Fix fuzzer-found deserialization bugs

src/core/SkPath.cpp

Index: src/core/SkPath.cpp
diff --git a/src/core/SkPath.cpp b/src/core/SkPath.cpp
index ab8d7359d2271b5a15b531859f44379522a4b378..a9989234bd988ea937bcb48a29dc167dbbf8a01b 100644
--- a/src/core/SkPath.cpp
+++ b/src/core/SkPath.cpp
@@ -1930,7 +1930,7 @@ size_t SkPath::readFromMemory(const void* storage, size_t length) {
     }
 
     size_t sizeRead = 0;
-    if (buffer.isValid()) {
+    if (buffer.isValid() && pathRef) {

[reed1, 2016/01/13 19:20:05]

I think this if/else-if is getting more confusing. I posit that the following is
correct, and perhaps clearer.

(I think this should go on line 1912)

if (!pathRef) {
    SkASSERT(!buffer.isValid());
    return 0;
}

Then we shouldn't need to check again.

[ajuma, 2016/01/13 20:08:15]

Moved the check. The suggested SkASSERT doesn't hold though; for example,
SkPathRef::CreateFromBuffer can fail because one of the counts read from the
buffer is negative (see the changes in SkPathRef.cpp) without the buffer itself
becoming invalid.

         fPathRef.reset(pathRef);
         SkDEBUGCODE(this->validate();)
         buffer.skipToAlign4();