Index: src/whereInt.h
==================================================================
--- src/whereInt.h
+++ src/whereInt.h
@@ -282,10 +282,11 @@
 #endif
 #define TERM_LIKEOPT    0x100  /* Virtual terms from the LIKE optimization */
 #define TERM_LIKECOND   0x200  /* Conditionally this LIKE operator term */
 #define TERM_LIKE       0x400  /* The original LIKE operator */
 #define TERM_IS         0x800  /* Term.pExpr is an IS operator */
+#define TERM_VARSELECT  0x1000 /* Term.pExpr contains a correlated sub-query */
 
 /*
 ** An instance of the WhereScan object is used as an iterator for locating
 ** terms in the WHERE clause that are useful to the query planner.
 */
@@ -371,10 +372,11 @@
 ** does not really matter.  What is important is that sparse cursor
 ** numbers all get mapped into bit numbers that begin with 0 and contain
 ** no gaps.
 */
 struct WhereMaskSet {
+  int bVarSelect;               /* Used by sqlite3WhereExprUsage() */
   int n;                        /* Number of assigned cursor values */
   int ix[BMS];                  /* Cursor assigned to each bit */
 };
 
 /*

Index: src/wherecode.c
==================================================================
--- src/wherecode.c
+++ src/wherecode.c
@@ -1128,11 +1128,11 @@
   int addrHalt;                   /* addrBrk for the outermost loop */
   int addrCont;                   /* Jump here to continue with next cycle */
   int iRowidReg = 0;        /* Rowid is stored in this register, if not zero */
   int iReleaseReg = 0;      /* Temp register to free before returning */
   Index *pIdx = 0;          /* Index used by loop (if any) */
-  int loopAgain;            /* True if constraint generator loop should repeat */
+  int iLoop;                /* Iteration of constraint generator loop */
 
   pParse = pWInfo->pParse;
   v = pParse->pVdbe;
   pWC = &pWInfo->sWC;
   db = pParse->db;
@@ -2023,17 +2023,24 @@
 #endif
 
   /* Insert code to test every subexpression that can be completely
   ** computed using the current set of tables.
   **
-  ** This loop may run either once (pIdx==0) or twice (pIdx!=0). If
-  ** it is run twice, then the first iteration codes those sub-expressions
-  ** that can be computed using columns from pIdx only (without seeking
-  ** the main table cursor). 
+  ** This loop may run between one and three times, depending on the
+  ** constraints to be generated. The value of stack variable iLoop
+  ** determines the constraints coded by each iteration, as follows:
+  **
+  ** iLoop==1: Code only expressions that are entirely covered by pIdx.
+  ** iLoop==2: Code remaining expressions that do not contain correlated
+  **           sub-queries.  
+  ** iLoop==3: Code all remaining expressions.
+  **
+  ** An effort is made to skip unnecessary iterations of the loop.
   */
+  iLoop = (pIdx ? 1 : 2);
   do{
-    loopAgain = 0;
+    int iNext = 0;                /* Next value for iLoop */
     for(pTerm=pWC->a, j=pWC->nTerm; j>0; j--, pTerm++){
       Expr *pE;
       int skipLikeAddr = 0;
       testcase( pTerm->wtFlags & TERM_VIRTUAL );
       testcase( pTerm->wtFlags & TERM_CODED );
@@ -2047,14 +2054,20 @@
       pE = pTerm->pExpr;
       assert( pE!=0 );
       if( pLevel->iLeftJoin && !ExprHasProperty(pE, EP_FromJoin) ){
         continue;
       }
-      if( pIdx && !sqlite3ExprCoveredByIndex(pE, pLevel->iTabCur, pIdx) ){
-        loopAgain = 1;
+      
+      if( iLoop==1 && !sqlite3ExprCoveredByIndex(pE, pLevel->iTabCur, pIdx) ){
+        iNext = 2;
+        continue;
+      }
+      if( iLoop<3 && (pTerm->wtFlags & TERM_VARSELECT) ){
+        if( iNext==0 ) iNext = 3;
         continue;
       }
+
       if( pTerm->wtFlags & TERM_LIKECOND ){
         /* If the TERM_LIKECOND flag is set, that means that the range search
         ** is sufficient to guarantee that the LIKE operator is true, so we
         ** can skip the call to the like(A,B) function.  But this only works
         ** for strings.  So do not skip the call to the function on the pass
@@ -2066,16 +2079,22 @@
         assert( x>0 );
         skipLikeAddr = sqlite3VdbeAddOp1(v, (x&1)?OP_IfNot:OP_If, (int)(x>>1));
         VdbeCoverage(v);
 #endif
       }
+#ifdef WHERETRACE_ENABLED /* 0xffff */
+      if( sqlite3WhereTrace ){
+        VdbeNoopComment((v, "WhereTerm[%d] (%p) priority=%d",
+                         pWC->nTerm-j, pTerm, iLoop));
+      }
+#endif
       sqlite3ExprIfFalse(pParse, pE, addrCont, SQLITE_JUMPIFNULL);
       if( skipLikeAddr ) sqlite3VdbeJumpHere(v, skipLikeAddr);
       pTerm->wtFlags |= TERM_CODED;
     }
-    pIdx = 0;
-  }while( loopAgain );
+    iLoop = iNext;
+  }while( iLoop>0 );
 
