Found while fuzzing m-c 20230503-f802f88c1fc7 (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

Assertion failure: inverted (Attempted to get the inverse of a non-invertible matrix), at /builds/worker/workspace/obj-build/dist/include/mozilla/gfx/Matrix.h:277

#0 0x7f15a85bc9ab in Inverse /builds/worker/workspace/obj-build/dist/include/mozilla/gfx/Matrix.h:276:5
#1 0x7f15a85bc9ab in gfxContext::DeviceToUser(mozilla::gfx::PointTyped<mozilla::gfx::UnknownUnits, double> const&) const /builds/worker/workspace/obj-build/dist/include/gfxContext.h:242:31
#2 0x7f15a85bc8be in nsLayoutUtils::GetSnappedBaselineY(nsIFrame*, gfxContext*, int, int) /builds/worker/checkouts/gecko/layout/base/nsLayoutUtils.cpp:5510:20
#3 0x7f15a877f680 in nsTextFrame::PaintText(nsTextFrame::PaintTextParams const&, int, int, nsPoint const&, bool, float) /builds/worker/checkouts/gecko/layout/generic/nsTextFrame.cpp:6435:20
#4 0x7f15a884c6fc in mozilla::SVGTextFrame::PaintSVG(gfxContext&, mozilla::gfx::BaseMatrix<double> const&, mozilla::image::imgDrawingParams&) /builds/worker/checkouts/gecko/layout/svg/SVGTextFrame.cpp
#5 0x7f15a8813ec5 in mozilla::DisplaySVGItem::Paint(mozilla::nsDisplayListBuilder*, gfxContext*) /builds/worker/checkouts/gecko/layout/svg/DisplaySVGItem.cpp:55:13
#6 0x7f15a43420b5 in mozilla::layers::DIGroup::PaintItemRange(mozilla::layers::Grouper*, mozilla::LinkedListIterator<mozilla::nsDisplayItem*>, mozilla::LinkedListIterator<mozilla::nsDisplayItem*>, gfxContext*, mozilla::layers::WebRenderDrawEventRecorder*, mozilla::layers::RenderRootStateManager*, mozilla::wr::IpcResourceUpdateQueue&) /builds/worker/checkouts/gecko/gfx/layers/wr/WebRenderCommandBuilder.cpp:867:22
#7 0x7f15a43aaa4a in operator() /builds/worker/checkouts/gecko/gfx/layers/wr/WebRenderCommandBuilder.cpp:1023:23
#8 0x7f15a43aaa4a in std::_Function_handler<void (), mozilla::layers::Grouper::PaintContainerItem(mozilla::layers::DIGroup*, mozilla::nsDisplayItem*, mozilla::layers::BlobItemData*, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&, bool, mozilla::nsDisplayList*, gfxContext*, mozilla::layers::WebRenderDrawEventRecorder*, mozilla::layers::RenderRootStateManager*, mozilla::wr::IpcResourceUpdateQueue&)::$_0>::_M_invoke(std::_Any_data const&) /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/7/../../../../include/c++/7/bits/std_function.h:316:2
#9 0x7f15a88346fc in operator() /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/7/../../../../include/c++/7/bits/std_function.h:706:14
#10 0x7f15a88346fc in void mozilla::PaintMaskAndClipPathInternal<std::function<void ()>>(mozilla::SVGIntegrationUtils::PaintFramesParams const&, std::function<void ()> const&) /builds/worker/checkouts/gecko/layout/svg/SVGIntegrationUtils.cpp:892:3
#11 0x7f15a893e314 in mozilla::nsDisplayMasksAndClipPaths::PaintWithContentsPaintCallback(mozilla::nsDisplayListBuilder*, gfxContext*, std::function<void ()> const&) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:8041:3
#12 0x7f15a4340dbd in mozilla::layers::Grouper::PaintContainerItem(mozilla::layers::DIGroup*, mozilla::nsDisplayItem*, mozilla::layers::BlobItemData*, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&, bool, mozilla::nsDisplayList*, gfxContext*, mozilla::layers::WebRenderDrawEventRecorder*, mozilla::layers::RenderRootStateManager*, mozilla::wr::IpcResourceUpdateQueue&) /builds/worker/checkouts/gecko/gfx/layers/wr/WebRenderCommandBuilder.cpp:1018:19
#13 0x7f15a4341e50 in mozilla::layers::DIGroup::PaintItemRange(mozilla::layers::Grouper*, mozilla::LinkedListIterator<mozilla::nsDisplayItem*>, mozilla::LinkedListIterator<mozilla::nsDisplayItem*>, gfxContext*, mozilla::layers::WebRenderDrawEventRecorder*, mozilla::layers::RenderRootStateManager*, mozilla::wr::IpcResourceUpdateQueue&) /builds/worker/checkouts/gecko/gfx/layers/wr/WebRenderCommandBuilder.cpp:840:19
