RenderLayer::hitTestLayer only handles finding a single hit layer when we're doing 3d depth sorting for transform-style:preserve-3d. If we're using elementsFromPoint and want to return all the elements at the point, we don't handle sorting these by depth. I think we need to collect a list of HitTestResult objects (and HitLayer objects), with the associated depth, and then sort the result by depth at the end and merge into a single HitTestResult object. This list would need to be passed into RenderLayer::hitTestList so that we can append to it from there rather than returning a single result from hitTestList.
<rdar://problem/107861877>
It looks like blink has the same bug here, but Gecko gets it right.
Created attachment 465841 [details] Testcase