Toggling clip brushes on a specific map crashes the game

[hexaflexahexagon]

Describe the bug
Loading the given map will crash the game if you toggle clipbrushes on. The map was made ~10/20/20 so it was pre-chaos but it worked at that point in time. There are no clip brushes on the map. Compiled using the TF2 fgd/hammer/compile pal settings/etc if that's relevant. The map itself is a simple fullbright box with a player teamspawn, teleport destination, and trigger_teleport.

To Reproduce
Steps to reproduce the behavior:

1. Load the linked map file
2. Toggle r_drawclipbrushes 2
3. Game crashes with Cannot load corrupted map. Engine Error popup.

Expected behavior
The game should not crash

Screenshots

Desktop/Branch (please complete the following information):
OS: Windows
Branch: 0.8.8-rc

Additional context
bsp: https://cdn.discordapp.com/attachments/671175695648423959/822160010838671440/rj_projectiletele.bsp
vmf: https://cdn.discordapp.com/attachments/671175695648423959/822161965509640192/rj_projectiletele.vmf

[Gocnak]

Might just be a matter of recompiling the map but the engine should gracefully handle this and not crash.

[braem]

From my testing, any map that has exactly 1 trigger will crash like this. This even happens on CSGO. Will have to dive into the differences on how they render clip brushes.

[Gocnak]

Looks like it's related to leafs? I was getting a crash in the command computing the clipbrushes to render and the leaf + leafbrushes seemed to go out of bounds of the BSP's collision data array...

Really weird, the functions look the same between 2013/GO. I don't know if there's something deeper here.

[braem]

Looks like it's related to leafs? I was getting a crash in the command computing the clipbrushes to render and the leaf + leafbrushes seemed to go out of bounds of the BSP's collision data array...

Really weird, the functions look the same between 2013/GO. I don't know if there's something deeper here.

Yup exactly. I believe it's much deeper. Had a poke around that area, comparing to TF2 code,, couldn't find anything pointing to it,

[hexaflexahexagon]

did some more experimenting on this since it seems to be related to visleaves and wrote down my findings in case it's of any use

• mat_leafvis 3 works fine and doesn't cause a crash
• a pure empty map (with just a teamspawn entity) does not crash
• func_detail does not crash, func_brush does crash (and any other func_* entities that i tested)
• adding a hint/skip brush added between the player and entity does not crash
  
• trying to add a wall so that the entity isn't in a rendered visleaf doesn't change anything
  
• separating the player and 1 entity into different areas also doesn't do anything
  
• having 2 entities rather than 1 does not crash, same with any value higher than 2. i thought i crashed the first time i tried 2 entities but that might have been me loading the map with 1 before it had compiled 2 entities instead since i couldn't replicate it, even after fresh game boot.

[Gocnak]

Fun fact, this error happens on TF2 as well. Let's just say this crash may or may not be an exploit that was fixed for more modern versions of the engine. The actual fix for this specific crash (non-malicious BSPs) was changing some other related logic.

[Gocnak]

Dos this still happen on latest?

[hexaflexahexagon]

looks like the crash doesn't happen anymore on the latest update.