diff --git a/.eslintrc.yaml b/.eslintrc.yaml
index 9665a635910b44..f39bbfe4cb59fb 100644
--- a/.eslintrc.yaml
+++ b/.eslintrc.yaml
@@ -100,7 +100,10 @@ rules:
   key-spacing: [2, {mode: minimum}]
   keyword-spacing: 2
   linebreak-style: [2, unix]
-  max-len: [2, {code: 80, ignoreUrls: true, tabWidth: 2}]
+  max-len: [2, {code: 80,
+                ignoreRegExpLiterals: true,
+                ignoreUrls: true,
+                tabWidth: 2}]
   new-parens: 2
   no-mixed-spaces-and-tabs: 2
   no-multiple-empty-lines: [2, {max: 2, maxEOF: 0, maxBOF: 0}]
@@ -109,8 +112,14 @@ rules:
     message: "setTimeout() must be invoked with at least two arguments."
   }, {
     selector: "CallExpression[callee.name='setInterval'][arguments.length<2]",
-    message: "setInterval() must be invoked with at least 2 arguments"
-  }]
+    message: "setInterval() must be invoked with at least 2 arguments."
+  }, {
+    selector: "ThrowStatement > CallExpression[callee.name=/Error$/]",
+    message: "Use new keyword when throwing an Error."
+    }, {
+    selector: "CallExpression[callee.object.name='assert'][callee.property.name='fail'][arguments.length=1]",
+    message: "assert.fail() message should be third argument"
+    }]
   no-tabs: 2
   no-trailing-spaces: 2
   operator-linebreak: [2, after, {overrides: {'?': ignore, ':': ignore}}]
@@ -140,9 +149,7 @@ rules:
 
   # Custom rules in tools/eslint-rules
   align-multiline-assignment: 2
-  assert-fail-single-argument: 2
   assert-throws-arguments: [2, { requireTwo: false }]
-  new-with-error: [2, Error, RangeError, TypeError, SyntaxError, ReferenceError]
   no-useless-regex-char-class-escape: [2, { override: ['[', ']'] }]
 
 # Global scoped method and vars
diff --git a/.gitignore b/.gitignore
index f8f99f5f839389..b1e73c519893c4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -34,6 +34,7 @@ node_g
 .benchmark_reports
 icu_config.gypi
 .eslintcache
+node_trace.*.log
 
 /out
 
diff --git a/BUILDING.md b/BUILDING.md
index d1962af1bdf70f..979908b2150bc6 100644
--- a/BUILDING.md
+++ b/BUILDING.md
@@ -26,11 +26,10 @@ Support is divided into three tiers:
   the broader community.
 * **Tier 2**: Full test coverage but more limited maintenance,
   often provided by the vendor of the platform.
-* **Experimental**: Known to compile but not necessarily reliably or with
-  a full passing test suite. These are often working to be promoted to Tier
-  2 but are not quite ready. There is at least one individual actively
-  providing maintenance and the team is striving to broaden quality and
-  reliability of support.
+* **Experimental**: May not compile reliably or test suite may not pass.
+  These are often working to be promoted to Tier 2 but are not quite ready.
+  There is at least one individual actively providing maintenance and the team
+  is striving to broaden quality and reliability of support.
 
 ### Supported platforms
 
@@ -96,7 +95,7 @@ to avoid popups asking to accept incoming network connections when running tests
 $ sudo ./tools/macosx-firewall.sh
 ```
 Running this script will add rules for the executable `node` in the out
-directory and the symbolic `node` link in the projects root directory.
+directory and the symbolic `node` link in the project's root directory.
 
 On FreeBSD and OpenBSD, you may also need:
 * libexecinfo
@@ -121,7 +120,7 @@ and not a newer version.
 
 To run the tests:
 
-```console
+```
 $ make test
 ```
 
@@ -206,9 +205,9 @@ in the current continuous integration environment. The participation of people
 dedicated and determined to improve Android building, testing, and support is
 encouraged.
 
-Be sure you have downloaded and extracted [Android NDK]
-(https://developer.android.com/tools/sdk/ndk/index.html)
-before in a folder. Then run:
+Be sure you have downloaded and extracted
+[Android NDK](https://developer.android.com/tools/sdk/ndk/index.html) before in
+a folder. Then run:
 
 ```console
 $ ./android-configure /path/to/your/android-ndk
@@ -350,6 +349,6 @@ and [user guide](https://openssl.org/docs/fips/UserGuide-2.0.pdf).
 6. Get into Node.js checkout folder
 7. `./configure --openssl-fips=/path/to/openssl-fips/installdir`
    For example on ubuntu 12 the installation directory was
-   /usr/local/ssl/fips-2.0
+   `/usr/local/ssl/fips-2.0`
 8. Build Node.js with `make -j`
-9. Verify with `node -p "process.versions.openssl"` (`1.0.2a-fips`)
+9. Verify with `node -p "process.versions.openssl"` (for example `1.0.2a-fips`)
diff --git a/Makefile b/Makefile
index 9bd94fc3679d20..e2a2f1bca31995 100644
--- a/Makefile
+++ b/Makefile
@@ -122,7 +122,7 @@ test: all
 	$(MAKE) build-addons
 	$(MAKE) cctest
 	$(PYTHON) tools/test.py --mode=release -J \
-		addons doctool inspector known_issues message pseudo-tty parallel sequential
+		doctool inspector known_issues message pseudo-tty parallel sequential addons
 	$(MAKE) lint
 
 test-parallel: all
@@ -186,6 +186,14 @@ test/addons/.buildstamp: config.gypi \
 # TODO(bnoordhuis) Force rebuild after gyp update.
 build-addons: $(NODE_EXE) test/addons/.buildstamp
 
+clear-stalled:
+	# Clean up any leftover processes but don't error if found.
+	ps awwx | grep Release/node | grep -v grep | cat
+	@PS_OUT=`ps awwx | grep Release/node | grep -v grep | awk '{print $$1}'`; \
+	if [ "$${PS_OUT}" ]; then \
+		echo $${PS_OUT} | xargs kill; \
+	fi
+
 test-gc: all test/gc/node_modules/weak/build/Release/weakref.node
 	$(PYTHON) tools/test.py --mode=release gc
 
@@ -208,26 +216,28 @@ test-ci-native: | test/addons/.buildstamp
 		$(TEST_CI_ARGS) $(CI_NATIVE_SUITES)
 
 # This target should not use a native compiler at all
-test-ci-js:
+test-ci-js: | clear-stalled
 	$(PYTHON) tools/test.py $(PARALLEL_ARGS) -p tap --logfile test.tap \
 		--mode=release --flaky-tests=$(FLAKY_TESTS) \
 		$(TEST_CI_ARGS) $(CI_JS_SUITES)
-	# Clean up any leftover processes
-	PS_OUT=`ps awwx | grep Release/node | grep -v grep | awk '{print $$1}'`; \
+	# Clean up any leftover processes, error if found.
+	ps awwx | grep Release/node | grep -v grep | cat
+	@PS_OUT=`ps awwx | grep Release/node | grep -v grep | awk '{print $$1}'`; \
 	if [ "$${PS_OUT}" ]; then \
 		echo $${PS_OUT} | $(XARGS) kill; exit 1; \
 	fi
 
 test-ci: LOGLEVEL := info
-test-ci: | build-addons
+test-ci: | clear-stalled build-addons
 	out/Release/cctest --gtest_output=tap:cctest.tap
 	$(PYTHON) tools/test.py $(PARALLEL_ARGS) -p tap --logfile test.tap \
 		--mode=release --flaky-tests=$(FLAKY_TESTS) \
-		$(TEST_CI_ARGS) $(CI_NATIVE_SUITES) $(CI_JS_SUITES)
-	# Clean up any leftover processes
-	PS_OUT=`ps awwx | grep Release/node | grep -v grep | awk '{print $$1}'`; \
+		$(TEST_CI_ARGS) $(CI_JS_SUITES) $(CI_NATIVE_SUITES)
+	# Clean up any leftover processes, error if found.
+	ps awwx | grep Release/node | grep -v grep | cat
+	@PS_OUT=`ps awwx | grep Release/node | grep -v grep | awk '{print $$1}'`; \
 	if [ "$${PS_OUT}" ]; then \
-		echo $${PS_OUT} | $(XARGS) kill; exit 1; \
+		echo $${PS_OUT} | xargs kill; exit 1; \
 	fi
 
 test-release: test-build
@@ -800,5 +810,4 @@ endif
         bench-buffer bench-net bench-http bench-fs bench-tls cctest run-ci \
         test-v8 test-v8-intl test-v8-benchmarks test-v8-all v8 lint-ci \
         bench-ci jslint-ci doc-only $(TARBALL)-headers test-ci test-ci-native \
-        test-ci-js build-ci
-
+        test-ci-js build-ci clear-stalled
diff --git a/benchmark/module/module-loader.js b/benchmark/module/module-loader.js
index a175533c7bbc6e..0a8e97aea8eadf 100644
--- a/benchmark/module/module-loader.js
+++ b/benchmark/module/module-loader.js
@@ -34,6 +34,8 @@ function main(conf) {
     measureFull(n);
   else
     measureDir(n);
+
+  rmrf(tmpDirectory);
 }
 
 function measureFull(n) {
diff --git a/benchmark/net/tcp-raw-pipe.js b/benchmark/net/tcp-raw-pipe.js
index fb8da5ea41faf3..b6a61e49dc9748 100644
--- a/benchmark/net/tcp-raw-pipe.js
+++ b/benchmark/net/tcp-raw-pipe.js
@@ -97,8 +97,6 @@ function client() {
   if (err)
     fail(err, 'connect');
 
-  clientHandle.readStart();
-
   clientHandle.onread = function(nread, buffer) {
     if (nread < 0)
       fail(nread, 'read');
@@ -112,6 +110,8 @@ function client() {
 
     bench.start();
 
+    clientHandle.readStart();
+
     setTimeout(function() {
       // multiply by 2 since we're sending it first one way
       // then then back again.
diff --git a/deps/openssl/asm/arm-void-gas/aes/bsaes-armv7.S b/deps/openssl/asm/arm-void-gas/aes/bsaes-armv7.S
index 449e7a442e87ce..b21ed7078b194a 100644
--- a/deps/openssl/asm/arm-void-gas/aes/bsaes-armv7.S
+++ b/deps/openssl/asm/arm-void-gas/aes/bsaes-armv7.S
@@ -1298,7 +1298,7 @@ bsaes_cbc_encrypt:
 	vmov	q4,q15		@ just in case ensure that IV
 	vmov	q5,q0			@ and input are preserved
 	bl	AES_decrypt
-	vld1.8	{q0}, [r9,:64]		@ load result
+	vld1.8	{q0}, [r9]		@ load result
 	veor	q0, q0, q4	@ ^= IV
 	vmov	q15, q5		@ q5 holds input
 	vst1.8	{q0}, [r10]		@ write output
diff --git a/deps/openssl/asm/x64-elf-gas/aes/aesni-sha1-x86_64.s b/deps/openssl/asm/x64-elf-gas/aes/aesni-sha1-x86_64.s
index 88042248685372..c7c53e8771e132 100644
--- a/deps/openssl/asm/x64-elf-gas/aes/aesni-sha1-x86_64.s
+++ b/deps/openssl/asm/x64-elf-gas/aes/aesni-sha1-x86_64.s
@@ -2692,6 +2692,7 @@ aesni_cbc_sha1_enc_shaext:
 	movl	240(%rcx),%r11d
 	subq	%rdi,%rsi
 	movups	(%rcx),%xmm15
+	movups	(%r8),%xmm2
 	movups	16(%rcx),%xmm0
 	leaq	112(%rcx),%rcx
 
diff --git a/deps/openssl/asm/x64-elf-gas/aes/aesni-sha256-x86_64.s b/deps/openssl/asm/x64-elf-gas/aes/aesni-sha256-x86_64.s
index 139ebe3615c46c..70eed05b00c136 100644
--- a/deps/openssl/asm/x64-elf-gas/aes/aesni-sha256-x86_64.s
+++ b/deps/openssl/asm/x64-elf-gas/aes/aesni-sha256-x86_64.s
@@ -4012,6 +4012,7 @@ aesni_cbc_sha256_enc_shaext:
 	movl	240(%rcx),%r11d
 	subq	%rdi,%rsi
 	movups	(%rcx),%xmm15
+	movups	(%r8),%xmm6
 	movups	16(%rcx),%xmm4
 	leaq	112(%rcx),%rcx
 
diff --git a/deps/openssl/asm/x64-elf-gas/x86_64cpuid.s b/deps/openssl/asm/x64-elf-gas/x86_64cpuid.s
index 0e81a290e3ec09..06d11dc9c8e95e 100644
--- a/deps/openssl/asm/x64-elf-gas/x86_64cpuid.s
+++ b/deps/openssl/asm/x64-elf-gas/x86_64cpuid.s
@@ -107,14 +107,6 @@ OPENSSL_ia32_cpuid:
 	shrl	$14,%r10d
 	andl	$0xfff,%r10d
 
-	cmpl	$7,%r11d
-	jb	.Lnocacheinfo
-
-	movl	$7,%eax
-	xorl	%ecx,%ecx
-	cpuid
-	movl	%ebx,8(%rdi)
-
 .Lnocacheinfo:
 	movl	$1,%eax
 	cpuid
@@ -144,6 +136,15 @@ OPENSSL_ia32_cpuid:
 	orl	%ecx,%r9d
 
 	movl	%edx,%r10d
+
+	cmpl	$7,%r11d
+	jb	.Lno_extended_info
+	movl	$7,%eax
+	xorl	%ecx,%ecx
+	cpuid
+	movl	%ebx,8(%rdi)
+.Lno_extended_info:
+
 	btl	$27,%r9d
 	jnc	.Lclear_avx
 	xorl	%ecx,%ecx
diff --git a/deps/openssl/asm/x64-macosx-gas/aes/aesni-sha1-x86_64.s b/deps/openssl/asm/x64-macosx-gas/aes/aesni-sha1-x86_64.s
index c7606aec49a95b..cdce52cd0a2358 100644
--- a/deps/openssl/asm/x64-macosx-gas/aes/aesni-sha1-x86_64.s
+++ b/deps/openssl/asm/x64-macosx-gas/aes/aesni-sha1-x86_64.s
@@ -2692,6 +2692,7 @@ aesni_cbc_sha1_enc_shaext:
 	movl	240(%rcx),%r11d
 	subq	%rdi,%rsi
 	movups	(%rcx),%xmm15
+	movups	(%r8),%xmm2
 	movups	16(%rcx),%xmm0
 	leaq	112(%rcx),%rcx
 
diff --git a/deps/openssl/asm/x64-macosx-gas/aes/aesni-sha256-x86_64.s b/deps/openssl/asm/x64-macosx-gas/aes/aesni-sha256-x86_64.s
index 89faf46249a9b9..40e75bfedb6d3a 100644
--- a/deps/openssl/asm/x64-macosx-gas/aes/aesni-sha256-x86_64.s
+++ b/deps/openssl/asm/x64-macosx-gas/aes/aesni-sha256-x86_64.s
@@ -4012,6 +4012,7 @@ aesni_cbc_sha256_enc_shaext:
 	movl	240(%rcx),%r11d
 	subq	%rdi,%rsi
 	movups	(%rcx),%xmm15
+	movups	(%r8),%xmm6
 	movups	16(%rcx),%xmm4
 	leaq	112(%rcx),%rcx
 
diff --git a/deps/openssl/asm/x64-macosx-gas/x86_64cpuid.s b/deps/openssl/asm/x64-macosx-gas/x86_64cpuid.s
index ef623d5967716c..909270ecae312b 100644
--- a/deps/openssl/asm/x64-macosx-gas/x86_64cpuid.s
+++ b/deps/openssl/asm/x64-macosx-gas/x86_64cpuid.s
@@ -108,14 +108,6 @@ L$intel:
 	shrl	$14,%r10d
 	andl	$0xfff,%r10d
 
-	cmpl	$7,%r11d
-	jb	L$nocacheinfo
-
-	movl	$7,%eax
-	xorl	%ecx,%ecx
-	cpuid
-	movl	%ebx,8(%rdi)
-
 L$nocacheinfo:
 	movl	$1,%eax
 	cpuid
@@ -145,6 +137,15 @@ L$generic:
 	orl	%ecx,%r9d
 
 	movl	%edx,%r10d
+
+	cmpl	$7,%r11d
+	jb	L$no_extended_info
+	movl	$7,%eax
+	xorl	%ecx,%ecx
+	cpuid
+	movl	%ebx,8(%rdi)
+L$no_extended_info:
+
 	btl	$27,%r9d
 	jnc	L$clear_avx
 	xorl	%ecx,%ecx
diff --git a/deps/openssl/asm/x64-win32-masm/aes/aesni-sha1-x86_64.asm b/deps/openssl/asm/x64-win32-masm/aes/aesni-sha1-x86_64.asm
index 7403dc3ee6bac1..5a2c8e0eb52b0b 100644
--- a/deps/openssl/asm/x64-win32-masm/aes/aesni-sha1-x86_64.asm
+++ b/deps/openssl/asm/x64-win32-masm/aes/aesni-sha1-x86_64.asm
@@ -2793,6 +2793,7 @@ $L$prologue_shaext::
 	mov	r11d,DWORD PTR[240+rcx]
 	sub	rsi,rdi
 	movups	xmm15,XMMWORD PTR[rcx]
+	movups	xmm2,XMMWORD PTR[r8]
 	movups	xmm0,XMMWORD PTR[16+rcx]
 	lea	rcx,QWORD PTR[112+rcx]
 
diff --git a/deps/openssl/asm/x64-win32-masm/aes/aesni-sha256-x86_64.asm b/deps/openssl/asm/x64-win32-masm/aes/aesni-sha256-x86_64.asm
index 602ee5b2655442..b6fc1862a893d7 100644
--- a/deps/openssl/asm/x64-win32-masm/aes/aesni-sha256-x86_64.asm
+++ b/deps/openssl/asm/x64-win32-masm/aes/aesni-sha256-x86_64.asm
@@ -4146,6 +4146,7 @@ $L$prologue_shaext::
 	mov	r11d,DWORD PTR[240+rcx]
 	sub	rsi,rdi
 	movups	xmm15,XMMWORD PTR[rcx]
+	movups	xmm6,XMMWORD PTR[r8]
 	movups	xmm4,XMMWORD PTR[16+rcx]
 	lea	rcx,QWORD PTR[112+rcx]
 
diff --git a/deps/openssl/asm/x64-win32-masm/x86_64cpuid.asm b/deps/openssl/asm/x64-win32-masm/x86_64cpuid.asm
index c767b91f9a7cd1..6cb8077b9da0a5 100644
--- a/deps/openssl/asm/x64-win32-masm/x86_64cpuid.asm
+++ b/deps/openssl/asm/x64-win32-masm/x86_64cpuid.asm
@@ -118,14 +118,6 @@ $L$intel::
 	shr	r10d,14
 	and	r10d,0fffh
 
-	cmp	r11d,7
-	jb	$L$nocacheinfo
-
-	mov	eax,7
-	xor	ecx,ecx
-	cpuid
-	mov	DWORD PTR[8+rdi],ebx
-
 $L$nocacheinfo::
 	mov	eax,1
 	cpuid
@@ -155,6 +147,15 @@ $L$generic::
 	or	r9d,ecx
 
 	mov	r10d,edx
+
+	cmp	r11d,7
+	jb	$L$no_extended_info
+	mov	eax,7
+	xor	ecx,ecx
+	cpuid
+	mov	DWORD PTR[8+rdi],ebx
+$L$no_extended_info::
+
 	bt	r9d,27
 	jnc	$L$clear_avx
 	xor	ecx,ecx
diff --git a/deps/openssl/asm/x86-elf-gas/x86cpuid.s b/deps/openssl/asm/x86-elf-gas/x86cpuid.s
index 80a4d1a5183adf..08369b42391d75 100644
--- a/deps/openssl/asm/x86-elf-gas/x86cpuid.s
+++ b/deps/openssl/asm/x86-elf-gas/x86cpuid.s
@@ -20,10 +20,10 @@ OPENSSL_ia32_cpuid:
 	popl	%eax
 	xorl	%eax,%ecx
 	xorl	%eax,%eax
-	btl	$21,%ecx
-	jnc	.L000nocpuid
 	movl	20(%esp),%esi
 	movl	%eax,8(%esi)
+	btl	$21,%ecx
+	jnc	.L000nocpuid
 	.byte	0x0f,0xa2
 	movl	%eax,%edi
 	xorl	%eax,%eax
@@ -74,40 +74,32 @@ OPENSSL_ia32_cpuid:
 	andl	$4026531839,%edx
 	jmp	.L002generic
 .L001intel:
-	cmpl	$7,%edi
-	jb	.L003cacheinfo
-	movl	20(%esp),%esi
-	movl	$7,%eax
-	xorl	%ecx,%ecx
-	.byte	0x0f,0xa2
-	movl	%ebx,8(%esi)
-.L003cacheinfo:
 	cmpl	$4,%edi
-	movl	$-1,%edi
-	jb	.L004nocacheinfo
+	movl	$-1,%esi
+	jb	.L003nocacheinfo
 	movl	$4,%eax
 	movl	$0,%ecx
 	.byte	0x0f,0xa2
-	movl	%eax,%edi
-	shrl	$14,%edi
-	andl	$4095,%edi
-.L004nocacheinfo:
+	movl	%eax,%esi
+	shrl	$14,%esi
+	andl	$4095,%esi
+.L003nocacheinfo:
 	movl	$1,%eax
 	xorl	%ecx,%ecx
 	.byte	0x0f,0xa2
 	andl	$3220176895,%edx
 	cmpl	$0,%ebp
-	jne	.L005notintel
+	jne	.L004notintel
 	orl	$1073741824,%edx
 	andb	$15,%ah
 	cmpb	$15,%ah
-	jne	.L005notintel
+	jne	.L004notintel
 	orl	$1048576,%edx
-.L005notintel:
+.L004notintel:
 	btl	$28,%edx
 	jnc	.L002generic
 	andl	$4026531839,%edx
-	cmpl	$0,%edi
+	cmpl	$0,%esi
 	je	.L002generic
 	orl	$268435456,%edx
 	shrl	$16,%ebx
@@ -119,7 +111,15 @@ OPENSSL_ia32_cpuid:
 	andl	$4294965247,%ecx
 	movl	%edx,%esi
 	orl	%ecx,%ebp
-	btl	$27,%ecx
+	cmpl	$7,%edi
+	movl	20(%esp),%edi
+	jb	.L005no_extended_info
+	movl	$7,%eax
+	xorl	%ecx,%ecx
+	.byte	0x0f,0xa2
+	movl	%ebx,8(%edi)
+.L005no_extended_info:
+	btl	$27,%ebp
 	jnc	.L006clear_avx
 	xorl	%ecx,%ecx
 .byte	15,1,208
@@ -133,7 +133,6 @@ OPENSSL_ia32_cpuid:
 	andl	$4278190079,%esi
 .L006clear_avx:
 	andl	$4026525695,%ebp
-	movl	20(%esp),%edi
 	andl	$4294967263,8(%edi)
 .L007done:
 	movl	%esi,%eax
diff --git a/deps/openssl/asm/x86-macosx-gas/x86cpuid.s b/deps/openssl/asm/x86-macosx-gas/x86cpuid.s
index 3db70b61139e72..c3e9fd6dbaf05b 100644
--- a/deps/openssl/asm/x86-macosx-gas/x86cpuid.s
+++ b/deps/openssl/asm/x86-macosx-gas/x86cpuid.s
@@ -19,10 +19,10 @@ L_OPENSSL_ia32_cpuid_begin:
 	popl	%eax
 	xorl	%eax,%ecx
 	xorl	%eax,%eax
-	btl	$21,%ecx
-	jnc	L000nocpuid
 	movl	20(%esp),%esi
 	movl	%eax,8(%esi)
+	btl	$21,%ecx
+	jnc	L000nocpuid
 	.byte	0x0f,0xa2
 	movl	%eax,%edi
 	xorl	%eax,%eax
@@ -73,40 +73,32 @@ L_OPENSSL_ia32_cpuid_begin:
 	andl	$4026531839,%edx
 	jmp	L002generic
 L001intel:
-	cmpl	$7,%edi
-	jb	L003cacheinfo
-	movl	20(%esp),%esi
-	movl	$7,%eax
-	xorl	%ecx,%ecx
-	.byte	0x0f,0xa2
-	movl	%ebx,8(%esi)
-L003cacheinfo:
 	cmpl	$4,%edi
-	movl	$-1,%edi
-	jb	L004nocacheinfo
+	movl	$-1,%esi
+	jb	L003nocacheinfo
 	movl	$4,%eax
 	movl	$0,%ecx
 	.byte	0x0f,0xa2
-	movl	%eax,%edi
-	shrl	$14,%edi
-	andl	$4095,%edi
-L004nocacheinfo:
+	movl	%eax,%esi
+	shrl	$14,%esi
+	andl	$4095,%esi
+L003nocacheinfo:
 	movl	$1,%eax
 	xorl	%ecx,%ecx
 	.byte	0x0f,0xa2
 	andl	$3220176895,%edx
 	cmpl	$0,%ebp
-	jne	L005notintel
+	jne	L004notintel
 	orl	$1073741824,%edx
 	andb	$15,%ah
 	cmpb	$15,%ah
-	jne	L005notintel
+	jne	L004notintel
 	orl	$1048576,%edx
-L005notintel:
+L004notintel:
 	btl	$28,%edx
 	jnc	L002generic
 	andl	$4026531839,%edx
-	cmpl	$0,%edi
+	cmpl	$0,%esi
 	je	L002generic
 	orl	$268435456,%edx
 	shrl	$16,%ebx
@@ -118,7 +110,15 @@ L002generic:
 	andl	$4294965247,%ecx
 	movl	%edx,%esi
 	orl	%ecx,%ebp
-	btl	$27,%ecx
+	cmpl	$7,%edi
+	movl	20(%esp),%edi
+	jb	L005no_extended_info
+	movl	$7,%eax
+	xorl	%ecx,%ecx
+	.byte	0x0f,0xa2
+	movl	%ebx,8(%edi)
+L005no_extended_info:
+	btl	$27,%ebp
 	jnc	L006clear_avx
 	xorl	%ecx,%ecx
 .byte	15,1,208
@@ -132,7 +132,6 @@ L008clear_xmm:
 	andl	$4278190079,%esi
 L006clear_avx:
 	andl	$4026525695,%ebp
-	movl	20(%esp),%edi
 	andl	$4294967263,8(%edi)
 L007done:
 	movl	%esi,%eax
diff --git a/deps/openssl/asm/x86-win32-masm/x86cpuid.asm b/deps/openssl/asm/x86-win32-masm/x86cpuid.asm
index b4462fc2aa72bd..d53b6a44d895a3 100644
--- a/deps/openssl/asm/x86-win32-masm/x86cpuid.asm
+++ b/deps/openssl/asm/x86-win32-masm/x86cpuid.asm
@@ -35,10 +35,10 @@ $L_OPENSSL_ia32_cpuid_begin::
 	pop	eax
 	xor	ecx,eax
 	xor	eax,eax
-	bt	ecx,21
-	jnc	$L000nocpuid
 	mov	esi,DWORD PTR 20[esp]
 	mov	DWORD PTR 8[esi],eax
+	bt	ecx,21
+	jnc	$L000nocpuid
 	cpuid
 	mov	edi,eax
 	xor	eax,eax
@@ -89,40 +89,32 @@ $L_OPENSSL_ia32_cpuid_begin::
 	and	edx,4026531839
 	jmp	$L002generic
 $L001intel:
-	cmp	edi,7
-	jb	$L003cacheinfo
-	mov	esi,DWORD PTR 20[esp]
-	mov	eax,7
-	xor	ecx,ecx
-	cpuid
-	mov	DWORD PTR 8[esi],ebx
-$L003cacheinfo:
 	cmp	edi,4
-	mov	edi,-1
-	jb	$L004nocacheinfo
+	mov	esi,-1
+	jb	$L003nocacheinfo
 	mov	eax,4
 	mov	ecx,0
 	cpuid
-	mov	edi,eax
-	shr	edi,14
-	and	edi,4095
-$L004nocacheinfo:
+	mov	esi,eax
+	shr	esi,14
+	and	esi,4095
+$L003nocacheinfo:
 	mov	eax,1
 	xor	ecx,ecx
 	cpuid
 	and	edx,3220176895
 	cmp	ebp,0
-	jne	$L005notintel
+	jne	$L004notintel
 	or	edx,1073741824
 	and	ah,15
 	cmp	ah,15
-	jne	$L005notintel
+	jne	$L004notintel
 	or	edx,1048576
-$L005notintel:
+$L004notintel:
 	bt	edx,28
 	jnc	$L002generic
 	and	edx,4026531839
-	cmp	edi,0
+	cmp	esi,0
 	je	$L002generic
 	or	edx,268435456
 	shr	ebx,16
@@ -134,7 +126,15 @@ $L002generic:
 	and	ecx,4294965247
 	mov	esi,edx
 	or	ebp,ecx
-	bt	ecx,27
+	cmp	edi,7
+	mov	edi,DWORD PTR 20[esp]
+	jb	$L005no_extended_info
+	mov	eax,7
+	xor	ecx,ecx
+	cpuid
+	mov	DWORD PTR 8[edi],ebx
+$L005no_extended_info:
+	bt	ebp,27
 	jnc	$L006clear_avx
 	xor	ecx,ecx
 DB	15,1,208
@@ -148,7 +148,6 @@ $L008clear_xmm:
 	and	esi,4278190079
 $L006clear_avx:
 	and	ebp,4026525695
-	mov	edi,DWORD PTR 20[esp]
 	and	DWORD PTR 8[edi],4294967263
 $L007done:
 	mov	eax,esi
diff --git a/deps/openssl/asm_obsolete/arm-void-gas/aes/bsaes-armv7.S b/deps/openssl/asm_obsolete/arm-void-gas/aes/bsaes-armv7.S
index 449e7a442e87ce..b21ed7078b194a 100644
--- a/deps/openssl/asm_obsolete/arm-void-gas/aes/bsaes-armv7.S
+++ b/deps/openssl/asm_obsolete/arm-void-gas/aes/bsaes-armv7.S
@@ -1298,7 +1298,7 @@ bsaes_cbc_encrypt:
 	vmov	q4,q15		@ just in case ensure that IV
 	vmov	q5,q0			@ and input are preserved
 	bl	AES_decrypt
-	vld1.8	{q0}, [r9,:64]		@ load result
+	vld1.8	{q0}, [r9]		@ load result
 	veor	q0, q0, q4	@ ^= IV
 	vmov	q15, q5		@ q5 holds input
 	vst1.8	{q0}, [r10]		@ write output
diff --git a/deps/openssl/asm_obsolete/x64-elf-gas/aes/aesni-sha1-x86_64.s b/deps/openssl/asm_obsolete/x64-elf-gas/aes/aesni-sha1-x86_64.s
index d4ed2047c6db9c..84c5dced020b22 100644
--- a/deps/openssl/asm_obsolete/x64-elf-gas/aes/aesni-sha1-x86_64.s
+++ b/deps/openssl/asm_obsolete/x64-elf-gas/aes/aesni-sha1-x86_64.s
@@ -1389,6 +1389,7 @@ aesni_cbc_sha1_enc_shaext:
 	movl	240(%rcx),%r11d
 	subq	%rdi,%rsi
 	movups	(%rcx),%xmm15
+	movups	(%r8),%xmm2
 	movups	16(%rcx),%xmm0
 	leaq	112(%rcx),%rcx
 
diff --git a/deps/openssl/asm_obsolete/x64-elf-gas/x86_64cpuid.s b/deps/openssl/asm_obsolete/x64-elf-gas/x86_64cpuid.s
index 0e81a290e3ec09..06d11dc9c8e95e 100644
--- a/deps/openssl/asm_obsolete/x64-elf-gas/x86_64cpuid.s
+++ b/deps/openssl/asm_obsolete/x64-elf-gas/x86_64cpuid.s
@@ -107,14 +107,6 @@ OPENSSL_ia32_cpuid:
 	shrl	$14,%r10d
 	andl	$0xfff,%r10d
 
-	cmpl	$7,%r11d
-	jb	.Lnocacheinfo
-
-	movl	$7,%eax
-	xorl	%ecx,%ecx
-	cpuid
-	movl	%ebx,8(%rdi)
-
 .Lnocacheinfo:
 	movl	$1,%eax
 	cpuid
@@ -144,6 +136,15 @@ OPENSSL_ia32_cpuid:
 	orl	%ecx,%r9d
 
 	movl	%edx,%r10d
+
+	cmpl	$7,%r11d
+	jb	.Lno_extended_info
+	movl	$7,%eax
+	xorl	%ecx,%ecx
+	cpuid
+	movl	%ebx,8(%rdi)
+.Lno_extended_info:
+
 	btl	$27,%r9d
 	jnc	.Lclear_avx
 	xorl	%ecx,%ecx
diff --git a/deps/openssl/asm_obsolete/x64-macosx-gas/aes/aesni-sha1-x86_64.s b/deps/openssl/asm_obsolete/x64-macosx-gas/aes/aesni-sha1-x86_64.s
index 015db5faa7facd..8cd95238b020d7 100644
--- a/deps/openssl/asm_obsolete/x64-macosx-gas/aes/aesni-sha1-x86_64.s
+++ b/deps/openssl/asm_obsolete/x64-macosx-gas/aes/aesni-sha1-x86_64.s
@@ -1389,6 +1389,7 @@ aesni_cbc_sha1_enc_shaext:
 	movl	240(%rcx),%r11d
 	subq	%rdi,%rsi
 	movups	(%rcx),%xmm15
+	movups	(%r8),%xmm2
 	movups	16(%rcx),%xmm0
 	leaq	112(%rcx),%rcx
 
diff --git a/deps/openssl/asm_obsolete/x64-macosx-gas/x86_64cpuid.s b/deps/openssl/asm_obsolete/x64-macosx-gas/x86_64cpuid.s
index ef623d5967716c..909270ecae312b 100644
--- a/deps/openssl/asm_obsolete/x64-macosx-gas/x86_64cpuid.s
+++ b/deps/openssl/asm_obsolete/x64-macosx-gas/x86_64cpuid.s
@@ -108,14 +108,6 @@ L$intel:
 	shrl	$14,%r10d
 	andl	$0xfff,%r10d
 
-	cmpl	$7,%r11d
-	jb	L$nocacheinfo
-
-	movl	$7,%eax
-	xorl	%ecx,%ecx
-	cpuid
-	movl	%ebx,8(%rdi)
-
 L$nocacheinfo:
 	movl	$1,%eax
 	cpuid
@@ -145,6 +137,15 @@ L$generic:
 	orl	%ecx,%r9d
 
 	movl	%edx,%r10d
+
+	cmpl	$7,%r11d
+	jb	L$no_extended_info
+	movl	$7,%eax
+	xorl	%ecx,%ecx
+	cpuid
+	movl	%ebx,8(%rdi)
+L$no_extended_info:
+
 	btl	$27,%r9d
 	jnc	L$clear_avx
 	xorl	%ecx,%ecx
diff --git a/deps/openssl/asm_obsolete/x64-win32-masm/aes/aesni-sha1-x86_64.asm b/deps/openssl/asm_obsolete/x64-win32-masm/aes/aesni-sha1-x86_64.asm
index bfc5fa17b4aa70..dbad8c5e233db6 100644
--- a/deps/openssl/asm_obsolete/x64-win32-masm/aes/aesni-sha1-x86_64.asm
+++ b/deps/openssl/asm_obsolete/x64-win32-masm/aes/aesni-sha1-x86_64.asm
@@ -1454,6 +1454,7 @@ $L$prologue_shaext::
 	mov	r11d,DWORD PTR[240+rcx]
 	sub	rsi,rdi
 	movups	xmm15,XMMWORD PTR[rcx]
+	movups	xmm2,XMMWORD PTR[r8]
 	movups	xmm0,XMMWORD PTR[16+rcx]
 	lea	rcx,QWORD PTR[112+rcx]
 
diff --git a/deps/openssl/asm_obsolete/x64-win32-masm/x86_64cpuid.asm b/deps/openssl/asm_obsolete/x64-win32-masm/x86_64cpuid.asm
index c767b91f9a7cd1..6cb8077b9da0a5 100644
--- a/deps/openssl/asm_obsolete/x64-win32-masm/x86_64cpuid.asm
+++ b/deps/openssl/asm_obsolete/x64-win32-masm/x86_64cpuid.asm
@@ -118,14 +118,6 @@ $L$intel::
 	shr	r10d,14
 	and	r10d,0fffh
 
-	cmp	r11d,7
-	jb	$L$nocacheinfo
-
-	mov	eax,7
-	xor	ecx,ecx
-	cpuid
-	mov	DWORD PTR[8+rdi],ebx
-
 $L$nocacheinfo::
 	mov	eax,1
 	cpuid
@@ -155,6 +147,15 @@ $L$generic::
 	or	r9d,ecx
 
 	mov	r10d,edx
+
+	cmp	r11d,7
+	jb	$L$no_extended_info
+	mov	eax,7
+	xor	ecx,ecx
+	cpuid
+	mov	DWORD PTR[8+rdi],ebx
+$L$no_extended_info::
+
 	bt	r9d,27
 	jnc	$L$clear_avx
 	xor	ecx,ecx
diff --git a/deps/openssl/asm_obsolete/x86-elf-gas/x86cpuid.s b/deps/openssl/asm_obsolete/x86-elf-gas/x86cpuid.s
index 80a4d1a5183adf..08369b42391d75 100644
--- a/deps/openssl/asm_obsolete/x86-elf-gas/x86cpuid.s
+++ b/deps/openssl/asm_obsolete/x86-elf-gas/x86cpuid.s
@@ -20,10 +20,10 @@ OPENSSL_ia32_cpuid:
 	popl	%eax
 	xorl	%eax,%ecx
 	xorl	%eax,%eax
-	btl	$21,%ecx
-	jnc	.L000nocpuid
 	movl	20(%esp),%esi
 	movl	%eax,8(%esi)
+	btl	$21,%ecx
+	jnc	.L000nocpuid
 	.byte	0x0f,0xa2
 	movl	%eax,%edi
 	xorl	%eax,%eax
@@ -74,40 +74,32 @@ OPENSSL_ia32_cpuid:
 	andl	$4026531839,%edx
 	jmp	.L002generic
 .L001intel:
-	cmpl	$7,%edi
-	jb	.L003cacheinfo
-	movl	20(%esp),%esi
-	movl	$7,%eax
-	xorl	%ecx,%ecx
-	.byte	0x0f,0xa2
-	movl	%ebx,8(%esi)
-.L003cacheinfo:
 	cmpl	$4,%edi
-	movl	$-1,%edi
-	jb	.L004nocacheinfo
+	movl	$-1,%esi
+	jb	.L003nocacheinfo
 	movl	$4,%eax
 	movl	$0,%ecx
 	.byte	0x0f,0xa2
-	movl	%eax,%edi
-	shrl	$14,%edi
-	andl	$4095,%edi
-.L004nocacheinfo:
+	movl	%eax,%esi
+	shrl	$14,%esi
+	andl	$4095,%esi
+.L003nocacheinfo:
 	movl	$1,%eax
 	xorl	%ecx,%ecx
 	.byte	0x0f,0xa2
 	andl	$3220176895,%edx
 	cmpl	$0,%ebp
-	jne	.L005notintel
+	jne	.L004notintel
 	orl	$1073741824,%edx
 	andb	$15,%ah
 	cmpb	$15,%ah
-	jne	.L005notintel
+	jne	.L004notintel
 	orl	$1048576,%edx
-.L005notintel:
+.L004notintel:
 	btl	$28,%edx
 	jnc	.L002generic
 	andl	$4026531839,%edx
-	cmpl	$0,%edi
+	cmpl	$0,%esi
 	je	.L002generic
 	orl	$268435456,%edx
 	shrl	$16,%ebx
@@ -119,7 +111,15 @@ OPENSSL_ia32_cpuid:
 	andl	$4294965247,%ecx
 	movl	%edx,%esi
 	orl	%ecx,%ebp
-	btl	$27,%ecx
+	cmpl	$7,%edi
+	movl	20(%esp),%edi
+	jb	.L005no_extended_info
+	movl	$7,%eax
+	xorl	%ecx,%ecx
+	.byte	0x0f,0xa2
+	movl	%ebx,8(%edi)
+.L005no_extended_info:
+	btl	$27,%ebp
 	jnc	.L006clear_avx
 	xorl	%ecx,%ecx
 .byte	15,1,208
@@ -133,7 +133,6 @@ OPENSSL_ia32_cpuid:
 	andl	$4278190079,%esi
 .L006clear_avx:
 	andl	$4026525695,%ebp
-	movl	20(%esp),%edi
 	andl	$4294967263,8(%edi)
 .L007done:
 	movl	%esi,%eax
diff --git a/deps/openssl/asm_obsolete/x86-macosx-gas/x86cpuid.s b/deps/openssl/asm_obsolete/x86-macosx-gas/x86cpuid.s
index 3db70b61139e72..c3e9fd6dbaf05b 100644
--- a/deps/openssl/asm_obsolete/x86-macosx-gas/x86cpuid.s
+++ b/deps/openssl/asm_obsolete/x86-macosx-gas/x86cpuid.s
@@ -19,10 +19,10 @@ L_OPENSSL_ia32_cpuid_begin:
 	popl	%eax
 	xorl	%eax,%ecx
 	xorl	%eax,%eax
-	btl	$21,%ecx
-	jnc	L000nocpuid
 	movl	20(%esp),%esi
 	movl	%eax,8(%esi)
+	btl	$21,%ecx
+	jnc	L000nocpuid
 	.byte	0x0f,0xa2
 	movl	%eax,%edi
 	xorl	%eax,%eax
@@ -73,40 +73,32 @@ L_OPENSSL_ia32_cpuid_begin:
 	andl	$4026531839,%edx
 	jmp	L002generic
 L001intel:
-	cmpl	$7,%edi
-	jb	L003cacheinfo
-	movl	20(%esp),%esi
-	movl	$7,%eax
-	xorl	%ecx,%ecx
-	.byte	0x0f,0xa2
-	movl	%ebx,8(%esi)
-L003cacheinfo:
 	cmpl	$4,%edi
-	movl	$-1,%edi
-	jb	L004nocacheinfo
+	movl	$-1,%esi
+	jb	L003nocacheinfo
 	movl	$4,%eax
 	movl	$0,%ecx
 	.byte	0x0f,0xa2
-	movl	%eax,%edi
-	shrl	$14,%edi
-	andl	$4095,%edi
-L004nocacheinfo:
+	movl	%eax,%esi
+	shrl	$14,%esi
+	andl	$4095,%esi
+L003nocacheinfo:
 	movl	$1,%eax
 	xorl	%ecx,%ecx
 	.byte	0x0f,0xa2
 	andl	$3220176895,%edx
 	cmpl	$0,%ebp
-	jne	L005notintel
+	jne	L004notintel
 	orl	$1073741824,%edx
 	andb	$15,%ah
 	cmpb	$15,%ah
-	jne	L005notintel
+	jne	L004notintel
 	orl	$1048576,%edx
-L005notintel:
+L004notintel:
 	btl	$28,%edx
 	jnc	L002generic
 	andl	$4026531839,%edx
-	cmpl	$0,%edi
+	cmpl	$0,%esi
 	je	L002generic
 	orl	$268435456,%edx
 	shrl	$16,%ebx
@@ -118,7 +110,15 @@ L002generic:
 	andl	$4294965247,%ecx
 	movl	%edx,%esi
 	orl	%ecx,%ebp
-	btl	$27,%ecx
+	cmpl	$7,%edi
+	movl	20(%esp),%edi
+	jb	L005no_extended_info
+	movl	$7,%eax
+	xorl	%ecx,%ecx
+	.byte	0x0f,0xa2
+	movl	%ebx,8(%edi)
+L005no_extended_info:
+	btl	$27,%ebp
 	jnc	L006clear_avx
 	xorl	%ecx,%ecx
 .byte	15,1,208
@@ -132,7 +132,6 @@ L008clear_xmm:
 	andl	$4278190079,%esi
 L006clear_avx:
 	andl	$4026525695,%ebp
-	movl	20(%esp),%edi
 	andl	$4294967263,8(%edi)
 L007done:
 	movl	%esi,%eax
diff --git a/deps/openssl/asm_obsolete/x86-win32-masm/x86cpuid.asm b/deps/openssl/asm_obsolete/x86-win32-masm/x86cpuid.asm
index b4462fc2aa72bd..d53b6a44d895a3 100644
--- a/deps/openssl/asm_obsolete/x86-win32-masm/x86cpuid.asm
+++ b/deps/openssl/asm_obsolete/x86-win32-masm/x86cpuid.asm
@@ -35,10 +35,10 @@ $L_OPENSSL_ia32_cpuid_begin::
 	pop	eax
 	xor	ecx,eax
 	xor	eax,eax
-	bt	ecx,21
-	jnc	$L000nocpuid
 	mov	esi,DWORD PTR 20[esp]
 	mov	DWORD PTR 8[esi],eax
+	bt	ecx,21
+	jnc	$L000nocpuid
 	cpuid
 	mov	edi,eax
 	xor	eax,eax
@@ -89,40 +89,32 @@ $L_OPENSSL_ia32_cpuid_begin::
 	and	edx,4026531839
 	jmp	$L002generic
 $L001intel:
-	cmp	edi,7
-	jb	$L003cacheinfo
-	mov	esi,DWORD PTR 20[esp]
-	mov	eax,7
-	xor	ecx,ecx
-	cpuid
-	mov	DWORD PTR 8[esi],ebx
-$L003cacheinfo:
 	cmp	edi,4
-	mov	edi,-1
-	jb	$L004nocacheinfo
+	mov	esi,-1
+	jb	$L003nocacheinfo
 	mov	eax,4
 	mov	ecx,0
 	cpuid
-	mov	edi,eax
-	shr	edi,14
-	and	edi,4095
-$L004nocacheinfo:
+	mov	esi,eax
+	shr	esi,14
+	and	esi,4095
+$L003nocacheinfo:
 	mov	eax,1
 	xor	ecx,ecx
 	cpuid
 	and	edx,3220176895
 	cmp	ebp,0
-	jne	$L005notintel
+	jne	$L004notintel
 	or	edx,1073741824
 	and	ah,15
 	cmp	ah,15
-	jne	$L005notintel
+	jne	$L004notintel
 	or	edx,1048576
-$L005notintel:
+$L004notintel:
 	bt	edx,28
 	jnc	$L002generic
 	and	edx,4026531839
-	cmp	edi,0
+	cmp	esi,0
 	je	$L002generic
 	or	edx,268435456
 	shr	ebx,16
@@ -134,7 +126,15 @@ $L002generic:
 	and	ecx,4294965247
 	mov	esi,edx
 	or	ebp,ecx
-	bt	ecx,27
+	cmp	edi,7
+	mov	edi,DWORD PTR 20[esp]
+	jb	$L005no_extended_info
+	mov	eax,7
+	xor	ecx,ecx
+	cpuid
+	mov	DWORD PTR 8[edi],ebx
+$L005no_extended_info:
+	bt	ebp,27
 	jnc	$L006clear_avx
 	xor	ecx,ecx
 DB	15,1,208
@@ -148,7 +148,6 @@ $L008clear_xmm:
 	and	esi,4278190079
 $L006clear_avx:
 	and	ebp,4026525695
-	mov	edi,DWORD PTR 20[esp]
 	and	DWORD PTR 8[edi],4294967263
 $L007done:
 	mov	eax,esi
diff --git a/deps/openssl/doc/UPGRADING.md b/deps/openssl/doc/UPGRADING.md
index 5c8919d2cf349e..fc229f1975776b 100644
--- a/deps/openssl/doc/UPGRADING.md
+++ b/deps/openssl/doc/UPGRADING.md
@@ -280,6 +280,13 @@ and the other is the older one. sections 6.1 and 6.2 describe the two
 types of files. Section 6.3 explains the steps to update the files.
 In the case of upgrading 1.0.2f there were no changes to the asm files.
 
+Files changed between two tags can be manually inspected using:
+```
+https://github.com/openssl/openssl/compare/OpenSSL_1_0_2e...OpenSSL_1_0_2f#files_bucket
+```
+If any source files in `asm` directory were changed then please follow the rest of the
+steps in this section otherwise these steps can be skipped.
+
 ### 6.1. asm files for the latest compiler
 This was made in `deps/openssl/asm/Makefile`
 - Updated asm files for each platforms which are required in
@@ -339,6 +346,7 @@ ohtsu@ubuntu:~/github/node/deps/openssl/asm_obsolete$ make clean
 find . -iname '*.asm' -exec rm "{}" \;
 find . -iname '*.s' -exec rm "{}" \;
 find . -iname '*.S' -exec rm "{}" \;
+ohtsu@ubuntu:~/github/node/deps/openssl/asm_obsolete$ make
 ohtsu@ubuntu:~/github/node/deps/openssl$ git status
 ohtsu@ubuntu:~/github/node/deps/openssl$ git commit asm asm_obsolete
 ````
@@ -346,6 +354,8 @@ The commit message can be
 
 >deps: update openssl asm and asm_obsolete files
 >
->Regenerate asm files with Makefile and CC=gcc and ASM=gcc where
->gcc-4.8.4. Also asm files in asm_obsolete dir to support old compiler
->and assembler are regenerated without CC and ASM envs.
+>Regenerate asm files with Makefile and CC=gcc and ASM=nasm where gcc
+>version was 5.4.0 and nasm version was 2.11.08.
+>
+>Also asm files in asm_obsolete dir to support old compiler and
+>assembler are regenerated without CC and ASM envs.
diff --git a/deps/openssl/openssl/CHANGES b/deps/openssl/openssl/CHANGES
index 95aabc64d05475..307b2ed5e31287 100644
--- a/deps/openssl/openssl/CHANGES
+++ b/deps/openssl/openssl/CHANGES
@@ -2,6 +2,12 @@
  OpenSSL CHANGES
  _______________
 
+ Changes between 1.0.2k and 1.0.2l [25 May 2017]
+
+  *) Have 'config' recognise 64-bit mingw and choose 'mingw64' as the target
+     platform rather than 'mingw'.
+     [Richard Levitte]
+
  Changes between 1.0.2j and 1.0.2k [26 Jan 2017]
 
   *) Truncated packet could crash via OOB read
diff --git a/deps/openssl/openssl/Configure b/deps/openssl/openssl/Configure
index 5da7cadbf3326c..fd7988e2b3d93a 100755
--- a/deps/openssl/openssl/Configure
+++ b/deps/openssl/openssl/Configure
@@ -109,7 +109,7 @@ my $usage="Usage: Configure [no-<cipher> ...] [enable-<cipher> ...] [experimenta
 # Minimum warning options... any contributions to OpenSSL should at least get
 # past these. 
 
-my $gcc_devteam_warn = "-Wall -pedantic -DPEDANTIC -Wno-long-long -Wsign-compare -Wmissing-prototypes -Wshadow -Wformat -Werror -DCRYPTO_MDEBUG_ALL -DCRYPTO_MDEBUG_ABORT -DREF_CHECK -DOPENSSL_NO_DEPRECATED";
+my $gcc_devteam_warn = "-Wall -pedantic -DPEDANTIC -Wno-long-long -Wsign-compare -Wmissing-prototypes -Wshadow -Wformat -Wundef -Werror -DCRYPTO_MDEBUG_ALL -DCRYPTO_MDEBUG_ABORT -DREF_CHECK -DOPENSSL_NO_DEPRECATED";
 
 # TODO(openssl-team): fix problems and investigate if (at least) the following
 # warnings can also be enabled:
@@ -2041,12 +2041,13 @@ EOF
 	close(OUT);
 } else {
 	my $make_command = "$make PERL=\'$perl\'";
-	my $make_targets = "";
-	$make_targets .= " links" if $symlink;
-	$make_targets .= " depend" if $depflags ne $default_depflags && $make_depend;
-	$make_targets .= " gentests" if $symlink;
-	(system $make_command.$make_targets) == 0 or exit $?
-		if $make_targets ne "";
+	my @make_targets = ();
+	push @make_targets, "links" if $symlink;
+	push @make_targets, "depend" if $depflags ne $default_depflags && $make_depend;
+	push @make_targets, "gentests" if $symlink;
+	foreach my $make_target (@make_targets) {
+	    (system "$make_command $make_target") == 0 or exit $?;
+	}
 	if ( $perl =~ m@^/@) {
 	    &dofile("tools/c_rehash",$perl,'^#!/', '#!%s','^my \$dir;$', 'my $dir = "' . $openssldir . '";', '^my \$prefix;$', 'my $prefix = "' . $prefix . '";');
 	    &dofile("apps/CA.pl",$perl,'^#!/', '#!%s');
@@ -2056,8 +2057,8 @@ EOF
 	    &dofile("apps/CA.pl",'/usr/local/bin/perl','^#!/', '#!%s');
 	}
 	if ($depflags ne $default_depflags && !$make_depend) {
-            $warn_make_depend++;
-        }
+	    $warn_make_depend++;
+	}
 }
 
 # create the ms/version32.rc file if needed
diff --git a/deps/openssl/openssl/LICENSE b/deps/openssl/openssl/LICENSE
index fb03713dd11115..bdfd985a691b07 100644
--- a/deps/openssl/openssl/LICENSE
+++ b/deps/openssl/openssl/LICENSE
@@ -2,7 +2,7 @@
   LICENSE ISSUES
   ==============
 
-  The OpenSSL toolkit stays under a dual license, i.e. both the conditions of
+  The OpenSSL toolkit stays under a double license, i.e. both the conditions of
   the OpenSSL License and the original SSLeay license apply to the toolkit.
   See below for the actual license texts. Actually both licenses are BSD-style
   Open Source licenses. In case of any license issues related to OpenSSL
@@ -12,7 +12,7 @@
   ---------------
 
 /* ====================================================================
- * Copyright (c) 1998-2016 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1998-2017 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/deps/openssl/openssl/Makefile b/deps/openssl/openssl/Makefile
index 0b894ff47f300b..a3d30318f9178d 100644
--- a/deps/openssl/openssl/Makefile
+++ b/deps/openssl/openssl/Makefile
@@ -4,7 +4,7 @@
 ## Makefile for OpenSSL
 ##
 
-VERSION=1.0.2k
+VERSION=1.0.2l
 MAJOR=1
 MINOR=0.2
 SHLIB_VERSION_NUMBER=1.0.0
@@ -426,6 +426,14 @@ clean:	libclean
 	rm -fr $$i/*; \
 	done
 
+distclean: clean
+	-$(RM) `find . -name .git -prune -o -type l -print`
+	$(RM) apps/CA.pl
+	$(RM) test/evptests.txt test/newkey.pem test/testkey.pem test/testreq.pem
+	$(RM) tools/c_rehash
+	$(RM) crypto/opensslconf.h
+	$(RM) Makefile Makefile.bak
+
 makefile.one: files
 	$(PERL) util/mk1mf.pl >makefile.one; \
 	sh util/do_ms.sh
diff --git a/deps/openssl/openssl/Makefile.bak b/deps/openssl/openssl/Makefile.bak
index 402333e809e51a..ea0d92e4d7db50 100644
--- a/deps/openssl/openssl/Makefile.bak
+++ b/deps/openssl/openssl/Makefile.bak
@@ -4,7 +4,7 @@
 ## Makefile for OpenSSL
 ##
 
-VERSION=1.0.2k
+VERSION=1.0.2l
 MAJOR=1
 MINOR=0.2
 SHLIB_VERSION_NUMBER=1.0.0
@@ -426,6 +426,14 @@ clean:	libclean
 	rm -fr $$i/*; \
 	done
 
+distclean: clean
+	-$(RM) `find . -name .git -prune -o -type l -print`
+	$(RM) apps/CA.pl
+	$(RM) test/evptests.txt test/newkey.pem test/testkey.pem test/testreq.pem
+	$(RM) tools/c_rehash
+	$(RM) crypto/opensslconf.h
+	$(RM) Makefile Makefile.bak
+
 makefile.one: files
 	$(PERL) util/mk1mf.pl >makefile.one; \
 	sh util/do_ms.sh
diff --git a/deps/openssl/openssl/Makefile.org b/deps/openssl/openssl/Makefile.org
index 61a329b4f20f6e..f51f0a756c3e08 100644
--- a/deps/openssl/openssl/Makefile.org
+++ b/deps/openssl/openssl/Makefile.org
@@ -424,6 +424,14 @@ clean:	libclean
 	rm -fr $$i/*; \
 	done
 
+distclean: clean
+	-$(RM) `find . -name .git -prune -o -type l -print`
+	$(RM) apps/CA.pl
+	$(RM) test/evptests.txt test/newkey.pem test/testkey.pem test/testreq.pem
+	$(RM) tools/c_rehash
+	$(RM) crypto/opensslconf.h
+	$(RM) Makefile Makefile.bak
+
 makefile.one: files
 	$(PERL) util/mk1mf.pl >makefile.one; \
 	sh util/do_ms.sh
diff --git a/deps/openssl/openssl/NEWS b/deps/openssl/openssl/NEWS
index be4a266bac13a4..fd49cedeba4c5c 100644
--- a/deps/openssl/openssl/NEWS
+++ b/deps/openssl/openssl/NEWS
@@ -5,6 +5,10 @@
   This file gives a brief overview of the major changes between each OpenSSL
   release. For more details please read the CHANGES file.
 