#14 0x7f15a434109c in mozilla::layers::Grouper::PaintContainerItem(mozilla::layers::DIGroup*, mozilla::nsDisplayItem*, mozilla::layers::BlobItemData*, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&, bool, mozilla::nsDisplayList*, gfxContext*, mozilla::layers::WebRenderDrawEventRecorder*, mozilla::layers::RenderRootStateManager*, mozilla::wr::IpcResourceUpdateQueue&) /builds/worker/checkouts/gecko/gfx/layers/wr/WebRenderCommandBuilder.cpp:952:17
#15 0x7f15a4341e50 in mozilla::layers::DIGroup::PaintItemRange(mozilla::layers::Grouper*, mozilla::LinkedListIterator<mozilla::nsDisplayItem*>, mozilla::LinkedListIterator<mozilla::nsDisplayItem*>, gfxContext*, mozilla::layers::WebRenderDrawEventRecorder*, mozilla::layers::RenderRootStateManager*, mozilla::wr::IpcResourceUpdateQueue&) /builds/worker/checkouts/gecko/gfx/layers/wr/WebRenderCommandBuilder.cpp:840:19
#16 0x7f15a4344a41 in mozilla::layers::DIGroup::EndGroup(mozilla::layers::WebRenderLayerManager*, mozilla::nsDisplayListBuilder*, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::Grouper*, mozilla::LinkedListIterator<mozilla::nsDisplayItem*>, mozilla::LinkedListIterator<mozilla::nsDisplayItem*>) /builds/worker/checkouts/gecko/gfx/layers/wr/WebRenderCommandBuilder.cpp:680:5
#17 0x7f15a434335b in mozilla::layers::Grouper::ConstructGroups(mozilla::nsDisplayListBuilder*, mozilla::layers::WebRenderCommandBuilder*, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::DIGroup*, mozilla::nsDisplayList*, mozilla::nsDisplayItem*, mozilla::layers::StackingContextHelper const&) /builds/worker/checkouts/gecko/gfx/layers/wr/WebRenderCommandBuilder.cpp:1449:17
#18 0x7f15a4349340 in mozilla::layers::WebRenderCommandBuilder::DoGroupingForDisplayList(mozilla::nsDisplayList*, mozilla::nsDisplayItem*, mozilla::nsDisplayListBuilder*, mozilla::layers::StackingContextHelper const&, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&) /builds/worker/checkouts/gecko/gfx/layers/wr/WebRenderCommandBuilder.cpp:1714:5
#19 0x7f15a8940dce in CreateWebRenderCommandsNewClipListOption /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:4673:30
#20 0x7f15a8940dce in mozilla::nsDisplaySVGWrapper::CreateWebRenderCommands(mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::layers::RenderRootStateManager*, mozilla::nsDisplayListBuilder*) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:8531:10
#21 0x7f15a434d0b6 in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommands(mozilla::nsDisplayItem*, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::nsDisplayListBuilder*) /builds/worker/checkouts/gecko/gfx/layers/wr/WebRenderCommandBuilder.cpp:1859:41
#22 0x7f15a434bb28 in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommandsFromDisplayList(mozilla::nsDisplayList*, mozilla::nsDisplayItem*, mozilla::nsDisplayListBuilder*, mozilla::layers::StackingContextHelper const&, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, bool) /builds/worker/checkouts/gecko/gfx/layers/wr/WebRenderCommandBuilder.cpp:2125:7
#23 0x7f15a8936571 in mozilla::nsDisplayTransform::CreateWebRenderCommands(mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::layers::RenderRootStateManager*, mozilla::nsDisplayListBuilder*) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:6741:30
#24 0x7f15a434d0b6 in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommands(mozilla::nsDisplayItem*, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::nsDisplayListBuilder*) /builds/worker/checkouts/gecko/gfx/layers/wr/WebRenderCommandBuilder.cpp:1859:41
