diff --git a/.hgtags b/.hgtags
index e8bbe93f8fcd720516e6cf94187fa882c55b84ac..f0ae285819409e5feeb7466a330c1a0f48cb83f6 100644
--- a/.hgtags
+++ b/.hgtags
@@ -281,7 +281,6 @@ ab2ffc547c8a8950ff187c4f6c95e5334fab597b 3.3.4-beta5
 28e100d0379a2b0710c57647a28fc5239d3d7b99 3.3.4-release
 005dfe5c4c377207d065fb27858d2eb0b53b143a DRTVWR-167
 888768f162d2c0a8de1dcc5fb9a08bd8bd120a6b DRTVWR-175
-4ad8a3afe40e0200309e3ada68932c4295ac2795 DRTVWR-179
 a8b3eca451a9eaab59987efb0ab1c4217e3f2dcc DRTVWR-182
 1f27cdfdc54246484f8afbbe42ce48e954175cbd 3.4.0-beta1
 9ee9387789701d597130f879d9011a4958753862 DRTVWR-189
@@ -318,6 +317,7 @@ f00068a66a2e2f72acbe3f690b98b323e740b289 DRTVWR-222
 dd23d4da3bcb2ffda58569e759feb7c119982973 DRTVWR-224
 0bd3744ff060452aa13ff4992eafb381df7b1012 3.4.1-beta5
 29075f8c1abed53dcf195a59f61744e27a91108f DRTVWR-226
+fba99f381b8d4ad1b7b42fa4993b29998d95be18 DRTVWR-179
 49ed253c80bed7410e238eeab35a9f14cb034364 3.4.1-beta6
 468ca3268229011a59df99229b24315844b33d34 DRTVWR-227
 524da902713e8b60322640b9825101add4a7c497 3.4.1-beta7
@@ -328,3 +328,4 @@ dd23d4da3bcb2ffda58569e759feb7c119982973 DRTVWR-224
 637fe8bbee5e24940448198c221d5ee0fa3247b4 3.4.1-beta9
 4e0d84e92132e9e95a1d52a1e49bad69c278ea05 3.4.1-beta10
 f7cbd60a3f57ff1101157eeb79ea21e8898bedae DRTVWR-235
+baf97f06ae17223614c5e31aa42e71d87cff07fe DRTVWR-236
diff --git a/indra/llmath/lloctree.h b/indra/llmath/lloctree.h
index c3f6f7de2a147dd12474ced4798aea07aacb7590..4ac1e55cfc79e278fea79b8ae93dc6b8b251dd25 100644
--- a/indra/llmath/lloctree.h
+++ b/indra/llmath/lloctree.h
@@ -78,7 +78,7 @@ class LLOctreeNode : public LLTreeNode<T>
 
 	typedef LLOctreeTraveler<T>									oct_traveler;
 	typedef LLTreeTraveler<T>									tree_traveler;
-	typedef LLPointer<T>*										element_list;
+	typedef std::vector<LLPointer<T> >							element_list;
 	typedef LLPointer<T>*										element_iter;
 	typedef const LLPointer<T>*									const_element_iter;
 	typedef typename std::vector<LLTreeListener<T>*>::iterator	tree_listener_iter;
@@ -106,8 +106,9 @@ class LLOctreeNode : public LLTreeNode<T>
 	:	mParent((oct_node*)parent), 
 		mOctant(octant) 
 	{ 
-		mData = NULL;
-		mDataEnd = NULL;
+		//always keep a NULL terminated list to avoid out of bounds exceptions in debug builds
+		mData.push_back(NULL);
+		mDataEnd = &mData[0];
 
 		mCenter = center;
 		mSize = size;
@@ -133,9 +134,9 @@ class LLOctreeNode : public LLTreeNode<T>
 			mData[i] = NULL;
 		}
 