+  Major changes between OpenSSL 1.0.2k and OpenSSL 1.0.2l [25 May 2017]
+
+      o config now recognises 64-bit mingw and chooses mingw64 instead of mingw
+
   Major changes between OpenSSL 1.0.2j and OpenSSL 1.0.2k [26 Jan 2017]
 
       o Truncated packet could crash via OOB read (CVE-2017-3731)
diff --git a/deps/openssl/openssl/README b/deps/openssl/openssl/README
index 615d0c6a5dc8f5..4c357d9a836d08 100644
--- a/deps/openssl/openssl/README
+++ b/deps/openssl/openssl/README
@@ -1,5 +1,5 @@
 
- OpenSSL 1.0.2k 26 Jan 2017
+ OpenSSL 1.0.2l 25 May 2017
 
  Copyright (c) 1998-2015 The OpenSSL Project
  Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson
diff --git a/deps/openssl/openssl/apps/ca.c b/deps/openssl/openssl/apps/ca.c
index 4cea3cb7b1cea8..f90f033baed375 100644
--- a/deps/openssl/openssl/apps/ca.c
+++ b/deps/openssl/openssl/apps/ca.c
@@ -2126,10 +2126,8 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
         goto err;
     }
 
-    for (i = 0; i < DB_NUMBER; i++) {
+    for (i = 0; i < DB_NUMBER; i++)
         irow[i] = row[i];
-        row[i] = NULL;
-    }
     irow[DB_NUMBER] = NULL;
 
     if (!TXT_DB_insert(db->db, irow)) {
@@ -2137,11 +2135,14 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
         BIO_printf(bio_err, "TXT_DB error number %ld\n", db->db->error);
         goto err;
     }
+    irow = NULL;
     ok = 1;
  err:
-    for (i = 0; i < DB_NUMBER; i++)
-        if (row[i] != NULL)
+    if (irow != NULL) {
+        for (i = 0; i < DB_NUMBER; i++)
             OPENSSL_free(row[i]);
+        OPENSSL_free(irow);
+    }
 
     if (CAname != NULL)
         X509_NAME_free(CAname);
@@ -2396,18 +2397,20 @@ static int do_revoke(X509 *x509, CA_DB *db, int type, char *value)
             goto err;
         }
 
-        for (i = 0; i < DB_NUMBER; i++) {
+        for (i = 0; i < DB_NUMBER; i++)
             irow[i] = row[i];
-            row[i] = NULL;
-        }
         irow[DB_NUMBER] = NULL;
 
         if (!TXT_DB_insert(db->db, irow)) {
             BIO_printf(bio_err, "failed to update database\n");
             BIO_printf(bio_err, "TXT_DB error number %ld\n", db->db->error);
+            OPENSSL_free(irow);
             goto err;
         }
 
+        for (i = 0; i < DB_NUMBER; i++)
+            row[i] = NULL;
+
         /* Revoke Certificate */
         if (type == -1)
             ok = 1;
diff --git a/deps/openssl/openssl/apps/dhparam.c b/deps/openssl/openssl/apps/dhparam.c
index 1210adb104d9f3..bd91234abd664d 100644
--- a/deps/openssl/openssl/apps/dhparam.c
+++ b/deps/openssl/openssl/apps/dhparam.c
@@ -381,10 +381,19 @@ int MAIN(int argc, char **argv)
         } else
 # endif
         {
-            if (informat == FORMAT_ASN1)
+            if (informat == FORMAT_ASN1) {
+                /*
+                 * We have no PEM header to determine what type of DH params it
+                 * is. We'll just try both.
+                 */
                 dh = d2i_DHparams_bio(in, NULL);
-            else                /* informat == FORMAT_PEM */
+                /* BIO_reset() returns 0 for success for file BIOs only!!! */
+                if (dh == NULL && BIO_reset(in) == 0)
+                    dh = d2i_DHxparams_bio(in, NULL);
+            } else {
+                /* informat == FORMAT_PEM */
                 dh = PEM_read_bio_DHparams(in, NULL, NULL, NULL);
+            }
 
             if (dh == NULL) {
                 BIO_printf(bio_err, "unable to load DH parameters\n");
@@ -484,10 +493,13 @@ int MAIN(int argc, char **argv)
     }
 
     if (!noout) {
-        if (outformat == FORMAT_ASN1)
-            i = i2d_DHparams_bio(out, dh);
-        else if (outformat == FORMAT_PEM) {
-            if (dh->q)
+        if (outformat == FORMAT_ASN1) {
+            if (dh->q != NULL)
+                i = i2d_DHxparams_bio(out, dh);
+            else
+                i = i2d_DHparams_bio(out, dh);
+        } else if (outformat == FORMAT_PEM) {
+            if (dh->q != NULL)
                 i = PEM_write_bio_DHxparams(out, dh);
             else
                 i = PEM_write_bio_DHparams(out, dh);
diff --git a/deps/openssl/openssl/apps/enc.c b/deps/openssl/openssl/apps/enc.c
index 8c8f1ef0f90b21..66145b3be770e7 100644
--- a/deps/openssl/openssl/apps/enc.c
+++ b/deps/openssl/openssl/apps/enc.c
@@ -81,20 +81,32 @@ int set_hex(char *in, unsigned char *out, int size);
 #define BSIZE   (8*1024)
 #define PROG    enc_main
 
-static void show_ciphers(const OBJ_NAME *name, void *bio_)
+struct doall_enc_ciphers {
+    BIO *bio;
+    int n;
+};
+
+static void show_ciphers(const OBJ_NAME *name, void *arg)
 {
-    BIO *bio = bio_;
-    static int n;
+    struct doall_enc_ciphers *dec = (struct doall_enc_ciphers *)arg;
+    const EVP_CIPHER *cipher;
 
     if (!islower((unsigned char)*name->name))
         return;
 
-    BIO_printf(bio, "-%-25s", name->name);
-    if (++n == 3) {
-        BIO_printf(bio, "\n");
-        n = 0;
+    /* Filter out ciphers that we cannot use */
+    cipher = EVP_get_cipherbyname(name->name);
+    if (cipher == NULL ||
+            (EVP_CIPHER_flags(cipher) & EVP_CIPH_FLAG_AEAD_CIPHER) != 0 ||
+            EVP_CIPHER_mode(cipher) == EVP_CIPH_XTS_MODE)
+        return;
+
+    BIO_printf(dec->bio, "-%-25s", name->name);
+    if (++dec->n == 3) {
+        BIO_printf(dec->bio, "\n");
+        dec->n = 0;
     } else
-        BIO_printf(bio, " ");
+        BIO_printf(dec->bio, " ");
 }
 
 int MAIN(int, char **);
@@ -130,6 +142,7 @@ int MAIN(int argc, char **argv)
     ENGINE *e = NULL;
     const EVP_MD *dgst = NULL;
     int non_fips_allow = 0;
+    struct doall_enc_ciphers dec;
 
     apps_startup();
 
@@ -311,8 +324,10 @@ int MAIN(int argc, char **argv)
 #endif
 
             BIO_printf(bio_err, "Cipher Types\n");
+            dec.n = 0;
+            dec.bio = bio_err;
             OBJ_NAME_do_all_sorted(OBJ_NAME_TYPE_CIPHER_METH,
-                                   show_ciphers, bio_err);
+                                   show_ciphers, &dec);
             BIO_printf(bio_err, "\n");
 
             goto end;
diff --git a/deps/openssl/openssl/apps/engine.c b/deps/openssl/openssl/apps/engine.c
index f54631b50d819a..a8eed9af5c18cb 100644
--- a/deps/openssl/openssl/apps/engine.c
+++ b/deps/openssl/openssl/apps/engine.c
@@ -108,13 +108,16 @@ static int append_buf(char **buf, const char *s, int *size, int step)
     }
 
     if (strlen(*buf) + strlen(s) >= (unsigned int)*size) {
+        char *p = *buf;
+
         *size += step;
         *buf = OPENSSL_realloc(*buf, *size);
+        if (*buf == NULL) {
+            OPENSSL_free(p);
+            return 0;
+        }
     }
 
-    if (*buf == NULL)
-        return 0;
-
     if (**buf != '\0')
         BUF_strlcat(*buf, ", ", *size);
     BUF_strlcat(*buf, s, *size);
diff --git a/deps/openssl/openssl/apps/pkeyutl.c b/deps/openssl/openssl/apps/pkeyutl.c
index 7c62d1c8709bcf..19f2e5d9cf9fd1 100644
--- a/deps/openssl/openssl/apps/pkeyutl.c
+++ b/deps/openssl/openssl/apps/pkeyutl.c
@@ -322,8 +322,10 @@ int MAIN(int argc, char **argv)
                              buf_in, (size_t)buf_inlen);
         if (rv == 0)
             BIO_puts(out, "Signature Verification Failure\n");
-        else if (rv == 1)
+        else if (rv == 1) {
             BIO_puts(out, "Signature Verified Successfully\n");
+            ret = 0;
+        }
         if (rv >= 0)
             goto end;
     } else {
diff --git a/deps/openssl/openssl/apps/prime.c b/deps/openssl/openssl/apps/prime.c
index 133167f2d4d1e5..d8f764a3d7f1f0 100644
--- a/deps/openssl/openssl/apps/prime.c
+++ b/deps/openssl/openssl/apps/prime.c
@@ -155,5 +155,8 @@ int MAIN(int argc, char **argv)
     BIO_printf(bio_err, "options are\n");
     BIO_printf(bio_err, "%-14s hex\n", "-hex");
     BIO_printf(bio_err, "%-14s number of checks\n", "-checks <n>");
+    BIO_printf(bio_err, "%-14s generate prime\n", "-generate");
+    BIO_printf(bio_err, "%-14s number of bits\n", "-bits <n>");
+    BIO_printf(bio_err, "%-14s safe prime\n", "-safe");
     return 1;
 }
diff --git a/deps/openssl/openssl/apps/progs.h b/deps/openssl/openssl/apps/progs.h
index fb498fd20c2746..d5c0039bd69d13 100644
--- a/deps/openssl/openssl/apps/progs.h
+++ b/deps/openssl/openssl/apps/progs.h
@@ -58,7 +58,7 @@ extern int srp_main(int argc, char *argv[]);
 typedef struct {
     int type;
     const char *name;
-    int (*func) (int argc, char *argv[]);
+    int (*func)(int argc, char *argv[]);
 } FUNCTION;
 DECLARE_LHASH_OF(FUNCTION);
 
diff --git a/deps/openssl/openssl/apps/progs.pl b/deps/openssl/openssl/apps/progs.pl
index fa6258cf5e1324..73498e3d6efad8 100644
--- a/deps/openssl/openssl/apps/progs.pl
+++ b/deps/openssl/openssl/apps/progs.pl
@@ -6,22 +6,22 @@
 grep(s/^asn1pars$/asn1parse/,@ARGV);
 
 foreach (@ARGV)
-	{ printf "extern int %s_main(int argc,char *argv[]);\n",$_; }
+	{ printf "extern int %s_main(int argc, char *argv[]);\n",$_; }
 
 print <<'EOF';
 
-#define FUNC_TYPE_GENERAL	1
-#define FUNC_TYPE_MD		2
-#define FUNC_TYPE_CIPHER	3
-#define FUNC_TYPE_PKEY		4
-#define FUNC_TYPE_MD_ALG	5
-#define FUNC_TYPE_CIPHER_ALG	6
+#define FUNC_TYPE_GENERAL       1
+#define FUNC_TYPE_MD            2
+#define FUNC_TYPE_CIPHER        3
+#define FUNC_TYPE_PKEY          4
+#define FUNC_TYPE_MD_ALG        5
+#define FUNC_TYPE_CIPHER_ALG    6
 
 typedef struct {
-	int type;
-	const char *name;
-	int (*func)(int argc,char *argv[]);
-	} FUNCTION;
+    int type;
+    const char *name;
+    int (*func)(int argc, char *argv[]);
+} FUNCTION;
 DECLARE_LHASH_OF(FUNCTION);
 
 FUNCTION functions[] = {
@@ -30,7 +30,7 @@
 foreach (@ARGV)
 	{
 	push(@files,$_);
-	$str="\t{FUNC_TYPE_GENERAL,\"$_\",${_}_main},\n";
+	$str="    {FUNC_TYPE_GENERAL, \"$_\", ${_}_main},\n";
 	if (($_ =~ /^s_/) || ($_ =~ /^ciphers$/))
 		{ print "#if !defined(OPENSSL_NO_SOCK)\n${str}#endif\n"; } 
 	elsif ( ($_ =~ /^speed$/))
@@ -60,7 +60,7 @@
 foreach ("md2","md4","md5","sha","sha1","mdc2","rmd160")
 	{
 	push(@files,$_);
-	printf "#ifndef OPENSSL_NO_".uc($_)."\n\t{FUNC_TYPE_MD,\"".$_."\",dgst_main},\n#endif\n";
+	printf "#ifndef OPENSSL_NO_".uc($_)."\n    {FUNC_TYPE_MD, \"".$_."\", dgst_main},\n#endif\n";
 	}
 
 foreach (
@@ -86,7 +86,7 @@
 	{
 	push(@files,$_);
 
-	$t=sprintf("\t{FUNC_TYPE_CIPHER,\"%s\",enc_main},\n",$_);
+	$t=sprintf("    {FUNC_TYPE_CIPHER, \"%s\", enc_main},\n",$_);
 	if    ($_ =~ /des/)  { $t="#ifndef OPENSSL_NO_DES\n${t}#endif\n"; }
 	elsif ($_ =~ /aes/)  { $t="#ifndef OPENSSL_NO_AES\n${t}#endif\n"; }
 	elsif ($_ =~ /camellia/)  { $t="#ifndef OPENSSL_NO_CAMELLIA\n${t}#endif\n"; }
@@ -101,4 +101,4 @@
 	print $t;
 	}
 
-print "\t{0,NULL,NULL}\n\t};\n";
+print "    {0, NULL, NULL}\n};\n";
diff --git a/deps/openssl/openssl/apps/req.c b/deps/openssl/openssl/apps/req.c
index cdea1f61119472..ede1d32cae62cc 100644
--- a/deps/openssl/openssl/apps/req.c
+++ b/deps/openssl/openssl/apps/req.c
@@ -331,7 +331,6 @@ int MAIN(int argc, char **argv)
         else if (strcmp(*argv, "-text") == 0)
             text = 1;
         else if (strcmp(*argv, "-x509") == 0) {
-            newreq = 1;
             x509 = 1;
         } else if (strcmp(*argv, "-asn1-kludge") == 0)
             kludge = 1;
@@ -447,6 +446,9 @@ int MAIN(int argc, char **argv)
         goto end;
     }
 
+    if (x509 && infile == NULL)
+        newreq = 1;
+
     ERR_load_crypto_strings();
     if (!app_passwd(bio_err, passargin, passargout, &passin, &passout)) {
         BIO_printf(bio_err, "Error getting passwords\n");
@@ -753,7 +755,7 @@ int MAIN(int argc, char **argv)
         }
     }
 
-    if (newreq) {
+    if (newreq || x509) {
         if (pkey == NULL) {
             BIO_printf(bio_err, "you need to specify a private key\n");
             goto end;
diff --git a/deps/openssl/openssl/apps/s_client.c b/deps/openssl/openssl/apps/s_client.c
index cdea5ff8d857e2..ffb8ffc5af20c7 100644
--- a/deps/openssl/openssl/apps/s_client.c
+++ b/deps/openssl/openssl/apps/s_client.c
@@ -2147,6 +2147,7 @@ int MAIN(int argc, char **argv)
         BIO_free(bio_c_msg);
         bio_c_msg = NULL;
     }
+    SSL_COMP_free_compression_methods();
     apps_shutdown();
     OPENSSL_EXIT(ret);
 }
diff --git a/deps/openssl/openssl/apps/s_server.c b/deps/openssl/openssl/apps/s_server.c
index b561cf3a362bf9..d75871386928f5 100644
--- a/deps/openssl/openssl/apps/s_server.c
+++ b/deps/openssl/openssl/apps/s_server.c
@@ -2132,6 +2132,7 @@ int MAIN(int argc, char *argv[])
         BIO_free(bio_s_msg);
         bio_s_msg = NULL;
     }
+    SSL_COMP_free_compression_methods();
     apps_shutdown();
     OPENSSL_EXIT(ret);
 }
diff --git a/deps/openssl/openssl/apps/srp.c b/deps/openssl/openssl/apps/srp.c
index 37341a5d20ed61..ce01a24f2a78c4 100644
--- a/deps/openssl/openssl/apps/srp.c
+++ b/deps/openssl/openssl/apps/srp.c
@@ -183,10 +183,8 @@ static int update_index(CA_DB *db, BIO *bio, char **row)
         return 0;
     }
 
-    for (i = 0; i < DB_NUMBER; i++) {
+    for (i = 0; i < DB_NUMBER; i++)
         irow[i] = row[i];
-        row[i] = NULL;
-    }
     irow[DB_NUMBER] = NULL;
 
     if (!TXT_DB_insert(db->db, irow)) {
diff --git a/deps/openssl/openssl/appveyor.yml b/deps/openssl/openssl/appveyor.yml
index 8695359488d8dd..8c38feae6d954c 100644
--- a/deps/openssl/openssl/appveyor.yml
+++ b/deps/openssl/openssl/appveyor.yml
@@ -50,11 +50,3 @@ build_script:
 
 test_script:
     - nmake /f ms\%MAK% test
-
-notifications:
-    - provider: Email
-      to:
-          - openssl-commits@openssl.org
-      on_build_success: false
-      on_build_failure: true
-      on_build_status_changed: true
diff --git a/deps/openssl/openssl/config b/deps/openssl/openssl/config
index bba370c4f3f1cb..21534e00ba4a28 100755
--- a/deps/openssl/openssl/config
+++ b/deps/openssl/openssl/config
@@ -344,6 +344,15 @@ case "${SYSTEM}:${RELEASE}:${VERSION}:${MACHINE}" in
 	echo "mips-sony-newsos4"; exit 0;
 	;;
 
+    # The following combinations are supported
+    # MINGW64* on x86_64 => mingw64
+    # MINGW32* on x86_64 => mingw
+    # MINGW32* on i?86 => mingw
+    #
+    # MINGW64* on i?86 isn't expected to work...
+    MINGW64*:*:*:x86_64)
+	echo "${MACHINE}-whatever-mingw64"; exit 0;
+	;;
     MINGW*)
 	echo "${MACHINE}-whatever-mingw"; exit 0;
 	;;
diff --git a/deps/openssl/openssl/crypto/aes/Makefile b/deps/openssl/openssl/crypto/aes/Makefile
index e825c140194f60..05e4a0149ed86d 100644
--- a/deps/openssl/openssl/crypto/aes/Makefile
+++ b/deps/openssl/openssl/crypto/aes/Makefile
@@ -133,7 +133,7 @@ dclean:
 	mv -f Makefile.new $(MAKEFILE)
 
 clean:
-	rm -f *.s *.o *.obj lib tags core .pure .nfs* *.old *.bak fluff
+	rm -f *.s *.S *.o *.obj lib tags core .pure .nfs* *.old *.bak fluff
 
 # DO NOT DELETE THIS LINE -- make depend depends on it.
 
diff --git a/deps/openssl/openssl/crypto/aes/asm/aesni-sha1-x86_64.pl b/deps/openssl/openssl/crypto/aes/asm/aesni-sha1-x86_64.pl
index 8c84260856e164..7a30e893fbe67b 100644
--- a/deps/openssl/openssl/crypto/aes/asm/aesni-sha1-x86_64.pl
+++ b/deps/openssl/openssl/crypto/aes/asm/aesni-sha1-x86_64.pl
@@ -1702,6 +1702,7 @@ ()
 	mov	240($key),$rounds
 	sub	$in0,$out
 	movups	($key),$rndkey0			# $key[0]
+	movups	($ivp),$iv			# load IV
 	movups	16($key),$rndkey[0]		# forward reference
 	lea	112($key),$key			# size optimization
 
diff --git a/deps/openssl/openssl/crypto/aes/asm/aesni-sha256-x86_64.pl b/deps/openssl/openssl/crypto/aes/asm/aesni-sha256-x86_64.pl
index 72f44ecf625345..588ade64ee52c4 100644
--- a/deps/openssl/openssl/crypto/aes/asm/aesni-sha256-x86_64.pl
+++ b/deps/openssl/openssl/crypto/aes/asm/aesni-sha256-x86_64.pl
@@ -1299,6 +1299,7 @@ ()
 	mov		240($key),$rounds
 	sub		$in0,$out
 	movups		($key),$rndkey0		# $key[0]
+	movups		($ivp),$iv		# load IV
 	movups		16($key),$rndkey[0]	# forward reference
 	lea		112($key),$key		# size optimization
 
diff --git a/deps/openssl/openssl/crypto/aes/asm/bsaes-armv7.pl b/deps/openssl/openssl/crypto/aes/asm/bsaes-armv7.pl
index 83343e2de1af7b..70b3f9656f4fa7 100644
--- a/deps/openssl/openssl/crypto/aes/asm/bsaes-armv7.pl
+++ b/deps/openssl/openssl/crypto/aes/asm/bsaes-armv7.pl
@@ -1333,7 +1333,7 @@ sub bitslice_key {
 	vmov	@XMM[4],@XMM[15]		@ just in case ensure that IV
 	vmov	@XMM[5],@XMM[0]			@ and input are preserved
 	bl	AES_decrypt
-	vld1.8	{@XMM[0]}, [$fp,:64]		@ load result
+	vld1.8	{@XMM[0]}, [$fp]		@ load result
 	veor	@XMM[0], @XMM[0], @XMM[4]	@ ^= IV
 	vmov	@XMM[15], @XMM[5]		@ @XMM[5] holds input
 	vst1.8	{@XMM[0]}, [$rounds]		@ write output
diff --git a/deps/openssl/openssl/crypto/asn1/a_bitstr.c b/deps/openssl/openssl/crypto/asn1/a_bitstr.c
index f906188b114b08..c429342e03d42a 100644
--- a/deps/openssl/openssl/crypto/asn1/a_bitstr.c
+++ b/deps/openssl/openssl/crypto/asn1/a_bitstr.c
@@ -114,10 +114,11 @@ int i2c_ASN1_BIT_STRING(ASN1_BIT_STRING *a, unsigned char **pp)
 
     *(p++) = (unsigned char)bits;
     d = a->data;
-    memcpy(p, d, len);
-    p += len;
-    if (len > 0)
+    if (len > 0) {
+        memcpy(p, d, len);
+        p += len;
         p[-1] &= (0xff << bits);
+    }
     *pp = p;
     return (ret);
 }
diff --git a/deps/openssl/openssl/crypto/asn1/a_digest.c b/deps/openssl/openssl/crypto/asn1/a_digest.c
index 7cbc4751cd8120..57a04f768ca024 100644
--- a/deps/openssl/openssl/crypto/asn1/a_digest.c
+++ b/deps/openssl/openssl/crypto/asn1/a_digest.c
@@ -86,8 +86,10 @@ int ASN1_digest(i2d_of_void *i2d, const EVP_MD *type, char *data,
     p = str;
     i2d(data, &p);
 
-    if (!EVP_Digest(str, i, md, len, type, NULL))
+    if (!EVP_Digest(str, i, md, len, type, NULL)) {
+        OPENSSL_free(str);
         return 0;
+    }
     OPENSSL_free(str);
     return (1);
 }
@@ -104,8 +106,10 @@ int ASN1_item_digest(const ASN1_ITEM *it, const EVP_MD *type, void *asn,
     if (!str)
         return (0);
 
-    if (!EVP_Digest(str, i, md, len, type, NULL))
+    if (!EVP_Digest(str, i, md, len, type, NULL)) {
+        OPENSSL_free(str);
         return 0;
+    }
     OPENSSL_free(str);
     return (1);
 }
diff --git a/deps/openssl/openssl/crypto/asn1/a_gentm.c b/deps/openssl/openssl/crypto/asn1/a_gentm.c
index fa76dcac91f34b..85118137859f91 100644
--- a/deps/openssl/openssl/crypto/asn1/a_gentm.c
+++ b/deps/openssl/openssl/crypto/asn1/a_gentm.c
@@ -202,7 +202,7 @@ int asn1_generalizedtime_to_tm(struct tm *tm, const ASN1_GENERALIZEDTIME *d)
     if (a[o] == 'Z')
         o++;
     else if ((a[o] == '+') || (a[o] == '-')) {
-        int offsign = a[o] == '-' ? -1 : 1, offset = 0;
+        int offsign = a[o] == '-' ? 1 : -1, offset = 0;
         o++;
         if (o + 4 > l)
             goto err;
diff --git a/deps/openssl/openssl/crypto/asn1/a_strnid.c b/deps/openssl/openssl/crypto/asn1/a_strnid.c
index 2d2303d8599e7a..99ffe737873569 100644
--- a/deps/openssl/openssl/crypto/asn1/a_strnid.c
+++ b/deps/openssl/openssl/crypto/asn1/a_strnid.c
@@ -192,7 +192,8 @@ static const ASN1_STRING_TABLE tbl_standard[] = {
     {NID_name, 1, ub_name, DIRSTRING_TYPE, 0},
     {NID_dnQualifier, -1, -1, B_ASN1_PRINTABLESTRING, STABLE_NO_MASK},
     {NID_domainComponent, 1, -1, B_ASN1_IA5STRING, STABLE_NO_MASK},
-    {NID_ms_csp_name, -1, -1, B_ASN1_BMPSTRING, STABLE_NO_MASK}
+    {NID_ms_csp_name, -1, -1, B_ASN1_BMPSTRING, STABLE_NO_MASK},
+    {NID_jurisdictionCountryName, 2, 2, B_ASN1_PRINTABLESTRING, STABLE_NO_MASK}
 };
 
 static int sk_table_cmp(const ASN1_STRING_TABLE *const *a,
diff --git a/deps/openssl/openssl/crypto/asn1/a_time.c b/deps/openssl/openssl/crypto/asn1/a_time.c
index fcb2d565cdd0ac..0eeb79cd428ce0 100644
--- a/deps/openssl/openssl/crypto/asn1/a_time.c
+++ b/deps/openssl/openssl/crypto/asn1/a_time.c
@@ -137,7 +137,7 @@ int ASN1_TIME_check(ASN1_TIME *t)
 ASN1_GENERALIZEDTIME *ASN1_TIME_to_generalizedtime(ASN1_TIME *t,
                                                    ASN1_GENERALIZEDTIME **out)
 {
-    ASN1_GENERALIZEDTIME *ret;
+    ASN1_GENERALIZEDTIME *ret = NULL;
     char *str;
     int newlen;
 
@@ -146,22 +146,21 @@ ASN1_GENERALIZEDTIME *ASN1_TIME_to_generalizedtime(ASN1_TIME *t,
 
     if (!out || !*out) {
         if (!(ret = ASN1_GENERALIZEDTIME_new()))
-            return NULL;
-        if (out)
-            *out = ret;
-    } else
+            goto err;
+    } else {
         ret = *out;
+    }
 
     /* If already GeneralizedTime just copy across */
     if (t->type == V_ASN1_GENERALIZEDTIME) {
         if (!ASN1_STRING_set(ret, t->data, t->length))
-            return NULL;
-        return ret;
+            goto err;
+        goto done;
     }
 
     /* grow the string */
     if (!ASN1_STRING_set(ret, NULL, t->length + 2))
-        return NULL;
+        goto err;
     /* ASN1_STRING_set() allocated 'len + 1' bytes. */
     newlen = t->length + 2 + 1;
     str = (char *)ret->data;
@@ -173,9 +172,18 @@ ASN1_GENERALIZEDTIME *ASN1_TIME_to_generalizedtime(ASN1_TIME *t,
 
     BUF_strlcat(str, (char *)t->data, newlen);
 
-    return ret;
+ done:
+   if (out != NULL && *out == NULL)
+       *out = ret;
+   return ret;
+
+ err:
+    if (out == NULL || *out != ret)
+        ASN1_GENERALIZEDTIME_free(ret);
+    return NULL;
 }
 
+
 int ASN1_TIME_set_string(ASN1_TIME *s, const char *str)
 {
     ASN1_TIME t;
diff --git a/deps/openssl/openssl/crypto/asn1/a_utctm.c b/deps/openssl/openssl/crypto/asn1/a_utctm.c
index 724a10be4ed6ab..0344482cc247f2 100644
--- a/deps/openssl/openssl/crypto/asn1/a_utctm.c
+++ b/deps/openssl/openssl/crypto/asn1/a_utctm.c
@@ -172,7 +172,7 @@ int asn1_utctime_to_tm(struct tm *tm, const ASN1_UTCTIME *d)
     if (a[o] == 'Z')
         o++;
     else if ((a[o] == '+') || (a[o] == '-')) {
-        int offsign = a[o] == '-' ? -1 : 1, offset = 0;
+        int offsign = a[o] == '-' ? 1 : -1, offset = 0;
         o++;
         if (o + 4 > l)
             goto err;
diff --git a/deps/openssl/openssl/crypto/asn1/f_enum.c b/deps/openssl/openssl/crypto/asn1/f_enum.c
index 94cd54dbeedd3a..527f1d8f87b3f2 100644
--- a/deps/openssl/openssl/crypto/asn1/f_enum.c
+++ b/deps/openssl/openssl/crypto/asn1/f_enum.c
@@ -138,7 +138,7 @@ int a2i_ASN1_ENUMERATED(BIO *bp, ASN1_ENUMERATED *bs, char *buf, int size)
         bufp = (unsigned char *)buf;
         if (first) {
             first = 0;
-            if ((bufp[0] == '0') && (buf[1] == '0')) {
+            if ((bufp[0] == '0') && (bufp[1] == '0')) {
                 bufp += 2;
                 i -= 2;
             }
diff --git a/deps/openssl/openssl/crypto/asn1/f_int.c b/deps/openssl/openssl/crypto/asn1/f_int.c
index 2bdc78d74491ce..e6ed7f1e770b99 100644
--- a/deps/openssl/openssl/crypto/asn1/f_int.c
+++ b/deps/openssl/openssl/crypto/asn1/f_int.c
@@ -152,7 +152,7 @@ int a2i_ASN1_INTEGER(BIO *bp, ASN1_INTEGER *bs, char *buf, int size)
         bufp = (unsigned char *)buf;
         if (first) {
             first = 0;
-            if ((bufp[0] == '0') && (buf[1] == '0')) {
+            if ((bufp[0] == '0') && (bufp[1] == '0')) {
                 bufp += 2;
                 i -= 2;
             }
diff --git a/deps/openssl/openssl/crypto/asn1/tasn_dec.c b/deps/openssl/openssl/crypto/asn1/tasn_dec.c
index d25402730b8b9d..d49a5d5792a430 100644
--- a/deps/openssl/openssl/crypto/asn1/tasn_dec.c
+++ b/deps/openssl/openssl/crypto/asn1/tasn_dec.c
@@ -673,6 +673,7 @@ static int asn1_template_noexp_d2i(ASN1_VALUE **val,
             }
             len -= p - q;
             if (!sk_ASN1_VALUE_push((STACK_OF(ASN1_VALUE) *)*val, skfield)) {
+                ASN1_item_ex_free(&skfield, ASN1_ITEM_ptr(tt->item));
                 ASN1err(ASN1_F_ASN1_TEMPLATE_NOEXP_D2I, ERR_R_MALLOC_FAILURE);
                 goto err;
             }
diff --git a/deps/openssl/openssl/crypto/asn1/tasn_new.c b/deps/openssl/openssl/crypto/asn1/tasn_new.c
index b0c73beeb57870..54f459d1ed9cbf 100644
--- a/deps/openssl/openssl/crypto/asn1/tasn_new.c
+++ b/deps/openssl/openssl/crypto/asn1/tasn_new.c
@@ -158,7 +158,7 @@ static int asn1_item_ex_combine_new(ASN1_VALUE **pval, const ASN1_ITEM *it,
         }
         asn1_set_choice_selector(pval, -1, it);
         if (asn1_cb && !asn1_cb(ASN1_OP_NEW_POST, pval, it, NULL))
-            goto auxerr;
+            goto auxerr2;
         break;
 
     case ASN1_ITYPE_NDEF_SEQUENCE:
@@ -186,10 +186,10 @@ static int asn1_item_ex_combine_new(ASN1_VALUE **pval, const ASN1_ITEM *it,
         for (i = 0, tt = it->templates; i < it->tcount; tt++, i++) {
             pseqval = asn1_get_field_ptr(pval, tt);
             if (!ASN1_template_new(pseqval, tt))
-                goto memerr;
+                goto memerr2;
         }
         if (asn1_cb && !asn1_cb(ASN1_OP_NEW_POST, pval, it, NULL))
-            goto auxerr;
+            goto auxerr2;
         break;
     }
 #ifdef CRYPTO_MDEBUG
@@ -198,6 +198,8 @@ static int asn1_item_ex_combine_new(ASN1_VALUE **pval, const ASN1_ITEM *it,
 #endif
     return 1;
 
+ memerr2:
+    ASN1_item_ex_free(pval, it);
  memerr:
     ASN1err(ASN1_F_ASN1_ITEM_EX_COMBINE_NEW, ERR_R_MALLOC_FAILURE);
 #ifdef CRYPTO_MDEBUG
@@ -206,9 +208,10 @@ static int asn1_item_ex_combine_new(ASN1_VALUE **pval, const ASN1_ITEM *it,
 #endif
     return 0;
 
+ auxerr2:
+    ASN1_item_ex_free(pval, it);
  auxerr:
     ASN1err(ASN1_F_ASN1_ITEM_EX_COMBINE_NEW, ASN1_R_AUX_ERROR);
-    ASN1_item_ex_free(pval, it);
 #ifdef CRYPTO_MDEBUG
     if (it->sname)
         CRYPTO_pop_info();
diff --git a/deps/openssl/openssl/crypto/asn1/x_long.c b/deps/openssl/openssl/crypto/asn1/x_long.c
index 3aed44a3ddf753..aecb95069de723 100644
--- a/deps/openssl/openssl/crypto/asn1/x_long.c
+++ b/deps/openssl/openssl/crypto/asn1/x_long.c
@@ -126,7 +126,7 @@ static int long_i2c(ASN1_VALUE **pval, unsigned char *cont, int *putype,
      * set.
      */
     if (ltmp < 0)
-        utmp = -ltmp - 1;
+        utmp = 0 - (unsigned long)ltmp - 1;
     else
         utmp = ltmp;
     clen = BN_num_bits_word(utmp);
@@ -155,19 +155,41 @@ static int long_i2c(ASN1_VALUE **pval, unsigned char *cont, int *putype,
 static int long_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len,
                     int utype, char *free_cont, const ASN1_ITEM *it)
 {
-    int neg, i;
+    int neg = -1, i;
     long ltmp;
     unsigned long utmp = 0;
     char *cp = (char *)pval;
+
+    if (len) {
+        /*
+         * Check possible pad byte.  Worst case, we're skipping past actual
+         * content, but since that's only with 0x00 and 0xff and we set neg
+         * accordingly, the result will be correct in the end anyway.
+         */
+        switch (cont[0]) {
+        case 0xff:
+            cont++;
+            len--;
+            neg = 1;
+            break;
+        case 0:
+            cont++;
+            len--;
+            neg = 0;
+            break;
+        }
+    }
     if (len > (int)sizeof(long)) {
         ASN1err(ASN1_F_LONG_C2I, ASN1_R_INTEGER_TOO_LARGE_FOR_LONG);
         return 0;
     }
-    /* Is it negative? */
-    if (len && (cont[0] & 0x80))
-        neg = 1;
-    else
-        neg = 0;
+    if (neg == -1) {
+        /* Is it negative? */
+        if (len && (cont[0] & 0x80))
+            neg = 1;
+        else
+            neg = 0;
+    }
     utmp = 0;
     for (i = 0; i < len; i++) {
         utmp <<= 8;
@@ -178,8 +200,8 @@ static int long_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len,
     }
     ltmp = (long)utmp;
     if (neg) {
-        ltmp++;
         ltmp = -ltmp;
+        ltmp--;
     }
     if (ltmp == it->size) {
         ASN1err(ASN1_F_LONG_C2I, ASN1_R_INTEGER_TOO_LARGE_FOR_LONG);
diff --git a/deps/openssl/openssl/crypto/asn1/x_name.c b/deps/openssl/openssl/crypto/asn1/x_name.c
index 26378fdb2a02e1..1fb7ad1cbf88af 100644
--- a/deps/openssl/openssl/crypto/asn1/x_name.c
+++ b/deps/openssl/openssl/crypto/asn1/x_name.c
@@ -178,6 +178,16 @@ static void x509_name_ex_free(ASN1_VALUE **pval, const ASN1_ITEM *it)
     *pval = NULL;
 }
 
+static void local_sk_X509_NAME_ENTRY_free(STACK_OF(X509_NAME_ENTRY) *ne)
+{
+    sk_X509_NAME_ENTRY_free(ne);
+}
+
+static void local_sk_X509_NAME_ENTRY_pop_free(STACK_OF(X509_NAME_ENTRY) *ne)
+{
+    sk_X509_NAME_ENTRY_pop_free(ne, X509_NAME_ENTRY_free);
+}
+
 static int x509_name_ex_d2i(ASN1_VALUE **val,
                             const unsigned char **in, long len,
                             const ASN1_ITEM *it, int tag, int aclass,
@@ -228,13 +238,14 @@ static int x509_name_ex_d2i(ASN1_VALUE **val,
             entry->set = i;
             if (!sk_X509_NAME_ENTRY_push(nm.x->entries, entry))
                 goto err;
+            sk_X509_NAME_ENTRY_set(entries, j, NULL);
         }
-        sk_X509_NAME_ENTRY_free(entries);
     }
-    sk_STACK_OF_X509_NAME_ENTRY_free(intname.s);
     ret = x509_name_canon(nm.x);
     if (!ret)
         goto err;
+    sk_STACK_OF_X509_NAME_ENTRY_pop_free(intname.s,
+                                         local_sk_X509_NAME_ENTRY_free);
     nm.x->modified = 0;
     *val = nm.a;
     *in = p;
@@ -242,6 +253,8 @@ static int x509_name_ex_d2i(ASN1_VALUE **val,
  err:
     if (nm.x != NULL)
         X509_NAME_free(nm.x);
+    sk_STACK_OF_X509_NAME_ENTRY_pop_free(intname.s,
+                                         local_sk_X509_NAME_ENTRY_pop_free);
     ASN1err(ASN1_F_X509_NAME_EX_D2I, ERR_R_NESTED_ASN1_ERROR);
     return 0;
 }
@@ -267,16 +280,6 @@ static int x509_name_ex_i2d(ASN1_VALUE **val, unsigned char **out,
     return ret;
 }
 
-static void local_sk_X509_NAME_ENTRY_free(STACK_OF(X509_NAME_ENTRY) *ne)
-{
-    sk_X509_NAME_ENTRY_free(ne);
-}
-
-static void local_sk_X509_NAME_ENTRY_pop_free(STACK_OF(X509_NAME_ENTRY) *ne)
-{
-    sk_X509_NAME_ENTRY_pop_free(ne, X509_NAME_ENTRY_free);
-}
-
 static int x509_name_encode(X509_NAME *a)
 {
     union {
@@ -299,8 +302,10 @@ static int x509_name_encode(X509_NAME *a)
             entries = sk_X509_NAME_ENTRY_new_null();
             if (!entries)
                 goto memerr;
-            if (!sk_STACK_OF_X509_NAME_ENTRY_push(intname.s, entries))
+            if (!sk_STACK_OF_X509_NAME_ENTRY_push(intname.s, entries)) {
+                sk_X509_NAME_ENTRY_free(entries);
                 goto memerr;
+            }
             set = entry->set;
         }
         if (!sk_X509_NAME_ENTRY_push(entries, entry))
@@ -370,8 +375,10 @@ static int x509_name_canon(X509_NAME *a)
             entries = sk_X509_NAME_ENTRY_new_null();
             if (!entries)
                 goto err;
-            if (!sk_STACK_OF_X509_NAME_ENTRY_push(intname, entries))
+            if (!sk_STACK_OF_X509_NAME_ENTRY_push(intname, entries)) {
+                sk_X509_NAME_ENTRY_free(entries);
                 goto err;
+            }
             set = entry->set;
         }
         tmpentry = X509_NAME_ENTRY_new();
diff --git a/deps/openssl/openssl/crypto/bio/b_print.c b/deps/openssl/openssl/crypto/bio/b_print.c
index 987fe068c6de10..eb3ab759349cde 100644
--- a/deps/openssl/openssl/crypto/bio/b_print.c
+++ b/deps/openssl/openssl/crypto/bio/b_print.c
@@ -502,7 +502,7 @@ fmtint(char **sbuffer,
     if (!(flags & DP_F_UNSIGNED)) {
         if (value < 0) {
             signvalue = '-';
-            uvalue = -value;
+            uvalue = -(unsigned LLONG)value;
         } else if (flags & DP_F_PLUS)
             signvalue = '+';
         else if (flags & DP_F_SPACE)
diff --git a/deps/openssl/openssl/crypto/bio/bio_cb.c b/deps/openssl/openssl/crypto/bio/bio_cb.c
index d3e860686c3c58..f96294bb430475 100644
--- a/deps/openssl/openssl/crypto/bio/bio_cb.c
+++ b/deps/openssl/openssl/crypto/bio/bio_cb.c
@@ -78,6 +78,9 @@ long MS_CALLBACK BIO_debug_callback(BIO *bio, int cmd, const char *argp,
 
     len = BIO_snprintf(buf,sizeof buf,"BIO[%p]: ",(void *)bio);
 
+    /* Ignore errors and continue printing the other information. */
+    if (len < 0)
+        len = 0;
     p = buf + len;
     p_maxlen = sizeof(buf) - len;
 
diff --git a/deps/openssl/openssl/crypto/bio/bss_file.c b/deps/openssl/openssl/crypto/bio/bss_file.c
index a6e3b3ac0130aa..0cf67e5b770b0c 100644
--- a/deps/openssl/openssl/crypto/bio/bss_file.c
+++ b/deps/openssl/openssl/crypto/bio/bss_file.c
@@ -251,7 +251,7 @@ static int MS_CALLBACK file_read(BIO *b, char *out, int outl)
             ret = fread(out, 1, (int)outl, (FILE *)b->ptr);
         if (ret == 0
             && (b->flags & BIO_FLAGS_UPLINK) ? UP_ferror((FILE *)b->ptr) :
-            ferror((FILE *)b->ptr)) {
+                                               ferror((FILE *)b->ptr)) {
             SYSerr(SYS_F_FREAD, get_last_sys_error());
             BIOerr(BIO_F_FILE_READ, ERR_R_SYS_LIB);
             ret = -1;
@@ -287,6 +287,7 @@ static long MS_CALLBACK file_ctrl(BIO *b, int cmd, long num, void *ptr)
     FILE *fp = (FILE *)b->ptr;
     FILE **fpp;
     char p[4];
+    int st;
 
     switch (cmd) {
     case BIO_C_FILE_SEEK:
@@ -318,8 +319,11 @@ static long MS_CALLBACK file_ctrl(BIO *b, int cmd, long num, void *ptr)
 #   if defined(__MINGW32__) && defined(__MSVCRT__) && !defined(_IOB_ENTRIES)
 #    define _IOB_ENTRIES 20
 #   endif
-#   if defined(_IOB_ENTRIES)
         /* Safety net to catch purely internal BIO_set_fp calls */
+#   if defined(_MSC_VER) && _MSC_VER>=1900
+        if (ptr == stdin || ptr == stdout || ptr == stderr)
+            BIO_clear_flags(b, BIO_FLAGS_UPLINK);
+#   elif defined(_IOB_ENTRIES)
         if ((size_t)ptr >= (size_t)stdin &&
             (size_t)ptr < (size_t)(stdin + _IOB_ENTRIES))
             BIO_clear_flags(b, BIO_FLAGS_UPLINK);
@@ -424,10 +428,14 @@ static long MS_CALLBACK file_ctrl(BIO *b, int cmd, long num, void *ptr)
         b->shutdown = (int)num;
         break;
     case BIO_CTRL_FLUSH:
-        if (b->flags & BIO_FLAGS_UPLINK)
-            UP_fflush(b->ptr);
-        else
-            fflush((FILE *)b->ptr);
+        st = b->flags & BIO_FLAGS_UPLINK
+                ? UP_fflush(b->ptr) : fflush((FILE *)b->ptr);
+        if (st == EOF) {
+            SYSerr(SYS_F_FFLUSH, get_last_sys_error());
+            ERR_add_error_data(1, "fflush()");
+            BIOerr(BIO_F_FILE_CTRL, ERR_R_SYS_LIB);
+            ret = 0;
+        }
         break;
     case BIO_CTRL_DUP:
         ret = 1;
diff --git a/deps/openssl/openssl/crypto/bn/Makefile b/deps/openssl/openssl/crypto/bn/Makefile
index c4c6409517596f..20e8ef0a28d7e9 100644
--- a/deps/openssl/openssl/crypto/bn/Makefile
+++ b/deps/openssl/openssl/crypto/bn/Makefile
@@ -187,7 +187,7 @@ dclean:
 	mv -f Makefile.new $(MAKEFILE)
 
 clean:
-	rm -f *.s *.o *.obj lib tags core .pure .nfs* *.old *.bak fluff
+	rm -f *.s *.S *.o *.obj lib tags core .pure .nfs* *.old *.bak fluff
 
 # DO NOT DELETE THIS LINE -- make depend depends on it.
 
diff --git a/deps/openssl/openssl/crypto/bn/asm/sparcv9-mont.pl b/deps/openssl/openssl/crypto/bn/asm/sparcv9-mont.pl
index b8fb1e8a25dc0b..d8662878006eac 100644
--- a/deps/openssl/openssl/crypto/bn/asm/sparcv9-mont.pl
+++ b/deps/openssl/openssl/crypto/bn/asm/sparcv9-mont.pl
@@ -290,7 +290,7 @@
 ######## .Lbn_sqr_mont gives up to 20% *overall* improvement over
 ######## code without following dedicated squaring procedure.
 ########
-$sbit="%i2";		# re-use $bp!
+$sbit="%o5";
 
 $code.=<<___;
 .align	32
@@ -403,7 +403,7 @@
 	mulx	$apj,$mul0,$acc0
 	mulx	$npj,$mul1,$acc1
 	add	$acc0,$car0,$car0
-	add	$tpj,$car1,$car1
+	add	$tpj,$sbit,$sbit
 	ld	[$ap+$j],$apj			! ap[j]
 	and	$car0,$mask,$acc0
 	ld	[$np+$j],$npj			! np[j]
@@ -412,7 +412,7 @@
 	ld	[$tp+8],$tpj			! tp[j]
 	add	$acc0,$acc0,$acc0
 	add	$j,4,$j				! j++
-	or	$sbit,$acc0,$acc0
+	add	$sbit,$acc0,$acc0
 	srlx	$acc0,32,$sbit
 	and	$acc0,$mask,$acc0
 	cmp	$j,$num
@@ -426,12 +426,12 @@
 	mulx	$apj,$mul0,$acc0
 	mulx	$npj,$mul1,$acc1
 	add	$acc0,$car0,$car0
-	add	$tpj,$car1,$car1
+	add	$tpj,$sbit,$sbit
 	and	$car0,$mask,$acc0
 	srlx	$car0,32,$car0
 	add	$acc1,$car1,$car1
 	add	$acc0,$acc0,$acc0
-	or	$sbit,$acc0,$acc0
+	add	$sbit,$acc0,$acc0
 	srlx	$acc0,32,$sbit
 	and	$acc0,$mask,$acc0
 	add	$acc0,$car1,$car1
@@ -439,7 +439,7 @@
 	srlx	$car1,32,$car1
 
 	add	$car0,$car0,$car0
-	or	$sbit,$car0,$car0
+	add	$sbit,$car0,$car0
 	add	$car0,$car1,$car1
 	add	$car2,$car1,$car1
 	st	$car1,[$tp+4]
@@ -499,7 +499,7 @@
 .Lsqr_inner2:
 	mulx	$apj,$mul0,$acc0
 	mulx	$npj,$mul1,$acc1
-	add	$tpj,$car1,$car1
+	add	$tpj,$sbit,$sbit
 	add	$acc0,$car0,$car0
 	ld	[$ap+$j],$apj			! ap[j]
 	and	$car0,$mask,$acc0
@@ -507,7 +507,7 @@
 	srlx	$car0,32,$car0
 	add	$acc0,$acc0,$acc0
 	ld	[$tp+8],$tpj			! tp[j]
-	or	$sbit,$acc0,$acc0
+	add	$sbit,$acc0,$acc0
 	add	$j,4,$j				! j++
 	srlx	$acc0,32,$sbit
 	and	$acc0,$mask,$acc0
@@ -522,12 +522,12 @@
 .Lsqr_no_inner2:
 	mulx	$apj,$mul0,$acc0
 	mulx	$npj,$mul1,$acc1
-	add	$tpj,$car1,$car1
+	add	$tpj,$sbit,$sbit
 	add	$acc0,$car0,$car0
 	and	$car0,$mask,$acc0
 	srlx	$car0,32,$car0
 	add	$acc0,$acc0,$acc0
-	or	$sbit,$acc0,$acc0
+	add	$sbit,$acc0,$acc0
 	srlx	$acc0,32,$sbit
 	and	$acc0,$mask,$acc0
 	add	$acc0,$car1,$car1
@@ -536,7 +536,7 @@
 	srlx	$car1,32,$car1
 
 	add	$car0,$car0,$car0
-	or	$sbit,$car0,$car0
+	add	$sbit,$car0,$car0
 	add	$car0,$car1,$car1
 	add	$car2,$car1,$car1
 	st	$car1,[$tp+4]
@@ -581,14 +581,17 @@
 !.Lsqr_last
 
 	mulx	$npj,$mul1,$acc1
-	add	$tpj,$car1,$car1
+	add	$tpj,$acc0,$acc0
+	srlx	$acc0,32,$tmp0
+	and	$acc0,$mask,$acc0
+	add	$tmp0,$sbit,$sbit
 	add	$acc0,$car1,$car1
 	add	$acc1,$car1,$car1
 	st	$car1,[$tp]
 	srlx	$car1,32,$car1
 
 	add	$car0,$car0,$car0		! recover $car0
-	or	$sbit,$car0,$car0
+	add	$sbit,$car0,$car0
 	add	$car0,$car1,$car1
 	add	$car2,$car1,$car1
 	st	$car1,[$tp+4]
diff --git a/deps/openssl/openssl/crypto/bn/bn_prime.c b/deps/openssl/openssl/crypto/bn/bn_prime.c
index 8177fd294772f2..e911e157859aae 100644
--- a/deps/openssl/openssl/crypto/bn/bn_prime.c
+++ b/deps/openssl/openssl/crypto/bn/bn_prime.c
@@ -252,7 +252,6 @@ int BN_is_prime_fasttest_ex(const BIGNUM *a, int checks, BN_CTX *ctx_passed,
     BN_CTX *ctx = NULL;
     BIGNUM *A1, *A1_odd, *check; /* taken from ctx */
     BN_MONT_CTX *mont = NULL;
-    const BIGNUM *A = NULL;
 
     if (BN_cmp(a, BN_value_one()) <= 0)
         return 0;
@@ -278,25 +277,14 @@ int BN_is_prime_fasttest_ex(const BIGNUM *a, int checks, BN_CTX *ctx_passed,
         goto err;
     BN_CTX_start(ctx);
 
-    /* A := abs(a) */
-    if (a->neg) {
-        BIGNUM *t;
-        if ((t = BN_CTX_get(ctx)) == NULL)
-            goto err;
-        if (BN_copy(t, a) == NULL)
-            goto err;
-        t->neg = 0;
-        A = t;
-    } else
-        A = a;
     A1 = BN_CTX_get(ctx);
     A1_odd = BN_CTX_get(ctx);
     check = BN_CTX_get(ctx);
     if (check == NULL)
         goto err;
 
-    /* compute A1 := A - 1 */
-    if (!BN_copy(A1, A))
+    /* compute A1 := a - 1 */
+    if (!BN_copy(A1, a))
         goto err;
     if (!BN_sub_word(A1, 1))
         goto err;
@@ -312,11 +300,11 @@ int BN_is_prime_fasttest_ex(const BIGNUM *a, int checks, BN_CTX *ctx_passed,
     if (!BN_rshift(A1_odd, A1, k))
         goto err;
 
-    /* Montgomery setup for computations mod A */
+    /* Montgomery setup for computations mod a */
     mont = BN_MONT_CTX_new();
     if (mont == NULL)
         goto err;
-    if (!BN_MONT_CTX_set(mont, A, ctx))
+    if (!BN_MONT_CTX_set(mont, a, ctx))
         goto err;
 
     for (i = 0; i < checks; i++) {
@@ -324,9 +312,9 @@ int BN_is_prime_fasttest_ex(const BIGNUM *a, int checks, BN_CTX *ctx_passed,
             goto err;
         if (!BN_add_word(check, 1))
             goto err;
-        /* now 1 <= check < A */
+        /* now 1 <= check < a */
 
