Reset notify parameter in CPWL_ListBox OnDestroy().

fpdfsdk/pdfwindow/PWL_ListBox.cpp

Index: fpdfsdk/pdfwindow/PWL_ListBox.cpp
diff --git a/fpdfsdk/pdfwindow/PWL_ListBox.cpp b/fpdfsdk/pdfwindow/PWL_ListBox.cpp
index e8c1f82bdef31be056bfb0696547dd568dec9e56..c8a554b0f8f5619224778f4cbb3457fe92892577 100644
--- a/fpdfsdk/pdfwindow/PWL_ListBox.cpp
+++ b/fpdfsdk/pdfwindow/PWL_ListBox.cpp
@@ -94,6 +94,10 @@ void CPWL_ListBox::OnCreated() {
 }
 
 void CPWL_ListBox::OnDestroy() {
+  // Make sure the notifier is removed from the list as we are about to
+  // destroy the notifier and don't want to leave a dangling pointer.
+  if (m_pList)
+    m_pList->SetNotify(nullptr);
   m_pListNotify.reset();
 }