Repository: godot
Issue: Crash, when using multithread physics and small amount of physics ticks per second(e.g. 1)
Labels: bug,topic:physics,crash

### Tested versions

4.3.beta.custom_build.daa81bbb7


### System information

Ubuntu 24.04

### Issue description

When running test physics project, which removes and adds randomly thousands of physics nodes, then I got this crash(after a few seconds) 
```
=================================================================
==513240==ERROR: AddressSanitizer: heap-use-after-free on address 0x531000118818 at pc 0x573724640323 bp 0x7237bc5fecc0 sp 0x7237bc5fecb0
READ of size 8 at 0x531000118818 thread T3
-- Created CollisionPolygon3D
-- Created CollisionShape3D
-- Created CollisionPolygon3D
-- Created CollisionShape3D
-- Created CollisionShape3D
-- Creating - DampedSpringJoint2D
    #0 0x573724640322 in CommandQueueMT::_flush() core/templates/command_queue_mt.h:373
    #1 0x57372464117b in CommandQueueMT::flush_all() core/templates/command_queue_mt.h:431
    #2 0x57373e98b988 in PhysicsServer2DWrapMT::_thread_loop() servers/physics_server_2d_wrap_mt.cpp:47
    #3 0x57373ea6dd12 in void call_with_variant_args_helper<PhysicsServer2DWrapMT>(PhysicsServer2DWrapMT*, void (PhysicsServer2DWrapMT::*)(), Variant const**, Callable::CallError&, IndexSequence<>) core/variant/binder_common.h:304
    #4 0x57373ea6d836 in void call_with_variant_args<PhysicsServer2DWrapMT>(PhysicsServer2DWrapMT*, void (PhysicsServer2DWrapMT::*)(), Variant const**, int, Callable::CallError&) core/variant/binder_common.h:418
    #5 0x57373ea38b7c in CallableCustomMethodPointer<PhysicsServer2DWrapMT>::call(Variant const**, int, Variant&, Callable::CallError&) const core/object/callable_method_pointer.h:103
    #6 0x573740b512de in Callable::callp(Variant const**, int, Variant&, Callable::CallError&) const core/variant/callable.cpp:57
    #7 0x57372258f3d0 in Variant Callable::call<>() const core/variant/variant.h:875
    #8 0x573741a5440a in WorkerThreadPool::_process_task(WorkerThreadPool::Task*) core/object/worker_thread_pool.cpp:137
    #9 0x573741a560e9 in WorkerThreadPool::_thread_function(void*) core/object/worker_thread_pool.cpp:196
    #10 0x57373fda8fed in Thread::callback(unsigned long, Thread::Settings const&, void (*)(void*), void*) core/os/thread.cpp:64
    #11 0x57373fdac621 in void std::__invoke_impl<void, void (*)(unsigned long, Thread::Settings const&, void (*)(void*), void*), unsigned long, Thread::Settings, void (*)(void*), void*>(std::__invoke_other, void (*&&)(unsigned long, Thread::Settings const&, void (*)(void*), void*), unsigned long&&, Thread::Settings&&, void (*&&)(void*), void*&&) /usr/include/c++/11/bits/invoke.h:61
    #12 0x57373fdac233 in std::__invoke_result<void (*)(unsigned long, Thread::Settings const&, void (*)(void*), void*), unsigned long, Thread::Settings, void (*)(void*), void*>::type std::__invoke<void (*)(unsigned long, Thread::Settings const&, void (*)(void*), void*), unsigned long, Thread::Settings, void (*)(void*), void*>(void (*&&)(unsigned long, Thread::Settings const&, void (*)(void*), void*), unsigned long&&, Thread::Settings&&, void (*&&)(void*), void*&&) /usr/include/c++/11/bits/invoke.h:96
    #13 0x57373fdabca3 in void std::thread::_Invoker<std::tuple<void (*)(unsigned long, Thread::Settings const&, void (*)(void*), void*), unsigned long, Thread::Settings, void (*)(void*), void*> >::_M_invoke<0ul, 1ul, 2ul, 3ul, 4ul>(std::_Index_tuple<0ul, 1ul, 2ul, 3ul, 4ul>) /usr/include/c++/11/bits/std_thread.h:259
    #14 0x57373fdab8fd in std::thread::_Invoker<std::tuple<void (*)(unsigned long, Thread::Settings const&, void (*)(void*), void*), unsigned long, Thread::Settings, void (*)(void*), void*> >::operator()() /usr/include/c++/11/bits/std_thread.h:266
    #15 0x57373fdab8b1 in std::thread::_State_impl<std::thread::_Invoker<std::tuple<void (*)(unsigned long, Thread::Settings const&, void (*)(void*), void*), unsigned long, Thread::Settings, void (*)(void*), void*> > >::_M_run() /usr/include/c++/11/bits/std_thread.h:211
    #16 0x573743689083 in execute_native_thread_routine (/home/rafal/Downloads/rr/godot.linuxbsd.editor.dev.x86_64.san+0x63739083)
