Index: Makefile.in
==================================================================
--- Makefile.in
+++ Makefile.in
@@ -1030,11 +1030,11 @@
    $(TOP)/ext/fts5/fts5_vocab.c  \
 
 fts5parse.c:	$(TOP)/ext/fts5/fts5parse.y lemon 
 	cp $(TOP)/ext/fts5/fts5parse.y .
 	rm -f fts5parse.h
-	./lemon $(OPTS) fts5parse.y
+	./lemon$(BEXE) $(OPTS) fts5parse.y
 
 fts5parse.h: fts5parse.c
 
 fts5.c: $(FTS5_SRC)
 	$(TCLSH_CMD) $(TOP)/ext/fts5/tool/mkfts5c.tcl
@@ -1162,12 +1162,13 @@
 
 # This target will fail if the SQLite amalgamation contains any exported
 # symbols that do not begin with "sqlite3_". It is run as part of the
 # releasetest.tcl script.
 #
+VALIDIDS=' sqlite3(changeset|changegroup|session)?_'
 checksymbols: sqlite3.lo
-	nm -g --defined-only sqlite3.o | egrep -v ' sqlite3(changeset|session)?_' ; test $$? -ne 0
+	nm -g --defined-only sqlite3.o | egrep -v $(VALIDIDS); test $$? -ne 0
 	echo '0 errors out of 1 tests'
 
 # Build the amalgamation-autoconf package.  The amalamgation-tarball target builds
 # a tarball named for the version number.  Ex:  sqlite-autoconf-3110000.tar.gz.
 # The snapshot-tarball target builds a tarball named by the SHA1 hash

Index: ext/icu/icu.c
==================================================================
--- ext/icu/icu.c
+++ ext/icu/icu.c
@@ -352,19 +352,21 @@
 **     lower('I', 'tr_tr') -> 'ı' (small dotless i)
 **
 ** http://www.icu-project.org/userguide/posix.html#case_mappings
 */
 static void icuCaseFunc16(sqlite3_context *p, int nArg, sqlite3_value **apArg){
-  const UChar *zInput;
-  UChar *zOutput = 0;
-  int nInput;
-  int nOut;
+  const UChar *zInput;            /* Pointer to input string */
+  UChar *zOutput = 0;             /* Pointer to output buffer */
+  int nInput;                     /* Size of utf-16 input string in bytes */
+  int nOut;                       /* Size of output buffer in bytes */
   int cnt;
+  int bToUpper;                   /* True for toupper(), false for tolower() */
   UErrorCode status;
   const char *zLocale = 0;
 
   assert(nArg==1 || nArg==2);
+  bToUpper = (sqlite3_user_data(p)!=0);
   if( nArg==2 ){
     zLocale = (const char *)sqlite3_value_text(apArg[1]);
   }
 
   zInput = sqlite3_value_text16(apArg[0]);
@@ -384,23 +386,27 @@
       sqlite3_result_error_nomem(p);
       return;
     }
     zOutput = zNew;
     status = U_ZERO_ERROR;
-    if( sqlite3_user_data(p) ){
+    if( bToUpper ){
       nOut = 2*u_strToUpper(zOutput,nOut/2,zInput,nInput/2,zLocale,&status);
     }else{
       nOut = 2*u_strToLower(zOutput,nOut/2,zInput,nInput/2,zLocale,&status);
     }
-    if( !U_SUCCESS(status) ){
-      if( status==U_BUFFER_OVERFLOW_ERROR ) continue;
-      icuFunctionError(p,
-          sqlite3_user_data(p) ? "u_strToUpper" : "u_strToLower", status);
-      return;
-    }
-  }
-  sqlite3_result_text16(p, zOutput, nOut, xFree);
+
+    if( U_SUCCESS(status) ){
+      sqlite3_result_text16(p, zOutput, nOut, xFree);
+    }else if( status==U_BUFFER_OVERFLOW_ERROR ){
+      assert( cnt==0 );
+      continue;
+    }else{
+      icuFunctionError(p, bToUpper ? "u_strToUpper" : "u_strToLower", status);
+    }
+    return;
+  }
+  assert( 0 );     /* Unreachable */
 }
 
 /*
 ** Collation sequence destructor function. The pCtx argument points to
 ** a UCollator structure previously allocated using ucol_open().

Index: ext/rbu/rbu.c
==================================================================
--- ext/rbu/rbu.c
+++ ext/rbu/rbu.c
@@ -22,16 +22,26 @@
 /*
 ** Print a usage message and exit.
 */
 void usage(const char *zArgv0){
   fprintf(stderr, 
-"Usage: %s [-step NSTEP] TARGET-DB RBU-DB\n"
+"Usage: %s ?OPTIONS? TARGET-DB RBU-DB\n"
+"\n"
+"Where options are:\n"
+"\n"
+"    -step NSTEP\n"
+"    -vacuum\n"
+"\n"
+"  If the -vacuum switch is not present, argument RBU-DB must be an RBU\n"
+"  database containing an update suitable for target database TARGET-DB.\n"
+"  Or, if -vacuum is specified, then TARGET-DB is a database to vacuum using\n"
+"  RBU, and RBU-DB is used as the state database for the vacuum (refer to\n"
+"  API documentation for details).\n"
 "\n"
-"  Argument RBU-DB must be an RBU database containing an update suitable for\n"
-"  target database TARGET-DB. If NSTEP is set to less than or equal to zero\n"
-"  (the default value), this program attempts to apply the entire update to\n"
-"  the target database.\n"
+"  If NSTEP is set to less than or equal to zero (the default value), this \n"
+"  program attempts to perform the entire update or vacuum operation before\n"
+"  exiting\n"
 "\n"
 "  If NSTEP is greater than zero, then a maximum of NSTEP calls are made\n"
 "  to sqlite3rbu_step(). If the RBU update has not been completely applied\n"
 "  after the NSTEP'th call is made, the state is saved in the database RBU-DB\n"
 "  and the program exits. Subsequent invocations of this (or any other RBU)\n"
@@ -67,33 +77,47 @@
   const char *zRbu;               /* Database containing RBU */
   char zBuf[200];                 /* Buffer for printf() */
   char *zErrmsg;                  /* Error message, if any */
   sqlite3rbu *pRbu;               /* RBU handle */
   int nStep = 0;                  /* Maximum number of step() calls */
+  int bVacuum = 0;
   int rc;
   sqlite3_int64 nProgress = 0;
-
-  /* Process command line arguments. Following this block local variables 
-  ** zTarget, zRbu and nStep are all set. */
-  if( argc==5 ){
-    size_t nArg1 = strlen(argv[1]);
-    if( nArg1>5 || nArg1<2 || memcmp("-step", argv[1], nArg1) ) usage(argv[0]);
-    nStep = atoi(argv[2]);
-  }else if( argc!=3 ){
-    usage(argv[0]);
-  }
+  int nArg = argc-2;
+
+  if( argc<3 ) usage(argv[0]);
+  for(i=1; i<nArg; i++){
+    const char *zArg = argv[i];
+    int nArg = strlen(zArg);
+    if( nArg>1 && nArg<=8 && 0==memcmp(zArg, "-vacuum", nArg) ){
+      bVacuum = 1;
+    }else if( nArg>1 && nArg<=5 && 0==memcmp(zArg, "-step", nArg) && i<nArg-1 ){
+      i++;
+      nStep = atoi(argv[i]);
+    }else{
+      usage(argv[0]);
+    }
+  }
+
   zTarget = argv[argc-2];
   zRbu = argv[argc-1];
 
   report_default_vfs();
 
-  /* Open an RBU handle. If nStep is less than or equal to zero, call
+  /* Open an RBU handle. A vacuum handle if -vacuum was specified, or a
+  ** regular RBU update handle otherwise.  */
+  if( bVacuum ){
+    pRbu = sqlite3rbu_vacuum(zTarget, zRbu);
+  }else{
+    pRbu = sqlite3rbu_open(zTarget, zRbu, 0);
+  }
+  report_rbu_vfs(pRbu);
+
+  /* If nStep is less than or equal to zero, call
   ** sqlite3rbu_step() until either the RBU has been completely applied
   ** or an error occurs. Or, if nStep is greater than zero, call
   ** sqlite3rbu_step() a maximum of nStep times.  */
-  pRbu = sqlite3rbu_open(zTarget, zRbu, 0);
-  report_rbu_vfs(pRbu);
   for(i=0; (nStep<=0 || i<nStep) && sqlite3rbu_step(pRbu)==SQLITE_OK; i++);
   nProgress = sqlite3rbu_progress(pRbu);
   rc = sqlite3rbu_close(pRbu, &zErrmsg);
 
   /* Let the user know what happened. */

ADDED   ext/rbu/rbufault3.test
Index: ext/rbu/rbufault3.test
==================================================================
--- /dev/null
+++ ext/rbu/rbufault3.test
@@ -0,0 +1,98 @@
+# 2016 April 20
+#
+# The author disclaims copyright to this source code.  In place of
+# a legal notice, here is a blessing:
+#
+#    May you do good and not evil.
+#    May you find forgiveness for yourself and forgive others.
+#    May you share freely, never taking more than you give.
+#
+#***********************************************************************
+#
+# This file contains fault injection tests for RBU vacuum operations.
+#
+
+source [file join [file dirname [info script]] rbu_common.tcl]
+source $testdir/malloc_common.tcl
+set ::testprefix rbufault3
+
+foreach {fault errlist} {
+  oom-* {
+    {1 SQLITE_NOMEM}
+    {1 SQLITE_IOERR_NOMEM}
+    {1 {SQLITE_NOMEM - out of memory}}
+  }
+
+  ioerr-* {
+    {1 {SQLITE_IOERR - disk I/O error}}
+    {1 SQLITE_IOERR} 
+    {1 SQLITE_IOERR_WRITE} 
+    {1 SQLITE_IOERR_FSYNC} 
+    {1 SQLITE_IOERR_READ} 
+    {1 {SQLITE_IOERR - unable to open database: test.db2}} 
+    {1 {SQLITE_ERROR - unable to open database: test.db2}} 
+    {1 {SQLITE_ERROR - SQL logic error or missing database}}
+  }
+
+  cantopen* {
+    {1 {SQLITE_CANTOPEN - unable to open database: test.db2}}  
+    {1 {SQLITE_CANTOPEN - unable to open database: test.db2}}  
+    {1 {SQLITE_CANTOPEN - unable to open database file}}  
+    {1 SQLITE_CANTOPEN} 
+  }
+
+} {
+
+  reset_db
+  do_execsql_test 0 {
+    CREATE TABLE target(x UNIQUE, y, z, PRIMARY KEY(y));
+    INSERT INTO target VALUES(1, 2, 3);
+    INSERT INTO target VALUES(4, 5, 6);
+    INSERT INTO target VALUES(7, 8, 9);
+    CREATE INDEX i1 ON target(z);
+  }
+  faultsim_save_and_close
+
+  do_faultsim_test 1 -faults $fault -prep {
+    faultsim_restore_and_reopen
+    forcedelete test.db2
+  } -body {
+    sqlite3rbu_vacuum rbu test.db test.db2
+    while {[rbu step]=="SQLITE_OK"} {}
+    rbu close
+  } -test {
+    eval [list faultsim_test_result {0 SQLITE_DONE} {*}$::errlist]
+  }
+
+  do_faultsim_test 2 -faults $fault -prep {
+    faultsim_restore_and_reopen
+    forcedelete test.db2
+  } -body {
+    sqlite3rbu_vacuum rbu test.db test.db2
+    rbu step
+    rbu close
+  } -test {
+    eval [list faultsim_test_result {0 SQLITE_OK} {*}$::errlist]
+  }
+
+  forcedelete test.db2
+  sqlite3rbu_vacuum rbu test.db test.db2
+  rbu step
+  rbu close
+  faultsim_save_and_close
+
+  do_faultsim_test 3 -faults $fault -prep {
+    faultsim_restore_and_reopen
+    forcedelete test.db2
+  } -body {
+    sqlite3rbu_vacuum rbu test.db test.db2
+    rbu step
+    rbu close
+  } -test {
+    eval [list faultsim_test_result {0 SQLITE_OK} {*}$::errlist]
+  }
+
+}
+
+finish_test
+

ADDED   ext/rbu/rbuvacuum.test
Index: ext/rbu/rbuvacuum.test
==================================================================
--- /dev/null
+++ ext/rbu/rbuvacuum.test
@@ -0,0 +1,410 @@
+# 2016 April 15
+#
+# The author disclaims copyright to this source code.  In place of
+# a legal notice, here is a blessing:
+#
+#    May you do good and not evil.
+#    May you find forgiveness for yourself and forgive others.
+#    May you share freely, never taking more than you give.
+#
+#***********************************************************************
+#
+# This file contains tests for the RBU module. More specifically, it
+# contains tests to ensure that the sqlite3rbu_vacuum() API works as
+# expected.
+#
+
+source [file join [file dirname [info script]] rbu_common.tcl]
+set ::testprefix rbuvacuum
+
+proc do_rbu_vacuum_test {tn step} {
+  uplevel [list do_test $tn.1 {
+    if {$step==0} { sqlite3rbu_vacuum rbu test.db state.db }
+    while 1 {
+      if {$step==1} { sqlite3rbu_vacuum rbu test.db state.db }
+      set rc [rbu step]
+      if {$rc!="SQLITE_OK"} break
+      if {$step==1} { rbu close }
+    }
+    rbu close
+  } {SQLITE_DONE}]
+
+  uplevel [list do_execsql_test $tn.2 {
+    PRAGMA integrity_check
+  } ok]
+}
+
+foreach step {0 1} {
+
+  set ::testprefix rbuvacuum-step=$step
+  reset_db
+
+  # Simplest possible vacuum.
+  do_execsql_test 1.0 {
+    PRAGMA page_size = 1024;
+    CREATE TABLE t1(a INTEGER PRIMARY KEY, b, c);
+    INSERT INTO t1 VALUES(1, 2, 3);
+    INSERT INTO t1 VALUES(4, 5, 6);
+    INSERT INTO t1 VALUES(7, 8, 9);
+    PRAGMA integrity_check;
+  } {ok}
+  do_rbu_vacuum_test 1.1 $step
+
+  # A vacuum that actually reclaims space.
+  do_execsql_test 1.2.1 {
+    INSERT INTO t1 VALUES(8, randomblob(900), randomblob(900));
+    INSERT INTO t1 VALUES(9, randomblob(900), randomblob(900));
+    INSERT INTO t1 VALUES(10, randomblob(900), randomblob(900));
+    INSERT INTO t1 VALUES(11, randomblob(900), randomblob(900));
+    INSERT INTO t1 VALUES(12, randomblob(900), randomblob(900));
+    PRAGMA page_count;
+  } {12}
+  do_execsql_test 1.2.2 {
+    DELETE FROM t1 WHERE rowid BETWEEN 8 AND 11;
+    PRAGMA page_count;
+  } {12}
+  do_rbu_vacuum_test 1.2.3 $step
+  do_execsql_test 1.2.4 {
+    PRAGMA page_count;
+  } {3}
+  
+  # Add an index to the table.
+  do_execsql_test 1.3.1 {
+    CREATE INDEX t1b ON t1(b);
+    INSERT INTO t1 VALUES(13, randomblob(900), randomblob(900));
+    INSERT INTO t1 VALUES(14, randomblob(900), randomblob(900));
+    INSERT INTO t1 VALUES(15, randomblob(900), randomblob(900));
+    INSERT INTO t1 VALUES(16, randomblob(900), randomblob(900));
+    PRAGMA page_count;
+  } {18}
+  do_execsql_test 1.3.2 {
+    DELETE FROM t1 WHERE rowid BETWEEN 12 AND 15;
+    PRAGMA page_count;
+  } {18}
+  do_rbu_vacuum_test 1.3.3 $step
+  do_execsql_test 1.3.4 {
+    PRAGMA page_count;
+  } {5}
+
+  # WITHOUT ROWID table.
+  do_execsql_test 1.4.1 {
+    CREATE TABLE t2(a, b, c, PRIMARY KEY(a, b)) WITHOUT ROWID;
+
+    INSERT INTO t2 VALUES(randomblob(900), 1, randomblob(900));
+    INSERT INTO t2 VALUES(randomblob(900), 2, randomblob(900));
+    INSERT INTO t2 VALUES(randomblob(900), 3, randomblob(900));
+    INSERT INTO t2 VALUES(randomblob(900), 4, randomblob(900));
+    INSERT INTO t2 VALUES(randomblob(900), 6, randomblob(900));
+    INSERT INTO t2 VALUES(randomblob(900), 7, randomblob(900));
+    INSERT INTO t2 VALUES(randomblob(900), 8, randomblob(900));
+
+    DELETE FROM t2 WHERE b BETWEEN 2 AND 7;
+    PRAGMA page_count;
+  } {20}
+  do_rbu_vacuum_test 1.4.2 $step
+  do_execsql_test 1.4.3 {
+    PRAGMA page_count;
+  } {10}
+  
+  # WITHOUT ROWID table with an index.
+  do_execsql_test 1.4.1 {
+    CREATE INDEX t2c ON t2(c);
+
+    INSERT INTO t2 VALUES(randomblob(900), 9, randomblob(900));
+    INSERT INTO t2 VALUES(randomblob(900), 10, randomblob(900));
+    INSERT INTO t2 VALUES(randomblob(900), 11, randomblob(900));
+    INSERT INTO t2 VALUES(randomblob(900), 12, randomblob(900));
+    INSERT INTO t2 VALUES(randomblob(900), 13, randomblob(900));
+
+    DELETE FROM t2 WHERE b BETWEEN 8 AND 12;
+    PRAGMA page_count;
+  } {35}
+  do_rbu_vacuum_test 1.4.2 $step
+  do_execsql_test 1.4.3 {
+    PRAGMA page_count;
+  } {15}
+  do_execsql_test 1.4.4 {
+    VACUUM;
+    PRAGMA page_count;
+  } {15}
+
+  do_execsql_test 1.5.1 {
+    CREATE TABLE t3(a, b, c);
+    INSERT INTO t3 VALUES('a', 'b', 'c');
+    INSERT INTO t3 VALUES('d', 'e', 'f');
+    INSERT INTO t3 VALUES('g', 'h', 'i');
+  }
+  do_rbu_vacuum_test 1.5.2 $step
+  do_execsql_test 1.5.3 {
+    SELECT * FROM t3
+  } {a b c d e f g h i}
+  do_execsql_test 1.5.4 {
+    CREATE INDEX t3a ON t3(a);
+    CREATE INDEX t3b ON t3(b);
+    CREATE INDEX t3c ON t3(c);
+    INSERT INTO t3 VALUES('j', 'k', 'l');
+    DELETE FROM t3 WHERE a = 'g';
+  }
+  do_rbu_vacuum_test 1.5.5 $step
+  do_execsql_test 1.5.6 {
+    SELECT rowid, * FROM t3 ORDER BY b
+  } {1 a b c 2 d e f 4 j k l}
+
+  do_execsql_test 1.6.1 {
+    CREATE TABLE t4(a PRIMARY KEY, b, c);
+    INSERT INTO t4 VALUES('a', 'b', 'c');
+    INSERT INTO t4 VALUES('d', 'e', 'f');
+    INSERT INTO t4 VALUES('g', 'h', 'i');
+  }
+  do_rbu_vacuum_test 1.6.2 $step
+  do_execsql_test 1.6.3 {
+    SELECT * FROM t4
+  } {a b c d e f g h i}
+  do_execsql_test 1.6.4 {
+    CREATE INDEX t4a ON t4(a);
+    CREATE INDEX t4b ON t4(b);
+    CREATE INDEX t4c ON t4(c);
+    
+    INSERT INTO t4 VALUES('j', 'k', 'l');
+    DELETE FROM t4 WHERE a='g';
+  }
+  do_rbu_vacuum_test 1.6.5 $step
+  do_execsql_test 1.6.6 {
+    SELECT * FROM t4 ORDER BY b
+  } {a b c d e f j k l}
+
+  reset_db
+  do_execsql_test 1.7.0 {
+    CREATE TABLE t1(a INTEGER PRIMARY KEY AUTOINCREMENT, b);
+    INSERT INTO t1 VALUES(NULL, 'one');
+    INSERT INTO t1 VALUES(NULL, 'two');
+    DELETE FROM t1 WHERE a=2;
+    INSERT INTO t1 VALUES(NULL, 'three');
+    INSERT INTO t1 VALUES(NULL, 'four');
+    DELETE FROM t1 WHERE a=4;
+    INSERT INTO t1 VALUES(NULL, 'five');
+    INSERT INTO t1 VALUES(NULL, 'six');
+    DELETE FROM t1 WHERE a=6;
+    SELECT * FROM t1;
+  } {1 one 3 three 5 five}
+  do_rbu_vacuum_test 1.7.1 $step
+  do_execsql_test 1.7.2 {
+    INSERT INTO t1 VALUES(NULL, 'seven');
+    SELECT * FROM t1;
+  } {1 one 3 three 5 five 7 seven}
+
+  reset_db
+  do_execsql_test 1.8.0 {
+    CREATE TABLE t1(a INTEGER PRIMARY KEY AUTOINCREMENT, b);
+    CREATE INDEX i1 ON t1(b);
+    INSERT INTO t1 VALUES(NULL, 'one');
+    INSERT INTO t1 VALUES(NULL, 'two');
+    INSERT INTO t1 VALUES(NULL, 'three');
+    INSERT INTO t1 VALUES(NULL, 'four');
+    INSERT INTO t1 VALUES(NULL, 'five');
+    INSERT INTO t1 VALUES(NULL, 'six');
+    ANALYZE;
+    SELECT * FROM sqlite_stat1;
+  } {t1 i1 {6 1}}
+  do_rbu_vacuum_test 1.8.1 $step
+  do_execsql_test 1.7.2 {
+    SELECT * FROM sqlite_stat1;
+  } {t1 i1 {6 1}}
+
+  reset_db
+  do_execsql_test 1.9.0 {
+    PRAGMA page_size = 8192;
+    PRAGMA auto_vacuum = 2;
+    PRAGMA user_version = 412;
+    PRAGMA application_id = 413;
+
+    CREATE TABLE t1(a INTEGER PRIMARY KEY AUTOINCREMENT, b);
+    CREATE INDEX i1 ON t1(b);
+    INSERT INTO t1 VALUES(NULL, 'one');
+    INSERT INTO t1 VALUES(NULL, 'two');
+    INSERT INTO t1 VALUES(NULL, 'three');
+    INSERT INTO t1 VALUES(NULL, 'four');
+    INSERT INTO t1 VALUES(NULL, 'five');
+    INSERT INTO t1 VALUES(NULL, 'six');
+
+    PRAGMA main.page_size;
+    PRAGMA main.auto_vacuum;
+    PRAGMA main.user_version;
+    PRAGMA main.application_id;
+  } {8192 2 412 413}
+
+  do_rbu_vacuum_test 1.9.1 $step
+  do_execsql_test 1.9.2 {
+    PRAGMA main.page_size;
+    PRAGMA main.auto_vacuum;
+    PRAGMA main.user_version;
+    PRAGMA main.application_id;
+  } {8192 2 412 413}
+
+  # Vacuum a database with a large sqlite_master table.
+  #
+  reset_db
+  do_test 1.10.1 {
+    for {set i 1} {$i < 50} {incr i} {
+      execsql "PRAGMA page_size = 1024"
+      execsql "CREATE TABLE t$i (a, b, c, PRIMARY KEY(a, b));"
+      execsql "
+        INSERT INTO t$i VALUES(1, 2, 3);
+        INSERT INTO t$i VALUES(4, 5, 6);
+      "
+    }
+  } {}
+  do_rbu_vacuum_test 1.10.2 $step
+
+  # Database with empty tables.
+  #
+  reset_db
+  do_execsql_test 1.11.1 {
+    CREATE TABLE t1(a INTEGER PRIMARY KEY, b);
+    CREATE TABLE t2(a INTEGER PRIMARY KEY, b);
+    CREATE TABLE t3(a INTEGER PRIMARY KEY, b);
+    CREATE TABLE t4(a INTEGER PRIMARY KEY, b);
+    INSERT INTO t4 VALUES(1, 2);
+  }
+  do_rbu_vacuum_test 1.11.2 $step
+  do_execsql_test 1.11.3 {
+    SELECT * FROM t1;
+    SELECT * FROM t2;
+    SELECT * FROM t3;
+    SELECT * FROM t4;
+  } {1 2}
+  reset_db
+  do_execsql_test 1.12.1 {
+    CREATE TABLE t1(a INTEGER PRIMARY KEY, b);
+    CREATE TABLE t2(a INTEGER PRIMARY KEY, b);
+    CREATE TABLE t3(a INTEGER PRIMARY KEY, b);
+    CREATE TABLE t4(a INTEGER PRIMARY KEY, b);
+    INSERT INTO t1 VALUES(1, 2);
+  }
+  do_rbu_vacuum_test 1.12.2 $step
+  do_execsql_test 1.12.3 {
+    SELECT * FROM t1;
+    SELECT * FROM t2;
+    SELECT * FROM t3;
+    SELECT * FROM t4;
+  } {1 2}
+}
+set ::testprefix rbuvacuum
+
+#-------------------------------------------------------------------------
+# Test some error cases:
+#
+#   2.1.* the db being vacuumed being in wal mode already.
+#   2.2.* database modified mid vacuum.
+#
+reset_db
+do_execsql_test 2.1.0 {
+  CREATE TABLE t1(a, b);
+  INSERT INTO t1 VALUES(1, 2);
+  INSERT INTO t1 VALUES(3, 4);
+  INSERT INTO t1 VALUES(5, 6);
+  INSERT INTO t1 VALUES(7, 8);
+  PRAGMA journal_mode = wal;
+  INSERT INTO t1 VALUES(9, 10);
+} wal
+do_test 2.1.1 {
+  sqlite3rbu_vacuum rbu test.db state.db
+  rbu step
+} {SQLITE_ERROR}
+do_test 2.1.2 {
+  list [catch { rbu close } msg] $msg
+} {1 {SQLITE_ERROR - cannot vacuum wal mode database}}
+
+reset_db
+do_execsql_test 2.2.0 {
+  CREATE TABLE tx(a PRIMARY KEY, b BLOB);
+  INSERT INTO tx VALUES(1, randomblob(900));
+  INSERT INTO tx SELECT a+1, randomblob(900) FROM tx;
+  INSERT INTO tx SELECT a+2, randomblob(900) FROM tx;
+  INSERT INTO tx SELECT a+4, randomblob(900) FROM tx;
+  INSERT INTO tx SELECT a+8, randomblob(900) FROM tx;
+}
+db_save_and_close
+for {set i 1} 1 {incr i} {
+  db_restore_and_reopen
+
+  sqlite3rbu_vacuum rbu test.db state.db
+  for {set step 0} {$step<$i} {incr step} { rbu step }
+  rbu close
+  if {[file exists test.db-wal]} break
+
+  execsql { INSERT INTO tx VALUES(20, 20) }
+
+  do_test 2.2.$i.1 {
+    sqlite3rbu_vacuum rbu test.db state.db 
+    rbu step
+  } {SQLITE_BUSY}
+  do_test 2.2.$i.2 {
+    list [catch { rbu close } msg] $msg
+  } {1 {SQLITE_BUSY - database modified during rbu vacuum}}
+}
+
+#-------------------------------------------------------------------------
+# Test that a database that uses custom collation sequences can be RBU
+# vacuumed.
+#
+reset_db
+forcedelete state.db
+proc noop {args} {}
+proc length_cmp {x y} {
+  set n1 [string length $x]
+  set n2 [string length $y]
+  return [expr $n1 - $n2]
+}
+sqlite3_create_collation_v2 db length length_cmp noop
+
+do_execsql_test 3.0 {
+  CREATE TABLE t1(a INTEGER PRIMARY KEY, b);
+  INSERT INTO t1 VALUES(1, 'i');
+  INSERT INTO t1 VALUES(2, 'iiii');
+  INSERT INTO t1 VALUES(3, 'ii');
+  INSERT INTO t1 VALUES(4, 'iii');
+  SELECT a FROM t1 ORDER BY b COLLATE length;
+} {1 3 4 2}
+do_execsql_test 3.1 {
+  CREATE INDEX i1 ON t1(b COLLATE length);
+}
+
+do_test 3.2 {
+  sqlite3rbu_vacuum rbu test.db state.db
+  while {[rbu step]=="SQLITE_OK"} {}
+  list [catch { rbu close } msg] $msg
+} {1 {SQLITE_ERROR - no such collation sequence: length}}
+
+do_test 3.3 {
+  sqlite3rbu_vacuum rbu test.db state.db
+  set db1 [rbu db 0]
+  sqlite3_create_collation_v2 $db1 length length_cmp noop
+  while {[rbu step]=="SQLITE_OK"} {}
+  list [catch { rbu close } msg] $msg
+} {1 {SQLITE_ERROR - no such collation sequence: length}}
+
+do_test 3.4 {
+  sqlite3rbu_vacuum rbu test.db state.db
+  set db1 [rbu db 1]
+  sqlite3_create_collation_v2 $db1 length length_cmp noop
+  while {[rbu step]=="SQLITE_OK"} {}
+  list [catch { rbu close } msg] $msg
+} {1 {SQLITE_ERROR - no such collation sequence: length}}
+
+do_test 3.5 {
+  sqlite3rbu_vacuum rbu test.db state.db
+  set db1 [rbu db 0]
+  set db2 [rbu db 1]
+
+  sqlite3_create_collation_v2 $db1 length length_cmp noop
+  sqlite3_create_collation_v2 $db2 length length_cmp noop
+
+  while {[rbu step]=="SQLITE_OK"} {}
+  list [catch { rbu close } msg] $msg
+} {0 SQLITE_DONE}
+
+
+catch { db close }
+finish_test
+

