[LayoutNG] Simplified layout needs to account for table-cell intrinsic padding.

Previously we didn't account for intrinsic-padding when determining the
static postiion in the simplified layout algorithm.

When using vertical-align: middle (or something which triggers intrinsic
padding) a OOF-position node might "jump".

This was found with the lastpass password manager.

Bug: 1000864
Change-Id: I94831f735a7e0992130ae065b0f6c9c6abb8c37a
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1785898
Reviewed-by: Christian Biesinger <cbiesinger@chromium.org>
Reviewed-by: Aleks Totic <atotic@chromium.org>
Commit-Queue: Ian Kilpatrick <ikilpatrick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#693446}
diff --git a/css/css-position/position-absolute-dynamic-static-position-table-cell.html b/css/css-position/position-absolute-dynamic-static-position-table-cell.html
new file mode 100644
index 0000000..3a28b20
--- /dev/null
+++ b/css/css-position/position-absolute-dynamic-static-position-table-cell.html
@@ -0,0 +1,32 @@
+<!DOCTYPE html>
+<link rel="match" href="../reference/ref-filled-green-100px-square.xht">
+<link rel="help" href="https://www.w3.org/TR/css-position-3/" />
+<meta name="assert" content="This test checks that a dynamic change in constraints calculates the static position correctly for table-cells."/>
+<style>
+#table-cell {
+  position: relative;
+  display: table-cell;
+  vertical-align: middle;
+
+  width: 100px;
+  height: 100px;
+  background: red;
+}
+
+#target {
+  position: absolute;
+  translate: 0 -50px;
+
+  width: 100px;
+  height: 100px;
+  background: green;
+}
+</style>
+<p>Test passes if there is a filled green square and <strong>no red</strong>.</p>
+<div id="table-cell">
+  <div id="target" style="top: 0;"></div>
+</div>
+<script>
+document.body.offsetTop;
+document.getElementById('target').style.top = 'auto';
+</script>