Provide an RNG seed for creating snapshot.

If Math.random is called when creating the snapshot, we need seeds to
work with. Those seeds are going to be overwritten after deserializing
from the snapshot.

NOTRY=true
NOTREECHECKS=true
TBR=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1458003005

Cr-Commit-Position: refs/heads/master@{#32134}

src/js/math.js

@@ -14,7 +14,7 @@ var GlobalMath = global.Math;
 var GlobalObject = global.Object;
 var InternalArray = utils.InternalArray;
 var NaN = %GetRootNaN();
-var rngstate;
+var rngstate = { a: 1, b: 2, c: 3, d: 4 };
 var toStringTagSymbol = utils.ImportNow("to_string_tag_symbol");
 
 utils.InitializeRNG = function() {