The ASSERT()s in https://bugs.webkit.org/show_bug.cgi?id=49019 trigger on fast/flexbox/021.html. With this render tree: RenderView 0x3dfa858 #document 0x3e03220 RenderBlock 0x3e003f8 HTML 0x3e421b0 RenderBody 0x3e3d578 BODY 0x3e42240 RenderBlock 0x3cc9948 P 0x3e3d6b0 RenderText 0x3e3e3c8 #text 0x3e3e340 "You should see a 100x100 green square below. If you see any red, the test has failed. This test is checking\nfor visibility:collapse support." RenderFlexibleBox 0x3e3e5f8 DIV 0x3e3e4b0 * RenderFlexibleBox 0x3e3ead8 DIV 0x3e3e840 CLASS=first RenderFlexibleBox 0x3e3eff8 DIV 0x3e3ece0 CLASS=second RenderFlexibleBox::layoutBlock() on the 0x3e3e5f8 box calls setNeedsLayout(false) on itself while its first child 0x3e3ead8 still has m_needsLayout set to true.
This doesn't reproduce anymore. I don't know Flexbox enough to pinpoint when it was solved though. Maybe Ojan or Tony know more.
This is for old flexbox. Not sure off the top of my head. Looking through the commit history maybe https://bugs.webkit.org/show_bug.cgi?id=64842 or https://bugs.webkit.org/show_bug.cgi?id=63776 , but it doesn't seem that important.