core: report the placeholders the analyzer used to walk past

Under SQLCEXPERIMENT=coreanalyzer several statement shapes lost their
parameters, so the generated function took fewer arguments than the query
has placeholders:

- INSERT ... SELECT: the engines report the source query with an empty
  VALUES list rather than none, so the analyzer took the VALUES branch and
  walked nothing. The query is analyzed now, and a placeholder selected
  directly stands in for the column it lands in.
- UPDATE ... LIMIT and DELETE ... LIMIT, and LIMIT/OFFSET on a UNION,
  INTERSECT or EXCEPT, were never looked at.
- ON DUPLICATE KEY UPDATE assignments were never looked at; they bind the
  way SET does.
- x IN (SELECT ...) on MySQL arrives wrapped in a sublink, which the IN
  node did not look through.
- x COLLATE c: SQLite puts the expression in the node's other field and
  the collation's name where PostgreSQL puts the expression, so the
  placeholder underneath was neither found nor typed.
- CALL: the compiler only sent SELECT, INSERT, UPDATE and DELETE through
  the core, and the schema package skipped CREATE PROCEDURE. A procedure is
  recorded now, with a void pseudo type as its result, and a CALL types
  each placeholder from the procedure's declared parameter, by position or
  by name, and names it after the parameter. The AST gains IsProcedure,
  which both parsers set, since a function with only OUT parameters also
  declares no return type.

A placeholder on the left of an IN list takes its type from the members,
the way the other operand of a comparison would.

In the core replay context 12 more cases pass, with no case regressing.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XZcKb4GFiZQbeo9oVmyF3m

Author: claude

internal/compiler/parse_core.go

@@ -54,7 +54,7 @@ func (c *Compiler) parseQueryCore(raw *ast.RawStmt, src string, pre *preprocess.
 	var cols []*Column
 	var params []Parameter
 	switch raw.Stmt.(type) {
-	case *ast.SelectStmt, *ast.InsertStmt, *ast.UpdateStmt, *ast.DeleteStmt:
+	case *ast.SelectStmt, *ast.InsertStmt, *ast.UpdateStmt, *ast.DeleteStmt, *ast.CallStmt:
 		res, err := coreanalyzer.Prepare(c.coreCatalog, raw)
 		if err != nil {
 			return nil, err

internal/core/analysis.go

@@ -7,6 +7,7 @@ const (
 	CommandInsert Command = "INSERT"
 	CommandUpdate Command = "UPDATE"
 	CommandDelete Command = "DELETE"
+	CommandCall   Command = "CALL"
 )
 
 type PrepareResult struct {

internal/core/analyzer/analyzer.go

@@ -37,6 +37,11 @@ func Prepare(cat *core.Catalog, stmt ast.Node) (core.PrepareResult, error) {
 			return core.PrepareResult{}, err
 		}
 		a.command = core.CommandDelete
+	case *ast.CallStmt:
+		if err := a.analyzeCall(s); err != nil {
+			return core.PrepareResult{}, err
+		}
+		a.command = core.CommandCall
 	default:
 		return core.PrepareResult{}, fmt.Errorf("analyzer: unsupported statement %T", stmt)
 	}
@@ -174,7 +179,7 @@ func (a *analyzer) analyzeSelect(s *ast.SelectStmt) error {
 		if err := a.analyzeSetOperation(s); err != nil {
 			return err
 		}
-		return nil
+		return a.typeLimits(s)
 	}
 
 	sc, err := a.buildScope(s.FromClause)
@@ -234,6 +239,11 @@ func (a *analyzer) analyzeSelect(s *ast.SelectStmt) error {
 			}
 		}
 	}
+	return a.typeLimits(s)
+}
+
+// typeLimits types a SELECT's LIMIT and OFFSET.
+func (a *analyzer) typeLimits(s *ast.SelectStmt) error {
 	for _, n := range []ast.Node{s.LimitCount, s.LimitOffset} {
 		if err := a.typeLimit(n); err != nil {
 			return fmt.Errorf("limit: %w", err)

