content: Fix problem with implementation of MergeIntoFreeList.

content/common/discardable_shared_memory_heap.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/common/discardable_shared_memory_heap.h"
 
 #include "base/memory/discardable_shared_memory.h"
 
 namespace content {
 namespace {
@@ skipping 57 matching lines @@
 
 void DiscardableSharedMemoryHeap::MergeIntoFreeList(scoped_ptr<Span> span) {
   DCHECK(span->shared_memory_);
 
   // Merge with previous span if possible.
   SpanMap::iterator prev_it = spans_.find(span->start_ - 1);
   if (prev_it != spans_.end() && IsInFreeList(prev_it->second)) {
     scoped_ptr<Span> prev = RemoveFromFreeList(prev_it->second);
     DCHECK_EQ(prev->start_ + prev->length_, span->start_);
     UnregisterSpan(prev.get());
-    spans_.erase(span->start_);
+    if (span->length_ > 1)
+      spans_.erase(span->start_);
     span->start_ -= prev->length_;
     span->length_ += prev->length_;
     spans_[span->start_] = span.get();
   }
 
   // Merge with next span if possible.
   SpanMap::iterator next_it = spans_.find(span->start_ + span->length_);
   if (next_it != spans_.end() && IsInFreeList(next_it->second)) {
     scoped_ptr<Span> next = RemoveFromFreeList(next_it->second);
     DCHECK_EQ(next->start_, span->start_ + span->length_);
@@ skipping 133 matching lines @@
 
     offset += span->length_;
 
     // If |span| is in the free list, remove it.
     if (IsInFreeList(span))
       RemoveFromFreeList(span);
   }
 }
 
 }  // namespace content