,PRIMARY KE
+|   3696: 59 28 6c 65 76 65 6c 2c 20 69 64 78 29 29 31 06   Y(level, idx))1.
+|   3712: 06 17 45 1f 01 00 69 6e 64 65 78 73 71 6c 69 74   ..E...indexsqlit
+|   3728: 65 5f 61 75 74 6f 69 6e 64 65 78 5f 74 31 5f 73   e_autoindex_t1_s
+|   3744: 65 67 64 69 72 5f 31 74 31 5f 73 65 67 64 69 72   egdir_1t1_segdir
+|   3760: 06 0f c7 00 08 00 00 00 00 66 04 07 17 23 23 01   .........f...##.
+|   3776: 81 13 74 61 62 6c 65 74 31 5f 73 65 67 6d 65 6e   ..tablet1_segmen
+|   3792: 74 73 74 31 5f 73 65 67 6d 65 6e 74 73 04 43 52   tst1_segments.CR
+|   3808: 45 41 54 45 20 54 41 42 4c 45 20 27 74 31 5f 73   EATE TABLE 't1_s
+|   3824: 65 67 6d 65 6e 74 73 27 28 62 6c 6f 63 6b 69 64   egments'(blockid
+|   3840: 20 49 4e 54 45 47 45 52 20 50 52 49 4d 41 52 59    INTEGER PRIMARY
+|   3856: 20 4b 45 59 2c 20 62 6c 6f 63 6b 20 42 4c 4f 42    KEY, block BLOB
+|   3872: 29 6a 03 07 17 21 21 01 81 1f 74 61 62 6c 65 74   )j...!!...tablet
+|   3888: 31 5f 63 6f 6e 74 65 6e 74 74 31 5f 63 6f 6e 74   1_contentt1_cont
+|   3904: 65 6e 74 03 43 52 45 41 54 45 20 54 41 42 4c 45   ent.CREATE TABLE
+|   3920: 20 27 74 31 5f 63 6f 6e 74 65 6e 74 27 28 64 6f    't1_content'(do
+|   3936: 63 69 64 20 49 4e 54 45 47 45 52 20 50 52 49 4d   cid INTEGER PRIM
+|   3952: 41 52 59 20 4b 45 59 2c 20 27 63 30 61 27 2c 20   ARY KEY, 'c0a', 
+|   3968: 27 63 31 62 27 2c 20 27 63 32 63 27 29 38 02 06   'c1b', 'c2c')8..
+|   3984: 17 11 11 08 5f 74 61 62 6c 65 74 31 74 41 43 52   ...._tablet1tACR
+|   4000: 45 41 54 45 20 56 49 52 54 55 41 4c 20 54 41 42   EATE VIRTUAL TAB
+|   4016: 4c 45 20 74 31 20 55 53 49 4e 47 20 66 74 73 33   LE t1 USING fts3
+|   4032: 28 61 2c 62 2c 63 29 00 00 00 39 00 00 00 00 00   (a,b,c)...9.....
+| page 3 offset 8192
+|      0: 0d 00 00 00 25 0b 48 00 0f d8 0f af 0f 86 0f 74   ....%.H........t
+|     16: 0f 61 0f 4e 0f 2f 0f 0f 0e ef 0e d7 0e be 0e a5   .a.N./..........
+|     32: 0e 8d 0e 74 0e 5b 0e 40 0e 24 0e 08 0d ef 0d d5   ...t.[.@.$......
+|     48: 0d bb 0d a0 0d 84 0d 68 0d 4f 0d 35 0d 1b 0c fb   .......h.O.5....
+|     64: 0c da 0c b9 0c 99 0c 78 0c 57 0c 3e 0c 24 0c 0a   .......x.W.>.$..
+|     80: 0b 48 00 00 00 00 00 00 00 00 00 00 00 00 00 00   .H..............
+|   2880: 00 00 00 00 00 00 00 00 81 3f 25 06 00 82 7f 00   .........?%.....
+|   2896: 00 43 4f 4d 50 49 4c 45 52 3d 67 63 63 2d 35 2f   .COMPILER=gcc-5/
+|   2912: 34 2e 30 20 32 30 31 36 30 36 30 39 20 44 45 42   4.0 20160609 DEB
+|   2928: 55 47 20 45 4e 41 42 4c 45 20 44 42 53 54 41 54   UG ENABLE DBSTAT
+|   2944: 20 56 54 41 42 20 45 4e 41 42 4c 45 20 46 54 53    VTAB ENABLE FTS
+|   2960: 34 20 45 4e 41 42 4c 45 20 46 54 53 35 20 45 4e   4 ENABLE FTS5 EN
+|   2976: 41 42 4c 45 20 47 45 4f 50 4f 4c 59 20 45 4e 41   ABLE GEOPOLY ENA
+|   2992: 42 4c 45 20 4a 53 4f 4e 31 20 45 4e 41 42 4c 45   BLE JSON1 ENABLE
+|   3008: 20 4d 45 4d 53 59 53 35 20 45 4e 41 42 4c 45 20    MEMSYS5 ENABLE 
+|   3024: 52 54 52 45 45 20 4d 41 58 20 4d 45 4d 4f 52 59   RTREE MAX MEMORY
+|   3040: 3d 35 30 30 30 30 30 30 30 20 4f 4d 49 54 20 4c   =50000000 OMIT L
+|   3056: 4f 41 44 20 45 58 54 45 4e 53 49 4f 4e 20 54 48   OAD EXTENSION TH
+|   3072: 52 45 41 44 53 41 46 45 3d 30 18 24 05 00 25 0f   READSAFE=0.$..%.
+|   3088: 19 54 48 52 45 41 44 53 41 46 45 3d 30 58 42 49   .THREADSAFE=0XBI
+|   3104: 4e 41 52 59 18 23 05 00 25 0f 19 54 48 52 45 41   NARY.#..%..THREA
+|   3120: 44 53 41 46 45 3d 30 58 4e 4f 43 41 53 45 17 22   DSAFE=0XNOCASE..
+|   3136: 05 00 25 0f 17 54 48 52 45 41 44 53 41 46 45 3d   ..%..THREADSAFE=
+|   3152: 30 58 52 54 52 49 4d 1f 21 05 00 33 0f 19 4f 4d   0XRTRIM.!..3..OM
+|   3168: 49 54 20 4c 4f 41 44 20 45 58 54 45 4e 53 49 4f   IT LOAD EXTENSIO
+|   3184: 4e 58 42 49 4e 41 52 59 1f 20 05 00 33 0f 19 4f   NXBINARY. ..3..O
+|   3200: 4d 49 54 20 4c 4f 41 44 20 45 58 54 45 4e 53 49   MIT LOAD EXTENSI
+|   3216: 4f 4e 58 4e 4f 43 41 53 45 1e 1f 05 00 33 0f 17   ONXNOCASE....3..
+|   3232: 4f 4d 49 54 20 4c 4f 41 44 20 45 58 54 45 4e 53   OMIT LOAD EXTENS
+|   3248: 49 4f 4e 58 52 54 52 49 4d 1f 1e 05 00 33 0f 19   IONXRTRIM....3..
+|   3264: 4d 41 58 20 4d 45 4d 4f 52 59 3d 35 30 30 30 30   MAX MEMORY=50000
+|   3280: 30 30 30 58 42 49 4e 41 52 59 1f 1d 05 00 33 0f   000XBINARY....3.
+|   3296: 19 4d 41 58 20 4d 45 4d 4f 52 59 3d 35 30 30 30   .MAX MEMORY=5000
+|   3312: 30 30 30 30 58 4e 4f 43 41 53 45 1e 1c 05 00 33   0000XNOCASE....3
+|   3328: 0f 17 4d 41 58 20 4d 45 4d 4f 52 59 3d 35 30 30   ..MAX MEMORY=500
+|   3344: 30 30 30 30 30 58 52 54 52 49 4d 18 1b 05 00 25   00000XRTRIM....%
+|   3360: 0f 19 45 4e 41 42 4c 45 20 52 54 52 45 45 58 42   ..ENABLE RTREEXB
+|   3376: 49 4e 41 52 59 18 1a 05 00 25 0f 19 45 4e 41 42   INARY....%..ENAB
+|   3392: 4c 45 20 52 54 52 45 45 58 4e 4f 43 41 53 45 17   LE RTREEXNOCASE.
+|   3408: 19 05 00 25 0f 17 45 4e 41 42 4c 45 20 52 54 52   ...%..ENABLE RTR
+|   3424: 45 45 58 52 54 52 49 4d 1a 18 05 00 29 0f 19 45   EEXRTRIM....)..E
+|   3440: 4e 41 42 4c 45 20 4d 45 4d 53 59 53 35 58 42 49   NABLE MEMSYS5XBI
+|   3456: 4e 41 52 59 1a 17 05 00 29 0f 19 45 4e 41 42 4c   NARY....)..ENABL
+|   3472: 45 20 4d 45 4d 53 59 53 35 58 4e 4f 43 41 53 45   E MEMSYS5XNOCASE
+|   3488: 19 16 05 00 29 0f 17 45 4e 41 42 4c 45 20 4d 45   ....)..ENABLE ME
+|   3504: 4d 53 59 53 35 58 52 54 52 49 4d 18 15 05 00 25   MSYS5XRTRIM....%
+|   3520: 0f 19 45 4e 41 42 4c 45 20 4a 53 4f 4e 31 58 42   ..ENABLE JSON1XB
+|   3536: 49 4e 41 52 59 18 14 05 00 25 0f 19 45 4e 41 42   INARY....%..ENAB
+|   3552: 4c 45 20 4a 53 4f 4e 31 58 4e 4f 43 41 53 45 17   LE JSON1XNOCASE.
+|   3568: 13 05 00 25 0f 17 45 4e 41 42 4c 45 20 4a 53 4f   ...%..ENABLE JSO
+|   3584: 4e 31 58 52 54 52 49 4d 1a 12 05 00 29 0f 19 45   N1XRTRIM....)..E
+|   3600: 4e 41 42 4c 45 20 47 45 4f 50 4f 4c 59 58 42 49   NABLE GEOPOLYXBI
+|   3616: 4e 41 52 59 1a 11 05 00 29 0f 19 45 4e 41 42 4c   NARY....)..ENABL
+|   3632: 45 20 47 45 4f 50 4f 4c 59 58 4e 4f 43 41 53 45   E GEOPOLYXNOCASE
+|   3648: 19 10 05 00 29 0f 17 45 4e 41 42 4c 45 20 47 45   ....)..ENABLE GE
+|   3664: 4f 50 4f 4c 59 58 52 54 52 49 4d 17 0f 05 00 23   OPOLYXRTRIM....#
+|   3680: 0f 19 45 4e 41 42 4c 45 20 46 54 53 35 58 42 49   ..ENABLE FTS5XBI
+|   3696: 4f 41 52 59 17 0e 05 00 23 0f 19 45 4e 41 42 4c   OARY....#..ENABL
+|   3712: 45 20 46 54 53 35 58 4e 4f 43 41 53 45 16 0d 05   E FTS5XNOCASE...
+|   3728: 00 23 0f 17 45 4e 41 42 4c 45 20 46 54 53 35 58   .#..ENABLE FTS5X
+|   3744: 52 54 52 49 4d 17 0c 05 00 23 0f 19 45 4e 41 42   RTRIM....#..ENAB
+|   3760: 4c 45 20 46 54 53 34 58 42 49 4e 41 52 59 17 0b   LE FTS4XBINARY..
+|   3776: 05 00 23 0f 19 45 4e 41 42 4d f5 20 46 54 53 34   ..#..ENABM. FTS4
+|   3792: 58 4e 4f 43 41 53 45 16 0a 05 00 23 0f 17 45 4e   XNOCASE....#..EN
+|   3808: 41 52 4c 45 20 46 54 53 34 58 52 54 52 49 4d 1e   ARLE FTS4XRTRIM.
+|   3824: 09 05 00 31 0f 19 45 4e 41 42 4c 45 20 44 42 53   ...1..ENABLE DBS
+|   3840: 54 41 54 20 56 54 41 42 58 42 49 4e 41 52 59 1e   TAT VTABXBINARY.
+|   3856: 08 05 00 31 0f 19 45 4e 41 42 4c 45 20 44 42 53   ...1..ENABLE DBS
+|   3872: 54 41 54 20 56 54 41 42 58 4e 4f 43 41 53 45 1d   TAT VTABXNOCASE.
+|   3888: 07 05 00 31 0f 17 45 4e 41 42 4c 45 20 44 42 53   ...1..ENABLE DBS
+|   3904: 54 41 54 20 56 54 41 42 58 52 54 52 49 4d 11 06   TAT VTABXRTRIM..
+|   3920: 05 00 17 0f 19 44 45 42 55 47 58 42 49 4e 41 52   .....DEBUGXBINAR
+|   3936: 59 11 05 05 00 17 0f 19 44 45 42 55 47 58 4e 4f   Y.......DEBUGXNO
+|   3952: 43 41 53 45 10 04 05 00 17 0f 17 44 45 42 55 47   CASE.......DEBUG
+|   3968: 58 52 54 52 49 4d 27 03 05 00 43 0f 19 43 4f 4d   XRTRIM'...C..COM
+|   3984: 50 49 4c 45 52 3d 67 63 63 2d 35 2e 34 2e 30 20   PILER=gcc-5.4.0 
+|   4000: 32 30 31 36 30 36 30 39 58 42 49 4e 41 52 59 27   20160609XBINARY'
+|   4016: 02 04 00 43 0f 19 43 4f 4d 50 49 4c 45 52 3d 67   ...C..COMPILER=g
+|   4032: 63 63 2d 35 2e 34 2e 30 20 32 30 31 36 30 36 30   cc-5.4.0 2016060
+|   4048: 39 58 4e 4f 43 41 53 45 26 01 05 00 43 0f 17 43   9XNOCASE&...C..C
+|   4064: 4f 4d 50 49 4c 45 52 3d 67 63 63 2d 35 2e 34 2e   OMPILER=gcc-5.4.
+|   4080: 30 20 32 30 31 36 30 36 30 39 58 52 54 52 49 4d   0 20160609XRTRIM
+| page 4 offset 12288
+|      0: 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
+| page 5 offset 16384
+|      0: 0d 00 00 00 02 0b a0 00 0c ad 0b a0 00 00 00 00   ................
+|   2976: 82 0a 02 08 08 09 08 08 17 84 06 30 20 32 35 33   ...........0 253
+|   2992: 00 01 30 04 25 06 1b 00 00 08 32 30 31 36 30 36   ..0.%.....201606
+|   3008: 30 39 03 25 07 00 00 01 34 03 25 05 00 00 01 35   09.%....4.%....5
+|   3024: 03 25 04 00 01 07 30 30 30 30 30 30 30 03 25 1a   .%....0000000.%.
+|   3040: 00 00 08 63 6f 6d 70 69 6c 65 72 03 25 02 00 00   ...compiler.%...
+|   3056: 06 64 62 73 74 61 74 03 25 0a 00 01 04 65 62 75   .dbstat.%....ebu
+|   3072: 67 03 25 08 00 00 06 65 6e 61 62 6c 65 09 25 09   g.%....enable.%.
+|   3088: 05 04 04 04 04 04 00 01 08 78 74 65 6e 73 69 6f   .........xtensio
+|   3104: 6e 03 25 1d 00 00 04 66 74 73 34 03 25 0d 00 03   n.%....fts4.%...
+|   3120: 01 35 03 25 0f 00 00 03 67 63 63 03 25 03 00 01   .5.%....gcc.%...
+|   3136: 06 65 6f 70 6f 6c 79 03 25 11 00 00 05 6a 73 6f   .eopoly.%....jso
+|   3152: 6e 31 03 25 13 00 00 04 6c 6f 61 64 03 25 1c 00   n1.%....load.%..
+|   3168: 00 03 6d 61 78 03 25 18 00 01 05 65 6d 6f 72 79   ..max.%....emory
+|   3184: 03 25 19 00 03 04 73 79 73 35 03 25 15 00 00 04   .%....sys5.%....
+|   3200: 6f 6d 69 74 03 25 1b 00 00 05 72 74 72 65 65 03   omit.%....rtree.
+|   3216: 25 17 00 00 0a 74 68 72 65 61 64 73 61 66 65 03   %....threadsafe.
+|   3232: 25 1e 00 00 04 76 74 61 62 03 25 0b 00 86 50 01   %....vtab.%...P.
+|   3248: 08 08 08 08 08 17 8d 12 30 20 38 33 35 00 01 30   ........0 835..0
+|   3264: 12 01 06 00 01 06 00 01 06 00 1f 03 00 01 03 00   ................
+|   3280: 01 03 00 00 08 32 30 31 36 30 36 30 39 09 01 07   .....20160609...
+|   3296: 00 01 07 00 01 07 00 00 01 34 09 01 05 00 01 05   .........4......
+|   3312: 00 01 05 00 00 01 35 09 01 04 00 01 04 00 01 04   ......5.........
+|   3328: 00 01 07 30 30 30 30 30 30 30 09 1c 04 00 01 04   ...0000000......
+|   3344: 00 01 04 00 00 06 62 69 6e 61 72 79 3c 03 01 02   ......binary<...
+|   3360: 02 00 03 01 02 02 00 03 01 02 02 00 03 01 02 02   ................
+|   3376: 00 03 01 02 02 00 03 01 02 02 00 03 01 02 02 00   ................
+|   3392: 03 01 02 02 00 03 01 02 02 00 03 01 02 02 00 03   ................
+|   3408: 01 02 02 00 03 01 02 02 00 00 08 63 6f 6d 70 69   ...........compi
+|   3424: 6c 65 72 09 01 02 00 01 02 00 01 02 00 00 06 64   ler............d
+|   3440: 62 73 74 61 74 09 07 03 00 01 03 00 01 03 00 01   bstat...........
+|   3456: 04 65 62 75 67 09 04 02 00 01 02 00 01 02 00 00   .ebug...........
+|   3472: 06 65 6e 61 62 6c 65 3f 07 02 00 01 02 00 01 02   .enable?........
+|   3488: 00 01 02 00 01 02 00 01 02 00 01 02 00 01 02 00   ................
+|   3504: 01 02 00 01 02 00 01 02 00 01 02 00 01 02 00 01   ................
+|   3520: 02 00 01 02 00 01 02 00 01 02 00 01 02 00 01 02   ................
+|   3536: 00 01 02 00 01 02 00 01 08 78 74 65 6e 73 69 6f   .........xtensio
+|   3552: 6e 09 1f 04 00 01 04 00 01 04 00 00 04 66 74 73   n............fts
+|   3568: 34 09 0a 03 00 01 03 00 01 03 00 03 01 35 09 0d   4............5..
+|   3584: 03 00 01 03 00 01 03 00 00 03 67 63 63 09 01 03   ..........gcc...
+|   3600: 00 01 03 00 01 03 00 01 06 65 6f 70 6f 6c 79 09   .........eopoly.
+|   3616: 10 03 00 01 03 00 01 03 00 00 05 6a 73 6f 6e 31   ...........json1
+|   3632: 09 13 03 00 01 03 00 01 03 00 00 04 6c 6f 61 64   ............load
+|   3648: 09 1f 03 00 01 03 00 01 03 00 00 03 6d 61 78 09   ............max.
+|   3664: 1c 02 00 01 02 00 01 02 00 01 05 65 6d 6f 72 79   ...........emory
+|   3680: 09 1c 03 00 01 03 00 01 03 00 03 04 73 79 73 35   ............sys5
+|   3696: 09 16 03 00 01 03 00 01 03 00 00 06 6e 6f 63 61   ............noca
+|   3712: 73 65 3c 02 01 02 02 00 03 01 02 02 00 03 01 02   se<.............
+|   3728: 02 00 03 01 02 02 00 03 01 02 02 00 03 01 02 02   ................
+|   3744: 00 03 01 02 02 00 03 01 02 02 00 03 01 02 02 00   ................
+|   3760: 03 01 02 02 00 13 01 02 02 00 03 01 02 02 00 00   ................
+|   3776: 04 6f 6d 69 74 09 1f 02 00 01 12 00 01 02 00 00   .omit...........
+|   3792: 05 72 74 72 65 65 09 19 03 00 01 81 00 01 03 00   .rtree..........
+|   3808: 03 02 69 6d 3c 01 01 02 02 00 03 01 02 02 00 03   ..im<...........
+|   3824: 01 02 02 00 03 01 02 02 00 03 01 02 02 00 03 01   ................
+|   3840: 02 02 00 03 01 02 02 00 03 01 02 02 00 03 01 02   ................
+|   3856: 02 00 03 01 02 02 00 03 01 02 02 00 03 01 02 02   ................
+|   3872: 00 00 0a 74 68 72 65 61 64 73 61 66 65 09 22 02   ...threadsafe...
+|   3888: 00 01 02 00 01 02 00 00 04 76 74 61 62 09 07 04   .........vtab...
+|   3904: 00 01 04 00 01 04 00 00 01 78 b4 01 01 01 01 02   .........x......
+|   3920: 00 01 01 01 02 00 01 01 01 02 00 01 01 01 02 00   ................
+|   3936: 01 01 01 02 00 01 01 01 02 00 01 01 01 02 00 01   ................
+|   3952: 01 01 02 00 01 01 01 02 00 01 01 01 02 00 01 01   ................
+|   3968: 01 02 00 01 01 01 02 00 01 01 01 02 00 01 01 01   ................
+|   3984: 02 00 01 01 01 02 00 01 01 01 02 00 01 01 01 02   ................
+|   4000: 00 01 01 01 02 00 01 01 01 02 00 01 01 01 02 00   ................
+|   4016: 01 01 01 02 00 01 01 01 02 00 01 01 01 02 00 01   ................
+|   4032: 01 01 02 00 01 01 01 02 00 01 01 01 02 00 01 01   ................
+|   4048: 01 02 00 01 01 01 02 00 01 01 01 02 00 01 01 01   ................
+|   4064: 02 00 01 01 01 02 00 01 01 01 02 00 01 01 01 02   ................
+|   4080: 00 01 01 01 02 00 01 01 01 02 00 01 01 01 02 00   ................
+| page 6 offset 20480
+|      0: 0a 00 00 00 02 0f f5 00 0f fb 0f f5 00 00 00 00   ................
+|   4080: 00 00 00 00 00 05 04 08 09 01 02 04 04 08 08 09   ................
+| page 7 offset 24576
+|      0: 0d 00 00 00 05 0f b8 00 0f f4 0f e9 0f d6 0f c7   ................
+|     16: 0f b8 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
+|   4016: 00 00 00 00 00 00 00 00 0d 05 02 23 61 75 74 6f   ...........#auto
+|   4032: 6d 65 72 67 65 3d 35 0d 04 02 23 6d 65 72 67 65   merge=5...#merge
+|   4048: 3d 31 30 30 2c 38 11 03 02 2b 69 6e 74 65 67 72   =100,8...+integr
+|   4064: 69 74 79 2d 63 68 65 63 6b 09 02 02 1b 72 65 62   ity-check....reb
+|   4080: 75 69 6c 64 0a 01 02 1d 6f 70 74 69 6d 69 7a 65   uild....optimize
+| end crash-526ea445f41c02.db
+}]} {}
+
+do_catchsql_test 19.1 {
+  SELECT rowid,a,c,snippet(t1,85101090932165,-1,10) FROM t1 WHERE a MATCH 'rtree';
+} {1 {database disk image is malformed}}
 
+finish_test
 

Index: test/fts3cov.test
==================================================================
--- test/fts3cov.test
+++ test/fts3cov.test
@@ -87,10 +87,11 @@
     SELECT substr(hex(root), 1, 2) FROM t1_segdir;
   }
 } {03}
 
 # Test the "missing entry" case:
+sqlite3_db_config db DEFENSIVE 0
 do_test fts3cov-2.2 {
   set root [db one {SELECT root FROM t1_segdir}]
   read_fts3varint [string range $root 1 end] left_child
   execsql { DELETE FROM t1_segments WHERE blockid = $left_child }
 } {}
@@ -403,10 +404,11 @@
   SELECT rowid FROM t15 WHERE t15 MATCH '"abc* def2"'
 } {1 2}
 
 # Test a corruption case.
 #
+sqlite3_db_config db DEFENSIVE 0
 do_execsql_test 16.1 {
   CREATE VIRTUAL TABLE t16 USING fts4;
   INSERT INTO t16 VALUES('theoretical work to examine the relationship');
   INSERT INTO t16 VALUES('solution of our problems on the invisible');
   DELETE FROM t16_content WHERE rowid = 2;

Index: test/fts3d.test
==================================================================
--- test/fts3d.test
+++ test/fts3d.test
@@ -294,10 +294,11 @@
     SELECT level, idx FROM t1_segdir ORDER BY level, idx;
   }
 } {{Index already optimal} 1 0}
 
 # Even if we move things around, still does nothing.
+sqlite3_db_config db DEFENSIVE 0
 do_test fts3d-5.1 {
   execsql {
     UPDATE t1_segdir SET level = 2 WHERE level = 1 AND idx = 0;
     SELECT OPTIMIZE(t1) FROM t1 LIMIT 1;
     SELECT level, idx FROM t1_segdir ORDER BY level, idx;

Index: test/fts3defer.test
==================================================================
--- test/fts3defer.test
+++ test/fts3defer.test
@@ -57,10 +57,11 @@
   5  {SELECT rowid FROM t1 WHERE t1 MATCH 'a dog'}                   {1}
 }
 
 do_select_tests 1.2 $tests
 
+sqlite3_db_config db DEFENSIVE 0
 do_execsql_test 1.3 {
   SELECT count(*) FROM t1_segments WHERE length(block)>10000;
   UPDATE t1_segments 
     SET block = zeroblob(length(block)) 
     WHERE length(block)>10000;
@@ -223,25 +224,28 @@
   3 {
     set dmt_modes {0 1 2}
     execsql { CREATE VIRTUAL TABLE t1 USING FTS4 }
     foreach doc $data { execsql { INSERT INTO t1 VALUES($doc) } }
     add_empty_records 1000
+    sqlite3_db_config db DEFENSIVE 0
     execsql $zero_long_doclists
   }
   4 {
     set dmt_modes 0
     execsql { CREATE VIRTUAL TABLE t1 USING FTS4 }
     foreach doc $data { execsql { INSERT INTO t1 VALUES($doc) } }
     add_empty_records 1000
     execsql "INSERT INTO t1(t1) VALUES('optimize')"
+    sqlite3_db_config db DEFENSIVE 0
     execsql $zero_long_doclists
   }
   5 {
     set dmt_modes 0
     execsql { CREATE VIRTUAL TABLE t1 USING FTS4(matchinfo=fts3) }
     foreach doc $data { execsql { INSERT INTO t1 VALUES($doc) } }
     add_empty_records 1000
+    sqlite3_db_config db DEFENSIVE 0
     execsql $zero_long_doclists
   }
 } {
 
   execsql { DROP TABLE IF EXISTS t1 }

Index: test/fts3defer2.test
==================================================================
--- test/fts3defer2.test
+++ test/fts3defer2.test
@@ -44,10 +44,11 @@
   INSERT INTO t1 VALUES('');
   INSERT INTO t1 VALUES('');
   INSERT INTO t1 VALUES('');
   INSERT INTO t1(t1) VALUES('optimize');
 }
+sqlite3_db_config db DEFENSIVE 0
 do_execsql_test 1.1.4 {
   SELECT count(*) FROM t1_segments WHERE length(block)>10000;
   UPDATE t1_segments SET block = zeroblob(length(block)) WHERE length(block)>10000;
 } {2}
 
@@ -96,10 +97,11 @@
   2 { INSERT INTO t2(t2) VALUES('optimize') }
   3 { UPDATE t2_segments SET block = zeroblob(length(block)) 
       WHERE length(block)>10000;
   }
 } {
+  sqlite3_db_config db DEFENSIVE 0
   execsql $sql
 
   do_execsql_test 2.2.$tn.1 {
     SELECT mit(matchinfo(t2, 'pcxnal')) FROM t2 WHERE t2 MATCH 'a b';
   } [list                                          \
@@ -150,13 +152,14 @@
   2 { INSERT INTO t3(t3) VALUES('optimize') }
   3 { UPDATE t3_segments SET block = zeroblob(length(block)) 
       WHERE length(block)>10000;
   }
 } {
+  sqlite3_db_config db DEFENSIVE 0
   execsql $sql
   do_execsql_test 2.4.$tn {
     SELECT docid, mit(matchinfo(t3, 'pcxnal')) FROM t3 WHERE t3 MATCH '"a b c"';
   } {1 {1 1 1 4 4 11 912 6} 3 {1 1 1 4 4 11 912 6}}
 }
 
 
 finish_test

Index: test/fts3expr5.test
==================================================================
--- test/fts3expr5.test
+++ test/fts3expr5.test
@@ -19,10 +19,14 @@
 # If SQLITE_ENABLE_FTS3 is defined, omit this file.
 ifcapable !fts3 {
   finish_test
   return
 }
+
+proc test_fts3expr {expr} {
+  db one {SELECT fts3_exprtest('simple', $expr, 'a', 'b', 'c')}
+}
 
 #-------------------------------------------------------------------------
 # Various forms of empty phrase expressions.
 #
 do_execsql_test 1.0 {
@@ -43,6 +47,21 @@
 } {}
 do_execsql_test 1.5 {
   SELECT rowid FROM t0 WHERE x MATCH '""""';
 } {}
 
+#-------------------------------------------------------------------------
+# Various forms of empty phrase expressions.
+#
+set sqlite_fts3_enable_parentheses 1
+do_test 2.0 {
+  test_fts3expr {(a:123)(b:234)()(c:456)}
+} {AND {AND {PHRASE 0 0 123} {PHRASE 1 0 234}} {PHRASE 2 0 456}}
+do_test 2.1 {
+  test_fts3expr {(a:123)(b:234)(c:456)}
+} {AND {AND {PHRASE 0 0 123} {PHRASE 1 0 234}} {PHRASE 2 0 456}}
+do_test 2.2 {
+  list [catch { test_fts3expr {"123" AND ( )} } msg] $msg
+} {1 {Error parsing expression}}
+
 finish_test
+

