Executing RichTextLabel functions crashes Godot

[qarmin]

Godot version

4.2.dev.custom_build. 60f3b79

System information

Ubuntu 22.04 CI

Issue description

When executing

extends Node
func _process(delta):
	for i in get_children():
		i.queue_free()

	var temp_variable16897 = RichTextLabel.new()
	add_child(temp_variable16897)
	temp_variable16897.get_content_width()
	temp_variable16897.push_list(12, -48, false, "127.0.0.1")
	temp_variable16897.newline()
	temp_variable16897.push_font(FontFile.new(), 79)
	temp_variable16897.push_outline_color(Color(73.4791259765625, -86.9401092529297, 58.615779876709, 1))
	temp_variable16897.push_indent(17)
	temp_variable16897.newline()
	temp_variable16897.get_line_offset(-78)
	temp_variable16897.remove_paragraph(4)

Godot crashes:

 ######################## Ending test ########################
ERROR: FATAL: Index p_index = 4 is out of bounds (count = 4).
   at: operator[] (./core/templates/local_vector.h:161)

================================================================
handle_crash: Program crashed with signal 4
Engine version: Godot Engine v4.2.dev.custom_build (60f3b7967cbd00b4e1f52d33d372646f7bec02f6)
Dumping the backtrace. Please include this when reporting the bug to the project developer.
[1] ./godot.linuxbsd.editor.dev.x86_64.san(+0x3a6809cc) [0x557ca49b79cc] (/home/runner/work/Qarminer/Qarminer/godot/platform/linuxbsd/crash_handler_linuxbsd.cpp:57)
[2] /lib/x86_64-linux-gnu/libc.so.6(+0x42520) [0x7faeaa185520] (??:0)
[3] LocalVector<RichTextLabel::Line, unsigned int, false, false>::operator[](unsigned int) (/home/runner/work/Qarminer/Qarminer/godot/./core/templates/local_vector.h:161 (discriminator 1))
[4] RichTextLabel::_validate_line_caches() (/home/runner/work/Qarminer/Qarminer/godot/scene/gui/rich_text_label.cpp:2862 (discriminator 1))
[5] RichTextLabel::_notification(int) (/home/runner/work/Qarminer/Qarminer/godot/scene/gui/rich_text_label.cpp:1842)
[6] RichTextLabel::_notificationv(int, bool) (/home/runner/work/Qarminer/Qarminer/godot/scene/gui/rich_text_label.h:41 (discriminator 14))
[7] Object::notification(int, bool) (/home/runner/work/Qarminer/Qarminer/godot/core/object/object.cpp:798)
[8] CanvasItem::_redraw_callback() (/home/runner/work/Qarminer/Qarminer/godot/scene/main/canvas_item.cpp:141)
[9] void call_with_variant_args_helper<CanvasItem>(CanvasItem*, void (CanvasItem::*)(), Variant const**, Callable::CallError&, IndexSequence<>) (/home/runner/work/Qarminer/Qarminer/godot/./core/variant/binder_common.h:308 (discriminator 4))
[10] void call_with_variant_args<CanvasItem>(CanvasItem*, void (CanvasItem::*)(), Variant const**, int, Callable::CallError&) (/home/runner/work/Qarminer/Qarminer/godot/./core/variant/binder_common.h:403)
[11] CallableCustomMethodPointer<CanvasItem>::call(Variant const**, int, Variant&, Callable::CallError&) const (/home/runner/work/Qarminer/Qarminer/godot/./core/object/callable_method_pointer.h:105)
[12] Callable::callp(Variant const**, int, Variant&, Callable::CallError&) const (/home/runner/work/Qarminer/Qarminer/godot/core/variant/callable.cpp:64)
[13] CallQueue::_call_function(Callable const&, Variant const*, int, bool) (/home/runner/work/Qarminer/Qarminer/godot/core/object/message_queue.cpp:220)
[14] CallQueue::flush() (/home/runner/work/Qarminer/Qarminer/godot/core/object/message_queue.cpp:322)
[15] SceneTree::process(double) (/home/runner/work/Qarminer/Qarminer/godot/scene/main/scene_tree.cpp:511 (discriminator 4))
[16] Main::iteration() (/home/runner/work/Qarminer/Qarminer/godot/main/main.cpp:3431)
[17] OS_LinuxBSD::run() (/home/runner/work/Qarminer/Qarminer/godot/platform/linuxbsd/os_linuxbsd.cpp:912)
[18] ./godot.linuxbsd.editor.dev.x86_64.san(main+0x58f) [0x557ca49b7378] (/home/runner/work/Qarminer/Qarminer/godot/platform/linuxbsd/godot_linuxbsd.cpp:76)
[19] /lib/x86_64-linux-gnu/libc.so.6(+0x29d90) [0x7faeaa16cd90] (??:0)
[20] /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0x80) [0x7faeaa16ce40] (??:0)
[21] ./godot.linuxbsd.editor.dev.x86_64.san(_start+0x25) [0x557ca49b6d25] (??:?)
-- END OF BACKTRACE --
================================================================
Aborted (core dumped)