Index: ext/rbu/sqlite3rbu.c
==================================================================
--- ext/rbu/sqlite3rbu.c
+++ ext/rbu/sqlite3rbu.c
@@ -174,10 +174,11 @@
 typedef struct rbu_file rbu_file;
 typedef struct RbuUpdateStmt RbuUpdateStmt;
 
 #if !defined(SQLITE_AMALGAMATION)
 typedef unsigned int u32;
+typedef unsigned short u16;
 typedef unsigned char u8;
 typedef sqlite3_int64 i64;
 #endif
 
 /*
@@ -186,10 +187,12 @@
 ** format.
 */
 #define WAL_LOCK_WRITE  0
 #define WAL_LOCK_CKPT   1
 #define WAL_LOCK_READ0  3
+
+#define SQLITE_FCNTL_RBUCNT    5149216
 
 /*
 ** A structure to store values read from the rbu_state table in memory.
 */
 struct RbuState {
@@ -365,10 +368,14 @@
   int nFrameAlloc;                /* Allocated size of aFrame[] array */
   RbuFrame *aFrame;
   int pgsz;
   u8 *aBuf;
   i64 iWalCksum;
+
+  /* Used in RBU vacuum mode only */
+  int nRbu;                       /* Number of RBU VFS in the stack */
+  rbu_file *pRbuFd;               /* Fd for main db of dbRbu */
 };
 
 /*
 ** An rbu VFS is implemented using an instance of this structure.
 */
@@ -390,10 +397,11 @@
   sqlite3rbu *pRbu;               /* Pointer to rbu object (rbu target only) */
 
   int openFlags;                  /* Flags this file was opened with */
   u32 iCookie;                    /* Cookie value for main db files */
   u8 iWriteVer;                   /* "write-version" value for main db files */
+  u8 bNolock;                     /* True to fail EXCLUSIVE locks */
 
   int nShm;                       /* Number of entries in apShm[] array */
   char **apShm;                   /* Array of mmap'd *-shm regions */
   char *zDel;                     /* Delete this when closing file */
 
@@ -400,10 +408,15 @@
   const char *zWal;               /* Wal filename for this main db file */
   rbu_file *pWalFd;               /* Wal file descriptor for this main db */
   rbu_file *pMainNext;            /* Next MAIN_DB file */
 };
 
+/*
+** True for an RBU vacuum handle, or false otherwise.
+*/
+#define rbuIsVacuum(p) ((p)->zTarget==0)
+
 
 /*************************************************************************
 ** The following three functions, found below:
 **
 **   rbuDeltaGetInt()
@@ -848,12 +861,15 @@
 }
 
 
 /*
 ** The implementation of the rbu_target_name() SQL function. This function
-** accepts one argument - the name of a table in the RBU database. If the
-** table name matches the pattern:
+** accepts one or two arguments. The first argument is the name of a table -
+** the name of a table in the RBU database.  The second, if it is present, is 1
+** for a view or 0 for a table. 
+**
+** For a non-vacuum RBU handle, if the table name matches the pattern:
 **
 **     data[0-9]_<name>
 **
 ** where <name> is any sequence of 1 or more characters, <name> is returned.
 ** Otherwise, if the only argument does not match the above pattern, an SQL
@@ -860,25 +876,37 @@
 ** NULL is returned.
 **
 **     "data_t1"     -> "t1"
 **     "data0123_t2" -> "t2"
 **     "dataAB_t3"   -> NULL
+**
+** For an rbu vacuum handle, a copy of the first argument is returned if
+** the second argument is either missing or 0 (not a view).
 */
 static void rbuTargetNameFunc(
-  sqlite3_context *context,
+  sqlite3_context *pCtx,
   int argc,
   sqlite3_value **argv
 ){
+  sqlite3rbu *p = sqlite3_user_data(pCtx);
   const char *zIn;
-  assert( argc==1 );
+  assert( argc==1 || argc==2 );
 
   zIn = (const char*)sqlite3_value_text(argv[0]);
-  if( zIn && strlen(zIn)>4 && memcmp("data", zIn, 4)==0 ){
-    int i;
-    for(i=4; zIn[i]>='0' && zIn[i]<='9'; i++);
-    if( zIn[i]=='_' && zIn[i+1] ){
-      sqlite3_result_text(context, &zIn[i+1], -1, SQLITE_STATIC);
+  if( zIn ){
+    if( rbuIsVacuum(p) ){
+      if( argc==1 || 0==sqlite3_value_int(argv[1]) ){
+        sqlite3_result_text(pCtx, zIn, -1, SQLITE_STATIC);
+      }
+    }else{
+      if( strlen(zIn)>4 && memcmp("data", zIn, 4)==0 ){
+        int i;
+        for(i=4; zIn[i]>='0' && zIn[i]<='9'; i++);
+        if( zIn[i]=='_' && zIn[i+1] ){
+          sqlite3_result_text(pCtx, &zIn[i+1], -1, SQLITE_STATIC);
+        }
+      }
     }
   }
 }
 
 /*
@@ -892,11 +920,12 @@
 static int rbuObjIterFirst(sqlite3rbu *p, RbuObjIter *pIter){
   int rc;
   memset(pIter, 0, sizeof(RbuObjIter));
 
   rc = prepareAndCollectError(p->dbRbu, &pIter->pTblIter, &p->zErrmsg, 
-      "SELECT rbu_target_name(name) AS target, name FROM sqlite_master "
+      "SELECT rbu_target_name(name, type='view') AS target, name "
+      "FROM sqlite_master "
       "WHERE type IN ('table', 'view') AND target IS NOT NULL "
       "ORDER BY name"
   );
 
   if( rc==SQLITE_OK ){
@@ -1268,10 +1297,11 @@
     }
     sqlite3_finalize(pStmt);
     pStmt = 0;
 
     if( p->rc==SQLITE_OK
+     && rbuIsVacuum(p)==0
      && bRbuRowid!=(pIter->eType==RBU_PK_VTAB || pIter->eType==RBU_PK_NONE)
     ){
       p->rc = SQLITE_ERROR;
       p->zErrmsg = sqlite3_mprintf(
           "table %q %s rbu_rowid column", pIter->zDataTbl,
@@ -1407,10 +1437,12 @@
       if( pIter->eType==RBU_PK_IPK ){
         int i;
         for(i=0; pIter->abTblPk[i]==0; i++);
         assert( i<pIter->nTblCol );
         zCol = pIter->azTblCol[i];
+      }else if( rbuIsVacuum(p) ){
+        zCol = "_rowid_";
       }else{
         zCol = "rbu_rowid";
       }
       zType = "INTEGER";
     }else{
@@ -1947,20 +1979,29 @@
           sqlite3_mprintf("INSERT INTO \"rbu_imp_%w\" VALUES(%s)", zTbl, zBind)
         );
       }
 
       /* And to delete index entries */
-      if( p->rc==SQLITE_OK ){
+      if( rbuIsVacuum(p)==0 && p->rc==SQLITE_OK ){
         p->rc = prepareFreeAndCollectError(
             p->dbMain, &pIter->pDelete, &p->zErrmsg,
           sqlite3_mprintf("DELETE FROM \"rbu_imp_%w\" WHERE %s", zTbl, zWhere)
         );
       }
 
       /* Create the SELECT statement to read keys in sorted order */
       if( p->rc==SQLITE_OK ){
         char *zSql;
+        if( rbuIsVacuum(p) ){
+          zSql = sqlite3_mprintf(
+              "SELECT %s, 0 AS rbu_control FROM '%q' ORDER BY %s%s",
+              zCollist, 
+              pIter->zDataTbl,
+              zCollist, zLimit
+          );
+        }else
+
         if( pIter->eType==RBU_PK_EXTERNAL || pIter->eType==RBU_PK_NONE ){
           zSql = sqlite3_mprintf(
               "SELECT %s, rbu_control FROM %s.'rbu_tmp_%q' ORDER BY %s%s",
               zCollist, p->zStateDb, pIter->zDataTbl,
               zCollist, zLimit
@@ -1983,11 +2024,13 @@
       sqlite3_free(zImposterCols);
       sqlite3_free(zImposterPK);
       sqlite3_free(zWhere);
       sqlite3_free(zBind);
     }else{
-      int bRbuRowid = (pIter->eType==RBU_PK_VTAB || pIter->eType==RBU_PK_NONE);
+      int bRbuRowid = (pIter->eType==RBU_PK_VTAB)
+                    ||(pIter->eType==RBU_PK_NONE)
+                    ||(pIter->eType==RBU_PK_EXTERNAL && rbuIsVacuum(p));
       const char *zTbl = pIter->zTbl;       /* Table this step applies to */
       const char *zWrite;                   /* Imposter table name */
 
       char *zBindings = rbuObjIterGetBindlist(p, pIter->nTblCol + bRbuRowid);
       char *zWhere = rbuObjIterGetWhere(p, pIter);
@@ -2010,20 +2053,22 @@
               zWrite, zTbl, zCollist, (bRbuRowid ? ", _rowid_" : ""), zBindings
             )
         );
       }
 
-      /* Create the DELETE statement to write to the target PK b-tree */
-      if( p->rc==SQLITE_OK ){
+      /* Create the DELETE statement to write to the target PK b-tree.
+      ** Because it only performs INSERT operations, this is not required for
+      ** an rbu vacuum handle.  */
+      if( rbuIsVacuum(p)==0 && p->rc==SQLITE_OK ){
         p->rc = prepareFreeAndCollectError(p->dbMain, &pIter->pDelete, pz,
             sqlite3_mprintf(
               "DELETE FROM \"%s%w\" WHERE %s", zWrite, zTbl, zWhere
             )
         );
       }
 
-      if( pIter->abIndexed ){
+      if( rbuIsVacuum(p)==0 && pIter->abIndexed ){
         const char *zRbuRowid = "";
         if( pIter->eType==RBU_PK_EXTERNAL || pIter->eType==RBU_PK_NONE ){
           zRbuRowid = ", rbu_rowid";
         }
 
@@ -2069,14 +2114,20 @@
         rbuObjIterPrepareTmpInsert(p, pIter, zCollist, zRbuRowid);
       }
 
       /* Create the SELECT statement to read keys from data_xxx */
       if( p->rc==SQLITE_OK ){
+        const char *zRbuRowid = "";
+        if( bRbuRowid ){
+          zRbuRowid = rbuIsVacuum(p) ? ",_rowid_ " : ",rbu_rowid";
+        }
         p->rc = prepareFreeAndCollectError(p->dbRbu, &pIter->pSelect, pz,
             sqlite3_mprintf(
-              "SELECT %s, rbu_control%s FROM '%q'%s", 
-              zCollist, (bRbuRowid ? ", rbu_rowid" : ""), 
+              "SELECT %s,%s rbu_control%s FROM '%q'%s", 
+              zCollist, 
+              (rbuIsVacuum(p) ? "0 AS " : ""),
+              zRbuRowid,
               pIter->zDataTbl, zLimit
             )
         );
       }
 
@@ -2167,44 +2218,231 @@
   }
 
   return p->rc;
 }
 
-static sqlite3 *rbuOpenDbhandle(sqlite3rbu *p, const char *zName){
+static sqlite3 *rbuOpenDbhandle(
+  sqlite3rbu *p, 
+  const char *zName, 
+  int bUseVfs
+){
   sqlite3 *db = 0;
   if( p->rc==SQLITE_OK ){
     const int flags = SQLITE_OPEN_READWRITE|SQLITE_OPEN_CREATE|SQLITE_OPEN_URI;
-    p->rc = sqlite3_open_v2(zName, &db, flags, p->zVfsName);
+    p->rc = sqlite3_open_v2(zName, &db, flags, bUseVfs ? p->zVfsName : 0);
     if( p->rc ){
       p->zErrmsg = sqlite3_mprintf("%s", sqlite3_errmsg(db));
       sqlite3_close(db);
       db = 0;
     }
   }
   return db;
 }
+
+/*
+** Free an RbuState object allocated by rbuLoadState().
+*/
+static void rbuFreeState(RbuState *p){
+  if( p ){
+    sqlite3_free(p->zTbl);
+    sqlite3_free(p->zIdx);
+    sqlite3_free(p);
+  }
+}
+
+/*
+** Allocate an RbuState object and load the contents of the rbu_state 
+** table into it. Return a pointer to the new object. It is the 
+** responsibility of the caller to eventually free the object using
+** sqlite3_free().
+**
+** If an error occurs, leave an error code and message in the rbu handle
+** and return NULL.
+*/
+static RbuState *rbuLoadState(sqlite3rbu *p){
+  RbuState *pRet = 0;
+  sqlite3_stmt *pStmt = 0;
+  int rc;
+  int rc2;
+
+  pRet = (RbuState*)rbuMalloc(p, sizeof(RbuState));
+  if( pRet==0 ) return 0;
+
+  rc = prepareFreeAndCollectError(p->dbRbu, &pStmt, &p->zErrmsg, 
+      sqlite3_mprintf("SELECT k, v FROM %s.rbu_state", p->zStateDb)
+  );
+  while( rc==SQLITE_OK && SQLITE_ROW==sqlite3_step(pStmt) ){
+    switch( sqlite3_column_int(pStmt, 0) ){
+      case RBU_STATE_STAGE:
+        pRet->eStage = sqlite3_column_int(pStmt, 1);
+        if( pRet->eStage!=RBU_STAGE_OAL
+         && pRet->eStage!=RBU_STAGE_MOVE
+         && pRet->eStage!=RBU_STAGE_CKPT
+        ){
+          p->rc = SQLITE_CORRUPT;
+        }
+        break;
+
+      case RBU_STATE_TBL:
+        pRet->zTbl = rbuStrndup((char*)sqlite3_column_text(pStmt, 1), &rc);
+        break;
+
+      case RBU_STATE_IDX:
+        pRet->zIdx = rbuStrndup((char*)sqlite3_column_text(pStmt, 1), &rc);
+        break;
+
+      case RBU_STATE_ROW:
+        pRet->nRow = sqlite3_column_int(pStmt, 1);
+        break;
+
+      case RBU_STATE_PROGRESS:
+        pRet->nProgress = sqlite3_column_int64(pStmt, 1);
+        break;
+
+      case RBU_STATE_CKPT:
+        pRet->iWalCksum = sqlite3_column_int64(pStmt, 1);
+        break;
+
+      case RBU_STATE_COOKIE:
+        pRet->iCookie = (u32)sqlite3_column_int64(pStmt, 1);
+        break;
+
+      case RBU_STATE_OALSZ:
+        pRet->iOalSz = (u32)sqlite3_column_int64(pStmt, 1);
+        break;
+
+      case RBU_STATE_PHASEONESTEP:
+        pRet->nPhaseOneStep = sqlite3_column_int64(pStmt, 1);
+        break;
+
+      default:
+        rc = SQLITE_CORRUPT;
+        break;
+    }
+  }
+  rc2 = sqlite3_finalize(pStmt);
+  if( rc==SQLITE_OK ) rc = rc2;
+
+  p->rc = rc;
+  return pRet;
+}
+
 
 /*
 ** Open the database handle and attach the RBU database as "rbu". If an
 ** error occurs, leave an error code and message in the RBU handle.
 */
 static void rbuOpenDatabase(sqlite3rbu *p){
   assert( p->rc==SQLITE_OK );
   assert( p->dbMain==0 && p->dbRbu==0 );
+  assert( rbuIsVacuum(p) || p->zTarget!=0 );
 
-  p->eStage = 0;
-  p->dbMain = rbuOpenDbhandle(p, p->zTarget);
-  p->dbRbu = rbuOpenDbhandle(p, p->zRbu);
+  /* Open the RBU database */
+  p->dbRbu = rbuOpenDbhandle(p, p->zRbu, 1);
+
+  if( p->rc==SQLITE_OK && rbuIsVacuum(p) ){
+    sqlite3_file_control(p->dbRbu, "main", SQLITE_FCNTL_RBUCNT, (void*)p);
+  }
 
   /* If using separate RBU and state databases, attach the state database to
   ** the RBU db handle now.  */
   if( p->zState ){
     rbuMPrintfExec(p, p->dbRbu, "ATTACH %Q AS stat", p->zState);
     memcpy(p->zStateDb, "stat", 4);
   }else{
     memcpy(p->zStateDb, "main", 4);
   }
+
+#if 0
+  if( p->rc==SQLITE_OK && rbuIsVacuum(p) ){
+    p->rc = sqlite3_exec(p->dbRbu, "BEGIN", 0, 0, 0);
+  }
+#endif
+
+  /* If it has not already been created, create the rbu_state table */
+  rbuMPrintfExec(p, p->dbRbu, RBU_CREATE_STATE, p->zStateDb);
+
+#if 0
+  if( rbuIsVacuum(p) ){
+    if( p->rc==SQLITE_OK ){
+      int rc2;
+      int bOk = 0;
+      sqlite3_stmt *pCnt = 0;
+      p->rc = prepareAndCollectError(p->dbRbu, &pCnt, &p->zErrmsg,
+          "SELECT count(*) FROM stat.sqlite_master"
+      );
+      if( p->rc==SQLITE_OK 
+       && sqlite3_step(pCnt)==SQLITE_ROW
+       && 1==sqlite3_column_int(pCnt, 0)
+      ){
+        bOk = 1;
+      }
+      rc2 = sqlite3_finalize(pCnt);
+      if( p->rc==SQLITE_OK ) p->rc = rc2;
+
+      if( p->rc==SQLITE_OK && bOk==0 ){
+        p->rc = SQLITE_ERROR;
+        p->zErrmsg = sqlite3_mprintf("invalid state database");
+      }
+    
+      if( p->rc==SQLITE_OK ){
+        p->rc = sqlite3_exec(p->dbRbu, "COMMIT", 0, 0, 0);
+      }
+    }
+  }
+#endif
+
+  if( p->rc==SQLITE_OK && rbuIsVacuum(p) ){
+    int bOpen = 0;
+    int rc;
+    p->nRbu = 0;
+    p->pRbuFd = 0;
+    rc = sqlite3_file_control(p->dbRbu, "main", SQLITE_FCNTL_RBUCNT, (void*)p);
+    if( rc!=SQLITE_NOTFOUND ) p->rc = rc;
+    if( p->eStage>=RBU_STAGE_MOVE ){
+      bOpen = 1;
+    }else{
+      RbuState *pState = rbuLoadState(p);
+      if( pState ){
+        bOpen = (pState->eStage>RBU_STAGE_MOVE);
+        rbuFreeState(pState);
+      }
+    }
+    if( bOpen ) p->dbMain = rbuOpenDbhandle(p, p->zRbu, p->nRbu<=1);
+  }
+
+  p->eStage = 0;
+  if( p->rc==SQLITE_OK && p->dbMain==0 ){
+    if( !rbuIsVacuum(p) ){
+      p->dbMain = rbuOpenDbhandle(p, p->zTarget, 1);
+    }else if( p->pRbuFd->pWalFd ){
+      p->rc = SQLITE_ERROR;
+      p->zErrmsg = sqlite3_mprintf("cannot vacuum wal mode database");
+    }else{
+      char *zTarget;
+      char *zExtra = 0;
+      if( strlen(p->zRbu)>=5 && 0==memcmp("file:", p->zRbu, 5) ){
+        zExtra = &p->zRbu[5];
+        while( *zExtra ){
+          if( *zExtra++=='?' ) break;
+        }
+        if( *zExtra=='\0' ) zExtra = 0;
+      }
+
+      zTarget = sqlite3_mprintf("file:%s-vacuum?rbu_memory=1%s%s", 
+          sqlite3_db_filename(p->dbRbu, "main"),
+          (zExtra==0 ? "" : "&"), (zExtra==0 ? "" : zExtra)
+      );
+
+      if( zTarget==0 ){
+        p->rc = SQLITE_NOMEM;
+        return;
+      }
+      p->dbMain = rbuOpenDbhandle(p, zTarget, p->nRbu<=1);
+      sqlite3_free(zTarget);
+    }
+  }
 
   if( p->rc==SQLITE_OK ){
     p->rc = sqlite3_create_function(p->dbMain, 
         "rbu_tmp_insert", -1, SQLITE_UTF8, (void*)p, rbuTmpInsertFunc, 0, 0
     );
@@ -2216,11 +2454,11 @@
     );
   }
 
   if( p->rc==SQLITE_OK ){
     p->rc = sqlite3_create_function(p->dbRbu, 
-        "rbu_target_name", 1, SQLITE_UTF8, (void*)p, rbuTargetNameFunc, 0, 0
+        "rbu_target_name", -1, SQLITE_UTF8, (void*)p, rbuTargetNameFunc, 0, 0
     );
   }
 
   if( p->rc==SQLITE_OK ){
     p->rc = sqlite3_file_control(p->dbMain, "main", SQLITE_FCNTL_RBU, (void*)p);
@@ -2475,13 +2713,19 @@
 ** If an error occurs, leave an error code and error message in the rbu 
 ** handle.
 */
 static void rbuMoveOalFile(sqlite3rbu *p){
   const char *zBase = sqlite3_db_filename(p->dbMain, "main");
+  const char *zMove = zBase;
+  char *zOal;
+  char *zWal;
 
-  char *zWal = sqlite3_mprintf("%s-wal", zBase);
-  char *zOal = sqlite3_mprintf("%s-oal", zBase);
+  if( rbuIsVacuum(p) ){
+    zMove = sqlite3_db_filename(p->dbRbu, "main");
+  }
+  zOal = sqlite3_mprintf("%s-oal", zMove);
+  zWal = sqlite3_mprintf("%s-wal", zMove);
 
   assert( p->eStage==RBU_STAGE_MOVE );
   assert( p->rc==SQLITE_OK && p->zErrmsg==0 );
   if( zWal==0 || zOal==0 ){
     p->rc = SQLITE_NOMEM;
@@ -2498,12 +2742,12 @@
       rbuFileSuffix3(zBase, zWal);
       rbuFileSuffix3(zBase, zOal);
 
       /* Re-open the databases. */
       rbuObjIterFinalize(&p->objiter);
-      sqlite3_close(p->dbMain);
       sqlite3_close(p->dbRbu);
+      sqlite3_close(p->dbMain);
       p->dbMain = 0;
       p->dbRbu = 0;
 
 #if defined(_WIN32_WCE)
       {
@@ -2661,23 +2905,28 @@
 
     pVal = sqlite3_column_value(pIter->pSelect, i);
     p->rc = sqlite3_bind_value(pWriter, i+1, pVal);
     if( p->rc ) return;
   }
-  if( pIter->zIdx==0
-   && (pIter->eType==RBU_PK_VTAB || pIter->eType==RBU_PK_NONE) 
-  ){
-    /* For a virtual table, or a table with no primary key, the 
-    ** SELECT statement is:
-    **
-    **   SELECT <cols>, rbu_control, rbu_rowid FROM ....
-    **
-    ** Hence column_value(pIter->nCol+1).
-    */
-    assertColumnName(pIter->pSelect, pIter->nCol+1, "rbu_rowid");
-    pVal = sqlite3_column_value(pIter->pSelect, pIter->nCol+1);
-    p->rc = sqlite3_bind_value(pWriter, pIter->nCol+1, pVal);
+  if( pIter->zIdx==0 ){
+    if( pIter->eType==RBU_PK_VTAB 
+     || pIter->eType==RBU_PK_NONE 
+     || (pIter->eType==RBU_PK_EXTERNAL && rbuIsVacuum(p)) 
+    ){
+      /* For a virtual table, or a table with no primary key, the 
+      ** SELECT statement is:
+      **
+      **   SELECT <cols>, rbu_control, rbu_rowid FROM ....
+      **
+      ** Hence column_value(pIter->nCol+1).
+      */
+      assertColumnName(pIter->pSelect, pIter->nCol+1, 
+          rbuIsVacuum(p) ? "rowid" : "rbu_rowid"
+      );
+      pVal = sqlite3_column_value(pIter->pSelect, pIter->nCol+1);
+      p->rc = sqlite3_bind_value(pWriter, pIter->nCol+1, pVal);
+    }
   }
   if( p->rc==SQLITE_OK ){
     sqlite3_step(pWriter);
     p->rc = resetAndCollectError(pWriter, &p->zErrmsg);
   }
@@ -2752,17 +3001,22 @@
   return p->rc;
 }
 
 /*
 ** Increment the schema cookie of the main database opened by p->dbMain.
+**
+** Or, if this is an RBU vacuum, set the schema cookie of the main db
+** opened by p->dbMain to one more than the schema cookie of the main
+** db opened by p->dbRbu.
 */
 static void rbuIncrSchemaCookie(sqlite3rbu *p){
   if( p->rc==SQLITE_OK ){
+    sqlite3 *dbread = (rbuIsVacuum(p) ? p->dbRbu : p->dbMain);
     int iCookie = 1000000;
     sqlite3_stmt *pStmt;
 
-    p->rc = prepareAndCollectError(p->dbMain, &pStmt, &p->zErrmsg, 
+    p->rc = prepareAndCollectError(dbread, &pStmt, &p->zErrmsg, 
         "PRAGMA schema_version"
     );
     if( p->rc==SQLITE_OK ){
       /* Coverage: it may be that this sqlite3_step() cannot fail. There
       ** is already a transaction open, so the prepared statement cannot
@@ -2786,10 +3040,11 @@
 ** are determined by inspecting the rbu handle passed as the first argument.
 */
 static void rbuSaveState(sqlite3rbu *p, int eStage){
   if( p->rc==SQLITE_OK || p->rc==SQLITE_DONE ){
     sqlite3_stmt *pInsert = 0;
+    rbu_file *pFd = (rbuIsVacuum(p) ? p->pRbuFd : p->pTargetFd);
     int rc;
 
     assert( p->zErrmsg==0 );
     rc = prepareFreeAndCollectError(p->dbRbu, &pInsert, &p->zErrmsg, 
         sqlite3_mprintf(
@@ -2808,11 +3063,11 @@
           RBU_STATE_TBL, p->objiter.zTbl, 
           RBU_STATE_IDX, p->objiter.zIdx, 
           RBU_STATE_ROW, p->nStep, 
           RBU_STATE_PROGRESS, p->nProgress,
           RBU_STATE_CKPT, p->iWalCksum,
-          RBU_STATE_COOKIE, (i64)p->pTargetFd->iCookie,
+          RBU_STATE_COOKIE, (i64)pFd->iCookie,
           RBU_STATE_OALSZ, p->iOalSz,
           RBU_STATE_PHASEONESTEP, p->nPhaseOneStep
       )
     );
     assert( pInsert==0 || rc==SQLITE_OK );
@@ -2823,26 +3078,121 @@
     }
     if( rc!=SQLITE_OK ) p->rc = rc;
   }
 }
 
+
+/*
+** The second argument passed to this function is the name of a PRAGMA 
+** setting - "page_size", "auto_vacuum", "user_version" or "application_id".
+** This function executes the following on sqlite3rbu.dbRbu:
+**
+**   "PRAGMA main.$zPragma"
+**
+** where $zPragma is the string passed as the second argument, then
+** on sqlite3rbu.dbMain:
+**
+**   "PRAGMA main.$zPragma = $val"
+**
+** where $val is the value returned by the first PRAGMA invocation.
+**
+** In short, it copies the value  of the specified PRAGMA setting from
+** dbRbu to dbMain.
+*/
+static void rbuCopyPragma(sqlite3rbu *p, const char *zPragma){
+  if( p->rc==SQLITE_OK ){
+    sqlite3_stmt *pPragma = 0;
+    p->rc = prepareFreeAndCollectError(p->dbRbu, &pPragma, &p->zErrmsg, 
+        sqlite3_mprintf("PRAGMA main.%s", zPragma)
+    );
+    if( p->rc==SQLITE_OK && SQLITE_ROW==sqlite3_step(pPragma) ){
+      p->rc = rbuMPrintfExec(p, p->dbMain, "PRAGMA main.%s = %d",
+          zPragma, sqlite3_column_int(pPragma, 0)
+      );
+    }
+    rbuFinalize(p, pPragma);
+  }
+}
+
+/*
+** The RBU handle passed as the only argument has just been opened and 
+** the state database is empty. If this RBU handle was opened for an
+** RBU vacuum operation, create the schema in the target db.
+*/
+static void rbuCreateTargetSchema(sqlite3rbu *p){
+  sqlite3_stmt *pSql = 0;
+  sqlite3_stmt *pInsert = 0;
+
+  assert( rbuIsVacuum(p) );
+  p->rc = sqlite3_exec(p->dbMain, "PRAGMA writable_schema=1", 0,0, &p->zErrmsg);
+  if( p->rc==SQLITE_OK ){
+    p->rc = prepareAndCollectError(p->dbRbu, &pSql, &p->zErrmsg, 
+      "SELECT sql FROM sqlite_master WHERE sql!='' AND rootpage!=0"
+      " AND name!='sqlite_sequence' "
+      " ORDER BY type DESC"
+    );
+  }
+
+  while( p->rc==SQLITE_OK && sqlite3_step(pSql)==SQLITE_ROW ){
+    const char *zSql = (const char*)sqlite3_column_text(pSql, 0);
+    p->rc = sqlite3_exec(p->dbMain, zSql, 0, 0, &p->zErrmsg);
+  }
+  rbuFinalize(p, pSql);
+  if( p->rc!=SQLITE_OK ) return;
+
+  if( p->rc==SQLITE_OK ){
+    p->rc = prepareAndCollectError(p->dbRbu, &pSql, &p->zErrmsg, 
+        "SELECT * FROM sqlite_master WHERE rootpage=0 OR rootpage IS NULL" 
+    );
+  }
+
+  if( p->rc==SQLITE_OK ){
+    p->rc = prepareAndCollectError(p->dbMain, &pInsert, &p->zErrmsg, 
+        "INSERT INTO sqlite_master VALUES(?,?,?,?,?)"
+    );
+  }
+
+  while( p->rc==SQLITE_OK && sqlite3_step(pSql)==SQLITE_ROW ){
+    int i;
+    for(i=0; i<5; i++){
+      sqlite3_bind_value(pInsert, i+1, sqlite3_column_value(pSql, i));
+    }
+    sqlite3_step(pInsert);
+    p->rc = sqlite3_reset(pInsert);
+  }
+  if( p->rc==SQLITE_OK ){
+    p->rc = sqlite3_exec(p->dbMain, "PRAGMA writable_schema=0",0,0,&p->zErrmsg);
+  }
+
+  rbuFinalize(p, pSql);
+  rbuFinalize(p, pInsert);
+}
 
