PR-URL: https://github.com/nodejs/node/pull/4218


Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com>
Reviewed-By: Ryan Graham <r.m.graham@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>

Hello everyone!

PR-URL: https://github.com/nodejs/node/pull/4220


Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com>
Reviewed-By: Ryan Graham <r.m.graham@gmail.com>
Reviewed-By: Calvin Metcalf <calvin.metcalf@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/4219


Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com>
Reviewed-By: Calvin Metcalf <calvin.metcalf@gmail.com>

Different sections said different things about what the `ca` argument
should look like.  This commit harmonizes them.

Ref: https://github.com/nodejs/node/pull/4099
PR-URL: https://github.com/nodejs/node/pull/4213


Reviewed-By: Roman Reiss <me@silverwind.io>

Scan the child process's stderr for an 'unknown flag' error message and
mark the test as skipped if found.

Fixes: https://github.com/nodejs/node/issues/3927
PR-URL: https://github.com/nodejs/node/pull/4204


Reviewed-By: Rich Trott <rtrott@gmail.com>

`assert.throws()` and `assert.doesNotThrow()` blow up with a `TypeError`
if used with an ES6 class that extends Error.

Fixes: https://github.com/nodejs/node/issues/3188
PR-URL: https://github.com/nodejs/node/pull/4166


Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

Some API doc referenced Node.js with "node" or "node.js". This commit
replaces these references.

PR-URL:https://github.com/nodejs/node/pull/4177


Reviewed-By: Evan Lucas <evanlucas@me.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Minwoo Jung <jmwsoft@gmail.com>

Before this change, configure used processor specific macro defines
(like __ARM_ARCH_6M__) to detect the arm processor version. This
changes configure to use __ARM_ARCH, that should be defined to the
correct version.

Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
PR-URL: https://github.com/nodejs/node/pull/4123

When cross compiling, GYP uses the variables CC_host and CXX_host to
find the host compiler, if they are defined. This ensures that
variable is used, if defined, when detecting the host architecture.

Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: James M Snell <jasnell@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/4117

Notable changes:

* build:
  - Add support for Intel's VTune JIT profiling when compiled with
    --enable-vtune-profiling. For more information about VTune, see
    https://software.intel.com/en-us/node/544211. (Chunyang Dai) #3785.
  - Properly enable V8 snapshots by default. Due to a configuration
    error, snapshots have been kept off by default when the intention
    is for the feature to be enabled. (Fedor Indutny) #3962.
* crypto:
  - Simplify use of ECDH (Elliptic Curve Diffie-Hellman) objects
    (created via crypto.createECDH(curve_name)) with private keys that
    are not dynamically generated via generateKeys(). The public key
    is now computed when explicitly setting a private key. Added
    validity checks to reduce the possibility of computing weak or
    invalid shared secrets. Also, deprecated the setPublicKey() method
    for ECDH objects as its usage is unnecessary and can lead to
    inconsistent state. (Michael Ruddy) #3511.
  - Update root certificates from the current list stored maintained
    by Mozilla NSS. (Ben Noordhuis) #3951.
  - Multiple CA certificates can now be passed with the ca option to
    TLS methods as an array of strings or in a single new-line
    separated string. (Ben Noordhuis) #4099
* tools: Include a tick processor in core, exposed via the
  --prof-process command-line argument which can be used to process V8
  profiling output files generated when using the --prof command-line
  argument. (Matt Loring) #4021.

PR-URL: https://github.com/nodejs/node/pull/4181

Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/4174

Before this commit you had to pass multiple CA certificates as an array
of strings.  For convenience you can now pass them as a single string.

Fixes: https://github.com/nodejs/node/issues/4096
PR-URL: https://github.com/nodejs/node/pull/4099


Reviewed-By: Fedor Indutny <fedor@indutny.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

Writing `// NOLINT(whitespace/if-one-line)` was not possible because the
directive was not listed in the list of known lint rules.  You can now.

PR-URL: https://github.com/nodejs/node/pull/4099


Reviewed-By: Fedor Indutny <fedor@indutny.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

remove a bunch of variables and rely on %configure_flags% where
possible, also allow for an external %config_flags% variable to supply
additional arguments to configure to match the behaviour of the Makefile

PR-URL: https://github.com/nodejs/node/pull/3399


Reviewed-By: Johan Bergström <bugs@bergstroem.nu>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: João Reis <reis@janeasystems.com>

Fix incorrect slicing of cleartext buffer in `TLSWrap::ClearOut`.

Fix: https://github.com/nodejs/node/issues/4161
PR-URL: https://github.com/nodejs/node/pull/4184


Reviewed-By: Brian White <mscdex@mscdex.net>

This change cleans up outstanding comments on #3032. It improves error
handling when no isolate file is provided and adds the --prof-process
flag to the node binary which executes the tick processor on the
provided isolate file.

PR-URL: https://github.com/nodejs/node/pull/4021


Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Evan Lucas <evanlucas@me.com>

Verify that start and end are coerced properly.

