Aborted in ReportFatalException (Js::JavascriptString::PadCore)

## Version
commit id: c3ead3f8a6e0bb8e32e043adc091c68cba5935e9

## Platform
Ubuntu 20.04.5 LTS (Linux 5.4.0-144-generic x86_64)

## Build
- Debug Mode

```
./build.sh --debug --static
```

## PoC
```
("abcdefg").padStart(1779013264);
//("65536").padEnd(~3107152661);
```

## Execution steps & Output
```
./ch poc.js
Aborted (core dumped)
```
## Backtrace
```
(lldb) thread backtrace
* thread #1, name = 'ch', stop reason = signal SIGTRAP
* frame #0: 0x0000555556808bf9 ch`DBG_DebugBreak at debugbreak.S:18
frame #1: 0x00005555567fb181 ch`::DebugBreak() at debug.cpp:408:9
frame #2: 0x0000555555947f29 ch`::ReportFatalException(context=0, exceptionCode=-2147024882, reasonCode=Fatal_OutOfMemory, scenario=10) at ReportError.cpp:20:9
frame #3: 0x00005555559482a6 ch`RecyclerSingleAllocationLimit_unrecoverable_error() at ReportError.cpp:151:5
frame #4: 0x0000555555a2a3b7 ch`char* Memory::Recycler::LargeAlloc(this=0x0000555557eb84c8, heap=0x0000555557ebcf20, size=3558026516, attributes=LeafBit) at Recycler.cpp:1380:21
frame #5: 0x00005555558a9b2d ch`char* Memory::Recycler::RealAlloc<(Memory::ObjectInfoBits)32, false>(this=0x0000555557eb84c8, heap=0x0000555557ebcf20, size=3558026516) at Recycler.inl:384:12
frame #6: 0x00005555558a98ca ch`char* Memory::Recycler::AllocWithAttributesInlined<(Memory::ObjectInfoBits)32, false>(this=0x0000555557eb84c8, size=3558026516) at Recycler.inl:113:24
frame #7: 0x00005555558a948d ch`char* Memory::Recycler::AllocWithAttributes<(Memory::ObjectInfoBits)32, false>(this=0x0000555557eb84c8, size=3558026516) at Recycler.h:1589:16
frame #8: 0x00005555558a90bd ch`Memory::Recycler::AllocLeaf(this=0x0000555557eb84c8, size=3558026516) at Recycler.h:1380:5
frame #9: 0x00005555558a93e0 ch`void* operator new[](byteSize=3558026516, alloc=0x0000555557eb84c8, AllocFunc=a0 90 8a 55 55 55 00 00 00 00 00 00 00 00 00 00)(unsigned long)) at Allocator.h:498:21
frame #10: 0x0000555555ab0ad4 ch`char16_t* Memory::AllocateArray(allocator=0x0000555557eb84c8, AllocFunc=a0 90 8a 55 55 55 00 00 00 00 00 00 00 00 00 00, count=1779013258)(unsigned long), unsigned long) at Allocator.h:348:12
frame #11: 0x00005555563e3f8f ch`Js::JavascriptString::RepeatCore(currentString=0x00007ff7e6c3c600, count=1779013257, scriptContext=0x0000555557ee8cc8) at JavascriptString.cpp:2627:26
frame #12: 0x00005555563e3a85 ch`Js::JavascriptString::PadCore(args=0x00007fffffffad58, mainString=0x00007ff7e6c2f280, isPadStart=true, scriptContext=0x0000555557ee8cc8) at JavascriptString.cpp:2187:24
frame #13: 0x00005555563e3730 ch`Js::JavascriptString::EntryPadStart(function=0x00007ff7e6c3c4c0, callInfo=(Count = 2, Flags = CallFlags_NotUsed, unused = 0)) at JavascriptString.cpp:2120:16
frame #14: 0x00005555564a37de ch`amd64_CallFunction at JavascriptFunctionA.S:100
frame #15: 0x00005555561d7a4b ch`void* Js::JavascriptFunction::CallFunction(function=0x00007ff7e6c3c4c0, entryPoint=(ch`Js::JavascriptString::EntryPadStart(Js::RecyclableObject*, Js::CallInfo, ...) at JavascriptString.cpp:2108), args=Arguments @ 0x00007fffffffaed0, useLargeArgCount=false)(Js::RecyclableObject*, Js::CallInfo, ...), Js::Arguments, bool) at JavascriptFunction.cpp:1364:16
frame #16: 0x0000555555ffc5fe ch`void Js::InterpreterStackFrame::OP_CallCommon > > __unaligned>(this=0x00007fffffffc090, playout=0x00007ff7e84d31b2, function=0x00007ff7e6c3c4c0, flags=16, spreadIndices=0x0000000000000000)0> > > __unaligned const __unaligned*, Js::RecyclableObject*, unsigned int, Js::AuxArray const*) at InterpreterStackFrame.cpp:3973:21
frame #17: 0x0000555555ffc0e1 ch`void Js::InterpreterStackFrame::OP_ProfileCallCommon > > __unaligned>(this=0x00007fffffffc090, playout=0x00007ff7e84d31b2, function=0x00007ff7e6c3c4c0, flags=0, profileId=0, inlineCacheIndex=0, spreadIndices=0x0000000000000000)0> > > __unaligned const __unaligned*, Js::RecyclableObject*, unsigned int, unsigned short, unsigned int, Js::AuxArray const*) at InterpreterStackFrame.cpp:4016:9
frame #18: 0x0000555555fc72a8 ch`void Js::InterpreterStackFrame::OP_ProfiledCallIWithICIndex > >(this=0x00007fffffffc090, playout=0x00007ff7e84d31b2)0> > > const __unaligned*) at InterpreterStackFrame.h:520:115
frame #19: 0x0000555555eac7d3 ch`Js::InterpreterStackFrame::ProcessProfiled(this=0x00007fffffffc090) at InterpreterHandler.inl:91:3
frame #20: 0x0000555555e52112 ch`Js::InterpreterStackFrame::Process(this=0x00007fffffffc090) at InterpreterStackFrame.cpp:3472:20
frame #21: 0x0000555555e50dd3 ch`Js::InterpreterStackFrame::InterpreterHelper(function=0x00007ff7e7c766e0, args=ArgumentReader @ 0x00007fffffffc580, returnAddress=0x00007ff7e6bc0fa2, addressOfReturnAddress=0x00007fffffffc5c8, asmJsReturn=0x0000000000000000) at InterpreterStackFrame.cpp:2153:40
frame #22: 0x0000555555e4feb0 ch`Js::InterpreterStackFrame::InterpreterThunk(layout=0x00007fffffffc5e0) at InterpreterStackFrame.cpp:1833:16
frame #23: 0x00007ff7e6bc0fa2
frame #24: 0x00005555564a37de ch`amd64_CallFunction at JavascriptFunctionA.S:100
frame #25: 0x00005555561d7a4b ch`void* Js::JavascriptFunction::CallFunction(function=0x00007ff7e7c766e0, entryPoint=(ch`NativeCodeGenerator::CheckCodeGenThunk(Js::RecyclableObject*, Js::CallInfo, ...)), args=Arguments @ 0x00007fffffffc7e8, useLargeArgCount=false)(Js::RecyclableObject*, Js::CallInfo, ...), Js::Arguments, bool) at JavascriptFunction.cpp:1364:16

```