2 files changed, 14 insertions, 11 deletions

diff --git a/fpdfsdk/pwl/cpwl_appstream.cpp b/fpdfsdk/pwl/cpwl_appstream.cpp
index c17c146d20..512af1437a 100644
--- a/fpdfsdk/pwl/cpwl_appstream.cpp
+++ b/fpdfsdk/pwl/cpwl_appstream.cpp
@@ -1597,12 +1597,13 @@ void CPWL_AppStream::SetAsComboBox(const WideString* sValue) {
   rcButton.left = rcButton.right - 13;
   rcButton.Normalize();
 
-  auto pEdit = pdfium::MakeUnique<CPWL_EditImpl>();
-  pEdit->EnableRefresh(false);
-
+  // Font map must outlive |pEdit|.
   CBA_FontMap font_map(
       widget_.Get(),
       widget_->GetInterForm()->GetFormFillEnv()->GetSysHandler());
+
+  auto pEdit = pdfium::MakeUnique<CPWL_EditImpl>();
+  pEdit->EnableRefresh(false);
   pEdit->SetFontMap(&font_map);
 
   CFX_FloatRect rcEdit = rcClient;
@@ -1663,12 +1664,13 @@ void CPWL_AppStream::SetAsListBox() {
   CFX_FloatRect rcClient = widget_->GetClientRect();
   std::ostringstream sBody;
 
-  auto pEdit = pdfium::MakeUnique<CPWL_EditImpl>();
-  pEdit->EnableRefresh(false);
-
+  // Font map must outlive |pEdit|.
   CBA_FontMap font_map(
       widget_.Get(),
       widget_->GetInterForm()->GetFormFillEnv()->GetSysHandler());
+
+  auto pEdit = pdfium::MakeUnique<CPWL_EditImpl>();
+  pEdit->EnableRefresh(false);
   pEdit->SetFontMap(&font_map);
   pEdit->SetPlateRect(CFX_FloatRect(rcClient.left, 0.0f, rcClient.right, 0.0f));
 
@@ -1747,12 +1749,13 @@ void CPWL_AppStream::SetAsTextField(const WideString* sValue) {
   std::ostringstream sBody;
   std::ostringstream sLines;
 
-  auto pEdit = pdfium::MakeUnique<CPWL_EditImpl>();
-  pEdit->EnableRefresh(false);
-
+  // Font map must outlive |pEdit|.
   CBA_FontMap font_map(
       widget_.Get(),
       widget_->GetInterForm()->GetFormFillEnv()->GetSysHandler());
+
+  auto pEdit = pdfium::MakeUnique<CPWL_EditImpl>();
+  pEdit->EnableRefresh(false);
   pEdit->SetFontMap(&font_map);
 
   CFX_FloatRect rcClient = widget_->GetClientRect();
diff --git a/fpdfsdk/pwl/cpwl_edit_impl.h b/fpdfsdk/pwl/cpwl_edit_impl.h
index 7f4d3e108b..8680885e63 100644
--- a/fpdfsdk/pwl/cpwl_edit_impl.h
+++ b/fpdfsdk/pwl/cpwl_edit_impl.h
@@ -374,10 +374,10 @@ class CPWL_EditImpl {
 
   void AddEditUndoItem(std::unique_ptr<IFX_Edit_UndoItem> pEditUndoItem);
 
-  std::unique_ptr<CPDF_VariableText> m_pVT;
+  std::unique_ptr<CPWL_EditImpl_Provider> m_pVTProvider;
+  std::unique_ptr<CPDF_VariableText> m_pVT;  // Must outlive |m_pVTProvider|.
   UnownedPtr<CPWL_EditCtrl> m_pNotify;
   UnownedPtr<CPWL_Edit> m_pOperationNotify;
-  std::unique_ptr<CPWL_EditImpl_Provider> m_pVTProvider;
   CPVT_WordPlace m_wpCaret;
   CPVT_WordPlace m_wpOldCaret;
   CPWL_EditImpl_Select m_SelState;