Indexed DB: Ensure large explicit keys consistently max out generator

content/browser/indexed_db/indexed_db_database.cc

Index: content/browser/indexed_db/indexed_db_database.cc
diff --git a/content/browser/indexed_db/indexed_db_database.cc b/content/browser/indexed_db/indexed_db_database.cc
index ca13e95dbc151c70c4cee6a548773d9e4f02b851..896ebd9fb33a7b34bb1bf52aaf14dfd28cd27d9f 100644
--- a/content/browser/indexed_db/indexed_db_database.cc
+++ b/content/browser/indexed_db/indexed_db_database.cc
@@ -6,6 +6,7 @@
 
 #include <math.h>
 
+#include <algorithm>
 #include <limits>
 #include <set>
 
@@ -1201,6 +1202,10 @@ static std::unique_ptr<IndexedDBKey> GenerateKey(
   return base::MakeUnique<IndexedDBKey>(current_number, WebIDBKeyTypeNumber);
 }
 
+// Called at the end of a "put" operation. The key is a number that was either
+// generated by the generator which now needs to be incremented (so
+// |check_current| is false) or was user-supplied so we only conditionally use
+// (and |check_current| is true).
 static leveldb::Status UpdateKeyGenerator(IndexedDBBackingStore* backing_store,
                                           IndexedDBTransaction* transaction,
                                           int64_t database_id,
@@ -1208,9 +1213,13 @@ static leveldb::Status UpdateKeyGenerator(IndexedDBBackingStore* backing_store,
                                           const IndexedDBKey& key,
                                           bool check_current) {
   DCHECK_EQ(WebIDBKeyTypeNumber, key.type());
+  // Maximum integer storable as ECMAScript number.

[pwnall, 2017/03/07 19:42:41]

Technically not true, 9007199254740994 can also be stored. I suspect you mean
it's the top of the interval of integers w/ the property that all interval
members can be stored. I wonder if it'd be easier to say this is
Number.MAX_SAFE_INTEGER + 1, and which gives a good hint to the interested
reader, who can then Google for the details.

[jsbell, 2017/03/07 20:27:57]

Yeah, bad comment (copied pasted from above). Needs the qualifier "uniquely";
fixed both.

+  const double max_generator_value = 9007199254740992.0;
+  int64_t value = base::saturated_cast<int64_t>(
+      floor(std::min(key.number(), max_generator_value)));
   return backing_store->MaybeUpdateKeyGeneratorCurrentNumber(
       transaction->BackingStoreTransaction(), database_id, object_store_id,
-      static_cast<int64_t>(floor(key.number())) + 1, check_current);
+      value + 1, check_current);
 }
 
 struct IndexedDBDatabase::PutOperationParams {