[Bug]: Abort during exponentiation of large strings

### ChakraCore Version

622c745

### Steps to reproduce

Build ChakraCore with the default configuration:
```
./build.sh -d
```

Run ChakraCore with the provided input:
```
./out/Debug/ch test.js
```

### Proof of concept

```js
let c = [];

new Outer();

function Outer() {
function grow() {
c += Map;
c += c;
}

grow();
grow();
grow();
grow();
c += Map;

recurse();

function recurse() {
c += Map;
c += Map;
c += Map;

Intl **= c;

for (let i = 0; i < 4; i++) {
c += Map;
c += c;
}

recurse();
}
}
```

### Exception or Error

```text
Aborted (core dumped)

(gdb) run
Starting program: /home/chakracore/out/Debug/ch test.js
warning: Error disabling address space randomization: Operation not permitted
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
[New Thread 0x7f554e3af700 (LWP 2771971)]
[New Thread 0x7f554db7f700 (LWP 2771972)]
[New Thread 0x7f554d37e700 (LWP 2771973)]

Thread 1 "ch" received signal SIGTRAP, Trace/breakpoint trap.
DBG_DebugBreak () at /home/chakracore/pal/src/arch/i386/debugbreak.S:18
18 ret
(gdb) bt
#0 DBG_DebugBreak () at /home/chakracore/pal/src/arch/i386/debugbreak.S:18
#1 0x00007f5d4e6cc4b1 in DebugBreak () at /home/chakracore/pal/src/debug/debug.cpp:408
#2 0x00007f5d4ec9ec69 in ReportFatalException (context=0, exceptionCode=-2147024882, reasonCode=Fatal_OutOfMemory, scenario=10)
at /home/chakracore/lib/Common/Exceptions/ReportError.cpp:21
#3 0x00007f5d4ec9efe6 in RecyclerSingleAllocationLimit_unrecoverable_error ()
at /home/chakracore/lib/Common/Exceptions/ReportError.cpp:152
#4 0x00007f5d4ed89be7 in Memory::Recycler::LargeAlloc (this=0x5566dbf01d18, heap=0x5566dbf06770, size=2429340738,
attributes=Memory::LeafBit) at /home/chakracore/lib/Common/Memory/Recycler.cpp:1381
#5 0x00007f5d4e79beed in Memory::Recycler::RealAlloc<(Memory::ObjectInfoBits)32, false> (this=0x5566dbf01d18, heap=0x5566dbf06770,
size=2429340738) at /home/chakracore/lib/Common/Memory/Recycler.inl:384
#6 0x00007f5d4e79bc8a in Memory::Recycler::AllocWithAttributesInlined<(Memory::ObjectInfoBits)32, false> (this=0x5566dbf01d18,
size=2429340738) at /home/chakracore/lib/Common/Memory/Recycler.inl:113
#7 0x00007f5d4e79b84d in Memory::Recycler::AllocWithAttributes<(Memory::ObjectInfoBits)32, false> (this=0x5566dbf01d18,
size=2429340738) at /home/chakracore/lib/Common/Memory/Recycler.h:1590
#8 0x00007f5d4e79b47d in Memory::Recycler::AllocLeaf (this=0x5566dbf01d18, size=2429340738)
at /home/chakracore/lib/Common/Memory/Recycler.h:1381
#9 0x00007f5d4e79b7a0 in operator new[] (byteSize=2429340738, alloc=0x5566dbf01d18, AllocFunc=
(char *(Memory::Recycler::*)(Memory::Recycler * const, size_t)) 0x7f5d4e79b460 )
at /home/chakracore/lib/Common/DataStructures/../Memory/Allocator.h:509
#10 0x00007f5d4ee186a4 in Memory::AllocateArray (allocator=0x5566dbf01d18, AllocFunc=
(char *(Memory::Recycler::*)(Memory::Recycler * const, size_t)) 0x7f5d4e79b460 ,
count=1214670369) at /home/chakracore/lib/Common/DataStructures/../Memory/Allocator.h:349
#11 0x00007f5d4f4b7397 in Js::CompoundString::GetSz (this=0x7f554ca27000)
at /home/chakracore/lib/Runtime/Library/CompoundString.cpp:1039
#12 0x00007f5d4f7dbd9d in Js::JavascriptString::ToDouble (this=0x7f554ca27000, result=0x7ffd9aa88a20)
at /home/chakracore/lib/Runtime/Library/JavascriptString.cpp:3107
#13 0x00007f5d4f7dc029 in Js::JavascriptString::ToDouble (this=0x7f554ca27000)
at /home/chakracore/lib/Runtime/Library/JavascriptString.cpp:3162
#14 0x00007f5d4f3bb679 in Js::JavascriptConversion::ToNumber_Full (aValue=0x7f554ca27000, scriptContext=0x5566dbf32848)
at /home/chakracore/lib/Runtime/Language/JavascriptConversion.cpp:884
#15 0x00007f5d4eaf355f in Js::JavascriptConversion::ToNumber (aValue=0x7f554ca27000, scriptContext=0x5566dbf32848)
at /home/chakracore/lib/Backend/../Runtime/Language/JavascriptConversion.inl:60
#16 0x00007f5d4f3d49a3 in Js::JavascriptMath::Exponentiation_Full (aLeft=0x8004000000000000, aRight=0x7f554ca27000,
scriptContext=0x5566dbf32848) at /home/chakracore/lib/Runtime/Language/../Math/JavascriptMath.cpp:929
#17 0x00007f5d4eaf2285 in Js::JavascriptMath::Exponentiation (aLeft=0x8004000000000000, aRight=0x7f554ca27000,
--Type for more, q to quit, c to continue without paging--
scriptContext=0x5566dbf32848)
at /home/chakracore/lib/Backend/../Runtime/Language/../Math/JavascriptMath.inl:226
#18 0x00007f5d4f229b8a in Js::InterpreterStackFrame::ProcessUnprofiled (this=0x7ffd9aa89b10)
at /home/chakracore/lib/Runtime/Language/InterpreterHandler.inl:121
#19 0x00007f5d4f2087ae in Js::InterpreterStackFrame::Process (this=0x7ffd9aa89b10)
at /home/chakracore/lib/Runtime/Language/InterpreterStackFrame.cpp:3495
#20 0x00007f5d4f2072c3 in Js::InterpreterStackFrame::InterpreterHelper (function=0x7ffd9aa92f58, args=...,
returnAddress=0x7f554cad0f7a, addressOfReturnAddress=0x7ffd9aa8a088, asmJsReturn=0x0)
at /home/chakracore/lib/Runtime/Language/InterpreterStackFrame.cpp:2153
#21 0x00007f5d4f2063a0 in Js::InterpreterStackFrame::InterpreterThunk (layout=0x7ffd9aa8a0a0)
at /home/chakracore/lib/Runtime/Language/InterpreterStackFrame.cpp:1833
#22 0x00007f554cad0f7a in ?? ()
#23 0x00007ffd9aa8a0c0 in ?? ()
#24 0x00007f5d4f898ace in amd64_CallFunction ()
at /home/chakracore/lib/Runtime/Library/amd64/JavascriptFunctionA.S:100
```

### Additional Context

When a large compound string is repeatedly concatenated and then used as the right-hand operand of an exponentiation assignment (`**=`), the engine attempts to convert the string to a number. For sufficiently large strings, this triggers an unrecoverable allocation in the memory allocator, causing the process to abort.