Repository: godot
Issue: Executing `RichTextLabel.remove_paragraph` function crashes Godot
Labels: bug,crash,topic:gui

### Tested versions

4.3.dev.custom_build

### System information

Ubuntu 22.04 CI

### Issue description

When executing (this code was automatically minimized, so it is possible, that an even more "minimal" project can be created)
```
extends Node
func _process(delta):
	var temp_variable28937 = GraphElement.new()
	add_child(temp_variable28937)
	temp_variable28937.queue_free()
	var temp_variable29116 = RayCast3D.new()
	add_child(temp_variable29116)
	temp_variable29116.clear_exceptions()
	temp_variable29116.queue_free()
	var temp_variable29135 = RichTextLabel.new()
	add_child(temp_variable29135)
	temp_variable29135.get_selection_from()
	temp_variable29135.set_visible_characters(-97)
	temp_variable29135.push_bold()
	temp_variable29135.push_bgcolor(Color(2.01305150985718, -89.7856063842773, -35.7873916625977, 1))
	temp_variable29135.remove_paragraph(0)
```
Godot crashes:
```
Godot Engine v4.3.dev.custom_build - https://godotengine.org

=================================================================
==13296==ERROR: AddressSanitizer: heap-use-after-free on address 0x60b000d648c0 at pc 0x565186749076 bp 0x7fffc87dc4d0 sp 0x7fffc87dc4c0
READ of size 8 at 0x60b000d648c0 thread T0
    #0 0x565186749075 in List<RichTextLabel::Item*, DefaultAllocator>::size() const core/templates/list.h:469
    #1 0x5651866678f6 in RichTextLabel::remove_paragraph(int) scene/gui/rich_text_label.cpp:3466
    #2 0x5651867c958b in void call_with_variant_args_ret_helper<__UnexistingClass, bool, int, 0ul>(__UnexistingClass*, bool (__UnexistingClass::*)(int), Variant const**, Variant&, Callable::CallError&, IndexSequence<0ul>) core/variant/binder_common.h:756
    #3 0x5651867b5c9d in void call_with_variant_args_ret_dv<__UnexistingClass, bool, int>(__UnexistingClass*, bool (__UnexistingClass::*)(int), Variant const**, int, Variant&, Callable::CallError&, Vector<Variant> const&) core/variant/binder_common.h:535
    #4 0x56518679cc74 in MethodBindTR<bool, int>::call(Object*, Variant const**, int, Callable::CallError&) const core/object/method_bind.h:523
    #5 0x56519283da3b in Object::callp(StringName const&, Variant const**, int, Callable::CallError&) core/object/object.cpp:837
    #6 0x565191bab846 in Variant::callp(StringName const&, Variant const**, int, Variant&, Callable::CallError&) core/variant/variant_call.cpp:1212
    #7 0x56517b70de3a in GDScriptFunction::call(GDScriptInstance*, Variant const**, int, Callable::CallError&, GDScriptFunction::CallState*) modules/gdscript/gdscript_vm.cpp:1734
    #8 0x56517af83466 in GDScriptInstance::callp(StringName const&, Variant const**, int, Callable::CallError&) modules/gdscript/gdscript.cpp:1970
    #9 0x565184fa274c in bool Node::_gdvirtual__process_call<false>(double) scene/main/node.h:350
    #10 0x565184eceff1 in Node::_notification(int) scene/main/node.cpp:57
    #11 0x56517c83778f in Node::_notificationv(int, bool) scene/main/node.h:49
    #12 0x56519283f5c4 in Object::notification(int, bool) core/object/object.cpp:899
    #13 0x5651850ea0e4 in SceneTree::_process_group(SceneTree::ProcessGroup*, bool) scene/main/scene_tree.cpp:979
    #14 0x5651850ed388 in SceneTree::_process(bool) scene/main/scene_tree.cpp:1056
    #15 0x5651850db7b0 in SceneTree::process(double) scene/main/scene_tree.cpp:534
    #16 0x56517ac9fa5a in Main::iteration() main/main.cpp:4016
    #17 0x56517a99235d in OS_LinuxBSD::run() platform/linuxbsd/os_linuxbsd.cpp:962