This example was found by Godot fuzzer - Qarminer, so it is quite unlikelly that this code could be used in real project, but still this should be handled gracefully.

Memory leaks or asan backtraces are visibe when using Godot build with sanitizers support - https://github.com/qarmin/GodotBuilds/actions (linux -> linux-editor-sanitizers)

Steps to reproduce

Above

Minimal reproduction project

Above

[knochenhans]

I’m running into the same problem, here is an even simpler Minimal reproduction project using C#, Godot 4.1.1 in Linux.

This is code I used, seems to be related to the Newline() function.

using Godot;

public partial class RichTextLabel : Godot.RichTextLabel
{
    public override void _Ready()
    {
        AppendText("1");
        AppendText("2");
        // Newline(); <-- uncommenting this line crashes the project
        RemoveParagraph(GetParagraphCount() - 1);
        RemoveParagraph(GetParagraphCount() - 1);
    }
}

Crashlog:

Godot Engine v4.1.1.stable.mono.official.bd6af8e0e - https://godotengine.org
Vulkan API 1.3.246 - Forward Mobile - Using Vulkan Device #0: AMD - AMD Radeon Graphics (RADV RENOIR)

ERROR: FATAL: Index p_index = 4294967295 is out of bounds (count = 0).
   at: operator[] (./core/templates/local_vector.h:161)

================================================================
handle_crash: Program crashed with signal 4
Engine version: Godot Engine v4.1.1.stable.mono.official (bd6af8e0ea69167dd0627f3bd54f9105bda0f8b5)
Dumping the backtrace. Please include this when reporting the bug to the project developer.
[1] /usr/share/dotnet/shared/Microsoft.NETCore.App/7.0.7/libcoreclr.so(+0x4a9cee) [0x7fcebbca9cee] (??:0)
[2] /usr/lib/libc.so.6(+0x39ab0) [0x7fcefa376ab0] (??:0)
[3] /usr/bin/godot-mono() [0x302d557] (??:0)
[4] /usr/bin/godot-mono() [0x4826124] (??:0)
[5] /usr/bin/godot-mono() [0x2d6c180] (??:0)
[6] /usr/bin/godot-mono() [0x4e89c25] (??:0)
[7] /usr/bin/godot-mono() [0x489b7b0] (??:0)
[8] /usr/bin/godot-mono() [0x2dc0253] (??:0)
[9] /usr/bin/godot-mono() [0xf24436] (??:0)
[10] /usr/bin/godot-mono() [0xe54664] (??:0)
[11] /usr/lib/libc.so.6(+0x23850) [0x7fcefa360850] (??:0)
[12] /usr/lib/libc.so.6(__libc_start_main+0x8a) [0x7fcefa36090a] (??:0)
[13] /usr/bin/godot-mono() [0xe86e5e] (??:0)
-- END OF BACKTRACE --
================================================================
The program '[683979] godot-mono' has exited with code 0 (0x0).

richtexttest.zip