Aborted in ReportFatalException (Js::JavascriptString::RepeatCore)

Version
---
Branch : master
Version : https://github.com/chakra-core/ChakraCore/commit/c3ead3f8a6e0bb8e32e043adc091c68cba5935e9

Platform
---
Ubuntu 20.04.5 LTS (Linux 5.4.0-144-generic x86_64)

Build
---
- Address Sanitizer=On
- Debug
```
./build.sh -d --static --sanitize=address
```
It also happens on release mode.
```
./build.sh --static
```

PoC
---
testcase

```javascript
var o ;
try {
o = " a " . repeat ( 536870912 ) , RegExp . prototype . toString . call ( { source : o , flags : o } ) ;
}
catch ( o ) {
}
console . log ( " PASS : no crash " ) ;
```

```javascript
// poc.js
" a " . repeat ( 536870912 )
```

Execution steps & Output
---

```
$ ./ch poc.js
Aborted
```

Backtrace
---
Debug (ASAN)
```
(gdb) r poc.js
Starting program: ./ChakraCore/out/Debug/ch poc.js
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
[New Thread 0x7ff7f1915700 (LWP 2302071)]
[New Thread 0x7ff7f1114700 (LWP 2302072)]
[New Thread 0x7ff7f0913700 (LWP 2302074)]

Thread 1 "ch" received signal SIGILL, Illegal instruction.
0x0000555556a35e09 in DebugBreak () at ./ChakraCore/lib/Common/CommonPal.h:161
161 __builtin_trap();
(gdb) bt
#0 0x0000555556a35e09 in DebugBreak () at ./ChakraCore/lib/Common/CommonPal.h:161
#1 ReportFatalException (context=, exceptionCode=, reasonCode=, scenario=) at ./ChakraCore/lib/Common/Exceptions/ReportError.cpp:20
#2 0x0000555556a36247 in RecyclerSingleAllocationLimit_unrecoverable_error () at ./ChakraCore/lib/Common/Exceptions/ReportError.cpp:151
#3 0x0000555556deecba in Memory::Recycler::LargeAlloc (this=0x632000000858, heap=0x6320000052b8, size=3221225474, attributes=Memory::LeafBit) at ./ChakraCore/lib/Common/Memory/Recycler.cpp:1380
#4 0x00005555567fd87f in Memory::Recycler::RealAlloc<(Memory::ObjectInfoBits)32, false> (this=0x632000000858, heap=0x6320000052b8, size=3221225474) at ./ChakraCore/lib/Common/Memory/Recycler.inl:384
#5 0x00005555567fcb24 in Memory::Recycler::AllocWithAttributesInlined<(Memory::ObjectInfoBits)32, false> (this=, size=)
at ./ChakraCore/lib/Common/Memory/HeapInfoManager.h:18
#6 0x00005555567fbce9 in operator new[] (byteSize=3221225474, alloc=, AllocFunc=) at ./ChakraCore/lib/Common/DataStructures/../Memory/Allocator.h:498
#7 0x0000555559402613 in Memory::AllocateArray (allocator=0x632000000858, AllocFunc=, count=1610612737)
at ./ChakraCore/lib/Common/DataStructures/../Memory/Allocator.h:348
#8 Js::JavascriptString::RepeatCore (currentString=, count=, scriptContext=) at ./ChakraCore/lib/Runtime/Library/JavascriptString.cpp:2627
#9 0x000055555940c592 in Js::JavascriptString::EntryRepeat (function=, callInfo=...) at ./ChakraCore/lib/Runtime/Library/JavascriptString.cpp:2607
#10 0x0000555559723c4e in amd64_CallFunction () at ./ChakraCore/lib/Runtime/Library/amd64/JavascriptFunctionA.S:100
#11 0x000055555843ceef in Js::InterpreterStackFrame::OP_CallCommon > > __unaligned>(Js::OpLayoutDynamicProfile > > __unaligned const __unaligned*, Js::RecyclableObject*, unsigned int, Js::AuxArray const*) (this=0x7fffffffca60, playout=, function=,