 /*
 ** Step the RBU object.
 */
 int sqlite3rbu_step(sqlite3rbu *p){
   if( p ){
     switch( p->eStage ){
       case RBU_STAGE_OAL: {
         RbuObjIter *pIter = &p->objiter;
+
+        /* If this is an RBU vacuum operation and the state table was empty
+        ** when this handle was opened, create the target database schema. */
+        if( rbuIsVacuum(p) && p->nProgress==0 && p->rc==SQLITE_OK ){
+          rbuCreateTargetSchema(p);
+          rbuCopyPragma(p, "user_version");
+          rbuCopyPragma(p, "application_id");
+        }
+
         while( p->rc==SQLITE_OK && pIter->zTbl ){
 
           if( pIter->bCleanup ){
             /* Clean up the rbu_tmp_xxx table for the previous table. It 
             ** cannot be dropped as there are currently active SQL statements.
             ** But the contents can be deleted.  */
-            if( pIter->abIndexed ){
+            if( rbuIsVacuum(p)==0 && pIter->abIndexed ){
               rbuMPrintfExec(p, p->dbRbu, 
                   "DELETE FROM %s.'rbu_tmp_%q'", p->zStateDb, pIter->zDataTbl
               );
             }
           }else{
@@ -2925,98 +3275,10 @@
   }else{
     return SQLITE_NOMEM;
   }
 }
 
-/*
-** Free an RbuState object allocated by rbuLoadState().
-*/
-static void rbuFreeState(RbuState *p){
-  if( p ){
-    sqlite3_free(p->zTbl);
-    sqlite3_free(p->zIdx);
-    sqlite3_free(p);
-  }
-}
-
-/*
-** Allocate an RbuState object and load the contents of the rbu_state 
-** table into it. Return a pointer to the new object. It is the 
-** responsibility of the caller to eventually free the object using
-** sqlite3_free().
-**
-** If an error occurs, leave an error code and message in the rbu handle
-** and return NULL.
-*/
-static RbuState *rbuLoadState(sqlite3rbu *p){
-  RbuState *pRet = 0;
-  sqlite3_stmt *pStmt = 0;
-  int rc;
-  int rc2;
-
-  pRet = (RbuState*)rbuMalloc(p, sizeof(RbuState));
-  if( pRet==0 ) return 0;
-
-  rc = prepareFreeAndCollectError(p->dbRbu, &pStmt, &p->zErrmsg, 
-      sqlite3_mprintf("SELECT k, v FROM %s.rbu_state", p->zStateDb)
-  );
-  while( rc==SQLITE_OK && SQLITE_ROW==sqlite3_step(pStmt) ){
-    switch( sqlite3_column_int(pStmt, 0) ){
-      case RBU_STATE_STAGE:
-        pRet->eStage = sqlite3_column_int(pStmt, 1);
-        if( pRet->eStage!=RBU_STAGE_OAL
-         && pRet->eStage!=RBU_STAGE_MOVE
-         && pRet->eStage!=RBU_STAGE_CKPT
-        ){
-          p->rc = SQLITE_CORRUPT;
-        }
-        break;
-
-      case RBU_STATE_TBL:
-        pRet->zTbl = rbuStrndup((char*)sqlite3_column_text(pStmt, 1), &rc);
-        break;
-
-      case RBU_STATE_IDX:
-        pRet->zIdx = rbuStrndup((char*)sqlite3_column_text(pStmt, 1), &rc);
-        break;
-
-      case RBU_STATE_ROW:
-        pRet->nRow = sqlite3_column_int(pStmt, 1);
-        break;
-
-      case RBU_STATE_PROGRESS:
-        pRet->nProgress = sqlite3_column_int64(pStmt, 1);
-        break;
-
-      case RBU_STATE_CKPT:
-        pRet->iWalCksum = sqlite3_column_int64(pStmt, 1);
-        break;
-
-      case RBU_STATE_COOKIE:
-        pRet->iCookie = (u32)sqlite3_column_int64(pStmt, 1);
-        break;
-
-      case RBU_STATE_OALSZ:
-        pRet->iOalSz = (u32)sqlite3_column_int64(pStmt, 1);
-        break;
-
-      case RBU_STATE_PHASEONESTEP:
-        pRet->nPhaseOneStep = sqlite3_column_int64(pStmt, 1);
-        break;
-
-      default:
-        rc = SQLITE_CORRUPT;
-        break;
-    }
-  }
-  rc2 = sqlite3_finalize(pStmt);
-  if( rc==SQLITE_OK ) rc = rc2;
-
-  p->rc = rc;
-  return pRet;
-}
-
 /*
 ** Compare strings z1 and z2, returning 0 if they are identical, or non-zero
 ** otherwise. Either or both argument may be NULL. Two NULL values are
 ** considered equal, and NULL is considered distinct from all other values.
 */
@@ -3202,20 +3464,18 @@
       }
     }
   }
 }
 
-/*
-** Open and return a new RBU handle. 
-*/
-sqlite3rbu *sqlite3rbu_open(
+
+static sqlite3rbu *openRbuHandle(
   const char *zTarget, 
   const char *zRbu,
   const char *zState
 ){
   sqlite3rbu *p;
-  size_t nTarget = strlen(zTarget);
+  size_t nTarget = zTarget ? strlen(zTarget) : 0;
   size_t nRbu = strlen(zRbu);
   size_t nState = zState ? strlen(zState) : 0;
   size_t nByte = sizeof(sqlite3rbu) + nTarget+1 + nRbu+1+ nState+1;
 
   p = (sqlite3rbu*)sqlite3_malloc64(nByte);
@@ -3224,26 +3484,28 @@
 
     /* Create the custom VFS. */
     memset(p, 0, sizeof(sqlite3rbu));
     rbuCreateVfs(p);
 
-    /* Open the target database */
+    /* Open the target, RBU and state databases */
     if( p->rc==SQLITE_OK ){
-      p->zTarget = (char*)&p[1];
-      memcpy(p->zTarget, zTarget, nTarget+1);
-      p->zRbu = &p->zTarget[nTarget+1];
+      char *pCsr = (char*)&p[1];
+      if( zTarget ){
+        p->zTarget = pCsr;
+        memcpy(p->zTarget, zTarget, nTarget+1);
+        pCsr += nTarget+1;
+      }
+      p->zRbu = pCsr;
       memcpy(p->zRbu, zRbu, nRbu+1);
+      pCsr += nRbu+1;
       if( zState ){
-        p->zState = &p->zRbu[nRbu+1];
+        p->zState = pCsr;
         memcpy(p->zState, zState, nState+1);
       }
       rbuOpenDatabase(p);
     }
 
-    /* If it has not already been created, create the rbu_state table */
-    rbuMPrintfExec(p, p->dbRbu, RBU_CREATE_STATE, p->zStateDb);
-
     if( p->rc==SQLITE_OK ){
       pState = rbuLoadState(p);
       assert( pState || p->rc!=SQLITE_OK );
       if( p->rc==SQLITE_OK ){
 
@@ -3269,31 +3531,43 @@
         p->eStage = RBU_STAGE_CKPT;
         p->nStep = 0;
       }
     }
 
-    if( p->rc==SQLITE_OK
+    if( p->rc==SQLITE_OK 
      && (p->eStage==RBU_STAGE_OAL || p->eStage==RBU_STAGE_MOVE)
-     && pState->eStage!=0 && p->pTargetFd->iCookie!=pState->iCookie
-    ){   
-      /* At this point (pTargetFd->iCookie) contains the value of the
-      ** change-counter cookie (the thing that gets incremented when a 
-      ** transaction is committed in rollback mode) currently stored on 
-      ** page 1 of the database file. */
-      p->rc = SQLITE_BUSY;
-      p->zErrmsg = sqlite3_mprintf("database modified during rbu update");
+     && pState->eStage!=0
+    ){
+      rbu_file *pFd = (rbuIsVacuum(p) ? p->pRbuFd : p->pTargetFd);
+      if( pFd->iCookie!=pState->iCookie ){   
+        /* At this point (pTargetFd->iCookie) contains the value of the
+        ** change-counter cookie (the thing that gets incremented when a 
+        ** transaction is committed in rollback mode) currently stored on 
+        ** page 1 of the database file. */
+        p->rc = SQLITE_BUSY;
+        p->zErrmsg = sqlite3_mprintf("database modified during rbu %s",
+            (rbuIsVacuum(p) ? "vacuum" : "update")
+        );
+      }
     }
 
     if( p->rc==SQLITE_OK ){
       if( p->eStage==RBU_STAGE_OAL ){
         sqlite3 *db = p->dbMain;
+
+        if( pState->eStage==0 && rbuIsVacuum(p) ){
+          rbuCopyPragma(p, "page_size");
+          rbuCopyPragma(p, "auto_vacuum");
+        }
 
         /* Open transactions both databases. The *-oal file is opened or
         ** created at this point. */
-        p->rc = sqlite3_exec(db, "BEGIN IMMEDIATE", 0, 0, &p->zErrmsg);
+        if( p->rc==SQLITE_OK ){
+          p->rc = sqlite3_exec(db, "BEGIN IMMEDIATE", 0, 0, &p->zErrmsg);
+        }
         if( p->rc==SQLITE_OK ){
-          p->rc = sqlite3_exec(p->dbRbu, "BEGIN IMMEDIATE", 0, 0, &p->zErrmsg);
+          p->rc = sqlite3_exec(p->dbRbu, "BEGIN", 0, 0, &p->zErrmsg);
         }
 
         /* Check if the main database is a zipvfs db. If it is, set the upper
         ** level pager to use "journal_mode=off". This prevents it from 
         ** generating a large journal using a temp file.  */
@@ -3334,10 +3608,32 @@
   }
 
   return p;
 }
 
+/*
+** Open and return a new RBU handle. 
+*/
+sqlite3rbu *sqlite3rbu_open(
+  const char *zTarget, 
+  const char *zRbu,
+  const char *zState
+){
+  /* TODO: Check that zTarget and zRbu are non-NULL */
+  return openRbuHandle(zTarget, zRbu, zState);
+}
+
+/*
+** Open a handle to begin or resume an RBU VACUUM operation.
+*/
+sqlite3rbu *sqlite3rbu_vacuum(
+  const char *zTarget, 
+  const char *zState
+){
+  /* TODO: Check that both arguments are non-NULL */
+  return openRbuHandle(0, zTarget, zState);
+}
 
 /*
 ** Return the database handle used by pRbu.
 */
 sqlite3 *sqlite3rbu_db(sqlite3rbu *pRbu, int bRbu){
@@ -3387,14 +3683,24 @@
       p->rc = sqlite3_exec(p->dbRbu, "COMMIT", 0, 0, &p->zErrmsg);
     }
 
     /* Close any open statement handles. */
     rbuObjIterFinalize(&p->objiter);
+
+    /* If this is an RBU vacuum handle and the vacuum has either finished
+    ** successfully or encountered an error, delete the contents of the 
+    ** state table. This causes the next call to sqlite3rbu_vacuum() 
+    ** specifying the current target and state databases to start a new
+    ** vacuum from scratch.  */
+    if( rbuIsVacuum(p) && p->rc!=SQLITE_OK && p->dbRbu ){
+      int rc2 = sqlite3_exec(p->dbRbu, "DELETE FROM stat.rbu_state", 0, 0, 0);
+      if( p->rc==SQLITE_DONE && rc2!=SQLITE_OK ) p->rc = rc2;
+    }
 
     /* Close the open database handle and VFS object. */
-    sqlite3_close(p->dbMain);
     sqlite3_close(p->dbRbu);
+    sqlite3_close(p->dbMain);
     rbuDeleteVfs(p);
     sqlite3_free(p->aBuf);
     sqlite3_free(p->aFrame);
 
     rbuEditErrmsg(p);
@@ -3591,10 +3897,26 @@
   return ((u32)aBuf[0] << 24)
        + ((u32)aBuf[1] << 16)
        + ((u32)aBuf[2] <<  8)
        + ((u32)aBuf[3]);
 }
+
+/*
+** Write an unsigned 32-bit value in big-endian format to the supplied
+** buffer.
+*/
+static void rbuPutU32(u8 *aBuf, u32 iVal){
+  aBuf[0] = (iVal >> 24) & 0xFF;
+  aBuf[1] = (iVal >> 16) & 0xFF;
+  aBuf[2] = (iVal >>  8) & 0xFF;
+  aBuf[3] = (iVal >>  0) & 0xFF;
+}
+
+static void rbuPutU16(u8 *aBuf, u16 iVal){
+  aBuf[0] = (iVal >>  8) & 0xFF;
+  aBuf[1] = (iVal >>  0) & 0xFF;
+}
 
 /*
 ** Read data from an rbuVfs-file.
 */
 static int rbuVfsRead(
@@ -3617,10 +3939,39 @@
     ){
       rc = SQLITE_OK;
       memset(zBuf, 0, iAmt);
     }else{
       rc = p->pReal->pMethods->xRead(p->pReal, zBuf, iAmt, iOfst);
+#if 1
+      /* If this is being called to read the first page of the target 
+      ** database as part of an rbu vacuum operation, synthesize the 
+      ** contents of the first page if it does not yet exist. Otherwise,
+      ** SQLite will not check for a *-wal file.  */
+      if( pRbu && rbuIsVacuum(pRbu) 
+          && rc==SQLITE_IOERR_SHORT_READ && iOfst==0
+          && (p->openFlags & SQLITE_OPEN_MAIN_DB)
+          && pRbu->rc==SQLITE_OK
+      ){
+        sqlite3_file *pFd = (sqlite3_file*)pRbu->pRbuFd;
+        rc = pFd->pMethods->xRead(pFd, zBuf, iAmt, iOfst);
+        if( rc==SQLITE_OK ){
+          u8 *aBuf = (u8*)zBuf;
+          u32 iRoot = rbuGetU32(&aBuf[52]) ? 1 : 0;
+          rbuPutU32(&aBuf[52], iRoot);      /* largest root page number */
+          rbuPutU32(&aBuf[36], 0);          /* number of free pages */
+          rbuPutU32(&aBuf[32], 0);          /* first page on free list trunk */
+          rbuPutU32(&aBuf[28], 1);          /* size of db file in pages */
+          rbuPutU32(&aBuf[24], pRbu->pRbuFd->iCookie+1);  /* Change counter */
+
+          if( iAmt>100 ){
+            memset(&aBuf[100], 0, iAmt-100);
+            rbuPutU16(&aBuf[105], iAmt & 0xFFFF);
+            aBuf[100] = 0x0D;
+          }
+        }
+      }
+#endif
     }
     if( rc==SQLITE_OK && iOfst==0 && (p->openFlags & SQLITE_OPEN_MAIN_DB) ){
       /* These look like magic numbers. But they are stable, as they are part
        ** of the definition of the SQLite file format, which may not change. */
       u8 *pBuf = (u8*)zBuf;
@@ -3691,11 +4042,24 @@
 /*
 ** Return the current file-size of an rbuVfs-file.
 */
 static int rbuVfsFileSize(sqlite3_file *pFile, sqlite_int64 *pSize){
   rbu_file *p = (rbu_file *)pFile;
-  return p->pReal->pMethods->xFileSize(p->pReal, pSize);
+  int rc;
+  rc = p->pReal->pMethods->xFileSize(p->pReal, pSize);
+
+  /* If this is an RBU vacuum operation and this is the target database,
+  ** pretend that it has at least one page. Otherwise, SQLite will not
+  ** check for the existance of a *-wal file. rbuVfsRead() contains 
+  ** similar logic.  */
+  if( rc==SQLITE_OK && *pSize==0 
+   && p->pRbu && rbuIsVacuum(p->pRbu) 
+   && (p->openFlags & SQLITE_OPEN_MAIN_DB)
+  ){
+    *pSize = 1024;
+  }
+  return rc;
 }
 
 /*
 ** Lock an rbuVfs-file.
 */
@@ -3703,11 +4067,13 @@
   rbu_file *p = (rbu_file*)pFile;
   sqlite3rbu *pRbu = p->pRbu;
   int rc = SQLITE_OK;
 
   assert( p->openFlags & (SQLITE_OPEN_MAIN_DB|SQLITE_OPEN_TEMP_DB) );
-  if( pRbu && eLock==SQLITE_LOCK_EXCLUSIVE && pRbu->eStage!=RBU_STAGE_DONE ){
+  if( eLock==SQLITE_LOCK_EXCLUSIVE 
+   && (p->bNolock || (pRbu && pRbu->eStage!=RBU_STAGE_DONE))
+  ){
     /* Do not allow EXCLUSIVE locks. Preventing SQLite from taking this 
     ** prevents it from checkpointing the database from sqlite3_close(). */
     rc = SQLITE_BUSY;
   }else{
     rc = p->pReal->pMethods->xLock(p->pReal, eLock);
@@ -3765,10 +4131,16 @@
         if( p->pWalFd ) p->pWalFd->pRbu = pRbu;
         rc = SQLITE_OK;
       }
     }
     return rc;
+  }
+  else if( op==SQLITE_FCNTL_RBUCNT ){
+    sqlite3rbu *pRbu = (sqlite3rbu*)pArg;
+    pRbu->nRbu++;
+    pRbu->pRbuFd = p;
+    p->bNolock = 1;
   }
 
   rc = xControl(p->pReal, op, pArg);
   if( rc==SQLITE_OK && op==SQLITE_FCNTL_VFSNAME ){
     rbu_vfs *pRbuVfs = p->pRbuVfs;
@@ -3928,10 +4300,37 @@
   sqlite3_mutex_enter(pRbuVfs->mutex);
   for(pDb=pRbuVfs->pMain; pDb && pDb->zWal!=zWal; pDb=pDb->pMainNext){}
   sqlite3_mutex_leave(pRbuVfs->mutex);
   return pDb;
 }
+
+/* 
+** A main database named zName has just been opened. The following 
+** function returns a pointer to a buffer owned by SQLite that contains
+** the name of the *-wal file this db connection will use. SQLite
+** happens to pass a pointer to this buffer when using xAccess()
+** or xOpen() to operate on the *-wal file.  
+*/
+static const char *rbuMainToWal(const char *zName, int flags){
+  int n = (int)strlen(zName);
+  const char *z = &zName[n];
+  if( flags & SQLITE_OPEN_URI ){
+    int odd = 0;
+    while( 1 ){
+      if( z[0]==0 ){
+        odd = 1 - odd;
+        if( odd && z[1]==0 ) break;
+      }
+      z++;
+    }
+    z += 2;
+  }else{
+    while( *z==0 ) z++;
+  }
+  z += (n + 8 + 1);
+  return z;
+}
 
 /*
 ** Open an rbu file handle.
 */
 static int rbuVfsOpen(
@@ -3964,10 +4363,11 @@
   rbu_vfs *pRbuVfs = (rbu_vfs*)pVfs;
   sqlite3_vfs *pRealVfs = pRbuVfs->pRealVfs;
   rbu_file *pFd = (rbu_file *)pFile;
   int rc = SQLITE_OK;
   const char *zOpen = zName;
+  int oflags = flags;
 
   memset(pFd, 0, sizeof(rbu_file));
   pFd->pReal = (sqlite3_file*)&pFd[1];
   pFd->pRbuVfs = pRbuVfs;
   pFd->openFlags = flags;
@@ -3976,40 +4376,31 @@
       /* A main database has just been opened. The following block sets
       ** (pFd->zWal) to point to a buffer owned by SQLite that contains
       ** the name of the *-wal file this db connection will use. SQLite
       ** happens to pass a pointer to this buffer when using xAccess()
       ** or xOpen() to operate on the *-wal file.  */
-      int n = (int)strlen(zName);
-      const char *z = &zName[n];
-      if( flags & SQLITE_OPEN_URI ){
-        int odd = 0;
-        while( 1 ){
-          if( z[0]==0 ){
-            odd = 1 - odd;
-            if( odd && z[1]==0 ) break;
-          }
-          z++;
-        }
-        z += 2;
-      }else{
-        while( *z==0 ) z++;
-      }
-      z += (n + 8 + 1);
-      pFd->zWal = z;
+      pFd->zWal = rbuMainToWal(zName, flags);
     }
     else if( flags & SQLITE_OPEN_WAL ){
       rbu_file *pDb = rbuFindMaindb(pRbuVfs, zName);
       if( pDb ){
         if( pDb->pRbu && pDb->pRbu->eStage==RBU_STAGE_OAL ){
           /* This call is to open a *-wal file. Intead, open the *-oal. This
           ** code ensures that the string passed to xOpen() is terminated by a
           ** pair of '\0' bytes in case the VFS attempts to extract a URI 
           ** parameter from it.  */
-          size_t nCopy = strlen(zName);
-          char *zCopy = sqlite3_malloc64(nCopy+2);
+          const char *zBase = zName;
+          size_t nCopy;
+          char *zCopy;
+          if( rbuIsVacuum(pDb->pRbu) ){
+            zBase = sqlite3_db_filename(pDb->pRbu->dbRbu, "main");
+            zBase = rbuMainToWal(zBase, SQLITE_OPEN_URI);
+          }
+          nCopy = strlen(zBase);
+          zCopy = sqlite3_malloc64(nCopy+2);
           if( zCopy ){
-            memcpy(zCopy, zName, nCopy);
+            memcpy(zCopy, zBase, nCopy);
             zCopy[nCopy-3] = 'o';
             zCopy[nCopy] = '\0';
             zCopy[nCopy+1] = '\0';
             zOpen = (const char*)(pFd->zDel = zCopy);
           }else{
@@ -4019,13 +4410,22 @@
         }
         pDb->pWalFd = pFd;
       }
     }
   }
+
+  if( oflags & SQLITE_OPEN_MAIN_DB 
+   && sqlite3_uri_boolean(zName, "rbu_memory", 0) 
+  ){
+    assert( oflags & SQLITE_OPEN_MAIN_DB );
+    oflags =  SQLITE_OPEN_TEMP_DB | SQLITE_OPEN_READWRITE | SQLITE_OPEN_CREATE |
+              SQLITE_OPEN_EXCLUSIVE | SQLITE_OPEN_DELETEONCLOSE;
+    zOpen = 0;
+  }
 
   if( rc==SQLITE_OK ){
-    rc = pRealVfs->xOpen(pRealVfs, zOpen, pFd->pReal, flags, pOutFlags);
+    rc = pRealVfs->xOpen(pRealVfs, zOpen, pFd->pReal, oflags, pOutFlags);
   }
   if( pFd->pReal->pMethods ){
     /* The xOpen() operation has succeeded. Set the sqlite3_file.pMethods
     ** pointer and, if the file is a main database file, link it into the
     ** mutex protected linked list of all such files.  */

Index: ext/rbu/sqlite3rbu.h
==================================================================
--- ext/rbu/sqlite3rbu.h
+++ ext/rbu/sqlite3rbu.h
@@ -311,10 +311,42 @@
 sqlite3rbu *sqlite3rbu_open(
   const char *zTarget, 
   const char *zRbu,
   const char *zState
 );
+
+/*
+** Open an RBU handle to perform an RBU vacuum on database file zTarget.
+** An RBU vacuum is similar to SQLite's built-in VACUUM command, except
+** that it can be suspended and resumed like an RBU update.
+**
+** The second argument to this function, which may not be NULL, identifies 
+** a database in which to store the state of the RBU vacuum operation if
+** it is suspended. The first time sqlite3rbu_vacuum() is called, to start
+** an RBU vacuum operation, the state database should either not exist or
+** be empty (contain no tables). If an RBU vacuum is suspended by calling
+** sqlite3rbu_close() on the RBU handle before sqlite3rbu_step() has
+** returned SQLITE_DONE, the vacuum state is stored in the state database. 
+** The vacuum can be resumed by calling this function to open a new RBU
+** handle specifying the same target and state databases.
+**
+** This function does not delete the state database after an RBU vacuum
+** is completed, even if it created it. However, if the call to
+** sqlite3rbu_close() returns any value other than SQLITE_OK, the contents
+** of the state tables within the state database are zeroed. This way,
+** the next call to sqlite3rbu_vacuum() opens a handle that starts a 
+** new RBU vacuum operation.
+**
+** As with sqlite3rbu_open(), Zipvfs users should rever to the comment
+** describing the sqlite3rbu_create_vfs() API function below for 
+** a description of the complications associated with using RBU with 
+** zipvfs databases.
+*/
+sqlite3rbu *sqlite3rbu_vacuum(
+  const char *zTarget, 
+  const char *zState
+);
 
 /*
 ** Internally, each RBU connection uses a separate SQLite database 
 ** connection to access the target and rbu update databases. This
 ** API allows the application direct access to these database handles.

Index: ext/rbu/test_rbu.c
==================================================================
--- ext/rbu/test_rbu.c
+++ ext/rbu/test_rbu.c
@@ -18,12 +18,13 @@
 
 #include "sqlite3rbu.h"
 #include <tcl.h>
 #include <assert.h>
 
-/* From main.c (apparently...) */
+/* From main.c */ 
 extern const char *sqlite3ErrName(int);
+extern int sqlite3TestMakePointerStr(Tcl_Interp*, char*, void*);
 
 void test_rbu_delta(sqlite3_context *pCtx, int nArg, sqlite3_value **apVal){
   Tcl_Interp *interp = (Tcl_Interp*)sqlite3_user_data(pCtx);
   Tcl_Obj *pScript;
   int i;
@@ -64,11 +65,12 @@
     {"step", 2, ""},              /* 0 */
     {"close", 2, ""},             /* 1 */
     {"create_rbu_delta", 2, ""},  /* 2 */
     {"savestate", 2, ""},         /* 3 */
     {"dbMain_eval", 3, "SQL"},    /* 4 */
-    {"bp_progress", 2, ""},    /* 5 */
+    {"bp_progress", 2, ""},       /* 5 */
+    {"db", 3, "RBU"},             /* 6 */
     {0,0,0}
   };
   int iCmd;
 
   if( objc<2 ){
@@ -146,10 +148,26 @@
       Tcl_ListObjAppendElement(interp, pObj, Tcl_NewIntObj(one));
       Tcl_ListObjAppendElement(interp, pObj, Tcl_NewIntObj(two));
       Tcl_SetObjResult(interp, pObj);
       break;
     }
+
+    case 6: /* db */ {
+      int bArg;
+      if( Tcl_GetBooleanFromObj(interp, objv[2], &bArg) ){
+        ret = TCL_ERROR;
+      }else{
+        char zBuf[50];
+        sqlite3 *db = sqlite3rbu_db(pRbu, bArg);
+        if( sqlite3TestMakePointerStr(interp, zBuf, (void*)db) ){
+          ret = TCL_ERROR;
+        }else{
+          Tcl_SetResult(interp, zBuf, TCL_VOLATILE);
+        }
+      }
+      break;
+    }
 
     default: /* seems unlikely */
       assert( !"cannot happen" );
       break;
   }
@@ -184,10 +202,38 @@
   pRbu = sqlite3rbu_open(zTarget, zRbu, zStateDb);
   Tcl_CreateObjCommand(interp, zCmd, test_sqlite3rbu_cmd, (ClientData)pRbu, 0);
   Tcl_SetObjResult(interp, objv[1]);
   return TCL_OK;
 }
+
+/*
+** Tclcmd: sqlite3rbu_vacuum CMD <target-db> <state-db>
+*/
+static int test_sqlite3rbu_vacuum(
+  ClientData clientData,
+  Tcl_Interp *interp,
+  int objc,
+  Tcl_Obj *CONST objv[]
+){
+  sqlite3rbu *pRbu = 0;
+  const char *zCmd;
+  const char *zTarget;
+  const char *zStateDb = 0;
+
+  if( objc!=4 ){
+    Tcl_WrongNumArgs(interp, 1, objv, "NAME TARGET-DB STATE-DB");
+    return TCL_ERROR;
+  }
+  zCmd = Tcl_GetString(objv[1]);
+  zTarget = Tcl_GetString(objv[2]);
+  zStateDb = Tcl_GetString(objv[3]);
+
+  pRbu = sqlite3rbu_vacuum(zTarget, zStateDb);
+  Tcl_CreateObjCommand(interp, zCmd, test_sqlite3rbu_cmd, (ClientData)pRbu, 0);
+  Tcl_SetObjResult(interp, objv[1]);
+  return TCL_OK;
+}
 
 /*
 ** Tclcmd: sqlite3rbu_create_vfs ?-default? NAME PARENT
 */
 static int test_sqlite3rbu_create_vfs(
@@ -272,10 +318,11 @@
   static struct {
      char *zName;
      Tcl_ObjCmdProc *xProc;
   } aObjCmd[] = {
     { "sqlite3rbu", test_sqlite3rbu },
+    { "sqlite3rbu_vacuum", test_sqlite3rbu_vacuum },
     { "sqlite3rbu_create_vfs", test_sqlite3rbu_create_vfs },
     { "sqlite3rbu_destroy_vfs", test_sqlite3rbu_destroy_vfs },
     { "sqlite3rbu_internal_test", test_sqlite3rbu_internal_test },
   };
   int i;

