Fix fuzzer-found deserialization bugs

src/core/SkPath.cpp

 /*
  * Copyright 2006 The Android Open Source Project
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 #include "SkBuffer.h"
 #include "SkCubicClipper.h"
 #include "SkErrorInternals.h"
@@ skipping 1889 matching lines @@
     int32_t packed;
     if (!buffer.readS32(&packed)) {
         return 0;
     }
 
     unsigned version = packed & 0xFF;
 
     fConvexity = (packed >> kConvexity_SerializationShift) & 0xFF;
     fFillType = (packed >> kFillType_SerializationShift) & 0xFF;
     uint8_t dir = (packed >> kDirection_SerializationShift) & 0x3;
     fIsVolatile = (packed >> kIsVolatile_SerializationShift) & 0x1;

[reed1, 2016/01/13 19:20:05]

unrelated: this seems wacky -- storing/restoring the volatile bit

     SkPathRef* pathRef = SkPathRef::CreateFromBuffer(&buffer);
 
     // compatibility check
     if (version < kPathPrivFirstDirection_Version) {
         switch (dir) {  // old values
             case 0:
                 fFirstDirection = SkPathPriv::kUnknown_FirstDirection;
                 break;
             case 1:
                 fFirstDirection = SkPathPriv::kCW_FirstDirection;
                 break;
             case 2:
                 fFirstDirection = SkPathPriv::kCCW_FirstDirection;
                 break;
             default:
                 SkASSERT(false);
         }
     } else {
         fFirstDirection = dir;
     }
 
     size_t sizeRead = 0;
-    if (buffer.isValid()) {
+    if (buffer.isValid() && pathRef) {

[reed1, 2016/01/13 19:20:05]

I think this if/else-if is getting more confusing. I posit that the following is
correct, and perhaps clearer.

(I think this should go on line 1912)

if (!pathRef) {
    SkASSERT(!buffer.isValid());
    return 0;
}

Then we shouldn't need to check again.

[ajuma, 2016/01/13 20:08:15]

Moved the check. The suggested SkASSERT doesn't hold though; for example,
SkPathRef::CreateFromBuffer can fail because one of the counts read from the
buffer is negative (see the changes in SkPathRef.cpp) without the buffer itself
becoming invalid.

         fPathRef.reset(pathRef);
         SkDEBUGCODE(this->validate();)
         buffer.skipToAlign4();
         sizeRead = buffer.pos();
     } else if (pathRef) {
         // If the buffer is not valid, pathRef should be nullptr
         sk_throw();
     }
     return sizeRead;
 }
@@ skipping 1143 matching lines @@
         }
     } while (!done);
     return SkToBool(tangents.count()) ^ isInverse;
 }
 
 int SkPath::ConvertConicToQuads(const SkPoint& p0, const SkPoint& p1, const SkPoint& p2,
                                 SkScalar w, SkPoint pts[], int pow2) {
     const SkConic conic(p0, p1, p2, w);
     return conic.chopIntoQuadsPOW2(pts, pow2);
 }