-        j = witness(check, A, A1, A1_odd, k, ctx, mont);
+        j = witness(check, a, A1, A1_odd, k, ctx, mont);
         if (j == -1)
             goto err;
         if (j) {
diff --git a/deps/openssl/openssl/crypto/bn/bn_prime.h b/deps/openssl/openssl/crypto/bn/bn_prime.h
index 5cf0de169e0497..489af8b424ca56 100644
--- a/deps/openssl/openssl/crypto/bn/bn_prime.h
+++ b/deps/openssl/openssl/crypto/bn/bn_prime.h
@@ -64,263 +64,263 @@ typedef unsigned short prime_t;
 typedef unsigned char prime_t;
 #endif
 static const prime_t primes[NUMPRIMES] = {
-    2, 3, 5, 7, 11, 13, 17, 19,
-    23, 29, 31, 37, 41, 43, 47, 53,
-    59, 61, 67, 71, 73, 79, 83, 89,
-    97, 101, 103, 107, 109, 113, 127, 131,
-    137, 139, 149, 151, 157, 163, 167, 173,
-    179, 181, 191, 193, 197, 199, 211, 223,
-    227, 229, 233, 239, 241, 251,
+         2,     3,     5,     7,    11,    13,    17,    19,
+        23,    29,    31,    37,    41,    43,    47,    53,
+        59,    61,    67,    71,    73,    79,    83,    89,
+        97,   101,   103,   107,   109,   113,   127,   131,
+       137,   139,   149,   151,   157,   163,   167,   173,
+       179,   181,   191,   193,   197,   199,   211,   223,
+       227,   229,   233,   239,   241,   251,
 #ifndef EIGHT_BIT
-    257, 263,
-    269, 271, 277, 281, 283, 293, 307, 311,
-    313, 317, 331, 337, 347, 349, 353, 359,
-    367, 373, 379, 383, 389, 397, 401, 409,
-    419, 421, 431, 433, 439, 443, 449, 457,
-    461, 463, 467, 479, 487, 491, 499, 503,
-    509, 521, 523, 541, 547, 557, 563, 569,
-    571, 577, 587, 593, 599, 601, 607, 613,
-    617, 619, 631, 641, 643, 647, 653, 659,
-    661, 673, 677, 683, 691, 701, 709, 719,
-    727, 733, 739, 743, 751, 757, 761, 769,
-    773, 787, 797, 809, 811, 821, 823, 827,
-    829, 839, 853, 857, 859, 863, 877, 881,
-    883, 887, 907, 911, 919, 929, 937, 941,
-    947, 953, 967, 971, 977, 983, 991, 997,
-    1009, 1013, 1019, 1021, 1031, 1033, 1039, 1049,
-    1051, 1061, 1063, 1069, 1087, 1091, 1093, 1097,
-    1103, 1109, 1117, 1123, 1129, 1151, 1153, 1163,
-    1171, 1181, 1187, 1193, 1201, 1213, 1217, 1223,
-    1229, 1231, 1237, 1249, 1259, 1277, 1279, 1283,
-    1289, 1291, 1297, 1301, 1303, 1307, 1319, 1321,
-    1327, 1361, 1367, 1373, 1381, 1399, 1409, 1423,
-    1427, 1429, 1433, 1439, 1447, 1451, 1453, 1459,
-    1471, 1481, 1483, 1487, 1489, 1493, 1499, 1511,
-    1523, 1531, 1543, 1549, 1553, 1559, 1567, 1571,
-    1579, 1583, 1597, 1601, 1607, 1609, 1613, 1619,
-    1621, 1627, 1637, 1657, 1663, 1667, 1669, 1693,
-    1697, 1699, 1709, 1721, 1723, 1733, 1741, 1747,
-    1753, 1759, 1777, 1783, 1787, 1789, 1801, 1811,
-    1823, 1831, 1847, 1861, 1867, 1871, 1873, 1877,
-    1879, 1889, 1901, 1907, 1913, 1931, 1933, 1949,
-    1951, 1973, 1979, 1987, 1993, 1997, 1999, 2003,
-    2011, 2017, 2027, 2029, 2039, 2053, 2063, 2069,
-    2081, 2083, 2087, 2089, 2099, 2111, 2113, 2129,
-    2131, 2137, 2141, 2143, 2153, 2161, 2179, 2203,
-    2207, 2213, 2221, 2237, 2239, 2243, 2251, 2267,
-    2269, 2273, 2281, 2287, 2293, 2297, 2309, 2311,
-    2333, 2339, 2341, 2347, 2351, 2357, 2371, 2377,
-    2381, 2383, 2389, 2393, 2399, 2411, 2417, 2423,
-    2437, 2441, 2447, 2459, 2467, 2473, 2477, 2503,
-    2521, 2531, 2539, 2543, 2549, 2551, 2557, 2579,
-    2591, 2593, 2609, 2617, 2621, 2633, 2647, 2657,
-    2659, 2663, 2671, 2677, 2683, 2687, 2689, 2693,
-    2699, 2707, 2711, 2713, 2719, 2729, 2731, 2741,
-    2749, 2753, 2767, 2777, 2789, 2791, 2797, 2801,
-    2803, 2819, 2833, 2837, 2843, 2851, 2857, 2861,
-    2879, 2887, 2897, 2903, 2909, 2917, 2927, 2939,
-    2953, 2957, 2963, 2969, 2971, 2999, 3001, 3011,
-    3019, 3023, 3037, 3041, 3049, 3061, 3067, 3079,
-    3083, 3089, 3109, 3119, 3121, 3137, 3163, 3167,
-    3169, 3181, 3187, 3191, 3203, 3209, 3217, 3221,
-    3229, 3251, 3253, 3257, 3259, 3271, 3299, 3301,
-    3307, 3313, 3319, 3323, 3329, 3331, 3343, 3347,
-    3359, 3361, 3371, 3373, 3389, 3391, 3407, 3413,
-    3433, 3449, 3457, 3461, 3463, 3467, 3469, 3491,
-    3499, 3511, 3517, 3527, 3529, 3533, 3539, 3541,
-    3547, 3557, 3559, 3571, 3581, 3583, 3593, 3607,
-    3613, 3617, 3623, 3631, 3637, 3643, 3659, 3671,
-    3673, 3677, 3691, 3697, 3701, 3709, 3719, 3727,
-    3733, 3739, 3761, 3767, 3769, 3779, 3793, 3797,
-    3803, 3821, 3823, 3833, 3847, 3851, 3853, 3863,
-    3877, 3881, 3889, 3907, 3911, 3917, 3919, 3923,
-    3929, 3931, 3943, 3947, 3967, 3989, 4001, 4003,
-    4007, 4013, 4019, 4021, 4027, 4049, 4051, 4057,
-    4073, 4079, 4091, 4093, 4099, 4111, 4127, 4129,
-    4133, 4139, 4153, 4157, 4159, 4177, 4201, 4211,
-    4217, 4219, 4229, 4231, 4241, 4243, 4253, 4259,
-    4261, 4271, 4273, 4283, 4289, 4297, 4327, 4337,
-    4339, 4349, 4357, 4363, 4373, 4391, 4397, 4409,
-    4421, 4423, 4441, 4447, 4451, 4457, 4463, 4481,
-    4483, 4493, 4507, 4513, 4517, 4519, 4523, 4547,
-    4549, 4561, 4567, 4583, 4591, 4597, 4603, 4621,
-    4637, 4639, 4643, 4649, 4651, 4657, 4663, 4673,
-    4679, 4691, 4703, 4721, 4723, 4729, 4733, 4751,
-    4759, 4783, 4787, 4789, 4793, 4799, 4801, 4813,
-    4817, 4831, 4861, 4871, 4877, 4889, 4903, 4909,
-    4919, 4931, 4933, 4937, 4943, 4951, 4957, 4967,
-    4969, 4973, 4987, 4993, 4999, 5003, 5009, 5011,
-    5021, 5023, 5039, 5051, 5059, 5077, 5081, 5087,
-    5099, 5101, 5107, 5113, 5119, 5147, 5153, 5167,
-    5171, 5179, 5189, 5197, 5209, 5227, 5231, 5233,
-    5237, 5261, 5273, 5279, 5281, 5297, 5303, 5309,
-    5323, 5333, 5347, 5351, 5381, 5387, 5393, 5399,
-    5407, 5413, 5417, 5419, 5431, 5437, 5441, 5443,
-    5449, 5471, 5477, 5479, 5483, 5501, 5503, 5507,
-    5519, 5521, 5527, 5531, 5557, 5563, 5569, 5573,
-    5581, 5591, 5623, 5639, 5641, 5647, 5651, 5653,
-    5657, 5659, 5669, 5683, 5689, 5693, 5701, 5711,
-    5717, 5737, 5741, 5743, 5749, 5779, 5783, 5791,
-    5801, 5807, 5813, 5821, 5827, 5839, 5843, 5849,
-    5851, 5857, 5861, 5867, 5869, 5879, 5881, 5897,
-    5903, 5923, 5927, 5939, 5953, 5981, 5987, 6007,
-    6011, 6029, 6037, 6043, 6047, 6053, 6067, 6073,
-    6079, 6089, 6091, 6101, 6113, 6121, 6131, 6133,
-    6143, 6151, 6163, 6173, 6197, 6199, 6203, 6211,
-    6217, 6221, 6229, 6247, 6257, 6263, 6269, 6271,
-    6277, 6287, 6299, 6301, 6311, 6317, 6323, 6329,
-    6337, 6343, 6353, 6359, 6361, 6367, 6373, 6379,
-    6389, 6397, 6421, 6427, 6449, 6451, 6469, 6473,
-    6481, 6491, 6521, 6529, 6547, 6551, 6553, 6563,
-    6569, 6571, 6577, 6581, 6599, 6607, 6619, 6637,
-    6653, 6659, 6661, 6673, 6679, 6689, 6691, 6701,
-    6703, 6709, 6719, 6733, 6737, 6761, 6763, 6779,
-    6781, 6791, 6793, 6803, 6823, 6827, 6829, 6833,
-    6841, 6857, 6863, 6869, 6871, 6883, 6899, 6907,
-    6911, 6917, 6947, 6949, 6959, 6961, 6967, 6971,
-    6977, 6983, 6991, 6997, 7001, 7013, 7019, 7027,
-    7039, 7043, 7057, 7069, 7079, 7103, 7109, 7121,
-    7127, 7129, 7151, 7159, 7177, 7187, 7193, 7207,
-    7211, 7213, 7219, 7229, 7237, 7243, 7247, 7253,
-    7283, 7297, 7307, 7309, 7321, 7331, 7333, 7349,
-    7351, 7369, 7393, 7411, 7417, 7433, 7451, 7457,
-    7459, 7477, 7481, 7487, 7489, 7499, 7507, 7517,
-    7523, 7529, 7537, 7541, 7547, 7549, 7559, 7561,
-    7573, 7577, 7583, 7589, 7591, 7603, 7607, 7621,
-    7639, 7643, 7649, 7669, 7673, 7681, 7687, 7691,
-    7699, 7703, 7717, 7723, 7727, 7741, 7753, 7757,
-    7759, 7789, 7793, 7817, 7823, 7829, 7841, 7853,
-    7867, 7873, 7877, 7879, 7883, 7901, 7907, 7919,
-    7927, 7933, 7937, 7949, 7951, 7963, 7993, 8009,
-    8011, 8017, 8039, 8053, 8059, 8069, 8081, 8087,
-    8089, 8093, 8101, 8111, 8117, 8123, 8147, 8161,
-    8167, 8171, 8179, 8191, 8209, 8219, 8221, 8231,
-    8233, 8237, 8243, 8263, 8269, 8273, 8287, 8291,
-    8293, 8297, 8311, 8317, 8329, 8353, 8363, 8369,
-    8377, 8387, 8389, 8419, 8423, 8429, 8431, 8443,
-    8447, 8461, 8467, 8501, 8513, 8521, 8527, 8537,
-    8539, 8543, 8563, 8573, 8581, 8597, 8599, 8609,
-    8623, 8627, 8629, 8641, 8647, 8663, 8669, 8677,
-    8681, 8689, 8693, 8699, 8707, 8713, 8719, 8731,
-    8737, 8741, 8747, 8753, 8761, 8779, 8783, 8803,
-    8807, 8819, 8821, 8831, 8837, 8839, 8849, 8861,
-    8863, 8867, 8887, 8893, 8923, 8929, 8933, 8941,
-    8951, 8963, 8969, 8971, 8999, 9001, 9007, 9011,
-    9013, 9029, 9041, 9043, 9049, 9059, 9067, 9091,
-    9103, 9109, 9127, 9133, 9137, 9151, 9157, 9161,
-    9173, 9181, 9187, 9199, 9203, 9209, 9221, 9227,
-    9239, 9241, 9257, 9277, 9281, 9283, 9293, 9311,
-    9319, 9323, 9337, 9341, 9343, 9349, 9371, 9377,
-    9391, 9397, 9403, 9413, 9419, 9421, 9431, 9433,
-    9437, 9439, 9461, 9463, 9467, 9473, 9479, 9491,
-    9497, 9511, 9521, 9533, 9539, 9547, 9551, 9587,
-    9601, 9613, 9619, 9623, 9629, 9631, 9643, 9649,
-    9661, 9677, 9679, 9689, 9697, 9719, 9721, 9733,
-    9739, 9743, 9749, 9767, 9769, 9781, 9787, 9791,
-    9803, 9811, 9817, 9829, 9833, 9839, 9851, 9857,
-    9859, 9871, 9883, 9887, 9901, 9907, 9923, 9929,
-    9931, 9941, 9949, 9967, 9973, 10007, 10009, 10037,
-    10039, 10061, 10067, 10069, 10079, 10091, 10093, 10099,
-    10103, 10111, 10133, 10139, 10141, 10151, 10159, 10163,
-    10169, 10177, 10181, 10193, 10211, 10223, 10243, 10247,
-    10253, 10259, 10267, 10271, 10273, 10289, 10301, 10303,
-    10313, 10321, 10331, 10333, 10337, 10343, 10357, 10369,
-    10391, 10399, 10427, 10429, 10433, 10453, 10457, 10459,
-    10463, 10477, 10487, 10499, 10501, 10513, 10529, 10531,
-    10559, 10567, 10589, 10597, 10601, 10607, 10613, 10627,
-    10631, 10639, 10651, 10657, 10663, 10667, 10687, 10691,
-    10709, 10711, 10723, 10729, 10733, 10739, 10753, 10771,
-    10781, 10789, 10799, 10831, 10837, 10847, 10853, 10859,
-    10861, 10867, 10883, 10889, 10891, 10903, 10909, 10937,
-    10939, 10949, 10957, 10973, 10979, 10987, 10993, 11003,
-    11027, 11047, 11057, 11059, 11069, 11071, 11083, 11087,
-    11093, 11113, 11117, 11119, 11131, 11149, 11159, 11161,
-    11171, 11173, 11177, 11197, 11213, 11239, 11243, 11251,
-    11257, 11261, 11273, 11279, 11287, 11299, 11311, 11317,
-    11321, 11329, 11351, 11353, 11369, 11383, 11393, 11399,
-    11411, 11423, 11437, 11443, 11447, 11467, 11471, 11483,
-    11489, 11491, 11497, 11503, 11519, 11527, 11549, 11551,
-    11579, 11587, 11593, 11597, 11617, 11621, 11633, 11657,
-    11677, 11681, 11689, 11699, 11701, 11717, 11719, 11731,
-    11743, 11777, 11779, 11783, 11789, 11801, 11807, 11813,
-    11821, 11827, 11831, 11833, 11839, 11863, 11867, 11887,
-    11897, 11903, 11909, 11923, 11927, 11933, 11939, 11941,
-    11953, 11959, 11969, 11971, 11981, 11987, 12007, 12011,
-    12037, 12041, 12043, 12049, 12071, 12073, 12097, 12101,
-    12107, 12109, 12113, 12119, 12143, 12149, 12157, 12161,
-    12163, 12197, 12203, 12211, 12227, 12239, 12241, 12251,
-    12253, 12263, 12269, 12277, 12281, 12289, 12301, 12323,
-    12329, 12343, 12347, 12373, 12377, 12379, 12391, 12401,
-    12409, 12413, 12421, 12433, 12437, 12451, 12457, 12473,
-    12479, 12487, 12491, 12497, 12503, 12511, 12517, 12527,
-    12539, 12541, 12547, 12553, 12569, 12577, 12583, 12589,
-    12601, 12611, 12613, 12619, 12637, 12641, 12647, 12653,
-    12659, 12671, 12689, 12697, 12703, 12713, 12721, 12739,
-    12743, 12757, 12763, 12781, 12791, 12799, 12809, 12821,
-    12823, 12829, 12841, 12853, 12889, 12893, 12899, 12907,
-    12911, 12917, 12919, 12923, 12941, 12953, 12959, 12967,
-    12973, 12979, 12983, 13001, 13003, 13007, 13009, 13033,
-    13037, 13043, 13049, 13063, 13093, 13099, 13103, 13109,
-    13121, 13127, 13147, 13151, 13159, 13163, 13171, 13177,
-    13183, 13187, 13217, 13219, 13229, 13241, 13249, 13259,
-    13267, 13291, 13297, 13309, 13313, 13327, 13331, 13337,
-    13339, 13367, 13381, 13397, 13399, 13411, 13417, 13421,
-    13441, 13451, 13457, 13463, 13469, 13477, 13487, 13499,
-    13513, 13523, 13537, 13553, 13567, 13577, 13591, 13597,
-    13613, 13619, 13627, 13633, 13649, 13669, 13679, 13681,
-    13687, 13691, 13693, 13697, 13709, 13711, 13721, 13723,
-    13729, 13751, 13757, 13759, 13763, 13781, 13789, 13799,
-    13807, 13829, 13831, 13841, 13859, 13873, 13877, 13879,
-    13883, 13901, 13903, 13907, 13913, 13921, 13931, 13933,
-    13963, 13967, 13997, 13999, 14009, 14011, 14029, 14033,
-    14051, 14057, 14071, 14081, 14083, 14087, 14107, 14143,
-    14149, 14153, 14159, 14173, 14177, 14197, 14207, 14221,
-    14243, 14249, 14251, 14281, 14293, 14303, 14321, 14323,
-    14327, 14341, 14347, 14369, 14387, 14389, 14401, 14407,
-    14411, 14419, 14423, 14431, 14437, 14447, 14449, 14461,
-    14479, 14489, 14503, 14519, 14533, 14537, 14543, 14549,
-    14551, 14557, 14561, 14563, 14591, 14593, 14621, 14627,
-    14629, 14633, 14639, 14653, 14657, 14669, 14683, 14699,
-    14713, 14717, 14723, 14731, 14737, 14741, 14747, 14753,
-    14759, 14767, 14771, 14779, 14783, 14797, 14813, 14821,
-    14827, 14831, 14843, 14851, 14867, 14869, 14879, 14887,
-    14891, 14897, 14923, 14929, 14939, 14947, 14951, 14957,
-    14969, 14983, 15013, 15017, 15031, 15053, 15061, 15073,
-    15077, 15083, 15091, 15101, 15107, 15121, 15131, 15137,
-    15139, 15149, 15161, 15173, 15187, 15193, 15199, 15217,
-    15227, 15233, 15241, 15259, 15263, 15269, 15271, 15277,
-    15287, 15289, 15299, 15307, 15313, 15319, 15329, 15331,
-    15349, 15359, 15361, 15373, 15377, 15383, 15391, 15401,
-    15413, 15427, 15439, 15443, 15451, 15461, 15467, 15473,
-    15493, 15497, 15511, 15527, 15541, 15551, 15559, 15569,
-    15581, 15583, 15601, 15607, 15619, 15629, 15641, 15643,
-    15647, 15649, 15661, 15667, 15671, 15679, 15683, 15727,
-    15731, 15733, 15737, 15739, 15749, 15761, 15767, 15773,
-    15787, 15791, 15797, 15803, 15809, 15817, 15823, 15859,
-    15877, 15881, 15887, 15889, 15901, 15907, 15913, 15919,
-    15923, 15937, 15959, 15971, 15973, 15991, 16001, 16007,
-    16033, 16057, 16061, 16063, 16067, 16069, 16073, 16087,
-    16091, 16097, 16103, 16111, 16127, 16139, 16141, 16183,
-    16187, 16189, 16193, 16217, 16223, 16229, 16231, 16249,
-    16253, 16267, 16273, 16301, 16319, 16333, 16339, 16349,
-    16361, 16363, 16369, 16381, 16411, 16417, 16421, 16427,
-    16433, 16447, 16451, 16453, 16477, 16481, 16487, 16493,
-    16519, 16529, 16547, 16553, 16561, 16567, 16573, 16603,
-    16607, 16619, 16631, 16633, 16649, 16651, 16657, 16661,
-    16673, 16691, 16693, 16699, 16703, 16729, 16741, 16747,
-    16759, 16763, 16787, 16811, 16823, 16829, 16831, 16843,
-    16871, 16879, 16883, 16889, 16901, 16903, 16921, 16927,
-    16931, 16937, 16943, 16963, 16979, 16981, 16987, 16993,
-    17011, 17021, 17027, 17029, 17033, 17041, 17047, 17053,
-    17077, 17093, 17099, 17107, 17117, 17123, 17137, 17159,
-    17167, 17183, 17189, 17191, 17203, 17207, 17209, 17231,
-    17239, 17257, 17291, 17293, 17299, 17317, 17321, 17327,
-    17333, 17341, 17351, 17359, 17377, 17383, 17387, 17389,
-    17393, 17401, 17417, 17419, 17431, 17443, 17449, 17467,
-    17471, 17477, 17483, 17489, 17491, 17497, 17509, 17519,
-    17539, 17551, 17569, 17573, 17579, 17581, 17597, 17599,
-    17609, 17623, 17627, 17657, 17659, 17669, 17681, 17683,
-    17707, 17713, 17729, 17737, 17747, 17749, 17761, 17783,
-    17789, 17791, 17807, 17827, 17837, 17839, 17851, 17863,
+       257,   263,
+       269,   271,   277,   281,   283,   293,   307,   311,
+       313,   317,   331,   337,   347,   349,   353,   359,
+       367,   373,   379,   383,   389,   397,   401,   409,
+       419,   421,   431,   433,   439,   443,   449,   457,
+       461,   463,   467,   479,   487,   491,   499,   503,
+       509,   521,   523,   541,   547,   557,   563,   569,
+       571,   577,   587,   593,   599,   601,   607,   613,
+       617,   619,   631,   641,   643,   647,   653,   659,
+       661,   673,   677,   683,   691,   701,   709,   719,
+       727,   733,   739,   743,   751,   757,   761,   769,
+       773,   787,   797,   809,   811,   821,   823,   827,
+       829,   839,   853,   857,   859,   863,   877,   881,
+       883,   887,   907,   911,   919,   929,   937,   941,
+       947,   953,   967,   971,   977,   983,   991,   997,
+      1009,  1013,  1019,  1021,  1031,  1033,  1039,  1049,
+      1051,  1061,  1063,  1069,  1087,  1091,  1093,  1097,
+      1103,  1109,  1117,  1123,  1129,  1151,  1153,  1163,
+      1171,  1181,  1187,  1193,  1201,  1213,  1217,  1223,
+      1229,  1231,  1237,  1249,  1259,  1277,  1279,  1283,
+      1289,  1291,  1297,  1301,  1303,  1307,  1319,  1321,
+      1327,  1361,  1367,  1373,  1381,  1399,  1409,  1423,
+      1427,  1429,  1433,  1439,  1447,  1451,  1453,  1459,
+      1471,  1481,  1483,  1487,  1489,  1493,  1499,  1511,
+      1523,  1531,  1543,  1549,  1553,  1559,  1567,  1571,
+      1579,  1583,  1597,  1601,  1607,  1609,  1613,  1619,
+      1621,  1627,  1637,  1657,  1663,  1667,  1669,  1693,
+      1697,  1699,  1709,  1721,  1723,  1733,  1741,  1747,
+      1753,  1759,  1777,  1783,  1787,  1789,  1801,  1811,
+      1823,  1831,  1847,  1861,  1867,  1871,  1873,  1877,
+      1879,  1889,  1901,  1907,  1913,  1931,  1933,  1949,
+      1951,  1973,  1979,  1987,  1993,  1997,  1999,  2003,
+      2011,  2017,  2027,  2029,  2039,  2053,  2063,  2069,
+      2081,  2083,  2087,  2089,  2099,  2111,  2113,  2129,
+      2131,  2137,  2141,  2143,  2153,  2161,  2179,  2203,
+      2207,  2213,  2221,  2237,  2239,  2243,  2251,  2267,
+      2269,  2273,  2281,  2287,  2293,  2297,  2309,  2311,
+      2333,  2339,  2341,  2347,  2351,  2357,  2371,  2377,
+      2381,  2383,  2389,  2393,  2399,  2411,  2417,  2423,
+      2437,  2441,  2447,  2459,  2467,  2473,  2477,  2503,
+      2521,  2531,  2539,  2543,  2549,  2551,  2557,  2579,
+      2591,  2593,  2609,  2617,  2621,  2633,  2647,  2657,
+      2659,  2663,  2671,  2677,  2683,  2687,  2689,  2693,
+      2699,  2707,  2711,  2713,  2719,  2729,  2731,  2741,
+      2749,  2753,  2767,  2777,  2789,  2791,  2797,  2801,
+      2803,  2819,  2833,  2837,  2843,  2851,  2857,  2861,
+      2879,  2887,  2897,  2903,  2909,  2917,  2927,  2939,
+      2953,  2957,  2963,  2969,  2971,  2999,  3001,  3011,
+      3019,  3023,  3037,  3041,  3049,  3061,  3067,  3079,
+      3083,  3089,  3109,  3119,  3121,  3137,  3163,  3167,
+      3169,  3181,  3187,  3191,  3203,  3209,  3217,  3221,
+      3229,  3251,  3253,  3257,  3259,  3271,  3299,  3301,
+      3307,  3313,  3319,  3323,  3329,  3331,  3343,  3347,
+      3359,  3361,  3371,  3373,  3389,  3391,  3407,  3413,
+      3433,  3449,  3457,  3461,  3463,  3467,  3469,  3491,
+      3499,  3511,  3517,  3527,  3529,  3533,  3539,  3541,
+      3547,  3557,  3559,  3571,  3581,  3583,  3593,  3607,
+      3613,  3617,  3623,  3631,  3637,  3643,  3659,  3671,
+      3673,  3677,  3691,  3697,  3701,  3709,  3719,  3727,
+      3733,  3739,  3761,  3767,  3769,  3779,  3793,  3797,
+      3803,  3821,  3823,  3833,  3847,  3851,  3853,  3863,
+      3877,  3881,  3889,  3907,  3911,  3917,  3919,  3923,
+      3929,  3931,  3943,  3947,  3967,  3989,  4001,  4003,
+      4007,  4013,  4019,  4021,  4027,  4049,  4051,  4057,
+      4073,  4079,  4091,  4093,  4099,  4111,  4127,  4129,
+      4133,  4139,  4153,  4157,  4159,  4177,  4201,  4211,
+      4217,  4219,  4229,  4231,  4241,  4243,  4253,  4259,
+      4261,  4271,  4273,  4283,  4289,  4297,  4327,  4337,
+      4339,  4349,  4357,  4363,  4373,  4391,  4397,  4409,
+      4421,  4423,  4441,  4447,  4451,  4457,  4463,  4481,
+      4483,  4493,  4507,  4513,  4517,  4519,  4523,  4547,
+      4549,  4561,  4567,  4583,  4591,  4597,  4603,  4621,
+      4637,  4639,  4643,  4649,  4651,  4657,  4663,  4673,
+      4679,  4691,  4703,  4721,  4723,  4729,  4733,  4751,
+      4759,  4783,  4787,  4789,  4793,  4799,  4801,  4813,
+      4817,  4831,  4861,  4871,  4877,  4889,  4903,  4909,
+      4919,  4931,  4933,  4937,  4943,  4951,  4957,  4967,
+      4969,  4973,  4987,  4993,  4999,  5003,  5009,  5011,
+      5021,  5023,  5039,  5051,  5059,  5077,  5081,  5087,
+      5099,  5101,  5107,  5113,  5119,  5147,  5153,  5167,
+      5171,  5179,  5189,  5197,  5209,  5227,  5231,  5233,
+      5237,  5261,  5273,  5279,  5281,  5297,  5303,  5309,
+      5323,  5333,  5347,  5351,  5381,  5387,  5393,  5399,
+      5407,  5413,  5417,  5419,  5431,  5437,  5441,  5443,
+      5449,  5471,  5477,  5479,  5483,  5501,  5503,  5507,
+      5519,  5521,  5527,  5531,  5557,  5563,  5569,  5573,
+      5581,  5591,  5623,  5639,  5641,  5647,  5651,  5653,
+      5657,  5659,  5669,  5683,  5689,  5693,  5701,  5711,
+      5717,  5737,  5741,  5743,  5749,  5779,  5783,  5791,
+      5801,  5807,  5813,  5821,  5827,  5839,  5843,  5849,
+      5851,  5857,  5861,  5867,  5869,  5879,  5881,  5897,
+      5903,  5923,  5927,  5939,  5953,  5981,  5987,  6007,
+      6011,  6029,  6037,  6043,  6047,  6053,  6067,  6073,
+      6079,  6089,  6091,  6101,  6113,  6121,  6131,  6133,
+      6143,  6151,  6163,  6173,  6197,  6199,  6203,  6211,
+      6217,  6221,  6229,  6247,  6257,  6263,  6269,  6271,
+      6277,  6287,  6299,  6301,  6311,  6317,  6323,  6329,
+      6337,  6343,  6353,  6359,  6361,  6367,  6373,  6379,
+      6389,  6397,  6421,  6427,  6449,  6451,  6469,  6473,
+      6481,  6491,  6521,  6529,  6547,  6551,  6553,  6563,
+      6569,  6571,  6577,  6581,  6599,  6607,  6619,  6637,
+      6653,  6659,  6661,  6673,  6679,  6689,  6691,  6701,
+      6703,  6709,  6719,  6733,  6737,  6761,  6763,  6779,
+      6781,  6791,  6793,  6803,  6823,  6827,  6829,  6833,
+      6841,  6857,  6863,  6869,  6871,  6883,  6899,  6907,
+      6911,  6917,  6947,  6949,  6959,  6961,  6967,  6971,
+      6977,  6983,  6991,  6997,  7001,  7013,  7019,  7027,
+      7039,  7043,  7057,  7069,  7079,  7103,  7109,  7121,
+      7127,  7129,  7151,  7159,  7177,  7187,  7193,  7207,
+      7211,  7213,  7219,  7229,  7237,  7243,  7247,  7253,
+      7283,  7297,  7307,  7309,  7321,  7331,  7333,  7349,
+      7351,  7369,  7393,  7411,  7417,  7433,  7451,  7457,
+      7459,  7477,  7481,  7487,  7489,  7499,  7507,  7517,
+      7523,  7529,  7537,  7541,  7547,  7549,  7559,  7561,
+      7573,  7577,  7583,  7589,  7591,  7603,  7607,  7621,
+      7639,  7643,  7649,  7669,  7673,  7681,  7687,  7691,
+      7699,  7703,  7717,  7723,  7727,  7741,  7753,  7757,
+      7759,  7789,  7793,  7817,  7823,  7829,  7841,  7853,
+      7867,  7873,  7877,  7879,  7883,  7901,  7907,  7919,
+      7927,  7933,  7937,  7949,  7951,  7963,  7993,  8009,
+      8011,  8017,  8039,  8053,  8059,  8069,  8081,  8087,
+      8089,  8093,  8101,  8111,  8117,  8123,  8147,  8161,
+      8167,  8171,  8179,  8191,  8209,  8219,  8221,  8231,
+      8233,  8237,  8243,  8263,  8269,  8273,  8287,  8291,
+      8293,  8297,  8311,  8317,  8329,  8353,  8363,  8369,
+      8377,  8387,  8389,  8419,  8423,  8429,  8431,  8443,
+      8447,  8461,  8467,  8501,  8513,  8521,  8527,  8537,
+      8539,  8543,  8563,  8573,  8581,  8597,  8599,  8609,
+      8623,  8627,  8629,  8641,  8647,  8663,  8669,  8677,
+      8681,  8689,  8693,  8699,  8707,  8713,  8719,  8731,
+      8737,  8741,  8747,  8753,  8761,  8779,  8783,  8803,
+      8807,  8819,  8821,  8831,  8837,  8839,  8849,  8861,
+      8863,  8867,  8887,  8893,  8923,  8929,  8933,  8941,
+      8951,  8963,  8969,  8971,  8999,  9001,  9007,  9011,
+      9013,  9029,  9041,  9043,  9049,  9059,  9067,  9091,
+      9103,  9109,  9127,  9133,  9137,  9151,  9157,  9161,
+      9173,  9181,  9187,  9199,  9203,  9209,  9221,  9227,
+      9239,  9241,  9257,  9277,  9281,  9283,  9293,  9311,
+      9319,  9323,  9337,  9341,  9343,  9349,  9371,  9377,
+      9391,  9397,  9403,  9413,  9419,  9421,  9431,  9433,
+      9437,  9439,  9461,  9463,  9467,  9473,  9479,  9491,
+      9497,  9511,  9521,  9533,  9539,  9547,  9551,  9587,
+      9601,  9613,  9619,  9623,  9629,  9631,  9643,  9649,
+      9661,  9677,  9679,  9689,  9697,  9719,  9721,  9733,
+      9739,  9743,  9749,  9767,  9769,  9781,  9787,  9791,
+      9803,  9811,  9817,  9829,  9833,  9839,  9851,  9857,
+      9859,  9871,  9883,  9887,  9901,  9907,  9923,  9929,
+      9931,  9941,  9949,  9967,  9973, 10007, 10009, 10037,
+     10039, 10061, 10067, 10069, 10079, 10091, 10093, 10099,
+     10103, 10111, 10133, 10139, 10141, 10151, 10159, 10163,
+     10169, 10177, 10181, 10193, 10211, 10223, 10243, 10247,
+     10253, 10259, 10267, 10271, 10273, 10289, 10301, 10303,
+     10313, 10321, 10331, 10333, 10337, 10343, 10357, 10369,
+     10391, 10399, 10427, 10429, 10433, 10453, 10457, 10459,
+     10463, 10477, 10487, 10499, 10501, 10513, 10529, 10531,
+     10559, 10567, 10589, 10597, 10601, 10607, 10613, 10627,
+     10631, 10639, 10651, 10657, 10663, 10667, 10687, 10691,
+     10709, 10711, 10723, 10729, 10733, 10739, 10753, 10771,
+     10781, 10789, 10799, 10831, 10837, 10847, 10853, 10859,
+     10861, 10867, 10883, 10889, 10891, 10903, 10909, 10937,
+     10939, 10949, 10957, 10973, 10979, 10987, 10993, 11003,
+     11027, 11047, 11057, 11059, 11069, 11071, 11083, 11087,
+     11093, 11113, 11117, 11119, 11131, 11149, 11159, 11161,
+     11171, 11173, 11177, 11197, 11213, 11239, 11243, 11251,
+     11257, 11261, 11273, 11279, 11287, 11299, 11311, 11317,
+     11321, 11329, 11351, 11353, 11369, 11383, 11393, 11399,
+     11411, 11423, 11437, 11443, 11447, 11467, 11471, 11483,
+     11489, 11491, 11497, 11503, 11519, 11527, 11549, 11551,
+     11579, 11587, 11593, 11597, 11617, 11621, 11633, 11657,
+     11677, 11681, 11689, 11699, 11701, 11717, 11719, 11731,
+     11743, 11777, 11779, 11783, 11789, 11801, 11807, 11813,
+     11821, 11827, 11831, 11833, 11839, 11863, 11867, 11887,
+     11897, 11903, 11909, 11923, 11927, 11933, 11939, 11941,
+     11953, 11959, 11969, 11971, 11981, 11987, 12007, 12011,
+     12037, 12041, 12043, 12049, 12071, 12073, 12097, 12101,
+     12107, 12109, 12113, 12119, 12143, 12149, 12157, 12161,
+     12163, 12197, 12203, 12211, 12227, 12239, 12241, 12251,
+     12253, 12263, 12269, 12277, 12281, 12289, 12301, 12323,
+     12329, 12343, 12347, 12373, 12377, 12379, 12391, 12401,
+     12409, 12413, 12421, 12433, 12437, 12451, 12457, 12473,
+     12479, 12487, 12491, 12497, 12503, 12511, 12517, 12527,
+     12539, 12541, 12547, 12553, 12569, 12577, 12583, 12589,
+     12601, 12611, 12613, 12619, 12637, 12641, 12647, 12653,
+     12659, 12671, 12689, 12697, 12703, 12713, 12721, 12739,
+     12743, 12757, 12763, 12781, 12791, 12799, 12809, 12821,
+     12823, 12829, 12841, 12853, 12889, 12893, 12899, 12907,
+     12911, 12917, 12919, 12923, 12941, 12953, 12959, 12967,
+     12973, 12979, 12983, 13001, 13003, 13007, 13009, 13033,
+     13037, 13043, 13049, 13063, 13093, 13099, 13103, 13109,
+     13121, 13127, 13147, 13151, 13159, 13163, 13171, 13177,
+     13183, 13187, 13217, 13219, 13229, 13241, 13249, 13259,
+     13267, 13291, 13297, 13309, 13313, 13327, 13331, 13337,
+     13339, 13367, 13381, 13397, 13399, 13411, 13417, 13421,
+     13441, 13451, 13457, 13463, 13469, 13477, 13487, 13499,
+     13513, 13523, 13537, 13553, 13567, 13577, 13591, 13597,
+     13613, 13619, 13627, 13633, 13649, 13669, 13679, 13681,
+     13687, 13691, 13693, 13697, 13709, 13711, 13721, 13723,
+     13729, 13751, 13757, 13759, 13763, 13781, 13789, 13799,
+     13807, 13829, 13831, 13841, 13859, 13873, 13877, 13879,
+     13883, 13901, 13903, 13907, 13913, 13921, 13931, 13933,
+     13963, 13967, 13997, 13999, 14009, 14011, 14029, 14033,
+     14051, 14057, 14071, 14081, 14083, 14087, 14107, 14143,
+     14149, 14153, 14159, 14173, 14177, 14197, 14207, 14221,
+     14243, 14249, 14251, 14281, 14293, 14303, 14321, 14323,
+     14327, 14341, 14347, 14369, 14387, 14389, 14401, 14407,
+     14411, 14419, 14423, 14431, 14437, 14447, 14449, 14461,
+     14479, 14489, 14503, 14519, 14533, 14537, 14543, 14549,
+     14551, 14557, 14561, 14563, 14591, 14593, 14621, 14627,
+     14629, 14633, 14639, 14653, 14657, 14669, 14683, 14699,
+     14713, 14717, 14723, 14731, 14737, 14741, 14747, 14753,
+     14759, 14767, 14771, 14779, 14783, 14797, 14813, 14821,
+     14827, 14831, 14843, 14851, 14867, 14869, 14879, 14887,
+     14891, 14897, 14923, 14929, 14939, 14947, 14951, 14957,
+     14969, 14983, 15013, 15017, 15031, 15053, 15061, 15073,
+     15077, 15083, 15091, 15101, 15107, 15121, 15131, 15137,
+     15139, 15149, 15161, 15173, 15187, 15193, 15199, 15217,
+     15227, 15233, 15241, 15259, 15263, 15269, 15271, 15277,
+     15287, 15289, 15299, 15307, 15313, 15319, 15329, 15331,
+     15349, 15359, 15361, 15373, 15377, 15383, 15391, 15401,
+     15413, 15427, 15439, 15443, 15451, 15461, 15467, 15473,
+     15493, 15497, 15511, 15527, 15541, 15551, 15559, 15569,
+     15581, 15583, 15601, 15607, 15619, 15629, 15641, 15643,
+     15647, 15649, 15661, 15667, 15671, 15679, 15683, 15727,
+     15731, 15733, 15737, 15739, 15749, 15761, 15767, 15773,
+     15787, 15791, 15797, 15803, 15809, 15817, 15823, 15859,
+     15877, 15881, 15887, 15889, 15901, 15907, 15913, 15919,
+     15923, 15937, 15959, 15971, 15973, 15991, 16001, 16007,
+     16033, 16057, 16061, 16063, 16067, 16069, 16073, 16087,
+     16091, 16097, 16103, 16111, 16127, 16139, 16141, 16183,
+     16187, 16189, 16193, 16217, 16223, 16229, 16231, 16249,
+     16253, 16267, 16273, 16301, 16319, 16333, 16339, 16349,
+     16361, 16363, 16369, 16381, 16411, 16417, 16421, 16427,
+     16433, 16447, 16451, 16453, 16477, 16481, 16487, 16493,
+     16519, 16529, 16547, 16553, 16561, 16567, 16573, 16603,
+     16607, 16619, 16631, 16633, 16649, 16651, 16657, 16661,
+     16673, 16691, 16693, 16699, 16703, 16729, 16741, 16747,
+     16759, 16763, 16787, 16811, 16823, 16829, 16831, 16843,
+     16871, 16879, 16883, 16889, 16901, 16903, 16921, 16927,
+     16931, 16937, 16943, 16963, 16979, 16981, 16987, 16993,
+     17011, 17021, 17027, 17029, 17033, 17041, 17047, 17053,
+     17077, 17093, 17099, 17107, 17117, 17123, 17137, 17159,
+     17167, 17183, 17189, 17191, 17203, 17207, 17209, 17231,
+     17239, 17257, 17291, 17293, 17299, 17317, 17321, 17327,
+     17333, 17341, 17351, 17359, 17377, 17383, 17387, 17389,
+     17393, 17401, 17417, 17419, 17431, 17443, 17449, 17467,
+     17471, 17477, 17483, 17489, 17491, 17497, 17509, 17519,
+     17539, 17551, 17569, 17573, 17579, 17581, 17597, 17599,
+     17609, 17623, 17627, 17657, 17659, 17669, 17681, 17683,
+     17707, 17713, 17729, 17737, 17747, 17749, 17761, 17783,
+     17789, 17791, 17807, 17827, 17837, 17839, 17851, 17863,
 #endif
 };
diff --git a/deps/openssl/openssl/crypto/bn/bn_prime.pl b/deps/openssl/openssl/crypto/bn/bn_prime.pl
index 3fafb6f3e90aa8..6bede65e1dd45f 100644
--- a/deps/openssl/openssl/crypto/bn/bn_prime.pl
+++ b/deps/openssl/openssl/crypto/bn/bn_prime.pl
@@ -26,7 +26,7 @@
 #  * the code are not to be removed.
 #  * See the COPYRIGHT file in the SSLeay distribution for more details.
 #  */
-# 
+#
 # EOF
 
 print <<\EOF;
@@ -37,21 +37,21 @@
  * This package is an SSL implementation written
  * by Eric Young (eay@cryptsoft.com).
  * The implementation was written so as to conform with Netscapes SSL.
- * 
+ *
  * This library is free for commercial and non-commercial use as long as
  * the following conditions are aheared to.  The following conditions
  * apply to all code found in this distribution, be it the RC4, RSA,
  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  * included with this distribution is covered by the same copyright terms
  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- * 
+ *
  * Copyright remains Eric Young's, and as such any Copyright notices in
  * the code are not to be removed.
  * If this package is used in a product, Eric Young should be given attribution
  * as the author of the parts of the library used.
  * This can be in the form of a textual message at program startup or
  * in documentation (online or textual) provided with the package.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
@@ -66,10 +66,10 @@
  *     Eric Young (eay@cryptsoft.com)"
  *    The word 'cryptographic' can be left out if the rouines from the library
  *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from 
+ * 4. If you include any Windows specific code (or a derivative thereof) from
  *    the apps directory (application code) you must include an acknowledgement:
  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
@@ -81,7 +81,7 @@
  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
- * 
+ *
  * The licence and distribution terms for any publically available version or
  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  * copied and put under another distribution licence
@@ -100,20 +100,20 @@
 	}
 
 printf "#ifndef EIGHT_BIT\n";
-printf "#define NUMPRIMES %d\n",$num;
+printf "# define NUMPRIMES %d\n",$num;
 printf "typedef unsigned short prime_t;\n";
 printf "#else\n";
-printf "#define NUMPRIMES %d\n",$eight;
+printf "# define NUMPRIMES %d\n",$eight;
 printf "typedef unsigned char prime_t;\n";
 printf "#endif\n";
-print "static const prime_t primes[NUMPRIMES]=\n\t{\n\t";
+print "static const prime_t primes[NUMPRIMES] = {";
 $init=0;
 for ($i=0; $i <= $#primes; $i++)
 	{
-	printf "\n#ifndef EIGHT_BIT\n\t" if ($primes[$i] > 256) && !($init++);
-	printf("\n\t") if (($i%8) == 0) && ($i != 0);
-	printf("%4d,",$primes[$i]);
+	printf "\n#ifndef EIGHT_BIT\n    " if ($primes[$i] > 256) && !($init++);
+	printf("\n    ") if ($i%8) == 0;
+	printf(" %5d,",$primes[$i]);
 	}
-print "\n#endif\n\t};\n";
+print "\n#endif\n};\n";
 
 
diff --git a/deps/openssl/openssl/crypto/bn/bn_print.c b/deps/openssl/openssl/crypto/bn/bn_print.c
index f121fb6e9a08d8..f85a6550a54ee5 100644
--- a/deps/openssl/openssl/crypto/bn/bn_print.c
+++ b/deps/openssl/openssl/crypto/bn/bn_print.c
@@ -82,8 +82,6 @@ char *BN_bn2hex(const BIGNUM *a)
     p = buf;
     if (a->neg)
         *(p++) = '-';
-    if (BN_is_zero(a))
-        *(p++) = '0';
     for (i = a->top - 1; i >= 0; i--) {
         for (j = BN_BITS2 - 8; j >= 0; j -= 8) {
             /* strip leading zeros */
diff --git a/deps/openssl/openssl/crypto/comp/c_rle.c b/deps/openssl/openssl/crypto/comp/c_rle.c
index e9aabbd166a2ec..41919613eec5a3 100644
--- a/deps/openssl/openssl/crypto/comp/c_rle.c
+++ b/deps/openssl/openssl/crypto/comp/c_rle.c
@@ -31,12 +31,11 @@ static int rle_compress_block(COMP_CTX *ctx, unsigned char *out,
                               unsigned int olen, unsigned char *in,
                               unsigned int ilen)
 {
-    /* int i; */
+    if (ilen == 0)
+        return 0;
 
-    if (ilen == 0 || olen < (ilen - 1)) {
-        /* ZZZZZZZZZZZZZZZZZZZZZZ */
-        return (-1);
-    }
+    if (olen <= ilen)
+        return -1;
 
     *(out++) = 0;
     memcpy(out, in, ilen);
@@ -49,14 +48,16 @@ static int rle_expand_block(COMP_CTX *ctx, unsigned char *out,
 {
     int i;
 
-    if (olen < (ilen - 1)) {
-        /* ZZZZZZZZZZZZZZZZZZZZZZ */
-        return (-1);
-    }
+    if (ilen == 0)
+        return 0;
+
+    if (olen < (ilen - 1))
+        return -1;
 
     i = *(in++);
-    if (i == 0) {
-        memcpy(out, in, ilen - 1);
-    }
+    if (i != 0)
+        return -1;
+
+    memcpy(out, in, ilen - 1);
     return (ilen - 1);
 }
diff --git a/deps/openssl/openssl/crypto/conf/conf.h b/deps/openssl/openssl/crypto/conf/conf.h
index 8d926d5d8268f5..fe49113080b700 100644
--- a/deps/openssl/openssl/crypto/conf/conf.h
+++ b/deps/openssl/openssl/crypto/conf/conf.h
@@ -259,6 +259,7 @@ void ERR_load_CONF_strings(void);
 # define CONF_R_NO_VALUE                                  108
 # define CONF_R_UNABLE_TO_CREATE_NEW_SECTION              103
 # define CONF_R_UNKNOWN_MODULE_NAME                       113
+# define CONF_R_VARIABLE_EXPANSION_TOO_LONG               116
 # define CONF_R_VARIABLE_HAS_NO_VALUE                     104
 
 #ifdef  __cplusplus
diff --git a/deps/openssl/openssl/crypto/conf/conf_def.c b/deps/openssl/openssl/crypto/conf/conf_def.c
index 68c77cec7d8b46..75e309aaca8184 100644
--- a/deps/openssl/openssl/crypto/conf/conf_def.c
+++ b/deps/openssl/openssl/crypto/conf/conf_def.c
@@ -69,6 +69,12 @@
 #include <openssl/buffer.h>
 #include <openssl/err.h>
 
+/*
+ * The maximum length we can grow a value to after variable expansion. 64k
+ * should be more than enough for all reasonable uses.
+ */
+#define MAX_CONF_VALUE_LENGTH       65536
+
 static char *eat_ws(CONF *conf, char *p);
 static char *eat_alpha_numeric(CONF *conf, char *p);
 static void clear_comments(CONF *conf, char *p);
@@ -530,6 +536,8 @@ static int str_copy(CONF *conf, char *section, char **pto, char *from)
         } else if (IS_EOF(conf, *from))
             break;
         else if (*from == '$') {
+            size_t newsize;
+
             /* try to expand it */
             rrp = NULL;
             s = &(from[1]);
@@ -584,8 +592,12 @@ static int str_copy(CONF *conf, char *section, char **pto, char *from)
                 CONFerr(CONF_F_STR_COPY, CONF_R_VARIABLE_HAS_NO_VALUE);
                 goto err;
             }
-            if (!BUF_MEM_grow_clean(buf,
-                        (strlen(p) + buf->length - (e - from)))) {
+            newsize = strlen(p) + buf->length - (e - from);
+            if (newsize > MAX_CONF_VALUE_LENGTH) {
+                CONFerr(CONF_F_STR_COPY, CONF_R_VARIABLE_EXPANSION_TOO_LONG);
+                goto err;
+            }
+            if (!BUF_MEM_grow_clean(buf, newsize)) {
                 CONFerr(CONF_F_STR_COPY, ERR_R_MALLOC_FAILURE);
                 goto err;
             }
diff --git a/deps/openssl/openssl/crypto/conf/conf_err.c b/deps/openssl/openssl/crypto/conf/conf_err.c
index bb5e2fe25215b8..b0b6896f837ee8 100644
--- a/deps/openssl/openssl/crypto/conf/conf_err.c
+++ b/deps/openssl/openssl/crypto/conf/conf_err.c
@@ -115,6 +115,8 @@ static ERR_STRING_DATA CONF_str_reasons[] = {
     {ERR_REASON(CONF_R_UNABLE_TO_CREATE_NEW_SECTION),
      "unable to create new section"},
     {ERR_REASON(CONF_R_UNKNOWN_MODULE_NAME), "unknown module name"},
+    {ERR_REASON(CONF_R_VARIABLE_EXPANSION_TOO_LONG),
+     "variable expansion too long"},
     {ERR_REASON(CONF_R_VARIABLE_HAS_NO_VALUE), "variable has no value"},
     {0, NULL}
 };
diff --git a/deps/openssl/openssl/crypto/des/Makefile b/deps/openssl/openssl/crypto/des/Makefile
index 8b5166ca9ff5fa..89156ba5ce2dcc 100644
--- a/deps/openssl/openssl/crypto/des/Makefile
+++ b/deps/openssl/openssl/crypto/des/Makefile
@@ -107,7 +107,7 @@ dclean:
 	mv -f Makefile.new $(MAKEFILE)
 
 clean:
-	rm -f *.s *.o *.obj des lib tags core .pure .nfs* *.old *.bak fluff
+	rm -f *.s *.S *.o *.obj des lib tags core .pure .nfs* *.old *.bak fluff
 
 # DO NOT DELETE THIS LINE -- make depend depends on it.
 
diff --git a/deps/openssl/openssl/crypto/des/set_key.c b/deps/openssl/openssl/crypto/des/set_key.c
index 8fd8fe14bb6316..d9c5e7fcb3bbfb 100644
--- a/deps/openssl/openssl/crypto/des/set_key.c
+++ b/deps/openssl/openssl/crypto/des/set_key.c
@@ -120,7 +120,7 @@ int DES_check_key_parity(const_DES_cblock *key)
 }
 
 /*-
- * Weak and semi week keys as take from
+ * Weak and semi weak keys as taken from
  * %A D.W. Davies
  * %A W.L. Price
  * %T Security for Computer Networks
diff --git a/deps/openssl/openssl/crypto/dh/dh.h b/deps/openssl/openssl/crypto/dh/dh.h
index a5bd9016aae85a..a228c7a7a4c3a1 100644
--- a/deps/openssl/openssl/crypto/dh/dh.h
+++ b/deps/openssl/openssl/crypto/dh/dh.h
@@ -182,12 +182,29 @@ struct dh_st {
  */
 # define DH_CHECK_P_NOT_STRONG_PRIME     DH_CHECK_P_NOT_SAFE_PRIME
 
-# define d2i_DHparams_fp(fp,x) (DH *)ASN1_d2i_fp((char *(*)())DH_new, \
-                (char *(*)())d2i_DHparams,(fp),(unsigned char **)(x))
-# define i2d_DHparams_fp(fp,x) ASN1_i2d_fp(i2d_DHparams,(fp), \
-                (unsigned char *)(x))
-# define d2i_DHparams_bio(bp,x) ASN1_d2i_bio_of(DH,DH_new,d2i_DHparams,bp,x)
-# define i2d_DHparams_bio(bp,x) ASN1_i2d_bio_of_const(DH,i2d_DHparams,bp,x)
+# define d2i_DHparams_fp(fp,x) \
+    (DH *)ASN1_d2i_fp((char *(*)())DH_new, \
+                      (char *(*)())d2i_DHparams, \
+                      (fp), \
+                      (unsigned char **)(x))
+# define i2d_DHparams_fp(fp,x) \
+    ASN1_i2d_fp(i2d_DHparams,(fp), (unsigned char *)(x))
+# define d2i_DHparams_bio(bp,x) \
+    ASN1_d2i_bio_of(DH, DH_new, d2i_DHparams, bp, x)
+# define i2d_DHparams_bio(bp,x) \
+    ASN1_i2d_bio_of_const(DH,i2d_DHparams,bp,x)
+
+# define d2i_DHxparams_fp(fp,x) \
+    (DH *)ASN1_d2i_fp((char *(*)())DH_new, \
+                      (char *(*)())d2i_DHxparams, \
+                      (fp), \
+                      (unsigned char **)(x))
+# define i2d_DHxparams_fp(fp,x) \
+    ASN1_i2d_fp(i2d_DHxparams,(fp), (unsigned char *)(x))
+# define d2i_DHxparams_bio(bp,x) \
+    ASN1_d2i_bio_of(DH, DH_new, d2i_DHxparams, bp, x)
+# define i2d_DHxparams_bio(bp,x) \
+    ASN1_i2d_bio_of_const(DH, i2d_DHxparams, bp, x)
 
 DH *DHparams_dup(DH *);
 
diff --git a/deps/openssl/openssl/crypto/ec/ec_ameth.c b/deps/openssl/openssl/crypto/ec/ec_ameth.c
index d089af7a28300b..2c41c6e7a9f181 100644
--- a/deps/openssl/openssl/crypto/ec/ec_ameth.c
+++ b/deps/openssl/openssl/crypto/ec/ec_ameth.c
@@ -342,8 +342,10 @@ static int eckey_priv_encode(PKCS8_PRIV_KEY_INFO *p8, const EVP_PKEY *pkey)
     }
 
     if (!PKCS8_pkey_set0(p8, OBJ_nid2obj(NID_X9_62_id_ecPublicKey), 0,
-                         ptype, pval, ep, eplen))
+                         ptype, pval, ep, eplen)) {
+        OPENSSL_free(ep);
         return 0;
+    }
 
     return 1;
 }
diff --git a/deps/openssl/openssl/crypto/ec/ec_asn1.c b/deps/openssl/openssl/crypto/ec/ec_asn1.c
index 33abf61f44417c..b0cd3e1788dcae 100644
--- a/deps/openssl/openssl/crypto/ec/ec_asn1.c
+++ b/deps/openssl/openssl/crypto/ec/ec_asn1.c
@@ -62,17 +62,22 @@
 #include <openssl/asn1t.h>
 #include <openssl/objects.h>
 
+#define OSSL_NELEM(x)    (sizeof(x)/sizeof(x[0]))
+
 int EC_GROUP_get_basis_type(const EC_GROUP *group)
 {
-    int i = 0;
+    int i;
 
     if (EC_METHOD_get_field_type(EC_GROUP_method_of(group)) !=
         NID_X9_62_characteristic_two_field)
         /* everything else is currently not supported */
         return 0;
 
-    while (group->poly[i] != 0)
-        i++;
+    /* Find the last non-zero element of group->poly[] */
+    for (i = 0;
+         i < (int)OSSL_NELEM(group->poly) && group->poly[i] != 0;
+         i++)
+        continue;
 
     if (i == 4)
         return NID_X9_62_ppBasis;
diff --git a/deps/openssl/openssl/crypto/ec/ec_mult.c b/deps/openssl/openssl/crypto/ec/ec_mult.c
index 23b8c3089b2fa8..24ca67a6ef1e71 100644
--- a/deps/openssl/openssl/crypto/ec/ec_mult.c
+++ b/deps/openssl/openssl/crypto/ec/ec_mult.c
@@ -68,10 +68,14 @@
 #include "ec_lcl.h"
 
 /*
- * This file implements the wNAF-based interleaving multi-exponentation method
- * (<URL:http://www.informatik.tu-darmstadt.de/TI/Mitarbeiter/moeller.html#multiexp>);
- * for multiplication with precomputation, we use wNAF splitting
- * (<URL:http://www.informatik.tu-darmstadt.de/TI/Mitarbeiter/moeller.html#fastexp>).
+ * This file implements the wNAF-based interleaving multi-exponentiation method
+ * Formerly at:
+ *   http://www.informatik.tu-darmstadt.de/TI/Mitarbeiter/moeller.html#multiexp
+ * You might now find it here:
+ *   http://link.springer.com/chapter/10.1007%2F3-540-45537-X_13
+ *   http://www.bmoeller.de/pdf/TI-01-08.multiexp.pdf
+ * For multiplication with precomputation, we use wNAF splitting, formerly at:
+ *   http://www.informatik.tu-darmstadt.de/TI/Mitarbeiter/moeller.html#fastexp
  */
 
 /* structure for precomputed multiples of the generator */
diff --git a/deps/openssl/openssl/crypto/ec/eck_prn.c b/deps/openssl/openssl/crypto/ec/eck_prn.c
index df9b37a750d625..176ec1f17308bd 100644
--- a/deps/openssl/openssl/crypto/ec/eck_prn.c
+++ b/deps/openssl/openssl/crypto/ec/eck_prn.c
@@ -342,7 +342,7 @@ static int print_bin(BIO *fp, const char *name, const unsigned char *buf,
                      size_t len, int off)
 {
     size_t i;
-    char str[128];
+    char str[128 + 1 + 4];
 
     if (buf == NULL)
         return 1;
diff --git a/deps/openssl/openssl/crypto/engine/eng_cryptodev.c b/deps/openssl/openssl/crypto/engine/eng_cryptodev.c
index 2a2b95ce837e24..af59471c4771cf 100644
--- a/deps/openssl/openssl/crypto/engine/eng_cryptodev.c
+++ b/deps/openssl/openssl/crypto/engine/eng_cryptodev.c
@@ -810,14 +810,15 @@ static int cryptodev_digest_update(EVP_MD_CTX *ctx, const void *data,
 
     if (!(ctx->flags & EVP_MD_CTX_FLAG_ONESHOT)) {
         /* if application doesn't support one buffer */
-        state->mac_data =
+        char *mac_data =
             OPENSSL_realloc(state->mac_data, state->mac_len + count);
 
-        if (!state->mac_data) {
+        if (mac_data == NULL) {
             printf("cryptodev_digest_update: realloc failed\n");
             return (0);
         }
 
+        state->mac_data = mac_data;
         memcpy(state->mac_data + state->mac_len, data, count);
         state->mac_len += count;
 
diff --git a/deps/openssl/openssl/crypto/err/err.c b/deps/openssl/openssl/crypto/err/err.c
index 52dc9a5ddd873c..0b1fcfc1f1a5de 100644
--- a/deps/openssl/openssl/crypto/err/err.c
+++ b/deps/openssl/openssl/crypto/err/err.c
@@ -172,6 +172,7 @@ static ERR_STRING_DATA ERR_str_functs[] = {
 # endif
     {ERR_PACK(0, SYS_F_OPENDIR, 0), "opendir"},
     {ERR_PACK(0, SYS_F_FREAD, 0), "fread"},
+    {ERR_PACK(0, SYS_F_FFLUSH, 0), "fflush"},
     {0, NULL},
 };
 
diff --git a/deps/openssl/openssl/crypto/err/err.h b/deps/openssl/openssl/crypto/err/err.h
index 585aa8ba3df935..f42365620db0c0 100644
--- a/deps/openssl/openssl/crypto/err/err.h
+++ b/deps/openssl/openssl/crypto/err/err.h
@@ -258,6 +258,7 @@ typedef struct err_state_st {
 # define SYS_F_WSASTARTUP        9/* Winsock stuff */
 # define SYS_F_OPENDIR           10
 # define SYS_F_FREAD             11
+# define SYS_F_FFLUSH            18
 
 /* reasons */
 # define ERR_R_SYS_LIB   ERR_LIB_SYS/* 2 */
diff --git a/deps/openssl/openssl/crypto/evp/e_aes.c b/deps/openssl/openssl/crypto/evp/e_aes.c
index 7c62d327a1f613..b45b364466acb8 100644
--- a/deps/openssl/openssl/crypto/evp/e_aes.c
+++ b/deps/openssl/openssl/crypto/evp/e_aes.c
@@ -1120,6 +1120,8 @@ BLOCK_CIPHER_generic_pack(NID_aes, 128, EVP_CIPH_FLAG_FIPS)
 static int aes_gcm_cleanup(EVP_CIPHER_CTX *c)
 {
     EVP_AES_GCM_CTX *gctx = c->cipher_data;
+    if (gctx == NULL)
+        return 0;
     OPENSSL_cleanse(&gctx->gcm, sizeof(gctx->gcm));
     if (gctx->iv != c->iv)
         OPENSSL_free(gctx->iv);
@@ -1235,10 +1237,15 @@ static int aes_gcm_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr)
         {
             unsigned int len = c->buf[arg - 2] << 8 | c->buf[arg - 1];
             /* Correct length for explicit IV */
+            if (len < EVP_GCM_TLS_EXPLICIT_IV_LEN)
+                return 0;
             len -= EVP_GCM_TLS_EXPLICIT_IV_LEN;
             /* If decrypting correct for tag too */
-            if (!c->encrypt)
+            if (!c->encrypt) {
+                if (len < EVP_GCM_TLS_TAG_LEN)
+                    return 0;
                 len -= EVP_GCM_TLS_TAG_LEN;
+            }
             c->buf[arg - 2] = len >> 8;
             c->buf[arg - 1] = len & 0xff;
         }
diff --git a/deps/openssl/openssl/crypto/evp/e_aes_cbc_hmac_sha1.c b/deps/openssl/openssl/crypto/evp/e_aes_cbc_hmac_sha1.c
index 6dfd590a4a2c8e..d114710e98ec4e 100644
--- a/deps/openssl/openssl/crypto/evp/e_aes_cbc_hmac_sha1.c
+++ b/deps/openssl/openssl/crypto/evp/e_aes_cbc_hmac_sha1.c
@@ -859,6 +859,8 @@ static int aesni_cbc_hmac_sha1_ctrl(EVP_CIPHER_CTX *ctx, int type, int arg,
                 key->payload_length = len;
                 if ((key->aux.tls_ver =
                      p[arg - 4] << 8 | p[arg - 3]) >= TLS1_1_VERSION) {
+                    if (len < AES_BLOCK_SIZE)
+                        return 0;
                     len -= AES_BLOCK_SIZE;
                     p[arg - 2] = len >> 8;
                     p[arg - 1] = len;
diff --git a/deps/openssl/openssl/crypto/evp/e_aes_cbc_hmac_sha256.c b/deps/openssl/openssl/crypto/evp/e_aes_cbc_hmac_sha256.c
index 46c9d033895b87..917ae0751dee3f 100644
--- a/deps/openssl/openssl/crypto/evp/e_aes_cbc_hmac_sha256.c
+++ b/deps/openssl/openssl/crypto/evp/e_aes_cbc_hmac_sha256.c
@@ -825,15 +825,19 @@ static int aesni_cbc_hmac_sha256_ctrl(EVP_CIPHER_CTX *ctx, int type, int arg,
     case EVP_CTRL_AEAD_TLS1_AAD:
         {
             unsigned char *p = ptr;
-            unsigned int len = p[arg - 2] << 8 | p[arg - 1];
+            unsigned int len;
 
             if (arg != EVP_AEAD_TLS1_AAD_LEN)
                 return -1;
 
+            len = p[arg - 2] << 8 | p[arg - 1];
+
             if (ctx->encrypt) {
                 key->payload_length = len;
                 if ((key->aux.tls_ver =
                      p[arg - 4] << 8 | p[arg - 3]) >= TLS1_1_VERSION) {
+                    if (len < AES_BLOCK_SIZE)
+                        return 0;
                     len -= AES_BLOCK_SIZE;
                     p[arg - 2] = len >> 8;
                     p[arg - 1] = len;
diff --git a/deps/openssl/openssl/crypto/evp/e_des3.c b/deps/openssl/openssl/crypto/evp/e_des3.c
index 0e910d6d8085b9..ab8126e5c9cf68 100644
--- a/deps/openssl/openssl/crypto/evp/e_des3.c
+++ b/deps/openssl/openssl/crypto/evp/e_des3.c
@@ -212,6 +212,8 @@ static int des_ede3_cfb1_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
     size_t n;
     unsigned char c[1], d[1];
 
+    if (!EVP_CIPHER_CTX_test_flags(ctx, EVP_CIPH_FLAG_LENGTH_BITS))
+            inl *= 8;
     for (n = 0; n < inl; ++n) {
         c[0] = (in[n / 8] & (1 << (7 - n % 8))) ? 0x80 : 0;
         DES_ede3_cfb_encrypt(c, d, 1, 1,
diff --git a/deps/openssl/openssl/crypto/evp/evp_enc.c b/deps/openssl/openssl/crypto/evp/evp_enc.c
index 0e40f09f2f91f4..be577bac767fe9 100644
--- a/deps/openssl/openssl/crypto/evp/evp_enc.c
+++ b/deps/openssl/openssl/crypto/evp/evp_enc.c
@@ -182,6 +182,7 @@ int EVP_CipherInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
         if (ctx->cipher->ctx_size) {
             ctx->cipher_data = OPENSSL_malloc(ctx->cipher->ctx_size);
             if (!ctx->cipher_data) {
+                ctx->cipher = NULL;
                 EVPerr(EVP_F_EVP_CIPHERINIT_EX, ERR_R_MALLOC_FAILURE);
                 return 0;
             }
@@ -193,6 +194,7 @@ int EVP_CipherInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
         ctx->flags &= EVP_CIPHER_CTX_FLAG_WRAP_ALLOW;
         if (ctx->cipher->flags & EVP_CIPH_CTRL_INIT) {
             if (!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_INIT, 0, NULL)) {
+                ctx->cipher = NULL;
                 EVPerr(EVP_F_EVP_CIPHERINIT_EX, EVP_R_INITIALIZATION_ERROR);
                 return 0;
             }
@@ -654,6 +656,7 @@ int EVP_CIPHER_CTX_copy(EVP_CIPHER_CTX *out, const EVP_CIPHER_CTX *in)
     if (in->cipher_data && in->cipher->ctx_size) {
         out->cipher_data = OPENSSL_malloc(in->cipher->ctx_size);
         if (!out->cipher_data) {
+            out->cipher = NULL;
             EVPerr(EVP_F_EVP_CIPHER_CTX_COPY, ERR_R_MALLOC_FAILURE);
             return 0;
         }
@@ -661,6 +664,10 @@ int EVP_CIPHER_CTX_copy(EVP_CIPHER_CTX *out, const EVP_CIPHER_CTX *in)
     }
 
     if (in->cipher->flags & EVP_CIPH_CUSTOM_COPY)
-        return in->cipher->ctrl((EVP_CIPHER_CTX *)in, EVP_CTRL_COPY, 0, out);
+        if (!in->cipher->ctrl((EVP_CIPHER_CTX *)in, EVP_CTRL_COPY, 0, out)) {
+            out->cipher = NULL;
+            EVPerr(EVP_F_EVP_CIPHER_CTX_COPY, EVP_R_INITIALIZATION_ERROR);
+            return 0;
+        }
     return 1;
 }
diff --git a/deps/openssl/openssl/crypto/evp/pmeth_lib.c b/deps/openssl/openssl/crypto/evp/pmeth_lib.c
index d06686290459c7..b7b7bdcd0290e6 100644
--- a/deps/openssl/openssl/crypto/evp/pmeth_lib.c
+++ b/deps/openssl/openssl/crypto/evp/pmeth_lib.c
@@ -188,6 +188,7 @@ static EVP_PKEY_CTX *int_ctx_new(EVP_PKEY *pkey, ENGINE *e, int id)
 
     if (pmeth->init) {
         if (pmeth->init(ret) <= 0) {
+            ret->pmeth = NULL;
             EVP_PKEY_CTX_free(ret);
             return NULL;
         }
@@ -315,6 +316,7 @@ EVP_PKEY_CTX *EVP_PKEY_CTX_dup(EVP_PKEY_CTX *pctx)
     if (pctx->pmeth->copy(rctx, pctx) > 0)
         return rctx;
 
+    rctx->pmeth = NULL;
     EVP_PKEY_CTX_free(rctx);
     return NULL;
 
diff --git a/deps/openssl/openssl/crypto/ex_data.c b/deps/openssl/openssl/crypto/ex_data.c
index f96a51781ab065..108a1959eacfc2 100644
--- a/deps/openssl/openssl/crypto/ex_data.c
+++ b/deps/openssl/openssl/crypto/ex_data.c
@@ -331,7 +331,11 @@ static EX_CLASS_ITEM *def_get_class(int class_index)
                  * from the insert will be NULL
                  */
                 (void)lh_EX_CLASS_ITEM_insert(ex_data, gen);
-                p = gen;
+                p = lh_EX_CLASS_ITEM_retrieve(ex_data, &d);
+                if (p != gen) {
+                    sk_CRYPTO_EX_DATA_FUNCS_free(gen->meth);
+                    OPENSSL_free(gen);
+                }
             }
         }
     }
@@ -455,7 +459,7 @@ static int int_dup_ex_data(int class_index, CRYPTO_EX_DATA *to,
                            CRYPTO_EX_DATA *from)
 {
     int mx, j, i;
-    char *ptr;
+    void *ptr;
     CRYPTO_EX_DATA_FUNCS **storage = NULL;
     EX_CLASS_ITEM *item;
     if (!from->sk)
@@ -469,6 +473,8 @@ static int int_dup_ex_data(int class_index, CRYPTO_EX_DATA *to,
     if (j < mx)
         mx = j;
     if (mx > 0) {
+        if (!CRYPTO_set_ex_data(to, mx - 1, NULL))
+            goto skip;
         storage = OPENSSL_malloc(mx * sizeof(CRYPTO_EX_DATA_FUNCS *));
         if (!storage)
             goto skip;
@@ -499,11 +505,12 @@ static void int_free_ex_data(int class_index, void *obj, CRYPTO_EX_DATA *ad)
     int mx, i;
     EX_CLASS_ITEM *item;
     void *ptr;
+    CRYPTO_EX_DATA_FUNCS *f;
     CRYPTO_EX_DATA_FUNCS **storage = NULL;
     if (ex_data == NULL)
-        return;
+        goto err;
     if ((item = def_get_class(class_index)) == NULL)
-        return;
+        goto err;
     CRYPTO_r_lock(CRYPTO_LOCK_EX_DATA);
     mx = sk_CRYPTO_EX_DATA_FUNCS_num(item->meth);
     if (mx > 0) {
@@ -515,23 +522,23 @@ static void int_free_ex_data(int class_index, void *obj, CRYPTO_EX_DATA *ad)
     }
  skip:
     CRYPTO_r_unlock(CRYPTO_LOCK_EX_DATA);
-    if ((mx > 0) && !storage) {
-        CRYPTOerr(CRYPTO_F_INT_FREE_EX_DATA, ERR_R_MALLOC_FAILURE);
-        return;
-    }
     for (i = 0; i < mx; i++) {
-        if (storage[i] && storage[i]->free_func) {
+        if (storage != NULL)
+            f = storage[i];
+        else {
+            CRYPTO_r_lock(CRYPTO_LOCK_EX_DATA);
+            f = sk_CRYPTO_EX_DATA_FUNCS_value(item->meth, i);
+            CRYPTO_r_unlock(CRYPTO_LOCK_EX_DATA);
+        }
+        if (f != NULL && f->free_func != NULL) {
             ptr = CRYPTO_get_ex_data(ad, i);
-            storage[i]->free_func(obj, ptr, ad, i,
-                                  storage[i]->argl, storage[i]->argp);
+            f->free_func(obj, ptr, ad, i, f->argl, f->argp);
         }
     }
-    if (storage)
-        OPENSSL_free(storage);
-    if (ad->sk) {
-        sk_void_free(ad->sk);
-        ad->sk = NULL;
-    }
+    OPENSSL_free(storage);
+ err:
+    sk_void_free(ad->sk);
+    ad->sk = NULL;
 }
 
 /********************************************************************/
diff --git a/deps/openssl/openssl/crypto/hmac/hm_pmeth.c b/deps/openssl/openssl/crypto/hmac/hm_pmeth.c
index 0ffff79cc4503b..0a59a01cf0e81f 100644
--- a/deps/openssl/openssl/crypto/hmac/hm_pmeth.c
+++ b/deps/openssl/openssl/crypto/hmac/hm_pmeth.c
@@ -99,15 +99,18 @@ static int pkey_hmac_copy(EVP_PKEY_CTX *dst, EVP_PKEY_CTX *src)
     sctx = src->data;
     dctx = dst->data;
     dctx->md = sctx->md;
-    HMAC_CTX_init(&dctx->ctx);
     if (!HMAC_CTX_copy(&dctx->ctx, &sctx->ctx))
-        return 0;
-    if (sctx->ktmp.data) {
+        goto err;
+    if (sctx->ktmp.data != NULL) {
         if (!ASN1_OCTET_STRING_set(&dctx->ktmp,
                                    sctx->ktmp.data, sctx->ktmp.length))
-            return 0;
+            goto err;
     }
     return 1;
+ err:
+    HMAC_CTX_cleanup(&dctx->ctx);
+    OPENSSL_free(dctx);
+    return 0;
 }
 
 static void pkey_hmac_cleanup(EVP_PKEY_CTX *ctx)
diff --git a/deps/openssl/openssl/crypto/include/internal/bn_conf.h b/deps/openssl/openssl/crypto/include/internal/bn_conf.h
new file mode 100644
index 00000000000000..34bd8b78b4f90f
--- /dev/null
+++ b/deps/openssl/openssl/crypto/include/internal/bn_conf.h
@@ -0,0 +1,28 @@
+/* WARNING: do not edit! */
+/* Generated by Makefile from crypto/include/internal/bn_conf.h.in */
+/*
+ * Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the OpenSSL license (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+
+#ifndef HEADER_BN_CONF_H
+# define HEADER_BN_CONF_H
+
+/*
+ * The contents of this file are not used in the UEFI build, as
+ * both 32-bit and 64-bit builds are supported from a single run
+ * of the Configure script.
+ */
+
+/* Should we define BN_DIV2W here? */
+
+/* Only one for the following should be defined */
+#define SIXTY_FOUR_BIT_LONG
+#undef SIXTY_FOUR_BIT
+#undef THIRTY_TWO_BIT
+
+#endif
diff --git a/deps/openssl/openssl/crypto/include/internal/dso_conf.h b/deps/openssl/openssl/crypto/include/internal/dso_conf.h
new file mode 100644
index 00000000000000..7a52dd1f1a1159
--- /dev/null
+++ b/deps/openssl/openssl/crypto/include/internal/dso_conf.h
@@ -0,0 +1,16 @@
+/* WARNING: do not edit! */
+/* Generated by Makefile from crypto/include/internal/dso_conf.h.in */
+/*
+ * Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the OpenSSL license (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+
+#ifndef HEADER_DSO_CONF_H
+# define HEADER_DSO_CONF_H
+
+# define DSO_EXTENSION ".so"
+#endif
diff --git a/deps/openssl/openssl/crypto/md5/Makefile b/deps/openssl/openssl/crypto/md5/Makefile
index f5240da74cd791..9942cb4e37a692 100644
--- a/deps/openssl/openssl/crypto/md5/Makefile
+++ b/deps/openssl/openssl/crypto/md5/Makefile
@@ -90,7 +90,7 @@ dclean:
 	mv -f Makefile.new $(MAKEFILE)
 
 clean:
-	rm -f *.s *.o *.obj lib tags core .pure .nfs* *.old *.bak fluff
+	rm -f *.s *.S *.o *.obj lib tags core .pure .nfs* *.old *.bak fluff
 
 # DO NOT DELETE THIS LINE -- make depend depends on it.
 
diff --git a/deps/openssl/openssl/crypto/mem.c b/deps/openssl/openssl/crypto/mem.c
index 06c3960cc6c05b..dd4c9ce9e0b86b 100644
--- a/deps/openssl/openssl/crypto/mem.c
+++ b/deps/openssl/openssl/crypto/mem.c
@@ -150,12 +150,12 @@ static long (*get_debug_options_func) (void) = NULL;
 int CRYPTO_set_mem_functions(void *(*m) (size_t), void *(*r) (void *, size_t),
                              void (*f) (void *))
 {
-    /* Dummy call just to ensure OPENSSL_init() gets linked in */
-    OPENSSL_init();
     if (!allow_customize)
         return 0;
     if ((m == 0) || (r == 0) || (f == 0))
         return 0;
+    /* Dummy call just to ensure OPENSSL_init() gets linked in */
+    OPENSSL_init();
     malloc_func = m;
     malloc_ex_func = default_malloc_ex;
     realloc_func = r;
diff --git a/deps/openssl/openssl/crypto/modes/Makefile b/deps/openssl/openssl/crypto/modes/Makefile
index a7863d98be2f5c..2528f4a1b9cad4 100644
--- a/deps/openssl/openssl/crypto/modes/Makefile
+++ b/deps/openssl/openssl/crypto/modes/Makefile
@@ -106,7 +106,7 @@ dclean:
 	mv -f Makefile.new $(MAKEFILE)
 
 clean:
-	rm -f *.s *.o */*.o *.obj lib tags core .pure .nfs* *.old *.bak fluff
+	rm -f *.s *.S *.o */*.o *.obj lib tags core .pure .nfs* *.old *.bak fluff
 
 # DO NOT DELETE THIS LINE -- make depend depends on it.
 
diff --git a/deps/openssl/openssl/crypto/o_dir.c b/deps/openssl/openssl/crypto/o_dir.c
index f9dbed87112793..fb3b2fd8e4370f 100644
--- a/deps/openssl/openssl/crypto/o_dir.c
+++ b/deps/openssl/openssl/crypto/o_dir.c
@@ -73,7 +73,8 @@
 #include "o_dir.h"
 
 #define LPDIR_H
-#if defined OPENSSL_SYS_UNIX || defined DJGPP
+#if defined OPENSSL_SYS_UNIX || defined DJGPP \
+    || (defined __VMS_VER && __VMS_VER >= 70000000)
 # include "LPdir_unix.c"
 #elif defined OPENSSL_SYS_VMS
 # include "LPdir_vms.c"
diff --git a/deps/openssl/openssl/crypto/o_time.c b/deps/openssl/openssl/crypto/o_time.c
index b99e5990b4e4e9..04d805d9a96d04 100755
--- a/deps/openssl/openssl/crypto/o_time.c
+++ b/deps/openssl/openssl/crypto/o_time.c
@@ -106,11 +106,8 @@ struct tm *OPENSSL_gmtime(const time_t *timer, struct tm *result)
     struct tm *ts = NULL;
 
 #if defined(OPENSSL_THREADS) && !defined(OPENSSL_SYS_WIN32) && !defined(OPENSSL_SYS_OS2) && (!defined(OPENSSL_SYS_VMS) || defined(gmtime_r)) && !defined(OPENSSL_SYS_MACOSX) && !defined(OPENSSL_SYS_SUNOS)
-    /*
-     * should return &data, but doesn't on some systems, so we don't even
-     * look at the return value
-     */
-    gmtime_r(timer, result);
+    if (gmtime_r(timer, result) == NULL)
+        return NULL;
     ts = result;
 #elif !defined(OPENSSL_SYS_VMS) || defined(VMS_GMTIME_OK)
     ts = gmtime(timer);
diff --git a/deps/openssl/openssl/crypto/opensslv.h b/deps/openssl/openssl/crypto/opensslv.h
index 645dd0793f32e0..825a330abc8825 100644
--- a/deps/openssl/openssl/crypto/opensslv.h
+++ b/deps/openssl/openssl/crypto/opensslv.h
@@ -30,11 +30,11 @@ extern "C" {
  * (Prior to 0.9.5a beta1, a different scheme was used: MMNNFFRBB for
  *  major minor fix final patch/beta)
  */
-# define OPENSSL_VERSION_NUMBER  0x100020bfL
+# define OPENSSL_VERSION_NUMBER  0x100020cfL
 # ifdef OPENSSL_FIPS
-#  define OPENSSL_VERSION_TEXT    "OpenSSL 1.0.2k-fips  26 Jan 2017"
+#  define OPENSSL_VERSION_TEXT    "OpenSSL 1.0.2l-fips  25 May 2017"
 # else
-#  define OPENSSL_VERSION_TEXT    "OpenSSL 1.0.2k  26 Jan 2017"
+#  define OPENSSL_VERSION_TEXT    "OpenSSL 1.0.2l  25 May 2017"
 # endif
 # define OPENSSL_VERSION_PTEXT   " part of " OPENSSL_VERSION_TEXT
 
diff --git a/deps/openssl/openssl/crypto/perlasm/x86_64-xlate.pl b/deps/openssl/openssl/crypto/perlasm/x86_64-xlate.pl
index b7ae40b4dbfa98..625f95cd3c3eb8 100755
--- a/deps/openssl/openssl/crypto/perlasm/x86_64-xlate.pl
+++ b/deps/openssl/openssl/crypto/perlasm/x86_64-xlate.pl
@@ -414,7 +414,7 @@
 	}
     }
 }
-{ package expr;		# pick up expressioins
+{ package expr;		# pick up expressions
     sub re {
 	my	$self = shift;	# single instance is enough...
 	local	*line = shift;
@@ -977,7 +977,7 @@ sub rxb {
 # the area above user stack pointer in true asynchronous manner...
 #
 # All the above means that if assembler programmer adheres to Unix
-# register and stack layout, but disregards the "red zone" existense,
+# register and stack layout, but disregards the "red zone" existence,
 # it's possible to use following prologue and epilogue to "gear" from
 # Unix to Win64 ABI in leaf functions with not more than 6 arguments.
 #
diff --git a/deps/openssl/openssl/crypto/pkcs12/p12_mutl.c b/deps/openssl/openssl/crypto/pkcs12/p12_mutl.c
index cbf34da05adadb..b1f7381a6fb5e4 100644
--- a/deps/openssl/openssl/crypto/pkcs12/p12_mutl.c
+++ b/deps/openssl/openssl/crypto/pkcs12/p12_mutl.c
@@ -159,7 +159,10 @@ int PKCS12_set_mac(PKCS12 *p12, const char *pass, int passlen,
 int PKCS12_setup_mac(PKCS12 *p12, int iter, unsigned char *salt, int saltlen,
                      const EVP_MD *md_type)
 {
-    if (!(p12->mac = PKCS12_MAC_DATA_new()))
+    PKCS12_MAC_DATA_free(p12->mac);
+    p12->mac = NULL;
+
+    if ((p12->mac = PKCS12_MAC_DATA_new()) == NULL)
         return PKCS12_ERROR;
     if (iter > 1) {
         if (!(p12->mac->iter = M_ASN1_INTEGER_new())) {
diff --git a/deps/openssl/openssl/crypto/ppccap.c b/deps/openssl/openssl/crypto/ppccap.c
index 74af4732b5fa8d..60566b1a5f52fb 100644
--- a/deps/openssl/openssl/crypto/ppccap.c
+++ b/deps/openssl/openssl/crypto/ppccap.c
@@ -7,6 +7,10 @@
 #if defined(__linux) || defined(_AIX)
 # include <sys/utsname.h>
 #endif
+#if defined(__APPLE__) && defined(__MACH__)
+# include <sys/types.h>
+# include <sys/sysctl.h>
+#endif
 #include <openssl/crypto.h>
 #include <openssl/bn.h>
 
