Switch digest calculation from using xor.

The problem with xor is it's a commutative operator, so the relative
ordering of operations won't be captured in the digest calculated.

This is problematic, as drawing an oval and then a rectangle can produce
visually-different results than drawing the rectangle and then the oval.

Instead, we can use the IdentifiableTokenBuilder library, which was
designed to preserve such ordering.

Bug: 973801
Change-Id: I45baf54418263a1984bc3446233fd5a7d0a6ebc3
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2311059
Commit-Queue: Caleb Raitto <caraitto@chromium.org>
Reviewed-by: Fernando Serboncini <fserb@chromium.org>
Reviewed-by: Khushal <khushalsagar@chromium.org>
Cr-Commit-Position: refs/heads/master@{#795677}

third_party/blink/renderer/core/html/canvas/html_canvas_element.cc

@@ -276,7 +276,7 @@ void HTMLCanvasElement::IdentifiabilityReportWithDigest(
             : nullptr;
     const uint64_t canvas_digest =
         identifiability_paintop_digest
-            ? identifiability_paintop_digest->digest()
+            ? identifiability_paintop_digest->GetToken().ToUkmMetricValue()
             : 0;
     const uint64_t context_type =
         context_ ? context_->GetContextType()

third_party/blink/renderer/platform/graphics/identifiability_paint_op_digest.cc

@@ -114,7 +114,7 @@ void IdentifiabilityPaintOpDigest::MaybeUpdateDigest(
       }
       SerializationBuffer().Grow(SerializationBuffer().size() << 1);
     }
-    digest_ ^= IdentifiabilityDigestOfBytes(base::as_bytes(
+    builder_.AddAtomic(base::as_bytes(
         base::make_span(SerializationBuffer().data(), serialized_size)));
     total_ops_digested_++;
     cur_ops_digested++;

third_party/blink/renderer/platform/graphics/identifiability_paint_op_digest.h

@@ -10,6 +10,7 @@
 #include "cc/paint/draw_image.h"
 #include "cc/paint/image_provider.h"
 #include "cc/paint/paint_cache.h"
+#include "third_party/blink/public/common/privacy_budget/identifiable_token_builder.h"
 #include "third_party/blink/renderer/platform/geometry/int_size.h"
 #include "third_party/blink/renderer/platform/platform_export.h"
 #include "third_party/skia/include/utils/SkNoDrawCanvas.h"
@@ -46,8 +47,8 @@ class PLATFORM_EXPORT IdentifiabilityPaintOpDigest {
     prefix_skip_count_ = prefix_skip_count;
   }
 
-  // The digest that was calculated, based on the PaintOps observed.
-  uint64_t digest() const { return digest_; }
+  // The IdentifiabilityToken (digest), based on the PaintOps observed.
+  IdentifiableToken GetToken() const { return builder_.GetToken(); }
 
   bool encountered_partially_digested_image() const {
     return encountered_partially_digested_image_;
@@ -71,9 +72,8 @@ class PLATFORM_EXPORT IdentifiabilityPaintOpDigest {
   // IdentifiabilityPaintOpDigest object.
   const int max_digest_ops_;
 
-  // The current identifiability digest -- potentially updated every
-  // MaybeUpdateDigest() call.
-  uint64_t digest_ = 0;
+  // Potentially updated every MaybeUpdateDigest() call.
+  IdentifiableTokenBuilder builder_;
 
   // The number of PaintOps that have contributed to the current digest -- used
   // to stop updating the digest after a threshold number of operations to avoid