http_server: pause socket properly

Account pending response data to decide whether pause the socket or
not. Writable stream state is a not reliable measure, because it just
says how much data is pending on a **current** request, thus not helping
much with problem we are trying to solve here.

PR-URL: https://github.com/nodejs/node/pull/3128

http: fix out-of-order 'finish' bug in pipelining

Changes to `stream_base.cc` are required to support empty writes.
Fixes CVE-2015-7384, https://github.com/nodejs/node/issues/3138

Fix: https://github.com/nodejs/node/issues/2639
PR-URL: https://github.com/nodejs/node/pull/3128

test: load common.js to test for global leaks

common.js contains code that checks for variables leaking into the
global namespace. Load common.js in all tests that do not
intentionally leak variables.

PR-URL: https://github.com/nodejs/node/pull/3095
Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com>
Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>

crypto: enable FIPS only when configured with it

Do not rely on `OPENSSL_FIPS` in `node_crypto.cc` when building with
shared FIPS-enabled OpenSSL library. Enable FIPS in core only when
configured with `--openssl-fips`.

Fix: https://github.com/nodejs/node/issues/3077
PR-URL: https://github.com/nodejs/node/pull/3153
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

test: fix invalid variable name

The variable `er` is not declared at all. So if EPERM error is ever
raised then the `er` will throw `ReferenceError` and the code will
break.

PR-URL: https://github.com/nodejs/node/pull/3150
Reviewed-By: Brian White <mscdex@mscdex.net>

async_wrap: ensure all objects have internal field

If the constructor can't assign a class id then the heap snapshot will
not be able to report the object. So ensure that all AsyncWrap instances
use a FunctionTemplate instance with an internal field count >= 1.

PR-URL: https://github.com/nodejs/node/pull/3139
Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-by: Stephen Belanger <admin@stephenbelanger.com>

async_wrap: update providers and add test

Several provider ids have been removed that are no longer in use. Others
have been updated to match their class constructors.

Add test to ensure all internally listed providers are used.

PR-URL: https://github.com/nodejs/node/pull/3139
Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-by: Stephen Belanger <admin@stephenbelanger.com>

contextify: use CHECK instead of `if`

I was walking through the vm changes and saw this particular `if` check
interesting. In case `ctx` is empty it's going to fail later anyways.
So, instead of putting an `if` check there;

option a - use CHECK
option b - do nothing

Considering the developer wanted to make sure `ctx` is not empty,
`CHECK` option looked more convenient.

PR-URL: https://github.com/nodejs/node/pull/3125
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

deps: upgrade libuv to 1.7.5

PR-URL: https://github.com/nodejs/node/pull/3010
Reviewed-By: Rod Vagg <rod@vagg.org>
Reviewed-By: Trevor Norris <trev.norris@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>

build,win: fix node.exe resource version

When MSBuild invokes rc.exe, it passes NODE_TAG unstringified, but
passes it correctly to cl.exe. Hence, this workaround was made to
apply only to the resource file.

Fixes: https://github.com/nodejs/node/issues/2963
PR-URL: https://github.com/nodejs/node/pull/3053
Reviewed-By: Alexis Campailla <orangemocha@nodejs.org>
Reviewed-By: Johan Bergström <bugs@bergstroem.nu>

doc: fix outdated 'try/catch' statement in sync

Fixes description about crypto.randomBytes.

Fixes: https://github.com/nodejs/node/issues/3081
PR-URL: https://github.com/nodejs/node/pull/3087
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Brendan Ashworth <brendan.ashworth@me.com>
Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>

deps: upgrade V8 to 4.5.103.35

Apply the latest fixes from V8 4.5 branch & bring us up to 4.5.103.35:
* Disallow Object.observe calls on access checked objects.
https://github.com/v8/v8/commit/134e541ad149b9732bc4fee6fe6952cf669703a7
* Avoid excessive data copying for ExternalStreamingStream::SetBookmark.
https://github.com/v8/v8/commit/96dddb455daff3d8626bc4e5d7b2898fbab55991

PR-URL: https://github.com/nodejs/node/pull/3117
Reviewed-By: indutny - Fedor Indutny <fedor.indutny@gmail.com>
Reviewed-By: bnoordhuis - Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: trevnorris - Trevor Norris <trev.norris@gmail.com>
Reviewed-By: targos - Michaël Zasso <mic.besace@gmail.com>

deps: backport f782159 from v8's upstream

Backport f78215962bf5de9d47c022e7baa3952d0bf6d17f from V8's upstream
to speed up promise introspection.

Original commit message:

  Remove obsolete try/catch from ObjectIsPromise().

  Review URL: https://codereview.chromium.org/1367123003

  Cr-Commit-Position: refs/heads/master@{#30966}

PR-URL: https://github.com/nodejs/node/pull/3130
Reviewed-By: Evan Lucas <evanlucas@me.com>
Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>

util: optimize promise introspection

Use V8's builtin ObjectIsPromise() to check that the value is a promise
before creating the promise mirror.  Reduces garbage collector strain
in the (common) non-promise case, which is beneficial when inspecting
deep object graphs.

