Merge branch 'v0.4'

Conflicts:
	src/node.js
	src/node_version.h

32 files changed, 335 insertions, 109 deletions

diff --git a/ChangeLog b/ChangeLog
index 867d8cd04..47c408e60 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,4 +1,38 @@
-2011.05.20, Version 0.4.8 (stable)
+2011.06.29, Version 0.4.9 (stable)
+
+* Improve documentation
+
+* #1095 error handling bug in stream.pipe() (Felix Geisendörfer)
+
+* #1097 Fix a few leaks in node_crypto.cc (Ben Noordhuis)
+
+* #562 #1078 Parse file:// urls properly (Ryan Petrello)
+
+* #880 Option to disable SSLv2 (Jérémy Lal)
+
+* #1087 Disabling SSL compression disabled with early OpenSSLs.
+
+* #1144 debugger: don't allow users to input non-valid commands
+  (Siddharth Mahendraker)
+
+* Perf improvement for util.inherits
+
+* #1166 Support for signature verification with RSA/DSA public keys
+  (Mark Cavage)
+
+* #1177 Remove node_modules lookup optimization to better support
+  nested project structures (Mathias Buus)
+
+* #1203 Add missing scope.Close to fs.sendfileSync
+
+* #1187 Support multiple 'link' headers
+
+* #1196 Fix -e/--eval can't load module from node_modules (Koichi Kobayashi)
+
+* Upgrade V8 to 3.1.8.25, upgrade http-parser.
+
+
+2011.05.20, Version 0.4.8 (stable), 7dd22c26e4365698dc3efddf138c4d399cb912c8
 
 * #974 Properly report traceless errors (isaacs)
 
diff --git a/deps/v8/src/arm/codegen-arm.cc b/deps/v8/src/arm/codegen-arm.cc
index 0fcaa0b09..1cd86d1da 100644
--- a/deps/v8/src/arm/codegen-arm.cc
+++ b/deps/v8/src/arm/codegen-arm.cc
@@ -7233,6 +7233,9 @@ void CodeGenerator::EmitKeyedStore(StaticType* key_type,
 
     ASSERT(we_remembered_the_write_barrier);
 
+    // Make sure that r0 holds the value which is the result of the expression.
+    __ Move(r0, value);
+
     deferred->BindExit();
   } else {
     frame()->CallKeyedStoreIC(strict_mode_flag());
diff --git a/deps/v8/src/arm/lithium-arm.cc b/deps/v8/src/arm/lithium-arm.cc
index 54ed4bace..c04e5ca8e 100644
--- a/deps/v8/src/arm/lithium-arm.cc
+++ b/deps/v8/src/arm/lithium-arm.cc
@@ -1936,6 +1936,10 @@ LInstruction* LChunkBuilder::DoParameter(HParameter* instr) {
 
 LInstruction* LChunkBuilder::DoUnknownOSRValue(HUnknownOSRValue* instr) {
   int spill_index = chunk()->GetNextSpillIndex(false);  // Not double-width.
+  if (spill_index > LUnallocated::kMaxFixedIndex) {
+    Abort("Too many spill slots needed for OSR");
+    spill_index = 0;
+  }
   return DefineAsSpilled(new LUnknownOSRValue, spill_index);
 }
 
diff --git a/deps/v8/src/builtins.cc b/deps/v8/src/builtins.cc
index ff073883c..0f9d152f5 100644
--- a/deps/v8/src/builtins.cc
+++ b/deps/v8/src/builtins.cc
@@ -373,8 +373,7 @@ static bool ArrayPrototypeHasNoElements(Context* global_context,
   array_proto = JSObject::cast(proto);
   if (array_proto != global_context->initial_object_prototype()) return false;
   if (array_proto->elements() != Heap::empty_fixed_array()) return false;
-  ASSERT(array_proto->GetPrototype()->IsNull());
-  return true;
+  return array_proto->GetPrototype()->IsNull();
 }
 