Index: test/fts3fault.test
==================================================================
--- test/fts3fault.test
+++ test/fts3fault.test
@@ -237,7 +237,23 @@
 } -body {
   execsql { CREATE VIRTUAL TABLE t1 USING fts4(a, b, languageid=d) }
 } -test {
   faultsim_test_result {0 {}}
 }
+
+#-------------------------------------------------------------------------
+reset_db
+do_execsql_test 11.0 {
+  CREATE VIRTUAL TABLE t1 USING fts3(a, b);
+}
+faultsim_save_and_close
+
+do_faultsim_test 11 -faults oom* -prep {
+  faultsim_restore_and_reopen
+} -body {
+  execsql { DROP TABLE t1 }
+} -test {
+  faultsim_test_result {0 {}}
+}
+
 
 finish_test

ADDED   test/fts3fuzz001.test
Index: test/fts3fuzz001.test
==================================================================
--- /dev/null
+++ test/fts3fuzz001.test
@@ -0,0 +1,114 @@
+# 2012-12-21
+#
+# The author disclaims copyright to this source code.  In place of
+# a legal notice, here is a blessing:
+#
+#    May you do good and not evil.
+#    May you find forgiveness for yourself and forgive others.
+#    May you share freely, never taking more than you give.
+#
+#***********************************************************************
+#
+# Test cases for corrupt database files.
+
+set testdir [file dirname $argv0]
+source $testdir/tester.tcl
+
+ifcapable !deserialize||!fts3 {
+  finish_test
+  return
+}
+database_may_be_corrupt
+
+do_test fts3fuzz001-100 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 24576 pagesize 4096 filename c6.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 00 00 00 00 06   .....@  ........
+|     32: 00 00 00 00 00 00 00 00 00 00 00 05 00 00 00 04   ................
+|     48: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00   ................
+|     96: 00 00 00 00 0d 0e f9 00 06 0d ec 00 0f cd 0f 69   ...............i
+|    112: 0f 01 0e 10 0e c6 0d ec 00 00 00 00 00 00 00 00   ................
+|   3552: 00 00 00 00 00 00 00 00 00 00 00 00 22 06 06 17   ............"...
+|   3568: 11 11 01 31 74 61 62 6c 65 74 32 74 32 06 43 52   ...1tablet2t2.CR
+|   3584: 45 41 54 45 20 54 41 42 4c 45 20 74 32 28 78 29   EATE TABLE t2(x)
+|   3600: 81 33 04 07 17 1f 1f 01 82 35 74 61 62 6c 65 74   .3.......5tablet
+|   3616: 31 5f 73 65 67 64 69 72 74 31 5f 73 65 67 64 69   1_segdirt1_segdi
+|   3632: 72 04 43 52 45 41 54 45 20 54 41 42 4c 45 20 27   r.CREATE TABLE '
+|   3648: 74 31 5f 73 65 67 64 69 72 27 28 6c 65 76 65 6c   t1_segdir'(level
+|   3664: 20 49 4e 54 45 47 45 52 2c 69 64 78 20 49 4e 54    INTEGER,idx INT
+|   3680: 45 47 45 52 2c 73 74 61 72 74 5f 62 6c 6f 63 6b   EGER,start_block
+|   3696: 20 49 4e 54 45 47 45 52 2c 6c 65 61 76 65 73 5f    INTEGER,leaves_
+|   3712: 65 6e 64 5f 62 6c 6f 63 6b 20 49 4e 54 45 47 45   end_block INTEGE
+|   3728: 52 2c 65 6e 64 5f 62 6c 6f 63 6b 20 49 4e 54 45   R,end_block INTE
+|   3744: 47 45 52 2c 72 6f 6f 74 20 42 4c 4f 42 2c 50 52   GER,root BLOB,PR
+|   3760: 49 4d 41 52 59 20 4b 45 59 28 6c 65 76 65 6c 2c   IMARY KEY(level,
+|   3776: 20 69 64 78 29 29 31 05 06 17 45 1f 01 00 69 6e    idx))1...E...in
+|   3792: 64 65 78 73 71 6c 69 74 65 5f 61 75 74 6f 69 6e   dexsqlite_autoin
+|   3808: 64 65 78 5f 74 15 f7 36 56 76 46 97 25 f3 17 43   dex_t..6VvF.%..C
+|   3824: 15 5f 73 65 67 64 69 72 05 00 00 00 08 00 00 00   ._segdir........
+|   3840: 00 66 03 07 17 23 23 01 81 13 74 61 62 6c 65 74   .f...##...tablet
+|   3856: 31 5f 73 65 67 6d 65 6e 74 73 74 31 5f 73 65 67   1_segmentst1_seg
+|   3872: 6d 65 6e 74 73 03 43 52 45 41 54 45 20 54 41 42   ments.CREATE TAB
+|   3888: 4c 45 20 27 74 31 5f 73 65 67 6d 65 6e 74 73 27   LE 't1_segments'
+|   3904: 28 62 6c 6f 63 6b 69 64 20 49 4e 54 45 47 45 52   (blockid INTEGER
+|   3920: 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20 62 6c    PRIMARY KEY, bl
+|   3936: 6f 63 6b 20 42 4c 4f 42 29 62 02 07 17 21 21 01   ock BLOB)b...!!.
+|   3952: 81 0f 74 61 62 6c 65 74 31 5f 63 6f 6e 74 65 6e   ..tablet1_conten
+|   3968: 74 74 31 5f 63 6f 6e 74 65 6e 74 02 43 52 45 41   tt1_content.CREA
+|   3984: 54 45 20 54 41 42 4c 45 20 27 74 31 5f 63 6f 6e   TE TABLE 't1_con
+|   4000: 74 65 6e 74 27 28 64 6f 63 69 64 20 49 4e 54 45   tent'(docid INTE
+|   4016: 47 45 52 20 50 52 49 4d 41 52 59 20 4b 45 59 2c   GER PRIMARY KEY,
+|   4032: 20 27 63 30 63 6f 6e 74 65 6e 74 27 29 31 01 06    'c0content')1..
+|   4048: 17 11 11 08 51 74 61 62 6c 65 74 31 74 31 43 52   ....Qtablet1t1CR
+|   4064: 45 41 54 45 20 56 49 52 54 55 41 4c 20 54 41 42   EATE VIRTUAL TAB
+|   4080: 4c 45 20 74 31 20 55 53 49 4e 47 20 66 74 73 33   LE t1 USING fts3
+| page 2 offset 4096
+|      0: 0d 00 00 00 03 0f e0 00 0f f6 0f ec 0f e0 00 00   ................
+|   4064: 0a 03 03 00 1b 61 62 61 6e 64 6f 6e 08 02 03 00   .....abandon....
+|   4080: 17 61 62 61 66 74 08 01 03 00 17 61 62 61 63 6b   .abaft.....aback
+| page 3 offset 8192
+|      0: 0d 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00   ................
+| page 4 offset 12288
+|      0: 0d 00 00 00 01 0f d6 00 0f 00 00 00 00 00 00 00   ................
+|   4048: 00 00 00 00 00 00 28 01 07 08 08 08 08 15 46 30   ......(.......F0
+|   4064: 20 32 39 00 05 61 62 61 63 6b 03 01 02 00 03 02    29..aback......
+|   4080: 66 74 03 02 02 00 03 04 6e 64 6f 6e 03 03 02 00   ft......ndon....
+| page 5 offset 16384
+|      0: 0a 00 00 00 01 0f fb 00 0f fb 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 00 00 00 00 00 00 00 04 04 08 08 09   ................
+| page 6 offset 20480
+|      0: 0d 00 00 00 05 0f b8 00 0f f4 0f e9 0f d6 0f c7   ................
+|     16: 0f b8 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
+|   4016: 00 00 00 00 00 00 00 00 0d 05 02 23 61 75 74 6f   ...........#auto
+|   4032: 6d 65 72 67 65 3d 35 0d 04 02 23 6d 65 72 67 65   merge=5...#merge
+|   4048: 3d 31 30 30 2c 38 11 03 02 2b 69 6e 74 65 67 72   =100,8...+integr
+|   4064: 69 74 79 3d 63 68 65 63 6b 09 02 02 1b 72 65 62   ity=check....reb
+|   4080: 75 69 6c 64 0a 01 02 1d 6f 70 74 69 6d 69 7a 65   uild....optimize
+| end c6.db
+  }]
+  catchsql {
+    PRAGMA writable_schema=on; -- disable schema corruption detection
+    INSERT INTO t1(t1) SELECT x FROM t2;
+  }
+} {1 {database disk image is malformed}}
+do_test fts3fuzz001-110 {
+  catchsql {
+    INSERT INTO t1(t1) VALUES('integrity-check');
+  }
+} {1 {database disk image is malformed}}
+do_test fts3fuzz001-120 {
+  catchsql {
+    INSERT INTO t1(t1) VALUES('optimize');
+  }
+} {1 {database disk image is malformed}}
+do_test fts3fuzz001-121 {
+  catchsql {
+    INSERT INTO t1(t1) VALUES('integrity-check');
+  }
+} {1 {database disk image is malformed}}
+
+
+finish_test

Index: test/fts3matchinfo.test
==================================================================
--- test/fts3matchinfo.test
+++ test/fts3matchinfo.test
@@ -276,10 +276,11 @@
 do_matchinfo_test 4.3.6 t5 {t5 MATCH 'a OR b'}      { s {1 2 1 1} }
 
 do_execsql_test 4.4.0.1 { INSERT INTO t5(t5) VALUES('optimize') }
 
 ifcapable fts4_deferred {
+  sqlite3_db_config db DEFENSIVE 0
   do_execsql_test 4.4.0.2 {
     UPDATE t5_segments 
     SET block = zeroblob(length(block)) 
     WHERE length(block)>10000;
   }
@@ -337,10 +338,11 @@
     'this record is used to try to dectect corruption'
   );
   SELECT offsets(t9) FROM t9 WHERE t9 MATCH 'to';
 } {{0 0 20 2 0 0 27 2}}
 
+sqlite3_db_config db DEFENSIVE 0
 do_catchsql_test 6.2 {
   UPDATE t9_content SET c0content = 'this record is used to'; 
   SELECT offsets(t9) FROM t9 WHERE t9 MATCH 'to';
 } {1 {database disk image is malformed}}
 
@@ -390,10 +392,11 @@
 do_execsql_test 8.3 {
   SELECT mit(matchinfo(t11, 'nxa')) FROM t11 WHERE t11 MATCH 'a*'
 } {{204 1 3 3 0} {204 1 3 3 0} {204 1 3 3 0}}
 
 # Corruption related tests.
+sqlite3_db_config db DEFENSIVE 0
 do_execsql_test  8.4.1.1 { UPDATE t11_stat SET value = X'0000'; }
 do_catchsql_test 8.5.1.2 {
   SELECT mit(matchinfo(t11, 'nxa')) FROM t11 WHERE t11 MATCH 'a*'
 } {1 {database disk image is malformed}}
 

Index: test/fts3misc.test
==================================================================
--- test/fts3misc.test
+++ test/fts3misc.test
@@ -158,10 +158,11 @@
     SELECT count(*) FROM t4 WHERE t4 MATCH '"a b c" OR "c a b"'
   } {8000}
   do_execsql_test 4.2 {
     SELECT quote(value) from t4_stat where id=0
   } {X'C03EC0B204C0A608'}
+  sqlite3_db_config db DEFENSIVE 0
   do_execsql_test 4.3 {
     UPDATE t4_stat SET value = X'C03EC0B204C0A60800' WHERE id=0;
   }
   do_catchsql_test 4.4 {
     SELECT count(*) FROM t4 WHERE t4 MATCH '"a b c" OR "c a b"'

Index: test/fts3query.test
==================================================================
--- test/fts3query.test
+++ test/fts3query.test
@@ -165,10 +165,11 @@
   1 "SELECT matchinfo(content) FROM t2 WHERE t2 MATCH 'history'" matchinfo
   2 "SELECT offsets(content) FROM t2 WHERE t2 MATCH 'history'"   offsets
   3 "SELECT snippet(content) FROM t2 WHERE t2 MATCH 'history'"   snippet
   4 "SELECT optimize(content) FROM t2 WHERE t2 MATCH 'history'"  optimize
 }
+sqlite3_db_config db DEFENSIVE 0
 do_execsql_test 5.4.0 { UPDATE t2_content SET c0content = X'1234' }
 do_select_tests 5.4 -errorformat {
   illegal first argument to %s
 } {
   1 "SELECT matchinfo(content) FROM t2 WHERE t2 MATCH 'history'" matchinfo

Index: test/fts3snippet.test
==================================================================
--- test/fts3snippet.test
+++ test/fts3snippet.test
@@ -182,10 +182,11 @@
   set off [string first "onehundred " $numbers]
   do_offsets_test $T.2.2 {onehundred} \
     [list 0 0 $off 10 1 0 $off 10] [list 0 0 $off 10]
 
   # Test a corruption case:
+  sqlite3_db_config db DEFENSIVE 0
   execsql { UPDATE ft_content SET c1b = 'hello world' WHERE c1b = $numbers }
   do_error_test $T.2.3 {
     SELECT offsets(ft) FROM ft WHERE ft MATCH 'onehundred'
   } {database disk image is malformed}
   
@@ -552,10 +553,15 @@
   llength [db one {
     SELECT snippet(t4, '', '', '', 0, 64) FROM t4 WHERE t4 MATCH 'E'
   }]
 } {64}
 
+do_test 4.3 {
+  llength [db one {
+    SELECT snippet(t4, '', '', '', 0, 150) FROM t4 WHERE t4 MATCH 'E'
+  }]
+} {64}
 
 
 
 set sqlite_fts3_enable_parentheses 0
 finish_test

Index: test/fts4check.test
==================================================================
--- test/fts4check.test
+++ test/fts4check.test
@@ -64,10 +64,11 @@
     DELETE FROM t1_segdir WHERE level=0 AND idx=(
       SELECT max(idx) FROM t1_segdir WHERE level=0
     );
   }
 } {
+  sqlite3_db_config db DEFENSIVE 0
   do_execsql_test  1.2.1.$tn "BEGIN; $disruption"
   do_catchsql_test 1.2.2.$tn {
     INSERT INTO t1 (t1) VALUES('integrity-check')
   } {1 {database disk image is malformed}}
   do_execsql_test  1.2.3.$tn "ROLLBACK"
@@ -98,10 +99,11 @@
     DELETE FROM t2_segdir WHERE level=0 AND idx=(
       SELECT max(idx) FROM t2_segdir WHERE level=1024
     );
   }
 } {
+  sqlite3_db_config db DEFENSIVE 0
   do_execsql_test  2.2.1.$tn "BEGIN; $disruption"
   do_catchsql_test 2.2.2.$tn {
     INSERT INTO t2 (t2) VALUES('integrity-check')
   } {1 {database disk image is malformed}}
   do_execsql_test  2.2.3.$tn "ROLLBACK"
@@ -143,10 +145,11 @@
     UPDATE t3_content SET langid=langid+1 WHERE rowid = (
       SELECT max(rowid) FROM t3_content
     )
   }
 } {
+  sqlite3_db_config db DEFENSIVE 0
   do_execsql_test  3.2.1.$tn "BEGIN; $disruption"
   do_catchsql_test 3.2.2.$tn {
     INSERT INTO t3 (t3) VALUES('integrity-check')
   } {1 {database disk image is malformed}}
   do_execsql_test  3.2.3.$tn "ROLLBACK"
@@ -161,10 +164,11 @@
   CREATE VIRTUAL TABLE t4 USING fts4(a, b, c, notindexed=b);
   INSERT INTO t4 VALUES('text one', 'text two', 'text three');
   INSERT INTO t4(t4) VALUES('integrity-check');
 }
 
+sqlite3_db_config db DEFENSIVE 0
 do_execsql_test 4.1 {
   PRAGMA writable_schema = 1;
   UPDATE sqlite_master 
     SET sql = 'CREATE VIRTUAL TABLE t4 USING fts4(a, b, c)' 
     WHERE name = 't4';
@@ -195,10 +199,11 @@
 
 do_execsql_test 5.1 {
   INSERT INTO t5(t5) VALUES('integrity-check');
 } {}
 
+sqlite3_db_config db DEFENSIVE 0
 do_catchsql_test 5.2 {
   INSERT INTO t5_content VALUES(5, 'his hardy mountain pony');
   INSERT INTO t5(t5) VALUES('integrity-check');
 } {1 {database disk image is malformed}}
 

Index: test/fts4growth.test
==================================================================
--- test/fts4growth.test
+++ test/fts4growth.test
@@ -23,10 +23,11 @@
   return
 }
 
 source $testdir/genesis.tcl
 
+sqlite3_db_config db DEFENSIVE 0
 do_execsql_test 1.1 { CREATE VIRTUAL TABLE x1 USING fts3; }
 
 do_test 1.2 {
   foreach L {
     {"See here, young man," said Mulga Bill, "from Walgett to the sea,}

Index: test/fts4merge.test
==================================================================
--- test/fts4merge.test
+++ test/fts4merge.test
@@ -154,10 +154,11 @@
   
   do_execsql_test 4.4.1 {
     SELECT quote(value) FROM t4_stat WHERE rowid=1
   } {X'0006'}
   
+  sqlite3_db_config db DEFENSIVE 0
   do_execsql_test 4.4.2 {
     DELETE FROM t4_stat WHERE rowid=1;
     INSERT INTO t4(t4) VALUES('merge=1,12');
     SELECT level, group_concat(idx, ' ') FROM t4_segdir GROUP BY level;
   } "0 {0 1 2 3 4 5}                     1 0"

Index: test/fts4opt.test
==================================================================
--- test/fts4opt.test
+++ test/fts4opt.test
@@ -35,10 +35,11 @@
 # %_segdir table so that all segments within each index are on the same
 # level. This means that the 'merge' command can then be used for an
 # incremental optimize routine.
 #
 proc prepare_for_optimize {db tbl} {
+  sqlite3_db_config $db DEFENSIVE 0
   $db eval [string map [list % $tbl] {
     BEGIN;
       CREATE TEMP TABLE tmp_segdir(
         level, idx, start_block, leaves_end_block, end_block, root
       );

ADDED   test/fts4umlaut.test
Index: test/fts4umlaut.test
==================================================================
--- /dev/null
+++ test/fts4umlaut.test
@@ -0,0 +1,64 @@
+# 2018 December 3
+#
+# The author disclaims copyright to this source code.  In place of
+# a legal notice, here is a blessing:
+#
+#    May you do good and not evil.
+#    May you find forgiveness for yourself and forgive others.
+#    May you share freely, never taking more than you give.
+#
+#*************************************************************************
+# This file implements regression tests for SQLite library.  The
+# focus of this script is testing the FTS5 module.
+#
+
+set testdir [file dirname $argv0]
+source $testdir/tester.tcl
+set testprefix fts4umlaut
+
+ifcapable !fts3 {
+  finish_test
+  return
+}
+
+do_execsql_test 1.0 {
+  CREATE VIRTUAL TABLE t1 USING fts4(x, tokenize=unicode61);
+  CREATE VIRTUAL TABLE t2 USING fts4(
+      x, 
+      tokenize=unicode61 "remove_diacritics=2"
+  );
+}
+
+foreach {tn q res1 res2} {
+  1 "Hà Nội"                  0 1
+  2 "Hà Noi"                  1 1
+  3 "Ha Noi"                  1 1
+  4 "Ha N\u1ed9i"             0 1
+  5 "Ha N\u006fi"             1 1
+  6 "Ha N\u006f\u0302i"       1 1
+  7 "Ha N\u006f\u0323\u0302i" 1 1
+} {
+  do_execsql_test 1.$tn.1 {
+    DELETE FROM t1;
+    INSERT INTO t1(rowid, x) VALUES (1, 'Ha Noi');
+    SELECT count(*) FROM t1 WHERE t1 MATCH $q
+  } $res1
+  do_execsql_test 1.$tn.2 {
+    DELETE FROM t1;
+    INSERT INTO t1(rowid, x) VALUES (1, $q);
+    SELECT count(*) FROM t1 WHERE t1 MATCH 'Ha Noi'
+  } $res1
+
+  do_execsql_test 1.$tn.3 {
+    DELETE FROM t2;
+    INSERT INTO t2(rowid, x) VALUES (1, 'Ha Noi');
+    SELECT count(*) FROM t2 WHERE t2 MATCH $q
+  } $res2
+  do_execsql_test 1.$tn.4 {
+    DELETE FROM t2;
+    INSERT INTO t2(rowid, x) VALUES (1, $q);
+    SELECT count(*) FROM t2 WHERE t2 MATCH 'Ha Noi'
+  } $res2
+}
+
+finish_test

ADDED   test/fuzz4.test
Index: test/fuzz4.test
==================================================================
--- /dev/null
+++ test/fuzz4.test
@@ -0,0 +1,82 @@
+# 2018-12-12
+#
+# The author disclaims copyright to this source code.  In place of
+# a legal notice, here is a blessing:
+#
+#    May you do good and not evil.
+#    May you find forgiveness for yourself and forgive others.
+#    May you share freely, never taking more than you give.
+#
+#***********************************************************************
+# 
+# Test cases found by Matthew Denton's fuzzer at Chrome.
+#
+
+
+set testdir [file dirname $argv0]
+source $testdir/tester.tcl
+
+do_execsql_test fuzz4-100 {
+  CREATE TABLE Table0 (Col0  NOT NULL DEFAULT (CURRENT_TIME IS 1 > 1));
+  INSERT OR REPLACE INTO Table0 DEFAULT VALUES ;
+  SELECT * FROM Table0;
+} {0}
+
+do_execsql_test fuzz4-110 {
+  CREATE TABLE Table1(
+    Col0 TEXT DEFAULT (CASE WHEN 1 IS 3530822107858468864 
+                            THEN 1 ELSE quote(1) IS 3530822107858468864 END)
+  );
+  INSERT INTO Table1 DEFAULT VALUES;
+  SELECT * FROM Table1;
+} {0}
+
+do_execsql_test fuzz4-200 {
+  CREATE TABLE Table2a(
+     Col0  NOT NULL   DEFAULT (CURRENT_TIME IS 1  IS NOT 1  > 1)
+  );
+  INSERT OR REPLACE INTO Table2a DEFAULT VALUES;
+  SELECT * FROM Table2a;
+} {0}
+
+do_execsql_test fuzz4-210 {
+  CREATE TABLE Table2b (Col0  NOT NULL  DEFAULT (CURRENT_TIME  IS NOT FALSE)) ;
+  INSERT OR REPLACE INTO Table2b DEFAULT VALUES ;
+  SELECT * FROM Table2b;
+} {1}
+
+do_execsql_test fuzz4-300 {
+  CREATE TABLE Table3 (Col0 DEFAULT (CURRENT_TIMESTAMP BETWEEN 1 AND 1));
+  INSERT INTO Table3 DEFAULT VALUES;
+  SELECT * FROM Table3;
+} {0}
+
+do_execsql_test fuzz4-400 {
+  CREATE TABLE Table4 (Col0 DEFAULT (1 BETWEEN CURRENT_TIMESTAMP AND 1));
+  INSERT INTO Table4 DEFAULT VALUES;
+  SELECT * FROM Table4;
+} {0}
+
+do_execsql_test fuzz4-500 {
+  CREATE TABLE Table5 (Col0 DEFAULT (1 BETWEEN 1 AND CURRENT_TIMESTAMP));
+  INSERT INTO Table5 DEFAULT VALUES;
+  SELECT * FROM Table5;
+} {1}
+
+do_execsql_test fuzz4-600 {
+  CREATE TEMPORARY TABLE Table6(
+    Col0 DEFAULT (CASE x'5d' WHEN 1 THEN
+        CASE CURRENT_TIMESTAMP WHEN 1 THEN 1 ELSE 1 END
+        ELSE CASE WHEN 1 THEN FALSE END  END )
+  );
+  INSERT INTO temp.Table6 DEFAULT VALUES ;
+  SELECT * FROM Table6;
+} {0}
+do_execsql_test fuzz4-610 {
+  WITH TableX AS (SELECT DISTINCT * ORDER BY 1  , 1 COLLATE RTRIM)
+      DELETE FROM Table6  WHERE Col0 || +8388608  ;
+  SELECT * FROM Table6;
+} {}
+
+
+finish_test

Index: test/fuzzcheck.c
==================================================================
--- test/fuzzcheck.c
+++ test/fuzzcheck.c
@@ -67,10 +67,11 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <stdarg.h>
 #include <ctype.h>
+#include <assert.h>
 #include "sqlite3.h"
 #define ISSPACE(X) isspace((unsigned char)(X))
 #define ISDIGIT(X) isdigit((unsigned char)(X))
 