PR-URL: https://github.com/nodejs/node/pull/3130
Reviewed-By: Evan Lucas <evanlucas@me.com>
Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>

i18n: add caller to removal list for bidi in ICU55

For ICU 55 we are currently stripping out bidi and
the callers.  AIX is more pedantic and identified
an additional caller than needed to be stripped out.
This PR adds that caller to those stripped out.

PR-URL: https://github.com/nodejs/node/pull/3115
Reviewed-By: Steven Loomis <srloomis@us.ibm.com>

doc: add TSC meeting minutes 2015-09-16

PR-URL: https://github.com/nodejs/node/pull/3023
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>

doc: copyedit fs.watch() information

Removed "Only FSEvents supports this type of file watching so it is
unlikely any additional platforms will be added soon."

Per @saghul, "FSEvents" refers to the OSX API, but since we added
Windows support it may not be  unlikely that we add more.

PR-URL: https://github.com/nodejs/node/pull/3097
Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>
Reviewed-By: Michaël Zasso <mic.besace@gmail.com>
Reviewed-By: Saúl Ibarra Corretgé <saghul@gmail.com>

benchmark: update comment in common.js

Very minor update in benchmark/common.js
Not exactly a critical change, just continued cleaning
out of old joyent/node PRs that never landed.

Ref: https://github.com/nodejs/node-v0.x-archive/pull/8515
PR-URL: https://github.com/nodejs/node/pull/2399
Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>
Reviewed-By: Brendan Ashworth <brendan.ashworth@me.com>
Reviewed-By: Michaël Zasso <mic.besace@gmail.com>

smalloc: remove module

Bye bye, smalloc. I'm not sure why this was still here; it was removed
in 70d1f32 and hasn't worked since. It wasn't packaged in the
binary, either.

Reviewed-By: Michaël Zasso <mic.besace@gmail.com>
Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>
Reviewed-By: Сковорода Никита Андреевич <chalkerx@gmail.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
PR-URL: https://github.com/nodejs/node/pull/3099

test: change calls to deprecated util.print()

common.print() is just util.print() and as such prints a deprecation
warning. Per docs, update to console.log().

PR-URL: https://github.com/nodejs/node/pull/3083
Reviewed-By: Michaël Zasso <mic.besace@gmail.com>
Reviewed-By: Brendan Ashworth <brendan.ashworth@me.com>

test: replace deprecated util.debug() calls

common.debug() is just util.debug() and emits a deprecation notice. Per
docs, use console.error() instead.

PR-URL: https://github.com/nodejs/node/pull/3082
Reviewed-By: Michaël Zasso <mic.besace@gmail.com>

dns: add missing exports.BADNAME

Adds the documented but missing DNS error exports.BADNAME. This export
has been there before but got lost in a 2012 commit that added more
error codes. https://github.com/nodejs/node/pull/3076 will remove the
wrong error code exports.ADNAME.

PR-URL: https://github.com/nodejs/node/pull/3051
Fixes: https://github.com/nodejs/node/issues/3050
Reviewed-By: Сковорода Никита Андреевич <chalkerx@gmail.com>
Reviewed-By: Michaël Zasso <mic.besace@gmail.com>
Reviewed-By: Evan Lucas <evanlucas@me.com>

src: internalize binding function property names

Internalized strings are created in the old space and that is where they
eventually would end up anyway when created as normal strings.

PR-URL: https://github.com/nodejs/node/pull/3060
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Trevor Norris <trev.norris@gmail.com>

src: internalize per-isolate string properties

Speeds up property lookups a little and it creates the string in the
old space straight away.  It's a little easier on the garbage collector
because it doesn't have to track eternalized strings in the new space.

PR-URL: https://github.com/nodejs/node/pull/3060
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Trevor Norris <trev.norris@gmail.com>

path: improve posixSplitPath performance

Instead of slicing the first element off of the matches, shift and then
return. This improves performance of the following path functions:

- basename: 18-20%
- extname: 60-70%
- dirname: 18-20%
- parse: 20-25%

PR-URL: https://github.com/nodejs/node/pull/3034
Reviewed-By: Brian White <mscdex@mscdex.net>
Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>

src: include signal.h in util.h

It is required for using the "SIGABRT" constant.

It doesn't cause compilation errors in Node because most files already
have "signal.h" included, but it causes errors for third party embedder.

PR-URL: https://github.com/nodejs/node/pull/3058
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>
Reviewed-By: Rod Vagg <r@va.gg>
Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>
Reviewed-By: Trevor Norris <trev.norris@gmail.com>

src: fix function and variable names in comments

The `src/node.js` file is actually loaded and executed by
`node::LoadEnvironment` function.

The variable which has the contents is, `native_node`.

PR-URL: https://github.com/nodejs/node/pull/3039
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

crypto: add more keylen sanity checks in pbkdf2

issue #2987 makes the point that crypto.pbkdf2 should not fail silently
and accept invalid but numeric values like NaN and Infinity. We already
check if the keylen is lower than 0, so extending that to NaN and
Infinity should make sense.

