Merge 131658 - IndexedDB: Enforce unsigned long/unsigned long long ranges

Source/WebCore/Modules/indexeddb/IDBCursor.cpp

 /*
  * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 137 matching lines @@
         RefPtr<IDBKey> keyPathKey = createIDBKeyFromScriptValueAndKeyPath(value, keyPath);
         if (!keyPathKey || !keyPathKey->isEqual(m_currentPrimaryKey.get())) {
             ec = IDBDatabaseException::DATA_ERR;
             return 0;
         }
     }
 
     return objectStore->put(IDBObjectStoreBackendInterface::CursorUpdate, IDBAny::create(this), context, value, m_currentPrimaryKey, ec);
 }
 
-void IDBCursor::advance(unsigned long count, ExceptionCode& ec)
+void IDBCursor::advance(long count, ExceptionCode& ec)
 {
     IDB_TRACE("IDBCursor::advance");
     if (!m_gotValue) {
         ec = IDBDatabaseException::IDB_INVALID_STATE_ERR;
         return;
     }
 
     if (!m_transaction->isActive()) {
         ec = IDBDatabaseException::TRANSACTION_INACTIVE_ERR;
         return;
     }
 
-    if (!count) {
+    // FIXME: This should only need to check for 0 once webkit.org/b/96798 lands.
+    const int64_t maxECMAScriptInteger = 0x20000000000000LL - 1;
+    if (count < 1 || count > maxECMAScriptInteger) {
         ec = NATIVE_TYPE_ERR;
         return;
     }
 
     m_request->setPendingCursor(this);
     m_gotValue = false;
     m_backend->advance(count, m_request, ec);
     if (ec)
         m_request->markEarlyDeath();
 }
@@ skipping 141 matching lines @@
 
     default:
         ec = NATIVE_TYPE_ERR;
         return IDBCursor::directionNext();
     }
 }
 
 } // namespace WebCore
 
 #endif // ENABLE(INDEXED_DATABASE)