@@ -123,6 +127,26 @@ void OPENSSL_cpuid_setup(void)
     }
 #endif
 
+#if defined(__APPLE__) && defined(__MACH__)
+    {
+        int val;
+        size_t len = sizeof(val);
+
+        if (sysctlbyname("hw.optional.64bitops", &val, &len, NULL, 0) == 0) {
+            if (val)
+                OPENSSL_ppccap_P |= PPC_FPU64;
+        }
+
+        len = sizeof(val);
+        if (sysctlbyname("hw.optional.altivec", &val, &len, NULL, 0) == 0) {
+            if (val)
+                OPENSSL_ppccap_P |= PPC_ALTIVEC;
+        }
+
+        return;
+    }
+#endif
+
     memset(&ill_act, 0, sizeof(ill_act));
     ill_act.sa_handler = ill_handler;
     ill_act.sa_mask = all_masked;
diff --git a/deps/openssl/openssl/crypto/rand/md_rand.c b/deps/openssl/openssl/crypto/rand/md_rand.c
index bd76e23e3deb33..29e465b07524b1 100644
--- a/deps/openssl/openssl/crypto/rand/md_rand.c
+++ b/deps/openssl/openssl/crypto/rand/md_rand.c
@@ -266,17 +266,21 @@ static void ssleay_rand_add(const void *buf, int num, double add)
         j = (num - i);
         j = (j > MD_DIGEST_LENGTH) ? MD_DIGEST_LENGTH : j;
 
-        MD_Init(&m);
-        MD_Update(&m, local_md, MD_DIGEST_LENGTH);
+        if (!MD_Init(&m) ||
+            !MD_Update(&m, local_md, MD_DIGEST_LENGTH))
+            goto err;
         k = (st_idx + j) - STATE_SIZE;
         if (k > 0) {
-            MD_Update(&m, &(state[st_idx]), j - k);
-            MD_Update(&m, &(state[0]), k);
+            if (!MD_Update(&m, &(state[st_idx]), j - k) ||
+                !MD_Update(&m, &(state[0]), k))
+                goto err;
         } else
-            MD_Update(&m, &(state[st_idx]), j);
+            if (!MD_Update(&m, &(state[st_idx]), j))
+                goto err;
 
         /* DO NOT REMOVE THE FOLLOWING CALL TO MD_Update()! */
-        MD_Update(&m, buf, j);
+        if (!MD_Update(&m, buf, j))
+            goto err;
         /*
          * We know that line may cause programs such as purify and valgrind
          * to complain about use of uninitialized data.  The problem is not,
@@ -285,8 +289,9 @@ static void ssleay_rand_add(const void *buf, int num, double add)
          * insecure keys.
          */
 
-        MD_Update(&m, (unsigned char *)&(md_c[0]), sizeof(md_c));
-        MD_Final(&m, local_md);
+        if (!MD_Update(&m, (unsigned char *)&(md_c[0]), sizeof(md_c)) ||
+            !MD_Final(&m, local_md))
+            goto err;
         md_c[1]++;
 
         buf = (const char *)buf + j;
@@ -305,7 +310,6 @@ static void ssleay_rand_add(const void *buf, int num, double add)
                 st_idx = 0;
         }
     }
-    EVP_MD_CTX_cleanup(&m);
 
     if (!do_not_lock)
         CRYPTO_w_lock(CRYPTO_LOCK_RAND);
@@ -326,6 +330,9 @@ static void ssleay_rand_add(const void *buf, int num, double add)
 #if !defined(OPENSSL_THREADS) && !defined(OPENSSL_SYS_WIN32)
     assert(md_c[1] == md_count[1]);
 #endif
+
+ err:
+    EVP_MD_CTX_cleanup(&m);
 }
 
 static void ssleay_rand_seed(const void *buf, int num)
@@ -469,15 +476,18 @@ int ssleay_rand_bytes(unsigned char *buf, int num, int pseudo, int lock)
         /* num_ceil -= MD_DIGEST_LENGTH/2 */
         j = (num >= MD_DIGEST_LENGTH / 2) ? MD_DIGEST_LENGTH / 2 : num;
         num -= j;
-        MD_Init(&m);
+        if (!MD_Init(&m))
+           goto err;
 #ifndef GETPID_IS_MEANINGLESS
         if (curr_pid) {         /* just in the first iteration to save time */
-            MD_Update(&m, (unsigned char *)&curr_pid, sizeof curr_pid);
+            if (!MD_Update(&m, (unsigned char *)&curr_pid, sizeof curr_pid))
+                goto err;
             curr_pid = 0;
         }
 #endif
-        MD_Update(&m, local_md, MD_DIGEST_LENGTH);
-        MD_Update(&m, (unsigned char *)&(md_c[0]), sizeof(md_c));
+        if (!MD_Update(&m, local_md, MD_DIGEST_LENGTH) ||
+            !MD_Update(&m, (unsigned char *)&(md_c[0]), sizeof(md_c)))
+            goto err;
 
 #ifndef PURIFY                  /* purify complains */
         /*
@@ -487,16 +497,21 @@ int ssleay_rand_bytes(unsigned char *buf, int num, int pseudo, int lock)
          * builds it is not used: the removal of such a small source of
          * entropy has negligible impact on security.
          */
-        MD_Update(&m, buf, j);
+        if (!MD_Update(&m, buf, j))
+            goto err;
 #endif
 
         k = (st_idx + MD_DIGEST_LENGTH / 2) - st_num;
         if (k > 0) {
-            MD_Update(&m, &(state[st_idx]), MD_DIGEST_LENGTH / 2 - k);
-            MD_Update(&m, &(state[0]), k);
-        } else
-            MD_Update(&m, &(state[st_idx]), MD_DIGEST_LENGTH / 2);
-        MD_Final(&m, local_md);
+            if (!MD_Update(&m, &(state[st_idx]), MD_DIGEST_LENGTH / 2 - k) ||
+                !MD_Update(&m, &(state[0]), k))
+                goto err;
+        } else {
+            if (!MD_Update(&m, &(state[st_idx]), MD_DIGEST_LENGTH / 2))
+                goto err;
+        }
+        if (!MD_Final(&m, local_md))
+            goto err;
 
         for (i = 0; i < MD_DIGEST_LENGTH / 2; i++) {
             /* may compete with other threads */
@@ -508,13 +523,18 @@ int ssleay_rand_bytes(unsigned char *buf, int num, int pseudo, int lock)
         }
     }
 
-    MD_Init(&m);
-    MD_Update(&m, (unsigned char *)&(md_c[0]), sizeof(md_c));
-    MD_Update(&m, local_md, MD_DIGEST_LENGTH);
+    if (!MD_Init(&m) ||
+        !MD_Update(&m, (unsigned char *)&(md_c[0]), sizeof(md_c)) ||
+        !MD_Update(&m, local_md, MD_DIGEST_LENGTH))
+        goto err;
     if (lock)
         CRYPTO_w_lock(CRYPTO_LOCK_RAND);
-    MD_Update(&m, md, MD_DIGEST_LENGTH);
-    MD_Final(&m, md);
+    if (!MD_Update(&m, md, MD_DIGEST_LENGTH) ||
+        !MD_Final(&m, md)) {
+        if (lock)
+            CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
+        goto err;
+    }
     if (lock)
         CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
 
@@ -529,6 +549,10 @@ int ssleay_rand_bytes(unsigned char *buf, int num, int pseudo, int lock)
                            "http://www.openssl.org/support/faq.html");
         return (0);
     }
+
+ err:
+    EVP_MD_CTX_cleanup(&m);
+    return (0);
 }
 
 static int ssleay_rand_nopseudo_bytes(unsigned char *buf, int num)
diff --git a/deps/openssl/openssl/crypto/rc4/Makefile b/deps/openssl/openssl/crypto/rc4/Makefile
index 7434ff737e6613..a495324cc6b5ae 100644
--- a/deps/openssl/openssl/crypto/rc4/Makefile
+++ b/deps/openssl/openssl/crypto/rc4/Makefile
@@ -100,7 +100,7 @@ dclean:
 	mv -f Makefile.new $(MAKEFILE)
 
 clean:
-	rm -f *.s *.o *.obj lib tags core .pure .nfs* *.old *.bak fluff
+	rm -f *.s *.S *.o *.obj lib tags core .pure .nfs* *.old *.bak fluff
 
 # DO NOT DELETE THIS LINE -- make depend depends on it.
 
diff --git a/deps/openssl/openssl/crypto/rsa/rsa_pmeth.c b/deps/openssl/openssl/crypto/rsa/rsa_pmeth.c
index ac583bf60b0181..8896e2e977149b 100644
--- a/deps/openssl/openssl/crypto/rsa/rsa_pmeth.c
+++ b/deps/openssl/openssl/crypto/rsa/rsa_pmeth.c
@@ -446,19 +446,14 @@ static int pkey_rsa_decrypt(EVP_PKEY_CTX *ctx,
     int ret;
     RSA_PKEY_CTX *rctx = ctx->data;
     if (rctx->pad_mode == RSA_PKCS1_OAEP_PADDING) {
-        int i;
         if (!setup_tbuf(rctx, ctx))
             return -1;
         ret = RSA_private_decrypt(inlen, in, rctx->tbuf,
                                   ctx->pkey->pkey.rsa, RSA_NO_PADDING);
         if (ret <= 0)
             return ret;
-        for (i = 0; i < ret; i++) {
-            if (rctx->tbuf[i])
-                break;
-        }
-        ret = RSA_padding_check_PKCS1_OAEP_mgf1(out, ret, rctx->tbuf + i,
-                                                ret - i, ret,
+        ret = RSA_padding_check_PKCS1_OAEP_mgf1(out, ret, rctx->tbuf,
+                                                ret, ret,
                                                 rctx->oaep_label,
                                                 rctx->oaep_labellen,
                                                 rctx->md, rctx->mgf1md);
diff --git a/deps/openssl/openssl/crypto/rsa/rsa_pss.c b/deps/openssl/openssl/crypto/rsa/rsa_pss.c
index 41bc0844e48ed9..2c3fd73b0996a9 100644
--- a/deps/openssl/openssl/crypto/rsa/rsa_pss.c
+++ b/deps/openssl/openssl/crypto/rsa/rsa_pss.c
@@ -122,7 +122,11 @@ int RSA_verify_PKCS1_PSS_mgf1(RSA *rsa, const unsigned char *mHash,
         EM++;
         emLen--;
     }
-    if (emLen < (hLen + sLen + 2)) { /* sLen can be small negative */
+    if (emLen < hLen + 2) {
+        RSAerr(RSA_F_RSA_VERIFY_PKCS1_PSS_MGF1, RSA_R_DATA_TOO_LARGE);
+        goto err;
+    }
+    if (sLen > emLen - hLen - 2) { /* sLen can be small negative */
         RSAerr(RSA_F_RSA_VERIFY_PKCS1_PSS_MGF1, RSA_R_DATA_TOO_LARGE);
         goto err;
     }
@@ -222,9 +226,14 @@ int RSA_padding_add_PKCS1_PSS_mgf1(RSA *rsa, unsigned char *EM,
         *EM++ = 0;
         emLen--;
     }
+    if (emLen < hLen + 2) {
+        RSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_PSS_MGF1,
+               RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE);
+        goto err;
+    }
     if (sLen == -2) {
         sLen = emLen - hLen - 2;
-    } else if (emLen < (hLen + sLen + 2)) {
+    } else if (sLen > emLen - hLen - 2) {
         RSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_PSS_MGF1,
                RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE);
         goto err;
diff --git a/deps/openssl/openssl/crypto/sha/Makefile b/deps/openssl/openssl/crypto/sha/Makefile
index de6cdde58a9ca1..8b8f8b285f1c68 100644
--- a/deps/openssl/openssl/crypto/sha/Makefile
+++ b/deps/openssl/openssl/crypto/sha/Makefile
@@ -135,7 +135,7 @@ dclean:
 	mv -f Makefile.new $(MAKEFILE)
 
 clean:
-	rm -f *.s *.o *.obj lib tags core .pure .nfs* *.old *.bak fluff
+	rm -f *.s *.S *.o *.obj lib tags core .pure .nfs* *.old *.bak fluff
 
 # DO NOT DELETE THIS LINE -- make depend depends on it.
 
diff --git a/deps/openssl/openssl/crypto/srp/srp_vfy.c b/deps/openssl/openssl/crypto/srp/srp_vfy.c
index a8ec52a4dadc24..c8bc7a94b26c4b 100644
--- a/deps/openssl/openssl/crypto/srp/srp_vfy.c
+++ b/deps/openssl/openssl/crypto/srp/srp_vfy.c
@@ -86,10 +86,13 @@ static int t_fromb64(unsigned char *a, size_t alen, const char *src)
     int i, j;
     int size;
 
+    if (alen == 0 || alen > INT_MAX)
+        return -1;
+
     while (*src && (*src == ' ' || *src == '\t' || *src == '\n'))
         ++src;
     size = strlen(src);
-    if (alen > INT_MAX || size > (int)alen)
+    if (size < 0 || size >= (int)alen)
         return -1;
 
     i = 0;
@@ -127,7 +130,7 @@ static int t_fromb64(unsigned char *a, size_t alen, const char *src)
         if (--i < 0)
             break;
     }
-    while (a[j] == 0 && j <= size)
+    while (j <= size && a[j] == 0)
         ++j;
     i = 0;
     while (j <= size)
diff --git a/deps/openssl/openssl/crypto/txt_db/txt_db.c b/deps/openssl/openssl/crypto/txt_db/txt_db.c
index f9b42ac6e5880c..ed02efc261834c 100644
--- a/deps/openssl/openssl/crypto/txt_db/txt_db.c
+++ b/deps/openssl/openssl/crypto/txt_db/txt_db.c
@@ -162,6 +162,7 @@ TXT_DB *TXT_DB_read(BIO *in, int num)
                     "wrong number of fields on line %ld (looking for field %d, got %d, '%s' left)\n",
                     ln, num, n, f);
 #endif
+            OPENSSL_free(pp);
             er = 2;
             goto err;
         }
@@ -171,6 +172,7 @@ TXT_DB *TXT_DB_read(BIO *in, int num)
                                                                * fix :-( */
             fprintf(stderr, "failure in sk_push\n");
 #endif
+            OPENSSL_free(pp);
             er = 2;
             goto err;
         }
@@ -222,7 +224,7 @@ int TXT_DB_create_index(TXT_DB *db, int field, int (*qual) (OPENSSL_STRING *),
                         LHASH_HASH_FN_TYPE hash, LHASH_COMP_FN_TYPE cmp)
 {
     LHASH_OF(OPENSSL_STRING) *idx;
-    OPENSSL_STRING *r;
+    OPENSSL_STRING *r, *k;
     int i, n;
 
     if (field >= db->num_fields) {
@@ -239,13 +241,18 @@ int TXT_DB_create_index(TXT_DB *db, int field, int (*qual) (OPENSSL_STRING *),
         r = sk_OPENSSL_PSTRING_value(db->data, i);
         if ((qual != NULL) && (qual(r) == 0))
             continue;
-        if ((r = lh_OPENSSL_STRING_insert(idx, r)) != NULL) {
+        if ((k = lh_OPENSSL_STRING_insert(idx, r)) != NULL) {
             db->error = DB_ERROR_INDEX_CLASH;
-            db->arg1 = sk_OPENSSL_PSTRING_find(db->data, r);
+            db->arg1 = sk_OPENSSL_PSTRING_find(db->data, k);
             db->arg2 = i;
             lh_OPENSSL_STRING_free(idx);
             return (0);
         }
+        if (lh_OPENSSL_STRING_retrieve(idx, r) == NULL) {
+            db->error = DB_ERROR_MALLOC;
+            lh_OPENSSL_STRING_free(idx);
+            return (0);
+        }
     }
     if (db->index[field] != NULL)
         lh_OPENSSL_STRING_free(db->index[field]);
@@ -320,20 +327,29 @@ int TXT_DB_insert(TXT_DB *db, OPENSSL_STRING *row)
             }
         }
     }
-    /* We have passed the index checks, now just append and insert */
-    if (!sk_OPENSSL_PSTRING_push(db->data, row)) {
-        db->error = DB_ERROR_MALLOC;
-        goto err;
-    }
 
     for (i = 0; i < db->num_fields; i++) {
         if (db->index[i] != NULL) {
             if ((db->qual[i] != NULL) && (db->qual[i] (row) == 0))
                 continue;
             (void)lh_OPENSSL_STRING_insert(db->index[i], row);
+            if (lh_OPENSSL_STRING_retrieve(db->index[i], row) == NULL)
+                goto err1;
         }
     }
+    if (!sk_OPENSSL_PSTRING_push(db->data, row))
+        goto err1;
     return (1);
+
+ err1:
+    db->error = DB_ERROR_MALLOC;
+    while (i-- > 0) {
+        if (db->index[i] != NULL) {
+            if ((db->qual[i] != NULL) && (db->qual[i] (row) == 0))
+                continue;
+            (void)lh_OPENSSL_STRING_delete(db->index[i], row);
+        }
+    }
  err:
     return (0);
 }
diff --git a/deps/openssl/openssl/crypto/ui/ui_lib.c b/deps/openssl/openssl/crypto/ui/ui_lib.c
index 3cc067c3b7ee80..643ae593439aeb 100644
--- a/deps/openssl/openssl/crypto/ui/ui_lib.c
+++ b/deps/openssl/openssl/crypto/ui/ui_lib.c
@@ -747,7 +747,6 @@ const char *UI_get0_action_string(UI_STRING *uis)
     if (!uis)
         return NULL;
     switch (uis->type) {
-    case UIT_PROMPT:
     case UIT_BOOLEAN:
         return uis->_.boolean_data.action_desc;
     default:
diff --git a/deps/openssl/openssl/crypto/x509/x509_lu.c b/deps/openssl/openssl/crypto/x509/x509_lu.c
index 50120a4d70c645..b7424809fdbb2e 100644
--- a/deps/openssl/openssl/crypto/x509/x509_lu.c
+++ b/deps/openssl/openssl/crypto/x509/x509_lu.c
@@ -185,14 +185,16 @@ X509_STORE *X509_STORE_new(void)
 
     if ((ret = (X509_STORE *)OPENSSL_malloc(sizeof(X509_STORE))) == NULL)
         return NULL;
-    ret->objs = sk_X509_OBJECT_new(x509_object_cmp);
+    if ((ret->objs = sk_X509_OBJECT_new(x509_object_cmp)) == NULL)
+        goto err0;
     ret->cache = 1;
-    ret->get_cert_methods = sk_X509_LOOKUP_new_null();
+    if ((ret->get_cert_methods = sk_X509_LOOKUP_new_null()) == NULL)
+        goto err1;
     ret->verify = 0;
     ret->verify_cb = 0;
 
     if ((ret->param = X509_VERIFY_PARAM_new()) == NULL)
-        return NULL;
+        goto err2;
 
     ret->get_issuer = 0;
     ret->check_issued = 0;
@@ -204,14 +206,21 @@ X509_STORE *X509_STORE_new(void)
     ret->lookup_crls = 0;
     ret->cleanup = 0;
 
-    if (!CRYPTO_new_ex_data(CRYPTO_EX_INDEX_X509_STORE, ret, &ret->ex_data)) {
-        sk_X509_OBJECT_free(ret->objs);
-        OPENSSL_free(ret);
-        return NULL;
-    }
+    if (!CRYPTO_new_ex_data(CRYPTO_EX_INDEX_X509_STORE, ret, &ret->ex_data))
+       goto err3;
 
     ret->references = 1;
     return ret;
+
+ err3:
+    X509_VERIFY_PARAM_free(ret->param);
+ err2:
+    sk_X509_LOOKUP_free(ret->get_cert_methods);
+ err1:
+    sk_X509_OBJECT_free(ret->objs);
+ err0:
+    OPENSSL_free(ret);
+    return NULL;
 }
 
 static void cleanup(X509_OBJECT *a)
@@ -360,8 +369,12 @@ int X509_STORE_add_cert(X509_STORE *ctx, X509 *x)
         X509err(X509_F_X509_STORE_ADD_CERT,
                 X509_R_CERT_ALREADY_IN_HASH_TABLE);
         ret = 0;
-    } else
-        sk_X509_OBJECT_push(ctx->objs, obj);
+    } else if (!sk_X509_OBJECT_push(ctx->objs, obj)) {
+        X509_OBJECT_free_contents(obj);
+        OPENSSL_free(obj);
+        X509err(X509_F_X509_STORE_ADD_CERT, ERR_R_MALLOC_FAILURE);
+        ret = 0;
+    }
 
     CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
 
@@ -392,8 +405,12 @@ int X509_STORE_add_crl(X509_STORE *ctx, X509_CRL *x)
         OPENSSL_free(obj);
         X509err(X509_F_X509_STORE_ADD_CRL, X509_R_CERT_ALREADY_IN_HASH_TABLE);
         ret = 0;
-    } else
-        sk_X509_OBJECT_push(ctx->objs, obj);
+    } else if (!sk_X509_OBJECT_push(ctx->objs, obj)) {
+        X509_OBJECT_free_contents(obj);
+        OPENSSL_free(obj);
+        X509err(X509_F_X509_STORE_ADD_CRL, ERR_R_MALLOC_FAILURE);
+        ret = 0;
+    }
 
     CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
 
diff --git a/deps/openssl/openssl/crypto/x509v3/v3_alt.c b/deps/openssl/openssl/crypto/x509v3/v3_alt.c
index 7f1e71dd1a4292..a0351faf11192f 100644
--- a/deps/openssl/openssl/crypto/x509v3/v3_alt.c
+++ b/deps/openssl/openssl/crypto/x509v3/v3_alt.c
@@ -119,32 +119,39 @@ STACK_OF(CONF_VALUE) *i2v_GENERAL_NAME(X509V3_EXT_METHOD *method,
     int i;
     switch (gen->type) {
     case GEN_OTHERNAME:
-        X509V3_add_value("othername", "<unsupported>", &ret);
+        if (!X509V3_add_value("othername", "<unsupported>", &ret))
+            return NULL;
         break;
 
     case GEN_X400:
-        X509V3_add_value("X400Name", "<unsupported>", &ret);
+        if (!X509V3_add_value("X400Name", "<unsupported>", &ret))
+            return NULL;
         break;
 
     case GEN_EDIPARTY:
-        X509V3_add_value("EdiPartyName", "<unsupported>", &ret);
+        if (!X509V3_add_value("EdiPartyName", "<unsupported>", &ret))
+            return NULL;
         break;
 
     case GEN_EMAIL:
-        X509V3_add_value_uchar("email", gen->d.ia5->data, &ret);
+        if (!X509V3_add_value_uchar("email", gen->d.ia5->data, &ret))
+            return NULL;
         break;
 
     case GEN_DNS:
-        X509V3_add_value_uchar("DNS", gen->d.ia5->data, &ret);
+        if (!X509V3_add_value_uchar("DNS", gen->d.ia5->data, &ret))
+            return NULL;
         break;
 
     case GEN_URI:
-        X509V3_add_value_uchar("URI", gen->d.ia5->data, &ret);
+        if (!X509V3_add_value_uchar("URI", gen->d.ia5->data, &ret))
+            return NULL;
         break;
 
     case GEN_DIRNAME:
-        X509_NAME_oneline(gen->d.dirn, oline, 256);
-        X509V3_add_value("DirName", oline, &ret);
+        if (X509_NAME_oneline(gen->d.dirn, oline, 256) == NULL
+                || !X509V3_add_value("DirName", oline, &ret))
+            return NULL;
         break;
 
     case GEN_IPADD:
@@ -162,15 +169,18 @@ STACK_OF(CONF_VALUE) *i2v_GENERAL_NAME(X509V3_EXT_METHOD *method,
                     strcat(oline, ":");
             }
         } else {
-            X509V3_add_value("IP Address", "<invalid>", &ret);
+            if (!X509V3_add_value("IP Address", "<invalid>", &ret))
+                return NULL;
             break;
         }
-        X509V3_add_value("IP Address", oline, &ret);
+        if (!X509V3_add_value("IP Address", oline, &ret))
+            return NULL;
         break;
 
     case GEN_RID:
         i2t_ASN1_OBJECT(oline, 256, gen->d.rid);
-        X509V3_add_value("Registered ID", oline, &ret);
+        if (!X509V3_add_value("Registered ID", oline, &ret))
+            return NULL;
         break;
     }
     return ret;
diff --git a/deps/openssl/openssl/crypto/x509v3/v3_cpols.c b/deps/openssl/openssl/crypto/x509v3/v3_cpols.c
index d97f6226b9ee01..b99269e7f839a5 100644
--- a/deps/openssl/openssl/crypto/x509v3/v3_cpols.c
+++ b/deps/openssl/openssl/crypto/x509v3/v3_cpols.c
@@ -390,10 +390,10 @@ static int nref_nos(STACK_OF(ASN1_INTEGER) *nnums, STACK_OF(CONF_VALUE) *nos)
     return 1;
 
  merr:
+    ASN1_INTEGER_free(aint);
     X509V3err(X509V3_F_NREF_NOS, ERR_R_MALLOC_FAILURE);
 
  err:
-    sk_ASN1_INTEGER_pop_free(nnums, ASN1_STRING_free);
     return 0;
 }
 
@@ -458,9 +458,15 @@ static void print_notice(BIO *out, USERNOTICE *notice, int indent)
             num = sk_ASN1_INTEGER_value(ref->noticenos, i);
             if (i)
                 BIO_puts(out, ", ");
-            tmp = i2s_ASN1_INTEGER(NULL, num);
-            BIO_puts(out, tmp);
-            OPENSSL_free(tmp);
+            if (num == NULL)
+                BIO_puts(out, "(null)");
+            else {
+                tmp = i2s_ASN1_INTEGER(NULL, num);
+                if (tmp == NULL)
+                    return;
+                BIO_puts(out, tmp);
+                OPENSSL_free(tmp);
+            }
         }
         BIO_puts(out, "\n");
     }
diff --git a/deps/openssl/openssl/crypto/x509v3/v3_info.c b/deps/openssl/openssl/crypto/x509v3/v3_info.c
index e052a34b940a30..7064c725d98dba 100644
--- a/deps/openssl/openssl/crypto/x509v3/v3_info.c
+++ b/deps/openssl/openssl/crypto/x509v3/v3_info.c
@@ -107,29 +107,30 @@ ASN1_ITEM_TEMPLATE_END(AUTHORITY_INFO_ACCESS)
 
 IMPLEMENT_ASN1_FUNCTIONS(AUTHORITY_INFO_ACCESS)
 
-static STACK_OF(CONF_VALUE) *i2v_AUTHORITY_INFO_ACCESS(X509V3_EXT_METHOD
-                                                       *method, AUTHORITY_INFO_ACCESS
-                                                       *ainfo, STACK_OF(CONF_VALUE)
-                                                       *ret)
+static STACK_OF(CONF_VALUE) *i2v_AUTHORITY_INFO_ACCESS(
+    X509V3_EXT_METHOD *method, AUTHORITY_INFO_ACCESS *ainfo,
+    STACK_OF(CONF_VALUE) *ret)
 {
     ACCESS_DESCRIPTION *desc;
     int i, nlen;
     char objtmp[80], *ntmp;
     CONF_VALUE *vtmp;
+    STACK_OF(CONF_VALUE) *tret = ret;
+
     for (i = 0; i < sk_ACCESS_DESCRIPTION_num(ainfo); i++) {
+        STACK_OF(CONF_VALUE) *tmp;
+
         desc = sk_ACCESS_DESCRIPTION_value(ainfo, i);
-        ret = i2v_GENERAL_NAME(method, desc->location, ret);
-        if (!ret)
-            break;
-        vtmp = sk_CONF_VALUE_value(ret, i);
+        tmp = i2v_GENERAL_NAME(method, desc->location, tret);
+        if (tmp == NULL)
+            goto err;
+        tret = tmp;
+        vtmp = sk_CONF_VALUE_value(tret, i);
         i2t_ASN1_OBJECT(objtmp, sizeof objtmp, desc->method);
         nlen = strlen(objtmp) + strlen(vtmp->name) + 5;
         ntmp = OPENSSL_malloc(nlen);
-        if (!ntmp) {
-            X509V3err(X509V3_F_I2V_AUTHORITY_INFO_ACCESS,
-                      ERR_R_MALLOC_FAILURE);
-            return NULL;
-        }
+        if (ntmp == NULL)
+            goto err;
         BUF_strlcpy(ntmp, objtmp, nlen);
         BUF_strlcat(ntmp, " - ", nlen);
         BUF_strlcat(ntmp, vtmp->name, nlen);
@@ -137,9 +138,15 @@ static STACK_OF(CONF_VALUE) *i2v_AUTHORITY_INFO_ACCESS(X509V3_EXT_METHOD
         vtmp->name = ntmp;
 
     }
-    if (!ret)
+    if (ret == NULL && tret == NULL)
         return sk_CONF_VALUE_new_null();
-    return ret;
+
+    return tret;
+ err:
+    X509V3err(X509V3_F_I2V_AUTHORITY_INFO_ACCESS, ERR_R_MALLOC_FAILURE);
+    if (ret == NULL && tret != NULL)
+        sk_CONF_VALUE_pop_free(tret, X509V3_conf_free);
+    return NULL;
 }
 
 static AUTHORITY_INFO_ACCESS *v2i_AUTHORITY_INFO_ACCESS(X509V3_EXT_METHOD
diff --git a/deps/openssl/openssl/crypto/x509v3/v3_purp.c b/deps/openssl/openssl/crypto/x509v3/v3_purp.c
index 845be673b79998..96e629a9301f62 100644
--- a/deps/openssl/openssl/crypto/x509v3/v3_purp.c
+++ b/deps/openssl/openssl/crypto/x509v3/v3_purp.c
@@ -321,6 +321,7 @@ int X509_supported_extension(X509_EXTENSION *ex)
         NID_subject_alt_name,   /* 85 */
         NID_basic_constraints,  /* 87 */
         NID_certificate_policies, /* 89 */
+        NID_crl_distribution_points, /* 103 */
         NID_ext_key_usage,      /* 126 */
 #ifndef OPENSSL_NO_RFC3779
         NID_sbgp_ipAddrBlock,   /* 290 */
diff --git a/deps/openssl/openssl/crypto/x86_64cpuid.pl b/deps/openssl/openssl/crypto/x86_64cpuid.pl
index d208d02392e9d2..a3d6f438f91e7b 100644
--- a/deps/openssl/openssl/crypto/x86_64cpuid.pl
+++ b/deps/openssl/openssl/crypto/x86_64cpuid.pl
@@ -59,7 +59,7 @@
 	mov	%rbx,%r8		# save %rbx
 
 	xor	%eax,%eax
-	mov	%eax,8(%rdi)		# clear 3rd word
+	mov	%eax,8(%rdi)		# clear extended feature flags
 	cpuid
 	mov	%eax,%r11d		# max value for standard query level
 
@@ -127,14 +127,6 @@
 	shr	\$14,%r10d
 	and	\$0xfff,%r10d		# number of cores -1 per L1D
 
-	cmp	\$7,%r11d
-	jb	.Lnocacheinfo
-
-	mov	\$7,%eax
-	xor	%ecx,%ecx
-	cpuid
-	mov	%ebx,8(%rdi)
-
 .Lnocacheinfo:
 	mov	\$1,%eax
 	cpuid
@@ -164,6 +156,15 @@
 	or	%ecx,%r9d		# merge AMD XOP flag
 
 	mov	%edx,%r10d		# %r9d:%r10d is copy of %ecx:%edx
+
+	cmp	\$7,%r11d
+	jb	.Lno_extended_info
+	mov	\$7,%eax
+	xor	%ecx,%ecx
+	cpuid
+	mov	%ebx,8(%rdi)		# save extended feature flags
+.Lno_extended_info:
+
 	bt	\$27,%r9d		# check OSXSAVE bit
 	jnc	.Lclear_avx
 	xor	%ecx,%ecx		# XCR0
diff --git a/deps/openssl/openssl/crypto/x86cpuid.pl b/deps/openssl/openssl/crypto/x86cpuid.pl
index e95f6274f5e063..90ed196c09cd15 100644
--- a/deps/openssl/openssl/crypto/x86cpuid.pl
+++ b/deps/openssl/openssl/crypto/x86cpuid.pl
@@ -20,10 +20,10 @@
 	&pop	("eax");
 	&xor	("ecx","eax");
 	&xor	("eax","eax");
+	&mov	("esi",&wparam(0));
+	&mov	(&DWP(8,"esi"),"eax");	# clear extended feature flags
 	&bt	("ecx",21);
 	&jnc	(&label("nocpuid"));
-	&mov	("esi",&wparam(0));
-	&mov	(&DWP(8,"esi"),"eax");	# clear 3rd word
 	&cpuid	();
 	&mov	("edi","eax");		# max value for standard query level
 
@@ -81,26 +81,16 @@
 	&jmp	(&label("generic"));
 	
 &set_label("intel");
-	&cmp	("edi",7);
-	&jb	(&label("cacheinfo"));
-
-	&mov	("esi",&wparam(0));
-	&mov	("eax",7);
-	&xor	("ecx","ecx");
-	&cpuid	();
-	&mov	(&DWP(8,"esi"),"ebx");
-
-&set_label("cacheinfo");
 	&cmp	("edi",4);
-	&mov	("edi",-1);
+	&mov	("esi",-1);
 	&jb	(&label("nocacheinfo"));
 
 	&mov	("eax",4);
 	&mov	("ecx",0);		# query L1D
 	&cpuid	();
-	&mov	("edi","eax");
-	&shr	("edi",14);
-	&and	("edi",0xfff);		# number of cores -1 per L1D
+	&mov	("esi","eax");
+	&shr	("esi",14);
+	&and	("esi",0xfff);		# number of cores -1 per L1D
 
 &set_label("nocacheinfo");
 	&mov	("eax",1);
@@ -118,7 +108,7 @@
 	&bt	("edx",28);		# test hyper-threading bit
 	&jnc	(&label("generic"));
 	&and	("edx",0xefffffff);
-	&cmp	("edi",0);
+	&cmp	("esi",0);
 	&je	(&label("generic"));
 
 	&or	("edx",0x10000000);
@@ -130,10 +120,19 @@
 &set_label("generic");
 	&and	("ebp",1<<11);		# isolate AMD XOP flag
 	&and	("ecx",0xfffff7ff);	# force 11th bit to 0
-	&mov	("esi","edx");
+	&mov	("esi","edx");		# %ebp:%esi is copy of %ecx:%edx
 	&or	("ebp","ecx");		# merge AMD XOP flag
 
-	&bt	("ecx",27);		# check OSXSAVE bit
+	&cmp	("edi",7);
+	&mov	("edi",&wparam(0));
+	&jb	(&label("no_extended_info"));
+	&mov	("eax",7);
+	&xor	("ecx","ecx");
+	&cpuid	();
+	&mov	(&DWP(8,"edi"),"ebx");	# save extended feature flag
+&set_label("no_extended_info");
+
+	&bt	("ebp",27);		# check OSXSAVE bit
 	&jnc	(&label("clear_avx"));
 	&xor	("ecx","ecx");
 	&data_byte(0x0f,0x01,0xd0);	# xgetbv
@@ -147,7 +146,6 @@
 	&and	("esi",0xfeffffff);	# clear FXSR
 &set_label("clear_avx");
 	&and	("ebp",0xefffe7ff);	# clear AVX, FMA and AMD XOP bits
-	&mov	("edi",&wparam(0));
 	&and	(&DWP(8,"edi"),0xffffffdf);	# clear AVX2
 &set_label("done");
 	&mov	("eax","esi");
diff --git a/deps/openssl/openssl/doc-nits b/deps/openssl/openssl/doc-nits
new file mode 100644
index 00000000000000..e69de29bb2d1d6
diff --git a/deps/openssl/openssl/doc/apps/ciphers.pod b/deps/openssl/openssl/doc/apps/ciphers.pod
index 9224557255ed67..35d40bbf27aeff 100644
--- a/deps/openssl/openssl/doc/apps/ciphers.pod
+++ b/deps/openssl/openssl/doc/apps/ciphers.pod
@@ -179,7 +179,8 @@ When in doubt, include B<!aNULL> in your cipherlist.
 
 =item B<kRSA>, B<RSA>
 
-cipher suites using RSA key exchange.
+cipher suites using RSA key exchange or authentication. B<RSA> is an alias for
+B<kRSA>.
 
 =item B<kDHr>, B<kDHd>, B<kDH>
 
diff --git a/deps/openssl/openssl/doc/apps/config.pod b/deps/openssl/openssl/doc/apps/config.pod
index e12591528c0cd8..3f607d3b5fc84f 100644
--- a/deps/openssl/openssl/doc/apps/config.pod
+++ b/deps/openssl/openssl/doc/apps/config.pod
@@ -47,7 +47,8 @@ or B<${section::name}>. By using the form B<$ENV::name> environment
 variables can be substituted. It is also possible to assign values to
 environment variables by using the name B<ENV::name>, this will work
 if the program looks up environment variables using the B<CONF> library
-instead of calling B<getenv()> directly.
+instead of calling B<getenv()> directly. The value string must not exceed 64k in
+length after variable expansion. Otherwise an error will occur.
 
 It is possible to escape certain characters by using any kind of quote
 or the B<\> character. By making the last character of a line a B<\>
diff --git a/deps/openssl/openssl/doc/apps/genrsa.pod b/deps/openssl/openssl/doc/apps/genrsa.pod
index 3dc9870f34b96a..f4ed9593ae2695 100644
--- a/deps/openssl/openssl/doc/apps/genrsa.pod
+++ b/deps/openssl/openssl/doc/apps/genrsa.pod
@@ -7,11 +7,15 @@ genrsa - generate an RSA private key
 =head1 SYNOPSIS
 
 B<openssl> B<genrsa>
+[B<-help>]
 [B<-out filename>]
 [B<-passout arg>]
 [B<-aes128>]
 [B<-aes192>]
 [B<-aes256>]
+[B<-aria128>]
+[B<-aria192>]
+[B<-aria256>]
 [B<-camellia128>]
 [B<-camellia192>]
 [B<-camellia256>]
@@ -32,17 +36,21 @@ The B<genrsa> command generates an RSA private key.
 
 =over 4
 
+=item B<-help>
+
+Print out a usage message.
+
 =item B<-out filename>
 
-the output filename. If this argument is not specified then standard output is
-used.  
+Output the key to the specified file. If this argument is not specified then
+standard output is used.
 
 =item B<-passout arg>
 
 the output file password source. For more information about the format of B<arg>
-see the B<PASS PHRASE ARGUMENTS> section in L<openssl(1)|openssl(1)>.
+see the B<PASS PHRASE ARGUMENTS> section in L<openssl(1)>.
 
-=item B<-aes128|-aes192|-aes256|-camellia128|-camellia192|-camellia256|-des|-des3|-idea>
+=item B<-aes128|-aes192|-aes256|-aria128|-aria192|-aria256|-camellia128|-camellia192|-camellia256|-des|-des3|-idea>
 
 These options encrypt the private key with specified
 cipher before outputting it. If none of these options is
@@ -56,8 +64,8 @@ the public exponent to use, either 65537 or 3. The default is 65537.
 =item B<-rand file(s)>
 
 a file or files containing random data used to seed the random number
-generator, or an EGD socket (see L<RAND_egd(3)|RAND_egd(3)>).
-Multiple files can be specified separated by a OS-dependent character.
+generator, or an EGD socket (see L<RAND_egd(3)>).
+Multiple files can be specified separated by an OS-dependent character.
 The separator is B<;> for MS-Windows, B<,> for OpenVMS, and B<:> for
 all others.
 
@@ -71,7 +79,7 @@ for all available algorithms.
 =item B<numbits>
 
 the size of the private key to generate in bits. This must be the last option
-specified. The default is 512.
+specified. The default is 2048.
 
 =back
 
@@ -96,7 +104,15 @@ be much larger (typically 1024 bits).
 
 =head1 SEE ALSO
 
-L<gendsa(1)|gendsa(1)>
+L<gendsa(1)>
 
-=cut
+=head1 COPYRIGHT
 
+Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.
+
+Licensed under the OpenSSL license (the "License").  You may not use
+this file except in compliance with the License.  You can obtain a copy
+in the file LICENSE in the source distribution or at
+L<https://www.openssl.org/source/license.html>.
+
+=cut
diff --git a/deps/openssl/openssl/doc/apps/req.pod b/deps/openssl/openssl/doc/apps/req.pod
index 30653e50935777..1682ba5143dd02 100644
--- a/deps/openssl/openssl/doc/apps/req.pod
+++ b/deps/openssl/openssl/doc/apps/req.pod
@@ -237,6 +237,9 @@ a self signed root CA. The extensions added to the certificate
 using the B<set_serial> option, a large random number will be used for
 the serial number.
 
+If existing request is specified with the B<-in> option, it is converted
+to the self signed certificate otherwise new request is created.
+
 =item B<-days n>
 
 when the B<-x509> option is being used this specifies the number of
diff --git a/deps/openssl/openssl/doc/apps/s_client.pod b/deps/openssl/openssl/doc/apps/s_client.pod
index 29675dd213f451..b45acbc5e3e42f 100644
--- a/deps/openssl/openssl/doc/apps/s_client.pod
+++ b/deps/openssl/openssl/doc/apps/s_client.pod
@@ -42,6 +42,8 @@ B<openssl> B<s_client>
 [B<-no_tls1_2>]
 [B<-fallback_scsv>]
 [B<-bugs>]
+[B<-sigalgs sigalglist>]
+[B<-curves curvelist>]
 [B<-cipher cipherlist>]
 [B<-serverpref>]
 [B<-starttls protocol>]
@@ -217,6 +219,19 @@ Send TLS_FALLBACK_SCSV in the ClientHello.
 there are several known bug in SSL and TLS implementations. Adding this
 option enables various workarounds.
 
+=item B<-sigalgs sigalglist>
+
+Specifies the list of signature algorithms that are sent by the client.
+The server selects one entry in the list based on its preferences.
+For example strings, see L<SSL_CTX_set1_sigalgs(3)>
+
+=item B<-curves curvelist>
+
+Specifies the list of supported curves to be sent by the client. The curve is
+is ultimately selected by the server. For a list of all curves, use:
+
+    $ openssl ecparam -list_curves
+
 =item B<-cipher cipherlist>
 
 this allows the cipher list sent by the client to be modified. Although
diff --git a/deps/openssl/openssl/doc/apps/s_server.pod b/deps/openssl/openssl/doc/apps/s_server.pod
index fa17488d917359..1fe93ddfbebb0b 100644
--- a/deps/openssl/openssl/doc/apps/s_server.pod
+++ b/deps/openssl/openssl/doc/apps/s_server.pod
@@ -35,6 +35,8 @@ B<openssl> B<s_server>
 [B<-CAfile filename>]
 [B<-no_alt_chains>]
 [B<-nocert>]
+[B<-client_sigalgs sigalglist>]
+[B<-named_curve curve>]
 [B<-cipher cipherlist>]
 [B<-serverpref>]
 [B<-quiet>]
@@ -234,6 +236,18 @@ option enables various workarounds.
 this option enables a further workaround for some some early Netscape
 SSL code (?).
 
+=item B<-client_sigalgs sigalglist>
+
+Signature algorithms to support for client certificate authentication
+(colon-separated list)
+
+=item B<-named_curve curve>
+
+Specifies the elliptic curve to use. NOTE: this is single curve, not a list.
+For a list of all possible curves, use:
+
+    $ openssl ecparam -list_curves
+
 =item B<-cipher cipherlist>
 
 this allows the cipher list used by the server to be modified.  When
diff --git a/deps/openssl/openssl/doc/crypto/EVP_EncryptInit.pod b/deps/openssl/openssl/doc/crypto/EVP_EncryptInit.pod
index d9513338d8aacb..0c0a30c1ffa048 100644
--- a/deps/openssl/openssl/doc/crypto/EVP_EncryptInit.pod
+++ b/deps/openssl/openssl/doc/crypto/EVP_EncryptInit.pod
@@ -19,14 +19,17 @@ EVP_CIPHER_CTX_mode, EVP_CIPHER_param_to_asn1, EVP_CIPHER_asn1_to_param,
 EVP_CIPHER_CTX_set_padding,  EVP_enc_null, EVP_des_cbc, EVP_des_ecb,
 EVP_des_cfb, EVP_des_ofb, EVP_des_ede_cbc, EVP_des_ede, EVP_des_ede_ofb,
 EVP_des_ede_cfb, EVP_des_ede3_cbc, EVP_des_ede3, EVP_des_ede3_ofb,
-EVP_des_ede3_cfb, EVP_desx_cbc, EVP_rc4, EVP_rc4_40, EVP_idea_cbc,
-EVP_idea_ecb, EVP_idea_cfb, EVP_idea_ofb, EVP_idea_cbc, EVP_rc2_cbc,
+EVP_des_ede3_cfb, EVP_desx_cbc, EVP_rc4, EVP_rc4_40, EVP_rc4_hmac_md5,
+EVP_idea_cbc, EVP_idea_ecb, EVP_idea_cfb, EVP_idea_ofb, EVP_rc2_cbc,
 EVP_rc2_ecb, EVP_rc2_cfb, EVP_rc2_ofb, EVP_rc2_40_cbc, EVP_rc2_64_cbc,
 EVP_bf_cbc, EVP_bf_ecb, EVP_bf_cfb, EVP_bf_ofb, EVP_cast5_cbc,
 EVP_cast5_ecb, EVP_cast5_cfb, EVP_cast5_ofb, EVP_rc5_32_12_16_cbc,
 EVP_rc5_32_12_16_ecb, EVP_rc5_32_12_16_cfb, EVP_rc5_32_12_16_ofb, 
 EVP_aes_128_gcm, EVP_aes_192_gcm, EVP_aes_256_gcm, EVP_aes_128_ccm,
-EVP_aes_192_ccm, EVP_aes_256_ccm - EVP cipher routines
+EVP_aes_192_ccm, EVP_aes_256_ccm,
+EVP_aes_128_cbc_hmac_sha1, EVP_aes_256_cbc_hmac_sha1,
+EVP_aes_128_cbc_hmac_sha256, EVP_aes_256_cbc_hmac_sha256
+- EVP cipher routines
 
 =head1 SYNOPSIS
 
@@ -395,8 +398,6 @@ Sets the expected tag to B<taglen> bytes from B<tag>. This call is only legal
 when decrypting data and must be made B<before> any data is processed (e.g.
 before any EVP_DecryptUpdate() call). 
 
-See L<EXAMPLES> below for an example of the use of GCM mode.
-
 =head1 CCM Mode
 
 The behaviour of CCM mode ciphers is similar to CCM mode but with a few
diff --git a/deps/openssl/openssl/doc/crypto/RSA_private_encrypt.pod b/deps/openssl/openssl/doc/crypto/RSA_private_encrypt.pod
index 746a80c79ea0c8..3e1f895c5ad8c1 100644
--- a/deps/openssl/openssl/doc/crypto/RSA_private_encrypt.pod
+++ b/deps/openssl/openssl/doc/crypto/RSA_private_encrypt.pod
@@ -8,10 +8,10 @@ RSA_private_encrypt, RSA_public_decrypt - low level signature operations
 
  #include <openssl/rsa.h>
 
- int RSA_private_encrypt(int flen, unsigned char *from,
+ int RSA_private_encrypt(int flen, const unsigned char *from,
     unsigned char *to, RSA *rsa, int padding);
 
- int RSA_public_decrypt(int flen, unsigned char *from, 
+ int RSA_public_decrypt(int flen, const unsigned char *from,
     unsigned char *to, RSA *rsa, int padding);
 
 =head1 DESCRIPTION
diff --git a/deps/openssl/openssl/doc/crypto/RSA_public_encrypt.pod b/deps/openssl/openssl/doc/crypto/RSA_public_encrypt.pod
index ab0fe3b2cd1c77..0541f348b3e20c 100644
--- a/deps/openssl/openssl/doc/crypto/RSA_public_encrypt.pod
+++ b/deps/openssl/openssl/doc/crypto/RSA_public_encrypt.pod
@@ -8,10 +8,10 @@ RSA_public_encrypt, RSA_private_decrypt - RSA public key cryptography
 
  #include <openssl/rsa.h>
 
- int RSA_public_encrypt(int flen, unsigned char *from,
+ int RSA_public_encrypt(int flen, const unsigned char *from,
     unsigned char *to, RSA *rsa, int padding);
 
- int RSA_private_decrypt(int flen, unsigned char *from,
+ int RSA_private_decrypt(int flen, const unsigned char *from,
      unsigned char *to, RSA *rsa, int padding);
 
 =head1 DESCRIPTION
diff --git a/deps/openssl/openssl/doc/crypto/X509_STORE_CTX_new.pod b/deps/openssl/openssl/doc/crypto/X509_STORE_CTX_new.pod
index eb38b0a1090512..1aee1172686385 100644
--- a/deps/openssl/openssl/doc/crypto/X509_STORE_CTX_new.pod
+++ b/deps/openssl/openssl/doc/crypto/X509_STORE_CTX_new.pod
@@ -41,7 +41,7 @@ is no longer valid.
 X509_STORE_CTX_init() sets up B<ctx> for a subsequent verification operation.
 It must be called before each call to X509_verify_cert(), i.e. a B<ctx> is only
 good for one call to X509_verify_cert(); if you want to verify a second
-certificate with the same B<ctx> then you must call X509_XTORE_CTX_cleanup()
+certificate with the same B<ctx> then you must call X509_STORE_CTX_cleanup()
 and then X509_STORE_CTX_init() again before the second call to
 X509_verify_cert(). The trusted certificate store is set to B<store>, the end
 entity certificate to be verified is set to B<x509> and a set of additional
diff --git a/deps/openssl/openssl/doc/crypto/des.pod b/deps/openssl/openssl/doc/crypto/des.pod
index e1add56b5e8139..339617aab02431 100644
--- a/deps/openssl/openssl/doc/crypto/des.pod
+++ b/deps/openssl/openssl/doc/crypto/des.pod
@@ -123,7 +123,7 @@ architecture dependent I<DES_key_schedule> via the
 DES_set_key_checked() or DES_set_key_unchecked() function.
 
 DES_set_key_checked() will check that the key passed is of odd parity
-and is not a week or semi-weak key.  If the parity is wrong, then -1
+and is not a weak or semi-weak key.  If the parity is wrong, then -1
 is returned.  If the key is a weak key, then -2 is returned.  If an
 error is returned, the key schedule is not generated.
 
diff --git a/deps/openssl/openssl/doc/man3/SSL_CTX_set_tlsext_servername_callback.pod b/deps/openssl/openssl/doc/man3/SSL_CTX_set_tlsext_servername_callback.pod
new file mode 100644
index 00000000000000..3b0a50956d9bc9
--- /dev/null
+++ b/deps/openssl/openssl/doc/man3/SSL_CTX_set_tlsext_servername_callback.pod
@@ -0,0 +1,62 @@
+=pod
+
+=head1 NAME
+
+SSL_CTX_set_tlsext_servername_callback, SSL_CTX_set_tlsext_servername_arg,
+SSL_get_servername_type, SSL_get_servername - handle server name indication
+(SNI)
+
+=head1 SYNOPSIS
+
+ #include <openssl/ssl.h>
+
+ long SSL_CTX_set_tlsext_servername_callback(SSL_CTX *ctx,
+                                   int (*cb)(SSL *, int *, void *));
+ long SSL_CTX_set_tlsext_servername_arg(SSL_CTX *ctx, void *arg);
+
+ const char *SSL_get_servername(const SSL *s, const int type);
+ int SSL_get_servername_type(const SSL *s);
+
+=head1 DESCRIPTION
+
+SSL_CTX_set_tlsext_servername_callback() sets the application callback B<cb>
+used by a server to perform any actions or configuration required based on
+the servername extension received in the incoming connection. When B<cb>
+is NULL, SNI is not used. The B<arg> value is a pointer which is passed to
+the application callback.
+
+SSL_CTX_set_tlsext_servername_arg() sets a context-specific argument to be
+passed into the callback for this B<SSL_CTX>.
+
+SSL_get_servername() returns a servername extension value of the specified
+type if provided in the Client Hello or NULL.
+
+SSL_get_servername_type() returns the servername type or -1 if no servername
+is present. Currently the only supported type (defined in RFC3546) is
+B<TLSEXT_NAMETYPE_host_name>.
+
+=head1 NOTES
+
+The ALPN and SNI callbacks are both executed during Client Hello processing.
+The servername callback is executed first, followed by the ALPN callback.
+
+=head1 RETURN VALUES
+
+SSL_CTX_set_tlsext_servername_callback() and
+SSL_CTX_set_tlsext_servername_arg() both always return 1 indicating success.
+
+=head1 SEE ALSO
+
+L<ssl(7)>, L<SSL_CTX_set_alpn_select_cb(3)>,
+L<SSL_get0_alpn_selected(3)>
+
+=head1 COPYRIGHT
+
+Copyright 2017 The OpenSSL Project Authors. All Rights Reserved.
+
+Licensed under the OpenSSL license (the "License").  You may not use
+this file except in compliance with the License.  You can obtain a copy
+in the file LICENSE in the source distribution or at
+L<https://www.openssl.org/source/license.html>.
+
+=cut
diff --git a/deps/openssl/openssl/include/openssl/conf.h b/deps/openssl/openssl/include/openssl/conf.h
index 8d926d5d8268f5..fe49113080b700 100644
--- a/deps/openssl/openssl/include/openssl/conf.h
+++ b/deps/openssl/openssl/include/openssl/conf.h
@@ -259,6 +259,7 @@ void ERR_load_CONF_strings(void);
 # define CONF_R_NO_VALUE                                  108
 # define CONF_R_UNABLE_TO_CREATE_NEW_SECTION              103
 # define CONF_R_UNKNOWN_MODULE_NAME                       113
+# define CONF_R_VARIABLE_EXPANSION_TOO_LONG               116
 # define CONF_R_VARIABLE_HAS_NO_VALUE                     104
 
 #ifdef  __cplusplus
diff --git a/deps/openssl/openssl/include/openssl/dh.h b/deps/openssl/openssl/include/openssl/dh.h
index a5bd9016aae85a..a228c7a7a4c3a1 100644
--- a/deps/openssl/openssl/include/openssl/dh.h
+++ b/deps/openssl/openssl/include/openssl/dh.h
@@ -182,12 +182,29 @@ struct dh_st {
  */
 # define DH_CHECK_P_NOT_STRONG_PRIME     DH_CHECK_P_NOT_SAFE_PRIME
 
-# define d2i_DHparams_fp(fp,x) (DH *)ASN1_d2i_fp((char *(*)())DH_new, \
-                (char *(*)())d2i_DHparams,(fp),(unsigned char **)(x))
-# define i2d_DHparams_fp(fp,x) ASN1_i2d_fp(i2d_DHparams,(fp), \
-                (unsigned char *)(x))
-# define d2i_DHparams_bio(bp,x) ASN1_d2i_bio_of(DH,DH_new,d2i_DHparams,bp,x)
-# define i2d_DHparams_bio(bp,x) ASN1_i2d_bio_of_const(DH,i2d_DHparams,bp,x)
+# define d2i_DHparams_fp(fp,x) \
+    (DH *)ASN1_d2i_fp((char *(*)())DH_new, \
+                      (char *(*)())d2i_DHparams, \
+                      (fp), \
+                      (unsigned char **)(x))
+# define i2d_DHparams_fp(fp,x) \
+    ASN1_i2d_fp(i2d_DHparams,(fp), (unsigned char *)(x))
+# define d2i_DHparams_bio(bp,x) \
+    ASN1_d2i_bio_of(DH, DH_new, d2i_DHparams, bp, x)
+# define i2d_DHparams_bio(bp,x) \
+    ASN1_i2d_bio_of_const(DH,i2d_DHparams,bp,x)
+
+# define d2i_DHxparams_fp(fp,x) \
+    (DH *)ASN1_d2i_fp((char *(*)())DH_new, \
+                      (char *(*)())d2i_DHxparams, \
+                      (fp), \
+                      (unsigned char **)(x))
+# define i2d_DHxparams_fp(fp,x) \
+    ASN1_i2d_fp(i2d_DHxparams,(fp), (unsigned char *)(x))
+# define d2i_DHxparams_bio(bp,x) \
+    ASN1_d2i_bio_of(DH, DH_new, d2i_DHxparams, bp, x)
+# define i2d_DHxparams_bio(bp,x) \
+    ASN1_i2d_bio_of_const(DH, i2d_DHxparams, bp, x)
 
 DH *DHparams_dup(DH *);
 
diff --git a/deps/openssl/openssl/include/openssl/err.h b/deps/openssl/openssl/include/openssl/err.h
index 585aa8ba3df935..f42365620db0c0 100644
--- a/deps/openssl/openssl/include/openssl/err.h
+++ b/deps/openssl/openssl/include/openssl/err.h
@@ -258,6 +258,7 @@ typedef struct err_state_st {
 # define SYS_F_WSASTARTUP        9/* Winsock stuff */
 # define SYS_F_OPENDIR           10
 # define SYS_F_FREAD             11
+# define SYS_F_FFLUSH            18
 
 /* reasons */
 # define ERR_R_SYS_LIB   ERR_LIB_SYS/* 2 */
diff --git a/deps/openssl/openssl/include/openssl/opensslv.h b/deps/openssl/openssl/include/openssl/opensslv.h
index 645dd0793f32e0..825a330abc8825 100644
--- a/deps/openssl/openssl/include/openssl/opensslv.h
+++ b/deps/openssl/openssl/include/openssl/opensslv.h
@@ -30,11 +30,11 @@ extern "C" {
  * (Prior to 0.9.5a beta1, a different scheme was used: MMNNFFRBB for
  *  major minor fix final patch/beta)
  */
-# define OPENSSL_VERSION_NUMBER  0x100020bfL
+# define OPENSSL_VERSION_NUMBER  0x100020cfL
 # ifdef OPENSSL_FIPS
-#  define OPENSSL_VERSION_TEXT    "OpenSSL 1.0.2k-fips  26 Jan 2017"
+#  define OPENSSL_VERSION_TEXT    "OpenSSL 1.0.2l-fips  25 May 2017"
 # else
-#  define OPENSSL_VERSION_TEXT    "OpenSSL 1.0.2k  26 Jan 2017"
+#  define OPENSSL_VERSION_TEXT    "OpenSSL 1.0.2l  25 May 2017"
 # endif
 # define OPENSSL_VERSION_PTEXT   " part of " OPENSSL_VERSION_TEXT
 
diff --git a/deps/openssl/openssl/openssl.spec b/deps/openssl/openssl/openssl.spec
index 7bbcdf69a4310f..add18a4b37c260 100644
--- a/deps/openssl/openssl/openssl.spec
+++ b/deps/openssl/openssl/openssl.spec
@@ -7,7 +7,7 @@ Release: 1
 
 Summary: Secure Sockets Layer and cryptography libraries and tools
 Name: openssl
-Version: 1.0.2k
+Version: 1.0.2l
 Source0: ftp://ftp.openssl.org/source/%{name}-%{version}.tar.gz
 License: OpenSSL
 Group: System Environment/Libraries
diff --git a/deps/openssl/openssl/ssl/d1_both.c b/deps/openssl/openssl/ssl/d1_both.c
index 9bc61536101b5c..e6bc761e8bf236 100644
--- a/deps/openssl/openssl/ssl/d1_both.c
+++ b/deps/openssl/openssl/ssl/d1_both.c
@@ -517,6 +517,17 @@ long dtls1_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok)
         return i;
     }
 
+    /*
+     * Don't change the *message* read sequence number while listening. For
+     * the *record* write sequence we reflect the ClientHello sequence number
+     * when listening.
+     */
+    if (s->d1->listen)
+        memcpy(s->s3->write_sequence, s->s3->read_sequence,
+               sizeof(s->s3->write_sequence));
+    else
+        s->d1->handshake_read_seq++;
+
     if (mt >= 0 && s->s3->tmp.message_type != mt) {
         al = SSL_AD_UNEXPECTED_MESSAGE;
         SSLerr(SSL_F_DTLS1_GET_MESSAGE, SSL_R_UNEXPECTED_MESSAGE);
@@ -544,10 +555,6 @@ long dtls1_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok)
 
     memset(msg_hdr, 0x00, sizeof(struct hm_header_st));
 
-    /* Don't change sequence numbers while listening */
-    if (!s->d1->listen)
-        s->d1->handshake_read_seq++;
-
     s->init_msg = s->init_buf->data + DTLS1_HM_HEADER_LENGTH;
     return s->init_num;
 
@@ -1068,7 +1075,9 @@ int dtls1_send_change_cipher_spec(SSL *s, int a, int b)
 int dtls1_read_failed(SSL *s, int code)
 {
     if (code > 0) {
+#ifdef TLS_DEBUG
         fprintf(stderr, "invalid state reached %s:%d", __FILE__, __LINE__);
+#endif
         return 1;
     }
 
@@ -1140,7 +1149,9 @@ int dtls1_retransmit_buffered_messages(SSL *s)
                                      (frag->msg_header.seq,
                                       frag->msg_header.is_ccs), 0,
                                      &found) <= 0 && found) {
+#ifdef TLS_DEBUG
             fprintf(stderr, "dtls1_retransmit_message() failed\n");
+#endif
             return -1;
         }
     }
@@ -1240,7 +1251,9 @@ dtls1_retransmit_message(SSL *s, unsigned short seq, unsigned long frag_off,
 
     item = pqueue_find(s->d1->sent_messages, seq64be);
     if (item == NULL) {
+#ifdef TLS_DEBUG
         fprintf(stderr, "retransmit:  message %d non-existant\n", seq);
+#endif
         *found = 0;
         return 0;
     }
diff --git a/deps/openssl/openssl/ssl/d1_clnt.c b/deps/openssl/openssl/ssl/d1_clnt.c
index 7e2f5c2830b512..76451a346d86b4 100644
--- a/deps/openssl/openssl/ssl/d1_clnt.c
+++ b/deps/openssl/openssl/ssl/d1_clnt.c
@@ -320,8 +320,13 @@ int dtls1_connect(SSL *s)
             s->shutdown = 0;
 
             /* every DTLS ClientHello resets Finished MAC */
-            ssl3_init_finished_mac(s);
+            if (!ssl3_init_finished_mac(s)) {
+                ret = -1;
+                s->state = SSL_ST_ERR;
+                goto end;
+            }
 
+            /* fall thru */
         case SSL3_ST_CW_CLNT_HELLO_B:
             dtls1_start_timer(s);
             ret = ssl3_client_hello(s);
diff --git a/deps/openssl/openssl/ssl/d1_pkt.c b/deps/openssl/openssl/ssl/d1_pkt.c
index 7a02459f2b7876..10586fee5408ea 100644
--- a/deps/openssl/openssl/ssl/d1_pkt.c
+++ b/deps/openssl/openssl/ssl/d1_pkt.c
@@ -1323,9 +1323,9 @@ int dtls1_read_bytes(SSL *s, int type, unsigned char *buf, int len, int peek)
         /* XDTLS: check that epoch is consistent */
         if ((rr->length != ccs_hdr_len) ||
             (rr->off != 0) || (rr->data[0] != SSL3_MT_CCS)) {
-            i = SSL_AD_ILLEGAL_PARAMETER;
+            al = SSL_AD_ILLEGAL_PARAMETER;
             SSLerr(SSL_F_DTLS1_READ_BYTES, SSL_R_BAD_CHANGE_CIPHER_SPEC);
-            goto err;
+            goto f_err;
         }
 
         rr->length = 0;
diff --git a/deps/openssl/openssl/ssl/d1_srvr.c b/deps/openssl/openssl/ssl/d1_srvr.c
index bc875b53c9a0d9..8502b242e51cd3 100644
--- a/deps/openssl/openssl/ssl/d1_srvr.c
+++ b/deps/openssl/openssl/ssl/d1_srvr.c
@@ -282,7 +282,12 @@ int dtls1_accept(SSL *s)
                         goto end;
                     }
 
-                ssl3_init_finished_mac(s);
+                if (!ssl3_init_finished_mac(s)) {
+                    ret = -1;
+                    s->state = SSL_ST_ERR;
+                    goto end;
+                }
+
                 s->state = SSL3_ST_SR_CLNT_HELLO_A;
                 s->ctx->stats.sess_accept++;
             } else if (!s->s3->send_connection_binding &&
@@ -322,7 +327,11 @@ int dtls1_accept(SSL *s)
             s->state = SSL3_ST_SW_FLUSH;
             s->init_num = 0;
 
