MSE - Fix crash caused by incorrect GC of GOP with next buffer position

media/filters/source_buffer_range.h

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef MEDIA_FILTERS_SOURCE_BUFFER_RANGE_H_
 #define MEDIA_FILTERS_SOURCE_BUFFER_RANGE_H_
 
 #include <stddef.h>
 
 #include <map>
@@ skipping 96 matching lines @@
   // Returns true if everything in the range was deleted. Otherwise
   // returns false.
   bool TruncateAt(DecodeTimestamp timestamp,
                   BufferQueue* deleted_buffers, bool is_exclusive);
   // Deletes all buffers in range.
   void DeleteAll(BufferQueue* deleted_buffers);
 
   // Deletes a GOP from the front or back of the range and moves these
   // buffers into |deleted_buffers|. Returns the number of bytes deleted from
   // the range (i.e. the size in bytes of |deleted_buffers|).
+  // This range must NOT be empty when these methods are called.
+  // The GOP being deleted must NOT contain the next buffer position.
   size_t DeleteGOPFromFront(BufferQueue* deleted_buffers);
   size_t DeleteGOPFromBack(BufferQueue* deleted_buffers);
 
   // Gets the range of GOP to secure at least |bytes_to_free| from
   // [|start_timestamp|, |end_timestamp|).
   // Returns the size of the buffers to secure if the buffers of
   // [|start_timestamp|, |end_removal_timestamp|) is removed.
   // Will not update |end_removal_timestamp| if the returned size is 0.
   size_t GetRemovalGOP(
       DecodeTimestamp start_timestamp, DecodeTimestamp end_timestamp,
       size_t bytes_to_free, DecodeTimestamp* end_removal_timestamp);
 
+  // Returns true iff the buffered end time of the first GOP in this range is
+  // at or before |media_time|.
   bool FirstGOPEarlierThanMediaTime(DecodeTimestamp media_time) const;
 
   // Indicates whether the GOP at the beginning or end of the range contains the
   // next buffer position.
   bool FirstGOPContainsNextBufferPosition() const;
   bool LastGOPContainsNextBufferPosition() const;
 
   // Updates |out_buffer| with the next buffer in presentation order. Seek()
   // must be called before calls to GetNextBuffer(), and buffers are returned
   // in order from the last call to Seek(). Returns true if |out_buffer| is
@@ skipping 151 matching lines @@
 
   // Stores the amount of memory taken up by the data in |buffers_|.
   size_t size_in_bytes_;
 
   DISALLOW_COPY_AND_ASSIGN(SourceBufferRange);
 };
 
 }  // namespace media
 
 #endif  // MEDIA_FILTERS_SOURCE_BUFFER_RANGE_H_