#25 0x7f15a434bb28 in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommandsFromDisplayList(mozilla::nsDisplayList*, mozilla::nsDisplayItem*, mozilla::nsDisplayListBuilder*, mozilla::layers::StackingContextHelper const&, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, bool) /builds/worker/checkouts/gecko/gfx/layers/wr/WebRenderCommandBuilder.cpp:2125:7
#26 0x7f15a892f1bb in CreateWebRenderCommandsNewClipListOption /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:4673:30
#27 0x7f15a892f1bb in CreateWebRenderCommands /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.h:4988:12
#28 0x7f15a892f1bb in mozilla::nsDisplayOwnLayer::CreateWebRenderCommands(mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::layers::RenderRootStateManager*, mozilla::nsDisplayListBuilder*) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:5312:22
#29 0x7f15a434d0b6 in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommands(mozilla::nsDisplayItem*, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::nsDisplayListBuilder*) /builds/worker/checkouts/gecko/gfx/layers/wr/WebRenderCommandBuilder.cpp:1859:41
#30 0x7f15a434bb28 in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommandsFromDisplayList(mozilla::nsDisplayList*, mozilla::nsDisplayItem*, mozilla::nsDisplayListBuilder*, mozilla::layers::StackingContextHelper const&, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, bool) /builds/worker/checkouts/gecko/gfx/layers/wr/WebRenderCommandBuilder.cpp:2125:7
#31 0x7f15a434a1f3 in mozilla::layers::WebRenderCommandBuilder::BuildWebRenderCommands(mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::nsDisplayList*, mozilla::nsDisplayListBuilder*, mozilla::layers::WebRenderScrollData&, WrFiltersHolder&&) /builds/worker/checkouts/gecko/gfx/layers/wr/WebRenderCommandBuilder.cpp:1780:5
#32 0x7f15a435f32c in mozilla::layers::WebRenderLayerManager::EndTransactionWithoutLayer(mozilla::nsDisplayList*, mozilla::nsDisplayListBuilder*, WrFiltersHolder&&, mozilla::layers::WebRenderBackgroundData*, double) /builds/worker/checkouts/gecko/gfx/layers/wr/WebRenderLayerManager.cpp:363:30
#33 0x7f15a891e598 in mozilla::nsDisplayList::PaintRoot(mozilla::nsDisplayListBuilder*, gfxContext*, unsigned int, mozilla::Maybe<double>) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:2342:18
#34 0x7f15a85b50b9 in nsLayoutUtils::PaintFrame(gfxContext*, nsIFrame*, nsRegion const&, unsigned int, mozilla::nsDisplayListBuilderMode, nsLayoutUtils::PaintFrameFlags) /builds/worker/checkouts/gecko/layout/base/nsLayoutUtils.cpp:3428:9
#35 0x7f15a8527023 in mozilla::PresShell::PaintInternal(nsView*, mozilla::PaintInternalFlags) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:6438:5
#36 0x7f15a80ffae6 in nsViewManager::ProcessPendingUpdatesPaint(nsIWidget*) /builds/worker/checkouts/gecko/view/nsViewManager.cpp:433:18
#37 0x7f15a80ff5cf in nsViewManager::ProcessPendingUpdatesForView(nsView*, bool) /builds/worker/checkouts/gecko/view/nsViewManager.cpp:368:22
#38 0x7f15a8100a6c in nsViewManager::ProcessPendingUpdates() /builds/worker/checkouts/gecko/view/nsViewManager.cpp:941:5
#39 0x7f15a84e02b6 in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2760:11
#40 0x7f15a84e8e6d in TickDriver /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:373:13
#41 0x7f15a84e8e6d in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver>>&) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:351:7
#42 0x7f15a84e8d70 in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:367:5
#43 0x7f15a84e8c4d in mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:911:5
#44 0x7f15a84e8006 in mozilla::VsyncRefreshDriverTimer::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:825:5
#45 0x7f15a84e72c9 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsyncTimerOnMainThread() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:592:14
