diff --git a/manifest b/manifest
index c40d0dcd37..255ba7ac07 100644
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Improve\sthe\serror\smessage\sreturned\swhen\sfts5\sfinds\sa\srow\sis\smissing\sfrom\sits\scontent\stable.
-D 2024-07-08T16:01:49.563
+C Fix\sa\suse-after-free\sthat\scould\soccur\sfollowing\san\sOOM\sintroduced\sby\s[d8cedbe0].
+D 2024-07-08T17:39:52.184
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
 F LICENSE.md df5091916dbb40e6e9686186587125e1b2ff51f022cc334e886c19a0e9982724
@@ -705,7 +705,7 @@ F src/date.c 13dd752847afb32ed70510ad7345a5b9c841f51ad904dba5d010f1fa3a6a324e
 F src/dbpage.c 80e46e1df623ec40486da7a5086cb723b0275a6e2a7b01d9f9b5da0f04ba2782
 F src/dbstat.c 3b677254d512fcafd4d0b341bf267b38b235ccfddbef24f9154e19360fa22e43
 F src/delete.c cb766727c78e715f9fb7ec8a7d03658ed2a3016343ca687acfcec9083cdca500
-F src/expr.c e8e5c5b2e2bf3d3d4b575c71e8fdd19caed20712afef6ad9fde735f9a210e08d
+F src/expr.c 1119a2cbb1ade3ee249c7eb18916174385219a7e4f0f5ad26d22fed6607903b0
 F src/fault.c 460f3e55994363812d9d60844b2a6de88826e007
 F src/fkey.c 852f93c0ef995e0c2b8983059a2b97151c194cc8259e21f5bc2b7ac508348c2a
 F src/func.c 1f61e32e7a357e615b5d2e774bee563761fce4f2fd97ecb0f72c33e62a2ada5f
@@ -2195,8 +2195,8 @@ F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93
 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
 F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
 F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
-P d8cedbe055b40a0ea4e5d47845b535162e9fcb0d0f88c03211797ab64d2d56fb
-R 94dba3784e751a9ba9bcb5baa59e9879
+P 9b1afd4acb8cf9738154e921dcb074d895bbcc4742bf1016ef9f045a0da78bc8
+R 572ce10240355ed2f88bbf920eee8899
 U dan
-Z a1c389616ef05340b174d47447289b9e
+Z de9768796b5b05d843e990250379b518
 # Remove this line to create a well-formed Fossil manifest.
diff --git a/manifest.uuid b/manifest.uuid
index 00d333fbd1..101aa9fe3a 100644
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-9b1afd4acb8cf9738154e921dcb074d895bbcc4742bf1016ef9f045a0da78bc8
+4fabfacfcf38e129949d3e4e2c3ffde3da3cd40d9d12c97ca29bc7c3604db6ed
diff --git a/src/expr.c b/src/expr.c
index e7df61c869..b9310fb396 100644
--- a/src/expr.c
+++ b/src/expr.c
@@ -3563,8 +3563,8 @@ void sqlite3CodeRhsOfIN(
       pSig->iAddr = pExpr->y.sub.iAddr;
       pSig->regReturn = pExpr->y.sub.regReturn;
       pSig->iTable = iTab;
-      sqlite3VdbeChangeP4(v, -1, (const char*)pSig, P4_SUBRTNSIG);
       pParse->mSubrtnSig = 1 << (pSig->selId&7);
+      sqlite3VdbeChangeP4(v, -1, (const char*)pSig, P4_SUBRTNSIG);
     }
     addrOnce = sqlite3VdbeAddOp0(v, OP_Once); VdbeCoverage(v);
   }