-		free(mData);
-		mData = NULL;
-		mDataEnd = NULL;
+		mData.clear();
+		mData.push_back(NULL);
+		mDataEnd = &mData[0];
 
 		for (U32 i = 0; i < getChildCount(); i++)
 		{
@@ -239,9 +240,9 @@ class LLOctreeNode : public LLTreeNode<T>
 	bool isEmpty() const							{ return mElementCount == 0; }
 	element_list& getData()							{ return mData; }
 	const element_list& getData() const				{ return mData; }
-	element_iter getDataBegin()						{ return mData; }
+	element_iter getDataBegin()						{ return &mData[0]; }
 	element_iter getDataEnd()						{ return mDataEnd; }
-	const_element_iter getDataBegin() const			{ return mData; }
+	const_element_iter getDataBegin() const			{ return &mData[0]; }
 	const_element_iter getDataEnd() const			{ return mDataEnd; }
 		
 	U32 getChildCount()	const						{ return mChildCount; }
@@ -321,14 +322,10 @@ class LLOctreeNode : public LLTreeNode<T>
 			if ((getElementCount() < gOctreeMaxCapacity && contains(data->getBinRadius()) ||
 				(data->getBinRadius() > getSize()[0] &&	parent && parent->getElementCount() >= gOctreeMaxCapacity))) 
 			{ //it belongs here
+				mData.push_back(NULL);
+				mData[mElementCount] = data;
 				mElementCount++;
-				mData = (element_list) realloc(mData, sizeof(LLPointer<T>)*mElementCount);
-
-				//avoid unref on uninitialized memory
-				memset(mData+mElementCount-1, 0, sizeof(LLPointer<T>));
-
-				mData[mElementCount-1] = data;
-				mDataEnd = mData + mElementCount;
+				mDataEnd = &mData[mElementCount];
 				data->setBinIndex(mElementCount-1);
 				BaseType::insert(data);
 				return true;
@@ -364,14 +361,10 @@ class LLOctreeNode : public LLTreeNode<T>
 
 				if( lt == 0x7 )
 				{
+					mData.push_back(NULL);
+					mData[mElementCount] = data;
 					mElementCount++;
-					mData = (element_list) realloc(mData, sizeof(LLPointer<T>)*mElementCount);
-
-					//avoid unref on uninitialized memory
-					memset(mData+mElementCount-1, 0, sizeof(LLPointer<T>));
-
-					mData[mElementCount-1] = data;
-					mDataEnd = mData + mElementCount;
+					mDataEnd = &mData[mElementCount];
 					data->setBinIndex(mElementCount-1);
 					BaseType::insert(data);
 					return true;
@@ -436,16 +429,15 @@ class LLOctreeNode : public LLTreeNode<T>
 				mData[i]->setBinIndex(i);
 			}
 
-			mData[mElementCount] = NULL; //needed for unref
-			mData = (element_list) realloc(mData, sizeof(LLPointer<T>)*mElementCount);
-			mDataEnd = mData+mElementCount;
+			mData[mElementCount] = NULL;
+			mData.pop_back();
+			mDataEnd = &mData[mElementCount];
 		}
 		else
 		{
-			mData[0] = NULL; //needed for unref
-			free(mData);
-			mData = NULL;
-			mDataEnd = NULL;
+			mData.clear();
+			mData.push_back(NULL);
+			mDataEnd = &mData[0];
 		}
 
 		notifyRemoval(data);
@@ -491,7 +483,7 @@ class LLOctreeNode : public LLTreeNode<T>
 		}
 
 		//node is now root
-		llwarns << "!!! OCTREE REMOVING FACE BY ADDRESS, SEVERE PERFORMANCE PENALTY |||" << llendl;
+		llwarns << "!!! OCTREE REMOVING ELEMENT BY ADDRESS, SEVERE PERFORMANCE PENALTY |||" << llendl;
 		node->removeByAddress(data);
 		llassert(data->getBinIndex() == -1);
 		return true;
diff --git a/indra/newview/llspatialpartition.cpp b/indra/newview/llspatialpartition.cpp
index 7264ba3cab9166f12f32d95b54a8f22731dd3cb4..3bb8e60787b07b9864249b51bc73057ac1e0b5e6 100644
--- a/indra/newview/llspatialpartition.cpp
+++ b/indra/newview/llspatialpartition.cpp
@@ -4713,55 +4713,63 @@ LLCullResult::LLCullResult()
 	mVisibleListAllocated = 0;
 	mVisibleBridgeAllocated = 0;
 
