Found by the new real-world corpus harness on its first run.
What happens
A self-union of Thingi10K model 48556 panics instead of returning a
result or a typed refusal:
thread 'main' panicked at csg/boolean45.rs:272:5:
assertion `left == right` failed
left: 1
right: 0
The assertion is assert_eq!(pts.len() % 2, 0) in pair_up, which
requires the edge-point list to have even length. Real geometry reaches
it with an odd count.
The input is not obviously damaged
Every structural check we apply passes:
verts : 6902
facets : 13796
finite positions : true
max index : 6901 of 6902 (in range)
duplicate facets : 0
degenerate facets : 0
So this is not a case of garbage in. A mesh that passes our own audit
still reaches an internal invariant violation.
Severity
This is a panic, not a wrong answer. It crosses a contract boundary: the
provider is expected to return Result, and a caller cannot catch this.
Any application feeding user meshes through the boolean can be killed by
an input that looks sound.
Upstream status
Same assertion exists in crates.io boolmesh 0.1.9 at
boolean45/mod.rs:149, so this is an upstream invariant rather than
absorption damage — same category as #100.
Reproduction
benchmarks/examples/repro_48556.rs loads the packed model and calls
the self-union directly. It reads the corpus cache and skips cleanly
when the corpus is absent.
Model licence is Creative Commons - Attribution (author
bongoboy23), so the id is citable, but the geometry stays out of the
repository per the corpus licence policy.
Suggested direction
pair_up should return a Result and let the boolean surface a typed
refusal, rather than asserting. That converts an uncatchable crash into
the refusal the contract already allows for input it cannot process.
Found by the new real-world corpus harness on its first run.
What happens
A self-union of Thingi10K model
48556panics instead of returning aresult or a typed refusal:
The assertion is
assert_eq!(pts.len() % 2, 0)inpair_up, whichrequires the edge-point list to have even length. Real geometry reaches
it with an odd count.
The input is not obviously damaged
Every structural check we apply passes:
So this is not a case of garbage in. A mesh that passes our own audit
still reaches an internal invariant violation.
Severity
This is a panic, not a wrong answer. It crosses a contract boundary: the
provider is expected to return
Result, and a caller cannot catch this.Any application feeding user meshes through the boolean can be killed by
an input that looks sound.
Upstream status
Same assertion exists in crates.io
boolmesh0.1.9 atboolean45/mod.rs:149, so this is an upstream invariant rather thanabsorption damage — same category as #100.
Reproduction
benchmarks/examples/repro_48556.rsloads the packed model and callsthe self-union directly. It reads the corpus cache and skips cleanly
when the corpus is absent.
Model licence is
Creative Commons - Attribution(authorbongoboy23), so the id is citable, but the geometry stays out of therepository per the corpus licence policy.
Suggested direction
pair_upshould return aResultand let the boolean surface a typedrefusal, rather than asserting. That converts an uncatchable crash into
the refusal the contract already allows for input it cannot process.