From 687cff0eb8dfe663b99e18cfd953e0764d8ab372 Mon Sep 17 00:00:00 2001
From: Austin Doupnik <austin@lindenlab.com>
Date: Tue, 30 Jun 2009 21:34:46 +0000
Subject: [PATCH] [EXT-68] Fixed dynamic_cast on partially destroyed object bug
 that was breaking menu branching.

---
 indra/llui/llmenugl.cpp | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/indra/llui/llmenugl.cpp b/indra/llui/llmenugl.cpp
index 4af1c1241b8..95221d5fc6e 100644
--- a/indra/llui/llmenugl.cpp
+++ b/indra/llui/llmenugl.cpp
@@ -1646,15 +1646,17 @@ bool LLMenuGL::addChild(LLView* view, S32 tab_group)
 
 void LLMenuGL::removeChild( LLView* ctrl)
 {
-	LLMenuItemGL* itemp = dynamic_cast<LLMenuItemGL*>(ctrl);
-	if (itemp)
+	// previously a dynamic_cast with if statement to check validity
+	// unfortunately removeChild is called by ~LLView, and at that point the
+	// object being deleted is no longer a LLMenuItemGL so a dynamic_cast will fail
+	LLMenuItemGL* itemp = static_cast<LLMenuItemGL*>(ctrl);
+
+	item_list_t::iterator found_it = std::find(mItems.begin(), mItems.end(), (itemp));
+	if (found_it != mItems.end())
 	{
-		item_list_t::iterator found_it = std::find(mItems.begin(), mItems.end(), (itemp));
-		if (found_it != mItems.end())
-		{
-			mItems.erase(found_it);
-		}
+		mItems.erase(found_it);
 	}
+
 	return LLUICtrl::removeChild(ctrl);
 }
 
-- 
GitLab