Fix some egregious bugs in Var.

ppapi/cpp/var.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ppapi/cpp/var.h"
 
 #include <stdio.h>
 #include <string.h>
 
 #include <algorithm>
@@ skipping 99 matching lines @@
     needs_release_ = false;
   }
 }
 
 Var::~Var() {
   if (needs_release_ && has_interface<PPB_Var>())
     get_interface<PPB_Var>()->Release(var_);
 }
 
 Var& Var::operator=(const Var& other) {
-  if (needs_release_ && has_interface<PPB_Var>())
-    get_interface<PPB_Var>()->Release(var_);
-  var_ = other.var_;
-  if (NeedsRefcounting(var_)) {
-    if (has_interface<PPB_Var>()) {
-      needs_release_ = true;
-      get_interface<PPB_Var>()->AddRef(var_);
-    } else {
-      var_.type = PP_VARTYPE_NULL;
-      needs_release_ = false;
-    }
+  // Be careful to keep the ref alive for cases where we're assigning an
+  // object to itself by addrefing the new one before releasing the old one.
+  bool old_needs_release = needs_release_;
+  if (NeedsRefcounting(other.var_)) {
+    // Assume we already has_interface<PPB_Var> for refcounted vars or else we
+    // couldn't have created them in the first place.
+    needs_release_ = true;
+    get_interface<PPB_Var>()->AddRef(other.var_);
   } else {
     needs_release_ = false;
   }
+  if (old_needs_release)
+    get_interface<PPB_Var>()->Release(var_);
+
+  var_ = other.var_;
   return *this;
 }
 
 bool Var::operator==(const Var& other) const {
   if (var_.type != other.var_.type)
     return false;
   switch (var_.type) {
     case PP_VARTYPE_UNDEFINED:
     case PP_VARTYPE_NULL:
       return true;
@@ skipping 76 matching lines @@
       str.append("...");
     }
     snprintf(buf, sizeof(buf), format, str.c_str());
   } else if (is_object()) {
     snprintf(buf, sizeof(buf), "Var<OBJECT>");
   }
   return buf;
 }
 
 }  // namespace pp