 
@@ -398,25 +399,490 @@
     free(p);
     p = pNext;
   }
 }
 
-
 /* Return the current wall-clock time */
 static sqlite3_int64 timeOfDay(void){
   static sqlite3_vfs *clockVfs = 0;
   sqlite3_int64 t;
-  if( clockVfs==0 ) clockVfs = sqlite3_vfs_find(0);
+  if( clockVfs==0 ){
+    clockVfs = sqlite3_vfs_find(0);
+    if( clockVfs==0 ) return 0;
+  }
   if( clockVfs->iVersion>=1 && clockVfs->xCurrentTimeInt64!=0 ){
     clockVfs->xCurrentTimeInt64(clockVfs, &t);
   }else{
     double r;
     clockVfs->xCurrentTime(clockVfs, &r);
     t = (sqlite3_int64)(r*86400000.0);
   }
   return t;
 }
+
+/***************************************************************************
+** Code to process combined database+SQL scripts generated by the
+** dbsqlfuzz fuzzer.
+*/
+
+/* An instance of the following object is passed by pointer as the
+** client data to various callbacks.
+*/
+typedef struct FuzzCtx {
+  sqlite3 *db;               /* The database connection */
+  sqlite3_int64 iCutoffTime; /* Stop processing at this time. */
+  sqlite3_int64 iLastCb;     /* Time recorded for previous progress callback */
+  sqlite3_int64 mxInterval;  /* Longest interval between two progress calls */
+  unsigned nCb;              /* Number of progress callbacks */
+  unsigned mxCb;             /* Maximum number of progress callbacks allowed */
+  unsigned execCnt;          /* Number of calls to the sqlite3_exec callback */
+  int timeoutHit;            /* True when reaching a timeout */
+} FuzzCtx;
+
+/* Verbosity level for the dbsqlfuzz test runner */
+static int eVerbosity = 0;
+
+/* True to activate PRAGMA vdbe_debug=on */
+static int bVdbeDebug = 0;
+
+/* Timeout for each fuzzing attempt, in milliseconds */
+static int giTimeout = 10000;   /* Defaults to 10 seconds */
+
+/* Maximum number of progress handler callbacks */
+static unsigned int mxProgressCb = 2000;
+
+/* Maximum string length in SQLite */
+static int lengthLimit = 1000000;
+
+/* Maximum byte-code program length in SQLite */
+static int vdbeOpLimit = 25000;
+
+/* Maximum size of the in-memory database */
+static sqlite3_int64 maxDbSize = 104857600;
+
+/*
+** Translate a single byte of Hex into an integer.
+** This routine only works if h really is a valid hexadecimal
+** character:  0..9a..fA..F
+*/
+static unsigned char hexToInt(unsigned int h){
+#ifdef SQLITE_EBCDIC
+  h += 9*(1&~(h>>4));   /* EBCDIC */
+#else
+  h += 9*(1&(h>>6));    /* ASCII */
+#endif
+  return h & 0xf;
+}
+
+/*
+** The first character of buffer zIn[0..nIn-1] is a '['.  This routine
+** checked to see if the buffer holds "[NNNN]" or "[+NNNN]" and if it
+** does it makes corresponding changes to the *pK value and *pI value
+** and returns true.  If the input buffer does not match the patterns,
+** no changes are made to either *pK or *pI and this routine returns false.
+*/
+static int isOffset(
+  const unsigned char *zIn,  /* Text input */
+  int nIn,                   /* Bytes of input */
+  unsigned int *pK,          /* half-byte cursor to adjust */
+  unsigned int *pI           /* Input index to adjust */
+){
+  int i;
+  unsigned int k = 0;
+  unsigned char c;
+  for(i=1; i<nIn && (c = zIn[i])!=']'; i++){
+    if( !isxdigit(c) ) return 0;
+    k = k*16 + hexToInt(c);
+  }
+  if( i==nIn ) return 0;
+  *pK = 2*k;
+  *pI += i;
+  return 1;
+}
+
+/*
+** Decode the text starting at zIn into a binary database file.
+** The maximum length of zIn is nIn bytes.  Compute the binary database
+** file contain in space obtained from sqlite3_malloc().
+**
+** Return the number of bytes of zIn consumed.  Or return -1 if there
+** is an error.  One potential error is that the recipe specifies a
+** database file larger than MX_FILE_SZ bytes.
+**
+** Abort on an OOM.
+*/
+static int decodeDatabase(
+  const unsigned char *zIn,      /* Input text to be decoded */
+  int nIn,                       /* Bytes of input text */
+  unsigned char **paDecode,      /* OUT: decoded database file */
+  int *pnDecode                  /* OUT: Size of decoded database */
+){
+  unsigned char *a;              /* Database under construction */
+  int mx = 0;                    /* Current size of the database */
+  sqlite3_uint64 nAlloc = 4096;  /* Space allocated in a[] */
+  unsigned int i;                /* Next byte of zIn[] to read */
+  unsigned int j;                /* Temporary integer */
+  unsigned int k;                /* half-byte cursor index for output */
+  unsigned int n;                /* Number of bytes of input */
+  unsigned char b = 0;
+  if( nIn<4 ) return -1;
+  n = (unsigned int)nIn;
+  a = sqlite3_malloc64( nAlloc );
+  if( a==0 ){
+    fprintf(stderr, "Out of memory!\n");
+    exit(1);
+  }
+  memset(a, 0, nAlloc);
+  for(i=k=0; i<n; i++){
+    char c = zIn[i];
+    if( isxdigit(c) ){
+      k++;
+      if( k & 1 ){
+        b = hexToInt(c)*16;
+      }else{
+        b += hexToInt(c);
+        j = k/2 - 1;
+        if( j>=nAlloc ){
+          sqlite3_uint64 newSize;
+          if( nAlloc==MX_FILE_SZ || j>=MX_FILE_SZ ){
+            if( eVerbosity ){
+              fprintf(stderr, "Input database too big: max %d bytes\n",
+                      MX_FILE_SZ);
+            }
+            sqlite3_free(a);
+            return -1;
+          }
+          newSize = nAlloc*2;
+          if( newSize<=j ){
+            newSize = (j+4096)&~4095;
+          }
+          if( newSize>MX_FILE_SZ ){
+            if( j>=MX_FILE_SZ ){
+              sqlite3_free(a);
+              return -1;
+            }
+            newSize = MX_FILE_SZ;
+          }
+          a = sqlite3_realloc64( a, newSize );
+          if( a==0 ){
+            fprintf(stderr, "Out of memory!\n");
+            exit(1);
+          }
+          assert( newSize > nAlloc );
+          memset(a+nAlloc, 0, newSize - nAlloc);
+          nAlloc = newSize;
+        }
+        if( j>=(unsigned)mx ){
+          mx = (j + 4095)&~4095;
+          if( mx>MX_FILE_SZ ) mx = MX_FILE_SZ;
+        }
+        assert( j<nAlloc );
+        a[j] = b;
+      }
+    }else if( zIn[i]=='[' && i<n-3 && isOffset(zIn+i, nIn-i, &k, &i) ){
+      continue;
+   }else if( zIn[i]=='\n' && i<n-4 && memcmp(zIn+i,"\n--\n",4)==0 ){
+      i += 4;
+      break;
+    }
+  }
+  *pnDecode = mx;
+  *paDecode = a;
+  return i;
+}
+
+/*
+** Progress handler callback.
+**
+** The argument is the cutoff-time after which all processing should
+** stop.  So return non-zero if the cut-off time is exceeded.
+*/
+static int progress_handler(void *pClientData) {
+  FuzzCtx *p = (FuzzCtx*)pClientData;
+  sqlite3_int64 iNow = timeOfDay();
+  int rc = iNow>=p->iCutoffTime;
+  sqlite3_int64 iDiff = iNow - p->iLastCb;
+  if( iDiff > p->mxInterval ) p->mxInterval = iDiff;
+  p->nCb++;
+  if( rc==0 && p->mxCb>0 && p->mxCb<=p->nCb ) rc = 1;
+  if( rc && !p->timeoutHit && eVerbosity>=2 ){
+    printf("Timeout on progress callback %d\n", p->nCb);
+    fflush(stdout);
+    p->timeoutHit = 1;
+  }
+  return rc;
+}
+
+/*
+** Disallow debugging pragmas such as "PRAGMA vdbe_debug" and
+** "PRAGMA parser_trace" since they can dramatically increase the
+** amount of output without actually testing anything useful.
+**
+** Also block ATTACH and DETACH
+*/
+static int block_troublesome_sql(
+  void *Notused,
+  int eCode,
+  const char *zArg1,
+  const char *zArg2,
+  const char *zArg3,
+  const char *zArg4
+){
+  (void)Notused;
+  (void)zArg2;
+  (void)zArg3;
+  (void)zArg4;
+  if( eCode==SQLITE_PRAGMA ){
+    if( sqlite3_strnicmp("vdbe_", zArg1, 5)==0
+     || sqlite3_stricmp("parser_trace", zArg1)==0
+     || sqlite3_stricmp("temp_store_directory", zArg1)==0
+    ){
+      return SQLITE_DENY;
+    }
+  }else if( (eCode==SQLITE_ATTACH || eCode==SQLITE_DETACH)
+            && zArg1 && zArg1[0] ){
+    return SQLITE_DENY;
+  }
+  return SQLITE_OK;
+}
+
+/*
+** Run the SQL text
+*/
+static int runDbSql(sqlite3 *db, const char *zSql){
+  int rc;
+  sqlite3_stmt *pStmt;
+  while( isspace(zSql[0]) ) zSql++;
+  if( zSql[0]==0 ) return SQLITE_OK;
+  if( eVerbosity>=4 ){
+    printf("RUNNING-SQL: [%s]\n", zSql);
+    fflush(stdout);
+  }
+  rc = sqlite3_prepare_v2(db, zSql, -1, &pStmt, 0);
+  if( rc==SQLITE_OK ){
+    while( (rc = sqlite3_step(pStmt))==SQLITE_ROW ){
+      if( eVerbosity>=5 ){
+        int j;
+        for(j=0; j<sqlite3_column_count(pStmt); j++){
+          if( j ) printf(",");
+          switch( sqlite3_column_type(pStmt, j) ){
+            case SQLITE_NULL: {
+              printf("NULL");
+              break;
+            }
+            case SQLITE_INTEGER:
+            case SQLITE_FLOAT: {
+              printf("%s", sqlite3_column_text(pStmt, j));
+              break;
+            }
+            case SQLITE_BLOB: {
+              int n = sqlite3_column_bytes(pStmt, j);
+              int i;
+              const unsigned char *a;
+              a = (const unsigned char*)sqlite3_column_blob(pStmt, j);
+              printf("x'");
+              for(i=0; i<n; i++){
+                printf("%02x", a[i]);
+              }
+              printf("'");
+              break;
+            }
+            case SQLITE_TEXT: {
+              int n = sqlite3_column_bytes(pStmt, j);
+              int i;
+              const unsigned char *a;
+              a = (const unsigned char*)sqlite3_column_blob(pStmt, j);
+              printf("'");
+              for(i=0; i<n; i++){
+                if( a[i]=='\'' ){
+                  printf("''");
+                }else{
+                  putchar(a[i]);
+                }
+              }
+              printf("'");
+              break;
+            }
+          } /* End switch() */
+        } /* End for() */
+        printf("\n");
+        fflush(stdout);
+      } /* End if( eVerbosity>=5 ) */
+    } /* End while( SQLITE_ROW */
+    if( rc!=SQLITE_DONE && eVerbosity>=4 ){
+      printf("SQL-ERROR: (%d) %s\n", rc, sqlite3_errmsg(db));
+      fflush(stdout);
+    }
+  }else if( eVerbosity>=4 ){
+    printf("SQL-ERROR (%d): %s\n", rc, sqlite3_errmsg(db));
+    fflush(stdout);    
+  } /* End if( SQLITE_OK ) */
+  return sqlite3_finalize(pStmt);
+}
+
+/* Invoke this routine to run a single test case */
+int runCombinedDbSqlInput(const uint8_t *aData, size_t nByte){
+  int rc;                    /* SQLite API return value */
+  int iSql;                  /* Index in aData[] of start of SQL */
+  unsigned char *aDb = 0;    /* Decoded database content */
+  int nDb = 0;               /* Size of the decoded database */
+  int i;                     /* Loop counter */
+  int j;                     /* Start of current SQL statement */
+  char *zSql = 0;            /* SQL text to run */
+  int nSql;                  /* Bytes of SQL text */
+  FuzzCtx cx;                /* Fuzzing context */
+
+  if( nByte<10 ) return 0;
+  if( sqlite3_initialize() ) return 0;
+  if( sqlite3_memory_used()!=0 ){
+    int nAlloc = 0;
+    int nNotUsed = 0;
+    sqlite3_status(SQLITE_STATUS_MALLOC_COUNT, &nAlloc, &nNotUsed, 0);
+    fprintf(stderr,"Memory leak in mutator: %lld bytes in %d allocations\n",
+            sqlite3_memory_used(), nAlloc);
+    exit(1);
+  }
+  memset(&cx, 0, sizeof(cx));
+  iSql = decodeDatabase((unsigned char*)aData, (int)nByte, &aDb, &nDb);
+  if( iSql<0 ) return 0;
+  nSql = (int)(nByte - iSql);
+  if( eVerbosity>=3 ){
+    printf(
+      "****** %d-byte input, %d-byte database, %d-byte script "
+      "******\n", (int)nByte, nDb, nSql);
+    fflush(stdout);
+  }
+  rc = sqlite3_open(0, &cx.db);
+  if( rc ) return 1;
+  if( bVdbeDebug ){
+    sqlite3_exec(cx.db, "PRAGMA vdbe_debug=ON", 0, 0, 0);
+  }
+
+  /* Invoke the progress handler frequently to check to see if we
+  ** are taking too long.  The progress handler will return true
+  ** (which will block further processing) if more than giTimeout seconds have
+  ** elapsed since the start of the test.
+  */
+  cx.iLastCb = timeOfDay();
+  cx.iCutoffTime = cx.iLastCb + giTimeout;  /* Now + giTimeout seconds */
+  cx.mxCb = mxProgressCb;
+#ifndef SQLITE_OMIT_PROGRESS_CALLBACK
+  sqlite3_progress_handler(cx.db, 10, progress_handler, (void*)&cx);
+#endif
+
+  /* Set a limit on the maximum size of a prepared statement, and the
+  ** maximum length of a string or blob */
+  if( vdbeOpLimit>0 ){
+    sqlite3_limit(cx.db, SQLITE_LIMIT_VDBE_OP, vdbeOpLimit);
+  }
+  if( lengthLimit>0 ){
+    sqlite3_limit(cx.db, SQLITE_LIMIT_LENGTH, lengthLimit);
+  }
+
+  if( nDb>=20 && aDb[18]==2 && aDb[19]==2 ){
+    aDb[18] = aDb[19] = 1;
+  }
+  rc = sqlite3_deserialize(cx.db, "main", aDb, nDb, nDb,
+          SQLITE_DESERIALIZE_RESIZEABLE |
+          SQLITE_DESERIALIZE_FREEONCLOSE);
+  if( rc ){
+    fprintf(stderr, "sqlite3_deserialize() failed with %d\n", rc);
+    goto testrun_finished;
+  }
+  if( maxDbSize>0 ){
+    sqlite3_int64 x = maxDbSize;
+    sqlite3_file_control(cx.db, "main", SQLITE_FCNTL_SIZE_LIMIT, &x);
+  }
+
+  /* For high debugging levels, turn on debug mode */
+  if( eVerbosity>=5 ){
+    sqlite3_exec(cx.db, "PRAGMA vdbe_debug=ON;", 0, 0, 0);
+  }
+
+  /* Block debug pragmas and ATTACH/DETACH.  But wait until after
+  ** deserialize to do this because deserialize depends on ATTACH */
+  sqlite3_set_authorizer(cx.db, block_troublesome_sql, 0);
+
+  /* Consistent PRNG seed */
+  sqlite3_randomness(0,0);
+
+  zSql = sqlite3_malloc( nSql + 1 );
+  if( zSql==0 ){
+    fprintf(stderr, "Out of memory!\n");
+  }else{
+    memcpy(zSql, aData+iSql, nSql);
+    zSql[nSql] = 0;
+    for(i=j=0; zSql[i]; i++){
+      if( zSql[i]==';' ){
+        char cSaved = zSql[i+1];
+        zSql[i+1] = 0;
+        if( sqlite3_complete(zSql+j) ){
+          rc = runDbSql(cx.db, zSql+j);
+          j = i+1;
+        }
+        zSql[i+1] = cSaved;
+        if( rc==SQLITE_INTERRUPT || progress_handler(&cx) ){
+          goto testrun_finished;
+        }
+      }
+    }
+    if( j<i ){
+      runDbSql(cx.db, zSql+j);
+    }
+  }
+testrun_finished:
+  sqlite3_free(zSql);
+  rc = sqlite3_close(cx.db);
+  if( rc!=SQLITE_OK ){
+    fprintf(stdout, "sqlite3_close() returns %d\n", rc);
+  }
+  if( eVerbosity>=2 ){
+    fprintf(stdout, "Peak memory usages: %f MB\n",
+       sqlite3_memory_highwater(1) / 1000000.0);
+  }
+  if( sqlite3_memory_used()!=0 ){
+    int nAlloc = 0;
+    int nNotUsed = 0;
+    sqlite3_status(SQLITE_STATUS_MALLOC_COUNT, &nAlloc, &nNotUsed, 0);
+    fprintf(stderr,"Memory leak: %lld bytes in %d allocations\n",
+            sqlite3_memory_used(), nAlloc);
+    exit(1);
+  }
+  return 0;
+}
+
+/*
+** END of the dbsqlfuzz code
+***************************************************************************/
+
+/* Look at a SQL text and try to determine if it begins with a database
+** description, such as would be found in a dbsqlfuzz test case.  Return
+** true if this does appear to be a dbsqlfuzz test case and false otherwise.
+*/
+static int isDbSql(unsigned char *a, int n){
+  unsigned char buf[12];
+  int i;
+  if( n>4 && memcmp(a,"\n--\n",4)==0 ) return 1;
+  while( n>0 && isspace(a[0]) ){ a++; n--; }
+  for(i=0; n>0 && i<8; n--, a++){
+    if( isxdigit(a[0]) ) buf[i++] = a[0];
+  }
+  if( i==8 && memcmp(buf,"53514c69",8)==0 ) return 1;
+  return 0;
+}
+
+/* Implementation of the isdbsql(TEXT) SQL function.
+*/
+static void isDbSqlFunc(
+  sqlite3_context *context,
+  int argc,
+  sqlite3_value **argv
+){
+  int n = sqlite3_value_bytes(argv[0]);
+  unsigned char *a = (unsigned char*)sqlite3_value_blob(argv[0]);
+  sqlite3_result_int(context, a!=0 && n>0 && isDbSql(a,n));
+}
 
 /* Methods for the VHandle object
 */
 static int inmemClose(sqlite3_file *pFile){
   VHandle *p = (VHandle*)pFile;
@@ -442,11 +908,11 @@
     return SQLITE_IOERR_SHORT_READ;
   }
   if( iOfst+iAmt>pVFile->sz ){
     memset(pData, 0, iAmt);
     iAmt = (int)(pVFile->sz - iOfst);
-    memcpy(pData, pVFile->a, iAmt);
+    memcpy(pData, pVFile->a + iOfst, iAmt);
     return SQLITE_IOERR_SHORT_READ;
   }
   memcpy(pData, pVFile->a + iOfst, iAmt);
   return SQLITE_OK;
 }
@@ -712,27 +1178,32 @@
 **
 **    (1)  Remove duplicate entries
 **    (2)  Put all entries in order
 **    (3)  Vacuum
 */
-static void rebuild_database(sqlite3 *db){
+static void rebuild_database(sqlite3 *db, int dbSqlOnly){
   int rc;
-  rc = sqlite3_exec(db, 
+  char *zSql;
+  zSql = sqlite3_mprintf(
      "BEGIN;\n"
      "CREATE TEMP TABLE dbx AS SELECT DISTINCT dbcontent FROM db;\n"
      "DELETE FROM db;\n"
      "INSERT INTO db(dbid, dbcontent) "
         " SELECT NULL, dbcontent FROM dbx ORDER BY 2;\n"
      "DROP TABLE dbx;\n"
-     "CREATE TEMP TABLE sx AS SELECT DISTINCT sqltext FROM xsql;\n"
+     "CREATE TEMP TABLE sx AS SELECT DISTINCT sqltext FROM xsql %s;\n"
      "DELETE FROM xsql;\n"
      "INSERT INTO xsql(sqlid,sqltext) "
         " SELECT NULL, sqltext FROM sx ORDER BY 2;\n"
      "DROP TABLE sx;\n"
      "COMMIT;\n"
      "PRAGMA page_size=1024;\n"
-     "VACUUM;\n", 0, 0, 0);
+     "VACUUM;\n",
+     dbSqlOnly ? " WHERE isdbsql(sqltext)" : ""
+  );
+  rc = sqlite3_exec(db, zSql, 0, 0, 0);
+  sqlite3_free(zSql);
   if( rc ) fatalError("cannot rebuild: %s", sqlite3_errmsg(db));
 }
 
 /*
 ** Return the value of a hexadecimal digit.  Return -1 if the input
@@ -789,10 +1260,23 @@
     }
   }
   if( v>0x7fffffff ) fatalError("parameter too large - max 2147483648");
   return (int)(isNeg? -v : v);
 }
+
+/*
+** Return the number of "v" characters in a string.  Return 0 if there
+** are any characters in the string other than "v".
+*/
+static int numberOfVChar(const char *z){
+  int N = 0;
+  while( z[0] && z[0]=='v' ){
+    z++;
+    N++;
+  }
+  return z[0]==0 ? N : 0;
+}
 
 /*
 ** Print sketchy documentation for this utility program
 */
 static void showHelp(void){
@@ -809,10 +1293,11 @@
 "  --info               Show information about SOURCE-DB w/o running tests\n"
 "  --limit-mem N        Limit memory used by test SQLite instance to N bytes\n"
 "  --limit-vdbe         Panic if any test runs for more than 100,000 cycles\n"
 "  --load-sql ARGS...   Load SQL scripts fron files into SOURCE-DB\n"
 "  --load-db ARGS...    Load template databases from files into SOURCE_DB\n"
+"  --load-dbsql ARGS..  Load dbsqlfuzz outputs into the xsql table\n"
 "  -m TEXT              Add a description to the database\n"
 "  --native-vfs         Use the native VFS for initially empty database files\n"
 "  --native-malloc      Turn off MEMSYS3/5 and Lookaside\n"
 "  --oss-fuzz           Enable OSS-FUZZ testing\n"
 "  --prng-seed N        Seed value for the PRGN inside of SQLite\n"
@@ -835,10 +1320,11 @@
   sqlite3_stmt *pStmt;         /* A prepared statement */
   int rc;                      /* Result code from SQLite interface calls */
   Blob *pSql;                  /* For looping over SQL scripts */
   Blob *pDb;                   /* For looping over template databases */
   int i;                       /* Loop index for the argv[] loop */
+  int dbSqlOnly = 0;           /* Only use scripts that are dbsqlfuzz */
   int onlySqlid = -1;          /* --sqlid */
   int onlyDbid = -1;           /* --dbid */
   int nativeFlag = 0;          /* --native-vfs */
   int rebuildFlag = 0;         /* --rebuild */
   int vdbeLimitFlag = 0;       /* --limit-vdbe */
@@ -863,11 +1349,13 @@
   int ossFuzz = 0;             /* enable OSS-FUZZ testing */
   int ossFuzzThisDb = 0;       /* ossFuzz value for this particular database */
   int nativeMalloc = 0;        /* Turn off MEMSYS3/5 and lookaside if true */
   sqlite3_vfs *pDfltVfs;       /* The default VFS */
   int openFlags4Data;          /* Flags for sqlite3_open_v2() */
+  int nV;                      /* How much to increase verbosity with -vvvv */
 
+  sqlite3_initialize();
   iBegin = timeOfDay();
 #ifdef __unix__
   signal(SIGALRM, timeoutHandler);
 #endif
   g.zArgv0 = argv[0];
@@ -889,11 +1377,11 @@
       }else
       if( strcmp(z,"export-db")==0 ){
         if( i>=argc-1 ) fatalError("missing arguments on %s", argv[i]);
         zExpDb = argv[++i];
       }else
-      if( strcmp(z,"export-sql")==0 ){
+      if( strcmp(z,"export-sql")==0 || strcmp(z,"export-dbsql")==0 ){
         if( i>=argc-1 ) fatalError("missing arguments on %s", argv[i]);
         zExpSql = argv[++i];
       }else
       if( strcmp(z,"help")==0 ){
         showHelp();
@@ -923,10 +1411,17 @@
       if( strcmp(z,"load-db")==0 ){
         zInsSql = "INSERT INTO db(dbcontent) VALUES(readfile(?1))";
         iFirstInsArg = i+1;
         openFlags4Data = SQLITE_OPEN_READWRITE|SQLITE_OPEN_CREATE;
         break;
+      }else
+      if( strcmp(z,"load-dbsql")==0 ){
+        zInsSql = "INSERT INTO xsql(sqltext)VALUES(CAST(readfile(?1) AS text))";
+        iFirstInsArg = i+1;
+        openFlags4Data = SQLITE_OPEN_READWRITE|SQLITE_OPEN_CREATE;
+        dbSqlOnly = 1;
+        break;
       }else
       if( strcmp(z,"m")==0 ){
         if( i>=argc-1 ) fatalError("missing arguments on %s", argv[i]);
         zMsg = argv[++i];
         openFlags4Data = SQLITE_OPEN_READWRITE|SQLITE_OPEN_CREATE;
@@ -945,10 +1440,11 @@
         g.uRandom = atoi(argv[++i]);
       }else
       if( strcmp(z,"quiet")==0 || strcmp(z,"q")==0 ){
         quietFlag = 1;
         verboseFlag = 0;
+        eVerbosity = 0;
       }else
       if( strcmp(z,"rebuild")==0 ){
         rebuildFlag = 1;
         openFlags4Data = SQLITE_OPEN_READWRITE;
       }else
@@ -967,14 +1463,30 @@
         timeoutTest = 1;
 #ifndef __unix__
         fatalError("timeout is not available on non-unix systems");
 #endif
       }else
-      if( strcmp(z,"verbose")==0 || strcmp(z,"v")==0 ){
+      if( strcmp(z,"verbose")==0 ){
         quietFlag = 0;
         verboseFlag++;
+        eVerbosity++;
+        if( verboseFlag>1 ) runFlags |= SQL_TRACE;
+      }else
+      if( (nV = numberOfVChar(z))>=1 ){
+        quietFlag = 0;
+        verboseFlag += nV;
+        eVerbosity += nV;
         if( verboseFlag>1 ) runFlags |= SQL_TRACE;
+      }else
+      if( strcmp(z,"version")==0 ){
+        int ii;
+        const char *zz;
+        printf("SQLite %s %s\n", sqlite3_libversion(), sqlite3_sourceid());
+        for(ii=0; (zz = sqlite3_compileoption_get(ii))!=0; ii++){
+          printf("%s\n", zz);
+        }
+        return 0;
       }else
       {
         fatalError("unknown option: %s", argv[i]);
       }
     }else{
@@ -1088,10 +1600,12 @@
     }
 
     if( zInsSql ){
       sqlite3_create_function(db, "readfile", 1, SQLITE_UTF8, 0,
                               readfileFunc, 0, 0);
+      sqlite3_create_function(db, "isdbsql", 1, SQLITE_UTF8, 0,
+                              isDbSqlFunc, 0, 0);
       rc = sqlite3_prepare_v2(db, zInsSql, -1, &pStmt, 0);
       if( rc ) fatalError("cannot prepare statement [%s]: %s",
                           zInsSql, sqlite3_errmsg(db));
       rc = sqlite3_exec(db, "BEGIN", 0, 0, 0);
       if( rc ) fatalError("cannot start a transaction");
@@ -1103,11 +1617,11 @@
       }
       sqlite3_finalize(pStmt);
       rc = sqlite3_exec(db, "COMMIT", 0, 0, 0);
       if( rc ) fatalError("cannot commit the transaction: %s",
                           sqlite3_errmsg(db));
-      rebuild_database(db);
+      rebuild_database(db, dbSqlOnly);
       sqlite3_close(db);
       return 0;
     }
     rc = sqlite3_exec(db, "PRAGMA query_only=1;", 0, 0, 0);
     if( rc ) fatalError("cannot set database to query-only");
@@ -1190,11 +1704,11 @@
     if( rebuildFlag ){
       if( !quietFlag ){
         printf("%s: rebuilding... ", zDbName);
         fflush(stdout);
       }
-      rebuild_database(db);
+      rebuild_database(db, 0);
       if( !quietFlag ) printf("done\n");
     }
   
     /* Close the source database.  Verify that no SQLite memory allocations are
     ** outstanding.
@@ -1224,10 +1738,30 @@
     
     /* Run a test using each SQL script against each database.
     */
     if( !verboseFlag && !quietFlag ) printf("%s:", zDbName);
     for(pSql=g.pFirstSql; pSql; pSql=pSql->pNext){
+      if( isDbSql(pSql->a, pSql->sz) ){
+        sqlite3_snprintf(sizeof(g.zTestName), g.zTestName, "sqlid=%d",pSql->id);
+        if( verboseFlag ){
+          printf("%s\n", g.zTestName);
+          fflush(stdout);
+        }else if( !quietFlag ){
+          static int prevAmt = -1;
+          int idx = pSql->seq;
+          int amt = idx*10/(g.nSql);
+          if( amt!=prevAmt ){
+            printf(" %d%%", amt*10);
+            fflush(stdout);
+            prevAmt = amt;
+          }
+        }
+        runCombinedDbSqlInput(pSql->a, pSql->sz);
+        nTest++;
+        g.zTestName[0] = 0;
+        continue;
+      }
       for(pDb=g.pFirstDb; pDb; pDb=pDb->pNext){
         int openFlags;
         const char *zVfs = "inmem";
         sqlite3_snprintf(sizeof(g.zTestName), g.zTestName, "sqlid=%d,dbid=%d",
                          pSql->id, pDb->id);

Index: test/fuzzdata7.db
==================================================================
--- test/fuzzdata7.db
+++ test/fuzzdata7.db
cannot compute difference between binary files

ADDED   test/fuzzdata8.db
Index: test/fuzzdata8.db
==================================================================
--- /dev/null
+++ test/fuzzdata8.db
cannot compute difference between binary files

Index: test/incrvacuum.test
==================================================================
--- test/incrvacuum.test
+++ test/incrvacuum.test
@@ -781,6 +781,56 @@
     COMMIT;
     PRAGMA integrity_check;
   }
 } {ok}
 
+#-------------------------------------------------------------------------
+# At one point it was unsafe to truncate a db file on windows while there
+# were outstanding xFetch() references. This test case attempts to hit
+# that case.
+#
+ifcapable mmap {
+  reset_db
+  do_execsql_test incrvacuum-16.0 {
+    PRAGMA auto_vacuum = 2;
+    CREATE TABLE t3(a);
+    INSERT INTO t3 VALUES(1), (2), (3), (4);
+  
+    CREATE TABLE t2(x);
+    INSERT INTO t2 VALUES( randomblob(1000) );
+    INSERT INTO t2 VALUES( randomblob(1000) );
+    INSERT INTO t2 VALUES( randomblob(1000) );
+    INSERT INTO t2 VALUES( randomblob(1000) );
+    INSERT INTO t2 VALUES( randomblob(1000) );
+    INSERT INTO t2 VALUES( randomblob(1000) );
+  } {}
+  
+  # Reopen db to ensure the page-cache is empty.
+  #
+  db close
+  sqlite3 db test.db
+  
+  # Open db in mmap-mode. Open a transaction, delete some data, then run
+  # incremental-vacuum. Do not commit the transaction. 
+  #
+  do_execsql_test incrvacuum-16.1 {
+    PRAGMA mmap_size = 1000000;
+    BEGIN;
+    DELETE FROM t2;
+    PRAGMA incremental_vacuum = 1000;
+  } {1000000}
+
+  # Scan through table t3 (which is all clean pages - so mmap is used). Then,
+  # midway through, commit the transaction. This causes the db to be truncated
+  # while there are outstanding xFetch pages.
+  #
+  do_test incrvacuum-16.2 {
+    set res [list]
+    db eval { SELECT a FROM t3 } {
+      if {$a==3} { db eval COMMIT }
+      lappend res $a
+    }
+    set res
+  } {1 2 3 4}
+}
+  
 finish_test

Index: test/index.test
==================================================================
--- test/index.test
+++ test/index.test
@@ -624,11 +624,10 @@
   catchsql {
     CREATE TABLE sqlite_t1(a, b, c);
   }
 } {1 {object name reserved for internal use: sqlite_t1}}
 do_test index-18.1.2 {
-  sqlite3_db_config db DEFENSIVE 1
   catchsql {
     CREATE TABLE sqlite_t1(a, b, c);
   }
 } {1 {object name reserved for internal use: sqlite_t1}}
 sqlite3_db_config db DEFENSIVE 0

Index: test/index3.test
==================================================================
--- test/index3.test
+++ test/index3.test
@@ -81,10 +81,11 @@
 
 # This test corrupts the database file so it must be the last test
 # in the series.
 #
 do_test index3-99.1 {
+  sqlite3_db_config db DEFENSIVE 0
   execsql {
     PRAGMA writable_schema=on;
     UPDATE sqlite_master SET sql='nonsense' WHERE name='t1d'
   }
   db close

Index: test/index6.test
==================================================================
--- test/index6.test
+++ test/index6.test
@@ -387,8 +387,27 @@
   EXPLAIN QUERY PLAN SELECT a FROM t11 WHERE b<>99;
 } {/USING INDEX t11x/}
 do_execsql_test index6-11.2 {
   EXPLAIN QUERY PLAN SELECT a FROM t11 WHERE b<>99 AND c<>98;
 } {/USING INDEX t11x/}
-  
 
+# 2018-12-08
+# Ticket https://www.sqlite.org/src/info/1d958d90596593a7
+# NOT IN operator fails when using a partial index.
+#
+do_execsql_test index6-12.1 {
+  DROP TABLE IF EXISTS t1;
+  DROP TABLE IF EXISTS t2;
+  CREATE TABLE t1(a,b);
+  INSERT INTO t1 VALUES(1,1);
+  INSERT INTO t1 VALUES(2,2);
+  CREATE TABLE t2(x);
+  INSERT INTO t2 VALUES(1);
+  INSERT INTO t2 VALUES(2);
+  SELECT 'one', * FROM t2 WHERE x NOT IN (SELECT a FROM t1);
+  CREATE INDEX t1a ON t1(a) WHERE b=1;
+  SELECT 'two', * FROM t2 WHERE x NOT IN (SELECT a FROM t1);
+} {}
+do_execsql_test index6-12.2 {
+  SELECT x FROM t2 WHERE x IN (SELECT a FROM t1) ORDER BY +x;
+} {1 2}
 finish_test

Index: test/indexexpr2.test
==================================================================
--- test/indexexpr2.test
+++ test/indexexpr2.test
@@ -199,35 +199,84 @@
 } {0}
 
 # Additional test cases to show that UPDATE does not modify indexes that
 # do not involve unchanged columns.
 #
-load_static_extension db explain
-do_execsql_test 4.200 {
-  CREATE TABLE t2(a,b,c,d,e,f);
-  INSERT INTO t2 VALUES(2,3,4,5,6,7);
-  CREATE INDEX t2abc ON t2(a+b+c);
-  CREATE INDEX t2cd ON t2(c*d);
-  CREATE INDEX t2def ON t2(d,e+25*f);
-  SELECT sqlite_master.name 
-    FROM sqlite_master, explain('UPDATE t2 SET b=b+1')
-   WHERE explain.opcode LIKE 'Open%'
-     AND sqlite_master.rootpage=explain.p2
-   ORDER BY 1;
-} {t2 t2abc}
-do_execsql_test 4.210 {
-  SELECT sqlite_master.name 
-    FROM sqlite_master, explain('UPDATE t2 SET c=c+1')
-   WHERE explain.opcode LIKE 'Open%'
-     AND sqlite_master.rootpage=explain.p2
-   ORDER BY 1;
-} {t2 t2abc t2cd}
-do_execsql_test 4.220 {
-  SELECT sqlite_master.name 
-    FROM sqlite_master, explain('UPDATE t2 SET c=c+1, f=NULL')
-   WHERE explain.opcode LIKE 'Open%'
-     AND sqlite_master.rootpage=explain.p2
-   ORDER BY 1;
-} {t2 t2abc t2cd t2def}
+ifcapable vtab {
+  load_static_extension db explain
+  do_execsql_test 4.200 {
+    CREATE TABLE t2(a,b,c,d,e,f);
+    INSERT INTO t2 VALUES(2,3,4,5,6,7);
+    CREATE INDEX t2abc ON t2(a+b+c);
+    CREATE INDEX t2cd ON t2(c*d);
+    CREATE INDEX t2def ON t2(d,e+25*f);
+    SELECT sqlite_master.name 
+      FROM sqlite_master, explain('UPDATE t2 SET b=b+1')
+     WHERE explain.opcode LIKE 'Open%'
+       AND sqlite_master.rootpage=explain.p2
+     ORDER BY 1;
+  } {t2 t2abc}
+  do_execsql_test 4.210 {
+    SELECT sqlite_master.name 
+      FROM sqlite_master, explain('UPDATE t2 SET c=c+1')
+     WHERE explain.opcode LIKE 'Open%'
+       AND sqlite_master.rootpage=explain.p2
+     ORDER BY 1;
+  } {t2 t2abc t2cd}
+  do_execsql_test 4.220 {
+    SELECT sqlite_master.name 
+      FROM sqlite_master, explain('UPDATE t2 SET c=c+1, f=NULL')
+     WHERE explain.opcode LIKE 'Open%'
+       AND sqlite_master.rootpage=explain.p2
+     ORDER BY 1;
+  } {t2 t2abc t2cd t2def}
+}
+
+#-------------------------------------------------------------------------
+# Test that ticket [d96eba87] has been fixed.
+#
+do_execsql_test 5.0 {
+  CREATE TABLE t5(a INTEGER, b INTEGER);
+  INSERT INTO t5 VALUES(2, 4), (3, 9);
+}
+do_execsql_test 5.1 {
+  SELECT * FROM t5 WHERE abs(a)=2 or abs(b)=9;
+} {2 4 3 9}
+do_execsql_test 5.2 {
+  CREATE INDEX t5a ON t5( abs(a) );
+  CREATE INDEX t5b ON t5( abs(b) );
+}
+do_execsql_test 5.4 {
+  SELECT * FROM t5 WHERE abs(a)=2 or abs(b)=9;
+} {2 4 3 9}
+
+#-------------------------------------------------------------------------
+do_execsql_test 6.0 {
+  CREATE TABLE x1(a INTEGER PRIMARY KEY, b);
+  INSERT INTO x1 VALUES
+      (1, 123), (2, '123'), (3, '123abc'), (4, 123.0), (5, 1234);
+}
+
+do_execsql_test 6.1.1 {
+  SELECT a, b FROM x1 WHERE CAST(b AS INTEGER) = 123;
+} {1 123   2 123   3 123abc  4 123.0}
+do_execsql_test 6.1.2 {
+  CREATE INDEX x1i ON x1( CAST(b AS INTEGER) );
+  SELECT a, b FROM x1 WHERE CAST(b AS INTEGER) = 123;
+} {1 123   2 123   3 123abc  4 123.0}
+do_eqp_test 6.1.3 {
+  SELECT a, b FROM x1 WHERE CAST(b AS INTEGER) = 123;
+} {SEARCH TABLE x1 USING INDEX x1i (<expr>=?)}
+
+do_execsql_test 6.2.1 {
+  SELECT a, b FROM x1 WHERE CAST(b AS TEXT) = 123;
+} {1 123   2 123}
+do_execsql_test 6.2.2 {
+  CREATE INDEX x1i2 ON x1( CAST(b AS TEXT) );
+  SELECT a, b FROM x1 WHERE CAST(b AS TEXT) = 123;
+} {1 123   2 123}
+do_eqp_test 6.2.3 {
+  SELECT a, b FROM x1 WHERE CAST(b AS TEXT) = 123;
+} {SEARCH TABLE x1 USING INDEX x1i2 (<expr>=?)}
 
 
 finish_test

Index: test/insert.test
==================================================================
--- test/insert.test
+++ test/insert.test
@@ -446,9 +446,18 @@
   CREATE INDEX t13x1 ON t13(-b=b);
   INSERT INTO t13 VALUES(1,5),(6,2);
   REPLACE INTO t13 SELECT b,0 FROM t13;
   SELECT * FROM t13 ORDER BY +b;
 } {2 0 6 2 1 5}
+
+# 2019-01-17.  From the chromium fuzzer.
+#
+do_execsql_test insert-14.1 {
+  DROP TABLE IF EXISTS t14;
+  CREATE TABLE t14(x INTEGER PRIMARY KEY);
+  INSERT INTO t14 VALUES(CASE WHEN 1 THEN null END);
+  SELECT x FROM t14;
+} {1}
 
 integrity_check insert-99.0
 
 finish_test

ADDED   test/insertfault.test
Index: test/insertfault.test
==================================================================
--- /dev/null
+++ test/insertfault.test
@@ -0,0 +1,36 @@
+# 2019-01-26
+#
+# The author disclaims copyright to this source code.  In place of
+# a legal notice, here is a blessing:
+#
+#    May you do good and not evil.
+#    May you find forgiveness for yourself and forgive others.
+#    May you share freely, never taking more than you give.
+#
+#***********************************************************************
+#
+# Test cases for INSERT
+
+set testdir [file dirname $argv0]
+source $testdir/tester.tcl
+set testprefix insertfault
+
+do_execsql_test 1.0 {
+  CREATE TABLE t1(a INTEGER PRIMARY KEY, b, c, d DEFAULT true);
+  INSERT INTO t1 DEFAULT VALUES;
+  SELECT * FROM t1;
+} {1 {} {} 1}
+faultsim_save_and_close
+
+breakpoint
+do_faultsim_test 1 -faults oom* -prep {
+  faultsim_restore_and_reopen
+  db eval { SELECT * FROM sqlite_master } 
+} -body {
+  execsql { SELECT * FROM t1 }
+} -test {
+  faultsim_test_result {0 {1 {} {} 1}}
+}
+
+
+finish_test

