fuzz wednesday

src/pathops/SkOpCoincidence.cpp

 /*
  * Copyright 2015 Google Inc.
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 #include "SkOpCoincidence.h"
 #include "SkOpSegment.h"
 #include "SkPathOpsTSect.h"
 
@@ skipping 243 matching lines @@
     SkASSERT(coinPtTStart->fT < coinPtTEnd->fT);
     SkASSERT(oppPtTStart->fT != oppPtTEnd->fT);
     SkASSERT(!coinPtTStart->deleted());
     SkASSERT(!coinPtTEnd->deleted());
     SkASSERT(!oppPtTStart->deleted());
     SkASSERT(!oppPtTEnd->deleted());
     DebugCheckAdd(fHead, coinPtTStart, coinPtTEnd, oppPtTStart, oppPtTEnd);
     DebugCheckAdd(fTop, coinPtTStart, coinPtTEnd, oppPtTStart, oppPtTEnd);
     SkCoincidentSpans* coinRec = SkOpTAllocator<SkCoincidentSpans>::Allocate(
             this->globalState()->allocator());
-    coinRec->init();
+    coinRec->init(SkDEBUGCODE(fGlobalState));
     coinRec->set(this->fHead, coinPtTStart, coinPtTEnd, oppPtTStart, oppPtTEnd
             SkDEBUGPARAMS(fGlobalState->nextCoinID()));
     fHead = coinRec;
 }
 
 // description below
 bool SkOpCoincidence::addEndMovedSpans(const SkOpSpan* base, const SkOpSpanBase* testSpan) {
     const SkOpPtT* testPtT = testSpan->ptT();
     const SkOpPtT* stopPtT = testPtT;
     const SkOpSegment* baseSeg = base->segment();
@@ skipping 52 matching lines @@
             if (!this->addOrOverlap(coinSeg, oppSeg, coinTs, coinTe, oppTs, oppTe)) {
                 return false;
             }
         }
     }
     return true;
 }
 
 // description below
 bool SkOpCoincidence::addEndMovedSpans(const SkOpPtT* ptT) {
+    if (!ptT->span()->upCastable()) {
+        return false;
+    }
     const SkOpSpan* base = ptT->span()->upCast();
     const SkOpSpan* prev = base->prev();
     if (!prev) {
         return false;
     }
     if (!prev->isCanceled()) {
         if (!this->addEndMovedSpans(base, base->prev())) {
             return false;
         }
     }
@@ skipping 1014 matching lines @@
         }
         /* coin and opp spans may not match up. Mark the ends, and then let the interior
            get marked as many times as the spans allow */
         start->insertCoincidence(oStart->upCast());
         end->insertCoinEnd(oEnd);
         const SkOpSegment* segment = start->segment();
         const SkOpSegment* oSegment = oStart->segment();
         SkOpSpanBase* next = start;
         SkOpSpanBase* oNext = oStart;
         while ((next = next->upCast()->next()) != end) {
+            if (!next->upCastable()) {
+                return false;
+            }
             if (!next->upCast()->insertCoincidence(oSegment, flipped)) {
                 return false;
             }
         }
         while ((oNext = oNext->upCast()->next()) != oEnd) {
             if (!oNext->upCast()->insertCoincidence(segment, flipped)) {
                 return false;
             }
         }
     } while ((coin = coin->next()));
@@ skipping 68 matching lines @@
             this->release(fHead, coin);
         }
     } while ((coin = coin->next()));
 }
 
 bool SkOpCoincidence::testForCoincidence(const SkCoincidentSpans* outer, const SkOpPtT* testS,
         const SkOpPtT* testE) const {
     return testS->segment()->testForCoincidence(testS, testE, testS->span(),
             testE->span(), outer->coinPtTStart()->segment());
 }