Segmentation fault on self-referential array raised to power of zero

[lmaltsis]

JerryScript revision

b706935

Build platform

Ubuntu 24.04.4 LTS (Linux 6.17.0-23-generic x86_64)

Build steps

Debug build from source with -DCMAKE_BUILD_TYPE=Debug

mkdir build && cmake  -B "$BUILD_DIR" -S "$SRC_DIR" -DCMAKE_INSTALL_PREFIX="$INSTALL_DIR" -DCMAKE_BUILD_TYPE=Debug && cmake --build "$BUILD_DIR" -j"$JOBS"

Test case

let base = new Array;
base[0] = base;
Math.pow(base, 0)

Execution steps + Output

$ jerry /tmp/bug.js
Aborted (core dumped)

Backtrace

(None except segfault)

Note: This bug was found via fuzzing.

[lmaltsis]

Here is a (probably related) bug in self-referential arrays and Math.floor

const a = [0];
a.push(a);
Math.floor(a);

$ jerry /tmp/bug.js
Aborted (core dumped)