Index: test/join.test
==================================================================
--- test/join.test
+++ test/join.test
@@ -669,24 +669,30 @@
 jointest join-12.4 64 {0 1}
 jointest join-12.5 65 {1 {at most 64 tables in a join}}
 jointest join-12.6 66 {1 {at most 64 tables in a join}}
 jointest join-12.7 127 {1 {at most 64 tables in a join}}
 jointest join-12.8 128 {1 {at most 64 tables in a join}}
-jointest join-12.9 1000 {1 {at most 64 tables in a join}}
-
-# If SQLite is built with SQLITE_MEMDEBUG, then the huge number of realloc()
-# calls made by the following test cases are too time consuming to run.
-# Without SQLITE_MEMDEBUG, realloc() is fast enough that these are not
-# a problem.
-ifcapable pragma&&compileoption_diags {
-  if {[lsearch [db eval {PRAGMA compile_options}] MEMDEBUG]<0} {
-    jointest join-12.10 65534 {1 {at most 64 tables in a join}}
-    jointest join-12.11 65535 {1 {too many references to "t14": max 65535}}
-    jointest join-12.12 65536 {1 {too many references to "t14": max 65535}}
-    jointest join-12.13 65537 {1 {too many references to "t14": max 65535}}
-  }
-}
+
+# As of 2019-01-17, the number of elements in a SrcList is limited
+# to 200.  The following tests still run, but the answer is now
+# an SQLITE_NOMEM error.
+#
+# jointest join-12.9 1000 {1 {at most 64 tables in a join}}
+#
+#  If SQLite is built with SQLITE_MEMDEBUG, then the huge number of realloc()
+#  calls made by the following test cases are too time consuming to run.
+#  Without SQLITE_MEMDEBUG, realloc() is fast enough that these are not
+#  a problem.
+#
+# ifcapable pragma&&compileoption_diags {
+#    if {[lsearch [db eval {PRAGMA compile_options}] MEMDEBUG]<0} {
+#     jointest join-12.10 65534 {1 {at most 64 tables in a join}}
+#     jointest join-12.11 65535 {1 {too many references to "t14": max 65535}}
+#     jointest join-12.12 65536 {1 {too many references to "t14": max 65535}}
+#     jointest join-12.13 65537 {1 {too many references to "t14": max 65535}}
+#   }
+# }
 
 
 #-------------------------------------------------------------------------
 # Test a problem with reordering tables following a LEFT JOIN.
 #
@@ -841,7 +847,21 @@
           ON x4<=CASE WHEN x3 THEN CASE WHEN a4 THEN 1 ELSE -1 END ELSE 0 END
         LEFT JOIN (SELECT a AS a5, b AS b5 FROM t1)
           ON x4 IS TRUE AND b5=a4
    ORDER BY a1, a2, a3, a4, a5;
 } {1 {} {} {} {} 1 11 {} {} {} 1 12 {} {} {} 1 12 121 {} {} 1 13 {} {} {}}
+
+# 2019-02-05 Ticket https://www.sqlite.org/src/tktview/5948e09b8c415bc45da5c
+# Error in join due to the LEFT JOIN strength reduction optimization.
+#
+do_execsql_test join-16.100 {
+  DROP TABLE IF EXISTS t1;
+  DROP TABLE IF EXISTS t2;
+  CREATE TABLE t1(a INT);
+  INSERT INTO t1(a) VALUES(1);
+  CREATE TABLE t2(b INT);
+  SELECT a, b
+    FROM t1 LEFT JOIN t2 ON 0
+   WHERE (b IS NOT NULL)=0;
+} {1 {}}
 
 finish_test

Index: test/join5.test
==================================================================
--- test/join5.test
+++ test/join5.test
@@ -265,12 +265,14 @@
   );
 } {
   QUERY PLAN
   |--SCAN TABLE t1
   `--MULTI-INDEX OR
-     |--SEARCH TABLE t2 USING INDEX t2xy (x=? AND y=?)
-     `--SEARCH TABLE t2 USING INDEX t2xy (x=? AND y=?)
+     |--INDEX 1
+     |  `--SEARCH TABLE t2 USING INDEX t2xy (x=? AND y=?)
+     `--INDEX 2
+        `--SEARCH TABLE t2 USING INDEX t2xy (x=? AND y=?)
 }
 
 do_execsql_test 7.3 {
   CREATE TABLE t3(x);
 

Index: test/json101.test
==================================================================
--- test/json101.test
+++ test/json101.test
@@ -811,8 +811,25 @@
 } {$}
 do_execsql_test json-14.170 {
   SELECT fullkey FROM json_tree('null');
 } {$}
 
-
+# 2018-12-03
+# Make sure the table-valued functions contained within parentheses
+# work correctly.
+#
+# Bug reported via private email. See TH3 for more information.
+#
+do_execsql_test json-15.100 {
+  SELECT * FROM JSON_EACH('{"a":1, "b":2}');
+} {a 1 integer 1 2 {} {$.a} {$} b 2 integer 2 4 {} {$.b} {$}}
+do_execsql_test json-15.110 {
+  SELECT xyz.* FROM JSON_EACH('{"a":1, "b":2}') AS xyz;
+} {a 1 integer 1 2 {} {$.a} {$} b 2 integer 2 4 {} {$.b} {$}}
+do_execsql_test json-15.120 {
+  SELECT * FROM (JSON_EACH('{"a":1, "b":2}'));
+} {a 1 integer 1 2 {} {$.a} {$} b 2 integer 2 4 {} {$.b} {$}}
+do_execsql_test json-15.130 {
+  SELECT xyz.* FROM (JSON_EACH('{"a":1, "b":2}')) AS xyz;
+} {a 1 integer 1 2 {} {$.a} {$} b 2 integer 2 4 {} {$.b} {$}}
 
 finish_test

ADDED   test/lemon-test01.y
Index: test/lemon-test01.y
==================================================================
--- /dev/null
+++ test/lemon-test01.y
@@ -0,0 +1,75 @@
+// A test case for the LEMON parser generator.  Run as follows:
+//
+//     lemon lemon-test01.y && gcc -g lemon-test01.c && ./a.out
+//
+%token_prefix TK_
+%token_type   int
+%default_type int
+%include {
+  static int nSyntaxError = 0;
+  static int nAccept = 0;
+  static int nFailure = 0;
+}
+
+all ::=  A B.
+all ::=  error B.
+
+%syntax_error {
+  nSyntaxError++;
+}
+%parse_accept {
+  nAccept++;
+}
+%parse_failure {
+  nFailure++;
+}
+%code {
+  #include <assert.h>
+  #include "lemon-test01.h"
+  static int nTest = 0;
+  static int nErr = 0;
+  static int testCase(int testId, int shouldBe, int actual){
+    nTest++;
+    if( shouldBe==actual ){
+      printf("test %d: ok\n", testId);
+    }else{
+      printf("test %d: got %d, expected %d\n", testId, actual, shouldBe);
+      nErr++;
+    }
+  }
+  int main(int argc, char **argv){
+    yyParser xp;
+    ParseInit(&xp);
+    Parse(&xp, TK_A, 0);
+    Parse(&xp, TK_B, 0);
+    Parse(&xp, 0, 0);
+    ParseFinalize(&xp);
+    testCase(100, 0, nSyntaxError);
+    testCase(110, 1, nAccept);
+    testCase(120, 0, nFailure);
+    nSyntaxError = nAccept = nFailure = 0;
+    ParseInit(&xp);
+    Parse(&xp, TK_B, 0);
+    Parse(&xp, TK_B, 0);
+    Parse(&xp, 0, 0);
+    ParseFinalize(&xp);
+    testCase(200, 1, nSyntaxError);
+    testCase(210, 1, nAccept);
+    testCase(220, 0, nFailure);
+    nSyntaxError = nAccept = nFailure = 0;
+    ParseInit(&xp);
+    Parse(&xp, TK_A, 0);
+    Parse(&xp, TK_A, 0);
+    Parse(&xp, 0, 0);
+    ParseFinalize(&xp);
+    testCase(200, 1, nSyntaxError);
+    testCase(210, 0, nAccept);
+    testCase(220, 0, nFailure);
+    if( nErr==0 ){
+      printf("%d tests pass\n", nTest);
+    }else{
+      printf("%d errors out %d tests\n", nErr, nTest);
+    }
+    return nErr;
+  }
+}

Index: test/loadext.test
==================================================================
--- test/loadext.test
+++ test/loadext.test
@@ -59,13 +59,13 @@
     {%s: cannot open shared object file: No such file or directory}
 set dlerror_notadll    {%s: file too short}
 set dlerror_nosymbol   {%s: undefined symbol: %s}
 
 if {$::tcl_platform(os) eq "Darwin"} {
-  set dlerror_nosuchfile {dlopen(%s, 10): image not found}
-  set dlerror_notadll    {dlopen(%1$s, 10): no suitable image found.*}
-  set dlerror_nosymbol   {dlsym(XXX, %2$s): symbol not found}
+  set dlerror_nosuchfile {dlopen.%s, 10.: .*image.*found.*}
+  set dlerror_notadll    {dlopen.%1$s, 10.: .*image.*found.*}
+  set dlerror_nosymbol   {dlsym.XXX, %2$s.: symbol not found}
 }
 
 if {$::tcl_platform(platform) eq "windows"} {
   set dlerror_nosuchfile {The specified module could not be found.*}
   set dlerror_notadll    {%%1 is not a valid Win32 application.*}

Index: test/lock_common.tcl
==================================================================
--- test/lock_common.tcl
+++ test/lock_common.tcl
@@ -13,22 +13,24 @@
 # processes) to test locking.
 #
 
 proc do_multiclient_test {varname script} {
 
-  foreach code [list {
+  foreach {tn code} [list 1 {
     if {[info exists ::G(valgrind)]} { db close ; continue }
     set ::code2_chan [launch_testfixture]
     set ::code3_chan [launch_testfixture]
     proc code2 {tcl} { testfixture $::code2_chan $tcl }
     proc code3 {tcl} { testfixture $::code3_chan $tcl }
-    set tn 1
-  } {
+  } 2 {
     proc code2 {tcl} { uplevel #0 $tcl }
     proc code3 {tcl} { uplevel #0 $tcl }
-    set tn 2
   }] {
+    # Do not run multi-process tests with the unix-excl VFS.
+    #
+    if {$tn==1 && [permutation]=="unix-excl"} continue
+
     faultsim_delete_and_reopen
 
     proc code1 {tcl} { uplevel #0 $tcl }
   
     # Open connections [db2] and [db3]. Depending on which iteration this

Index: test/memdb1.test
==================================================================
--- test/memdb1.test
+++ test/memdb1.test
@@ -69,10 +69,35 @@
 } {116}
 do_execsql_test 140 {
   VACUUM;
   PRAGMA page_count;
 } {2}
+
+do_test 150 {
+  catch {db deserialize -unknown 1 $db1} msg
+  set msg
+} {unknown option: -unknown}
+do_test 151 {
+  db deserialize -readonly 1 $db1
+  db eval {SELECT * FROM t1}
+} {1 2}
+do_test 152 {
+  catchsql {INSERT INTO t1 VALUES(3,4);}
+} {1 {attempt to write a readonly database}}
+
+breakpoint
+do_test 160 {
+  db deserialize -maxsize 32768 $db1
+  db eval {SELECT * FROM t1}
+} {1 2}
+do_test 161 {
+  db eval {INSERT INTO t1 VALUES(3,4); SELECT * FROM t1}
+} {1 2 3 4}
+do_test 162 {
+  catchsql {INSERT INTO t1 VALUES(5,randomblob(100000))}
+} {1 {database or disk is full}}
+
 
 # Build a largish on-disk database and serialize it.  Verify that the
 # serialization works.
 #
 db close
@@ -152,12 +177,12 @@
   lappend rc $msg
 } {1 {wrong # args: should be "db deserialize ?DATABASE? VALUE"}}
 do_test 610 {
   set rc [catch {db deserialize a b c} msg]
   lappend rc $msg
-} {1 {wrong # args: should be "db deserialize ?DATABASE? VALUE"}}
+} {1 {unknown option: a}}
 do_test 620 {
   set rc [catch {db serialize a b} msg]
   lappend rc $msg
 } {1 {wrong # args: should be "db serialize ?DATABASE?"}}
 
 finish_test

Index: test/misc1.test
==================================================================
--- test/misc1.test
+++ test/misc1.test
@@ -657,10 +657,11 @@
 
 # 2015-04-19: NULL pointer dereference on a corrupt schema
 #
 db close
 sqlite3 db :memory:
+sqlite3_db_config db DEFENSIVE 0
 do_execsql_test misc1-23.1 {
   CREATE TABLE t1(x);
   PRAGMA writable_schema=ON;
   UPDATE sqlite_master SET sql='CREATE table t(d CHECK(T(#0)';
   BEGIN;
@@ -672,10 +673,11 @@
 # 2015-04-19:  Faulty assert() statement
 #
 db close
 database_may_be_corrupt
 sqlite3 db :memory:
+sqlite3_db_config db DEFENSIVE 0
 do_catchsql_test misc1-23.2 {
   CREATE TABLE t1(x UNIQUE);
   PRAGMA writable_schema=ON;
   UPDATE sqlite_master SET sql='CREATE TABLE IF not EXISTS t(c)';
   BEGIN;
@@ -683,10 +685,11 @@
   ROLLBACK;
   DROP TABLE F;
 } {1 {no such table: F}}
 db close
 sqlite3 db :memory:
+sqlite3_db_config db DEFENSIVE 0
 do_catchsql_test misc1-23.3 {
   CREATE TABLE t1(x UNIQUE);
   PRAGMA writable_schema=ON;
   UPDATE sqlite_master SET sql='CREATE table y(a TEXT, a TEXT)';
   BEGIN;
@@ -739,7 +742,21 @@
 do_execsql_test misc1-27.1 {
   UPDATE dup1 SET a=7, b=8, c=9, a=10, b=11, c=12;
   SELECT a,b,c FROM dup1;
 } {10 11 12}
 
+# 2018-12-20
+#
+# The Cursor.seekOp debugging value set incorrectly
+# in OP_NotExists.
+#
+sqlite3 db :memory:
+do_execsql_test misc1-28.0 {
+  CREATE TABLE t1(x);
+  CREATE UNIQUE INDEX t1x ON t1(x) WHERE x=1;
+  INSERT OR ABORT INTO t1 DEFAULT VALUES;
+  UPDATE OR REPLACE t1 SET x = 1;
+  PRAGMA integrity_check;
+  SELECT * FROM t1;
+} {ok 1}
 
 finish_test

Index: test/misc4.test
==================================================================
--- test/misc4.test
+++ test/misc4.test
@@ -210,10 +210,11 @@
 
 # 2015-05-15.  Error message formatting problem.
 #
 db close
 sqlite3 db :memory:
+sqlite3_db_config db DEFENSIVE 0
 do_catchsql_test misc4-7.1 {
   CREATE TABLE t7(x);
   PRAGMA writable_schema=ON;
   UPDATE sqlite_master SET sql='CREATE TABLE [M%s%s%s%s%s%s%s%s%s%s%s%s%s';
   VACUUM;

Index: test/misc5.test
==================================================================
--- test/misc5.test
+++ test/misc5.test
@@ -588,10 +588,11 @@
 # Parser stack overflow is silently ignored when it occurs while parsing the
 # schema and PRAGMA writable_schema is turned on.
 #
 do_test misc5-7.2 {
   sqlite3 db2 :memory:
+  sqlite3_db_config db2 DEFENSIVE 0
   catchsql {
     CREATE TABLE t1(x UNIQUE);
     PRAGMA writable_schema=ON;
     UPDATE sqlite_master SET sql='CREATE table t(o CHECK(((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((;VALUES(o)';
     BEGIN;

Index: test/misc7.test
==================================================================
--- test/misc7.test
+++ test/misc7.test
@@ -225,10 +225,13 @@
       CREATE VIRTUAL TABLE t1 USING echo(abc);
       SELECT a FROM t1 WHERE a = 1 ORDER BY b;
     }
   } {1}
   set sqlite_where_trace 0
+  do_catchsql_test misc7-10.1 {
+    INSERT INTO t1(a,b,c) VALUES(12345,2,3) ON CONFLICT(a) DO NOTHING;
+  } {1 {UPSERT not implemented for virtual table "t1"}}
 
   # Specify an ORDER BY clause that cannot be indexed.
   do_test misc7-11 {
     execsql {
       SELECT t1.a, t2.a FROM t1, t1 AS t2 ORDER BY 2 LIMIT 1;
@@ -432,10 +435,11 @@
     
     # sqlite3_test_control_pending_page [expr ($::sqlite_pending_byte / 1024) + 1]
     set ::pending_byte_page [expr ($::sqlite_pending_byte / 1024) + 1]
     sqlite3_test_control_pending_byte $::sqlite_pending_byte 
     do_test misc7-17.3 {
+      sqlite3_db_config db DEFENSIVE 0
       db eval {
         pragma writable_schema = true;
         UPDATE sqlite_master 
           SET rootpage = $pending_byte_page
           WHERE type = 'table' AND name = 't3';

Index: test/mjournal.test
==================================================================
--- test/mjournal.test
+++ test/mjournal.test
@@ -158,6 +158,5 @@
     INSERT INTO t4 VALUES(1);
   COMMIT;
 } {0}
 
 finish_test
-

Index: test/normalize.test
==================================================================
--- test/normalize.test
+++ test/normalize.test
@@ -84,11 +84,11 @@
 
   sqlite3_bind_null $STMT 1
 } {}
 do_test 202 {
   sqlite3_normalized_sql $STMT
-} {}
+} {SELECT a,b FROM t1 WHERE b=?ORDER BY a;}
 do_test 203 {
   sqlite3_finalize $STMT
 } {SQLITE_OK}
 
 do_test 210 {
@@ -205,21 +205,21 @@
   {0 {SELECT a FROM t1 WHERE x IN(?,?,?)AND hex8(?);}}
 
   430
   {SELECT "a" FROM t1 WHERE "x" IN ("1","2",'3');}
   0x2
-  {0 {SELECT"a"FROM t1 WHERE"x"IN(?,?,?);}}
+  {0 {SELECT a FROM t1 WHERE x IN(?,?,?);}}
 
   440
   {SELECT 'a' FROM t1 WHERE 'x';}
   0x2
   {0 {SELECT?FROM t1 WHERE?;}}
 
   450
   {SELECT [a] FROM t1 WHERE [x];}
   0x2
-  {0 {SELECT"a"FROM t1 WHERE"x";}}
+  {0 {SELECT a FROM t1 WHERE x;}}
 
   460
   {SELECT * FROM t1 WHERE x IN (x);}
   0x2
   {0 {SELECT*FROM t1 WHERE x IN(x);}}
@@ -230,31 +230,31 @@
   {0 {SELECT*FROM t1 WHERE x IN(x,a);}}
 
   480
   {SELECT * FROM t1 WHERE x IN ([x],"a");}
   0x2
-  {0 {SELECT*FROM t1 WHERE x IN("x","a");}}
+  {0 {SELECT*FROM t1 WHERE x IN(x,a);}}
 
   500
   {SELECT * FROM t1 WHERE x IN ([x],"a",'b',sqlite_version());}
   0x2
-  {0 {SELECT*FROM t1 WHERE x IN("x","a",?,sqlite_version());}}
+  {0 {SELECT*FROM t1 WHERE x IN(x,a,?,sqlite_version());}}
 
   520
   {SELECT * FROM t1 WHERE x IN (SELECT x FROM t1);}
   0x2
   {0 {SELECT*FROM t1 WHERE x IN(SELECT x FROM t1);}}
 
   540
   {SELECT * FROM t1 WHERE x IN ((SELECT x FROM t1));}
   0x2
-  {0 {SELECT*FROM t1 WHERE x IN(?,?,?);}}
+  {0 {SELECT*FROM t1 WHERE x IN((SELECT x FROM t1));}}
 
   550
   {SELECT a, a+1, a||'b', a+"b" FROM t1;}
   0x2
-  {0 {SELECT a,a+?,a||?,a+"b"FROM t1;}}
+  {0 {SELECT a,a+?,a||?,a+b FROM t1;}}
 
   570
   {SELECT * FROM t1 WHERE x IN (1);}
   0x2
   {0 {SELECT*FROM t1 WHERE x IN(?,?,?);}}
@@ -314,11 +314,11 @@
   {0 {SELECT"col f","col f"FROM t1;}}
 
   680
   {SELECT a, "col f" FROM t1 LEFT OUTER JOIN t2 ON [t1].[col f] == [t2].[col y];}
   0x2
-  {0 {SELECT a,"col f"FROM t1 LEFT OUTER JOIN t2 ON"t1"."col f"=="t2"."col y";}}
+  {0 {SELECT a,"col f"FROM t1 LEFT OUTER JOIN t2 ON t1."col f"==t2."col y";}}
 
   690
   {SELECT * FROM ( WITH x AS ( SELECT * FROM t1 WHERE x IN ( 1)) SELECT 10);}
   0x2
   {0 {SELECT*FROM(WITH x AS(SELECT*FROM t1 WHERE x IN(?,?,?))SELECT?);}}
@@ -344,11 +344,11 @@
   {0 {SELECT x FROM t1 WHERE x=?;}}
 
   760
   {SELECT x FROM t1 WHERE x IN ([x] IS NOT NULL, NULL, 1, 'a', "b", x'00');}
   0x2
-  {0 {SELECT x FROM t1 WHERE x IN("x"IS NOT NULL,?,?,?,"b",?);}}
+  {0 {SELECT x FROM t1 WHERE x IN(x IS NOT NULL,?,?,?,b,?);}}
 } {
   do_test $tnum {
     set code [catch {
       set STMT [sqlite3_prepare_v3 $DB $sql -1 $flags TAIL]
       sqlite3_normalized_sql $STMT

Index: test/notnull.test
==================================================================
--- test/notnull.test
+++ test/notnull.test
@@ -604,6 +604,5 @@
 
 do_uses_op_next_test notnull-6.9 "SELECT * FROM t8 WHERE a IS ?" 0
 do_uses_op_next_test notnull-6.10 "SELECT * FROM t8 WHERE a IS ?" 0
 
 finish_test
-

Index: test/ossfuzz.c
==================================================================
--- test/ossfuzz.c
+++ test/ossfuzz.c
@@ -34,11 +34,14 @@
 ** Julian epoch (-4714-11-24).
 */
 static sqlite3_int64 timeOfDay(void){
   static sqlite3_vfs *clockVfs = 0;
   sqlite3_int64 t;
-  if( clockVfs==0 ) clockVfs = sqlite3_vfs_find(0);
+  if( clockVfs==0 ){
+    clockVfs = sqlite3_vfs_find(0);
+    if( clockVfs==0 ) return 0;
+  }
   if( clockVfs->iVersion>=2 && clockVfs->xCurrentTimeInt64!=0 ){
     clockVfs->xCurrentTimeInt64(clockVfs, &t);
   }else{
     double r;
     clockVfs->xCurrentTime(clockVfs, &r);
@@ -54,13 +57,13 @@
   sqlite3 *db;               /* The database connection */
   sqlite3_int64 iCutoffTime; /* Stop processing at this time. */
   sqlite3_int64 iLastCb;     /* Time recorded for previous progress callback */
   sqlite3_int64 mxInterval;  /* Longest interval between two progress calls */
   unsigned nCb;              /* Number of progress callbacks */
+  unsigned execCnt;          /* Number of calls to the sqlite3_exec callback */
 } FuzzCtx;
 
-#ifndef SQLITE_OMIT_PROGRESS_CALLBACK
 /*
 ** Progress handler callback.
 **
 ** The argument is the cutoff-time after which all processing should
 ** stop.  So return non-zero if the cut-off time is exceeded.
@@ -72,11 +75,10 @@
   sqlite3_int64 iDiff = iNow - p->iLastCb;
   if( iDiff > p->mxInterval ) p->mxInterval = iDiff;
   p->nCb++;
   return rc;
 }
-#endif
 
 /*
 ** Disallow debugging pragmas such as "PRAGMA vdbe_debug" and
 ** "PRAGMA parser_trace" since they can dramatically increase the
 ** amount of output without actually testing anything useful.
@@ -99,24 +101,24 @@
 }
 
 /*
 ** Callback for sqlite3_exec().
 */
-static int exec_handler(void *pCnt, int argc, char **argv, char **namev){
+static int exec_handler(void *pClientData, int argc, char **argv, char **namev){
+  FuzzCtx *p = (FuzzCtx*)pClientData;
   int i;
   if( argv ){
     for(i=0; i<argc; i++) sqlite3_free(sqlite3_mprintf("%s", argv[i]));
   }
-  return ((*(int*)pCnt)--)<=0;
+  return (p->execCnt--)<=0 || progress_handler(pClientData);
 }
 
 /*
 ** Main entry point.  The fuzzer invokes this function with each
 ** fuzzed input.
 */
 int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
-  int execCnt = 0;         /* Abort row callback when count reaches zero */
   char *zErrMsg = 0;       /* Error message returned by sqlite_exec() */
   uint8_t uSelector;       /* First byte of input data[] */
   int rc;                  /* Return code from various interfaces */
   char *zSql;              /* Zero-terminated copy of data[] */
   FuzzCtx cx;              /* Fuzzing context */
@@ -132,27 +134,33 @@
   }else{
     uSelector = 0xfd;
   }
 
   /* Open the database connection.  Only use an in-memory database. */
+  if( sqlite3_initialize() ) return 0;
   rc = sqlite3_open_v2("fuzz.db", &cx.db,
            SQLITE_OPEN_READWRITE | SQLITE_OPEN_CREATE | SQLITE_OPEN_MEMORY, 0);
   if( rc ) return 0;
 
-#ifndef SQLITE_OMIT_PROGRESS_CALLBACK
   /* Invoke the progress handler frequently to check to see if we
   ** are taking too long.  The progress handler will return true
   ** (which will block further processing) if more than 10 seconds have
   ** elapsed since the start of the test.
   */
   cx.iLastCb = timeOfDay();
   cx.iCutoffTime = cx.iLastCb + 10000;  /* Now + 10 seconds */
+#ifndef SQLITE_OMIT_PROGRESS_CALLBACK
   sqlite3_progress_handler(cx.db, 10, progress_handler, (void*)&cx);
 #endif
 
   /* Set a limit on the maximum size of a prepared statement */
   sqlite3_limit(cx.db, SQLITE_LIMIT_VDBE_OP, 25000);
+
+  /* Set a limit on the maximum length of a string or BLOB.  Without this
+  ** limit, fuzzers will invoke randomblob(N) for a large N, and the process
+  ** will timeout trying to generate the huge blob */
+  sqlite3_limit(cx.db, SQLITE_LIMIT_LENGTH, 50000);
 
   /* Bit 1 of the selector enables foreign key constraints */
   sqlite3_db_config(cx.db, SQLITE_DBCONFIG_ENABLE_FKEY, uSelector&1, &rc);
   uSelector >>= 1;
 
@@ -159,19 +167,19 @@
   /* Do not allow debugging pragma statements that might cause excess output */
   sqlite3_set_authorizer(cx.db, block_debug_pragmas, 0);
 
   /* Remaining bits of the selector determine a limit on the number of
   ** output rows */
-  execCnt = uSelector + 1;
+  cx.execCnt = uSelector + 1;
 
   /* Run the SQL.  The sqlite_exec() interface expects a zero-terminated
   ** string, so make a copy. */
   zSql = sqlite3_mprintf("%.*s", (int)size, data);
 #ifndef SQLITE_OMIT_COMPLETE
   sqlite3_complete(zSql);
 #endif
-  sqlite3_exec(cx.db, zSql, exec_handler, (void*)&execCnt, &zErrMsg);
+  sqlite3_exec(cx.db, zSql, exec_handler, (void*)&cx, &zErrMsg);
 
   /* Show any errors */
   if( (mDebug & FUZZ_SHOW_ERRORS)!=0 && zErrMsg ){
     printf("Error: %s\n", zErrMsg);
   }

Index: test/pager1.test
==================================================================
--- test/pager1.test
+++ test/pager1.test
@@ -1877,10 +1877,11 @@
   }
 } {}
 do_test pager1-18.2 {
   set root [db one "SELECT rootpage FROM sqlite_master"]
   set lockingpage [expr (0x10000/1024) + 1]
+  sqlite3_db_config db DEFENSIVE 0
   execsql {
     PRAGMA writable_schema = 1;
     UPDATE sqlite_master SET rootpage = $lockingpage;
   }
   sqlite3 db2 test.db
@@ -1929,10 +1930,11 @@
   catchsql { SELECT length(x||'') FROM t2 } db2
 } {1 {database disk image is malformed}}
 db2 close
 do_test pager1-18.5 {
   sqlite3 db ""
+  sqlite3_db_config db DEFENSIVE 0
   execsql {
     CREATE TABLE t1(a, b);
     CREATE TABLE t2(a, b);
     PRAGMA writable_schema = 1;
     UPDATE sqlite_master SET rootpage=5 WHERE tbl_name = 't1';

Index: test/parser1.test
==================================================================
--- test/parser1.test
+++ test/parser1.test
@@ -26,10 +26,11 @@
 
 # Verify that a legacy schema in the sqlite_master file is allowed to have
 # COLLATE, ASC, and DESC keywords on the id list of a FK constraint, and that
 # those keywords are silently ignored.
 #
+sqlite3_db_config db DEFENSIVE 0
 do_execsql_test parser1-1.2 {
   CREATE TABLE t1(
     a TEXT PRIMARY KEY,
     b TEXT,
     FOREIGN KEY(b) REFERENCES t1(a)

Index: test/permutations.test
==================================================================
--- test/permutations.test
+++ test/permutations.test
@@ -428,14 +428,22 @@
 #   coverage-wal
 #
 test_suite "coverage-wal" -description {
   Coverage tests for file wal.c.
 } -files {
-  wal.test       wal2.test     wal3.test       walmode.test    
-  walbak.test    walhook.test  walcrash2.test  walcksum.test
-  walfault.test  walbig.test   walnoshm.test
-  wal5.test
+  wal.test wal2.test wal3.test wal4.test wal5.test
+  wal64k.test wal6.test wal7.test wal8.test wal9.test
+  walbak.test walbig.test walblock.test walcksum.test walcrash2.test
+  walcrash3.test walcrash4.test walcrash.test walfault.test walhook.test
+  walmode.test walnoshm.test waloverwrite.test walpersist.test 
+  walprotocol2.test walprotocol.test walro2.test walrofault.test 
+  walro.test walshared.test walslow.test walvfs.test
+  walfault2.test
+  nockpt.test
+
+  snapshot2.test snapshot3.test snapshot4.test
+  snapshot_fault.test snapshot.test snapshot_up.test
 } 
 
 test_suite "coverage-pager" -description {
   Coverage tests for file pager.c.
 } -files {
@@ -742,11 +750,11 @@
 
   # Exclude test scripts that use tcl IO to access journal files or count
   # the number of fsync() calls.
   pager.test exclusive.test jrnlmode.test sync.test misc1.test 
   journal1.test conflict.test crash8.test tkt3457.test io.test
-  journal3.test 8_3_names.test
+  journal3.test 8_3_names.test shmlock.test
 
   pager1.test async4.test corrupt.test filefmt.test pager2.test
   corrupt5.test corruptA.test pageropt.test
 
   # Exclude stmt.test, which expects sub-journals to use temporary files.
@@ -956,11 +964,11 @@
 } -files [test_set $::allquicktests -exclude {
   wal* incrvacuum.test ioerr.test corrupt4.test io.test crash8.test 
   async4.test bigfile.test backcompat.test e_wal* fstat.test mmap2.test
   pager1.test syscall.test tkt3457.test *malloc* mmap* multiplex* nolock*
   pager2.test *fault* rowal* snapshot* superlock* symlink.test
-  delete_db.test
+  delete_db.test shmlock.test
 }]
 
 if {[info commands register_demovfs] != ""} {
   test_suite "demovfs" -description {
     Check that the demovfs (code in test_demovfs.c) more or less works.