-            ssl3_init_finished_mac(s);
+            if (!ssl3_init_finished_mac(s)) {
+                ret = -1;
+                s->state = SSL_ST_ERR;
+                goto end;
+            }
             break;
 
         case SSL3_ST_SW_HELLO_REQ_C:
@@ -346,15 +355,6 @@ int dtls1_accept(SSL *s)
 
             s->init_num = 0;
 
-            /*
-             * Reflect ClientHello sequence to remain stateless while
-             * listening
-             */
-            if (listen) {
-                memcpy(s->s3->write_sequence, s->s3->read_sequence,
-                       sizeof(s->s3->write_sequence));
-            }
-
             /* If we're just listening, stop here */
             if (listen && s->state == SSL3_ST_SW_SRVR_HELLO_A) {
                 ret = 2;
@@ -381,7 +381,11 @@ int dtls1_accept(SSL *s)
 
             /* HelloVerifyRequest resets Finished MAC */
             if (s->version != DTLS1_BAD_VER)
-                ssl3_init_finished_mac(s);
+                if (!ssl3_init_finished_mac(s)) {
+                    ret = -1;
+                    s->state = SSL_ST_ERR;
+                    goto end;
+                }
             break;
 
 #ifndef OPENSSL_NO_SCTP
diff --git a/deps/openssl/openssl/ssl/s23_clnt.c b/deps/openssl/openssl/ssl/s23_clnt.c
index 6850dc0c670444..b80d1fd8ce6e9d 100644
--- a/deps/openssl/openssl/ssl/s23_clnt.c
+++ b/deps/openssl/openssl/ssl/s23_clnt.c
@@ -204,7 +204,10 @@ int ssl23_connect(SSL *s)
                 goto end;
             }
 
-            ssl3_init_finished_mac(s);
+            if (!ssl3_init_finished_mac(s)) {
+                ret = -1;
+                goto end;
+            }
 
             s->state = SSL23_ST_CW_CLNT_HELLO_A;
             s->ctx->stats.sess_connect++;
diff --git a/deps/openssl/openssl/ssl/s23_srvr.c b/deps/openssl/openssl/ssl/s23_srvr.c
index 470bd3d94f29a4..d3f6db15cceee7 100644
--- a/deps/openssl/openssl/ssl/s23_srvr.c
+++ b/deps/openssl/openssl/ssl/s23_srvr.c
@@ -195,7 +195,10 @@ int ssl23_accept(SSL *s)
                 s->init_buf = buf;
             }
 
-            ssl3_init_finished_mac(s);
+            if (!ssl3_init_finished_mac(s)) {
+                ret = -1;
+                goto end;
+            }
 
             s->state = SSL23_ST_SR_CLNT_HELLO_A;
             s->ctx->stats.sess_accept++;
diff --git a/deps/openssl/openssl/ssl/s3_clnt.c b/deps/openssl/openssl/ssl/s3_clnt.c
index 32f2f1aeed2b19..5b8b2da59f544f 100644
--- a/deps/openssl/openssl/ssl/s3_clnt.c
+++ b/deps/openssl/openssl/ssl/s3_clnt.c
@@ -263,6 +263,7 @@ int ssl3_connect(SSL *s)
 
             if (!ssl3_setup_buffers(s)) {
                 ret = -1;
+                s->state = SSL_ST_ERR;
                 goto end;
             }
 
@@ -275,7 +276,11 @@ int ssl3_connect(SSL *s)
 
             /* don't push the buffering BIO quite yet */
 
-            ssl3_init_finished_mac(s);
+            if (!ssl3_init_finished_mac(s)) {
+                ret = -1;
+                s->state = SSL_ST_ERR;
+                goto end;
+            }
 
             s->state = SSL3_ST_CW_CLNT_HELLO_A;
             s->ctx->stats.sess_connect++;
@@ -1864,6 +1869,7 @@ int ssl3_get_key_exchange(SSL *s)
             goto err;
         }
         if (EC_KEY_set_group(ecdh, ngroup) == 0) {
+            EC_GROUP_free(ngroup);
             SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ERR_R_EC_LIB);
             goto err;
         }
diff --git a/deps/openssl/openssl/ssl/s3_enc.c b/deps/openssl/openssl/ssl/s3_enc.c
index fbc954d43c70c7..1eee9d9b21cf5c 100644
--- a/deps/openssl/openssl/ssl/s3_enc.c
+++ b/deps/openssl/openssl/ssl/s3_enc.c
@@ -177,32 +177,34 @@ static int ssl3_generate_key_block(SSL *s, unsigned char *km, int num)
     EVP_MD_CTX_init(&s1);
     for (i = 0; (int)i < num; i += MD5_DIGEST_LENGTH) {
         k++;
-        if (k > sizeof buf) {
+        if (k > sizeof(buf))
             /* bug: 'buf' is too small for this ciphersuite */
-            SSLerr(SSL_F_SSL3_GENERATE_KEY_BLOCK, ERR_R_INTERNAL_ERROR);
-            return 0;
-        }
+            goto err;
 
         for (j = 0; j < k; j++)
             buf[j] = c;
         c++;
-        EVP_DigestInit_ex(&s1, EVP_sha1(), NULL);
-        EVP_DigestUpdate(&s1, buf, k);
-        EVP_DigestUpdate(&s1, s->session->master_key,
-                         s->session->master_key_length);
-        EVP_DigestUpdate(&s1, s->s3->server_random, SSL3_RANDOM_SIZE);
-        EVP_DigestUpdate(&s1, s->s3->client_random, SSL3_RANDOM_SIZE);
-        EVP_DigestFinal_ex(&s1, smd, NULL);
-
-        EVP_DigestInit_ex(&m5, EVP_md5(), NULL);
-        EVP_DigestUpdate(&m5, s->session->master_key,
-                         s->session->master_key_length);
-        EVP_DigestUpdate(&m5, smd, SHA_DIGEST_LENGTH);
+        if (!EVP_DigestInit_ex(&s1, EVP_sha1(), NULL) ||
+            !EVP_DigestUpdate(&s1, buf, k) ||
+            !EVP_DigestUpdate(&s1, s->session->master_key,
+                              s->session->master_key_length) ||
+            !EVP_DigestUpdate(&s1, s->s3->server_random, SSL3_RANDOM_SIZE) ||
+            !EVP_DigestUpdate(&s1, s->s3->client_random, SSL3_RANDOM_SIZE) ||
+            !EVP_DigestFinal_ex(&s1, smd, NULL))
+            goto err2;
+
+        if (!EVP_DigestInit_ex(&m5, EVP_md5(), NULL) ||
+            !EVP_DigestUpdate(&m5, s->session->master_key,
+                              s->session->master_key_length) ||
+            !EVP_DigestUpdate(&m5, smd, SHA_DIGEST_LENGTH))
+            goto err2;
         if ((int)(i + MD5_DIGEST_LENGTH) > num) {
-            EVP_DigestFinal_ex(&m5, smd, NULL);
+            if (!EVP_DigestFinal_ex(&m5, smd, NULL))
+                goto err2;
             memcpy(km, smd, (num - i));
         } else
-            EVP_DigestFinal_ex(&m5, km, NULL);
+            if (!EVP_DigestFinal_ex(&m5, km, NULL))
+                goto err2;
 
         km += MD5_DIGEST_LENGTH;
     }
@@ -210,6 +212,12 @@ static int ssl3_generate_key_block(SSL *s, unsigned char *km, int num)
     EVP_MD_CTX_cleanup(&m5);
     EVP_MD_CTX_cleanup(&s1);
     return 1;
+ err:
+    SSLerr(SSL_F_SSL3_GENERATE_KEY_BLOCK, ERR_R_INTERNAL_ERROR);
+ err2:
+    EVP_MD_CTX_cleanup(&m5);
+    EVP_MD_CTX_cleanup(&s1);
+    return 0;
 }
 
 int ssl3_change_cipher_state(SSL *s, int which)
@@ -360,25 +368,33 @@ int ssl3_change_cipher_state(SSL *s, int which)
          * In here I set both the read and write key/iv to the same value
          * since only the correct one will be used :-).
          */
-        EVP_DigestInit_ex(&md, EVP_md5(), NULL);
-        EVP_DigestUpdate(&md, key, j);
-        EVP_DigestUpdate(&md, er1, SSL3_RANDOM_SIZE);
-        EVP_DigestUpdate(&md, er2, SSL3_RANDOM_SIZE);
-        EVP_DigestFinal_ex(&md, &(exp_key[0]), NULL);
+        if (!EVP_DigestInit_ex(&md, EVP_md5(), NULL) ||
+            !EVP_DigestUpdate(&md, key, j) ||
+            !EVP_DigestUpdate(&md, er1, SSL3_RANDOM_SIZE) ||
+            !EVP_DigestUpdate(&md, er2, SSL3_RANDOM_SIZE) ||
+            !EVP_DigestFinal_ex(&md, &(exp_key[0]), NULL)) {
+            EVP_MD_CTX_cleanup(&md);
+            goto err2;
+        }
         key = &(exp_key[0]);
 
         if (k > 0) {
-            EVP_DigestInit_ex(&md, EVP_md5(), NULL);
-            EVP_DigestUpdate(&md, er1, SSL3_RANDOM_SIZE);
-            EVP_DigestUpdate(&md, er2, SSL3_RANDOM_SIZE);
-            EVP_DigestFinal_ex(&md, &(exp_iv[0]), NULL);
+            if (!EVP_DigestInit_ex(&md, EVP_md5(), NULL) ||
+                !EVP_DigestUpdate(&md, er1, SSL3_RANDOM_SIZE) ||
+                !EVP_DigestUpdate(&md, er2, SSL3_RANDOM_SIZE) ||
+                !EVP_DigestFinal_ex(&md, &(exp_iv[0]), NULL)) {
+                EVP_MD_CTX_cleanup(&md);
+                goto err2;
+            }
             iv = &(exp_iv[0]);
         }
     }
+    EVP_MD_CTX_cleanup(&md);
 
     s->session->key_arg_length = 0;
 
-    EVP_CipherInit_ex(dd, c, NULL, key, iv, (which & SSL3_CC_WRITE));
+    if (!EVP_CipherInit_ex(dd, c, NULL, key, iv, (which & SSL3_CC_WRITE)))
+        goto err2;
 
 #ifdef OPENSSL_SSL_TRACE_CRYPTO
     if (s->msg_callback) {
@@ -399,7 +415,6 @@ int ssl3_change_cipher_state(SSL *s, int which)
 
     OPENSSL_cleanse(&(exp_key[0]), sizeof(exp_key));
     OPENSSL_cleanse(&(exp_iv[0]), sizeof(exp_iv));
-    EVP_MD_CTX_cleanup(&md);
     return (1);
  err:
     SSLerr(SSL_F_SSL3_CHANGE_CIPHER_STATE, ERR_R_MALLOC_FAILURE);
@@ -555,17 +570,20 @@ int ssl3_enc(SSL *s, int send)
         if ((bs != 1) && !send)
             return ssl3_cbc_remove_padding(s, rec, bs, mac_size);
     }
-    return (1);
+    return 1;
 }
 
-void ssl3_init_finished_mac(SSL *s)
+int ssl3_init_finished_mac(SSL *s)
 {
     if (s->s3->handshake_buffer)
         BIO_free(s->s3->handshake_buffer);
     if (s->s3->handshake_dgst)
         ssl3_free_digest_list(s);
     s->s3->handshake_buffer = BIO_new(BIO_s_mem());
+    if (s->s3->handshake_buffer == NULL)
+        return 0;
     (void)BIO_set_close(s->s3->handshake_buffer, BIO_CLOSE);
+    return 1;
 }
 
 void ssl3_free_digest_list(SSL *s)
@@ -622,6 +640,10 @@ int ssl3_digest_cached_records(SSL *s)
     for (i = 0; ssl_get_handshake_digest(i, &mask, &md); i++) {
         if ((mask & ssl_get_algorithm2(s)) && md) {
             s->s3->handshake_dgst[i] = EVP_MD_CTX_create();
+            if (s->s3->handshake_dgst[i] == NULL) {
+                SSLerr(SSL_F_SSL3_DIGEST_CACHED_RECORDS, ERR_R_MALLOC_FAILURE);
+                return 0;
+            }
 #ifdef OPENSSL_FIPS
             if (EVP_MD_nid(md) == NID_md5) {
                 EVP_MD_CTX_set_flags(s->s3->handshake_dgst[i],
@@ -903,7 +925,7 @@ int ssl3_generate_master_secret(SSL *s, unsigned char *out, unsigned char *p,
                         s, s->msg_callback_arg);
     }
 #endif
-    OPENSSL_cleanse(buf, sizeof buf);
+    OPENSSL_cleanse(buf, sizeof(buf));
     return (ret);
 }
 
diff --git a/deps/openssl/openssl/ssl/s3_lib.c b/deps/openssl/openssl/ssl/s3_lib.c
index 0385e039c8d46c..1014a3fce16f75 100644
--- a/deps/openssl/openssl/ssl/s3_lib.c
+++ b/deps/openssl/openssl/ssl/s3_lib.c
@@ -4237,7 +4237,7 @@ int ssl3_get_req_cert_type(SSL *s, unsigned char *p)
         return (int)s->cert->ctype_num;
     }
     /* get configured sigalgs */
-    siglen = tls12_get_psigalgs(s, &sig);
+    siglen = tls12_get_psigalgs(s, 1, &sig);
     if (s->cert->cert_flags & SSL_CERT_FLAGS_CHECK_TLS_STRICT)
         nostrict = 0;
     for (i = 0; i < siglen; i += 2, sig += 2) {
diff --git a/deps/openssl/openssl/ssl/s3_pkt.c b/deps/openssl/openssl/ssl/s3_pkt.c
index 6ece87d0628c4f..0290c991d8101d 100644
--- a/deps/openssl/openssl/ssl/s3_pkt.c
+++ b/deps/openssl/openssl/ssl/s3_pkt.c
@@ -670,7 +670,7 @@ int ssl3_write_bytes(SSL *s, int type, const void *buf_, int len)
      * promptly send beyond the end of the users buffer ... so we trap and
      * report the error in a way the user will notice
      */
-    if (len < tot) {
+    if ((len < tot) || ((wb->left != 0) && (len < (tot + s->s3->wpend_tot)))) {
         SSLerr(SSL_F_SSL3_WRITE_BYTES, SSL_R_BAD_LENGTH);
         return (-1);
     }
@@ -699,6 +699,7 @@ int ssl3_write_bytes(SSL *s, int type, const void *buf_, int len)
         len >= 4 * (int)(max_send_fragment = s->max_send_fragment) &&
         s->compress == NULL && s->msg_callback == NULL &&
         SSL_USE_EXPLICIT_IV(s) &&
+        s->enc_write_ctx != NULL &&
         EVP_CIPHER_flags(s->enc_write_ctx->cipher) &
         EVP_CIPH_FLAG_TLS1_1_MULTIBLOCK) {
         unsigned char aad[13];
diff --git a/deps/openssl/openssl/ssl/s3_srvr.c b/deps/openssl/openssl/ssl/s3_srvr.c
index ea56f9ca81509b..ba17f1b562812c 100644
--- a/deps/openssl/openssl/ssl/s3_srvr.c
+++ b/deps/openssl/openssl/ssl/s3_srvr.c
@@ -311,7 +311,12 @@ int ssl3_accept(SSL *s)
                     goto end;
                 }
 
-                ssl3_init_finished_mac(s);
+                if (!ssl3_init_finished_mac(s)) {
+                    ret = -1;
+                    s->state = SSL_ST_ERR;
+                    goto end;
+                }
+
                 s->state = SSL3_ST_SR_CLNT_HELLO_A;
                 s->ctx->stats.sess_accept++;
             } else if (!s->s3->send_connection_binding &&
@@ -348,7 +353,11 @@ int ssl3_accept(SSL *s)
             s->state = SSL3_ST_SW_FLUSH;
             s->init_num = 0;
 
-            ssl3_init_finished_mac(s);
+            if (!ssl3_init_finished_mac(s)) {
+                ret = -1;
+                s->state = SSL_ST_ERR;
+                goto end;
+            }
             break;
 
         case SSL3_ST_SW_HELLO_REQ_C:
@@ -1704,6 +1713,12 @@ int ssl3_send_server_key_exchange(SSL *s)
         if (type & SSL_kEECDH) {
             const EC_GROUP *group;
 
+            if (s->s3->tmp.ecdh != NULL) {
+                SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,
+                       ERR_R_INTERNAL_ERROR);
+                goto err;
+            }
+
             ecdhp = cert->ecdh_tmp;
             if (s->cert->ecdh_tmp_auto) {
                 /* Get NID of appropriate shared curve */
@@ -1724,17 +1739,7 @@ int ssl3_send_server_key_exchange(SSL *s)
                 goto f_err;
             }
 
-            if (s->s3->tmp.ecdh != NULL) {
-                SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,
-                       ERR_R_INTERNAL_ERROR);
-                goto err;
-            }
-
             /* Duplicate the ECDH structure. */
-            if (ecdhp == NULL) {
-                SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE, ERR_R_ECDH_LIB);
-                goto err;
-            }
             if (s->cert->ecdh_tmp_auto)
                 ecdh = ecdhp;
             else if ((ecdh = EC_KEY_dup(ecdhp)) == NULL) {
@@ -2084,7 +2089,7 @@ int ssl3_send_certificate_request(SSL *s)
 
         if (SSL_USE_SIGALGS(s)) {
             const unsigned char *psigs;
-            nl = tls12_get_psigalgs(s, &psigs);
+            nl = tls12_get_psigalgs(s, 1, &psigs);
             s2n(nl, p);
             memcpy(p, psigs, nl);
             p += nl;
@@ -3018,6 +3023,11 @@ int ssl3_get_cert_verify(SSL *s)
 
     peer = s->session->peer;
     pkey = X509_get_pubkey(peer);
+    if (pkey == NULL) {
+        al = SSL_AD_INTERNAL_ERROR;
+        goto f_err;
+    }
+
     type = X509_certificate_type(peer, pkey);
 
     if (!(type & EVP_PKT_SIGN)) {
@@ -3154,7 +3164,9 @@ int ssl3_get_cert_verify(SSL *s)
             goto f_err;
         }
         if (i != 64) {
+#ifdef SSL_DEBUG
             fprintf(stderr, "GOST signature length is %d", i);
+#endif
         }
         for (idx = 0; idx < 64; idx++) {
             signature[63 - idx] = p[idx];
@@ -3463,8 +3475,22 @@ int ssl3_send_newsession_ticket(SSL *s)
          * all the work otherwise use generated values from parent ctx.
          */
         if (tctx->tlsext_ticket_key_cb) {
-            if (tctx->tlsext_ticket_key_cb(s, key_name, iv, &ctx,
-                                           &hctx, 1) < 0)
+            /* if 0 is returned, write en empty ticket */
+            int ret = tctx->tlsext_ticket_key_cb(s, key_name, iv, &ctx,
+                                                 &hctx, 1);
+
+            if (ret == 0) {
+                l2n(0, p); /* timeout */
+                s2n(0, p); /* length */
+                ssl_set_handshake_header(s, SSL3_MT_NEWSESSION_TICKET,
+                                         p - ssl_handshake_start(s));
+                s->state = SSL3_ST_SW_SESSION_TICKET_B;
+                OPENSSL_free(senc);
+                EVP_CIPHER_CTX_cleanup(&ctx);
+                HMAC_CTX_cleanup(&hctx);
+                return ssl_do_write(s);
+            }
+            if (ret < 0)
                 goto err;
         } else {
             if (RAND_bytes(iv, 16) <= 0)
diff --git a/deps/openssl/openssl/ssl/ssl_cert.c b/deps/openssl/openssl/ssl/ssl_cert.c
index 1be6fb0032e200..155728d03772b1 100644
--- a/deps/openssl/openssl/ssl/ssl_cert.c
+++ b/deps/openssl/openssl/ssl/ssl_cert.c
@@ -412,6 +412,7 @@ CERT *ssl_cert_dup(CERT *cert)
 #endif
 
     ssl_cert_clear_certs(ret);
+    OPENSSL_free(ret);
 
     return NULL;
 }
diff --git a/deps/openssl/openssl/ssl/ssl_ciph.c b/deps/openssl/openssl/ssl/ssl_ciph.c
index 2ad8f4392236e6..40021329a93617 100644
--- a/deps/openssl/openssl/ssl/ssl_ciph.c
+++ b/deps/openssl/openssl/ssl/ssl_ciph.c
@@ -2001,7 +2001,7 @@ int SSL_COMP_add_compression_method(int id, COMP_METHOD *cm)
     if (id < 193 || id > 255) {
         SSLerr(SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD,
                SSL_R_COMPRESSION_ID_NOT_WITHIN_PRIVATE_RANGE);
-        return 0;
+        return 1;
     }
 
     MemCheck_off();
@@ -2013,6 +2013,7 @@ int SSL_COMP_add_compression_method(int id, COMP_METHOD *cm)
     }
     comp->id = id;
     comp->method = cm;
+    comp->name = cm->name;
     load_builtin_compressions();
     if (ssl_comp_methods && sk_SSL_COMP_find(ssl_comp_methods, comp) >= 0) {
         OPENSSL_free(comp);
diff --git a/deps/openssl/openssl/ssl/ssl_lib.c b/deps/openssl/openssl/ssl/ssl_lib.c
index f8054dae6b6b10..24be376c9fdf6e 100644
--- a/deps/openssl/openssl/ssl/ssl_lib.c
+++ b/deps/openssl/openssl/ssl/ssl_lib.c
@@ -1838,13 +1838,21 @@ int SSL_export_keying_material(SSL *s, unsigned char *out, size_t olen,
 
 static unsigned long ssl_session_hash(const SSL_SESSION *a)
 {
+    const unsigned char *session_id = a->session_id;
     unsigned long l;
+    unsigned char tmp_storage[4];
+
+    if (a->session_id_length < sizeof(tmp_storage)) {
+        memset(tmp_storage, 0, sizeof(tmp_storage));
+        memcpy(tmp_storage, a->session_id, a->session_id_length);
+        session_id = tmp_storage;
+    }
 
     l = (unsigned long)
-        ((unsigned int)a->session_id[0]) |
-        ((unsigned int)a->session_id[1] << 8L) |
-        ((unsigned long)a->session_id[2] << 16L) |
-        ((unsigned long)a->session_id[3] << 24L);
+        ((unsigned long)session_id[0]) |
+        ((unsigned long)session_id[1] << 8L) |
+        ((unsigned long)session_id[2] << 16L) |
+        ((unsigned long)session_id[3] << 24L);
     return (l);
 }
 
@@ -3186,6 +3194,9 @@ SSL_CTX *SSL_set_SSL_CTX(SSL *ssl, SSL_CTX *ctx)
         ssl->cert->alpn_proposed_len = ocert->alpn_proposed_len;
         ocert->alpn_proposed = NULL;
         ssl->cert->alpn_sent = ocert->alpn_sent;
+
+        if (!custom_exts_copy_flags(&ssl->cert->srv_ext, &ocert->srv_ext))
+            return NULL;
 #endif
         ssl_cert_free(ocert);
     }
diff --git a/deps/openssl/openssl/ssl/ssl_locl.h b/deps/openssl/openssl/ssl/ssl_locl.h
index d50edd18c91658..aeffc006347171 100644
--- a/deps/openssl/openssl/ssl/ssl_locl.h
+++ b/deps/openssl/openssl/ssl/ssl_locl.h
@@ -1158,7 +1158,7 @@ long ssl2_default_timeout(void);
 
 const SSL_CIPHER *ssl3_get_cipher_by_char(const unsigned char *p);
 int ssl3_put_cipher_by_char(const SSL_CIPHER *c, unsigned char *p);
-void ssl3_init_finished_mac(SSL *s);
+int ssl3_init_finished_mac(SSL *s);
 int ssl3_send_server_certificate(SSL *s);
 int ssl3_send_newsession_ticket(SSL *s);
 int ssl3_send_cert_status(SSL *s);
@@ -1430,7 +1430,7 @@ int ssl_parse_clienthello_renegotiate_ext(SSL *s, unsigned char *d, int len,
 long ssl_get_algorithm2(SSL *s);
 int tls1_save_sigalgs(SSL *s, const unsigned char *data, int dsize);
 int tls1_process_sigalgs(SSL *s);
-size_t tls12_get_psigalgs(SSL *s, const unsigned char **psigs);
+size_t tls12_get_psigalgs(SSL *s, int sent, const unsigned char **psigs);
 int tls12_check_peer_sigalg(const EVP_MD **pmd, SSL *s,
                             const unsigned char *sig, EVP_PKEY *pkey);
 void ssl_set_client_disabled(SSL *s);
@@ -1482,6 +1482,8 @@ int custom_ext_add(SSL *s, int server,
                    unsigned char **pret, unsigned char *limit, int *al);
 
 int custom_exts_copy(custom_ext_methods *dst, const custom_ext_methods *src);
+int custom_exts_copy_flags(custom_ext_methods *dst,
+                           const custom_ext_methods *src);
 void custom_exts_free(custom_ext_methods *exts);
 
 # else
diff --git a/deps/openssl/openssl/ssl/ssl_rsa.c b/deps/openssl/openssl/ssl/ssl_rsa.c
index f679801a297c8f..af03d45c2e9ae9 100644
--- a/deps/openssl/openssl/ssl/ssl_rsa.c
+++ b/deps/openssl/openssl/ssl/ssl_rsa.c
@@ -964,6 +964,7 @@ int SSL_CTX_use_serverinfo_file(SSL_CTX *ctx, const char *file)
     int ret = 0;
     BIO *bin = NULL;
     size_t num_extensions = 0;
+    unsigned char *new_serverinfo;
 
     if (ctx == NULL || file == NULL) {
         SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_FILE,
@@ -1014,12 +1015,13 @@ int SSL_CTX_use_serverinfo_file(SSL_CTX *ctx, const char *file)
             goto end;
         }
         /* Append the decoded extension to the serverinfo buffer */
-        serverinfo =
+        new_serverinfo =
             OPENSSL_realloc(serverinfo, serverinfo_length + extension_length);
-        if (serverinfo == NULL) {
+        if (new_serverinfo == NULL) {
             SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_FILE, ERR_R_MALLOC_FAILURE);
             goto end;
         }
+        serverinfo = new_serverinfo;
         memcpy(serverinfo + serverinfo_length, extension, extension_length);
         serverinfo_length += extension_length;
 
diff --git a/deps/openssl/openssl/ssl/ssl_sess.c b/deps/openssl/openssl/ssl/ssl_sess.c
index c3369a44aea7e2..f50f5142126f80 100644
--- a/deps/openssl/openssl/ssl/ssl_sess.c
+++ b/deps/openssl/openssl/ssl/ssl_sess.c
@@ -1006,7 +1006,8 @@ int SSL_SESSION_set1_id_context(SSL_SESSION *s, const unsigned char *sid_ctx,
         return 0;
     }
     s->sid_ctx_length = sid_ctx_len;
-    memcpy(s->sid_ctx, sid_ctx, sid_ctx_len);
+    if (s->sid_ctx != sid_ctx)
+        memcpy(s->sid_ctx, sid_ctx, sid_ctx_len);
 
     return 1;
 }
diff --git a/deps/openssl/openssl/ssl/ssltest.c b/deps/openssl/openssl/ssl/ssltest.c
index 890e47685350bb..b75cac61fbdc42 100644
--- a/deps/openssl/openssl/ssl/ssltest.c
+++ b/deps/openssl/openssl/ssl/ssltest.c
@@ -311,6 +311,10 @@ static const char *sn_client;
 static const char *sn_server1;
 static const char *sn_server2;
 static int sn_expect = 0;
+static int s_ticket1 = 0;
+static int s_ticket2 = 0;
+static int c_ticket = 0;
+static int ticket_expect = -1;
 
 static int servername_cb(SSL *s, int *ad, void *arg)
 {
@@ -325,6 +329,9 @@ static int servername_cb(SSL *s, int *ad, void *arg)
             !strcasecmp(servername, sn_server2)) {
             BIO_printf(bio_stdout, "Switching server context.\n");
             SSL_set_SSL_CTX(s, s_ctx2);
+            /* Copy over all the SSL_CTX options */
+            SSL_clear_options(s, 0xFFFFFFFFL);
+            SSL_set_options(s, SSL_CTX_get_options(s_ctx2));
         }
     }
     return SSL_TLSEXT_ERR_OK;
@@ -349,6 +356,21 @@ static int verify_servername(SSL *client, SSL *server)
     return -1;
 }
 
+static int verify_ticket(SSL* ssl)
+{
+    if (ticket_expect == -1)
+        return 0;
+    if (ticket_expect == 0 &&
+        (ssl->session->tlsext_tick == NULL ||
+         ssl->session->tlsext_ticklen == 0))
+        return 1;
+    if (ticket_expect == 1 &&
+        (ssl->session->tlsext_tick != NULL &&
+         ssl->session->tlsext_ticklen != 0))
+        return 1;
+    return -1;
+}
+
 /*-
  * next_protos_parse parses a comma separated list of strings into a string
  * in a format suitable for passing to SSL_CTX_set_next_protos_advertised.
@@ -477,6 +499,42 @@ static int verify_alpn(SSL *client, SSL *server)
     return -1;
 }
 
+#ifndef OPENSSL_NO_TLSEXT
+
+static int cb_ticket0(SSL* s, unsigned char* key_name, unsigned char *iv, EVP_CIPHER_CTX *ctx, HMAC_CTX *hctx, int enc)
+{
+    return 0;
+}
+
+static int cb_ticket1(SSL* s, unsigned char* key_name, unsigned char *iv, EVP_CIPHER_CTX *ctx, HMAC_CTX *hctx, int enc)
+{
+    static unsigned char key[] = { 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16 };
+    static char name[] = "ticket11ticket11";
+    if (SSL_get_options(s) & SSL_OP_NO_TICKET)
+        return 0;
+    if (enc) {
+        RAND_pseudo_bytes(iv, EVP_MAX_IV_LENGTH);
+        EVP_EncryptInit_ex(ctx, EVP_aes_128_cbc(), NULL, key, iv);
+        HMAC_Init_ex(hctx, key, sizeof(key), EVP_sha1(), NULL);
+        memcpy(key_name, name, 16);
+        return 1;
+    } else {
+        if (memcmp(key_name, name, 16) == 0) {
+            EVP_DecryptInit_ex(ctx, EVP_aes_128_cbc(), NULL, key, iv);
+            HMAC_Init_ex(hctx, key, sizeof(key), EVP_sha1(), NULL);
+            return 1;
+        }
+    }
+    return 0;
+}
+
+static int cb_ticket2(SSL* s, unsigned char* key_name, unsigned char *iv, EVP_CIPHER_CTX *ctx, HMAC_CTX *hctx, int enc)
+{
+    fprintf(stderr, "ticket callback for SNI context should never be called\n");
+    EXIT(1);
+}
+#endif
+
 #define SCT_EXT_TYPE 18
 
 /*
@@ -820,6 +878,12 @@ static void sv_usage(void)
     fprintf(stderr, " -sn_server2 <string> - have server context 2 respond to this servername\n");
     fprintf(stderr, " -sn_expect1          - expected server 1\n");
     fprintf(stderr, " -sn_expect2          - expected server 2\n");
+#ifndef OPENSSL_NO_TLSEXT
+    fprintf(stderr, " -s_ticket1 <yes|no|broken> - enable/disable session tickets on context 1\n");
+    fprintf(stderr, " -s_ticket2 <yes|no>        - enable/disable session tickets on context 2\n");
+    fprintf(stderr, " -c_ticket <yes|no>         - enable/disable session tickets on the client\n");
+    fprintf(stderr, " -ticket_expect <yes|no>    - indicate that the client should (or should not) have a ticket\n");
+#endif
 }
 
 static void print_details(SSL *c_ssl, const char *prefix)
@@ -1175,13 +1239,21 @@ int main(int argc, char *argv[])
         } else if (strcmp(*argv, "-time") == 0) {
             print_time = 1;
         }
-#ifndef OPENSSL_NO_COMP
         else if (strcmp(*argv, "-zlib") == 0) {
+#ifndef OPENSSL_NO_COMP
             comp = COMP_ZLIB;
+#else
+            fprintf(stderr,
+                    "ignoring -zlib, since I'm compiled without COMP\n");
+#endif
         } else if (strcmp(*argv, "-rle") == 0) {
+#ifndef OPENSSL_NO_COMP
             comp = COMP_RLE;
-        }
+#else
+            fprintf(stderr,
+                    "ignoring -rle, since I'm compiled without COMP\n");
 #endif
+        }
         else if (strcmp(*argv, "-named_curve") == 0) {
             if (--argc < 1)
                 goto bad;
@@ -1241,6 +1313,36 @@ int main(int argc, char *argv[])
             sn_expect = 1;
         } else if (strcmp(*argv, "-sn_expect2") == 0) {
             sn_expect = 2;
+#ifndef OPENSSL_NO_TLSEXT
+        } else if (strcmp(*argv, "-s_ticket1") == 0) {
+            if (--argc < 1)
+                goto bad;
+            argv++;
+            if (strcmp(*argv, "yes") == 0)
+                s_ticket1 = 1;
+            if (strcmp(*argv, "broken") == 0)
+                s_ticket1 = 2;
+        } else if (strcmp(*argv, "-s_ticket2") == 0) {
+            if (--argc < 1)
+                goto bad;
+            argv++;
+            if (strcmp(*argv, "yes") == 0)
+                s_ticket2 = 1;
+        } else if (strcmp(*argv, "-c_ticket") == 0) {
+            if (--argc < 1)
+                goto bad;
+            argv++;
+            if (strcmp(*argv, "yes") == 0)
+                c_ticket = 1;
+        } else if (strcmp(*argv, "-ticket_expect") == 0) {
+            if (--argc < 1)
+                goto bad;
+            argv++;
+            if (strcmp(*argv, "yes") == 0)
+                ticket_expect = 1;
+            else if (strcmp(*argv, "no") == 0)
+                ticket_expect = 0;
+#endif
         } else {
             fprintf(stderr, "unknown option %s\n", *argv);
             badop = 1;
@@ -1679,6 +1781,24 @@ int main(int argc, char *argv[])
     if (sn_server1 || sn_server2)
         SSL_CTX_set_tlsext_servername_callback(s_ctx, servername_cb);
 
+#ifndef OPENSSL_NO_TLSEXT
+    if (s_ticket1 == 0)
+        SSL_CTX_set_options(s_ctx, SSL_OP_NO_TICKET);
+    /* always set the callback */
+    if (s_ticket1 == 2)
+        SSL_CTX_set_tlsext_ticket_key_cb(s_ctx, cb_ticket0);
+    else
+        SSL_CTX_set_tlsext_ticket_key_cb(s_ctx, cb_ticket1);
+
+    if (!s_ticket2)
+        SSL_CTX_set_options(s_ctx2, SSL_OP_NO_TICKET);
+    /* always set the callback - this should never be called */
+    SSL_CTX_set_tlsext_ticket_key_cb(s_ctx2, cb_ticket2);
+
+    if (!c_ticket)
+        SSL_CTX_set_options(c_ctx, SSL_OP_NO_TICKET);
+#endif
+
     c_ssl = SSL_new(c_ctx);
     s_ssl = SSL_new(s_ctx);
 
@@ -1742,6 +1862,8 @@ int main(int argc, char *argv[])
         ret = 1;
     if (verify_servername(c_ssl, s_ssl) < 0)
         ret = 1;
+    if (verify_ticket(c_ssl) < 0)
+        ret = 1;
 
     SSL_free(s_ssl);
     SSL_free(c_ssl);
diff --git a/deps/openssl/openssl/ssl/t1_ext.c b/deps/openssl/openssl/ssl/t1_ext.c
index 79ed946a514226..0f4aba0226b423 100644
--- a/deps/openssl/openssl/ssl/t1_ext.c
+++ b/deps/openssl/openssl/ssl/t1_ext.c
@@ -179,6 +179,25 @@ int custom_ext_add(SSL *s, int server,
     return 1;
 }
 
+/* Copy the flags from src to dst for any extensions that exist in both */
+int custom_exts_copy_flags(custom_ext_methods *dst,
+                           const custom_ext_methods *src)
+{
+    size_t i;
+    custom_ext_method *methsrc = src->meths;
+
+    for (i = 0; i < src->meths_count; i++, methsrc++) {
+        custom_ext_method *methdst = custom_ext_find(dst, methsrc->ext_type);
+
+        if (methdst == NULL)
+            continue;
+
+        methdst->ext_flags = methsrc->ext_flags;
+    }
+
+    return 1;
+}
+
 /* Copy table of custom extensions */
 int custom_exts_copy(custom_ext_methods *dst, const custom_ext_methods *src)
 {
@@ -223,16 +242,14 @@ static int custom_ext_meth_add(custom_ext_methods *exts,
     /* Search for duplicate */
     if (custom_ext_find(exts, ext_type))
         return 0;
-    exts->meths = OPENSSL_realloc(exts->meths,
-                                  (exts->meths_count +
-                                   1) * sizeof(custom_ext_method));
-
-    if (!exts->meths) {
-        exts->meths_count = 0;
+    meth = OPENSSL_realloc(exts->meths,
+                           (exts->meths_count + 1)
+                           * sizeof(custom_ext_method));
+    if (meth == NULL)
         return 0;
-    }
 
-    meth = exts->meths + exts->meths_count;
+    exts->meths = meth;
+    meth += exts->meths_count;
     memset(meth, 0, sizeof(custom_ext_method));
     meth->parse_cb = parse_cb;
     meth->add_cb = add_cb;
diff --git a/deps/openssl/openssl/ssl/t1_lib.c b/deps/openssl/openssl/ssl/t1_lib.c
index e60c88bd5b2766..6587e8bb685c94 100644
--- a/deps/openssl/openssl/ssl/t1_lib.c
+++ b/deps/openssl/openssl/ssl/t1_lib.c
@@ -1035,7 +1035,7 @@ static unsigned char suiteb_sigalgs[] = {
         tlsext_sigalg_ecdsa(TLSEXT_hash_sha384)
 };
 # endif
-size_t tls12_get_psigalgs(SSL *s, const unsigned char **psigs)
+size_t tls12_get_psigalgs(SSL *s, int sent, const unsigned char **psigs)
 {
     /*
      * If Suite B mode use Suite B sigalgs only, ignore any other
@@ -1057,7 +1057,7 @@ size_t tls12_get_psigalgs(SSL *s, const unsigned char **psigs)
     }
 # endif
     /* If server use client authentication sigalgs if not NULL */
-    if (s->server && s->cert->client_sigalgs) {
+    if (s->server == sent && s->cert->client_sigalgs) {
         *psigs = s->cert->client_sigalgs;
         return s->cert->client_sigalgslen;
     } else if (s->cert->conf_sigalgs) {
@@ -1121,7 +1121,7 @@ int tls12_check_peer_sigalg(const EVP_MD **pmd, SSL *s,
 # endif
 
     /* Check signature matches a type we sent */
-    sent_sigslen = tls12_get_psigalgs(s, &sent_sigs);
+    sent_sigslen = tls12_get_psigalgs(s, 1, &sent_sigs);
     for (i = 0; i < sent_sigslen; i += 2, sent_sigs += 2) {
         if (sig[0] == sent_sigs[0] && sig[1] == sent_sigs[1])
             break;
@@ -1169,7 +1169,7 @@ void ssl_set_client_disabled(SSL *s)
      * Now go through all signature algorithms seeing if we support any for
      * RSA, DSA, ECDSA. Do this for all versions not just TLS 1.2.
      */
-    sigalgslen = tls12_get_psigalgs(s, &sigalgs);
+    sigalgslen = tls12_get_psigalgs(s, 1, &sigalgs);
     for (i = 0; i < sigalgslen; i += 2, sigalgs += 2) {
         switch (sigalgs[1]) {
 # ifndef OPENSSL_NO_RSA
@@ -1440,7 +1440,7 @@ unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *buf,
     if (SSL_CLIENT_USE_SIGALGS(s)) {
         size_t salglen;
         const unsigned char *salg;
-        salglen = tls12_get_psigalgs(s, &salg);
+        salglen = tls12_get_psigalgs(s, 1, &salg);
 
         /*-
          * check for enough space.
@@ -1769,6 +1769,9 @@ unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *buf,
             return NULL;
         s2n(TLSEXT_TYPE_session_ticket, ret);
         s2n(0, ret);
+    } else {
+        /* if we don't add the above TLSEXT, we can't add a session ticket later */
+        s->tlsext_ticket_expected = 0;
     }
 
     if (s->tlsext_status_expected) {
@@ -3574,8 +3577,14 @@ static int tls_decrypt_ticket(SSL *s, const unsigned char *etick,
     p = sdec;
 
     sess = d2i_SSL_SESSION(NULL, &p, slen);
+    slen -= p - sdec;
     OPENSSL_free(sdec);
     if (sess) {
+        /* Some additional consistency checks */
+        if (slen != 0 || sess->session_id_length != 0) {
+            SSL_SESSION_free(sess);
+            return 2;
+        }
         /*
          * The session ID, if non-empty, is used by some clients to detect
          * that the ticket has been accepted. So we copy it to the session
@@ -3803,7 +3812,7 @@ static int tls1_set_shared_sigalgs(SSL *s)
         conf = c->conf_sigalgs;
         conflen = c->conf_sigalgslen;
     } else
-        conflen = tls12_get_psigalgs(s, &conf);
+        conflen = tls12_get_psigalgs(s, 0, &conf);
     if (s->options & SSL_OP_CIPHER_SERVER_PREFERENCE || is_suiteb) {
         pref = conf;
         preflen = conflen;
diff --git a/deps/openssl/openssl/test/Makefile b/deps/openssl/openssl/test/Makefile
index 8f272ef99d5ee2..a324eeb39ac317 100644
--- a/deps/openssl/openssl/test/Makefile
+++ b/deps/openssl/openssl/test/Makefile
@@ -307,6 +307,7 @@ test_ssl: keyU.ss certU.ss certCA.ss certP1.ss keyP1.ss certP2.ss keyP2.ss \
 	fi
 	../util/shlib_wrap.sh ./$(SSLTEST) -test_cipherlist
 	@sh ./testssl keyU.ss certU.ss certCA.ss
+	@sh ./testssl keyU.ss certU.ss certCA.ss -rle
 	@sh ./testsslproxy keyP1.ss certP1.ss intP1.ss
 	@sh ./testsslproxy keyP2.ss certP2.ss intP2.ss
 
diff --git a/deps/openssl/openssl/test/ssltest_old b/deps/openssl/openssl/test/ssltest_old
new file mode 100755
index 00000000000000..3e3a27d41d7daf
Binary files /dev/null and b/deps/openssl/openssl/test/ssltest_old differ
diff --git a/deps/openssl/openssl/test/testssl b/deps/openssl/openssl/test/testssl
index a6f9fa770b3647..d7dda6e9a5af4c 100644
--- a/deps/openssl/openssl/test/testssl
+++ b/deps/openssl/openssl/test/testssl
@@ -292,4 +292,25 @@ if [ -z "$extra" -a `uname -m` = "x86_64" ]; then
   $ssltest -cipher AES128-SHA256 -bytes 8m	|| exit 1
 fi
 
+
+$ssltest -bio_pair -sn_client alice -sn_server1 alice -sn_server2 bob -s_ticket1 no -s_ticket2 no -c_ticket no -ticket_expect no || exit 1
+$ssltest -bio_pair -sn_client alice -sn_server1 alice -sn_server2 bob -s_ticket1 no -s_ticket2 no -c_ticket yes -ticket_expect no || exit 1
+$ssltest -bio_pair -sn_client alice -sn_server1 alice -sn_server2 bob -s_ticket1 no -s_ticket2 yes -c_ticket no -ticket_expect no || exit 1
+$ssltest -bio_pair -sn_client alice -sn_server1 alice -sn_server2 bob -s_ticket1 no -s_ticket2 yes -c_ticket yes -ticket_expect no || exit 1
+$ssltest -bio_pair -sn_client alice -sn_server1 alice -sn_server2 bob -s_ticket1 yes -s_ticket2 no -c_ticket no -ticket_expect no || exit 1
+$ssltest -bio_pair -sn_client alice -sn_server1 alice -sn_server2 bob -s_ticket1 yes -s_ticket2 no -c_ticket yes -ticket_expect yes || exit 1
+$ssltest -bio_pair -sn_client alice -sn_server1 alice -sn_server2 bob -s_ticket1 yes -s_ticket2 yes -c_ticket no -ticket_expect no || exit 1
+$ssltest -bio_pair -sn_client alice -sn_server1 alice -sn_server2 bob -s_ticket1 yes -s_ticket2 yes -c_ticket yes -ticket_expect yes || exit 1
+
+$ssltest -bio_pair -sn_client bob -sn_server1 alice -sn_server2 bob -s_ticket1 no -s_ticket2 no -c_ticket no -ticket_expect no || exit 1
+$ssltest -bio_pair -sn_client bob -sn_server1 alice -sn_server2 bob -s_ticket1 no -s_ticket2 no -c_ticket yes -ticket_expect no || exit 1
+$ssltest -bio_pair -sn_client bob -sn_server1 alice -sn_server2 bob -s_ticket1 no -s_ticket2 yes -c_ticket no -ticket_expect no || exit 1
+$ssltest -bio_pair -sn_client bob -sn_server1 alice -sn_server2 bob -s_ticket1 no -s_ticket2 yes -c_ticket yes -ticket_expect no || exit 1
+$ssltest -bio_pair -sn_client bob -sn_server1 alice -sn_server2 bob -s_ticket1 yes -s_ticket2 no -c_ticket no -ticket_expect no || exit 1
+$ssltest -bio_pair -sn_client bob -sn_server1 alice -sn_server2 bob -s_ticket1 yes -s_ticket2 no -c_ticket yes -ticket_expect no || exit 1
+$ssltest -bio_pair -sn_client bob -sn_server1 alice -sn_server2 bob -s_ticket1 yes -s_ticket2 yes -c_ticket no -ticket_expect no || exit 1
+$ssltest -bio_pair -sn_client bob -sn_server1 alice -sn_server2 bob -s_ticket1 yes -s_ticket2 yes -c_ticket yes -ticket_expect yes || exit 1
+
+$ssltest -bio_pair -s_ticket1 broken -c_ticket yes -ticket_expect no || exit 1
+
 exit 0
diff --git a/deps/openssl/openssl/test/testutil.h b/deps/openssl/openssl/test/testutil.h
index 75f0c8ae01ee14..e40b37ed6e7a70 100644
--- a/deps/openssl/openssl/test/testutil.h
+++ b/deps/openssl/openssl/test/testutil.h
@@ -103,7 +103,7 @@
  * TEST_CASE_NAME is defined as the name of the test case function where
  * possible; otherwise we get by with the file name and line number.
  */
-# if __STDC_VERSION__ < 199901L
+# if !defined(__STDC_VERSION__) || __STDC_VERSION__ < 199901L
 #  if defined(_MSC_VER)
 #   define TEST_CASE_NAME __FUNCTION__
 #  else
diff --git a/deps/openssl/openssl/test/v3ext b/deps/openssl/openssl/test/v3ext
new file mode 100755
index 00000000000000..09a0c3aa326f4b
Binary files /dev/null and b/deps/openssl/openssl/test/v3ext differ
diff --git a/deps/openssl/openssl/test/x509aux b/deps/openssl/openssl/test/x509aux
new file mode 100755
index 00000000000000..35378a8ff9aee5
Binary files /dev/null and b/deps/openssl/openssl/test/x509aux differ
diff --git a/deps/openssl/openssl/util/domd b/deps/openssl/openssl/util/domd
index bc2a85f7dd5076..5a92559c9b7a83 100755
--- a/deps/openssl/openssl/util/domd
+++ b/deps/openssl/openssl/util/domd
@@ -34,11 +34,11 @@ else
     ${PERL} $TOP/util/clean-depend.pl < Makefile > Makefile.new
     RC=$?
 fi
-if ! cmp -s Makefile.save Makefile.new; then
-    mv Makefile.new Makefile
-else
+if cmp -s Makefile.save Makefile.new; then
     mv Makefile.save Makefile
     rm -f Makefile.new
+else
+    mv Makefile.new Makefile
 fi
 # unfake the presence of Kerberos
 rm $TOP/krb5.h
diff --git a/deps/openssl/openssl/util/mk1mf.pl b/deps/openssl/openssl/util/mk1mf.pl
index 7a3ae11f7865fe..490a034e4037e6 100755
--- a/deps/openssl/openssl/util/mk1mf.pl
+++ b/deps/openssl/openssl/util/mk1mf.pl
@@ -1207,6 +1207,7 @@ sub read_options
 		"no-ssl3-method" => 0,
 		"no-tlsext" => \$no_tlsext,
 		"no-tls1" => \$no_tls1,
+		"no-dtls1" => 0,
 		"no-srp" => \$no_srp,
 		"no-cms" => \$no_cms,
 		"no-jpake" => \$no_jpake,
diff --git a/deps/v8/src/objects-body-descriptors.h b/deps/v8/src/objects-body-descriptors.h
index 91cb8883be8873..a1c3634bd762d7 100644
--- a/deps/v8/src/objects-body-descriptors.h
+++ b/deps/v8/src/objects-body-descriptors.h
@@ -99,7 +99,7 @@ class FixedBodyDescriptor final : public BodyDescriptorBase {
 
   template <typename StaticVisitor>
   static inline void IterateBody(HeapObject* obj, int object_size) {
-    IterateBody(obj);
+    IterateBody<StaticVisitor>(obj);
   }
 };
 
diff --git a/deps/v8/src/objects-inl.h b/deps/v8/src/objects-inl.h
index 11f4d7498d7558..72208c2f00f4a9 100644
--- a/deps/v8/src/objects-inl.h
+++ b/deps/v8/src/objects-inl.h
@@ -36,6 +36,27 @@
 namespace v8 {
 namespace internal {
 
+template <typename Derived, typename Shape, typename Key>
+uint32_t HashTable<Derived, Shape, Key>::Hash(Key key) {
+  if (Shape::UsesSeed) {
+    return Shape::SeededHash(key, GetHeap()->HashSeed());
+  } else {
+    return Shape::Hash(key);
+  }
+}
+
+
+template <typename Derived, typename Shape, typename Key>
+uint32_t HashTable<Derived, Shape, Key>::HashForObject(Key key,
+                                                       Object* object) {
+  if (Shape::UsesSeed) {
+    return Shape::SeededHashForObject(key, GetHeap()->HashSeed(), object);
+  } else {
+    return Shape::HashForObject(key, object);
+  }
+}
+
+
 PropertyDetails::PropertyDetails(Smi* smi) {
   value_ = smi->value();
 }
diff --git a/deps/v8/src/objects.h b/deps/v8/src/objects.h
index d1632c9deb2982..47b02dadcff965 100644
--- a/deps/v8/src/objects.h
+++ b/deps/v8/src/objects.h
@@ -3261,22 +3261,10 @@ class HashTableBase : public FixedArray {
 template <typename Derived, typename Shape, typename Key>
 class HashTable : public HashTableBase {
  public:
-  // Wrapper methods
-  inline uint32_t Hash(Key key) {
-    if (Shape::UsesSeed) {
-      return Shape::SeededHash(key, GetHeap()->HashSeed());
-    } else {
-      return Shape::Hash(key);
-    }
-  }
-
-  inline uint32_t HashForObject(Key key, Object* object) {
-    if (Shape::UsesSeed) {
-      return Shape::SeededHashForObject(key, GetHeap()->HashSeed(), object);
-    } else {
-      return Shape::HashForObject(key, object);
-    }
-  }
+  // Wrapper methods.  Defined in src/objects-inl.h
+  // to break a cycle with src/heap/heap.h.
+  inline uint32_t Hash(Key key);
+  inline uint32_t HashForObject(Key key, Object* object);
 
   // Returns a new HashTable object.
   MUST_USE_RESULT static Handle<Derived> New(
diff --git a/doc/api/assert.md b/doc/api/assert.md
index 873f03e77553b2..e02829918c8b45 100644
--- a/doc/api/assert.md
+++ b/doc/api/assert.md
@@ -199,7 +199,7 @@ added: v0.1.21
 * `actual` {any}
 * `expected` {any}
 * `message` {any}
-* `operator` {String}
+* `operator` {string}
 
 Throws an `AssertionError`. If `message` is falsy, the error message is set as
 the values of `actual` and `expected` separated by the provided `operator`.
diff --git a/doc/api/buffer.md b/doc/api/buffer.md
index 106d4f58f0c4fa..4b3f762f80740c 100644
--- a/doc/api/buffer.md
+++ b/doc/api/buffer.md
@@ -350,8 +350,8 @@ deprecated: v6.0.0
 
 * `arrayBuffer` {ArrayBuffer} An [`ArrayBuffer`] or the `.buffer` property of a
   [`TypedArray`].
-* `byteOffset` {Integer} Index of first byte to expose. **Default:** `0`
-* `length` {Integer} Number of bytes to expose.
+* `byteOffset` {integer} Index of first byte to expose. **Default:** `0`
+* `length` {integer} Number of bytes to expose.
   **Default:** `arrayBuffer.length - byteOffset`
 
 This creates a view of the [`ArrayBuffer`] without copying the underlying
@@ -391,7 +391,7 @@ deprecated: v6.0.0
 > Stability: 0 - Deprecated: Use [`Buffer.alloc()`] instead (also see
 > [`Buffer.allocUnsafe()`]).
 
-* `size` {Integer} The desired length of the new `Buffer`
+* `size` {integer} The desired length of the new `Buffer`
 
 Allocates a new `Buffer` of `size` bytes.  The `size` must be less than or equal
 to the value of [`buffer.kMaxLength`]. Otherwise, a [`RangeError`] is thrown.
@@ -424,8 +424,8 @@ deprecated: v6.0.0
 > Stability: 0 - Deprecated:
 > Use [`Buffer.from(string[, encoding])`][`Buffer.from(string)`] instead.
 
-* `string` {String} String to encode
-* `encoding` {String} The encoding of `string`. **Default:** `'utf8'`
+* `string` {string} String to encode
+* `encoding` {string} The encoding of `string`. **Default:** `'utf8'`
 
 Creates a new `Buffer` containing the given JavaScript string `string`. If
 provided, the `encoding` parameter identifies the character encoding of `string`.
@@ -453,10 +453,10 @@ console.log(buf2.toString());
 added: v5.10.0
 -->
 
-* `size` {Integer} The desired length of the new `Buffer`
-* `fill` {String | Buffer | Integer} A value to pre-fill the new `Buffer` with.
+* `size` {integer} The desired length of the new `Buffer`
+* `fill` {string|Buffer|integer} A value to pre-fill the new `Buffer` with.
   **Default:** `0`
-* `encoding` {String} If `fill` is a string, this is its encoding.
+* `encoding` {string} If `fill` is a string, this is its encoding.
   **Default:** `'utf8'`
 
 Allocates a new `Buffer` of `size` bytes. If `fill` is `undefined`, the
@@ -510,7 +510,7 @@ A `TypeError` will be thrown if `size` is not a number.
 added: v5.10.0
 -->
 
-* `size` {Integer} The desired length of the new `Buffer`
+* `size` {integer} The desired length of the new `Buffer`
 
 Allocates a new *non-zero-filled* `Buffer` of `size` bytes. The `size` must
 be less than or equal to the value of [`buffer.kMaxLength`]. Otherwise, a
@@ -556,7 +556,7 @@ additional performance that [`Buffer.allocUnsafe()`] provides.
 added: v5.10.0
 -->
 
-* `size` {Integer} The desired length of the new `Buffer`
+* `size` {integer} The desired length of the new `Buffer`
 
 Allocates a new *non-zero-filled* and non-pooled `Buffer` of `size` bytes. The
 `size` must be less than or equal to the value of [`buffer.kMaxLength`].
@@ -609,11 +609,11 @@ A `TypeError` will be thrown if `size` is not a number.
 added: v0.1.90
 -->
 
-* `string` {String | Buffer | TypedArray | DataView | ArrayBuffer} A value to
+* `string` {string|Buffer|TypedArray|DataView|ArrayBuffer} A value to
   calculate the length of
-* `encoding` {String} If `string` is a string, this is its encoding.
+* `encoding` {string} If `string` is a string, this is its encoding.
   **Default:** `'utf8'`
-* Returns: {Integer} The number of bytes contained within `string`
+* Returns: {integer} The number of bytes contained within `string`
 
 Returns the actual byte length of a string. This is not the same as
 [`String.prototype.length`] since that returns the number of *characters* in
@@ -645,7 +645,7 @@ added: v0.11.13
 
 * `buf1` {Buffer}
 * `buf2` {Buffer}
-* Returns: {Integer}
+* Returns: {integer}
 
 Compares `buf1` to `buf2` typically for the purpose of sorting arrays of
 `Buffer` instances. This is equivalent to calling
@@ -669,7 +669,7 @@ added: v0.7.11
 -->
 
 * `list` {Array} List of `Buffer` instances to concat
-* `totalLength` {Integer} Total length of the `Buffer` instances in `list`
+* `totalLength` {integer} Total length of the `Buffer` instances in `list`
   when concatenated
 * Returns: {Buffer}
 
@@ -729,8 +729,8 @@ added: v5.10.0
 
 * `arrayBuffer` {ArrayBuffer} An [`ArrayBuffer`] or the `.buffer` property of a
   [`TypedArray`].
-* `byteOffset` {Integer} Index of first byte to expose. **Default:** `0`
-* `length` {Integer} Number of bytes to expose.
+* `byteOffset` {integer} Index of first byte to expose. **Default:** `0`
+* `length` {integer} Number of bytes to expose.
   **Default:** `arrayBuffer.length - byteOffset`
 
 This creates a view of the [`ArrayBuffer`] without copying the underlying
@@ -805,8 +805,8 @@ A `TypeError` will be thrown if `buffer` is not a `Buffer`.
 added: v5.10.0
 -->
 
-* `string` {String} A string to encode.
-* `encoding` {String} The encoding of `string`. **Default:** `'utf8'`
+* `string` {string} A string to encode.
+* `encoding` {string} The encoding of `string`. **Default:** `'utf8'`
 
 Creates a new `Buffer` containing the given JavaScript string `string`. If
 provided, the `encoding` parameter identifies the character encoding of `string`.
@@ -837,7 +837,7 @@ added: v0.1.101
 -->
 
 * `obj` {Object}
-* Returns: {Boolean}
+* Returns: {boolean}
 
 Returns `true` if `obj` is a `Buffer`, `false` otherwise.
 
@@ -846,8 +846,8 @@ Returns `true` if `obj` is a `Buffer`, `false` otherwise.
 added: v0.9.1
 -->
 
-* `encoding` {String} A character encoding name to check
-* Returns: {Boolean}
+* `encoding` {string} A character encoding name to check
+* Returns: {boolean}
 
 Returns `true` if `encoding` contains a supported character encoding, or `false`
 otherwise.
@@ -857,7 +857,7 @@ otherwise.
 added: v0.11.3
 -->
 
-* {Integer} **Default:** `8192`
+* {integer} **Default:** `8192`
 
 This is the number of bytes used to determine the size of pre-allocated, internal
 `Buffer` instances used for pooling. This value may be modified.
@@ -896,17 +896,17 @@ added: v0.11.13
 -->
 
 * `target` {Buffer} A `Buffer` to compare to
-* `targetStart` {Integer} The offset within `target` at which to begin
+* `targetStart` {integer} The offset within `target` at which to begin
   comparison. **Default:** `0`
-* `targetEnd` {Integer} The offset with `target` at which to end comparison
+* `targetEnd` {integer} The offset with `target` at which to end comparison
   (not inclusive). Ignored when `targetStart` is `undefined`.
   **Default:** `target.length`
-* `sourceStart` {Integer} The offset within `buf` at which to begin comparison.
+* `sourceStart` {integer} The offset within `buf` at which to begin comparison.
   Ignored when `targetStart` is `undefined`. **Default:** `0`
-* `sourceEnd` {Integer} The offset within `buf` at which to end comparison
+* `sourceEnd` {integer} The offset within `buf` at which to end comparison
   (not inclusive). Ignored when `targetStart` is `undefined`.
   **Default:** [`buf.length`]
-* Returns: {Integer}
+* Returns: {integer}
 
 Compares `buf` with `target` and returns a number indicating whether `buf`
 comes before, after, or is the same as `target` in sort order.
@@ -972,13 +972,13 @@ added: v0.1.90
 -->
 
 * `target` {Buffer|Uint8Array} A `Buffer` or [`Uint8Array`] to copy into.
-* `targetStart` {Integer} The offset within `target` at which to begin
+* `targetStart` {integer} The offset within `target` at which to begin
   copying to. **Default:** `0`
-* `sourceStart` {Integer} The offset within `buf` at which to begin copying from.
+* `sourceStart` {integer} The offset within `buf` at which to begin copying from.
   Ignored when `targetStart` is `undefined`. **Default:** `0`
-* `sourceEnd` {Integer} The offset within `buf` at which to stop copying (not
+* `sourceEnd` {integer} The offset within `buf` at which to stop copying (not
   inclusive). Ignored when `sourceStart` is `undefined`. **Default:** [`buf.length`]
-* Returns: {Integer} The number of bytes copied.
+* Returns: {integer} The number of bytes copied.
 
