Backout a567cc63a389 (bug 820180) due to red on Windows.

--HG--
extra : rebase_source : 83177da726fdd2945a3c3293b72c8c615ed7b25d

js/src/jsapi.cpp

@@ -888,8 +888,7 @@ JSRuntime::JSRuntime(JSUseHelperThreads useHelperThreads)
     threadPool(this),
     ionReturnOverride_(MagicValue(JS_ARG_POISON)),
     useHelperThreads_(useHelperThreads),
-    requestedHelperThreadCount(-1),
-    rngNonce(0)
+    requestedHelperThreadCount(-1)
 {
     /* Initialize infallibly first, so we can goto bad and JS_DestroyRuntime. */
     JS_INIT_CLIST(&onNewGlobalObjectWatchers);

js/src/jscntxt.cpp

@@ -262,6 +262,8 @@ js::NewContext(JSRuntime *rt, size_t stackChunkSize)
     bool first = rt->contextList.isEmpty();
     rt->contextList.insertBack(cx);
 
+    js_InitRandom(cx);
+
     /*
      * If cx is the first context on this runtime, initialize well-known atoms,
      * keywords, numbers, strings and self-hosted scripts. If one of these
@@ -1112,6 +1114,7 @@ JSContext::JSContext(JSRuntime *rt)
     outstandingRequests(0),
 #endif
     resolveFlags(0),
+    rngSeed(0),
     iterValue(MagicValue(JS_NO_ITER_VALUE)),
 #ifdef JS_METHODJIT
     methodJitEnabled(false),

js/src/jscntxt.h

@@ -1219,16 +1219,6 @@ struct JSRuntime : js::RuntimeFriendFields
         return 0;
 #endif
     }
-
-  private:
-    /*
-     * Used to ensure that compartments created at the same time get different
-     * random number sequences. See js::InitRandom.
-     */
-    uint64_t rngNonce;
-
-  public:
-    uint64_t nextRNGNonce() { return rngNonce++; }
 };
 
 /* Common macros to access thread-local caches in JSRuntime. */
@@ -1577,6 +1567,9 @@ struct JSContext : js::ContextFriendFields,
     /* Stored here to avoid passing it around as a parameter. */
     unsigned               resolveFlags;
 
+    /* Random number generator state, used by jsmath.cpp. */
+    int64_t             rngSeed;
+
     /* Location to stash the iteration value between JSOP_MOREITER and JSOP_ITERNEXT. */
     js::Value           iterValue;
 

js/src/jscompartment.cpp

@@ -78,7 +78,6 @@ JSCompartment::JSCompartment(JSRuntime *rt)
     gcGrayRoots(),
     gcMallocBytes(0),
     debugModeBits(rt->debugMode ? DebugFromC : 0),
-    rngState(0),
     watchpointMap(NULL),
     scriptCountsMap(NULL),
     debugScriptMap(NULL),
@@ -127,9 +126,6 @@ JSCompartment::init(JSContext *cx)
     if (!regExps.init(cx))
         return false;
 
-    if (cx)
-        InitRandom(cx->runtime, &rngState);
-
 #ifdef JSGC_GENERATIONAL
     /*
      * If we are in the middle of post-barrier verification, we need to

js/src/jscompartment.h

@@ -463,9 +463,6 @@ struct JSCompartment : private JS::shadow::Compartment, public js::gc::GraphNode
 
     js::DtoaCache dtoaCache;
 
-    /* Random number generator state, used by jsmath.cpp. */
-    uint64_t rngState;
-
   private:
     /*
      * Weak reference to each global in this compartment that is a debuggee.

js/src/jsmath.cpp

@@ -541,48 +541,47 @@ js_math_pow(JSContext *cx, unsigned argc, Value *vp)
 # pragma optimize("", on)
 #endif
 
-static const uint64_t RNG_MULTIPLIER = 0x5DEECE66DLL;
-static const uint64_t RNG_ADDEND = 0xBLL;
-static const uint64_t RNG_MASK = (1LL << 48) - 1;
+static const int64_t RNG_MULTIPLIER = 0x5DEECE66DLL;
+static const int64_t RNG_ADDEND = 0xBLL;
+static const int64_t RNG_MASK = (1LL << 48) - 1;
 static const double RNG_DSCALE = double(1LL << 53);
 
 /*
  * Math.random() support, lifted from java.util.Random.java.
  */
 extern void
-random_setSeed(uint64_t *rngState, uint64_t seed)
+random_setSeed(int64_t *rngSeed, int64_t seed)
 {
-    *rngState = (seed ^ RNG_MULTIPLIER) & RNG_MASK;
+    *rngSeed = (seed ^ RNG_MULTIPLIER) & RNG_MASK;
 }
 
 void
-js::InitRandom(JSRuntime *rt, uint64_t *rngState)
+js_InitRandom(JSContext *cx)
 {
     /*
-     * Set the seed from current time. Since we have a RNG per compartment and
-     * we often bring up several compartments at the same time, mix in a
-     * different integer each time. This is only meant to prevent all the new
-     * compartments from getting the same sequence of pseudo-random
-     * numbers. There's no security guarantee.
+     * Set the seed from current time. Since we have a RNG per context and we often bring
+     * up several contexts at the same time, we xor in some additional values, namely
+     * the context and its successor. We don't just use the context because it might be
+     * possible to reverse engineer the context pointer if one guesses the time right.
      */
-    random_setSeed(rngState, (uint64_t(PRMJ_Now()) << 8) ^ rt->nextRNGNonce());
+    random_setSeed(&cx->rngSeed, (PRMJ_Now() / 1000) ^ int64_t(cx) ^ int64_t(cx->getNext()));
 }
 
 extern uint64_t
-random_next(uint64_t *rngState, int bits)
+random_next(int64_t *rngSeed, int bits)
 {
-    uint64_t nextstate = *rngState * RNG_MULTIPLIER;
-    nextstate += RNG_ADDEND;
-    nextstate &= RNG_MASK;
-    *rngState = nextstate;
-    return nextstate >> (48 - bits);
+    uint64_t nextseed = *rngSeed * RNG_MULTIPLIER;
+    nextseed += RNG_ADDEND;
+    nextseed &= RNG_MASK;
+    *rngSeed = nextseed;
+    return nextseed >> (48 - bits);
 }
 
 static inline double
 random_nextDouble(JSContext *cx)
 {
-    uint64_t *rng = &cx->compartment->rngState;
-    return double((random_next(rng, 26) << 27) + random_next(rng, 27)) / RNG_DSCALE;
+    return double((random_next(&cx->rngSeed, 26) << 27) + random_next(&cx->rngSeed, 27)) /
+           RNG_DSCALE;
 }
 
 double

js/src/jsmath.h

@@ -45,9 +45,6 @@ class MathCache
     size_t sizeOfIncludingThis(JSMallocSizeOfFun mallocSizeOf);
 };
 
-extern void
-InitRandom(JSRuntime *rt, uint64_t *rngState);
-
 } /* namespace js */
 
 /*
@@ -57,6 +54,9 @@ InitRandom(JSRuntime *rt, uint64_t *rngState);
 extern JSObject *
 js_InitMathClass(JSContext *cx, js::HandleObject obj);
 
+extern void
+js_InitRandom(JSContext *cx);
+
 extern double
 math_random_no_outparam(JSContext *cx);