Earlier error detection for index expression usage by aggregate functions.

dbsqlfuzz 29214ace4e25c98d2ddff8fbcf97afdda23f28b9

FossilOrigin-Name: 8e841e7f025f7205959453875f2d9db36271642045593970a2b2fc20b2f847c3

1 files changed, 4 insertions, 1 deletions

diff --git a/src/expr.c b/src/expr.c
index e5a16ca77..4b536a843 100644
--- a/src/expr.c
+++ b/src/expr.c
@@ -6452,6 +6452,7 @@ static int analyzeAggregate(Walker *pWalker, Expr *pExpr){
       if( pIEpr==0 ) break;
       if( NEVER(!ExprUseYTab(pExpr)) ) break;
       if( pExpr->pAggInfo!=0 ) break; /* Already resolved by outer context */
+      if( pParse->nErr ){ return WRC_Abort; }
 
       /* If we reach this point, it means that expression pExpr can be
       ** translated into a reference to an index column as described by
@@ -6462,7 +6463,9 @@ static int analyzeAggregate(Walker *pWalker, Expr *pExpr){
       tmp.iTable = pIEpr->iIdxCur;
       tmp.iColumn = pIEpr->iIdxCol;
       findOrCreateAggInfoColumn(pParse, pAggInfo, &tmp);
-      if( pParse->nErr ) return WRC_Abort;
+      if( pParse->nErr ){ return WRC_Abort; }
+      assert( pAggInfo->aCol!=0 );
+      assert( tmp.iAgg<pAggInfo->nColumn );
       pAggInfo->aCol[tmp.iAgg].pCExpr = pExpr;
       pExpr->pAggInfo = pAggInfo;
       pExpr->iAgg = tmp.iAgg;