Fix a crash that could occur if a sub-select inside an EXISTS expression features an ORDER BY clause containing one or more window functions.

FossilOrigin-Name: 9768e7db624fbfe688d61ac06bffca14a169d439d8f65f5a14529af5660d3d2e

1 files changed, 5 insertions, 1 deletions

diff --git a/src/select.c b/src/select.c
index 53c83c9a3..10203156e 100644
--- a/src/select.c
+++ b/src/select.c
@@ -85,12 +85,16 @@ static void clearSelect(sqlite3 *db, Select *p, int bFree){
     sqlite3ExprDelete(db, p->pHaving);
     sqlite3ExprListDelete(db, p->pOrderBy);
     sqlite3ExprDelete(db, p->pLimit);
+    if( OK_IF_ALWAYS_TRUE(p->pWith) ) sqlite3WithDelete(db, p->pWith);
 #ifndef SQLITE_OMIT_WINDOWFUNC
     if( OK_IF_ALWAYS_TRUE(p->pWinDefn) ){
       sqlite3WindowListDelete(db, p->pWinDefn);
     }
+    while( p->pWin ){
+      assert( p->pWin->ppThis==&p->pWin );
+      sqlite3WindowUnlinkFromSelect(p->pWin);
+    }
 #endif
-    if( OK_IF_ALWAYS_TRUE(p->pWith) ) sqlite3WithDelete(db, p->pWith);
     if( bFree ) sqlite3DbFreeNN(db, p);
     p = pPrior;
     bFree = 1;