 
diff --git a/deps/v8/src/compiler.cc b/deps/v8/src/compiler.cc
index 367de6488..18f54c2af 100755
--- a/deps/v8/src/compiler.cc
+++ b/deps/v8/src/compiler.cc
@@ -1,4 +1,4 @@
-// Copyright 2010 the V8 project authors. All rights reserved.
+// Copyright 2011 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
@@ -223,10 +223,12 @@ static bool MakeCrankshaftCode(CompilationInfo* info) {
   //
   // The encoding is as a signed value, with parameters and receiver using
   // the negative indices and locals the non-negative ones.
-  const int limit = LUnallocated::kMaxFixedIndices / 2;
+  const int parameter_limit = -LUnallocated::kMinFixedIndex;
+  const int locals_limit = LUnallocated::kMaxFixedIndex;
   Scope* scope = info->scope();
-  if ((scope->num_parameters() + 1) > limit ||
-      scope->num_stack_slots() > limit) {
+  if ((scope->num_parameters() + 1) > parameter_limit ||
+      (info->osr_ast_id() != AstNode::kNoNumber &&
+       scope->num_parameters() + 1 + scope->num_stack_slots() > locals_limit)) {
     AbortAndDisable(info);
     // True indicates the compilation pipeline is still going, not
     // necessarily that we optimized the code.
diff --git a/deps/v8/src/hydrogen-instructions.h b/deps/v8/src/hydrogen-instructions.h
index 35ff29749..1bce34beb 100644
--- a/deps/v8/src/hydrogen-instructions.h
+++ b/deps/v8/src/hydrogen-instructions.h
@@ -789,15 +789,33 @@ class HBlockEntry: public HTemplateInstruction<0> {
 };
 
 
-class HDeoptimize: public HTemplateControlInstruction<0> {
+class HDeoptimize: public HControlInstruction {
  public:
-  HDeoptimize() : HTemplateControlInstruction<0>(NULL, NULL) { }
+  explicit HDeoptimize(int environment_length)
+      : HControlInstruction(NULL, NULL),
+        values_(environment_length) { }
 
   virtual Representation RequiredInputRepresentation(int index) const {
     return Representation::None();
   }
 
+  virtual int OperandCount() { return values_.length(); }
+  virtual HValue* OperandAt(int index) { return values_[index]; }
+
+  void AddEnvironmentValue(HValue* value) {
+    values_.Add(NULL);
+    SetOperandAt(values_.length() - 1, value);
+  }
+
   DECLARE_CONCRETE_INSTRUCTION(Deoptimize, "deoptimize")
+
+ protected:
+  virtual void InternalSetOperandAt(int index, HValue* value) {
+    values_[index] = value;
+  }
+
+ private:
+  ZoneList<HValue*> values_;
 };
 
 
diff --git a/deps/v8/src/hydrogen.cc b/deps/v8/src/hydrogen.cc
index e40685cd6..b37d3356c 100644
--- a/deps/v8/src/hydrogen.cc
+++ b/deps/v8/src/hydrogen.cc
@@ -113,6 +113,21 @@ void HBasicBlock::AddInstruction(HInstruction* instr) {
 }
 
 
+HDeoptimize* HBasicBlock::CreateDeoptimize() {
+  ASSERT(HasEnvironment());
+  HEnvironment* environment = last_environment();
+
+  HDeoptimize* instr = new HDeoptimize(environment->length());
+
+  for (int i = 0; i < environment->length(); i++) {
+    HValue* val = environment->values()->at(i);
+    instr->AddEnvironmentValue(val);
+  }
+
+  return instr;
+}
+
+
 HSimulate* HBasicBlock::CreateSimulate(int id) {
   ASSERT(HasEnvironment());
   HEnvironment* environment = last_environment();
@@ -2560,7 +2575,7 @@ void HGraphBuilder::VisitSwitchStatement(SwitchStatement* stmt) {
   // If we have a non-smi compare clause, we deoptimize after trying
   // all the previous compares.
   if (num_smi_clauses < num_clauses) {
-    last_false_block->Finish(new HDeoptimize);
+    last_false_block->FinishExitWithDeoptimization();
   }
 
