It looks like we always clip replaced elements to the content box rect, even if `overflow: visible` is specified. RenderViewTransitionCapture is the exception, which has the reverse issue, and never clips overflow when using the layer attachment rendering path `RenderLayerCompositor::collectViewTransitionNewContentLayers`.
<rdar://problem/127218689>