Disallow users modify canvas after it transfers control to offscreen

third_party/WebKit/Source/modules/canvas/HTMLCanvasElementModule.cpp

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "modules/canvas/HTMLCanvasElementModule.h"
 
 #include "core/dom/DOMNodeIds.h"
 #include "core/html/canvas/CanvasContextCreationAttributes.h"
 #include "core/html/canvas/CanvasRenderingContext.h"
 #include "core/offscreencanvas/OffscreenCanvas.h"
 
 namespace blink {
 
-void HTMLCanvasElementModule::getContext(HTMLCanvasElement& canvas, const String& type, const CanvasContextCreationAttributes& attributes, RenderingContext& result)
+void HTMLCanvasElementModule::getContext(HTMLCanvasElement& canvas, const String& type, const CanvasContextCreationAttributes& attributes, ExceptionState& exceptionState, RenderingContext& result)
 {
+    if (canvas.surfaceLayerBridge()) {
+        // The existence of canvas surfaceLayerBridge indicates that HTMLCanvasElement.transferControlToOffscreen() has been called.
+        exceptionState.throwDOMException(InvalidStateError, "Cannot get context from a canvas that has transferred its control to offscreen.");
+    }
+
     CanvasRenderingContext* context = canvas.getCanvasRenderingContext(type, attributes);
     if (context) {
         context->setCanvasGetContextResult(result);
     }
 }
 
 OffscreenCanvas* HTMLCanvasElementModule::transferControlToOffscreen(HTMLCanvasElement& canvas, ExceptionState& exceptionState)
 {
     if (!canvas.createSurfaceLayer()) {
         exceptionState.throwDOMException(V8Error, "Offscreen canvas creation failed due to an internal timeout.");
@@ skipping 15 matching lines @@
     CanvasSurfaceLayerBridge* bridge = canvas.surfaceLayerBridge();
     if (bridge) {
         // If a bridge exists, it means canvas.createSurfaceLayer() has been called
         // and its SurfaceId has been populated as well.
         offscreenCanvas->setSurfaceId(bridge->getSurfaceId().client_id(), bridge->getSurfaceId().local_id(), bridge->getSurfaceId().nonce());
     }
     return offscreenCanvas;
 }
 
 }