Improvements to register allocation, especially in the ANALYZE command.

New assert() statements added to help verify that memory allocation is
correct, and to help fuzzer find lingering errors.

FossilOrigin-Name: 6f8b97f31a4c8552312b4c98432ea356ae54c06d9cc929969f50c3c88360cd7b

4 files changed, 53 insertions, 18 deletions

diff --git a/src/analyze.c b/src/analyze.c
index 086a58494..b6b59a6b7 100644
--- a/src/analyze.c
+++ b/src/analyze.c
@@ -198,7 +198,6 @@ static void openStatTable(
   assert( sqlite3BtreeHoldsAllMutexes(db) );
   assert( sqlite3VdbeDb(v)==db );
   pDb = &db->aDb[iDb];
-  pParse->okConstFactor = 0;
 
   /* Create new statistic tables if they do not exist, or clear them
   ** if they do already exist.
@@ -1002,7 +1001,8 @@ static void analyzeOneTable(
   Table *pStat1 = 0;
 #endif
 
-  pParse->nMem = MAX(pParse->nMem, iMem);
+  sqlite3TouchRegister(pParse, iMem);
+  assert( sqlite3NoTempsInRange(pParse, regNewRowid, iMem) );
   v = sqlite3GetVdbe(pParse);
   if( v==0 || NEVER(pTab==0) ){
     return;
@@ -1108,7 +1108,7 @@ static void analyzeOneTable(
     ** the regPrev array and a trailing rowid (the rowid slot is required
     ** when building a record to insert into the sample column of 
     ** the sqlite_stat4 table.  */
-    pParse->nMem = MAX(pParse->nMem, regPrev+nColTest);
+    sqlite3TouchRegister(pParse, regPrev+nColTest);
 
     /* Open a read-only cursor on the index being analyzed. */
     assert( iDb==sqlite3SchemaToIndex(db, pIdx->pSchema) );
@@ -1296,24 +1296,19 @@ static void analyzeOneTable(
         }
 
         /* Allocate space to compute results for the largest index */
-        pParse->nMem = MAX(pParse->nMem, regCol+mxCol);
+        sqlite3TouchRegister(pParse, regCol+mxCol);
         doOnce = 0;
 #ifdef SQLITE_DEBUG
-        /* Verify that setting pParse->nTempReg to zero below really
-        ** is needed in some cases, in order to excise all temporary
-        ** registers from the middle of the STAT4 buffer.  
+        /* Verify that the call to sqlite3ClearTempRegCache() below
+        ** really is needed.
         ** https://sqlite.org/forum/forumpost/83cb4a95a0 (2023-03-25)
         */
-        if( pParse->nTempReg>0 ){
-          int kk;
-          for(kk=0; kk<pParse->nTempReg; kk++){
-            int regT = pParse->aTempReg[kk];
-            testcase( regT>=regCol && regT<regCol+mxCol );
-          }
-        }
+        testcase( !sqlite3NoTempsInRange(pParse, regEq, regCol+mxCol) );
 #endif
-        pParse->nTempReg = 0;  /* tag-20230325-1 */
+        sqlite3ClearTempRegCache(pParse);  /* tag-20230325-1 */
+        assert( sqlite3NoTempsInRange(pParse, regEq, regCol+mxCol) );
       }
+      assert( sqlite3NoTempsInRange(pParse, regEq, regCol+nCol) );
 
       addrNext = sqlite3VdbeCurrentAddr(v);
       callStatGet(pParse, regStat, STAT_GET_ROWID, regSampleRowid);
@@ -1394,6 +1389,7 @@ static void analyzeDatabase(Parse *pParse, int iDb){
   for(k=sqliteHashFirst(&pSchema->tblHash); k; k=sqliteHashNext(k)){
     Table *pTab = (Table*)sqliteHashData(k);
     analyzeOneTable(pParse, pTab, 0, iStatCur, iMem, iTab);
+    iMem = sqlite3FirstAvailableRegister(pParse, iMem);
   }
   loadAnalysis(pParse, iDb);
 }
diff --git a/src/expr.c b/src/expr.c
index cd09c0d71..564dfc7fb 100644
--- a/src/expr.c
+++ b/src/expr.c
@@ -6636,6 +6636,35 @@ void sqlite3ClearTempRegCache(Parse *pParse){
 }
 
