Random crashes in realloc downstack from Object::get_instance_binding()

[max99x]

Godot version

4.4.1

godot-cpp version

6388e26

System information

Windows 11

Issue description

I have the following self-contained code running in a thread in the editor:

PackedByteArray bitmap;
// ...filling the bitmap...
Ref<Image> image = Image::create_from_data(width, height, false, Image::FORMAT_R8, bitmap);
Ref<ImageTexture> image_textre = ImageTexture::create_from_image(image);  // <-- crash here

Nothing in this thread accesses external state until after the line with the crash.

Most of the time it works fine. However, sometimes it randomly crashes with a heap corruption with the following stack:

ntdll.dll!RtlReAllocateHeap()
Godot_v4.4.1-stable_win64.exe!_realloc_base(void * block, unsigned __int64 size) Line 46
Godot_v4.4.1-stable_win64.exe!Memory::realloc_static(void * p_memory, unsigned __int64 p_bytes, bool p_pad_align) Line 161
Godot_v4.4.1-stable_win64.exe!CowData<ObjectID>::_realloc(__int64 p_alloc_size) Line 424
Godot_v4.4.1-stable_win64.exe!CowData<ObjectID>::resize<0>(__int64 p_size) Line 382
[Inline Frame] Godot_v4.4.1-stable_win64.exe!Vector<ObjectID>::resize(__int64) Line 100
[Inline Frame] Godot_v4.4.1-stable_win64.exe!Vector<ObjectID>::push_back(ObjectID p_elem) Line 321
[Inline Frame] Godot_v4.4.1-stable_win64.exe!GDExtension::track_instance_binding(Object *) Line 927
Godot_v4.4.1-stable_win64.exe!GDExtensionManager::track_instance_binding(void * p_token, Object * p_object) Line 256
Godot_v4.4.1-stable_win64.exe!Object::get_instance_binding(void * p_token, const GDExtensionInstanceBindingCallbacks * p_callbacks) Line 2026
~libwutw-gdext.windows.template_debug.x86_64.dll!godot::internal::get_object_instance_binding(void * p_engine_object) Line 60
[Inline Frame] ~libwutw-gdext.windows.template_debug.x86_64.dll!godot::internal::_call_native_mb_ret_obj(const void * const) Line 54
~libwutw-gdext.windows.template_debug.x86_64.dll!godot::ImageTexture::create_from_image(const godot::Ref<godot::Image> & p_image) Line 46

This is a hot-reloadable extension, but I have observed the crash before it is ever hot-reloaded. I have observed other crashes related to instance_bindings during hot-reload, seemingly due to signals referencing replaced instances (godotengine/godot#105802), but that's a separate issue.

Steps to reproduce

Run the code above in multiple threads repeatedly.

Minimal reproduction project

N/A