Fixup formfiller cleanup

The CFFL_InteractiveFormFiller must be cleaned up before the environment because
the destruction of the formfiller will trigger the destruction of the formfiller
widgets. Some of those widgets may require stopping timers, which requires
accessing the environment.

BUG=chromium:654272, chromium:653459

Review-Url: https://codereview.chromium.org/2408163003
diff --git a/fpdfsdk/cpdfsdk_formfillenvironment.cpp b/fpdfsdk/cpdfsdk_formfillenvironment.cpp
index 5b05d08..7b41ea1 100644
--- a/fpdfsdk/cpdfsdk_formfillenvironment.cpp
+++ b/fpdfsdk/cpdfsdk_formfillenvironment.cpp
@@ -39,6 +39,16 @@
       m_pSysHandler(new CFX_SystemHandler(this)) {}
 
 CPDFSDK_FormFillEnvironment::~CPDFSDK_FormFillEnvironment() {
+  // |m_pAnnotHandlerMgr| will try to access |m_pFormFiller|
+  // when it cleans up. So, we must make sure it is cleaned up before
+  // |m_pFormFiller|.
+  m_pAnnotHandlerMgr.reset();
+
+  // Must destroy the |m_pFormFiller| before the environment (|this|)
+  // because any created form widgets hold a pointer to the environment.
+  // Those widgets may call things like KillTimer() as they are shutdown.
+  m_pFormFiller.reset();
+
 #ifdef PDF_ENABLE_XFA
   CPDFXFA_App* pProvider = CPDFXFA_App::GetInstance();
   if (pProvider->m_pEnvList.GetSize() == 0)