Index: ext/session/sessionfault.test
==================================================================
--- ext/session/sessionfault.test
+++ ext/session/sessionfault.test
@@ -15,10 +15,11 @@
 if {![info exists testdir]} {
   set testdir [file join [file dirname [info script]] .. .. test]
 } 
 source [file join [file dirname [info script]] session_common.tcl]
 source $testdir/tester.tcl
+ifcapable !session {finish_test; return}
 
 set testprefix sessionfault
 
 forcedelete test.db2
 sqlite3 db2 test.db2

Index: ext/session/sessionfault2.test
==================================================================
--- ext/session/sessionfault2.test
+++ ext/session/sessionfault2.test
@@ -15,10 +15,11 @@
 if {![info exists testdir]} {
   set testdir [file join [file dirname [info script]] .. .. test]
 } 
 source [file join [file dirname [info script]] session_common.tcl]
 source $testdir/tester.tcl
+ifcapable !session {finish_test; return}
 set testprefix sessionfault2
 
 do_execsql_test 1.0.0 {
   CREATE TABLE t1(a PRIMARY KEY, b UNIQUE);
   INSERT INTO t1 VALUES(1, 1);

Index: ext/session/sqlite3session.c
==================================================================
--- ext/session/sqlite3session.c
+++ ext/session/sqlite3session.c
@@ -590,18 +590,23 @@
   u8 *a1 = aLeft;                 /* Cursor to iterate through aLeft */
   u8 *a2 = aRight;                /* Cursor to iterate through aRight */
   int iCol;                       /* Used to iterate through table columns */
 
   for(iCol=0; iCol<pTab->nCol; iCol++){
-    int n1 = sessionSerialLen(a1);
-    int n2 = sessionSerialLen(a2);
-
-    if( pTab->abPK[iCol] && (n1!=n2 || memcmp(a1, a2, n1)) ){
-      return 0;
-    }
-    if( pTab->abPK[iCol] || bLeftPkOnly==0 ) a1 += n1;
-    if( pTab->abPK[iCol] || bRightPkOnly==0 ) a2 += n2;
+    if( pTab->abPK[iCol] ){
+      int n1 = sessionSerialLen(a1);
+      int n2 = sessionSerialLen(a2);
+
+      if( pTab->abPK[iCol] && (n1!=n2 || memcmp(a1, a2, n1)) ){
+        return 0;
+      }
+      a1 += n1;
+      a2 += n2;
+    }else{
+      if( bLeftPkOnly==0 ) a1 += sessionSerialLen(a1);
+      if( bRightPkOnly==0 ) a2 += sessionSerialLen(a2);
+    }
   }
 
   return 1;
 }
 

Index: src/build.c
==================================================================
--- src/build.c
+++ src/build.c
@@ -1084,10 +1084,11 @@
     pCol->szEst = 1;
   }else{
     zType = z + sqlite3Strlen30(z) + 1;
     memcpy(zType, pType->z, pType->n);
     zType[pType->n] = 0;
+    sqlite3Dequote(zType);
     pCol->affinity = sqlite3AffinityType(zType, &pCol->szEst);
     pCol->colFlags |= COLFLAG_HASTYPE;
   }
   p->nCol++;
   pParse->constraintName.n = 0;

Index: src/expr.c
==================================================================
--- src/expr.c
+++ src/expr.c
@@ -2358,11 +2358,11 @@
     }
     p->tempReg = 0;
   }
   p->iReg = 0;
   pParse->nColCache--;
-  assert( cacheIsValid(pParse) );
+  assert( pParse->db->mallocFailed || cacheIsValid(pParse) );
 }
 
 
 /*
 ** Record in the column cache that a particular column from a
@@ -2403,11 +2403,11 @@
       p->iColumn = iCol;
       p->iReg = iReg;
       p->tempReg = 0;
       p->lru = pParse->iCacheCnt++;
       pParse->nColCache++;
-      assert( cacheIsValid(pParse) );
+      assert( pParse->db->mallocFailed || cacheIsValid(pParse) );
       return;
     }
   }
 
   /* Replace the last recently used */

Index: src/func.c
==================================================================
--- src/func.c
+++ src/func.c
@@ -1383,10 +1383,18 @@
 static void loadExt(sqlite3_context *context, int argc, sqlite3_value **argv){
   const char *zFile = (const char *)sqlite3_value_text(argv[0]);
   const char *zProc;
   sqlite3 *db = sqlite3_context_db_handle(context);
   char *zErrMsg = 0;
+
+  /* Disallow the load_extension() SQL function unless the SQLITE_LoadExtFunc
+  ** flag is set.  See the sqlite3_enable_load_extension() API.
+  */
+  if( (db->flags & SQLITE_LoadExtFunc)==0 ){
+    sqlite3_result_error(context, "not authorized", -1);
+    return;
+  }
 
   if( argc==2 ){
     zProc = (const char *)sqlite3_value_text(argv[1]);
   }else{
     zProc = 0;

Index: src/hash.c
==================================================================
--- src/hash.c
+++ src/hash.c
@@ -53,11 +53,11 @@
 ** The hashing function.
 */
 static unsigned int strHash(const char *z){
   unsigned int h = 0;
   unsigned char c;
-  while( (c = (unsigned char)*z++)!=0 ){
+  while( (c = (unsigned char)*z++)!=0 ){     /*OPTIMIZATION-IF-TRUE*/
     h = (h<<3) ^ h ^ sqlite3UpperToLower[c];
   }
   return h;
 }
 
@@ -146,11 +146,11 @@
 ){
   HashElem *elem;                /* Used to loop thru the element list */
   int count;                     /* Number of elements left to test */
   unsigned int h;                /* The computed hash */
 
-  if( pH->ht ){
+  if( pH->ht ){   /*OPTIMIZATION-IF-TRUE*/
     struct _ht *pEntry;
     h = strHash(pKey) % pH->htsize;
     pEntry = &pH->ht[h];
     elem = pEntry->chain;
     count = pEntry->count;

Index: src/loadext.c
==================================================================
--- src/loadext.c
+++ src/loadext.c
@@ -462,12 +462,13 @@
   if( pzErrMsg ) *pzErrMsg = 0;
 
   /* Ticket #1863.  To avoid a creating security problems for older
   ** applications that relink against newer versions of SQLite, the
   ** ability to run load_extension is turned off by default.  One
-  ** must call sqlite3_enable_load_extension() to turn on extension
-  ** loading.  Otherwise you get the following error.
+  ** must call either sqlite3_enable_load_extension(db) or
+  ** sqlite3_db_config(db, SQLITE_DBCONFIG_ENABLE_LOAD_EXTENSION, 1, 0)
+  ** to turn on extension loading.
   */
   if( (db->flags & SQLITE_LoadExtension)==0 ){
     if( pzErrMsg ){
       *pzErrMsg = sqlite3_mprintf("not authorized");
     }
@@ -602,13 +603,13 @@
 ** default so as not to open security holes in older applications.
 */
 int sqlite3_enable_load_extension(sqlite3 *db, int onoff){
   sqlite3_mutex_enter(db->mutex);
   if( onoff ){
-    db->flags |= SQLITE_LoadExtension;
+    db->flags |= SQLITE_LoadExtension|SQLITE_LoadExtFunc;
   }else{
-    db->flags &= ~SQLITE_LoadExtension;
+    db->flags &= ~(SQLITE_LoadExtension|SQLITE_LoadExtFunc);
   }
   sqlite3_mutex_leave(db->mutex);
   return SQLITE_OK;
 }
 

Index: src/main.c
==================================================================
--- src/main.c
+++ src/main.c
@@ -802,10 +802,11 @@
         u32 mask;    /* Mask of the bit in sqlite3.flags to set/clear */
       } aFlagOp[] = {
         { SQLITE_DBCONFIG_ENABLE_FKEY,           SQLITE_ForeignKeys    },
         { SQLITE_DBCONFIG_ENABLE_TRIGGER,        SQLITE_EnableTrigger  },
         { SQLITE_DBCONFIG_ENABLE_FTS3_TOKENIZER, SQLITE_Fts3Tokenizer  },
+        { SQLITE_DBCONFIG_ENABLE_LOAD_EXTENSION, SQLITE_LoadExtension  },
       };
       unsigned int i;
       rc = SQLITE_ERROR; /* IMP: R-42790-23372 */
       for(i=0; i<ArraySize(aFlagOp); i++){
         if( aFlagOp[i].op==op ){

Index: src/os.c
==================================================================
--- src/os.c
+++ src/os.c
@@ -79,17 +79,15 @@
 ** The following routines are convenience wrappers around methods
 ** of the sqlite3_file object.  This is mostly just syntactic sugar. All
 ** of this would be completely automatic if SQLite were coded using
 ** C++ instead of plain old C.
 */
-int sqlite3OsClose(sqlite3_file *pId){
-  int rc = SQLITE_OK;
+void sqlite3OsClose(sqlite3_file *pId){
   if( pId->pMethods ){
-    rc = pId->pMethods->xClose(pId);
+    pId->pMethods->xClose(pId);
     pId->pMethods = 0;
   }
-  return rc;
 }
 int sqlite3OsRead(sqlite3_file *id, void *pBuf, int amt, i64 offset){
   DO_OS_MALLOC_TEST(id);
   return id->pMethods->xRead(id, pBuf, amt, offset);
 }
@@ -303,16 +301,14 @@
   }else{
     rc = SQLITE_NOMEM_BKPT;
   }
   return rc;
 }
-int sqlite3OsCloseFree(sqlite3_file *pFile){
-  int rc = SQLITE_OK;
+void sqlite3OsCloseFree(sqlite3_file *pFile){
   assert( pFile );
-  rc = sqlite3OsClose(pFile);
+  sqlite3OsClose(pFile);
   sqlite3_free(pFile);
-  return rc;
 }
 
 /*
 ** This function is a wrapper around the OS specific implementation of
 ** sqlite3_os_init(). The purpose of the wrapper is to provide the

Index: src/os.h
==================================================================
--- src/os.h
+++ src/os.h
@@ -158,11 +158,11 @@
 int sqlite3OsInit(void);
 
 /* 
 ** Functions for accessing sqlite3_file methods 
 */
-int sqlite3OsClose(sqlite3_file*);
+void sqlite3OsClose(sqlite3_file*);
 int sqlite3OsRead(sqlite3_file*, void*, int amt, i64 offset);
 int sqlite3OsWrite(sqlite3_file*, const void*, int amt, i64 offset);
 int sqlite3OsTruncate(sqlite3_file*, i64 size);
 int sqlite3OsSync(sqlite3_file*, int);
 int sqlite3OsFileSize(sqlite3_file*, i64 *pSize);
@@ -203,8 +203,8 @@
 /*
 ** Convenience functions for opening and closing files using 
 ** sqlite3_malloc() to obtain space for the file-handle structure.
 */
 int sqlite3OsOpenMalloc(sqlite3_vfs *, const char *, sqlite3_file **, int,int*);
-int sqlite3OsCloseFree(sqlite3_file *);
+void sqlite3OsCloseFree(sqlite3_file *);
 
 #endif /* _SQLITE_OS_H_ */

Index: src/os_unix.c
==================================================================
--- src/os_unix.c
+++ src/os_unix.c
@@ -403,11 +403,11 @@
 #if defined(USE_PREAD64)
   { "pread64",      (sqlite3_syscall_ptr)pread64,    0  },
 #else
   { "pread64",      (sqlite3_syscall_ptr)0,          0  },
 #endif
-#define osPread64   ((ssize_t(*)(int,void*,size_t,off_t))aSyscall[10].pCurrent)
+#define osPread64 ((ssize_t(*)(int,void*,size_t,off64_t))aSyscall[10].pCurrent)
 
   { "write",        (sqlite3_syscall_ptr)write,      0  },
 #define osWrite     ((ssize_t(*)(int,const void*,size_t))aSyscall[11].pCurrent)
 
 #if defined(USE_PREAD) || SQLITE_ENABLE_LOCKING_STYLE
@@ -421,11 +421,11 @@
 #if defined(USE_PREAD64)
   { "pwrite64",     (sqlite3_syscall_ptr)pwrite64,   0  },
 #else
   { "pwrite64",     (sqlite3_syscall_ptr)0,          0  },
 #endif
-#define osPwrite64  ((ssize_t(*)(int,const void*,size_t,off_t))\
+#define osPwrite64  ((ssize_t(*)(int,const void*,size_t,off64_t))\
                     aSyscall[13].pCurrent)
 
   { "fchmod",       (sqlite3_syscall_ptr)fchmod,          0  },
 #define osFchmod    ((int(*)(int,mode_t))aSyscall[14].pCurrent)
 
@@ -4286,14 +4286,16 @@
     sqlite3FileSuffix3(pDbFd->zPath, zShmFilename);
 #endif
     pShmNode->h = -1;
     pDbFd->pInode->pShmNode = pShmNode;
     pShmNode->pInode = pDbFd->pInode;
-    pShmNode->mutex = sqlite3_mutex_alloc(SQLITE_MUTEX_FAST);
-    if( pShmNode->mutex==0 ){
-      rc = SQLITE_NOMEM_BKPT;
-      goto shm_open_err;
+    if( sqlite3GlobalConfig.bCoreMutex ){
+      pShmNode->mutex = sqlite3_mutex_alloc(SQLITE_MUTEX_FAST);
+      if( pShmNode->mutex==0 ){
+        rc = SQLITE_NOMEM_BKPT;
+        goto shm_open_err;
+      }
     }
 
     if( pInode->bProcessLock==0 ){
       int openFlags = O_RDWR | O_CREAT;
       if( sqlite3_uri_boolean(pDbFd->zPath, "readonly_shm", 0) ){
@@ -5414,18 +5416,18 @@
   struct stat buf;
   const char *zDir = sqlite3_temp_directory;
 
   if( !azDirs[0] ) azDirs[0] = getenv("SQLITE_TMPDIR");
   if( !azDirs[1] ) azDirs[1] = getenv("TMPDIR");
-  for(i=0; i<sizeof(azDirs)/sizeof(azDirs[0]); zDir=azDirs[i++]){
+  for(i=0; i<=sizeof(azDirs)/sizeof(azDirs[0]); zDir=azDirs[i++]){
     if( zDir==0 ) continue;
     if( osStat(zDir, &buf) ) continue;
     if( !S_ISDIR(buf.st_mode) ) continue;
-    if( osAccess(zDir, 07) ) continue;
-    break;
+    if( osAccess(zDir, 03) ) continue;
+    return zDir;
   }
-  return zDir;
+  return 0;
 }
 
 /*
 ** Create a temporary file name in zBuf.  zBuf must be allocated
 ** by the calling process and must be big enough to hold at least
@@ -5437,13 +5439,15 @@
 
   /* It's odd to simulate an io-error here, but really this is just
   ** using the io-error infrastructure to test that SQLite handles this
   ** function failing. 
   */
+  zBuf[0] = 0;
   SimulateIOError( return SQLITE_IOERR );
 
   zDir = unixTempFileDir();
+  if( zDir==0 ) return SQLITE_IOERR_GETTEMPPATH;
   do{
     u64 r;
     sqlite3_randomness(sizeof(r), &r);
     assert( nBuf>2 );
     zBuf[nBuf-2] = 0;

Index: src/os_win.c
==================================================================
--- src/os_win.c
+++ src/os_win.c
@@ -1258,12 +1258,12 @@
 */
 int sqlite3_win32_reset_heap(){
   int rc;
   MUTEX_LOGIC( sqlite3_mutex *pMaster; ) /* The main static mutex */
   MUTEX_LOGIC( sqlite3_mutex *pMem; )    /* The memsys static mutex */
-  MUTEX_LOGIC( pMaster = sqlite3_mutex_alloc(SQLITE_MUTEX_STATIC_MASTER); )
-  MUTEX_LOGIC( pMem = sqlite3_mutex_alloc(SQLITE_MUTEX_STATIC_MEM); )
+  MUTEX_LOGIC( pMaster = sqlite3MutexAlloc(SQLITE_MUTEX_STATIC_MASTER); )
+  MUTEX_LOGIC( pMem = sqlite3MutexAlloc(SQLITE_MUTEX_STATIC_MEM); )
   sqlite3_mutex_enter(pMaster);
   sqlite3_mutex_enter(pMem);
   winMemAssertMagic();
   if( winMemGetHeap()!=NULL && winMemGetOwned() && sqlite3_memory_used()==0 ){
     /*
@@ -3167,13 +3167,12 @@
   /* Lock the PENDING_LOCK byte if we need to acquire a PENDING lock or
   ** a SHARED lock.  If we are acquiring a SHARED lock, the acquisition of
   ** the PENDING_LOCK byte is temporary.
   */
   newLocktype = pFile->locktype;
-  if(   (pFile->locktype==NO_LOCK)
-     || (   (locktype==EXCLUSIVE_LOCK)
-         && (pFile->locktype==RESERVED_LOCK))
+  if( pFile->locktype==NO_LOCK
+   || (locktype==EXCLUSIVE_LOCK && pFile->locktype<=RESERVED_LOCK)
   ){
     int cnt = 3;
     while( cnt-->0 && (res = winLockFile(&pFile->h, SQLITE_LOCKFILE_FLAGS,
                                          PENDING_BYTE, 0, 1, 0))==0 ){
       /* Try 3 times to get the pending lock.  This is needed to work
@@ -3763,14 +3762,16 @@
     pNew = 0;
     ((winFile*)(&pShmNode->hFile))->h = INVALID_HANDLE_VALUE;
     pShmNode->pNext = winShmNodeList;
     winShmNodeList = pShmNode;
 
-    pShmNode->mutex = sqlite3_mutex_alloc(SQLITE_MUTEX_FAST);
-    if( pShmNode->mutex==0 ){
-      rc = SQLITE_IOERR_NOMEM_BKPT;
-      goto shm_open_err;
+    if( sqlite3GlobalConfig.bCoreMutex ){
+      pShmNode->mutex = sqlite3_mutex_alloc(SQLITE_MUTEX_FAST);
+      if( pShmNode->mutex==0 ){
+        rc = SQLITE_IOERR_NOMEM_BKPT;
+        goto shm_open_err;
+      }
     }
 
     rc = winOpen(pDbFd->pVfs,
                  pShmNode->zFilename,             /* Name of the file (UTF-8) */
                  (sqlite3_file*)&pShmNode->hFile,  /* File handle here */

Index: src/pager.c
==================================================================
--- src/pager.c
+++ src/pager.c
@@ -870,10 +870,11 @@
   ** return SQLITE_IOERR_NOMEM while the journal file is being written). It 
   ** is therefore not possible for an in-memory pager to enter the ERROR 
   ** state.
   */
   if( MEMDB ){
+    assert( !isOpen(p->fd) );
     assert( p->noSync );
     assert( p->journalMode==PAGER_JOURNALMODE_OFF 
          || p->journalMode==PAGER_JOURNALMODE_MEMORY 
     );
     assert( p->eState!=PAGER_ERROR && p->eState!=PAGER_OPEN );
@@ -1817,21 +1818,22 @@
 
   /* If Pager.errCode is set, the contents of the pager cache cannot be
   ** trusted. Now that there are no outstanding references to the pager,
   ** it can safely move back to PAGER_OPEN state. This happens in both
   ** normal and exclusive-locking mode.
-  **
-  ** Exception: There is no way out of the error state for temp files.
-  ** This is because it is not possible to call pager_reset() on a temp
-  ** file pager (as this may discard the only copy of some data).  */
+  */
   assert( pPager->errCode==SQLITE_OK || !MEMDB );
-  if( pPager->tempFile==0 && pPager->errCode ){
-    pager_reset(pPager);
-    pPager->changeCountDone = 0;
-    pPager->eState = PAGER_OPEN;
-    pPager->errCode = SQLITE_OK;
+  if( pPager->errCode ){
+    if( pPager->tempFile==0 ){
+      pager_reset(pPager);
+      pPager->changeCountDone = 0;
+      pPager->eState = PAGER_OPEN;
+    }else{
+      pPager->eState = (isOpen(pPager->jfd) ? PAGER_OPEN : PAGER_READER);
+    }
     if( USEFETCH(pPager) ) sqlite3OsUnfetch(pPager->fd, 0, 0);
+    pPager->errCode = SQLITE_OK;
   }
 
   pPager->journalOff = 0;
   pPager->journalHdr = 0;
   pPager->setMaster = 0;
@@ -1870,10 +1872,29 @@
   }
   return rc;
 }
 
 static int pager_truncate(Pager *pPager, Pgno nPage);
+
+/*
+** The write transaction open on the pager passed as the only argument is
+** being committed. This function returns true if all dirty pages should
+** be flushed to disk, or false otherwise. Pages should be flushed to disk
+** unless one of the following is true:
+**
+**   * The db is an in-memory database.
+**
+**   * The db is a temporary database and the db file has not been opened.
+**
+**   * The db is a temporary database and the cache contains less than
+**     C/4 dirty pages, where C is the configured cache-size.
+*/
+static int pagerFlushOnCommit(Pager *pPager){
+  if( pPager->tempFile==0 ) return 1;
+  if( !isOpen(pPager->fd) ) return 0;
+  return (sqlite3PCachePercentDirty(pPager->pPCache)>=25);
+}
 
 /*
 ** This routine ends a transaction. A transaction is usually ended by 
 ** either a COMMIT or a ROLLBACK operation. This routine may be called 
 ** after rollback of a hot-journal, or if an error occurs while opening
@@ -2009,11 +2030,11 @@
 #endif
 
   sqlite3BitvecDestroy(pPager->pInJournal);
   pPager->pInJournal = 0;
   pPager->nRec = 0;
-  if( isOpen(pPager->fd) || MEMDB ){
+  if( MEMDB || pagerFlushOnCommit(pPager) ){
     sqlite3PcacheCleanAll(pPager->pPCache);
   }else{
     sqlite3PcacheClearWritable(pPager->pPCache);
   }
   sqlite3PcacheTruncate(pPager->pPCache, pPager->dbSize);
@@ -2298,11 +2319,11 @@
     pPg = 0;
   }else{
     pPg = sqlite3PagerLookup(pPager, pgno);
   }
   assert( pPg || !MEMDB );
-  assert( pPager->eState!=PAGER_OPEN || pPg==0 );
+  assert( pPager->eState!=PAGER_OPEN || pPg==0 || pPager->tempFile );
   PAGERTRACE(("PLAYBACK %d page %d hash(%08x) %s\n",
            PAGERID(pPager), pgno, pager_datahash(pPager->pageSize, (u8*)aData),
            (isMainJrnl?"main-journal":"sub-journal")
   ));
   if( isMainJrnl ){
@@ -3179,25 +3200,24 @@
   ** available from the WAL sub-system if the log file is empty or
   ** contains no valid committed transactions.
   */
   assert( pPager->eState==PAGER_OPEN );
   assert( pPager->eLock>=SHARED_LOCK );
+  assert( isOpen(pPager->fd) );
+  assert( pPager->tempFile==0 );
   nPage = sqlite3WalDbsize(pPager->pWal);
 
   /* If the number of pages in the database is not available from the
   ** WAL sub-system, determine the page counte based on the size of
   ** the database file.  If the size of the database file is not an
   ** integer multiple of the page-size, round up the result.
   */
-  if( nPage==0 ){
+  if( nPage==0 && ALWAYS(isOpen(pPager->fd)) ){
     i64 n = 0;                    /* Size of db file in bytes */
-    assert( isOpen(pPager->fd) || pPager->tempFile );
-    if( isOpen(pPager->fd) ){
-      int rc = sqlite3OsFileSize(pPager->fd, &n);
-      if( rc!=SQLITE_OK ){
-        return rc;
-      }
+    int rc = sqlite3OsFileSize(pPager->fd, &n);
+    if( rc!=SQLITE_OK ){
+      return rc;
     }
     nPage = (Pgno)((n+pPager->pageSize-1) / pPager->pageSize);
   }
 
   /* If the current number of pages in the file is greater than the
@@ -4939,10 +4959,11 @@
     */
     rc = sqlite3OsCheckReservedLock(pPager->fd, &locked);
     if( rc==SQLITE_OK && !locked ){
       Pgno nPage;                 /* Number of pages in database file */
 
+      assert( pPager->tempFile==0 );
       rc = pagerPagecount(pPager, &nPage);
       if( rc==SQLITE_OK ){
         /* If the database is zero pages in size, that means that either (1) the
         ** journal is a remnant from a prior database with the same name where
         ** the database file but not the journal was deleted, or (2) the initial
@@ -5031,21 +5052,21 @@
   int rc = SQLITE_OK;                /* Return code */
 
   /* This routine is only called from b-tree and only when there are no
   ** outstanding pages. This implies that the pager state should either
   ** be OPEN or READER. READER is only possible if the pager is or was in 
-  ** exclusive access mode.
-  */
+  ** exclusive access mode.  */
   assert( sqlite3PcacheRefCount(pPager->pPCache)==0 );
   assert( assert_pager_state(pPager) );
-  if( pPager->tempFile && pPager->errCode ) { return pPager->errCode; }
   assert( pPager->eState==PAGER_OPEN || pPager->eState==PAGER_READER );
+  assert( pPager->errCode==SQLITE_OK );
 
   if( !pagerUseWal(pPager) && pPager->eState==PAGER_OPEN ){
     int bHotJournal = 1;          /* True if there exists a hot journal-file */
 
     assert( !MEMDB );
+    assert( pPager->tempFile==0 || pPager->eLock==EXCLUSIVE_LOCK );
 
     rc = pager_wait_on_lock(pPager, SHARED_LOCK);
     if( rc!=SQLITE_OK ){
       assert( pPager->eLock==NO_LOCK || pPager->eLock==UNKNOWN_LOCK );
       goto failed;
@@ -5127,11 +5148,11 @@
       */
       if( isOpen(pPager->jfd) ){
         assert( rc==SQLITE_OK );
         rc = pagerSyncHotJournal(pPager);
         if( rc==SQLITE_OK ){
-          rc = pager_playback(pPager, 1);
+          rc = pager_playback(pPager, !pPager->tempFile);
           pPager->eState = PAGER_OPEN;
         }
       }else if( !pPager->exclusiveMode ){
         pagerUnlockDb(pPager, SHARED_LOCK);
       }
@@ -5223,11 +5244,11 @@
   if( pagerUseWal(pPager) ){
     assert( rc==SQLITE_OK );
     rc = pagerBeginReadTransaction(pPager);
   }
 
-  if( pPager->eState==PAGER_OPEN && rc==SQLITE_OK ){
+  if( pPager->tempFile==0 && pPager->eState==PAGER_OPEN && rc==SQLITE_OK ){
     rc = pagerPagecount(pPager, &pPager->dbSize);
   }
 
  failed:
   if( rc!=SQLITE_OK ){
@@ -5356,11 +5377,11 @@
       rc = sqlite3OsFetch(pPager->fd, 
           (i64)(pgno-1) * pPager->pageSize, pPager->pageSize, &pData
       );
 
       if( rc==SQLITE_OK && pData ){
-        if( pPager->eState>PAGER_READER ){
+        if( pPager->eState>PAGER_READER || pPager->tempFile ){
           pPg = sqlite3PagerLookup(pPager, pgno);
         }
         if( pPg==0 ){
           rc = pagerAcquireMapPage(pPager, pgno, pData, &pPg);
         }else{
@@ -5423,11 +5444,12 @@
     if( pgno>PAGER_MAX_PGNO || pgno==PAGER_MJ_PGNO(pPager) ){
       rc = SQLITE_CORRUPT_BKPT;
       goto pager_acquire_err;
     }
 
-    if( MEMDB || pPager->dbSize<pgno || noContent || !isOpen(pPager->fd) ){
+    assert( !isOpen(pPager->fd) || !MEMDB );
+    if( !isOpen(pPager->fd) || pPager->dbSize<pgno || noContent ){
       if( pgno>pPager->mxPgno ){
         rc = SQLITE_FULL;
         goto pager_acquire_err;
       }
       if( noContent ){
@@ -6185,20 +6207,23 @@
   );
   assert( assert_pager_state(pPager) );
 
   /* If a prior error occurred, report that error again. */
   if( NEVER(pPager->errCode) ) return pPager->errCode;
+
+  /* Provide the ability to easily simulate an I/O error during testing */
+  if( (rc = sqlite3FaultSim(400))!=SQLITE_OK ) return rc;
 
   PAGERTRACE(("DATABASE SYNC: File=%s zMaster=%s nSize=%d\n", 
       pPager->zFilename, zMaster, pPager->dbSize));
 
   /* If no database changes have been made, return early. */
   if( pPager->eState<PAGER_WRITER_CACHEMOD ) return SQLITE_OK;
 
   assert( MEMDB==0 || pPager->tempFile );
   assert( isOpen(pPager->fd) || pPager->tempFile );
-  if( !isOpen(pPager->fd) ){
+  if( 0==pagerFlushOnCommit(pPager) ){
     /* If this is an in-memory db, or no pages have been written to, or this
     ** function has already been called, it is mostly a no-op.  However, any
     ** backup in progress needs to be restarted.  */
     sqlite3BackupRestart(pPager->pBackup);
   }else{
@@ -7326,10 +7351,11 @@
     if( rc==SQLITE_OK ){
       rc = sqlite3WalClose(pPager->pWal, pPager->ckptSyncFlags,
                            pPager->pageSize, (u8*)pPager->pTmpSpace);
       pPager->pWal = 0;
       pagerFixMaplimit(pPager);
+      if( rc && !pPager->exclusiveMode ) pagerUnlockDb(pPager, SHARED_LOCK);
     }
   }
   return rc;
 }
 

Index: src/pager.h
==================================================================
--- src/pager.h
+++ src/pager.h
@@ -66,11 +66,15 @@
 #define PAGER_LOCKINGMODE_QUERY      -1
 #define PAGER_LOCKINGMODE_NORMAL      0
 #define PAGER_LOCKINGMODE_EXCLUSIVE   1
 
