This is an important security release. All Node.js users should consult
the security release summary at nodejs.org for details on patched
vulnerabilities.

This release is specifically related to a Buffer overflow vulnerability
discovered in v8, more details can be found in the CVE
https://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1669

PR-URL: https://github.com/nodejs/node-private/pull/41

Original commit message:

  Fix overflow issue in Zone::New

  When requesting a large allocation near the end of the address space,
  the computation could overflow and erroneously *not* grow the Zone
  as required.

	BUG=chromium:606115
	LOG=y

  Review-Url: https://codereview.chromium.org/1930873002
  Cr-Commit-Position: refs/heads/master@{#35903}

PR-URL: https://github.com/nodejs/node-private/pull/38


Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Myles Borins <myles.borins@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/6824

Notable changes:

* **buffer**:
  * Buffer no longer errors if you call lastIndexOf with a search term
    longer than the buffer (Anna Henningsen)
    https://github.com/nodejs/node/pull/6511

* contextify:
  * Context objects are now properly garbage collected, this solves a
    problem some individuals were experiencing with extreme memory
    growth (Ali Ijaz Sheikh)
    https://github.com/nodejs/node/pull/6871

* deps:
  * update npm to 2.15.5 (Rebecca Turner)
    https://github.com/nodejs/node/pull/6663

* http:
  * Invalid status codes can no longer be sent. Limited to 3 digit
    numbers between 100 - 999 (Brian White)
    https://github.com/nodejs/node/pull/6291

Remove port increment by `1337` which appears to sometimes result in a
port that is already in use. There is no reason not to use
`common.PORT`.

PR-URL: https://github.com/nodejs/node/pull/6769
Fixes: https://github.com/nodejs/node/issues/6754


Reviewed-By: Colin Ihrig <cjihrig@gmail.com>

The test is currently flaky and CI provides no real information because
the test times out rather than failing on an assertion. Add logging to
gather more information about the failure.

Refs: https://github.com/nodejs/node/issues/6754
PR-URL: https://github.com/nodejs/node/pull/6769


Reviewed-By: Colin Ihrig <cjihrig@gmail.com>

When the previous set of changes (bfff07b4) it was possible to have the
context get garbage collected while sandbox was still live. We need to
tie the lifetime of the context to the lifetime of the sandbox.

This is a backport of #5786 to v5.x.

Ref: https://github.com/nodejs/node/pull/5786
PR-URL: https://github.com/nodejs/node/pull/5800


Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/5392


Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

PR-URL: https://github.com/nodejs/node/pull/5392


Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

Simplify how node_contextify was keeping a weak reference to the
sandbox object in order to prepare for new style phantom weakness V8
API. It is simpler (and more robust) for the context to hold a
reference to the sandbox in an embedder data field. Doing otherwise
meant that the sandbox could become weak while the context was still
alive. This wasn't a problem because we would make the reference
strong at that point.

Since the sandbox must live at least as long as the context, it
would be better for the context to hold onto the sandbox.

PR-URL: https://github.com/nodejs/node/pull/5392


Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

Cleanup how node_contextify keeps weak references in order to prepare
for new style phantom weakness API. We didn't need to keep a weak
reference to the context's global proxy, as the context holds it.

PR-URL: https://github.com/nodejs/node/pull/5392


Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

The debugger needs to be active now before one is allowed to query the
list of scripts.  Replace the example with one that works without
installing a debug event listener first.

Fixes: https://github.com/nodejs/node/issues/4862
PR-URL: https://github.com/nodejs/node/pull/6757


Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Myles Borins <myles.borins@gmail.com>

Print test name as (for example) "parallel/test-assert".  Tests that are
scraped from the addons documentation are all named test.js, making it
hard to decipher what test is running when only the filename is printed.

Fixes: https://github.com/nodejs/node/issues/6651
PR-URL: https://github.com/nodejs/node/pull/6653


Reviewed-By: James M Snell <jasnell@gmail.com>

There have been failures on AIX due to the slower
default loopback performance. So far I've resisted
updating the global timeout but seeing another
new failure in a newly added test I now think the
right thing is to just extend the platform
timeout for AIX. This commit does that.

PR-URL: https://github.com/nodejs/node/pull/6342


Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com>

There were previously no tests where console.assert failed

PR-URL: https://github.com/nodejs/node/pull/6302


Reviewed-By: Santiago Gimeno <santiago.gimeno@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Brian White <mscdex@mscdex.net>
Reviewed-By: Rich Trott <rtrott@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/6291


Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>
Reviewed-By: Сковорода Никита Андреевич <chalkerx@gmail.com>
Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>

Add a regression test based on the report in
https://github.com/nodejs/node/issues/6034.

PR-URL: https://github.com/nodejs/node/pull/6270


Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Santiago Gimeno <santiago.gimeno@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

An internal zlib error may cause _handle to be set to null.
Close now will check if there is a _handle prior to calling .close on
it.

PR-URL: https://github.com/nodejs/node/pull/5982
Fixes: https://github.com/nodejs/node/issues/6034


Reviewed-By: Brian White <mscdex@mscdex.net>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>

`lib/internal/v8_prof_processor.js` was being excluded from linting, but
the only lint issue it has is that it cannot run in strict mode. Disable
the `strict` rule with a comment and remove the file from
`.eslintignore`.

