Notable changes

* openssl: Upgrade to 1.0.2d, fixes CVE-2015-1793 (Alternate Chains
Certificate Forgery).
* npm: Upgraded to v2.12.1, release notes can be found in
https://github.com/npm/npm/releases/tag/v2.12.0 and
https://github.com/npm/npm/releases/tag/v2.12.1 (Kat Marchán)
https://github.com/nodejs/io.js/pull/2112.

They should be updated according to the fix at
https://github.com/openssl/openssl/commit/b4f0d1a4a89b964dba80036a6348ca0a1913c526

PR-URL: https://github.com/nodejs/io.js/pull/2141


Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

This just replaces all sources of openssl-1.0.2d.tar.gz
into deps/openssl/openssl

deps: copy all openssl header files to include dir

All symlink files in `deps/openssl/openssl/include/openssl/`
 are removed and replaced with real header files to avoid
issues on Windows.

deps: fix openssl assembly error on ia32 win32

`x86masm.pl` was mistakenly using .486 instruction set, why `cpuid` (and
perhaps others) are requiring .686 .

Fixes: https://github.com/iojs/io.js/issues/589
PR-URL: https://github.com/iojs/io.js/pull/1389


Reviewed-By: Fedor Indutny <fedor@indutny.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Shigeki Ohtsu <ohtsu@iij.ad.jp>

deps: fix asm build error of openssl in x86_win32

See
https://mta.openssl.org/pipermail/openssl-dev/2015-February/000651.html

iojs needs to stop using masm and move to nasm or yasm on Win32.

Fixes: https://github.com/iojs/io.js/issues/589
PR-URL: https://github.com/iojs/io.js/pull/1389


Reviewed-By: Fedor Indutny <fedor@indutny.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

openssl: fix keypress requirement in apps on win32

Reapply b9106137 .

Fixes: https://github.com/iojs/io.js/issues/589
PR-URL: https://github.com/iojs/io.js/pull/1389


Reviewed-By: Fedor Indutny <fedor@indutny.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

deps: add -no_rand_screen to openssl s_client

In openssl s_client on Windows, RAND_screen() is invoked to initialize
random state but it takes several seconds in each connection.
This added -no_rand_screen to openssl s_client on Windows to skip
RAND_screen() and gets a better performance in the unit test of
test-tls-server-verify.
Do not enable this except to use in the unit test.

Fixes: https://github.com/nodejs/io.js/issues/1461
PR-URL: https://github.com/nodejs/io.js/pull/1836


Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

PR-URL: https://github.com/nodejs/io.js/pull/2141


Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

PR-URL: https://github.com/nodejs/io.js/pull/2143


Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Evan Lucas <evanlucas@me.com>
Reviewed-By: Trevor Norris <trev.norris@gmail.com>

Add a check for crypto before using it, similar to how
other tests work.

PR-URL: https://github.com/nodejs/io.js/pull/2129


Reviewed-By: Shigeki Ohtsu <ohtsu@iij.ad.jp>
Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com>

gdbinit provided by V8 can be very useful for low-level debugging of
crashes in node and in binary addons. Most useful commands at 'jst'
for JS stack traces and 'job' for printing a heap object.

This patch installs the file at $PREFIX/share/doc/node/gdbinit.

Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
PR-URL: https://github.com/nodejs/io.js/pull/2123

The original test uses a variable to explicitly count how many
times the callback is invoked. This patch uses common.mustCall()
to track if the callback is called or not. This makes the test
more robust, as we don't explicitly hardcode the number of times
to be called.

PR-URL: https://github.com/nodejs/io.js/pull/2122


Reviewed-By: Colin Ihrig <cjihrig@gmail.com>

PR-URL: https://github.com/nodejs/io.js/pull/2099
Author: Jeremiah Senkpiel <fishrock123@rocketmail.com>

The delay-load hook allows node.exe/iojs.exe to be renamed. See efadffe8
for more background.

PR-URL: https://github.com/iojs/io.js/pull/1433


Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

Every npm version bump requires a few patches to be floated on
node-gyp for io.js compatibility. These patches are found in
03d19927,
5de334c2, and
da730c76. This commit squashes
them into a single commit.

PR-URL: https://github.com/iojs/io.js/pull/990


Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

PR-URL: https://github.com/nodejs/io.js/pull/2112


Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com>

This reverts commit 9436a860.

