* v8: backport CVE-2013-6668

* openssl: Update to v1.0.1i

* npm: Update to v1.4.23

* cluster: disconnect should not be synchronous (Sam Roberts)

* fs: fix fs.readFileSync fd leak when get RangeError (Jackson Tian)

* stream: fix Readable.wrap objectMode falsy values (James Halliday)

* timers: fix timers with non-integer delay hanging. (Julien Gilli)

This reverts commit 181b8a5d.

Original commit message:

    Fix Hydrogen bounds check elimination

    When combining bounds checks, they must all be moved before the first load/store
    that they are guarding.

    BUG=chromium:344186
    LOG=y
    R=svenpanne@chromium.org

    Review URL: https://codereview.chromium.org/172093002

    git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@19475 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

fix #8070

Original source:

http://openssl.6102.n7.nabble.com/PATCH-s-client-Fix-keypress-requirement-with-redirected-input-on-Windows-td46787.html



Reviewed-By: Fedor Indutny <fedor@indutny.com>

Send messages until both the parent and the child process have received
at least one message. If at least one of them doesn't receive any
message, the test runner will make the test timeout.

Fixes #8046.

Fixes #6361.

Supresses a very loud warning from GCC 4.8 about unused typedefs

Original url https://codereview.chromium.org/69413002

When backporting f8193ab3 into v0.10, a regression was introduced. Timers
with non-integer timeout could trigger a infinite recursion with 100%
cpu usage. This commit backports 93b06246 which fixes the regression.

After backporting f8193ab3, instead of using Date.now(), timers would use
Timer.now() to determine if they had expired. However, Timer.now() is
based on loop->time, which is not updated when a timer's remaining time
is > 0 and < 1. Timers would thus never timeout if their remaining time
was at some point > 0 and < 1.

With this commit, Timer.now() updates loop->time itself, and timers
always timeout eventually.

Fixes #8065 and #8068.

Callbacks in node are usually asynchronous, and should never be
sometimes synchronous, and sometimes asynchronous.

Reviewed-by: Trevor Norris <trev.norris@gmail.com>

A streams1 stream will have its falsy values such as 0, false, or ""
eaten by the upgrade to streams2, even when objectMode is enabled.

Include test for said cases.

Reviewed-by: isaacs <i@izs.me>
Reviewed-by: Trevor Norris <trev.norris@gmail.com>

Reviewed-By: Fedor Indutny <fedor@indutny.com>

* uv: Upgrade to v0.10.28

* npm: Upgrade to v1.4.21

* v8: Interrupts must not mask stack overflow.

* Revert "stream: start old-mode read in a next tick" (Fedor Indutny)

* buffer: fix sign overflow in `readUIn32BE` (Fedor Indutny)

* buffer: improve {read,write}{U}Int* methods (Nick Apperson)

* child_process: handle writeUtf8String error (Fedor Indutny)

* deps: backport 4ed5fde4f from v8 upstream (Fedor Indutny)

* deps: cherry-pick eca441b2 from OpenSSL (Fedor Indutny)

* lib: remove and restructure calls to isNaN() (cjihrig)

* module: eliminate double `getenv()` (Maciej Małecki)

* stream2: flush extant data on read of ended stream (Chris Dickinson)

* streams: remove unused require('assert') (Rod Vagg)

* timers: backport f8193ab3 (Julien Gilli)

* util.h: interface compatibility (Oguz Bastemur)

* zlib: do not crash on write after close (Fedor Indutny)

Backport of https://codereview.chromium.org/339883002

`process.env` access results in a synchronous `getenv` call. Cache the
first result instead and save one syscall.

Original commit message:

 timers: use uv_now instead of Date.now

 This saves a few calls to gettimeofday which can be expensive, and
 potentially subject to clock drift. Instead use the loop time which
 uses hrtime internally.

In addition to the backport, this commit:
 - keeps _idleStart timers' property which is still set to
   Date.now() to avoid breaking existing code that uses it, even if
   its use is discouraged.
 - adds automated tests. These tests use a specific branch of
   libfaketime that hasn't been submitted upstream yet. libfaketime
   is git cloned if needed when running automated tests.

Signed-off-by: Timothy J Fontaine <tjfontaine@gmail.com>

fix #8026

Reviewed-By: Fedor Indutny <fedor@indutny.com>

`|` operation takes precendence on `+`, which will result in
`new Buffer('ffffffff', 16).readUInt32BE(0)` returning `-1` instead of
`ffffffff`.

fix #7963

Documentation claimed it accepted a single label argument, as time and
timeEnd do, which was incorrect.

Signed-off-by: Fedor Indutny <fedor@indutny.com>

Expose missing constants and keep symbols on OSX.

Original commit message:

    Fix x64 MathMinMax for negative untagged int32 arguments.

    An untagged int32 has zeros in the upper half even if it is negative.
    Using cmpq to compare such numbers will incorrectly ignore the sign.

    BUG=164442
    R=mvstanton@chromium.org

    Review URL: https://chromiumcodereview.appspot.com/11665007

    git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@13273

 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Signed-off-by: Fedor Indutny <fedor@indutny.com>

Pass `-force_load` to linker when linking to `libv8_base` to preserve
`v8dbg_` symbols, which are useful for debugging.

A ReadableStream with a base64 StringDecoder backed by only
one or two bytes would fail to output its partial data before
ending. This fix adds a check to see if the `read` was triggered
by an internal `flow`, and if so, empties any remaining data.

fixes #7914.

Signed-off-by: Fedor Indutny <fedor@indutny.com>

When handling `writeUtf8String` error, return after emitting it.
Otherwise a runtime failure can occur.

fix #7923

Switch condition order to check for null before calling isNaN().
Also remove two unnecessary calls to isNaN() that are already
covered by calls to isFinite(). This commit targets v0.10, as
opposed to #7891, which targets master (suggested by
@bnoordhuis). Closes #7840.

Signed-off-by: Fedor Indutny <fedor@indutny.com>