internal/core/analyzer/dml.go

@@ -24,9 +24,95 @@ func (a *analyzer) analyzeInsert(s *ast.InsertStmt) error {
 	if err := a.bindInsertValues(s.SelectStmt, rel, targets); err != nil {
 		return err
 	}
+	if s.OnDuplicateKeyUpdate != nil {
+		if err := a.bindAssignments(rel, s.OnDuplicateKeyUpdate.TargetList); err != nil {
+			return fmt.Errorf("on duplicate key update: %w", err)
+		}
+	}
 	return a.projectReturning(s.ReturningList)
 }
 
+// bindAssignments types the values a SET-style list assigns to the
+// relation's columns.
+func (a *analyzer) bindAssignments(rel scopeRel, targets *ast.List) error {
+	for _, item := range listItems(targets) {
+		rt, ok := item.(*ast.ResTarget)
+		if !ok || rt.Name == nil {
+			continue
+		}
+		col, ok := findColumn(rel, *rt.Name)
+		if !ok {
+			return fmt.Errorf("unknown column %q", *rt.Name)
+		}
+		if err := a.bindValue(rel, &col, rt.Val); err != nil {
+			return fmt.Errorf("set %s: %w", *rt.Name, err)
+		}
+	}
+	return nil
+}
+
+// analyzeCall types the arguments of a CALL from the procedure's declared
+// parameters: a placeholder takes the parameter's type and name, whether
+// it is passed by position or by name.
+func (a *analyzer) analyzeCall(s *ast.CallStmt) error {
+	if s.FuncCall == nil {
+		return fmt.Errorf("call: missing procedure")
+	}
+	name := funcCallName(s.FuncCall)
+	overloads, err := a.cat.FindProcs(name, nil)
+	if err != nil {
+		return err
+	}
+	args := listItems(s.FuncCall.Args)
+	var procs []core.ProcOverload
+	for _, p := range overloads {
+		if p.Kind == "p" {
+			procs = append(procs, p)
+		}
+	}
+	if len(procs) == 0 {
+		return fmt.Errorf("unknown procedure %q", name)
+	}
+	proc := procs[0]
+	for _, p := range procs {
+		if len(p.ArgTypes) == len(args) {
+			proc = p
+			break
+		}
+	}
+	params, err := a.cat.ProcArgs(proc.OID)
+	if err != nil {
+		return err
+	}
+	for i, arg := range args {
+		var param *core.ProcArg
+		value := arg
+		if named, ok := arg.(*ast.NamedArgExpr); ok {
+			value = named.Arg
+			if named.Name != nil {
+				for j := range params {
+					if params[j].Name == *named.Name {
+						param = &params[j]
+						break
+					}
+				}
+			}
+		} else if i < len(params) {
+			param = &params[i]
+		}
+		pr, ok := value.(*ast.ParamRef)
+		if !ok || param == nil {
+			if _, err := a.typeExpr(value); err != nil {
+				return err
+			}
+			continue
+		}
+		a.inferParam(pr.Number, exprType{typeOID: param.TypeOID})
+		a.nameParam(pr.Number, param.Name)
+	}
+	return nil
+}
+
 func (a *analyzer) analyzeUpdate(s *ast.UpdateStmt) error {
 	if err := a.bindCTEs(s.WithClause); err != nil {
 		return err
@@ -57,6 +143,9 @@ func (a *analyzer) analyzeUpdate(s *ast.UpdateStmt) error {
 			return fmt.Errorf("where: %w", err)
 		}
 	}
+	if err := a.typeLimit(s.LimitCount); err != nil {
+		return fmt.Errorf("limit: %w", err)
+	}
 	return a.projectReturning(s.ReturningList)
 }
 
@@ -75,6 +164,9 @@ func (a *analyzer) analyzeDelete(s *ast.DeleteStmt) error {
 			return fmt.Errorf("where: %w", err)
 		}
 	}
+	if err := a.typeLimit(s.LimitCount); err != nil {
+		return fmt.Errorf("limit: %w", err)
+	}
 	return a.projectReturning(s.ReturningList)
 }
 
