Repository: godot
Issue: Crash on freed reference trying to emit "completed" signal
Labels: bug,topic:gdscript,confirmed,crash

**Godot version:** 3.2.2

**OS/device including version:** macOS 10.14.6

**Issue description:** I'm seeing a crash that appears to be related to an invalid reference to a GDScriptFunctionState trying to emit a "completed" signal. 

I've got a long-running recursive function that I'm trying get to run across frames. Here's the basic setup. Basically I call a function to kick it off and store the continuation:
```gdscript
func start_expensive_calculation():
    _frame_start = OS.get_ticks_usec()
    _continuation = expensive_function(rootNode)
```

Then the expensive function itself:
```gdscript
func expensive_function(treeNode):
    # frameBudget = 10000
    if OS.get_ticks_usec() - _frame_start > frameBudget:
        yield()

    if treeNode._child:
        var child_run = expensive_function(treeNode._child)
        while child_run is GDScriptFunctionState:
            yield()
            child_run = child_run.resume()

    do_expensive_calculation()
```

Then every frame while it's still running, I resume it.
```gdscript
func _process(_delta: float):
    if _continuation:
        _frame_start = OS.get_ticks_usec()
        _continuation = _continuation.resume()
```

All of this works fine in [a little toy project I made](https://github.com/sjml/godot_continuation), but in my larger scale project where the function is actually doing meaningful work, there are occasional crashes. (They go away if I make the frame budget check always return true, so it's definitely related to how I'm doing the continuation.)

The macOS crash reporter was pointing to EXC\_BAD\_ACCESS in `Object::emit_signal(StringName const&, Variant const**, int)`. Running a debug version of Godot, I found that the signal it's trying to emit is `"completed"`, but it can't find it because the `hash_table` member of the reference's `signal_map` is trashed. ([The engine code checks that it's not null](https://github.com/godotengine/godot/blob/3.2/core/hash_map.h#L315), but since it *is* pointing to something, it [tries to access it](https://github.com/godotengine/godot/blob/3.2/core/hash_map.h#L186) and then fails.)

I'm guessing something about the way I'm calling resume and then storing the result back into the original variable is leading to the `GDScriptFunctionState` getting cleaned up before it can emit its signal, but the emitting code doesn't know that it's now getting called on garbage data. 

I don't know if the engine code needs to add a check here, or if I should be more careful in my GDSCript usage -- is there a better approach to setting up a continuation of a recursive function? 

**Steps to reproduce:** I haven't been able to figure out exactly what conditions trigger it. I happens in web exports almost immediately, but on the macOS native build it seems a bit more random. (The whole process will run fine anywhere between 5-20 times, then crash on the next attempt.)

**Minimal reproduction project:** Attached. On my mac, it crashes about 2/3 of the time when run from the editor. On a web export, it crashes almost immediately 100% of the time in Firefox. (And usually after a single refresh in Chrome.) As I said, I'm very willing to admit that I'm doing something wrong here, but it should still be tough to crash the engine just using (even abusing) GDScript.
[CrashOnEmit.zip](https://github.com/godotengine/godot/files/4852824/CrashOnEmit.zip)