Path functions being benchmarked are:
* format
* isAbsolute
* join
* normalize
* relative
* resolve

PR-URL: https://github.com/nodejs/io.js/pull/1778


Reviewed-By: Сковорода Никита Андреевич <chalkerx@gmail.com>
Reviewed-By: Roman Reiss <me@silverwind.io>

Improve performance by:
+ Not leaking the `arguments` object!
+ Getting the last character of a string by index, instead of
  with `.substr()` or `.slice()`

Improve code consistency by:
+ Using `[]` instead of `.charAt()` where possible
+ Using a function declaration instead of a var declaration
+ Using `.slice()` with clearer arguments
+ Checking if `dir` is truthy in `win32.format`
  (added tests for this)

Improve both by:
+ Making the reusable `trimArray()` function
+ Standardizing getting certain path statistics with
  the new `win32StatPath()` function

PR-URL: https://github.com/nodejs/io.js/pull/1778


Reviewed-By: Сковорода Никита Андреевич <chalkerx@gmail.com>
Reviewed-By: Roman Reiss <me@silverwind.io>

Update AUTHORS list using tools/update-authors.sh

PR-URL: https://github.com/nodejs/io.js/pull/2100


Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: James Hartig <fastest963@gmail.com>

See next commit for the actual fix.

PR-URL: https://github.com/iojs/io.js/pull/1373


Reviewed-By: Fedor Indutny <fedor@indutny.com>

Notable changes

* deps: Fixed an out-of-band write in utf8 decoder.
This is an important security update as it can be used to cause a
denial of service attack.

Originally reported by: Kris Reeves <kris.re@bbhmedia.com>

Reviewed-By: Trevor Norris <trev.norris@gmail.com>

Remove the suggestion to use domains for exception handling. Add clarity
to "unhandledException".

Fixes: https://github.com/nodejs/io.js/issues/2055
PR-URL: https://github.com/nodejs/io.js/pull/2056


Reviewed-By: Trev Norris <trev.norris@gmail.com>
Reviewed-By: Chris Dickinson <chris@neversaw.us>

Changes included in this commit are

   1. Making the deprecation messages consistent. The messages will be in
      the following format

           x is deprecated. Use y instead.

      If there is no alternative for `x`, then the ` Use y instead.` part
      will not be there in the message.

   2. All the internal deprecation messages are printed with the prefix
      `(node) `, except when the `--trace-deprecation` flag is set.

Fixes: https://github.com/nodejs/io.js/issues/1883
PR-URL: https://github.com/nodejs/io.js/pull/1892


Reviewed-By: Roman Reiss <me@silverwind.io>

Notable changes

build:
  - Added support for compiling with Microsoft Visual C++ 2015
  - Started building and distributing headers-only tarballs along with binaries

It's long past v0.3.0 and .break isn't going anywhere anytime soon.

PR-URL: https://github.com/nodejs/io.js/pull/2081


Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Brian White <mscdex@mscdex.net>

Fixes an edge case regression introduced in
1bef7174.

With the lookup being skipped, an error could be emitted before an
error listener has been added.

An example of this was presented by changing the server’s IP address
and then immediately making a request to the old address.

Related: https://github.com/nodejs/io.js/pull/1823
PR-URL: https://github.com/nodejs/io.js/pull/2054


Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-by: Trevor Norris <trev.norris@gmail.com>

Queued write requests should be invoked on handle close, otherwise the
"consumer" might be already destroyed when the write callbacks of the
"consumed" handle will be invoked. Same applies to the shutdown
requests.

Make sure to "move" away socket from server to not break the
`connections` counter in `net.js`. Otherwise it might not call `close`
callback, or call it too early.

Fix: https://github.com/iojs/io.js/issues/1696
PR-URL: https://github.com/nodejs/io.js/pull/1910


Reviewed-By: Trevor Norris <trev.norris@gmail.com>

PR-URL: https://github.com/nodejs/io.js/pull/2071


Reviewed-By: Roman Reiss <me@silverwind.io>
Reviewed-By: Trevor Norris <trev.norris@gmail.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com>

This issue has already submitted to the upstream in
https://code.google.com/p/gyp/issues/detail?id=477
Use this commit until the upstream is to be fixed.