   // Build statement blocks, connect them to their comparison block and
@@ -3230,7 +3245,7 @@ void HGraphBuilder::HandlePolymorphicStoreNamedField(Assignment* expr,
     HSubgraph* default_graph = CreateBranchSubgraph(environment());
     { SubgraphScope scope(this, default_graph);
       if (!needs_generic && FLAG_deoptimize_uncommon_cases) {
-        default_graph->exit_block()->FinishExit(new HDeoptimize());
+        default_graph->exit_block()->FinishExitWithDeoptimization();
         default_graph->set_exit_block(NULL);
       } else {
         HInstruction* instr = BuildStoreNamedGeneric(object, name, value);
@@ -3567,7 +3582,7 @@ void HGraphBuilder::HandlePolymorphicLoadNamedField(Property* expr,
     HSubgraph* default_graph = CreateBranchSubgraph(environment());
     { SubgraphScope scope(this, default_graph);
       if (!needs_generic && FLAG_deoptimize_uncommon_cases) {
-        default_graph->exit_block()->FinishExit(new HDeoptimize());
+        default_graph->exit_block()->FinishExitWithDeoptimization();
         default_graph->set_exit_block(NULL);
       } else {
         HInstruction* instr = BuildLoadNamedGeneric(object, expr);
@@ -3928,7 +3943,7 @@ void HGraphBuilder::HandlePolymorphicCallNamed(Call* expr,
     HSubgraph* default_graph = CreateBranchSubgraph(environment());
     { SubgraphScope scope(this, default_graph);
       if (!needs_generic && FLAG_deoptimize_uncommon_cases) {
-        default_graph->exit_block()->FinishExit(new HDeoptimize());
+        default_graph->exit_block()->FinishExitWithDeoptimization();
         default_graph->set_exit_block(NULL);
       } else {
         HContext* context = new HContext;
diff --git a/deps/v8/src/hydrogen.h b/deps/v8/src/hydrogen.h
index 1ac4fc430..16f0edeaa 100644
--- a/deps/v8/src/hydrogen.h
+++ b/deps/v8/src/hydrogen.h
@@ -124,6 +124,10 @@ class HBasicBlock: public ZoneObject {
   void AddSimulate(int id) { AddInstruction(CreateSimulate(id)); }
   void AssignCommonDominator(HBasicBlock* other);
 
+  void FinishExitWithDeoptimization() {
+    FinishExit(CreateDeoptimize());
+  }
+
   // Add the inlined function exit sequence, adding an HLeaveInlined
   // instruction and updating the bailout environment.
   void AddLeaveInlined(HValue* return_value, HBasicBlock* target);
@@ -146,6 +150,7 @@ class HBasicBlock: public ZoneObject {
   void AddDominatedBlock(HBasicBlock* block);
 
   HSimulate* CreateSimulate(int id);
+  HDeoptimize* CreateDeoptimize();
 
   int block_id_;
   HGraph* graph_;
diff --git a/deps/v8/src/ia32/lithium-ia32.cc b/deps/v8/src/ia32/lithium-ia32.cc
index ea6d41aa1..ece0ab3d6 100644
--- a/deps/v8/src/ia32/lithium-ia32.cc
+++ b/deps/v8/src/ia32/lithium-ia32.cc
@@ -1986,6 +1986,10 @@ LInstruction* LChunkBuilder::DoParameter(HParameter* instr) {
 
 LInstruction* LChunkBuilder::DoUnknownOSRValue(HUnknownOSRValue* instr) {
   int spill_index = chunk()->GetNextSpillIndex(false);  // Not double-width.
+  if (spill_index > LUnallocated::kMaxFixedIndex) {
+    Abort("Too many spill slots needed for OSR");
+    spill_index = 0;
+  }
   return DefineAsSpilled(new LUnknownOSRValue, spill_index);
 }
 
diff --git a/deps/v8/src/lithium.h b/deps/v8/src/lithium.h
index d85a87c12..280da4724 100644
--- a/deps/v8/src/lithium.h
+++ b/deps/v8/src/lithium.h
@@ -143,7 +143,8 @@ class LUnallocated: public LOperand {
   };
 
   static const int kMaxVirtualRegisters = 1 << (kVirtualRegisterWidth + 1);
-  static const int kMaxFixedIndices = 128;
+  static const int kMaxFixedIndex = 63;
+  static const int kMinFixedIndex = -64;
 
   bool HasIgnorePolicy() const { return policy() == IGNORE; }
   bool HasNoPolicy() const { return policy() == NONE; }
diff --git a/deps/v8/src/messages.js b/deps/v8/src/messages.js
index 2c94912fd..f39ea9ff6 100644
--- a/deps/v8/src/messages.js
+++ b/deps/v8/src/messages.js
@@ -211,6 +211,7 @@ function FormatMessage(message) {
       invalid_preparser_data:       ["Invalid preparser data for function ", "%0"],
       strict_mode_with:             ["Strict mode code may not include a with statement"],
       strict_catch_variable:        ["Catch variable may not be eval or arguments in strict mode"],
+      too_many_arguments:           ["Too many arguments in function call (only 32766 allowed)"],
       too_many_parameters:          ["Too many parameters in function definition"],
       strict_param_name:            ["Parameter name eval or arguments is not allowed in strict mode"],
       strict_param_dupe:            ["Strict mode function may not have duplicate parameter names"],
diff --git a/deps/v8/src/parser.cc b/deps/v8/src/parser.cc
index 04e2407e0..6d462bc53 100644
--- a/deps/v8/src/parser.cc
+++ b/deps/v8/src/parser.cc
@@ -3490,6 +3490,12 @@ ZoneList<Expression*>* Parser::ParseArguments(bool* ok) {
   while (!done) {
     Expression* argument = ParseAssignmentExpression(true, CHECK_OK);
     result->Add(argument);
+    if (result->length() > kMaxNumFunctionParameters) {
+      ReportMessageAt(scanner().location(), "too_many_arguments",
+                      Vector<const char*>::empty());
+      *ok = false;
+      return NULL;
+    }
     done = (peek() == Token::RPAREN);
     if (!done) Expect(Token::COMMA, CHECK_OK);
   }
diff --git a/deps/v8/src/platform-solaris.cc b/deps/v8/src/platform-solaris.cc
index 6051fb0c4..0ee2e7cdb 100644
--- a/deps/v8/src/platform-solaris.cc
+++ b/deps/v8/src/platform-solaris.cc
@@ -1,4 +1,4 @@
-// Copyright 2006-2009 the V8 project authors. All rights reserved.
+// Copyright 2011 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
@@ -105,7 +105,8 @@ uint64_t OS::CpuFeaturesImpliedByPlatform() {
 