-	mVisibleGroups = NULL;
-	mVisibleGroupsEnd = NULL;
-	mAlphaGroups = NULL;
-	mAlphaGroupsEnd = NULL;
-	mOcclusionGroups = NULL;
-	mOcclusionGroupsEnd = NULL;
-	mDrawableGroups = NULL;
-	mDrawableGroupsEnd = NULL;
-	mVisibleList = NULL;
-	mVisibleListEnd = NULL;
-	mVisibleBridge = NULL;
-	mVisibleBridgeEnd = NULL;
+	mVisibleGroups.clear();
+	mVisibleGroups.push_back(NULL);
+	mVisibleGroupsEnd = &mVisibleGroups[0];
+	mAlphaGroups.clear();
+	mAlphaGroups.push_back(NULL);
+	mAlphaGroupsEnd = &mAlphaGroups[0];
+	mOcclusionGroups.clear();
+	mOcclusionGroups.push_back(NULL);
+	mOcclusionGroupsEnd = &mOcclusionGroups[0];
+	mDrawableGroups.clear();
+	mDrawableGroups.push_back(NULL);
+	mDrawableGroupsEnd = &mDrawableGroups[0];
+	mVisibleList.clear();
+	mVisibleList.push_back(NULL);
+	mVisibleListEnd = &mVisibleList[0];
+	mVisibleBridge.clear();
+	mVisibleBridge.push_back(NULL);
+	mVisibleBridgeEnd = &mVisibleBridge[0];
 
 	for (U32 i = 0; i < LLRenderPass::NUM_RENDER_TYPES; i++)
 	{
-		mRenderMap[i] = NULL;
-		mRenderMapEnd[i] = NULL;
+		mRenderMap[i].clear();
+		mRenderMap[i].push_back(NULL);
+		mRenderMapEnd[i] = &mRenderMap[i][0];
 		mRenderMapAllocated[i] = 0;
 	}
 
 	clear();
 }
 
-void LLCullResult::pushBack(void**& head, U32& count, void* val)
+template <class T, class V> 
+void LLCullResult::pushBack(T& head, U32& count, V* val)
 {
+	head[count] = val;
+	head.push_back(NULL);
 	count++;
-	head = (void**) realloc((void*) head, sizeof(void*) * count);
-	head[count-1] = val;
 }
 
 void LLCullResult::clear()
 {
 	mVisibleGroupsSize = 0;
-	mVisibleGroupsEnd = mVisibleGroups;
+	mVisibleGroupsEnd = &mVisibleGroups[0];
 
 	mAlphaGroupsSize = 0;
-	mAlphaGroupsEnd = mAlphaGroups;
+	mAlphaGroupsEnd = &mAlphaGroups[0];
 
 	mOcclusionGroupsSize = 0;
-	mOcclusionGroupsEnd = mOcclusionGroups;
+	mOcclusionGroupsEnd = &mOcclusionGroups[0];
 
 	mDrawableGroupsSize = 0;
-	mDrawableGroupsEnd = mDrawableGroups;
+	mDrawableGroupsEnd = &mDrawableGroups[0];
 
 	mVisibleListSize = 0;
-	mVisibleListEnd = mVisibleList;
+	mVisibleListEnd = &mVisibleList[0];
 
 	mVisibleBridgeSize = 0;
-	mVisibleBridgeEnd = mVisibleBridge;
+	mVisibleBridgeEnd = &mVisibleBridge[0];
 
 
 	for (U32 i = 0; i < LLRenderPass::NUM_RENDER_TYPES; i++)
@@ -4771,13 +4779,13 @@ void LLCullResult::clear()
 			mRenderMap[i][j] = 0;
 		}
 		mRenderMapSize[i] = 0;
-		mRenderMapEnd[i] = mRenderMap[i];
+		mRenderMapEnd[i] = &(mRenderMap[i][0]);
 	}
 }
 
 LLCullResult::sg_iterator LLCullResult::beginVisibleGroups()
 {
-	return mVisibleGroups;
+	return &mVisibleGroups[0];
 }
 