 /*
-** Numeric constants that encode the journalmode.  
+** Numeric constants that encode the journalmode.
+**
+** The numeric values encoded here (other than PAGER_JOURNALMODE_QUERY)
+** are exposed in the API via the "PRAGMA journal_mode" command and
+** therefore cannot be changed without a compatibility break.
 */
 #define PAGER_JOURNALMODE_QUERY     (-1)  /* Query the value of journalmode */
 #define PAGER_JOURNALMODE_DELETE      0   /* Commit by deleting journal file */
 #define PAGER_JOURNALMODE_PERSIST     1   /* Commit by zeroing journal header */
 #define PAGER_JOURNALMODE_OFF         2   /* Journal omitted.  */
@@ -84,10 +88,15 @@
 #define PAGER_GET_NOCONTENT     0x01  /* Do not load data from disk */
 #define PAGER_GET_READONLY      0x02  /* Read-only page is acceptable */
 
 /*
 ** Flags for sqlite3PagerSetFlags()
+**
+** Value constraints (enforced via assert()):
+**    PAGER_FULLFSYNC      == SQLITE_FullFSync
+**    PAGER_CKPT_FULLFSYNC == SQLITE_CkptFullFSync
+**    PAGER_CACHE_SPILL    == SQLITE_CacheSpill
 */
 #define PAGER_SYNCHRONOUS_OFF       0x01  /* PRAGMA synchronous=OFF */
 #define PAGER_SYNCHRONOUS_NORMAL    0x02  /* PRAGMA synchronous=NORMAL */
 #define PAGER_SYNCHRONOUS_FULL      0x03  /* PRAGMA synchronous=FULL */
 #define PAGER_SYNCHRONOUS_EXTRA     0x04  /* PRAGMA synchronous=EXTRA */

Index: src/pcache.c
==================================================================
--- src/pcache.c
+++ src/pcache.c
@@ -684,10 +684,21 @@
 ** Return the size of the header added by this middleware layer
 ** in the page-cache hierarchy.
 */
 int sqlite3HeaderSizePcache(void){ return ROUND8(sizeof(PgHdr)); }
 
+/*
+** Return the number of dirty pages currently in the cache, as a percentage
+** of the configured cache size.
+*/
+int sqlite3PCachePercentDirty(PCache *pCache){
+  PgHdr *pDirty;
+  int nDirty = 0;
+  int nCache = numberOfCachePages(pCache);
+  for(pDirty=pCache->pDirty; pDirty; pDirty=pDirty->pDirtyNext) nDirty++;
+  return nCache ? (int)(((i64)nDirty * 100) / nCache) : 0;
+}
 
 #if defined(SQLITE_CHECK_PAGES) || defined(SQLITE_DEBUG)
 /*
 ** For all dirty pages currently in the cache, invoke the specified
 ** callback. This is only used if the SQLITE_CHECK_PAGES macro is

Index: src/pcache.h
==================================================================
--- src/pcache.h
+++ src/pcache.h
@@ -97,10 +97,11 @@
 
 void sqlite3PcacheDrop(PgHdr*);         /* Remove page from cache */
 void sqlite3PcacheMakeDirty(PgHdr*);    /* Make sure page is marked dirty */
 void sqlite3PcacheMakeClean(PgHdr*);    /* Mark a single page as clean */
 void sqlite3PcacheCleanAll(PCache*);    /* Mark all dirty list pages as clean */
+void sqlite3PcacheClearWritable(PCache*);
 
 /* Change a page number.  Used by incr-vacuum. */
 void sqlite3PcacheMove(PgHdr*, Pgno);
 
 /* Remove all pages with pgno>x.  Reset the cache if x==0 */
@@ -170,7 +171,10 @@
 void sqlite3PCacheSetDefault(void);
 
 /* Return the header size */
 int sqlite3HeaderSizePcache(void);
 int sqlite3HeaderSizePcache1(void);
+
+/* Number of dirty pages as a percentage of the configured cache size */
+int sqlite3PCachePercentDirty(PCache*);
 
 #endif /* _PCACHE_H_ */

Index: src/pcache1.c
==================================================================
--- src/pcache1.c
+++ src/pcache1.c
@@ -688,12 +688,12 @@
   pcache1.separateCache = sqlite3GlobalConfig.pPage==0;
 #endif
 
 #if SQLITE_THREADSAFE
   if( sqlite3GlobalConfig.bCoreMutex ){
-    pcache1.grp.mutex = sqlite3_mutex_alloc(SQLITE_MUTEX_STATIC_LRU);
-    pcache1.mutex = sqlite3_mutex_alloc(SQLITE_MUTEX_STATIC_PMEM);
+    pcache1.grp.mutex = sqlite3MutexAlloc(SQLITE_MUTEX_STATIC_LRU);
+    pcache1.mutex = sqlite3MutexAlloc(SQLITE_MUTEX_STATIC_PMEM);
   }
 #endif
   if( pcache1.separateCache
    && sqlite3GlobalConfig.nPage!=0
    && sqlite3GlobalConfig.pPage==0

Index: src/rowset.c
==================================================================
--- src/rowset.c
+++ src/rowset.c
@@ -55,12 +55,13 @@
 ** batch number is O(NlogN) where N is the number of elements in the RowSet.
 ** The cost of a TEST using the same batch number is O(logN).  The cost
 ** of the first SMALLEST is O(NlogN).  Second and subsequent SMALLEST
 ** primitives are constant time.  The cost of DESTROY is O(N).
 **
-** There is an added cost of O(N) when switching between TEST and
-** SMALLEST primitives.
+** TEST and SMALLEST may not be used by the same RowSet.  This used to
+** be possible, but the feature was not used, so it was removed in order
+** to simplify the code.
 */
 #include "sqliteInt.h"
 
 
 /*
@@ -177,11 +178,13 @@
 ** In an OOM situation, the RowSet.db->mallocFailed flag is set and this
 ** routine returns NULL.
 */
 static struct RowSetEntry *rowSetEntryAlloc(RowSet *p){
   assert( p!=0 );
-  if( p->nFresh==0 ){
+  if( p->nFresh==0 ){  /*OPTIMIZATION-IF-FALSE*/
+    /* We could allocate a fresh RowSetEntry each time one is needed, but it
+    ** is more efficient to pull a preallocated entry from the pool */
     struct RowSetChunk *pNew;
     pNew = sqlite3DbMallocRawNN(p->db, sizeof(*pNew));
     if( pNew==0 ){
       return 0;
     }
@@ -211,11 +214,13 @@
   if( pEntry==0 ) return;
   pEntry->v = rowid;
   pEntry->pRight = 0;
   pLast = p->pLast;
   if( pLast ){
-    if( (p->rsFlags & ROWSET_SORTED)!=0 && rowid<=pLast->v ){
+    if( rowid<=pLast->v ){  /*OPTIMIZATION-IF-FALSE*/
+      /* Avoid unnecessary sorts by preserving the ROWSET_SORTED flags
+      ** where possible */
       p->rsFlags &= ~ROWSET_SORTED;
     }
     pLast->pRight = pEntry;
   }else{
     p->pEntry = pEntry;
@@ -333,27 +338,33 @@
   struct RowSetEntry **ppList,
   int iDepth
 ){
   struct RowSetEntry *p;         /* Root of the new tree */
   struct RowSetEntry *pLeft;     /* Left subtree */
-  if( *ppList==0 ){
-    return 0;
+  if( *ppList==0 ){ /*OPTIMIZATION-IF-TRUE*/
+    /* Prevent unnecessary deep recursion when we run out of entries */
+    return 0; 
   }
-  if( iDepth==1 ){
+  if( iDepth>1 ){   /*OPTIMIZATION-IF-TRUE*/
+    /* This branch causes a *balanced* tree to be generated.  A valid tree
+    ** is still generated without this branch, but the tree is wildly
+    ** unbalanced and inefficient. */
+    pLeft = rowSetNDeepTree(ppList, iDepth-1);
+    p = *ppList;
+    if( p==0 ){     /*OPTIMIZATION-IF-FALSE*/
+      /* It is safe to always return here, but the resulting tree
+      ** would be unbalanced */
+      return pLeft;
+    }
+    p->pLeft = pLeft;
+    *ppList = p->pRight;
+    p->pRight = rowSetNDeepTree(ppList, iDepth-1);
+  }else{
     p = *ppList;
     *ppList = p->pRight;
     p->pLeft = p->pRight = 0;
-    return p;
-  }
-  pLeft = rowSetNDeepTree(ppList, iDepth-1);
-  p = *ppList;
-  if( p==0 ){
-    return pLeft;
-  }
-  p->pLeft = pLeft;
-  *ppList = p->pRight;
-  p->pRight = rowSetNDeepTree(ppList, iDepth-1);
+  }
   return p;
 }
 
 /*
 ** Convert a sorted list of elements into a binary tree. Make the tree
@@ -376,63 +387,41 @@
     p->pRight = rowSetNDeepTree(&pList, iDepth);
   }
   return p;
 }
 
-/*
-** Take all the entries on p->pEntry and on the trees in p->pForest and
-** sort them all together into one big ordered list on p->pEntry.
-**
-** This routine should only be called once in the life of a RowSet.
-*/
-static void rowSetToList(RowSet *p){
-
-  /* This routine is called only once */
-  assert( p!=0 && (p->rsFlags & ROWSET_NEXT)==0 );
-
-  if( (p->rsFlags & ROWSET_SORTED)==0 ){
-    p->pEntry = rowSetEntrySort(p->pEntry);
-  }
-
-  /* While this module could theoretically support it, sqlite3RowSetNext()
-  ** is never called after sqlite3RowSetText() for the same RowSet.  So
-  ** there is never a forest to deal with.  Should this change, simply
-  ** remove the assert() and the #if 0. */
-  assert( p->pForest==0 );
-#if 0
-  while( p->pForest ){
-    struct RowSetEntry *pTree = p->pForest->pLeft;
-    if( pTree ){
-      struct RowSetEntry *pHead, *pTail;
-      rowSetTreeToList(pTree, &pHead, &pTail);
-      p->pEntry = rowSetEntryMerge(p->pEntry, pHead);
-    }
-    p->pForest = p->pForest->pRight;
-  }
-#endif
-  p->rsFlags |= ROWSET_NEXT;  /* Verify this routine is never called again */
-}
-
 /*
 ** Extract the smallest element from the RowSet.
 ** Write the element into *pRowid.  Return 1 on success.  Return
 ** 0 if the RowSet is already empty.
 **
 ** After this routine has been called, the sqlite3RowSetInsert()
-** routine may not be called again.  
+** routine may not be called again.
+**
+** This routine may not be called after sqlite3RowSetTest() has
+** been used.  Older versions of RowSet allowed that, but as the
+** capability was not used by the code generator, it was removed
+** for code economy.
 */
 int sqlite3RowSetNext(RowSet *p, i64 *pRowid){
   assert( p!=0 );
+  assert( p->pForest==0 );  /* Cannot be used with sqlite3RowSetText() */
 
   /* Merge the forest into a single sorted list on first call */
-  if( (p->rsFlags & ROWSET_NEXT)==0 ) rowSetToList(p);
+  if( (p->rsFlags & ROWSET_NEXT)==0 ){  /*OPTIMIZATION-IF-FALSE*/
+    if( (p->rsFlags & ROWSET_SORTED)==0 ){  /*OPTIMIZATION-IF-FALSE*/
+      p->pEntry = rowSetEntrySort(p->pEntry);
+    }
+    p->rsFlags |= ROWSET_SORTED|ROWSET_NEXT;
+  }
 
   /* Return the next entry on the list */
   if( p->pEntry ){
     *pRowid = p->pEntry->v;
     p->pEntry = p->pEntry->pRight;
-    if( p->pEntry==0 ){
+    if( p->pEntry==0 ){ /*OPTIMIZATION-IF-TRUE*/
+      /* Free memory immediately, rather than waiting on sqlite3_finalize() */
       sqlite3RowSetClear(p);
     }
     return 1;
   }else{
     return 0;
@@ -451,17 +440,19 @@
   struct RowSetEntry *p, *pTree;
 
   /* This routine is never called after sqlite3RowSetNext() */
   assert( pRowSet!=0 && (pRowSet->rsFlags & ROWSET_NEXT)==0 );
 
-  /* Sort entries into the forest on the first test of a new batch 
+  /* Sort entries into the forest on the first test of a new batch.
+  ** To save unnecessary work, only do this when the batch number changes.
   */
-  if( iBatch!=pRowSet->iBatch ){
+  if( iBatch!=pRowSet->iBatch ){  /*OPTIMIZATION-IF-FALSE*/
     p = pRowSet->pEntry;
     if( p ){
       struct RowSetEntry **ppPrevTree = &pRowSet->pForest;
-      if( (pRowSet->rsFlags & ROWSET_SORTED)==0 ){
+      if( (pRowSet->rsFlags & ROWSET_SORTED)==0 ){ /*OPTIMIZATION-IF-FALSE*/
+        /* Only sort the current set of entiries if they need it */
         p = rowSetEntrySort(p);
       }
       for(pTree = pRowSet->pForest; pTree; pTree=pTree->pRight){
         ppPrevTree = &pTree->pRight;
         if( pTree->pLeft==0 ){

Index: src/select.c
==================================================================
--- src/select.c
+++ src/select.c
@@ -3783,16 +3783,22 @@
   Expr *pWhere,         /* The WHERE clause of the outer query */
   int iCursor           /* Cursor number of the subquery */
 ){
   Expr *pNew;
   int nChng = 0;
+  Select *pX;           /* For looping over compound SELECTs in pSubq */
   if( pWhere==0 ) return 0;
-  if( (pSubq->selFlags & (SF_Aggregate|SF_Recursive))!=0 ){
-     return 0; /* restrictions (1) and (2) */
+  for(pX=pSubq; pX; pX=pX->pPrior){
+    if( (pX->selFlags & (SF_Aggregate|SF_Recursive))!=0 ){
+      testcase( pX->selFlags & SF_Aggregate );
+      testcase( pX->selFlags & SF_Recursive );
+      testcase( pX!=pSubq );
+      return 0; /* restrictions (1) and (2) */
+    }
   }
   if( pSubq->pLimit!=0 ){
-     return 0; /* restriction (3) */
+    return 0; /* restriction (3) */
   }
   while( pWhere->op==TK_AND ){
     nChng += pushDownWhereTerms(db, pSubq, pWhere->pRight, iCursor);
     pWhere = pWhere->pLeft;
   }
@@ -5090,10 +5096,17 @@
     pGroupBy = p->pGroupBy = sqlite3ExprListDup(db, pEList, 0);
     /* Notice that even thought SF_Distinct has been cleared from p->selFlags,
     ** the sDistinct.isTnct is still set.  Hence, isTnct represents the
     ** original setting of the SF_Distinct flag, not the current setting */
     assert( sDistinct.isTnct );
+
+#if SELECTTRACE_ENABLED
+    if( sqlite3SelectTrace & 0x400 ){
+      SELECTTRACE(0x400,pParse,p,("Transform DISTINCT into GROUP BY:\n"));
+      sqlite3TreeViewSelect(0, p, 0);
+    }
+#endif
   }
 
   /* If there is an ORDER BY clause, then create an ephemeral index to
   ** do the sorting.  But this sorting ephemeral index might end up
   ** being unused if the data can be extracted in pre-sorted order.

Index: src/shell.c
==================================================================
--- src/shell.c
+++ src/shell.c
@@ -1060,11 +1060,11 @@
       utf8_printf(p->out, "%s;\n", azArg[0]);
       break;
     }
     case MODE_Pretty: {  /* .schema and .fullschema with --indent */
       char *z;
-      int i,j;
+      int j;
       int nParen = 0;
       char cEnd = 0;
       char c;
       int nLine = 0;
       assert( nArg==1 );
@@ -1087,12 +1087,11 @@
         z[j++] = c;
       }
       while( j>0 && IsSpace(z[j-1]) ){ j--; }
       z[j] = 0;
       if( strlen30(z)>=79 ){
-        for(i=j=0; z[i]; i++){
-          char c = z[i];
+        for(i=j=0; (c = z[i])!=0; i++){
           if( c==cEnd ){
             cEnd = 0;
           }else if( c=='"' || c=='\'' || c=='`' ){
             cEnd = c;
           }else if( c=='[' ){
@@ -1732,11 +1731,11 @@
       for(i=p2op; i<iOp; i++) p->aiIndent[i] += 2;
     }
     if( str_in_array(zOp, azGoto) && p2op<p->nIndent
      && (abYield[p2op] || sqlite3_column_int(pSql, 2))
     ){
-      for(i=p2op+1; i<iOp; i++) p->aiIndent[i] += 2;
+      for(i=p2op; i<iOp; i++) p->aiIndent[i] += 2;
     }
   }
 
   p->iIndent = 0;
   sqlite3_free(abYield);
@@ -1750,10 +1749,108 @@
   sqlite3_free(p->aiIndent);
   p->aiIndent = 0;
   p->nIndent = 0;
   p->iIndent = 0;
 }
+
+/*
+** Disable and restore .wheretrace and .selecttrace settings.
+*/
+#if defined(SQLITE_DEBUG) && defined(SQLITE_ENABLE_SELECTTRACE)
+extern int sqlite3SelectTrace;
+static int savedSelectTrace;
+#endif
+#if defined(SQLITE_DEBUG) && defined(SQLITE_ENABLE_WHERETRACE)
+extern int sqlite3WhereTrace;
+static int savedWhereTrace;
+#endif
+static void disable_debug_trace_modes(void){
+#if defined(SQLITE_DEBUG) && defined(SQLITE_ENABLE_SELECTTRACE)
+  savedSelectTrace = sqlite3SelectTrace;
+  sqlite3SelectTrace = 0;
+#endif
+#if defined(SQLITE_DEBUG) && defined(SQLITE_ENABLE_WHERETRACE)
+  savedWhereTrace = sqlite3WhereTrace;
+  sqlite3WhereTrace = 0;
+#endif
+}
+static void restore_debug_trace_modes(void){
+#if defined(SQLITE_DEBUG) && defined(SQLITE_ENABLE_SELECTTRACE)
+  sqlite3SelectTrace = savedSelectTrace;
+#endif
+#if defined(SQLITE_DEBUG) && defined(SQLITE_ENABLE_WHERETRACE)
+  sqlite3WhereTrace = savedWhereTrace;
+#endif
+}
+
+/*
+** Run a prepared statement
+*/
+static void exec_prepared_stmt(
+  ShellState *pArg,                                /* Pointer to ShellState */
+  sqlite3_stmt *pStmt,                             /* Statment to run */
+  int (*xCallback)(void*,int,char**,char**,int*)   /* Callback function */
+){
+  int rc;
+
+  /* perform the first step.  this will tell us if we
+  ** have a result set or not and how wide it is.
+  */
+  rc = sqlite3_step(pStmt);
+  /* if we have a result set... */
+  if( SQLITE_ROW == rc ){
+    /* if we have a callback... */
+    if( xCallback ){
+      /* allocate space for col name ptr, value ptr, and type */
+      int nCol = sqlite3_column_count(pStmt);
+      void *pData = sqlite3_malloc64(3*nCol*sizeof(const char*) + 1);
+      if( !pData ){
+        rc = SQLITE_NOMEM;
+      }else{
+        char **azCols = (char **)pData;      /* Names of result columns */
+        char **azVals = &azCols[nCol];       /* Results */
+        int *aiTypes = (int *)&azVals[nCol]; /* Result types */
+        int i, x;
+        assert(sizeof(int) <= sizeof(char *));
+        /* save off ptrs to column names */
+        for(i=0; i<nCol; i++){
+          azCols[i] = (char *)sqlite3_column_name(pStmt, i);
+        }
+        do{
+          /* extract the data and data types */
+          for(i=0; i<nCol; i++){
+            aiTypes[i] = x = sqlite3_column_type(pStmt, i);
+            if( x==SQLITE_BLOB && pArg && pArg->cMode==MODE_Insert ){
+              azVals[i] = "";
+            }else{
+              azVals[i] = (char*)sqlite3_column_text(pStmt, i);
+            }
+            if( !azVals[i] && (aiTypes[i]!=SQLITE_NULL) ){
+              rc = SQLITE_NOMEM;
+              break; /* from for */
+            }
+          } /* end for */
+
+          /* if data and types extracted successfully... */
+          if( SQLITE_ROW == rc ){
+            /* call the supplied callback with the result row data */
+            if( xCallback(pArg, nCol, azVals, azCols, aiTypes) ){
+              rc = SQLITE_ABORT;
+            }else{
+              rc = sqlite3_step(pStmt);
+            }
+          }
+        } while( SQLITE_ROW == rc );
+        sqlite3_free(pData);
+      }
+    }else{
+      do{
+        rc = sqlite3_step(pStmt);
+      } while( rc == SQLITE_ROW );
+    }
+  }
+}
 
 /*
 ** Execute a statement or set of statements.  Print
 ** any result rows/columns depending on the current mode
 ** set via the supplied callback.
@@ -1778,10 +1875,11 @@
   if( pzErrMsg ){
     *pzErrMsg = NULL;
   }
 
   while( zSql[0] && (SQLITE_OK == rc) ){
+    static const char *zStmtSql;
     rc = sqlite3_prepare_v2(db, zSql, -1, &pStmt, &zLeftover);
     if( SQLITE_OK != rc ){
       if( pzErrMsg ){
         *pzErrMsg = save_err_msg(db);
       }
@@ -1790,28 +1888,30 @@
         /* this happens for a comment or white-space */
         zSql = zLeftover;
         while( IsSpace(zSql[0]) ) zSql++;
         continue;
       }
+      zStmtSql = sqlite3_sql(pStmt);
+      while( IsSpace(zStmtSql[0]) ) zStmtSql++;
 
       /* save off the prepared statment handle and reset row count */
       if( pArg ){
         pArg->pStmt = pStmt;
         pArg->cnt = 0;
       }
 
       /* echo the sql statement if echo on */
       if( pArg && pArg->echoOn ){
-        const char *zStmtSql = sqlite3_sql(pStmt);
         utf8_printf(pArg->out, "%s\n", zStmtSql ? zStmtSql : zSql);
       }
 
       /* Show the EXPLAIN QUERY PLAN if .eqp is on */
-      if( pArg && pArg->autoEQP ){
+      if( pArg && pArg->autoEQP && sqlite3_strlike("EXPLAIN%",zStmtSql,0)!=0 ){
         sqlite3_stmt *pExplain;
-        char *zEQP = sqlite3_mprintf("EXPLAIN QUERY PLAN %s",
-                                     sqlite3_sql(pStmt));
+        char *zEQP;
+        disable_debug_trace_modes();
+        zEQP = sqlite3_mprintf("EXPLAIN QUERY PLAN %s", zStmtSql);
         rc = sqlite3_prepare_v2(db, zEQP, -1, &pExplain, 0);
         if( rc==SQLITE_OK ){
           while( sqlite3_step(pExplain)==SQLITE_ROW ){
             raw_printf(pArg->out,"--EQP-- %d,",sqlite3_column_int(pExplain, 0));
             raw_printf(pArg->out,"%d,", sqlite3_column_int(pExplain, 1));
@@ -1819,17 +1919,31 @@
             utf8_printf(pArg->out,"%s\n", sqlite3_column_text(pExplain, 3));
           }
         }
         sqlite3_finalize(pExplain);
         sqlite3_free(zEQP);
+        if( pArg->autoEQP>=2 ){
+          /* Also do an EXPLAIN for ".eqp full" mode */
+          zEQP = sqlite3_mprintf("EXPLAIN %s", zStmtSql);
+          rc = sqlite3_prepare_v2(db, zEQP, -1, &pExplain, 0);
+          if( rc==SQLITE_OK ){
+            pArg->cMode = MODE_Explain;
+            explain_data_prepare(pArg, pExplain);
+            exec_prepared_stmt(pArg, pExplain, xCallback);
+            explain_data_delete(pArg);
+          }
+          sqlite3_finalize(pExplain);
+          sqlite3_free(zEQP);
+        }
+        restore_debug_trace_modes();
       }
 
       if( pArg ){
         pArg->cMode = pArg->mode;
         if( pArg->autoExplain
          && sqlite3_column_count(pStmt)==8
-         && sqlite3_strlike("%EXPLAIN%", sqlite3_sql(pStmt),0)==0
+         && sqlite3_strlike("EXPLAIN%", zStmtSql,0)==0
         ){
           pArg->cMode = MODE_Explain;
         }
 
         /* If the shell is currently in ".explain" mode, gather the extra
@@ -1837,67 +1951,11 @@
         if( pArg->cMode==MODE_Explain ){
           explain_data_prepare(pArg, pStmt);
         }
       }
 
-      /* perform the first step.  this will tell us if we
-      ** have a result set or not and how wide it is.
-      */
-      rc = sqlite3_step(pStmt);
-      /* if we have a result set... */
-      if( SQLITE_ROW == rc ){
-        /* if we have a callback... */
-        if( xCallback ){
-          /* allocate space for col name ptr, value ptr, and type */
-          int nCol = sqlite3_column_count(pStmt);
-          void *pData = sqlite3_malloc64(3*nCol*sizeof(const char*) + 1);
-          if( !pData ){
-            rc = SQLITE_NOMEM;
-          }else{
-            char **azCols = (char **)pData;      /* Names of result columns */
-            char **azVals = &azCols[nCol];       /* Results */
-            int *aiTypes = (int *)&azVals[nCol]; /* Result types */
-            int i, x;
-            assert(sizeof(int) <= sizeof(char *));
-            /* save off ptrs to column names */
-            for(i=0; i<nCol; i++){
-              azCols[i] = (char *)sqlite3_column_name(pStmt, i);
-            }
-            do{
-              /* extract the data and data types */
-              for(i=0; i<nCol; i++){
-                aiTypes[i] = x = sqlite3_column_type(pStmt, i);
-                if( x==SQLITE_BLOB && pArg && pArg->cMode==MODE_Insert ){
-                  azVals[i] = "";
-                }else{
-                  azVals[i] = (char*)sqlite3_column_text(pStmt, i);
-                }
-                if( !azVals[i] && (aiTypes[i]!=SQLITE_NULL) ){
-                  rc = SQLITE_NOMEM;
-                  break; /* from for */
-                }
-              } /* end for */
-
-              /* if data and types extracted successfully... */
-              if( SQLITE_ROW == rc ){
-                /* call the supplied callback with the result row data */
-                if( xCallback(pArg, nCol, azVals, azCols, aiTypes) ){
-                  rc = SQLITE_ABORT;
-                }else{
-                  rc = sqlite3_step(pStmt);
-                }
-              }
-            } while( SQLITE_ROW == rc );
-            sqlite3_free(pData);
-          }
-        }else{
-          do{
-            rc = sqlite3_step(pStmt);
-          } while( rc == SQLITE_ROW );
-        }
-      }
-
+      exec_prepared_stmt(pArg, pStmt, xCallback);
       explain_data_delete(pArg);
 
       /* print usage stats if stats on */
       if( pArg && pArg->statsOn ){
         display_stats(db, pArg, 0);
@@ -2083,11 +2141,11 @@
   ".dbinfo ?DB?           Show status information about the database\n"
   ".dump ?TABLE? ...      Dump the database in an SQL text format\n"
   "                         If TABLE specified, only dump tables matching\n"
   "                         LIKE pattern TABLE.\n"
   ".echo on|off           Turn command echo on or off\n"
-  ".eqp on|off            Enable or disable automatic EXPLAIN QUERY PLAN\n"
+  ".eqp on|off|full       Enable or disable automatic EXPLAIN QUERY PLAN\n"
   ".exit                  Exit this program\n"
   ".explain ?on|off|auto? Turn EXPLAIN output mode on or off or to automatic\n"
   ".fullschema ?--indent? Show schema and the content of sqlite_stat tables\n"
   ".headers on|off        Turn display of headers on or off\n"
   ".help                  Show this message\n"
@@ -3253,13 +3311,17 @@
     }
   }else
 
   if( c=='e' && strncmp(azArg[0], "eqp", n)==0 ){
     if( nArg==2 ){
-      p->autoEQP = booleanValue(azArg[1]);
+      if( strcmp(azArg[1],"full")==0 ){
+        p->autoEQP = 2;
+      }else{
+        p->autoEQP = booleanValue(azArg[1]);
+      }
     }else{
-      raw_printf(stderr, "Usage: .eqp on|off\n");
+      raw_printf(stderr, "Usage: .eqp on|off|full\n");
       rc = 1;
     }
   }else
 
   if( c=='e' && strncmp(azArg[0], "exit", n)==0 ){
@@ -4016,11 +4078,10 @@
     }
   }else
 
 #if defined(SQLITE_DEBUG) && defined(SQLITE_ENABLE_SELECTTRACE)
   if( c=='s' && n==11 && strncmp(azArg[0], "selecttrace", n)==0 ){
-    extern int sqlite3SelectTrace;
     sqlite3SelectTrace = integerValue(azArg[1]);
   }else
 #endif
 
