Add MX lock to InstanceSave::Add/RemovePlayer. Because BindToInstance can be called within Player::Update.

Try to fix crashes #2514 and #2177. May also fix #3466, #2862 and #2239.

src/server/game/Instances/InstanceSaveMgr.h

@@ -80,8 +80,8 @@ class InstanceSave
 
         /* online players bound to the instance (perm/solo)
            does not include the members of the group unless they have permanent saves */
-        void AddPlayer(Player* player) { m_playerList.push_back(player); }
-        bool RemovePlayer(Player* player) { m_playerList.remove(player); return UnloadIfEmpty(); }
+        void AddPlayer(Player* player) { ACE_GUARD(ACE_Thread_Mutex, guard, _lock); m_playerList.push_back(player); }
+        bool RemovePlayer(Player* player) { ACE_GUARD_RETURN(ACE_Thread_Mutex, guard, _lock, false); m_playerList.remove(player); return UnloadIfEmpty(); }
         /* all groups bound to the instance */
         void AddGroup(Group* group) { m_groupList.push_back(group); }
         bool RemoveGroup(Group* group) { m_groupList.remove(group); return UnloadIfEmpty(); }
@@ -110,6 +110,8 @@ class InstanceSave
         uint32 m_mapid;
         Difficulty m_difficulty;
         bool m_canReset;
+
+        ACE_Thread_Mutex _lock;
 };
 
 typedef UNORDERED_MAP<uint32 /*PAIR32(map, difficulty)*/, time_t /*resetTime*/> ResetTimeByMapDifficultyMap;