Fixes: https://github.com/nodejs/node/issues/2987

PR-URL: https://github.com/nodejs/node/pull/3029
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Brian White <mscdex@mscdex.net>
Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>
Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>

child_process: `null` channel handle on close

`HandleWrap::OnClose` destroys the underlying C++ object and null's the
internal field pointer to it. Therefore there should be no references to
the wrapping JavaScript object.

`null` the process' `_channel` field right after closing it, to ensure
no crashes will happen.

Fix: https://github.com/nodejs/node/issues/2847
PR-URL: https://github.com/nodejs/node/pull/3041
Reviewed-By: Trevor Norris <trev.norris@gmail.com>

deps: remove and gitignore .bin directory

The .bin/ directory in deps/npm/node_modules seens to have been an
accidental check-in in commit e79ccee ("npm: upgrade to v2.1.18").
It causes trouble for distro packagers so delete it and blacklist it.

Fixes: https://github.com/nodejs/node/issues/2839
PR-URL: https://github.com/nodejs/node/pull/3004
Reviewed-By: Kat Marchán <kzm@sykosomatic.org>
Reviewed-By: Rod Vagg <r@va.gg>
Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>

deps: backport c281c15 from V8's upstream

Backport c281c15d6dab8370a7805f0717502d260e0ad433 from V8's upstream to
allow post-mortem debugging tools to inspect Buffer instances' length.

Original commit message:

  Add JSTypedArray's length in post-mortem metadata.

  BUG=
  R=bmeurer@chromium.org

  Review URL: https://codereview.chromium.org/1363683002

  Cr-Commit-Position: refs/heads/master@{#30873}

PR: #3031
PR-URL: https://github.com/nodejs/node/pull/3031
Reviewed-By: Trevor Norris <trev.norris@gmail.com>

doc: jenkins-iojs.nodesource.com -> ci.nodejs.org

The Jenkins URL has changed from https://jenkins-iojs.nodesource.com
to https://ci.nodejs.org. The former address now redirects to the
latter. Some jobs has also changed names.

PR-URL: https://github.com/nodejs/node/pull/2886
Reviewed-By: Rod Vagg <r@va.gg>
Reviewed-By: Evan Lucas <evanlucas@me.com>
Reviewed-By: Roman Reiss <me@silverwind.io>

docs: Clarify assert.doesNotThrow behavior

The documentation for assert.doesNotThrow now reflects all the inputs
the function accepts, as well as the errors thrown for each combination
of parameter types.

PR-URL: https://github.com/nodejs/node/pull/2807
Reviewed-By: Rich Trott <rtrott@gmail.com>

build: iojs -> nodejs of release-urlbase

PR-URL: https://github.com/nodejs/node/pull/3015
Reviewed-By: Rod Vagg <r@va.gg>
Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>
Reviewed-By: Roman Reiss <me@silverwind.io>

doc: rearrange execSync and execFileSync

Changed the ordering so it is in line with the async methods.

PR-URL: https://github.com/nodejs/node/pull/2940
Reviewed-By: Michaël Zasso <mic.besace@gmail.com>
Reviewed-By: Roman Reiss <me@silverwind.io>

doc: make execFileSync in line with execFile

PR-URL: https://github.com/nodejs/node/pull/2940
Reviewed-By: Michaël Zasso <mic.besace@gmail.com>
Reviewed-By: Roman Reiss <me@silverwind.io>

build: fix some typos inside the configure script

PR-URL: https://github.com/nodejs/node/pull/3016
Reviewed-By: Michaël Zasso <mic.besace@gmail.com>
Reviewed-By: Roman Reiss <me@silverwind.io>

doc: fix typos in cluster & errors

PR-URL: https://github.com/nodejs/node/pull/3011
Reviewed-By: Michaël Zasso <mic.besace@gmail.com>
Reviewed-By: Roman Reiss <me@silverwind.io>

doc: switch LICENSE from closure-linter to eslint

Ref: https://github.com/nodejs/node/pull/1539
PR-URL: https://github.com/nodejs/node/pull/3018
Reviewed-By: Roman Reiss <me@silverwind.io>
Reviewed-By: Michaël Zasso <mic.besace@gmail.com>
Reviewed-By: Yosuke Furukawa <yosuke.furukawa@gmail.com>

Working on v4.1.2

2015-09-22, Version 4.1.1 (Stable) Release

Notable changes

* buffer: Fixed a bug introduced in v4.1.0 where allocating a new
  zero-length buffer can result in the next allocation of a TypedArray
  in JavaScript not being zero-filled. In certain circumstances this
  could result in data leakage via reuse of memory space in
  TypedArrays, breaking the normally safe assumption that TypedArrays
  should be always zero-filled. (Trevor Norris) #2931.
* http: Guard against response-splitting of HTTP trailing headers
  added via response.addTrailers() by removing new-line ([\r\n])
  characters from values. Note that standard header values are already
  stripped of new-line characters. The expected security impact is low
  because trailing headers are rarely used. (Ben Noordhuis) #2945.
* npm: Upgrade to npm 2.14.4 from 2.14.3, see release notes for full
  details (Kat Marchán) #2958
  - Upgrades graceful-fs on multiple dependencies to no longer rely on
    monkey-patching fs
  - Fix npm link for pre-release / RC builds of Node
* v8: Update post-mortem metadata to allow post-mortem debugging tools
  to find and inspect:
  - JavaScript objects that use dictionary properties
    (Julien Gilli) #2959
  - ScopeInfo and thus closures (Julien Gilli) #2974

lib,src: remove usage of events.EventEmitter

The `events` module already exports `EventEmitter` constructor function
So, we don't have to use `events.EventEmitter` to access it.