    #17 0x7237cae9ca93 in start_thread nptl/pthread_create.c:447
    #18 0x7237caf29c3b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

0x531000118818 is located 24 bytes inside of 65552-byte region [0x531000118800,0x531000128810)
freed by thread T0 here:
    #0 0x7237cbab4278 in __interceptor_realloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:164
    #1 0x57373fd86f05 in Memory::realloc_static(void*, unsigned long, bool) core/os/memory.cpp:129
    #2 0x5737226b8947 in LocalVector<unsigned char, unsigned int, false, false>::resize(unsigned int) core/templates/local_vector.h:161
    #3 0x57373ea2290b in CommandQueueMT::Command4<PhysicsServer2D, void (PhysicsServer2D::*)(RID, int, bool, float), RID, int, bool, float>* CommandQueueMT::allocate<CommandQueueMT::Command4<PhysicsServer2D, void (PhysicsServer2D::*)(RID, int, bool, float), RID, int, bool, float> >() core/templates/command_queue_mt.h:344
    #4 0x57373ea051e6 in void CommandQueueMT::push<PhysicsServer2D, void (PhysicsServer2D::*)(RID, int, bool, float), RID, int, bool, float>(PhysicsServer2D*, void (PhysicsServer2D::*)(RID, int, bool, float), RID, int, bool, float) core/templates/command_queue_mt.h:414
    #5 0x57373e9bd1b0 in PhysicsServer2DWrapMT::body_set_shape_as_one_way_collision(RID, int, bool, float) servers/physics_server_2d_wrap_mt.h:185
    #6 0x573737a0e9c4 in CollisionObject2D::shape_owner_set_one_way_collision(unsigned int, bool) scene/2d/physics/collision_object_2d.cpp:349
    #7 0x573737a9e71a in CollisionShape2D::_update_in_shape_owner(bool) scene/2d/physics/collision_shape_2d.cpp:48
    #8 0x573737a9ff3e in CollisionShape2D::_notification(int) scene/2d/physics/collision_shape_2d.cpp:66
    #9 0x573737ab0e0d in CollisionShape2D::_notificationv(int, bool) scene/2d/physics/collision_shape_2d.h:40
    #10 0x5737419064a2 in Object::notification(int, bool) core/object/object.cpp:903
    #11 0x573733ef4b1e in Node::_add_child_nocheck(Node*, StringName const&, Node::InternalMode) scene/main/node.cpp:1542
    #12 0x573733ef740a in Node::add_child(Node*, bool, Node::InternalMode) scene/main/node.cpp:1577
    #13 0x573734086e5d in void call_with_variant_args_helper<__UnexistingClass, Node*, bool, Node::InternalMode, 0ul, 1ul, 2ul>(__UnexistingClass*, void (__UnexistingClass::*)(Node*, bool, Node::InternalMode), Variant const**, Callable::CallError&, IndexSequence<0ul, 1ul, 2ul>) core/variant/binder_common.h:304
    #14 0x573734066cd2 in void call_with_variant_args_dv<__UnexistingClass, Node*, bool, Node::InternalMode>(__UnexistingClass*, void (__UnexistingClass::*)(Node*, bool, Node::InternalMode), Variant const**, int, Callable::CallError&, Vector<Variant> const&) core/variant/binder_common.h:451
    #15 0x57373404949d in MethodBindT<Node*, bool, Node::InternalMode>::call(Object*, Variant const**, int, Callable::CallError&) const core/object/method_bind.h:345
    #16 0x5737264cc8fa in GDScriptFunction::call(GDScriptInstance*, Variant const**, int, Callable::CallError&, GDScriptFunction::CallState*) modules/gdscript/gdscript_vm.cpp:1863
    #17 0x573725d66056 in GDScriptInstance::callp(StringName const&, Variant const**, int, Callable::CallError&) modules/gdscript/gdscript.cpp:2050
    #18 0x573741904504 in Object::callp(StringName const&, Variant const**, int, Callable::CallError&) core/object/object.cpp:819
    #19 0x573740c0f3f8 in Variant::callp(StringName const&, Variant const**, int, Variant&, Callable::CallError&) core/variant/variant_call.cpp:1211
    #20 0x5737264c8b9f in GDScriptFunction::call(GDScriptInstance*, Variant const**, int, Callable::CallError&, GDScriptFunction::CallState*) modules/gdscript/gdscript_vm.cpp:1767
    #21 0x573725d66056 in GDScriptInstance::callp(StringName const&, Variant const**, int, Callable::CallError&) modules/gdscript/gdscript.cpp:2050
    #22 0x573741904504 in Object::callp(StringName const&, Variant const**, int, Callable::CallError&) core/object/object.cpp:819
    #23 0x573740c0f3f8 in Variant::callp(StringName const&, Variant const**, int, Variant&, Callable::CallError&) core/variant/variant_call.cpp:1211
    #24 0x5737264c8b9f in GDScriptFunction::call(GDScriptInstance*, Variant const**, int, Callable::CallError&, GDScriptFunction::CallState*) modules/gdscript/gdscript_vm.cpp:1767
