Fix crashes caused when SourceBuffer.remove() is called starting at the presentation duration.

media/filters/source_buffer_stream.cc

Index: media/filters/source_buffer_stream.cc
diff --git a/media/filters/source_buffer_stream.cc b/media/filters/source_buffer_stream.cc
index 7c66f28f059c37894477984355f38513fb875e9d..c177bab5db348ddf80dd84d39fe3289fafecc592 100644
--- a/media/filters/source_buffer_stream.cc
+++ b/media/filters/source_buffer_stream.cc
@@ -589,6 +589,8 @@ void SourceBufferStream::Remove(base::TimeDelta start, base::TimeDelta end,
   DCHECK(start < end) << "start " << start.InSecondsF()
                       << " end " << end.InSecondsF();
   DCHECK(duration != kNoTimestamp());
+  DCHECK(start <= duration) << "start " << start.InSecondsF()
+                            << " duration " << duration.InSecondsF();
 
   base::TimeDelta remove_end_timestamp = duration;
   base::TimeDelta keyframe_timestamp = FindKeyframeAfterTimestamp(end);
@@ -598,6 +600,9 @@ void SourceBufferStream::Remove(base::TimeDelta start, base::TimeDelta end,
     remove_end_timestamp = end;
   }
 
+  if (start == remove_end_timestamp)

[wolenetz, 2014/06/05 21:38:03]

remove_end_timestamp is either duration (in which case, if start is also
duration, we should fail DCHECK above, already); or |end| which is less than
|duration| (in which case, if start is == end, we should fail the same DCHECK
above, already); or a keyframe timestamp beyond the original end and DCHECK
passes and start < remove_end_timestamp.

So, does this change focus only on fixing release mode crashes where either:
1. start == duration (caller can protect against this)
2. start == end (caller can protect against this)
3. start > end (and a keyframe exists beyond end at 'start' time): caller can
protect against this, too.

I think I'm missing the reason why caller isn't doing the work here.

[acolwell GONE FROM CHROMIUM, 2014/06/05 22:56:25]

I moved this to ChunkDemuxer::Remove(). I can't go any higher than that right
now because that is where the authoritative duration information lives.

+    return;
+
   BufferQueue deleted_buffers;
   RemoveInternal(start, remove_end_timestamp, false, &deleted_buffers);