4 files changed, 32 insertions, 42 deletions

diff --git a/core/fpdfdoc/cpdf_variabletext.cpp b/core/fpdfdoc/cpdf_variabletext.cpp
index 31f09c9dcd..ddc3bb4459 100644
--- a/core/fpdfdoc/cpdf_variabletext.cpp
+++ b/core/fpdfdoc/cpdf_variabletext.cpp
@@ -178,22 +178,9 @@ bool CPDF_VariableText::Iterator::GetLine(CPVT_Line& line) const {
   return true;
 }
 
-CPDF_VariableText::CPDF_VariableText()
-    : m_nLimitChar(0),
-      m_nCharArray(0),
-      m_bMultiLine(false),
-      m_bLimitWidth(false),
-      m_bAutoFontSize(false),
-      m_nAlignment(0),
-      m_fLineLeading(0.0f),
-      m_fCharSpace(0.0f),
-      m_nHorzScale(100),
-      m_wSubWord(0),
-      m_fFontSize(0.0f),
-      m_bInitialized(false),
-      m_pVTProvider(nullptr) {}
-
-CPDF_VariableText::~CPDF_VariableText() {}
+CPDF_VariableText::CPDF_VariableText() = default;
+
+CPDF_VariableText::~CPDF_VariableText() = default;
 
 void CPDF_VariableText::Initialize() {
   if (m_bInitialized)
diff --git a/core/fpdfdoc/cpdf_variabletext.h b/core/fpdfdoc/cpdf_variabletext.h
index 786ad10f3e..c97d303554 100644
--- a/core/fpdfdoc/cpdf_variabletext.h
+++ b/core/fpdfdoc/cpdf_variabletext.h
@@ -18,6 +18,7 @@
 #include "core/fxcrt/fx_coordinates.h"
 #include "core/fxcrt/fx_string.h"
 #include "core/fxcrt/fx_system.h"
+#include "core/fxcrt/unowned_ptr.h"
 
 class CPVT_Word;
 class CSection;
@@ -28,7 +29,6 @@ struct CPVT_WordInfo;
 
 class CPDF_VariableText {
  public:
-
   class Iterator {
    public:
     explicit Iterator(CPDF_VariableText* pVT);
@@ -63,7 +63,7 @@ class CPDF_VariableText {
     virtual int32_t GetDefaultFontIndex();
 
    private:
-    IPVT_FontMap* const m_pFontMap;
+    UnownedPtr<IPVT_FontMap> const m_pFontMap;
   };
 
   CPDF_VariableText();
@@ -196,20 +196,20 @@ class CPDF_VariableText {
   bool IsBigger(float fFontSize) const;
   CPVT_FloatRect RearrangeSections(const CPVT_WordRange& PlaceRange);
 
+  bool m_bInitialized = false;
+  bool m_bMultiLine = false;
+  bool m_bLimitWidth = false;
+  bool m_bAutoFontSize = false;
+  uint16_t m_wSubWord = 0;
+  int32_t m_nLimitChar = 0;
+  int32_t m_nCharArray = 0;
+  int32_t m_nAlignment = 0;
+  int32_t m_nHorzScale = 100;
+  float m_fLineLeading = 0.0f;
+  float m_fCharSpace = 0.0f;
+  float m_fFontSize = 0.0f;
   std::vector<std::unique_ptr<CSection>> m_SectionArray;
-  int32_t m_nLimitChar;
-  int32_t m_nCharArray;
-  bool m_bMultiLine;
-  bool m_bLimitWidth;
-  bool m_bAutoFontSize;
-  int32_t m_nAlignment;
-  float m_fLineLeading;
-  float m_fCharSpace;
-  int32_t m_nHorzScale;
-  uint16_t m_wSubWord;
-  float m_fFontSize;
-  bool m_bInitialized;
-  CPDF_VariableText::Provider* m_pVTProvider;
+  UnownedPtr<CPDF_VariableText::Provider> m_pVTProvider;
   std::unique_ptr<CPDF_VariableText::Iterator> m_pVTIterator;
   CFX_FloatRect m_rcPlate;
   CPVT_FloatRect m_rcContent;
diff --git a/fpdfsdk/pwl/cpwl_appstream.cpp b/fpdfsdk/pwl/cpwl_appstream.cpp
index c17c146d20..512af1437a 100644
--- a/fpdfsdk/pwl/cpwl_appstream.cpp
+++ b/fpdfsdk/pwl/cpwl_appstream.cpp
@@ -1597,12 +1597,13 @@ void CPWL_AppStream::SetAsComboBox(const WideString* sValue) {
   rcButton.left = rcButton.right - 13;
   rcButton.Normalize();
 
