Assertion failure: !mIsMapped (Someone forgot to call Unmap()) This assertion was added in https://hg.mozilla.org/mozilla-central/rev/856705b0c63f, not sure if the bug is a more recent regression.
Assignee: nobody → lsalzman
Status: NEW → ASSIGNED
The testcase causes an OOM allocating the destination array inside CanvasRenderingContext2D::GetImageDataArray. However, the source is mapped before this occurs, and not unmapped when the OOM is returned. To avoid this, this just moves the destination array allocation up before the map, so that if an OOM happens and returns, there is no mapped source lying around to be unmapped in the first place. With this patch, the test case no longer crashes.
Attachment #8637957 - Flags: review?(bas)
Attachment #8637957 - Flags: review?(bas) → review+
Attachment #8637957 - Flags: approval-mozilla-aurora?
can we get a try run here, thanks!
(In reply to Carsten Book [:Tomcat] from comment #3) > can we get a try run here, thanks! https://treeherder.mozilla.org/#/jobs?repo=try&revision=35567d4763d6
Comment on attachment 8637957 [details] [diff] [review] check for OOM on destination array before mapping source to avoid needing unmap Simple fix. Let's uplift to Aurora and hope it helps.
Attachment #8637957 - Flags: approval-mozilla-aurora? → approval-mozilla-aurora+
You need to log in before you can comment on or make changes to this bug.