Aborted in ReportFatalException (Js::CompoundString::GetSz)

Version
---
Branch : master
Version : https://github.com/chakra-core/ChakraCore/commit/c3ead3f8a6e0bb8e32e043adc091c68cba5935e9

Platform
---
Ubuntu 20.04.5 LTS (Linux 5.4.0-144-generic x86_64)

Build
---
- Address Sanitizer=On
- Debug
```
./build.sh -d --static --sanitize=address
```

PoC
---
testcase1

```javascript
var c = " x " ;
for ( var r = 0 ; r < 8 * 8 ; r ++ ) {
try { c += c ; }
catch ( c ) { }
}
try { / ( x | x ) ; * / . exec ( c ) ; } catch ( c ) { }
```

testcase2

```javascript
var c = " x " ;
for ( var r = 0 ; r < 32 ; r ++ ) {
try { c += c ; }
catch ( c ) { }
}
try { / ( x | x ) * / . exec ( c ) ; } catch ( c ) { }
```

```javascript
// poc.js
var c = " x " ;
for ( var r = 0 ; r < 29 ; r ++ ) {
try { c += c ; }
catch ( c ) { } }
/ / . exec ( c ) ;
```

Execution steps & Output
---

```
$ ./ch poc.js
Aborted
```

Backtrace
---
Debug (ASAN)
```
(gdb) r poc.js
Starting program: ./ChakraCore/out/Debug/ch poc.js
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
[New Thread 0x7ff7f1915700 (LWP 528483)]
[New Thread 0x7ff7f1114700 (LWP 528484)]
[New Thread 0x7ff7f0913700 (LWP 528485)]

Thread 1 "ch" received signal SIGILL, Illegal instruction.
0x0000555556a35e09 in DebugBreak () at ./ChakraCore/lib/Common/CommonPal.h:161
161 __builtin_trap();
(gdb) bt
#0 0x0000555556a35e09 in DebugBreak () at ./ChakraCore/lib/Common/CommonPal.h:161
#1 ReportFatalException (context=, exceptionCode=, reasonCode=, scenario=) at ./ChakraCore/lib/Common/Exceptions/ReportError.cpp:20
#2 0x0000555556a36247 in RecyclerSingleAllocationLimit_unrecoverable_error () at ./ChakraCore/lib/Common/Exceptions/ReportError.cpp:151
#3 0x0000555556deecba in Memory::Recycler::LargeAlloc (this=0x632000000858, heap=0x6320000052b8, size=3221225474, attributes=Memory::LeafBit) at ./ChakraCore/lib/Common/Memory/Recycler.cpp:1380
#4 0x00005555567fd87f in Memory::Recycler::RealAlloc<(Memory::ObjectInfoBits)32, false> (this=0x632000000858, heap=0x6320000052b8, size=3221225474) at ./ChakraCore/lib/Common/Memory/Recycler.inl:384
#5 0x00005555567fcb24 in Memory::Recycler::AllocWithAttributesInlined<(Memory::ObjectInfoBits)32, false> (this=, size=) at ./ChakraCore/lib/Common/Memory/HeapInfoManager.h:18
#6 0x00005555567fbce9 in operator new[] (byteSize=3221225474, alloc=, AllocFunc=) at ./ChakraCore/lib/Common/DataStructures/../Memory/Allocator.h:498
#7 0x000055555888c82a in Memory::AllocateArray (allocator=0x632000000858, AllocFunc=, count=) at ./ChakraCore/lib/Common/DataStructures/../Memory/Allocator.h:348
#8 Js::CompoundString::GetSz (this=0x7ffff2849340) at ./ChakraCore/lib/Runtime/Library/CompoundString.cpp:1039
#9 0x00005555593ceff8 in Js::JavascriptString::GetString (this=0x7ffff2849340) at ./ChakraCore/lib/Runtime/Library/JavascriptString.cpp:2850
