diff --git a/manifest b/manifest
index c1adb34c7c..1bd1ba3c96 100644
--- a/manifest
+++ b/manifest
@@ -1,8 +1,8 @@
 -----BEGIN PGP SIGNED MESSAGE-----
 Hash: SHA1
 
-C Remove\sa\sNEVER()\sfrom\sbtree.c\sthat\scould\soccur\sin\sa\svery\sobscure\stested\nevaluation\swith\san\sI/O\serror\son\sfstat().
-D 2009-12-03T19:40:00
+C Fix\san\sassert()\sin\sbtree.c\sthat\smight\shave\sfired\son\sa\scorrupt\sdatabase\sfile.
+D 2009-12-03T21:26:53
 F Makefile.arm-wince-mingw32ce-gcc fcd5e9cd67fe88836360bb4f9ef4cb7f8e2fb5a0
 F Makefile.in c5827ead754ab32b9585487177c93bb00b9497b3
 F Makefile.linux-gcc d53183f4aa6a9192d249731c90dbdffbd2c68654
@@ -111,7 +111,7 @@ F src/auth.c 523da7fb4979469955d822ff9298352d6b31de34
 F src/backup.c 744e98359dfc79fed43e8dec911e33e108b06aae
 F src/bitvec.c 06ad2c36a9c3819c0b9cbffec7b15f58d5d834e0
 F src/btmutex.c 96a12f50f7a17475155971a241d85ec5171573ff
-F src/btree.c e6f7c7bbb1a888fdf1a2c5b83a4efebf2dc13326
+F src/btree.c 086f343d8b7bc37eabd2cf81dbbce3db37a093da
 F src/btree.h 7944a9dac59eb3e541aad45fd2747f1051e7c63d
 F src/btreeInt.h 54f4245decd0409ea52cf9aee422d3d761d7ac10
 F src/build.c a48e74d24897100017d39ceba5de255e53ec9488
@@ -779,14 +779,14 @@ F tool/speedtest2.tcl ee2149167303ba8e95af97873c575c3e0fab58ff
 F tool/speedtest8.c 2902c46588c40b55661e471d7a86e4dd71a18224
 F tool/speedtest8inst1.c 293327bc76823f473684d589a8160bde1f52c14e
 F tool/vdbe-compress.tcl d70ea6d8a19e3571d7ab8c9b75cba86d1173ff0f
-P 75863c2d55e0801add5b8dcf88d575c5c870af04
-R 2b7a161eaee6afd6b881b53584d9aa6b
+P d5861d9ffecca499d79d722b5f742ffe3a5aff44
+R 672739783a57cc2945d2711dc3624ee1
 U drh
-Z da696b30584703ae55e60b117c5da01a
+Z 8b12fd840dfeb2d0d552e6c6adcc395d
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.6 (GNU/Linux)
 
-iD8DBQFLGBQToxKgR168RlERAiGTAJ9mUJN1i4Ic+WSNCIGMUesT59i0xQCeONoR
-J6K+b4rPUbkVZNhiJY2wehI=
-=sv5f
+iD8DBQFLGC0goxKgR168RlERAsceAJ4tPVtQmWVNN9jH7h66NAP7ntVM3QCffxuS
+O3PLkAGKJceDIgUe5VAtAtE=
+=AN6z
 -----END PGP SIGNATURE-----
diff --git a/manifest.uuid b/manifest.uuid
index f4e0145c8b..104be73ece 100644
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-d5861d9ffecca499d79d722b5f742ffe3a5aff44
\ No newline at end of file
+5ab2b3e300b70bc04cdead69275f8f734ea2d885
\ No newline at end of file
diff --git a/src/btree.c b/src/btree.c
index cc2279ff4b..8b25509b6a 100644
--- a/src/btree.c
+++ b/src/btree.c
@@ -5295,8 +5295,13 @@ static void insertCell(
   assert( i>=0 && i<=pPage->nCell+pPage->nOverflow );
   assert( pPage->nCell<=MX_CELL(pPage->pBt) && MX_CELL(pPage->pBt)<=5460 );
   assert( pPage->nOverflow<=ArraySize(pPage->aOvfl) );
-  assert( sz==cellSizePtr(pPage, pCell) );
   assert( sqlite3_mutex_held(pPage->pBt->mutex) );
+  /* The cell should normally be sized correctly.  However, when moving a
+  ** malformed cell from a leaf page to an interior page, if the cell size
+  ** wanted to be less than 4 but got rounded up to 4 on the leaf, then size
+  ** might be less than 8 (leaf-size + pointer) on the interior node.  Hence
+  ** the term after the || in the following assert(). */
+  assert( sz==cellSizePtr(pPage, pCell) || (sz==8 && iChild>0) );
   if( pPage->nOverflow || sz+2>pPage->nFree ){
     if( pTemp ){
       memcpy(pTemp+nSkip, pCell+nSkip, sz-nSkip);