[EXT-68] Fixed dynamic_cast on partially destroyed object bug that was breaking menu branching.

1 files changed, 9 insertions, 7 deletions

diff --git a/indra/llui/llmenugl.cpp b/indra/llui/llmenugl.cpp
index 4af1c1241b..95221d5fc6 100644
--- a/indra/llui/llmenugl.cpp
+++ b/indra/llui/llmenugl.cpp
@@ -1646,15 +1646,17 @@ bool LLMenuGL::addChild(LLView* view, S32 tab_group)
 
 void LLMenuGL::removeChild( LLView* ctrl)
 {
-	LLMenuItemGL* itemp = dynamic_cast<LLMenuItemGL*>(ctrl);
-	if (itemp)
+	// previously a dynamic_cast with if statement to check validity
+	// unfortunately removeChild is called by ~LLView, and at that point the
+	// object being deleted is no longer a LLMenuItemGL so a dynamic_cast will fail
+	LLMenuItemGL* itemp = static_cast<LLMenuItemGL*>(ctrl);
+
+	item_list_t::iterator found_it = std::find(mItems.begin(), mItems.end(), (itemp));
+	if (found_it != mItems.end())
 	{
-		item_list_t::iterator found_it = std::find(mItems.begin(), mItems.end(), (itemp));
-		if (found_it != mItems.end())
-		{
-			mItems.erase(found_it);
-		}
+		mItems.erase(found_it);
 	}
+
 	return LLUICtrl::removeChild(ctrl);
 }