Allow Math.random to be called when creating a custom startup snapshot.

src/js/math.js

Index: src/js/math.js
diff --git a/src/js/math.js b/src/js/math.js
index fbe783bf7758b36daaa86ae10ad502c5db72cc81..121d188101037fbda683c2e160364ec77a8cfbc8 100644
--- a/src/js/math.js
+++ b/src/js/math.js
@@ -10,7 +10,6 @@
 // -------------------------------------------------------------------
 // Imports
 
-define kRandomBatchSize = 64;
 // The first two slots are reserved to persist PRNG state.
 define kRandomNumberStart = 2;
 
@@ -19,7 +18,7 @@ var GlobalMath = global.Math;
 var GlobalObject = global.Object;
 var InternalArray = utils.InternalArray;
 var NaN = %GetRootNaN();
-var nextRandomIndex = kRandomBatchSize;
+var nextRandomIndex = 0;
 var randomNumbers = UNDEFINED;
 var toStringTagSymbol = utils.ImportNow("to_string_tag_symbol");
 
@@ -67,19 +66,24 @@ function MathPowJS(x, y) {
 
 // ECMA 262 - 15.8.2.14
 function MathRandom() {
-  if (nextRandomIndex >= kRandomBatchSize) {
+  // While creating a startup snapshot, %GenerateRandomNumbers returns a
+  // normal array containing a single random number, and has to be called for
+  // every new random number.
+  // Otherwise, it returns a pre-populated typed array of random numbers. The
+  // first two elements are reserved for the PRNG state.
+  if (nextRandomIndex <= kRandomNumberStart) {
     randomNumbers = %GenerateRandomNumbers(randomNumbers);
-    nextRandomIndex = kRandomNumberStart;
+    nextRandomIndex = randomNumbers.length;
   }
-  return randomNumbers[nextRandomIndex++];
+  return randomNumbers[--nextRandomIndex];
 }
 
 function MathRandomRaw() {
-  if (nextRandomIndex >= kRandomBatchSize) {
+  if (nextRandomIndex <= kRandomNumberStart) {
     randomNumbers = %GenerateRandomNumbers(randomNumbers);
-    nextRandomIndex = kRandomNumberStart;
+    nextRandomIndex = randomNumbers.length;
   }
-  return %_DoubleLo(randomNumbers[nextRandomIndex++]) & 0x3FFFFFFF;
+  return %_DoubleLo(randomNumbers[--nextRandomIndex]) & 0x3FFFFFFF;
 }
 
 // ECMA 262 - 15.8.2.15