Refer: https://github.com/nodejs/node/pull/2896

PR-URL: https://github.com/nodejs/node/pull/2921
Reviewed-By: Roman Reiss <me@silverwind.io>
Reviewed-By: Michaël Zasso <mic.besace@gmail.com>

doc: remove usage of events.EventEmitter

The `events` module already exports `EventEmitter` constructor function
So, we don't have to use `events.EventEmitter` to access it.

Refer: https://github.com/nodejs/node/pull/2896

PR-URL: https://github.com/nodejs/node/pull/2921
Reviewed-By: Roman Reiss <me@silverwind.io>
Reviewed-By: Michaël Zasso <mic.besace@gmail.com>

repl: don't use tty control codes when $TERM is set to "dumb"

This change stops the REPL from using ANSI control codes for colours
when the TERM environment variable is set to "dumb".

"dumb" is the terminal type with the smallest set of capabilities as
described by terminfo. See:

http://invisible-island.net/ncurses/terminfo.ti.html#toc-_Specials

Related: https://github.com/nodejs/node-v0.x-archive/issues/5344
Related: https://github.com/nodejs/node-v0.x-archive/pull/25506
Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com>
Reviewed-By: Roman Reiss <me@silverwind.io>
PR-URL: https://github.com/nodejs/node/pull/2712

http: remove redundant code in _deferToConnect

Logic for calling the passed in socket method and/or callback
was duplicated. This commit refactors the relevant code to
remove the redundancy.

PR-URL: https://github.com/nodejs/node/pull/2769
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Brendan Ashworth <brendan.ashworth@me.com>

repl: backslash bug fix

The actual problem was with the line parsing logic for string literals.
When we use backslash in the string literals, it used to remember the
`\` as the previous character even after we parsed the character next
to it. This leads to REPL thinking that the end of string literals is
not reached.

This patch replaces the previous character with `null`, so that it will
properly skip the character next to it.

Previous Discussion: https://github.com/nodejs/node/pull/2952
Fixes: https://github.com/nodejs/node/issues/2749
PR-URL: https://github.com/nodejs/node/pull/2968
Reviewed-By: Roman Reiss <me@silverwind.io>

deps: backport 357e6b9 from V8's upstream

Backport 357e6b99ee3927cc075dd8d27c99b89d858f9dd5 from V8's upstream.

Original commit message:

  Add ScopeInfo constants to post-mortem metadata

  mdb_v8, a post-mortem debugging tool for Node.js, allows users to
  inspect ScopeInfo structures in order to get more information about
  closures.

  Currently, it hardcodes the metadata it uses to find this information.
  This change allows it to get this metadata from the node binary itself,
  and thus to adapt to future changes made to the layout of the ScopeInfo
  data structure.

  BUG=

  R=bmeurer@chromium.org

PR: #2974
PR-URL: https://github.com/nodejs/node/pull/2974
Reviewed-By: Rod Vagg <r@va.gg>
Reviewed-By: Ben Noordhuis <ben@strongloop.com>

doc: remove extra using v8::HandleScope statement

v8::HandleScope does not seem to be required for addon functions.

PR-URL: https://github.com/nodejs/node/pull/2983
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

configure: detect mipsel host

Detect mipsel before mips because mipsel has __mips__ flag as well.

PR-URL: https://github.com/nodejs/node/pull/2971
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Johan Bergström <bugs@bergstroem.nu>

test: test sync version of mkdir & rmdir

This patch includes tests for sync versions of mkdir and rmdir.
Also, it moves the test to `parallel`.

PR-URL: https://github.com/nodejs/node/pull/2588
Reviewed-By: Roman Reiss <me@silverwind.io>
Reviewed-By: Johan Bergström <bugs@bergstroem.nu>

deps: backport ff7d70b from V8's upstream

Original commit message:

  Update BitField3 type in gen-postmortem-metadata.py

  Since https://codereview.chromium.org/272163002, BitField3 is a raw
  uint32 field, and not a SMI anymore.

  Update tools/gen-postmortem-metadata.py so that post-mortem tools can
  work with versions of V8 that shipped after that change.

  This change was merged in github.com/joyent/node right before node
  v0.12.0 was released.

