Handle corrupted generator or async generator prototype

[rhuanjl]

This PR fixes a fatal bug (abort at runtime) introduced by my previous fix to the handling of generator and async generator prototypes.

As well as fixing the abort this also brings behaviour for these cases in line with v8 and jsc. (The previously released version of chakra did not match them)

Fix: #6677

[ppenzin]

I will come back to this tomorrow. Does anything special need to happen if prototype is set to 0?

[rhuanjl]

I will come back to this tomorrow. Does anything special need to happen if prototype is set to 0?

No though we can test if you like; the crash is for any non-object value type so the same for 1 as 0.

[rhuanjl]

I'v added a couple of extra tests so we do 0 as well as 1 and also a string - the internal path is the same for these but thought best to have the test there to catch any future regression.

[ppenzin]

I'v added a couple of extra tests so we do 0 as well as 1 and also a string - the internal path is the same for these but thought best to have the test there to catch any future regression.

Sure, that is a good idea.