 
 int OS::ActivationFrameAlignment() {
-  return STACK_ALIGN;
+  // GCC generates code that requires 16 byte alignment such as movdqa.
+  return Max(STACK_ALIGN, 16);
 }
 
 
diff --git a/deps/v8/src/v8natives.js b/deps/v8/src/v8natives.js
index 91e19c13d..823f8ee57 100644
--- a/deps/v8/src/v8natives.js
+++ b/deps/v8/src/v8natives.js
@@ -147,17 +147,6 @@ function GlobalEval(x) {
 }
 
 
-// execScript for IE compatibility.
-function GlobalExecScript(expr, lang) {
-  // NOTE: We don't care about the character casing.
-  if (!lang || /javascript/i.test(lang)) {
-    var f = %CompileString(ToString(expr));
-    f.call(%GlobalReceiver(global));
-  }
-  return null;
-}
-
-
 // ----------------------------------------------------------------------------
 
 
@@ -177,8 +166,7 @@ function SetupGlobal() {
     "isFinite", GlobalIsFinite,
     "parseInt", GlobalParseInt,
     "parseFloat", GlobalParseFloat,
-    "eval", GlobalEval,
-    "execScript", GlobalExecScript
+    "eval", GlobalEval
   ));
 }
 
diff --git a/deps/v8/src/version.cc b/deps/v8/src/version.cc
index ccfbd18c5..f70e40591 100644
--- a/deps/v8/src/version.cc
+++ b/deps/v8/src/version.cc
@@ -35,7 +35,7 @@
 #define MAJOR_VERSION     3
 #define MINOR_VERSION     1
 #define BUILD_NUMBER      8
-#define PATCH_LEVEL       16
+#define PATCH_LEVEL       25
 #define CANDIDATE_VERSION false
 
 // Define SONAME to have the SCons build the put a specific SONAME into the
diff --git a/deps/v8/src/x64/full-codegen-x64.cc b/deps/v8/src/x64/full-codegen-x64.cc
index 0ad6ec237..60b77b5bf 100644
--- a/deps/v8/src/x64/full-codegen-x64.cc
+++ b/deps/v8/src/x64/full-codegen-x64.cc
@@ -1383,13 +1383,17 @@ void FullCodeGenerator::VisitObjectLiteral(ObjectLiteral* expr) {
         // Fall through.
       case ObjectLiteral::Property::COMPUTED:
         if (key->handle()->IsSymbol()) {
-          VisitForAccumulatorValue(value);
-          __ Move(rcx, key->handle());
-          __ movq(rdx, Operand(rsp, 0));
           if (property->emit_store()) {
-            Handle<Code> ic(Builtins::builtin(Builtins::StoreIC_Initialize));
+            VisitForAccumulatorValue(value);
+            __ Move(rcx, key->handle());
+            __ movq(rdx, Operand(rsp, 0));
+            Handle<Code> ic(Builtins::builtin(
+                is_strict() ? Builtins::StoreIC_Initialize_Strict
+                            : Builtins::StoreIC_Initialize));
             EmitCallIC(ic, RelocInfo::CODE_TARGET);
             PrepareForBailoutForId(key->id(), NO_REGISTERS);
+          } else {
+            VisitForEffect(value);
           }
           break;
         }
diff --git a/deps/v8/src/x64/lithium-x64.cc b/deps/v8/src/x64/lithium-x64.cc
index 18b38e248..2f413feb9 100644
--- a/deps/v8/src/x64/lithium-x64.cc
+++ b/deps/v8/src/x64/lithium-x64.cc
@@ -1939,6 +1939,10 @@ LInstruction* LChunkBuilder::DoParameter(HParameter* instr) {
 