    #18 0x56517a970b53 in main platform/linuxbsd/godot_linuxbsd.cpp:85
    #19 0x7f7924629d8f  (/lib/x86_64-linux-gnu/libc.so.6+0x29d8f)
    #20 0x7f7924629e3f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e3f)
    #21 0x56517a9705d4 in _start (/home/runner/work/Qarminer/Qarminer/godot.linuxbsd.editor.dev.x86_64.san+0x342785d4)
0x60b000d648c0 is located 48 bytes inside of 104-byte region [0x60b000d64890,0x60b000d648f8)
freed by thread T0 here:
    #0 0x7f79252b4537 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:127
    #1 0x565190cff4d1 in Memory::free_static(void*, bool) core/os/memory.cpp:168
    #2 0x5651867495b2 in void memdelete<RichTextLabel::Item>(RichTextLabel::Item*) core/os/memory.h:119
    #3 0x56518665c422 in RichTextLabel::_remove_item(RichTextLabel::Item*, int) scene/gui/rich_text_label.cpp:3239
    #4 0x56518665c0bb in RichTextLabel::_remove_item(RichTextLabel::Item*, int) scene/gui/rich_text_label.cpp:3233
    #5 0x5651866670a5 in RichTextLabel::remove_paragraph(int) scene/gui/rich_text_label.cpp:3455
    #6 0x5651867c958b in void call_with_variant_args_ret_helper<__UnexistingClass, bool, int, 0ul>(__UnexistingClass*, bool (__UnexistingClass::*)(int), Variant const**, Variant&, Callable::CallError&, IndexSequence<0ul>) core/variant/binder_common.h:756
    #7 0x5651867b5c9d in void call_with_variant_args_ret_dv<__UnexistingClass, bool, int>(__UnexistingClass*, bool (__UnexistingClass::*)(int), Variant const**, int, Variant&, Callable::CallError&, Vector<Variant> const&) core/variant/binder_common.h:535
    #8 0x56518679cc74 in MethodBindTR<bool, int>::call(Object*, Variant const**, int, Callable::CallError&) const core/object/method_bind.h:523
    #9 0x56519283da3b in Object::callp(StringName const&, Variant const**, int, Callable::CallError&) core/object/object.cpp:837
    #10 0x565191bab846 in Variant::callp(StringName const&, Variant const**, int, Variant&, Callable::CallError&) core/variant/variant_call.cpp:1212
    #11 0x56517b70de3a in GDScriptFunction::call(GDScriptInstance*, Variant const**, int, Callable::CallError&, GDScriptFunction::CallState*) modules/gdscript/gdscript_vm.cpp:1734
    #12 0x56517af83466 in GDScriptInstance::callp(StringName const&, Variant const**, int, Callable::CallError&) modules/gdscript/gdscript.cpp:1970
    #13 0x565184fa274c in bool Node::_gdvirtual__process_call<false>(double) scene/main/node.h:350
    #14 0x565184eceff1 in Node::_notification(int) scene/main/node.cpp:57
    #15 0x56517c83778f in Node::_notificationv(int, bool) scene/main/node.h:49
    #16 0x56519283f5c4 in Object::notification(int, bool) core/object/object.cpp:899
    #17 0x5651850ea0e4 in SceneTree::_process_group(SceneTree::ProcessGroup*, bool) scene/main/scene_tree.cpp:979
    #18 0x5651850ed388 in SceneTree::_process(bool) scene/main/scene_tree.cpp:1056
    #19 0x5651850db7b0 in SceneTree::process(double) scene/main/scene_tree.cpp:534
    #20 0x56517ac9fa5a in Main::iteration() main/main.cpp:4016
    #21 0x56517a99235d in OS_LinuxBSD::run() platform/linuxbsd/os_linuxbsd.cpp:962
    #22 0x56517a970b53 in main platform/linuxbsd/godot_linuxbsd.cpp:85
    #23 0x7f7924629d8f  (/lib/x86_64-linux-gnu/libc.so.6+0x29d8f)
previously allocated by thread T0 here:
    #0 0x7f79252b4887 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
    #1 0x565190cfe423 in Memory::alloc_static(unsigned long, bool) core/os/memory.cpp:75
    #2 0x565190cfe334 in operator new(unsigned long, char const*) core/os/memory.cpp:40
    #3 0x565186682fd3 in RichTextLabel::push_bgcolor(Color const&) scene/gui/rich_text_label.cpp:3840
