fix more fuzz, carsvg

src/pathops/SkOpCoincidence.cpp

Index: src/pathops/SkOpCoincidence.cpp
diff --git a/src/pathops/SkOpCoincidence.cpp b/src/pathops/SkOpCoincidence.cpp
index d16f6f86421883789b0a2395f986794bb9548623..f87931830f8531495c5002f8c86daf4de900da97 100755
--- a/src/pathops/SkOpCoincidence.cpp
+++ b/src/pathops/SkOpCoincidence.cpp
@@ -481,7 +481,12 @@ bool SkOpCoincidence::addExpanded(DEBUG_COIN_DECLARE_ONLY_PARAMS()) {
             }
             if (oTest != oEnd) {
                 oPriorT = oTest->t();
-                oTest = coin->flipped() ? oTest->prev() : oTest->upCast()->next();
+                if (coin->flipped()) {
+                    oTest = oTest->prev();
+                } else {
+                    FAIL_IF(!oTest->upCastable());
+                    oTest = oTest->upCast()->next();
+                }
                 FAIL_IF(!oTest);
             }
 
@@ -864,6 +869,7 @@ bool SkOpCoincidence::addOverlap(const SkOpSegment* seg1, const SkOpSegment* seg
         s2 = overS->find(seg2o);
         e2 = overE->find(seg2o);
         FAIL_IF(!s2);
+        FAIL_IF(!e2);
         if (!s2->starter(e2)->span()->upCast()->windValue()) {
             return true;
         }
@@ -1306,6 +1312,7 @@ bool SkOpCoincidence::mark(DEBUG_COIN_DECLARE_ONLY_PARAMS()) {
             SkAssertResult(next->upCast()->insertCoincidence(oSegment, flipped, ordered));
         }
         while ((oNext = oNext->upCast()->next()) != oEnd) {
+            FAIL_IF(!oNext->upCastable());
             FAIL_IF(!oNext->upCast()->insertCoincidence(segment, flipped, ordered));
         }
     } while ((coin = coin->next()));