diff --git a/pdf/pdfium/pdfium_engine.cc b/pdf/pdfium/pdfium_engine.cc
index 73730942971c9..25f079d6f6b9c 100644
--- a/pdf/pdfium/pdfium_engine.cc
+++ b/pdf/pdfium/pdfium_engine.cc
@@ -794,6 +794,16 @@ PDFiumEngine::~PDFiumEngine() {
   if (doc()) {
     FORM_DoDocumentAAction(form(), FPDFDOC_AACTION_WC);
   }
+
+  // The /WC action above can run arbitrary JavaScript that may have re-loaded
+  // pages (via FFI_GetPage) and/or focused a form widget. During implicit
+  // member destruction, `visible_pages_` and friends are destroyed before
+  // `pages_`, but `~PDFiumPage` -> `FPDF_ClosePage` can re-enter the engine
+  // (KillFocusAnnot -> /Bl JavaScript -> `this.pageNum`) and call back into
+  // `CalculateVisiblePages()`, writing to those already-freed vectors.
+  // Clearing `plugin_size_` makes `CalculateVisiblePages()` a no-op for the
+  // remainder of teardown.
+  plugin_size_.reset();
 }
 
 void PDFiumEngine::SetDocumentLoaderForTesting(