Fix a problem that could cause an infinite loop in the fts3 'merge' command.

FossilOrigin-Name: be545f85a6ef09cc6c762f7d2ab7a0b3adf5590c3fbdc9903e6b5b5cec6e823f
(cherry picked from commit 30b5db126149763c826250ed171318f8b4d075ec)
Bug: 1097979
Change-Id: I6b9266d90a987eca566b9ce46b95b8bf764d1368
diff --git a/amalgamation/sqlite3.c b/amalgamation/sqlite3.c
index b6f8455..a884e81 100644
--- a/amalgamation/sqlite3.c
+++ b/amalgamation/sqlite3.c
@@ -1164,7 +1164,7 @@
 */
 #define SQLITE_VERSION        "3.32.1"
 #define SQLITE_VERSION_NUMBER 3032001
-#define SQLITE_SOURCE_ID      "2020-05-25 16:19:56 4a8744e8b307f2f763ebd296a34cc42f2e7287ef79d6fa618e7b315631f5c8cf"
+#define SQLITE_SOURCE_ID      "2020-05-25 16:19:56 733705d72dbb3812c8bad28795d7086e3c41ccdef128e6c56723dab0f0432dc3"
 
 /*
 ** CAPI3REF: Run-Time Library Version Numbers
@@ -176079,7 +176079,9 @@
 ** created by merging the oldest :2 segments from absolute level :1. See 
 ** function sqlite3Fts3Incrmerge() for details.  */
 /* 29 */ "SELECT 2 * total(1 + leaves_end_block - start_block) "
-         "  FROM %Q.'%q_segdir' WHERE level = ? AND idx < ?",
+         "  FROM (SELECT * FROM %Q.'%q_segdir' "
+         "        WHERE level = ? ORDER BY idx ASC LIMIT ?"
+         "  )",
 
 /* SQL_DELETE_SEGDIR_ENTRY
 **   Delete the %_segdir entry on absolute level :1 with index :2.  */
@@ -229108,9 +229110,9 @@
 #endif /* !defined(SQLITE_CORE) || defined(SQLITE_ENABLE_STMTVTAB) */
 
 /************** End of stmt.c ************************************************/
-#if __LINE__!=229111
+#if __LINE__!=229113
 #undef SQLITE_SOURCE_ID
-#define SQLITE_SOURCE_ID      "2020-05-25 16:19:56 4a8744e8b307f2f763ebd296a34cc42f2e7287ef79d6fa618e7b315631f5alt2"
+#define SQLITE_SOURCE_ID      "2020-05-25 16:19:56 733705d72dbb3812c8bad28795d7086e3c41ccdef128e6c56723dab0f043alt2"
 #endif
 /* Return the source-id for this library */
 SQLITE_API const char *sqlite3_sourceid(void){ return SQLITE_SOURCE_ID; }
diff --git a/amalgamation/sqlite3.h b/amalgamation/sqlite3.h
index 507e65e..99db69c 100644
--- a/amalgamation/sqlite3.h
+++ b/amalgamation/sqlite3.h
@@ -125,7 +125,7 @@
 */
 #define SQLITE_VERSION        "3.32.1"
 #define SQLITE_VERSION_NUMBER 3032001
-#define SQLITE_SOURCE_ID      "2020-05-25 16:19:56 4a8744e8b307f2f763ebd296a34cc42f2e7287ef79d6fa618e7b315631f5c8cf"
+#define SQLITE_SOURCE_ID      "2020-05-25 16:19:56 733705d72dbb3812c8bad28795d7086e3c41ccdef128e6c56723dab0f0432dc3"
 
 /*
 ** CAPI3REF: Run-Time Library Version Numbers
diff --git a/amalgamation_dev/sqlite3.c b/amalgamation_dev/sqlite3.c
index c5de591..87a53aa 100644
--- a/amalgamation_dev/sqlite3.c
+++ b/amalgamation_dev/sqlite3.c
@@ -1164,7 +1164,7 @@
 */
 #define SQLITE_VERSION        "3.32.1"
 #define SQLITE_VERSION_NUMBER 3032001
-#define SQLITE_SOURCE_ID      "2020-05-25 16:19:56 4a8744e8b307f2f763ebd296a34cc42f2e7287ef79d6fa618e7b315631f5c8cf"
+#define SQLITE_SOURCE_ID      "2020-05-25 16:19:56 733705d72dbb3812c8bad28795d7086e3c41ccdef128e6c56723dab0f0432dc3"
 
 /*
 ** CAPI3REF: Run-Time Library Version Numbers
@@ -176578,7 +176578,9 @@
 ** created by merging the oldest :2 segments from absolute level :1. See 
 ** function sqlite3Fts3Incrmerge() for details.  */
 /* 29 */ "SELECT 2 * total(1 + leaves_end_block - start_block) "
-         "  FROM %Q.'%q_segdir' WHERE level = ? AND idx < ?",
+         "  FROM (SELECT * FROM %Q.'%q_segdir' "
+         "        WHERE level = ? ORDER BY idx ASC LIMIT ?"
+         "  )",
 
 /* SQL_DELETE_SEGDIR_ENTRY
 **   Delete the %_segdir entry on absolute level :1 with index :2.  */
@@ -229607,9 +229609,9 @@
 #endif /* !defined(SQLITE_CORE) || defined(SQLITE_ENABLE_STMTVTAB) */
 
