| Index: third_party/WebKit/Source/core/dom/IntersectionObservation.cpp | 
| diff --git a/third_party/WebKit/Source/core/dom/IntersectionObservation.cpp b/third_party/WebKit/Source/core/dom/IntersectionObservation.cpp | 
| index 39821a7a7755560f04cd10ee74856060e19bfca9..ea0cd1fdb901526599b6079bffe44a3c156f5c7a 100644 | 
| --- a/third_party/WebKit/Source/core/dom/IntersectionObservation.cpp | 
| +++ b/third_party/WebKit/Source/core/dom/IntersectionObservation.cpp | 
| @@ -61,14 +61,17 @@ void IntersectionObservation::clipToRoot(IntersectionGeometry& geometry) const | 
| // Map and clip rect into root element coordinates. | 
| // TODO(szager): the writing mode flipping needs a test. | 
| DCHECK(m_target); | 
| -    LayoutObject* rootLayoutObject = m_observer->rootLayoutObject(); | 
| +    LayoutBox* rootLayoutObject = toLayoutBox(m_observer->rootLayoutObject()); | 
| LayoutObject* targetLayoutObject = target()->layoutObject(); | 
|  | 
| -    geometry.doesIntersect = targetLayoutObject->mapToVisualRectInAncestorSpace(toLayoutBoxModelObject(rootLayoutObject), geometry.intersectionRect, EdgeInclusive); | 
| +    geometry.doesIntersect = targetLayoutObject->mapToVisualRectInAncestorSpace(rootLayoutObject, geometry.intersectionRect, EdgeInclusive); | 
| +    if (rootLayoutObject->hasOverflowClip()) | 
| +        geometry.intersectionRect.move(-rootLayoutObject->scrolledContentOffset()); | 
| + | 
| if (!geometry.doesIntersect) | 
| return; | 
| LayoutRect rootClipRect(geometry.rootRect); | 
| -    toLayoutBox(rootLayoutObject)->flipForWritingMode(rootClipRect); | 
| +    rootLayoutObject->flipForWritingMode(rootClipRect); | 
| geometry.doesIntersect &= geometry.intersectionRect.inclusiveIntersect(rootClipRect); | 
| } | 
|  | 
|  |