fix more fuzz, carsvg

src/pathops/SkOpCoincidence.cpp

 /*
  * Copyright 2015 Google Inc.
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 #include "SkOpCoincidence.h"
 #include "SkOpSegment.h"
 #include "SkPathOpsTSect.h"
 
@@ skipping 463 matching lines @@
                 end = coin->coinPtTEnd()->span();
                 oEnd = coin->oppPtTEnd()->span();
             }
             if (test != end) {
                 FAIL_IF(!test->upCastable());
                 priorT = test->t();
                 test = test->upCast()->next();
             }
             if (oTest != oEnd) {
                 oPriorT = oTest->t();
-                oTest = coin->flipped() ? oTest->prev() : oTest->upCast()->next();
+                if (coin->flipped()) {
+                    oTest = oTest->prev();
+                } else {
+                    FAIL_IF(!oTest->upCastable());
+                    oTest = oTest->upCast()->next();
+                }
                 FAIL_IF(!oTest);
             }
 
         }
     } while ((coin = coin->next()));
     return true;
 }
 
 // given a t span, map the same range on the coincident span
 /*
@@ skipping 362 matching lines @@
             return true;
         }
     }
     const SkOpPtT* s2 = overS->find(seg2);
     const SkOpPtT* e2 = overE->find(seg2);
     FAIL_IF(!e2);
     if (!s2->starter(e2)->span()->upCast()->windValue()) {
         s2 = overS->find(seg2o);
         e2 = overE->find(seg2o);
         FAIL_IF(!s2);
+        FAIL_IF(!e2);
         if (!s2->starter(e2)->span()->upCast()->windValue()) {
             return true;
         }
     }
     if (s1->segment() == s2->segment()) {
         return true;
     }
     if (s1->fT > e1->fT) {
         SkTSwap(s1, e1);
         SkTSwap(s2, e2);
@@ skipping 422 matching lines @@
         const SkOpSegment* oSegment = oStart->segment();
         SkOpSpanBase* next = start;
         SkOpSpanBase* oNext = oStart;
         bool ordered;
         FAIL_IF(!coin->ordered(&ordered));
         while ((next = next->upCast()->next()) != end) {
             FAIL_IF(!next->upCastable());
             SkAssertResult(next->upCast()->insertCoincidence(oSegment, flipped, ordered));
         }
         while ((oNext = oNext->upCast()->next()) != oEnd) {
+            FAIL_IF(!oNext->upCastable());
             FAIL_IF(!oNext->upCast()->insertCoincidence(segment, flipped, ordered));
         }
     } while ((coin = coin->next()));
     return true;
 }
 
 // Please keep in sync with debugMarkCollapsed()
 void SkOpCoincidence::markCollapsed(SkCoincidentSpans* coin, SkOpPtT* test) {
     SkCoincidentSpans* head = coin;
     while (coin) {
@@ skipping 55 matching lines @@
     }
     do {
         if (coin->coinPtTStart()->segment() == deleted
                 || coin->coinPtTEnd()->segment() == deleted
                 || coin->oppPtTStart()->segment() == deleted
                 || coin->oppPtTEnd()->segment() == deleted) {
             this->release(fHead, coin);
         }
     } while ((coin = coin->next()));
 }