Ref: https://github.com/nodejs/node/pull/2919
PR-URL: https://github.com/nodejs/node/pull/4019


Reviewed-By: Trevor Norris <trev.norris@gmail.com>

If `start` is not a valid number in the range, then the default value
zero will be used. Same way, if `end` is not a valid number in the
accepted range, then, by default, the length of the buffer is assumed.

Fixes: https://github.com/nodejs/node/issues/2668
Ref: https://github.com/nodejs/node/pull/2919
PR-URL: https://github.com/nodejs/node/pull/4019


Reviewed-By: Trevor Norris <trev.norris@gmail.com>

Rename doNTCallback functions for clarity when profiling, these make
sense internally but the "NT" in particular is a bit obtuse to be
immediately understandable by non-core developers.

PR-URL: https://github.com/nodejs/node/pull/4167


Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Minwoo Jung <jmwsoft@gmail.com>

These changes simplify using ECDH with private keys that are not
dynamically generated with ECDH.generateKeys.

Support for computing the public key corresponding to the given private
key was added. Validity checks to reduce the possibility of computing
a weak or invalid shared secret were also added.

Finally, ECDH.setPublicKey was softly deprecated.

PR-URL: https://github.com/nodejs/node/pull/3511


Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Shigeki Ohtsu <ohtsu@iij.ad.jp>

If not running on Windows it skips the long path tests in:

* test-fs-long-path.js
* test-require-long-path.js

Fixes: https://github.com/nodejs/node/issues/2255
PR-URL: https://github.com/nodejs/node/pull/4116


Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Minwoo Jung <jmwsoft@gmail.com>

A lot of machines don't upgrade libstdc++.so library for a long time,
but the new version of node requires the latest GLIBCXX.

Using "--fully-static" configurable options may resolve this problem,
but the side effect is that the size of the executable file will be
increased.

Adding "--partly-static" configurable options it will only build
libgcc and libstdc++ libraries into executable file, resolve the
problem and control the size of file.

PR-URL: https://github.com/nodejs/node/pull/4152


Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Minwoo Jung <jmwsoft@gmail.com>

As it can happen that the HTTP response is received in more than
one TCP chunk.

PR-URL: https://github.com/nodejs/node/pull/3961


Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Fedor Indutny <fedor@indutny.com>
Reviewed-By: Minwoo Jung <jmwsoft@gmail.com>

If `.setEncoding` was called on input stream - all emitted `data` will
be `String`s instances, not `Buffer`s. This is unacceptable for
`StreamWrap`, and should not lead to the crash.

Fix: https://github.com/nodejs/node/issues/3970
PR-URL: https://github.com/nodejs/node/pull/4031


Reviewed-By: Colin Ihrig <cjihrig@gmail.com>

test-cluster-shared-leak is flaky on Windows.

Refs: https://github.com/nodejs/node/issues/3956

PR-URL: https://github.com/nodejs/node/pull/4162


Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Roman Klauke <romaaan.git@gmail.com>
Reviewed-By: Minwoo Jung <jmwsoft@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/3912


Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Evan Lucas <evanlucas@me.com>
Reviewed-By: Michaël Zasso <mic.besace@gmail.com>
Reviewed-By: Bert Belder <bertbelder@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>

Change url.format's references to slash postfixing to reflect
true behaviour (it only automatically postfixes slashes to the
slashedProtocols when host is present).

Fixes: #3361

PR-URL: https://github.com/nodejs/node/pull/4119


Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Roman Reiss <me@silverwind.io>
Reviewed-By: Minwoo Jung <jmwsoft@gmail.com>

Check if the worker 'isDead' instead of 'isConnected' as the
'disconnect' event is not guaranteed to be received before the
'exit' event.
Remove the 'net' dependency as it is not used.

PR-URL: https://github.com/nodejs/node/pull/3954


Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Michaël Zasso <mic.besace@gmail.com>
Reviewed-By: Minwoo Jung <jmwsoft@gmail.com>

The Buffer constructor will generally get inlined, but any call to the Buffer
constructor for a string without encoding will cause an eager deoptimization
of any function that inlined the Buffer constructor. This is due to a an
out-of-bounds read on `arguments[1]`. This change prevents that deopt.

PR-URL: https://github.com/nodejs/node/pull/4158


Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Trevor Norris <trev.norris@gmail.com>
Reviewed-By: Minwoo Jung <jmwsoft@gmail.com>

Pick up the latest patch-level from V8 stable. This includes the following fix:

* https://github.com/v8/v8/commit/c408ea72bff7e26cdf498e952133c4c191ecb30c
  Make AstRawString deduplication encoding-agnostic.

  BUG=v8:4450
  LOG=N
  R=hablich@chromium.org
  TBR=hablich@chromium.org

  Review URL: https://codereview.chromium.org/1494293003

See also: https://github.com/nodejs/node/pull/4128

PR-URL: https://github.com/nodejs/node/pull/4160


Reviewed-By: bnoordhuis - Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: targos - Michaël Zasso <mic.besace@gmail.com>

If JS throws an object whose toString() method throws, then Node
attempts to print an empty message, but actually prints garbage.
This commit checks for this case, and prints a message instead.

