Take care when checking the table of a TK_COLUMN expression node to see if the

table is a virtual table to first ensure that the Expr.y.pTab pointer is not
null due to generated column optimizations.  Ticket [4374860b29383380].

FossilOrigin-Name: 9d0d4ab95dc0c56e053c2924ed322a9ea7b25439e6f74599f706905a1994e454

3 files changed, 16 insertions, 6 deletions

diff --git a/src/expr.c b/src/expr.c
index 46a3f9f57..be23a5bd5 100644
--- a/src/expr.c
+++ b/src/expr.c
@@ -2245,6 +2245,15 @@ int sqlite3ExprIsInteger(Expr *p, int *pValue){
 }
 
 /*
+** Return true if p is a Column node that references a virtual table.
+*/
+int sqlite3ExprIsVtabRef(Expr *p){
+  if( p->op!=TK_COLUMN ) return 0;
+  if( p->y.pTab==0 ) return 0;
+  return IsVirtual(p->y.pTab);
+}
+
+/*
 ** Return FALSE if there is no chance that the expression can be NULL.
 **
 ** If the expression might be NULL or if the expression is too complex
@@ -5479,8 +5488,8 @@ static int impliesNotNullRow(Walker *pWalker, Expr *pExpr){
       testcase( pExpr->op==TK_LE );
       testcase( pExpr->op==TK_GT );
       testcase( pExpr->op==TK_GE );
-      if( (pExpr->pLeft->op==TK_COLUMN && IsVirtual(pExpr->pLeft->y.pTab))
-       || (pExpr->pRight->op==TK_COLUMN && IsVirtual(pExpr->pRight->y.pTab))
+      if( sqlite3ExprIsVtabRef(pExpr->pLeft)
+       || sqlite3ExprIsVtabRef(pExpr->pRight)
       ){
        return WRC_Prune;
       }
diff --git a/src/sqliteInt.h b/src/sqliteInt.h
index 4040f01a4..c42a9e8c6 100644
--- a/src/sqliteInt.h
+++ b/src/sqliteInt.h
@@ -4278,6 +4278,7 @@ int sqlite3ExprIsTableConstant(Expr*,int);
 int sqlite3ExprContainsSubquery(Expr*);
 #endif
 int sqlite3ExprIsInteger(Expr*, int*);
+int sqlite3ExprIsVtabRef(Expr*);
 int sqlite3ExprCanBeNull(const Expr*);
 int sqlite3ExprNeedsNoAffinityChange(const Expr*, char);
 int sqlite3IsRowid(const char*);
diff --git a/src/whereexpr.c b/src/whereexpr.c
index cec0aefd8..e99a44f15 100644
--- a/src/whereexpr.c
+++ b/src/whereexpr.c
@@ -377,7 +377,7 @@ static int isAuxiliaryVtabOperator(
     **       MATCH(expression,vtab_column)
     */
     pCol = pList->a[1].pExpr;
-    if( pCol->op==TK_COLUMN && IsVirtual(pCol->y.pTab) ){
+    if( sqlite3ExprIsVtabRef(pCol) ){
       for(i=0; i<ArraySize(aOp); i++){
         if( sqlite3StrICmp(pExpr->u.zToken, aOp[i].zOp)==0 ){
           *peOp2 = aOp[i].eOp2;
@@ -399,7 +399,7 @@ static int isAuxiliaryVtabOperator(
     ** with function names in an arbitrary case.
     */
     pCol = pList->a[0].pExpr;
-    if( pCol->op==TK_COLUMN && IsVirtual(pCol->y.pTab) ){
+    if( sqlite3ExprIsVtabRef(pCol) ){
       sqlite3_vtab *pVtab;
       sqlite3_module *pMod;
       void (*xNotUsed)(sqlite3_context*,int,sqlite3_value**);
@@ -422,10 +422,10 @@ static int isAuxiliaryVtabOperator(
     int res = 0;
     Expr *pLeft = pExpr->pLeft;
     Expr *pRight = pExpr->pRight;
-    if( pLeft->op==TK_COLUMN && IsVirtual(pLeft->y.pTab) ){
+    if( sqlite3ExprIsVtabRef(pLeft) ){
       res++;
     }
-    if( pRight && pRight->op==TK_COLUMN && IsVirtual(pRight->y.pTab) ){
+    if( pRight && sqlite3ExprIsVtabRef(pRight) ){
       res++;
       SWAP(Expr*, pLeft, pRight);
     }