Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 986e5185e1c1450f95dd8746a3c2a63d8cd40a86
https://github.com/WebKit/WebKit/commit/986e5185e1c1450f95dd8746a3c2a63d8cd40a86
Author: Ahmad Saleem <[email protected]>
Date: 2026-07-13 (Mon, 13 Jul 2026)
Changed paths:
M Source/WebCore/Modules/indexeddb/server/SQLiteIDBBackingStore.cpp
Log Message:
-----------
IndexedDB getCount() truncates record counts above INT_MAX
https://bugs.webkit.org/show_bug.cgi?id=319222
rdar://182075709
Reviewed by Chris Dumez.
SQLiteIDBBackingStore::getCount() writes the record count into a
uint64_t out-parameter, and SQLite's COUNT(*) is a 64-bit integer,
but the result was read with columnInt(), which returns a 32-bit int.
A count above INT_MAX would be truncated (and sign-extended into a
bogus large value). Read the column with columnInt64() instead,
matching uncheckedGetKeyGeneratorValue() just below it.
No new tests; triggering truncation requires more than 2^31 records
in a single object store, which is not practical to exercise in a
test.
* Source/WebCore/Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
(WebCore::IDBServer::SQLiteIDBBackingStore::getCount):
Canonical link: https://commits.webkit.org/317026@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
