Actually, this is a bit worse. Observe the following code:
  UnguessableToken token1 = UnguessableToken::Deserialize(0x0000000012345678, 0x0000000123456789);
  UnguessableToken token2 = UnguessableToken::Deserialize(0x0000000123456781, 0x0000000023456789);
  EXPECT_NE(token1.ToString(), token2.ToString());
You would expect the two string to be different, but they are, in fact, the same.

Fix here: https://chromium-review.googlesource.com/c/chromium/src/+/934824

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/d16e74c356a770d216177213eec390790eca75dc

commit d16e74c356a770d216177213eec390790eca75dc
Author: Elad Alon <eladalon@chromium.org>
Date: Mon Feb 26 13:16:50 2018

Fix UnguessableToken::ToString()

Make sure that ToString() would produce distinct strings for
distinct tokens.

Bug:  815217 
Cq-Include-Trybots: master.tryserver.chromium.android:android_optional_gpu_tests_rel
Change-Id: I38ea5bfad061610e95945eb31187cb3c02f737cf
Reviewed-on: https://chromium-review.googlesource.com/934824
Reviewed-by: Avi Drissman <avi@chromium.org>
Reviewed-by: Daniel Cheng <dcheng@chromium.org>
Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Commit-Queue: Elad Alon <eladalon@chromium.org>
Cr-Commit-Position: refs/heads/master@{#539115}
[modify] https://crrev.com/d16e74c356a770d216177213eec390790eca75dc/base/unguessable_token.cc
[modify] https://crrev.com/d16e74c356a770d216177213eec390790eca75dc/base/unguessable_token_unittest.cc
[modify] https://crrev.com/d16e74c356a770d216177213eec390790eca75dc/components/viz/common/surfaces/local_surface_id_unittest.cc

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot