Arai-A

A problem in the ECMAScript specification of async generators may lead to mis-implementation in a way that could present as a security issue, such as type confusion and pointer dereference. The internal async generator machinery calls regular promise resolver functions on IteratorResult objects, assuming that these objects will not be then-ables. However, these objects can be made then-able, triggering arbitrary behavior, including re-entering the async generator machinery in a way that violates some internal invariants.

A wrong assumption in Boa's implementation of `AsyncGenerator` can cause an uncaught exception on certain scripts. This occurs because the state of an `AsyncGenerator` object is assumed not to change while resolving a promise created by methods such as `%AsyncGeneratorPrototype%.next`, `%AsyncGeneratorPrototype%.return`, or `%AsyncGeneratorPrototype%.throw`. However, a carefully constructed code can trigger a state transition from a getter method for the promise's `then` property, causing the engine to fail an assertion of this assumption and resulting in an uncaught exception. This could be used to create a Denial Of Service attack in applications that run arbitrary ECMAScript code provided by an external user.