Refs: https://github.com/nodejs/node/issues/22160

PR-URL: https://github.com/nodejs/node/pull/22328


Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Gus Caplan <me@gus.host>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>

Refs: https://github.com/whatwg/url/commit/6ef17ebe1220a7e7c0cfff0785017502ee18808b
PR-URL: https://github.com/nodejs/node/pull/22022


Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

The signature of EmbedderGraph::AddEdge() has been changed so
the current implementation of JSGraph no longer compiles.
This patch updates the implementation accordingly.

PR-URL: https://github.com/nodejs/node/pull/22106
Refs: https://github.com/v8/v8/commit/6ee834532d6f924f6057584085fa79b4777c396a


Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: James M Snell <jasnell@gmail.com>

Original commit message:

    [heap-profiler] Allow embedder to specify edge names

    This patch adds a variant of EmbedderGraph::AddEdge() which
    allows the embedder to specify the name of an edge. The edges
    added without name are element edges with auto-incremented indexes
    while the edges added with names will be internal edges with
    the specified names for more meaningful output in the heap
    snapshot.

    Refs: https://github.com/nodejs/node/pull/21741
    Bug: v8:7938
    Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
    Change-Id: I8feefa2cf6911743e24b3b2024e0e849b0c65cd3
    Reviewed-on: https://chromium-review.googlesource.com/1133299


    Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#54412}

Refs: https://github.com/v8/v8/commit/6ee834532d6f924f6057584085fa79b4777c396a

PR-URL: https://github.com/nodejs/node/pull/22106


Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: James M Snell <jasnell@gmail.com>

Document how pipes can be chained in readable.pipe().
Document that zlib.Zlib inherits from stream.Transform.

PR-URL: https://github.com/nodejs/node/pull/22354
Fixes: https://github.com/nodejs/node/issues/22341


Reviewed-By: Vse Mozhet Byt <vsemozhetbyt@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/22104
Fixes: https://github.com/nodejs/node/issues/21230


Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: John-David Dalton <john.david.dalton@gmail.com>

Currently V8 only checks that the length of the source code is the
same as the code used to generate the hash, so we add an additional
check here:

1. During compile time, when generating node_javascript.cc and
   node_code_cache.cc, we compute and include the hash of the
  (unwrapped) JavaScript source in both.
2. At runtime, we check that the hash of the code being compiled
  and the hash of the code used to generate the cache
  (inside the wrapper) is the same.

This is based on the assumptions:

1. `internalBinding('code_cache_hash')` must be in sync with
   `internalBinding('code_cache')` (same C++ file)
2. `internalBinding('natives_hash')` must be in sync with
   `process.binding('natives')` (same C++ file)
3. If `internalBinding('natives_hash')` is in sync with
   `internalBinding('natives_hash')`, then the (unwrapped)
   code used to generate `internalBinding('code_cache')`
   should be in sync with the (unwrapped) code in
   `process.binding('natives')`

There will be, however, false positives if the wrapper used
to generate the cache is different from the one used at run time,
and the length of the wrapper somehow stays the same.
But that should be rare and can be eased once we make the
two bootstrappers cached and checked as well.

PR-URL: https://github.com/nodejs/node/pull/22152


Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Tiancheng "Timothy" Gu <timothygu99@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Gus Caplan <me@gus.host>

`deps/v8/third_party/jinja2/LICENSE` is not in upstream v8,
and contains CRLF, which is in conflict with `deps/v8/.gitattributes`
which sets all text files to use LF.
This has caused failures in CI workers with older versions of Git.
This patch manually fixes up the file to use LF to resolve
the conflict.

The file has already been fixed in upstream jinja2,
which is pull into our repo when we update V8 so it should
be fixed the next time we update V8.

PR-URL: https://github.com/nodejs/node/pull/22340
Refs: https://github.com/nodejs/build/issues/1443
Refs: https://github.com/nodejs/reliability/issues/12
Refs: https://github.com/nodejs/build/issues/1453
Refs: https://chromium-review.googlesource.com/c/993812/


Reviewed-By: Richard Lau <riclau@uk.ibm.com>
Reviewed-By: João Reis <reis@janeasystems.com>
Reviewed-By: Matheus Marchini <matheus@sthima.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Jon Moss <me@jonathanmoss.me>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: James M Snell <jasnell@gmail.com>

Track state of async_hooks trace event category enablement.
Enable/disable the async_hooks trace event dynamically.

PR-URL: https://github.com/nodejs/node/pull/22128


Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Andreas Madsen <amwebdk@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/22232


Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: George Adams <george.adams@uk.ibm.com>

Fixes a rare race condition on modpending when two native modules are
loaded simultaneously on different threads by storing it thread-
locally.

PR-URL: https://github.com/nodejs/node/pull/21611


Reviewed-By: Gabriel Schulhof <gabriel.schulhof@intel.com>
Reviewed-By: Anatoli Papirovski <apapirovski@mac.com>

Since we are CI testing on x64 hosts, we can only commit to x64 hosts.