  R=danno@chromium.org

  TEST=mdb_v8, a post-mortem debugging tool running on SmartOS,  has been
  using this change since Node.js v0.12.0 was released

  BUG=

  Review URL: https://codereview.chromium.org/1296743003

  Cr-Commit-Position: refs/heads/master@{#30839}

PR: #2959
PR-URL: https://github.com/nodejs/node/pull/2959
Reviewed-By: Ali Ijaz Sheikh <ofrobots@google.com>
Reviewed-By: Rod Vagg <r@va.gg>

tools: single, cross-platform tick processor

Currently there are three separate tick processor scripts for
mac, windows, and linux. These have been replaced with a single
node.js script to improve maintainability and remove the need
to preserve parallel logic in these separate places.

PR-URL: https://github.com/nodejs/node/pull/2868
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>

deps: upgraded to node-gyp@3.0.3 in npm

PR-URL: https://github.com/nodejs/node/pull/2958
Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>
Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com>

deps: upgrade to npm 2.14.4

PR-URL: https://github.com/nodejs/node/pull/2958
Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>
Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com>

test: use tmpDir instead of fixtures in readdir

This patch

 - makes the test use tmp directory instead of the fixtures directory,
 - simplifies the code
 - moves the test to `parallel`.

PR-URL: https://github.com/nodejs/node/pull/2587

Reviewed-By: Rich Trott <rtrott@gmail.com>

http_parser: do not dealloc during kOnExecute

`freeParser` deallocates `Parser` instances early if they do not fit
into the free list. This does not play well with recent socket
consumption change, because it will try to deallocate the parser while
executing on its stack.

Regression was introduced in: 1bc4468

Fix: https://github.com/nodejs/node/issues/2928
PR-URL: https://github.com/nodejs/node/pull/2956
Reviewed-by: Trevor Norris <trev.norris@gmail.com>

doc: clarify description of assert.ifError()

This fixes a few typographical errors (comma splices and the like) and
clarifies the description of assert.ifError(). It also standardizes the
document on "inequality" rather than having both "inequality" and "non-
equality".

PR-URL: https://github.com/nodejs/node/pull/2941
Reviewed-By: Michaël Zasso <mic.besace@gmail.com>
Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>

http: guard against response splitting in trailers

Commit 3c293ba ("http: protect against response splitting attacks")
filters out newline characters from HTTP headers but forgot to apply
the same logic to trailing HTTP headers, i.e., headers that come after
the response body.  This commit rectifies that.

The expected security impact is low because approximately no one uses
trailing headers.  Some HTTP clients can't even parse them.

PR-URL: https://github.com/nodejs/node/pull/2945
Reviewed-By: Сковорода Никита Андреевич <chalkerx@gmail.com>
Reviewed-By: Rod Vagg <r@va.gg>

test: test more http response splitting scenarios

The test verified the output of http.OutgoingMessage#writeHead() but
not http.OutgoingMessage#setHeader().  Also check the response body.

PR-URL: https://github.com/nodejs/node/pull/2945
Reviewed-By: Сковорода Никита Андреевич <chalkerx@gmail.com>
Reviewed-By: Rod Vagg <r@va.gg>

test: add test-spawn-cmd-named-pipe

Adding a Windows test to verify that a node process spawned via
cmd with named pipes can access its stdio streams.

Ref: https://github.com/nodejs/node-v0.x-archive/issues/7345

PR-URL: https://github.com/nodejs/node/pull/2770
Reviewed-By: cjihrig - Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: thefourtheye - Sakthipriyan Vairamani <thechargingvolcano@gmail.com>
Reviewed-By: evanlucas - Evan Lucas <evanlucas@me.com>

readline: fix tab completion bug

This fixes a problem where tab completion is empty when the input
stream column size is undefined. As a solution we can force maxColumns
to 1 in this scenario.

PR-URL: https://github.com/nodejs/node/pull/2816
Fixes: https://github.com/nodejs/node/issues/2396
Reviewed-By: Roman Reiss <me@silverwind.io>

buffer: don't set zero fill for zero-length buffer

Instantiating a Buffer of length zero would set the kNoZeroFill flag to
true but never actually call ArrayBuffer::Allocator(). Which means the
flag was never set back to false. The result was that the next
allocation would unconditionally not be zero filled.

Add test to ensure Uint8Array's are zero-filled after creating a Buffer
of length zero. This test may falsely succeed, but will not falsely fail.

Fix: https://github.com/nodejs/node/issues/2930
PR-URL: https://github.com/nodejs/node/pull/2931
Reviewed-By: Rod Vagg <rod@vagg.org>

doc: refine process.kill() and exit explanations

Add corrections about when exit event fires and how .kill() works on
Windows.

PR-URL: https://github.com/nodejs/node/pull/2918
Reviewed-By: Sam Roberts <vieuxtech@gmail.com>

src: honor --abort_on_uncaught_exception flag

Fix regression introduced in 0af4c9ea7434e4f505dbe071357e4bc3b4ab2a8a
that ignores the --abort-on-uncaught-exception flag. Prior to that
commit, the flag was passed through to v8. After that commit, the
process just calls exit(1).

