Repository: godot
Issue: Crash when FileDialog is set as custom viewport of ParallaxBackground
Labels: bug,crash,topic:2d

### Godot version

4.2.beta.custom_build. 914445748

### System information

Ubuntu 22.04 CI

### Issue description

When executing (this code was automatically minimized, so it is possible, that an even more "minimal" project can be created)
```
extends Node
func _process(delta):
	var temp_variable998 = ParallaxBackground.new()
	add_child(temp_variable998)
	var temp_argument998_f903_0 = FileDialog.new()
	temp_variable998.set_custom_viewport(temp_argument998_f903_0)
	temp_argument998_f903_0.queue_free()
	temp_variable998.queue_free()
```
Godot crashes:
```
Godot Engine v4.2.beta.custom_build.914445748 - https://godotengine.org
Time set to: 0 seconds.
Loaded settings:
modules/gdscript/gdscript_vm.cpp:698:13: runtime error: store to misaligned address 0x62100012df5c for type '<unknown> *', which requires 8 byte alignment
0x62100012df5c: note: pointer points here
  04 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  15 00 00 00 10 00 00 01  14 00 00 00 06 00 00 00
              ^ 
'number_of_function_repeats' with value '6'
modules/gdscript/gdscript_vm.cpp:705:42: runtime error: load of misaligned address 0x62100012df5c for type '<unknown> *', which requires 8 byte alignment
0x62100012df5c: note: pointer points here
  04 00 00 00 e1 7c 83 c2  bd 55 00 00 00 00 00 00  15 00 00 00 10 00 00 01  14 00 00 00 06 00 00 00
              ^ 
'use_parent_methods' with value 'true'
'test_one_class_multiple_times' with value 'true'
'how_many_times_test_one_class' with value '2'
######################## Ending test ########################
=================================================================
==22900==ERROR: AddressSanitizer: heap-use-after-free on address 0x620000001090 at pc 0x55bdb6735c52 bp 0x7ffc5c5afb40 sp 0x7ffc5c5afb30
READ of size 8 at 0x620000001090 thread T0
    #0 0x55bdb6735c51 in CallableCustomMethodPointer<Viewport, Node*>::CallableCustomMethodPointer(Viewport*, void (Viewport::*)(Node*)) core/object/callable_method_pointer.h:111
    #1 0x55bdb67216f7 in Callable create_custom_callable_function_pointer<Viewport, Node*>(Viewport*, char const*, void (Viewport::*)(Node*)) core/object/callable_method_pointer.h:125
    #2 0x55bdb67ebf6a in CanvasLayer::_notification(int) scene/main/canvas_layer.cpp:194
    #3 0x55bdb67ff3e7 in CanvasLayer::_notificationv(int, bool) scene/main/canvas_layer.h:38
    #4 0x55bdb9b055c4 in ParallaxBackground::_notificationv(int, bool) scene/2d/parallax_background.h:37
    #5 0x55bdc2c4bfc1 in Object::notification(int, bool) core/object/object.cpp:850
    #6 0x55bdb696a2a1 in Node::_propagate_exit_tree() scene/main/node.cpp:340
    #7 0x55bdb69cfd47 in Node::_set_tree(SceneTree*) scene/main/node.cpp:2928
    #8 0x55bdb6996416 in Node::remove_child(Node*) scene/main/node.cpp:1450
    #9 0x55bdb6963b61 in Node::_notification(int) scene/main/node.cpp:206
    #10 0x55bda8d7e4c3 in Node::_notificationv(int, bool) scene/main/node.h:49
    #11 0x55bdb67ff522 in CanvasLayer::_notificationv(int, bool) scene/main/canvas_layer.h:38
    #12 0x55bdb9b055c4 in ParallaxBackground::_notificationv(int, bool) scene/2d/parallax_background.h:37
    #13 0x55bdc2c4bfc1 in Object::notification(int, bool) core/object/object.cpp:850
    #14 0x55bdc2c365a6 in Object::_predelete() core/object/object.cpp:198
    #15 0x55bdc2c7e987 in predelete_handler(Object*) core/object/object.cpp:2050
    #16 0x55bda83f5695 in void memdelete<Object>(Object*) core/os/memory.h:105
    #17 0x55bdb6b26bb5 in SceneTree::_flush_delete_queue() scene/main/scene_tree.cpp:1345
    #18 0x55bdb6b0be41 in SceneTree::process(double) scene/main/scene_tree.cpp:516
    #19 0x55bda83bc003 in Main::iteration() main/main.cpp:3613
    #20 0x55bda80d6be5 in OS_LinuxBSD::run() platform/linuxbsd/os_linuxbsd.cpp:933
    #21 0x55bda80b5117 in main platform/linuxbsd/godot_linuxbsd.cpp:74
    #22 0x7f8ecf229d8f  (/lib/x86_64-linux-gnu/libc.so.6+0x29d8f)
    #23 0x7f8ecf229e3f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e3f)
    #24 0x55bda80b4ac4 in _start (/home/runner/work/Qarminer/Qarminer/godot.linuxbsd.editor.dev.x86_64.san+0x3a201ac4)
0x620000001090 is located 16 bytes inside of 3912-byte region [0x620000001080,0x620000001fc8)
freed by thread T0 here:
    #0 0x7f8ecfeb4537 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:127
    #1 0x55bdc12f5d15 in Memory::free_static(void*, bool) core/os/memory.cpp:168
