Indexed DB: Ensure large explicit keys consistently max out generator

content/browser/indexed_db/indexed_db_database.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/indexed_db/indexed_db_database.h"
 
 #include <math.h>
 
+#include <algorithm>
 #include <limits>
 #include <set>
 
 #include "base/auto_reset.h"
 #include "base/logging.h"
 #include "base/macros.h"
 #include "base/memory/ptr_util.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/numerics/safe_conversions.h"
 #include "base/stl_util.h"
@@ skipping 1175 matching lines @@
   if (!s.ok()) {
     LOG(ERROR) << "Failed to GetKeyGeneratorCurrentNumber";
     return base::MakeUnique<IndexedDBKey>();
   }
   if (current_number < 0 || current_number > max_generator_value)
     return base::MakeUnique<IndexedDBKey>();
 
   return base::MakeUnique<IndexedDBKey>(current_number, WebIDBKeyTypeNumber);
 }
 
+// Called at the end of a "put" operation. The key is a number that was either
+// generated by the generator which now needs to be incremented (so
+// |check_current| is false) or was user-supplied so we only conditionally use
+// (and |check_current| is true).
 static leveldb::Status UpdateKeyGenerator(IndexedDBBackingStore* backing_store,
                                           IndexedDBTransaction* transaction,
                                           int64_t database_id,
                                           int64_t object_store_id,
                                           const IndexedDBKey& key,
                                           bool check_current) {
   DCHECK_EQ(WebIDBKeyTypeNumber, key.type());
+  // Maximum integer storable as ECMAScript number.

[pwnall, 2017/03/07 19:42:41]

Technically not true, 9007199254740994 can also be stored. I suspect you mean
it's the top of the interval of integers w/ the property that all interval
members can be stored. I wonder if it'd be easier to say this is
Number.MAX_SAFE_INTEGER + 1, and which gives a good hint to the interested
reader, who can then Google for the details.

[jsbell, 2017/03/07 20:27:57]

Yeah, bad comment (copied pasted from above). Needs the qualifier "uniquely";
fixed both.

+  const double max_generator_value = 9007199254740992.0;
+  int64_t value = base::saturated_cast<int64_t>(
+      floor(std::min(key.number(), max_generator_value)));
   return backing_store->MaybeUpdateKeyGeneratorCurrentNumber(
       transaction->BackingStoreTransaction(), database_id, object_store_id,
-      static_cast<int64_t>(floor(key.number())) + 1, check_current);
+      value + 1, check_current);
 }
 
 struct IndexedDBDatabase::PutOperationParams {
   PutOperationParams() {}
   int64_t object_store_id;
   IndexedDBValue value;
   std::vector<std::unique_ptr<storage::BlobDataHandle>> handles;
   std::unique_ptr<IndexedDBKey> key;
   blink::WebIDBPutMode put_mode;
   scoped_refptr<IndexedDBCallbacks> callbacks;
@@ skipping 724 matching lines @@
   if (status.IsCorruption()) {
     IndexedDBDatabaseError error(blink::WebIDBDatabaseExceptionUnknownError,
                                  message);
     factory_->HandleBackingStoreCorruption(backing_store_->origin(), error);
   } else {
     factory_->HandleBackingStoreFailure(backing_store_->origin());
   }
 }
 
 }  // namespace content