 LInstruction* LChunkBuilder::DoUnknownOSRValue(HUnknownOSRValue* instr) {
   int spill_index = chunk()->GetNextSpillIndex(false);  // Not double-width.
+  if (spill_index > LUnallocated::kMaxFixedIndex) {
+    Abort("Too many spill slots needed for OSR");
+    spill_index = 0;
+  }
   return DefineAsSpilled(new LUnknownOSRValue, spill_index);
 }
 
diff --git a/deps/v8/test/mjsunit/function-names.js b/deps/v8/test/mjsunit/function-names.js
index c083f18f5..5ed0b794e 100644
--- a/deps/v8/test/mjsunit/function-names.js
+++ b/deps/v8/test/mjsunit/function-names.js
@@ -128,6 +128,6 @@ var globalFunctions = [
     "encodeURI", "encodeURIComponent", "Error", "TypeError",
     "RangeError", "SyntaxError", "ReferenceError", "EvalError",
     "URIError", "isNaN", "isFinite", "parseInt", "parseFloat",
-    "eval", "execScript"];
+    "eval"];
 
 TestFunctionNames(this, globalFunctions);
diff --git a/deps/v8/test/mjsunit/regress/regress-1122.js b/deps/v8/test/mjsunit/regress/regress-1122.js
index 7dc9b248a..815511d18 100644
--- a/deps/v8/test/mjsunit/regress/regress-1122.js
+++ b/deps/v8/test/mjsunit/regress/regress-1122.js
@@ -25,12 +25,14 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Test that we can handle functions with up to 32766 arguments, and that
-// functions with more arguments throw an exception.
+// Test that we can handle function calls with up to 32766 arguments, and
+// that function calls with more arguments throw an exception.  Apply a
+// similar limit to the number of function parameters.
 
-// See http://code.google.com/p/v8/issues/detail?id=1122.
+// See http://code.google.com/p/v8/issues/detail?id=1122 and
+// http://code.google.com/p/v8/issues/detail?id=1413.
 
-function function_with_n_args(n) {
+function function_with_n_params_and_m_args(n, m) {
   test_prefix = 'prefix ';
   test_suffix = ' suffix';
   var source = 'test_prefix + (function f(';
@@ -39,7 +41,7 @@ function function_with_n_args(n) {
     source += 'arg' + arg;
   }
   source += ') { return arg' + (n - n % 2) / 2 + '; })(';
-  for (var arg = 0; arg < n ; arg++) {
+  for (var arg = 0; arg < m ; arg++) {
     if (arg != 0) source += ',';
     source += arg;
   }
@@ -47,9 +49,20 @@ function function_with_n_args(n) {
   return eval(source);
 }
 
-assertEquals('prefix 4000 suffix', function_with_n_args(8000));
-assertEquals('prefix 9000 suffix', function_with_n_args(18000));
-assertEquals('prefix 16000 suffix', function_with_n_args(32000));
+assertEquals('prefix 4000 suffix',
+             function_with_n_params_and_m_args(8000, 8000));
+assertEquals('prefix 3000 suffix',
+             function_with_n_params_and_m_args(6000, 8000));
+assertEquals('prefix 5000 suffix',
+             function_with_n_params_and_m_args(10000, 8000));
+assertEquals('prefix 9000 suffix',
+             function_with_n_params_and_m_args(18000, 18000));
+assertEquals('prefix 16000 suffix',
+             function_with_n_params_and_m_args(32000, 32000));
+assertEquals('prefix undefined suffix',
+             function_with_n_params_and_m_args(32000, 10000));
 
