Reland "Implement Math.random() purely in JavaScript" plus fixes.

Reland "Implement Math.random() purely in JavaScript" plus fixes.

The main change is that a bit has been added to array buffers to
signal that the backing store has to be freed when the buffer dies.

BUG=316359
LOG=Y
R=yangguo@chromium.org

Committed: http://code.google.com/p/v8/source/detail?r=18003

[Yang, 2013-11-22 11:34:43]

LGTM with comment (basically what we discussed offline).

https://codereview.chromium.org/82763005/diff/1/src/runtime.cc
File src/runtime.cc (right):

https://codereview.chromium.org/82763005/diff/1/src/runtime.cc#newcode698
src/runtime.cc:698: free(phantom_array_buffer->backing_store());
Please make sure that this returns afterwards, either by asserting that
should_be_freed() also implies is_external(), or just adding a return right
after. This would prevent freeing again using the allocator later.

[Yang, 2013-11-22 11:35:32]

On 2013/11/22 11:34:43, Yang wrote:
> LGTM with comment (basically what we discussed offline).
> 
> https://codereview.chromium.org/82763005/diff/1/src/runtime.cc
> File src/runtime.cc (right):
> 
> https://codereview.chromium.org/82763005/diff/1/src/runtime.cc#newcode698
> src/runtime.cc:698: free(phantom_array_buffer->backing_store());
> Please make sure that this returns afterwards, either by asserting that
> should_be_freed() also implies is_external(), or just adding a return right
> after. This would prevent freeing again using the allocator later.

LGTM.

[Sven Panne, 2013-11-22 11:36:07]

Committed patchset #2 manually as r18003 (presubmit successful).