PR-URL: https://github.com/nodejs/node/pull/21443
Refs: https://github.com/nodejs/node/issues/21402
Refs: https://github.com/nodejs/node/pull/21437


Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Matheus Marchini <matheus@sthima.com>
Reviewed-By: João Reis <reis@janeasystems.com>

Skip one specific test that requires ICU

Fixes: https://github.com/nodejs/node/issues/19051

PR-URL: https://github.com/nodejs/node/pull/22265


Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: Richard Lau <riclau@uk.ibm.com>
Reviewed-By: Tiancheng "Timothy" Gu <timothygu99@gmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>

PR-URL: https://github.com/nodejs/node/pull/22271


Reviewed-By: Tiancheng "Timothy" Gu <timothygu99@gmail.com>

CVE-2018-12115
Discovered by ChALkeR - Сковорода Никита Андреевич
Fix by Anna Henningsen

Writing to the second-to-last byte with UCS-2 encoding will cause a -1
length to be send to String::Write(), writing all of the provided Buffer
from that point and beyond.

Fixes: https://github.com/nodejs-private/security/issues/203
PR-URL: https://github.com/nodejs-private/node-private/pull/138

CVE-2018-7166
Discovered by ChALkeR - Сковорода Никита Андреевич

Prevent Buffer.alloc(size, fill, number) from returning uninitialized memory.

Fixes: https://github.com/nodejs-private/security/issues/202
PR-URL: https://github.com/nodejs-private/node-private/pull/137


Reviewed-By: Rod Vagg <rod@vagg.org>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Evan Lucas <evanlucas@me.com>
Reviewed-By: Сковорода Никита Андреевич <chalkerx@gmail.com>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>

In short: `ServerResponse` acutally inherits from `OutgoingMessage`,
with a series of methods like those in `Stream.Writable`. So we cannot
use `implements`(this has made poeple feel puzzled because there are
still many methods we don't need or have), so `inherits from Stream` is
enough, due to some core reasons and performance told by mcollina from
the ref (See some latest discussions at Ref).

Ref: https://github.com/nodejs/node/issues/14146.
PR-URL: https://github.com/nodejs/node/pull/22305


Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Vse Mozhet Byt <vsemozhetbyt@gmail.com>
Reviewed-By: Jon Moss <me@jonathanmoss.me>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

Notable changes:

* buffer:
  * Fix out-of-bounds (OOB) write in `Buffer.write()` for UCS-2 encoding
    (CVE-2018-12115)
  * Fix unintentional exposure of uninitialized memory in `Buffer.alloc()`
    (CVE-2018-7166)
* deps:
  * Upgrade to OpenSSL 1.1.0i, fixing:
    - Client DoS due to large DH parameter (CVE-2018-0732)
    - ECDSA key extraction via local side-channel (CVE not assigned)
  * Upgrade V8 from 6.7 to 6.8 (Michaël Zasso) #21079
    - Memory reduction and performance improvements, details at:
      https://v8project.blogspot.com/2018/06/v8-release-68.html
* http: `http.get()` and `http.request()` (and `https` variants) can now accept
  three arguments to allow for a `URL` _and_ an `options` object
  (Sam Ruby) #21616
* Added new collaborators
  * Sam Ruby (https://github.com/rubys)
  * George Adams (https://github.com/gdams)

This is a security release. All Node.js users should consult the
security release summary at:

  https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/

for details on patched vulnerabilities.

Fixes for the following CVEs are included in this release:

  * CVE-2018-0732 (OpenSSL)
  * CVE-2018-12115 (Node.js)

Notable changes:

* buffer: Fix out-of-bounds (OOB) write in `Buffer.write()` for UCS-2 encoding
  (CVE-2018-12115)
* deps: Upgrade to OpenSSL 1.0.2p, fixing:
  * Client DoS due to large DH parameter (CVE-2018-0732)
  * ECDSA key extraction via local side-channel (CVE not assigned)

This is a security release. All Node.js users should consult the
security release summary at:

  https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/

for details on patched vulnerabilities.

Fixes for the following CVEs are included in this release:

  * CVE-2018-0732 (OpenSSL)
  * CVE-2018-12115 (Node.js)

Notable changes:

* buffer: Fix out-of-bounds (OOB) write in `Buffer.write()` for UCS-2 encoding
  (CVE-2018-12115)
* deps: Upgrade to OpenSSL 1.0.2p, fixing:
  * Client DoS due to large DH parameter (CVE-2018-0732)
  * ECDSA key extraction via local side-channel (CVE not assigned)

After upgradeing OpenSSL-1.1.0i, two tests are failed due to changes
of error messages.

Ref: https://github.com/openssl/openssl/commit/45ae18b38401a027f231f1408e71b13ff3111021
Ref: https://github.com/openssl/openssl/commit/36d2517a97f6020049116492b4d5491d177e629c
PR-URL: https://github.com/nodejs/node/pull/22318


Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Rod Vagg <rod@vagg.org>

`cd deps/openssl/config; make` updates all archs dependant files.

