Fix a faulty assert() in the "AS" alias resolution logic of the parser.

FossilOrigin-Name: b5e43602833249aa4b73337bf85b7f308450dab6

manifest

@@ -1,5 +1,5 @@
-C Improvement\sto\s"ID"\sformatting\son\sthe\s".selecttrace\s0x1ff"\sdebugging\sfunction.
-D 2015-04-23T13:00:42.419
+C Fix\sa\sfaulty\sassert()\sin\sthe\s"AS"\salias\sresolution\slogic\sof\sthe\sparser.
+D 2015-04-23T13:37:05.307
 F Makefile.arm-wince-mingw32ce-gcc d6df77f1f48d690bd73162294bbba7f59507c72f
 F Makefile.in faaf75b89840659d74501bea269c7e33414761c1
 F Makefile.linux-gcc 91d710bdc4998cb015f39edf3cb314ec4f4d7e23
@@ -228,7 +228,7 @@ F src/pragma.h 09c89bca58e9a44de2116cc8272b8d454657129f
 F src/prepare.c 1fffbdcd6f8a0173a8f70d71f22528f4c0e1e3d3
 F src/printf.c 08fa675c200aac29e561c6153f91f909ed17612f
 F src/random.c ba2679f80ec82c4190062d756f22d0c358180696
-F src/resolve.c 53486a98c17b7ae09b8c2b398013e973ce4c1aae
+F src/resolve.c 13109bc3b5ab404446296efa17039640de5bc35d
 F src/rowset.c eccf6af6d620aaa4579bd3b72c1b6395d9e9fa1e
 F src/select.c 35433ea8894ac42594ddc31eb0165a6d6401cfe5
 F src/shell.c 78eabce4c16c45e36fea2368f95118116399ba8a
@@ -814,7 +814,7 @@ F test/rdonly.test 64e2696c322e3538df0b1ed624e21f9a23ed9ff8
 F test/regexp1.test 497ea812f264d12b6198d6e50a76be4a1973a9d8
 F test/reindex.test 44edd3966b474468b823d481eafef0c305022254
 F test/releasetest.tcl a37cd82092c8be438255d65804b5951d6e3ecdae
-F test/resolver01.test 33abf37ff8335e6bf98f2b45a0af3e06996ccd9a
+F test/resolver01.test f4022acafda7f4d40eca94dbf16bc5fc4ac30ceb
 F test/rollback.test 458fe73eb3ffdfdf9f6ba3e9b7350a6220414dea
 F test/rollback2.test fc14cf6d1a2b250d2735ef16124b971bce152f14
 F test/rollbackfault.test 6a004f71087cc399296cffbb5429ea6da655ae65
@@ -1252,7 +1252,7 @@ F tool/vdbe_profile.tcl 67746953071a9f8f2f668b73fe899074e2c6d8c1
 F tool/warnings-clang.sh f6aa929dc20ef1f856af04a730772f59283631d4
 F tool/warnings.sh 0abfd78ceb09b7f7c27c688c8e3fe93268a13b32
 F tool/win/sqlite.vsix deb315d026cc8400325c5863eef847784a219a2f
-P 3b925189a75eae875da256b6e54999cad3cef1eb
-R 91b21b2647bc9d8855495606fbb1f5a3
+P 01c50cee37bfaddfecdda014728c35a1be1d991a
+R b16870d1654f6de484a72bbc7fa9d1f0
 U drh
-Z 7838074221fad9e070444c0a40a76b3b
+Z cee60c918913e56f32da2a16c41282ec

manifest.uuid

@@ -1 +1 @@
-01c50cee37bfaddfecdda014728c35a1be1d991a
+b5e43602833249aa4b73337bf85b7f308450dab6

src/resolve.c

@@ -79,7 +79,7 @@ static void incrAggFunctionDepth(Expr *pExpr, int N){
 **     SELECT a+b, c+d FROM t1 ORDER BY (a+b) COLLATE nocase;
 **
 ** The nSubquery parameter specifies how many levels of subquery the
-** alias is removed from the original expression.  The usually value is
+** alias is removed from the original expression.  The usual value is
 ** zero but it might be more if the alias is contained within a subquery
 ** of the original expression.  The Expr.op2 field of TK_AGG_FUNCTION
 ** structures must be increased by the nSubquery amount.
@@ -99,7 +99,7 @@ static void resolveAlias(
   assert( iCol>=0 && iCol<pEList->nExpr );
   pOrig = pEList->a[iCol].pExpr;
   assert( pOrig!=0 );
-  assert( pOrig->flags & EP_Resolved );
+  assert( (pOrig->flags & EP_Resolved)!=0 || zType[0]==0 );
   db = pParse->db;
   pDup = sqlite3ExprDup(db, pOrig, 0);
   if( pDup==0 ) return;

test/resolver01.test

@@ -11,10 +11,12 @@
 #
 # This file tests features of the name resolver (the component that
 # figures out what identifiers in the SQL statement refer to) that
-# were fixed by ticket [2500cdb9be]
+# were fixed by ticket [2500cdb9be].
 #
 # See also tickets [1c69be2daf] and [f617ea3125] from 2013-08-14.
 #
+# Also a fuzzer-discovered problem on 2015-04-23.
+#
 
 set testdir [file dirname $argv0]
 source $testdir/tester.tcl
@@ -201,6 +203,12 @@ do_execsql_test resolver01-6.3 {
    GROUP BY lower(name);
 } {1 {} 1 {}}
 
+do_execsql_test resolver01-7.1 {
+  SELECT 2 AS x WHERE (SELECT x AS y WHERE 3>y);
+} {2}
+do_execsql_test resolver01-7.2 {
+  SELECT 2 AS x WHERE (SELECT x AS y WHERE 1>y);
+} {}