Move math-related typed arrays off js builtins object..

src/js/math.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-var rngstate;  // Initialized to a Uint32Array during genesis.
-
 (function(global, utils) {
 "use strict";
 
 %CheckIsBootstrapping();
 
 // -------------------------------------------------------------------
 // Imports
 
 var GlobalMath = global.Math;
 var GlobalObject = global.Object;
 var InternalArray = utils.InternalArray;
 var NaN = %GetRootNaN();
+var rngstate;
 var toStringTagSymbol = utils.ImportNow("to_string_tag_symbol");
 
+utils.SetupTypedArray(function(arg1, arg2, arg3) {
+  rngstate = arg1;
+});
+
 //-------------------------------------------------------------------
 
 // ECMA 262 - 15.8.2.1
 function MathAbs(x) {
   x = +x;
   return (x > 0) ? x : 0 - x;
 }
 
 // ECMA 262 - 15.8.2.2
 function MathAcosJS(x) {
@@ skipping 314 matching lines @@
 utils.Export(function(to) {
   to.MathAbs = MathAbs;
   to.MathExp = MathExp;
   to.MathFloor = MathFloorJS;
   to.IntRandom = MathRandomRaw;
   to.MathMax = MathMax;
   to.MathMin = MathMin;
 });
 
 })