 /*
+** Make sure sufficient registers have been allocated so that
+** iReg is a valid register number.
+*/
+void sqlite3TouchRegister(Parse *pParse, int iReg){
+  if( pParse->nMem<iReg ) pParse->nMem = iReg;
+}
+
+/*
+** Return the latest reusable register in the set of all registers.
+** The value returned is no less than iMin.  If any register iMin or
+** greater is in permanent use, then return one more than that last
+** permanent register.
+*/
+int sqlite3FirstAvailableRegister(Parse *pParse, int iMin){
+  const ExprList *pList = pParse->pConstExpr;
+  if( pList ){
+    int i;
+    for(i=0; i<pList->nExpr; i++){
+      if( pList->a[i].u.iConstExprReg>=iMin ){
+        iMin = pList->a[i].u.iConstExprReg + 1;
+      }
+    }
+  }
+  pParse->nTempReg = 0;
+  pParse->nRangeReg = 0;
+  return iMin;
+}
+
+/*
 ** Validate that no temporary register falls within the range of
 ** iFirst..iLast, inclusive.  This routine is only call from within assert()
 ** statements.
@@ -6654,6 +6683,14 @@ int sqlite3NoTempsInRange(Parse *pParse, int iFirst, int iLast){
       return 0;
     }
   }
+  if( pParse->pConstExpr ){
+    ExprList *pList = pParse->pConstExpr;
+    for(i=0; i<pList->nExpr; i++){
+      int iReg = pList->a[i].u.iConstExprReg;
+      if( iReg==0 ) continue;
+      if( iReg>=iFirst && iReg<=iLast ) return 0;
+    }
+  }
   return 1;
 }
 #endif /* SQLITE_DEBUG */
diff --git a/src/pragma.c b/src/pragma.c
index cd8d51c73..4686adfad 100644
--- a/src/pragma.c
+++ b/src/pragma.c
@@ -1524,7 +1524,7 @@ void sqlite3Pragma(
       zDb = db->aDb[iDb].zDbSName;
       sqlite3CodeVerifySchema(pParse, iDb);
       sqlite3TableLock(pParse, iDb, pTab->tnum, 0, pTab->zName);
-      if( pTab->nCol+regRow>pParse->nMem ) pParse->nMem = pTab->nCol + regRow;
+      sqlite3TouchRegister(pParse, pTab->nCol+regRow);
       sqlite3OpenTable(pParse, 0, iDb, pTab, OP_OpenRead);
       sqlite3VdbeLoadString(v, regResult, pTab->zName);
       assert( IsOrdinaryTable(pTab) );
@@ -1565,7 +1565,7 @@ void sqlite3Pragma(
         ** regRow..regRow+n. If any of the child key values are NULL, this 
         ** row cannot cause an FK violation. Jump directly to addrOk in 
         ** this case. */
-        if( regRow+pFK->nCol>pParse->nMem ) pParse->nMem = regRow+pFK->nCol;
+        sqlite3TouchRegister(pParse, regRow + pFK->nCol);
         for(j=0; j<pFK->nCol; j++){
           int iCol = aiCols ? aiCols[j] : pFK->aCol[j].iFrom;
           sqlite3ExprCodeGetColumnOfTable(v, pTab, 0, iCol, regRow+j);
@@ -1729,7 +1729,7 @@ void sqlite3Pragma(
       aRoot[0] = cnt;
 
       /* Make sure sufficient number of registers have been allocated */
-      pParse->nMem = MAX( pParse->nMem, 8+mxIdx );
+      sqlite3TouchRegister(pParse, 8+mxIdx);
       sqlite3ClearTempRegCache(pParse);
 
       /* Do the b-tree integrity checks */
diff --git a/src/sqliteInt.h b/src/sqliteInt.h
index 8cb0198a2..d6560c51b 100644
--- a/src/sqliteInt.h
+++ b/src/sqliteInt.h
@@ -4649,6 +4649,8 @@ void sqlite3ReleaseTempReg(Parse*,int);
 int sqlite3GetTempRange(Parse*,int);
 void sqlite3ReleaseTempRange(Parse*,int,int);
 void sqlite3ClearTempRegCache(Parse*);
+void sqlite3TouchRegister(Parse*,int);
+int sqlite3FirstAvailableRegister(Parse*,int);
 #ifdef SQLITE_DEBUG
 int sqlite3NoTempsInRange(Parse*,int,int);
 #endif