Assertion failure: !mIsMapped (Someone forgot to call Unmap()) This assertion was added in https://hg.mozilla.org/mozilla-central/rev/856705b0c63f, not sure if the bug is a more recent regression.

The testcase causes an OOM allocating the destination array inside CanvasRenderingContext2D::GetImageDataArray. However, the source is mapped before this occurs, and not unmapped when the OOM is returned. To avoid this, this just moves the destination array allocation up before the map, so that if an OOM happens and returns, there is no mapped source lying around to be unmapped in the first place. With this patch, the test case no longer crashes.

Comment on attachment 8637957 [details] [diff] [review] check for OOM on destination array before mapping source to avoid needing unmap Approval Request Comment [Feature/regressing bug #]: https://hg.mozilla.org/mozilla-central/rev/536bd9910bc2 [User impact if declined]: JavaScript canvas2d code can be used to crash Firefox. [Describe test coverage new/current, TreeHerder]: dom/canvas/test [Risks and why]: Doesn't change code behavior, just causes OOM to be signaled earlier so as to avoid triggering assertion. Since the crash goes away once patched, we can assume the OOM is being handled properly now since no assertions are getting hit anymore. [String/UUID change made/needed]: None

can we get a try run here, thanks!

(In reply to Carsten Book [:Tomcat] from comment #3) > can we get a try run here, thanks! https://treeherder.mozilla.org/#/jobs?repo=try&revision=35567d4763d6

Comment on attachment 8637957 [details] [diff] [review] check for OOM on destination array before mapping source to avoid needing unmap Simple fix. Let's uplift to Aurora and hope it helps.