Indexed DB: Ensure large explicit keys consistently max out generator

content/browser/indexed_db/indexed_db_database.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/indexed_db/indexed_db_database.h"
 
 #include <math.h>
 
+#include <algorithm>
 #include <limits>
 #include <set>
 
 #include "base/auto_reset.h"
 #include "base/logging.h"
 #include "base/macros.h"
 #include "base/memory/ptr_util.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/numerics/safe_conversions.h"
 #include "base/stl_util.h"
@@ skipping 1157 matching lines @@
     callbacks->OnSuccessArray(&found_values);
   }
   return s;
 }
 
 static std::unique_ptr<IndexedDBKey> GenerateKey(
     IndexedDBBackingStore* backing_store,
     IndexedDBTransaction* transaction,
     int64_t database_id,
     int64_t object_store_id) {
-  const int64_t max_generator_value =
-      9007199254740992LL;  // Maximum integer storable as ECMAScript number.
+  // Maximum integer uniquely representable as ECMAScript number.
+  const int64_t max_generator_value = 9007199254740992LL;
   int64_t current_number;
   leveldb::Status s = backing_store->GetKeyGeneratorCurrentNumber(
-      transaction->BackingStoreTransaction(),
-      database_id,
-      object_store_id,
+      transaction->BackingStoreTransaction(), database_id, object_store_id,
       &current_number);
   if (!s.ok()) {
     LOG(ERROR) << "Failed to GetKeyGeneratorCurrentNumber";
     return base::MakeUnique<IndexedDBKey>();
   }
   if (current_number < 0 || current_number > max_generator_value)
     return base::MakeUnique<IndexedDBKey>();
 
   return base::MakeUnique<IndexedDBKey>(current_number, WebIDBKeyTypeNumber);
 }
 
+// Called at the end of a "put" operation. The key is a number that was either
+// generated by the generator which now needs to be incremented (so
+// |check_current| is false) or was user-supplied so we only conditionally use
+// (and |check_current| is true).
 static leveldb::Status UpdateKeyGenerator(IndexedDBBackingStore* backing_store,
                                           IndexedDBTransaction* transaction,
                                           int64_t database_id,
                                           int64_t object_store_id,
                                           const IndexedDBKey& key,
                                           bool check_current) {
   DCHECK_EQ(WebIDBKeyTypeNumber, key.type());
+  // Maximum integer uniquely representable as ECMAScript number.
+  const double max_generator_value = 9007199254740992.0;
+  int64_t value = base::saturated_cast<int64_t>(
+      floor(std::min(key.number(), max_generator_value)));
   return backing_store->MaybeUpdateKeyGeneratorCurrentNumber(
       transaction->BackingStoreTransaction(), database_id, object_store_id,
-      static_cast<int64_t>(floor(key.number())) + 1, check_current);
+      value + 1, check_current);
 }
 
 struct IndexedDBDatabase::PutOperationParams {
   PutOperationParams() {}
   int64_t object_store_id;
   IndexedDBValue value;
   std::vector<std::unique_ptr<storage::BlobDataHandle>> handles;
   std::unique_ptr<IndexedDBKey> key;
   blink::WebIDBPutMode put_mode;
   scoped_refptr<IndexedDBCallbacks> callbacks;
@@ skipping 724 matching lines @@
   if (status.IsCorruption()) {
     IndexedDBDatabaseError error(blink::WebIDBDatabaseExceptionUnknownError,
                                  message);
     factory_->HandleBackingStoreCorruption(backing_store_->origin(), error);
   } else {
     factory_->HandleBackingStoreFailure(backing_store_->origin());
   }
 }
 
 }  // namespace content