fix fuzzer bugs

src/pathops/SkOpCoincidence.cpp

Index: src/pathops/SkOpCoincidence.cpp
diff --git a/src/pathops/SkOpCoincidence.cpp b/src/pathops/SkOpCoincidence.cpp
index 719c9398696b88cf0609991874c68e695df91b3b..446f34cb26abb0fff8991309e5fc2c5e885ec6a7 100755
--- a/src/pathops/SkOpCoincidence.cpp
+++ b/src/pathops/SkOpCoincidence.cpp
@@ -172,6 +172,9 @@ bool SkCoincidentSpans::ordered() const {
         if (next == end) {
             break;
         }
+        if (!next->upCastable()) {
+            return false;
+        }
         next = next->upCast()->next();
     } while (true);
     return true;
@@ -449,7 +452,7 @@ bool SkOpCoincidence::addExpanded() {
         const SkOpPtT* oStartPtT = coin->oppPtTStart();
         double priorT = startPtT->fT;
         double oPriorT = oStartPtT->fT;
-        SkASSERT(startPtT->contains(oStartPtT));
+        FAIL_IF(!startPtT->contains(oStartPtT));
         SkOPASSERT(coin->coinPtTEnd()->contains(coin->oppPtTEnd()));
         const SkOpSpanBase* start = startPtT->span();
         const SkOpSpanBase* oStart = oStartPtT->span();