Executing TextServerDummy.string_get_character_breaks function crashes Godot

[qarmin]

Godot version

4.2.dev.custom_build. b51ee8b

System information

Ubuntu 22.04 CI

Issue description

Crash happens in new function added in #80650

When executing

extends Node
func _process(delta):

	var temp_variable2285 = MeshInstance2D.new()
	add_child(temp_variable2285)
	temp_variable2285.has_method(StringName("5555"))
	temp_variable2285.get_process_thread_group()
	temp_variable2285.queue_free()

	var temp_variable2511 = TextServerDummy.new()
	temp_variable2511.font_set_msdf_pixel_range(RID(), -91)
	temp_variable2511.tag_to_name(-95)
	temp_variable2511.string_get_character_breaks("127.0.0.1", "")

Godot crashes:

ERROR: FATAL: Index p_index = 10 is out of bounds (((Vector<T> *)(this))->_cowdata.size() = 10).
   at: operator[] (./core/templates/vector.h:52)

================================================================
handle_crash: Program crashed with signal 4
Engine version: Godot Engine v4.2.dev.custom_build (b51ee8b029b0b9f719f01bbdd21a329e65d4d238)
Dumping the backtrace. Please include this when reporting the bug to the project developer.
[1] ./godot.linuxbsd.editor.dev.x86_64.san(+0x39ddb484) [0x5617804c1484] (/home/runner/work/Qarminer/Qarminer/godot/platform/linuxbsd/crash_handler_linuxbsd.cpp:57)
[2] /lib/x86_64-linux-gnu/libc.so.6(+0x42520) [0x7f8fac649520] (??:0)
[3] VectorWriteProxy<int>::operator[](int) (/home/runner/work/Qarminer/Qarminer/godot/./core/templates/vector.h:52 (discriminator 7))
[4] TextServer::string_get_character_breaks(String const&, String const&) const (/home/runner/work/Qarminer/Qarminer/godot/servers/text_server.cpp:1479 (discriminator 3))
[5] TextServerExtension::string_get_character_breaks(String const&, String const&) const (/home/runner/work/Qarminer/Qarminer/godot/servers/text/text_server_extension.cpp:1446)
[6] void call_with_variant_args_retc_helper<__UnexistingClass, Vector<int>, String const&, String const&, 0ul, 1ul>(__UnexistingClass*, Vector<int> (__UnexistingClass::*)(String const&, String const&) const, Variant const**, Variant&, Callable::CallError&, IndexSequence<0ul, 1ul>) (/home/runner/work/Qarminer/Qarminer/godot/./core/variant/binder_common.h:806 (discriminator 4))
[7] void call_with_variant_args_retc_dv<__UnexistingClass, Vector<int>, String const&, String const&>(__UnexistingClass*, Vector<int> (__UnexistingClass::*)(String const&, String const&) const, Variant const**, int, Variant&, Callable::CallError&, Vector<Variant> const&) (/home/runner/work/Qarminer/Qarminer/godot/./core/variant/binder_common.h:538)
[8] MethodBindTRC<Vector<int>, String const&, String const&>::call(Object*, Variant const**, int, Callable::CallError&) const (/home/runner/work/Qarminer/Qarminer/godot/./core/object/method_bind.h:579)
[9] Object::callp(StringName const&, Variant const**, int, Callable::CallError&) (/home/runner/work/Qarminer/Qarminer/godot/core/object/object.cpp:741)
[10] Variant::callp(StringName const&, Variant const**, int, Variant&, Callable::CallError&) (/home/runner/work/Qarminer/Qarminer/godot/core/variant/variant_call.cpp:1174)
[11] GDScriptFunction::call(GDScriptInstance*, Variant const**, int, Callable::CallError&, GDScriptFunction::CallState*) (/home/runner/work/Qarminer/Qarminer/godot/modules/gdscript/gdscript_vm.cpp:1734)
[12] GDScriptInstance::callp(StringName const&, Variant const**, int, Callable::CallError&) (/home/runner/work/Qarminer/Qarminer/godot/modules/gdscript/gdscript.cpp:1892)
[13] bool Node::_gdvirtual__process_call<false>(double) (/home/runner/work/Qarminer/Qarminer/godot/scene/main/node.h:318 (discriminator 1))
[14] Node::_notification(int) (/home/runner/work/Qarminer/Qarminer/godot/scene/main/node.cpp:57)
[15] Node::_notificationv(int, bool) (/home/runner/work/Qarminer/Qarminer/godot/./scene/main/node.h:49 (discriminator 14))
[16] Object::notification(int, bool) (/home/runner/work/Qarminer/Qarminer/godot/core/object/object.cpp:800)
[17] SceneTree::_process_group(SceneTree::ProcessGroup*, bool) (/home/runner/work/Qarminer/Qarminer/godot/scene/main/scene_tree.cpp:948)
[18] SceneTree::_process(bool) (/home/runner/work/Qarminer/Qarminer/godot/scene/main/scene_tree.cpp:1020 (discriminator 2))
[19] SceneTree::process(double) (/home/runner/work/Qarminer/Qarminer/godot/scene/main/scene_tree.cpp:510)
[20] Main::iteration() (/home/runner/work/Qarminer/Qarminer/godot/main/main.cpp:3501)
[21] OS_LinuxBSD::run() (/home/runner/work/Qarminer/Qarminer/godot/platform/linuxbsd/os_linuxbsd.cpp:933)
[22] ./godot.linuxbsd.editor.dev.x86_64.san(main+0x58f) [0x5617804c0f18] (/home/runner/work/Qarminer/Qarminer/godot/platform/linuxbsd/godot_linuxbsd.cpp:76)
[23] /lib/x86_64-linux-gnu/libc.so.6(+0x29d90) [0x7f8fac630d90] (??:0)
[24] /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0x80) [0x7f8fac630e40] (??:0)
[25] ./godot.linuxbsd.editor.dev.x86_64.san(_start+0x25) [0x5617804c08c5] (??:?)
-- END OF BACKTRACE --
================================================================
Aborted (core dumped)

This example was found by Godot fuzzer - Qarminer, so it is quite unlikelly that this code could be used in real project, but still this should be handled gracefully.

Memory leaks or asan backtraces are visibe when using Godot build with sanitizers support - https://github.com/qarmin/GodotBuilds/actions (linux -> linux-editor-sanitizers)

Steps to reproduce

Above

Minimal reproduction project

Above