PR-URL: https://github.com/nodejs/node/pull/2776
Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Brian White <mscdex@mscdex.net>
Reviewed-by: Trevor Norris <trev.norris@gmail.com>

src: Add ABORT macro

Windows 8+ compiled in Release mode exits with code 0xC0000409 when
abort() is called. This prevents us from being able to reliably verify
an abort exit code (3) on windows.

PR-URL: https://github.com/nodejs/node/pull/2776
Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Brian White <mscdex@mscdex.net>
Reviewed-by: Trevor Norris <trev.norris@gmail.com>

build: fix icutrim when building small-icu on BE

Fix a build error that occurs when icutrim is run to cut down
the ICU locale set on Big-Endian platforms when building with
--with-intl=small-icu (which is done by the "make binary" target).
This fixes the binary build on POWER platforms.

Fixes: https://github.com/nodejs/node/issues/2601
PR-URL: https://github.com/nodejs/node/pull/2602
Reviewed-By: Steven Loomis <srloomis@us.ibm.com>

test: make cluster tests more time tolerant

Port https://github.com/nodejs/node-v0.x-archive/commit/f3f4e282168d243610f8e0241d633ff941c9c260
to master, updating to guard changes for AIX as requested

PR-URL: https://github.com/nodejs/node/pull/2891
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com>

test: update cwd-enoent tests for AIX

On AIX you can not remove a directory that you are currently inside of
as it results in an EBUSY error. "EBUSY: resource busy or locked".
Updated the tests accordingly so that they are skipped on AIX.

PR-URL: https://github.com/nodejs/node/pull/2909
Reviewed-By: Ben Noordhuis <ben@strongloop.com>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>

Working on v4.1.1

Refs: https://github.com/nodejs/node/issues/2844
PR-URL: https://github.com/nodejs/node/pull/2889

2015-09-17, Version 4.1.0 (Stable) Release

Notable changes:

* buffer:
  - Buffers are now created in JavaScript, rather than C++. This increases the speed of buffer creation (Trevor Norris) https://github.com/nodejs/node/pull/2866.
  - `Buffer#slice()` now uses `Uint8Array#subarray()` internally, increasing `slice()` performance (Karl Skomski) https://github.com/nodejs/node/pull/2777.
* fs:
  - `fs.utimes()` now properly converts numeric strings, `NaN`, and `Infinity` (Yazhong Liu) https://github.com/nodejs/node/pull/2387.
  - `fs.WriteStream` now implements `_writev`, allowing for super-fast bulk writes (Ron Korving) https://github.com/nodejs/node/pull/2167.
* http: Fixed an issue with certain `write()` sizes causing errors when using `http.request()` (Fedor Indutny) https://github.com/nodejs/node/pull/2824.
* npm: Upgrade to version 2.14.3, see https://github.com/npm/npm/releases/tag/v2.14.3 for more details (Kat Marchán) https://github.com/nodejs/node/pull/2822.
* src: V8 cpu profiling no longer erroneously shows idle time (Oleksandr Chekhovskyi) https://github.com/nodejs/node/pull/2324.
* v8: Lateral upgrade to 4.5.103.33 from 4.5.103.30, contains minor fixes (Ali Ijaz Sheikh) https://github.com/nodejs/node/pull/2870.
  - This fixes a previously known bug where some computed object shorthand properties did not work correctly (https://github.com/nodejs/node/issues/2507).

Refs: https://github.com/nodejs/node/issues/2844
PR-URL: https://github.com/nodejs/node/pull/2889

deps: backport 6d32be2 from v8's upstream

Original commit message:

    [es6] Bound function name

    Instead of updating the SharedFuntionInfo set the name property on
    the function directly.

    BUG=v8:4278
    LOG=N
    R=verwaest@chromium.org, littledan@chromium.org
    CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

    Review URL: https://codereview.chromium.org/1227523003

    Cr-Commit-Position: refs/heads/master@{#29558}

Fixes: https://github.com/nodejs/node/issues/2754
PR-URL: https://github.com/nodejs/node/pull/2916
Reviewed-By: Fedor Indutny <fedor@indutny.com>
Reviewed-By: Trevor Norris <trev.norris@gmail.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

deps: backport 0d01728 from v8's upstream

Original commit message:

    [objects] do not visit ArrayBuffer's backing store

    ArrayBuffer's backing store is a pointer to external heap, and
    can't be treated as a heap object. Doing so will result in
    crashes, when the backing store is unaligned.

