fix fuzzer

Previous spans always have a valid next pointer. The final span does not.
Change the test for a valid link to take into consideration whether
the links are chased forwards or backwards.

TBR=reed@google.com
BUG=629454
GOLD_TRYBOT_URL= https://gold.skia.org/search?issue=2166543002

Review-Url: https://codereview.chromium.org/2166543002

1 files changed, 12 insertions, 3 deletions

diff --git a/src/pathops/SkOpSpan.cpp b/src/pathops/SkOpSpan.cpp
index 577a9db326..1cdfe91a24 100755
--- a/src/pathops/SkOpSpan.cpp
+++ b/src/pathops/SkOpSpan.cpp
@@ -387,9 +387,18 @@ bool SkOpSpan::insertCoincidence(const SkOpSegment* segment, bool flipped) {
     SkOpPtT* next = &fPtT;
     while ((next = next->next()) != &fPtT) {
         if (next->segment() == segment) {
-            SkOpSpan* span = flipped ? next->span()->prev() : next->span()->upCast();
-            if (!span) {
-                return false;
+            SkOpSpan* span;
+            if (flipped) {
+                span = next->span()->prev();
+                if (!span) {
+                    return false;
+                }
+            } else {
+                SkOpSpanBase* base = next->span();
+                if (!base->upCastable()) {
+                    return false;
+                }
+                span = base->upCast();
             }
             this->insertCoincidence(span);
             return true;