VWR-2683: Possible crash accessing dead llviewerregion.

3 files changed, 12 insertions, 2 deletions

diff --git a/ChangeLog.txt b/ChangeLog.txt
index e69de29..36a5be0 100644
--- a/ChangeLog.txt
+++ b/ChangeLog.txt
@@ -0,0 +1,6 @@
+2008-09-17  Nicholaz Beresford  <nicholaz@blueflash.cc>
+
+        * linden/indra/newview/llfloateractivespeakers.cpp (updateSpeakerList): 
+        VWR-2683: Possible crash accessing dead llviewerregion.
+        * linden/indra/newview/llviewerobjectlist.cpp (killObjects): 
+        Ditto.
diff --git a/linden/indra/newview/llfloateractivespeakers.cpp b/linden/indra/newview/llfloateractivespeakers.cpp
index ed2f9f8..9aa21d5 100644
--- a/linden/indra/newview/llfloateractivespeakers.cpp
+++ b/linden/indra/newview/llfloateractivespeakers.cpp
@@ -1342,7 +1342,7 @@ void LLLocalSpeakerMgr::updateSpeakerList()
         for(avatar_it = LLCharacter::sInstances.begin(); avatar_it != LLCharacter::sInstances.end(); ++avatar_it)
         {
                 LLVOAvatar* avatarp = (LLVOAvatar*)*avatar_it;
-                if (dist_vec(avatarp->getPositionAgent(), gAgent.getPositionAgent()) <= CHAT_NORMAL_RADIUS)
+                if (!avatarp->isDead() &&  dist_vec(avatarp->getPositionAgent(), gAgent.getPositionAgent()) <= CHAT_NORMAL_RADIUS)
                 {
                         setSpeaker(avatarp->getID());
                 }
@@ -1356,7 +1356,7 @@ void LLLocalSpeakerMgr::updateSpeakerList()
                 if (speakerp->mStatus == LLSpeaker::STATUS_TEXT_ONLY)
                 {
                         LLVOAvatar* avatarp = (LLVOAvatar*)gObjectList.findObject(speaker_id);
-                        if (!avatarp || dist_vec(avatarp->getPositionAgent(), gAgent.getPositionAgent()) > CHAT_NORMAL_RADIUS)
+                        if (!avatarp || avatarp->isDead() || dist_vec(avatarp->getPositionAgent(), gAgent.getPositionAgent()) > CHAT_NORMAL_RADIUS)
                         {
                                 speakerp->mStatus = LLSpeaker::STATUS_NOT_IN_CHANNEL;
                                 speakerp->mDotColor = INACTIVE_COLOR;
diff --git a/linden/indra/newview/llviewerobjectlist.cpp b/linden/indra/newview/llviewerobjectlist.cpp
index bd8ed97..dec7ced 100644
--- a/linden/indra/newview/llviewerobjectlist.cpp
+++ b/linden/indra/newview/llviewerobjectlist.cpp
@@ -859,6 +859,10 @@ void LLViewerObjectList::killObjects(LLViewerRegion *regionp)
                 if (objectp->mRegionp == regionp)
                 {
                         killObject(objectp);
+
+                        // invalidate region pointer. region will become invalid, but 
+                        // refcounted objects may survive the cleanDeadObjects() call below
+                        objectp->mRegionp = NULL;        
                 }
         }