fix fuzzer bugs

src/pathops/SkOpCoincidence.cpp

 /*
  * Copyright 2015 Google Inc.
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 #include "SkOpCoincidence.h"
 #include "SkOpSegment.h"
 #include "SkPathOpsTSect.h"
 
@@ skipping 154 matching lines @@
             SkASSERT(0);  // may assert if coincident span isn't fully processed
             continue;
         }
         if ((oppLastT > opp->fT) != flipped) {
             return false;
         }
         oppLastT = opp->fT;
         if (next == end) {
             break;
         }
+        if (!next->upCastable()) {
+            return false;
+        }
         next = next->upCast()->next();
     } while (true);
     return true;
 }
 
 // returns true if the point is on a coincident edge, and if it is the start of that edge
 bool SkOpCoincidence::edge(const SkOpPtT* test, bool* start) const {
     SkCoincidentSpans* coinRec = fHead;
     if (!coinRec) {
         return false;
@@ skipping 257 matching lines @@
 bool SkOpCoincidence::addExpanded() {
     SkCoincidentSpans* coin = this->fHead;
     if (!coin) {
         return true;
     }
     do {
         const SkOpPtT* startPtT = coin->coinPtTStart();
         const SkOpPtT* oStartPtT = coin->oppPtTStart();
         double priorT = startPtT->fT;
         double oPriorT = oStartPtT->fT;
-        SkASSERT(startPtT->contains(oStartPtT));
+        FAIL_IF(!startPtT->contains(oStartPtT));
         SkOPASSERT(coin->coinPtTEnd()->contains(coin->oppPtTEnd()));
         const SkOpSpanBase* start = startPtT->span();
         const SkOpSpanBase* oStart = oStartPtT->span();
         const SkOpSpanBase* end = coin->coinPtTEnd()->span();
         const SkOpSpanBase* oEnd = coin->oppPtTEnd()->span();
         FAIL_IF(oEnd->deleted());
         FAIL_IF(!start->upCastable());
         const SkOpSpanBase* test = start->upCast()->next();
         const SkOpSpanBase* oTest = coin->flipped() ? oStart->prev() : oStart->upCast()->next();
         FAIL_IF(!oTest);
@@ skipping 1137 matching lines @@
             this->release(fHead, coin);
         }
     } while ((coin = coin->next()));
 }
 
 bool SkOpCoincidence::testForCoincidence(const SkCoincidentSpans* outer, const SkOpPtT* testS,
         const SkOpPtT* testE) const {
     return testS->segment()->testForCoincidence(testS, testE, testS->span(),
             testE->span(), outer->coinPtTStart()->segment());
 }