    See: https://github.com/nodejs/node/issues/2791

    BUG=chromium:530531
    R=mlippautz@chromium.org
    LOG=N

    Review URL: https://codereview.chromium.org/1327403002

    Cr-Commit-Position: refs/heads/master@{#30771}

Fix: https://github.com/nodejs/node/issues/2791
PR-URL: https://github.com/nodejs/node/pull/2912
Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com>
Reviewed-By: Trevor Norris <trev.norris@gmail.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

test: use tmp directory in chdir test

This patch

 - makes chdir test to use the tmp directory
 - moves the test to parallel
 - renames the file to test-process-chdir as chdir is in process module

PR-URL: https://github.com/nodejs/node/pull/2589
Reviewed-By: Brendan Ashworth <brendan.ashworth@me.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>

doc: process exit event is not guaranteed to fire

This change:

* notes that the exit event is not guaranteed to fire
* provides an example situation where the exit event may not fire
* makes a minor copyediting change
* enforces 80 character wrap in one place where it was not honored

Fixes: https://github.com/nodejs/node/issues/2853
PR-URL: https://github.com/nodejs/node/pull/2861
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

test: fix Buffer OOM error message

Now that Buffers instantiate the Uint8Array in JS the error message has
changed in case the allocation fails due to OOM. Tests have been updated
to match.

PR-URL: https://github.com/nodejs/node/pull/2915
Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com>
Reviewed-By: Michaël Zasso <mic.besace@gmail.com>

src: null env_ field from constructor

The env_ field in ArrayBufferAllocator needs to be null'd out since it
is used during initialization and checked prior to properly being set by
set_env().

Fixes: 74178a5 "buffer: construct Uint8Array in JS"
PR-URL: https://github.com/nodejs/node/pull/2913
Reviewed-By: Fedor Indutny <fedor@indutny.com>

doc: remove incorrect reference to TCP in net docs

createServer() can create socket of types other than TCP.

PR-URL: https://github.com/nodejs/node/pull/2903
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>

doc: correct buffer.slice arg syntax

PR-URL: https://github.com/nodejs/node/pull/2903
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>

doc: describe spawn option.detached

PR-URL: https://github.com/nodejs/node/pull/2903
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>

timer: ref/unref return self

Most calls to ref() and unref() are chainable, timers should be
chainable, too.

Typical use:

    var to = setTimeout(ontimeout, 123).unref();

PR-URL: https://github.com/nodejs/node/pull/2905
Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Trevor Norris <trevnorris@nodejs.org>

buffer: always allocate typed arrays outside heap

By default v8 allocates typed arrays <= 64 bytes inside the v8 heap. In
these cases the memory pointer returned by Buffer::Data() can change
while the memory is being operated on. Resolve by passing a flag that
forces all typed arrays outside the v8 heap.

Fixes: 74178a5 "buffer: construct Uint8Array in JS"
PR-URL: https://github.com/nodejs/node/pull/2893
Reviewed-By: Fedor Indutny <fedor@indutny.com>

buffer: construct Uint8Array in JS

Overall construction time of Typed Arrays is faster in JS, but the
problem with using it normally is zero-fill of memory. Get around this
by using a flag in the ArrayBuffer::Allocator to trigger when memory
should or shouldn't be zero-filled.

Remove Buffer::Create() as it is no longer called.

The creation of the Uint8Array() was done at each callsite because at
the time of this patch there was a performance penalty for centralizing
the call in a single function.

PR-URL: https://github.com/nodejs/node/pull/2866
Reviewed-By: Fedor Indutny <fedor@indutny.com>

http: default Agent.getName to 'localhost'

Refactor out the if/else statement checking for option.host.
Add whitespace to make concatenation chunks more readable and
consistent with the https version of Agent.getName().

PR-URL: https://github.com/nodejs/node/pull/2825
Reviewed-By: Julian Duque <julianduquej@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>

src: use subarray() in Buffer#slice() for speedup

Use the built-in Typed Array method subarray() to improve performance of
Buffer#slice().

Benchmark improvements:

    benchmark/buffer-slice: 40%
    benchmark/buffer-creation (pool): 25%

Additional tests also added.

PR-URL: https://github.com/nodejs/node/pull/2777
Reviewed-By: Trevor Norris <trev.norris@gmail.com>
Reviewed-By: Сковорода Никита Андреевич <chalkerx@gmail.com>

tsc: adjust TSC membership for IBM+StrongLoop

Following the IBM+StrongLoop announcement last week, we
(@piscisaureus, @bnoordhuis, @srl295, @mhdawson, and myself)
want to take a moment to reiterate our personal commitment
to Node.js and the Foundation.

Per the TSC rules, any one company is limited to no more than
1/4 of the voting seats on the TSC and after talking it over
amongst ourselves, @srl295 and @mhdawson have elected to step
back from the TSC for now.

What I would propose is that they continue to participate in the
weekly TSC meetings as observers; and that once the membership
expands, they be considered once again for full TSC status.

Both Steven and Michael will continue to be actively involved
with Node.js. Both are active members of various Working Groups.
(Michael chairs the Benchmarking workgroup and Steven chairs the
Intl workgroup.)

/cc @nodejs/tsc

Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com>
Reviewed-By: Fedor Indutny <fedor@indutny.com>
Reviewed-By: Alexis Campailla <orangemocha@nodejs.org>
Reviewed-By: Rod Vagg <r@va.gg>
Reviewed-By: Trevor Norris <trevnorris@nodejs.org>
PR-URL: https://github.com/nodejs/node/pull/2858

doc: rename from iojs(1) to node(1) in benchmarks

Examples in the benchmark readme previously sill referenced iojs(1).

