Segmentation fault on self-referential array raised to power of zero

Author: lmaltsisCreated Jun 9, 2026Updated Jun 9, 2026
JerryScript revision

https://github.com/jerryscript-project/jerryscript/commit/b7069350c2e52e7dc721dfb75f067147bd79b39b

Build platform

Ubuntu 24.04.4 LTS (Linux 6.17.0-23-generic x86_64)

Build steps

Debug build from source with -DCMAKE_BUILD_TYPE=Debug

bash
mkdir build && cmake  -B "$BUILD_DIR" -S "$SRC_DIR" -DCMAKE_INSTALL_PREFIX="$INSTALL_DIR" -DCMAKE_BUILD_TYPE=Debug && cmake --build "$BUILD_DIR" -j"$JOBS"
Test case
javascript
let base = new Array;
base[0] = base;
Math.pow(base, 0)
Execution steps + Output
bash
$ jerry /tmp/bug.js
Aborted (core dumped)
Backtrace

(None except segfault)

Note: This bug was found via fuzzing.

Source: jerryscript-project/jerryscript