Handle exception when user call canvas.transferControlToOffscreen() twice

third_party/WebKit/Source/modules/canvas/HTMLCanvasElementModule.cpp

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "modules/canvas/HTMLCanvasElementModule.h"
 
 #include "core/dom/DOMNodeIds.h"
 #include "core/html/canvas/CanvasContextCreationAttributes.h"
 #include "core/html/canvas/CanvasRenderingContext.h"
 #include "core/offscreencanvas/OffscreenCanvas.h"
@@ skipping 19 matching lines @@
   CanvasRenderingContext* context =
       canvas.getCanvasRenderingContext(type, attributes);
   if (context) {
     context->setCanvasGetContextResult(result);
   }
 }
 
 OffscreenCanvas* HTMLCanvasElementModule::transferControlToOffscreen(
     HTMLCanvasElement& canvas,
     ExceptionState& exceptionState) {
+  if (canvas.surfaceLayerBridge()) {
+    exceptionState.throwDOMException(
+        InvalidStateError,
+        "Cannot transfer control from a canvas for more than one time.");
+    return nullptr;
+  }
+
   if (!canvas.createSurfaceLayer()) {
     exceptionState.throwDOMException(
         V8Error,
         "Offscreen canvas creation failed due to an internal timeout.");
     return nullptr;
   }
 
   return transferControlToOffscreenInternal(canvas, exceptionState);
 }
 
@@ skipping 16 matching lines @@
     // and its SurfaceId has been populated as well.
     offscreenCanvas->setSurfaceId(
         bridge->getSurfaceId().frame_sink_id().client_id(),
         bridge->getSurfaceId().frame_sink_id().sink_id(),
         bridge->getSurfaceId().local_frame_id().local_id(),
         bridge->getSurfaceId().local_frame_id().nonce());
   }
   return offscreenCanvas;
 }
 }