geo Rectangle checks minLat <= maxLat only with an assert, so a lat/lon box with swapped latitudes throws a bare AssertionError with -ea and is silently accepted with -da, while XYRectangle throws IllegalArgumentException

org.apache.lucene.geo.Rectangle(minLat, maxLat, minLon, maxLon) range-checks each coordinate with GeoUtils.checkLatitude / checkLongitude, which throw IllegalArgumentException, but checks the latitude order only with assert maxLat >= minLat (Rectangle.java:94 on main 645d4fe14a20). A box with swapped latitudes, built directly, through LatLonShape.newBoxQuery or newSlowDocValuesBoxQuery, for newGeometryQuery, or from a WKT ENVELOPE(minLon, maxLon, maxLat, minLat), therefore throws a bare AssertionError with assertions on and is accepted with assertions off. A LatLonShape box query then returns hits that match no region: neither the empty result that LatLonPoint.newBoxQuery gives for the same box nor the result of the correctly ordered box. The Cartesian twin XYRectangle had the same assert until LUCENE-9218 (8.5.0) made it throw IllegalArgumentException; Rectangle was not changed. The input is invalid, so this is missing validation, not a wrong answer to a valid query. Every release from 5.4.0 to 10.6.0 is affected; a one-line check in the constructor fixes it.

• Rectangle (org.apache.lucene.geo): "A rectangle is defined by its minimum and maximum latitude/longitude coordinates. It can cross the dateline, in which case minLon > maxLon" (Rectangle.java:38-39). The fields are "Minimum latitude" and "Maximum latitude" (:67-71).
• XYRectangle: the same box on a flat (Cartesian) plane, used by XYShape.
• -ea / -da: JVM flags that turn Java assert statements on or off; off is the default.

1. The constructor calls GeoUtils.checkLatitude(minLat), checkLatitude(maxLat), checkLongitude(minLon) and checkLongitude(maxLon) (Rectangle.java:86-89); each throws IllegalArgumentException for an out-of-range value. The only check of the order is assert maxLat >= minLat; (:94).
2. LatLonShape.newBoxQuery (LatLonShape.java:258) and newSlowDocValuesBoxQuery (:283) pass the caller's four values straight into the constructor; SimpleWKTShapeParser.parseBBox reads ENVELOPE(minLon, maxLon, maxLat, minLat) and does the same (SimpleWKTShapeParser.java:252-264).
3. With -ea that assert throws a bare java.lang.AssertionError with no message. With -da the box Rectangle(lat=10.0 TO 5.0 lon=0.0 TO 1.0) is kept as is.
4. The shape query encodes it unchanged (LatLonShapeBoundingBoxQuery.java:240-246: min latitude 10, max latitude 5). Its point test y < minY || y > maxY (SpatialQuery.java:824-827) is then true for every latitude, so no vertex is ever inside, and its triangle test drops every triangle that does not reach both above 10 and below 5 (:864-869). INTERSECTS keeps only shapes that cross both latitude lines; DISJOINT returns the rest.
5. LatLonPoint.newBoxQuery builds no Rectangle: it encodes the range from latitude 10 up to 5, which is empty, so it returns 0 hits with -ea and -da (LatLonPoint.java:243-244).
6. XYRectangle checks the same order with if (minY > maxY) throw new IllegalArgumentException("minY must be lower than maxY, got ...") (XYRectangle.java:41-44), and the same for X.

Polygons: big lat 0..20 (lon -1..2); band 6..8, north 12..15, south 1..3 (lon 0.2..0.8). Box lon 0..1, assertions off:

With assertions on, every LatLonShape row and LatLonPoint.newGeometryQuery(field, new Rectangle(10, 5, 0, 1)) throw AssertionError; the LatLonPoint.newBoxQuery row is the same.

• Who is hit. Any caller of new Rectangle, LatLonShape.newBoxQuery / newSlowDocValuesBoxQuery, LatLonShape or LatLonPoint.newGeometryQuery with a Rectangle, or SimpleWKTShapeParser.parse of an ENVELOPE, that passes minLat > maxLat. Possible sources: box corners from a user or a map that the application forwards without ordering them, or WKT text, whose ENVELOPE(minLon, maxLon, maxLat, minLat) puts the two latitudes the other way round from the constructor's minLat, maxLat. How often this happens was not measured.
• Default or opt-in. Default: no setting, any codec, any index. -da is the JVM default. Lucene's gradle test runs enable assertions for about 75% of seeds by default (tests.asserts, randomized since #15325, TestsAndRandomizationPlugin.java:240-249).
• Effect with -da. No error and a hit set with no meaning: not empty (what the point queries return) and not the correctly ordered box. A bug in the caller's own box code goes unnoticed.
• Effect with -ea. A bare AssertionError with no message. It is an Error, so catch (IllegalArgumentException e) and catch (Exception e) do not see it.
• Scale. One invalid query at a time. Valid boxes are not affected, and nothing is written to the index.
• How likely: rare. Two public records show a caller's own computation building such a box, both caught by the assert in tests: a CI failure posted on LUCENE-9552 (#10591), inside Lucene (quantization of a very thin box), and elastic/elasticsearch#32857 (an overflow in that project's geohash code). The recorded searches found no public report of the missing check itself since 5.4.0.

