Please see https://skia-review.googlesource.com/c/7945/ for the unit test to reproduce this problem. This problem is more related to quad/conic than AA as the unit test is in non-AA mode.

I've heard conflicting opinions about how the team should handle integer-overflow.
 
I have no interest in working on this.

            do {
                int L = SkFixedRoundToInt(left);
                int R = SkFixedRoundToInt(rite);
                if (L < R) {
                    blitter->blitH(L, local_top, R - L);
                }
                left += dLeft;
                rite += dRite;
                local_top += 1;
            } while (--count >= 0);

I posit that count might be zero when this overflow happens...

Correct, if I remember correctly, count == 0 and fCurveCount ==  7.

Detailed report: https://clusterfuzz.com/testcase?key=6016465059971072

Job Type: linux_ubsan_chrome
Crash Type: Integer-overflow
Crash Address: 
Crash State:
  walk_convex_edges
  sk_fill_path
  SkScan::FillPath
  
Sanitizer: undefined (UBSAN)

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6016465059971072


See https://github.com/google/clusterfuzz-tools for more information.

Detailed report: https://clusterfuzz.com/testcase?key=6016465059971072

Job Type: linux_ubsan_chrome
Crash Type: Integer-overflow
Crash Address: 
Crash State:
  walk_convex_edges
  sk_fill_path
  SkScan::FillPath
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=398502:398570

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6016465059971072


See https://github.com/google/clusterfuzz-tools for more information.

ClusterFuzz testcase 6016465059971072 is flaky and no longer crashes, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.