Stowage/ladybird
2
0
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2025-10-19 15:43:20 +00:00
Code Issues Projects Releases Packages Wiki Activity

LibWeb/IDB: Adjust how negative numbers increment the key generator

Browse source 
Directly mapping a negative double to a u64 causes it to wrap around
to the max value. We work around this here by comparing as doubles,
and only incrementing the generator if the new value is greater

Fixes #6455
This commit is contained in:
stelar7 2025-10-13 10:14:56 +02:00 • committed by Sam Atkins
parent 207f313b4b
commit 61185d98aa
Notes: github-actions[bot] 2025-10-14 09:27:49 +00:00
1 changed files with 6 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

11
Libraries/LibWeb/IndexedDB/Internal/Algorithms.cpp
View file

@ -1293,20 +1293,21 @@ void possibly_update_the_key_generator(GC::Ref<ObjectStore> store, GC::Ref<Key>
return; return;
// 2. Let value be the value of key. // 2. Let value be the value of key.
auto temp_value = key->value_as_double(); auto value = key->value_as_double();
// 3. Set value to the minimum of value and 2^53 (9007199254740992). // 3. Set value to the minimum of value and 2^53 (9007199254740992).
temp_value = min(temp_value, MAX_KEY_GENERATOR_VALUE); value = min(value, MAX_KEY_GENERATOR_VALUE);
// 4. Set value to the largest integer not greater than value. // 4. Set value to the largest integer not greater than value.
u64 value = floor(temp_value); value = floor(value);
// 5. Let generator be store’s key generator. // 5. Let generator be store’s key generator.
auto& generator = store->key_generator(); auto& generator = store->key_generator();
// 6. If value is greater than or equal to generator’s current number, then set generator’s current number to value + 1. // 6. If value is greater than or equal to generator’s current number, then set generator’s current number to value + 1.
if (value >= generator.current_number()) if (value >= static_cast<double>(generator.current_number())) {
generator.set(value + 1); generator.set(static_cast<u64>(value + 1));
}
} }
// https://w3c.github.io/IndexedDB/#inject-a-key-into-a-value-using-a-key-path // https://w3c.github.io/IndexedDB/#inject-a-key-into-a-value-using-a-key-path