 /************** End of stmt.c ************************************************/
-#if __LINE__!=229610
+#if __LINE__!=229612
 #undef SQLITE_SOURCE_ID
-#define SQLITE_SOURCE_ID      "2020-05-25 16:19:56 4a8744e8b307f2f763ebd296a34cc42f2e7287ef79d6fa618e7b315631f5alt2"
+#define SQLITE_SOURCE_ID      "2020-05-25 16:19:56 733705d72dbb3812c8bad28795d7086e3c41ccdef128e6c56723dab0f043alt2"
 #endif
 /* Return the source-id for this library */
 SQLITE_API const char *sqlite3_sourceid(void){ return SQLITE_SOURCE_ID; }
diff --git a/amalgamation_dev/sqlite3.h b/amalgamation_dev/sqlite3.h
index 507e65e..99db69c 100644
--- a/amalgamation_dev/sqlite3.h
+++ b/amalgamation_dev/sqlite3.h
@@ -125,7 +125,7 @@
 */
 #define SQLITE_VERSION        "3.32.1"
 #define SQLITE_VERSION_NUMBER 3032001
-#define SQLITE_SOURCE_ID      "2020-05-25 16:19:56 4a8744e8b307f2f763ebd296a34cc42f2e7287ef79d6fa618e7b315631f5c8cf"
+#define SQLITE_SOURCE_ID      "2020-05-25 16:19:56 733705d72dbb3812c8bad28795d7086e3c41ccdef128e6c56723dab0f0432dc3"
 
 /*
 ** CAPI3REF: Run-Time Library Version Numbers
diff --git a/ext/fts3/fts3_write.c b/ext/fts3/fts3_write.c
index b9acc47..b8e2bac 100644
--- a/ext/fts3/fts3_write.c
+++ b/ext/fts3/fts3_write.c
@@ -341,7 +341,9 @@
 ** created by merging the oldest :2 segments from absolute level :1. See 
 ** function sqlite3Fts3Incrmerge() for details.  */
 /* 29 */ "SELECT 2 * total(1 + leaves_end_block - start_block) "
-         "  FROM %Q.'%q_segdir' WHERE level = ? AND idx < ?",
+         "  FROM (SELECT * FROM %Q.'%q_segdir' "
+         "        WHERE level = ? ORDER BY idx ASC LIMIT ?"
+         "  )",
 
 /* SQL_DELETE_SEGDIR_ENTRY
 **   Delete the %_segdir entry on absolute level :1 with index :2.  */
diff --git a/manifest b/manifest
index 71f053b..6badc22 100644
--- a/manifest
+++ b/manifest
@@ -100,7 +100,7 @@
 F ext/fts3/fts3_tokenizer1.c 5c98225a53705e5ee34824087478cf477bdb7004
 F ext/fts3/fts3_unicode.c 4b9af6151c29b35ed09574937083cece7c31e911f69615e168a39677569b684d
 F ext/fts3/fts3_unicode2.c 416eb7e1e81142703520d284b768ca2751d40e31fa912cae24ba74860532bf0f
-F ext/fts3/fts3_write.c ed869b24d074f2498bdbef915d6db1f88c604ca5811502112061932a0bed5133
+F ext/fts3/fts3_write.c 78a447d9f2610b90eb39489721d5dc547098fab3a8b06f834ad809f9832ce93d
 F ext/fts3/fts3speed.tcl b54caf6a18d38174f1a6e84219950d85e98bb1e9
 F ext/fts3/mkfts3amal.tcl 252ecb7fe6467854f2aa237bf2c390b74e71f100
 F ext/fts3/tool/fts3cov.sh c331d006359456cf6f8f953e37f2b9c7d568f3863f00bb5f7eb87fea4ac01b73
@@ -948,7 +948,7 @@
 F test/fts3corrupt.test 79a32ffdcd5254e2f7fa121d9656e61949ad049c3c6554229911b7ceac37c9c6
 F test/fts3corrupt2.test bf55c3fa0b0dc8ea1c0fe5543623bd27714585da6a129038fd6999fe3b0d25f3
 F test/fts3corrupt3.test 0d5b69a0998b4adf868cc301fc78f3d0707745f1d984ce044c205cdb764b491f
-F test/fts3corrupt4.test fde292a4712753c7ef235a199273c5d196e18a56bd2c4d2db7ccaf59b7027a0a
+F test/fts3corrupt4.test 8f9b299962560910865ffd14a3094e8f130bd0c99e143b82c8cdd9a13d141f73
 F test/fts3corrupt5.test 0549f85ec4bd22e992f645f13c59b99d652f2f5e643dac75568bfd23a6db7ed5
 F test/fts3cov.test 7eacdbefd756cfa4dc2241974e3db2834e9b372ca215880e00032222f32194cf
 F test/fts3d.test 2bd8c97bcb9975f2334147173b4872505b6a41359a4f9068960a36afe07a679f
diff --git a/test/fts3corrupt4.test b/test/fts3corrupt4.test
index 8bbf0f5..52a846e 100644
--- a/test/fts3corrupt4.test
+++ b/test/fts3corrupt4.test
@@ -6066,4 +6066,16 @@
 } {1 {database disk image is malformed}}
 
 
+#-------------------------------------------------------------------------
+do_execsql_test 42.1 {
+  CREATE VIRTUAL TABLE f USING fts3(a, b);
+}
+do_execsql_test 42.2 {
+  INSERT INTO f_segdir VALUES(0,2,1111,0,0,X'00');
+  INSERT INTO f_segdir VALUES(0,3,0   ,0,0,X'00013003010200');
+}
+do_execsql_test 42.3 {
+  INSERT INTO f(f) VALUES ('merge=107,2');
+}
+
 finish_test