#10 0x00005555594fdfca in Js::RegexHelperTrace (scriptContext=0x622000000158, use=UnifiedRegex::RegexStats::Exec, regExp=0x7ffff2849b40, input=0x7ffff2849340) at ./ChakraCore/lib/Runtime/Library/RegexHelper.cpp:340
#11 0x00005555594fd044 in Js::RegexHelper::RegexExecImpl (scriptContext=, regularExpression=0x7ffff2849b40, input=, noResult=, stackAllocationPointer=)
at ./ChakraCore/lib/Runtime/Library/RegexHelper.cpp:607
#12 0x000055555951a48f in Js::RegexHelper::RegexExec (entryFunctionContext=0x622000000158, regularExpression=0x0, input=0x10007fff7e00, noResult=false, stackAllocationPointer=0x7ffff7fc4000)
at ./ChakraCore/lib/Runtime/Library/RegexHelper.cpp:2278
#13 0x000055555937eb72 in Js::JavascriptRegExp::EntryExec (function=, callInfo=...) at ./ChakraCore/lib/Runtime/Library/JavascriptRegularExpression.cpp:636
#14 0x0000555559723c4e in amd64_CallFunction () at ./ChakraCore/lib/Runtime/Library/amd64/JavascriptFunctionA.S:100
#15 0x000055555843ceef in Js::InterpreterStackFrame::OP_CallCommon > > __unaligned>(Js::OpLayoutDynamicProfile > > __unaligned const __unaligned*, Js::RecyclableObject*, unsigned int, Js::AuxArray const*) (this=0x7fffffffca40, playout=, function=, flags=, spreadIndices=)
at ./ChakraCore/lib/Runtime/Language/InterpreterStackFrame.cpp:3973
#16 0x000055555843bae9 in Js::InterpreterStackFrame::OP_ProfileCallCommon > > __unaligned>(Js::OpLayoutDynamicProfile > > __unaligned const __unaligned*, Js::RecyclableObject*, unsigned int, unsigned short, unsigned int, Js::AuxArray const*) (this=0x7fffffffca40, playout=0x7ffff26e11a4, function=, flags=0, profileId=,
inlineCacheIndex=0, spreadIndices=0x0) at ./ChakraCore/lib/Runtime/Language/InterpreterStackFrame.cpp:4016
#17 0x0000555557df8817 in Js::InterpreterStackFrame::OP_ProfiledCallIWithICIndex > >(Js::OpLayoutDynamicProfile > > const __unaligned*) (this=0x7fffffffca40, playout=0x7ffff26e11a4) at ./ChakraCore/lib/Runtime/./Language/InterpreterStackFrame.h:520
#18 Js::InterpreterStackFrame::ProcessProfiled (this=) at ./ChakraCore/lib/Runtime/Language/InterpreterHandler.inl:91
#19 0x0000555557c426df in Js::InterpreterStackFrame::Process (this=0x7fffffffca40) at ./ChakraCore/lib/Runtime/Language/InterpreterStackFrame.cpp:3472
#20 0x0000555557c3d150 in Js::InterpreterStackFrame::InterpreterHelper (function=, args=, returnAddress=, addressOfReturnAddress=, asmJsReturn=)
at ./ChakraCorelib/Runtime/Language/InterpreterStackFrame.cpp:2153
#21 0x0000555557c3a80d in Js::InterpreterStackFrame::InterpreterThunk (layout=0x7ffff26c0fa2) at ./ChakraCore/lib/Runtime/Language/InterpreterStackFrame.cpp:1833
#22 0x00007ffff26c0fa2 in ?? ()
#23 0x00007fffffffd010 in ?? ()
#24 0x0000555559723c4e in amd64_CallFunction () at ./ChakraCore/lib/Runtime/Library/amd64/JavascriptFunctionA.S:100
Backtrace stopped: frame did not save the PC
(gdb)
```

Credits: @Ye0nny, @EJueon of the seclab-yonsei.