
`bm_face_len_cmp` incorrectly interpreted its arguments as `BMFace *` instead of `BMFace **`, causing an out-of-bounds read. Ref D11637
`bm_face_len_cmp` incorrectly interpreted its arguments as `BMFace *` instead of `BMFace **`, causing an out-of-bounds read. Ref D11637