V2: Require render stability to count as 'visible'

[jakearchibald]

Currently isVisible === true means the element's rendering wasn't altered to a degree where the meaning of the button was altered/confused. This includes changes to the element & ancestors, and anything that is on top of & visually intersects with the button.

However, other forms of motion can confuse the intent of an element. Movement could make it hard to read, or make clicks unintentional.

Here's an extreme demo: https://static-misc.glitch.me/tap-test/

Once clickjacking is enabled, the "pay now" button is moved on top of the "safe" button in terms of layout only. When it comes to painting, it's moved back into its original spot. IOv2 doesn't catch this, because the "pay" button is always unobscured in the viewport.

I'm not sure what the ideal solution is, but the position of the element should be considered 'stable' before it should be considered 'isVisible'.

[szager-chromium]

Chromium is now shipping a browser intervention that suppresses input events to cross-origin iframes that have moved recently and are using IntersectionObserver V2:

https://groups.google.com/a/chromium.org/d/msg/blink-dev/MzXscv7fT0w/ygq7qc6sBQAJ