PR-URL: https://github.com/iojs/io.js/pull/1325


Reviewed-By: Fedor Indutny <fedor@indutny.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

Includes improved support for VS 2015[0] and makes it possible to build
with ninja again[1].

[0] https://codereview.chromium.org/1112753003
[1] https://codereview.chromium.org/1209553002

Fixes: https://github.com/nodejs/io.js/pull/2065
PR-URL: https://github.com/nodejs/io.js/pull/2074


Reviewed-By: Johan Bergström <bugs@bergstroem.nu>
Reviewed-By: Shigeki Ohtsu <ohtsu@iij.ad.jp>

In http_bench.js, allow the concurrent requests per client
to be configurable.

This also changes the launch of clients to wait until all
forked servers are online. This eliminates spurious error
messages at the start of the run.

PR-URL: https://github.com/nodejs/io.js/pull/2068


Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

PR-URL: https://github.com/nodejs/io.js/pull/2067


Reviewed-By: Brian White <mscdex@mscdex.net>
Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com>

The rule was disabled because of an eslint bug which is now resolved.
All code in lib was already conforming and only test code needed a few
changes to make the linter happy with this rule enabled.

Ref: https://github.com/eslint/eslint/issues/2408

PR-URL: https://github.com/nodejs/io.js/pull/2072


Reviewed-By: Yosuke Furukawa <yosuke.furukawa@gmail.com>
Reviewed-by: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Alex Kocharin <alex@kocharin.ru>

PR-URL: https://github.com/nodejs/io.js/pull/2072


Reviewed-By: Yosuke Furukawa <yosuke.furukawa@gmail.com>
Reviewed-by: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Alex Kocharin <alex@kocharin.ru>

Original commit log follows:

    Meaningful name for builtins in JitCodeEvent API.

    Report builtins by name (e.g. "Builtin:ArgumentsAdaptorTrampoline")
    instead of labeling everything "Builtin:A builtin from the snapshot"

    Review URL: https://codereview.chromium.org/1216833002

PR-URL: https://github.com/nodejs/io.js/pull/2075


Reviewed-By: Trevor Norris <trev.norris@gmail.com>

3beb8807 has a bug in VerifyCallback
when preverify is 1 and the cert chain has an verify error. If the
error is UNABLE_TO_GET_ISSUER_CERT_LOCALLY, it leads an assertion
error in finding rootCA.
The whitelist check should be made only when the cert chain has no
verify error with X509_V_OK.

Fixes: https://github.com/nodejs/io.js/issues/2061
PR-URL: https://github.com/nodejs/io.js/pull/2064


Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

this opts for stream.push('') which has the same effect
but uses a public API.

PR-URL: https://github.com/nodejs/io.js/pull/454


Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>

Prevent debug call from showing [object Object] for dnsopts in
lookupAndConnect

PR-URL: https://github.com/nodejs/io.js/pull/2059


Reviewed-by: Colin Ihrig <cjihrig@gmail.com>

If an object's prototype is munged it's possible to bypass the
instanceof check and cause the application to abort. Instead now use
HasInstance() to verify that the object is a Buffer, and throw if not.

This check will not work for JS only methods. So while the application
won't abort, it also won't throw.

In order to properly throw in all cases with toString() the JS
optimization of checking that length is zero has been removed. In its
place the native methods will now return early if a zero length string
is detected.

Ref: https://github.com/nodejs/io.js/pull/1486
Ref: https://github.com/nodejs/io.js/pull/1922
Fixes: https://github.com/nodejs/io.js/issues/1485
PR-URL: https://github.com/nodejs/io.js/pull/2012


Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

Tests in the disabled directory are not used by Makefile nor by the CI.
Other than a single 2015 commit that puts 'use strict' in each test,
many of them haven't been touched in years.

This removes all the disabled tests that have been unmodified since
2011 (with the exception of the 'use strict' modification mentioned
above).

PR-URL: https://github.com/nodejs/io.js/pull/2045


Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Evan Lucas <evanlucas@me.com>

PR-URL: https://github.com/nodejs/io.js/pull/2042


Reviewed-By: Brendan Ashworth <brendan.ashworth@me.com>
Reviewed-By: Johan Bergström <bugs@bergstroem.nu>