[sqlite] Segmentation fault when using window function with (nested?) subquery

[Gene Sacky]

This query causes segmentation fault in SQLite 3.26.0 (on macOS 10.14.1).
--------------
SELECT * FROM(
SELECT * FROM (SELECT 1 AS c) WHERE c IN (
SELECT (row_number() OVER()) FROM (VALUES (0))
)
)
--------------

However, no error occurs in the following queries. The only difference is
whether it is wrapped with "SELECT * FROM" .
--------------
SELECT * FROM(
SELECT 1 AS c WHERE c IN (
SELECT (row_number() OVER()) FROM (VALUES (0))
)
)
--------------

--------------
SELECT * FROM (SELECT 1 AS c) WHERE c IN (
SELECT (row_number() OVER()) FROM (VALUES (0))
)
--------------


I found similar bug report about window function but I think it is unrelated
because it was fixed before 3.26.0.
http://sqlite.1065341.n5.nabble.com/Segmentation-Fault-When-Using-Window-Function-td104584.html






--
Sent from: http://sqlite.1065341.n5.nabble.com/

[Larry Brasfield]

Post by Gene Sacky
This query causes segmentation fault in SQLite 3.26.0 (on macOS 10.14.1).
--------------
SELECT * FROM(
SELECT * FROM (SELECT 1 AS c) WHERE c IN (
SELECT (row_number() OVER()) FROM (VALUES (0))
)
)
--------------
However, no error occurs in the following queries. The only difference is
whether it is wrapped with "SELECT * FROM" .
--------------
SELECT * FROM(
SELECT 1 AS c WHERE c IN (
SELECT (row_number() OVER()) FROM (VALUES (0))
)
)
--------------
--------------
SELECT * FROM (SELECT 1 AS c) WHERE c IN (
SELECT (row_number() OVER()) FROM (VALUES (0))
)
--------------

The above fault and non-fault also occur on Windows 10 x64 (with a 64-bit build) with the SQLite3 v3.26 shell. I can provide build options and compile flags if that would be useful.

[Richard Hipp]

Post by Larry Brasfield
The above fault and non-fault also occur on Windows 10 x64 (with a 64-bit
build) with the SQLite3 v3.26 shell. I can provide build options and
compile flags if that would be useful.

Thanks, but I have no trouble reproducing the problem. It is an issue
with the byte-code generator for window functions. If you run with
assert()s enabled, it hits an assert() early on. This problem has
existed ever since window functions were added in version 3.25.0. It
is not something new to 3.26.0.