 #if defined(SQLITE_ENABLE_SESSION)
@@ -4276,21 +4337,22 @@
     sqlite3_free(zCmd);
     if( x ) raw_printf(stderr, "System command returns %d\n", x);
   }else
 
   if( c=='s' && strncmp(azArg[0], "show", n)==0 ){
+    static const char *azBool[] = { "off", "on", "full", "unk" };
     int i;
     if( nArg!=1 ){
       raw_printf(stderr, "Usage: .show\n");
       rc = 1;
       goto meta_command_exit;
     }
-    utf8_printf(p->out, "%12.12s: %s\n","echo", p->echoOn ? "on" : "off");
-    utf8_printf(p->out, "%12.12s: %s\n","eqp", p->autoEQP ? "on" : "off");
+    utf8_printf(p->out, "%12.12s: %s\n","echo", azBool[p->echoOn!=0]);
+    utf8_printf(p->out, "%12.12s: %s\n","eqp", azBool[p->autoEQP&3]);
     utf8_printf(p->out, "%12.12s: %s\n","explain",
          p->mode==MODE_Explain ? "on" : p->autoExplain ? "auto" : "off");
-    utf8_printf(p->out,"%12.12s: %s\n","headers", p->showHeader ? "on" : "off");
+    utf8_printf(p->out,"%12.12s: %s\n","headers", azBool[p->showHeader!=0]);
     utf8_printf(p->out, "%12.12s: %s\n","mode", modeDescr[p->mode]);
     utf8_printf(p->out, "%12.12s: ", "nullvalue");
       output_c_string(p->out, p->nullValue);
       raw_printf(p->out, "\n");
     utf8_printf(p->out,"%12.12s: %s\n","output",
@@ -4299,11 +4361,11 @@
       output_c_string(p->out, p->colSeparator);
       raw_printf(p->out, "\n");
     utf8_printf(p->out,"%12.12s: ", "rowseparator");
       output_c_string(p->out, p->rowSeparator);
       raw_printf(p->out, "\n");
-    utf8_printf(p->out, "%12.12s: %s\n","stats", p->statsOn ? "on" : "off");
+    utf8_printf(p->out, "%12.12s: %s\n","stats", azBool[p->statsOn!=0]);
     utf8_printf(p->out, "%12.12s: ", "width");
     for (i=0;i<(int)ArraySize(p->colWidth) && p->colWidth[i] != 0;i++) {
       raw_printf(p->out, "%d ", p->colWidth[i]);
     }
     raw_printf(p->out, "\n");
@@ -4714,11 +4776,10 @@
     }
   }else
 
 #if defined(SQLITE_DEBUG) && defined(SQLITE_ENABLE_WHERETRACE)
   if( c=='w' && strncmp(azArg[0], "wheretrace", n)==0 ){
-    extern int sqlite3WhereTrace;
     sqlite3WhereTrace = nArg>=2 ? booleanValue(azArg[1]) : 0xff;
   }else
 #endif
 
   if( c=='w' && strncmp(azArg[0], "width", n)==0 ){
@@ -5382,10 +5443,12 @@
       data.showHeader = 0;
     }else if( strcmp(z,"-echo")==0 ){
       data.echoOn = 1;
     }else if( strcmp(z,"-eqp")==0 ){
       data.autoEQP = 1;
+    }else if( strcmp(z,"-eqpfull")==0 ){
+      data.autoEQP = 2;
     }else if( strcmp(z,"-stats")==0 ){
       data.statsOn = 1;
     }else if( strcmp(z,"-scanstats")==0 ){
       data.scanstatsOn = 1;
     }else if( strcmp(z,"-backslash")==0 ){

Index: src/sqlite.h.in
==================================================================
--- src/sqlite.h.in
+++ src/sqlite.h.in
@@ -1930,16 +1930,34 @@
 ** The second parameter is a pointer to an integer into which
 ** is written 0 or 1 to indicate whether fts3_tokenizer is disabled or enabled
 ** following this call.  The second parameter may be a NULL pointer, in
 ** which case the new setting is not reported back. </dd>
 **
+** <dt>SQLITE_DBCONFIG_ENABLE_LOAD_EXTENSION</dt>
+** <dd> ^This option is used to enable or disable the [sqlite3_load_extension()]
+** interface independently of the [load_extension()] SQL function.
+** The [sqlite3_enable_load_extension()] API enables or disables both the
+** C-API [sqlite3_load_extension()] and the SQL function [load_extension()].
+** There should be two additional arguments.
+** When the first argument to this interface is 1, then only the C-API is
+** enabled and the SQL function remains disabled.  If the first argment to
+** this interface is 0, then both the C-API and the SQL function are disabled.
+** If the first argument is -1, then no changes are made to state of either the
+** C-API or the SQL function.
+** The second parameter is a pointer to an integer into which
+** is written 0 or 1 to indicate whether [sqlite3_load_extension()] interface
+** is disabled or enabled following this call.  The second parameter may
+** be a NULL pointer, in which case the new setting is not reported back.
+** </dd>
+**
 ** </dl>
 */
 #define SQLITE_DBCONFIG_LOOKASIDE             1001 /* void* int int */
 #define SQLITE_DBCONFIG_ENABLE_FKEY           1002 /* int int* */
 #define SQLITE_DBCONFIG_ENABLE_TRIGGER        1003 /* int int* */
 #define SQLITE_DBCONFIG_ENABLE_FTS3_TOKENIZER 1004 /* int int* */
+#define SQLITE_DBCONFIG_ENABLE_LOAD_EXTENSION 1005 /* int int* */
 
 
 /*
 ** CAPI3REF: Enable Or Disable Extended Result Codes
 ** METHOD: sqlite3
@@ -5472,12 +5490,21 @@
 ** fill *pzErrMsg with error message text stored in memory
 ** obtained from [sqlite3_malloc()]. The calling function
 ** should free this memory by calling [sqlite3_free()].
 **
 ** ^Extension loading must be enabled using
-** [sqlite3_enable_load_extension()] prior to calling this API,
+** [sqlite3_enable_load_extension()] or
+** [sqlite3_db_config](db,[SQLITE_DBCONFIG_ENABLE_LOAD_EXTENSION],1,NULL)
+** prior to calling this API,
 ** otherwise an error will be returned.
+**
+** <b>Security warning:</b> It is recommended that the 
+** [SQLITE_DBCONFIG_ENABLE_LOAD_EXTENSION] method be used to enable only this
+** interface.  The use of the [sqlite3_enable_load_extension()] interface
+** should be avoided.  This will keep the SQL function [load_extension()]
+** disabled and prevent SQL injections from giving attackers
+** access to extension loading capabilities.
 **
 ** See also the [load_extension() SQL function].
 */
 int sqlite3_load_extension(
   sqlite3 *db,          /* Load the extension into this database connection */
@@ -5497,10 +5524,21 @@
 **
 ** ^Extension loading is off by default.
 ** ^Call the sqlite3_enable_load_extension() routine with onoff==1
 ** to turn extension loading on and call it with onoff==0 to turn
 ** it back off again.
+**
+** ^This interface enables or disables both the C-API
+** [sqlite3_load_extension()] and the SQL function [load_extension()].
+** Use [sqlite3_db_config](db,[SQLITE_DBCONFIG_ENABLE_LOAD_EXTENSION],..)
+** to enable or disable only the C-API.
+**
+** <b>Security warning:</b> It is recommended that extension loading
+** be disabled using the [SQLITE_DBCONFIG_ENABLE_LOAD_EXTENSION] method
+** rather than this interface, so the [load_extension()] SQL function
+** remains disabled. This will prevent SQL injections from giving attackers
+** access to extension loading capabilities.
 */
 int sqlite3_enable_load_extension(sqlite3 *db, int onoff);
 
 /*
 ** CAPI3REF: Automatically Load Statically Linked Extensions

Index: src/sqliteInt.h
==================================================================
--- src/sqliteInt.h
+++ src/sqliteInt.h
@@ -13,10 +13,37 @@
 **
 */
 #ifndef _SQLITEINT_H_
 #define _SQLITEINT_H_
 
+/* Special Comments:
+**
+** Some comments have special meaning to the tools that measure test
+** coverage:
+**
+**    NO_TEST                     - The branches on this line are not
+**                                  measured by branch coverage.  This is
+**                                  used on lines of code that actually
+**                                  implement parts of coverage testing.
+**
+**    OPTIMIZATION-IF-TRUE        - This branch is allowed to alway be false
+**                                  and the correct answer is still obtained,
+**                                  though perhaps more slowly.
+**
+**    OPTIMIZATION-IF-FALSE       - This branch is allowed to alway be true
+**                                  and the correct answer is still obtained,
+**                                  though perhaps more slowly.
+**
+**    PREVENTS-HARMLESS-OVERREAD  - This branch prevents a buffer overread
+**                                  that would be harmless and undetectable
+**                                  if it did occur.  
+**
+** In all cases, the special comment must be enclosed in the usual
+** slash-asterisk...asterisk-slash comment marks, with no spaces between the 
+** asterisks and the comment text.
+*/
+
 /*
 ** Make sure that rand_s() is available on Windows systems with MSVC 2005
 ** or higher.
 */
 #if defined(_MSC_VER) && _MSC_VER>=1400
@@ -1348,10 +1375,15 @@
 #define SCHEMA_ENC(db) ((db)->aDb[0].pSchema->enc)
 #define ENC(db)        ((db)->enc)
 
 /*
 ** Possible values for the sqlite3.flags.
+**
+** Value constraints (enforced via assert()):
+**      SQLITE_FullFSync     == PAGER_FULLFSYNC
+**      SQLITE_CkptFullFSync == PAGER_CKPT_FULLFSYNC
+**      SQLITE_CacheSpill    == PAGER_CACHE_SPILL
 */
 #define SQLITE_VdbeTrace      0x00000001  /* True to trace VDBE execution */
 #define SQLITE_InternChanges  0x00000002  /* Uncommitted Hash table changes */
 #define SQLITE_FullColNames   0x00000004  /* Show full column names on SELECT */
 #define SQLITE_FullFSync      0x00000008  /* Use full fsync on the backend */
@@ -1375,17 +1407,18 @@
 #define SQLITE_RecTriggers    0x00040000  /* Enable recursive triggers */
 #define SQLITE_ForeignKeys    0x00080000  /* Enforce foreign key constraints  */
 #define SQLITE_AutoIndex      0x00100000  /* Enable automatic indexes */
 #define SQLITE_PreferBuiltin  0x00200000  /* Preference to built-in funcs */
 #define SQLITE_LoadExtension  0x00400000  /* Enable load_extension */
-#define SQLITE_EnableTrigger  0x00800000  /* True to enable triggers */
-#define SQLITE_DeferFKs       0x01000000  /* Defer all FK constraints */
-#define SQLITE_QueryOnly      0x02000000  /* Disable database changes */
-#define SQLITE_VdbeEQP        0x04000000  /* Debug EXPLAIN QUERY PLAN */
-#define SQLITE_Vacuum         0x08000000  /* Currently in a VACUUM */
-#define SQLITE_CellSizeCk     0x10000000  /* Check btree cell sizes on load */
-#define SQLITE_Fts3Tokenizer  0x20000000  /* Enable fts3_tokenizer(2) */
+#define SQLITE_LoadExtFunc    0x00800000  /* Enable load_extension() SQL func */
+#define SQLITE_EnableTrigger  0x01000000  /* True to enable triggers */
+#define SQLITE_DeferFKs       0x02000000  /* Defer all FK constraints */
+#define SQLITE_QueryOnly      0x04000000  /* Disable database changes */
+#define SQLITE_VdbeEQP        0x08000000  /* Debug EXPLAIN QUERY PLAN */
+#define SQLITE_Vacuum         0x10000000  /* Currently in a VACUUM */
+#define SQLITE_CellSizeCk     0x20000000  /* Check btree cell sizes on load */
+#define SQLITE_Fts3Tokenizer  0x40000000  /* Enable fts3_tokenizer(2) */
 
 
 /*
 ** Bits of the sqlite3.dbOptFlags field that are used by the
 ** sqlite3_test_control(SQLITE_TESTCTRL_OPTIMIZATIONS,...) interface to
@@ -1482,10 +1515,17 @@
 /*
 ** Possible values for FuncDef.flags.  Note that the _LENGTH and _TYPEOF
 ** values must correspond to OPFLAG_LENGTHARG and OPFLAG_TYPEOFARG.  And
 ** SQLITE_FUNC_CONSTANT must be the same as SQLITE_DETERMINISTIC.  There
 ** are assert() statements in the code to verify this.
+**
+** Value constraints (enforced via assert()):
+**     SQLITE_FUNC_MINMAX    ==  NC_MinMaxAgg      == SF_MinMaxAgg
+**     SQLITE_FUNC_LENGTH    ==  OPFLAG_LENGTHARG
+**     SQLITE_FUNC_TYPEOF    ==  OPFLAG_TYPEOFARG
+**     SQLITE_FUNC_CONSTANT  ==  SQLITE_DETERMINISTIC from the API
+**     SQLITE_FUNC_ENCMASK   depends on SQLITE_UTF* macros in the API
 */
 #define SQLITE_FUNC_ENCMASK  0x0003 /* SQLITE_UTF8, SQLITE_UTF16BE or UTF16LE */
 #define SQLITE_FUNC_LIKE     0x0004 /* Candidate for the LIKE optimization */
 #define SQLITE_FUNC_CASE     0x0008 /* Case-sensitive LIKE-type function */
 #define SQLITE_FUNC_EPHEM    0x0010 /* Ephemeral.  Delete with VDBE */
@@ -2481,10 +2521,13 @@
 
 
 /*
 ** Flags appropriate for the wctrlFlags parameter of sqlite3WhereBegin()
 ** and the WhereInfo.wctrlFlags member.
+**
+** Value constraints (enforced via assert()):
+**     WHERE_USE_LIMIT  == SF_FixedLimit
 */
 #define WHERE_ORDERBY_NORMAL   0x0000 /* No-op */
 #define WHERE_ORDERBY_MIN      0x0001 /* ORDER BY processing for min() func */
 #define WHERE_ORDERBY_MAX      0x0002 /* ORDER BY processing for max() func */
 #define WHERE_ONEPASS_DESIRED  0x0004 /* Want to do one-pass UPDATE/DELETE */
@@ -2541,19 +2584,20 @@
 };
 
 /*
 ** Allowed values for the NameContext, ncFlags field.
 **
-** Note:  NC_MinMaxAgg must have the same value as SF_MinMaxAgg and
-** SQLITE_FUNC_MINMAX.
+** Value constraints (all checked via assert()):
+**    NC_HasAgg    == SF_HasAgg
+**    NC_MinMaxAgg == SF_MinMaxAgg == SQLITE_FUNC_MINMAX
 **
 */
 #define NC_AllowAgg  0x0001  /* Aggregate functions are allowed here */
-#define NC_HasAgg    0x0002  /* One or more aggregate functions seen */
+#define NC_PartIdx   0x0002  /* True if resolving a partial index WHERE */
 #define NC_IsCheck   0x0004  /* True if resolving names in a CHECK constraint */
 #define NC_InAggFunc 0x0008  /* True if analyzing arguments to an agg func */
-#define NC_PartIdx   0x0010  /* True if resolving a partial index WHERE */
+#define NC_HasAgg    0x0010  /* One or more aggregate functions seen */
 #define NC_IdxExpr   0x0020  /* True if resolving columns of CREATE INDEX */
 #define NC_MinMaxAgg 0x1000  /* min/max aggregates seen.  See note above */
 
 /*
 ** An instance of the following structure contains all information
@@ -2598,28 +2642,34 @@
 };
 
 /*
 ** Allowed values for Select.selFlags.  The "SF" prefix stands for
 ** "Select Flag".
+**
+** Value constraints (all checked via assert())
+**     SF_HasAgg     == NC_HasAgg
+**     SF_MinMaxAgg  == NC_MinMaxAgg     == SQLITE_FUNC_MINMAX
+**     SF_FixedLimit == WHERE_USE_LIMIT
 */
 #define SF_Distinct       0x00001  /* Output should be DISTINCT */
 #define SF_All            0x00002  /* Includes the ALL keyword */
 #define SF_Resolved       0x00004  /* Identifiers have been resolved */
-#define SF_Aggregate      0x00008  /* Contains aggregate functions */
-#define SF_UsesEphemeral  0x00010  /* Uses the OpenEphemeral opcode */
-#define SF_Expanded       0x00020  /* sqlite3SelectExpand() called on this */
-#define SF_HasTypeInfo    0x00040  /* FROM subqueries have Table metadata */
-#define SF_Compound       0x00080  /* Part of a compound query */
-#define SF_Values         0x00100  /* Synthesized from VALUES clause */
-#define SF_MultiValue     0x00200  /* Single VALUES term with multiple rows */
-#define SF_NestedFrom     0x00400  /* Part of a parenthesized FROM clause */
-#define SF_MaybeConvert   0x00800  /* Need convertCompoundSelectToSubquery() */
+#define SF_Aggregate      0x00008  /* Contains agg functions or a GROUP BY */
+#define SF_HasAgg         0x00010  /* Contains aggregate functions */
+#define SF_UsesEphemeral  0x00020  /* Uses the OpenEphemeral opcode */
+#define SF_Expanded       0x00040  /* sqlite3SelectExpand() called on this */
+#define SF_HasTypeInfo    0x00080  /* FROM subqueries have Table metadata */
+#define SF_Compound       0x00100  /* Part of a compound query */
+#define SF_Values         0x00200  /* Synthesized from VALUES clause */
+#define SF_MultiValue     0x00400  /* Single VALUES term with multiple rows */
+#define SF_NestedFrom     0x00800  /* Part of a parenthesized FROM clause */
 #define SF_MinMaxAgg      0x01000  /* Aggregate containing min() or max() */
 #define SF_Recursive      0x02000  /* The recursive part of a recursive CTE */
 #define SF_FixedLimit     0x04000  /* nSelectRow set by a constant LIMIT */
-#define SF_Converted      0x08000  /* By convertCompoundSelectToSubquery() */
-#define SF_IncludeHidden  0x10000  /* Include hidden columns in output */
+#define SF_MaybeConvert   0x08000  /* Need convertCompoundSelectToSubquery() */
+#define SF_Converted      0x10000  /* By convertCompoundSelectToSubquery() */
+#define SF_IncludeHidden  0x20000  /* Include hidden columns in output */
 
 
 /*
 ** The results of a SELECT can be distributed in several ways, as defined
 ** by one of the following macros.  The "SRT" prefix means "SELECT Result
@@ -2926,10 +2976,19 @@
   Parse *pParse;              /* The Parse structure */
 };
 
 /*
 ** Bitfield flags for P5 value in various opcodes.
+**
+** Value constraints (enforced via assert()):
+**    OPFLAG_LENGTHARG    == SQLITE_FUNC_LENGTH
+**    OPFLAG_TYPEOFARG    == SQLITE_FUNC_TYPEOF
+**    OPFLAG_BULKCSR      == BTREE_BULKLOAD
+**    OPFLAG_SEEKEQ       == BTREE_SEEK_EQ
+**    OPFLAG_FORDELETE    == BTREE_FORDELETE
+**    OPFLAG_SAVEPOSITION == BTREE_SAVEPOSITION
+**    OPFLAG_AUXDELETE    == BTREE_AUXDELETE
 */
 #define OPFLAG_NCHANGE       0x01    /* OP_Insert: Set to update db->nChange */
                                      /* Also used in P2 (not P5) of OP_Delete */
 #define OPFLAG_EPHEM         0x01    /* OP_Column: Ephemeral output is ok */
 #define OPFLAG_LASTROWID     0x02    /* Set to update db->lastRowid */

Index: src/test1.c
==================================================================
--- src/test1.c
+++ src/test1.c
@@ -1269,11 +1269,11 @@
     Tcl_AppendResult(interp, "wrong # args: should be \"", argv[0],
        " FORMAT INT INT INT\"", 0);
     return TCL_ERROR;
   }
   for(i=2; i<5; i++){
-    if( sqlite3Atoi64(argv[i], &a[i-2], 1000000, SQLITE_UTF8) ){
+    if( sqlite3Atoi64(argv[i], &a[i-2], sqlite3Strlen30(argv[i]), SQLITE_UTF8) ){
       Tcl_AppendResult(interp, "argument is not a valid 64-bit integer", 0);
       return TCL_ERROR;
     }
   }
   z = sqlite3_mprintf(argv[1], a[0], a[1], a[2]);
@@ -5211,21 +5211,23 @@
   return TCL_OK;
 }
 /*
 ** tclcmd:   vfs_reregister_all
 **
-** Restore all VFSes that were removed using vfs_unregister_all
+** Restore all VFSes that were removed using vfs_unregister_all. Taking
+** care to put the linked list back together in the same order as it was
+** in before vfs_unregister_all was invoked.
 */
 static int vfs_reregister_all(
   ClientData clientData, /* Pointer to sqlite3_enable_XXX function */
   Tcl_Interp *interp,    /* The TCL interpreter that invoked this command */
   int objc,              /* Number of arguments */
   Tcl_Obj *CONST objv[]  /* Command arguments */
 ){
   int i;
-  for(i=0; i<nVfs; i++){
-    sqlite3_vfs_register(apVfs[i], i==0);
+  for(i=nVfs-1; i>=0; i--){
+    sqlite3_vfs_register(apVfs[i], 1);
   }
   return TCL_OK;
 }
 
 
@@ -6986,10 +6988,11 @@
     int eVal;
   } aSetting[] = {
     { "FKEY",            SQLITE_DBCONFIG_ENABLE_FKEY },
     { "TRIGGER",         SQLITE_DBCONFIG_ENABLE_TRIGGER },
     { "FTS3_TOKENIZER",  SQLITE_DBCONFIG_ENABLE_FTS3_TOKENIZER },
+    { "LOAD_EXTENSION",  SQLITE_DBCONFIG_ENABLE_LOAD_EXTENSION },
   };
   int i;
   int v;
   const char *zSetting;
   sqlite3 *db;

Index: src/test6.c
==================================================================
--- src/test6.c
+++ src/test6.c
@@ -699,10 +699,14 @@
 }
 static int cfCurrentTime(sqlite3_vfs *pCfVfs, double *pTimeOut){
   sqlite3_vfs *pVfs = (sqlite3_vfs *)pCfVfs->pAppData;
   return pVfs->xCurrentTime(pVfs, pTimeOut);
 }
+static int cfGetLastError(sqlite3_vfs *pCfVfs, int n, char *z){
+  sqlite3_vfs *pVfs = (sqlite3_vfs *)pCfVfs->pAppData;
+  return pVfs->xGetLastError(pVfs, n, z);
+}
 
 static int processDevSymArgs(
   Tcl_Interp *interp,
   int objc,
   Tcl_Obj *CONST objv[],
@@ -825,11 +829,11 @@
     cfDlSym,              /* xDlSym */
     cfDlClose,            /* xDlClose */
     cfRandomness,         /* xRandomness */
     cfSleep,              /* xSleep */
     cfCurrentTime,        /* xCurrentTime */
-    0,                    /* xGetlastError */
+    cfGetLastError,       /* xGetLastError */
     0,                    /* xCurrentTimeInt64 */
   };
 
   if( objc!=2 ){
     Tcl_WrongNumArgs(interp, 1, objv, "ENABLE");
@@ -938,10 +942,31 @@
     return TCL_ERROR;
   }
   devsym_register(iDc, iSectorSize);
 
   return TCL_OK;
+
+}
+
+/*
+** tclcmd: unregister_devsim
+*/
+static int dsUnregisterObjCmd(
+  void * clientData,
+  Tcl_Interp *interp,
+  int objc,
+  Tcl_Obj *CONST objv[]
+){
+  void devsym_unregister(void);
+
+  if( objc!=1 ){
+    Tcl_WrongNumArgs(interp, 1, objv, "");
+    return TCL_ERROR;
+  }
+
+  devsym_unregister();
+  return TCL_OK;
 }
 
 /*
 ** tclcmd: register_jt_vfs ?-default? PARENT-VFS
 */
@@ -1008,12 +1033,13 @@
 int Sqlitetest6_Init(Tcl_Interp *interp){
 #ifndef SQLITE_OMIT_DISKIO
   Tcl_CreateObjCommand(interp, "sqlite3_crash_enable", crashEnableCmd, 0, 0);
   Tcl_CreateObjCommand(interp, "sqlite3_crashparams", crashParamsObjCmd, 0, 0);
   Tcl_CreateObjCommand(interp, "sqlite3_simulate_device", devSymObjCmd, 0, 0);
+  Tcl_CreateObjCommand(interp, "unregister_devsim", dsUnregisterObjCmd, 0, 0);
   Tcl_CreateObjCommand(interp, "register_jt_vfs", jtObjCmd, 0, 0);
   Tcl_CreateObjCommand(interp, "unregister_jt_vfs", jtUnregisterObjCmd, 0, 0);
 #endif
   return TCL_OK;
 }
 
 #endif /* SQLITE_TEST */

Index: src/test_devsym.c
==================================================================
--- src/test_devsym.c
+++ src/test_devsym.c
@@ -131,11 +131,12 @@
 /*
 ** Close an devsym-file.
 */
 static int devsymClose(sqlite3_file *pFile){
   devsym_file *p = (devsym_file *)pFile;
-  return sqlite3OsClose(p->pReal);
+  sqlite3OsClose(p->pReal);
+  return SQLITE_OK;
 }
 
 /*
 ** Read data from an devsym-file.
 */
@@ -392,7 +393,14 @@
     g.iSectorSize = iSectorSize;
   }else{
     g.iSectorSize = 512;
   }
 }
+
+void devsym_unregister(){
+  sqlite3_vfs_unregister(&devsym_vfs);
+  g.pVfs = 0;
+  g.iDeviceChar = 0;
+  g.iSectorSize = 0;
+}
 
 #endif

Index: src/test_journal.c
==================================================================
--- src/test_journal.c
+++ src/test_journal.c
@@ -158,10 +158,11 @@
 static void jtDlClose(sqlite3_vfs*, void*);
 static int jtRandomness(sqlite3_vfs*, int nByte, char *zOut);
 static int jtSleep(sqlite3_vfs*, int microseconds);
 static int jtCurrentTime(sqlite3_vfs*, double*);
 static int jtCurrentTimeInt64(sqlite3_vfs*, sqlite3_int64*);
+static int jtGetLastError(sqlite3_vfs*, int, char*);
 
 static sqlite3_vfs jt_vfs = {
   2,                             /* iVersion */
   sizeof(jt_file),               /* szOsFile */
   JT_MAX_PATHNAME,               /* mxPathname */
@@ -177,11 +178,11 @@
   jtDlSym,                       /* xDlSym */
   jtDlClose,                     /* xDlClose */
   jtRandomness,                  /* xRandomness */
   jtSleep,                       /* xSleep */
   jtCurrentTime,                 /* xCurrentTime */
-  0,                             /* xGetLastError */
+  jtGetLastError,                /* xGetLastError */
   jtCurrentTimeInt64             /* xCurrentTimeInt64 */
 };
 
 static sqlite3_io_methods jt_io_methods = {
   1,                             /* iVersion */
@@ -254,11 +255,12 @@
   if( p->zName ){
     for(pp=&g.pList; *pp!=p; pp=&(*pp)->pNext);
     *pp = p->pNext;
   }
   leaveJtMutex();
-  return sqlite3OsClose(p->pReal);
+  sqlite3OsClose(p->pReal);
+  return SQLITE_OK;
 }
 
 /*
 ** Read data from an jt-file.
 */
@@ -282,21 +284,22 @@
 **   a) SQLITE_OPEN_MAIN_DB was specified when the file was opened.
 **
 **   b) The file-name specified when the file was opened matches
 **      all but the final 8 characters of the journal file name.
 **
-**   c) There is currently a reserved lock on the file.
+**   c) There is currently a reserved lock on the file. This 
+**      condition is waived if the noLock argument is non-zero.
 **/
-static jt_file *locateDatabaseHandle(const char *zJournal){
+static jt_file *locateDatabaseHandle(const char *zJournal, int noLock){
   jt_file *pMain = 0;
   enterJtMutex();
   for(pMain=g.pList; pMain; pMain=pMain->pNext){
     int nName = (int)(strlen(zJournal) - strlen("-journal"));
     if( (pMain->flags&SQLITE_OPEN_MAIN_DB)
      && ((int)strlen(pMain->zName)==nName)
      && 0==memcmp(pMain->zName, zJournal, nName)
-     && (pMain->eLock>=SQLITE_LOCK_RESERVED)
+     && ((pMain->eLock>=SQLITE_LOCK_RESERVED) || noLock)
     ){
       break;
     }
   }
   leaveJtMutex();
@@ -514,11 +517,11 @@
 ){
   int rc;
   jt_file *p = (jt_file *)pFile;
   if( p->flags&SQLITE_OPEN_MAIN_JOURNAL ){
     if( iOfst==0 ){
-      jt_file *pMain = locateDatabaseHandle(p->zName);
+      jt_file *pMain = locateDatabaseHandle(p->zName, 0);
       assert( pMain );
   
       if( iAmt==28 ){
         /* Zeroing the first journal-file header. This is the end of a
         ** transaction. */
@@ -559,11 +562,11 @@
     }
   }
 
   rc = sqlite3OsWrite(p->pReal, zBuf, iAmt, iOfst);
   if( (p->flags&SQLITE_OPEN_MAIN_JOURNAL) && iAmt==12 ){
-    jt_file *pMain = locateDatabaseHandle(p->zName);
+    jt_file *pMain = locateDatabaseHandle(p->zName, 0);
     int rc2 = readJournalFile(p, pMain);
     if( rc==SQLITE_OK ) rc = rc2;
   }
   return rc;
 }
@@ -573,11 +576,11 @@
 */
 static int jtTruncate(sqlite3_file *pFile, sqlite_int64 size){
   jt_file *p = (jt_file *)pFile;
   if( p->flags&SQLITE_OPEN_MAIN_JOURNAL && size==0 ){
     /* Truncating a journal file. This is the end of a transaction. */
-    jt_file *pMain = locateDatabaseHandle(p->zName);
+    jt_file *pMain = locateDatabaseHandle(p->zName, 0);
     closeTransaction(pMain);
   }
   if( p->flags&SQLITE_OPEN_MAIN_DB && p->pWritable ){
     u32 pgno;
     u32 locking_page = (u32)(PENDING_BYTE/p->nPagesize+1);
@@ -601,15 +604,14 @@
     /* The journal file is being synced. At this point, we inspect the 
     ** contents of the file up to this point and set each bit in the 
     ** jt_file.pWritable bitvec of the main database file associated with
     ** this journal file.
     */
-    pMain = locateDatabaseHandle(p->zName);
-    assert(pMain);
+    pMain = locateDatabaseHandle(p->zName, 0);
 
