Segmentation fault on quit in MidiPort::setMode(...)

[zonkmachine]

Crash on exit, LinuxMint 17.3
Version 1.2.0-rc49.7 (Linux/x86_64, Qt 4.8.6, GCC 4.8.5)

(gdb) bt full

(gdb) run
...
Program received signal SIGSEGV, Segmentation fault.
0x0000000000573fd8 in MidiPort::setMode (this=0x7fffeadfc9a8, mode=MidiPort::Disabled) at /home/zonkmachine/builds/lmms/lmms/src/core/midi/MidiPort.cpp:111
111		m_midiClient->applyPortMode( this );
(gdb) bt
#0  0x0000000000573fd8 in MidiPort::setMode (this=0x7fffeadfc9a8, mode=MidiPort::Disabled)
    at /home/zonkmachine/builds/lmms/lmms/src/core/midi/MidiPort.cpp:111
#1  0x000000000057500e in MidiPort::updateMidiPortMode (this=0x7fffeadfc9a8) at /home/zonkmachine/builds/lmms/lmms/src/core/midi/MidiPort.cpp:313
#2  0x000000000062f318 in MidiPort::qt_static_metacall (_o=0x7fffeadfc9a8, _c=QMetaObject::InvokeMetaMethod, _id=3, _a=0x7fffffffd280)
    at /home/zonkmachine/builds/lmms/lmms/build/src/moc_MidiPort.cpp:62
#3  0x00007ffff697087a in QMetaObject::activate (sender=0x7fffeadfd0c0, m=<optimized out>, local_signal_index=<optimized out>, argv=0x0)
    at kernel/qobject.cpp:3539
#4  0x000000000062fb91 in Model::dataChanged (this=0x7fffeadfd0c0) at /home/zonkmachine/builds/lmms/lmms/build/src/moc_Model.cpp:102
#5  0x00000000004e00ea in AutomatableModel::setValue (this=0x7fffeadfd0c0, value=0) at /home/zonkmachine/builds/lmms/lmms/src/core/AutomatableModel.cpp:241
#6  0x0000000000573dcf in MidiPort::~MidiPort (this=0x7fffeadfc9a8, __in_chrg=<optimized out>)
    at /home/zonkmachine/builds/lmms/lmms/src/core/midi/MidiPort.cpp:89
#7  0x0000000000571cc5 in MidiController::~MidiController (this=0x7fffeadfc920, __in_chrg=<optimized out>)
    at /home/zonkmachine/builds/lmms/lmms/src/core/midi/MidiController.cpp:52
#8  0x0000000000571d22 in MidiController::~MidiController (this=0x7fffeadfc920, __in_chrg=<optimized out>)
    at /home/zonkmachine/builds/lmms/lmms/src/core/midi/MidiController.cpp:54
#9  0x00007ffff6973168 in QObjectPrivate::deleteChildren (this=this@entry=0xc2e7a0) at kernel/qobject.cpp:1907
#10 0x00007ffff69756ff in QObject::~QObject (this=0xc37150, __in_chrg=<optimized out>) at kernel/qobject.cpp:926
#11 0x00000000004e1a84 in Model::~Model (this=0xc37150, __in_chrg=<optimized out>) at /home/zonkmachine/builds/lmms/lmms/include/Model.h:47
#12 0x000000000055ec66 in TrackContainer::~TrackContainer (this=0xc37150, __in_chrg=<optimized out>)
    at /home/zonkmachine/builds/lmms/lmms/src/core/TrackContainer.cpp:50
#13 0x000000000054b2ad in Song::~Song (this=0xc37150, __in_chrg=<optimized out>) at /home/zonkmachine/builds/lmms/lmms/src/core/Song.cpp:129
#14 0x000000000054b2e6 in Song::~Song (this=0xc37150, __in_chrg=<optimized out>) at /home/zonkmachine/builds/lmms/lmms/src/core/Song.cpp:133

[zonkmachine]

I see this crash a whole lot and will try and find a reliable method/project to reproduce it.

[PhysSong]

A little bit different crash backtrace, but I found a way to constantly reproduce this issue.

1. Open the default project
2. Connect the tempo to any midi controller.
3. Close the project.
4. LMMS will crash.

#0  0x0000000000e9ace0 in ?? ()
#1  0x00000000005913a7 in MidiPort::updateMidiPortMode() ()
#2  0x00007ffff4ac8d2a in QMetaObject::activate(QObject*, int, int, void**) ()
   from /usr/lib/x86_64-linux-gnu/libQt5Core.so.5
#3  0x00000000004ce6bc in AutomatableModel::setValue(float) ()
#4  0x000000000058fead in MidiPort::~MidiPort() ()
#5  0x000000000058e737 in MidiController::~MidiController() ()
#6  0x000000000058e749 in MidiController::~MidiController() ()
#7  0x00000000004ed20f in ControllerConnection::~ControllerConnection() ()
#8  0x00000000004ed369 in ControllerConnection::~ControllerConnection() [clone .localalias.11] ()
#9  0x00000000004cfae0 in AutomatableModel::~AutomatableModel() ()
#10 0x0000000000562317 in Song::~Song() ()
#11 0x0000000000562369 in Song::~Song() ()

I'm investigating this...

[PhysSong]

MidiPort destructor calls MidiClient::removePort. MidiClient instance is destroyed when the mixer is deleted. However, Song is destroyed after Mixer. So when such controller connection is cleaned up, the MidiPort's m_midiClient points to invalid(already deleted) address.