-  auto pEdit = pdfium::MakeUnique<CPWL_EditImpl>();
-  pEdit->EnableRefresh(false);
-
+  // Font map must outlive |pEdit|.
   CBA_FontMap font_map(
       widget_.Get(),
       widget_->GetInterForm()->GetFormFillEnv()->GetSysHandler());
+
+  auto pEdit = pdfium::MakeUnique<CPWL_EditImpl>();
+  pEdit->EnableRefresh(false);
   pEdit->SetFontMap(&font_map);
 
   CFX_FloatRect rcEdit = rcClient;
@@ -1663,12 +1664,13 @@ void CPWL_AppStream::SetAsListBox() {
   CFX_FloatRect rcClient = widget_->GetClientRect();
   std::ostringstream sBody;
 
-  auto pEdit = pdfium::MakeUnique<CPWL_EditImpl>();
-  pEdit->EnableRefresh(false);
-
+  // Font map must outlive |pEdit|.
   CBA_FontMap font_map(
       widget_.Get(),
       widget_->GetInterForm()->GetFormFillEnv()->GetSysHandler());
+
+  auto pEdit = pdfium::MakeUnique<CPWL_EditImpl>();
+  pEdit->EnableRefresh(false);
   pEdit->SetFontMap(&font_map);
   pEdit->SetPlateRect(CFX_FloatRect(rcClient.left, 0.0f, rcClient.right, 0.0f));
 
@@ -1747,12 +1749,13 @@ void CPWL_AppStream::SetAsTextField(const WideString* sValue) {
   std::ostringstream sBody;
   std::ostringstream sLines;
 
-  auto pEdit = pdfium::MakeUnique<CPWL_EditImpl>();
-  pEdit->EnableRefresh(false);
-
+  // Font map must outlive |pEdit|.
   CBA_FontMap font_map(
       widget_.Get(),
       widget_->GetInterForm()->GetFormFillEnv()->GetSysHandler());
+
+  auto pEdit = pdfium::MakeUnique<CPWL_EditImpl>();
+  pEdit->EnableRefresh(false);
   pEdit->SetFontMap(&font_map);
 
   CFX_FloatRect rcClient = widget_->GetClientRect();
diff --git a/fpdfsdk/pwl/cpwl_edit_impl.h b/fpdfsdk/pwl/cpwl_edit_impl.h
index 7f4d3e108b..8680885e63 100644
--- a/fpdfsdk/pwl/cpwl_edit_impl.h
+++ b/fpdfsdk/pwl/cpwl_edit_impl.h
@@ -374,10 +374,10 @@ class CPWL_EditImpl {
 
   void AddEditUndoItem(std::unique_ptr<IFX_Edit_UndoItem> pEditUndoItem);
 
-  std::unique_ptr<CPDF_VariableText> m_pVT;
+  std::unique_ptr<CPWL_EditImpl_Provider> m_pVTProvider;
+  std::unique_ptr<CPDF_VariableText> m_pVT;  // Must outlive |m_pVTProvider|.
   UnownedPtr<CPWL_EditCtrl> m_pNotify;
   UnownedPtr<CPWL_Edit> m_pOperationNotify;
-  std::unique_ptr<CPWL_EditImpl_Provider> m_pVTProvider;
   CPVT_WordPlace m_wpCaret;
   CPVT_WordPlace m_wpOldCaret;
   CPWL_EditImpl_Select m_SelState;