Fix debug assertion being triggered because we may access dirty normalFlowList.
https://bugs.webkit.org/show_bug.cgi?id=109740

A debug assertion in RenderLayer.h is being hit when trying to
access the normalFlowList when it is dirty.  This is caused by a
new recursion that I added in RenderLayerBacking::hasVisibleNonCompositingDescendant(),
but I overlooked the need to call updateLayerListsIfNeeded()
recursively as well.

Reviewed by Simon Fraser.

No test, because there's no reliable way to test this (same as bug 85512).

* rendering/RenderLayerBacking.cpp:
(WebCore::hasVisibleNonCompositingDescendant):
(WebCore::RenderLayerBacking::hasVisibleNonCompositingDescendantLayers):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142815 268f45cc-cd09-0410-ab3c-d52691b4dbfc
ASSERTION FAILED: !object || object->isBox(), Bad cast in RenderBox::computeLogicalHeight
https://bugs.webkit.org/show_bug.cgi?id=107748

Reviewed by Levi Weintraub.

Source/WebCore:

Make sure that body renderer is not an inline-block display
when determining that it stretches to viewport or when paginated
content needs base height.

Test: fast/block/body-inline-block-crash.html

* rendering/RenderBox.cpp:
(WebCore::RenderBox::computeLogicalHeight):
* rendering/RenderBox.h:
(WebCore::RenderBox::stretchesToViewport):

LayoutTests:

* fast/block/body-inline-block-crash-expected.txt: Added.
* fast/block/body-inline-block-crash.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142816 268f45cc-cd09-0410-ab3c-d52691b4dbfc