Fixes: https://github.com/nodejs/node/issues/4079
PR-URL: https://github.com/nodejs/node/pull/4112


Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Chris Dickinson <christopher.s.dickinson@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Minwoo Jung <jmwsoft@gmail.com>

Commit a9c0c65f ("src: define getpid() based on OS") made src/env.cc
use `GetCurrentProcessId()` on Windows for the PID in log messages.
`GetCurrentProcessId()` is also what is used by libuv, OpenSSL and V8.

This commit makes `process.pid` use `GetCurrentProcessId()` instead of
`_getpid()` for consistency.

PR-URL: https://github.com/nodejs/node/pull/4163


Reviewed-By: Brian White <mscdex@mscdex.net>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Rod Vagg <rod@vagg.org>

The modification time of a file is assumed to happen at the
exact time when it was requested. As the utime API specification
delcares that the resolution of the result is 1 second,
relax the constrain to 1 second helps the test case to be
robust and consistent under different load conditions in the system

PR-URL: https://github.com/nodejs/node/pull/3981


Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Minwoo Jung <jmwsoft@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/3998


Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>
Reviewed-By: Сковорода Никита Андреевич <chalkerx@gmail.com>
Reviewed-By: Minwoo Jung <jmwsoft@gmail.com>

Security Update

Notable items:

* **http**: Fix a bug where an HTTP socket may no longer have a socket
  but a pipelined request triggers a pause or resume, a potential
  denial-of-service vector. (Fedor Indutny)
* **openssl**: Upgrade to 1.0.2e, containing fixes for:
  - CVE-2015-3193 "BN_mod_exp may produce incorrect results on x86_64",
    an attack is considered feasible against DH, an attack against RSA
    and DSA is considered possible but unlikely, EC algorithms are not
    affected. Details are available at
    <http://openssl.org/news/secadv/20151203.txt>.
  - CVE-2015-3194 "Certificate verify crash with missing PSS parameter",
    a potential denial-of-service vector for Node.js TLS servers; TLS
    clients are also impacted. Details are available at
    <http://openssl.org/news/secadv/20151203.txt>.
  (Shigeki Ohtsu) #4134
* v8: Backport fixes for a bug in `JSON.stringify()` that can result
  in out-of-bounds reads for arrays. (Ben Noordhuis)

PR-URL: https://github.com/nodejs/node-private/pull/11

Security Update

Notable items:

* http: Fix a bug where an HTTP socket may no longer have a socket
  but a pipelined request triggers a pause or resume, a potential
  denial-of-service vector. (Fedor Indutny)
* openssl: Upgrade to 1.0.2e, containing fixes for:
  - CVE-2015-3193 "BN_mod_exp may produce incorrect results on x86_64",
    an attack is considered feasible against a Node.js TLS server using
    DHE key exchange. Details are available at
    <http://openssl.org/news/secadv/20151203.txt>.
  - CVE-2015-3194 "Certificate verify crash with missing PSS parameter",
    a potential denial-of-service vector for Node.js TLS servers; TLS
    clients are also impacted. Details are available at
    <http://openssl.org/news/secadv/20151203.txt>.
  (Shigeki Ohtsu) #4134
* v8: Backport fixes for a bug in `JSON.stringify()` that can result
  in out-of-bounds reads for arrays. (Ben Noordhuis)

PR-URL: https://github.com/nodejs/node-private/pull/12

Security Update

Notable items:

* http: Fix a bug where an HTTP socket may no longer have a socket but a
  pipelined request triggers a pause or resume, a potential
  denial-of-service vector. (Fedor Indutny)
* openssl: Upgrade to 1.0.1q, fixes CVE-2015-3194
  "Certificate verify crash with missing PSS parameter", a potential
  denial-of-service vector for Node.js TLS servers; TLS clients are also
  impacted. Details are available at
  <http://openssl.org/news/secadv/20151203.txt>. (Ben Noordhuis) #4133

PR-URL: https://github.com/nodejs/node-private/pull/13

Security Update

Notable items:

* build: Add support for Microsoft Visual Studio 2015
* npm: Upgrade to v1.4.29 from v1.4.28. A special one-off release as
  part of the strategy to get a version of npm into Node.js v0.10.x that
  works with the current registry
  (https://github.com/nodejs/LTS/issues/37). This version of npm prints
  out a banner each time it is run. The banner warns that the next
  standard release of Node.js v0.10.x will ship with a version of npm
  v2.
* openssl: Upgrade to 1.0.1q, containing fixes CVE-2015-3194
  "Certificate verify crash with missing PSS parameter", a potential
  denial-of-service vector for Node.js TLS servers; TLS clients are also
  impacted. Details are available at
  <http://openssl.org/news/secadv/20151203.txt>. (Ben Noordhuis)
  #4133

PR-URL: https://github.com/nodejs/node-private/pull/15

PR-URL: https://github.com/nodejs/node/pull/2806

PR-URL: https://github.com/nodejs/node/pull/4138


Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Minwoo Jung <jmwsoft@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>