fix more chrome asan fuzzer failures

src/pathops/SkOpCoincidence.cpp

 /*
  * Copyright 2015 Google Inc.
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 #include "SkOpCoincidence.h"
 #include "SkOpSegment.h"
 #include "SkPathOpsTSect.h"
 
@@ skipping 221 matching lines @@
         }
         return;
     }
     SkASSERT(Ordered(coinPtTStart, oppPtTStart));
     // choose the ptT at the front of the list to track
     coinPtTStart = coinPtTStart->span()->ptT();
     coinPtTEnd = coinPtTEnd->span()->ptT();
     oppPtTStart = oppPtTStart->span()->ptT();
     oppPtTEnd = oppPtTEnd->span()->ptT();
     SkOPASSERT(coinPtTStart->fT < coinPtTEnd->fT);
-    SkASSERT(oppPtTStart->fT != oppPtTEnd->fT);
+    SkOPASSERT(oppPtTStart->fT != oppPtTEnd->fT);
     SkOPASSERT(!coinPtTStart->deleted());
     SkOPASSERT(!coinPtTEnd->deleted());
     SkOPASSERT(!oppPtTStart->deleted());
     SkOPASSERT(!oppPtTEnd->deleted());
     DebugCheckAdd(fHead, coinPtTStart, coinPtTEnd, oppPtTStart, oppPtTEnd);
     DebugCheckAdd(fTop, coinPtTStart, coinPtTEnd, oppPtTStart, oppPtTEnd);
     SkCoincidentSpans* coinRec = SkOpTAllocator<SkCoincidentSpans>::Allocate(
             this->globalState()->allocator());
     coinRec->init(SkDEBUGCODE(fGlobalState));
     coinRec->set(this->fHead, coinPtTStart, coinPtTEnd, oppPtTStart, oppPtTEnd);
@@ skipping 716 matching lines @@
         return true;
     }
     do {
         SkOpSpan* start = coin->coinPtTStartWritable()->span()->upCast();
         if (start->deleted()) {
             continue;
         }
         const SkOpSpanBase* end = coin->coinPtTEnd()->span();
         SkASSERT(start == start->starter(end));
         bool flipped = coin->flipped();
-        SkOpSpan* oStart = (flipped ? coin->oppPtTEndWritable()
-                : coin->oppPtTStartWritable())->span()->upCast();
+        SkOpSpanBase* oStartBase = (flipped ? coin->oppPtTEndWritable()
+                : coin->oppPtTStartWritable())->span();
+        FAIL_IF(!oStartBase->upCastable());
+        SkOpSpan* oStart = oStartBase->upCast();
         if (oStart->deleted()) {
             continue;
         }
         const SkOpSpanBase* oEnd = (flipped ? coin->oppPtTStart() : coin->oppPtTEnd())->span();
         SkASSERT(oStart == oStart->starter(oEnd));
         SkOpSegment* segment = start->segment();
         SkOpSegment* oSegment = oStart->segment();
         bool operandSwap = segment->operand() != oSegment->operand();
         if (flipped) {
             if (oEnd->deleted()) {
@@ skipping 77 matching lines @@
                 segment->markDone(start);
             }
             if (!oWindValue && !oOppValue) {
                 oSegment->markDone(oStart);
             }
             SkOpSpanBase* next = start->next();
             SkOpSpanBase* oNext = flipped ? oStart->prev() : oStart->next();
             if (next == end) {
                 break;
             }
+            FAIL_IF(!next->upCastable());
             start = next->upCast();
             // if the opposite ran out too soon, just reuse the last span
             if (!oNext || !oNext->upCastable()) {
                oNext = oStart;
             }
             oStart = oNext->upCast();
         } while (true);
     } while ((coin = coin->next()));
     return true;
 }
@@ skipping 211 matching lines @@
         const SkOpSegment* oSegment = oStart->segment();
         SkOpSpanBase* next = start;
         SkOpSpanBase* oNext = oStart;
         bool ordered;
         FAIL_IF(!coin->ordered(&ordered));
         while ((next = next->upCast()->next()) != end) {
             FAIL_IF(!next->upCastable());
             SkAssertResult(next->upCast()->insertCoincidence(oSegment, flipped, ordered));
         }
         while ((oNext = oNext->upCast()->next()) != oEnd) {
+            FAIL_IF(!oNext->upCastable());
             FAIL_IF(!oNext->upCast()->insertCoincidence(segment, flipped, ordered));
         }
     } while ((coin = coin->next()));
     return true;
 }
 
 // Please keep in sync with debugMarkCollapsed()
 void SkOpCoincidence::markCollapsed(SkCoincidentSpans* coin, SkOpPtT* test) {
     SkCoincidentSpans* head = coin;
     while (coin) {
@@ skipping 55 matching lines @@
     }
     do {
         if (coin->coinPtTStart()->segment() == deleted
                 || coin->coinPtTEnd()->segment() == deleted
                 || coin->oppPtTStart()->segment() == deleted
                 || coin->oppPtTEnd()->segment() == deleted) {
             this->release(fHead, coin);
         }
     } while ((coin = coin->next()));
 }