BugSplat Crash #1409959 onTopLost

onTopLost crashed
1. It contradicts callstack, but clearPopups() definetely has an issue
due to not checking the pointer prior to calling onTopLost
2. According to callstack, crash happened around ~LLFolderViewFolder
and while it does call removePopup for itself, it isn't a popup, the
only one in the list would be the renamer, which calls back to parent,
so made sure to secure it.
3. mFlashTimer was never deleted
4. Some explicit cleanup for TopLost

7 files changed, 27 insertions, 7 deletions

diff --git a/indra/newview/llconversationview.cpp b/indra/newview/llconversationview.cpp
index 48c7df40df..84e5e2fe44 100644
--- a/indra/newview/llconversationview.cpp
+++ b/indra/newview/llconversationview.cpp
@@ -106,6 +106,8 @@ LLConversationViewSession::~LLConversationViewSession()
     }
 
 	mFlashTimer->unset();
+    delete mFlashTimer;
+    mFlashStateOn = false;
 }
 
 void LLConversationViewSession::destroyView()
diff --git a/indra/newview/llexpandabletextbox.cpp b/indra/newview/llexpandabletextbox.cpp
index 3395777aab..463df0dda9 100644
--- a/indra/newview/llexpandabletextbox.cpp
+++ b/indra/newview/llexpandabletextbox.cpp
@@ -243,6 +243,12 @@ LLExpandableTextBox::LLExpandableTextBox(const Params& p)
 	mTextBox->setCommitCallback(boost::bind(&LLExpandableTextBox::onExpandClicked, this));
 }
 
+
+LLExpandableTextBox::~LLExpandableTextBox()
+{
+    gViewerWindow->removePopup(this);
+}
+
 void LLExpandableTextBox::draw()
 {
 	if(mBGVisible && !mExpanded)
diff --git a/indra/newview/llexpandabletextbox.h b/indra/newview/llexpandabletextbox.h
index aaf393277f..17a98e44d5 100644
--- a/indra/newview/llexpandabletextbox.h
+++ b/indra/newview/llexpandabletextbox.h
@@ -154,6 +154,8 @@ public:
 	 */
 	/*virtual*/ void draw();
 
+    virtual ~LLExpandableTextBox();
+
 protected:
 
 	LLExpandableTextBox(const Params& p);
diff --git a/indra/newview/llpopupview.cpp b/indra/newview/llpopupview.cpp
index d1a9ca229f..49645eec11 100644
--- a/indra/newview/llpopupview.cpp
+++ b/indra/newview/llpopupview.cpp
@@ -260,12 +260,12 @@ void LLPopupView::clearPopups()
 		popup_it != mPopups.end();)
 	{
 		LLView* popup = popup_it->get();
+        if (popup)
+        {
+            popup->onTopLost();
+        }
 
-		popup_list_t::iterator cur_popup_it = popup_it;
-		++popup_it;
-
-		mPopups.erase(cur_popup_it);
-		popup->onTopLost();
+		popup_it = mPopups.erase(popup_it);
 	}
 }
 
diff --git a/indra/newview/llsplitbutton.cpp b/indra/newview/llsplitbutton.cpp
index 790305103d..c216319e76 100644
--- a/indra/newview/llsplitbutton.cpp
+++ b/indra/newview/llsplitbutton.cpp
@@ -243,7 +243,14 @@ LLSplitButton::LLSplitButton(const LLSplitButton::Params& p)
 		item_top -= (rc.getHeight() + BUTTON_PAD);
 	}
 
-	setTopLostCallback(boost::bind(&LLSplitButton::hideButtons, this));
+    mTopLostSignalConnection = setTopLostCallback(boost::bind(&LLSplitButton::hideButtons, this));
+}
+
+LLSplitButton::~LLSplitButton()
+{
+    // explicitly disconect to avoid hideButtons with
+    // dead pointers being called on destruction
+    mTopLostSignalConnection.disconnect();
 }
 
 
diff --git a/indra/newview/llsplitbutton.h b/indra/newview/llsplitbutton.h
index 4f20c8b379..dbb18c0c62 100644
--- a/indra/newview/llsplitbutton.h
+++ b/indra/newview/llsplitbutton.h
@@ -67,7 +67,7 @@ public:
 	};
 
 
-	virtual ~LLSplitButton() {};
+	virtual ~LLSplitButton();
 
 	//Overridden
 	virtual void	onFocusLost();
@@ -99,6 +99,8 @@ protected:
 	LLButton* mShownItem;
 	EArrowPosition mArrowPosition;
 
+    boost::signals2::connection mTopLostSignalConnection;
+
 	commit_callback_t mSelectionCallback;
 };
 
diff --git a/indra/newview/lluploaddialog.cpp b/indra/newview/lluploaddialog.cpp
index e59064c074..b8bf70fc62 100644
--- a/indra/newview/lluploaddialog.cpp
+++ b/indra/newview/lluploaddialog.cpp
@@ -149,6 +149,7 @@ void LLUploadDialog::setMessage( const std::string& msg)
 
 LLUploadDialog::~LLUploadDialog()
 {
+    gViewerWindow->removePopup(this);
 	gFocusMgr.releaseFocusIfNeeded( this );
 
 //    LLFilePicker::instance().reset();