PR-URL: https://github.com/nodejs/node/pull/6262


Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Roman Klauke <romaaan.git@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

`assert.fail()` is often mistakenly used with a single argument even in
Node.js core. (See fixes to previous instances in
b7f4b1ba,
28e9a022. and
676e6187.)

This commit adds a linting rule to identify instances of this issue.

PR-URL: https://github.com/nodejs/node/pull/6261


Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Minwoo Jung <jmwsoft@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>

Add `CHECK_NE(·, nullptr)` after allocations made when
spawning child processes.

PR-URL: https://github.com/nodejs/node/pull/6256


Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>

The test directory had linting for undefined variables disabled. It is
enabled everywhere else in the code base. Let's disable the fule for
individual lines in the handful of tests that use undefined variables.

PR-URL: https://github.com/nodejs/node/pull/6255


Reviewed-By: Santiago Gimeno <santiago.gimeno@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Roman Reiss <me@silverwind.io>

Make the servers listen on a free port number picked by the OS to avoid
rare `EADDRINUSE` errors on `SmartOS`.

Fixes: https://github.com/nodejs/node/issues/6197
PR-URL: https://github.com/nodejs/node/pull/6248


Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/6241


Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Santiago Gimeno <santiago.gimeno@gmail.com>

Some vm tests are not in strict mode because they need to create and use
global variables. By using `global.foo` instead of just `foo`, we can
still enable strict mode.

PR-URL: https://github.com/nodejs/node/pull/6209


Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com>
Reviewed-By: Santiago Gimeno <santiago.gimeno@gmail.com>
Reviewed-By: Minwoo Jung <jmwsoft@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/6203


Reviewed-By: James M Snell <jasnell@gmail.com>

Only `test-stdin-from-file.js` has been modified so that the `stdin.txt`
is written in a temp directory instead of the `fixtures` directory.

PR-URL: https://github.com/nodejs/node/pull/6187


Reviewed-By: James M Snell <jasnell@gmail.com>

Describe that `zlib.flush()` may wait for pending writes and
until output is being read from the stream.

Fixes: https://github.com/nodejs/node/issues/3782
PR-URL: https://github.com/nodejs/node/pull/6172


Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Robert Jefe Lindstädt <robert.lindstaedt@gmail.com>

Add a full example using `zlib.flush()` for the common use
case of writing partial compressed HTTP output to the client.

PR-URL: https://github.com/nodejs/node/pull/6172


Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Robert Jefe Lindstädt <robert.lindstaedt@gmail.com>

Wait for the data to be received by the socket before creating the
clean-up timer. This way, a possible (though unlikely) `ECONNRESET`
error can be avoided.

PR-URL: https://github.com/nodejs/node/pull/6166


Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>

Reduce client connections from 10 to 4 in a test that is causing issues
on Raspberry Pi 2 devices in CI.

Fixes: https://github.com/nodejs/node/issues/5122
PR-URL: https://github.com/nodejs/node/pull/6138


Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/6132


Reviewed-By: Brian White <mscdex@mscdex.net>
Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: thefourtheye <thechargingvolcano@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/6132


Reviewed-By: Brian White <mscdex@mscdex.net>
Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: thefourtheye <thechargingvolcano@gmail.com>

Fixes: https://github.com/nodejs/node/issues/6080
PR-URL: https://github.com/nodejs/node/pull/6124


Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Brian White <mscdex@mscdex.net>
Reviewed-By: James M Snell <jasnell@gmail.com>

As Node.js expects either Python 2.6 or 2.7 installed to work properly,
simplejson module is no longer necessary. It was included in Python 2.6
as the json module.

PR-URL: https://github.com/nodejs/node/pull/6101


Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Johan Bergström <bugs@bergstroem.nu>

The only test with modifications is `test-stdin-child-proc` that was
passing when it should not because the exit code of the child process
was not being checked.

PR-URL: https://github.com/nodejs/node/pull/6087


Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Johan Bergström <bugs@bergstroem.nu>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>
Reviewed-By: Claudio Rodriguez <cjrodr@yahoo.com>

This commit refines the documentation around child.kill(), where kill
attempts against shells will lead to unexpected results. Namely, on
linux the child process of a child process will not terminate, when
its parent gets terminated. This is different across the the
platforms.

PR-URL: https://github.com/nodejs/node/issues/2098


Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Closes: https://github.com/nodejs/node/issues/2098

* use common.mustCall() to verify all tests have run
* eliminate unneeded removeTestFile()
* eliminate unneeded var leaking into global scope
* var -> const
* remove instance of let

PR-URL: https://github.com/nodejs/node/pull/6050


Reviewed-By: James M Snell <jasnell@gmail.com>

The last change to this test landed before a nit about strict mode was
addressed, so this change addresses that.

PR-URL: https://github.com/nodejs/node/pull/6047
Refs: https://github.com/nodejs/node/pull/6017


Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Roman Klauke <romaaan.git@gmail.com>

A handful of tests in `test/pummel` were failing due to undefined
variables.

The tests in pummel are not run in CI or otherwise exercised regularly
so these failures can go unnoticed for a long time.

PR-URL: https://github.com/nodejs/node/pull/6012


Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>