diff --git a/dom/indexedDB/ActorsParent.cpp b/dom/indexedDB/ActorsParent.cpp
index c9babe13cc8..15097c87224 100644
--- a/dom/indexedDB/ActorsParent.cpp
+++ b/dom/indexedDB/ActorsParent.cpp
@@ -10628,8 +10628,8 @@ already_AddRefed<PBackgroundIDBCursorParent> TransactionBase::AllocCursor(
   if (NS_AUUF_OR_WARN_IF(!objectStoreMetadata)) {
     return nullptr;
   }
-  if (aTrustParams && NS_AUUF_OR_WARN_IF(!VerifyRequestParams(
-                          commonParams.optionalKeyRange()))) {
+  if (!aTrustParams && NS_AUUF_OR_WARN_IF(!VerifyRequestParams(
+                           commonParams.optionalKeyRange()))) {
     return nullptr;
   }
   direction = commonParams.direction();
@@ -19142,7 +19142,8 @@ nsresult ObjectStoreAddOrPutRequestOp::DoDatabaseWork(
 
         // Update index keys if primary key is preserved in child.
         for (auto& updateInfo : mParams.indexUpdateInfos()) {
-          updateInfo.value().MaybeUpdateAutoIncrementKey(autoIncrementNum);
+          QM_TRY(
+              updateInfo.value().MaybeUpdateAutoIncrementKey(autoIncrementNum));
         }
       } else if (key.IsFloat()) {
         double numericKey = key.ToFloat();
diff --git a/dom/indexedDB/Key.cpp b/dom/indexedDB/Key.cpp
index 33a4c27eed7..dd63b2ce75c 100644
--- a/dom/indexedDB/Key.cpp
+++ b/dom/indexedDB/Key.cpp
@@ -585,19 +585,34 @@ void Key::ReserveAutoIncrementKey(bool aFirstOfArray) {
   mozilla::BigEndian::writeUint64(buffer, UINT64_MAX);
 }
 
-void Key::MaybeUpdateAutoIncrementKey(int64_t aKey) {
+Result<Ok, nsresult> Key::MaybeUpdateAutoIncrementKey(int64_t aKey) {
   if (mAutoIncrementKeyOffsets.IsEmpty()) {
-    return;
+    return Ok{};
   }
 
+  static constexpr auto maxOffset =
+      KEY_MAXIMUM_BUFFER_LENGTH - sizeof(double) - 1;
+
   for (uint32_t offset : mAutoIncrementKeyOffsets) {
+    if (offset > maxOffset) {
+      return Err(NS_ERROR_DOM_INDEXEDDB_KEY_ERR);
+    }
+
     char* buffer;
-    MOZ_ALWAYS_TRUE(mBuffer.GetMutableData(&buffer));
+    const auto capacity = mBuffer.GetMutableData(&buffer);
+    MOZ_ALWAYS_TRUE(capacity);
+
+    if (offset + sizeof(double) > capacity) {
+      return Err(NS_ERROR_DOM_INDEXEDDB_KEY_ERR);
+    }
+
     buffer += offset;
     WriteDoubleToUint64(buffer, double(aKey));
   }
 
   TrimBuffer();
+
+  return Ok{};
 }
 
 void Key::WriteDoubleToUint64(char* aBuffer, double aValue) {
diff --git a/dom/indexedDB/Key.h b/dom/indexedDB/Key.h
index 18c4bb6600c..4d0ed5992e7 100644
--- a/dom/indexedDB/Key.h
+++ b/dom/indexedDB/Key.h
@@ -185,7 +185,7 @@ class Key {
 
   void ReserveAutoIncrementKey(bool aFirstOfArray);
 
-  void MaybeUpdateAutoIncrementKey(int64_t aKey);
+  Result<Ok, nsresult> MaybeUpdateAutoIncrementKey(int64_t aKey);
 
  private:
   class MOZ_STACK_CLASS ArrayValueEncoder;