-assertThrows("function_with_n_args(35000)");
-assertThrows("function_with_n_args(100000)");
+assertThrows("function_with_n_params_and_m_args(35000, 35000)");
+assertThrows("function_with_n_params_and_m_args(100000, 100000)");
+assertThrows("function_with_n_params_and_m_args(35000, 30000)");
+assertThrows("function_with_n_params_and_m_args(30000, 35000)");
diff --git a/deps/v8/test/mjsunit/regress/regress-1257.js b/deps/v8/test/mjsunit/regress/regress-1257.js
new file mode 100644
index 000000000..c20fb8606
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-1257.js
@@ -0,0 +1,58 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function g(y) { assertEquals(y, 12); }
+
+var X = 0;
+
+function foo () {
+  var cnt = 0;
+  var l = -1;
+  var x = 0;
+  while (1) switch (l) {
+      case -1:
+        var y = x + 12;
+        l = 0;
+        break;
+      case 0:
+        // Loop for to hit OSR.
+        if (cnt++ < 10000000) {
+          l = 0;
+          break;
+        } else {
+          l = 1;
+          break;
+        }
+      case 1:
+        // This case will contain deoptimization
+        // because it has no type feedback.
+        g(y);
+        return;
+    };
+}
+
+foo();
diff --git a/deps/v8/test/mjsunit/regress/regress-1341167.js b/deps/v8/test/mjsunit/regress/regress-1401.js
index 194a7b886..33eb0677e 100644
--- a/deps/v8/test/mjsunit/regress/regress-1341167.js
+++ b/deps/v8/test/mjsunit/regress/regress-1401.js
@@ -1,4 +1,4 @@
-// Copyright 2008 the V8 project authors. All rights reserved.
+// Copyright 2011 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
@@ -25,9 +25,21 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Make sure that 'this' is bound to the global object when using
-// execScript.
+// See: http://code.google.com/p/v8/issues/detail?id=1401
 
-var result;
-execScript("result = this");
-assertTrue(result === this);
+var bottom = 0;
+var sizes = new Array();
+
+for (i = 0; i < 10; i++) {
+  sizes[i] = 0;
+}
+
+function foo() {
+  var size = bottom + 1 + 10;
+  var t =  (sizes[++bottom] = size);
+  return t;
+}
+
+for (i = 0; i < 5; i++) {
+  assertEquals(i + 11, foo());
+}
diff --git a/deps/v8/test/mjsunit/execScript-case-insensitive.js b/deps/v8/test/mjsunit/regress/regress-1403.js
index 468d65747..f2520ccbc 100644
--- a/deps/v8/test/mjsunit/execScript-case-insensitive.js
+++ b/deps/v8/test/mjsunit/regress/regress-1403.js
@@ -1,4 +1,4 @@
-// Copyright 2008 the V8 project authors. All rights reserved.
+// Copyright 2011 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
@@ -25,10 +25,12 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-var x  = 0;
-execScript('x = 1', 'javascript');
-assertEquals(1, x);
+// See: http://code.google.com/p/v8/issues/detail?id=1403
 
-execScript('x = 2', 'JavaScript');
-assertEquals(2, x);
+a = [];
+Object.prototype.__proto__ = { __proto__: null };
+a.shift();
 
+a = [];
+Array.prototype.__proto__ = { __proto__: null };
+a.shift();
diff --git a/deps/v8/test/mjsunit/regress/splice-missing-wb.js b/deps/v8/test/mjsunit/regress/splice-missing-wb.js
new file mode 100644
index 000000000..5ff0d81e8
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/splice-missing-wb.js
@@ -0,0 +1,56 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-gc
+
+// Create array large enough to span several page regions.
+var a = new Array(500);
+
+// Fill it with values.
+for (var i = 0; i < a.length; i++) a[i] = {idx:i};
+
+// Force it into oldspace.
+gc();
+gc();
+
+// Array should be in old space now. Store young object into array.
+// Region will be marked.
+a[0] = {idx:0};
+
+// Delete elements a[2] .. a[201]. Internally we will use
+// trimming of backing store. a[0] a[1] will be moved to
+// memory location previously occupied by a[200] a[201].
+a.splice(2, 200);
+
+// Force gc and heap verification.
+gc();
+
+// Try accessing a[0].idx. It will segfault if write-barrier was accidentally
+// omitted.
+assertEquals(0, a[0].idx);
+assertEquals(1, a[1].idx);
+assertEquals(202, a[2].idx);
diff --git a/doc/api/modules.markdown b/doc/api/modules.markdown
index 2e943bf2c..d147395f0 100644
--- a/doc/api/modules.markdown
+++ b/doc/api/modules.markdown
@@ -68,8 +68,7 @@ parent directory of the current module, and adds `/node_modules`, and
 attempts to load the module from that location.
 
 If it is not found there, then it moves to the parent directory, and so
-on, until either the module is found, or the root of the tree is
-reached.
+on, until the root of the tree is reached.
 
 For example, if the file at `'/home/ry/projects/foo.js'` called
 `require('bar.js')`, then node would look in the following locations, in
@@ -83,28 +82,6 @@ this order:
 This allows programs to localize their dependencies, so that they do not
 clash.
 
