--- linden-orig\indra\llmessage\llassetstorage.cpp	2007-09-20 12:36:46.000000000 +0200
+++ linden\indra\llmessage\llassetstorage.cpp	2007-10-08 00:10:17.828125000 +0200
@@ -512,16 +512,19 @@
 	S32 result,
 	const LLUUID& file_id,
 	LLAssetType::EType file_type,
-	void* user_data, LLExtStat ext_status)
+	void* callback_parm_req, LLExtStat ext_status)
 {
 	lldebugs << "LLAssetStorage::downloadCompleteCallback() for " << file_id
 		 << "," << LLAssetType::lookup(file_type) << llendl;
-	LLAssetRequest* req = (LLAssetRequest*)user_data;
+
+	// be careful! req may be a ptr to memory already freed (a timeout does this)
+	LLAssetRequest* req = (LLAssetRequest*)callback_parm_req;	
 	if(!req)
 	{
 		llwarns << "LLAssetStorage::downloadCompleteCallback called without"
 			"a valid request." << llendl;
-		return;
+		// we can live with a null pointer, we're not allowed to deref the ptr anyway (see above)
+		// return;  
 	}
 	if (!gAssetStorage)
 	{
@@ -529,12 +532,10 @@
 		return;
 	}
 
-	req->setUUID(file_id);
-	req->setType(file_type);
 	if (LL_ERR_NOERR == result)
 	{
 		// we might have gotten a zero-size file
-		LLVFile vfile(gAssetStorage->mVFS, req->getUUID(), req->getType());
+		LLVFile vfile(gAssetStorage->mVFS, file_id, file_type);
 		if (vfile.getSize() <= 0)
 		{
 			llwarns << "downloadCompleteCallback has non-existent or zero-size asset " << req->getUUID() << llendl;
@@ -553,7 +554,7 @@
 	{
 		request_list_t::iterator curiter = iter++;
 		LLAssetRequest* tmp = *curiter;
-		if ((tmp->getUUID() == req->getUUID()) && (tmp->getType()== req->getType()))
+		if ((tmp->getUUID() == file_id) && (tmp->getType() == file_type))
 		{
 			requests.push_front(tmp);
 			iter = gAssetStorage->mPendingDownloads.erase(curiter);
@@ -566,7 +567,7 @@
 		LLAssetRequest* tmp = *curiter;
 		if (tmp->mDownCallback)
 		{
-			tmp->mDownCallback(gAssetStorage->mVFS, req->getUUID(), req->getType(), tmp->mUserData, result, ext_status);
+			tmp->mDownCallback(gAssetStorage->mVFS, tmp->getUUID(), tmp->getType(), tmp->mUserData, result, ext_status);
 		}
 		delete tmp;
 	}
@@ -662,10 +663,10 @@
 	S32 result,
 	const LLUUID& file_id,
 	LLAssetType::EType file_type,
-	void* user_data,
+	void* callback_parm_req,
 	LLExtStat ext_status)
 {
-	LLEstateAssetRequest *req = (LLEstateAssetRequest*)user_data;
+	LLEstateAssetRequest *req = (LLEstateAssetRequest*)callback_parm_req;
 	if(!req)
 	{
 		llwarns << "LLAssetStorage::downloadEstateAssetCompleteCallback called"
@@ -679,12 +680,10 @@
 		return;
 	}
 
-	req->setUUID(file_id);
-	req->setType(file_type);
 	if (LL_ERR_NOERR == result)
 	{
 		// we might have gotten a zero-size file
-		LLVFile vfile(gAssetStorage->mVFS, req->getUUID(), req->getAType());
+		LLVFile vfile(gAssetStorage->mVFS, file_id, file_type);
 		if (vfile.getSize() <= 0)
 		{
 			llwarns << "downloadCompleteCallback has non-existent or zero-size asset!" << llendl;
@@ -694,7 +693,9 @@
 		}
 	}
 
-	req->mDownCallback(gAssetStorage->mVFS, req->getUUID(), req->getAType(), req->mUserData, result, ext_status);
+	req->mDownCallback(gAssetStorage->mVFS, file_id, file_type, req->mUserData, result, ext_status);
+
+	delete req;
 }
 
 void LLAssetStorage::getInvItemAsset(const LLHost &object_sim, const LLUUID &agent_id, const LLUUID &session_id,
@@ -799,10 +800,10 @@
 	S32 result,
 	const LLUUID& file_id,
 	LLAssetType::EType file_type,
-	void* user_data,
+	void* callback_parm_req,
 	LLExtStat ext_status)
 {
-	LLInvItemRequest *req = (LLInvItemRequest*)user_data;
+	LLInvItemRequest *req = (LLInvItemRequest*)callback_parm_req;
 	if(!req)
 	{
 		llwarns << "LLAssetStorage::downloadEstateAssetCompleteCallback called"
@@ -815,12 +816,10 @@
 		return;
 	}
 
-	req->setUUID(file_id);
-	req->setType(file_type);
 	if (LL_ERR_NOERR == result)
 	{
 		// we might have gotten a zero-size file
-		LLVFile vfile(gAssetStorage->mVFS, req->getUUID(), req->getType());
+		LLVFile vfile(gAssetStorage->mVFS, file_id, file_type);
 		if (vfile.getSize() <= 0)
 		{
 			llwarns << "downloadCompleteCallback has non-existent or zero-size asset!" << llendl;
@@ -830,7 +829,9 @@
 		}
 	}
 
-	req->mDownCallback(gAssetStorage->mVFS, req->getUUID(), req->getType(), req->mUserData, result, ext_status);
+	req->mDownCallback(gAssetStorage->mVFS, file_id, file_type, req->mUserData, result, ext_status);
+
+	delete req;
 }
 
 /////////////////////////////////////////////////////////////////////////////////////////////////////////////////