Destroy window before cleaning up combobox

fpdfsdk/formfiller/cffl_formfiller.h

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #ifndef FPDFSDK_FORMFILLER_CFFL_FORMFILLER_H_
 #define FPDFSDK_FORMFILLER_CFFL_FORMFILLER_H_
 
 #include <map>
@@ skipping 136 matching lines @@
   virtual void InvalidateRect(double left,
                               double top,
                               double right,
                               double bottom);
   CPDFDoc_Environment* GetApp() { return m_pApp; }
   CPDFSDK_Annot* GetSDKAnnot() { return m_pAnnot; }
 
  protected:
   using CFFL_PageView2PDFWindow = std::map<CPDFSDK_PageView*, CPWL_Wnd*>;
 
+  // If the inheriting widget has its own fontmap and a PWL_Edit widget that
+  // access that fontmap then you have to call DestroyWindows before destroying
+  // the font map in order to not get a use-after-free.
+  //
+  // The font map should be stored somewhere more appropriate so it will live
+  // until the PWL_Edit is done with it. pdfium:566
+  void DestroyWindows();
+
   CPDFDoc_Environment* m_pApp;
   CPDFSDK_Widget* m_pWidget;
   CPDFSDK_Annot* m_pAnnot;
 
   FX_BOOL m_bValid;
   CFFL_PageView2PDFWindow m_Maps;
   CFX_FloatPoint m_ptOldPos;
 };
 
 class CFFL_Button : public CFFL_FormFiller {
@@ skipping 27 matching lines @@
                       CFX_RenderDevice* pDevice,
                       CFX_Matrix* pUser2Device,
                       uint32_t dwFlags) override;
 
  protected:
   FX_BOOL m_bMouseIn;
   FX_BOOL m_bMouseDown;
 };
 
 #endif  // FPDFSDK_FORMFILLER_CFFL_FORMFILLER_H_