flags=, spreadIndices=) at ./ChakraCore/lib/Runtime/Language/InterpreterStackFrame.cpp:3973
#12 0x000055555843bae9 in Js::InterpreterStackFrame::OP_ProfileCallCommon > > __unaligned>(Js::OpLayoutDynamicProfile > > __unaligned const __unaligned*, Js::RecyclableObject*, unsigned int, unsigned short, unsigned int, Js::AuxArray const*) (this=0x7fffffffca60,
playout=0x7ffff28f31b2, function=, flags=0, profileId=, inlineCacheIndex=0, spreadIndices=0x0) at ./ChakraCore/lib/Runtime/Language/InterpreterStackFrame.cpp:4016
#13 0x0000555557df8817 in Js::InterpreterStackFrame::OP_ProfiledCallIWithICIndex > >(Js::OpLayoutDynamicProfile > > const __unaligned*) (this=0x7fffffffca60, playout=0x7ffff28f31b2) at ./ChakraCore/lib/Runtime/./Language/InterpreterStackFrame.h:520
#14 Js::InterpreterStackFrame::ProcessProfiled (this=) at ./ChakraCore/lib/Runtime/Language/InterpreterHandler.inl:91
#15 0x0000555557c426df in Js::InterpreterStackFrame::Process (this=0x7fffffffca60) at ./ChakraCore/lib/Runtime/Language/InterpreterStackFrame.cpp:3472
#16 0x0000555557c3d150 in Js::InterpreterStackFrame::InterpreterHelper (function=, args=, returnAddress=,
addressOfReturnAddress=, asmJsReturn=) at ./ChakraCore/lib/Runtime/Language/InterpreterStackFrame.cpp:2153
#17 0x0000555557c3a80d in Js::InterpreterStackFrame::InterpreterThunk (layout=0x7ffff26c0fa2) at ./ChakraCore/lib/Runtime/Language/InterpreterStackFrame.cpp:1833
#18 0x00007ffff26c0fa2 in ?? ()
#19 0x00007fffffffcff0 in ?? ()
#20 0x0000555559723c4e in amd64_CallFunction () at ./ChakraCore/lib/Runtime/Library/amd64/JavascriptFunctionA.S:100
Backtrace stopped: frame did not save the PC
(gdb)
```
Release
```
(gdb) r poc.js
Starting program: ./ChakraCore/out/Release/ch poc.js
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
[New Thread 0x7ff7f572f700 (LWP 2758859)]
[New Thread 0x7ff7f4eff700 (LWP 2758860)]
[New Thread 0x7ff7effff700 (LWP 2758861)]

Thread 1 "ch" received signal SIGILL, Illegal instruction.
0x000055555595618f in DebugBreak () at ./ChakraCore/lib/Common/CommonPal.h:161
161 __builtin_trap();
(gdb) bt
#0 0x000055555595618f in DebugBreak () at ./ChakraCore/lib/Common/CommonPal.h:161
#1 ReportFatalException (context=, exceptionCode=, reasonCode=, scenario=) at ./ChakraCore/lib/Common/Exceptions/ReportError.cpp:20
#2 0x0000555555956597 in OutOfMemory_unrecoverable_error () at ./ChakraCore/lib/Common/Exceptions/ReportError.cpp:145
#3 0x0000555556abce81 in Js::Exception::RaiseIfScriptActive (scriptContext=0x0, kind=0, returnAddress=0x0) at ./ChakraCore/lib/Runtime/Base/Exception.cpp:20
#4 0x0000555555956af7 in Js::Throw::OutOfMemory () at ./ChakraCore/lib/Common/Exceptions/Throw.cpp:122
#5 0x00005555559fb79e in Memory::Recycler::OutOfMemory (this=0x555557d05b50) at ./ChakraCore/lib/Common/Memory/Recycler.cpp:1423
#6 Memory::Recycler::LargeAlloc (this=0x555557d05b50, heap=0x555557d094f0, size=3221225474, attributes=Memory::LeafBit) at ./ChakraCore/lib/Common/Memory/Recycler.cpp:1384
#7 0x0000555555881758 in Memory::Recycler::RealAlloc<(Memory::ObjectInfoBits)32, false> (this=0x555557d05b50, heap=0x555557d094f0, size=3221225474) at ./ChakraCore/lib/Common/Memory/Recycler.inl:384
