Removing a SampleTCO while it plays will crash lmms (master and latest rc)

[Reflexe]

Steps to reproduce

• Open lmms
• load a sampletrack (doubleclick on a sample track and select an audio file)
• play it
• remove it while it plays (middle mouse button)
• see if lmms crashes

Please verify it so I'll work on a solution.

[BaraMGB]

It crashes only with the middle mouse button. If I use the context menu, it doesn't crash.

[PhysSong]

Could you test the latest stable-1.2? I think it might have been fixed recently.

[Reflexe]

@PhysSong It is probably a race condition since I had to do that a couple of times in order to reproduce it. ‎This is the crash's stacktrace:

1  ??                                                                                                      0x7ffff603aadb 
2  SampleBuffer::play(float ( *) [2], SampleBuffer::handleState *, short, float, SampleBuffer::LoopMode)   0x5555556b3c1f 
3  SamplePlayHandle::play(float ( *) [2])                                                                  0x5555556b72ff 
4  MixerWorkerThread::JobQueue::run()                                                                      0x55555569a5d8 
5  MixerWorkerThread::startAndWaitForJobs()                                                                0x55555569a76f 
6  Mixer::renderNextBuffer()                                                                               0x5555556983aa 
7  Mixer::fifoWriter::run()                                                                                0x555555698914 
8  ??                                                                                                      0x7ffff71a7feb 
9  start_thread                                                                                            0x7ffff7f7ea92 
10 clone                                                                                                   0x7ffff5bfdcd3 

The problem

sharedObject::unref might delete SampleBuffer, but we don't protect it with requestChangesInModel.

[PhysSong]

I found that TrackContentObjectView::remove may result in deleting TCOs while the mixer is rendering audio. So, I was working on the other approach than #4982:

diff --git a/src/core/Track.cpp b/src/core/Track.cpp
index 7a04ded95..eb8ebb3dc 100644
--- a/src/core/Track.cpp
+++ b/src/core/Track.cpp
@@ -422,7 +422,9 @@ void TrackContentObjectView::remove()
 
        // delete ourself
        close();
-       m_tco->deleteLater();
+       Engine::mixer()->requestChangeInModel();
+       delete m_tco;
+       Engine::mixer()->doneChangeInModel();
 }

#4982 looks fine, and I don't mind if any of them is accepted.

[Reflexe]

I think that your solution might actually be better, but for some reason, lmms still crashes with this solution; I need the research ti fouther.

We also have a problem with this function being called twice in a row; that will simply cause a double-free.

[Reflexe]

OK, for now, I'm going to merge it for stable-1.2. The recording branch has a better fix for that and will target master.

[BaraMGB]

@Reflexe is there a reason why you reopened this?