Repository: godot
Issue: Executing `JSONRPC.process_action` crashes Godot
Labels: bug,topic:network,crash

### Godot version

3.5.beta.custom_build. 20b08185f

### System information

Ubuntu 21.10 - Nvidia GTX 970, Gnome shell 40.4 X11

### Issue description

When executing
```
var temp_variable68581 = ClassDB.instance("JSONRPC")
temp_variable68581.set_scope("", AudioStreamOGGVorbis.new())
temp_variable68581.process_action({"roman" : 22, 22 : 25, BoxShape.new() : BoxShape.new()}, true)
```

Godot crashes with this backtrace
```
==79086==ERROR: AddressSanitizer: heap-use-after-free on address 0x6150000a7b10 at pc 0x00000238fcf2 bp 0x7ffdbd7c8410 sp 0x7ffdbd7c8400
READ of size 8 at 0x6150000a7b10 thread T0
    #0 0x238fcf1 in JSONRPC::process_action(Variant const&, bool) modules/jsonrpc/jsonrpc.cpp:126
    #1 0x23b1614 in MethodBind2R<Variant, Variant const&, bool>::call(Object*, Variant const**, int, Variant::CallError&) (/usr/bin/godots+0x23b1614)
    #2 0x12aa6cca in Object::call(StringName const&, Variant const**, int, Variant::CallError&) core/object.cpp:918
    #3 0x12d45498 in Variant::call_ptr(StringName const&, Variant const**, int, Variant*, Variant::CallError&) core/variant_call.cpp:1185
    #4 0x1f13e8e in GDScriptFunction::call(GDScriptInstance*, Variant const**, int, Variant::CallError&, GDScriptFunction::CallState*) modules/gdscript/gdscript_function.cpp:1050
    #5 0x1d427d1 in GDScriptInstance::call_multilevel(StringName const&, Variant const**, int) modules/gdscript/gdscript.cpp:1211
    #6 0xcf03987 in Node::_notification(int) scene/main/node.cpp:56
    #7 0x1be87ab in Node::_notificationv(int, bool) scene/main/node.h:45
    #8 0x12aa7166 in Object::notification(int, bool) core/object.cpp:927
    #9 0xd044191 in SceneTree::_notify_group_pause(StringName const&, int) scene/main/scene_tree.cpp:1069
    #10 0xd033095 in SceneTree::idle(float) scene/main/scene_tree.cpp:605
    #11 0x1a20fa6 in Main::iteration() main/main.cpp:2271
    #12 0x18efb7b in OS_X11::run() platform/x11/os_x11.cpp:3842
    #13 0x1853109 in main platform/x11/godot_x11.cpp:55
    #14 0x7f9f37ae1fcf in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #15 0x7f9f37ae207c in __libc_start_main_impl ../csu/libc-start.c:409
    #16 0x1852d1d in _start (/usr/bin/godots+0x1852d1d)

0x6150000a7b10 is located 16 bytes inside of 456-byte region [0x6150000a7b00,0x6150000a7cc8)
freed by thread T0 here:
    #0 0x7f9f38a6840f in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:122
    #1 0x13048f06 in Memory::free_static(void*, bool) core/os/memory.cpp:168
    #2 0x192832c in void memdelete<Reference>(Reference*) core/os/memory.h:117
    #3 0x1918e77 in Ref<Reference>::unref() core/reference.h:258
    #4 0x1919080 in Ref<Reference>::ref(Ref<Reference> const&) core/reference.h:68
    #5 0x1d7da8f in Ref<Reference>::operator=(Ref<Reference> const&) core/reference.h:138
    #6 0x12b77321 in RefPtr::operator=(RefPtr const&) core/ref_ptr.cpp:40
    #7 0x12d0f75d in Variant::ObjData::operator=(Variant::ObjData const&) (/usr/bin/godots+0x12d0f75d)
    #8 0x12cf4bb7 in Variant::operator=(Variant const&) core/variant.cpp:2452
    #9 0x12d458ba in Variant::call_ptr(StringName const&, Variant const**, int, Variant*, Variant::CallError&) core/variant_call.cpp:1204
