Steps to reproduce:
1. Open the attached user's project "JsonUtilitySizeOverflow.zip"
2. Select "Repro > 2. Parse 540M chars" in the top menu bar
3. Observe the Editor

Actual result: The Editor crashes with a "Size overflow in allocator" fatal error
Expected result: The JSON string is parsed, or a managed exception is thrown, and the Editor keeps running

Reproducible with: 6000.0.1f1, 6000.0.84f1, 6000.3.25f1, 6000.6.5f1, 6000.7.0b4
Not reproducible with: 7000.0.0a7
Fixed in: 7000.0.0a6

Testing Environment: Windows 11
Not reproducible on: no other environment tested

Notes:
-Selecting Repro > 1. Parse 530M chars parses successfully; the crash occurs only when the string is longer than 536,870,911 characters (int.MaxValue / 4)
-The machine needs about 8 GB of free RAM for the repro
-Native stack: JsonUtility_CUSTOM_FromJsonInternal → ICallString::ToUTF8 → scripting_icall_string_to_utf8 → convert_to_utf8 → MemoryManager::Allocate → DynamicHeapAllocator::Allocate → FatalError "Size overflow in allocator."
-Real-world trigger: the Addressables Report window crashes when opening a ~570 MB build layout (BuildReportListView.LoadLayout, BuildReportListView.cs:87)
-Workaround: disable "Open Addressables Report after build" in Preferences > Addressables
-First 5 lines of stacktrace:
0x00007FFAC7074E33 (Unity) MimallocPrimErrorHandler
0x00007FFAC703B329 (Unity) _mi_error_message
0x00007FFAC7038B5B (Unity) mi_find_page
0x00007FFAC7038277 (Unity) _mi_malloc_generic
0x00007FFAC707A7A4 (Unity) MimallocAllocator::Allocate