MSE - Fix crash caused by incorrect GC of GOP with next buffer position

media/filters/source_buffer_range.h

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef MEDIA_FILTERS_SOURCE_BUFFER_RANGE_H_
 #define MEDIA_FILTERS_SOURCE_BUFFER_RANGE_H_
 
 #include <stddef.h>
 
 #include <map>
@@ skipping 96 matching lines @@
   // Returns true if everything in the range was deleted. Otherwise
   // returns false.
   bool TruncateAt(DecodeTimestamp timestamp,
                   BufferQueue* deleted_buffers, bool is_exclusive);
   // Deletes all buffers in range.
   void DeleteAll(BufferQueue* deleted_buffers);
 
   // Deletes a GOP from the front or back of the range and moves these
   // buffers into |deleted_buffers|. Returns the number of bytes deleted from
   // the range (i.e. the size in bytes of |deleted_buffers|).
+  // This range must NOT be empty when these methods are called.
+  // The GOP being deleted must NOT contain the next buffer position.
   size_t DeleteGOPFromFront(BufferQueue* deleted_buffers);
   size_t DeleteGOPFromBack(BufferQueue* deleted_buffers);
 
   // Gets the range of GOP to secure at least |bytes_to_free| from
   // [|start_timestamp|, |end_timestamp|).
   // Returns the size of the buffers to secure if the buffers of
   // [|start_timestamp|, |end_removal_timestamp|) is removed.
   // Will not update |end_removal_timestamp| if the returned size is 0.
   size_t GetRemovalGOP(
       DecodeTimestamp start_timestamp, DecodeTimestamp end_timestamp,
@@ skipping 163 matching lines @@
 
   // Stores the amount of memory taken up by the data in |buffers_|.
   size_t size_in_bytes_;
 
   DISALLOW_COPY_AND_ASSIGN(SourceBufferRange);
 };
 
 }  // namespace media
 
 #endif  // MEDIA_FILTERS_SOURCE_BUFFER_RANGE_H_