Skip to content

An empty tree node's bounds are inverted infinities, not the float limits - #99

Merged
nicolas-maman merged 1 commit into
mainfrom
fix/tree-empty-node-infinite
Oct 4, 2026
Merged

nicolas-maman merged 1 commit into
mainfrom
fix/tree-empty-node-infinite

Conversation

@nicolas-maman

Copy link
Copy Markdown
Collaborator

I audited the dynamic tree and hull creation against Box3D e77352c. Both match upstream line for line, apart from this one defect.

An empty node counts as a leaf (EMPTY_NODE carries the leaf flag), so only its bounds keep a traversal out of it. Those bounds were math.aabb_empty(): the float limits (±MAX_FLOAT), inverted. Upstream's b3MakeEmptyNode uses infinities instead.

The failure: a query box reaching the float limits, which is the natural 'query everything' box, overlapped those bounds. In a tree with a single proxy, the root is a leaf with an empty node beside it. tree_query took the empty node for a leaf and read proxy 0x3FFFFFFF, which is an access violation. tree_box_cast had the same path for a cast box grown to the limits.

The fix: empty nodes now get ±infinity bounds from a new math.infinity(), and no box overlaps those.

test_dynamic_tree queries a one-proxy tree with a box out to the float limits and expects only that proxy. On main the test crashes.

All 28 test programs pass locally on aether 0.772.0, with no warnings.

… float limits

An empty node passes for a leaf (EMPTY_NODE carries the leaf flag), so
only its bounds keep a traversal out of it. They were math.aabb_empty(),
the float limits (+-MAX_FLOAT) inverted, where the reference's
b3MakeEmptyNode uses infinities. A query box reaching the limits -- the
natural 'everything' box -- overlapped them: in a tree of one proxy, whose
root is a leaf beside an empty node, tree_query took the empty node for a
leaf and read proxy 0x3FFFFFFF, an access violation; tree_box_cast had the
same path for a cast box grown to the limits. The empty node's bounds are
+-infinity now (math.infinity(), new), which no box overlaps.

test_dynamic_tree: the leaf root queried with a box out to the float limits
finds only its proxy (on main the test crashes). Found by an audit of the
dynamic tree and hull creation against Box3D e77352c, otherwise faithful.
@nicolas-maman
nicolas-maman merged commit df74fcb into main Oct 4, 2026
1 check passed
@nicolas-maman
nicolas-maman deleted the fix/tree-empty-node-infinite branch October 6, 2026 23:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant