Fix a faulty assert() in the "AS" alias resolution logic of the parser.

src/resolve.c

@@ -79,7 +79,7 @@ static void incrAggFunctionDepth(Expr *pExpr, int N){
 **     SELECT a+b, c+d FROM t1 ORDER BY (a+b) COLLATE nocase;
 **
 ** The nSubquery parameter specifies how many levels of subquery the
-** alias is removed from the original expression.  The usually value is
+** alias is removed from the original expression.  The usual value is
 ** zero but it might be more if the alias is contained within a subquery
 ** of the original expression.  The Expr.op2 field of TK_AGG_FUNCTION
 ** structures must be increased by the nSubquery amount.
@@ -99,7 +99,7 @@ static void resolveAlias(
   assert( iCol>=0 && iCol<pEList->nExpr );
   pOrig = pEList->a[iCol].pExpr;
   assert( pOrig!=0 );
-  assert( pOrig->flags & EP_Resolved );
+  assert( (pOrig->flags & EP_Resolved)!=0 || zType[0]==0 );
   db = pParse->db;
   pDup = sqlite3ExprDup(db, pOrig, 0);
   if( pDup==0 ) return;

test/resolver01.test

@@ -11,10 +11,12 @@
 #
 # This file tests features of the name resolver (the component that
 # figures out what identifiers in the SQL statement refer to) that
-# were fixed by ticket [2500cdb9be]
+# were fixed by ticket [2500cdb9be].
 #
 # See also tickets [1c69be2daf] and [f617ea3125] from 2013-08-14.
 #
+# Also a fuzzer-discovered problem on 2015-04-23.
+#
 
 set testdir [file dirname $argv0]
 source $testdir/tester.tcl
@@ -201,6 +203,12 @@ do_execsql_test resolver01-6.3 {
    GROUP BY lower(name);
 } {1 {} 1 {}}
 
+do_execsql_test resolver01-7.1 {
+  SELECT 2 AS x WHERE (SELECT x AS y WHERE 3>y);
+} {2}
+do_execsql_test resolver01-7.2 {
+  SELECT 2 AS x WHERE (SELECT x AS y WHERE 1>y);
+} {}