command buffers: correctly handle Flush(num_entries)

gpu/command_buffer/service/command_buffer_service.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "gpu/command_buffer/service/command_buffer_service.h"
 
 #include <stddef.h>
 #include <stdint.h>
 
 #include <limits>
@@ skipping 69 matching lines @@
 
 void CommandBufferService::WaitForTokenInRange(int32_t start, int32_t end) {
   DCHECK(error_ != error::kNoError || InRange(start, end, token_));
 }
 
 void CommandBufferService::WaitForGetOffsetInRange(int32_t start, int32_t end) {
   DCHECK(error_ != error::kNoError || InRange(start, end, get_offset_));
 }
 
 void CommandBufferService::Flush(int32_t put_offset) {
-  if (put_offset < 0 || put_offset > num_entries_) {
+  if (put_offset < 0 || put_offset >= num_entries_) {
     error_ = gpu::error::kOutOfBounds;
     return;
   }
 
   put_offset_ = put_offset;
 
   if (!put_offset_change_callback_.is_null())
     put_offset_change_callback_.Run();
 }
 
@@ skipping 112 matching lines @@
     const GetBufferChangedCallback& callback) {
   get_buffer_change_callback_ = callback;
 }
 
 void CommandBufferService::SetParseErrorCallback(
     const base::Closure& callback) {
   parse_error_callback_ = callback;
 }
 
 }  // namespace gpu