 Copies data from a region of `buf` to a region in `target` even if the `target`
 memory region overlaps with `buf`.
@@ -1051,7 +1051,7 @@ added: v0.11.13
 -->
 
 * `otherBuffer` {Buffer} A `Buffer` to compare to
-* Returns: {Boolean}
+* Returns: {boolean}
 
 Returns `true` if both `buf` and `otherBuffer` have exactly the same bytes,
 `false` otherwise.
@@ -1075,10 +1075,10 @@ console.log(buf1.equals(buf3));
 added: v0.5.0
 -->
 
-* `value` {String | Buffer | Integer} The value to fill `buf` with
-* `offset` {Integer} Where to start filling `buf`. **Default:** `0`
-* `end` {Integer} Where to stop filling `buf` (not inclusive). **Default:** [`buf.length`]
-* `encoding` {String} If `value` is a string, this is its encoding.
+* `value` {string|Buffer|integer} The value to fill `buf` with
+* `offset` {integer} Where to start filling `buf`. **Default:** `0`
+* `end` {integer} Where to stop filling `buf` (not inclusive). **Default:** [`buf.length`]
+* `encoding` {string} If `value` is a string, this is its encoding.
   **Default:** `'utf8'`
 * Returns: {Buffer} A reference to `buf`
 
@@ -1107,16 +1107,57 @@ Example: Fill a `Buffer` with a two-byte character
 console.log(Buffer.allocUnsafe(3).fill('\u0222'));
 ```
 
+### buf.includes(value[, byteOffset][, encoding])
+<!-- YAML
+added: v5.3.0
+-->
+
+* `value` {string|Buffer|integer} What to search for
+* `byteOffset` {integer} Where to begin searching in `buf`. **Default:** `0`
+* `encoding` {string} If `value` is a string, this is its encoding.
+  **Default:** `'utf8'`
+* Returns: {boolean} `true` if `value` was found in `buf`, `false` otherwise
+
+Equivalent to [`buf.indexOf() !== -1`][`buf.indexOf()`].
+
+Examples:
+
+```js
+const buf = Buffer.from('this is a buffer');
+
+// Prints: true
+console.log(buf.includes('this'));
+
+// Prints: true
+console.log(buf.includes('is'));
+
+// Prints: true
+console.log(buf.includes(Buffer.from('a buffer')));
+
+// Prints: true
+// (97 is the decimal ASCII value for 'a')
+console.log(buf.includes(97));
+
+// Prints: false
+console.log(buf.includes(Buffer.from('a buffer example')));
+
+// Prints: true
+console.log(buf.includes(Buffer.from('a buffer example').slice(0, 8)));
+
+// Prints: false
+console.log(buf.includes('this', 4));
+```
+
 ### buf.indexOf(value[, byteOffset][, encoding])
 <!-- YAML
 added: v1.5.0
 -->
 
-* `value` {String | Buffer | Integer} What to search for
-* `byteOffset` {Integer} Where to begin searching in `buf`. **Default:** `0`
-* `encoding` {String} If `value` is a string, this is its encoding.
+* `value` {string | Buffer | integer} What to search for
+* `byteOffset` {integer} Where to begin searching in `buf`. **Default:** `0`
+* `encoding` {string} If `value` is a string, this is its encoding.
   **Default:** `'utf8'`
-* Returns: {Integer} The index of the first occurrence of `value` in `buf` or `-1`
+* Returns: {integer} The index of the first occurrence of `value` in `buf` or `-1`
   if `buf` does not contain `value`
 
 If `value` is:
@@ -1258,12 +1299,12 @@ for (const key of buf.keys()) {
 added: v6.0.0
 -->
 
-* `value` {String | Buffer | Integer} What to search for
-* `byteOffset` {Integer} Where to begin searching in `buf`.
+* `value` {string | Buffer | integer} What to search for
+* `byteOffset` {integer} Where to begin searching in `buf`.
   **Default:** [`buf.length`]` - 1`
-* `encoding` {String} If `value` is a string, this is its encoding.
+* `encoding` {string} If `value` is a string, this is its encoding.
   **Default:** `'utf8'`
-* Returns: {Integer} The index of the last occurrence of `value` in `buf` or `-1`
+* Returns: {integer} The index of the last occurrence of `value` in `buf` or `-1`
   if `buf` does not contain `value`
 
 Identical to [`buf.indexOf()`], except `buf` is searched from back to front
@@ -1338,7 +1379,7 @@ console.log(b.lastIndexOf('b', []));
 added: v0.1.90
 -->
 
-* {Integer}
+* {integer}
 
 Returns the amount of memory allocated for `buf` in bytes. Note that this
 does not necessarily reflect the amount of "usable" data within `buf`.
@@ -1384,9 +1425,9 @@ console.log(buf.length);
 added: v0.11.15
 -->
 
-* `offset` {Integer} Where to start reading. Must satisfy: `0 <= offset <= buf.length - 8`
-* `noAssert` {Boolean} Skip `offset` validation? **Default:** `false`
-* Returns: {Number}
+* `offset` {integer} Where to start reading. Must satisfy: `0 <= offset <= buf.length - 8`
+* `noAssert` {boolean} Skip `offset` validation? **Default:** `false`
+* Returns: {number}
 
 Reads a 64-bit double from `buf` at the specified `offset` with specified
 endian format (`readDoubleBE()` returns big endian, `readDoubleLE()` returns
@@ -1420,9 +1461,9 @@ console.log(buf.readDoubleLE(1, true));
 added: v0.11.15
 -->
 
-* `offset` {Integer} Where to start reading. Must satisfy: `0 <= offset <= buf.length - 4`
-* `noAssert` {Boolean} Skip `offset` validation? **Default:** `false`
-* Returns: {Number}
+* `offset` {integer} Where to start reading. Must satisfy: `0 <= offset <= buf.length - 4`
+* `noAssert` {boolean} Skip `offset` validation? **Default:** `false`
+* Returns: {number}
 
 Reads a 32-bit float from `buf` at the specified `offset` with specified
 endian format (`readFloatBE()` returns big endian, `readFloatLE()` returns
@@ -1455,9 +1496,9 @@ console.log(buf.readFloatLE(1, true));
 added: v0.5.0
 -->
 
-* `offset` {Integer} Where to start reading. Must satisfy: `0 <= offset <= buf.length - 1`
-* `noAssert` {Boolean} Skip `offset` validation? **Default:** `false`
-* Returns: {Integer}
+* `offset` {integer} Where to start reading. Must satisfy: `0 <= offset <= buf.length - 1`
+* `noAssert` {boolean} Skip `offset` validation? **Default:** `false`
+* Returns: {integer}
 
 Reads a signed 8-bit integer from `buf` at the specified `offset`.
 
@@ -1487,9 +1528,9 @@ console.log(buf.readInt8(2));
 added: v0.5.5
 -->
 
-* `offset` {Integer} Where to start reading. Must satisfy: `0 <= offset <= buf.length - 2`
-* `noAssert` {Boolean} Skip `offset` validation? **Default:** `false`
-* Returns: {Integer}
+* `offset` {integer} Where to start reading. Must satisfy: `0 <= offset <= buf.length - 2`
+* `noAssert` {boolean} Skip `offset` validation? **Default:** `false`
+* Returns: {integer}
 
 Reads a signed 16-bit integer from `buf` at the specified `offset` with
 the specified endian format (`readInt16BE()` returns big endian,
@@ -1521,9 +1562,9 @@ console.log(buf.readInt16LE(1));
 added: v0.5.5
 -->
 
-* `offset` {Integer} Where to start reading. Must satisfy: `0 <= offset <= buf.length - 4`
-* `noAssert` {Boolean} Skip `offset` validation? **Default:** `false`
-* Returns: {Integer}
+* `offset` {integer} Where to start reading. Must satisfy: `0 <= offset <= buf.length - 4`
+* `noAssert` {boolean} Skip `offset` validation? **Default:** `false`
+* Returns: {integer}
 
 Reads a signed 32-bit integer from `buf` at the specified `offset` with
 the specified endian format (`readInt32BE()` returns big endian,
@@ -1555,10 +1596,10 @@ console.log(buf.readInt32LE(1));
 added: v0.11.15
 -->
 
-* `offset` {Integer} Where to start reading. Must satisfy: `0 <= offset <= buf.length - byteLength`
-* `byteLength` {Integer} How many bytes to read. Must satisfy: `0 < byteLength <= 6`
-* `noAssert` {Boolean} Skip `offset` and `byteLength` validation? **Default:** `false`
-* Returns: {Integer}
+* `offset` {integer} Where to start reading. Must satisfy: `0 <= offset <= buf.length - byteLength`
+* `byteLength` {integer} How many bytes to read. Must satisfy: `0 < byteLength <= 6`
+* `noAssert` {boolean} Skip `offset` and `byteLength` validation? **Default:** `false`
+* Returns: {integer}
 
 Reads `byteLength` number of bytes from `buf` at the specified `offset`
 and interprets the result as a two's complement signed value. Supports up to 48
@@ -1587,9 +1628,9 @@ console.log(buf.readIntBE(1, 6).toString(16));
 added: v0.5.0
 -->
 
-* `offset` {Integer} Where to start reading. Must satisfy: `0 <= offset <= buf.length - 1`
-* `noAssert` {Boolean} Skip `offset` validation? **Default:** `false`
-* Returns: {Integer}
+* `offset` {integer} Where to start reading. Must satisfy: `0 <= offset <= buf.length - 1`
+* `noAssert` {boolean} Skip `offset` validation? **Default:** `false`
+* Returns: {integer}
 
 Reads an unsigned 8-bit integer from `buf` at the specified `offset`.
 
@@ -1617,9 +1658,9 @@ console.log(buf.readUInt8(2));
 added: v0.5.5
 -->
 
-* `offset` {Integer} Where to start reading. Must satisfy: `0 <= offset <= buf.length - 2`
-* `noAssert` {Boolean} Skip `offset` validation? **Default:** `false`
-* Returns: {Integer}
+* `offset` {integer} Where to start reading. Must satisfy: `0 <= offset <= buf.length - 2`
+* `noAssert` {boolean} Skip `offset` validation? **Default:** `false`
+* Returns: {integer}
 
 Reads an unsigned 16-bit integer from `buf` at the specified `offset` with
 specified endian format (`readUInt16BE()` returns big endian, `readUInt16LE()`
@@ -1655,9 +1696,9 @@ console.log(buf.readUInt16LE(2).toString(16));
 added: v0.5.5
 -->
 
-* `offset` {Integer} Where to start reading. Must satisfy: `0 <= offset <= buf.length - 4`
-* `noAssert` {Boolean} Skip `offset` validation? **Default:** `false`
-* Returns: {Integer}
+* `offset` {integer} Where to start reading. Must satisfy: `0 <= offset <= buf.length - 4`
+* `noAssert` {boolean} Skip `offset` validation? **Default:** `false`
+* Returns: {integer}
 
 Reads an unsigned 32-bit integer from `buf` at the specified `offset` with
 specified endian format (`readUInt32BE()` returns big endian,
@@ -1687,10 +1728,10 @@ console.log(buf.readUInt32LE(1).toString(16));
 added: v0.11.15
 -->
 
-* `offset` {Integer} Where to start reading. Must satisfy: `0 <= offset <= buf.length - byteLength`
-* `byteLength` {Integer} How many bytes to read. Must satisfy: `0 < byteLength <= 6`
-* `noAssert` {Boolean} Skip `offset` and `byteLength` validation? **Default:** `false`
-* Returns: {Integer}
+* `offset` {integer} Where to start reading. Must satisfy: `0 <= offset <= buf.length - byteLength`
+* `byteLength` {integer} How many bytes to read. Must satisfy: `0 < byteLength <= 6`
+* `noAssert` {boolean} Skip `offset` and `byteLength` validation? **Default:** `false`
+* Returns: {integer}
 
 Reads `byteLength` number of bytes from `buf` at the specified `offset`
 and interprets the result as an unsigned integer. Supports up to 48
@@ -1719,8 +1760,8 @@ console.log(buf.readUIntBE(1, 6).toString(16));
 added: v0.3.0
 -->
 
-* `start` {Integer} Where the new `Buffer` will start. **Default:** `0`
-* `end` {Integer} Where the new `Buffer` will end (not inclusive).
+* `start` {integer} Where the new `Buffer` will start. **Default:** `0`
+* `end` {integer} Where the new `Buffer` will end (not inclusive).
   **Default:** [`buf.length`]
 * Returns: {Buffer}
 
@@ -1871,11 +1912,11 @@ for working with 64-bit floats.
 added: v0.1.90
 -->
 
-* `encoding` {String} The character encoding to decode to. **Default:** `'utf8'`
-* `start` {Integer} The byte offset to start decoding at. **Default:** `0`
-* `end` {Integer} The byte offset to stop decoding at (not inclusive).
+* `encoding` {string} The character encoding to decode to. **Default:** `'utf8'`
+* `start` {integer} The byte offset to start decoding at. **Default:** `0`
+* `end` {integer} The byte offset to stop decoding at (not inclusive).
   **Default:** [`buf.length`]
-* Returns: {String}
+* Returns: {string}
 
 Decodes `buf` to a string according to the specified character encoding in
 `encoding`. `start` and `end` may be passed to decode only a subset of `buf`.
@@ -1981,11 +2022,11 @@ for (const value of buf) {
 added: v0.1.90
 -->
 
-* `string` {String} String to be written to `buf`
-* `offset` {Integer} Where to start writing `string`. **Default:** `0`
-* `length` {Integer} How many bytes to write. **Default:** `buf.length - offset`
-* `encoding` {String} The character encoding of `string`. **Default:** `'utf8'`
-* Returns: {Integer} Number of bytes written
+* `string` {string} String to be written to `buf`
+* `offset` {integer} Where to start writing `string`. **Default:** `0`
+* `length` {integer} How many bytes to write. **Default:** `buf.length - offset`
+* `encoding` {string} The character encoding of `string`. **Default:** `'utf8'`
+* Returns: {integer} Number of bytes written
 
 Writes `string` to `buf` at `offset` according to the character encoding in `encoding`.
 The `length` parameter is the number of bytes to write. If `buf` did not contain
@@ -2009,10 +2050,10 @@ console.log(`${len} bytes: ${buf.toString('utf8', 0, len)}`);
 added: v0.11.15
 -->
 
-* `value` {Number} Number to be written to `buf`
-* `offset` {Integer} Where to start writing. Must satisfy: `0 <= offset <= buf.length - 8`
-* `noAssert` {Boolean} Skip `value` and `offset` validation? **Default:** `false`
-* Returns: {Integer} `offset` plus the number of bytes written
+* `value` {number} Number to be written to `buf`
+* `offset` {integer} Where to start writing. Must satisfy: `0 <= offset <= buf.length - 8`
+* `noAssert` {boolean} Skip `value` and `offset` validation? **Default:** `false`
+* Returns: {integer} `offset` plus the number of bytes written
 
 Writes `value` to `buf` at the specified `offset` with specified endian
 format (`writeDoubleBE()` writes big endian, `writeDoubleLE()` writes little
@@ -2044,10 +2085,10 @@ console.log(buf);
 added: v0.11.15
 -->
 
-* `value` {Number} Number to be written to `buf`
-* `offset` {Integer} Where to start writing. Must satisfy: `0 <= offset <= buf.length - 4`
-* `noAssert` {Boolean} Skip `value` and `offset` validation? **Default:** `false`
-* Returns: {Integer} `offset` plus the number of bytes written
+* `value` {number} Number to be written to `buf`
+* `offset` {integer} Where to start writing. Must satisfy: `0 <= offset <= buf.length - 4`
+* `noAssert` {boolean} Skip `value` and `offset` validation? **Default:** `false`
+* Returns: {integer} `offset` plus the number of bytes written
 
 Writes `value` to `buf` at the specified `offset` with specified endian
 format (`writeFloatBE()` writes big endian, `writeFloatLE()` writes little
@@ -2078,10 +2119,10 @@ console.log(buf);
 added: v0.5.0
 -->
 
-* `value` {Integer} Number to be written to `buf`
-* `offset` {Integer} Where to start writing. Must satisfy: `0 <= offset <= buf.length - 1`
-* `noAssert` {Boolean} Skip `value` and `offset` validation? **Default:** `false`
-* Returns: {Integer} `offset` plus the number of bytes written
+* `value` {integer} Number to be written to `buf`
+* `offset` {integer} Where to start writing. Must satisfy: `0 <= offset <= buf.length - 1`
+* `noAssert` {boolean} Skip `value` and `offset` validation? **Default:** `false`
+* Returns: {integer} `offset` plus the number of bytes written
 
 Writes `value` to `buf` at the specified `offset`. `value` *should* be a valid
 signed 8-bit integer. Behavior is undefined when `value` is anything other than
@@ -2110,10 +2151,10 @@ console.log(buf);
 added: v0.5.5
 -->
 
-* `value` {Integer} Number to be written to `buf`
-* `offset` {Integer} Where to start writing. Must satisfy: `0 <= offset <= buf.length - 2`
-* `noAssert` {Boolean} Skip `value` and `offset` validation? **Default:** `false`
-* Returns: {Integer} `offset` plus the number of bytes written
+* `value` {integer} Number to be written to `buf`
+* `offset` {integer} Where to start writing. Must satisfy: `0 <= offset <= buf.length - 2`
+* `noAssert` {boolean} Skip `value` and `offset` validation? **Default:** `false`
+* Returns: {integer} `offset` plus the number of bytes written
 
 Writes `value` to `buf` at the specified `offset` with specified endian
 format (`writeInt16BE()` writes big endian, `writeInt16LE()` writes little
@@ -2143,10 +2184,10 @@ console.log(buf);
 added: v0.5.5
 -->
 
-* `value` {Integer} Number to be written to `buf`
-* `offset` {Integer} Where to start writing. Must satisfy: `0 <= offset <= buf.length - 4`
-* `noAssert` {Boolean} Skip `value` and `offset` validation? **Default:** `false`
-* Returns: {Integer} `offset` plus the number of bytes written
+* `value` {integer} Number to be written to `buf`
+* `offset` {integer} Where to start writing. Must satisfy: `0 <= offset <= buf.length - 4`
+* `noAssert` {boolean} Skip `value` and `offset` validation? **Default:** `false`
+* Returns: {integer} `offset` plus the number of bytes written
 
 Writes `value` to `buf` at the specified `offset` with specified endian
 format (`writeInt32BE()` writes big endian, `writeInt32LE()` writes little
@@ -2176,12 +2217,12 @@ console.log(buf);
 added: v0.11.15
 -->
 
-* `value` {Integer} Number to be written to `buf`
-* `offset` {Integer} Where to start writing. Must satisfy: `0 <= offset <= buf.length - byteLength`
-* `byteLength` {Integer} How many bytes to write. Must satisfy: `0 < byteLength <= 6`
-* `noAssert` {Boolean} Skip `value`, `offset`, and `byteLength` validation?
+* `value` {integer} Number to be written to `buf`
+* `offset` {integer} Where to start writing. Must satisfy: `0 <= offset <= buf.length - byteLength`
+* `byteLength` {integer} How many bytes to write. Must satisfy: `0 < byteLength <= 6`
+* `noAssert` {boolean} Skip `value`, `offset`, and `byteLength` validation?
   **Default:** `false`
-* Returns: {Integer} `offset` plus the number of bytes written
+* Returns: {integer} `offset` plus the number of bytes written
 
 Writes `byteLength` bytes of `value` to `buf` at the specified `offset`.
 Supports up to 48 bits of accuracy. Behavior is undefined when `value` is
@@ -2211,10 +2252,10 @@ console.log(buf);
 added: v0.5.0
 -->
 
-* `value` {Integer} Number to be written to `buf`
-* `offset` {Integer} Where to start writing. Must satisfy: `0 <= offset <= buf.length - 1`
-* `noAssert` {Boolean} Skip `value` and `offset` validation? **Default:** `false`
-* Returns: {Integer} `offset` plus the number of bytes written
+* `value` {integer} Number to be written to `buf`
+* `offset` {integer} Where to start writing. Must satisfy: `0 <= offset <= buf.length - 1`
+* `noAssert` {boolean} Skip `value` and `offset` validation? **Default:** `false`
+* Returns: {integer} `offset` plus the number of bytes written
 
 Writes `value` to `buf` at the specified `offset`. `value` *should* be a
 valid unsigned 8-bit integer. Behavior is undefined when `value` is anything
@@ -2243,10 +2284,10 @@ console.log(buf);
 added: v0.5.5
 -->
 
-* `value` {Integer} Number to be written to `buf`
-* `offset` {Integer} Where to start writing. Must satisfy: `0 <= offset <= buf.length - 2`
-* `noAssert` {Boolean} Skip `value` and `offset` validation? **Default:** `false`
-* Returns: {Integer} `offset` plus the number of bytes written
+* `value` {integer} Number to be written to `buf`
+* `offset` {integer} Where to start writing. Must satisfy: `0 <= offset <= buf.length - 2`
+* `noAssert` {boolean} Skip `value` and `offset` validation? **Default:** `false`
+* Returns: {integer} `offset` plus the number of bytes written
 
 Writes `value` to `buf` at the specified `offset` with specified endian
 format (`writeUInt16BE()` writes big endian, `writeUInt16LE()` writes little
@@ -2280,10 +2321,10 @@ console.log(buf);
 added: v0.5.5
 -->
 
-* `value` {Integer} Number to be written to `buf`
-* `offset` {Integer} Where to start writing. Must satisfy: `0 <= offset <= buf.length - 4`
-* `noAssert` {Boolean} Skip `value` and `offset` validation? **Default:** `false`
-* Returns: {Integer} `offset` plus the number of bytes written
+* `value` {integer} Number to be written to `buf`
+* `offset` {integer} Where to start writing. Must satisfy: `0 <= offset <= buf.length - 4`
+* `noAssert` {boolean} Skip `value` and `offset` validation? **Default:** `false`
+* Returns: {integer} `offset` plus the number of bytes written
 
 Writes `value` to `buf` at the specified `offset` with specified endian
 format (`writeUInt32BE()` writes big endian, `writeUInt32LE()` writes little
@@ -2315,12 +2356,12 @@ console.log(buf);
 added: v0.5.5
 -->
 
-* `value` {Integer} Number to be written to `buf`
-* `offset` {Integer} Where to start writing. Must satisfy: `0 <= offset <= buf.length - byteLength`
-* `byteLength` {Integer} How many bytes to write. Must satisfy: `0 < byteLength <= 6`
-* `noAssert` {Boolean} Skip `value`, `offset`, and `byteLength` validation?
+* `value` {integer} Number to be written to `buf`
+* `offset` {integer} Where to start writing. Must satisfy: `0 <= offset <= buf.length - byteLength`
+* `byteLength` {integer} How many bytes to write. Must satisfy: `0 < byteLength <= 6`
+* `noAssert` {boolean} Skip `value`, `offset`, and `byteLength` validation?
   **Default:** `false`
-* Returns: {Integer} `offset` plus the number of bytes written
+* Returns: {integer} `offset` plus the number of bytes written
 
 Writes `byteLength` bytes of `value` to `buf` at the specified `offset`.
 Supports up to 48 bits of accuracy. Behavior is undefined when `value` is
@@ -2350,7 +2391,7 @@ console.log(buf);
 added: v0.5.4
 -->
 
-* {Integer} **Default:** `50`
+* {integer} **Default:** `50`
 
 Returns the maximum number of bytes that will be returned when
 `buf.inspect()` is called. This can be overridden by user modules. See
@@ -2364,7 +2405,7 @@ Note that this is a property on the `buffer` module as returned by
 added: v3.0.0
 -->
 
-* {Integer} The largest size allowed for a single `Buffer` instance
+* {integer} The largest size allowed for a single `Buffer` instance
 
 On 32-bit architectures, this value is `(2^30)-1` (~1GB).
 On 64-bit architectures, this value is `(2^31)-1` (~2GB).
@@ -2416,7 +2457,7 @@ deprecated: v6.0.0
 
 > Stability: 0 - Deprecated: Use [`Buffer.allocUnsafeSlow()`] instead.
 
-* `size` {Integer} The desired length of the new `SlowBuffer`
+* `size` {integer} The desired length of the new `SlowBuffer`
 
 Allocates a new `SlowBuffer` of `size` bytes. The `size` must be less than
 or equal to the value of [`buffer.kMaxLength`]. Otherwise, a [`RangeError`] is
diff --git a/doc/api/child_process.md b/doc/api/child_process.md
index d7a94e7debb2ec..21fb32c1ae0596 100644
--- a/doc/api/child_process.md
+++ b/doc/api/child_process.md
@@ -125,25 +125,25 @@ exec('"my script.cmd" a b', (err, stdout, stderr) => {
 added: v0.1.90
 -->
 
-* `command` {String} The command to run, with space-separated arguments
+* `command` {string} The command to run, with space-separated arguments
 * `options` {Object}
-  * `cwd` {String} Current working directory of the child process
+  * `cwd` {string} Current working directory of the child process
   * `env` {Object} Environment key-value pairs
-  * `encoding` {String} (Default: `'utf8'`)
-  * `shell` {String} Shell to execute the command with
+  * `encoding` {string} (Default: `'utf8'`)
+  * `shell` {string} Shell to execute the command with
     (Default: `'/bin/sh'` on UNIX, `'cmd.exe'` on Windows, The shell should
      understand the `-c` switch on UNIX or `/s /c` on Windows. On Windows,
      command line parsing should be compatible with `cmd.exe`.)
-  * `timeout` {Number} (Default: `0`)
-  * [`maxBuffer`][] {Number} largest amount of data (in bytes) allowed on
+  * `timeout` {number} (Default: `0`)
+  * [`maxBuffer`][] {number} largest amount of data (in bytes) allowed on
     stdout or stderr - if exceeded child process is killed (Default: `200*1024`)
-  * `killSignal` {String|Integer} (Default: `'SIGTERM'`)
-  * `uid` {Number} Sets the user identity of the process. (See setuid(2).)
-  * `gid` {Number} Sets the group identity of the process. (See setgid(2).)
+  * `killSignal` {string|integer} (Default: `'SIGTERM'`)
+  * `uid` {number} Sets the user identity of the process. (See setuid(2).)
+  * `gid` {number} Sets the group identity of the process. (See setgid(2).)
 * `callback` {Function} called with the output when process terminates
   * `error` {Error}
-  * `stdout` {String|Buffer}
-  * `stderr` {String|Buffer}
+  * `stdout` {string|Buffer}
+  * `stderr` {string|Buffer}
 * Returns: {ChildProcess}
 
 Spawns a shell then executes the `command` within that shell, buffering any
@@ -205,22 +205,22 @@ replace the existing process and uses a shell to execute the command.*
 added: v0.1.91
 -->
 
-* `file` {String} The name or path of the executable file to run
+* `file` {string} The name or path of the executable file to run
 * `args` {Array} List of string arguments
 * `options` {Object}
-  * `cwd` {String} Current working directory of the child process
+  * `cwd` {string} Current working directory of the child process
   * `env` {Object} Environment key-value pairs
-  * `encoding` {String} (Default: `'utf8'`)
-  * `timeout` {Number} (Default: `0`)
-  * [`maxBuffer`][] {Number} largest amount of data (in bytes) allowed on
+  * `encoding` {string} (Default: `'utf8'`)
+  * `timeout` {number} (Default: `0`)
+  * [`maxBuffer`][] {number} largest amount of data (in bytes) allowed on
     stdout or stderr - if exceeded child process is killed (Default: `200*1024`)
-  * `killSignal` {String|Integer} (Default: `'SIGTERM'`)
-  * `uid` {Number} Sets the user identity of the process. (See setuid(2).)
-  * `gid` {Number} Sets the group identity of the process. (See setgid(2).)
+  * `killSignal` {string|integer} (Default: `'SIGTERM'`)
+  * `uid` {number} Sets the user identity of the process. (See setuid(2).)
+  * `gid` {number} Sets the group identity of the process. (See setgid(2).)
 * `callback` {Function} called with the output when process terminates
   * `error` {Error}
-  * `stdout` {String|Buffer}
-  * `stderr` {String|Buffer}
+  * `stdout` {string|Buffer}
+  * `stderr` {string|Buffer}
 * Returns: {ChildProcess}
 
 The `child_process.execFile()` function is similar to [`child_process.exec()`][]
@@ -253,15 +253,15 @@ encoding, `Buffer` objects will be passed to the callback instead.
 added: v0.5.0
 -->
 
-* `modulePath` {String} The module to run in the child
+* `modulePath` {string} The module to run in the child
 * `args` {Array} List of string arguments
 * `options` {Object}
-  * `cwd` {String} Current working directory of the child process
+  * `cwd` {string} Current working directory of the child process
   * `env` {Object} Environment key-value pairs
-  * `execPath` {String} Executable used to create the child process
+  * `execPath` {string} Executable used to create the child process
   * `execArgv` {Array} List of string arguments passed to the executable
     (Default: `process.execArgv`)
-  * `silent` {Boolean} If `true`, stdin, stdout, and stderr of the child will be
+  * `silent` {boolean} If `true`, stdin, stdout, and stderr of the child will be
     piped to the parent, otherwise they will be inherited from the parent, see
     the `'pipe'` and `'inherit'` options for [`child_process.spawn()`][]'s
     [`stdio`][] for more details (Default: `false`)
@@ -269,8 +269,8 @@ added: v0.5.0
     [`stdio`][] option. When this option is provided, it overrides `silent`.
     The array must contain exactly one item with value `'ipc'` or an error will
     be thrown. For instance `[0, 1, 2, 'ipc']`.
-  * `uid` {Number} Sets the user identity of the process. (See setuid(2).)
-  * `gid` {Number} Sets the group identity of the process. (See setgid(2).)
+  * `uid` {number} Sets the user identity of the process. (See setuid(2).)
+  * `gid` {number} Sets the group identity of the process. (See setgid(2).)
 * Returns: {ChildProcess}
 
 The `child_process.fork()` method is a special case of
@@ -304,21 +304,21 @@ not clone the current process.*
 added: v0.1.90
 -->
 
-* `command` {String} The command to run
+* `command` {string} The command to run
 * `args` {Array} List of string arguments
 * `options` {Object}
-  * `cwd` {String} Current working directory of the child process
+  * `cwd` {string} Current working directory of the child process
   * `env` {Object} Environment key-value pairs
-  * `argv0` {String} Explicitly set the value of `argv[0]` sent to the child
+  * `argv0` {string} Explicitly set the value of `argv[0]` sent to the child
     process. This will be set to `command` if not specified.
-  * `stdio` {Array|String} Child's stdio configuration. (See
+  * `stdio` {Array|string} Child's stdio configuration. (See
     [`options.stdio`][`stdio`])
-  * `detached` {Boolean} Prepare child to run independently of its parent
+  * `detached` {boolean} Prepare child to run independently of its parent
     process. Specific behavior depends on the platform, see
     [`options.detached`][])
-  * `uid` {Number} Sets the user identity of the process. (See setuid(2).)
-  * `gid` {Number} Sets the group identity of the process. (See setgid(2).)
-  * `shell` {Boolean|String} If `true`, runs `command` inside of a shell. Uses
+  * `uid` {number} Sets the user identity of the process. (See setuid(2).)
+  * `gid` {number} Sets the group identity of the process. (See setgid(2).)
+  * `shell` {boolean|string} If `true`, runs `command` inside of a shell. Uses
     `'/bin/sh'` on UNIX, and `'cmd.exe'` on Windows. A different shell can be
     specified as a string. The shell should understand the `-c` switch on UNIX,
     or `/s /c` on Windows. Defaults to `false` (no shell).
@@ -576,27 +576,27 @@ configuration at startup.
 added: v0.11.12
 -->
 
-* `file` {String} The name or path of the executable file to run
+* `file` {string} The name or path of the executable file to run
 * `args` {Array} List of string arguments
 * `options` {Object}
-  * `cwd` {String} Current working directory of the child process
-  * `input` {String|Buffer} The value which will be passed as stdin to the
+  * `cwd` {string} Current working directory of the child process
+  * `input` {string|Buffer} The value which will be passed as stdin to the
     spawned process
     - supplying this value will override `stdio[0]`
-  * `stdio` {String | Array} Child's stdio configuration. (Default: `'pipe'`)
+  * `stdio` {string|Array} Child's stdio configuration. (Default: `'pipe'`)
     - `stderr` by default will be output to the parent process' stderr unless
       `stdio` is specified
   * `env` {Object} Environment key-value pairs
-  * `uid` {Number} Sets the user identity of the process. (See setuid(2).)
-  * `gid` {Number} Sets the group identity of the process. (See setgid(2).)
-  * `timeout` {Number} In milliseconds the maximum amount of time the process
+  * `uid` {number} Sets the user identity of the process. (See setuid(2).)
+  * `gid` {number} Sets the group identity of the process. (See setgid(2).)
+  * `timeout` {number} In milliseconds the maximum amount of time the process
     is allowed to run. (Default: `undefined`)
-  * `killSignal` {String|Integer} The signal value to be used when the spawned
+  * `killSignal` {string|integer} The signal value to be used when the spawned
     process will be killed. (Default: `'SIGTERM'`)
-  * [`maxBuffer`][] {Number} largest amount of data (in bytes) allowed on
+  * [`maxBuffer`][] {number} largest amount of data (in bytes) allowed on
     stdout or stderr - if exceeded child process is killed
-  * `encoding` {String} The encoding used for all stdio inputs and outputs. (Default: `'buffer'`)
-* Returns: {Buffer|String} The stdout from the command
+  * `encoding` {string} The encoding used for all stdio inputs and outputs. (Default: `'buffer'`)
+* Returns: {Buffer|string} The stdout from the command
 
 The `child_process.execFileSync()` method is generally identical to
 [`child_process.execFile()`][] with the exception that the method will not return
@@ -615,31 +615,31 @@ throw.  The [`Error`][] object will contain the entire result from
 added: v0.11.12
 -->
 
-* `command` {String} The command to run
+* `command` {string} The command to run
 * `options` {Object}
-  * `cwd` {String} Current working directory of the child process
-  * `input` {String|Buffer} The value which will be passed as stdin to the
+  * `cwd` {string} Current working directory of the child process
+  * `input` {string|Buffer} The value which will be passed as stdin to the
     spawned process
     - supplying this value will override `stdio[0]`
-  * `stdio` {String | Array} Child's stdio configuration. (Default: `'pipe'`)
+  * `stdio` {string|Array} Child's stdio configuration. (Default: `'pipe'`)
     - `stderr` by default will be output to the parent process' stderr unless
       `stdio` is specified
   * `env` {Object} Environment key-value pairs
-  * `shell` {String} Shell to execute the command with
+  * `shell` {string} Shell to execute the command with
     (Default: `'/bin/sh'` on UNIX, `'cmd.exe'` on Windows, The shell should
      understand the `-c` switch on UNIX or `/s /c` on Windows. On Windows,
      command line parsing should be compatible with `cmd.exe`.)
-  * `uid` {Number} Sets the user identity of the process. (See setuid(2).)
-  * `gid` {Number} Sets the group identity of the process. (See setgid(2).)
-  * `timeout` {Number} In milliseconds the maximum amount of time the process
+  * `uid` {number} Sets the user identity of the process. (See setuid(2).)
+  * `gid` {number} Sets the group identity of the process. (See setgid(2).)
+  * `timeout` {number} In milliseconds the maximum amount of time the process
     is allowed to run. (Default: `undefined`)
-  * `killSignal` {String|Integer} The signal value to be used when the spawned
+  * `killSignal` {string|integer} The signal value to be used when the spawned
     process will be killed. (Default: `'SIGTERM'`)
-  * [`maxBuffer`][] {Number} largest amount of data (in bytes) allowed on
+  * [`maxBuffer`][] {number} largest amount of data (in bytes) allowed on
     stdout or stderr - if exceeded child process is killed
-  * `encoding` {String} The encoding used for all stdio inputs and outputs.
+  * `encoding` {string} The encoding used for all stdio inputs and outputs.
     (Default: `'buffer'`)
-* Returns: {Buffer|String} The stdout from the command
+* Returns: {Buffer|string} The stdout from the command
 
 The `child_process.execSync()` method is generally identical to
 [`child_process.exec()`][] with the exception that the method will not return until
@@ -662,36 +662,36 @@ execution.**
 added: v0.11.12
 -->
 
-* `command` {String} The command to run
+* `command` {string} The command to run
 * `args` {Array} List of string arguments
 * `options` {Object}
-  * `cwd` {String} Current working directory of the child process
-  * `input` {String|Buffer} The value which will be passed as stdin to the
+  * `cwd` {string} Current working directory of the child process
+  * `input` {string|Buffer} The value which will be passed as stdin to the
     spawned process
     - supplying this value will override `stdio[0]`
-  * `stdio` {String | Array} Child's stdio configuration.
+  * `stdio` {string|Array} Child's stdio configuration.
   * `env` {Object} Environment key-value pairs
-  * `uid` {Number} Sets the user identity of the process. (See setuid(2).)
-  * `gid` {Number} Sets the group identity of the process. (See setgid(2).)
-  * `timeout` {Number} In milliseconds the maximum amount of time the process
+  * `uid` {number} Sets the user identity of the process. (See setuid(2).)
+  * `gid` {number} Sets the group identity of the process. (See setgid(2).)
+  * `timeout` {number} In milliseconds the maximum amount of time the process
     is allowed to run. (Default: `undefined`)
-  * `killSignal` {String|Integer} The signal value to be used when the spawned
+  * `killSignal` {string|integer} The signal value to be used when the spawned
     process will be killed. (Default: `'SIGTERM'`)
-  * [`maxBuffer`][] {Number} largest amount of data (in bytes) allowed on
+  * [`maxBuffer`][] {number} largest amount of data (in bytes) allowed on
     stdout or stderr - if exceeded child process is killed
-  * `encoding` {String} The encoding used for all stdio inputs and outputs.
+  * `encoding` {string} The encoding used for all stdio inputs and outputs.
     (Default: `'buffer'`)
-  * `shell` {Boolean|String} If `true`, runs `command` inside of a shell. Uses
+  * `shell` {boolean|string} If `true`, runs `command` inside of a shell. Uses
     `'/bin/sh'` on UNIX, and `'cmd.exe'` on Windows. A different shell can be
     specified as a string. The shell should understand the `-c` switch on UNIX,
     or `/s /c` on Windows. Defaults to `false` (no shell).
 * Returns: {Object}
-  * `pid` {Number} Pid of the child process
+  * `pid` {number} Pid of the child process
   * `output` {Array} Array of results from stdio output
-  * `stdout` {Buffer|String} The contents of `output[1]`
-  * `stderr` {Buffer|String} The contents of `output[2]`
-  * `status` {Number} The exit code of the child process
-  * `signal` {String} The signal used to kill the child process
+  * `stdout` {Buffer|string} The contents of `output[1]`
+  * `stderr` {Buffer|string} The contents of `output[2]`
+  * `status` {number} The exit code of the child process
+  * `signal` {string} The signal used to kill the child process
   * `error` {Error} The error object if the child process failed or timed out
 
 The `child_process.spawnSync()` method is generally identical to
@@ -724,8 +724,8 @@ instances of `ChildProcess`.
 added: v0.7.7
 -->
 
-* `code` {Number} the exit code if the child exited on its own.
-* `signal` {String} the signal by which the child process was terminated.
+* `code` {number} the exit code if the child exited on its own.
+* `signal` {string} the signal by which the child process was terminated.
 
 The `'close'` event is emitted when the stdio streams of a child process have
 been closed. This is distinct from the [`'exit'`][] event, since multiple
@@ -762,8 +762,8 @@ See also [`child.kill()`][] and [`child.send()`][].
 added: v0.1.90
 -->
 
-* `code` {Number} the exit code if the child exited on its own.
-* `signal` {String} the signal by which the child process was terminated.
+* `code` {number} the exit code if the child exited on its own.
+* `signal` {string} the signal by which the child process was terminated.
 
 The `'exit'` event is emitted after the child process ends. If the process
 exited, `code` is the final exit code of the process, otherwise `null`. If the
@@ -797,7 +797,7 @@ to send messages.
 added: v0.7.2
 -->
 
-* {Boolean} Set to `false` after `child.disconnect()` is called
+* {boolean} Set to `false` after `child.disconnect()` is called
 
 The `child.connected` property indicates whether it is still possible to send
 and receive messages from a child process. When `child.connected` is `false`, it
@@ -827,7 +827,7 @@ within the child process to close the IPC channel as well.
 added: v0.1.90
 -->
 
-* `signal` {String}
+* `signal` {string}
 
 The `child.kill()` methods sends a signal to the child process. If no argument
 is given, the process will be sent the `'SIGTERM'` signal. See signal(7) for
@@ -884,7 +884,7 @@ setTimeout(() => {
 added: v0.1.90
 -->
 
-* {Number} Integer
+* {number} Integer
 
 Returns the process identifier (PID) of the child process.
 
@@ -907,7 +907,7 @@ added: v0.5.9
 * `sendHandle` {Handle}
 * `options` {Object}
 * `callback` {Function}
-* Returns: {Boolean}
+* Returns: {boolean}
 
 When an IPC channel has been established between the parent and child (
 i.e. when using [`child_process.fork()`][]), the `child.send()` method can be
diff --git a/doc/api/cluster.md b/doc/api/cluster.md
index 01a2aaf6a8cc86..bdf58e2b45f279 100644
--- a/doc/api/cluster.md
+++ b/doc/api/cluster.md
@@ -148,8 +148,8 @@ In a worker you can also use `process.on('error')`.
 added: v0.11.2
 -->
 
-* `code` {Number} the exit code, if it exited normally.
-* `signal` {String} the name of the signal (e.g. `'SIGHUP'`) that caused
+* `code` {number} the exit code, if it exited normally.
+* `signal` {string} the name of the signal (e.g. `'SIGHUP'`) that caused
   the process to be killed.
 
 Similar to the `cluster.on('exit')` event, but specific to this worker.
@@ -328,7 +328,7 @@ if (cluster.isMaster) {
 added: v6.0.0
 -->
 
-* {Boolean}
+* {boolean}
 
 Set by calling `.kill()` or `.disconnect()`. Until then, it is `undefined`.
 
@@ -352,7 +352,7 @@ worker.kill();
 added: v0.8.0
 -->
 
-* {Number}
+* {number}
 
 Each new worker is given its own unique id, this id is stored in the
 `id`.
@@ -382,7 +382,7 @@ because of exiting or being signaled). Otherwise, it returns `false`.
 added: v0.9.12
 -->
 
-* `signal` {String} Name of the kill signal to send to the worker
+* `signal` {string} Name of the kill signal to send to the worker
   process.
 
 This function will kill the worker. In the master, it does this by disconnecting
@@ -502,8 +502,8 @@ added: v0.7.9
 -->
 
 * `worker` {cluster.Worker}
-* `code` {Number} the exit code, if it exited normally.
-* `signal` {String} the name of the signal (e.g. `'SIGHUP'`) that caused
+* `code` {number} the exit code, if it exited normally.
+* `signal` {string} the name of the signal (e.g. `'SIGHUP'`) that caused
   the process to be killed.
 
 When any of the workers die the cluster module will emit the `'exit'` event.
@@ -672,7 +672,7 @@ This can only be called from the master process.
 added: v0.8.1
 -->
 
-* {Boolean}
+* {boolean}
 
 True if the process is a master. This is determined
 by the `process.env.NODE_UNIQUE_ID`. If `process.env.NODE_UNIQUE_ID` is
@@ -683,7 +683,7 @@ undefined, then `isMaster` is `true`.
 added: v0.6.0
 -->
 
-* {Boolean}
+* {boolean}
 
 True if the process is not a master (it is the negation of `cluster.isMaster`).
 
@@ -713,16 +713,16 @@ added: v0.7.1
 * {Object}
   * `execArgv` {Array} list of string arguments passed to the Node.js
     executable. (Default=`process.execArgv`)
-  * `exec` {String} file path to worker file.  (Default=`process.argv[1]`)
+  * `exec` {string} file path to worker file.  (Default=`process.argv[1]`)
   * `args` {Array} string arguments passed to worker.
     (Default=`process.argv.slice(2)`)
-  * `silent` {Boolean} whether or not to send output to parent's stdio.
+  * `silent` {boolean} whether or not to send output to parent's stdio.
     (Default=`false`)
   * `stdio` {Array} Configures the stdio of forked processes. Because the
     cluster module relies on IPC to function, this configuration must contain an
     `'ipc'` entry. When this option is provided, it overrides `silent`.
-  * `uid` {Number} Sets the user identity of the process. (See setuid(2).)
-  * `gid` {Number} Sets the group identity of the process. (See setgid(2).)
+  * `uid` {number} Sets the user identity of the process. (See setuid(2).)
+  * `gid` {number} Sets the group identity of the process. (See setgid(2).)
 
 After calling `.setupMaster()` (or `.fork()`) this settings object will contain
 the settings, including the default values.
@@ -735,10 +735,10 @@ added: v0.7.1
 -->
 
 * `settings` {Object}
-  * `exec` {String} file path to worker file.  (Default=`process.argv[1]`)
+  * `exec` {string} file path to worker file.  (Default=`process.argv[1]`)
   * `args` {Array} string arguments passed to worker.
     (Default=`process.argv.slice(2)`)
-  * `silent` {Boolean} whether or not to send output to parent's stdio.
+  * `silent` {boolean} whether or not to send output to parent's stdio.
     (Default=`false`)
   * `stdio` {Array} Configures the stdio of forked processes. When this option
     is provided, it overrides `silent`.
diff --git a/doc/api/console.md b/doc/api/console.md
index 7bc54641a21714..4813988d77b978 100644
--- a/doc/api/console.md
+++ b/doc/api/console.md
@@ -155,6 +155,11 @@ console.log('this will also print');
 <!-- YAML
 added: v0.1.101
 -->
+* `obj` {any}
+* `options` {Object}
+  * `showHidden` {boolean}
+  * `depth` {number}
+  * `colors` {boolean}
 
 Uses [`util.inspect()`][] on `obj` and prints the resulting string to `stdout`.
 This function bypasses any custom `inspect()` function defined on `obj`. An
@@ -227,6 +232,7 @@ values are concatenated. See [`util.format()`][] for more information.
 <!-- YAML
 added: v0.1.104
 -->
+* `label` {string}
 
 Starts a timer that can be used to compute the duration of an operation. Timers
 are identified by a unique `label`. Use the same `label` when you call
@@ -237,6 +243,7 @@ milliseconds to `stdout`. Timer durations are accurate to the sub-millisecond.
 <!-- YAML
 added: v0.1.104
 -->
+* `label` {string}
 
 Stops a timer that was previously started by calling [`console.time()`][] and
 prints the result to `stdout`:
diff --git a/doc/api/crypto.md b/doc/api/crypto.md
index 17d273d115cea4..7b4a483b11e719 100644
--- a/doc/api/crypto.md
+++ b/doc/api/crypto.md
@@ -901,8 +901,8 @@ The `private_key` argument can be an object or a string. If `private_key` is a
 string, it is treated as a raw key with no passphrase. If `private_key` is an
 object, it is interpreted as a hash containing two properties:
 
-* `key` : {String} - PEM encoded private key
-* `passphrase` : {String} - passphrase for the private key
+* `key`: {string} - PEM encoded private key
+* `passphrase`: {string} - passphrase for the private key
 
 The `output_format` can specify one of `'latin1'`, `'hex'` or `'base64'`. If
 `output_format` is provided a string is returned; otherwise a [`Buffer`][] is
@@ -1410,8 +1410,8 @@ treated as the key with no passphrase and will use `RSA_PKCS1_OAEP_PADDING`.
 If `private_key` is an object, it is interpreted as a hash object with the
 keys:
 
-* `key` : {String} - PEM encoded private key
-* `passphrase` : {String} - Optional passphrase for the private key
+* `key`: {string} - PEM encoded private key
+* `passphrase`: {string} - Optional passphrase for the private key
 * `padding` : An optional padding value, one of the following:
   * `crypto.constants.RSA_NO_PADDING`
   * `crypto.constants.RSA_PKCS1_PADDING`
@@ -1447,8 +1447,8 @@ treated as the key with no passphrase and will use `RSA_PKCS1_PADDING`.
 If `private_key` is an object, it is interpreted as a hash object with the
 keys:
 
-* `key` : {String} - PEM encoded private key
-* `passphrase` : {String} - Optional passphrase for the private key
+* `key`: {string} - PEM encoded private key
+* `passphrase`: {string} - Optional passphrase for the private key
 * `padding` : An optional padding value, one of the following:
   * `crypto.constants.RSA_NO_PADDING`
   * `crypto.constants.RSA_PKCS1_PADDING`
@@ -1467,8 +1467,8 @@ treated as the key with no passphrase and will use `RSA_PKCS1_PADDING`.
 If `public_key` is an object, it is interpreted as a hash object with the
 keys:
 
-* `key` : {String} - PEM encoded public key
-* `passphrase` : {String} - Optional passphrase for the private key
+* `key`: {string} - PEM encoded public key
+* `passphrase`: {string} - Optional passphrase for the private key
 * `padding` : An optional padding value, one of the following:
   * `crypto.constants.RSA_NO_PADDING`
   * `crypto.constants.RSA_PKCS1_PADDING`
@@ -1491,8 +1491,8 @@ treated as the key with no passphrase and will use `RSA_PKCS1_OAEP_PADDING`.
 If `public_key` is an object, it is interpreted as a hash object with the
 keys:
 
-* `key` : {String} - PEM encoded public key
-* `passphrase` : {String} - Optional passphrase for the private key
+* `key`: {string} - PEM encoded public key
+* `passphrase`: {string} - Optional passphrase for the private key
 * `padding` : An optional padding value, one of the following:
   * `crypto.constants.RSA_NO_PADDING`
   * `crypto.constants.RSA_PKCS1_PADDING`
diff --git a/doc/api/debugger.md b/doc/api/debugger.md
index 7112b403fe35f3..745c5ac5b451b9 100644
--- a/doc/api/debugger.md
+++ b/doc/api/debugger.md
@@ -11,10 +11,10 @@ will be displayed indicating successful launch of the debugger:
 
 ```txt
 $ node debug myscript.js
-< debugger listening on port 5858
-connecting... ok
+< Debugger listening on [::]:5858
+connecting to 127.0.0.1:5858 ... ok
 break in /home/indutny/Code/git/indutny/myscript.js:1
-  1 x = 5;
+> 1 global.x = 5;
   2 setTimeout(() => {
   3   debugger;
 debug>
@@ -28,7 +28,7 @@ enable a breakpoint at that position in the code:
 
 ```js
 // myscript.js
-x = 5;
+global.x = 5;
 setTimeout(() => {
   debugger;
   console.log('world');
@@ -36,29 +36,29 @@ setTimeout(() => {
 console.log('hello');
 ```
 
-Once the debugger is run, a breakpoint will occur at line 4:
+Once the debugger is run, a breakpoint will occur at line 3:
 
 ```txt
 $ node debug myscript.js
-< debugger listening on port 5858
-connecting... ok
+< Debugger listening on [::]:5858
+connecting to 127.0.0.1:5858 ... ok
 break in /home/indutny/Code/git/indutny/myscript.js:1
-  1 x = 5;
+> 1 global.x = 5;
   2 setTimeout(() => {
   3   debugger;
 debug> cont
 < hello
 break in /home/indutny/Code/git/indutny/myscript.js:3
-  1 x = 5;
+  1 global.x = 5;
   2 setTimeout(() => {
-  3   debugger;
+> 3   debugger;
   4   console.log('world');
   5 }, 1000);
 debug> next
 break in /home/indutny/Code/git/indutny/myscript.js:4
   2 setTimeout(() => {
   3   debugger;
-  4   console.log('world');
+> 4   console.log('world');
   5 }, 1000);
   6 console.log('hello');
 debug> repl
@@ -68,11 +68,11 @@ Press Ctrl + C to leave debug repl
 > 2+2
 4
 debug> next
-< world
 break in /home/indutny/Code/git/indutny/myscript.js:5
+< world
   3   debugger;
   4   console.log('world');
-  5 }, 1000);
+> 5 }, 1000);
   6 console.log('hello');
   7
 debug> quit
@@ -121,24 +121,26 @@ is not loaded yet:
 
 ```txt
 $ node debug test/fixtures/break-in-module/main.js
-< debugger listening on port 5858
-connecting to port 5858... ok
+< Debugger listening on [::]:5858
+connecting to 127.0.0.1:5858 ... ok
 break in test/fixtures/break-in-module/main.js:1
-  1 var mod = require('./mod.js');
+> 1 var mod = require('./mod.js');
   2 mod.hello();
   3 mod.hello();
-debug> setBreakpoint('mod.js', 23)
+debug> setBreakpoint('mod.js', 2)
 Warning: script 'mod.js' was not loaded yet.
-  1 var mod = require('./mod.js');
+> 1 var mod = require('./mod.js');
   2 mod.hello();
   3 mod.hello();
+  4 debugger;
+  5
+  6 });
 debug> c
-break in test/fixtures/break-in-module/mod.js:23
- 21
- 22 exports.hello = () => {
- 23   return 'hello from module';
- 24 };
- 25
+break in test/fixtures/break-in-module/mod.js:2
+  1 exports.hello = function() {
+> 2   return 'hello from module';
+  3 };
+  4
 debug>
 ```
 
@@ -198,7 +200,11 @@ $ node --inspect index.js
 Debugger listening on port 9229.
 Warning: This is an experimental feature and could change at any time.
 To start debugging, open the following URL in Chrome:
-    chrome-devtools://devtools/remote/serve_file/@60cd6e859b9f557d2312f5bf532f6aec5f284980/inspector.html?experiments=true&v8only=true&ws=localhost:9229/node
+    chrome-devtools://devtools/remote/serve_file/@60cd6e859b9f557d2312f5bf532f6aec5f284980/inspector.html?experiments=true&v8only=true&ws=127.0.0.1:9229/3a6d0a9e-0707-48f8-a7c6-48f157b67ab5
 ```
 
+(In the example above, the UUID 3a6d0a9e-0707-48f8-a7c6-48f157b67ab5
+at the end of the URL is generated on the fly, it varies in different
+debugging sessions.)
+
 [TCP-based protocol]: https://github.com/v8/v8/wiki/Debugging-Protocol
diff --git a/doc/api/dgram.md b/doc/api/dgram.md
index 2e214beb2ff7d2..2d996ce0c6b058 100644
--- a/doc/api/dgram.md
+++ b/doc/api/dgram.md
@@ -74,18 +74,18 @@ The `'message'` event is emitted when a new datagram is available on a socket.
 The event handler function is passed two arguments: `msg` and `rinfo`.
 * `msg` {Buffer} - The message
 * `rinfo` {Object} - Remote address information
-  * `address` {String} The sender address
-  * `family` {String} The address family (`'IPv4'` or `'IPv6'`)
-  * `port` {Number} The sender port
-  * `size` {Number} The message size
+  * `address` {string} The sender address
+  * `family` {string} The address family (`'IPv4'` or `'IPv6'`)
+  * `port` {number} The sender port
+  * `size` {number} The message size
 
 ### socket.addMembership(multicastAddress[, multicastInterface])
 <!-- YAML
 added: v0.6.9
 -->
 
-* `multicastAddress` {String}
-* `multicastInterface` {String}, Optional
+* `multicastAddress` {string}
+* `multicastInterface` {string}, Optional
 
 Tells the kernel to join a multicast group at the given `multicastAddress` and
 `multicastInterface` using the `IP_ADD_MEMBERSHIP` socket option. If the
@@ -107,8 +107,8 @@ properties.
 added: v0.1.99
 -->
 
-* `port` {Number} - Integer, Optional
-* `address` {String}, Optional
+* `port` {number} - Integer, Optional
+* `address` {string}, Optional
 * `callback` {Function} with no parameters, Optional. Called when
   binding is complete.
 
@@ -160,9 +160,9 @@ added: v0.11.14
 -->
 
 * `options` {Object} - Required. Supports the following properties:
-  * `port` {Number} - Optional.
-  * `address` {String} - Optional.
-  * `exclusive` {Boolean} - Optional.
+  * `port` {number} - Optional.
+  * `address` {string} - Optional.
+  * `exclusive` {boolean} - Optional.
 * `callback` {Function} - Optional.
 
 For UDP sockets, causes the `dgram.Socket` to listen for datagram
@@ -214,8 +214,8 @@ provided, it is added as a listener for the [`'close'`][] event.
 added: v0.6.9
 -->
 
-* `multicastAddress` {String}
-* `multicastInterface` {String}, Optional
+* `multicastAddress` {string}
+* `multicastInterface` {string}, Optional
 
 Instructs the kernel to leave a multicast group at `multicastAddress` using the
 `IP_DROP_MEMBERSHIP` socket option. This method is automatically called by the
@@ -230,11 +230,11 @@ drop membership on all valid interfaces.
 added: v0.1.99
 -->
 
-* `msg` {Buffer|String|Array} Message to be sent
-* `offset` {Number} Integer. Optional. Offset in the buffer where the message starts.
-* `length` {Number} Integer. Optional. Number of bytes in the message.
-* `port` {Number} Integer. Destination port.
-* `address` {String} Destination hostname or IP address.
+* `msg` {Buffer|string|array} Message to be sent
+* `offset` {number} Integer. Optional. Offset in the buffer where the message starts.
+* `length` {number} Integer. Optional. Number of bytes in the message.
+* `port` {number} Integer. Destination port.
+* `address` {string} Destination hostname or IP address.
 * `callback` {Function} Called when the message has been sent. Optional.
 
 Broadcasts a datagram on the socket. The destination `port` and `address` must
@@ -330,7 +330,7 @@ source that the data did not reach its intended recipient.
 added: v0.6.9
 -->
 
-* `flag` {Boolean}
+* `flag` {boolean}
 
 Sets or clears the `SO_BROADCAST` socket option.  When set to `true`, UDP
 packets may be sent to a local interface's broadcast address.
@@ -340,7 +340,7 @@ packets may be sent to a local interface's broadcast address.
 added: v0.3.8
 -->
 
-* `flag` {Boolean}
+* `flag` {boolean}
 
 Sets or clears the `IP_MULTICAST_LOOP` socket option.  When set to `true`,
 multicast packets will also be received on the local interface.
@@ -350,7 +350,7 @@ multicast packets will also be received on the local interface.
 added: v0.3.8
 -->
 
-* `ttl` {Number} Integer
+* `ttl` {number} Integer
 
 Sets the `IP_MULTICAST_TTL` socket option.  While TTL generally stands for
 "Time to Live", in this context it specifies the number of IP hops that a
@@ -366,7 +366,7 @@ between 0 and 255. The default on most systems is `1` but can vary.
 added: v0.1.101
 -->
 
-* `ttl` {Number} Integer
+* `ttl` {number} Integer
 
 Sets the `IP_TTL` socket option. While TTL generally stands for "Time to Live",
 in this context it specifies the number of IP hops that a packet is allowed to
@@ -463,7 +463,7 @@ and `udp6` sockets). The bound address and port can be retrieved using
 added: v0.1.99
 -->
 
-* `type` {String} - Either 'udp4' or 'udp6'
+* `type` {string} - Either 'udp4' or 'udp6'
 * `callback` {Function} - Attached as a listener to `'message'` events.
   Optional
 * Returns: {dgram.Socket}
diff --git a/doc/api/dns.md b/doc/api/dns.md
index cdb468de232136..9c78ddd6545c75 100644
--- a/doc/api/dns.md
+++ b/doc/api/dns.md
@@ -74,15 +74,15 @@ an integer, then it must be `4` or `6`.
 
 Alternatively, `options` can be an object containing these properties:
 
-* `family` {Number} - The record family. If present, must be the integer
+* `family` {number} - The record family. If present, must be the integer
   `4` or `6`. If not provided, both IP v4 and v6 addresses are accepted.
-* `hints`: {Number} - If present, it should be one or more of the supported
+* `hints`: {number} - If present, it should be one or more of the supported
   `getaddrinfo` flags. If `hints` is not provided, then no flags are passed to
   `getaddrinfo`. Multiple flags can be passed through `hints` by bitwise
   `OR`ing their values.
   See [supported `getaddrinfo` flags][] for more information on supported
   flags.
-* `all`: {Boolean} - When `true`, the callback returns all resolved addresses
+* `all`: {boolean} - When `true`, the callback returns all resolved addresses
   in an array, otherwise returns a single address. Defaults to `false`.
 
 All properties are optional.
@@ -205,9 +205,9 @@ Uses the DNS protocol to resolve a IPv4 addresses (`A` records) for the
 will contain an array of IPv4 addresses (e.g.
 `['74.125.79.104', '74.125.79.105', '74.125.79.106']`).
 
-* `hostname` {String} Hostname to resolve.
+* `hostname` {string} Hostname to resolve.
 * `options` {Object}
-  * `ttl` {Boolean} Retrieve the Time-To-Live value (TTL) of each record.
+  * `ttl` {boolean} Retrieve the Time-To-Live value (TTL) of each record.
     The callback receives an array of `{ address: '1.2.3.4', ttl: 60 }` objects
     rather than an array of strings.  The TTL is expressed in seconds.
 * `callback` {Function} An `(err, result)` callback function.
@@ -221,9 +221,9 @@ Uses the DNS protocol to resolve a IPv6 addresses (`AAAA` records) for the
 `hostname`. The `addresses` argument passed to the `callback` function
 will contain an array of IPv6 addresses.
 
-* `hostname` {String} Hostname to resolve.
+* `hostname` {string} Hostname to resolve.
 * `options` {Object}
-  * `ttl` {Boolean} Retrieve the Time-To-Live value (TTL) of each record.
+  * `ttl` {boolean} Retrieve the Time-To-Live value (TTL) of each record.
     The callback receives an array of `{ address: '0:1:2:3:4:5:6:7', ttl: 60 }`
     objects rather than an array of strings.  The TTL is expressed in seconds.
 * `callback` {Function} An `(err, result)` callback function.
diff --git a/doc/api/errors.md b/doc/api/errors.md
index ea60f2b0e51ddb..9fc884b5625951 100644
--- a/doc/api/errors.md
+++ b/doc/api/errors.md
@@ -196,7 +196,7 @@ will either be instances of, or inherit from, the `Error` class.
 
 ### new Error(message)
 
-* `message` {String}
+* `message` {string}
 
 Creates a new `Error` object and sets the `error.message` property to the
 provided text message. If an object is passed as `message`, the text message
@@ -244,7 +244,7 @@ new MyError().stack;
 
 ### Error.stackTraceLimit
 
-* {Number}
+* {number}
 
 The `Error.stackTraceLimit` property specifies the number of stack frames
 collected by a stack trace (whether generated by `new Error().stack` or
@@ -258,7 +258,7 @@ not capture any frames.
 
 ### error.message
 
-* {String}
+* {string}
 
 The `error.message` property is the string description of the error as set by calling `new Error(message)`.
 The `message` passed to the constructor will also appear in the first line of
@@ -274,7 +274,7 @@ console.error(err.message);
 
 ### error.stack
 
-* {String}
+* {string}
 
 The `error.stack` property is a string describing the point in the code at which
 the `Error` was instantiated.
@@ -450,14 +450,14 @@ added properties.
 
 #### error.code
 
-* {String}
+* {string}
 
 The `error.code` property is a string representing the error code, which is always
 `E` followed by a sequence of capital letters.
 
 #### error.errno
 
-* {String | Number}
+* {string|number}
 
 The `error.errno` property is a number or a string.
 The number is a **negative** value which corresponds to the error code defined in
@@ -467,27 +467,27 @@ In case of a string, it is the same as `error.code`.
 
 #### error.syscall
 
-* {String}
+* {string}
 
 The `error.syscall` property is a string describing the [syscall][] that failed.
 
 #### error.path
 
-* {String}
+* {string}
 
 When present (e.g. in `fs` or `child_process`), the `error.path` property is a string
 containing a relevant invalid pathname.
 
 #### error.address
 
-* {String}
+* {string}
 
 When present (e.g. in `net` or `dgram`), the `error.address` property is a string
 describing the address to which the connection failed.
 
 #### error.port
 
-* {Number}
+* {number}
 
 When present (e.g. in `net` or `dgram`), the `error.port` property is a number representing
 the connection's port that is not available.
diff --git a/doc/api/events.md b/doc/api/events.md
index 8864e78d9fc4c7..7462902e09479a 100644
--- a/doc/api/events.md
+++ b/doc/api/events.md
@@ -185,7 +185,7 @@ added and `'removeListener'` when existing listeners are removed.
 added: v0.1.26
 -->
 
-* `eventName` {String|Symbol} The name of the event being listened for
+* `eventName` {string|symbol} The name of the event being listened for
 * `listener` {Function} The event handler function
 
 The `EventEmitter` instance will emit its own `'newListener'` event *before*
@@ -224,7 +224,7 @@ myEmitter.emit('event');
 added: v0.9.3
 -->
 
-* `eventName` {String|Symbol} The event name
+* `eventName` {string|symbol} The event name
 * `listener` {Function} The event handler function
 
 The `'removeListener'` event is emitted *after* the `listener` is removed.
@@ -339,7 +339,7 @@ set by [`emitter.setMaxListeners(n)`][] or defaults to
 added: v3.2.0
 -->
 
-* `eventName` {String|Symbol} The name of the event being listened for
+* `eventName` {string|symbol} The name of the event being listened for
 
 Returns the number of listeners listening to the event named `eventName`.
 
@@ -363,7 +363,7 @@ console.log(util.inspect(server.listeners('connection')));
 added: v0.1.101
 -->
 
-* `eventName` {String|Symbol} The name of the event.
+* `eventName` {string|symbol} The name of the event.
 * `listener` {Function} The callback function
 
 Adds the `listener` function to the end of the listeners array for the
@@ -399,7 +399,7 @@ myEE.emit('foo');
 added: v0.3.0
 -->
 
-* `eventName` {String|Symbol} The name of the event.
+* `eventName` {string|symbol} The name of the event.
 * `listener` {Function} The callback function
 
 Adds a **one time** `listener` function for the event named `eventName`. The
@@ -432,7 +432,7 @@ myEE.emit('foo');
 added: v6.0.0
 -->
 
-* `eventName` {String|Symbol} The name of the event.
+* `eventName` {string|symbol} The name of the event.
 * `listener` {Function} The callback function
 
 Adds the `listener` function to the *beginning* of the listeners array for the
@@ -454,7 +454,7 @@ Returns a reference to the `EventEmitter`, so that calls can be chained.
 added: v6.0.0
 -->
 
-* `eventName` {String|Symbol} The name of the event.
+* `eventName` {string|symbol} The name of the event.
 * `listener` {Function} The callback function
 
 Adds a **one time** `listener` function for the event named `eventName` to the
diff --git a/doc/api/fs.md b/doc/api/fs.md
index 3594b3812e6b62..dac10a018188fe 100644
--- a/doc/api/fs.md
+++ b/doc/api/fs.md
@@ -121,8 +121,8 @@ The object itself emits these events:
 added: v0.5.8
 -->
 
-* `eventType` {String} The type of fs change
-* `filename` {String | Buffer} The filename that changed (if relevant/available)
+* `eventType` {string} The type of fs change
+* `filename` {string|Buffer} The filename that changed (if relevant/available)
 
 Emitted when something changes in a watched directory or file.
 See more details in [`fs.watch()`][].
@@ -178,8 +178,9 @@ Emitted when the ReadStream's file is opened.
 added: v0.1.93
 -->
 
-Emitted when the `ReadStream`'s underlying file descriptor has been closed
-using the `fs.close()` method.
+* `fd` {integer} Integer file descriptor used by the ReadStream.
+
+Emitted when the ReadStream's file is opened.
 
 ### readStream.bytesRead
 <!-- YAML
@@ -291,8 +292,9 @@ Emitted when the WriteStream's file is opened.
 added: v0.1.93
 -->
 
-Emitted when the `WriteStream`'s underlying file descriptor has been closed
-using the `fs.close()` method.
+* `fd` {integer} Integer file descriptor used by the WriteStream.
+
+Emitted when the WriteStream's file is opened.
 
 ### writeStream.bytesWritten
 <!-- YAML
@@ -317,8 +319,8 @@ argument to `fs.createWriteStream()`. If `path` is passed as a string, then
 added: v0.11.15
 -->
 
-* `path` {String | Buffer}
-* `mode` {Integer}
+* `path` {string|Buffer}
+* `mode` {integer}
 * `callback` {Function}
 
 Tests a user's permissions for the file or directory specified by `path`.
@@ -438,8 +440,8 @@ process.
 added: v0.11.15
 -->
 
-* `path` {String | Buffer}
-* `mode` {Integer}
+* `path` {string|Buffer}
+* `mode` {integer}
 
 Synchronous version of [`fs.access()`][]. This throws if any accessibility
 checks fail, and does nothing otherwise.
@@ -449,12 +451,12 @@ checks fail, and does nothing otherwise.
 added: v0.6.7
 -->
 
-* `file` {String | Buffer | Number} filename or file descriptor
-* `data` {String | Buffer}
-* `options` {Object | String}
-  * `encoding` {String | Null} default = `'utf8'`
-  * `mode` {Integer} default = `0o666`
-  * `flag` {String} default = `'a'`
+* `file` {string|Buffer|number} filename or file descriptor
+* `data` {string|Buffer}
+* `options` {Object|string}
+  * `encoding` {string|null} default = `'utf8'`
+  * `mode` {integer} default = `0o666`
+  * `flag` {string} default = `'a'`
 * `callback` {Function}
 
 Asynchronously append data to a file, creating the file if it does not yet exist.
@@ -477,20 +479,20 @@ fs.appendFile('message.txt', 'data to append', 'utf8', callback);
 
 Any specified file descriptor has to have been opened for appending.
 
