Executing TextEdit.menu_option function crashes Godot

[qarmin]

Tested versions

4.3.dev. f91db3d

System information

Ubuntu 22.04 CI

Issue description

When executing (this code was automatically minimized, so it is possible, that an even more "minimal" project can be created)

extends Node
func _process(delta):
	for i in get_children():
		i.queue_free()
	var temp_variable28608 = AudioListener3D.new()
	add_child(temp_variable28608)
	temp_variable28608.queue_free()
	var temp_variable28839 = NavigationLink3D.new()
	add_child(temp_variable28839)
	temp_variable28839.queue_free()
	var temp_variable29043 = TextEdit.new()
	add_child(temp_variable29043)
	temp_variable29043.get_line_width(-84, 17)
	temp_variable29043.is_gutter_overwritable(98)
	temp_variable29043.begin_multicaret_edit()
	temp_variable29043.collapse_carets(1, 21, -22, -41, false)
	temp_variable29043.menu_option(2)

Godot crashes:

Godot Engine v4.3.dev.custom_build - https://godotengine.org
thirdparty/harfbuzz/src/OT/name/../../hb-open-type.hh:543:11: runtime error: index 2 out of bounds for type 'NameRecord [1]'
thirdparty/harfbuzz/src/OT/name/../../hb-open-type.hh:543:11: runtime error: index 2 out of bounds for type 'NameRecord [1]'
ERROR: Index p_line = -84 is out of bounds (text.size() = 1).
   at: get_line_width (scene/gui/text_edit.cpp:3361)
ERROR: Index p_gutter = 98 is out of bounds (gutters.size() = 0).
   at: is_gutter_overwritable (scene/gui/text_edit.cpp:6075)
ERROR: FATAL: Index p_index = 0 is out of bounds (size() = 0).
   at: get (./core/templates/cowdata.h:205)
================================================================
handle_crash: Program crashed with signal 4
Engine version: Godot Engine v4.3.dev.custom_build
Dumping the backtrace. Please include this when reporting the bug to the project developer.
[1] ./godot.linuxbsd.editor.dev.x86_64.san(+0x4009b42b) [0x561cdf24f42b] (/home/runner/work/Qarminer/Qarminer/godot/platform/linuxbsd/crash_handler_linuxbsd.cpp:61)
[2] /lib/x86_64-linux-gnu/libc.so.6(+0x42520) [0x7f47ae642520] (??:0)
[3] CowData<int>::get(long) const (/home/runner/work/Qarminer/Qarminer/godot/./core/templates/cowdata.h:205 (discriminator 7))
[4] Vector<int>::operator[](long) const (/home/runner/work/Qarminer/Qarminer/godot/./core/templates/vector.h:97)
[5] TextEdit::_paste_internal(int) (/home/runner/work/Qarminer/Qarminer/godot/scene/gui/text_edit.cpp:7064)
[6] TextEdit::paste(int) (/home/runner/work/Qarminer/Qarminer/godot/scene/gui/text_edit.cpp:3721)
[7] TextEdit::menu_option(int) (/home/runner/work/Qarminer/Qarminer/godot/scene/gui/text_edit.cpp:3753)
[8] void call_with_variant_args_helper<__UnexistingClass, int, 0ul>(__UnexistingClass*, void (__UnexistingClass::*)(int), Variant const**, Callable::CallError&, IndexSequence<0ul>) (/home/runner/work/Qarminer/Qarminer/godot/./core/variant/binder_common.h:309 (discriminator 4))
[9] void call_with_variant_args_dv<__UnexistingClass, int>(__UnexistingClass*, void (__UnexistingClass::*)(int), Variant const**, int, Callable::CallError&, Vector<Variant> const&) (/home/runner/work/Qarminer/Qarminer/godot/./core/variant/binder_common.h:422)
[10] MethodBindT<int>::call(Object*, Variant const**, int, Callable::CallError&) const (/home/runner/work/Qarminer/Qarminer/godot/./core/object/method_bind.h:344)
[11] Object::callp(StringName const&, Variant const**, int, Callable::CallError&) (/home/runner/work/Qarminer/Qarminer/godot/core/object/object.cpp:842)
[12] Variant::callp(StringName const&, Variant const**, int, Variant&, Callable::CallError&) (/home/runner/work/Qarminer/Qarminer/godot/core/variant/variant_call.cpp:1212)
[13] GDScriptFunction::call(GDScriptInstance*, Variant const**, int, Callable::CallError&, GDScriptFunction::CallState*) (/home/runner/work/Qarminer/Qarminer/godot/modules/gdscript/gdscript_vm.cpp:1764)
[14] GDScriptInstance::callp(StringName const&, Variant const**, int, Callable::CallError&) (/home/runner/work/Qarminer/Qarminer/godot/modules/gdscript/gdscript.cpp:1978)
[15] bool Node::_gdvirtual__process_call<false>(double) (/home/runner/work/Qarminer/Qarminer/godot/scene/main/node.h:350 (discriminator 1))
[16] Node::_notification(int) (/home/runner/work/Qarminer/Qarminer/godot/scene/main/node.cpp:58)
[17] Node::_notificationv(int, bool) (/home/runner/work/Qarminer/Qarminer/godot/./scene/main/node.h:49 (discriminator 14))
[18] Object::notification(int, bool) (/home/runner/work/Qarminer/Qarminer/godot/core/object/object.cpp:907)
[19] SceneTree::_process_group(SceneTree::ProcessGroup*, bool) (/home/runner/work/Qarminer/Qarminer/godot/scene/main/scene_tree.cpp:963)
[20] SceneTree::_process(bool) (/home/runner/work/Qarminer/Qarminer/godot/scene/main/scene_tree.cpp:1035 (discriminator 2))
[21] SceneTree::process(double) (/home/runner/work/Qarminer/Qarminer/godot/scene/main/scene_tree.cpp:529)
[22] Main::iteration() (/home/runner/work/Qarminer/Qarminer/godot/main/main.cpp:4040)
[23] OS_LinuxBSD::run() (/home/runner/work/Qarminer/Qarminer/godot/platform/linuxbsd/os_linuxbsd.cpp:962)
[24] ./godot.linuxbsd.editor.dev.x86_64.san(main+0x4c7) [0x561cdf24edc0] (/home/runner/work/Qarminer/Qarminer/godot/platform/linuxbsd/godot_linuxbsd.cpp:85)
[25] /lib/x86_64-linux-gnu/libc.so.6(+0x29d90) [0x7f47ae629d90] (??:0)
[26] /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0x80) [0x7f47ae629e40] (??:0)
[27] ./godot.linuxbsd.editor.dev.x86_64.san(_start+0x25) [0x561cdf24e835] (??:?)
-- END OF BACKTRACE --
================================================================
Aborted (core dumped)

This example was found by Godot fuzzer - Qarminer, so it is quite unlikelly that this code could be used in real project, but still this should be handled gracefully.

Memory leaks or asan backtraces are visible when using Godot build with sanitizers support - https://github.com/qarmin/GodotBuilds/actions (linux -> linux-editor-sanitizers)

Steps to reproduce

Above

Minimal reproduction project (MRP)

Above

[akien-mga]

To clarify, is this a newly introduced issue? The timing of the report comes shortly after the merge of #86978 which sounds potentially related, so being able to make this connnection early on can help with finding the best fix. CC @kitbdev