In `bun:sqlite`, make sure we set the number tag correctly when creating the JSValue (#5655)

* Make sure we set the number tag correctly when returning values from SQLite

* Add DOMJIT test

* Update JSSQLStatement.cpp

---------

Co-authored-by: Jarred Sumner <709451+Jarred-Sumner@users.noreply.github.com>

2 files changed, 17 insertions, 5 deletions

diff --git a/src/bun.js/bindings/sqlite/JSSQLStatement.cpp b/src/bun.js/bindings/sqlite/JSSQLStatement.cpp
index 8519cb2e2..e36d2b809 100644
--- a/src/bun.js/bindings/sqlite/JSSQLStatement.cpp
+++ b/src/bun.js/bindings/sqlite/JSSQLStatement.cpp
@@ -83,6 +83,11 @@ static JSC_DECLARE_CUSTOM_GETTER(jsSqlStatementGetColumnCount);
 
 static JSC_DECLARE_HOST_FUNCTION(jsSQLStatementSerialize);
 static JSC_DECLARE_HOST_FUNCTION(jsSQLStatementDeserialize);
+static inline JSC::JSValue jsNumberFromSQLite(sqlite3_stmt* stmt, unsigned int i)
+{
+    int64_t num = sqlite3_column_int64(stmt, i);
+    return num > INT_MAX || num < INT_MIN ? JSC::jsDoubleNumber(static_cast<double>(num)) : JSC::jsNumber(static_cast<int>(num));
+}
 
 #define CHECK_THIS                                                                                               \
     if (UNLIKELY(!castedThis)) {                                                                                 \
@@ -1090,7 +1095,7 @@ static inline JSC::JSValue constructResultObject(JSC::JSGlobalObject* lexicalGlo
             switch (sqlite3_column_type(stmt, i)) {
             case SQLITE_INTEGER: {
                 // https://github.com/oven-sh/bun/issues/1536
-                value = jsNumber(sqlite3_column_int64(stmt, i));
+                value = jsNumberFromSQLite(stmt, i);
                 break;
             }
             case SQLITE_FLOAT: {
@@ -1146,11 +1151,11 @@ static inline JSC::JSValue constructResultObject(JSC::JSGlobalObject* lexicalGlo
             switch (sqlite3_column_type(stmt, i)) {
             case SQLITE_INTEGER: {
                 // https://github.com/oven-sh/bun/issues/1536
-                result->putDirect(vm, name, jsNumber(sqlite3_column_int64(stmt, i)), 0);
+                result->putDirect(vm, name, jsNumberFromSQLite(stmt, i), 0);
                 break;
             }
             case SQLITE_FLOAT: {
-                result->putDirect(vm, name, jsNumber(sqlite3_column_double(stmt, i)), 0);
+                result->putDirect(vm, name, jsDoubleNumber(sqlite3_column_double(stmt, i)), 0);
                 break;
             }
             // > Note that the SQLITE_TEXT constant was also used in SQLite version
@@ -1205,11 +1210,11 @@ static inline JSC::JSArray* constructResultRow(JSC::JSGlobalObject* lexicalGloba
         switch (sqlite3_column_type(stmt, i)) {
         case SQLITE_INTEGER: {
             // https://github.com/oven-sh/bun/issues/1536
-            result->putDirectIndex(lexicalGlobalObject, i, jsNumber(sqlite3_column_int64(stmt, i)));
+            result->putDirectIndex(lexicalGlobalObject, i, jsNumberFromSQLite(stmt, i));
             break;
         }
         case SQLITE_FLOAT: {
-            result->putDirectIndex(lexicalGlobalObject, i, jsNumber(sqlite3_column_double(stmt, i)));
+            result->putDirectIndex(lexicalGlobalObject, i, jsDoubleNumber(sqlite3_column_double(stmt, i)));
             break;
         }
         // > Note that the SQLITE_TEXT constant was also used in SQLite version
diff --git a/test/js/bun/sqlite/sqlite.test.js b/test/js/bun/sqlite/sqlite.test.js
index 7998f7469..6bd72d8a8 100644
--- a/test/js/bun/sqlite/sqlite.test.js
+++ b/test/js/bun/sqlite/sqlite.test.js
@@ -347,6 +347,13 @@ it("db.query()", () => {
     ),
   ).toBe(JSON.stringify([{ id: 1, name: "Hello" }]));
 
+  const domjit = db.query("SELECT * FROM test");
+  (function (domjit) {
+    for (let i = 0; i < 100000; i++) {
+      domjit.get().name;
+    }
+  })(domjit);
+
   db.close();
 
   // Check that a closed database doesn't crash