[3.5.2] change_scene breaks when javascript target compiled with LTO, and incredibly specific conditions

[gelvinp]

Godot version

3.5.2 RC1

System information

Arch Linux, Firefox 108.0.2

Issue description

During this weekend's ludem dare, I found a strange bug when I compiled my export templates for my submission. Navigating between scenes, say between the main menu, credits, and how-to-play pages repeatedly would break, with errors to the console involving "index out of range", and resources (such as fonts) no longer loading.

Here is a video of what I'm talking about:
https://user-images.githubusercontent.com/61520531/211234434-47c85f83-7505-4c8c-bc9e-79194d256059.mp4

I have found that the problem goes away if any of the following:

1. I export to a non-javascript target
2. I export without use_lto="yes"
3. I stop using a MarginContainer in the scenes
4. I stop overriding fonts in the scenes (I suspect this has more to do with the overridden font being a resource to be loaded)
5. Really any significant change of the node structure inside my scenes, which only contain Control nodes, and some have overridden fonts, which are not a problem if they aren't inside a MarginContainer?

Here's an example of an error in the web console:

Uncaught RuntimeError: index out of bounds
    button_cb http://localhost:8060/tmp_js_export.js:9
    add http://localhost:8060/tmp_js_export.js:9
    _godot_js_input_mouse_button_cb http://localhost:8060/tmp_js_export.js:9
    _main http://localhost:8060/tmp_js_export.js:9
    callMain http://localhost:8060/tmp_js_export.js:9
    Engine http://localhost:8060/tmp_js_export.js:705
    Engine http://localhost:8060/tmp_js_export.js:700
    promise callback*SafeEngine/start/Engine< http://localhost:8060/tmp_js_export.js:699
    promise callback*start http://localhost:8060/tmp_js_export.js:678
    Engine http://localhost:8060/tmp_js_export.js:741
    promise callback*startGame http://localhost:8060/tmp_js_export.js:740
    <anonymous> http://localhost:8060/tmp_js_export.html:224
    <anonymous> http://localhost:8060/tmp_js_export.html:244

Additionally, once this error appears, clicking the same button causes the following:

Steps to reproduce

I don't even know where to start with a reproduction. I do have a minimum reproduction project that I got by stripping down a copy of my LD submission until it stopped giving the error. Compile the engine with the following custom.py:

debug_symbols="no"
target="release"
platform="javascript"
tools="no"
use_lto="yes"

(debug does NOT work. Running this project with the debug template crashes immediately with Aborted(Stack overflow! Stack cookie has been overwritten at 0x0021edd0, expected hex dwords 0x89BACDFE and 0x2135467, but received 0x00000000 0x00000000))

Create an HTML5 export preset in editor, and set the built template as the custom debug template (even though it's a release build) so that the editor's built in server will use it, and run the project by clicking on the little html5 icon next to the play buttons.

Open the web console, then click on:

1. Button A
2. Return
3. Button B
4. Return
5. Button A
6. Button A

Minimal reproduction project

wasm_lto_repro.zip