Implement Math.random() purely in JavaScript.

src/bootstrapper.cc

Index: src/bootstrapper.cc
diff --git a/src/bootstrapper.cc b/src/bootstrapper.cc
index 234a2118bdd7002189906df3e21f6446869f594e..b9a602d50a7fa23c56a44c6b94e7247f2dc34592 100644
--- a/src/bootstrapper.cc
+++ b/src/bootstrapper.cc
@@ -1308,10 +1308,6 @@ void Genesis::InitializeGlobal(Handle<GlobalObject> inner_global,
   // Initialize the embedder data slot.
   Handle<FixedArray> embedder_data = factory->NewFixedArray(2);
   native_context()->set_embedder_data(*embedder_data);
-
-  // Allocate the random seed slot.
-  Handle<ByteArray> random_seed = factory->NewByteArray(kRandomStateSize);
-  native_context()->set_random_seed(*random_seed);
 }
 
 
@@ -2635,13 +2631,36 @@ Genesis::Genesis(Isolate* isolate,
   InitializeExperimentalGlobal();
   if (!InstallExperimentalNatives()) return;
 
-  // Initially seed the per-context random number generator
-  // using the per-isolate random number generator.
-  uint32_t* state = reinterpret_cast<uint32_t*>(
-      native_context()->random_seed()->GetDataStartAddress());
-  do {
-    isolate->random_number_generator()->NextBytes(state, kRandomStateSize);
-  } while (state[0] == 0 || state[1] == 0);
+  // We can't (de-)serialize typed arrays currently, but we are lucky: The state
+  // of the random number generator needs no initialization during snapshot
+  // creation time.
+  if (!Serializer::enabled()) {
+    // Initially seed the per-context random number generator using the
+    // per-isolate random number generator.
+    const int num_elems = 2;
+    uint32_t* state = new uint32_t[num_elems];
+    const int num_bytes = num_elems * sizeof(*state);
+    // We have to delete the state when the context dies, so we remember it in
+    // the context (encoded as a Smi, our usual technique for aligned pointers)
+    // and do the cleanup in WeakListVisitor<Context>::VisitPhantomObject().
+    // This hack can go away when we have a way to allocate the backing store of
+    // typed arrays on the heap.
+    native_context()->set_random_state(reinterpret_cast<Smi*>(state));
+    ASSERT(native_context()->random_state()->IsSmi());
+
+    do {
+      isolate->random_number_generator()->NextBytes(state, num_bytes);
+    } while (state[0] == 0 || state[1] == 0);
+
+    v8::Local<v8::ArrayBuffer> buffer = v8::ArrayBuffer::New(state, num_bytes);
+    v8::Local<v8::Uint32Array> ta = v8::Uint32Array::New(buffer, 0, num_elems);
+    Handle<JSBuiltinsObject> builtins(native_context()->builtins());
+    ForceSetProperty(builtins,
+                     factory()->InternalizeOneByteString(
+                         STATIC_ASCII_VECTOR("rngstate")),
+                     Utils::OpenHandle(*ta),
+                     NONE);
+  }
 
   result_ = native_context();
 }