fix skia pathops fuzzers

src/pathops/SkOpSpan.cpp

 /*
  * Copyright 2014 Google Inc.
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 #include "SkOpCoincidence.h"
 #include "SkOpContour.h"
 #include "SkOpSegment.h"
 #include "SkPathWriter.h"
@@ skipping 453 matching lines @@
         return true;
     }
     SkOpPtT* next = &fPtT;
     while ((next = next->next()) != &fPtT) {
         if (next->segment() == segment) {
             SkOpSpan* span;
             SkOpSpanBase* base = next->span();
             if (!ordered) {
                 const SkOpSpanBase* spanEnd = fNext->contains(segment)->span();
                 const SkOpPtT* start = base->ptT()->starter(spanEnd->ptT());
+                FAIL_IF(!start->span()->upCastable());
                 span = const_cast<SkOpSpan*>(start->span()->upCast());
             } else if (flipped) {
                 span = base->prev();
                 FAIL_IF(!span);
             } else {
                 FAIL_IF(!base->upCastable());
                 span = base->upCast();
             }
             this->insertCoincidence(span);
             return true;
@@ skipping 43 matching lines @@
 
 void SkOpSpan::setWindSum(int windSum) {
     SkASSERT(!final());
     if (fWindSum != SK_MinS32 && fWindSum != windSum) {
         this->globalState()->setWindingFailed();
         return;
     }
     SkASSERT(!DEBUG_LIMIT_WIND_SUM || SkTAbs(windSum) <= DEBUG_LIMIT_WIND_SUM);
     fWindSum = windSum;
 }