Bug in IncrementalCopyFastPath about snappy HOT 6 CLOSED

When I say "if check to fail"', I don't mean fail as in a good fail... I mean 
it fails to recognize that len is not > 0, and it causes the code to execute, 
while it should in fact abort.

Can you explain to me how len can go negative? size_t is an unsigned type.

Maybe that's the problem... it goes 'negative', so it actually wraps and causes 
problems.

The previous while loop that decrements len based on src/op doesn't do any 
sanity check to see if you are decrementing past zero, and thus wrapping.

I think you're just misreading the function. len is not of type size_t, it is 
of ssize_t.

Ah, damn - mine is size_t -- not ssize_t.  Copy/Replace issue.

Ignore this.

Thanks!