#8 0x00005555565a3115 in Memory::Recycler::AllocWithAttributesInlined<(Memory::ObjectInfoBits)32, false> (this=0x555557d05b50, size=) at ./ChakraCore/lib/Common/Memory/Recycler.inl:113
#9 Memory::Recycler::AllocWithAttributes<(Memory::ObjectInfoBits)32, false> (this=0x555557d05b50, size=) at ./ChakraCore/lib/Common/Memory/Recycler.h:1589
#10 Memory::Recycler::AllocLeaf (this=0x555557d05b50, size=) at ./ChakraCore/lib/Common/Memory/Recycler.h:1380
#11 operator new[] (byteSize=, alloc=0x555557d05b50, AllocFunc=) at ./ChakraCore/lib/Common/DataStructures/../Memory/Allocator.h:498
#12 Memory::AllocateArray (allocator=0x555557d05b50, AllocFunc=, count=)
at ./ChakraCore/lib/Common/DataStructures/../Memory/Allocator.h:348
#13 Js::JavascriptString::RepeatCore (currentString=, count=536870912, scriptContext=0x555557d2f6b0) at ./ChakraCore/lib/Runtime/Library/JavascriptString.cpp:2627
#14 0x00005555565a5aab in Js::JavascriptString::EntryRepeat (function=, callInfo=...) at ./ChakraCore/lib/Runtime/Library/JavascriptString.cpp:2607
#15 0x00005555566b46fe in amd64_CallFunction () at ./ChakraCore/lib/Runtime/Library/amd64/JavascriptFunctionA.S:100
#16 0x0000555555effef7 in Js::InterpreterStackFrame::OP_CallCommon > > __unaligned>(Js::OpLayoutDynamicProfile > > __unaligned const __unaligned*, Js::RecyclableObject*, unsigned int, Js::AuxArray const*) (this=0x7fffffffd8b0, playout=, function=0x7ff7f469fb00,
flags=, spreadIndices=0x0) at ./ChakraCore/lib/Runtime/Language/InterpreterStackFrame.cpp:3973
#17 0x0000555555eff68d in Js::InterpreterStackFrame::OP_ProfileCallCommon > > __unaligned>(Js::OpLayoutDynamicProfile > > __unaligned const __unaligned*, Js::RecyclableObject*, unsigned int, unsigned short, unsigned int, Js::AuxArray const*) (this=0x0, playout=0x7ff7f575ca12,
function=, flags=0, profileId=0, inlineCacheIndex=0, spreadIndices=0x0) at ./ChakraCore/lib/Runtime/Language/InterpreterStackFrame.cpp:4016
#18 0x0000555555df2490 in Js::InterpreterStackFrame::OP_ProfiledCallIWithICIndex > >(Js::OpLayoutDynamicProfile > > const __unaligned*) (this=0x7fffffffd8b0, playout=0x7ff7f575ca12) at ./ChakraCore/lib/Runtime/./Language/InterpreterStackFrame.h:520
#19 Js::InterpreterStackFrame::ProcessProfiled (this=) at ./ChakraCore/lib/Runtime/Language/InterpreterHandler.inl:91
#20 0x0000555555da1782 in Js::InterpreterStackFrame::Process (this=0x7fffffffd8b0) at ./ChakraCore/lib/Runtime/Language/InterpreterStackFrame.cpp:3472
#21 0x0000555555d9fc47 in Js::InterpreterStackFrame::InterpreterHelper (function=, args=, returnAddress=0x7ff7f4650fa2,
addressOfReturnAddress=0x7fffffffdb68, asmJsReturn=0x0) at ./ChakraCore/lib/Runtime/Language/InterpreterStackFrame.cpp:2153
#22 0x0000555555d9ebba in Js::InterpreterStackFrame::InterpreterThunk (layout=0x7fffffffdb80) at ./ChakraCore/lib/Runtime/Language/InterpreterStackFrame.cpp:1833
#23 0x00007ff7f4650fa2 in ?? ()
#24 0x00007fffffffdb90 in ?? ()
#25 0x00005555566b46fe in amd64_CallFunction () at ./ChakraCore/lib/Runtime/Library/amd64/JavascriptFunctionA.S:100
Backtrace stopped: frame did not save the PC
(gdb)
```

Credits: @Ye0nny, @EJueon of the seclab-yonsei.