diff --git a/third_party/blink/renderer/core/paint/paint_layer.cc b/third_party/blink/renderer/core/paint/paint_layer.cc --- a/third_party/blink/renderer/core/paint/paint_layer.cc +++ b/third_party/blink/renderer/core/paint/paint_layer.cc @@ -1480,10 +1480,18 @@ PaintLayer* PaintLayer::HitTestLayer( recursion_data.location) && GetLayoutBox()->HitTestOverflowControl( result, recursion_data.location, layer_fragments[0].layer_offset)) { - if (z_offset && local_transform_state) { - *z_offset = ComputeZOffset(*local_transform_state); + // The overflow controls participate in the same preserve-3d depth-sort + // as the foreground/background paths below: only update the running-max + // *z_offset and report a hit if we are in front of the previously + // recorded sibling. Otherwise a behind-in-z scroller's resizer can + // clobber the depth-sort and let an occluded later sibling win, + // defeating IntersectionObserver-v2 / PEPC occlusion checks. + if (IsHitCandidateForDepthOrder( + this, false, z_offset, + container_transform_state ? container_transform_state + : local_transform_state)) { + return this; } - return this; } }