     /* Set the bitvec values */
-    if( pMain->pWritable ){
+    if( pMain && pMain->pWritable ){
       pMain->nSync++;
       rc = readJournalFile(p, pMain);
       if( rc!=SQLITE_OK ){
         return rc;
       }
@@ -727,11 +729,11 @@
 */
 static int jtDelete(sqlite3_vfs *pVfs, const char *zPath, int dirSync){
   int nPath = (int)strlen(zPath);
   if( nPath>8 && 0==strcmp("-journal", &zPath[nPath-8]) ){
     /* Deleting a journal file. The end of a transaction. */
-    jt_file *pMain = locateDatabaseHandle(zPath);
+    jt_file *pMain = locateDatabaseHandle(zPath, 0);
     if( pMain ){
       closeTransaction(pMain);
     }
   }
 
@@ -821,10 +823,14 @@
 ** Return the current time as a Julian Day number in *pTimeOut.
 */
 static int jtCurrentTimeInt64(sqlite3_vfs *pVfs, sqlite3_int64 *pTimeOut){
   return g.pVfs->xCurrentTimeInt64(g.pVfs, pTimeOut);
 }
+
+static int jtGetLastError(sqlite3_vfs *pVfs, int n, char *z){
+  return g.pVfs->xGetLastError(g.pVfs, n, z);
+}
 
 /**************************************************************************
 ** Start of public API.
 */
 

Index: src/test_syscall.c
==================================================================
--- src/test_syscall.c
+++ src/test_syscall.c
@@ -106,14 +106,17 @@
 static int ts_fstat(int fd, struct stat *p);
 static int ts_ftruncate(int fd, off_t n);
 static int ts_fcntl(int fd, int cmd, ... );
 static int ts_read(int fd, void *aBuf, size_t nBuf);
 static int ts_pread(int fd, void *aBuf, size_t nBuf, off_t off);
-static int ts_pread64(int fd, void *aBuf, size_t nBuf, off_t off);
+/* Note:  pread64() and pwrite64() actually use off64_t as the type on their
+** last parameter.  But that datatype is not defined on many systems 
+** (ex: Mac, OpenBSD).  So substitute a likely equivalent: sqlite3_uint64 */
+static int ts_pread64(int fd, void *aBuf, size_t nBuf, sqlite3_uint64 off);
 static int ts_write(int fd, const void *aBuf, size_t nBuf);
 static int ts_pwrite(int fd, const void *aBuf, size_t nBuf, off_t off);
-static int ts_pwrite64(int fd, const void *aBuf, size_t nBuf, off_t off);
+static int ts_pwrite64(int fd, const void *aBuf, size_t nBuf, sqlite3_uint64 off);
 static int ts_fchmod(int fd, mode_t mode);
 static int ts_fallocate(int fd, off_t off, off_t len);
 static void *ts_mmap(void *, size_t, int, int, int, off_t);
 static void *ts_mremap(void*, size_t, size_t, int, ...);
 
@@ -153,15 +156,15 @@
 #define orig_fstat     ((int(*)(int,struct stat*))aSyscall[5].xOrig)
 #define orig_ftruncate ((int(*)(int,off_t))aSyscall[6].xOrig)
 #define orig_fcntl     ((int(*)(int,int,...))aSyscall[7].xOrig)
 #define orig_read      ((ssize_t(*)(int,void*,size_t))aSyscall[8].xOrig)
 #define orig_pread     ((ssize_t(*)(int,void*,size_t,off_t))aSyscall[9].xOrig)
-#define orig_pread64   ((ssize_t(*)(int,void*,size_t,off_t))aSyscall[10].xOrig)
+#define orig_pread64   ((ssize_t(*)(int,void*,size_t,sqlite3_uint64))aSyscall[10].xOrig)
 #define orig_write     ((ssize_t(*)(int,const void*,size_t))aSyscall[11].xOrig)
 #define orig_pwrite    ((ssize_t(*)(int,const void*,size_t,off_t))\
                        aSyscall[12].xOrig)
-#define orig_pwrite64  ((ssize_t(*)(int,const void*,size_t,off_t))\
+#define orig_pwrite64  ((ssize_t(*)(int,const void*,size_t,sqlite3_uint64))\
                        aSyscall[13].xOrig)
 #define orig_fchmod    ((int(*)(int,mode_t))aSyscall[14].xOrig)
 #define orig_fallocate ((int(*)(int,off_t,off_t))aSyscall[15].xOrig)
 #define orig_mmap      ((void*(*)(void*,size_t,int,int,int,off_t))aSyscall[16].xOrig)
 #define orig_mremap    ((void*(*)(void*,size_t,size_t,int,...))aSyscall[17].xOrig)
@@ -324,11 +327,11 @@
 }
 
 /*
 ** A wrapper around pread64().
 */
-static int ts_pread64(int fd, void *aBuf, size_t nBuf, off_t off){
+static int ts_pread64(int fd, void *aBuf, size_t nBuf, sqlite3_uint64 off){
   if( tsIsFailErrno("pread64") ){
     return -1;
   }
   return orig_pread64(fd, aBuf, nBuf, off);
 }
@@ -355,11 +358,11 @@
 }
 
 /*
 ** A wrapper around pwrite64().
 */
-static int ts_pwrite64(int fd, const void *aBuf, size_t nBuf, off_t off){
+static int ts_pwrite64(int fd, const void *aBuf, size_t nBuf, sqlite3_uint64 off){
   if( tsIsFailErrno("pwrite64") ){
     return -1;
   }
   return orig_pwrite64(fd, aBuf, nBuf, off);
 }
@@ -717,18 +720,24 @@
     { "pagesize",   test_syscall_pagesize },
     { 0, 0 }
   };
   int iCmd;
   int rc;
+  sqlite3_vfs *pVfs = sqlite3_vfs_find(0);
 
   if( objc<2 ){
     Tcl_WrongNumArgs(interp, 1, objv, "SUB-COMMAND ...");
     return TCL_ERROR;
   }
-  rc = Tcl_GetIndexFromObjStruct(interp, 
-      objv[1], aCmd, sizeof(aCmd[0]), "sub-command", 0, &iCmd
-  );
+  if( pVfs->iVersion<3 || pVfs->xSetSystemCall==0 ){
+    Tcl_AppendResult(interp, "VFS does not support xSetSystemCall", 0);
+    rc = TCL_ERROR;
+  }else{
+    rc = Tcl_GetIndexFromObjStruct(interp, 
+        objv[1], aCmd, sizeof(aCmd[0]), "sub-command", 0, &iCmd
+    );
+  }
   if( rc!=TCL_OK ) return rc;
   return aCmd[iCmd].xCmd(clientData, interp, objc, objv);
 }
 
 int SqlitetestSyscall_Init(Tcl_Interp *interp){

Index: src/test_vfs.c
==================================================================
--- src/test_vfs.c
+++ src/test_vfs.c
@@ -304,11 +304,10 @@
 
 /*
 ** Close an tvfs-file.
 */
 static int tvfsClose(sqlite3_file *pFile){
-  int rc;
   TestvfsFile *pTestfile = (TestvfsFile *)pFile;
   TestvfsFd *pFd = pTestfile->pFd;
   Testvfs *p = (Testvfs *)pFd->pVfs->pAppData;
 
   if( p->pScript && p->mask&TESTVFS_CLOSE_MASK ){
@@ -322,14 +321,14 @@
     pFd->pShmId = 0;
   }
   if( pFile->pMethods ){
     ckfree((char *)pFile->pMethods);
   }
-  rc = sqlite3OsClose(pFd->pReal);
+  sqlite3OsClose(pFd->pReal);
   ckfree((char *)pFd);
   pTestfile->pFd = 0;
-  return rc;
+  return SQLITE_OK;
 }
 
 /*
 ** Read data from an tvfs-file.
 */

Index: src/util.c
==================================================================
--- src/util.c
+++ src/util.c
@@ -353,11 +353,11 @@
   int esign = 1;   /* sign of exponent */
   int e = 0;       /* exponent */
   int eValid = 1;  /* True exponent is either not used or is well-formed */
   double result;
   int nDigits = 0;
-  int nonNum = 0;
+  int nonNum = 0;  /* True if input contains UTF16 with high byte non-zero */
 
   assert( enc==SQLITE_UTF8 || enc==SQLITE_UTF16LE || enc==SQLITE_UTF16BE );
   *pResult = 0.0;   /* Default return value, in case of an error */
 
   if( enc==SQLITE_UTF8 ){
@@ -366,11 +366,11 @@
     int i;
     incr = 2;
     assert( SQLITE_UTF16LE==2 && SQLITE_UTF16BE==3 );
     for(i=3-enc; i<length && z[i]==0; i+=2){}
     nonNum = i<length;
-    zEnd = z+i+enc-3;
+    zEnd = &z[i^1];
     z += (enc&1);
   }
 
   /* skip leading spaces */
   while( z<zEnd && sqlite3Isspace(*z) ) z+=incr;
@@ -382,13 +382,10 @@
     z+=incr;
   }else if( *z=='+' ){
     z+=incr;
   }
 
-  /* skip leading zeroes */
-  while( z<zEnd && z[0]=='0' ) z+=incr, nDigits++;
-
   /* copy max significant digits to significand */
   while( z<zEnd && sqlite3Isdigit(*z) && s<((LARGEST_INT64-9)/10) ){
     s = s*10 + (*z - '0');
     z+=incr, nDigits++;
   }
@@ -401,24 +398,30 @@
   /* if decimal point is present */
   if( *z=='.' ){
     z+=incr;
     /* copy digits from after decimal to significand
     ** (decrease exponent by d to shift decimal right) */
-    while( z<zEnd && sqlite3Isdigit(*z) && s<((LARGEST_INT64-9)/10) ){
-      s = s*10 + (*z - '0');
-      z+=incr, nDigits++, d--;
+    while( z<zEnd && sqlite3Isdigit(*z) ){
+      if( s<((LARGEST_INT64-9)/10) ){
+        s = s*10 + (*z - '0');
+        d--;
+      }
+      z+=incr, nDigits++;
     }
-    /* skip non-significant digits */
-    while( z<zEnd && sqlite3Isdigit(*z) ) z+=incr, nDigits++;
   }
   if( z>=zEnd ) goto do_atof_calc;
 
   /* if exponent is present */
   if( *z=='e' || *z=='E' ){
     z+=incr;
     eValid = 0;
-    if( z>=zEnd ) goto do_atof_calc;
+
+    /* This branch is needed to avoid a (harmless) buffer overread.  The 
+    ** special comment alerts the mutation tester that the correct answer
+    ** is obtained even if the branch is omitted */
+    if( z>=zEnd ) goto do_atof_calc;              /*PREVENTS-HARMLESS-OVERREAD*/
+
     /* get sign of exponent */
     if( *z=='-' ){
       esign = -1;
       z+=incr;
     }else if( *z=='+' ){
@@ -431,13 +434,11 @@
       eValid = 1;
     }
   }
 
   /* skip trailing spaces */
-  if( nDigits && eValid ){
-    while( z<zEnd && sqlite3Isspace(*z) ) z+=incr;
-  }
+  while( z<zEnd && sqlite3Isspace(*z) ) z+=incr;
 
 do_atof_calc:
   /* adjust exponent by d, and update sign */
   e = (e*esign) + d;
   if( e<0 ) {
@@ -445,45 +446,55 @@
     e *= -1;
   } else {
     esign = 1;
   }
 
-  /* if 0 significand */
-  if( !s ) {
-    /* In the IEEE 754 standard, zero is signed.
-    ** Add the sign if we've seen at least one digit */
-    result = (sign<0 && nDigits) ? -(double)0 : (double)0;
+  if( s==0 ) {
+    /* In the IEEE 754 standard, zero is signed. */
+    result = sign<0 ? -(double)0 : (double)0;
   } else {
-    /* attempt to reduce exponent */
-    if( esign>0 ){
-      while( s<(LARGEST_INT64/10) && e>0 ) e--,s*=10;
-    }else{
-      while( !(s%10) && e>0 ) e--,s/=10;
+    /* Attempt to reduce exponent.
+    **
+    ** Branches that are not required for the correct answer but which only
+    ** help to obtain the correct answer faster are marked with special
+    ** comments, as a hint to the mutation tester.
+    */
+    while( e>0 ){                                       /*OPTIMIZATION-IF-TRUE*/
+      if( esign>0 ){
+        if( s>=(LARGEST_INT64/10) ) break;             /*OPTIMIZATION-IF-FALSE*/
+        s *= 10;
+      }else{
+        if( s%10!=0 ) break;                           /*OPTIMIZATION-IF-FALSE*/
+        s /= 10;
+      }
+      e--;
     }
 
     /* adjust the sign of significand */
     s = sign<0 ? -s : s;
 
-    /* if exponent, scale significand as appropriate
-    ** and store in result. */
-    if( e ){
+    if( e==0 ){                                         /*OPTIMIZATION-IF-TRUE*/
+      result = (double)s;
+    }else{
       LONGDOUBLE_TYPE scale = 1.0;
       /* attempt to handle extremely small/large numbers better */
-      if( e>307 && e<342 ){
-        while( e%308 ) { scale *= 1.0e+1; e -= 1; }
-        if( esign<0 ){
-          result = s / scale;
-          result /= 1.0e+308;
-        }else{
-          result = s * scale;
-          result *= 1.0e+308;
-        }
-      }else if( e>=342 ){
-        if( esign<0 ){
-          result = 0.0*s;
-        }else{
-          result = 1e308*1e308*s;  /* Infinity */
+      if( e>307 ){                                      /*OPTIMIZATION-IF-TRUE*/
+        if( e<342 ){                                    /*OPTIMIZATION-IF-TRUE*/
+          while( e%308 ) { scale *= 1.0e+1; e -= 1; }
+          if( esign<0 ){
+            result = s / scale;
+            result /= 1.0e+308;
+          }else{
+            result = s * scale;
+            result *= 1.0e+308;
+          }
+        }else{ assert( e>=342 );
+          if( esign<0 ){
+            result = 0.0*s;
+          }else{
+            result = 1e308*1e308*s;  /* Infinity */
+          }
         }
       }else{
         /* 1.0e+22 is the largest power of 10 than can be 
         ** represented exactly. */
         while( e%22 ) { scale *= 1.0e+1; e -= 1; }
@@ -492,20 +503,18 @@
           result = s / scale;
         }else{
           result = s * scale;
         }
       }
-    } else {
-      result = (double)s;
     }
   }
 
   /* store the result */
   *pResult = result;
 
   /* return true if number and no extra non-whitespace chracters after */
-  return z>=zEnd && nDigits>0 && eValid && nonNum==0;
+  return z==zEnd && nDigits>0 && eValid && nonNum==0;
 #else
   return !sqlite3Atoi64(z, pResult, length, enc);
 #endif /* SQLITE_OMIT_FLOATING_POINT */
 }
 
@@ -563,11 +572,11 @@
   int incr;
   u64 u = 0;
   int neg = 0; /* assume positive */
   int i;
   int c = 0;
-  int nonNum = 0;
+  int nonNum = 0;  /* True if input contains UTF16 with high byte non-zero */
   const char *zStart;
   const char *zEnd = zNum + length;
   assert( enc==SQLITE_UTF8 || enc==SQLITE_UTF16LE || enc==SQLITE_UTF16BE );
   if( enc==SQLITE_UTF8 ){
     incr = 1;
@@ -574,11 +583,11 @@
   }else{
     incr = 2;
     assert( SQLITE_UTF16LE==2 && SQLITE_UTF16BE==3 );
     for(i=3-enc; i<length && zNum[i]==0; i+=2){}
     nonNum = i<length;
-    zEnd = zNum+i+enc-3;
+    zEnd = &zNum[i^1];
     zNum += (enc&1);
   }
   while( zNum<zEnd && sqlite3Isspace(*zNum) ) zNum+=incr;
   if( zNum<zEnd ){
     if( *zNum=='-' ){
@@ -601,12 +610,15 @@
     *pNum = (i64)u;
   }
   testcase( i==18 );
   testcase( i==19 );
   testcase( i==20 );
-  if( (c!=0 && &zNum[i]<zEnd) || (i==0 && zStart==zNum)
-       || i>19*incr || nonNum ){
+  if( &zNum[i]<zEnd              /* Extra bytes at the end */
+   || (i==0 && zStart==zNum)     /* No digits */
+   || i>19*incr                  /* Too many digits */
+   || nonNum                     /* UTF16 with high-order bytes non-zero */
+  ){
     /* zNum is empty or contains non-numeric text or is longer
     ** than 19 digits (thus guaranteeing that it is too large) */
     return 1;
   }else if( i<19*incr ){
     /* Less than 19 digits, so we know that it fits in 64 bits */
@@ -644,11 +656,10 @@
 */
 int sqlite3DecOrHexToI64(const char *z, i64 *pOut){
 #ifndef SQLITE_OMIT_HEX_INTEGER
   if( z[0]=='0'
    && (z[1]=='x' || z[1]=='X')
-   && sqlite3Isxdigit(z[2])
   ){
     u64 u = 0;
     int i, k;
     for(i=2; z[i]=='0'; i++){}
     for(k=i; sqlite3Isxdigit(z[k]); k++){
@@ -1406,11 +1417,11 @@
   LogEst y = 40;
   if( x<8 ){
     if( x<2 ) return 0;
     while( x<8 ){  y -= 10; x <<= 1; }
   }else{
-    while( x>255 ){ y += 40; x >>= 4; }
+    while( x>255 ){ y += 40; x >>= 4; }  /*OPTIMIZATION-IF-TRUE*/
     while( x>15 ){  y += 10; x >>= 1; }
   }
   return a[x&7] + y - 10;
 }
 

Index: src/vdbe.c
==================================================================
--- src/vdbe.c
+++ src/vdbe.c
@@ -213,11 +213,11 @@
   nByte = 
       ROUND8(sizeof(VdbeCursor)) + 2*sizeof(u32)*nField + 
       (eCurType==CURTYPE_BTREE?sqlite3BtreeCursorSize():0);
 
   assert( iCur>=0 && iCur<p->nCursor );
-  if( p->apCsr[iCur] ){
+  if( p->apCsr[iCur] ){ /*OPTIMIZATION-IF-FALSE*/
     sqlite3VdbeFreeCursor(p, p->apCsr[iCur]);
     p->apCsr[iCur] = 0;
   }
   if( SQLITE_OK==sqlite3VdbeMemClearAndResize(pMem, nByte) ){
     p->apCsr[iCur] = pCx = (VdbeCursor*)pMem->z;
@@ -290,24 +290,27 @@
   u8 enc              /* Use this text encoding */
 ){
   if( affinity>=SQLITE_AFF_NUMERIC ){
     assert( affinity==SQLITE_AFF_INTEGER || affinity==SQLITE_AFF_REAL
              || affinity==SQLITE_AFF_NUMERIC );
-    if( (pRec->flags & MEM_Int)==0 ){
+    if( (pRec->flags & MEM_Int)==0 ){ /*OPTIMIZATION-IF-FALSE*/
       if( (pRec->flags & MEM_Real)==0 ){
         if( pRec->flags & MEM_Str ) applyNumericAffinity(pRec,1);
       }else{
         sqlite3VdbeIntegerAffinity(pRec);
       }
     }
   }else if( affinity==SQLITE_AFF_TEXT ){
     /* Only attempt the conversion to TEXT if there is an integer or real
     ** representation (blob and NULL do not get converted) but no string
-    ** representation.
-    */
-    if( 0==(pRec->flags&MEM_Str) && (pRec->flags&(MEM_Real|MEM_Int)) ){
-      sqlite3VdbeMemStringify(pRec, enc, 1);
+    ** representation.  It would be harmless to repeat the conversion if 
+    ** there is already a string rep, but it is pointless to waste those
+    ** CPU cycles. */
+    if( 0==(pRec->flags&MEM_Str) ){ /*OPTIMIZATION-IF-FALSE*/
+      if( (pRec->flags&(MEM_Real|MEM_Int)) ){
+        sqlite3VdbeMemStringify(pRec, enc, 1);
+      }
     }
     pRec->flags &= ~(MEM_Real|MEM_Int);
   }
 }
 
@@ -540,11 +543,11 @@
   Mem *pOut;
   assert( pOp->p2>0 );
   assert( pOp->p2<=(p->nMem+1 - p->nCursor) );
   pOut = &p->aMem[pOp->p2];
   memAboutToChange(p, pOut);
-  if( VdbeMemDynamic(pOut) ){
+  if( VdbeMemDynamic(pOut) ){ /*OPTIMIZATION-IF-FALSE*/
     return out2PrereleaseWithClear(pOut);
   }else{
     pOut->flags = MEM_Int;
     return pOut;
   }

Index: src/vdbesort.c
==================================================================
--- src/vdbesort.c
+++ src/vdbesort.c
@@ -929,11 +929,10 @@
   int nField,                     /* Number of key fields in each record */
   VdbeCursor *pCsr                /* Cursor that holds the new sorter */
 ){
   int pgsz;                       /* Page size of main database */
   int i;                          /* Used to iterate through aTask[] */
-  int mxCache;                    /* Cache size */
   VdbeSorter *pSorter;            /* The new sorter */
   KeyInfo *pKeyInfo;              /* Copy of pCsr->pKeyInfo with db==0 */
   int szKeyInfo;                  /* Size of pCsr->pKeyInfo in bytes */
   int sz;                         /* Size of pSorter in bytes */
   int rc = SQLITE_OK;
@@ -986,15 +985,24 @@
       SortSubtask *pTask = &pSorter->aTask[i];
       pTask->pSorter = pSorter;
     }
 
     if( !sqlite3TempInMemory(db) ){
+      i64 mxCache;                /* Cache size in bytes*/
       u32 szPma = sqlite3GlobalConfig.szPma;
       pSorter->mnPmaSize = szPma * pgsz;
+
       mxCache = db->aDb[0].pSchema->cache_size;
-      if( mxCache<(int)szPma ) mxCache = (int)szPma;
-      pSorter->mxPmaSize = MIN((i64)mxCache*pgsz, SQLITE_MAX_PMASZ);
+      if( mxCache<0 ){
+        /* A negative cache-size value C indicates that the cache is abs(C)
+        ** KiB in size.  */
+        mxCache = mxCache * -1024;
+      }else{
+        mxCache = mxCache * pgsz;
+      }
+      mxCache = MIN(mxCache, SQLITE_MAX_PMASZ);
+      pSorter->mxPmaSize = MAX(pSorter->mnPmaSize, (int)mxCache);
 
       /* EVIDENCE-OF: R-26747-61719 When the application provides any amount of
       ** scratch memory using SQLITE_CONFIG_SCRATCH, SQLite avoids unnecessary
       ** large heap allocations.
       */

Index: src/where.c
==================================================================
--- src/where.c
+++ src/where.c
@@ -3879,13 +3879,13 @@
    && (pWInfo->wctrlFlags & WHERE_DISTINCTBY)==0
    && pWInfo->eDistinct==WHERE_DISTINCT_NOOP
    && nRowEst
   ){
     Bitmask notUsed;
-    int rc = wherePathSatisfiesOrderBy(pWInfo, pWInfo->pResultSet, pFrom,
+    int rc = wherePathSatisfiesOrderBy(pWInfo, pWInfo->pDistinctSet, pFrom,
                  WHERE_DISTINCTBY, nLoop-1, pFrom->aLoop[nLoop-1], &notUsed);
-    if( rc==pWInfo->pResultSet->nExpr ){
+    if( rc==pWInfo->pDistinctSet->nExpr ){
       pWInfo->eDistinct = WHERE_DISTINCT_ORDERED;
     }
   }
   if( pWInfo->pOrderBy ){
     if( pWInfo->wctrlFlags & WHERE_DISTINCTBY ){
@@ -4096,18 +4096,18 @@
 ** the first cursor in an array of cursors for all indices.  iIdxCur should
 ** be used to compute the appropriate cursor depending on which index is
 ** used.
 */
 WhereInfo *sqlite3WhereBegin(
-  Parse *pParse,        /* The parser context */
-  SrcList *pTabList,    /* FROM clause: A list of all tables to be scanned */
-  Expr *pWhere,         /* The WHERE clause */
-  ExprList *pOrderBy,   /* An ORDER BY (or GROUP BY) clause, or NULL */
-  ExprList *pResultSet, /* Result set of the query */
-  u16 wctrlFlags,       /* One of the WHERE_* flags defined in sqliteInt.h */
-  int iAuxArg           /* If WHERE_ONETABLE_ONLY is set, index cursor number,
-                        ** If WHERE_USE_LIMIT, then the limit amount */
+  Parse *pParse,          /* The parser context */
+  SrcList *pTabList,      /* FROM clause: A list of all tables to be scanned */
+  Expr *pWhere,           /* The WHERE clause */
+  ExprList *pOrderBy,     /* An ORDER BY (or GROUP BY) clause, or NULL */
+  ExprList *pDistinctSet, /* Try not to output two rows that duplicate these */
+  u16 wctrlFlags,         /* The WHERE_* flags defined in sqliteInt.h */
+  int iAuxArg             /* If WHERE_ONETABLE_ONLY is set, index cursor number
+                          ** If WHERE_USE_LIMIT, then the limit amount */
 ){
   int nByteWInfo;            /* Num. bytes allocated for WhereInfo struct */
   int nTabList;              /* Number of elements in pTabList */
   WhereInfo *pWInfo;         /* Will become the return value of this function */
   Vdbe *v = pParse->pVdbe;   /* The virtual database engine */
@@ -4178,11 +4178,11 @@
   pWInfo->aiCurOnePass[0] = pWInfo->aiCurOnePass[1] = -1;
   pWInfo->nLevel = nTabList;
   pWInfo->pParse = pParse;
   pWInfo->pTabList = pTabList;
   pWInfo->pOrderBy = pOrderBy;
-  pWInfo->pResultSet = pResultSet;
+  pWInfo->pDistinctSet = pDistinctSet;
   pWInfo->iBreak = pWInfo->iContinue = sqlite3VdbeMakeLabel(v);
   pWInfo->wctrlFlags = wctrlFlags;
   pWInfo->iLimit = iAuxArg;
   pWInfo->savedNQueryLoop = pParse->nQueryLoop;
   assert( pWInfo->eOnePass==ONEPASS_OFF );  /* ONEPASS defaults to OFF */
@@ -4251,17 +4251,17 @@
   /* Analyze all of the subexpressions. */
   sqlite3WhereExprAnalyze(pTabList, &pWInfo->sWC);
   if( db->mallocFailed ) goto whereBeginError;
 
   if( wctrlFlags & WHERE_WANT_DISTINCT ){
-    if( isDistinctRedundant(pParse, pTabList, &pWInfo->sWC, pResultSet) ){
+    if( isDistinctRedundant(pParse, pTabList, &pWInfo->sWC, pDistinctSet) ){
       /* The DISTINCT marking is pointless.  Ignore it. */
       pWInfo->eDistinct = WHERE_DISTINCT_UNIQUE;
     }else if( pOrderBy==0 ){
       /* Try to ORDER BY the result set to make distinct processing easier */
       pWInfo->wctrlFlags |= WHERE_DISTINCTBY;
-      pWInfo->pOrderBy = pResultSet;
+      pWInfo->pOrderBy = pDistinctSet;
     }
   }
 
   /* Construct the WhereLoop objects */
 #if defined(WHERETRACE_ENABLED)
@@ -4336,14 +4336,14 @@
     }
   }
 #endif
   /* Attempt to omit tables from the join that do not effect the result */
   if( pWInfo->nLevel>=2
-   && pResultSet!=0
+   && pDistinctSet!=0
    && OptimizationEnabled(db, SQLITE_OmitNoopJoin)
   ){
-    Bitmask tabUsed = sqlite3WhereExprListUsage(pMaskSet, pResultSet);
+    Bitmask tabUsed = sqlite3WhereExprListUsage(pMaskSet, pDistinctSet);
     if( sWLB.pOrderBy ){
       tabUsed |= sqlite3WhereExprListUsage(pMaskSet, sWLB.pOrderBy);
     }
     while( pWInfo->nLevel>=2 ){
       WhereTerm *pTerm, *pEnd;

Index: src/whereInt.h
==================================================================
--- src/whereInt.h
+++ src/whereInt.h
@@ -406,11 +406,11 @@
 */
 struct WhereInfo {
   Parse *pParse;            /* Parsing and code generating context */
   SrcList *pTabList;        /* List of tables in the join */
   ExprList *pOrderBy;       /* The ORDER BY clause or NULL */
-  ExprList *pResultSet;     /* Result set. DISTINCT operates on these */
+  ExprList *pDistinctSet;   /* DISTINCT over all these values */
   WhereLoop *pLoops;        /* List of all WhereLoop objects */
   Bitmask revMask;          /* Mask of ORDER BY terms that need reversing */
   LogEst nRowOut;           /* Estimated number of output rows */
   LogEst iLimit;            /* LIMIT if wctrlFlags has WHERE_USE_LIMIT */
   u16 wctrlFlags;           /* Flags originally passed to sqlite3WhereBegin() */
@@ -490,10 +490,18 @@
 /*
 ** Bitmasks for the operators on WhereTerm objects.  These are all
 ** operators that are of interest to the query planner.  An
 ** OR-ed combination of these values can be used when searching for
 ** particular WhereTerms within a WhereClause.
+**
+** Value constraints:
+**     WO_EQ    == SQLITE_INDEX_CONSTRAINT_EQ
+**     WO_LT    == SQLITE_INDEX_CONSTRAINT_LT
+**     WO_LE    == SQLITE_INDEX_CONSTRAINT_LE
+**     WO_GT    == SQLITE_INDEX_CONSTRAINT_GT
+**     WO_GE    == SQLITE_INDEX_CONSTRAINT_GE
+**     WO_MATCH == SQLITE_INDEX_CONSTRAINT_MATCH
 */
 #define WO_IN     0x0001
 #define WO_EQ     0x0002
 #define WO_LT     (WO_EQ<<(TK_LT-TK_EQ))
 #define WO_LE     (WO_EQ<<(TK_LE-TK_EQ))

