### Godot version

master CI builds

### System information

Linux / Editor with doubles and GCC sanitizers

### Issue description

The `Linux / Editor with doubles and GCC sanitizers` build can fail with a `attempting free on address which was not malloc()-ed` crash in the `Open and close editor (Vulkan)` step.

https://github.com/godotengine/godot/actions/runs/5366302204/jobs/9735786296#step:15:138
https://github.com/godotengine/godot/actions/runs/5389199469/jobs/9783070708?pr=78740#step:15:138

The failure doesn't seem related to either PR (in fact one of them is just a docs change). I have only seen this issue these two times, still probably worth looking into.

### Steps to reproduce

Open and close https://github.com/godotengine/regression-test-project/archive/4.0.zip using the Vulkan renderer.

### Minimal reproduction project

https://github.com/godotengine/regression-test-project/archive/4.0.zip
for (int i = 0; i < shader->specialization_constants.size(); i++) {
			
			const Shader::SpecializationConstant &sc = shader->specialization_constants[i];
			data_ptr[i] = sc.constant.int_value; 
			for (int j = 0; j < p_specialization_constants.size(); j++) {
				const PipelineSpecializationConstant &psc = p_specialization_constants[j];
				if (psc.constant_id == sc.constant.constant_id) {
					ERR_FAIL_COND_V_MSG(psc.type != sc.constant.type, RID(), "Specialization constant provided for id (" + itos(sc.constant.constant_id) + ") is of the wrong type.");
					data_ptr[i] = psc.int_value;
					break;
				}
			}
			VkSpecializationMapEntry entry;
			entry.constantID = sc.constant.constant_id;
			entry.offset = i * sizeof(uint32_t);
			entry.size = sizeof(uint32_t);
			for (int j = 0; j < SHADER_STAGE_MAX; j++) {
				if (sc.stage_flags & (1 << j)) {
					VkShaderStageFlagBits stage = shader_stage_masks[j];
					for (int k = 0; k < pipeline_stages.size(); k++) {
						if (pipeline_stages[k].stage == stage) {
							specialization_map_entries.write[k].push_back(entry);
						}
					}
				}
			}
		}
		for (int i = 0; i < pipeline_stages.size(); i++) {
			if (specialization_map_entries[i].size()) {
				specialization_info.write[i].dataSize = specialization_constant_data.size() * sizeof(uint32_t);