Index: test/pragma.test
==================================================================
--- test/pragma.test
+++ test/pragma.test
@@ -495,10 +495,11 @@
 }
 
 # Verify that PRAGMA integrity_check catches UNIQUE and NOT NULL
 # constraint violations.
 #
+sqlite3_db_config db DEFENSIVE 0
 do_execsql_test pragma-3.20 {
   CREATE TABLE t1(a,b);
   CREATE INDEX t1a ON t1(a);
   INSERT INTO t1 VALUES(1,1),(2,2),(3,3),(2,4),(NULL,5),(NULL,6);
   PRAGMA writable_schema=ON;

Index: test/pragma4.test
==================================================================
--- test/pragma4.test
+++ test/pragma4.test
@@ -98,6 +98,148 @@
   }
   string map {\[ x \] x \173 {} \175 {}} \
     [db eval {EXPLAIN PRAGMA integrity_check}]
 } {/ IntegrityCk 2 2 1 x[0-9]+,1x /}
 
+
+#--------------------------------------------------------------------------
+#
+reset_db
+forcedelete test.db2
+do_execsql_test 4.1.1 {
+  CREATE TABLE t1(a, b, c);
+  ATTACH 'test.db2' AS aux;
+  CREATE TABLE aux.t2(d, e, f);
+}
+do_execsql_test 4.1.2 { PRAGMA table_info = t1 } {
+  0 a {} 0 {} 0 1 b {} 0 {} 0 2 c {} 0 {} 0
+}
+do_execsql_test 4.1.3 { PRAGMA table_info = t2 } {
+  0 d {} 0 {} 0 1 e {} 0 {} 0 2 f {} 0 {} 0
+}
+do_test 4.1.4 { 
+  sqlite3 db3 test.db
+  sqlite3 db2 test.db2
+  execsql { DROP TABLE t1 } db3
+  execsql { DROP TABLE t2 } db2
+} {}
+do_execsql_test 4.1.5 { PRAGMA table_info(t1) }
+do_execsql_test 4.1.6 { PRAGMA table_info(t2) }
+
+db2 close
+db3 close
+reset_db
+forcedelete test.db2
+do_execsql_test 4.2.1 {
+  CREATE TABLE t1(a, b, c);
+  ATTACH 'test.db2' AS aux;
+  CREATE TABLE aux.t2(d, e, f);
+}
+ifcapable vtab {
+  do_execsql_test 4.2.2 { SELECT * FROM pragma_table_info('t1') } {
+    0 a {} 0 {} 0 1 b {} 0 {} 0 2 c {} 0 {} 0
+  }
+  do_execsql_test 4.2.3 { SELECT * FROM pragma_table_info('t2') } {
+    0 d {} 0 {} 0 1 e {} 0 {} 0 2 f {} 0 {} 0
+  }
+}
+do_test 4.2.4 { 
+  sqlite3 db3 test.db
+  sqlite3 db2 test.db2
+  execsql { DROP TABLE t1 } db3
+  execsql { DROP TABLE t2 } db2
+} {}
+ifcapable vtab {
+  do_execsql_test 4.2.5 { SELECT * FROM pragma_table_info('t1') } 
+  do_execsql_test 4.2.6 { SELECT * FROM pragma_table_info('t2') } 
+}
+
+db2 close
+db3 close
+reset_db
+forcedelete test.db2
+do_execsql_test 4.3.1 {
+  CREATE TABLE t1(a, b, c);
+  CREATE INDEX i1 ON t1(b);
+  ATTACH 'test.db2' AS aux;
+  CREATE TABLE aux.t2(d, e, f);
+  CREATE INDEX aux.i2 ON t2(e);
+}
+ifcapable vtab {
+  do_execsql_test 4.3.2 { SELECT * FROM pragma_index_info('i1') } {0 1 b}
+  do_execsql_test 4.3.3 { SELECT * FROM pragma_index_info('i2') } {0 1 e}
+}
+do_test 4.3.4 { 
+  sqlite3 db3 test.db
+  sqlite3 db2 test.db2
+  execsql { DROP INDEX i1 } db3
+  execsql { DROP INDEX i2 } db2
+} {}
+ifcapable vtab {
+  do_execsql_test 4.3.5 { SELECT * FROM pragma_index_info('i1') } 
+  do_execsql_test 4.3.6 { SELECT * FROM pragma_index_info('i2') } 
+}
+
+execsql {SELECT * FROM main.sqlite_master, aux.sqlite_master}
+do_execsql_test 4.4.0 {
+  CREATE INDEX main.i1 ON t1(b, c);
+  CREATE INDEX aux.i2 ON t2(e, f);
+}
+ifcapable vtab {
+  do_execsql_test 4.4.1 { SELECT * FROM pragma_index_list('t1') } {0 i1 0 c 0}
+  do_execsql_test 4.4.2 { SELECT * FROM pragma_index_list('t2') } {0 i2 0 c 0}
+}
+do_test 4.4.3 { 
+  execsql { DROP INDEX i1 } db3
+  execsql { DROP INDEX i2 } db2
+} {}
+ifcapable vtab {
+  do_execsql_test 4.4.5 { SELECT * FROM pragma_index_list('t1') } {}
+  do_execsql_test 4.4.6 { SELECT * FROM pragma_index_list('t2') } {}
+}
+execsql {SELECT * FROM main.sqlite_master, aux.sqlite_master}
+
+do_execsql_test 4.5.0 {
+  CREATE UNIQUE INDEX main.i1 ON t1(a);
+  CREATE UNIQUE INDEX aux.i2 ON t2(d);
+  CREATE TABLE main.c1 (a, b, c REFERENCES t1(a));
+  CREATE TABLE aux.c2 (d, e, r REFERENCES t2(d));
+}
+ifcapable vtab {
+  do_execsql_test 4.5.1 { SELECT * FROM pragma_foreign_key_list('c1') } {
+    0 0 t1 c a {NO ACTION} {NO ACTION} NONE
+  }
+  do_execsql_test 4.5.2 { SELECT * FROM pragma_foreign_key_list('c2') } {
+    0 0 t2 r d {NO ACTION} {NO ACTION} NONE
+  }
+}
+do_test 4.5.3 { 
+  execsql { DROP TABLE c1 } db3
+  execsql { DROP TABLE c2 } db2
+} {}
+ifcapable vtab {
+  do_execsql_test 4.5.4 { SELECT * FROM pragma_foreign_key_list('c1') }
+  do_execsql_test 4.5.5 { SELECT * FROM pragma_foreign_key_list('c2') } 
+}
+execsql {SELECT * FROM main.sqlite_master, aux.sqlite_master}
+
+do_execsql_test 4.6.0 {
+  CREATE TABLE main.c1 (a, b, c REFERENCES t1(a));
+  CREATE TABLE aux.c2 (d, e, r REFERENCES t2(d));
+  INSERT INTO main.c1 VALUES(1, 2, 3);
+  INSERT INTO aux.c2 VALUES(4, 5, 6);
+}
+do_execsql_test 4.6.1 { pragma foreign_key_check('c1') } {
+  c1 1 t1 0
+}
+do_execsql_test 4.6.2 { pragma foreign_key_check('c2') } {
+  c2 1 t2 0
+}
+do_test 4.6.3 { 
+  execsql { DROP TABLE c2 } db2
+} {}
+do_execsql_test 4.6.4 { pragma foreign_key_check('c1') } {c1 1 t1 0}
+do_catchsql_test 4.6.5 { 
+  pragma foreign_key_check('c2') 
+} {1 {no such table: c2}}
+
 finish_test

ADDED   test/prefixes.test
Index: test/prefixes.test
==================================================================
--- /dev/null
+++ test/prefixes.test
@@ -0,0 +1,88 @@
+# 2018-01-15
+#
+# The author disclaims copyright to this source code.  In place of
+# a legal notice, here is a blessing:
+#
+#    May you do good and not evil.
+#    May you find forgiveness for yourself and forgive others.
+#    May you share freely, never taking more than you give.
+#
+#***********************************************************************
+# This file implements regression tests for SQLite library.  The
+# focus of this file is prefixes.c extension
+#
+
+set testdir [file dirname $argv0]
+source $testdir/tester.tcl
+set testprefix unionvtab
+
+ifcapable !vtab {
+  finish_test
+  return
+}
+
+load_static_extension db prefixes
+
+foreach {tn zLeft zRight expected} {
+  1 abcdxxx abcyy    3
+  2 abcdxxx bcyyy    0
+  3 abcdxxx ab       2
+  4 ab      abcd     2
+
+  5 "xyz\u1234xz" "xyz\u1234xy" 5
+  6 "xyz\u1234"   "xyz\u1234xy" 4
+  7 "xyz\u1234"   "xyz\u1234"   4
+  8 "xyz\u1234xy" "xyz\u1234"   4
+  9 "xyz\u1234xy" "xyz\u1233"   3
+ 10 "xyz\u1234xy" "xyz\u1235"   3
+} {
+  do_execsql_test 1.$tn { SELECT prefix_length($zLeft, $zRight) } $expected
+}
+
+
+do_execsql_test 2.0 {
+  CREATE TABLE t1(k TEXT UNIQUE, v INTEGER);
+  INSERT INTO t1 VALUES
+    ('aback', 1),
+    ('abaft', 2),
+    ('abandon', 3),
+    ('abandoned', 4),
+    ('abandoning', 5),
+    ('abandonment', 6),
+    ('abandons', 7),
+    ('abase', 8),
+    ('abased', 9),
+    ('abasement', 10),
+    ('abasements', 11),
+    ('abases', 12),
+    ('abash', 13),
+    ('abashed', 14),
+    ('abashes', 15),
+    ('abashing', 16),
+    ('abasing', 17),
+    ('abate', 18),
+    ('abated', 19),
+    ('abatement', 20),
+    ('abatements', 21);
+}
+
+foreach {tn INPUT expected} {
+  1 abatementt   abatement
+  2 abashet      abash
+  3 abandonio    abandon
+  4 abasemenu    abase
+} {
+  do_execsql_test 2.$tn {
+    WITH finder(str) AS (
+      SELECT (SELECT max(k) FROM t1 WHERE k<=$INPUT)
+        UNION ALL
+        SELECT (
+          SELECT max(k) FROM t1 
+          WHERE k<=substr($INPUT, 1, prefix_length(finder.str, $INPUT))
+        ) FROM finder WHERE length(finder.str)>0
+      )
+    SELECT str FROM finder WHERE length(str)==prefix_length(str, $INPUT) LIMIT 1
+  } $expected
+}
+
+finish_test

Index: test/releasetest.tcl
==================================================================
--- test/releasetest.tcl
+++ test/releasetest.tcl
@@ -77,10 +77,13 @@
   "Unlock-Notify" {
     -O2
     -DSQLITE_ENABLE_UNLOCK_NOTIFY
     -DSQLITE_THREADSAFE
     -DSQLITE_TCL_DEFAULT_FULLMUTEX=1
+  }
+  "User-Auth" {
+    -O2
     -DSQLITE_USER_AUTHENTICATION=1
   }
   "Secure-Delete" {
     -O2
     -DSQLITE_SECURE_DELETE=1
@@ -272,10 +275,11 @@
     "Fast-One"                "fuzztest test"
     "Debug-One"               "mptest test"
     "Have-Not"                test
     "Secure-Delete"           test
     "Unlock-Notify"           "QUICKTEST_INCLUDE=notify2.test test"
+    "User-Auth"               tcltest
     "Update-Delete-Limit"     test
     "Extra-Robustness"        test
     "Device-Two"              test
     "No-lookaside"            test
     "Devkit"                  test

Index: test/resetdb.test
==================================================================
--- test/resetdb.test
+++ test/resetdb.test
@@ -63,27 +63,32 @@
 } {210 6000 ok delete 8}
 
 do_test 200 {
   # Thoroughly corrupt the database file by overwriting the first
   # page with randomness.
+  sqlite3_db_config db DEFENSIVE 0
   catchsql {
     UPDATE sqlite_dbpage SET data=randomblob(4096) WHERE pgno=1;
     PRAGMA quick_check;
   }
-} {1 {unsupported file format}}
+} {1 {file is not a database}}
 do_test 201 {
   catchsql {
     PRAGMA quick_check;
   } db2
-} {1 {unsupported file format}}
+} {1 {file is not a database}}
 
 do_test 210 {
   # Reset the database file using SQLITE_DBCONFIG_RESET_DATABASE
   sqlite3_db_config db RESET_DB 1
   db eval VACUUM
   sqlite3_db_config db RESET_DB 0
 
+  # If using sqlite3_prepare() instead of _v2() or _v3(), the block 
+  # below raises an SQLITE_SCHEMA error. The following fixes this.
+  if {[permutation]=="prepare"} { catchsql "SELECT * FROM sqlite_master" db2 }
+
   # Verify that the reset took, even on the separate database connection
   catchsql {
      PRAGMA page_count;
      PRAGMA page_size;
      PRAGMA quick_check;
@@ -123,10 +128,11 @@
     PRAGMA page_count;
   } db2
 } {210 26000 ok wal 8192 12}
 
 # Corrupt the database again
+sqlite3_db_config db DEFENSIVE 0
 do_catchsql_test 320 {
   UPDATE sqlite_dbpage SET data=randomblob(8192) WHERE pgno=1;
   PRAGMA quick_check
 } {1 {file is not a database}}
 
@@ -226,10 +232,11 @@
 if {[nonzero_reserved_bytes]} {
   finish_test
   return
 }
 
+sqlite3_db_config db DEFENSIVE 0
 do_execsql_test 710 {
   UPDATE sqlite_dbpage SET data=
     X'53514C69746520666F726D61742033000200030100402020000000000000001300000000000000000000000300000004000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000D00000003017C0001D801AC017C00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002E03061715110145696E6465787431626374310443524541544520494E4445582074316263204F4E20743128622C63292A0206171311013F696E64657874316174310343524541544520494E44455820743161204F4E20743128612926010617111101397461626C657431743102435245415445205441424C4520743128612C622C6329' WHERE pgno=1;
 }
 

Index: test/rowvalue4.test
==================================================================
--- test/rowvalue4.test
+++ test/rowvalue4.test
@@ -233,13 +233,13 @@
     (a, b) IN (SELECT x, y FROM d1) AND
     (c) IN (SELECT y FROM d1)
 } {
   QUERY PLAN
   |--SEARCH TABLE d2 USING INDEX d2ab (a=? AND b=?)
-  |--LIST SUBQUERY
+  |--LIST SUBQUERY xxxxxx
   |  `--SCAN TABLE d1
-  `--LIST SUBQUERY
+  `--LIST SUBQUERY xxxxxx
      `--SCAN TABLE d1
 }
 
 do_execsql_test 6.0 {
   CREATE TABLE e1(a, b, c, d, e);

Index: test/select1.test
==================================================================
--- test/select1.test
+++ test/select1.test
@@ -1078,7 +1078,26 @@
 
 # 2015-04-17:  assertion fix.
 do_catchsql_test select1-16.2 {
   SELECT 1 FROM sqlite_master LIMIT 1,#1;
 } {1 {near "#1": syntax error}}
-  
+
+# 2019-01-16 Chromium bug 922312
+# Sorting with a LIMIT clause using SRT_EphemTab and SRT_Table
+#
+do_execsql_test select1-17.1 {
+  DROP TABLE IF EXISTS t1;
+  DROP TABLE IF EXISTS t2;
+  CREATE TABLE t1(x);   INSERT INTO t1 VALUES(1);
+  CREATE TABLE t2(y,z); INSERT INTO t2 VALUES(2,3);
+  CREATE INDEX t2y ON t2(y);
+  SELECT * FROM t1,(SELECT * FROM t2 WHERE y=2 ORDER BY y,z);
+} {1 2 3}
+do_execsql_test select1-17.2 {
+  SELECT * FROM t1,(SELECT * FROM t2 WHERE y=2 ORDER BY y,z LIMIT 4);
+} {1 2 3}
+do_execsql_test select1-17.3 {
+  SELECT * FROM t1,(SELECT * FROM t2 WHERE y=2
+         UNION ALL SELECT * FROM t2 WHERE y=3 ORDER BY y,z LIMIT 4);
+} {1 2 3}
+
 finish_test

Index: test/shared8.test
==================================================================
--- test/shared8.test
+++ test/shared8.test
@@ -60,10 +60,11 @@
     SELECT * FROM v1;
   } db1
 } {1 i 2 ii 3 iii 4 iv}
 
 do_test 1.1 {
+  sqlite3_db_config db1 DEFENSIVE 0
   execsql { 
     PRAGMA writable_schema = 1;
     DELETE FROM sqlite_master WHERE 1;
     PRAGMA writable_schema = 0;
     SELECT * FROM sqlite_master;

Index: test/shell1.test
==================================================================
--- test/shell1.test
+++ test/shell1.test
@@ -254,11 +254,11 @@
   catchcmd "test.db" ".backup FOO BAR"
 } {1 {Error: unknown database FOO}}
 do_test shell1-3.1.4 {
   # too many arguments
   catchcmd "test.db" ".backup FOO BAR BAD"
-} {1 {Usage: .backup ?DB? ?--append? FILENAME}}
+} {1 {Usage: .backup ?DB? ?OPTIONS? FILENAME}}
 
 # .bail ON|OFF           Stop after hitting an error.  Default OFF
 do_test shell1-3.2.1 {
   catchcmd "test.db" ".bail"
 } {1 {Usage: .bail on|off}}

Index: test/shell4.test
==================================================================
--- test/shell4.test
+++ test/shell4.test
@@ -105,18 +105,18 @@
        [regexp {Heap Usage} $res] \
        [regexp {Autoindex Inserts} $res]
 } {1 1 1}
 
 do_test shell4-2.1 {
-  catchcmd ":memory:" "CREATE TABLE t1(x);\n.trace"
-} {1 {Usage: .trace FILE|off}}
+  catchcmd ":memory:" "CREATE TABLE t1(x);\n.trace --unknown"
+} {1 {Unknown option "--unknown" on ".trace"}}
 do_test shell4-2.2 {
   catchcmd ":memory:" "CREATE TABLE t1(x);\n.trace off\n.trace off\n"
 } {0 {}}
 do_test shell4-2.3 {
-  catchcmd ":memory:" ".trace stdout\n.trace\n.trace off\n.dump\n"
-} {/^1 {PRAGMA.*Usage:.*}$/}
+  catchcmd ":memory:" ".trace stdout\n.dump\n.trace off\n"
+} {/^0 {PRAGMA.*}$/}
 ifcapable trace {
 do_test shell4-2.4 {
   catchcmd ":memory:" ".trace stdout\nCREATE TABLE t1(x);SELECT * FROM t1;"
 } {0 {CREATE TABLE t1(x);
 SELECT * FROM t1;}}

ADDED   test/shmlock.test
Index: test/shmlock.test
==================================================================
--- /dev/null
+++ test/shmlock.test
@@ -0,0 +1,180 @@
+# 2018 December 6
+#
+# The author disclaims copyright to this source code.  In place of
+# a legal notice, here is a blessing:
+#
+#    May you do good and not evil.
+#    May you find forgiveness for yourself and forgive others.
+#    May you share freely, never taking more than you give.
+#
+#***********************************************************************
+#
+
+set testdir [file dirname $argv0]
+source $testdir/tester.tcl
+
+set testprefix shmlock
+
+ifcapable !wal {finish_test ; return }
+
+sqlite3 db2 test.db
+sqlite3 db3 test.db
+
+do_execsql_test 1.0 {
+  PRAGMA journal_mode = wal;
+  CREATE TABLE t1(a, b);
+  INSERT INTO t1 VALUES(1, 2);
+} {wal}
+do_test 1.1 { execsql { SELECT * FROM t1 } db2 } {1 2}
+do_test 1.2 { execsql { SELECT * FROM t1 } db3 } {1 2}
+
+foreach {tn dbhandle cmd res} {
+  1    db  {shared    lock   7 1}    OK
+  2    db2 {exclusive lock   7 1}    BUSY
+  3    db  {shared    unlock 7 1}    OK
+  4    db2 {exclusive lock   7 1}    OK
+  5    db  {shared    lock   7 1}    BUSY
+  6    db  {exclusive lock   7 1}    BUSY
+  7    db2 {exclusive unlock 7 1}    OK
+
+  8    db  {exclusive lock   0 8}    OK
+  9    db  {exclusive unlock 0 8}    OK
+  10   db2 {exclusive lock   0 8}    OK
+  11   db2 {exclusive unlock 0 8}    OK
+
+  12   db  {shared    lock   0 1}    OK
+  13   db2 {shared    lock   0 1}    OK
+  14   db3 {shared    lock   0 1}    OK
+  15   db3 {shared    unlock 0 1}    OK
+  16   db3 {exclusive lock   0 1}    BUSY
+  17   db2 {shared    unlock 0 1}    OK
+  18   db3 {exclusive lock   0 1}    BUSY
+  19   db  {shared    unlock 0 1}    OK
+  20   db3 {exclusive lock   0 1}    OK
+  21   db3 {exclusive unlock 0 1}    OK
+
+  22   db  {shared    lock   3 1}    OK
+  23   db2 {exclusive lock   2 2}    BUSY
+  24   db  {shared    lock   2 1}    OK
+  25   db2 {exclusive lock   0 5}    BUSY
+  26   db2 {exclusive lock   0 4}    BUSY
+  27   db2 {exclusive lock   0 3}    BUSY
+  28   db  {shared    unlock 3 1}    OK
+  29   db2 {exclusive lock   2 2}    BUSY
+  28   db  {shared    unlock 2 1}    OK
+  29   db2 {exclusive lock   2 2}    OK
+  29   db2 {exclusive unlock 2 2}    OK
+} {
+  do_test 1.3.$tn [list vfs_shmlock $dbhandle main {*}$cmd] "SQLITE_$res"
+}
+
+db  close
+db2 close
+db3 close
+
+if {[permutation]=="unix-excl"} {
+  do_test 2.0 {
+    for {set i 0} {$i < 256} {incr i} { 
+      sqlite3 db$i test.db 
+      execsql { SELECT * FROM t1 } db$i
+    }
+    for {set i 0} {$i < 255} {incr i} { 
+      set rc [vfs_shmlock db$i main shared lock 4 1]
+      if {$rc != "SQLITE_OK"} { error $rc }
+    }
+
+    vfs_shmlock db255 main shared lock 4 1
+  } {SQLITE_BUSY}
+
+  do_test 2.1 { vfs_shmlock db255 main exclusive lock   4 1 } SQLITE_BUSY
+  do_test 2.2 { vfs_shmlock db0   main shared    unlock 4 1 } SQLITE_OK
+  do_test 2.3 { vfs_shmlock db255 main shared    lock   4 1 } SQLITE_OK
+  do_test 2.4 { vfs_shmlock db255 main shared    unlock 4 1 } SQLITE_OK
+  do_test 2.5 { vfs_shmlock db255 main exclusive lock   4 1 } SQLITE_BUSY
+
+  do_test 2.6 {
+    for {set i 1} {$i < 255} {incr i} { 
+      set rc [vfs_shmlock db255 main exclusive lock 4 1]
+      if {$rc != "SQLITE_BUSY"} { error $rc }
+      set rc [vfs_shmlock db$i main shared unlock 4 1]
+      if {$rc != "SQLITE_OK"} { error $rc }
+    }
+
+    vfs_shmlock db255 main exclusive lock 4 1
+  } {SQLITE_OK}
+
+  vfs_shmlock db255 main exclusive unlock 4 1
+
+  for {set i 0} {$i < 256} {incr i} {
+    db$i close
+  }
+}
+
+sqlite3 db0 test.db
+sqlite3 db1 test.db
+do_test 3.1 { execsql { SELECT * FROM t1 } db0 } {1 2}
+do_test 3.2 { execsql { SELECT * FROM t1 } db1 } {1 2}
+if {$tcl_platform(platform)=="windows"} {
+  set isWindows 1
+} else {
+  set isWindows 0
+}
+
+set L(0) {n n n n n n n n}
+set L(1) {n n n n n n n n}
+proc random_lock_test {idx} {
+  global L
+  set iSlot [expr int(rand()*8)]
+  if {[expr int(rand()*2)]} {
+    # Unlock operation
+    if {[lindex $L($idx) $iSlot]!="n"} {
+      vfs_shmlock db$idx main [lindex $L($idx) $iSlot] unlock $iSlot 1
+      lset L($idx) $iSlot n
+    }
+  } else {
+    # Lock operation
+    if {[lindex $L($idx) $iSlot]=="n"} {
+      set locktype [lindex {e s} [expr int(rand()*2)]]
+      set n 1
+      if {$locktype=="e"} {
+        for {set l $iSlot} {$l<8 && [lindex $L($idx) $l]=="n"} {incr l} {}
+        set n [expr int(rand()*($l-$iSlot))+1]
+        # The LockFile() and UnlockFile() apis on windows require that
+        # every unlock correspond exactly to a prior lock.  Hence, we cannot
+        # lock arbitrary ranges in this test on windows.
+        if {$::isWindows} {set n 1}
+        # puts "iSlot=$iSlot l=$l L=$L($idx)"
+        # puts "$iSlot $n"
+      }
+      set res [vfs_shmlock db$idx main $locktype lock $iSlot $n]
+
+      set bBusy 0
+      for {set i $iSlot} {$i<($iSlot+$n)} {incr i} {
+        set other [lindex $L([expr ($idx+1)%2]) $i]
+        if {($other!="n" && $locktype=="e")||($other=="e" && $locktype=="s")} {
+          if {$res != "SQLITE_BUSY"} { error "BUSY not detected" }
+          set bBusy 1
+          break
+        } 
+      }
+
+      if {$bBusy==0} {
+        if {$res != "SQLITE_OK"} { error "BUSY false-positive" }
+        for {set i $iSlot} {$i<($iSlot+$n)} {incr i} {
+          lset L($idx) $i $locktype
+        }
+      }
+    }
+  }
+}
+
+set nStep 100000
+for {set i 0} {$i < $nStep} {incr i} {
+  random_lock_test 0
+  random_lock_test 1
+}
+
+db0 close
+db1 close
+
+finish_test

Index: test/snapshot2.test
==================================================================
--- test/snapshot2.test
+++ test/snapshot2.test
@@ -236,6 +236,5 @@
   list [catch { sqlite3_snapshot_open_blob db2 main $snap } msg] $msg
 } {1 SQLITE_ERROR_SNAPSHOT}
 
 
 finish_test
-

Index: test/snapshot3.test
==================================================================
--- test/snapshot3.test
+++ test/snapshot3.test
@@ -95,6 +95,5 @@
   execsql BEGIN db3
   list [catch { sqlite3_snapshot_open_blob db3 main $snap } msg] $msg
 } {1 SQLITE_ERROR_SNAPSHOT}
 
 finish_test
-

Index: test/snapshot4.test
==================================================================
--- test/snapshot4.test
+++ test/snapshot4.test
@@ -70,6 +70,5 @@
   } 
 } {100}
 
 
 finish_test
-

Index: test/snapshot_fault.test
==================================================================
--- test/snapshot_fault.test
+++ test/snapshot_fault.test
@@ -219,8 +219,33 @@
   sqlite3_snapshot_recover db main
 } -test {
   faultsim_test_result {0 {}} {1 SQLITE_IOERR}
 }
 
