The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/b82224bccdc9543cc7bface3b14c21945ddc6810

commit b82224bccdc9543cc7bface3b14c21945ddc6810
Author: Koji Ishii <kojii@chromium.org>
Date: Fri Aug 31 16:03:17 2018

[LayoutNG] Fix when 'vertical-align: top' is nested

The 'vertical-align: top' and 'bottom' require the size of
the ancestor line box and thus are put into pending queue
while applying the baseline shift.

When they are nested, processing all pending queue at the
root line box applies the shift multiple times. This patch
puts into the queue of the nearest ancestor that has 'top'
or 'bottom' if exists.

Bug:  877977 
Cq-Include-Trybots: luci.chromium.try:linux_layout_tests_layout_ng
Change-Id: I6541d138267a6e42658b601901b673352e625440
Reviewed-on: https://chromium-review.googlesource.com/1198887
Commit-Queue: Koji Ishii <kojii@chromium.org>
Reviewed-by: Emil A Eklund <eae@chromium.org>
Cr-Commit-Position: refs/heads/master@{#588042}
[add] https://crrev.com/b82224bccdc9543cc7bface3b14c21945ddc6810/third_party/WebKit/LayoutTests/external/wpt/css/CSS2/linebox/vertical-align-nested-top-001-ref.html
[add] https://crrev.com/b82224bccdc9543cc7bface3b14c21945ddc6810/third_party/WebKit/LayoutTests/external/wpt/css/CSS2/linebox/vertical-align-nested-top-001.html
[modify] https://crrev.com/b82224bccdc9543cc7bface3b14c21945ddc6810/third_party/blink/renderer/core/layout/ng/inline/ng_inline_box_state.cc