Reset notify parameter in CPWL_ListBox OnDestroy().

fpdfsdk/pdfwindow/PWL_ListBox.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "fpdfsdk/pdfwindow/PWL_ListBox.h"
 
 #include "fpdfsdk/fxedit/include/fxet_edit.h"
 #include "fpdfsdk/fxedit/include/fxet_list.h"
@@ skipping 76 matching lines @@
 
     SetHoverSel(HasFlag(PLBS_HOVERSEL));
     m_pList->SetMultipleSel(HasFlag(PLBS_MULTIPLESEL));
     m_pList->SetFontSize(GetCreationParam().fFontSize);
 
     m_bHoverSel = HasFlag(PLBS_HOVERSEL);
   }
 }
 
 void CPWL_ListBox::OnDestroy() {
+  // Make sure the notifier is removed from the list as we are about to
+  // destroy the notifier and don't want to leave a dangling pointer.
+  if (m_pList)
+    m_pList->SetNotify(nullptr);
   m_pListNotify.reset();
 }
 
 void CPWL_ListBox::GetThisAppearanceStream(CFX_ByteTextBuf& sAppStream) {
   CPWL_Wnd::GetThisAppearanceStream(sAppStream);
 
   CFX_ByteTextBuf sListItems;
 
   if (m_pList) {
     CFX_FloatRect rcPlate = m_pList->GetPlateRect();
@@ skipping 415 matching lines @@
   if (zDelta < 0) {
     m_pList->OnVK_DOWN(IsSHIFTpressed(nFlag), IsCTRLpressed(nFlag));
   } else {
     m_pList->OnVK_UP(IsSHIFTpressed(nFlag), IsCTRLpressed(nFlag));
   }
 
   FX_BOOL bExit = FALSE;
   OnNotifySelChanged(FALSE, bExit, nFlag);
   return TRUE;
 }