@@ -140,10 +232,22 @@ func (a *analyzer) bindInsertValues(n ast.Node, rel scopeRel, targets []core.Cla
 		return fmt.Errorf("insert: unsupported source %T", n)
 	}
 	// INSERT ... SELECT inserts whatever the query returns. The rows are not
-	// the statement's result, but the query still holds placeholders.
-	if sel.ValuesLists == nil {
-		_, err := a.subqueryColumns(sel)
-		return err
+	// the statement's result, but the query still holds placeholders, and a
+	// placeholder selected directly stands in for the column it lands in.
+	if len(listItems(sel.ValuesLists)) == 0 {
+		if _, err := a.subqueryColumns(sel); err != nil {
+			return err
+		}
+		for i, item := range listItems(sel.TargetList) {
+			rt, ok := item.(*ast.ResTarget)
+			if !ok || i >= len(targets) {
+				continue
+			}
+			if pr, ok := rt.Val.(*ast.ParamRef); ok {
+				a.inferParam(pr.Number, columnType(rel, targets[i]))
+			}
+		}
+		return nil
 	}
 	for _, row := range listItems(sel.ValuesLists) {
 		values, ok := row.(*ast.List)

internal/core/analyzer/expr.go

@@ -78,7 +78,7 @@ func (a *analyzer) typeExpr(n ast.Node) (exprType, error) {
 		return a.typeSubLink(e)
 
 	case *ast.CollateExpr:
-		return a.typeExpr(e.Arg)
+		return a.typeExpr(collated(e))
 
 	case *ast.IntervalExpr:
 		// A dialect with no interval type of its own leaves it untyped.
@@ -231,6 +231,18 @@ func (a *analyzer) inferParam(number int, t exprType) {
 	a.params[number] = cur
 }
 
+// nameParam gives a placeholder a name when nothing has named it yet.
+func (a *analyzer) nameParam(number int, name string) {
+	if name == "" {
+		return
+	}
+	cur := a.params[number]
+	if cur.Name == "" && cur.Source == nil {
+		cur.Name = name
+		a.params[number] = cur
+	}
+}
+
 // nameParamAfter names a placeholder compared with a function call after
 // the function, the way a placeholder compared with a column is named after
 // the column.
@@ -296,12 +308,12 @@ func (a *analyzer) typeAExpr(e *ast.A_Expr) (exprType, error) {
 		return exprType{}, err
 	}
 
-	if pr, ok := e.Lexpr.(*ast.ParamRef); ok && rightT.typeOID != 0 {
+	if pr, ok := bareParam(e.Lexpr); ok && rightT.typeOID != 0 {
 		a.inferParam(pr.Number, rightT)
 		a.nameParamAfter(pr.Number, e.Rexpr)
 		leftT = rightT
 	}
-	if pr, ok := e.Rexpr.(*ast.ParamRef); ok && leftT.typeOID != 0 {
+	if pr, ok := bareParam(e.Rexpr); ok && leftT.typeOID != 0 {
 		a.inferParam(pr.Number, leftT)
 		a.nameParamAfter(pr.Number, e.Lexpr)
 		rightT = leftT
@@ -351,10 +363,8 @@ func (a *analyzer) typePredicateList(e *ast.A_Expr) (exprType, error) {
 		return exprType{}, err
 	}
 	if l, ok := e.Rexpr.(*ast.List); ok {
-		for _, item := range listItems(l) {
-			if err := a.typeOperands(item, leftT); err != nil {
-				return exprType{}, err
-			}
+		if err := a.typeMembers(e.Lexpr, leftT, listItems(l)); err != nil {
+			return exprType{}, err
 		}
 		return a.boolType(false)
 	}
@@ -364,21 +374,51 @@ func (a *analyzer) typePredicateList(e *ast.A_Expr) (exprType, error) {
 	return a.boolType(false)
 }
 