    #25 0x573725d66056 in GDScriptInstance::callp(StringName const&, Variant const**, int, Callable::CallError&) modules/gdscript/gdscript.cpp:2050
    #26 0x573733f89a58 in bool Node::_gdvirtual__process_call<false>(double) scene/main/node.h:351
    #27 0x573733eb71a7 in Node::_notification(int) scene/main/node.cpp:55
    #28 0x573724657905 in Node::_notificationv(int, bool) scene/main/node.h:50
    #29 0x5737419064a2 in Object::notification(int, bool) core/object/object.cpp:903

previously allocated by thread T0 here:
    #0 0x7237cbab3ec7 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
    #1 0x57373fd86289 in Memory::alloc_static(unsigned long, bool) core/os/memory.cpp:75
    #2 0x57373fd868d8 in Memory::realloc_static(void*, unsigned long, bool) core/os/memory.cpp:99
    #3 0x573741aa0817 in LocalVector<unsigned char, unsigned int, false, false>::reserve(unsigned int) core/templates/local_vector.h:144
    #4 0x573741aa03cf in CommandQueueMT::CommandQueueMT() core/templates/command_queue_mt.cpp:45
    #5 0x57373e990172 in PhysicsServer2DWrapMT::PhysicsServer2DWrapMT(PhysicsServer2D*, bool) servers/physics_server_2d_wrap_mt.cpp:105
    #6 0x57373ad2a03c in _createGodotPhysics2DCallback servers/register_server_types.cpp:131
    #7 0x57373af85820 in void call_with_variant_args_static_ret<PhysicsServer2D*>(PhysicsServer2D* (*)(), Variant const**, Variant&, Callable::CallError&, IndexSequence<>) (/home/rafal/Downloads/rr/godot.linuxbsd.editor.dev.x86_64.san+0x5b035820)
    #8 0x57373af5a725 in void call_with_variant_args_static_ret<PhysicsServer2D*>(PhysicsServer2D* (*)(), Variant const**, int, Variant&, Callable::CallError&) core/variant/binder_common.h:829
    #9 0x57373af35880 in CallableCustomStaticMethodPointerRet<PhysicsServer2D*>::call(Variant const**, int, Variant&, Callable::CallError&) const core/object/callable_method_pointer.h:309
    #10 0x573740b512de in Callable::callp(Variant const**, int, Variant&, Callable::CallError&) const core/variant/callable.cpp:57
    #11 0x57373abd97c7 in PhysicsServer2DManager::new_default_server() servers/physics_server_2d.cpp:976
    #12 0x5737227e5a00 in initialize_physics() main/main.cpp:321
    #13 0x57372283d069 in Main::setup2() main/main.cpp:3115
    #14 0x5737228276c8 in Main::setup(char const*, int, char**, bool) main/main.cpp:2432
    #15 0x57372252df28 in main platform/linuxbsd/godot_linuxbsd.cpp:74
    #16 0x7237cae2a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #17 0x7237cae2a28a in __libc_start_main_impl ../csu/libc-start.c:360
    #18 0x57372252dab4 in _start (/home/rafal/Downloads/rr/godot.linuxbsd.editor.dev.x86_64.san+0x425ddab4)

Thread T3 created by T0 here:
    #0 0x7237cba57d55 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:216
    #1 0x573743689158 in std::thread::_M_start_thread(std::unique_ptr<std::thread::_State, std::default_delete<std::thread::_State> >, void (*)()) (/home/rafal/Downloads/rr/godot.linuxbsd.editor.dev.x86_64.san+0x63739158)
    #2 0x57373fda939b in Thread::start(void (*)(void*), void*, Thread::Settings const&) core/os/thread.cpp:75
    #3 0x573741a635f9 in WorkerThreadPool::init(int, float) core/object/worker_thread_pool.cpp:655
    #4 0x573722801a2e in Main::setup(char const*, int, char**, bool) main/main.cpp:1777
    #5 0x57372252df28 in main platform/linuxbsd/godot_linuxbsd.cpp:74
    #6 0x7237cae2a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #7 0x7237cae2a28a in __libc_start_main_impl ../csu/libc-start.c:360
    #8 0x57372252dab4 in _start (/home/rafal/Downloads/rr/godot.linuxbsd.editor.dev.x86_64.san+0x425ddab4)

SUMMARY: AddressSanitizer: heap-use-after-free core/templates/command_queue_mt.h:373 in CommandQueueMT::_flush()

```

### Steps to reproduce

- Clone project - https://github.com/qarmin/Qarminer
- Add at the end of project.godot
```

[physics]

2d/run_on_separate_thread=true
3d/run_on_separate_thread=true
common/physics_ticks_per_second=1
```
- run StressPhysics.tscn file

Godot with build with Address Sanitizer is recomended

### Minimal reproduction project (MRP)

https://github.com/qarmin/Qarminer