+#-------------------------------------------------------------------------
+# Test the handling of faults that occur within sqlite3_snapshot_get().
+#
+reset_db
+do_execsql_test 5.0 {
+  PRAGMA page_size = 512;
+  PRAGMA journal_mode = wal;
+  PRAGMA wal_autocheckpoint = 0;
+  CREATE TABLE t1(zzz);
+  INSERT INTO t1 VALUES(randomblob( 5000 ));
+  PRAGMA user_version = 211;
+} {wal 0}
+faultsim_save_and_close
+
+do_faultsim_test 5 -prep {
+  faultsim_restore_and_reopen
+  execsql { SELECT count(*) FROM sqlite_master }
+  execsql BEGIN
+} -body {
+  sqlite3_snapshot_get_blob db main
+  set {} {}
+} -test {
+  execsql END
+  faultsim_test_result {0 {}} {1 SQLITE_IOERR} {1 SQLITE_NOMEM}
+}
 
 
 finish_test

Index: test/snapshot_up.test
==================================================================
--- test/snapshot_up.test
+++ test/snapshot_up.test
@@ -179,6 +179,5 @@
 
 sqlite3_snapshot_free $::snap1
 sqlite3_snapshot_free $::snap2
 
 finish_test
-

Index: test/swarmvtab3.test
==================================================================
--- test/swarmvtab3.test
+++ test/swarmvtab3.test
@@ -229,6 +229,5 @@
 db close
 forcedelete {*}[glob test.db*]
 forcedelete {*}[glob test_remote.db*]
 
 finish_test
-

Index: test/swarmvtabfault.test
==================================================================
--- test/swarmvtabfault.test
+++ test/swarmvtabfault.test
@@ -61,6 +61,5 @@
 } -test {
   faultsim_test_result {0 {1 2 9}} {1 {sql error: out of memory}}
 }
 
 finish_test
-

Index: test/tabfunc01.test
==================================================================
--- test/tabfunc01.test
+++ test/tabfunc01.test
@@ -122,10 +122,15 @@
 do_execsql_test tabfunc01-4.3 {
   ATTACH ':memory:' AS aux1;
   CREATE TABLE aux1.t1(a,b,c);
   SELECT * FROM aux1.generate_series(1,4)
 } {1 2 3 4}
+
+# 2018-12-03: Fix bug reported by by private email.
+do_execsql_test tabfunc01-4.4 {
+  SELECT * FROM (generate_series(1,5,2)) AS x LIMIT 10;
+} {1 3 5}
 
 # The next series of tests is verifying that virtual table are able
 # to optimize the IN operator, even on terms that are not marked "omit".
 # When the generate_series virtual table is compiled for the testfixture,
 # the special -DSQLITE_SERIES_CONSTRAINT_VERIFY=1 option is used, which

Index: test/table.test
==================================================================
--- test/table.test
+++ test/table.test
@@ -274,10 +274,11 @@
 
 do_test table-5.2.2 {
   db close
   forcedelete test.db
   sqlite3 db test.db
+  sqlite3_db_config db DEFENSIVE 0
   db eval {
     CREATE TABLE t0(a,b);
     CREATE INDEX t ON t0(a);
     PRAGMA writable_schema=ON;
     UPDATE sqlite_master SET sql='CREATE TABLE a.b(a UNIQUE';

Index: test/tempdb2.test
==================================================================
--- test/tempdb2.test
+++ test/tempdb2.test
@@ -74,6 +74,27 @@
 
 do_execsql_test 1.4 {
   SELECT b=int2str(2) FROM t1
 } {1 1 1}
 
+#-------------------------------------------------------------------------
+db close
+sqlite3 db ""
+db func int2str int2str
+
+do_execsql_test 2.0 {
+  PRAGMA cache_size = -100;
+  CREATE TABLE t1(a INTEGER PRIMARY KEY, b);
+  WITH c(x) AS ( VALUES(1) UNION ALL SELECT x+1 FROM c WHERE x<100 ) 
+    INSERT INTO t1 SELECT x, int2str(x) FROM c;
+}
+
+do_execsql_test 2.1 {
+  INSERT INTO t1 VALUES(10001, int2str(1001) || int2str(1001) || int2str(1001));
+}
+
+do_execsql_test 2.2 {
+  SELECT b FROM t1 WHERE a = 10001;
+} "[int2str 1001][int2str 1001][int2str 1001]"
+
 finish_test
+

Index: test/tester.tcl
==================================================================
--- test/tester.tcl
+++ test/tester.tcl
@@ -939,10 +939,16 @@
   if {[llength $args]==2} {
     foreach {testname sql} $args {}
     set result ""
   } elseif {[llength $args]==3} {
     foreach {testname sql result} $args {}
+
+    # With some versions of Tcl on windows, if $result is all whitespace but
+    # contains some CR/LF characters, the [list {*}$result] below returns a
+    # copy of $result instead of a zero length string. Not clear exactly why
+    # this is. The following is a workaround.
+    if {[llength $result]==0} { set result "" }
   } else {
     error [string trim {
       wrong # args: should be "do_execsql_test ?-db DB? testname sql ?result?"
     }]
   }

Index: test/trigger7.test
==================================================================
--- test/trigger7.test
+++ test/trigger7.test
@@ -104,10 +104,11 @@
 
 # This test corrupts the database file so it must be the last test
 # in the series.
 #
 do_test trigger7-99.1 {
+  sqlite3_db_config db DEFENSIVE 0
   execsql {
     PRAGMA writable_schema=on;
     UPDATE sqlite_master SET sql='nonsense';
   }
   db close

Index: test/triggerC.test
==================================================================
--- test/triggerC.test
+++ test/triggerC.test
@@ -1040,6 +1040,22 @@
 }
 
 do_execsql_test 15.2.2 { SELECT * FROM x2;       } {1 2 3 4}
 do_execsql_test 15.2.3 { SELECT * FROM """x2"""; } {3 11 x y}
 
+#-------------------------------------------------------------------------
+# At one point queries such as the following were causing segfaults.
+#
+do_catchsql_test 16.1 {
+  SELECT raise(ABORT, 'msg') FROM sqlite_master 
+  UNION SELECT 1 
+  ORDER BY raise(IGNORE);
+} {1 {1st ORDER BY term does not match any column in the result set}}
+
+do_catchsql_test 16.2 {
+  SELECT count(*) FROM sqlite_master 
+  GROUP BY raise(IGNORE) 
+  HAVING raise(ABORT, 'msg');
+} {1 {RAISE() may only be used within a trigger-program}}
+
 finish_test
+

Index: test/triggerE.test
==================================================================
--- test/triggerE.test
+++ test/triggerE.test
@@ -66,10 +66,11 @@
 
 #-------------------------------------------------------------------------
 # Test that variable references within trigger definitions loaded from 
 # the sqlite_master table are automatically converted to NULL.
 #
+sqlite3_db_config db DEFENSIVE 0
 do_execsql_test 2.1 {
   PRAGMA writable_schema = 1;
   INSERT INTO sqlite_master VALUES('trigger', 'tr1', 't1', 0,
     'CREATE TRIGGER tr1 AFTER INSERT ON t1 BEGIN 
         INSERT INTO t2 VALUES(?1, ?2); 

Index: test/triggerF.test
==================================================================
--- test/triggerF.test
+++ test/triggerF.test
@@ -18,11 +18,11 @@
   return
 }
 
 
 foreach {tn sql log} {
-  1 { } { }
+  1 {} {}
 
   2 { 
     CREATE TRIGGER trd AFTER DELETE ON t1 BEGIN
       INSERT INTO log VALUES(old.a || old.b || (SELECT count(*) FROM t1));
     END;

Index: test/unionvtab.test
==================================================================
--- test/unionvtab.test
+++ test/unionvtab.test
@@ -371,11 +371,11 @@
 } {
   -9223372036854775808 one
 }
 do_execsql_test 4.3.4 {
   SELECT * FROM sl WHERE rowid<-9223372036854775808
-} { }
+} {}
 
 do_execsql_test 4.4.1 {
   SELECT * FROM sl WHERE rowid<9223372036854775807
 } {
   -9223372036854775808 one -9223372036854775807 two -9223372036854775806 three
@@ -392,11 +392,11 @@
 } {
   9223372036854775807 six
 }
 do_execsql_test 4.4.4 {
   SELECT * FROM sl WHERE rowid>9223372036854775807
-} { }
+} {}
 
 #-------------------------------------------------------------------------
 # More than 8 source tables.
 #
 do_execsql_test 5.0 {
@@ -453,6 +453,5 @@
 do_execsql_test 5.4 {
   SELECT * FROM cc WHERE two LIKE '6'
 } {six 6}
 
 finish_test
-

Index: test/unionvtabfault.test
==================================================================
--- test/unionvtabfault.test
+++ test/unionvtabfault.test
@@ -79,6 +79,5 @@
 }
 
 
 
 finish_test
-

Index: test/update2.test
==================================================================
--- test/update2.test
+++ test/update2.test
@@ -213,7 +213,23 @@
 }
 
 do_execsql_test 6.2 {
   SELECT * FROM d1;
 } {3 2}
+
+# 2019-01-22 Bug in UPDATE OR REPLACE discovered by the 
+# Matt Denton's LPM fuzzer
+#
+do_execsql_test 7.100 {
+  DROP TABLE IF EXISTS t1;
+  CREATE TABLE t1(x,y);
+  CREATE UNIQUE INDEX t1x1 ON t1(x) WHERE x IS NOT NULL;
+  INSERT INTO t1(x) VALUES(NULL),(NULL);
+  CREATE INDEX t1x2 ON t1(y);
+  SELECT quote(x), quote(y), '|' FROM t1;
+} {NULL NULL | NULL NULL |}
+do_execsql_test 7.110 {
+  UPDATE OR REPLACE t1 SET x=1;
+  SELECT quote(x), quote(y), '|' FROM t1;
+} {1 NULL |}
 
 finish_test

ADDED   test/vacuum-into.test
Index: test/vacuum-into.test
==================================================================
--- /dev/null
+++ test/vacuum-into.test
@@ -0,0 +1,90 @@
+# 2018-12-07
+#
+# The author disclaims copyright to this source code.  In place of
+# a legal notice, here is a blessing:
+#
+#    May you do good and not evil.
+#    May you find forgiveness for yourself and forgive others.
+#    May you share freely, never taking more than you give.
+#
+#***********************************************************************
+# This file implements regression tests for SQLite library.  The
+# focus of this file is testing the VACUUM INTO statement.
+#
+
+set testdir [file dirname $argv0]
+source $testdir/tester.tcl
+
+# If the VACUUM statement is disabled in the current build, skip all
+# the tests in this file.
+#
+ifcapable {!vacuum} {
+  omit_test vacuum.test {Compiled with SQLITE_OMIT_VACUUM}
+  finish_test
+  return
+}
+
+forcedelete out.db
+do_execsql_test vacuum-into-100 {
+  CREATE TABLE t1(a INTEGER PRIMARY KEY, b);
+  WITH RECURSIVE c(x) AS (VALUES(1) UNION ALL SELECT x+1 FROM c WHERE x<100)
+  INSERT INTO t1(a,b) SELECT x, randomblob(600) FROM c;
+  CREATE INDEX t1b ON t1(b);
+  DELETE FROM t1 WHERE a%2;
+  SELECT count(*), sum(a), sum(length(b)) FROM t1;
+} {50 2550 30000}
+do_execsql_test vacuum-into-110 {
+  VACUUM main INTO 'out.db';
+} {}
+sqlite3 db2 out.db
+do_test vacuum-into-120 {
+  db2 eval {SELECT count(*), sum(a), sum(length(b)) FROM t1}
+} {50 2550 30000}
+do_catchsql_test vacuum-into-130 {
+  VACUUM INTO 'out.db';
+} {1 {output file already exists}}
+forcedelete out2.db
+do_catchsql_test vacuum-into-140 {
+  VACUUM INTO 'out2.db';
+} {0 {}}
+do_catchsql_test vacuum-into-150 {
+  VACUUM INTO 'out2.db';
+} {1 {output file already exists}}
+
+do_catchsql_test vacuum-into-200 {
+  VACUUM main INTO ':memory:';
+} {0 {}}
+
+# The INTO argument can be an arbitrary expression.
+#
+do_execsql_test vacuum-into-300 {
+  CREATE TABLE t2(name TEXT);
+  INSERT INTO t2 VALUES(':memory:');
+  VACUUM main INTO (SELECT name FROM t2);
+} {}
+do_catchsql_test vacuum-into-310 {
+  VACUUM INTO null;
+} {1 {non-text filename}}
+do_catchsql_test vacuum-into-320 {
+  VACUUM INTO x;
+} {1 {no such column: x}}
+do_catchsql_test vacuum-into-330 {
+  VACUUM INTO t1.nosuchcol;
+} {1 {no such column: t1.nosuchcol}}
+do_catchsql_test vacuum-into-340 {
+  VACUUM INTO main.t1.nosuchcol;
+} {1 {no such column: main.t1.nosuchcol}}
+
+forcedelete test.db2
+db func target target
+proc target {} { return "test.db2" }
+do_test vacuum-into-410 {
+  execsql { VACUUM INTO target() }
+  file exists test.db2
+} 1
+do_catchsql_test vacuum-into-420 {
+  VACUUM INTO target2()
+} {1 {no such function: target2}}
+
+
+finish_test

Index: test/vtab1.test
==================================================================
--- test/vtab1.test
+++ test/vtab1.test
@@ -1251,10 +1251,11 @@
 # an error message was set using a call similar to sqlite3_mprintf(zErr),
 # where zErr is an arbitrary string. This is no good if the string contains
 # characters that can be mistaken for printf() formatting directives.
 #
 do_test vtab1-17.1 {
+  sqlite3_db_config db DEFENSIVE 0
   execsql { 
     PRAGMA writable_schema = 1;
     INSERT INTO sqlite_master VALUES(
       'table', 't3', 't3', 0, 'INSERT INTO "%s%s" VALUES(1)'
     );

Index: test/vtab_err.test
==================================================================
--- test/vtab_err.test
+++ test/vtab_err.test
@@ -18,11 +18,10 @@
   finish_test
   return
 }
 
 
-
 unset -nocomplain echo_module_begin_fail
 do_ioerr_test vtab_err-1 -tclprep {
   register_echo_module [sqlite3_connection_pointer db]
 } -sqlbody {
   BEGIN;
@@ -60,7 +59,29 @@
     INSERT INTO e SELECT a||'x', b, c FROM r2;
   COMMIT;
 } 
 
 sqlite3_memdebug_fail -1
+
+reset_db
+register_echo_module [sqlite3_connection_pointer db]
+do_execsql_test vtab_err-3.0 {
+  CREATE TABLE r(a PRIMARY KEY, b, c);
+  CREATE VIRTUAL TABLE e USING echo(r);
+}
+faultsim_save_and_close
+
+do_faultsim_test vtab_err-3 -faults oom-t* -prep {
+  faultsim_restore_and_reopen
+  register_echo_module [sqlite3_connection_pointer db]
+} -body {
+  execsql {
+    BEGIN;
+      CREATE TABLE xyz(x);
+      SELECT a FROM e;
+    COMMIT;
+  }
+} -test {
+  faultsim_test_result {0 {}}
+}
 
 finish_test

ADDED   test/vtabdrop.test
Index: test/vtabdrop.test
==================================================================
--- /dev/null
+++ test/vtabdrop.test
@@ -0,0 +1,127 @@
+# 2018 December 28
+#
+#    May you do good and not evil.
+#    May you find forgiveness for yourself and forgive others.
+#    May you share freely, never taking more than you give.
+#
+#***********************************************************************
+#
+# The tests in this file test edge cases surrounding DROP TABLE on 
+# virtual tables.
+#
+
+set testdir [file dirname $argv0]
+source $testdir/tester.tcl
+
+ifcapable !vtab { finish_test ; return }
+source $testdir/fts3_common.tcl
+source $testdir/malloc_common.tcl
+
+set testprefix vtabdrop
+
+#-------------------------------------------------------------------------
+# Test that if a DROP TABLE is executed against an rtree table, but the
+# xDestroy() call fails, the rtree table is not dropped, the sqlite_master
+# table is not modified and the internal schema remains intact.
+# 
+ifcapable rtree {
+  do_execsql_test 1.0 {
+    CREATE VIRTUAL TABLE rt USING rtree(id, x1, x2);
+    CREATE TABLE t1(x, y);
+    INSERT INTO t1 VALUES(1, 2);
+  }
+  
+  do_test 1.1 {
+    execsql {
+      BEGIN;
+        INSERT INTO t1 VALUES(3, 4);
+    }
+    db eval { SELECT * FROM t1 } {
+      catchsql { DROP TABLE rt }
+    }
+    execsql COMMIT
+  } {}
+  
+  do_execsql_test 1.2 {
+    SELECT name FROM sqlite_master ORDER BY 1;
+    SELECT * FROM t1;
+    SELECT * FROM rt;
+  } {rt rt_node rt_parent rt_rowid t1 1 2 3 4}
+  
+  db close
+  sqlite3 db test.db
+  
+  do_execsql_test 1.3 {
+    SELECT name FROM sqlite_master ORDER BY 1;
+  } {rt rt_node rt_parent rt_rowid t1}
+}
+
+#-------------------------------------------------------------------------
+# Same as tests 1.*, except with fts5 instead of rtree.
+# 
+ifcapable fts5 {
+  reset_db
+  do_execsql_test 2.0 {
+    CREATE VIRTUAL TABLE ft USING fts5(x);
+    CREATE TABLE t1(x, y);
+    INSERT INTO t1 VALUES(1, 2);
+  }
+  
+  do_test 2.1 {
+    execsql {
+      BEGIN;
+        INSERT INTO t1 VALUES(3, 4);
+    }
+    db eval { SELECT * FROM t1 } {
+      catchsql { DROP TABLE ft }
+    }
+    execsql COMMIT
+  } {}
+  
+  do_execsql_test 2.2 {
+    SELECT name FROM sqlite_master ORDER BY 1;
+  } {ft ft_config ft_content ft_data ft_docsize ft_idx t1}
+  
+  db close
+  sqlite3 db test.db
+  
+  do_execsql_test 2.3 {
+    SELECT name FROM sqlite_master ORDER BY 1;
+  } {ft ft_config ft_content ft_data ft_docsize ft_idx t1}
+}
+
+#-------------------------------------------------------------------------
+# Same as tests 1.*, except with fts3 instead of rtree.
+# 
+ifcapable fts3 {
+  reset_db
+  do_execsql_test 2.0 {
+    CREATE VIRTUAL TABLE ft USING fts3(x);
+    CREATE TABLE t1(x, y);
+    INSERT INTO t1 VALUES(1, 2);
+  }
+  
+  do_test 2.1 {
+    execsql {
+      BEGIN;
+        INSERT INTO t1 VALUES(3, 4);
+    }
+    db eval { SELECT * FROM t1 } {
+      catchsql { DROP TABLE ft }
+    }
+    execsql COMMIT
+  } {}
+  
+  do_execsql_test 2.2 {
+    SELECT name FROM sqlite_master ORDER BY 1;
+  } {ft ft_content ft_segdir ft_segments sqlite_autoindex_ft_segdir_1 t1}
+  
+  db close
+  sqlite3 db test.db
+  
+  do_execsql_test 2.3 {
+    SELECT name FROM sqlite_master ORDER BY 1;
+  } {ft ft_content ft_segdir ft_segments sqlite_autoindex_ft_segdir_1 t1}
+}
+
+finish_test

Index: test/wal.test
==================================================================
--- test/wal.test
+++ test/wal.test
@@ -1295,55 +1295,57 @@
 #      the data is present and the database is not corrupt.
 #
 # At one point, SQLite was failing to grow the mapping of the wal-index
 # file in step 3 and the checkpoint was corrupting the database file.
 #
-do_test wal-20.1 {
-  catch {db close}
-  forcedelete test.db test.db-wal test.db-journal
-  sqlite3 db test.db
-  execsql {
-    PRAGMA journal_mode = WAL;
-    CREATE TABLE t1(x);
-    INSERT INTO t1 VALUES(randomblob(900));
-    SELECT count(*) FROM t1;
-  }
-} {wal 1}
-do_test wal-20.2 {
-  set ::buddy [launch_testfixture]
-  testfixture $::buddy {
-    sqlite3 db test.db
-    db transaction { db eval {
-      PRAGMA wal_autocheckpoint = 0;
-      INSERT INTO t1 SELECT randomblob(900) FROM t1;       /* 2 */
-      INSERT INTO t1 SELECT randomblob(900) FROM t1;       /* 4 */
-      INSERT INTO t1 SELECT randomblob(900) FROM t1;       /* 8 */
-      INSERT INTO t1 SELECT randomblob(900) FROM t1;       /* 16 */
-      INSERT INTO t1 SELECT randomblob(900) FROM t1;       /* 32 */
-      INSERT INTO t1 SELECT randomblob(900) FROM t1;       /* 64 */
-      INSERT INTO t1 SELECT randomblob(900) FROM t1;       /* 128 */
-      INSERT INTO t1 SELECT randomblob(900) FROM t1;       /* 256 */
-      INSERT INTO t1 SELECT randomblob(900) FROM t1;       /* 512 */
-      INSERT INTO t1 SELECT randomblob(900) FROM t1;       /* 1024 */
-      INSERT INTO t1 SELECT randomblob(900) FROM t1;       /* 2048 */
-      INSERT INTO t1 SELECT randomblob(900) FROM t1;       /* 4096 */
-      INSERT INTO t1 SELECT randomblob(900) FROM t1;       /* 8192 */
-      INSERT INTO t1 SELECT randomblob(900) FROM t1;       /* 16384 */
-    } }
-  }
-} {0}
-do_test wal-20.3 {
-  close $::buddy
-  execsql { PRAGMA wal_checkpoint }
-  execsql { SELECT count(*) FROM t1 }
-} {16384}
-do_test wal-20.4 {
-  db close
-  sqlite3 db test.db
-  execsql { SELECT count(*) FROM t1 }
-} {16384}
-integrity_check wal-20.5
+if {[permutation]!="unix-excl"} {
+  do_test wal-20.1 {
+    catch {db close}
+    forcedelete test.db test.db-wal test.db-journal
+    sqlite3 db test.db
+    execsql {
+      PRAGMA journal_mode = WAL;
+      CREATE TABLE t1(x);
+      INSERT INTO t1 VALUES(randomblob(900));
+      SELECT count(*) FROM t1;
+    }
+  } {wal 1}
+  do_test wal-20.2 {
+    set ::buddy [launch_testfixture]
+    testfixture $::buddy {
+      sqlite3 db test.db
+      db transaction { db eval {
+        PRAGMA wal_autocheckpoint = 0;
+        INSERT INTO t1 SELECT randomblob(900) FROM t1;       /* 2 */
+        INSERT INTO t1 SELECT randomblob(900) FROM t1;       /* 4 */
+        INSERT INTO t1 SELECT randomblob(900) FROM t1;       /* 8 */
+        INSERT INTO t1 SELECT randomblob(900) FROM t1;       /* 16 */
+        INSERT INTO t1 SELECT randomblob(900) FROM t1;       /* 32 */
+        INSERT INTO t1 SELECT randomblob(900) FROM t1;       /* 64 */
+        INSERT INTO t1 SELECT randomblob(900) FROM t1;       /* 128 */
+        INSERT INTO t1 SELECT randomblob(900) FROM t1;       /* 256 */
+        INSERT INTO t1 SELECT randomblob(900) FROM t1;       /* 512 */
+        INSERT INTO t1 SELECT randomblob(900) FROM t1;       /* 1024 */
+        INSERT INTO t1 SELECT randomblob(900) FROM t1;       /* 2048 */
+        INSERT INTO t1 SELECT randomblob(900) FROM t1;       /* 4096 */
+        INSERT INTO t1 SELECT randomblob(900) FROM t1;       /* 8192 */
+        INSERT INTO t1 SELECT randomblob(900) FROM t1;       /* 16384 */
+      } }
+    }
+  } {0}
+  do_test wal-20.3 {
+    close $::buddy
+    execsql { PRAGMA wal_checkpoint }
+    execsql { SELECT count(*) FROM t1 }
+  } {16384}
+  do_test wal-20.4 {
+    db close
+    sqlite3 db test.db
+    execsql { SELECT count(*) FROM t1 }
+  } {16384}
+  integrity_check wal-20.5
+}
 
 catch { db2 close }
 catch { db close }
 
 do_test wal-21.1 {

ADDED   test/walfault2.test
Index: test/walfault2.test
==================================================================
--- /dev/null
+++ test/walfault2.test
@@ -0,0 +1,90 @@
+# 2010 May 03
+#
+# The author disclaims copyright to this source code.  In place of
+# a legal notice, here is a blessing:
+#
+#    May you do good and not evil.
+#    May you find forgiveness for yourself and forgive others.
+#    May you share freely, never taking more than you give.
+#
+#***********************************************************************
+# This file implements regression tests for SQLite library.  The
+# focus of this file is testing the operation of the library in
+# "PRAGMA journal_mode=WAL" mode.
+#
+
+set testdir [file dirname $argv0]
+source $testdir/tester.tcl
+source $testdir/malloc_common.tcl
+source $testdir/lock_common.tcl
+
+ifcapable !wal {finish_test ; return }
+set testprefix walfault2
+
+#-------------------------------------------------------------------------
+# Inject faults while truncating the wal file.
+#
+do_execsql_test 1.0 {
+  PRAGMA auto_vacuum = 0;
+  CREATE TABLE t1(a, b);
+  PRAGMA journal_mode = wal;
+  WITH s(i) AS (
+    SELECT 1 UNION ALL SELECT i+1 FROM s LIMIT 30
+  )
+  INSERT INTO t1 SELECT randomblob(400), randomblob(400) FROM s;
+} {wal}
+faultsim_save_and_close
+
+do_faultsim_test 1 -prep {
+  faultsim_restore
+  sqlite3 db file:test.db?psow=0 -uri 1
+  file_control_powersafe_overwrite db 0
+  execsql {
+    PRAGMA wal_checkpoint;
+    PRAGMA journal_size_limit = 10000;
+    PRAGMA synchronous = full;
+  }
+} -body {
+  execsql { INSERT INTO t1 VALUES(1,1) }
+} -test {
+  faultsim_test_result {0 {}}
+}
+
+#-------------------------------------------------------------------------
+# Inject faults while rewriting checksums.
+#
+reset_db
+do_execsql_test 2.0 {
+  PRAGMA auto_vacuum = 0;
+  CREATE TABLE t1(a, b);
+  PRAGMA journal_mode = wal;
+  WITH s(i) AS (
+    SELECT 1 UNION ALL SELECT i+1 FROM s LIMIT 30
+  )
+  INSERT INTO t1 SELECT randomblob(400), randomblob(400) FROM s;
+} {wal}
+faultsim_save_and_close
+
+do_faultsim_test 2 -prep {
+  faultsim_restore_and_reopen
+  execsql {
+    PRAGMA cache_size = 2;
+    BEGIN;
+    UPDATE t1 SET a=randomblob(400);
+    UPDATE t1 SET b=randomblob(400);
+    UPDATE t1 SET a=randomblob(400);
+    UPDATE t1 SET b=randomblob(400);
+    UPDATE t1 SET a=randomblob(400);
+    UPDATE t1 SET b=randomblob(400);
+    UPDATE t1 SET a=randomblob(400);
+    UPDATE t1 SET b=randomblob(400);
+  }
+} -body {
+  execsql COMMIT
+} -test {
+  faultsim_test_result {0 {}}
+}
+
+
+
+finish_test

