Reland; Pepper: Var keeps invalid var_id if VarTracker release it and there is another reference

When VarTracker remove PP_Var from VarMap, it release its Var object
if needed, but never reset var_id stored in Var object. Then, if Var's
reference count is not 1, Var continue to exist with invalid var_id until
the last reference is released.

BUG=87310
TEST=ui_tests, browser_tests, nacl_integration

Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=114384

Review URL: http://codereview.chromium.org/8872065

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@114594 0039d316-1c4b-4281-b951-d872f2087c98

2 files changed, 7 insertions, 0 deletions

diff --git a/ppapi/shared_impl/var.h b/ppapi/shared_impl/var.h
index 988898a0..49b9272 100644
--- a/ppapi/shared_impl/var.h
+++ b/ppapi/shared_impl/var.h
@@ -17,6 +17,7 @@ namespace ppapi {
 class NPObjectVar;
 class ProxyObjectVar;
 class StringVar;
+class VarTracker;
 
 // Var -------------------------------------------------------------------------
 
@@ -48,6 +49,8 @@ class PPAPI_SHARED_EXPORT Var : public base::RefCounted<Var> {
   int32 GetExistingVarID() const;
 
  protected:
+  friend class VarTracker;
+
   Var();
 
   // Returns the unique ID associated with this string or object, creating it
@@ -62,6 +65,9 @@ class PPAPI_SHARED_EXPORT Var : public base::RefCounted<Var> {
   // before. This is used in cases where the ID is generated externally.
   void AssignVarID(int32 id);
 
+  // Reset the assigned object ID.
+  void ResetVarID() { var_id_ = 0; }
+
  private:
   // This will be 0 if no ID has been assigned (this happens lazily).
   int32 var_id_;
diff --git a/ppapi/shared_impl/var_tracker.cc b/ppapi/shared_impl/var_tracker.cc
index 7f7157e..d95a759 100644
--- a/ppapi/shared_impl/var_tracker.cc
+++ b/ppapi/shared_impl/var_tracker.cc
@@ -100,6 +100,7 @@ bool VarTracker::ReleaseVar(int32 var_id) {
     } else {
       // All other var types can just be released.
       DCHECK(info.track_with_no_reference_count == 0);
+      info.var->ResetVarID();
       live_vars_.erase(found);
     }
   }