A debug assertion in RenderLayer.h is being hit when trying to access the normalFlowList when it is dirty. Most likely this is caused by a new recursion that I added in , but I overlooked the need to call updateLayerListsIfNeeded() recursively as well. Patch coming in a moment. I'll ask for review later, after having a chance to verify that it stops triggering the assertion.
Created attachment 188166 [details] Patch
I see an assertion about dirty z-order lists in a hit testing code path when bringing up the inspector too. Probably unrelated, but would be nice to fix.
Comment on attachment 188166 [details] Patch Didn't reproduce any debug assertion on chromium's inspector. I'm building debug webkit now to try there - is there something specific that has to be done to reproduce the assertion?
Comment on attachment 188166 [details] Patch Clearing flags on attachment: 188166 Committed r142815: <http://trac.webkit.org/changeset/142815>
All reviewed patches have been landed. Closing bug.