[cascade] Reset generation bits

There was a bug in CascadePriority, when creating priorities with a
'generation'. This constructor was supposed to _set_ the generation,
not bitwise-or with the previous generation.

Bug: 947004
Change-Id: Ie3471f6a3052c0f3ca8454151a8f46839558d5a2
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2106064Reviewed-by: Rune Lillesveen <futhark@chromium.org>
Commit-Queue: Anders Hartvoll Ruud <andruud@chromium.org>
Cr-Commit-Position: refs/heads/master@{#750949}

third_party/blink/renderer/core/css/resolver/cascade_priority.h

@@ -70,8 +70,8 @@ class CORE_EXPORT CascadePriority {
                   << kOriginImportanceOffset) {}
   // See StyleCascade.generation_.
   CascadePriority(CascadePriority o, uint8_t generation)
-      : bits_(o.bits_ | generation) {
-    DCHECK_LT(generation, 0xF);
+      : bits_((o.bits_ & ~static_cast<uint8_t>(0xF)) | generation) {
+    DCHECK_LE(generation, 0xF);
   }
 
   bool IsImportant() const { return (bits_ >> kImportantBit) & 1; }
@@ -82,6 +82,7 @@ class CORE_EXPORT CascadePriority {
   }
   bool HasOrigin() const { return GetOrigin() != CascadeOrigin::kNone; }
   uint32_t GetPosition() const { return (bits_ >> 4) & 0xFFFFFFFF; }
+  uint8_t GetGeneration() const { return bits_ & 0xF; }
 
   bool operator>=(const CascadePriority& o) const { return bits_ >= o.bits_; }
   bool operator<(const CascadePriority& o) const { return bits_ < o.bits_; }

third_party/blink/renderer/core/css/resolver/cascade_priority_test.cc

@@ -206,6 +206,20 @@ TEST(CascadePriorityTest, Generation) {
   EXPECT_LT(CascadePriority(ua, 2), CascadePriority(author, 3));
 }
 
+TEST(CascadePriorityTest, GenerationOverwrite) {
+  CascadePriority ua(CascadeOrigin::kUserAgent);
+
+  for (int8_t g = 0; g < 16; ++g) {
+    ua = CascadePriority(ua, g);
+    EXPECT_EQ(g, ua.GetGeneration());
+  }
+
+  for (int8_t g = 15; g >= 0; --g) {
+    ua = CascadePriority(ua, g);
+    EXPECT_EQ(g, ua.GetGeneration());
+  }
+}
+
 TEST(CascadePriorityTest, PositionEncoding) {
   // Test 0b0, 0b1, 0b11, 0b111, etc.
   uint32_t pos = 0;