TestRectangleInvertedLatitude (27 lines with the license header, package org.apache.lucene.geo): one test method, one constructor call, single thread, deterministic (the seed does not matter). It is also the suggested regression test, or its method can go into an existing geo test class (core has no TestRectangle).

It fails on main 645d4fe14a20 through gradle and through a standalone runner, with assertions on and off, and passes with the fix. The shape-query hit lists (above) are what callers get today; they are not part of the test.

cp $REPRO/TestRectangleInvertedLatitude.java $LUCENE/lucene/core/src/test/org/apache/lucene/geo/
cd $LUCENE && ./gradlew :lucene:core:test --tests TestRectangleInvertedLatitude -Ptests.seed=DEADBEEF -Ptests.asserts=true
# and the same with -Ptests.asserts=false

# gradle, -Ptests.asserts=true
TestRectangleInvertedLatitude > testInvertedLatitudeRejected FAILED
    java.lang.AssertionError
        at __randomizedtesting.SeedInfo.seed([DEADBEEF:786E43E21F277DB3]:0)
        at org.apache.lucene.geo.Rectangle.<init>(Rectangle.java:94)
        at org.apache.lucene.geo.TestRectangleInvertedLatitude.lambda$testInvertedLatitudeRejected$0(TestRectangleInvertedLatitude.java:25)
        ...
1 test completed, 1 failed

# gradle, -Ptests.asserts=false
TestRectangleInvertedLatitude > testInvertedLatitudeRejected FAILED
    junit.framework.AssertionFailedError: Expected exception IllegalArgumentException but no exception was thrown
        at __randomizedtesting.SeedInfo.seed([DEADBEEF:786E43E21F277DB3]:0)
        ...
        at app//org.apache.lucene.geo.TestRectangleInvertedLatitude.testInvertedLatitudeRejected(TestRectangleInvertedLatitude.java:25)
1 test completed, 1 failed

• The twin was changed on purpose. XYRectangle shipped in 8.2.0 with assert minX <= maxX; assert minY <= maxY; (sandbox, through 8.4.1). LUCENE-9218 (#10258, apache/lucene-solr#1252, Ignacio Vera, 4a54ffb553a on main and ca3319cdbce on branch_8x, in 8.5.0) replaced both with IllegalArgumentException. Neither the issue nor the PR mentions Rectangle. TestXYRectangle.java:36 documents the rule as "maxY must be gte minY" (in a method whose name does not start with test, so it never runs: LFV-1013).
• Same class, other checks. Rectangle throws IllegalArgumentException for latitude 95 ("invalid latitude 95.0; must be between -90.0 and 90.0", GeoUtils.java:87).
• Siblings. spatial3d GeoRectangle throws "Top latitude less than bottom latitude" (GeoRectangle.java:111-112); sandbox LatLonBoundingBox throws "cannot have minLat [..] exceed maxLat [..]" (LatLonBoundingBox.java:124-128); Polygon and Line validate their arguments with IllegalArgumentException (Polygon.java:66-90, Line.java:55-64).
• Tests and callers. No upstream test passes an inverted latitude; the test framework's random boxes swap the latitudes to avoid one (GeoTestUtil.java:495-499). The Lucene callers reviewed build ordered boxes, and GeoEncodingUtils.createSubBoxes returns an empty grid for a box that quantization inverts before it builds any Rectangle (GeoEncodingUtils.java:237-240; the guard dates from LUCENE-7661, 2017, and has run on the four doubles, before any Rectangle, since LUCENE-9641, 2021).
• No meaning. With -da the shape hits are neither empty (the point paths), nor those of the ordered box, nor a pole-crossing reading (which would match the lat 12..15 and 1..3 polygons).
• Direction. #16919 (merged 2026-10-28) turned other AssertionErrors on reachable bad input into regular exceptions; it touched no geo file.
• Not a promise in the javadoc. "Constructs a bounding box by first validating the provided latitude and longitude coordinates" (Rectangle.java:82-84) was added in 2016 (89db4950b9e2, LUCENE-7015), when the constructor already had its four range checks and only the assert for the order; it does not say the order is checked.

The case (the read-only cross-model refute review, OpenAI GPT-5.6, and the intended-behaviour devil's advocate). minLat > maxLat is outside the documented domain: only minLon > maxLon is allowed, for the dateline. The assert states a programmer precondition, and behaviour after a broken precondition is unspecified. LatLonShape.newBoxQuery documents no @throws. LatLonPoint.newBoxQuery documents @throws IllegalArgumentException for "invalid coordinates" (LatLonPoint.java:218) and still returns an empty result for this box, so "empty" could be called the de facto answer. In 2015 only computed boxes reached GeoRect; user-supplied bounds came later (the shape box query builds a Rectangle since 7.7.0, LUCENE-8605). SimpleWKTShapeParser came in as a simple utility for tests (LUCENE-8538).