    #4 0x565184d1bd8b in void call_with_variant_args_helper<__UnexistingClass, Color const&, 0ul>(__UnexistingClass*, void (__UnexistingClass::*)(Color const&), Variant const**, Callable::CallError&, IndexSequence<0ul>) core/variant/binder_common.h:304
    #5 0x565184cde87d in void call_with_variant_args_dv<__UnexistingClass, Color const&>(__UnexistingClass*, void (__UnexistingClass::*)(Color const&), Variant const**, int, Callable::CallError&, Vector<Variant> const&) core/variant/binder_common.h:451
    #6 0x565184ca35f7 in MethodBindT<Color const&>::call(Object*, Variant const**, int, Callable::CallError&) const core/object/method_bind.h:344
    #7 0x56519283da3b in Object::callp(StringName const&, Variant const**, int, Callable::CallError&) core/object/object.cpp:837
    #8 0x565191bab846 in Variant::callp(StringName const&, Variant const**, int, Variant&, Callable::CallError&) core/variant/variant_call.cpp:1212
    #9 0x56517b70de3a in GDScriptFunction::call(GDScriptInstance*, Variant const**, int, Callable::CallError&, GDScriptFunction::CallState*) modules/gdscript/gdscript_vm.cpp:1734
    #10 0x56517af83466 in GDScriptInstance::callp(StringName const&, Variant const**, int, Callable::CallError&) modules/gdscript/gdscript.cpp:1970
    #11 0x565184fa274c in bool Node::_gdvirtual__process_call<false>(double) scene/main/node.h:350
    #12 0x565184eceff1 in Node::_notification(int) scene/main/node.cpp:57
    #13 0x56517c83778f in Node::_notificationv(int, bool) scene/main/node.h:49
    #14 0x56519283f5c4 in Object::notification(int, bool) core/object/object.cpp:899
    #15 0x5651850ea0e4 in SceneTree::_process_group(SceneTree::ProcessGroup*, bool) scene/main/scene_tree.cpp:979
    #16 0x5651850ed388 in SceneTree::_process(bool) scene/main/scene_tree.cpp:1056
    #17 0x5651850db7b0 in SceneTree::process(double) scene/main/scene_tree.cpp:534
    #18 0x56517ac9fa5a in Main::iteration() main/main.cpp:4016
    #19 0x56517a99235d in OS_LinuxBSD::run() platform/linuxbsd/os_linuxbsd.cpp:962
    #20 0x56517a970b53 in main platform/linuxbsd/godot_linuxbsd.cpp:85
    #21 0x7f7924629d8f  (/lib/x86_64-linux-gnu/libc.so.6+0x29d8f)
SUMMARY: AddressSanitizer: heap-use-after-free core/templates/list.h:469 in List<RichTextLabel::Item*, DefaultAllocator>::size() const
Shadow bytes around the buggy address:
  0x0c16801a48c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c16801a48d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c16801a48e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c16801a48f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c16801a4900: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c16801a4910: fa fa fd fd fd fd fd fd[fd]fd fd fd fd fd fd fa
  0x0c16801a4920: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c16801a4930: 00 00 00 00 00 04 fa fa fa fa fa fa fa fa 00 00
  0x0c16801a4940: 00 00 00 00 00 00 00 00 00 00 00 04 fa fa fa fa
  0x0c16801a4950: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c16801a4960: 00 04 fa fa fa fa fa fa fa fa 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==13296==ABORTING
```

This example was found by Godot fuzzer - [Qarminer](https://github.com/qarmin/Qarminer), so it is quite unlikelly that this code could be used in real project, but still this should be handled gracefully.

Memory leaks or asan backtraces are visible when using Godot build with sanitizers support - https://github.com/qarmin/GodotBuilds/actions (linux -> linux-editor-sanitizers)

   

### Steps to reproduce

Above

### Minimal reproduction project (MRP)

Above