   /* Insert code to test for implied constraints based on transitivity
   ** of the "==" operator.
   **
   ** Example: If the WHERE clause contains "t1.a=t2.b" and "t2.b=123"

Index: src/whereexpr.c
==================================================================
--- src/whereexpr.c
+++ src/whereexpr.c
@@ -949,11 +949,13 @@
   }else if( op==TK_ISNULL ){
     pTerm->prereqRight = 0;
   }else{
     pTerm->prereqRight = sqlite3WhereExprUsage(pMaskSet, pExpr->pRight);
   }
+  pMaskSet->bVarSelect = 0;
   prereqAll = sqlite3WhereExprUsage(pMaskSet, pExpr);
+  if( pMaskSet->bVarSelect ) pTerm->wtFlags |= TERM_VARSELECT;
   if( ExprHasProperty(pExpr, EP_FromJoin) ){
     Bitmask x = sqlite3WhereGetMask(pMaskSet, pExpr->iRightJoinTable);
     prereqAll |= x;
     extraRight = x-1;  /* ON clause terms may not be used with an index
                        ** on left table of a LEFT JOIN.  Ticket #3015 */
@@ -1380,13 +1382,16 @@
   if( p->op==TK_COLUMN ){
     return sqlite3WhereGetMask(pMaskSet, p->iTable);
   }
   mask = (p->op==TK_IF_NULL_ROW) ? sqlite3WhereGetMask(pMaskSet, p->iTable) : 0;
   assert( !ExprHasProperty(p, EP_TokenOnly) );
-  if( p->pRight ) mask |= sqlite3WhereExprUsage(pMaskSet, p->pRight);
   if( p->pLeft ) mask |= sqlite3WhereExprUsage(pMaskSet, p->pLeft);
-  if( ExprHasProperty(p, EP_xIsSelect) ){
+  if( p->pRight ){
+    mask |= sqlite3WhereExprUsage(pMaskSet, p->pRight);
+    assert( p->x.pList==0 );
+  }else if( ExprHasProperty(p, EP_xIsSelect) ){
+    if( ExprHasProperty(p, EP_VarSelect) ) pMaskSet->bVarSelect = 1;
     mask |= exprSelectUsage(pMaskSet, p->x.pSelect);
   }else if( p->x.pList ){
     mask |= sqlite3WhereExprListUsage(pMaskSet, p->x.pList);
   }
   return mask;

Index: test/pushdown.test
==================================================================
--- test/pushdown.test
+++ test/pushdown.test
@@ -53,7 +53,40 @@
 do_test 1.5 {
   set L [list]
   execsql { SELECT * FROM t1 WHERE a=3 AND f(c) AND f(b) }
   set L
 } {b3}
+
+#-----------------------------------------------
+
+do_execsql_test 2.0 {
+  CREATE TABLE u1(a, b, c);
+  CREATE TABLE u2(x, y, z);
+
+  INSERT INTO u1 VALUES('a1', 'b1', 'c1');
+  INSERT INTO u2 VALUES('a1', 'b1', 'c1');
+}
+
+do_test 2.1 {
+  set L [list]
+  execsql {
+    SELECT * FROM u1 WHERE f('one')=123 AND 123=(
+      SELECT x FROM u2 WHERE x=a AND f('two')
+    )
+  }
+  set L
+} {one}
+
+do_test 2.2 {
+  set L [list]
+  breakpoint
+  execsql {
+    SELECT * FROM u1 WHERE 123=(
+      SELECT x FROM u2 WHERE x=a AND f('two')
+    ) AND f('three')=123
+  }
+  set L
+} {three}
+
+
   
 finish_test