MSE - Fix crash caused by incorrect GC of GOP with next buffer position

media/filters/source_buffer_range.cc

Index: media/filters/source_buffer_range.cc
diff --git a/media/filters/source_buffer_range.cc b/media/filters/source_buffer_range.cc
index bd99bc01d3c395d099b061d94fda12607ba05818..6e664f974854dca4a1e9d8fdf8202fd049985128 100644
--- a/media/filters/source_buffer_range.cc
+++ b/media/filters/source_buffer_range.cc
@@ -231,6 +231,7 @@ bool SourceBufferRange::TruncateAt(
 }
 
 size_t SourceBufferRange::DeleteGOPFromFront(BufferQueue* deleted_buffers) {
+  DCHECK(!buffers_.empty());
   DCHECK(!FirstGOPContainsNextBufferPosition());
   DCHECK(deleted_buffers);
 
@@ -279,6 +280,7 @@ size_t SourceBufferRange::DeleteGOPFromFront(BufferQueue* deleted_buffers) {
 }
 
 size_t SourceBufferRange::DeleteGOPFromBack(BufferQueue* deleted_buffers) {
+  DCHECK(!buffers_.empty());
   DCHECK(!LastGOPContainsNextBufferPosition());
   DCHECK(deleted_buffers);
 
@@ -351,7 +353,7 @@ size_t SourceBufferRange::GetRemovalGOP(
 bool SourceBufferRange::FirstGOPEarlierThanMediaTime(
     DecodeTimestamp media_time) const {
   if (keyframe_map_.size() == 1u)
-    return (GetEndTimestamp() < media_time);
+    return (GetBufferedEndTimestamp() <= media_time);
 
   KeyframeMap::const_iterator second_gop = keyframe_map_.begin();
   ++second_gop;