-_Note: If a file descriptor is specified as the `file`, it will not be closed
-automatically._
+*Note*: If a file descriptor is specified as the `file`, it will not be closed
+automatically.
 
 ## fs.appendFileSync(file, data[, options])
 <!-- YAML
 added: v0.6.7
 -->
 
-* `file` {String | Buffer | Number} filename or file descriptor
-* `data` {String | Buffer}
-* `options` {Object | String}
-  * `encoding` {String | Null} default = `'utf8'`
-  * `mode` {Integer} default = `0o666`
-  * `flag` {String} default = `'a'`
+* `file` {string|Buffer|number} filename or file descriptor
+* `data` {string|Buffer}
+* `options` {Object|string}
+  * `encoding` {string|null} default = `'utf8'`
+  * `mode` {integer} default = `0o666`
+  * `flag` {string} default = `'a'`
 
 The synchronous version of [`fs.appendFile()`][]. Returns `undefined`.
 
@@ -499,8 +501,8 @@ The synchronous version of [`fs.appendFile()`][]. Returns `undefined`.
 added: v0.1.30
 -->
 
-* `path` {String | Buffer}
-* `mode` {Integer}
+* `path` {string|Buffer}
+* `mode` {integer}
 * `callback` {Function}
 
 Asynchronous chmod(2). No arguments other than a possible exception are given
@@ -511,8 +513,8 @@ to the completion callback.
 added: v0.6.7
 -->
 
-* `path` {String | Buffer}
-* `mode` {Integer}
+* `path` {string|Buffer}
+* `mode` {integer}
 
 Synchronous chmod(2). Returns `undefined`.
 
@@ -521,9 +523,9 @@ Synchronous chmod(2). Returns `undefined`.
 added: v0.1.97
 -->
 
-* `path` {String | Buffer}
-* `uid` {Integer}
-* `gid` {Integer}
+* `path` {string|Buffer}
+* `uid` {integer}
+* `gid` {integer}
 * `callback` {Function}
 
 Asynchronous chown(2). No arguments other than a possible exception are given
@@ -534,9 +536,9 @@ to the completion callback.
 added: v0.1.97
 -->
 
-* `path` {String | Buffer}
-* `uid` {Integer}
-* `gid` {Integer}
+* `path` {string|Buffer}
+* `uid` {integer}
+* `gid` {integer}
 
 Synchronous chown(2). Returns `undefined`.
 
@@ -545,7 +547,7 @@ Synchronous chown(2). Returns `undefined`.
 added: v0.0.2
 -->
 
-* `fd` {Integer}
+* `fd` {integer}
 * `callback` {Function}
 
 Asynchronous close(2).  No arguments other than a possible exception are given
@@ -556,7 +558,7 @@ to the completion callback.
 added: v0.1.21
 -->
 
-* `fd` {Integer}
+* `fd` {integer}
 
 Synchronous close(2). Returns `undefined`.
 
@@ -571,15 +573,15 @@ operations. The specific constants currently defined are described in
 added: v0.1.31
 -->
 
-* `path` {String | Buffer}
-* `options` {String | Object}
-  * `flags` {String}
-  * `encoding` {String}
-  * `fd` {Integer}
-  * `mode` {Integer}
-  * `autoClose` {Boolean}
-  * `start` {Integer}
-  * `end` {Integer}
+* `path` {string|Buffer}
+* `options` {string|Object}
+  * `flags` {string}
+  * `encoding` {string}
+  * `fd` {integer}
+  * `mode` {integer}
+  * `autoClose` {boolean}
+  * `start` {integer}
+  * `end` {integer}
 
 Returns a new [`ReadStream`][] object. (See [Readable Stream][]).
 
@@ -632,14 +634,14 @@ If `options` is a string, then it specifies the encoding.
 added: v0.1.31
 -->
 
-* `path` {String | Buffer}
-* `options` {String | Object}
-  * `flags` {String}
-  * `defaultEncoding` {String}
-  * `fd` {Integer}
-  * `mode` {Integer}
-  * `autoClose` {Boolean}
-  * `start` {Integer}
+* `path` {string|Buffer}
+* `options` {string|Object}
+  * `flags` {string}
+  * `defaultEncoding` {string}
+  * `fd` {integer}
+  * `mode` {integer}
+  * `autoClose` {boolean}
+  * `start` {integer}
 
 Returns a new [`WriteStream`][] object. (See [Writable Stream][]).
 
@@ -682,7 +684,7 @@ deprecated: v1.0.0
 
 > Stability: 0 - Deprecated: Use [`fs.stat()`][] or [`fs.access()`][] instead.
 
-* `path` {String | Buffer}
+* `path` {string|Buffer}
 * `callback` {Function}
 
 Test whether or not the given path exists by checking with the file system.
@@ -784,7 +786,7 @@ process.
 added: v0.1.21
 -->
 
-* `path` {String | Buffer}
+* `path` {string|Buffer}
 
 Synchronous version of [`fs.exists()`][].
 Returns `true` if the file exists, `false` otherwise.
@@ -799,8 +801,8 @@ a callback.)
 added: v0.4.7
 -->
 
-* `fd` {Integer}
-* `mode` {Integer}
+* `fd` {integer}
+* `mode` {integer}
 * `callback` {Function}
 
 Asynchronous fchmod(2). No arguments other than a possible exception
@@ -811,8 +813,8 @@ are given to the completion callback.
 added: v0.4.7
 -->
 
-* `fd` {Integer}
-* `mode` {Integer}
+* `fd` {integer}
+* `mode` {integer}
 
 Synchronous fchmod(2). Returns `undefined`.
 
@@ -821,9 +823,9 @@ Synchronous fchmod(2). Returns `undefined`.
 added: v0.4.7
 -->
 
-* `fd` {Integer}
-* `uid` {Integer}
-* `gid` {Integer}
+* `fd` {integer}
+* `uid` {integer}
+* `gid` {integer}
 * `callback` {Function}
 
 Asynchronous fchown(2). No arguments other than a possible exception are given
@@ -834,9 +836,9 @@ to the completion callback.
 added: v0.4.7
 -->
 
-* `fd` {Integer}
-* `uid` {Integer}
-* `gid` {Integer}
+* `fd` {integer}
+* `uid` {integer}
+* `gid` {integer}
 
 Synchronous fchown(2). Returns `undefined`.
 
@@ -845,7 +847,7 @@ Synchronous fchown(2). Returns `undefined`.
 added: v0.1.96
 -->
 
-* `fd` {Integer}
+* `fd` {integer}
 * `callback` {Function}
 
 Asynchronous fdatasync(2). No arguments other than a possible exception are
@@ -856,7 +858,7 @@ given to the completion callback.
 added: v0.1.96
 -->
 
-* `fd` {Integer}
+* `fd` {integer}
 
 Synchronous fdatasync(2). Returns `undefined`.
 
@@ -865,7 +867,7 @@ Synchronous fdatasync(2). Returns `undefined`.
 added: v0.1.95
 -->
 
-* `fd` {Integer}
+* `fd` {integer}
 * `callback` {Function}
 
 Asynchronous fstat(2). The callback gets two arguments `(err, stats)` where
@@ -877,7 +879,7 @@ except that the file to be stat-ed is specified by the file descriptor `fd`.
 added: v0.1.95
 -->
 
-* `fd` {Integer}
+* `fd` {integer}
 
 Synchronous fstat(2). Returns an instance of [`fs.Stats`][].
 
@@ -886,7 +888,7 @@ Synchronous fstat(2). Returns an instance of [`fs.Stats`][].
 added: v0.1.96
 -->
 
-* `fd` {Integer}
+* `fd` {integer}
 * `callback` {Function}
 
 Asynchronous fsync(2). No arguments other than a possible exception are given
@@ -897,7 +899,7 @@ to the completion callback.
 added: v0.1.96
 -->
 
-* `fd` {Integer}
+* `fd` {integer}
 
 Synchronous fsync(2). Returns `undefined`.
 
@@ -906,8 +908,8 @@ Synchronous fsync(2). Returns `undefined`.
 added: v0.8.6
 -->
 
-* `fd` {Integer}
-* `len` {Integer} default = `0`
+* `fd` {integer}
+* `len` {integer} default = `0`
 * `callback` {Function}
 
 Asynchronous ftruncate(2). No arguments other than a possible exception are
@@ -959,8 +961,8 @@ The last three bytes are null bytes ('\0'), to compensate the over-truncation.
 added: v0.8.6
 -->
 
-* `fd` {Integer}
-* `len` {Integer} default = `0`
+* `fd` {integer}
+* `len` {integer} default = `0`
 
 Synchronous ftruncate(2). Returns `undefined`.
 
@@ -969,9 +971,9 @@ Synchronous ftruncate(2). Returns `undefined`.
 added: v0.4.2
 -->
 
-* `fd` {Integer}
-* `atime` {Integer}
-* `mtime` {Integer}
+* `fd` {integer}
+* `atime` {integer}
+* `mtime` {integer}
 * `callback` {Function}
 
 Change the file timestamps of a file referenced by the supplied file
@@ -982,9 +984,9 @@ descriptor.
 added: v0.4.2
 -->
 
-* `fd` {Integer}
-* `atime` {Integer}
-* `mtime` {Integer}
+* `fd` {integer}
+* `atime` {integer}
+* `mtime` {integer}
 
 Synchronous version of [`fs.futimes()`][]. Returns `undefined`.
 
@@ -993,8 +995,8 @@ Synchronous version of [`fs.futimes()`][]. Returns `undefined`.
 deprecated: v0.4.7
 -->
 
-* `path` {String | Buffer}
-* `mode` {Integer}
+* `path` {string|Buffer}
+* `mode` {integer}
 * `callback` {Function}
 
 Asynchronous lchmod(2). No arguments other than a possible exception
@@ -1007,8 +1009,8 @@ Only available on macOS.
 deprecated: v0.4.7
 -->
 
-* `path` {String | Buffer}
-* `mode` {Integer}
+* `path` {string|Buffer}
+* `mode` {integer}
 
 Synchronous lchmod(2). Returns `undefined`.
 
@@ -1017,9 +1019,9 @@ Synchronous lchmod(2). Returns `undefined`.
 deprecated: v0.4.7
 -->
 
-* `path` {String | Buffer}
-* `uid` {Integer}
-* `gid` {Integer}
+* `path` {string|Buffer}
+* `uid` {integer}
+* `gid` {integer}
 * `callback` {Function}
 
 Asynchronous lchown(2). No arguments other than a possible exception are given
@@ -1030,9 +1032,9 @@ to the completion callback.
 deprecated: v0.4.7
 -->
 
-* `path` {String | Buffer}
-* `uid` {Integer}
-* `gid` {Integer}
+* `path` {string|Buffer}
+* `uid` {integer}
+* `gid` {integer}
 
 Synchronous lchown(2). Returns `undefined`.
 
@@ -1041,8 +1043,8 @@ Synchronous lchown(2). Returns `undefined`.
 added: v0.1.31
 -->
 
-* `existingPath` {String | Buffer}
-* `newPath` {String | Buffer}
+* `existingPath` {string|Buffer}
+* `newPath` {string|Buffer}
 * `callback` {Function}
 
 Asynchronous link(2). No arguments other than a possible exception are given to
@@ -1053,8 +1055,8 @@ the completion callback.
 added: v0.1.31
 -->
 
-* `existingPath` {String | Buffer}
-* `newPath` {String | Buffer}
+* `existingPath` {string|Buffer}
+* `newPath` {string|Buffer}
 
 Synchronous link(2). Returns `undefined`.
 
@@ -1063,7 +1065,7 @@ Synchronous link(2). Returns `undefined`.
 added: v0.1.30
 -->
 
-* `path` {String | Buffer}
+* `path` {string|Buffer}
 * `callback` {Function}
 
 Asynchronous lstat(2). The callback gets two arguments `(err, stats)` where
@@ -1076,7 +1078,7 @@ not the file that it refers to.
 added: v0.1.30
 -->
 
-* `path` {String | Buffer}
+* `path` {string|Buffer}
 
 Synchronous lstat(2). Returns an instance of [`fs.Stats`][].
 
@@ -1085,8 +1087,8 @@ Synchronous lstat(2). Returns an instance of [`fs.Stats`][].
 added: v0.1.8
 -->
 
-* `path` {String | Buffer}
-* `mode` {Integer}
+* `path` {string|Buffer}
+* `mode` {integer}
 * `callback` {Function}
 
 Asynchronous mkdir(2). No arguments other than a possible exception are given
@@ -1097,8 +1099,8 @@ to the completion callback. `mode` defaults to `0o777`.
 added: v0.1.21
 -->
 
-* `path` {String | Buffer}
-* `mode` {Integer}
+* `path` {string|Buffer}
+* `mode` {integer}
 
 Synchronous mkdir(2). Returns `undefined`.
 
@@ -1107,9 +1109,9 @@ Synchronous mkdir(2). Returns `undefined`.
 added: v5.10.0
 -->
 
-* `prefix` {String}
-* `options` {String | Object}
-  * `encoding` {String} default = `'utf8'`
+* `prefix` {string}
+* `options` {string|Object}
+  * `encoding` {string} default = `'utf8'`
 * `callback` {Function}
 
 Creates a unique temporary directory.
@@ -1169,9 +1171,9 @@ fs.mkdtemp(`${tmpDir}${sep}`, (err, folder) => {
 added: v5.10.0
 -->
 
-* `prefix` {String}
-* `options` {String | Object}
-  * `encoding` {String} default = `'utf8'`
+* `prefix` {string}
+* `options` {string|Object}
+  * `encoding` {string} default = `'utf8'`
 
 The synchronous version of [`fs.mkdtemp()`][]. Returns the created
 folder path.
@@ -1184,9 +1186,9 @@ object with an `encoding` property specifying the character encoding to use.
 added: v0.0.2
 -->
 
-* `path` {String | Buffer}
-* `flags` {String | Number}
-* `mode` {Integer}
+* `path` {string|Buffer}
+* `flags` {string|number}
+* `mode` {integer}
 * `callback` {Function}
 
 Asynchronous file open. See open(2). `flags` can be:
@@ -1246,10 +1248,10 @@ On Linux, positional writes don't work when the file is opened in append mode.
 The kernel ignores the position argument and always appends the data to
 the end of the file.
 
-_Note: The behavior of `fs.open()` is platform specific for some flags. As such,
+*Note*: The behavior of `fs.open()` is platform-specific for some flags. As such,
 opening a directory on macOS and Linux with the `'a+'` flag - see example
 below - will return an error. In contrast, on Windows and FreeBSD, a file
-descriptor will be returned._
+descriptor will be returned.
 
 ```js
 // macOS and Linux
@@ -1268,9 +1270,9 @@ fs.open('<directory>', 'a+', (err, fd) => {
 added: v0.1.21
 -->
 
-* `path` {String | Buffer}
-* `flags` {String | Number}
-* `mode` {Integer}
+* `path` {string|Buffer}
+* `flags` {string|number}
+* `mode` {integer}
 
 Synchronous version of [`fs.open()`][]. Returns an integer representing the file
 descriptor.
@@ -1280,11 +1282,11 @@ descriptor.
 added: v0.0.2
 -->
 
-* `fd` {Integer}
-* `buffer` {String | Buffer}
-* `offset` {Integer}
-* `length` {Integer}
-* `position` {Integer}
+* `fd` {integer}
+* `buffer` {string | Buffer}
+* `offset` {integer}
+* `length` {integer}
+* `position` {integer}
 * `callback` {Function}
 
 Read data from the file specified by `fd`.
@@ -1305,9 +1307,9 @@ The callback is given the three arguments, `(err, bytesRead, buffer)`.
 added: v0.1.8
 -->
 
-* `path` {String | Buffer}
-* `options` {String | Object}
-  * `encoding` {String} default = `'utf8'`
+* `path` {string|Buffer}
+* `options` {string|Object}
+  * `encoding` {string} default = `'utf8'`
 * `callback` {Function}
 
 Asynchronous readdir(3).  Reads the contents of a directory.
@@ -1324,9 +1326,9 @@ the filenames returned will be passed as `Buffer` objects.
 added: v0.1.21
 -->
 
-* `path` {String | Buffer}
-* `options` {String | Object}
-  * `encoding` {String} default = `'utf8'`
+* `path` {string|Buffer}
+* `options` {string|Object}
+  * `encoding` {string} default = `'utf8'`
 
 Synchronous readdir(3). Returns an array of filenames excluding `'.'` and
 `'..'`.
@@ -1341,10 +1343,10 @@ the filenames returned will be passed as `Buffer` objects.
 added: v0.1.29
 -->
 
-* `file` {String | Buffer | Integer} filename or file descriptor
-* `options` {Object | String}
-  * `encoding` {String | Null} default = `null`
-  * `flag` {String} default = `'r'`
+* `file` {string|Buffer|integer} filename or file descriptor
+* `options` {Object|string}
+  * `encoding` {string|null} default = `null`
+  * `flag` {string} default = `'r'`
 * `callback` {Function}
 
 Asynchronously reads the entire contents of a file. Example:
@@ -1366,35 +1368,63 @@ If `options` is a string, then it specifies the encoding. Example:
 ```js
 fs.readFile('/etc/passwd', 'utf8', callback);
 ```
+*Note*: When the path is a directory, the behavior of
+`fs.readFile()` and [`fs.readFileSync()`][] is platform-specific. On macOS,
+Linux, and Windows, an error will be returned. On FreeBSD, a representation
+of the directory's contents will be returned.
+
+```js
+// macOS, Linux and Windows
+fs.readFile('<directory>', (err, data) => {
+  // => [Error: EISDIR: illegal operation on a directory, read <directory>]
+});
+
+//  FreeBSD
+fs.readFile('<directory>', (err, data) => {
+  // => null, <data>
+});
+```
 
 Any specified file descriptor has to support reading.
 
-_Note: If a file descriptor is specified as the `file`, it will not be closed
-automatically._
+*Note*: If a file descriptor is specified as the `path`, it will not be closed
+automatically.
 
 ## fs.readFileSync(file[, options])
 <!-- YAML
 added: v0.1.8
 -->
 
-* `file` {String | Buffer | Integer} filename or file descriptor
-* `options` {Object | String}
-  * `encoding` {String | Null} default = `null`
-  * `flag` {String} default = `'r'`
+* `file` {string|Buffer|integer} filename or file descriptor
+* `options` {Object|string}
+  * `encoding` {string|null} default = `null`
+  * `flag` {string} default = `'r'`
 
 Synchronous version of [`fs.readFile`][]. Returns the contents of the `file`.
 
 If the `encoding` option is specified then this function returns a
 string. Otherwise it returns a buffer.
 
+*Note*: Similar to [`fs.readFile()`][], when the path is a directory, the
+behavior of `fs.readFileSync()` is platform-specific.
+
+```js
+// macOS, Linux and Windows
+fs.readFileSync('<directory>');
+// => [Error: EISDIR: illegal operation on a directory, read <directory>]
+
+//  FreeBSD
+fs.readFileSync('<directory>'); // => null, <data>
+```
+
 ## fs.readlink(path[, options], callback)
 <!-- YAML
 added: v0.1.31
 -->
 
-* `path` {String | Buffer}
-* `options` {String | Object}
-  * `encoding` {String} default = `'utf8'`
+* `path` {string|Buffer}
+* `options` {string|Object}
+  * `encoding` {string} default = `'utf8'`
 * `callback` {Function}
 
 Asynchronous readlink(2). The callback gets two arguments `(err,
@@ -1410,9 +1440,9 @@ the link path returned will be passed as a `Buffer` object.
 added: v0.1.31
 -->
 
-* `path` {String | Buffer}
-* `options` {String | Object}
-  * `encoding` {String} default = `'utf8'`
+* `path` {string|Buffer}
+* `options` {string|Object}
+  * `encoding` {string} default = `'utf8'`
 
 Synchronous readlink(2). Returns the symbolic link's string value.
 
@@ -1426,11 +1456,11 @@ the link path returned will be passed as a `Buffer` object.
 added: v0.1.21
 -->
 
-* `fd` {Integer}
-* `buffer` {String | Buffer}
-* `offset` {Integer}
-* `length` {Integer}
-* `position` {Integer}
+* `fd` {integer}
+* `buffer` {string | Buffer}
+* `offset` {integer}
+* `length` {integer}
+* `position` {integer}
 
 Synchronous version of [`fs.read()`][]. Returns the number of `bytesRead`.
 
@@ -1439,9 +1469,9 @@ Synchronous version of [`fs.read()`][]. Returns the number of `bytesRead`.
 added: v0.1.31
 -->
 
-* `path` {String | Buffer}
-* `options` {String | Object}
-  * `encoding` {String} default = `'utf8'`
+* `path` {string|Buffer}
+* `options` {string|Object}
+  * `encoding` {string} default = `'utf8'`
 * `callback` {Function}
 
 Asynchronous realpath(3). The `callback` gets two arguments `(err,
@@ -1459,9 +1489,9 @@ the path returned will be passed as a `Buffer` object.
 added: v0.1.31
 -->
 
-* `path` {String | Buffer};
-* `options` {String | Object}
-  * `encoding` {String} default = `'utf8'`
+* `path` {string|Buffer};
+* `options` {string|Object}
+  * `encoding` {string} default = `'utf8'`
 
 Synchronous realpath(3). Returns the resolved path.
 
@@ -1477,8 +1507,8 @@ will be passed as a `Buffer` object.
 added: v0.0.2
 -->
 
-* `oldPath` {String | Buffer}
-* `newPath` {String | Buffer}
+* `oldPath` {string|Buffer}
+* `newPath` {string|Buffer}
 * `callback` {Function}
 
 Asynchronous rename(2). No arguments other than a possible exception are given
@@ -1489,8 +1519,8 @@ to the completion callback.
 added: v0.1.21
 -->
 
-* `oldPath` {String | Buffer}
-* `newPath` {String | Buffer}
+* `oldPath` {string|Buffer}
+* `newPath` {string|Buffer}
 
 Synchronous rename(2). Returns `undefined`.
 
@@ -1499,7 +1529,7 @@ Synchronous rename(2). Returns `undefined`.
 added: v0.0.2
 -->
 
-* `path` {String | Buffer}
+* `path` {string|Buffer}
 * `callback` {Function}
 
 Asynchronous rmdir(2). No arguments other than a possible exception are given
@@ -1510,7 +1540,7 @@ to the completion callback.
 added: v0.1.21
 -->
 
-* `path` {String | Buffer}
+* `path` {string|Buffer}
 
 Synchronous rmdir(2). Returns `undefined`.
 
@@ -1519,7 +1549,7 @@ Synchronous rmdir(2). Returns `undefined`.
 added: v0.0.2
 -->
 
-* `path` {String | Buffer}
+* `path` {string|Buffer}
 * `callback` {Function}
 
 Asynchronous stat(2). The callback gets two arguments `(err, stats)` where
@@ -1540,7 +1570,7 @@ is recommended.
 added: v0.1.21
 -->
 
-* `path` {String | Buffer}
+* `path` {string|Buffer}
 
 Synchronous stat(2). Returns an instance of [`fs.Stats`][].
 
@@ -1549,9 +1579,9 @@ Synchronous stat(2). Returns an instance of [`fs.Stats`][].
 added: v0.1.31
 -->
 
-* `target` {String | Buffer}
-* `path` {String | Buffer}
-* `type` {String}
+* `target` {string|Buffer}
+* `path` {string|Buffer}
+* `type` {string}
 * `callback` {Function}
 
 Asynchronous symlink(2). No arguments other than a possible exception are given
@@ -1574,9 +1604,9 @@ It creates a symbolic link named "new-port" that points to "foo".
 added: v0.1.31
 -->
 
-* `target` {String | Buffer}
-* `path` {String | Buffer}
-* `type` {String}
+* `target` {string|Buffer}
+* `path` {string|Buffer}
+* `type` {string}
 
 Synchronous symlink(2). Returns `undefined`.
 
@@ -1585,8 +1615,8 @@ Synchronous symlink(2). Returns `undefined`.
 added: v0.8.6
 -->
 
-* `path` {String | Buffer}
-* `len` {Integer} default = `0`
+* `path` {string|Buffer}
+* `len` {integer} default = `0`
 * `callback` {Function}
 
 Asynchronous truncate(2). No arguments other than a possible exception are
@@ -1598,8 +1628,8 @@ first argument. In this case, `fs.ftruncate()` is called.
 added: v0.8.6
 -->
 
-* `path` {String | Buffer}
-* `len` {Integer} default = `0`
+* `path` {string|Buffer}
+* `len` {integer} default = `0`
 
 Synchronous truncate(2). Returns `undefined`. A file descriptor can also be
 passed as the first argument. In this case, `fs.ftruncateSync()` is called.
@@ -1609,7 +1639,7 @@ passed as the first argument. In this case, `fs.ftruncateSync()` is called.
 added: v0.0.2
 -->
 
-* `path` {String | Buffer}
+* `path` {string|Buffer}
 * `callback` {Function}
 
 Asynchronous unlink(2). No arguments other than a possible exception are given
@@ -1620,7 +1650,7 @@ to the completion callback.
 added: v0.1.21
 -->
 
-* `path` {String | Buffer}
+* `path` {string|Buffer}
 
 Synchronous unlink(2). Returns `undefined`.
 
@@ -1629,7 +1659,7 @@ Synchronous unlink(2). Returns `undefined`.
 added: v0.1.31
 -->
 
-* `filename` {String | Buffer}
+* `filename` {string|Buffer}
 * `listener` {Function}
 
 Stop watching for changes on `filename`. If `listener` is specified, only that
@@ -1639,18 +1669,18 @@ have effectively stopped watching `filename`.
 Calling `fs.unwatchFile()` with a filename that is not being watched is a
 no-op, not an error.
 
-_Note: [`fs.watch()`][] is more efficient than `fs.watchFile()` and `fs.unwatchFile()`.
+*Note*: [`fs.watch()`][] is more efficient than `fs.watchFile()` and `fs.unwatchFile()`.
 `fs.watch()` should be used instead of `fs.watchFile()` and `fs.unwatchFile()`
-when possible._
+when possible.
 
 ## fs.utimes(path, atime, mtime, callback)
 <!-- YAML
 added: v0.4.2
 -->
 
-* `path` {String | Buffer}
-* `atime` {Integer}
-* `mtime` {Integer}
+* `path` {string|Buffer}
+* `atime` {integer}
+* `mtime` {integer}
 * `callback` {Function}
 
 Change file timestamps of the file referenced by the supplied path.
@@ -1670,9 +1700,9 @@ follow these rules:
 added: v0.4.2
 -->
 
-* `path` {String | Buffer}
-* `atime` {Integer}
-* `mtime` {Integer}
+* `path` {string|Buffer}
+* `atime` {integer}
+* `mtime` {integer}
 
 Synchronous version of [`fs.utimes()`][]. Returns `undefined`.
 
@@ -1681,15 +1711,15 @@ Synchronous version of [`fs.utimes()`][]. Returns `undefined`.
 added: v0.5.10
 -->
 
-* `filename` {String | Buffer}
-* `options` {String | Object}
-  * `persistent` {Boolean} Indicates whether the process should continue to run
+* `filename` {string|Buffer}
+* `options` {string|Object}
+  * `persistent` {boolean} Indicates whether the process should continue to run
     as long as files are being watched. default = `true`
-  * `recursive` {Boolean} Indicates whether all subdirectories should be
+  * `recursive` {boolean} Indicates whether all subdirectories should be
     watched, or only the current directory. The applies when a directory is
     specified, and only on supported platforms (See [Caveats][]). default =
     `false`
-  * `encoding` {String} Specifies the character encoding to be used for the
+  * `encoding` {string} Specifies the character encoding to be used for the
      filename passed to the listener. default = `'utf8'`
 * `listener` {Function}
 
@@ -1784,10 +1814,10 @@ fs.watch('somedir', (eventType, filename) => {
 added: v0.1.31
 -->
 
-* `filename` {String | Buffer}
+* `filename` {string|Buffer}
 * `options` {Object}
-  * `persistent` {Boolean}
-  * `interval` {Integer}
+  * `persistent` {boolean}
+  * `interval` {integer}
 * `listener` {Function}
 
 Watch for changes on `filename`. The callback `listener` will be called each
@@ -1815,26 +1845,26 @@ These stat objects are instances of `fs.Stat`.
 If you want to be notified when the file was modified, not just accessed,
 you need to compare `curr.mtime` and `prev.mtime`.
 
-_Note: when an `fs.watchFile` operation results in an `ENOENT` error, it will
+*Note*: when an `fs.watchFile` operation results in an `ENOENT` error, it will
  invoke the listener once, with all the fields zeroed (or, for dates, the Unix
  Epoch). In Windows, `blksize` and `blocks` fields will be `undefined`, instead
  of zero. If the file is created later on, the listener will be called again,
- with the latest stat objects. This is a change in functionality since v0.10._
+ with the latest stat objects. This is a change in functionality since v0.10.
 
-_Note: [`fs.watch()`][] is more efficient than `fs.watchFile` and
+*Note*: [`fs.watch()`][] is more efficient than `fs.watchFile` and
 `fs.unwatchFile`. `fs.watch` should be used instead of `fs.watchFile` and
-`fs.unwatchFile` when possible._
+`fs.unwatchFile` when possible.
 
 ## fs.write(fd, buffer, offset, length[, position], callback)
 <!-- YAML
 added: v0.0.2
 -->
 
-* `fd` {Integer}
-* `buffer` {String | Buffer}
-* `offset` {Integer}
-* `length` {Integer}
-* `position` {Integer}
+* `fd` {integer}
+* `buffer` {string | Buffer}
+* `offset` {integer}
+* `length` {integer}
+* `position` {integer}
 * `callback` {Function}
 
 Write `buffer` to the file specified by `fd`.
@@ -1862,10 +1892,10 @@ the end of the file.
 added: v0.11.5
 -->
 
-* `fd` {Integer}
-* `data` {String | Buffer}
-* `position` {Integer}
-* `encoding` {String}
+* `fd` {integer}
+* `data` {string | Buffer}
+* `position` {integer}
+* `encoding` {string}
 * `callback` {Function}
 
 Write `data` to the file specified by `fd`.  If `data` is not a Buffer instance
@@ -1898,12 +1928,12 @@ the end of the file.
 added: v0.1.29
 -->
 
-* `file` {String | Buffer | Integer} filename or file descriptor
-* `data` {String | Buffer}
-* `options` {Object | String}
-  * `encoding` {String | Null} default = `'utf8'`
-  * `mode` {Integer} default = `0o666`
-  * `flag` {String} default = `'w'`
+* `file` {string | Buffer | integer} filename or file descriptor
+* `data` {string | Buffer}
+* `options` {Object | string}
+  * `encoding` {string | Null} default = `'utf8'`
+  * `mode` {integer} default = `0o666`
+  * `flag` {string} default = `'w'`
 * `callback` {Function}
 
 Asynchronously writes data to a file, replacing the file if it already exists.
@@ -1933,20 +1963,20 @@ Note that it is unsafe to use `fs.writeFile` multiple times on the same file
 without waiting for the callback. For this scenario,
 `fs.createWriteStream` is strongly recommended.
 
-_Note: If a file descriptor is specified as the `file`, it will not be closed
-automatically._
+*Note*: If a file descriptor is specified as the `file`, it will not be closed
+automatically.
 
 ## fs.writeFileSync(file, data[, options])
 <!-- YAML
 added: v0.1.29
 -->
 
-* `file` {String | Buffer | Integer} filename or file descriptor
-* `data` {String | Buffer}
-* `options` {Object | String}
-  * `encoding` {String | Null} default = `'utf8'`
-  * `mode` {Integer} default = `0o666`
-  * `flag` {String} default = `'w'`
+* `file` {string | Buffer | integer} filename or file descriptor
+* `data` {string | Buffer}
+* `options` {Object | string}
+  * `encoding` {string | Null} default = `'utf8'`
+  * `mode` {integer} default = `0o666`
+  * `flag` {string} default = `'w'`
 
 The synchronous version of [`fs.writeFile()`][]. Returns `undefined`.
 
@@ -1955,21 +1985,21 @@ The synchronous version of [`fs.writeFile()`][]. Returns `undefined`.
 added: v0.1.21
 -->
 
-* `fd` {Integer}
-* `buffer` {String | Buffer}
-* `offset` {Integer}
-* `length` {Integer}
-* `position` {Integer}
+* `fd` {integer}
+* `buffer` {string | Buffer}
+* `offset` {integer}
+* `length` {integer}
+* `position` {integer}
 
 ## fs.writeSync(fd, data[, position[, encoding]])
 <!-- YAML
 added: v0.11.5
 -->
 
-* `fd` {Integer}
-* `data` {String | Buffer}
-* `position` {Integer}
-* `encoding` {String}
+* `fd` {integer}
+* `data` {string | Buffer}
+* `position` {integer}
+* `encoding` {string}
 
 Synchronous versions of [`fs.write()`][]. Returns the number of bytes written.
 
diff --git a/doc/api/globals.md b/doc/api/globals.md
index a60cd4cc226fb2..b0467cdacde3a5 100644
--- a/doc/api/globals.md
+++ b/doc/api/globals.md
@@ -27,7 +27,7 @@ added: v0.1.27
 
 <!-- type=var -->
 
-* {String}
+* {string}
 
 The directory name of the current module. This the same as the
 [`path.dirname()`][] of the [`__filename`][].
@@ -50,7 +50,7 @@ added: v0.0.1
 
 <!-- type=var -->
 
-* {String}
+* {string}
 
 The file name of the current module. This is the resolved absolute path of the
 current module file.
diff --git a/doc/api/http.md b/doc/api/http.md
index cdbdacb94c939e..02b7aa5cc9e7e7 100644
--- a/doc/api/http.md
+++ b/doc/api/http.md
@@ -110,16 +110,16 @@ added: v0.3.4
 
 * `options` {Object} Set of configurable options to set on the agent.
   Can have the following fields:
-  * `keepAlive` {Boolean} Keep sockets around even when there are no
+  * `keepAlive` {boolean} Keep sockets around even when there are no
     outstanding requests, so they can be used for future requests without
     having to reestablish a TCP connection. Default = `false`
   * `keepAliveMsecs` {Integer} When using the `keepAlive` option, specifies
     the [initial delay](#net_socket_setkeepalive_enable_initialdelay)
     for TCP Keep-Alive packets. Ignored when the
     `keepAlive` option is `false` or `undefined`. Default = `1000`.
-  * `maxSockets` {Number} Maximum number of sockets to allow per
+  * `maxSockets` {number} Maximum number of sockets to allow per
     host.  Default = `Infinity`.
-  * `maxFreeSockets` {Number} Maximum number of sockets to leave open
+  * `maxFreeSockets` {number} Maximum number of sockets to leave open
     in a free state.  Only relevant if `keepAlive` is set to `true`.
     Default = `256`.
 
@@ -184,9 +184,9 @@ added: v0.11.4
 -->
 
 * `options` {Object} A set of options providing information for name generation
-  * `host` {String} A domain name or IP address of the server to issue the request to
-  * `port` {Number} Port of remote server
-  * `localAddress` {String} Local interface to bind for network connections
+  * `host` {string} A domain name or IP address of the server to issue the request to
+  * `port` {number} Port of remote server
+  * `localAddress` {string} Local interface to bind for network connections
     when issuing the request
 * Returns: {String}
 
@@ -463,8 +463,8 @@ aborted, in milliseconds since 1 January 1970 00:00:00 UTC.
 added: v0.1.90
 -->
 
-* `data` {String | Buffer}
-* `encoding` {String}
+* `data` {string|Buffer}
+* `encoding` {string}
 * `callback` {Function}
 
 Finishes sending the request. If any parts of the body are
@@ -497,7 +497,7 @@ the optimization and kickstart the request.
 added: v0.5.9
 -->
 
-* `noDelay` {Boolean}
+* `noDelay` {boolean}
 
 Once a socket is assigned to this request and is connected
 [`socket.setNoDelay()`][] will be called.
@@ -507,8 +507,8 @@ Once a socket is assigned to this request and is connected
 added: v0.5.9
 -->
 
-* `enable` {Boolean}
-* `initialDelay` {Number}
+* `enable` {boolean}
+* `initialDelay` {number}
 
 Once a socket is assigned to this request and is connected
 [`socket.setKeepAlive()`][] will be called.
@@ -518,7 +518,7 @@ Once a socket is assigned to this request and is connected
 added: v0.5.9
 -->
 
-* `timeout` {Number} Milliseconds before a request is considered to be timed out.
+* `timeout` {number} Milliseconds before a request is considered to be timed out.
 * `callback` {Function} Optional function to be called when a timeout occurs. Same as binding to the `timeout` event.
 
 Once a socket is assigned to this request and is connected
@@ -531,8 +531,8 @@ Returns `request`.
 added: v0.1.29
 -->
 
-* `chunk` {String | Buffer}
-* `encoding` {String}
+* `chunk` {string|Buffer}
+* `encoding` {string}
 * `callback` {Function}
 
 Sends a chunk of the body.  By calling this method
@@ -731,7 +731,7 @@ subsequent call will *re-open* the server using the provided options.
 added: v0.1.90
 -->
 
-* `path` {String}
+* `path` {string}
 * `callback` {Function}
 
 Start a UNIX socket server listening for connections on the given `path`.
@@ -747,9 +747,9 @@ subsequent call will *re-open* the server using the provided options.
 added: v0.1.90
 -->
 
-* `port` {Number}
-* `hostname` {String}
-* `backlog` {Number}
+* `port` {number}
+* `hostname` {string}
+* `backlog` {number}
 * `callback` {Function}
 
 Begin accepting connections on the specified `port` and `hostname`. If the
@@ -797,7 +797,7 @@ no limit will be applied.
 added: v0.9.12
 -->
 
-* `msecs` {Number}
+* `msecs` {number}
 * `callback` {Function}
 
 Sets the timeout value for sockets, and emits a `'timeout'` event on
@@ -895,8 +895,8 @@ will result in a [`TypeError`][] being thrown.
 added: v0.1.90
 -->
 
-* `data` {String | Buffer}
-* `encoding` {String}
+* `data` {string|Buffer}
+* `encoding` {string}
 * `callback` {Function}
 
 This method signals to the server that all of the response headers and body
@@ -924,7 +924,7 @@ as `false`. After [`response.end()`][] executes, the value will be `true`.
 added: v0.4.0
 -->
 
-* `name` {String}
+* `name` {string}
 * Returns: {String}
 
 Reads out a header that's already been queued but not sent to the client.
@@ -950,7 +950,7 @@ Boolean (read-only). True if headers were sent, false otherwise.
 added: v0.4.0
 -->
 
-* `name` {String}
+* `name` {string}
 
 Removes a header that's queued for implicit sending.
 
@@ -978,8 +978,8 @@ in responses.
 added: v0.4.0
 -->
 
-* `name` {String}
-* `value` {String}
+* `name` {string}
+* `value` {string}
 
 Sets a single header value for implicit headers.  If this header already exists
 in the to-be-sent headers, its value will be replaced.  Use an array of strings
@@ -1019,7 +1019,7 @@ const server = http.createServer((req,res) => {
 added: v0.9.12
 -->
 
-* `msecs` {Number}
+* `msecs` {number}
 * `callback` {Function}
 
 Sets the Socket's timeout value to `msecs`.  If a callback is
@@ -1080,8 +1080,8 @@ status message which was sent out.
 added: v0.1.29
 -->
 
-* `chunk` {String | Buffer}
-* `encoding` {String}
+* `chunk` {string|Buffer}
+* `encoding` {string}
 * `callback` {Function}
 * Returns: {Boolean}
 
@@ -1126,8 +1126,8 @@ the request body should be sent. See the [`'checkContinue'`][] event on `Server`
 added: v0.1.30
 -->
 
-* `statusCode` {Number}
-* `statusMessage` {String}
+* `statusCode` {number}
+* `statusMessage` {string}
 * `headers` {Object}
 
 Sends a response header to the request. The status code is a 3-digit HTTP
@@ -1315,7 +1315,7 @@ received.  Only populated at the `'end'` event.
 added: v0.5.9
 -->
 
-* `msecs` {Number}
+* `msecs` {number}
 * `callback` {Function}
 
 Calls `message.connection.setTimeout(msecs, callback)`.
@@ -1533,28 +1533,28 @@ added: v0.3.6
 -->
 
 * `options` {Object}
-  * `protocol` {String} Protocol to use. Defaults to `'http:'`.
-  * `host` {String} A domain name or IP address of the server to issue the
+  * `protocol` {string} Protocol to use. Defaults to `'http:'`.
+  * `host` {string} A domain name or IP address of the server to issue the
     request to. Defaults to `'localhost'`.
-  * `hostname` {String} Alias for `host`. To support [`url.parse()`][],
+  * `hostname` {string} Alias for `host`. To support [`url.parse()`][],
     `hostname` is preferred over `host`.
-  * `family` {Number} IP address family to use when resolving `host` and
+  * `family` {number} IP address family to use when resolving `host` and
     `hostname`. Valid values are `4` or `6`. When unspecified, both IP v4 and
     v6 will be used.
-  * `port` {Number} Port of remote server. Defaults to 80.
-  * `localAddress` {String} Local interface to bind for network connections.
-  * `socketPath` {String} Unix Domain Socket (use one of host:port or
+  * `port` {number} Port of remote server. Defaults to 80.
+  * `localAddress` {string} Local interface to bind for network connections.
+  * `socketPath` {string} Unix Domain Socket (use one of host:port or
     socketPath).
-  * `method` {String} A string specifying the HTTP request method. Defaults to
+  * `method` {string} A string specifying the HTTP request method. Defaults to
     `'GET'`.
-  * `path` {String} Request path. Defaults to `'/'`. Should include query
+  * `path` {string} Request path. Defaults to `'/'`. Should include query
     string if any. E.G. `'/index.html?page=12'`. An exception is thrown when
     the request path contains illegal characters. Currently, only spaces are
     rejected but that may change in the future.
   * `headers` {Object} An object containing request headers.
-  * `auth` {String} Basic authentication i.e. `'user:password'` to compute an
+  * `auth` {string} Basic authentication i.e. `'user:password'` to compute an
     Authorization header.
-  * `agent` {http.Agent|Boolean} Controls [`Agent`][] behavior. Possible values:
+  * `agent` {http.Agent|boolean} Controls [`Agent`][] behavior. Possible values:
    * `undefined` (default): use [`http.globalAgent`][] for this host and port.
    * `Agent` object: explicitly use the passed in `Agent`.
    * `false`: causes a new `Agent` with default values to be used.
diff --git a/doc/api/https.md b/doc/api/https.md
index 12ebef2bf8ce4b..ea99d8bcdb99b0 100644
--- a/doc/api/https.md
+++ b/doc/api/https.md
@@ -21,17 +21,20 @@ added: v0.3.4
 This class is a subclass of `tls.Server` and emits events same as
 [`http.Server`][]. See [`http.Server`][] for more information.
 
-### server.setTimeout(msecs, callback)
+### server.setTimeout([msecs][, callback])
 <!-- YAML
 added: v0.11.2
 -->
+- `msecs` {number} Defaults to 120000 (2 minutes).
+- `callback` {Function}
 
 See [`http.Server#setTimeout()`][].
 
-### server.timeout
+### server.timeout([msecs])
 <!-- YAML
 added: v0.11.2
 -->
+- `msecs` {number} Defaults to 120000 (2 minutes).
 
 See [`http.Server#timeout`][].
 
@@ -39,10 +42,8 @@ See [`http.Server#timeout`][].
 <!-- YAML
 added: v0.3.4
 -->
-
-Returns a new HTTPS web server object. The `options` is similar to
-[`tls.createServer()`][].  The `requestListener` is a function which is
-automatically added to the `'request'` event.
+- `options` {Object} Accepts `options` from [`tls.createServer()`][] and [`tls.createSecureContext()`][].
+- `requestListener` {Function} A listener to be added to the `request` event.
 
 Example:
 
@@ -83,19 +84,33 @@ https.createServer(options, (req, res) => {
 <!-- YAML
 added: v0.1.90
 -->
+- `callback` {Function}
 
 See [`http.close()`][] for details.
 
 ### server.listen(handle[, callback])
+- `handle` {Object}
+- `callback` {Function}
+
 ### server.listen(path[, callback])
-### server.listen(port[, host][, backlog][, callback])
+- `path` {string}
+- `callback` {Function}
+
+### server.listen([port][, host][, backlog][, callback])
+- `port` {number}
+- `hostname` {string}
+- `backlog` {number}
+- `callback` {Function}
 
 See [`http.listen()`][] for details.
 
-## https.get(options, callback)
+## https.get(options[, callback])
 <!-- YAML
 added: v0.3.6
 -->
+- `options` {Object | string} Accepts the same `options` as
+  [`https.request()`][], with the `method` always set to `GET`.
+- `callback` {Function}
 
 Like [`http.get()`][] but for HTTPS.
 
@@ -127,18 +142,27 @@ added: v0.5.9
 
 Global instance of [`https.Agent`][] for all HTTPS client requests.
 
-## https.request(options, callback)
+## https.request(options[, callback])
 <!-- YAML
 added: v0.3.6
 -->
+- `options` {Object | string} Accepts all `options` from [`http.request()`][],
+  with some differences in default values:
+  - `protocol` Defaults to `https:`
+  - `port` Defaults to `443`.
+  - `agent` Defaults to `https.globalAgent`.
+- `callback` {Function}
+
 
 Makes a request to a secure web server.
 
+The following additional `options` from [`tls.connect()`][] are also accepted when using a
+  custom [`Agent`][]:
+  `pfx`, `key`, `passphrase`, `cert`, `ca`, `ciphers`, `rejectUnauthorized`, `secureProtocol`, `servername`
+
 `options` can be an object or a string. If `options` is a string, it is
 automatically parsed with [`url.parse()`][].
 
-All options from [`http.request()`][] are valid.
-
 Example:
 
 ```js
@@ -165,58 +189,7 @@ req.on('error', (e) => {
 });
 req.end();
 ```
-
-The options argument has the following options
-
-- `host`: A domain name or IP address of the server to issue the request to.
-  Defaults to `'localhost'`.
-- `hostname`: Alias for `host`. To support `url.parse()` `hostname` is
-  preferred over `host`.
-- `family`: IP address family to use when resolving `host` and `hostname`.
-  Valid values are `4` or `6`. When unspecified, both IP v4 and v6 will be
-  used.
-- `port`: Port of remote server. Defaults to 443.
-- `localAddress`: Local interface to bind for network connections.
-- `socketPath`: Unix Domain Socket (use one of host:port or socketPath).
-- `method`: A string specifying the HTTP request method. Defaults to `'GET'`.
-- `path`: Request path. Defaults to `'/'`. Should include query string if any.
-  E.G. `'/index.html?page=12'`. An exception is thrown when the request path
-  contains illegal characters. Currently, only spaces are rejected but that
-  may change in the future.
-- `headers`: An object containing request headers.
-- `auth`: Basic authentication i.e. `'user:password'` to compute an
-  Authorization header.
-- `agent`: Controls [`Agent`][] behavior. When an Agent is used request will
-  default to `Connection: keep-alive`. Possible values:
- - `undefined` (default): use [`globalAgent`][] for this host and port.
- - `Agent` object: explicitly use the passed in `Agent`.
- - `false`: opts out of connection pooling with an Agent, defaults request to
-   `Connection: close`.
-
-The following options from [`tls.connect()`][] can also be specified:
-
-- `pfx`: Certificate, Private key and CA certificates to use for SSL. Default `null`.
-- `key`: Private key to use for SSL. Default `null`.
-- `passphrase`: A string of passphrase for the private key or pfx. Default `null`.
-- `cert`: Public x509 certificate to use. Default `null`.
-- `ca`: A string, [`Buffer`][] or array of strings or [`Buffer`][]s of trusted
-  certificates in PEM format. If this is omitted several well known "root"
-  CAs will be used, like VeriSign. These are used to authorize connections.
-- `ciphers`: A string describing the ciphers to use or exclude. Consult
-  <https://www.openssl.org/docs/man1.0.2/apps/ciphers.html#CIPHER-LIST-FORMAT> for
-  details on the format.
-- `rejectUnauthorized`: If `true`, the server certificate is verified against
-  the list of supplied CAs. An `'error'` event is emitted if verification
-  fails. Verification happens at the connection level, *before* the HTTP
-  request is sent. Default `true`.
-- `secureProtocol`: The SSL method to use, e.g. `SSLv3_method` to force
-  SSL version 3. The possible values depend on your installation of
-  OpenSSL and are defined in the constant [`SSL_METHODS`][].
-- `servername`: Servername for SNI (Server Name Indication) TLS extension.
-
-In order to specify these options, use a custom [`Agent`][].
-
-Example:
+Example using options from [`tls.connect()`][]:
 
 ```js
 const options = {
@@ -270,4 +243,5 @@ const req = https.request(options, (res) => {
 [`SSL_METHODS`]: https://www.openssl.org/docs/man1.0.2/ssl/ssl.html#DEALING-WITH-PROTOCOL-METHODS
 [`tls.connect()`]: tls.html#tls_tls_connect_options_callback
 [`tls.createServer()`]: tls.html#tls_tls_createserver_options_secureconnectionlistener
+[`tls.createSecureContext()`]: tls.html#tls_tls_createsecurecontext_options
 [`url.parse()`]: url.html#url_url_parse_urlstring_parsequerystring_slashesdenotehost
diff --git a/doc/api/modules.md b/doc/api/modules.md
index cdbbf14fa43310..9621c72ccee0e4 100644
--- a/doc/api/modules.md
+++ b/doc/api/modules.md
@@ -586,7 +586,7 @@ function require(/* ... */) {
 added: v0.1.16
 -->
 
-* {String}
+* {string}
 
 The fully resolved filename to the module.
 
@@ -595,7 +595,7 @@ The fully resolved filename to the module.
 added: v0.1.16
 -->
 
-* {String}
+* {string}
 
 The identifier for the module.  Typically this is the fully resolved
 filename.
@@ -605,7 +605,7 @@ filename.
 added: v0.1.16
 -->
 
-* {Boolean}
+* {boolean}
 
 Whether or not the module is done loading, or is in the process of
 loading.
@@ -624,7 +624,7 @@ The module that first required this one.
 added: v0.5.1
 -->
 
-* `id` {String}
+* `id` {string}
 * Returns: {Object} `module.exports` from the resolved module
 
 The `module.require` method provides a way to load a module as if
diff --git a/doc/api/net.md b/doc/api/net.md
index d7219efe5b3548..e6bbb05b0e2c61 100644
--- a/doc/api/net.md
+++ b/doc/api/net.md
@@ -123,7 +123,7 @@ added: v0.5.10
 -->
 
 * `handle` {Object}
-* `backlog` {Number}
+* `backlog` {number}
 * `callback` {Function}
 
 The `handle` object can be set to either a server or socket (anything
@@ -149,11 +149,11 @@ added: v0.11.14
 -->
 
 * `options` {Object} - Required. Supports the following properties:
-  * `port` {Number} - Optional.
-  * `host` {String} - Optional.
-  * `backlog` {Number} - Optional.
-  * `path` {String} - Optional.
-  * `exclusive` {Boolean} - Optional.
+  * `port` {number} - Optional.
+  * `host` {string} - Optional.
+  * `backlog` {number} - Optional.
+  * `path` {string} - Optional.
+  * `exclusive` {boolean} - Optional.
 * `callback` {Function} - Optional.
 
 The `port`, `host`, and `backlog` properties of `options`, as well as the
@@ -183,8 +183,8 @@ subsequent call will *re-open* the server using the provided options.
 added: v0.1.90
 -->
 
-* `path` {String}
-* `backlog` {Number}
+* `path` {string}
+* `backlog` {number}
 * `callback` {Function}
 
 Start a local socket server listening for connections on the given `path`.
@@ -343,7 +343,7 @@ About `allowHalfOpen`, refer to [`net.createServer()`][] and [`'end'`][] event.
 added: v0.1.90
 -->
 
-* `had_error` {Boolean} `true` if the socket had a transmission error.
+* `had_error` {boolean} `true` if the socket had a transmission error.
 
 Emitted once the socket is fully closed. The argument `had_error` is a boolean
 which says if the socket was closed due to a transmission error.
@@ -410,10 +410,10 @@ added: v0.11.3
 Emitted after resolving the hostname but before connecting.
 Not applicable to UNIX sockets.
 
-* `err` {Error|Null} The error object.  See [`dns.lookup()`][].
-* `address` {String} The IP address.
-* `family` {String|Null} The address type.  See [`dns.lookup()`][].
-* `host` {String} The hostname.
+* `err` {Error|null} The error object.  See [`dns.lookup()`][].
+* `address` {string} The IP address.
+* `family` {string|null} The address type.  See [`dns.lookup()`][].
+* `host` {string} The hostname.
 
 ### Event: 'timeout'
 <!-- YAML
diff --git a/doc/api/os.md b/doc/api/os.md
index b2e096d8d9ff0b..4009e53bcd5eac 100644
--- a/doc/api/os.md
+++ b/doc/api/os.md
@@ -14,7 +14,7 @@ const os = require('os');
 added: v0.7.8
 -->
 
-* {String}
+* {string}
 
 A string constant defining the operating system-specific end-of-line marker:
 
@@ -26,7 +26,7 @@ A string constant defining the operating system-specific end-of-line marker:
 added: v0.5.0
 -->
 
-* Returns: {String}
+* Returns: {string}
 
 The `os.arch()` method returns a string identifying the operating system CPU
 architecture *for which the Node.js binary was compiled*.
@@ -60,7 +60,7 @@ each CPU/core installed.
 
 The properties included on each object include:
 
-* `model` {String}
+* `model` {string}
 * `speed` {number} (in MHz)
 * `times` {Object}
   * `user` {number} The number of milliseconds the CPU has spent in user mode.
@@ -172,7 +172,7 @@ all processors are always 0.
 added: v0.9.4
 -->
 
-* Returns: {String}
+* Returns: {string}
 
 The `os.endianness()` method returns a string identifying the endianness of the
 CPU *for which the Node.js binary was compiled*.
@@ -187,7 +187,7 @@ Possible values are:
 added: v0.3.3
 -->
 
-* Returns: {Integer}
+* Returns: {integer}
 
 The `os.freemem()` method returns the amount of free system memory in bytes as
 an integer.
@@ -197,7 +197,7 @@ an integer.
 added: v2.3.0
 -->
 
-* Returns: {String}
+* Returns: {string}
 
 The `os.homedir()` method returns the home directory of the current user as a
 string.
@@ -207,7 +207,7 @@ string.
 added: v0.3.3
 -->
 
-* Returns: {String}
+* Returns: {string}
 
 The `os.hostname()` method returns the hostname of the operating system as a
 string.
@@ -244,10 +244,10 @@ value is an array of objects that each describe an assigned network address.
 
 The properties available on the assigned network address object include:
 
-* `address` {String} The assigned IPv4 or IPv6 address
-* `netmask` {String} The IPv4 or IPv6 network mask
-* `family` {String} Either `IPv4` or `IPv6`
-* `mac` {String} The MAC address of the network interface
+* `address` {string} The assigned IPv4 or IPv6 address
+* `netmask` {string} The IPv4 or IPv6 network mask
+* `family` {string} Either `IPv4` or `IPv6`
+* `mac` {string} The MAC address of the network interface
 * `internal` {boolean} `true` if the network interface is a loopback or
   similar interface that is not remotely accessible; otherwise `false`
 * `scopeid` {number} The numeric IPv6 scope ID (only specified when `family`
@@ -295,7 +295,7 @@ The properties available on the assigned network address object include:
 added: v0.5.0
 -->
 
-* Returns: {String}
+* Returns: {string}
 
 The `os.platform()` method returns a string identifying the operating system
 platform as set during compile time of Node.js.
@@ -321,7 +321,7 @@ to be experimental at this time.
 added: v0.3.3
 -->
 
-* Returns: {String}
+* Returns: {string}
 
 The `os.release()` method returns a string identifying the operating system
 release.
@@ -335,7 +335,7 @@ https://en.wikipedia.org/wiki/Uname#Examples for more information.
 added: v0.9.9
 -->
 
-* Returns: {String}
+* Returns: {string}
 
 The `os.tmpdir()` method returns a string specifying the operating system's
 default directory for temporary files.
@@ -345,7 +345,7 @@ default directory for temporary files.
 added: v0.3.3
 -->
 
-* Returns: {Integer}
+* Returns: {integer}
 
 The `os.totalmem()` method returns the total amount of system memory in bytes
 as an integer.
@@ -355,7 +355,7 @@ as an integer.
 added: v0.3.3
 -->
 
-* Returns: {String}
+* Returns: {string}
 
 The `os.type()` method returns a string identifying the operating system name
 as returned by uname(3). For example `'Linux'` on Linux, `'Darwin'` on macOS and
@@ -369,13 +369,12 @@ information about the output of running uname(3) on various operating systems.
 added: v0.3.3
 -->
 
-* Returns: {Integer}
+* Returns: {integer}
 
 The `os.uptime()` method returns the system uptime in number of seconds.
 
-*Note*: Within Node.js' internals, this number is represented as a `double`.
-However, fractional seconds are not returned and the value can typically be
-treated as an integer.
+*Note*: On Windows the returned value includes fractions of a second.
+Use `Math.floor()` to get whole seconds.
 
 ## os.userInfo([options])
 <!-- YAML
@@ -383,7 +382,7 @@ added: v6.0.0
 -->
 
 * `options` {Object}
-  * `encoding` {String} Character encoding used to interpret resulting strings.
+  * `encoding` {string} Character encoding used to interpret resulting strings.
     If `encoding` is set to `'buffer'`, the `username`, `shell`, and `homedir`
     values will be `Buffer` instances. (Default: 'utf8')
 * Returns: {Object}
diff --git a/doc/api/path.md b/doc/api/path.md
index 0c78c916497f6c..a44bacb4657c10 100644
--- a/doc/api/path.md
+++ b/doc/api/path.md
@@ -59,9 +59,9 @@ path.posix.basename('/tmp/myfile.html');
 added: v0.1.25
 -->
 
-* `path` {String}
-* `ext` {String} An optional file extension
-* Returns: {String}
+* `path` {string}
+* `ext` {string} An optional file extension
+* Returns: {string}
 
 The `path.basename()` methods returns the last portion of a `path`, similar to
 the Unix `basename` command. Trailing directory separators are ignored, see
@@ -85,7 +85,7 @@ and is not a string.
 added: v0.9.3
 -->
 
-* {String}
+* {string}
 
 Provides the platform-specific path delimiter:
 
@@ -117,8 +117,8 @@ process.env.PATH.split(path.delimiter)
 added: v0.1.16
 -->
 
-* `path` {String}
-* Returns: {String}
+* `path` {string}
+* Returns: {string}
 
 The `path.dirname()` method returns the directory name of a `path`, similar to
 the Unix `dirname` command. Trailing directory separators are ignored, see
@@ -138,8 +138,8 @@ A [`TypeError`][] is thrown if `path` is not a string.
 added: v0.1.25
 -->
 
-* `path` {String}
-* Returns: {String}
+* `path` {string}
+* Returns: {string}
 
 The `path.extname()` method returns the extension of the `path`, from the last
 occurrence of the `.` (period) character to end of string in the last portion of
@@ -174,12 +174,12 @@ added: v0.11.15
 -->
 
 * `pathObject` {Object}
-  * `dir` {String}
-  * `root` {String}
-  * `base` {String}
-  * `name` {String}
-  * `ext` {String}
-* Returns: {String}
+  * `dir` {string}
+  * `root` {string}
+  * `base` {string}
+  * `name` {string}
+  * `ext` {string}
+* Returns: {string}
 
 The `path.format()` method returns a path string from an object. This is the
 opposite of [`path.parse()`][].
@@ -237,8 +237,8 @@ path.format({
 added: v0.11.2
 -->
 
-* `path` {String}
-* Returns: {Boolean}
+* `path` {string}
+* Returns: {boolean}
 
 The `path.isAbsolute()` method determines if `path` is an absolute path.
 
@@ -272,8 +272,8 @@ A [`TypeError`][] is thrown if `path` is not a string.
 added: v0.1.16
 -->
 
-* `...paths` {String} A sequence of path segments
-* Returns: {String}
+* `...paths` {string} A sequence of path segments
+* Returns: {string}
 
 The `path.join()` method joins all given `path` segments together using the
 platform specific separator as a delimiter, then normalizes the resulting path.
@@ -299,8 +299,8 @@ A [`TypeError`][] is thrown if any of the path segments is not a string.
 added: v0.1.23
 -->
 
-* `path` {String}
-* Returns: {String}
+* `path` {string}
+* Returns: {string}
 
 The `path.normalize()` method normalizes the given `path`, resolving `'..'` and
 `'.'` segments.
@@ -333,7 +333,7 @@ A [`TypeError`][] is thrown if `path` is not a string.
 added: v0.11.15
 -->
 
-* `path` {String}
+* `path` {string}
 * Returns: {Object}
 
 The `path.parse()` method returns an object whose properties represent
@@ -342,11 +342,11 @@ see [`path.sep`][].
 
