Disallow users modify canvas after it transfers control to offscreen

third_party/WebKit/Source/modules/canvas/HTMLCanvasElementModule.cpp

Index: third_party/WebKit/Source/modules/canvas/HTMLCanvasElementModule.cpp
diff --git a/third_party/WebKit/Source/modules/canvas/HTMLCanvasElementModule.cpp b/third_party/WebKit/Source/modules/canvas/HTMLCanvasElementModule.cpp
index e673f25d2fb1e24173f604a6aec06cb0bb484ecd..60f2cdbf7bcbe8c8f32ea0d7cdcc0bcf482435f9 100644
--- a/third_party/WebKit/Source/modules/canvas/HTMLCanvasElementModule.cpp
+++ b/third_party/WebKit/Source/modules/canvas/HTMLCanvasElementModule.cpp
@@ -11,8 +11,14 @@
 
 namespace blink {
 
-void HTMLCanvasElementModule::getContext(HTMLCanvasElement& canvas, const String& type, const CanvasContextCreationAttributes& attributes, RenderingContext& result)
+void HTMLCanvasElementModule::getContext(HTMLCanvasElement& canvas, const String& type, const CanvasContextCreationAttributes& attributes, ExceptionState& exceptionState, RenderingContext& result)
 {
+    if (canvas.surfaceLayerBridge()) {
+        // The existence of canvas surfaceLayerBridge indicates that HTMLCanvasElement.transferControlToOffscreen() has been called.
+        exceptionState.throwDOMException(InvalidStateError, "Cannot get context from a canvas that has transferred its control to offscreen.");
+        return;
+    }
+
     CanvasRenderingContext* context = canvas.getCanvasRenderingContext(type, attributes);
     if (context) {
         context->setCanvasGetContextResult(result);