Why it fails. It shows the input is invalid, which the report concedes; it does not show that an AssertionError or silent acceptance is the right answer to invalid input on a public API. The maintainers chose IllegalArgumentException for the identical assert in the twin, the constructor throws it for every other bad coordinate, and the -da hits match neither the empty answer of the point paths nor any other reading. The refute reviewer itself called the exception "reasonable API hardening" and the split "a real defensive-validation inconsistency". Expect it to be triaged as hardening.

One fix was built and validated; three alternatives were not built.

In Rectangle(double, double, double, double), after the four range checks (1 file, +4/-1). The finder's fix; the same check XYRectangle has had since 8.5.0.

GeoUtils.checkLongitude(maxLon);
if (minLat > maxLat) {
  throw new IllegalArgumentException(
      "minLat must be lower than or equal to maxLat, got " + minLat + " > " + maxLat);
}
this.minLon = minLon;
this.maxLon = maxLon;
this.minLat = minLat;
this.maxLat = maxLat;
// removed: assert maxLat >= minLat;

Trade-offs

• Fixes every path at once: the constructor, both LatLonShape box factories, newGeometryQuery with a Rectangle and the WKT ENVELOPE. Matches XYRectangle, the constructor's own range checks and the sibling boxes.
• Behaviour change: LatLonPoint.newGeometryQuery(field, INTERSECTS, new Rectangle(10, 5, ...)) now throws where -da gives 0 hits today (the intended-behaviour check's probe; other relations not run); with -ea it already threw AssertionError.
• LatLonPoint.newBoxQuery and LatLonDocValuesField.newSlowBoxQuery keep returning 0 hits for the same box, because they never build a Rectangle; making them throw too would change an existing public call and is not proposed.
• No internal caller was found that would start throwing: the Lucene callers reviewed build ordered boxes, the quantized case of LUCENE-9552 returns an empty grid before any Rectangle is built (GeoEncodingUtils.java:237-240), and the 351 tests pass. That covers the reviewed paths, not every caller.
• Cost: one double comparison next to the four range checks the constructor already runs (also on the shape doc-values path, LatLonShapeDocValues.computeBoundingBox); not benchmarked.
• A CHANGES entry would be usual; none is drafted.

What the checks validated

• Scratch worktree of 645d4fe14a20, gradle, OpenJDK 25.0.3. Stock + the repro: 1 test, 1 failed, with -Ptests.asserts=true (AssertionError at Rectangle.java:94) and false (no exception).
• Fix + the repro: the repro, the 17 upstream classes of the org.apache.lucene.geo test package and the 19 classes org.apache.lucene.document.TestLatLon* plus TestShapeDocValues: 38 suites, 351 tests, 0 failed, 22 skipped (20 @Nightly, 1 @Ignore, 1 @AwaitsFix), with -Ptests.asserts=true (seed DEADBEEF) and false (seed 5EED1014).
• :lucene:core:check -x test (google-java-format, ecjLint, forbiddenApis) passes.
• Earlier: the finder's 86 upstream geo tests pass with the fix; the adjudication ran the independent reproduction's 5-test class with the fix: 5 of 5 pass (-da).

Return a no-match query from LatLonShape.newBoxQuery and newSlowDocValuesBoxQuery when minLatitude > maxLatitude, as the point path effectively does and as LUCENE-9552 chose for quantized boxes. Not built.

Trade-offs

Consistent with the point queries, but new Rectangle(10, 5, ...), the WKT ENVELOPE and newGeometryQuery still accept the box silently with -da or throw AssertionError with -ea, and the relations need care: DISJOINT with an empty box should match every shape, not none.

Throw in LatLonShape.newBoxQuery, newSlowDocValuesBoxQuery and SimpleWKTShapeParser.parseBBox. Not built.

Trade-offs

Leaves new Rectangle itself assert-only, so direct users and newGeometryQuery are not covered.

Add an @throws or a note to the constructor without changing behaviour. Not built.

Trade-offs

Assertions-off callers still get silent acceptance and meaningless hits.

Method: non-formal (a source-level static scan plus differential testing, no model or bounded-exhaustive check). The hunt's hunt unit for assert-only input checks, a follow-up to #16919, ran on main 645d4fe14a20 on 2026-10-29.

• Scan. A source scanner listed public and protected methods whose only check of a parameter is an assert: 430 rows.
• Differential run. On the stock jars, Rectangle against XYRectangle / XYShape.newBoxQuery and against LatLonPoint.newBoxQuery: an IllegalArgumentException on the Cartesian side, a bare AssertionError (-ea) or silent acceptance (-da) on the lat/lon side, 0 hits on the point side.
• Callers. Grepping the constructor's callers added newSlowDocValuesBoxQuery and the WKT ENVELOPE path.
• Reduction. The finder's 3-test JUnit was reduced to the one-line constructor test above.