Make cc::SurfaceId unguessable

components/mus/public/interfaces/surface_id.mojom

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 module mus.mojom;
 
-// A surface ID is composed of two parts, a local part and a namespace. The
-// local part is allocated by the client using any scheme that avoids
-// duplicates. The namespace is allocated by the service and will be different
-// for each client (aka each connection to mojo.Surface).
+// A surface ID is composed of three parts: a namespace, a local ID, and a
+// nonce. The local part and nonce are allocated by the client using any scheme
+// that avoids duplicates and makes IDs unguessable respectively. The namespace
+// is allocated by the service and will be different for each client.
 //
 // The special id_namespace value 0 is equivalent to the namespace of the
 // client. This can be used to create, destroy and submit frames to
 // surfaces before learning the namespace and to reference other surfaces
 // owned by the same client. The actual id namespace must be used to pass
 // surface ids to other clients for them to reference.
 struct SurfaceId {
-  uint32 local;
+  // A service allocated ID identifying a client.
   uint32 id_namespace;
+
+  // An identifier allocated by the client uniquely identifying a surface within
+  // a client process.
+  uint32 local_id;
+
+  // A cryptographically secure random int chosen to make the SurfaceId
+  // unguessable by other clients.
+  uint64 nonce;
 };