fix fuzzer

src/pathops/SkOpSpan.cpp

 /*
  * Copyright 2014 Google Inc.
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 #include "SkOpCoincidence.h"
 #include "SkOpContour.h"
 #include "SkOpSegment.h"
 #include "SkPathWriter.h"
@@ skipping 369 matching lines @@
 }
 
 // Please keep this in sync with debugInsertCoincidence()
 bool SkOpSpan::insertCoincidence(const SkOpSegment* segment, bool flipped) {
     if (this->containsCoincidence(segment)) {
         return true;
     }
     SkOpPtT* next = &fPtT;
     while ((next = next->next()) != &fPtT) {
         if (next->segment() == segment) {
-            SkOpSpan* span = flipped ? next->span()->prev() : next->span()->upCast();
-            if (!span) {
-                return false;
+            SkOpSpan* span;
+            if (flipped) {
+                span = next->span()->prev();
+                if (!span) {
+                    return false;
+                }
+            } else {
+                SkOpSpanBase* base = next->span();
+                if (!base->upCastable()) {
+                    return false;
+                }
+                span = base->upCast();
             }
             this->insertCoincidence(span);
             return true;
         }
     }
 #if DEBUG_COINCIDENCE
     SkASSERT(0); // FIXME? if we get here, the span is missing its opposite segment...
 #endif
     return true;
 }
@@ skipping 36 matching lines @@
 
 void SkOpSpan::setWindSum(int windSum) {
     SkASSERT(!final());
     if (fWindSum != SK_MinS32 && fWindSum != windSum) {
         this->globalState()->setWindingFailed();
         return;
     }
     SkASSERT(!DEBUG_LIMIT_WIND_SUM || SkTAbs(windSum) <= DEBUG_LIMIT_WIND_SUM);
     fWindSum = windSum;
 }