PR-URL: https://github.com/nodejs/node/pull/2884
Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com>

doc: add missing backtick in buffer.markdown

Fixes: https://github.com/nodejs/node/issues/2880
PR-URL: https://github.com/nodejs/node/pull/2881
Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com>

build: Updates to enable AIX support

These are the core changes that allow AIX to compile.  There
are still some test failures as there are some patches needed for
libuv and npm that we'll need to contribute through those
communities but this set allows node to be built on AIX and
pass most of the core tests

The change in js2c is because AIX does not support $ in
identifier names.  See the discussion/agreement in
https://github.com/nodejs/node/issues/2272

PR-URL: https://github.com/nodejs/node/pull/2364
Reviewed-By: Ben Noordhuis <ben@strongloop.com>
Reviewed-By: Rod Vagg <r@va.gg>

deps: upgrade V8 to 4.5.103.33

This brings in the patches from 4.5.103.30...4.5.103.33 fixing the issue with
computed property names not working in nested literals.

Full V8 4.5 commit log at:
https://chromium.googlesource.com/v8/v8.git/+log/branch-heads/4.5

Fixes: https://github.com/nodejs/node/issues/2507
PR-URL: https://github.com/nodejs/node/pull/2870
Reviewed-By: indutny - Fedor Indutny <fedor.indutny@gmail.com>
Reviewed-By: targos - Michaël Zasso <mic.besace@gmail.com>
Reviewed-By: bnoordhuis - Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: fishrock123 - Jeremiah Senkpiel <fishrock123@rocketmail.com>

test: fix default value for additional param

In Python, the default values of parameters are evaluated only once
during their declaration. So, whenever the default parameter is used
the same object will be used. Since we use a list, which is a mutable
object, this could lead to unexpected results.

PR-URL: https://github.com/nodejs/node/pull/2553
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

tools: enable arrow functions in .eslintrc

As of v8 4.5, arrow functions are rolled out. This patch allows eslint
to accept arrow functions as well.

PR-URL: #2840
Reviewed-By: Roman Reiss <me@silverwind.io>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>

build: clean up the generated tap file

Make `make clean` cleanup the generated tap file as well.

Fixes: #2834

PR-URL: #2837
Reviewed-By: Johan Bergström <bugs@bergstroem.nu>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Rod Vagg <rod@vagg.org>
Reviewed-By: Alexis Campailla <orangemocha@nodejs.org>

tools: open `test.tap` file in write-binary mode

By default the logfile is opened in append mode. This commit makes sure
that the file is opened in write-binary mode, so that the file will be
created if it doesn't exist or overwrite if it exists.

Fixes: #2834

PR-URL: #2837
Reviewed-By: Johan Bergström <bugs@bergstroem.nu>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Rod Vagg <rod@vagg.org>
Reviewed-By: Alexis Campailla <orangemocha@nodejs.org>

streams: refactor LazyTransform to internal/

This commit refactors LazyTransform from the crypto implementation
(lib/crypto.js) into an internal module (not publicy accessible) in
internal/streams/lazy_transform.js. This promotes a more modular core
design and removes code bloat in crypto, as LazyTransform didn't
specifically have anything to do with cryptography, but rather a fast
way to support two APIs on a stream.

PR-URL: https://github.com/nodejs/node/pull/2566
Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>

fs: consider NaN/Infinity in toUnixTimestamp

PR-URL: https://github.com/nodejs/node/pull/2387
Reviewed-By: Trevor Norris <trev.norris@gmail.com>

http_server: fix resume after socket close

Socket resume may happen on a next tick, and in following scenario:

1. `socket.resume()`
2. `socket._handle.close()`
3. `socket._handle = null;`

The `_resume` will be invoked with empty `._handle` property. There is
nothing bad about it, and we should just ignore the `resume`/`pause`
events in this case.

Same applies to the unconsuming of socket on adding `data` and/or
`readable` event listeners.

Fix: https://github.com/nodejs/node/issues/2821

PR-URL: https://github.com/nodejs/node/pull/2824
Reviewed-By: Сковорода Никита Андреевич <chalkerx@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com>

deps: upgraded to node-gyp@3.0.3 in npm

No more cherry-picked io patches. hooray.

PR-URL: https://github.com/nodejs/node/pull/2822
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com>

deps: upgrade to npm 2.14.3

PR-URL: https://github.com/nodejs/node/pull/2822
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com>

fs: implemented WriteStream#writev

Streams with writev allow many buffers to be pushed to underlying OS
APIs in one batch, in this case improving write throughput by an order
of magnitude. This is especially noticeable when writing many (small)
buffers.

PR-URL: https://github.com/nodejs/node/pull/2167
Reviewed-By: Trevor Norris <trev.norris@gmail.com>

tools: add missing tick processor polyfill

The polyfill is only needed if incorrect command line arguments
are passed to the script so it was missed in initial testing.

PR-URL: https://github.com/nodejs/node/pull/2694
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>