[Rollback] Fix crash when removing a track being rolled back.

Fixes https://crbug.com/1029641 and adds WPT test coverage.

Spec for removeTrack, which explicitly handles removeTrack by aborting:
https://w3c.github.io/webrtc-pc/#dom-rtcpeerconnection-removetrack

Bug: 1029641
Change-Id: I2c52e6711d34e0be25fad2681457eaf1eccc8f7f
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1962245
Commit-Queue: Henrik Boström <hbos@chromium.org>
Reviewed-by: Guido Urdaneta <guidou@chromium.org>
Cr-Commit-Position: refs/heads/master@{#723833}

webrtc/RTCPeerConnection-setRemoteDescription-rollback.html

@@ -538,4 +538,17 @@
 
   }, "rollback of a remote offer with stream changes");
 
+  promise_test(async t => {
+    const pc1 = new RTCPeerConnection();
+    t.add_cleanup(() => pc1.close());
+    const pc2 = new RTCPeerConnection();
+    t.add_cleanup(() => pc2.close());
+    pc2.addTransceiver('audio');
+    const offer = await pc2.createOffer();
+    await pc1.setRemoteDescription(offer);
+    const [transceiver] = pc1.getTransceivers();
+    pc1.setRemoteDescription({type:'rollback'});
+    pc1.removeTrack(transceiver.sender);
+  }, 'removeTrack() with a sender being rolled back does not crash or throw');
+
 </script>