Math.random must not be executed when creating a snapshot.

src/runtime/runtime-maths.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/runtime/runtime-utils.h"
 
 #include "src/arguments.h"
 #include "src/assembler.h"
 #include "src/base/utils/random-number-generator.h"
 #include "src/bootstrapper.h"
@@ skipping 211 matching lines @@
   CONVERT_DOUBLE_ARG_CHECKED(x, 0);
   lazily_initialize_fast_sqrt(isolate);
   return *isolate->factory()->NewNumber(fast_sqrt(x, isolate));
 }
 
 
 RUNTIME_FUNCTION(Runtime_GenerateRandomNumbers) {
   HandleScope scope(isolate);
   DCHECK(args.length() == 1);
   // Random numbers in the snapshot are not really that random.
-  DCHECK(!isolate->bootstrapper()->IsActive());
+  CHECK(!isolate->serializer_enabled());
   static const int kState0Offset = 0;
   static const int kState1Offset = 1;
   static const int kRandomBatchSize = 64;
   CONVERT_ARG_HANDLE_CHECKED(Object, maybe_typed_array, 0);
   Handle<JSTypedArray> typed_array;
   // Allocate typed array if it does not yet exist.
   if (maybe_typed_array->IsJSTypedArray()) {
     typed_array = Handle<JSTypedArray>::cast(maybe_typed_array);
   } else {
     static const int kByteLength = kRandomBatchSize * kDoubleSize;
@@ skipping 22 matching lines @@
     base::RandomNumberGenerator::XorShift128(&state0, &state1);
     array[i] = base::RandomNumberGenerator::ToDouble(state0, state1);
   }
   // Persist current state.
   array[kState0Offset] = uint64_to_double(state0);
   array[kState1Offset] = uint64_to_double(state1);
   return *typed_array;
 }
 }  // namespace internal
 }  // namespace v8