template intersection fuzz fixes

src/pathops/SkOpCoincidence.cpp

 /*
  * Copyright 2015 Google Inc.
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 #include "SkOpCoincidence.h"
 #include "SkOpSegment.h"
 #include "SkPathOpsTSect.h"
 
@@ skipping 443 matching lines @@
                 if (!success) {
                     SkOPASSERT(false);
                     return false;
                 }
                 if (startOver) {
                     test = start;
                     oTest = oStart;
                 }
             }
             if (test != end) {
+                if (!test->upCastable()) {
+                    return false;
+                }
                 test = test->upCast()->next();
             }
             if (oTest != oEnd) {
                 oTest = coin->flipped() ? oTest->prev() : oTest->upCast()->next();
                 if (!oTest) {
                     return false;
                 }
             }
         }
     } while ((coin = coin->next()));
@@ skipping 125 matching lines @@
     if (coinSeg == oppSeg) {
         return false;
     }
     return this->addOrOverlap(coinSeg, oppSeg, coinTs, coinTe, oppTs, oppTe);
 }
 
 /* Please keep this in sync with debugAddOrOverlap() */
 bool SkOpCoincidence::addOrOverlap(SkOpSegment* coinSeg, SkOpSegment* oppSeg,
         double coinTs, double coinTe, double oppTs, double oppTe) {
     SkTDArray<SkCoincidentSpans*> overlaps;
-    SkASSERT(fTop);
+    if (!fTop) {
+        return false;
+    }
     if (!this->checkOverlap(fTop, coinSeg, oppSeg, coinTs, coinTe, oppTs, oppTe, &overlaps)) {
         return false;
     }
     if (fHead && !this->checkOverlap(fHead, coinSeg, oppSeg, coinTs,
             coinTe, oppTs, oppTe, &overlaps)) {
         return false;
     }
     SkCoincidentSpans* overlap = overlaps.count() ? overlaps[0] : nullptr;
     for (int index = 1; index < overlaps.count(); ++index) { // combine overlaps before continuing
         SkCoincidentSpans* test = overlaps[index];
@@ skipping 56 matching lines @@
     if (oeExisting && (oeExisting == os || oeExisting->contains(osExisting ? osExisting : os))) {
         return false;
     }
     // extra line in debug code
     this->debugValidate();
     if (!cs || !os) {
         SkOpPtT* csWritable = cs ? const_cast<SkOpPtT*>(cs)
             : coinSeg->addT(coinTs, SkOpSegment::kNoAliasMatch, nullptr);
         SkOpPtT* osWritable = os ? const_cast<SkOpPtT*>(os)
             : oppSeg->addT(oppTs, SkOpSegment::kNoAliasMatch, nullptr);
+        if (!osWritable) {
+            return false;
+        }
         csWritable->span()->addOppAndMerge(osWritable->span());
         cs = csWritable;
         os = osWritable;
         if ((ce && ce->deleted()) || (oe && oe->deleted())) {
             return false;
         }
     }
     if (!ce || !oe) {
         SkOpPtT* ceWritable = ce ? const_cast<SkOpPtT*>(ce)
             : coinSeg->addT(coinTe, SkOpSegment::kNoAliasMatch, nullptr);
@@ skipping 676 matching lines @@
         SkOpSpanBase* oNext = oStart;
         while ((next = next->upCast()->next()) != end) {
             if (!next->upCastable()) {
                 return false;
             }
             if (!next->upCast()->insertCoincidence(oSegment, flipped)) {
                 return false;
             }
         }
         while ((oNext = oNext->upCast()->next()) != oEnd) {
+            if (!oNext->upCastable()) {
+                return false;
+            }
             if (!oNext->upCast()->insertCoincidence(segment, flipped)) {
                 return false;
             }
         }
     } while ((coin = coin->next()));
     return true;
 }
 
 // Please keep in sync with debugMarkCollapsed()
 void SkOpCoincidence::markCollapsed(SkCoincidentSpans* coin, SkOpPtT* test) {
@@ skipping 63 matching lines @@
             this->release(fHead, coin);
         }
     } while ((coin = coin->next()));
 }
 
 bool SkOpCoincidence::testForCoincidence(const SkCoincidentSpans* outer, const SkOpPtT* testS,
         const SkOpPtT* testE) const {
     return testS->segment()->testForCoincidence(testS, testE, testS->span(),
             testE->span(), outer->coinPtTStart()->segment());
 }