Reland; Pepper: Var keeps invalid var_id if VarTracker release it and there is another reference

When VarTracker remove PP_Var from VarMap, it release its Var object
if needed, but never reset var_id stored in Var object. Then, if Var's
reference count is not 1, Var continue to exist with invalid var_id until
the last reference is released.

BUG=87310
TEST=ui_tests, browser_tests, nacl_integration

Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=114384

Review URL: http://codereview.chromium.org/8872065

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@114594 0039d316-1c4b-4281-b951-d872f2087c98

ppapi/shared_impl/var.h

@@ -17,6 +17,7 @@ namespace ppapi {
 class NPObjectVar;
 class ProxyObjectVar;
 class StringVar;
+class VarTracker;
 
 // Var -------------------------------------------------------------------------
 
@@ -48,6 +49,8 @@ class PPAPI_SHARED_EXPORT Var : public base::RefCounted<Var> {
   int32 GetExistingVarID() const;
 
  protected:
+  friend class VarTracker;
+
   Var();
 
   // Returns the unique ID associated with this string or object, creating it
@@ -62,6 +65,9 @@ class PPAPI_SHARED_EXPORT Var : public base::RefCounted<Var> {
   // before. This is used in cases where the ID is generated externally.
   void AssignVarID(int32 id);
 
+  // Reset the assigned object ID.
+  void ResetVarID() { var_id_ = 0; }
+
  private:
   // This will be 0 if no ID has been assigned (this happens lazily).
   int32 var_id_;

ppapi/shared_impl/var_tracker.cc

@@ -100,6 +100,7 @@ bool VarTracker::ReleaseVar(int32 var_id) {
     } else {
       // All other var types can just be released.
       DCHECK(info.track_with_no_reference_count == 0);
+      info.var->ResetVarID();
       live_vars_.erase(found);
     }
   }