 LLCullResult::sg_iterator LLCullResult::endVisibleGroups()
@@ -4787,7 +4795,7 @@ LLCullResult::sg_iterator LLCullResult::endVisibleGroups()
 
 LLCullResult::sg_iterator LLCullResult::beginAlphaGroups()
 {
-	return mAlphaGroups;
+	return &mAlphaGroups[0];
 }
 
 LLCullResult::sg_iterator LLCullResult::endAlphaGroups()
@@ -4797,7 +4805,7 @@ LLCullResult::sg_iterator LLCullResult::endAlphaGroups()
 
 LLCullResult::sg_iterator LLCullResult::beginOcclusionGroups()
 {
-	return mOcclusionGroups;
+	return &mOcclusionGroups[0];
 }
 
 LLCullResult::sg_iterator LLCullResult::endOcclusionGroups()
@@ -4807,7 +4815,7 @@ LLCullResult::sg_iterator LLCullResult::endOcclusionGroups()
 
 LLCullResult::sg_iterator LLCullResult::beginDrawableGroups()
 {
-	return mDrawableGroups;
+	return &mDrawableGroups[0];
 }
 
 LLCullResult::sg_iterator LLCullResult::endDrawableGroups()
@@ -4817,7 +4825,7 @@ LLCullResult::sg_iterator LLCullResult::endDrawableGroups()
 
 LLCullResult::drawable_iterator LLCullResult::beginVisibleList()
 {
-	return mVisibleList;
+	return &mVisibleList[0];
 }
 
 LLCullResult::drawable_iterator LLCullResult::endVisibleList()
@@ -4827,7 +4835,7 @@ LLCullResult::drawable_iterator LLCullResult::endVisibleList()
 
 LLCullResult::bridge_iterator LLCullResult::beginVisibleBridge()
 {
-	return mVisibleBridge;
+	return &mVisibleBridge[0];
 }
 
 LLCullResult::bridge_iterator LLCullResult::endVisibleBridge()
@@ -4837,7 +4845,7 @@ LLCullResult::bridge_iterator LLCullResult::endVisibleBridge()
 
 LLCullResult::drawinfo_iterator LLCullResult::beginRenderMap(U32 type)
 {
-	return mRenderMap[type];
+	return &mRenderMap[type][0];
 }
 
 LLCullResult::drawinfo_iterator LLCullResult::endRenderMap(U32 type)
@@ -4853,10 +4861,10 @@ void LLCullResult::pushVisibleGroup(LLSpatialGroup* group)
 	}
 	else
 	{
-		pushBack((void**&) mVisibleGroups, mVisibleGroupsAllocated, (void*) group);
+		pushBack(mVisibleGroups, mVisibleGroupsAllocated, group);
 	}
 	++mVisibleGroupsSize;
-	mVisibleGroupsEnd = mVisibleGroups+mVisibleGroupsSize;
+	mVisibleGroupsEnd = &mVisibleGroups[mVisibleGroupsSize];
 }
 
 void LLCullResult::pushAlphaGroup(LLSpatialGroup* group)
@@ -4867,10 +4875,10 @@ void LLCullResult::pushAlphaGroup(LLSpatialGroup* group)
 	}
 	else
 	{
-		pushBack((void**&) mAlphaGroups, mAlphaGroupsAllocated, (void*) group);
+		pushBack(mAlphaGroups, mAlphaGroupsAllocated, group);
 	}
 	++mAlphaGroupsSize;
-	mAlphaGroupsEnd = mAlphaGroups+mAlphaGroupsSize;
+	mAlphaGroupsEnd = &mAlphaGroups[mAlphaGroupsSize];
 }
 
 void LLCullResult::pushOcclusionGroup(LLSpatialGroup* group)
@@ -4881,10 +4889,10 @@ void LLCullResult::pushOcclusionGroup(LLSpatialGroup* group)
 	}
 	else
 	{
-		pushBack((void**&) mOcclusionGroups, mOcclusionGroupsAllocated, (void*) group);
+		pushBack(mOcclusionGroups, mOcclusionGroupsAllocated, group);
 	}
 	++mOcclusionGroupsSize;
-	mOcclusionGroupsEnd = mOcclusionGroups+mOcclusionGroupsSize;
+	mOcclusionGroupsEnd = &mOcclusionGroups[mOcclusionGroupsSize];
 }
 