    #10 0x1f13e0d in GDScriptFunction::call(GDScriptInstance*, Variant const**, int, Variant::CallError&, GDScriptFunction::CallState*) modules/gdscript/gdscript_function.cpp:1048
    #11 0x1d427d1 in GDScriptInstance::call_multilevel(StringName const&, Variant const**, int) modules/gdscript/gdscript.cpp:1211
    #12 0xcf03987 in Node::_notification(int) scene/main/node.cpp:56
    #13 0x1be87ab in Node::_notificationv(int, bool) scene/main/node.h:45
    #14 0x12aa7166 in Object::notification(int, bool) core/object.cpp:927
    #15 0xd044191 in SceneTree::_notify_group_pause(StringName const&, int) scene/main/scene_tree.cpp:1069
    #16 0xd033095 in SceneTree::idle(float) scene/main/scene_tree.cpp:605
    #17 0x1a20fa6 in Main::iteration() main/main.cpp:2271
    #18 0x18efb7b in OS_X11::run() platform/x11/os_x11.cpp:3842
    #19 0x1853109 in main platform/x11/godot_x11.cpp:55
    #20 0x7f9f37ae1fcf in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

previously allocated by thread T0 here:
    #0 0x7f9f38a68808 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:144
    #1 0x13047ec3 in Memory::alloc_static(unsigned long, bool) core/os/memory.cpp:75
    #2 0x13047dd4 in operator new(unsigned long, char const*) core/os/memory.cpp:40
    #3 0x2427472 in Object* ClassDB::creator<AudioStreamOGGVorbis>() core/class_db.h:137
    #4 0x1281e8e1 in ClassDB::instance(StringName const&) core/class_db.cpp:520
    #5 0x1d1bb40 in GDScriptNativeClass::instance() modules/gdscript/gdscript.cpp:77
    #6 0x1d1b529 in GDScriptNativeClass::_new() modules/gdscript/gdscript.cpp:65
    #7 0x1df9403 in MethodBind0R<Variant>::call(Object*, Variant const**, int, Variant::CallError&) core/method_bind.gen.inc:233
    #8 0x12aa6cca in Object::call(StringName const&, Variant const**, int, Variant::CallError&) core/object.cpp:918
    #9 0x12d45498 in Variant::call_ptr(StringName const&, Variant const**, int, Variant*, Variant::CallError&) core/variant_call.cpp:1185
    #10 0x1f13e0d in GDScriptFunction::call(GDScriptInstance*, Variant const**, int, Variant::CallError&, GDScriptFunction::CallState*) modules/gdscript/gdscript_function.cpp:1048
    #11 0x1d427d1 in GDScriptInstance::call_multilevel(StringName const&, Variant const**, int) modules/gdscript/gdscript.cpp:1211
    #12 0xcf03987 in Node::_notification(int) scene/main/node.cpp:56
    #13 0x1be87ab in Node::_notificationv(int, bool) scene/main/node.h:45
    #14 0x12aa7166 in Object::notification(int, bool) core/object.cpp:927
    #15 0xd044191 in SceneTree::_notify_group_pause(StringName const&, int) scene/main/scene_tree.cpp:1069
    #16 0xd033095 in SceneTree::idle(float) scene/main/scene_tree.cpp:605
    #17 0x1a20fa6 in Main::iteration() main/main.cpp:2271
    #18 0x18efb7b in OS_X11::run() platform/x11/os_x11.cpp:3842
    #19 0x1853109 in main platform/x11/godot_x11.cpp:55
    #20 0x7f9f37ae1fcf in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

```


This example was found by Godot fuzzer - [Qarminer](https://github.com/qarmin/Qarminer), so it is quite unlikelly that this code could be used in real project, but still this should be handled gracefully.

### Steps to reproduce

Above

### Minimal reproduction project

_No response_