Fix for out-of-bounds intersection (found by fuzzer).

src/gpu/GrTessellatingPathRenderer.cpp

 /*
  * Copyright 2015 Google Inc.
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 #include "GrTessellatingPathRenderer.h"
 
 #include "GrDefaultGeoProcFactory.h"
@@ skipping 940 matching lines @@
                    !edge->isLeftOf(rightBottom)) {
             split_edge(edge, rightBottom, activeEdges, alloc);
         }
     }
 }
 
 void split_edge(Edge* edge, Vertex* v, Edge** activeEdges, SkChunkAlloc& alloc) {
     LOG("splitting edge (%g -> %g) at vertex %g (%g, %g)\n",
         edge->fTop->fID, edge->fBottom->fID,
         v->fID, v->fPoint.fX, v->fPoint.fY);
-    Edge* newEdge = ALLOC_NEW(Edge, (v, edge->fBottom, edge->fWinding), alloc);
-    insert_edge_below(newEdge, v);
-    insert_edge_above(newEdge, edge->fBottom);
-    set_bottom(edge, v, activeEdges);
-    cleanup_active_edges(edge, activeEdges, alloc);
-    fix_active_state(newEdge, activeEdges);
-    merge_collinear_edges(newEdge, activeEdges);
+    if (sweep_lt(v->fPoint, edge->fTop->fPoint)) {
+        set_top(edge, v, activeEdges);
+    } else if (sweep_gt(v->fPoint, edge->fBottom->fPoint)) {
+        set_bottom(edge, v, activeEdges);
+    } else {
+        Edge* newEdge = ALLOC_NEW(Edge, (v, edge->fBottom, edge->fWinding), alloc);
+        insert_edge_below(newEdge, v);
+        insert_edge_above(newEdge, edge->fBottom);
+        set_bottom(edge, v, activeEdges);
+        cleanup_active_edges(edge, activeEdges, alloc);
+        fix_active_state(newEdge, activeEdges);
+        merge_collinear_edges(newEdge, activeEdges);
+    }
 }
 
 void merge_vertices(Vertex* src, Vertex* dst, Vertex** head, SkChunkAlloc& alloc) {
     LOG("found coincident verts at %g, %g; merging %g into %g\n", src->fPoint.fX, src->fPoint.fY,
         src->fID, dst->fID);
     for (Edge* edge = src->fFirstEdgeAbove; edge;) {
         Edge* next = edge->fNextEdgeAbove;
         set_bottom(edge, dst, NULL);
         edge = next;
     }
@@ skipping 521 matching lines @@
     int actualCount = static_cast<int>((static_cast<char*>(end) - static_cast<char*>(arg.vertices())) / stride);
     LOG("actual count: %d\n", actualCount);
     SkASSERT(actualCount <= count);
 
     GrPrimitiveType primitiveType = WIREFRAME ? kLines_GrPrimitiveType
                                               : kTriangles_GrPrimitiveType;
     target->drawNonIndexed(pipelineBuilder, gp, primitiveType, 0, actualCount);
 
     return true;
 }