Segmentation fault on self-referential array raised to power of zero
Author: lmaltsisCreated Jun 9, 2026Updated Jun 9, 2026
JerryScript revision
https://github.com/jerryscript-project/jerryscript/commit/b7069350c2e52e7dc721dfb75f067147bd79b39b
Build platform
Ubuntu 24.04.4 LTS (Linux 6.17.0-23-generic x86_64)
Build steps
Debug build from source with -DCMAKE_BUILD_TYPE=Debug
mkdir build && cmake -B "$BUILD_DIR" -S "$SRC_DIR" -DCMAKE_INSTALL_PREFIX="$INSTALL_DIR" -DCMAKE_BUILD_TYPE=Debug && cmake --build "$BUILD_DIR" -j"$JOBS"Test case
let base = new Array;
base[0] = base;
Math.pow(base, 0)Execution steps + Output
$ jerry /tmp/bug.js
Aborted (core dumped)Backtrace
(None except segfault)
Note: This bug was found via fuzzing.
Source: jerryscript-project/jerryscript