ADDED   test/walvfs.test
Index: test/walvfs.test
==================================================================
--- /dev/null
+++ test/walvfs.test
@@ -0,0 +1,429 @@
+# 2018 December 23
+#
+# The author disclaims copyright to this source code.  In place of
+# a legal notice, here is a blessing:
+#
+#    May you do good and not evil.
+#    May you find forgiveness for yourself and forgive others.
+#    May you share freely, never taking more than you give.
+#
+#***********************************************************************
+# This file implements regression tests for SQLite library.  The
+# focus of this file is testing the operation of the library in
+# "PRAGMA journal_mode=WAL" mode.
+#
+
+set testdir [file dirname $argv0]
+source $testdir/tester.tcl
+source $testdir/lock_common.tcl
+source $testdir/malloc_common.tcl
+source $testdir/wal_common.tcl
+set testprefix walvfs
+
+ifcapable !wal {finish_test ; return }
+
+db close
+testvfs tvfs 
+tvfs script xSync
+tvfs filter xSync
+set ::sync_count 0
+proc xSync {method file args} {
+  if {[file tail $file]=="test.db-wal"} {
+    incr ::sync_count
+  }
+}
+
+
+#-------------------------------------------------------------------------
+# Test that if IOCAP_SEQUENTIAL is set, the wal-header is not synced to
+# disk immediately after it is written.
+#
+sqlite3 db test.db -vfs tvfs
+do_execsql_test 1.0 {
+  PRAGMA auto_vacuum = 0;
+  PRAGMA journal_mode = wal;
+  PRAGMA synchronous = normal;
+  CREATE TABLE t1(a, b, c);
+  INSERT INTO t1 VALUES(1, 2, 3);
+  INSERT INTO t1 VALUES(4, 5, 6);
+  INSERT INTO t1 VALUES(7, 8, 9);
+  PRAGMA wal_checkpoint;
+} {wal 0 5 5}
+
+set ::sync_count 0
+do_test 1.1 {
+  execsql { INSERT INTO t1 VALUES(10, 11, 12) }
+  set ::sync_count
+} 1
+
+db close
+tvfs devchar sequential
+sqlite3 db test.db -vfs tvfs
+do_execsql_test 1.2 {
+  PRAGMA synchronous = normal;
+  INSERT INTO t1 VALUES(13, 14, 15);
+  INSERT INTO t1 VALUES(16, 17, 18);
+  PRAGMA wal_checkpoint;
+} {0 4 4}
+
+set ::sync_count 0
+do_test 1.3 {
+  execsql { INSERT INTO t1 VALUES(10, 11, 12) }
+  set ::sync_count
+} 0
+
+#-------------------------------------------------------------------------
+# Test that "PRAGMA journal_size_limit" works in wal mode.
+#
+reset_db
+do_execsql_test 2.0 {
+  PRAGMA journal_size_limit = 10000;
+  CREATE TABLE t1(x);
+  PRAGMA journal_mode = wal;
+  WITH s(i) AS (
+    SELECT 1 UNION ALL SELECT i+1 FROM s LIMIT 20
+  )
+  INSERT INTO t1 SELECT randomblob(750) FROM s;
+} {10000 wal}
+do_test 2.1 {
+  expr [file size test.db-wal]>12000
+} {1}
+do_test 2.2 {
+  execsql {
+    PRAGMA wal_checkpoint;
+    INSERT INTO t1 VALUES(randomblob(750));
+  }
+  file size test.db-wal
+} {10000}
+do_test 2.3 {
+  execsql {
+    PRAGMA journal_size_limit = 8000;
+    PRAGMA wal_checkpoint;
+    INSERT INTO t1 VALUES(randomblob(750));
+  }
+  file size test.db-wal
+} {8000}
+
+#-------------------------------------------------------------------------
+# Test that a checkpoint may be interrupted using sqlite3_interrupt().
+# And that the error code is SQLITE_NOMEM, not SQLITE_INTERRUPT, if
+# an OOM error occurs just before the sqlite3_interrupt() call.
+#
+reset_db
+db close
+sqlite3 db test.db -vfs tvfs
+tvfs filter {}
+
+do_execsql_test 3.0 {
+  CREATE TABLE t1(x);
+  PRAGMA journal_mode = wal;
+  WITH s(i) AS (
+    SELECT 1 UNION ALL SELECT i+1 FROM s LIMIT 20
+  )
+  INSERT INTO t1 SELECT randomblob(750) FROM s;
+} {wal}
+
+tvfs filter xWrite
+tvfs script xWrite
+set ::cnt 2
+proc xWrite {method file args} {
+  if {[file tail $file]=="test.db"} {
+    incr ::cnt -1
+    if {$::cnt==0} {
+      sqlite3_interrupt db
+    }
+  }
+  return SQLITE_OK
+}
+
+do_catchsql_test 3.1 {
+  PRAGMA wal_checkpoint
+} {1 interrupted}
+
+set ::cnt 2
+proc xWrite {method file args} {
+  if {[file tail $file]=="test.db"} {
+    incr ::cnt -1
+    if {$::cnt==0} {
+      sqlite3_memdebug_fail 5 -repeat 0
+      catchsql { SELECT 'a big long string!' }
+      sqlite3_interrupt db
+    }
+  }
+  return SQLITE_OK
+}
+
+do_catchsql_test 3.2 {
+  PRAGMA wal_checkpoint
+} {1 {out of memory}}
+
+#-------------------------------------------------------------------------
+#
+reset_db
+db close
+do_test 4.0 {
+  sqlite3 db test.db -vfs tvfs
+  execsql {
+    CREATE TABLE t1(x);
+    PRAGMA journal_mode = wal;
+    WITH s(i) AS (
+        SELECT 1 UNION ALL SELECT i+1 FROM s LIMIT 20
+    )
+    INSERT INTO t1 SELECT randomblob(750) FROM s;
+  } db
+} {wal}
+db close
+
+tvfs filter xShmMap
+tvfs script xShmMap
+proc xShmMap {method file args} { 
+  return SQLITE_READONLY 
+}
+sqlite3 db test.db -vfs tvfs
+do_catchsql_test 4.1 {
+  SELECT count(*) FROM t1
+} {1 {attempt to write a readonly database}}
+
+set ::cnt 5
+tvfs filter {xShmMap xShmLock}
+proc xShmMap {method file name args} { 
+  switch -- $method {
+    xShmMap {  return SQLITE_READONLY }
+    xShmLock {
+      if {$args == "{0 1 lock shared}"} {
+        incr ::cnt -1
+        if {$::cnt>0} { return SQLITE_BUSY }
+      }
+    }
+  }
+  return SQLITE_OK
+}
+do_catchsql_test 4.2 {
+  SELECT count(*) FROM t1
+} {1 {attempt to write a readonly database}}
+
+#-------------------------------------------------------------------------
+#
+reset_db
+db close 
+sqlite3 db test.db -vfs tvfs
+tvfs filter {}
+do_execsql_test 5.0 {
+  PRAGMA auto_vacuum = 0;
+  PRAGMA page_size = 1024;
+  CREATE TABLE t1(x);
+  PRAGMA journal_mode = wal;
+  WITH s(i) AS (
+      SELECT 1 UNION ALL SELECT i+1 FROM s LIMIT 20
+  )
+  INSERT INTO t1 SELECT randomblob(750) FROM s;
+} {wal}
+
+do_execsql_test 5.1 {
+  SELECT count(*) FROM t1
+} {20}
+
+do_test 5.2 {
+  vfs_set_readmark db main 1 100
+  vfs_set_readmark db main 2 100
+  vfs_set_readmark db main 3 100
+  vfs_set_readmark db main 4 100
+} {100}
+
+do_execsql_test 5.3 {
+  SELECT count(*) FROM t1
+} {20}
+
+do_test 5.3 {
+  list [vfs_set_readmark db main 1] \
+       [vfs_set_readmark db main 2] \
+       [vfs_set_readmark db main 3] \
+       [vfs_set_readmark db main 4] 
+} {24 100 100 100}
+
+tvfs script xShmLock
+tvfs filter xShmLock
+set ::cnt 20
+proc xShmLock {args} {
+  incr ::cnt -1
+  if {$::cnt>0} { return SQLITE_BUSY }
+  return SQLITE_OK
+}
+
+do_test 5.4 {
+  vfs_set_readmark db main 1 100
+  execsql { SELECT count(*) FROM t1 }
+} {20}
+
+vfs_set_readmark db main 1 100
+vfs_set_readmark db main 2 100
+vfs_set_readmark db main 3 100
+vfs_set_readmark db main 4 100
+
+tvfs script xShmMapLock
+tvfs filter {xShmLock xShmMap}
+proc xShmMapLock {method args} {
+  if {$method=="xShmMap"} {
+    return "SQLITE_READONLY"
+  }
+  return SQLITE_BUSY
+}
+
+sqlite3 db2 test.db -vfs tvfs
+breakpoint
+do_test 5.5 {
+  list [catch { execsql { SELECT count(*) FROM t1 } db2 } msg] $msg
+} {1 {attempt to write a readonly database}}
+
+tvfs filter {}
+vfs_set_readmark db main 1 1
+
+do_test 5.6 {
+  list [catch { execsql { SELECT count(*) FROM t1 } db2 } msg] $msg
+} {0 20}
+db2 close
+db close
+
+#-------------------------------------------------------------------------
+# Cause an SQLITE_PROTOCOL while attempting to restart the wal file.
+#
+reset_db
+tvfs filter {}
+db close
+sqlite3 db test.db -vfs tvfs
+do_execsql_test 6.0 {
+  PRAGMA auto_vacuum = 0;
+  PRAGMA page_size = 1024;
+  CREATE TABLE t1(x);
+  PRAGMA journal_mode = wal;
+  WITH s(i) AS (
+      SELECT 1 UNION ALL SELECT i+1 FROM s LIMIT 20
+  )
+  INSERT INTO t1 SELECT randomblob(750) FROM s;
+} {wal}
+
+do_test 6.1 {
+  execsql { PRAGMA wal_checkpoint } 
+  set {} {}
+} {}
+
+tvfs filter xShmLock
+tvfs script xShmLock
+set ::flag 0
+proc xShmLock {method file handle spec} {
+  if {$::flag && [lrange $spec 2 end]=="lock shared"} {
+    return SQLITE_BUSY
+  }
+  if {$spec=="3 1 unlock shared"} {
+    set ::flag 1
+  }
+  return SQLITE_OK
+}
+
+puts "# WARNING: This next test takes around 12 seconds"
+do_catchsql_test 6.2 {
+  INSERT INTO t1 VALUES(1);
+} {1 {locking protocol}}
+
+#-------------------------------------------------------------------------
+# Check that a checkpoint fails if it cannot get the CHECKPOINTER lock
+#
+reset_db
+tvfs filter {}
+db close
+sqlite3 db test.db -vfs tvfs
+do_execsql_test 7.0 {
+  PRAGMA auto_vacuum = 0;
+  PRAGMA page_size = 1024;
+  CREATE TABLE t1(x);
+  PRAGMA journal_mode = wal;
+  WITH s(i) AS (
+      SELECT 1 UNION ALL SELECT i+1 FROM s LIMIT 20
+  )
+  INSERT INTO t1 SELECT randomblob(750) FROM s;
+} {wal}
+
+tvfs script xShmLock
+tvfs filter xShmLock
+proc xShmLock {method file handle spec} {
+  if {$spec=="1 1 lock exclusive"} {
+    return SQLITE_BUSY
+  }
+  return SQLITE_OK
+}
+
+do_execsql_test 7.1 {
+  PRAGMA wal_checkpoint
+} {1 -1 -1}
+
+#-------------------------------------------------------------------------
+# Check that the page cache is correctly flushed if a checkpointer using
+# a version 2 VFS makes a checkpoint with an out-of-date cache.
+#
+reset_db
+testvfs tvfs2 -iversion 2
+db close
+sqlite3 db test.db -vfs tvfs2
+do_execsql_test 8.0 {
+  PRAGMA auto_vacuum = 0;
+  PRAGMA page_size = 1024;
+  CREATE TABLE t1(x);
+  PRAGMA journal_mode = wal;
+  WITH s(i) AS ( SELECT 1 UNION ALL SELECT i+1 FROM s LIMIT 20 )
+  INSERT INTO t1 SELECT randomblob(75) FROM s;
+} {wal}
+
+do_execsql_test 8.1 { SELECT count(*) FROM t1 } {20}
+
+do_test 8.2 {
+  sqlite3 db2 test.db -vfs tvfs2
+  execsql {
+    INSERT INTO t1 VALUES(randomblob(75));
+  } db2
+  db2 close
+} {}
+
+do_execsql_test 8.3 { 
+  PRAGMA wal_checkpoint;
+  SELECT count(*) FROM t1 
+} {0 5 5 21}
+tvfs2 delete
+
+#-------------------------------------------------------------------------
+reset_db
+db close
+sqlite3 db test.db -vfs tvfs
+do_execsql_test 9.0 {
+  PRAGMA auto_vacuum = 0;
+  PRAGMA page_size = 1024;
+  CREATE TABLE t1(x);
+  PRAGMA journal_mode = wal;
+  WITH s(i) AS ( SELECT 1 UNION ALL SELECT i+1 FROM s LIMIT 20 )
+  INSERT INTO t1 SELECT randomblob(75) FROM s;
+} {wal}
+
+sqlite3 db2 test.db -vfs tvfs
+tvfs filter {xShmMap xShmLock}
+tvfs script xShmMap
+proc xShmMap {method file handle args} {
+  switch -- $method {
+    xShmMap {
+      return "SQLITE_READONLY_CANTINIT"
+    }
+    xShmLock {
+      if {$args=="{3 1 lock shared}"} {
+        return "SQLITE_IOERR"
+      }
+    }
+  }
+}
+
+do_test 9.1 {
+  catchsql { SELECT count(*) FROM t1 } db2
+} {1 {disk I/O error}}
+
+db close
+db2 close
+tvfs delete
+finish_test
+

Index: test/where7.test
==================================================================
--- test/where7.test
+++ test/where7.test
@@ -23351,12 +23351,14 @@
            OR t301.c8 = 1407424651264000)
    ORDER BY t302.c5 LIMIT 200;
 } {
   QUERY PLAN
   |--MULTI-INDEX OR
-  |  |--SEARCH TABLE t301 USING COVERING INDEX t301_c4 (c4=?)
-  |  `--SEARCH TABLE t301 USING INTEGER PRIMARY KEY (rowid=?)
+  |  |--INDEX 1
+  |  |  `--SEARCH TABLE t301 USING COVERING INDEX t301_c4 (c4=?)
+  |  `--INDEX 2
+  |     `--SEARCH TABLE t301 USING INTEGER PRIMARY KEY (rowid=?)
   |--SEARCH TABLE t302 USING INDEX t302_c8_c3 (c8=? AND c3>?)
   `--USE TEMP B-TREE FOR ORDER BY
 }
 
 finish_test

Index: test/where9.test
==================================================================
--- test/where9.test
+++ test/where9.test
@@ -362,23 +362,27 @@
     WHERE t1.a=80 AND ((t1.c=t2.c AND t1.d=t2.d) OR t1.f=t2.f)
   } [string map {"\n  " \n} {
     QUERY PLAN
     |--SEARCH TABLE t1 USING INTEGER PRIMARY KEY (rowid=?)
     `--MULTI-INDEX OR
-       |--SEARCH TABLE t2 USING INDEX t2d (d=?)
-       `--SEARCH TABLE t2 USING COVERING INDEX t2f (f=?)
+       |--INDEX 1
+       |  `--SEARCH TABLE t2 USING INDEX t2d (d=?)
+       `--INDEX 3
+          `--SEARCH TABLE t2 USING COVERING INDEX t2f (f=?)
   }]
   do_eqp_test where9-3.2 {
     SELECT coalesce(t2.a,9999)
     FROM t1 LEFT JOIN t2 ON (t1.c+1=t2.c AND t1.d=t2.d) OR (t1.f||'x')=t2.f
     WHERE t1.a=80
   } [string map {"\n  " \n} {
     QUERY PLAN
     |--SEARCH TABLE t1 USING INTEGER PRIMARY KEY (rowid=?)
     `--MULTI-INDEX OR
-       |--SEARCH TABLE t2 USING INDEX t2d (d=?)
-       `--SEARCH TABLE t2 USING COVERING INDEX t2f (f=?)
+       |--INDEX 1
+       |  `--SEARCH TABLE t2 USING INDEX t2d (d=?)
+       `--INDEX 2
+          `--SEARCH TABLE t2 USING COVERING INDEX t2f (f=?)
   }]
 } 
 
 # Make sure that INDEXED BY and multi-index OR clauses play well with
 # one another.
@@ -454,12 +458,14 @@
 do_eqp_test where9-5.1 {
   SELECT a FROM t1 WHERE b>1000 AND (c=31031 OR d IS NULL)
 } {
   QUERY PLAN
   `--MULTI-INDEX OR
-     |--SEARCH TABLE t1 USING INDEX t1c (c=?)
-     `--SEARCH TABLE t1 USING INDEX t1d (d=?)
+     |--INDEX 1
+     |  `--SEARCH TABLE t1 USING INDEX t1c (c=?)
+     `--INDEX 2
+        `--SEARCH TABLE t1 USING INDEX t1d (d=?)
 }
 
 # In contrast, b=1000 is preferred over any OR-clause.
 #
 do_eqp_test where9-5.2 {

Index: test/whereI.test
==================================================================
--- test/whereI.test
+++ test/whereI.test
@@ -29,12 +29,14 @@
 do_eqp_test 1.1 {
   SELECT a FROM t1 WHERE b='b' OR c='x'
 } {
   QUERY PLAN
   `--MULTI-INDEX OR
-     |--SEARCH TABLE t1 USING INDEX i1 (b=?)
-     `--SEARCH TABLE t1 USING INDEX i2 (c=?)
+     |--INDEX 1
+     |  `--SEARCH TABLE t1 USING INDEX i1 (b=?)
+     `--INDEX 2
+        `--SEARCH TABLE t1 USING INDEX i2 (c=?)
 }
 
 do_execsql_test 1.2 {
   SELECT a FROM t1 WHERE b='b' OR c='x'
 } {2 3}
@@ -59,12 +61,14 @@
 do_eqp_test 2.1 {
   SELECT a FROM t2 WHERE b='b' OR c='x'
 } {
   QUERY PLAN
   `--MULTI-INDEX OR
-     |--SEARCH TABLE t2 USING INDEX i3 (b=?)
-     `--SEARCH TABLE t2 USING INDEX i4 (c=?)
+     |--INDEX 1
+     |  `--SEARCH TABLE t2 USING INDEX i3 (b=?)
+     `--INDEX 2
+        `--SEARCH TABLE t2 USING INDEX i4 (c=?)
 }
 
 do_execsql_test 2.2 {
   SELECT a FROM t2 WHERE b='b' OR c='x'
 } {ii iii}

Index: test/wherelimit2.test
==================================================================
--- test/wherelimit2.test
+++ test/wherelimit2.test
@@ -295,6 +295,5 @@
   set ::log
 } {ax a bx b cx c dx d ex a}
 
 
 finish_test
-

Index: test/window1.test
==================================================================
--- test/window1.test
+++ test/window1.test
@@ -589,9 +589,116 @@
 
 do_execsql_test 13.5 {
   SELECT a, rank() OVER(ORDER BY b) FROM t1
     INTERSECT 
   SELECT a, rank() OVER(ORDER BY b DESC) FROM t1;
+} {}
+
+# 2018-12-06
+# https://www.sqlite.org/src/info/f09fcd17810f65f7
+# Assertion fault when window functions are used.
+#
+# Root cause is the query flattener invoking sqlite3ExprDup() on
+# expressions that contain subqueries with window functions.  The
+# sqlite3ExprDup() routine is not making correctly initializing
+# Select.pWin field of the subqueries.
+#
+sqlite3 db :memory:
+do_execsql_test 14.0 {
+  SELECT * FROM(
+    SELECT * FROM (SELECT 1 AS c) WHERE c IN (
+        SELECT (row_number() OVER()) FROM (VALUES (0))
+    )
+  );
+} {1}
+do_execsql_test 14.1 {
+  CREATE TABLE t1(x); INSERT INTO t1(x) VALUES(12345);
+  CREATE TABLE t2(c); INSERT INTO t2(c) VALUES(1);
+  SELECT y, y+1, y+2 FROM (
+    SELECT c IN (
+      SELECT (row_number() OVER()) FROM t1
+    ) AS y FROM t2
+  );
+} {1 2 3}
+
+# 2018-12-31
+# https://www.sqlite.org/src/info/d0866b26f83e9c55
+# Window function in correlated subquery causes assertion fault 
+#
+do_catchsql_test 15.0 {
+  WITH t(id, parent) AS (
+  SELECT CAST(1 AS INT), CAST(NULL AS INT)
+  UNION ALL
+  SELECT 2, NULL
+  UNION ALL
+  SELECT 3, 1
+  UNION ALL
+  SELECT 4, 1
+  UNION ALL
+  SELECT 5, 2
+  UNION ALL
+  SELECT 6, 2
+  ), q AS (
+  SELECT t.*, ROW_NUMBER() OVER (ORDER BY t.id) AS rn
+    FROM t
+   WHERE parent IS NULL
+   UNION ALL
+  SELECT t.*, ROW_NUMBER() OVER (ORDER BY t.id) AS rn
+    FROM q
+    JOIN t
+      ON t.parent = q.id
+  )
+  SELECT *
+    FROM q;
+} {1 {cannot use window functions in recursive queries}}
+do_execsql_test 15.1 {
+  DROP TABLE IF EXISTS t1;
+  DROP TABLE IF EXISTS t2;
+  CREATE TABLE t1(x);
+  INSERT INTO t1 VALUES('a'), ('b'), ('c');
+  CREATE TABLE t2(a, b);
+  INSERT INTO t2 VALUES('X', 1), ('X', 2), ('Y', 2), ('Y', 3);
+  SELECT x, (
+    SELECT sum(b)
+      OVER (PARTITION BY a ROWS BETWEEN UNBOUNDED PRECEDING
+                                    AND UNBOUNDED FOLLOWING)
+    FROM t2 WHERE b<x
+  ) FROM t1;
+} {a 3 b 3 c 3}
+
+do_execsql_test 15.2 {
+  SELECT(
+    WITH c AS(
+      VALUES(1)
+    ) SELECT '' FROM c,c
+  ) x WHERE x+x;
+} {}
+
+#-------------------------------------------------------------------------
+
+do_execsql_test 16.0 {
+  CREATE TABLE t7(a,b); 
+  INSERT INTO t7(rowid, a, b) VALUES
+      (1, 1, 3),
+      (2, 10, 4),
+      (3, 100, 2);
+}
+
+do_execsql_test 16.1 {
+  SELECT rowid, sum(a) OVER (PARTITION BY b IN (SELECT rowid FROM t7)) FROM t7;
+} {
+  2 10
+  1 101
+  3 101
+}
+
+do_execsql_test 16.2 {
+  SELECT rowid, sum(a) OVER w1 FROM t7 
+  WINDOW w1 AS (PARTITION BY b IN (SELECT rowid FROM t7));
 } {
+  2 10
+  1 101
+  3 101
 }
+
 
 finish_test

Index: test/window5.test
==================================================================
--- test/window5.test
+++ test/window5.test
@@ -92,6 +92,5 @@
   SELECT sum(a) FROM t1;
 } {21}
 
 
 finish_test
-

Index: test/windowfault.test
==================================================================
--- test/windowfault.test
+++ test/windowfault.test
@@ -161,6 +161,5 @@
 } -test {
   faultsim_test_result {0 {1 2 5 6 9 10}}
 }
 
 finish_test
-

Index: test/with1.test
==================================================================
--- test/with1.test
+++ test/with1.test
@@ -1042,6 +1042,53 @@
 } {0}
 do_execsql_test 20.2 {
   WITH c(i)AS(VALUES(5)UNIoN SELECT 0)SELECT min(1)-i fROM c;
 } {1}
 
+# 2018-12-26
+# Two different CTE tables with the same name appear in within a single FROM
+# clause due to the query-flattener optimization.  make sure this does not cause
+# problems.  This problem was discovered by Matt Denton.
+#
+do_execsql_test 21.1 {
+   WITH RECURSIVE t21(a,b) AS (
+    WITH t21(x) AS (VALUES(1))
+    SELECT x, x FROM t21 ORDER BY 1
+  )
+  SELECT * FROM t21 AS tA, t21 AS tB
+} {1 1 1 1}
+do_execsql_test 21.1b {
+   /* This variant from chromium bug 922312 on 2019-01-16 */
+   WITH RECURSIVE t21(a,b) AS (
+    WITH t21(x) AS (VALUES(1))
+    SELECT x, x FROM t21 ORDER BY 1 LIMIT 5
+  )
+  SELECT * FROM t21 AS tA, t21 AS tB
+} {1 1 1 1}
+do_execsql_test 21.2 {
+  SELECT printf('',
+     EXISTS (WITH RECURSIVE Table0 AS (WITH Table0 AS (SELECT DISTINCT 1)
+                                       SELECT *, * FROM Table0 ORDER BY 1 DESC)
+             SELECT * FROM Table0  NATURAL JOIN  Table0));
+} {{}}
+
+# 2019-01-17
+# Make sure crazy nexted CTE joins terminate with an error quickly.
+#
+do_catchsql_test 22.1 {
+  WITH RECURSIVE c AS (
+     WITH RECURSIVE c AS (
+        WITH RECURSIVE c AS (
+           WITH RECURSIVE c AS (
+               WITH  c AS (VALUES(0))
+               SELECT 1 FROM c LEFT JOIN c ON ltrim(1)
+           )
+           SELECT 1 FROM c,c,c,c,c,c,c,c,c
+        )
+        SELECT  2 FROM c,c,c,c,c,c,c,c,c
+     )
+     SELECT 3 FROM c,c,c,c,c,c,c,c,c
+  )
+  SELECT 4 FROM c,c,c,c,c,c,c,c,c;
+} {1 {at most 64 tables in a join}}
+
 finish_test

Index: test/with3.test
==================================================================
--- test/with3.test
+++ test/with3.test
@@ -118,11 +118,11 @@
 } {
   QUERY PLAN
   |--MATERIALIZE xxxxxx
   |  |--SETUP
   |  |  |--SCAN CONSTANT ROW
-  |  |  `--SCALAR SUBQUERY
+  |  |  `--SCALAR SUBQUERY xxxxxx
   |  |     `--SCAN TABLE w2
   |  `--RECURSIVE STEP
   |     |--SCAN TABLE w1
   |     `--SCAN TABLE c
   |--SCAN SUBQUERY xxxxxx

Index: test/without_rowid3.test
==================================================================
--- test/without_rowid3.test
+++ test/without_rowid3.test
@@ -951,19 +951,21 @@
   proc test_rename_parent {zCreate zOld zNew} {
     db eval {SELECT sqlite_rename_table(
         'main', 'table', 't1', $zCreate, $zOld, $zNew, 0
     )}
   }
+  sqlite3_test_control SQLITE_TESTCTRL_INTERNAL_FUNCTIONS 1
   do_test without_rowid3-14.2.1.1 {
     test_rename_parent {CREATE TABLE t1(a REFERENCES t2)} t2 t3
   } {{CREATE TABLE t1(a REFERENCES "t3")}}
   do_test without_rowid3-14.2.1.2 {
     test_rename_parent {CREATE TABLE t1(a REFERENCES t2)} t4 t3
   } {{CREATE TABLE t1(a REFERENCES t2)}}
   do_test without_rowid3-14.2.1.3 {
     test_rename_parent {CREATE TABLE t1(a REFERENCES "t2")} t2 t3
   } {{CREATE TABLE t1(a REFERENCES "t3")}}
+  sqlite3_test_control SQLITE_TESTCTRL_INTERNAL_FUNCTIONS 0
   
   # Test ALTER TABLE RENAME TABLE a bit.
   #
   do_test without_rowid3-14.2.2.1 {
     drop_all_tables
@@ -1035,19 +1037,21 @@
       PRAGMA foreign_keys = on;
       SELECT sql FROM temp.sqlite_master WHERE name='t2';
     }
   } {{CREATE TABLE t2(a, b, c REFERENCES t1, d DEFAULT NULL REFERENCES t1, e REFERENCES t1 DEFAULT NULL, h DEFAULT 'text' REFERENCES t1)}}
 
+  sqlite3_test_control SQLITE_TESTCTRL_INTERNAL_FUNCTIONS 1
   do_test without_rowid3-14.2tmp.1.1 {
     test_rename_parent {CREATE TABLE t1(a REFERENCES t2)} t2 t3
   } {{CREATE TABLE t1(a REFERENCES "t3")}}
   do_test without_rowid3-14.2tmp.1.2 {
     test_rename_parent {CREATE TABLE t1(a REFERENCES t2)} t4 t3
   } {{CREATE TABLE t1(a REFERENCES t2)}}
   do_test without_rowid3-14.2tmp.1.3 {
     test_rename_parent {CREATE TABLE t1(a REFERENCES "t2")} t2 t3
   } {{CREATE TABLE t1(a REFERENCES "t3")}}
+  sqlite3_test_control SQLITE_TESTCTRL_INTERNAL_FUNCTIONS 0
   
   # Test ALTER TABLE RENAME TABLE a bit.
   #
   do_test without_rowid3-14.2tmp.2.1 {
     drop_all_tables
@@ -1120,19 +1124,21 @@
       PRAGMA foreign_keys = on;
       SELECT sql FROM aux.sqlite_master WHERE name='t2';
     }
   } {{CREATE TABLE t2(a, b, c REFERENCES t1, d DEFAULT NULL REFERENCES t1, e REFERENCES t1 DEFAULT NULL, h DEFAULT 'text' REFERENCES t1)}}
 
+  sqlite3_test_control SQLITE_TESTCTRL_INTERNAL_FUNCTIONS 1
   do_test without_rowid3-14.2aux.1.1 {
     test_rename_parent {CREATE TABLE t1(a REFERENCES t2)} t2 t3
   } {{CREATE TABLE t1(a REFERENCES "t3")}}
   do_test without_rowid3-14.2aux.1.2 {
     test_rename_parent {CREATE TABLE t1(a REFERENCES t2)} t4 t3
   } {{CREATE TABLE t1(a REFERENCES t2)}}
   do_test without_rowid3-14.2aux.1.3 {
     test_rename_parent {CREATE TABLE t1(a REFERENCES "t2")} t2 t3
   } {{CREATE TABLE t1(a REFERENCES "t3")}}
+  sqlite3_test_control SQLITE_TESTCTRL_INTERNAL_FUNCTIONS 0
   
   # Test ALTER TABLE RENAME TABLE a bit.
   #
   do_test without_rowid3-14.2aux.2.1 {
     drop_all_tables

Index: test/zeroblob.test
==================================================================
--- test/zeroblob.test
+++ test/zeroblob.test
@@ -313,8 +313,19 @@
   sqlite3_reset $stmt
   set ret
 } {1000}
 
 sqlite3_finalize $stmt
+
+# 2019-01-25 https://sqlite.org/src/tktview/bb4bdb9f7f654b0bb9f34cfbac
+# Zeroblob truncated by an index on expression
+#
+do_execsql_test 13.100 {
+  DROP TABLE IF EXISTS t1;
+  CREATE TABLE t1(a,b,c);
+  CREATE INDEX t1bbc ON t1(b, b+c);
+  INSERT INTO t1(a,b,c) VALUES(1,zeroblob(8),3);
+  SELECT a, quote(b), length(b), c FROM t1;
+} {1 X'0000000000000000' 8 3}
 
 test_restore_config_pagecache
 finish_test

Index: test/zipfile.test
==================================================================
--- test/zipfile.test
+++ test/zipfile.test
@@ -759,6 +759,40 @@
 do_execsql_test 11.11 {
   UPDATE z SET name = name || 'suffix';
   SELECT name, data FROM z ORDER BY name;
 } {b0suffix two b2suffix one}
 
+
+if {$tcl_platform(platform)!="windows"} {
+  do_test 12.0 {
+    catch { file delete -force subdir }
+    foreach {path sz} {
+      subdir/x1.txt     143
+      subdir/x2.txt     153
+    } {
+      set dir [file dirname $path]
+      catch { file mkdir $dir }
+      set fd [open $path w]
+      puts -nonewline $fd [string repeat 1 $sz]
+      close $fd
+    }
+  } {}
+  
+  do_execsql_test 12.1 {
+    SELECT name FROM fsdir('subdir') ORDER BY 1;
+  } {subdir subdir/x1.txt subdir/x2.txt}
+  
+  do_execsql_test 12.2 {
+    CREATE TABLE d AS SELECT 'subdir' d;
+    CREATE TABLE x AS SELECT 1 x;
+  }
+  
+  do_execsql_test 12.4 {
+    SELECT name FROM d JOIN x JOIN fsdir(d) ORDER BY 1;
+  } {subdir subdir/x1.txt subdir/x2.txt}
+
+  do_execsql_test 12.5 {
+    SELECT name FROM d JOIN x JOIN fsdir('.', d) ORDER BY 1;
+  } {. ./x1.txt ./x2.txt}
+}
+
 finish_test