PR-URL: https://github.com/nodejs/node/pull/22318


Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Rod Vagg <rod@vagg.org>

This is a floating patch against OpenSSL-1.1.0 to generate asm files
with Makefile rules and it is to be submitted to the upstream.

Fixes: https://github.com/nodejs/node/issues/4270
PR-URL: https://github.com/nodejs/node/pull/19794


Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Rod Vagg <rod@vagg.org>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>

This updates all sources in deps/openssl/openssl with openssl-1.1.0i.

PR-URL: https://github.com/nodejs/node/pull/22318


Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Rod Vagg <rod@vagg.org>

Fixes: https://github.com/nodejs/node/issues/20079

PR-URL: https://github.com/nodejs/node/pull/22252


Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>

This adds the number of hidden items in case INSPECT_MAX_BYTES is
exceeded.

PR-URL: https://github.com/nodejs/node/pull/22289


Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

`exec`'s parameters are now deconstructored through
`normalizeExecArgs.apply`. We don't need an exclipit parameter anymore
(and in fact it's NEVER referred in the code directly), like `spwan` or
`spwanSync`. This might be missing.

PR-URL: https://github.com/nodejs/node/pull/22274


Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: George Adams <george.adams@uk.ibm.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Jon Moss <me@jonathanmoss.me>

They should be aligned with all other empty objects. Therefore the
whitespace is removed and they got a fast path for that.

PR-URL: https://github.com/nodejs/node/pull/22284


Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Gus Caplan <me@gus.host>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Minwoo Jung <minwoo@nodesource.com>

This adds a smarter logic to compare object keys (including symbols)
and it also skips the object key comparison for (typed) arrays, if
possible.

Besides that it adds a fast path for empty objects, arrays, sets and
maps and fast paths for sets and maps with an unequal size.

On top of that a few functions are now safer to call by using
uncurryThis and by caching the actual function.

Overall, this is a significant performance boost for comparisons.

PR-URL: https://github.com/nodejs/node/pull/22258


Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>

v8 6.8 supports all removed flags. For example for BigInt.

PR-URL: https://github.com/nodejs/node/pull/22285


Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

For very special sparse arrays it was possible that util.inspect
visualized the entries not in the intended way.

PR-URL: https://github.com/nodejs/node/pull/22283


Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>

Calling `formatValue()` directly requires the indentation level to
be set manually. This was not the case so far in most cases and the
indentation was off in all these cases.

PR-URL: https://github.com/nodejs/node/pull/22291


Reviewed-By: Gus Caplan <me@gus.host>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: James M Snell <jasnell@gmail.com>

Refs: https://github.com/nodejs/node/issues/15985

PR-URL: https://github.com/nodejs/node/pull/22330


Reviewed-By: Rod Vagg <rod@vagg.org>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Refael Ackermann <refack@gmail.com>

Refs: https://github.com/nodejs/node/issues/21425

PR-URL: https://github.com/nodejs/node/pull/22330


Reviewed-By: Rod Vagg <rod@vagg.org>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Refael Ackermann <refack@gmail.com>

Selectively fallthrough `process.binding()` to `internalBinding()`

Refs: https://github.com/nodejs/node/pull/22163

PR-URL: https://github.com/nodejs/node/pull/22269


Reviewed-By: Gus Caplan <me@gus.host>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Jon Moss <me@jonathanmoss.me>
Reviewed-By: John-David Dalton <john.david.dalton@gmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>

Remove "consists of" in favor of "is". Use "fragment identifier" instead
of "fragment" and remove quotes.

PR-URL: https://github.com/nodejs/node/pull/22326


Reviewed-By: Vse Mozhet Byt <vsemozhetbyt@gmail.com>
Reviewed-By: Bryan English <bryan@bryanenglish.com>

It's an octothorp, but no one knows what that is either so let's just
show the character in the sentence and be done with it.

PR-URL: https://github.com/nodejs/node/pull/22326


Reviewed-By: Vse Mozhet Byt <vsemozhetbyt@gmail.com>
Reviewed-By: Bryan English <bryan@bryanenglish.com>

The "at sign" is properly the "commercial at" but let's just avoid the
whole naming issue by putting the symbol right in the sentence.

PR-URL: https://github.com/nodejs/node/pull/22324


Reviewed-By: Vse Mozhet Byt <vsemozhetbyt@gmail.com>
Reviewed-By: Bryan English <bryan@bryanenglish.com>

Simplify format explanation for urlObject.auth.

PR-URL: https://github.com/nodejs/node/pull/22324


Reviewed-By: Vse Mozhet Byt <vsemozhetbyt@gmail.com>
Reviewed-By: Bryan English <bryan@bryanenglish.com>

PR-URL: https://github.com/nodejs/node/pull/22324


Reviewed-By: Vse Mozhet Byt <vsemozhetbyt@gmail.com>
Reviewed-By: Bryan English <bryan@bryanenglish.com>