    #2 0x55bda83f587a in void memdelete<Object>(Object*) core/os/memory.h:112
    #3 0x55bdb6b26bb5 in SceneTree::_flush_delete_queue() scene/main/scene_tree.cpp:1345
    #4 0x55bdb6b0be41 in SceneTree::process(double) scene/main/scene_tree.cpp:516
    #5 0x55bda83bc003 in Main::iteration() main/main.cpp:3613
    #6 0x55bda80d6be5 in OS_LinuxBSD::run() platform/linuxbsd/os_linuxbsd.cpp:933
    #7 0x55bda80b5117 in main platform/linuxbsd/godot_linuxbsd.cpp:74
    #8 0x7f8ecf229d8f  (/lib/x86_64-linux-gnu/libc.so.6+0x29d8f)
previously allocated by thread T0 here:
    #0 0x7f8ecfeb4887 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
    #1 0x55bdc12f4c67 in Memory::alloc_static(unsigned long, bool) core/os/memory.cpp:75
    #2 0x55bdc12f4b78 in operator new(unsigned long, char const*) core/os/memory.cpp:40
    #3 0x55bdb666ecd1 in Object* ClassDB::creator<FileDialog>() core/object/class_db.h:144
    #4 0x55bdc2b91cba in ClassDB::instantiate(StringName const&) core/object/class_db.cpp:362
    #5 0x55bda922e0d5 in GDScriptNativeClass::instantiate() modules/gdscript/gdscript.cpp:97
    #6 0x55bda922db6b in GDScriptNativeClass::_new() modules/gdscript/gdscript.cpp:85
    #7 0x55bda936f1a4 in void call_with_validated_variant_args_ret_helper<__UnexistingClass, Variant>(__UnexistingClass*, Variant (__UnexistingClass::*)(), Variant const**, Variant*, IndexSequence<>) core/variant/binder_common.h:374
    #8 0x55bda936e780 in void call_with_validated_object_instance_args_ret<__UnexistingClass, Variant>(__UnexistingClass*, Variant (__UnexistingClass::*)(), Variant const**, Variant*) core/variant/binder_common.h:661
    #9 0x55bda936db25 in MethodBindTR<Variant>::validated_call(Object*, Variant const**, Variant*) const core/object/method_bind.h:505
    #10 0x55bda997ea95 in GDScriptFunction::call(GDScriptInstance*, Variant const**, int, Callable::CallError&, GDScriptFunction::CallState*) modules/gdscript/gdscript_vm.cpp:1961
    #11 0x55bda926d4e2 in GDScriptInstance::callp(StringName const&, Variant const**, int, Callable::CallError&) modules/gdscript/gdscript.cpp:1896
    #12 0x55bdb6a1c1ec in bool Node::_gdvirtual__process_call<false>(double) scene/main/node.h:318
    #13 0x55bdb695a798 in Node::_notification(int) scene/main/node.cpp:57
    #14 0x55bda8d7e4c3 in Node::_notificationv(int, bool) scene/main/node.h:49
    #15 0x55bdc2c4b3e2 in Object::notification(int, bool) core/object/object.cpp:836
    #16 0x55bdb6b1a438 in SceneTree::_process_group(SceneTree::ProcessGroup*, bool) scene/main/scene_tree.cpp:951
    #17 0x55bdb6b1d6dc in SceneTree::_process(bool) scene/main/scene_tree.cpp:1028
    #18 0x55bdb6b0b7d2 in SceneTree::process(double) scene/main/scene_tree.cpp:508
    #19 0x55bda83bc003 in Main::iteration() main/main.cpp:3613
    #20 0x55bda80d6be5 in OS_LinuxBSD::run() platform/linuxbsd/os_linuxbsd.cpp:933
    #21 0x55bda80b5117 in main platform/linuxbsd/godot_linuxbsd.cpp:74
    #22 0x7f8ecf229d8f  (/lib/x86_64-linux-gnu/libc.so.6+0x29d8f)
SUMMARY: AddressSanitizer: heap-use-after-free core/object/callable_method_pointer.h:111 in CallableCustomMethodPointer<Viewport, Node*>::CallableCustomMethodPointer(Viewport*, void (Viewport::*)(Node*))
Shadow bytes around the buggy address:
  0x0c407fff81c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c407fff81d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c407fff81e0: fd fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c407fff81f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c407fff8200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c407fff8210: fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c407fff8220: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c407fff8230: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c407fff8240: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c407fff8250: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c407fff8260: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==22900==ABORTING
```

This example was found by Godot fuzzer - [Qarminer](https://github.com/qarmin/Qarminer), so it is quite unlikelly that this code could be used in real project, but still this should be handled gracefully.

Memory leaks or asan backtraces are visible when using Godot build with sanitizers support - https://github.com/qarmin/GodotBuilds/actions (linux -> linux-editor-sanitizers)

   

### Steps to reproduce

Above

### Minimal reproduction project

Above