Warm up RNG when --random_seed is used

The RNG state is initialized with random_seed parameter that usually
has lots of zeros. Each random generation iteration shuffles bits with
xor operation over the state. It takes a while before the state is populated
with enough 1s and starts generating uniformly distributed numbers.

The patch warms up the state with 32 iterations when --random_seed is used.

BUG=v8:8265

Change-Id: I7a4e8c842962bea0f2935c7b3673494367d8580f
Reviewed-on: https://chromium-review.googlesource.com/c/1263816
Commit-Queue: Alexei Filippov <alph@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56418}

src/base/utils/random-number-generator.h

@@ -127,6 +127,8 @@ class V8_BASE_EXPORT RandomNumberGenerator final {
     *state1 = s1;
   }
 
+  static uint64_t MurmurHash3(uint64_t);
+
  private:
   static const int64_t kMultiplier = V8_2PART_UINT64_C(0x5, deece66d);
   static const int64_t kAddend = 0xb;
@@ -134,8 +136,6 @@ class V8_BASE_EXPORT RandomNumberGenerator final {
 
   int Next(int bits) V8_WARN_UNUSED_RESULT;
 
-  static uint64_t MurmurHash3(uint64_t);
-
   int64_t initial_seed_;
   uint64_t state0_;
   uint64_t state1_;

src/math-random.cc

@@ -39,17 +39,16 @@ Smi* MathRandom::RefillCache(Isolate* isolate, Context* native_context) {
   // requested, use it to reset our state the first time a script asks for
   // random numbers in this context. This ensures the script sees a consistent
   // sequence.
-  if (state.s0 == 0 || state.s1 == 0) {
+  if (state.s0 == 0 && state.s1 == 0) {
+    uint64_t seed;
     if (FLAG_random_seed != 0) {
-      state.s0 = FLAG_random_seed;
-      state.s1 = FLAG_random_seed;
+      seed = FLAG_random_seed;
     } else {
-      base::RandomNumberGenerator* rng = isolate->random_number_generator();
-      while (state.s0 == 0 || state.s1 == 0) {
-        rng->NextBytes(&state.s0, sizeof(state.s0));
-        rng->NextBytes(&state.s1, sizeof(state.s1));
-      }
+      isolate->random_number_generator()->NextBytes(&seed, sizeof(seed));
     }
+    state.s0 = base::RandomNumberGenerator::MurmurHash3(seed);
+    state.s1 = base::RandomNumberGenerator::MurmurHash3(~seed);
+    CHECK(state.s0 != 0 || state.s1 != 0);
   }
 
   FixedDoubleArray* cache =

test/mjsunit/regress/regress-8265.js

+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --random-seed=1
+
+for (let i = 0; i < 54; ++i) Math.random();
+let sum = 0;
+for (let i = 0; i < 10; ++i)
+  sum += Math.floor(Math.random() * 50);
+
+assertNotEquals(0, sum);