Index: test/zipfile2.test
==================================================================
--- test/zipfile2.test
+++ test/zipfile2.test
@@ -239,6 +239,5 @@
   UPDATE OR REPLACE zip SET name='test2' WHERE name='test1';
   SELECT name FROM zip;
 } {test2}
 
 finish_test
-

ADDED   tool/dbtotxt.c
Index: tool/dbtotxt.c
==================================================================
--- /dev/null
+++ tool/dbtotxt.c
@@ -0,0 +1,146 @@
+/*
+** Copyright 2008 D. Richard Hipp and Hipp, Wyrick & Company, Inc.
+** All Rights Reserved
+**
+******************************************************************************
+**
+** This file implements a stand-alone utility program that converts
+** a binary file (usually an SQLite database) into a text format that
+** is compact and friendly to human-readers.
+**
+** Usage:
+**
+**         dbtotxt [--pagesize N] FILENAME
+**
+** The translation of the database appears on standard output.  If the
+** --pagesize command-line option is omitted, then the page size is taken
+** from the database header.
+**
+** Compactness is achieved by suppressing lines of all zero bytes.  This
+** works well at compressing test databases that are mostly empty.  But
+** the output will probably be lengthy for a real database containing lots
+** of real content.  For maximum compactness, it is suggested that test
+** databases be constructed with "zeroblob()" rather than "randomblob()"
+** used for filler content and with "PRAGMA secure_delete=ON" selected to
+** zero-out deleted content.
+*/
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+#include <ctype.h>
+ 
+/* Return true if the line is all zeros */
+static int allZero(unsigned char *aLine){
+  int i;
+  for(i=0; i<16 && aLine[i]==0; i++){}
+  return i==16;
+}
+
+int main(int argc, char **argv){
+  int pgsz = 0;               /* page size */
+  long szFile;                /* Size of the input file in bytes */
+  FILE *in;                   /* Input file */
+  int i, j;                   /* Loop counters */
+  int nErr = 0;               /* Number of errors */
+  const char *zInputFile = 0; /* Name of the input file */
+  const char *zBaseName = 0;  /* Base name of the file */
+  int lastPage = 0;           /* Last page number shown */
+  int iPage;                  /* Current page number */
+  unsigned char aLine[16];    /* A single line of the file */
+  unsigned char aHdr[100];    /* File header */
+  unsigned char bShow[256];      /* Characters ok to display */
+  memset(bShow, '.', sizeof(bShow));
+  for(i=' '; i<='~'; i++){
+    if( i!='{' && i!='}' && i!='"' && i!='\\' ) bShow[i] = i;
+  }
+  for(i=1; i<argc; i++){
+    if( argv[i][0]=='-' ){
+      const char *z = argv[i];
+      z++;
+      if( z[0]=='-' ) z++;
+      if( strcmp(z,"pagesize")==0 ){
+        i++;
+        pgsz = atoi(argv[i]);
+        if( pgsz<512 || pgsz>65536 || (pgsz&(pgsz-1))!=0 ){
+          fprintf(stderr, "Page size must be a power of two between"
+                          " 512 and 65536.\n");
+          nErr++;
+        }
+        continue;
+      }
+      fprintf(stderr, "Unknown option: %s\n", argv[i]);
+      nErr++;
+    }else if( zInputFile ){
+      fprintf(stderr, "Already using a different input file: [%s]\n", argv[i]);
+      nErr++;
+    }else{
+      zInputFile = argv[i];
+    }
+  }
+  if( zInputFile==0 ){
+    fprintf(stderr, "No input file specified.\n");
+    nErr++;
+  }
+  if( nErr ){
+    fprintf(stderr, "Usage: %s [--pagesize N] FILENAME\n", argv[0]);
+    exit(1);
+  }
+  in = fopen(zInputFile, "rb");
+  if( in==0 ){
+    fprintf(stderr, "Cannot open input file [%s]\n", zInputFile);
+    exit(1);
+  }
+  fseek(in, 0, SEEK_END);
+  szFile = ftell(in);
+  rewind(in);
+  if( szFile<100 ){
+    fprintf(stderr, "File too short. Minimum size is 100 bytes.\n");
+    exit(1);
+  }
+  if( fread(aHdr, 100, 1, in)!=1 ){
+    fprintf(stderr, "Cannot read file header\n");
+    exit(1);
+  }
+  rewind(in);
+  if( pgsz==0 ){
+    pgsz = (aHdr[16]<<8) | aHdr[17];
+    if( pgsz==1 ) pgsz = 65536;
+    if( pgsz<512 || (pgsz&(pgsz-1))!=0 ){
+      fprintf(stderr, "Invalid page size in header: %d\n", pgsz);
+      exit(1);
+    }
+  }
+  zBaseName = zInputFile;
+  for(i=0; zInputFile[i]; i++){
+    if( zInputFile[i]=='/' && zInputFile[i+1]!=0 ) zBaseName = zInputFile+i+1;
+  }
+  printf("| size %d pagesize %d filename %s\n",(int)szFile,pgsz,zBaseName);
+  for(i=0; i<szFile; i+=16){
+    int got = (int)fread(aLine, 1, 16, in);
+    if( got!=16 ){
+      static int once = 1;
+      if( once ){
+        fprintf(stderr, "Could not read input file starting at byte %d\n",
+                         i+got);
+      }
+      memset(aLine+got, 0, 16-got);
+    }
+    if( allZero(aLine) ) continue;
+    iPage = i/pgsz + 1;
+    if( lastPage!=iPage ){
+      printf("| page %d offset %d\n", iPage, (iPage-1)*pgsz);
+      lastPage = iPage;
+    }
+    printf("|  %5d:", i-(iPage-1)*pgsz);
+    for(j=0; j<16; j++) printf(" %02x", aLine[j]);
+    printf("   ");
+    for(j=0; j<16; j++){
+      unsigned char c = (unsigned char)aLine[j];
+      fputc( bShow[c], stdout);
+    }
+    fputc('\n', stdout);
+  }
+  fclose(in);
+  printf("| end %s\n", zBaseName);
+  return 0;
+}

ADDED   tool/dbtotxt.md
Index: tool/dbtotxt.md
==================================================================
--- /dev/null
+++ tool/dbtotxt.md
@@ -0,0 +1,56 @@
+<h1 align="center">The dbtotxt Tool</h1>
+
+The dbtotxt utility program reads an SQLite database file and writes its
+raw binary content to screen as a hex dump for testing and debugging
+purposes.
+
+The hex-dump output is formatted in such a way as to be easily readable
+both by humans and by software.  The dbtotxt utility has long been a part
+of the TH3 test suite.  The output of dbtotxt can be embedded in TH3 test
+scripts and used to generate very specific database files, perhaps with
+deliberately introduced corruption.  The cov1/corrupt*.test modules in
+TH3 make extensive use of dbtotxt.
+
+More recently (2018-12-13) the dbtotxt utility has been added to the SQLite 
+core and the command-line shell (CLI) has been augmented to be able to read 
+dbtotxt output.  The CLI dot-command is:
+
+>     .open --hexdb  ?OPTIONAL-FILENAME?
+
+If the OPTIONAL-FILENAME is included, then content is read from that file.
+If OPTIONAL-FILENAME is omitted, then the text is taken from the input stream,
+terminated by the "| end" line of the dbtotxt text.  This allows small test
+databases to be embedded directly in scripts.  Consider this example:
+
+>
+    .open --hexdb
+    | size 8192 pagesize 4096 filename x9.db
+    | page 1 offset 0
+    |      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+    |     16: 10 00 01 01 00 40 20 20 00 00 00 04 00 00 00 02   .....@  ........
+    |     32: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 04   ................
+    |     48: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00   ................
+    |     80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04   ................
+    |     96: 00 2e 30 38 0d 00 00 00 01 0f c0 00 0f c0 00 00   ..08............
+    |   4032: 3e 01 06 17 11 11 01 69 74 61 62 6c 65 74 31 74   >......itablet1t
+    |   4048: 31 02 43 52 45 41 54 45 20 54 41 42 4c 45 20 74   1.CREATE TABLE t
+    |   4064: 31 28 78 2c 79 20 44 45 46 41 55 4c 54 20 78 27   1(x,y DEFAULT x'
+    |   4080: 66 66 27 2c 7a 20 44 45 46 41 55 4c 54 20 30 29   ff',z DEFAULT 0)
+    | page 2 offset 4096
+    |      0: 0d 08 14 00 04 00 10 00 0e 05 0a 0f 04 15 00 10   ................
+    |     16: 88 02 03 05 90 04 0e 08 00 00 00 00 00 00 00 00   ................
+    |   1040: 00 00 00 00 ff 87 7c 02 05 8f 78 0e 08 00 00 00   ......|...x.....
+    |   2064: 00 00 00 ff 0c 0a 01 fb 00 00 00 00 00 00 00 00   ................
+    |   2560: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 83   ................
+    |   2576: 78 01 05 87 70 0e 08 00 00 00 00 00 00 00 00 00   x...p...........
+    |   3072: 00 00 00 00 00 00 00 00 00 ff 00 00 01 fb 00 00   ................
+    |   3584: 00 00 00 00 00 83 78 00 05 87 70 0e 08 00 00 00   ......x...p.....
+    |   4080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff   ................
+    | end x9.db
+    SELECT rowid FROM t1;
+    PRAGMA integrity_check;
+
+You can run this script to see that the database file is correctly decoded 
+and loaded.  Furthermore, you can make subtle corruptions to the input
+database simply by editing the hexadecimal description, then rerun the
+script to verify that SQLite correctly handles the corruption.

Index: tool/genfkey.test
==================================================================
--- tool/genfkey.test
+++ tool/genfkey.test
@@ -349,6 +349,5 @@
   execsql {
     SELECT * FROM parent;
     SELECT * FROM child;
   }
 } {1 1}
-

ADDED   tool/index_usage.c
Index: tool/index_usage.c
==================================================================
--- /dev/null
+++ tool/index_usage.c
@@ -0,0 +1,233 @@
+/*
+** 2018-12-04
+**
+** The author disclaims copyright to this source code.  In place of
+** a legal notice, here is a blessing:
+**
+**    May you do good and not evil.
+**    May you find forgiveness for yourself and forgive others.
+**    May you share freely, never taking more than you give.
+**
+*************************************************************************
+** 
+** This file implements a utility program used to help determine which
+** indexes in a database schema are used and unused, and how often specific
+** indexes are used.
+*/
+#include "sqlite3.h"
+#include <stdio.h>
+#include <stdlib.h>
+#include <assert.h>
+#include <string.h>
+
+static void usage(const char *argv0){
+  printf("Usage: %s [OPTIONS] DATABASE LOG\n\n", argv0);
+  printf(
+    "DATABASE is an SQLite database against which various statements\n"
+    "have been run.  The SQL text is stored in LOG.  LOG is an SQLite\n"
+    "database with this schema:\n"
+    "\n"
+    "    CREATE TABLE sqllog(sql TEXT);\n"
+    "\n"
+    "This utility program analyzes statements contained in LOG and prints\n"
+    "a report showing how many times each index in DATABASE is used by the\n"
+    "statements in LOG.\n"
+    "\n"
+    "DATABASE only needs to contain the schema used by the statements in\n"
+    "LOG. The content can be removed from DATABASE.\n"
+  );
+  printf(
+    "\nOPTIONS:\n\n"
+    "    --progress N   Show a progress message after every N input rows\n"
+    "    -q             Omit error message when parsing log entries\n"
+    "    --using NAME   Print SQL statements that use index NAME\n"
+  );
+  printf("\nAnalysis will be done by SQLite version %s dated %.20s\n"
+         "checkin number %.40s. Different versions\n"
+         "of SQLite might use different indexes.\n",
+         sqlite3_libversion(), sqlite3_sourceid(), sqlite3_sourceid()+21);
+  exit(1);
+}
+
+int main(int argc, char **argv){
+  sqlite3 *db = 0;          /* The main database */
+  sqlite3_stmt *pStmt = 0;  /* a query */
+  char *zSql;
+  int nErr = 0;
+  int rc;
+  int bQuiet = 0;
+  int i, j;
+  const char *zUsing = 0;
+  sqlite3_stmt *pIncrCnt = 0;
+  int nRow = 0;
+  int iProgress = 0;
+
+  for(i=j=1; i<argc; i++){
+    const char *z = argv[i];
+    if( z[0]=='-' ){
+      z++;
+      if( z[0]=='-' ) z++;
+      if( strcmp(z,"progress")==0 ){
+        if( i+1<argc ){
+          iProgress = strtol(argv[++i],0,0);
+          continue;
+        }
+        printf("The --progress option requires an argument\n");
+        exit(0);
+      }
+      if( strcmp(z,"q")==0 ){
+        bQuiet = 1;
+        continue;
+      }
+      if( strcmp(z,"using")==0 ){
+        if( i+1<argc ){
+          zUsing = argv[++i];
+          continue;
+        }
+        printf("The --using option requires an argument\n");
+        exit(0);
+      }
+      if( strcmp(z, "help")==0 || strcmp(z, "?")==0 ){
+        usage(argv[0]);
+      }
+      printf("Unknown command-line option: \"%s\"\n", argv[i]);
+      exit(0);
+    }else{
+      if( j<i ) argv[j++] = argv[i];
+    }
+  }
+  argc = j;
+
+  if( argc!=3 ) usage(argv[0]);
+  rc = sqlite3_open_v2(argv[1], &db, SQLITE_OPEN_READONLY, 0);
+  if( rc ){
+    printf("Cannot open \"%s\" for reading: %s\n", argv[1], sqlite3_errmsg(db));
+    goto errorOut;
+  }
+  rc = sqlite3_prepare_v2(db, "SELECT * FROM sqlite_master", -1, &pStmt, 0);
+  if( rc ){
+    printf("Cannot read the schema from \"%s\" - %s\n", argv[1],
+           sqlite3_errmsg(db));
+    goto errorOut;
+  }
+  sqlite3_finalize(pStmt);
+  pStmt = 0;
+  rc = sqlite3_exec(db, 
+     "CREATE TABLE temp.idxu(\n"
+     "  tbl TEXT COLLATE nocase,\n"
+     "  idx TEXT COLLATE nocase,\n"
+     "  cnt INT,\n"
+     "  PRIMARY KEY(idx)\n"
+     ") WITHOUT ROWID;", 0, 0, 0);
+  if( rc ){
+    printf("Cannot create the result table - %s\n",
+           sqlite3_errmsg(db));
+    goto errorOut;
+  }
+  rc = sqlite3_exec(db,
+     "INSERT INTO temp.idxu(tbl,idx,cnt)"
+     " SELECT tbl_name, name, 0 FROM sqlite_master"
+     " WHERE type='index' AND sql IS NOT NULL", 0, 0, 0);
+
+  /* Open the LOG database */
+  zSql = sqlite3_mprintf("ATTACH %Q AS log", argv[2]);
+  rc = sqlite3_exec(db, zSql, 0, 0, 0);
+  sqlite3_free(zSql);
+  if( rc ){
+    printf("Cannot open the LOG database \"%s\" - %s\n",
+           argv[2], sqlite3_errmsg(db));
+    goto errorOut;
+  }
+  rc = sqlite3_prepare_v2(db,
+     "SELECT sql, rowid FROM log.sqllog"
+     " WHERE upper(substr(sql,1,5)) NOT IN ('BEGIN','COMMI','ROLLB','PRAGM')",
+                          -1, &pStmt, 0);
+  if( rc ){
+    printf("Cannot read the SQLLOG table in the LOG database \"%s\" - %s\n",
+           argv[2], sqlite3_errmsg(db));
+    goto errorOut;
+  }
+
+  rc = sqlite3_prepare_v2(db,
+    "UPDATE temp.idxu SET cnt=cnt+1 WHERE idx=?1",
+    -1, &pIncrCnt, 0);
+  if( rc ){
+    printf("Cannot prepare a statement to increment a counter for "
+           "indexes used\n");
+    goto errorOut;
+  }
+
+  /* Update the counts based on LOG */
+  while( sqlite3_step(pStmt)==SQLITE_ROW ){
+    const char *zLog = (const char*)sqlite3_column_text(pStmt, 0);
+    sqlite3_stmt *pS2;
+    if( zLog==0 ) continue;
+    zSql = sqlite3_mprintf("EXPLAIN QUERY PLAN %s", zLog);
+    rc = sqlite3_prepare_v2(db, zSql, -1, &pS2, 0);
+    sqlite3_free(zSql);
+    if( rc ){
+      if( !bQuiet ){
+        printf("Cannot compile LOG entry %d (%s): %s\n",
+             sqlite3_column_int(pStmt, 1), zLog, sqlite3_errmsg(db));
+        fflush(stdout);
+      }
+      nErr++;
+    }else{
+      nRow++;
+      if( iProgress>0 && (nRow%iProgress)==0 ){
+        printf("%d...\n", nRow);
+        fflush(stdout);
+      }
+      while( sqlite3_step(pS2)==SQLITE_ROW ){
+        const char *zExplain = (const char*)sqlite3_column_text(pS2,3);
+        const char *z1, *z2;
+        int n;
+        /* printf("EXPLAIN: %s\n", zExplain); */
+        z1 = strstr(zExplain, " USING INDEX ");
+        if( z1==0 ) continue;
+        z1 += 13;
+        for(z2=z1+1; z2[0] && z2[1]!='('; z2++){}
+        n = z2 - z1;
+        if( zUsing && sqlite3_strnicmp(zUsing, z1, n)==0 ){
+          printf("Using %s:\n%s\n", zUsing, zLog);
+          fflush(stdout);
+        }
+        sqlite3_bind_text(pIncrCnt,1,z1,n,SQLITE_STATIC);
+        sqlite3_step(pIncrCnt);
+        sqlite3_reset(pIncrCnt);
+      }
+    }
+    sqlite3_finalize(pS2);
+  }
+  sqlite3_finalize(pStmt);
+
+  /* Generate the report */
+  rc = sqlite3_prepare_v2(db,
+     "SELECT tbl, idx, cnt, "
+     "   (SELECT group_concat(name,',') FROM pragma_index_info(idx))"
+     " FROM temp.idxu, main.sqlite_master"
+     " WHERE temp.idxu.tbl=main.sqlite_master.tbl_name"
+     "   AND temp.idxu.idx=main.sqlite_master.name"
+     " ORDER BY cnt DESC, tbl, idx",
+     -1, &pStmt, 0);
+  if( rc ){
+    printf("Cannot query the result table - %s\n",
+           sqlite3_errmsg(db));
+    goto errorOut;
+  }
+  while( sqlite3_step(pStmt)==SQLITE_ROW ){
+    printf("%10d %s on %s(%s)\n", 
+       sqlite3_column_int(pStmt, 2),
+       sqlite3_column_text(pStmt, 1),
+       sqlite3_column_text(pStmt, 0),
+       sqlite3_column_text(pStmt, 3));
+  }
+  sqlite3_finalize(pStmt);
+  pStmt = 0;
+
+errorOut:
+  sqlite3_finalize(pIncrCnt);
+  sqlite3_finalize(pStmt);
+  sqlite3_close(db);
+  return nErr;
+}

Index: tool/lemon.c
==================================================================
--- tool/lemon.c
+++ tool/lemon.c
@@ -4588,17 +4588,24 @@
 
   /* Generate code which executes whenever the parser stack overflows */
   tplt_print(out,lemp,lemp->overflow,&lineno);
   tplt_xfer(lemp->name,in,out,&lineno);
 
-  /* Generate the table of rule information
+  /* Generate the tables of rule information.  yyRuleInfoLhs[] and
+  ** yyRuleInfoNRhs[].
   **
   ** Note: This code depends on the fact that rules are number
   ** sequentually beginning with 0.
   */
   for(i=0, rp=lemp->rule; rp; rp=rp->next, i++){
-    fprintf(out,"  { %4d, %4d }, /* (%d) ",rp->lhs->index,-rp->nrhs,i);
+    fprintf(out,"  %4d,  /* (%d) ", rp->lhs->index, i);
+     rule_print(out, rp);
+    fprintf(out," */\n"); lineno++;
+  }
+  tplt_xfer(lemp->name,in,out,&lineno);
+  for(i=0, rp=lemp->rule; rp; rp=rp->next, i++){
+    fprintf(out,"  %3d,  /* (%d) ", -rp->nrhs, i);
     rule_print(out, rp);
     fprintf(out," */\n"); lineno++;
   }
   tplt_xfer(lemp->name,in,out,&lineno);
 
@@ -4665,10 +4672,11 @@
   tplt_xfer(lemp->name,in,out,&lineno);
 
   /* Append any addition code the user desires */
   tplt_print(out,lemp,lemp->extracode,&lineno);
 
+  acttab_free(pActtab);
   fclose(in);
   fclose(out);
   return;
 }
 

Index: tool/lempar.c
==================================================================
--- tool/lempar.c
+++ tool/lempar.c
@@ -21,10 +21,11 @@
 **
 ** The following is the concatenation of all %include directives from the
 ** input grammar file:
 */
 #include <stdio.h>
+#include <assert.h>
 /************ Begin %include sections from the grammar ************************/
 %%
 /**************** End of %include directives **********************************/
 /* These constants specify the various numeric values for terminal symbols
 ** in a format understandable to "makeheaders".  This section is blank unless
@@ -683,17 +684,19 @@
   yytos->major = yyMajor;
   yytos->minor.yy0 = yyMinor;
   yyTraceShift(yypParser, yyNewState, "Shift");
 }
 
-/* The following table contains information about every rule that
-** is used during the reduce.
-*/
-static const struct {
-  YYCODETYPE lhs;       /* Symbol on the left-hand side of the rule */
-  signed char nrhs;     /* Negative of the number of RHS symbols in the rule */
-} yyRuleInfo[] = {
+/* For rule J, yyRuleInfoLhs[J] contains the symbol on the left-hand side
+** of that rule */
+static const YYCODETYPE yyRuleInfoLhs[] = {
+%%
+};
+
+/* For rule J, yyRuleInfoNRhs[J] contains the negative of the number
+** of symbols on the right-hand side of that rule. */
+static const signed char yyRuleInfoNRhs[] = {
 %%
 };
 
 static void yy_accept(yyParser*);  /* Forward Declaration */
 
@@ -722,11 +725,11 @@
   (void)yyLookahead;
   (void)yyLookaheadToken;
   yymsp = yypParser->yytos;
 #ifndef NDEBUG
   if( yyTraceFILE && yyruleno<(int)(sizeof(yyRuleName)/sizeof(yyRuleName[0])) ){
-    yysize = yyRuleInfo[yyruleno].nrhs;
+    yysize = yyRuleInfoNRhs[yyruleno];
     if( yysize ){
       fprintf(yyTraceFILE, "%sReduce %d [%s], go to state %d.\n",
         yyTracePrompt,
         yyruleno, yyRuleName[yyruleno], yymsp[yysize].stateno);
     }else{
@@ -737,11 +740,11 @@
 #endif /* NDEBUG */
 
   /* Check that the stack is large enough to grow by a single entry
   ** if the RHS of the rule is empty.  This ensures that there is room
   ** enough on the stack to push the LHS value */
-  if( yyRuleInfo[yyruleno].nrhs==0 ){
+  if( yyRuleInfoNRhs[yyruleno]==0 ){
 #ifdef YYTRACKMAXSTACKDEPTH
     if( (int)(yypParser->yytos - yypParser->yystack)>yypParser->yyhwm ){
       yypParser->yyhwm++;
       assert( yypParser->yyhwm == (int)(yypParser->yytos - yypParser->yystack));
     }
@@ -779,13 +782,13 @@
   */
 /********** Begin reduce actions **********************************************/
 %%
 /********** End reduce actions ************************************************/
   };
-  assert( yyruleno<sizeof(yyRuleInfo)/sizeof(yyRuleInfo[0]) );
-  yygoto = yyRuleInfo[yyruleno].lhs;
-  yysize = yyRuleInfo[yyruleno].nrhs;
+  assert( yyruleno<sizeof(yyRuleInfoLhs)/sizeof(yyRuleInfoLhs[0]) );
+  yygoto = yyRuleInfoLhs[yyruleno];
+  yysize = yyRuleInfoNRhs[yyruleno];
   yyact = yy_find_reduce_action(yymsp[yysize].stateno,(YYCODETYPE)yygoto);
 
   /* There are no SHIFTREDUCE actions on nonterminals because the table
   ** generator has simplified them to pure REDUCE actions. */
   assert( !(yyact>YY_MAX_SHIFT && yyact<=YY_MAX_SHIFTREDUCE) );
@@ -985,14 +988,13 @@
 #endif
         yy_destructor(yypParser, (YYCODETYPE)yymajor, &yyminorunion);
         yymajor = YYNOCODE;
       }else{
         while( yypParser->yytos >= yypParser->yystack
-            && yymx != YYERRORSYMBOL
             && (yyact = yy_find_reduce_action(
                         yypParser->yytos->stateno,
-                        YYERRORSYMBOL)) >= YY_MIN_REDUCE
+                        YYERRORSYMBOL)) > YY_MAX_SHIFTREDUCE
         ){
           yy_pop_parser_stack(yypParser);
         }
         if( yypParser->yytos < yypParser->yystack || yymajor==0 ){
           yy_destructor(yypParser,(YYCODETYPE)yymajor,&yyminorunion);

Index: tool/mkpragmatab.tcl
==================================================================
--- tool/mkpragmatab.tcl
+++ tool/mkpragmatab.tcl
@@ -23,25 +23,29 @@
 set pragma_def {
   NAME: full_column_names
   TYPE: FLAG
   ARG:  SQLITE_FullColNames
   IF:   !defined(SQLITE_OMIT_FLAG_PRAGMAS)
+  IF:   !defined(SQLITE_OMIT_DEPRECATED)
 
   NAME: short_column_names
   TYPE: FLAG
   ARG:  SQLITE_ShortColNames
   IF:   !defined(SQLITE_OMIT_FLAG_PRAGMAS)
+  IF:   !defined(SQLITE_OMIT_DEPRECATED)
 
   NAME: count_changes
   TYPE: FLAG
   ARG:  SQLITE_CountRows
   IF:   !defined(SQLITE_OMIT_FLAG_PRAGMAS)
+  IF:   !defined(SQLITE_OMIT_DEPRECATED)
 
   NAME: empty_result_callbacks
   TYPE: FLAG
   ARG:  SQLITE_NullCallback
   IF:   !defined(SQLITE_OMIT_FLAG_PRAGMAS)
+  IF:   !defined(SQLITE_OMIT_DEPRECATED)
 
   NAME: legacy_file_format
   TYPE: FLAG
   ARG:  SQLITE_LegacyFileFmt
   IF:   !defined(SQLITE_OMIT_FLAG_PRAGMAS)
@@ -150,11 +154,13 @@
   ARG:  SQLITE_CellSizeCk
 
   NAME: default_cache_size
   FLAG: NeedSchema Result0 SchemaReq NoColumns1
   COLS: cache_size
-  IF:   !defined(SQLITE_OMIT_PAGER_PRAGMAS) && !defined(SQLITE_OMIT_DEPRECATED)
+  IF:   !defined(SQLITE_OMIT_PAGER_PRAGMAS)
+  IF:   !defined(SQLITE_OMIT_DEPRECATED)
+
 
   NAME: page_size
   FLAG: Result0 SchemaReq NoColumns1
   IF:   !defined(SQLITE_OMIT_PAGER_PRAGMAS)
 
@@ -292,11 +298,14 @@
   FLAG: NeedSchema Result0
   COLS: table rowid parent fkid
   IF:   !defined(SQLITE_OMIT_FOREIGN_KEY) && !defined(SQLITE_OMIT_TRIGGER)
 
   NAME: parser_trace
-  IF:   defined(SQLITE_DEBUG) && !defined(SQLITE_OMIT_PARSER_TRACE)
+  TYPE: FLAG
+  ARG:  SQLITE_ParserTrace
+  IF:   !defined(SQLITE_OMIT_FLAG_PRAGMAS)
+  IF:   defined(SQLITE_DEBUG)
 
   NAME: case_sensitive_like
   FLAG: NoColumns
 
   NAME: integrity_check

Index: tool/sqldiff.c
==================================================================
--- tool/sqldiff.c
+++ tool/sqldiff.c
@@ -1491,38 +1491,38 @@
 }
 
 /*
 ** Write an SQLite value onto out.
 */
-static void putValue(FILE *out, sqlite3_value *pVal){
-  int iDType = sqlite3_value_type(pVal);
+static void putValue(FILE *out, sqlite3_stmt *pStmt, int k){
+  int iDType = sqlite3_column_type(pStmt, k);
   sqlite3_int64 iX;
   double rX;
   sqlite3_uint64 uX;
   int j;
 
   putc(iDType, out);
   switch( iDType ){
     case SQLITE_INTEGER:
-      iX = sqlite3_value_int64(pVal);
+      iX = sqlite3_column_int64(pStmt, k);
       memcpy(&uX, &iX, 8);
       for(j=56; j>=0; j-=8) putc((uX>>j)&0xff, out);
       break;
     case SQLITE_FLOAT:
-      rX = sqlite3_value_double(pVal);
+      rX = sqlite3_column_double(pStmt, k);
       memcpy(&uX, &rX, 8);
       for(j=56; j>=0; j-=8) putc((uX>>j)&0xff, out);
       break;
     case SQLITE_TEXT:
-      iX = sqlite3_value_bytes(pVal);
+      iX = sqlite3_column_bytes(pStmt, k);
       putsVarint(out, (sqlite3_uint64)iX);
-      fwrite(sqlite3_value_text(pVal),1,(size_t)iX,out);
+      fwrite(sqlite3_column_text(pStmt, k),1,(size_t)iX,out);
       break;
     case SQLITE_BLOB:
-      iX = sqlite3_value_bytes(pVal);
+      iX = sqlite3_column_bytes(pStmt, k);
       putsVarint(out, (sqlite3_uint64)iX);
-      fwrite(sqlite3_value_blob(pVal),1,(size_t)iX,out);
+      fwrite(sqlite3_column_blob(pStmt, k),1,(size_t)iX,out);
       break;
     case SQLITE_NULL:
       break;
   }
 }
@@ -1648,14 +1648,14 @@
     putc(0, out);
     switch( sqlite3_column_int(pStmt,0) ){
       case SQLITE_UPDATE: {
         for(k=1, i=0; i<nCol; i++){
           if( aiFlg[i] ){
-            putValue(out, sqlite3_column_value(pStmt,k));
+            putValue(out, pStmt, k);
             k++;
           }else if( sqlite3_column_int(pStmt,k) ){
-            putValue(out, sqlite3_column_value(pStmt,k+1));
+            putValue(out, pStmt, k+1);
             k += 3;
           }else{
             putc(0, out);
             k += 3;
           }
@@ -1663,11 +1663,11 @@
         for(k=1, i=0; i<nCol; i++){
           if( aiFlg[i] ){
             putc(0, out);
             k++;
           }else if( sqlite3_column_int(pStmt,k) ){
-            putValue(out, sqlite3_column_value(pStmt,k+2));
+            putValue(out, pStmt, k+2);
             k += 3;
           }else{
             putc(0, out);
             k += 3;
           }
@@ -1675,26 +1675,26 @@
         break;
       }
       case SQLITE_INSERT: {
         for(k=1, i=0; i<nCol; i++){
           if( aiFlg[i] ){
-            putValue(out, sqlite3_column_value(pStmt,k));
+            putValue(out, pStmt, k);
             k++;
           }else{
-            putValue(out, sqlite3_column_value(pStmt,k+2));
+            putValue(out, pStmt, k+2);
             k += 3;
           }
         }
         break;
       }
       case SQLITE_DELETE: {
         for(k=1, i=0; i<nCol; i++){
           if( aiFlg[i] ){
-            putValue(out, sqlite3_column_value(pStmt,k));
+            putValue(out, pStmt, k);
             k++;
           }else{
-            putValue(out, sqlite3_column_value(pStmt,k+1));
+            putValue(out, pStmt, k+1);
             k += 3;
           }
         }
         break;
       }

Index: tool/warnings.sh
==================================================================
--- tool/warnings.sh
+++ tool/warnings.sh
@@ -14,14 +14,14 @@
   WARNING_ANDROID_OPTS="-Wshadow -Wall -Wextra"
 fi
 
 rm -f sqlite3.c
 make sqlite3.c
-echo '********** No optimizations.  Includes FTS4/5, RTREE, JSON1 ***'
+echo '********** No optimizations.  Includes FTS4/5, GEOPOLY, JSON1 ***'
 echo '**********    ' Options: $WARNING_OPTS
 gcc -c $WARNING_OPTS -std=c89 \
-      -ansi -DHAVE_STDINT_H -DSQLITE_ENABLE_FTS4 -DSQLITE_ENABLE_RTREE \
+      -ansi -DHAVE_STDINT_H -DSQLITE_ENABLE_FTS4 -DSQLITE_ENABLE_GEOPOLY \
       -DSQLITE_ENABLE_FTS5 -DSQLITE_ENABLE_JSON1 \
       sqlite3.c
 if test x`uname` = 'xLinux'; then
 echo '********** Android configuration ******************************'
 echo '**********    ' Options: $WARNING_ANDROID_OPTS
@@ -50,11 +50,11 @@
 echo '********** No optimizations. ENABLE_STAT4. THREADSAFE=0 *******'
 echo '**********    ' Options: $WARNING_OPTS
 gcc -c $WARNING_OPTS -std=c89 \
       -ansi -DSQLITE_ENABLE_STAT4 -DSQLITE_THREADSAFE=0 \
       sqlite3.c
-echo '********** Optimized -O3.  Includes FTS4/5, RTREE, JSON1 ******'
+echo '********** Optimized -O3.  Includes FTS4/5, GEOPOLY, JSON1 ******'
 echo '**********    ' Options: $WARNING_OPTS
 gcc -O3 -c $WARNING_OPTS -std=c89 \
-      -ansi -DHAVE_STDINT_H -DSQLITE_ENABLE_FTS4 -DSQLITE_ENABLE_RTREE \
+      -ansi -DHAVE_STDINT_H -DSQLITE_ENABLE_FTS4 -DSQLITE_ENABLE_GEOPOLY \
       -DSQLITE_ENABLE_FTS5 -DSQLITE_ENABLE_JSON1 \
       sqlite3.c