 void LLCullResult::pushDrawableGroup(LLSpatialGroup* group)
@@ -4895,10 +4903,10 @@ void LLCullResult::pushDrawableGroup(LLSpatialGroup* group)
 	}
 	else
 	{
-		pushBack((void**&) mDrawableGroups, mDrawableGroupsAllocated, (void*) group);
+		pushBack(mDrawableGroups, mDrawableGroupsAllocated, group);
 	}
 	++mDrawableGroupsSize;
-	mDrawableGroupsEnd = mDrawableGroups+mDrawableGroupsSize;
+	mDrawableGroupsEnd = &mDrawableGroups[mDrawableGroupsSize];
 }
 
 void LLCullResult::pushDrawable(LLDrawable* drawable)
@@ -4909,10 +4917,10 @@ void LLCullResult::pushDrawable(LLDrawable* drawable)
 	}
 	else
 	{
-		pushBack((void**&) mVisibleList, mVisibleListAllocated, (void*) drawable);
+		pushBack(mVisibleList, mVisibleListAllocated, drawable);
 	}
 	++mVisibleListSize;
-	mVisibleListEnd = mVisibleList+mVisibleListSize;
+	mVisibleListEnd = &mVisibleList[mVisibleListSize];
 }
 
 void LLCullResult::pushBridge(LLSpatialBridge* bridge)
@@ -4923,10 +4931,10 @@ void LLCullResult::pushBridge(LLSpatialBridge* bridge)
 	}
 	else
 	{
-		pushBack((void**&) mVisibleBridge, mVisibleBridgeAllocated, (void*) bridge);
+		pushBack(mVisibleBridge, mVisibleBridgeAllocated, bridge);
 	}
 	++mVisibleBridgeSize;
-	mVisibleBridgeEnd = mVisibleBridge+mVisibleBridgeSize;
+	mVisibleBridgeEnd = &mVisibleBridge[mVisibleBridgeSize];
 }
 
 void LLCullResult::pushDrawInfo(U32 type, LLDrawInfo* draw_info)
@@ -4937,10 +4945,10 @@ void LLCullResult::pushDrawInfo(U32 type, LLDrawInfo* draw_info)
 	}
 	else
 	{
-		pushBack((void**&) mRenderMap[type], mRenderMapAllocated[type], (void*) draw_info);
+		pushBack(mRenderMap[type], mRenderMapAllocated[type], draw_info);
 	}
 	++mRenderMapSize[type];
-	mRenderMapEnd[type] = mRenderMap[type] + mRenderMapSize[type];
+	mRenderMapEnd[type] = &(mRenderMap[type][mRenderMapSize[type]]);
 }
 
 
diff --git a/indra/newview/llspatialpartition.h b/indra/newview/llspatialpartition.h
index e63037b4a8c0c18325ce66bf5293d6c9d224d362..b1706d9d35130dbb75970c09c64761d6688ae2dd 100644
--- a/indra/newview/llspatialpartition.h
+++ b/indra/newview/llspatialpartition.h
@@ -569,10 +569,10 @@ class LLCullResult
 public:
 	LLCullResult();
 
-	typedef LLSpatialGroup** sg_list_t;
-	typedef LLDrawable** drawable_list_t;
-	typedef LLSpatialBridge** bridge_list_t;
-	typedef LLDrawInfo** drawinfo_list_t;
+	typedef std::vector<LLSpatialGroup*> sg_list_t;
+	typedef std::vector<LLDrawable*> drawable_list_t;
+	typedef std::vector<LLSpatialBridge*> bridge_list_t;
+	typedef std::vector<LLDrawInfo*> drawinfo_list_t;
 
 	typedef LLSpatialGroup** sg_iterator;
 	typedef LLSpatialBridge** bridge_iterator;
@@ -622,7 +622,7 @@ class LLCullResult
 
 private:
 
-	void pushBack(void** &head, U32& count, void* val);
+	template <class T, class V> void pushBack(T &head, U32& count, V* val);
 
 	U32					mVisibleGroupsSize;
 	U32					mAlphaGroupsSize;