[parser] Disallow await on LHS of exponentiation

Await is a unary operator and should be disallowed on the LHS of
exponentiation like all other unary operators.

Bug: v8:11213
Change-Id: I9c51e33cb37660627748cd926ec222ac0ac246de
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2566442Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71535}

src/parsing/parser-base.h

@@ -3166,6 +3166,15 @@ ParserBase<Impl>::ParseAwaitExpression() {
 
   ExpressionT value = ParseUnaryExpression();
 
+  // 'await' is a unary operator according to the spec, even though it's treated
+  // specially in the parser.
+  if (peek() == Token::EXP) {
+    impl()->ReportMessageAt(
+        Scanner::Location(await_pos, peek_end_position()),
+        MessageTemplate::kUnexpectedTokenUnaryExponentiation);
+    return impl()->FailureExpression();
+  }
+
   ExpressionT expr = factory()->NewAwait(value, await_pos);
   function_state_->AddSuspend();
   impl()->RecordSuspendSourceRange(expr, PositionAfterSemicolon());

test/mjsunit/es7/exponentiation-operator.js

@@ -269,6 +269,7 @@ function TestBadAssignmentLHS() {
   assertThrows("if (false) { /17/ **= 10; }", SyntaxError);
   assertThrows("if (false) { ({ valueOf() { return 17; } } **= 10); }",
                SyntaxError);
+  assertThrows("async function f() { await 1 ** 2; }", SyntaxError);
   // TODO(caitp): a Call expression as LHS should be an early SyntaxError!
   // assertThrows("if (false) { Array() **= 10; }", SyntaxError);
   assertThrows(() => Array() **= 10, ReferenceError);