+// typeMembers types the members of an IN list against the expression on
+// the left. When that expression is a bare placeholder, the members type
+// it instead, the way the other operand of a comparison would.
+func (a *analyzer) typeMembers(left ast.Node, leftT exprType, members []ast.Node) error {
+	for _, item := range members {
+		if err := a.typeOperands(item, leftT); err != nil {
+			return err
+		}
+	}
+	pr, ok := bareParam(left)
+	if !ok || leftT.typeOID != 0 {
+		return nil
+	}
+	for _, item := range members {
+		t, err := a.typeExpr(item)
+		if err != nil {
+			return err
+		}
+		if t.typeOID != 0 {
+			a.inferParam(pr.Number, t)
+			a.nameParamAfter(pr.Number, item)
+			return nil
+		}
+	}
+	return nil
+}
+
 // typeIn types the IN node the engines that have one report, where the values
 // compared against are held apart from the expression.
 func (a *analyzer) typeIn(e *ast.In) (exprType, error) {
 	leftT, err := a.typeExpr(e.Expr)
 	if err != nil {
 		return exprType{}, err
 	}
-	for _, item := range e.List {
-		if err := a.typeOperands(item, leftT); err != nil {
-			return exprType{}, err
-		}
+	if err := a.typeMembers(e.Expr, leftT, e.List); err != nil {
+		return exprType{}, err
 	}
 	// "x IN (SELECT ...)" compares x against the subquery's column, and the
-	// subquery's own placeholders are reported with the rest.
-	if sel, ok := e.Sel.(*ast.SelectStmt); ok {
+	// subquery's own placeholders are reported with the rest. An engine may
+	// report the subquery wrapped in a sublink.
+	subselect := e.Sel
+	if sl, ok := subselect.(*ast.SubLink); ok {
+		subselect = sl.Subselect
+	}
+	if sel, ok := subselect.(*ast.SelectStmt); ok {
 		cols, err := a.subqueryColumns(sel)
 		if err != nil {
 			return exprType{}, err
@@ -582,10 +622,30 @@ func (a *analyzer) typeNullIf(e *ast.A_Expr) (exprType, error) {
 	return leftT, nil
 }
 
+// collated is the expression a COLLATE clause applies to. Engines disagree
+// on which field holds it: PostgreSQL puts the expression in Arg, SQLite
+// puts it in Xpr and the collation's name in Arg.
+func collated(e *ast.CollateExpr) ast.Node {
+	if _, isName := e.Arg.(*ast.String); e.Arg == nil || isName {
+		return e.Xpr
+	}
+	return e.Arg
+}
+
+// bareParam reports whether n is a placeholder, looking through a COLLATE
+// clause, which changes how a value compares and not what it is.
+func bareParam(n ast.Node) (*ast.ParamRef, bool) {
+	if c, ok := n.(*ast.CollateExpr); ok {
+		n = collated(c)
+	}
+	pr, ok := n.(*ast.ParamRef)
+	return pr, ok
+}
+
 // typeOperands types a node standing opposite one of known type, giving a bare
 // placeholder that type.
 func (a *analyzer) typeOperands(n ast.Node, other exprType) error {
-	if pr, ok := n.(*ast.ParamRef); ok {
+	if pr, ok := bareParam(n); ok {
 		if other.typeOID != 0 || other.typeName != "" {
 			a.inferParam(pr.Number, other)
 		}

internal/core/catalogdb/query.sql.go

@@ -201,6 +201,11 @@ INSERT INTO sql_proc
      return_type_oid, return_set, return_nullable, strict, variadic_kind)
 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?);
 
+-- name: ProcArgs :many
+SELECT name, type_oid, mode, has_default FROM sql_proc_arg
+WHERE proc_oid = ?
+ORDER BY ord;
+
 -- name: CreateProcArg :exec
 INSERT INTO sql_proc_arg (proc_oid, ord, name, type_oid, mode, has_default)
 VALUES (?, ?, ?, ?, ?, ?);