IntersectionObserver: use border bounding box for target rect.

third_party/WebKit/Source/core/dom/IntersectionObservation.cpp

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/dom/IntersectionObservation.h"
 
 #include "core/dom/ElementRareData.h"
 #include "core/dom/IntersectionObserver.h"
 #include "core/frame/FrameView.h"
 #include "core/frame/LocalFrame.h"
@@ skipping 23 matching lines @@
     geometry.intersectionRect = geometry.targetRect;
     initializeRootRect(geometry.rootRect);
     geometry.doesIntersect = true;
 }
 
 void IntersectionObservation::initializeTargetRect(LayoutRect& rect) const
 {
     DCHECK(m_target);
     LayoutObject* targetLayoutObject = target()->layoutObject();
     DCHECK(targetLayoutObject && targetLayoutObject->isBoxModelObject());
-    rect = toLayoutBoxModelObject(targetLayoutObject)->visualOverflowRect();
+    rect = LayoutRect(toLayoutBoxModelObject(targetLayoutObject)->borderBoundingBox());
 }
 
 void IntersectionObservation::initializeRootRect(LayoutRect& rect) const
 {
     LayoutObject* rootLayoutObject = m_observer->rootLayoutObject();
     if (rootLayoutObject->isLayoutView())
         rect = LayoutRect(toLayoutView(rootLayoutObject)->frameView()->visibleContentRect());
     else if (rootLayoutObject->isBox() && rootLayoutObject->hasOverflowClip())
         rect = LayoutRect(toLayoutBox(rootLayoutObject)->contentBoxRect());
     else
@@ skipping 188 matching lines @@
     m_observer.clear();
 }
 
 DEFINE_TRACE(IntersectionObservation)
 {
     visitor->trace(m_observer);
     visitor->trace(m_target);
 }
 
 } // namespace blink