fix fuzzer

src/pathops/SkOpSpan.cpp

Index: src/pathops/SkOpSpan.cpp
diff --git a/src/pathops/SkOpSpan.cpp b/src/pathops/SkOpSpan.cpp
index 577a9db32669670449b66d84005bf6433ce7f5a4..1cdfe91a248dc6aad728707a933f5508c67ca8ff 100755
--- a/src/pathops/SkOpSpan.cpp
+++ b/src/pathops/SkOpSpan.cpp
@@ -387,9 +387,18 @@ bool SkOpSpan::insertCoincidence(const SkOpSegment* segment, bool flipped) {
     SkOpPtT* next = &fPtT;
     while ((next = next->next()) != &fPtT) {
         if (next->segment() == segment) {
-            SkOpSpan* span = flipped ? next->span()->prev() : next->span()->upCast();
-            if (!span) {
-                return false;
+            SkOpSpan* span;
+            if (flipped) {
+                span = next->span()->prev();
+                if (!span) {
+                    return false;
+                }
+            } else {
+                SkOpSpanBase* base = next->span();
+                if (!base->upCastable()) {
+                    return false;
+                }
+                span = base->upCast();
             }
             this->insertCoincidence(span);
             return true;