#46 0x7f15a78f879b in mozilla::dom::VsyncMainChild::RecvNotify(mozilla::VsyncEvent const&, float const&) /builds/worker/checkouts/gecko/dom/ipc/VsyncMainChild.cpp:66:15
#47 0x7f15a7bba4fe in mozilla::dom::PVsyncChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PVsyncChild.cpp:220:78
#48 0x7f15a7ab1e50 in mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PContentChild.cpp:8772:32
#49 0x7f15a3b08c3f in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1800:25
#50 0x7f15a3b058f2 in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message>>) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1725:9
#51 0x7f15a3b06424 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1525:3
#52 0x7f15a3b0774f in mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1623:14
#53 0x7f15a2eaef27 in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:555:16
#54 0x7f15a2eaa12a in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:879:26
#55 0x7f15a2ea8c07 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:702:15
#56 0x7f15a2ea8f85 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:491:36
#57 0x7f15a2eb2549 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:221:37
#58 0x7f15a2eb2549 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_1>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:548:5
#59 0x7f15a2ec891a in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1239:16
#60 0x7f15a2ecef3d in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:479:10
#61 0x7f15a3b0eb93 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:107:5
#62 0x7f15a3a30781 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:362:3
#63 0x7f15a3a30781 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:344:3
#64 0x7f15a8166558 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:148:27
#65 0x7f15aa3f4ddb in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:738:20
#66 0x7f15a3b0fa96 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:235:9
#67 0x7f15a3a30781 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:362:3
#68 0x7f15a3a30781 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:344:3
#69 0x7f15aa3f46a2 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:673:34
#70 0x559ef3d7d396 in content_process_main /builds/worker/checkouts/gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
#71 0x559ef3d7d396 in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:375:18
#72 0x7f15b6629d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#73 0x7f15b6629e3f in __libc_start_main csu/../csu/libc-start.c:392:3
#74 0x559ef3d54618 in _start (/home/user/workspace/browsers/m-c-20230503140026-fuzzing-debug/firefox-bin+0x58618) (BuildId: 9235c1a58ef5d8a102bfe1a8e9f0674c9b8b1f36)

Verified bug as reproducible on mozilla-central 20230504215417-f4a38c1b661a.
Unable to bisect testcase (Testcase reproduces on start build!):

Start: fe0b18ac5fe152cad89a780b5e48c2b325fea839 (20220506095052)
End: f802f88c1fc73705fcb0ddf7edca5b34de2a4fca (20230503090148)
BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=True, coverage=False, valgrind=False, no_opt=False, fuzzilli=False, nyx=False)

matrix(0,0,4,1,0,0) == {(0, 4, 0), (0, 1, 0), (0, 0, 1)} (row-major) is legal but indeed non-invertible (major diagonal contains zero).
Changing it to matrix(1,0,0,1,0,0) and going towards matrix(.5,0,0,1,0,0), then matrix(.1,0,0,1,0,0), the width of the text approaches zero, so perhaps we can short-circuit and avoid trying to find baseline to something that doesn't have a valid size.

https://treeherder.mozilla.org/jobs?repo=try&revision=2da4100d88dc8be20da10273528bbae6b3029d1b

https://hg.mozilla.org/mozilla-central/rev/adb1f71a18f9

Verified bug as fixed on rev mozilla-central 20230513092159-d36ba840f6ab.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.