-#### Optimizations to the `node_modules` Lookup Process
-
-When there are many levels of nested dependencies, it is possible for
-these file trees to get fairly long.  The following optimizations are thus
-made to the process.
-
-First, `/node_modules` is never appended to a folder already ending in
-`/node_modules`.
-
-Second, if the file calling `require()` is already inside a `node_modules`
-hierarchy, then the top-most `node_modules` folder is treated as the
-root of the search tree.
-
-For example, if the file at
-`'/home/ry/projects/foo/node_modules/bar/node_modules/baz/quux.js'`
-called `require('asdf.js')`, then node would search the following
-locations:
-
-* `/home/ry/projects/foo/node_modules/bar/node_modules/baz/node_modules/asdf.js`
-* `/home/ry/projects/foo/node_modules/bar/node_modules/asdf.js`
-* `/home/ry/projects/foo/node_modules/asdf.js`
-
 ### Folders as Modules
 
 It is convenient to organize programs and libraries into self-contained
diff --git a/doc/index.html b/doc/index.html
index c4dc5f16a..3146a4d8e 100644
--- a/doc/index.html
+++ b/doc/index.html
@@ -26,7 +26,7 @@
         <li><a href="#download">Download</a></li>
         <li><a href="https://github.com/joyent/node/raw/v0.4/ChangeLog">ChangeLog</a></li>
         <li><a href="#about">About</a></li>
-        <li><a href="http://nodejs.org/docs/v0.4.8/api">v0.4.8 docs</a></li>
+        <li><a href="http://nodejs.org/docs/v0.4.9/api">v0.4.9 docs</a></li>
         <br/>
         <li><a href="https://github.com/joyent/node/wiki">Wiki</a></li>
         <li><a href="http://blog.nodejs.org/">Blog</a></li>
@@ -108,9 +108,9 @@ server.listen(1337, "127.0.0.1");
       </p>
 
       <p>
-        2011.05.20
-        <a href="http://nodejs.org/dist/node-v0.4.8.tar.gz">node-v0.4.8.tar.gz</a>
-        (<a href="http://nodejs.org/docs/v0.4.8/api/index.html">Documentation</a>)
+        2011.06.29
+        <a href="http://nodejs.org/dist/node-v0.4.9.tar.gz">node-v0.4.9.tar.gz</a>
+        (<a href="http://nodejs.org/docs/v0.4.9/api/index.html">Documentation</a>)
       </p>
 
       <p>Historical: <a href="http://nodejs.org/dist">versions</a>, <a href="http://nodejs.org/docs">docs</a></p>
diff --git a/lib/http.js b/lib/http.js
index 7a74fdb92..0927a862d 100644
--- a/lib/http.js
+++ b/lib/http.js
@@ -284,6 +284,7 @@ IncomingMessage.prototype._addHeaderLine = function(field, value) {
     case 'connection':
     case 'cookie':
     case 'pragma':
+    case 'link':
       if (field in dest) {
         dest[field] += ', ' + value;
       } else {
diff --git a/lib/module.js b/lib/module.js
index be5475f9c..daf73d96f 100644
--- a/lib/module.js
+++ b/lib/module.js
@@ -199,12 +199,7 @@ Module._nodeModulePaths = function(from) {
   var paths = [];
   var parts = from.split(splitRe);
 
-  var root = parts.indexOf('node_modules') - 1;
-  if (root < 0) root = 0;
-
-  var tip = parts.length - 1;
-
-  for (var tip = parts.length - 1; tip >= root; tip --) {
+  for (var tip = parts.length - 1; tip >= 0; tip --) {
     // don't search in .../node_modules/node_modules
     if (parts[tip] === 'node_modules') continue;
     var dir = parts.slice(0, tip + 1).concat('node_modules').join(joiner);
diff --git a/src/node_crypto.cc b/src/node_crypto.cc
index 20a475e35..03e6a3545 100644
--- a/src/node_crypto.cc
+++ b/src/node_crypto.cc
@@ -42,10 +42,8 @@
     return ThrowException(Exception::TypeError(String::New("Not a string or buffer"))); \
   }
 
-static const char *RSA_PUB_KEY_PFX =  "-----BEGIN RSA PUBLIC KEY-----";
-static const char *DSA_PUB_KEY_PFX =  "-----BEGIN PUBLIC KEY-----";
-static const int RSA_PUB_KEY_PFX_LEN = strlen(RSA_PUB_KEY_PFX);
-static const int DSA_PUB_KEY_PFX_LEN = strlen(DSA_PUB_KEY_PFX);
+static const char *PUBLIC_KEY_PFX =  "-----BEGIN PUBLIC KEY-----";
+static const int PUBLIC_KEY_PFX_LEN = strlen(PUBLIC_KEY_PFX);
 
 namespace node {
 namespace crypto {
@@ -2926,10 +2924,8 @@ class Verify : public ObjectWrap {
       return 0;
     }
 