Index: test/backup.test
==================================================================
--- test/backup.test
+++ test/backup.test
@@ -162,11 +162,11 @@
   sqlite3 db2 $zDestFile
   set db_dest db2
   set file_dest temp
 }] {
 foreach rows_dest {0 3 10} {
-foreach pgsz_dest {512 1024 2048} {
+foreach pgsz_dest {512 1024 2048 4096} {
 foreach nPagePerStep {1 200} {
 
   # Open the databases.
   catch { delete_file test.db }
   catch { delete_file test2.db }
@@ -174,21 +174,20 @@
 
   # Set to true if copying to an in-memory destination. Copying to an 
   # in-memory destination is only possible if the initial destination
   # page size is the same as the source page size (in this case 1024 bytes).
   #
-  set isMemDest [expr {
-    $zDestFile eq ":memory:" || $file_dest eq "temp" && $TEMP_STORE>=2
-  }]
-
-  if { $isMemDest==0 || $pgsz_dest == 1024 } {
-    if 0 {
-      puts -nonewline "Test $iTest: src=$zSrcFile dest=$zDestFile"
-      puts -nonewline " (as $db_dest.$file_dest)"
-      puts -nonewline " rows_dest=$rows_dest pgsz_dest=$pgsz_dest"
-      puts ""
-    }
+  set isMemDest [expr { $zDestFile eq ":memory:" || $file_dest eq "temp" }]
+
+  if 0 {
+    puts -nonewline "Test $iTest: src=$zSrcFile dest=$zDestFile"
+    puts -nonewline " (as $db_dest.$file_dest)"
+    puts -nonewline " rows_dest=$rows_dest pgsz_dest=$pgsz_dest"
+    puts ""
+  }
+
+  if { $isMemDest==0 || $pgsz_dest==1024 || $rows_dest==0 } {
 
     # Set up the content of the source database.
     execsql {
       PRAGMA page_size = 1024;
       BEGIN;

Index: test/dbstatus2.test
==================================================================
--- test/dbstatus2.test
+++ test/dbstatus2.test
@@ -84,11 +84,11 @@
 } {0 4 0}
 do_test 2.3 { db_write db 1 } {0 4 0}
 do_test 2.4 { db_write db 0 } {0 0 0}
 do_test 2.5 { db_write db 1 } {0 0 0}
 
-ifcapable wal {
+if {[wal_is_capable]} {
   do_test 2.6 { 
     execsql { PRAGMA journal_mode = WAL }
     db_write db 1
   } {0 1 0}
 }

Index: test/e_vacuum.test
==================================================================
--- test/e_vacuum.test
+++ test/e_vacuum.test
@@ -174,11 +174,11 @@
   } {2048 0}
   
   # EVIDENCE-OF: R-48521-51450 When in write-ahead log mode, only the
   # auto_vacuum support property can be changed using VACUUM.
   #
-  ifcapable wal {
+  if {[wal_is_capable]} {
     do_test e_vacuum-1.3.3.1 {
       execsql { PRAGMA journal_mode = wal }
       execsql { PRAGMA page_size ; PRAGMA auto_vacuum }
     } {2048 0}
     do_test e_vacuum-1.3.3.2 {

Index: test/exists.test
==================================================================
--- test/exists.test
+++ test/exists.test
@@ -17,10 +17,11 @@
 source $testdir/tester.tcl
 source $testdir/lock_common.tcl
 
 
 foreach jm {rollback wal} {
+  if {![wal_is_capable] && $jm=="wal"} continue
 
   set testprefix exists-$jm
 
   # This block of tests is targeted at CREATE XXX IF NOT EXISTS statements.
   #

Index: test/hook.test
==================================================================
--- test/hook.test
+++ test/hook.test
@@ -702,11 +702,11 @@
   INSERT INTO t8 VALUES('one', 'two');
   INSERT INTO t8 VALUES('three', 'four');
   ALTER TABLE t8 ADD COLUMN c DEFAULT 'xxx';
 }
 
-ifcapable !session {
+if 0 {
   # At time of writing, these two are broken. They demonstrate that the
   # sqlite3_preupdate_old() method does not handle the case where ALTER TABLE
   # has been used to add a column with a default value other than NULL.
   #
   do_preupdate_test 7.5.2.1 {

Index: test/incrvacuum2.test
==================================================================
--- test/incrvacuum2.test
+++ test/incrvacuum2.test
@@ -132,11 +132,11 @@
   }
 } {}
 
 integrity_check incrvacuum2-3.3
 
-ifcapable wal {
+if {[wal_is_capable]} {
   # At one point, when a specific page was being extracted from the b-tree
   # free-list (e.g. during an incremental-vacuum), all trunk pages that
   # occurred before the specific page in the free-list trunk were being
   # written to the journal or wal file. This is not necessary. Only the 
   # extracted page and the page that contains the pointer to it need to

Index: test/intpkey.test
==================================================================
--- test/intpkey.test
+++ test/intpkey.test
@@ -601,8 +601,19 @@
 do_test intpkey-15.7 {
   execsql {
     SELECT b FROM t1 WHERE a>12345678901;
   }
 } {}
+
+# 2016-04-18 ticket https://www.sqlite.org/src/tktview/7d7525cb01b68712495d3a
+# Be sure to escape quoted typenames.
+#
+do_execsql_test intpkey-16.0 {
+  CREATE TABLE t16a(id "INTEGER" PRIMARY KEY AUTOINCREMENT, b [TEXT], c `INT`);
+} {}
+do_execsql_test intpkey-16.1 {
+  PRAGMA table_info=t16a;
+} {0 id INTEGER 0 {} 1 1 b TEXT 0 {} 0 2 c INT 0 {} 0}
+
 
 
 finish_test

Index: test/journal2.test
==================================================================
--- test/journal2.test
+++ test/journal2.test
@@ -202,11 +202,11 @@
 # Test that it is possible to switch from journal_mode=truncate to
 # journal_mode=WAL on a SAFE_DELETE file-system. SQLite should close and
 # delete the journal file when committing the transaction that switches
 # the system to WAL mode.
 #
-ifcapable wal {
+if {[wal_is_capable]} {
   do_test journal2-2.1 {
     faultsim_delete_and_reopen
     set ::oplog [list]
     execsql { PRAGMA journal_mode = persist }
     set ::oplog

Index: test/loadext.test
==================================================================
--- test/loadext.test
+++ test/loadext.test
@@ -109,11 +109,11 @@
 
 # Test that a second database connection (db2) can load the extension also.
 #
 do_test loadext-1.3 {
   sqlite3 db2 test.db
-  sqlite3_enable_load_extension db2 1
+  sqlite3_db_config db2 SQLITE_DBCONFIG_ENABLE_LOAD_EXTENSION 1
   catchsql {
     SELECT half(1.0);
   } db2
 } {1 {no such function: half}}
 do_test loadext-1.4 {
@@ -254,12 +254,22 @@
   catchsql {
     SELECT load_extension($::testextension,'testloadext_init')
   }
 } {0 {{}}}
 
+# disable all extension loading
 do_test loadext-4.3 {
   sqlite3_enable_load_extension db 0
+  catchsql {
+    SELECT load_extension($::testextension,'testloadext_init')
+  }
+} {1 {not authorized}}
+
+# enable C-api extension loading only.  Show that the SQL function
+# still does not work.
+do_test loadext-4.4 {
+  sqlite3_db_config db SQLITE_DBCONFIG_ENABLE_LOAD_EXTENSION 1
   catchsql {
     SELECT load_extension($::testextension,'testloadext_init')
   }
 } {1 {not authorized}}
 

Index: test/pagerfault.test
==================================================================
--- test/pagerfault.test
+++ test/pagerfault.test
@@ -682,26 +682,28 @@
 # If TEMP_STORE is 2 or greater, then the database [db2] will be created
 # as an in-memory database. This test will not work in that case, as it
 # is not possible to change the page-size of an in-memory database. Even
 # using the backup API.
 #
-if {$TEMP_STORE<2} {
-  do_faultsim_test pagerfault-14b -prep {
-    catch { db2 close }
-    faultsim_restore_and_reopen
+# Update: It is no longer possible to change the page size of any temp
+# database after it has been created.
+#
+do_faultsim_test pagerfault-14b -prep {
+  catch { db2 close }
+  faultsim_restore_and_reopen
     sqlite3 db2 ""
     db2 eval { PRAGMA page_size = 4096; CREATE TABLE xx(a) }
-  } -body {
-    sqlite3_backup B db2 main db main
-    B step 200
-    set rc [B finish]
-    if {[string match SQLITE_IOERR_* $rc]} {set rc SQLITE_IOERR}
-    if {$rc != "SQLITE_OK"} { error [sqlite3_test_errstr $rc] }
-    set {} {}
-  } -test {
-    faultsim_test_result {0 {}} {1 {sqlite3_backup_init() failed}}
-  }
+} -body {
+  sqlite3_backup B db2 main db main
+  B step 200
+  set rc [B finish]
+  if {[string match SQLITE_IOERR_* $rc]} {set rc SQLITE_IOERR}
+  if {$rc != "SQLITE_OK"} { error [sqlite3_test_errstr $rc] }
+  set {} {}
+} -test {
+  faultsim_test_result {1 {attempt to write a readonly database}} \
+                       {1 {sqlite3_backup_init() failed}}
 }
 
 do_faultsim_test pagerfault-14c -prep {
   catch { db2 close }
   faultsim_restore_and_reopen

Index: test/permutations.test
==================================================================
--- test/permutations.test
+++ test/permutations.test
@@ -726,11 +726,11 @@
   # Exclude all tests that simulate IO errors.
   autovacuum_ioerr2.test cffault.test incrvacuum_ioerr.test ioerr.test
   ioerr.test ioerr2.test ioerr3.test ioerr4.test ioerr5.test
   vacuum3.test incrblob_err.test diskfull.test backup_ioerr.test
   e_fts3.test fts3cov.test fts3malloc.test fts3rnd.test
-  fts3snippet.test mmapfault.test
+  fts3snippet.test mmapfault.test sessionfault.test sessionfault2.test
 
   # Exclude test scripts that use tcl IO to access journal files or count
   # the number of fsync() calls.
   pager.test exclusive.test jrnlmode.test sync.test misc1.test 
   journal1.test conflict.test crash8.test tkt3457.test io.test
@@ -940,11 +940,13 @@
   register_jt_vfs -default ""
 } -shutdown {
   unregister_jt_vfs
 } -files [test_set $::allquicktests -exclude {
   wal* incrvacuum.test ioerr.test corrupt4.test io.test crash8.test 
-  async4.test bigfile.test backcompat.test
+  async4.test bigfile.test backcompat.test e_wal* fstat.test mmap2.test
+  pager1.test syscall.test tkt3457.test *malloc* mmap* multiplex* nolock*
+  pager2.test *fault* rowal* snapshot* superlock* symlink.test
 }]
 
 if {[info commands register_demovfs] != ""} {
   test_suite "demovfs" -description {
     Check that the demovfs (code in test_demovfs.c) more or less works.
@@ -1048,19 +1050,17 @@
   set ::G(perm:prefix)       $options(-prefix)
   set ::G(perm:presql)       $options(-presql)
   set ::G(isquick)           1
   set ::G(perm:dbconfig)     $options(-dbconfig)
 
-  uplevel $options(-initialize)
-
   foreach file [lsort $options(-files)] {
+    uplevel $options(-initialize)
     if {[file tail $file] == $file} { set file [file join $::testdir $file] }
     slave_test_file $file
+    uplevel $options(-shutdown)
   }
 
-  uplevel $options(-shutdown)
-
   unset ::G(perm:name)
   unset ::G(perm:prefix)
   unset ::G(perm:presql)
   unset ::G(perm:dbconfig)
 }

Index: test/pragma.test
==================================================================
--- test/pragma.test
+++ test/pragma.test
@@ -626,14 +626,14 @@
     set res
   } {0 main 1 temp 2 aux}
 }
 do_test pragma-6.2 {
   execsql {
-    CREATE TABLE t2(a,b,c);
+    CREATE TABLE t2(a TYPE_X, b [TYPE_Y], c "TYPE_Z");
     pragma table_info(t2)
   }
-} {0 a {} 0 {} 0 1 b {} 0 {} 0 2 c {} 0 {} 0}
+} {0 a TYPE_X 0 {} 0 1 b TYPE_Y 0 {} 0 2 c TYPE_Z 0 {} 0}
 do_test pragma-6.2.1 {
   execsql {
     pragma table_info;
   }
 } {}

Index: test/pragma3.test
==================================================================
--- test/pragma3.test
+++ test/pragma3.test
@@ -219,11 +219,11 @@
 # Make sure this also works in WAL mode
 #
 # This will not work with the in-memory journal permutation, as opening
 # [db2] switches the journal mode back to "memory"
 #
-ifcapable wal {
+if {[wal_is_capable]} {
 if {[permutation]!="inmemory_journal"} {
 
   sqlite3 db test.db
   db eval {PRAGMA journal_mode=WAL}
   sqlite3 db2 test.db

Index: test/quota.test
==================================================================
--- test/quota.test
+++ test/quota.test
@@ -525,6 +525,8 @@
 } -body {
   sqlite3_quota_set * 4096 {}
 }
 
 catch { sqlite3_quota_shutdown }
+catch { db close }
+forcedelete test.db
 finish_test

Index: test/select4.test
==================================================================
--- test/select4.test
+++ test/select4.test
@@ -966,9 +966,45 @@
     LEFT JOIN t1 AS t3
   WHERE t2.a=t3.a AND t2.m=t3.b
   ORDER BY t3.a;
 } {95 96 97 98 99}
 
+# Ticket https://www.sqlite.org/src/tktview/f7f8c97e975978d45  on 2016-04-25
+#
+# The where push-down optimization from 2015-06-02 is suppose to disable
+# on aggregate subqueries.  But if the subquery is a compound where the
+# last SELECT is non-aggregate but some other SELECT is an aggregate, the
+# test is incomplete and the optimization is not properly disabled.
+# 
+# The following test cases verify that the fix works.
+#
+do_execsql_test select4-17.1 {
+  DROP TABLE IF EXISTS t1;
+  CREATE TABLE t1(a int, b int);
+  INSERT INTO t1 VALUES(1,2),(1,18),(2,19);
+  SELECT x, y FROM (
+    SELECT 98 AS x, 99 AS y
+    UNION
+    SELECT a AS x, sum(b) AS y FROM t1 GROUP BY a
+  ) AS w WHERE y>=20
+  ORDER BY +x;
+} {1 20 98 99}
+do_execsql_test select4-17.2 {
+  SELECT x, y FROM (
+    SELECT a AS x, sum(b) AS y FROM t1 GROUP BY a
+    UNION
+    SELECT 98 AS x, 99 AS y
+  ) AS w WHERE y>=20
+  ORDER BY +x;
+} {1 20 98 99}
+do_catchsql_test select4-17.3 {
+  SELECT x, y FROM (
+    SELECT a AS x, sum(b) AS y FROM t1 GROUP BY a LIMIT 3
+    UNION
+    SELECT 98 AS x, 99 AS y
+  ) AS w WHERE y>=20
+  ORDER BY +x;
+} {1 {LIMIT clause should come after UNION not before}}
 
 
 
 finish_test

Index: test/sort5.test
==================================================================
--- test/sort5.test
+++ test/sort5.test
@@ -39,6 +39,78 @@
   CREATE INDEX i1 ON t1(b);
 }
 
 db close
 tvfs delete
+
+#-------------------------------------------------------------------------
+# Test that the PMA size is determined correctly. The PMA size should be
+# roughly the same amount of memory allocated to the main pager cache, or
+# 250 pages if this is larger.
+#
+testvfs tvfs
+tvfs script tv_callback
+tvfs filter {xOpen xWrite}
+
+proc tv_callback {method args} {
+  global iTemp
+  global F
+  switch $method {
+    xOpen {
+      if {[lindex $args 0]==""} { return "temp[incr iTemp]" }
+      return "SQLITE_OK"
+    }
+
+    xWrite {
+      foreach {filename id off amt} $args {}
+      if {[info exists F($id)]==0 || $F($id)<($off + $amt)} {
+        set F($id) [expr $off+$amt]
+      }
+    }
+  }
+}
+
+catch { db close }
+forcedelete test.db
+sqlite3 db test.db -vfs tvfs
+execsql { CREATE TABLE t1(x) }
+
+# Each iteration of the following loop attempts to sort 10001 records
+# each a bit over 100 bytes in size. In total a little more than 1MiB 
+# of data.
+#
+breakpoint
+foreach {tn pgsz cachesz bTemp} {
+  2 1024   1000  1
+
+  1 4096   1000  0
+  2 1024   1000  1
+
+  3 4096  -1000  1
+  4 1024  -1000  1
+
+  5 4096  -9000  0
+  6 1024  -9000  0
+} {
+  do_execsql_test 2.$tn.0 "
+    PRAGMA page_size = $pgsz;
+    VACUUM;
+    PRAGMA cache_size = $cachesz;
+  "
+
+  do_test 2.$tn.1 {
+    set ::iTemp 0
+    catch { array unset F }
+    execsql {
+      WITH x(i, j) AS (
+        SELECT 1, randomblob(100)
+        UNION ALL
+        SELECT i+1, randomblob(100) FROM x WHERE i<10000
+      )
+      SELECT * FROM x ORDER BY j;
+    }
+    expr {[array names F]!=""}
+  } $bTemp
+}
+
 finish_test
+

Index: test/stat.test
==================================================================
--- test/stat.test
+++ test/stat.test
@@ -35,11 +35,11 @@
   PRAGMA auto_vacuum = OFF;
   CREATE VIRTUAL TABLE temp.stat USING dbstat;
   SELECT * FROM stat;
 } {}
 
-ifcapable wal {
+if {[wal_is_capable]} {
   do_execsql_test stat-0.1 {
     PRAGMA journal_mode = WAL;
     PRAGMA journal_mode = delete;
     SELECT name, path, pageno, pagetype, ncell, payload, unused, mx_payload
       FROM stat;

Index: test/sync.test
==================================================================
--- test/sync.test
+++ test/sync.test
@@ -79,10 +79,11 @@
   }
   cond_incr_sync_count 4
   set sqlite_sync_count
 } 11
 ifcapable pager_pragmas {
+if {[permutation]!="journaltest"} {
   do_test sync-1.4 {
     set sqlite_sync_count 0
     execsql {
       PRAGMA main.synchronous=off;
       PRAGMA db2.synchronous=off;
@@ -91,9 +92,10 @@
       INSERT INTO t2 VALUES(7,8);
       COMMIT;
     }
     set sqlite_sync_count
   } 0
+}
 }
 
 
 finish_test

Index: test/tempfault.test
==================================================================
--- test/tempfault.test
+++ test/tempfault.test
@@ -16,13 +16,13 @@
 set testdir [file dirname $argv0]
 source $testdir/tester.tcl
 source $testdir/malloc_common.tcl
 set testprefix tempfault
 
-sqlite3_memdebug_vfs_oom_test 0
+# sqlite3_memdebug_vfs_oom_test 0
 
-do_faultsim_test 1 -faults oom* -prep {
+do_faultsim_test 1 -faults * -prep {
   sqlite3 db ""
   db eval {
     PRAGMA page_size = 1024;
     CREATE TABLE t1(a, b);
     INSERT INTO t1 VALUES(1, 2);
@@ -40,28 +40,48 @@
     error "data mismatch 2: $msg"
   }
   faultsim_integrity_check
 }
 
-do_faultsim_test 2 -faults oom* -prep {
+do_faultsim_test 2 -faults * -prep {
   sqlite3 db ""
   db eval {
     PRAGMA page_size = 1024;
     PRAGMA cache_size = 10;
     CREATE TABLE t1(a, b);
     CREATE INDEX i1 ON t1(b, a);
-    WITH x(i) AS (SELECT 1 UNION ALL SELECT i+1 FROM x WHERE i<50)
+    WITH x(i) AS (SELECT 1 UNION ALL SELECT i+1 FROM x WHERE i<100)
     INSERT INTO t1 SELECT randomblob(100), randomblob(100) FROM x;
   }
 } -body {
   execsql { UPDATE t1 SET a = randomblob(99) }
 } -test {
   faultsim_test_result {0 {}}
   faultsim_integrity_check db
 }
 
-do_faultsim_test 3 -faults oom* -prep {
+catch { db close }
+do_faultsim_test 2.1 -faults * -prep {
+  if {[info commands db]==""} {
+    sqlite3 db ""
+    execsql {
+      PRAGMA page_size = 1024;
+      PRAGMA cache_size = 10;
+      CREATE TABLE t1(a, b);
+      CREATE INDEX i1 ON t1(b, a);
+      WITH x(i) AS (SELECT 1 UNION ALL SELECT i+1 FROM x WHERE i<100)
+          INSERT INTO t1 SELECT randomblob(100), randomblob(100) FROM x;
+    }
+  } 
+} -body {
+  execsql { UPDATE t1 SET a = randomblob(99) }
+} -test {
+  faultsim_test_result {0 {}}
+  faultsim_integrity_check db
+}
+
+do_faultsim_test 3 -faults * -prep {
   sqlite3 db ""
   db eval {
     PRAGMA page_size = 1024;
     PRAGMA cache_size = 10;
     CREATE TABLE t1(a, b);

Index: test/temptable2.test
==================================================================
--- test/temptable2.test
+++ test/temptable2.test
@@ -137,13 +137,15 @@
   CREATE TEMP TABLE t1(a, b);
   CREATE INDEX i1 ON t1(a, b);
   INSERT INTO t1 VALUES(1, 2);
 }
 
+# Test that the temp database is now much bigger than the configured
+# cache size (10 pages).
 do_test 5.1.2 {
   set n [db one { PRAGMA temp.page_count }]
-  expr ($n > 280 && $n < 290)
+  expr ($n > 270 && $n < 290)
 } {1}
 
 do_execsql_test 5.1.3 {
   BEGIN;
     UPDATE t1 SET a=2;
@@ -222,10 +224,11 @@
 # Try changing the page size using a backup operation when pages are
 # stored in main-memory only.
 #
 reset_db
 do_execsql_test 8.1 {
+  PRAGMA auto_vacuum = OFF;
   CREATE TABLE t2(a, b);
   CREATE INDEX i2 ON t2(a, b);
   WITH x(i) AS ( SELECT 1 UNION ALL SELECT i+1 FROM x WHERE i<20 )
   INSERT INTO t2 SELECT randomblob(100), randomblob(100) FROM x;
   PRAGMA page_count;
@@ -232,10 +235,11 @@
 } {13}
 
 do_test 8.2 {
   sqlite3 tmp ""
   execsql {
+    PRAGMA auto_vacuum = OFF;
     PRAGMA page_size = 8192;
     CREATE TABLE t1(a, b);
     CREATE INDEX i1 ON t1(a, b);
     WITH x(i) AS ( SELECT 1 UNION ALL SELECT i+1 FROM x WHERE i<100 )
     INSERT INTO t1 SELECT randomblob(100), randomblob(100) FROM x;
@@ -280,13 +284,13 @@
   sqlite3 db ""
   do_execsql_test 9.$tn.1.1 {
     PRAGMA cache_size = 15;
     PRAGMA auto_vacuum = 1;
   }
-  do_execsql_test 9.$tn.1.2 "PRAGMA journal_mode = $mode" delete
+  execsql "PRAGMA journal_mode = $mode"
 
-  do_execsql_test 9.$tn.1.3 {
+  do_execsql_test 9.$tn.1.2 {
     CREATE TABLE tx(a, b);
     CREATE INDEX i1 ON tx(a);
     CREATE INDEX i2 ON tx(b);
     WITH x(i) AS ( SELECT 1 UNION ALL SELECT i+1 FROM x WHERE i<1000 )
       INSERT INTO tx SELECT randomblob(100), randomblob(100) FROM x;
@@ -313,8 +317,40 @@
     }
 
     do_execsql_test 9.$tn.$i.6 { PRAGMA integrity_check } ok
   }
 }
+
+#-------------------------------------------------------------------------
+# When using mmap mode with a temp file, SQLite must search the cache 
+# before using a mapped page even when there is no write transaction
+# open. For a temp file, the on-disk version may not be up to date.
+#
+sqlite3 db ""
+do_execsql_test 10.0 {
+  PRAGMA cache_size = 50;
+  PRAGMA page_size = 1024;
+  CREATE TABLE t1(a, b, PRIMARY KEY(a)) WITHOUT ROWID;
+  CREATE INDEX i1 ON t1(a);
+  CREATE TABLE t2(x, y);
+  INSERT INTO t2 VALUES(1, 2);
+}
+
+do_execsql_test 10.1 {
+  BEGIN;
+    WITH x(i) AS ( SELECT 1 UNION ALL SELECT i+1 FROM x WHERE i<500 )
+      INSERT INTO t1 SELECT randomblob(100), randomblob(100) FROM x;
+  COMMIT;
+  INSERT INTO t2 VALUES(3, 4);
+}
+
+if {[permutation]!="journaltest"} {
+  # The journaltest permutation does not support mmap, so this part of
+  # the test is omitted.
+  do_execsql_test 10.2 { PRAGMA mmap_size = 512000 } 512000
+}
+
+do_execsql_test 10.3 { SELECT * FROM t2 } {1 2 3 4}
+do_execsql_test 10.4 { PRAGMA integrity_check } ok
 
 finish_test
 

Index: test/tester.tcl
==================================================================
--- test/tester.tcl
+++ test/tester.tcl
@@ -1941,10 +1941,16 @@
   if { [wal_is_wal_mode] } {
     $db eval { SELECT * FROM sqlite_master }
     do_test $testname [list $db eval "PRAGMA main.journal_mode"] {wal}
   }
 }
+
+proc wal_is_capable {} {
+  ifcapable !wal { return 0 }
+  if {[permutation]=="journaltest"} { return 0 }
+  return 1
+}
 
 proc permutation {} {
   set perm ""
   catch {set perm $::G(perm:name)}
   set perm

Index: test/tkt-2d1a5c67d.test
==================================================================
--- test/tkt-2d1a5c67d.test
+++ test/tkt-2d1a5c67d.test
@@ -17,11 +17,12 @@
 
 set testdir [file dirname $argv0]
 source $testdir/tester.tcl
 set testprefix tkt-2d1a5c67d
 
-ifcapable {!wal || !vtab} {finish_test; return}
+ifcapable {!vtab} {finish_test; return}
+if {[wal_is_capable]==0} {finish_test; return}
 
 for {set ii 1} {$ii<=10} {incr ii} {
   do_test tkt-2d1a5c67d.1.$ii {
     db close
     forcedelete test.db test.db-wal

Index: test/tkt-313723c356.test
==================================================================
--- test/tkt-313723c356.test
+++ test/tkt-313723c356.test
@@ -16,11 +16,11 @@
 
 set testdir [file dirname $argv0]
 source $testdir/tester.tcl
 source $testdir/malloc_common.tcl
 
-ifcapable !wal { finish_test ; return }
+if {![wal_is_capable]} { finish_test ; return }
 
 do_execsql_test tkt-313723c356.1 {
   PRAGMA page_size = 1024;
   PRAGMA journal_mode = WAL;
   CREATE TABLE t1(a, b);

Index: test/tkt-5d863f876e.test
==================================================================
--- test/tkt-5d863f876e.test
+++ test/tkt-5d863f876e.test
@@ -16,11 +16,11 @@
 
 set testdir [file dirname $argv0]
 source $testdir/tester.tcl
 source $testdir/lock_common.tcl
 set ::testprefix tkt-5d863f876e
-ifcapable !wal {finish_test ; return }
+if {![wal_is_capable]} {finish_test ; return }
 
 do_multiclient_test tn {
   do_test $tn.1 {
     sql1 {
       CREATE TABLE t1(a, b);

Index: test/tkt-9d68c883.test
==================================================================
--- test/tkt-9d68c883.test
+++ test/tkt-9d68c883.test
@@ -48,6 +48,8 @@
     catchsql { ROLLBACK }
     execsql { PRAGMA integrity_check }
   } {ok}
 }
 
+catch { db close } 
+unregister_devsim
 finish_test

Index: test/zerodamage.test
==================================================================
--- test/zerodamage.test
+++ test/zerodamage.test
@@ -87,11 +87,11 @@
     UPDATE t1 SET y=randomblob(50) WHERE x=124;
   }
   concat [file_control_powersafe_overwrite db -1] [set ::max_journal_size]
 } {0 0 24704}
 
-ifcapable wal {
+if {[wal_is_capable]} {
   # Run a WAL-mode transaction with POWERSAFE_OVERWRITE on to verify that the
   # WAL file does not get too big.
   #
   do_test zerodamage-3.0 {
     db eval {

Index: tool/lemon.c
==================================================================
--- tool/lemon.c
+++ tool/lemon.c
@@ -4400,11 +4400,12 @@
     if( rp->code[0]=='\n' && rp->code[1]==0 ) continue; /* Will be default: */
     fprintf(out,"      case %d: /* ", rp->iRule);
     writeRuleText(out, rp);
     fprintf(out, " */\n"); lineno++;
     for(rp2=rp->next; rp2; rp2=rp2->next){
-      if( rp2->code==rp->code ){
+      if( rp2->code==rp->code && rp2->codePrefix==rp->codePrefix
+             && rp2->codeSuffix==rp->codeSuffix ){
         fprintf(out,"      case %d: /* ", rp2->iRule);
         writeRuleText(out, rp2);
         fprintf(out," */ yytestcase(yyruleno==%d);\n", rp2->iRule); lineno++;
         rp2->code = 0;
       }