-    // Check if this is an RSA or DSA "raw" public key before trying
-    // X.509
-    if (strncmp(key_pem, RSA_PUB_KEY_PFX, RSA_PUB_KEY_PFX_LEN) == 0 ||
-        strncmp(key_pem, DSA_PUB_KEY_PFX, DSA_PUB_KEY_PFX_LEN) == 0) {
+    // Check if this is a PKCS#8 public key before trying as X.509
+    if (strncmp(key_pem, PUBLIC_KEY_PFX, PUBLIC_KEY_PFX_LEN) == 0) {
       pkey = PEM_read_bio_PUBKEY(bp, NULL, NULL, NULL);
       if (pkey == NULL) {
         ERR_print_errors_fp(stderr);
@@ -2951,8 +2947,6 @@ class Verify : public ObjectWrap {
     }
 
     r = EVP_VerifyFinal(&mdctx, sig, siglen, pkey);
-    if (r != 1)
-      ERR_print_errors_fp (stderr);
 
     if(pkey != NULL)
       EVP_PKEY_free (pkey);
diff --git a/src/node_file.cc b/src/node_file.cc
index f5c1511d7..ad0c7b4f9 100644
--- a/src/node_file.cc
+++ b/src/node_file.cc
@@ -606,7 +606,7 @@ static Handle<Value> SendFile(const Arguments& args) {
     ssize_t sent = eio_sendfile_sync (out_fd, in_fd, in_offset, length);
     // XXX is this the right errno to use?
     if (sent < 0) return ThrowException(ErrnoException(errno));
-    return Integer::New(sent);
+    return scope.Close(Integer::New(sent));
   }
 }
 
diff --git a/test/fixtures/node_modules/baz/index.js b/test/fixtures/node_modules/baz/index.js
index 44acc13da..84f587f2a 100644
--- a/test/fixtures/node_modules/baz/index.js
+++ b/test/fixtures/node_modules/baz/index.js
@@ -25,11 +25,5 @@ console.error(module.paths.join('\n')+'\n');
 var assert = require('assert');
 assert.equal(require('bar'), require('../bar.js'));
 
-// since this is inside a node_modules folder,
-// it should be impossible to ever see /node_modules in the
-// lookup paths, since it's rooted on the uppermost node_modules
-// directory.
-assert.equal(-1, module.paths.indexOf('/node_modules'));
-
 // this should work, and get the one in ./node_modules/asdf.js
 assert.equal(require('asdf'), require('./node_modules/asdf.js'));
diff --git a/test/simple/test-eval-require.js b/test/simple/test-eval-require.js
new file mode 100644
index 000000000..6fcb73a03
--- /dev/null
+++ b/test/simple/test-eval-require.js
@@ -0,0 +1,35 @@
+// Copyright Joyent, Inc. and other Node contributors.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a
+// copy of this software and associated documentation files (the
+// "Software"), to deal in the Software without restriction, including
+// without limitation the rights to use, copy, modify, merge, publish,
+// distribute, sublicense, and/or sell copies of the Software, and to permit
+// persons to whom the Software is furnished to do so, subject to the
+// following conditions:
+//
+// The above copyright notice and this permission notice shall be included
+// in all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
+// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
+// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+// USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+var common = require('../common');
+var assert = require('assert');
+var spawn = require('child_process').spawn;
+var path = require('path');
+var fs = require('fs');
+
+var options = {
+  cwd: common.fixturesDir
+};
+var child = spawn(process.execPath, ['-e', 'require("foo")'], options);
+child.on('exit', function(code) {
+  assert.equal(code, 0);
+});
+
diff --git a/wscript b/wscript
index f7d27e5a0..5955b4219 100644
--- a/wscript
+++ b/wscript
@@ -869,7 +869,7 @@ def build(bld):
         , 'CPPFLAGS'  : " ".join(program.env["CPPFLAGS"]).replace('"', '\\"')
         , 'LIBFLAGS'  : " ".join(program.env["LIBFLAGS"]).replace('"', '\\"')
         , 'PREFIX'    : safe_path(program.env["PREFIX"])
-        , 'VERSION'   : '0.4.8' # FIXME should not be hard-coded, see NODE_VERSION_STRING in src/node_version.
+        , 'VERSION'   : '0.4.9' # FIXME should not be hard-coded, see NODE_VERSION_STRING in src/node_version.
         }
     return x