 The returned object will have the following properties:
 
-* `root` {String}
-* `dir` {String}
-* `base` {String}
-* `ext` {String}
-* `name` {String}
+* `root` {string}
+* `dir` {string}
+* `base` {string}
+* `ext` {string}
+* `name` {string}
 
 For example on POSIX:
 
@@ -413,9 +413,9 @@ of the `path` methods.
 added: v0.5.0
 -->
 
-* `from` {String}
-* `to` {String}
-* Returns: {String}
+* `from` {string}
+* `to` {string}
+* Returns: {string}
 
 The `path.relative()` method returns the relative path from `from` to `to`.
 If `from` and `to` each resolve to the same path (after calling `path.resolve()`
@@ -445,8 +445,8 @@ A [`TypeError`][] is thrown if neither `from` nor `to` is a string.
 added: v0.3.4
 -->
 
-* `...paths` {String} A sequence of paths or path segments
-* Returns: {String}
+* `...paths` {string} A sequence of paths or path segments
+* Returns: {string}
 
 The `path.resolve()` method resolves a sequence of paths or path segments into
 an absolute path.
@@ -488,7 +488,7 @@ A [`TypeError`][] is thrown if any of the arguments is not a string.
 added: v0.7.9
 -->
 
-* {String}
+* {string}
 
 Provides the platform-specific path segment separator:
 
diff --git a/doc/api/process.md b/doc/api/process.md
index 5d4c08f1438189..57fe5ffef427dd 100644
--- a/doc/api/process.md
+++ b/doc/api/process.md
@@ -268,9 +268,9 @@ lead to sub-optimal application performance, bugs or security vulnerabilities.
 The listener function is called with a single `warning` argument whose value is
 an `Error` object. There are three key properties that describe the warning:
 
-* `name` {String} The name of the warning (currently `Warning` by default).
-* `message` {String} A system-provided description of the warning.
-* `stack` {String} A stack trace to the location in the code where the warning
+* `name` {string} The name of the warning (currently `Warning` by default).
+* `message` {string} A system-provided description of the warning.
+* `stack` {string} A stack trace to the location in the code where the warning
   was issued.
 
 ```js
@@ -447,7 +447,7 @@ generate a core file.
 added: v0.5.0
 -->
 
-* {String}
+* {string}
 
 The `process.arch` property returns a String identifying the processor
 architecture that the Node.js process is currently running on. For instance
@@ -501,7 +501,7 @@ Would generate the output:
 added: 6.4.0
 -->
 
-* {String}
+* {string}
 
 The `process.argv0` property stores a read-only copy of the original value of
 `argv[0]` passed when Node.js starts.
@@ -519,7 +519,7 @@ $ bash -c 'exec -a customArgv0 ./node'
 added: v0.1.17
 -->
 
-* `directory` {String}
+* `directory` {string}
 
 The `process.chdir()` method changes the current working directory of the
 Node.js process or throws an exception if doing so fails (for instance, if
@@ -586,7 +586,7 @@ replace the value of `process.config`.
 added: v0.7.2
 -->
 
-* {Boolean}
+* {boolean}
 
 If the Node.js process is spawned with an IPC channel (see the [Child Process][]
 and [Cluster][] documentation), the `process.connected` property will return
@@ -604,8 +604,8 @@ added: v6.1.0
 * `previousValue` {Object} A previous return value from calling
   `process.cpuUsage()`
 * Returns: {Object}
-    * `user` {Integer}
-    * `system` {Integer}
+    * `user` {integer}
+    * `system` {integer}
 
 The `process.cpuUsage()` method returns the user and system CPU time usage of
 the current process, in an object with properties `user` and `system`, whose
@@ -633,7 +633,7 @@ console.log(process.cpuUsage(startUsage));
 added: v0.1.8
 -->
 
-* Returns: {String}
+* Returns: {string}
 
 The `process.cwd()` method returns the current working directory of the Node.js
 process.
@@ -740,8 +740,8 @@ console.log(process.env.test);
 added: v6.0.0
 -->
 
-* `warning` {String | Error} The warning to emit.
-* `name` {String} When `warning` is a String, `name` is the name to use
+* `warning` {string | Error} The warning to emit.
+* `name` {string} When `warning` is a String, `name` is the name to use
   for the warning. Default: `Warning`.
 * `ctor` {Function} When `warning` is a String, `ctor` is an optional
   function used to limit the generated stack trace. Default
@@ -861,7 +861,7 @@ And `process.argv`:
 added: v0.1.100
 -->
 
-* {String}
+* {string}
 
 The `process.execPath` property returns the absolute pathname of the executable
 that started the Node.js process.
@@ -878,7 +878,7 @@ For example:
 added: v0.1.13
 -->
 
-* `code` {Integer} The exit code. Defaults to `0`.
+* `code` {integer} The exit code. Defaults to `0`.
 
 The `process.exit()` method instructs Node.js to terminate the process
 synchronously with an exit status of `code`. If `code` is omitted, exit uses
@@ -943,7 +943,7 @@ is safer than calling `process.exit()`.
 added: v0.11.8
 -->
 
-* {Integer}
+* {integer}
 
 A number which will be the process exit code, when the process either
 exits gracefully, or is exited via [`process.exit()`][] without specifying
@@ -1028,7 +1028,7 @@ Android)
 added: v0.1.28
 -->
 
-* Returns: {Integer}
+* Returns: {integer}
 
 The `process.getuid()` method returns the numeric user identity of the process.
 (See getuid(2).)
@@ -1080,8 +1080,8 @@ passing the result to process.hrtime() will result in undefined behavior.
 added: v0.9.4
 -->
 
-* `user` {String|number} The user name or numeric identifier.
-* `extra_group` {String|number} A group name or numeric identifier.
+* `user` {string|number} The user name or numeric identifier.
+* `extra_group` {string|number} A group name or numeric identifier.
 
 The `process.initgroups()` method reads the `/etc/group` file and initializes
 the group access list, using all groups of which the user is a member. This is
@@ -1107,7 +1107,7 @@ added: v0.0.6
 -->
 
 * `pid` {number} A process ID
-* `signal` {String|number} The signal to send, either as a string or number.
+* `signal` {string|number} The signal to send, either as a string or number.
   Defaults to `'SIGTERM'`.
 
 The `process.kill()` method sends the `signal` to the process identified by
@@ -1163,10 +1163,10 @@ added: v0.1.16
 -->
 
 * Returns: {Object}
-    * `rss` {Integer}
-    * `heapTotal` {Integer}
-    * `heapUsed` {Integer}
-    * `external` {Integer}
+    * `rss` {integer}
+    * `heapTotal` {integer}
+    * `heapUsed` {integer}
+    * `external` {integer}
 
 The `process.memoryUsage()` method returns an object describing the memory usage
 of the Node.js process measured in bytes.
@@ -1291,7 +1291,7 @@ happening, just like a `while(true);` loop.
 added: v0.1.15
 -->
 
-* {Integer}
+* {integer}
 
 The `process.pid` property returns the PID of the process.
 
@@ -1304,7 +1304,7 @@ console.log(`This process is pid ${process.pid}`);
 added: v0.1.16
 -->
 
-* {String}
+* {string}
 
 The `process.platform` property returns a string identifying the operating
 system platform on which the Node.js process is running. For instance
@@ -1325,7 +1325,7 @@ tarball.
 
 `process.release` contains the following properties:
 
-* `name` {String} A value that will always be `'node'` for Node.js. For
+* `name` {string} A value that will always be `'node'` for Node.js. For
   legacy io.js releases, this will be `'io.js'`.
 * `lts`: a string with a value indicating the _codename_ of the LTS (Long-term
   Support) line the current release is part of. This property only exists for
@@ -1333,17 +1333,17 @@ tarball.
   releases. Current valid values are:
   - `"Argon"` for the v4.x LTS line beginning with v4.2.0.
   - `"Boron"` for the v6.x LTS line beginning with v6.9.0.
-* `sourceUrl` {String} an absolute URL pointing to a _`.tar.gz`_ file containing
+* `sourceUrl` {string} an absolute URL pointing to a _`.tar.gz`_ file containing
   the source code of the current release.
-* `headersUrl`{String} an absolute URL pointing to a _`.tar.gz`_ file containing
+* `headersUrl`{string} an absolute URL pointing to a _`.tar.gz`_ file containing
   only the source header files for the current release. This file is
   significantly smaller than the full source file and can be used for compiling
   Node.js native add-ons.
-* `libUrl` {String} an absolute URL pointing to a _`node.lib`_ file matching the
+* `libUrl` {string} an absolute URL pointing to a _`node.lib`_ file matching the
   architecture and version of the current release. This file is used for
   compiling Node.js native add-ons. _This property is only present on Windows
   builds of Node.js and will be missing on all other platforms._
-* `lts` {String} a string label identifying the [LTS][] label for this release.
+* `lts` {string} a string label identifying the [LTS][] label for this release.
   If the Node.js release is not an LTS release, this will be `undefined`.
 
 For example:
@@ -1371,7 +1371,7 @@ added: v0.5.9
 * `sendHandle` {Handle object}
 * `options` {Object}
 * `callback` {Function}
-* Returns: {Boolean}
+* Returns: {boolean}
 
 If Node.js is spawned with an IPC channel, the `process.send()` method can be
 used to send messages to the parent process. Messages will be received as a
@@ -1388,7 +1388,7 @@ If Node.js was not spawned with an IPC channel, `process.send()` will be
 added: v2.0.0
 -->
 
-* `id` {String|number} A group name or ID
+* `id` {string|number} A group name or ID
 
 The `process.setegid()` method sets the effective group identity of the process.
 (See setegid(2).) The `id` can be passed as either a numeric ID or a group
@@ -1417,7 +1417,7 @@ Android)
 added: v2.0.0
 -->
 
-* `id` {String|number} A user name or ID
+* `id` {string|number} A user name or ID
 
 The `process.seteuid()` method sets the effective user identity of the process.
 (See seteuid(2).) The `id` can be passed as either a numeric ID or a username
@@ -1445,7 +1445,7 @@ Android)
 added: v0.1.31
 -->
 
-* `id` {String|number} The group name or ID
+* `id` {string|number} The group name or ID
 
 The `process.setgid()` method sets the group identity of the process. (See
 setgid(2).)  The `id` can be passed as either a numeric ID or a group name
@@ -1629,7 +1629,7 @@ See the [TTY][] documentation for more information.
 added: v0.1.104
 -->
 
-* {String}
+* {string}
 
 The `process.title` property returns the current process title (i.e. returns
 the current value of `ps`). Assigning a new value to `process.title` modifies
@@ -1670,17 +1670,20 @@ console.log(
 added: v0.5.0
 -->
 
-* Returns: {Number}
+* Returns: {number}
 
 The `process.uptime()` method returns the number of seconds the current Node.js
 process has been running.
 
+*Note*: the return value includes fractions of a second. Use `Math.floor()`
+to get whole seconds.
+
 ## process.version
 <!-- YAML
 added: v0.1.3
 -->
 
-* {String}
+* {string}
 
 The `process.version` property returns the Node.js version string.
 
diff --git a/doc/api/punycode.md b/doc/api/punycode.md
index a5d1908a8c40b6..87d1c7d80ad431 100644
--- a/doc/api/punycode.md
+++ b/doc/api/punycode.md
@@ -34,7 +34,7 @@ the module must be directed to the [Punycode.js][] project.
 added: v0.5.1
 -->
 
-* `string` {String}
+* `string` {string}
 
 The `punycode.decode()` method converts a [Punycode][] string of ASCII-only
 characters to the equivalent string of Unicode codepoints.
@@ -49,7 +49,7 @@ punycode.decode('--dqo34k'); // '☃-⌘'
 added: v0.5.1
 -->
 
-* `string` {String}
+* `string` {string}
 
 The `punycode.encode()` method converts a string of Unicode codepoints to a
 [Punycode][] string of ASCII-only characters.
@@ -64,7 +64,7 @@ punycode.encode('☃-⌘'); // '--dqo34k'
 added: v0.6.1
 -->
 
-* `domain` {String}
+* `domain` {string}
 
 The `punycode.toASCII()` method converts a Unicode string representing an
 Internationalized Domain Name to [Punycode][]. Only the non-ASCII parts of the
@@ -83,7 +83,7 @@ punycode.toASCII('example.com'); // 'example.com'
 added: v0.6.1
 -->
 
-* `domain` {String}
+* `domain` {string}
 
 The `punycode.toUnicode()` method converts a string representing a domain name
 containing [Punycode][] encoded characters into Unicode. Only the [Punycode][]
@@ -106,7 +106,7 @@ added: v0.7.0
 added: v0.7.0
 -->
 
-* `string` {String}
+* `string` {string}
 
 The `punycode.ucs2.decode()` method returns an array containing the numeric
 codepoint values of each Unicode symbol in the string.
diff --git a/doc/api/querystring.md b/doc/api/querystring.md
index 4dc6585397c063..a1ee5e62b87700 100644
--- a/doc/api/querystring.md
+++ b/doc/api/querystring.md
@@ -16,7 +16,7 @@ const querystring = require('querystring');
 added: v0.1.25
 -->
 
-* `str` {String}
+* `str` {string}
 
 The `querystring.escape()` method performs URL percent-encoding on the given
 `str` in a manner that is optimized for the specific requirements of URL
@@ -32,10 +32,10 @@ necessary by assigning `querystring.escape` to an alternative function.
 added: v0.1.25
 -->
 
-* `str` {String} The URL query string to parse
-* `sep` {String} The substring used to delimit key and value pairs in the
+* `str` {string} The URL query string to parse
+* `sep` {string} The substring used to delimit key and value pairs in the
   query string. Defaults to `'&'`.
-* `eq` {String}. The substring used to delimit keys and values in the
+* `eq` {string}. The substring used to delimit keys and values in the
   query string. Defaults to `'='`.
 * `options` {Object}
   * `decodeURIComponent` {Function} The function to use when decoding
@@ -79,9 +79,9 @@ added: v0.1.25
 -->
 
 * `obj` {Object} The object to serialize into a URL query string
-* `sep` {String} The substring used to delimit key and value pairs in the
+* `sep` {string} The substring used to delimit key and value pairs in the
   query string. Defaults to `'&'`.
-* `eq` {String}. The substring used to delimit keys and values in the
+* `eq` {string}. The substring used to delimit keys and values in the
   query string. Defaults to `'='`.
 * `options`
   * `encodeURIComponent` {Function} The function to use when converting
@@ -121,7 +121,7 @@ querystring.stringify({ w: '中文', foo: 'bar' }, null, null,
 <!-- YAML
 added: v0.1.25
 -->
-* `str` {String}
+* `str` {string}
 
 
 The `querystring.unescape()` method performs decoding of URL percent-encoded
diff --git a/doc/api/readline.md b/doc/api/readline.md
index acbb94c3e95edb..6fdee2c0449de5 100644
--- a/doc/api/readline.md
+++ b/doc/api/readline.md
@@ -158,7 +158,7 @@ For example:
 
 ```js
 rl.on('SIGINT', () => {
-  rl.question('Are you sure you want to exit?', (answer) => {
+  rl.question('Are you sure you want to exit? ', (answer) => {
     if (answer.match(/^y(es)?$/i)) rl.pause();
   });
 });
@@ -237,7 +237,7 @@ If the `readline.Interface` was created with `output` set to `null` or
 added: v0.3.3
 -->
 
-* `query` {String} A statement or query to write to `output`, prepended to the
+* `query` {string} A statement or query to write to `output`, prepended to the
   prompt.
 * `callback` {Function} A callback function that is invoked with the user's
   input in response to the `query`.
@@ -255,7 +255,7 @@ If the `readline.Interface` was created with `output` set to `null` or
 Example usage:
 
 ```js
-rl.question('What is your favorite food?', (answer) => {
+rl.question('What is your favorite food? ', (answer) => {
   console.log(`Oh, so your favorite food is ${answer}`);
 });
 ```
@@ -276,7 +276,7 @@ The `rl.resume()` method resumes the `input` stream if it has been paused.
 added: v0.1.98
 -->
 
-* `prompt` {String}
+* `prompt` {string}
 
 The `rl.setPrompt()` method sets the prompt that will be written to `output`
 whenever `rl.prompt()` is called.
@@ -286,12 +286,12 @@ whenever `rl.prompt()` is called.
 added: v0.1.98
 -->
 
-* `data` {String}
+* `data` {string}
 * `key` {Object}
   * `ctrl` {boolean} `true` to indicate the `<ctrl>` key.
   * `meta` {boolean} `true` to indicate the `<Meta>` key.
   * `shift` {boolean} `true` to indicate the `<Shift>` key.
-  * `name` {String} The name of the a key.
+  * `name` {string} The name of the a key.
 
 The `rl.write()` method will write either `data` or a key sequence  identified
 by `key` to the `output`. The `key` argument is supported only if `output` is
@@ -407,7 +407,7 @@ For instance: `[[substr1, substr2, ...], originalsubstring]`.
 ```js
 function completer(line) {
   const completions = '.help .error .exit .quit .q'.split(' ');
-  const hits = completions.filter((c) => { return c.indexOf(line) === 0 });
+  const hits = completions.filter((c) => c.startsWith(line));
   // show all completions if none found
   return [hits.length ? hits : completions, line];
 }
@@ -463,7 +463,7 @@ added: v0.7.7
 
 * `stream` {Writable}
 * `dx` {number}
-* `dy` {Number}
+* `dy` {number}
 
 The `readline.moveCursor()` method moves the cursor *relative* to its current
 position in a given [TTY][] `stream`.
diff --git a/doc/api/repl.md b/doc/api/repl.md
index 9ff416e004f4b3..248d87991bb8ff 100644
--- a/doc/api/repl.md
+++ b/doc/api/repl.md
@@ -304,7 +304,7 @@ Clearing context...
 added: v0.3.0
 -->
 
-* `keyword` {String} The command keyword (*without* a leading `.` character).
+* `keyword` {string} The command keyword (*without* a leading `.` character).
 * `cmd` {Object|Function} The function to invoke when the command is processed.
 
 The `replServer.defineCommand()` method is used to add new `.`-prefixed commands
@@ -312,7 +312,7 @@ to the REPL instance. Such commands are invoked by typing a `.` followed by the
 `keyword`. The `cmd` is either a Function or an object with the following
 properties:
 
-* `help` {String} Help text to be displayed when `.help` is entered (Optional).
+* `help` {string} Help text to be displayed when `.help` is entered (Optional).
 * `action` {Function} The function to execute, optionally accepting a single
   string argument.
 
@@ -351,7 +351,7 @@ Goodbye!
 added: v0.1.91
 -->
 
-* `preserveCursor` {Boolean}
+* `preserveCursor` {boolean}
 
 The `replServer.displayPrompt()` method readies the REPL instance for input
 from the user, printing the configured `prompt` to a new line in the `output`
@@ -371,8 +371,8 @@ within the action function for commands registered using the
 added: v0.1.91
 -->
 
-* `options` {Object | String}
-  * `prompt` {String} The input prompt to display. Defaults to `> `.
+* `options` {Object | string}
+  * `prompt` {string} The input prompt to display. Defaults to `> `.
   * `input` {Readable} The Readable stream from which REPL input will be read.
     Defaults to `process.stdin`.
   * `output` {Writable} The Writable stream to which REPL output will be
diff --git a/doc/api/stream.md b/doc/api/stream.md
index 35755185eb9c4e..6464d453840d13 100644
--- a/doc/api/stream.md
+++ b/doc/api/stream.md
@@ -354,10 +354,10 @@ See also: [`writable.uncork()`][].
 added: v0.9.4
 -->
 
-* `chunk` {String|Buffer|any} Optional data to write. For streams not operating
+* `chunk` {string|Buffer|any} Optional data to write. For streams not operating
   in object mode, `chunk` must be a string or a `Buffer`. For object mode
   streams, `chunk` may be any JavaScript value other than `null`.
-* `encoding` {String} The encoding, if `chunk` is a String
+* `encoding` {string} The encoding, if `chunk` is a String
 * `callback` {Function} Optional callback for when the stream is finished
 
 Calling the `writable.end()` method signals that no more data will be written
@@ -382,7 +382,7 @@ file.end('world!');
 added: v0.11.15
 -->
 
-* `encoding` {String} The new default encoding
+* `encoding` {string} The new default encoding
 * Returns: `this`
 
 The `writable.setDefaultEncoding()` method sets the default `encoding` for a
@@ -431,10 +431,10 @@ See also: [`writable.cork()`][].
 added: v0.9.4
 -->
 
-* `chunk` {String|Buffer} The data to write
-* `encoding` {String} The encoding, if `chunk` is a String
+* `chunk` {string|Buffer} The data to write
+* `encoding` {string} The encoding, if `chunk` is a String
 * `callback` {Function} Callback for when this chunk of data is flushed
-* Returns: {Boolean} `false` if the stream wishes for the calling code to
+* Returns: {boolean} `false` if the stream wishes for the calling code to
   wait for the `'drain'` event to be emitted before continuing to write
   additional data; otherwise `true`.
 
@@ -616,7 +616,7 @@ Not all [Readable][] streams will emit the `'close'` event.
 added: v0.9.4
 -->
 
-* `chunk` {Buffer|String|any} The chunk of data. For streams that are not
+* `chunk` {Buffer|string|any} The chunk of data. For streams that are not
   operating in object mode, the chunk will be either a string or `Buffer`.
   For streams that are in object mode, the chunk can be any JavaScript value
   other than `null`.
@@ -732,7 +732,7 @@ preferred over the use of the `'readable'` event.
 added: v0.11.14
 -->
 
-* Returns: {Boolean}
+* Returns: {boolean}
 
 The `readable.isPaused()` method returns the current operating state of the
 Readable. This is used primarily by the mechanism that underlies the
@@ -780,7 +780,7 @@ added: v0.9.4
 
 * `destination` {stream.Writable} The destination for writing data
 * `options` {Object} Pipe options
-  * `end` {Boolean} End the writer when the reader ends. Defaults to `true`.
+  * `end` {boolean} End the writer when the reader ends. Defaults to `true`.
 
 The `readable.pipe()` method attaches a [Writable][] stream to the `readable`,
 causing it to switch automatically into flowing mode and push all of its data
@@ -836,8 +836,8 @@ options.
 added: v0.9.4
 -->
 
-* `size` {Number} Optional argument to specify how much data to read.
-* Return {String|Buffer|Null}
+* `size` {number} Optional argument to specify how much data to read.
+* Return {string|Buffer|null}
 
 The `readable.read()` method pulls some data out of the internal buffer and
 returns it. If no data available to be read, `null` is returned. By default,
@@ -908,7 +908,7 @@ getReadableStreamSomehow()
 added: v0.9.4
 -->
 
-* `encoding` {String} The encoding to use.
+* `encoding` {string} The encoding to use.
 * Returns: `this`
 
 The `readable.setEncoding()` method sets the default character encoding for
@@ -972,7 +972,7 @@ setTimeout(() => {
 added: v0.9.11
 -->
 
-* `chunk` {Buffer|String} Chunk of data to unshift onto the read queue
+* `chunk` {Buffer|string} Chunk of data to unshift onto the read queue
 
 The `readable.unshift()` method pushes a chunk of data back into the internal
 buffer. This is useful in certain situations where a stream is being consumed by
@@ -1219,13 +1219,13 @@ constructor and implement the `writable._write()` method. The
 #### Constructor: new stream.Writable([options])
 
 * `options` {Object}
-  * `highWaterMark` {Number} Buffer level when
+  * `highWaterMark` {number} Buffer level when
     [`stream.write()`][stream-write] starts returning `false`. Defaults to
     `16384` (16kb), or `16` for `objectMode` streams.
-  * `decodeStrings` {Boolean} Whether or not to decode strings into
+  * `decodeStrings` {boolean} Whether or not to decode strings into
     Buffers before passing them to [`stream._write()`][stream-_write].
     Defaults to `true`
-  * `objectMode` {Boolean} Whether or not the
+  * `objectMode` {boolean} Whether or not the
     [`stream.write(anyObj)`][stream-write] is a valid operation. When set,
     it becomes possible to write JavaScript values other than string or
     `Buffer` if supported by the stream implementation. Defaults to `false`
@@ -1278,9 +1278,9 @@ const myWritable = new Writable({
 
 #### writable.\_write(chunk, encoding, callback)
 
-* `chunk` {Buffer|String} The chunk to be written. Will **always**
+* `chunk` {Buffer|string} The chunk to be written. Will **always**
   be a buffer unless the `decodeStrings` option was set to `false`.
-* `encoding` {String} If the chunk is a string, then `encoding` is the
+* `encoding` {string} If the chunk is a string, then `encoding` is the
   character encoding of that string. If chunk is a `Buffer`, or if the
   stream is operating in object mode, `encoding` may be ignored.
 * `callback` {Function} Call this function (optionally with an error
@@ -1400,12 +1400,12 @@ constructor and implement the `readable._read()` method.
 #### new stream.Readable([options])
 
 * `options` {Object}
-  * `highWaterMark` {Number} The maximum number of bytes to store in
+  * `highWaterMark` {number} The maximum number of bytes to store in
     the internal buffer before ceasing to read from the underlying
     resource. Defaults to `16384` (16kb), or `16` for `objectMode` streams
-  * `encoding` {String} If specified, then buffers will be decoded to
+  * `encoding` {string} If specified, then buffers will be decoded to
     strings using the specified encoding. Defaults to `null`
-  * `objectMode` {Boolean} Whether this stream should behave
+  * `objectMode` {boolean} Whether this stream should behave
     as a stream of objects. Meaning that [`stream.read(n)`][stream-read] returns
     a single value instead of a Buffer of size n. Defaults to `false`
   * `read` {Function} Implementation for the [`stream._read()`][stream-_read]
@@ -1452,7 +1452,7 @@ const myReadable = new Readable({
 
 #### readable.\_read(size)
 
-* `size` {Number} Number of bytes to read asynchronously
+* `size` {number} Number of bytes to read asynchronously
 
 *Note*: **This function MUST NOT be called by application code directly.** It
 should be implemented by child classes, and called only by the internal Readable
@@ -1483,10 +1483,10 @@ user programs.
 
 #### readable.push(chunk[, encoding])
 
-* `chunk` {Buffer|Null|String} Chunk of data to push into the read queue
-* `encoding` {String} Encoding of String chunks.  Must be a valid
+* `chunk` {Buffer|null|string} Chunk of data to push into the read queue
+* `encoding` {string} Encoding of String chunks.  Must be a valid
   Buffer encoding, such as `'utf8'` or `'ascii'`
-* Returns {Boolean} `true` if additional chunks of data may continued to be
+* Returns {boolean} `true` if additional chunks of data may continued to be
   pushed; `false` otherwise.
 
 When `chunk` is a `Buffer` or `string`, the `chunk` of data will be added to the
@@ -1615,13 +1615,13 @@ constructor and implement *both* the `readable._read()` and
 
 * `options` {Object} Passed to both Writable and Readable
   constructors. Also has the following fields:
-  * `allowHalfOpen` {Boolean} Defaults to `true`. If set to `false`, then
+  * `allowHalfOpen` {boolean} Defaults to `true`. If set to `false`, then
     the stream will automatically end the readable side when the
     writable side ends and vice versa.
-  * `readableObjectMode` {Boolean} Defaults to `false`. Sets `objectMode`
+  * `readableObjectMode` {boolean} Defaults to `false`. Sets `objectMode`
     for readable side of the stream. Has no effect if `objectMode`
     is `true`.
-  * `writableObjectMode` {Boolean} Defaults to `false`. Sets `objectMode`
+  * `writableObjectMode` {boolean} Defaults to `false`. Sets `objectMode`
     for writable side of the stream. Has no effect if `objectMode`
     is `true`.
 
@@ -1857,9 +1857,9 @@ user programs.
 
 #### transform.\_transform(chunk, encoding, callback)
 
-* `chunk` {Buffer|String} The chunk to be transformed. Will **always**
+* `chunk` {Buffer|string} The chunk to be transformed. Will **always**
   be a buffer unless the `decodeStrings` option was set to `false`.
-* `encoding` {String} If the chunk is a string, then this is the
+* `encoding` {string} If the chunk is a string, then this is the
   encoding type. If chunk is a buffer, then this is the special
   value - 'buffer', ignore it in this case.
 * `callback` {Function} A callback function (optionally with an error
diff --git a/doc/api/url.md b/doc/api/url.md
index 40a3440195e69a..ce47a2b695af0e 100644
--- a/doc/api/url.md
+++ b/doc/api/url.md
@@ -136,7 +136,7 @@ For example: `'#hash'`
 added: v0.1.25
 -->
 
-* `urlObject` {Object | String} A URL object (as returned by `url.parse()` or
+* `urlObject` {Object | string} A URL object (as returned by `url.parse()` or
   constructed otherwise). If a string, it is converted to an object by passing
   it to `url.parse()`.
 
@@ -198,18 +198,59 @@ The formatting process operates as follows:
   string, an [`Error`][] is thrown.
 * `result` is returned.
 
+## url.format(URL[, options])
+
+> Stability: 1 - Experimental
+
+* `URL` {URL} A [WHATWG URL][] object
+* `options` {Object}
+  * `auth` {boolean} `true` if the serialized URL string should include the
+    username and password, `false` otherwise. Defaults to `true`.
+  * `fragment` {boolean} `true` if the serialized URL string should include the
+    fragment, `false` otherwise. Defaults to `true`.
+  * `search` {boolean} `true` if the serialized URL string should include the
+    search query, `false` otherwise. Defaults to `true`.
+  * `unicode` {boolean} `true` if Unicode characters appearing in the host
+    component of the URL string should be encoded directly as opposed to being
+    Punycode encoded. Defaults to `false`.
+
+Returns a customizable serialization of a URL String representation of a
+[WHATWG URL][] object.
+
+The URL object has both a `toString()` method and `href` property that return
+string serializations of the URL. These are not, however, customizable in
+any way. The `url.format(URL[, options])` method allows for basic customization
+of the output.
+
+For example:
+
+```js
+const myURL = new URL('https://a:b@你好你好?abc#foo');
+
+console.log(myURL.href);
+  // Prints https://a:b@xn--6qqa088eba/?abc#foo
+
+console.log(myURL.toString());
+  // Prints https://a:b@xn--6qqa088eba/?abc#foo
+
+console.log(url.format(myURL, {fragment: false, unicode: true, auth: false}));
+  // Prints 'https://你好你好?abc'
+```
+
+*Note*: This variation of the `url.format()` method is currently considered to
+be experimental.
 
 ## url.parse(urlString[, parseQueryString[, slashesDenoteHost]])
 <!-- YAML
 added: v0.1.25
 -->
 
-* `urlString` {String} The URL string to parse.
-* `parseQueryString` {Boolean} If `true`, the `query` property will always
+* `urlString` {string} The URL string to parse.
+* `parseQueryString` {boolean} If `true`, the `query` property will always
   be set to an object returned by the [`querystring`][] module's `parse()`
   method. If `false`, the `query` property on the returned URL object will be an
   unparsed, undecoded string. Defaults to `false`.
-* `slashesDenoteHost` {Boolean} If `true`, the first token after the literal
+* `slashesDenoteHost` {boolean} If `true`, the first token after the literal
   string `//` and preceding the next `/` will be interpreted as the `host`.
   For instance, given `//foo/bar`, the result would be
   `{host: 'foo', pathname: '/bar'}` rather than `{pathname: '//foo/bar'}`.
@@ -223,8 +264,8 @@ object.
 added: v0.1.25
 -->
 
-* `from` {String} The Base URL being resolved against.
-* `to` {String} The HREF URL being resolved.
+* `from` {string} The Base URL being resolved against.
+* `to` {string} The HREF URL being resolved.
 
 The `url.resolve()` method resolves a target URL relative to a base URL in a
 manner similar to that of a Web browser resolving an anchor tag HREF.
@@ -250,7 +291,6 @@ properties of URL objects:
 For example, the ASCII space character (`' '`) is encoded as `%20`. The ASCII
 forward slash (`/`) character is encoded as `%3C`.
 
-
 [`Error`]: errors.html#errors_class_error
 [`querystring`]: querystring.html
 [`TypeError`]: errors.html#errors_class_typeerror
diff --git a/doc/api/util.md b/doc/api/util.md
index 28ceac1c54d7a9..01a653250c01da 100644
--- a/doc/api/util.md
+++ b/doc/api/util.md
@@ -15,7 +15,7 @@ const util = require('util');
 added: v0.11.3
 -->
 
-* `section` {String} A string identifying the portion of the application for
+* `section` {string} A string identifying the portion of the application for
   which the `debuglog` function is being created.
 * Returns: {Function} The logging function
 
@@ -93,7 +93,7 @@ property take precedence over `--trace-deprecation` and
 added: v0.5.3
 -->
 
-* `format` {String} A `printf`-like format string.
+* `format` {string} A `printf`-like format string.
 
 The `util.format()` method returns a formatted string using the first argument
 as a `printf`-like format.
@@ -391,7 +391,7 @@ deprecated: v0.11.3
 
 > Stability: 0 - Deprecated: Use [`console.error()`][] instead.
 
-* `string` {String} The message to print to `stderr`
+* `string` {string} The message to print to `stderr`
 
 Deprecated predecessor of `console.error`.
 
@@ -403,7 +403,7 @@ deprecated: v0.11.3
 
 > Stability: 0 - Deprecated: Use [`console.error()`][] instead.
 
-* `...strings` {String} The message to print to `stderr`
+* `...strings` {string} The message to print to `stderr`
 
 Deprecated predecessor of `console.error`.
 
@@ -805,7 +805,7 @@ deprecated: v6.0.0
 
 > Stability: 0 - Deprecated: Use a third party module instead.
 
-* `string` {String}
+* `string` {string}
 
 The `util.log()` method prints the given `string` to `stdout` with an included
 timestamp.
diff --git a/doc/api/vm.md b/doc/api/vm.md
index 3a98f59677866a..f1596c617a6ac2 100644
--- a/doc/api/vm.md
+++ b/doc/api/vm.md
@@ -116,6 +116,10 @@ console.log(util.inspect(sandbox));
 // { animal: 'cat', count: 12, name: 'kitty' }
 ```
 
+*Note*: Using the `timeout` or `breakOnSigint` options will result in new
+event loops and corresponding threads being started, which have a non-zero
+performance overhead.
+
 ### script.runInNewContext([sandbox][, options])
 <!-- YAML
 added: v0.3.1
diff --git a/doc/api/zlib.md b/doc/api/zlib.md
index a2e1c7e730f0ee..92ebc8141e3850 100644
--- a/doc/api/zlib.md
+++ b/doc/api/zlib.md
@@ -408,6 +408,10 @@ added: v0.5.8
 
 Returns a new [DeflateRaw][] object with an [options][].
 
+*Note*: The zlib library rejects requests for 256-byte windows (i.e.,
+`{ windowBits: 8 }` in `options`). An `Error` will be thrown when creating a
+[DeflateRaw][] object with this specific value of the `windowBits` option.
+
 ## zlib.createGunzip([options])
 <!-- YAML
 added: v0.5.8
diff --git a/lib/_http_outgoing.js b/lib/_http_outgoing.js
index 2b0b158721f562..5bf27a2e71d1d6 100644
--- a/lib/_http_outgoing.js
+++ b/lib/_http_outgoing.js
@@ -128,8 +128,7 @@ OutgoingMessage.prototype._send = function(data, encoding, callback) {
   // this at a lower level and in a more general way.
   if (!this._headerSent) {
     if (typeof data === 'string' &&
-        encoding !== 'hex' &&
-        encoding !== 'base64') {
+        (encoding === 'utf8' || encoding === 'latin1' || !encoding)) {
       data = this._header + data;
     } else {
       this.output.unshift(this._header);
diff --git a/lib/_stream_readable.js b/lib/_stream_readable.js
index 94c4164a10ec8d..fc6252edf4ba57 100644
--- a/lib/_stream_readable.js
+++ b/lib/_stream_readable.js
@@ -698,7 +698,7 @@ Readable.prototype.on = function(ev, fn) {
       if (!state.reading) {
         process.nextTick(nReadingNextTick, this);
       } else if (state.length) {
-        emitReadable(this, state);
+        emitReadable(this);
       }
     }
   }
diff --git a/lib/internal/repl.js b/lib/internal/repl.js
index 7782d6b84bb8fe..b4167cc56aecad 100644
--- a/lib/internal/repl.js
+++ b/lib/internal/repl.js
@@ -165,22 +165,24 @@ function setupHistory(repl, historyPath, oldHistoryPath, ready) {
       }
     }
 
-    fs.open(historyPath, 'w', onhandle);
+    fs.open(historyPath, 'r+', onhandle);
   }
 
   function onhandle(err, hnd) {
     if (err) {
       return ready(err);
     }
-    repl._historyHandle = hnd;
-    repl.on('line', online);
-
-    // reading the file data out erases it
-    repl.once('flushHistory', function() {
-      repl.resume();
-      ready(null, repl);
+    fs.ftruncate(hnd, 0, (err) => {
+      repl._historyHandle = hnd;
+      repl.on('line', online);
+
+      // reading the file data out erases it
+      repl.once('flushHistory', function() {
+        repl.resume();
+        ready(null, repl);
+      });
+      flushHistory();
     });
-    flushHistory();
   }
 
   // ------ history listeners ------
diff --git a/lib/zlib.js b/lib/zlib.js
index ffb7ba6c69f000..7b7b4b2031b311 100644
--- a/lib/zlib.js
+++ b/lib/zlib.js
@@ -379,9 +379,19 @@ function Zlib(opts, mode) {
   var strategy = exports.Z_DEFAULT_STRATEGY;
   if (typeof opts.strategy === 'number') strategy = opts.strategy;
 
-  this._handle.init(opts.windowBits || exports.Z_DEFAULT_WINDOWBITS,
+  var windowBits = exports.Z_DEFAULT_WINDOWBITS;
+  if (opts.windowBits && typeof opts.windowBits === 'number') {
+    windowBits = opts.windowBits;
+  }
+
+  var memLevel = exports.Z_DEFAULT_MEMLEVEL;
+  if (opts.memLevel && typeof opts.memLevel === 'number') {
+    memLevel = opts.memLevel;
+  }
+
+  this._handle.init(windowBits,
                     level,
-                    opts.memLevel || exports.Z_DEFAULT_MEMLEVEL,
+                    memLevel,
                     strategy,
                     opts.dictionary);
 
diff --git a/node.gyp b/node.gyp
index 9035c585c320e4..8bf26e276b2648 100644
--- a/node.gyp
+++ b/node.gyp
@@ -603,6 +603,7 @@
       ],
 
       'sources': [
+        'test/cctest/test_base64.cc',
         'test/cctest/test_util.cc',
       ],
 
diff --git a/node.gypi b/node.gypi
index d704834bd338a6..6aaabeed42aac1 100644
--- a/node.gypi
+++ b/node.gypi
@@ -323,7 +323,8 @@
                    '-O0' ],
        'cflags': [ '--coverage',
                    '-g',
-                   '-O0' ]
+                   '-O0' ],
+       'cflags!': [ '-O3' ]
     }],
     [ 'OS=="sunos"', {
       'ldflags': [ '-Wl,-M,/usr/lib/ld/map.noexstk' ],
diff --git a/src/env.h b/src/env.h
index a10e699e0a73c3..bb4dab070606a8 100644
--- a/src/env.h
+++ b/src/env.h
@@ -94,7 +94,6 @@ namespace node {
   V(encoding_string, "encoding")                                              \
   V(enter_string, "enter")                                                    \
   V(env_pairs_string, "envPairs")                                             \
-  V(env_string, "env")                                                        \
   V(errno_string, "errno")                                                    \
   V(error_string, "error")                                                    \
   V(events_string, "_events")                                                 \
diff --git a/src/node.cc b/src/node.cc
index 65795653c1a6d0..73ed460f361b44 100644
--- a/src/node.cc
+++ b/src/node.cc
@@ -1378,45 +1378,48 @@ Local<Value> MakeCallback(Environment* env,
 
 
 Local<Value> MakeCallback(Isolate* isolate,
-                           Local<Object> recv,
-                           const char* method,
-                           int argc,
-                           Local<Value> argv[]) {
+                          Local<Object> recv,
+                          const char* method,
+                          int argc,
+                          Local<Value> argv[]) {
   EscapableHandleScope handle_scope(isolate);
-  Local<Context> context = recv->CreationContext();
-  Environment* env = Environment::GetCurrent(context);
-  Context::Scope context_scope(context);
+  Local<String> method_string = OneByteString(isolate, method);
   return handle_scope.Escape(
-      Local<Value>::New(isolate, MakeCallback(env, recv, method, argc, argv)));
+      MakeCallback(isolate, recv, method_string, argc, argv));
 }
 
 
 Local<Value> MakeCallback(Isolate* isolate,
-                           Local<Object> recv,
-                           Local<String> symbol,
-                           int argc,
-                           Local<Value> argv[]) {
+                          Local<Object> recv,
+                          Local<String> symbol,
+                          int argc,
+                          Local<Value> argv[]) {
   EscapableHandleScope handle_scope(isolate);
-  Local<Context> context = recv->CreationContext();
-  Environment* env = Environment::GetCurrent(context);
-  Context::Scope context_scope(context);
-  return handle_scope.Escape(
-      Local<Value>::New(isolate, MakeCallback(env, recv, symbol, argc, argv)));
+  Local<Value> callback_v = recv->Get(symbol);
+  if (callback_v.IsEmpty()) return Local<Value>();
+  if (!callback_v->IsFunction()) return Local<Value>();
+  Local<Function> callback = callback_v.As<Function>();
+  return handle_scope.Escape(MakeCallback(isolate, recv, callback, argc, argv));
 }
 
 
 Local<Value> MakeCallback(Isolate* isolate,
-                           Local<Object> recv,
-                           Local<Function> callback,
-                           int argc,
-                           Local<Value> argv[]) {
+                          Local<Object> recv,
+                          Local<Function> callback,
+                          int argc,
+                          Local<Value> argv[]) {
+  // Observe the following two subtleties:
+  //
+  // 1. The environment is retrieved from the callback function's context.
+  // 2. The context to enter is retrieved from the environment.
+  //
+  // Because of the AssignToContext() call in src/node_contextify.cc,
+  // the two contexts need not be the same.
   EscapableHandleScope handle_scope(isolate);
-  Local<Context> context = recv->CreationContext();
-  Environment* env = Environment::GetCurrent(context);
-  Context::Scope context_scope(context);
-  return handle_scope.Escape(Local<Value>::New(
-        isolate,
-        MakeCallback(env, recv.As<Value>(), callback, argc, argv)));
+  Environment* env = Environment::GetCurrent(callback->CreationContext());
+  Context::Scope context_scope(env->context());
+  return handle_scope.Escape(
+      MakeCallback(env, recv.As<Value>(), callback, argc, argv));
 }
 
 
@@ -3280,7 +3283,7 @@ void SetupProcessObject(Environment* env,
 
   Local<Object> process_env =
       process_env_template->NewInstance(env->context()).ToLocalChecked();
-  process->Set(env->env_string(), process_env);
+  process->Set(FIXED_ONE_BYTE_STRING(env->isolate(), "env"), process_env);
 
   READONLY_PROPERTY(process, "pid", Integer::New(env->isolate(), getpid()));
   READONLY_PROPERTY(process, "features", GetFeatures(env));
diff --git a/src/node_crypto.cc b/src/node_crypto.cc
index db015339880d06..d7f3cfc80e0904 100644
--- a/src/node_crypto.cc
+++ b/src/node_crypto.cc
@@ -204,7 +204,9 @@ static void crypto_lock_cb(int mode, int n, const char* file, int line) {
 }
 
 
-static int CryptoPemCallback(char *buf, int size, int rwflag, void *u) {
+// This callback is used by OpenSSL when it needs to query for the passphrase
+// which may be used for encrypted PEM structures.
+static int PasswordCallback(char *buf, int size, int rwflag, void *u) {
   if (u) {
     size_t buflen = static_cast<size_t>(size);
     size_t len = strlen(static_cast<const char*>(u));
@@ -460,7 +462,7 @@ void SecureContext::SetKey(const FunctionCallbackInfo<Value>& args) {
 
   EVP_PKEY* key = PEM_read_bio_PrivateKey(bio,
                                           nullptr,
-                                          CryptoPemCallback,
+                                          PasswordCallback,
                                           len == 1 ? nullptr : *passphrase);
 
   if (!key) {
@@ -586,7 +588,7 @@ int SSL_CTX_use_certificate_chain(SSL_CTX* ctx,
   // that we are interested in
   ERR_clear_error();
 
-  x = PEM_read_bio_X509_AUX(in, nullptr, CryptoPemCallback, nullptr);
+  x = PEM_read_bio_X509_AUX(in, nullptr, PasswordCallback, nullptr);
 
   if (x == nullptr) {
     SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_CHAIN_FILE, ERR_R_PEM_LIB);
@@ -604,7 +606,7 @@ int SSL_CTX_use_certificate_chain(SSL_CTX* ctx,
     goto done;
   }
 
-  while ((extra = PEM_read_bio_X509(in, nullptr, CryptoPemCallback, nullptr))) {
+  while ((extra = PEM_read_bio_X509(in, nullptr, PasswordCallback, nullptr))) {
     if (sk_X509_push(extra_certs, extra))
       continue;
 
@@ -700,7 +702,7 @@ static X509_STORE* NewRootCertStore() {
   if (root_certs_vector.empty()) {
     for (size_t i = 0; i < arraysize(root_certs); i++) {
       BIO* bp = NodeBIO::NewFixed(root_certs[i], strlen(root_certs[i]));
-      X509 *x509 = PEM_read_bio_X509(bp, nullptr, CryptoPemCallback, nullptr);
+      X509 *x509 = PEM_read_bio_X509(bp, nullptr, PasswordCallback, nullptr);
       BIO_free(bp);
 
       // Parse errors from the built-in roots are fatal.
@@ -743,7 +745,7 @@ void SecureContext::AddCACert(const FunctionCallbackInfo<Value>& args) {
 
   X509_STORE* cert_store = SSL_CTX_get_cert_store(sc->ctx_);
   while (X509* x509 =
-             PEM_read_bio_X509(bio, nullptr, CryptoPemCallback, nullptr)) {
+             PEM_read_bio_X509(bio, nullptr, PasswordCallback, nullptr)) {
     if (cert_store == root_cert_store) {
       cert_store = NewRootCertStore();
       SSL_CTX_set_cert_store(sc->ctx_, cert_store);
@@ -775,7 +777,7 @@ void SecureContext::AddCRL(const FunctionCallbackInfo<Value>& args) {
     return;
 
   X509_CRL* crl =
-      PEM_read_bio_X509_CRL(bio, nullptr, CryptoPemCallback, nullptr);
+      PEM_read_bio_X509_CRL(bio, nullptr, PasswordCallback, nullptr);
 
   if (crl == nullptr) {
     BIO_free_all(bio);
@@ -814,7 +816,7 @@ static unsigned long AddCertsFromFile(  // NOLINT(runtime/int)
   }
 
   while (X509* x509 =
-      PEM_read_bio_X509(bio, nullptr, CryptoPemCallback, nullptr)) {
+      PEM_read_bio_X509(bio, nullptr, PasswordCallback, nullptr)) {
     X509_STORE_add_cert(store, x509);
     X509_free(x509);
   }
@@ -3792,6 +3794,10 @@ void Hmac::HmacDigest(const FunctionCallbackInfo<Value>& args) {
     encoding = ParseEncoding(env->isolate(), args[0], BUFFER);
   }
 
+  if (encoding == UCS2) {
+    return env->ThrowError("hmac.digest() does not support UTF-16");
+  }
+
   unsigned char* md_value = nullptr;
   unsigned int md_len = 0;
 
@@ -3915,6 +3921,10 @@ void Hash::HashDigest(const FunctionCallbackInfo<Value>& args) {
     encoding = ParseEncoding(env->isolate(), args[0], BUFFER);
   }
 
+  if (encoding == UCS2) {
+    return env->ThrowError("hash.digest() does not support UTF-16");
+  }
+
   unsigned char md_value[EVP_MAX_MD_SIZE];
   unsigned int md_len;
 
@@ -4072,7 +4082,7 @@ SignBase::Error Sign::SignFinal(const char* key_pem,
 
   pkey = PEM_read_bio_PrivateKey(bp,
                                  nullptr,
-                                 CryptoPemCallback,
+                                 PasswordCallback,
                                  const_cast<char*>(passphrase));
 
   // Errors might be injected into OpenSSL's error stack
@@ -4285,12 +4295,12 @@ SignBase::Error Verify::VerifyFinal(const char* key_pem,
   // Split this out into a separate function once we have more than one
   // consumer of public keys.
   if (strncmp(key_pem, PUBLIC_KEY_PFX, PUBLIC_KEY_PFX_LEN) == 0) {
-    pkey = PEM_read_bio_PUBKEY(bp, nullptr, CryptoPemCallback, nullptr);
+    pkey = PEM_read_bio_PUBKEY(bp, nullptr, PasswordCallback, nullptr);
     if (pkey == nullptr)
       goto exit;
   } else if (strncmp(key_pem, PUBRSA_KEY_PFX, PUBRSA_KEY_PFX_LEN) == 0) {
     RSA* rsa =
-        PEM_read_bio_RSAPublicKey(bp, nullptr, CryptoPemCallback, nullptr);
+        PEM_read_bio_RSAPublicKey(bp, nullptr, PasswordCallback, nullptr);
     if (rsa) {
       pkey = EVP_PKEY_new();
       if (pkey)
@@ -4301,7 +4311,7 @@ SignBase::Error Verify::VerifyFinal(const char* key_pem,
       goto exit;
   } else {
     // X.509 fallback
-    x509 = PEM_read_bio_X509(bp, nullptr, CryptoPemCallback, nullptr);
+    x509 = PEM_read_bio_X509(bp, nullptr, PasswordCallback, nullptr);
     if (x509 == nullptr)
       goto exit;
 
@@ -4419,7 +4429,7 @@ bool PublicKeyCipher::Cipher(const char* key_pem,
       goto exit;
   } else if (operation == kPublic &&
              strncmp(key_pem, CERTIFICATE_PFX, CERTIFICATE_PFX_LEN) == 0) {
-    x509 = PEM_read_bio_X509(bp, nullptr, CryptoPemCallback, nullptr);
+    x509 = PEM_read_bio_X509(bp, nullptr, PasswordCallback, nullptr);
     if (x509 == nullptr)
       goto exit;
 
@@ -4429,7 +4439,7 @@ bool PublicKeyCipher::Cipher(const char* key_pem,
   } else {
     pkey = PEM_read_bio_PrivateKey(bp,
                                    nullptr,
-                                   CryptoPemCallback,
+                                   PasswordCallback,
                                    const_cast<char*>(passphrase));
     if (pkey == nullptr)
       goto exit;
@@ -5011,6 +5021,8 @@ void ECDH::ComputeSecret(const FunctionCallbackInfo<Value>& args) {
   ECDH* ecdh;
   ASSIGN_OR_RETURN_UNWRAP(&ecdh, args.Holder());
 
+  MarkPopErrorOnReturn mark_pop_error_on_return;
+
   if (!ecdh->IsKeyPairValid())
     return env->ThrowError("Invalid key pair");
 
@@ -5160,6 +5172,8 @@ void ECDH::SetPublicKey(const FunctionCallbackInfo<Value>& args) {
 
   THROW_AND_RETURN_IF_NOT_BUFFER(args[0], "Public key");
 
+  MarkPopErrorOnReturn mark_pop_error_on_return;
+
   EC_POINT* pub = ecdh->BufferToPoint(Buffer::Data(args[0].As<Object>()),
                                       Buffer::Length(args[0].As<Object>()));
   if (pub == nullptr)
diff --git a/src/node_zlib.cc b/src/node_zlib.cc
index 2e62fb4160817a..bb149629c92f2f 100644
--- a/src/node_zlib.cc
+++ b/src/node_zlib.cc
@@ -530,16 +530,19 @@ class ZCtx : public AsyncWrap {
         CHECK(0 && "wtf?");
     }
 
-    if (ctx->err_ != Z_OK) {
-      ZCtx::Error(ctx, "Init error");
-    }
-
-
     ctx->dictionary_ = reinterpret_cast<Bytef *>(dictionary);
     ctx->dictionary_len_ = dictionary_len;
 
     ctx->write_in_progress_ = false;
     ctx->init_done_ = true;
+
+    if (ctx->err_ != Z_OK) {
+      if (dictionary != nullptr) {
+        delete[] dictionary;
+        ctx->dictionary_ = nullptr;
+      }
+      ctx->env()->ThrowError("Init error");
+    }
   }
 
   static void SetDictionary(ZCtx* ctx) {
diff --git a/src/stream_base.cc b/src/stream_base.cc
index 3ed622d7ef35a2..19130b5bb8bd7e 100644
--- a/src/stream_base.cc
+++ b/src/stream_base.cc
@@ -189,9 +189,14 @@ int StreamBase::Writev(const FunctionCallbackInfo<Value>& args) {
 
 int StreamBase::WriteBuffer(const FunctionCallbackInfo<Value>& args) {
   CHECK(args[0]->IsObject());
-  CHECK(Buffer::HasInstance(args[1]));
+
   Environment* env = Environment::GetCurrent(args);
 
+  if (!args[1]->IsUint8Array()) {
+    env->ThrowTypeError("Second argument must be a buffer");
+    return 0;
+  }
+
   Local<Object> req_wrap_obj = args[0].As<Object>();
   const char* data = Buffer::Data(args[1]);
   size_t length = Buffer::Length(args[1]);
diff --git a/test/README.md b/test/README.md
index 381402770c8621..a97e5f222b4627 100644
--- a/test/README.md
+++ b/test/README.md
@@ -174,6 +174,13 @@ A stream to push an array into a REPL
 
 Blocks for `time` amount of time.
 
+### crashOnUnhandledRejection()
+
+Installs a `process.on('unhandledRejection')` handler that crashes the process
+after a tick. This is useful for tests that use Promises and need to make sure
+no unexpected rejections occur, because currently they result in silent
+failures.
+
 ### ddCommand(filename, kilobytes)
 * return [&lt;Object>](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object)
 
diff --git a/test/addons/make-callback/test.js b/test/addons/make-callback/test.js
index 43ad014c4af478..b67d1146a6bf1b 100644
--- a/test/addons/make-callback/test.js
+++ b/test/addons/make-callback/test.js
@@ -36,6 +36,10 @@ const recv = {
 assert.strictEqual(42, makeCallback(recv, 'one'));
 assert.strictEqual(42, makeCallback(recv, 'two', 1337));
 
+// Check that callbacks on a receiver from a different context works.
+const foreignObject = vm.runInNewContext('({ fortytwo() { return 42; } })');
+assert.strictEqual(42, makeCallback(foreignObject, 'fortytwo'));
+
 // Check that the callback is made in the context of the receiver.
 const target = vm.runInNewContext(`
     (function($Object) {
diff --git a/test/cctest/node_test_fixture.h b/test/cctest/node_test_fixture.h
index de79b186851e79..59988ba6cb2a3e 100644
--- a/test/cctest/node_test_fixture.h
+++ b/test/cctest/node_test_fixture.h
@@ -64,6 +64,10 @@ class NodeTestFixture : public ::testing::Test {
   ArrayBufferAllocator allocator_;
   v8::Isolate* isolate_;
 
+  ~NodeTestFixture() {
+    TearDown();
+  }
+
   virtual void SetUp() {
     platform_ = v8::platform::CreateDefaultPlatform();
     v8::V8::InitializePlatform(platform_);
@@ -73,13 +77,14 @@ class NodeTestFixture : public ::testing::Test {
   }
 
   virtual void TearDown() {
+    if (platform_ == nullptr) return;
     v8::V8::ShutdownPlatform();
     delete platform_;
     platform_ = nullptr;
   }
 
  private:
-  v8::Platform* platform_;
+  v8::Platform* platform_ = nullptr;
 };
 
 #endif  // TEST_CCTEST_NODE_TEST_FIXTURE_H_
diff --git a/test/cctest/test_base64.cc b/test/cctest/test_base64.cc
new file mode 100644
index 00000000000000..fbdb969b4cbe46
--- /dev/null
+++ b/test/cctest/test_base64.cc
@@ -0,0 +1,127 @@
+#include "base64.h"
+
+#include <stddef.h>
+#include <string.h>
+
+#include "gtest/gtest.h"
+
+using node::base64_encode;
+using node::base64_decode;
+
+TEST(Base64Test, Encode) {
+  auto test = [](const char* string, const char* base64_string) {
+    const size_t len = strlen(base64_string);
+    char* const buffer = new char[len + 1];
+    buffer[len] = 0;
+    base64_encode(string, strlen(string), buffer, len);
+    EXPECT_STREQ(base64_string, buffer);
+    delete[] buffer;
+  };
+
+  test("a", "YQ==");
+  test("ab", "YWI=");
+  test("abc", "YWJj");
+  test("abcd", "YWJjZA==");
+  test("abcde", "YWJjZGU=");
+  test("abcdef", "YWJjZGVm");
+
+  test("Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do "
+       "eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut "
+       "enim ad minim veniam, quis nostrud exercitation ullamco laboris "
+       "nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in "
+       "reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla "
+       "pariatur. Excepteur sint occaecat cupidatat non proident, sunt in "
+       "culpa qui officia deserunt mollit anim id est laborum.",
+
+       "TG9yZW0gaXBzdW0gZG9sb3Igc2l0IGFtZXQsIGNvbnNlY3RldHVyIGFkaXBpc2Npbmcg"
+       "ZWxpdCwgc2VkIGRvIGVpdXNtb2QgdGVtcG9yIGluY2lkaWR1bnQgdXQgbGFib3JlIGV0"
+       "IGRvbG9yZSBtYWduYSBhbGlxdWEuIFV0IGVuaW0gYWQgbWluaW0gdmVuaWFtLCBxdWlz"
+       "IG5vc3RydWQgZXhlcmNpdGF0aW9uIHVsbGFtY28gbGFib3JpcyBuaXNpIHV0IGFsaXF1"
+       "aXAgZXggZWEgY29tbW9kbyBjb25zZXF1YXQuIER1aXMgYXV0ZSBpcnVyZSBkb2xvciBp"
+       "biByZXByZWhlbmRlcml0IGluIHZvbHVwdGF0ZSB2ZWxpdCBlc3NlIGNpbGx1bSBkb2xv"
+       "cmUgZXUgZnVnaWF0IG51bGxhIHBhcmlhdHVyLiBFeGNlcHRldXIgc2ludCBvY2NhZWNh"
+       "dCBjdXBpZGF0YXQgbm9uIHByb2lkZW50LCBzdW50IGluIGN1bHBhIHF1aSBvZmZpY2lh"
+       "IGRlc2VydW50IG1vbGxpdCBhbmltIGlkIGVzdCBsYWJvcnVtLg==");
+}
+
+TEST(Base64Test, Decode) {
+  auto test = [](const char* base64_string, const char* string) {
+    const size_t len = strlen(string);
+    char* const buffer = new char[len + 1];
+    buffer[len] = 0;
+    base64_decode(buffer, len, base64_string, strlen(base64_string));
+    EXPECT_STREQ(string, buffer);
+    delete[] buffer;
+  };
+
+  test("YQ", "a");
+  test("Y Q", "a");
+  test("Y Q ", "a");
+  test(" Y Q", "a");
+  test("Y Q==", "a");
+  test("YQ ==", "a");
+  test("YQ == junk", "a");
+  test("YWI", "ab");
+  test("YWI=", "ab");
+  test("YWJj", "abc");
+  test("YWJjZA", "abcd");
+  test("YWJjZA==", "abcd");
+  test("YW Jj ZA ==", "abcd");
+  test("YWJjZGU=", "abcde");
+  test("YWJjZGVm", "abcdef");
+  test("Y WJjZGVm", "abcdef");
+  test("YW JjZGVm", "abcdef");
+  test("YWJ jZGVm", "abcdef");
+  test("YWJj ZGVm", "abcdef");
+  test("Y W J j Z G V m", "abcdef");
+  test("Y   W\n JjZ \nG Vm", "abcdef");
+
+  const char* text =
+      "Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do "
+      "eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut "
+      "enim ad minim veniam, quis nostrud exercitation ullamco laboris "
+      "nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in "
+      "reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla "
+      "pariatur. Excepteur sint occaecat cupidatat non proident, sunt in "
+      "culpa qui officia deserunt mollit anim id est laborum.";
+
+  test("TG9yZW0gaXBzdW0gZG9sb3Igc2l0IGFtZXQsIGNvbnNlY3RldHVyIGFkaXBpc2Npbmcg"
+       "ZWxpdCwgc2VkIGRvIGVpdXNtb2QgdGVtcG9yIGluY2lkaWR1bnQgdXQgbGFib3JlIGV0"
+       "IGRvbG9yZSBtYWduYSBhbGlxdWEuIFV0IGVuaW0gYWQgbWluaW0gdmVuaWFtLCBxdWlz"
+       "IG5vc3RydWQgZXhlcmNpdGF0aW9uIHVsbGFtY28gbGFib3JpcyBuaXNpIHV0IGFsaXF1"
+       "aXAgZXggZWEgY29tbW9kbyBjb25zZXF1YXQuIER1aXMgYXV0ZSBpcnVyZSBkb2xvciBp"
+       "biByZXByZWhlbmRlcml0IGluIHZvbHVwdGF0ZSB2ZWxpdCBlc3NlIGNpbGx1bSBkb2xv"
+       "cmUgZXUgZnVnaWF0IG51bGxhIHBhcmlhdHVyLiBFeGNlcHRldXIgc2ludCBvY2NhZWNh"
+       "dCBjdXBpZGF0YXQgbm9uIHByb2lkZW50LCBzdW50IGluIGN1bHBhIHF1aSBvZmZpY2lh"
+       "IGRlc2VydW50IG1vbGxpdCBhbmltIGlkIGVzdCBsYWJvcnVtLg==", text);
+
+  test("TG9yZW0gaXBzdW0gZG9sb3Igc2l0IGFtZXQsIGNvbnNlY3RldHVyIGFkaXBpc2Npbmcg"
+       "ZWxpdCwgc2VkIGRvIGVpdXNtb2QgdGVtcG9yIGluY2lkaWR1bnQgdXQgbGFib3JlIGV0"
+       "IGRvbG9yZSBtYWduYSBhbGlxdWEuIFV0IGVuaW0gYWQgbWluaW0gdmVuaWFtLCBxdWlz"
+       "IG5vc3RydWQgZXhlcmNpdGF0aW9uIHVsbGFtY28gbGFib3JpcyBuaXNpIHV0IGFsaXF1"
+       "aXAgZXggZWEgY29tbW9kbyBjb25zZXF1YXQuIER1aXMgYXV0ZSBpcnVyZSBkb2xvciBp"
+       "biByZXByZWhlbmRlcml0IGluIHZvbHVwdGF0ZSB2ZWxpdCBlc3NlIGNpbGx1bSBkb2xv"
+       "cmUgZXUgZnVnaWF0IG51bGxhIHBhcmlhdHVyLiBFeGNlcHRldXIgc2ludCBvY2NhZWNh"
+       "dCBjdXBpZGF0YXQgbm9uIHByb2lkZW50LCBzdW50IGluIGN1bHBhIHF1aSBvZmZpY2lh"
+       "IGRlc2VydW50IG1vbGxpdCBhbmltIGlkIGVzdCBsYWJvcnVtLg", text);
+
+  test("TG9yZW0gaXBzdW0gZG9sb3Igc2l0IGFtZXQsIGNvbnNlY3RldHVyIGFkaXBpc2Npbmcg\n"
+       "ZWxpdCwgc2VkIGRvIGVpdXNtb2QgdGVtcG9yIGluY2lkaWR1bnQgdXQgbGFib3JlIGV0\n"
+       "IGRvbG9yZSBtYWduYSBhbGlxdWEuIFV0IGVuaW0gYWQgbWluaW0gdmVuaWFtLCBxdWlz\n"
+       "IG5vc3RydWQgZXhlcmNpdGF0aW9uIHVsbGFtY28gbGFib3JpcyBuaXNpIHV0IGFsaXF1\n"
+       "aXAgZXggZWEgY29tbW9kbyBjb25zZXF1YXQuIER1aXMgYXV0ZSBpcnVyZSBkb2xvciBp\n"
+       "biByZXByZWhlbmRlcml0IGluIHZvbHVwdGF0ZSB2ZWxpdCBlc3NlIGNpbGx1bSBkb2xv\n"
+       "cmUgZXUgZnVnaWF0IG51bGxhIHBhcmlhdHVyLiBFeGNlcHRldXIgc2ludCBvY2NhZWNh\n"
+       "dCBjdXBpZGF0YXQgbm9uIHByb2lkZW50LCBzdW50IGluIGN1bHBhIHF1aSBvZmZpY2lh\n"
+       "IGRlc2VydW50IG1vbGxpdCBhbmltIGlkIGVzdCBsYWJvcnVtLg==", text);
+
+  test("TG9yZW0gaXBzdW0gZG9sb3Igc2l0IGFtZXQsIGNvbnNlY3RldHVyIGFkaXBpc2Npbmcg\n"
+       "ZWxpdCwgc2VkIGRvIGVpdXNtb2QgdGVtcG9yIGluY2lkaWR1bnQgdXQgbGFib3JlIGV0\n"
+       "IGRvbG9yZSBtYWduYSBhbGlxdWEuIFV0IGVuaW0gYWQgbWluaW0gdmVuaWFtLCBxdWlz\n"
+       "IG5vc3RydWQgZXhlcmNpdGF0aW9uIHVsbGFtY28gbGFib3JpcyBuaXNpIHV0IGFsaXF1\n"
+       "aXAgZXggZWEgY29tbW9kbyBjb25zZXF1YXQuIER1aXMgYXV0ZSBpcnVyZSBkb2xvciBp\n"
+       "biByZXByZWhlbmRlcml0IGluIHZvbHVwdGF0ZSB2ZWxpdCBlc3NlIGNpbGx1bSBkb2xv\n"
+       "cmUgZXUgZnVnaWF0IG51bGxhIHBhcmlhdHVyLiBFeGNlcHRldXIgc2ludCBvY2NhZWNh\n"
+       "dCBjdXBpZGF0YXQgbm9uIHByb2lkZW50LCBzdW50IGluIGN1bHBhIHF1aSBvZmZpY2lh\n"
+       "IGRlc2VydW50IG1vbGxpdCBhbmltIGlkIGVzdCBsYWJvcnVtLg", text);
+}
diff --git a/test/common.js b/test/common.js
index dcd830420c3c6f..54357af6ca8e4c 100644
--- a/test/common.js
+++ b/test/common.js
@@ -552,3 +552,9 @@ exports.expectWarning = function(name, expected) {
     expected.splice(expected.indexOf(warning.message), 1);
   }, expected.length));
 };
+
+// Crash the process on unhandled rejections.
+exports.crashOnUnhandledRejection = function() {
+  process.on('unhandledRejection',
+             (err) => process.nextTick(() => { throw err; }));
+};
diff --git a/test/disabled/test-dgram-send-error.js b/test/disabled/test-dgram-send-error.js
deleted file mode 100644
index 271e6689046a00..00000000000000
--- a/test/disabled/test-dgram-send-error.js
+++ /dev/null
@@ -1,60 +0,0 @@
-'use strict';
-// Some operating systems report errors when an UDP message is sent to an
-// unreachable host. This error can be reported by sendto() and even by
-// recvfrom(). Node should not propagate this error to the user.
-
-// We test this by sending a bunch of packets to random IPs. In the meantime
-// we also send packets to ourselves to verify that after receiving an error
-// we can still receive packets successfully.
-
-const common = require('../common');
-var ITERATIONS = 1000;
-
-var assert = require('assert'),
-    dgram = require('dgram');
-
-var buf = Buffer.alloc(1024, 42);
-
-var packetsReceived = 0,
-    packetsSent = 0;
-
-var socket = dgram.createSocket('udp4');
-
-socket.on('message', onMessage);
-socket.on('listening', doSend);
-socket.bind(common.PORT);
-
-function onMessage(message, info) {
-  packetsReceived++;
-  if (packetsReceived < ITERATIONS) {
-    doSend();
-  } else {
-    socket.close();
-  }
-}
-
-function afterSend(err) {
-  if (err) throw err;
-  packetsSent++;
-}
-
-function doSend() {
-  // Generate a random IP.
-  var parts = [];
-  for (var i = 0; i < 4; i++) {
-    // Generate a random number in the range 1..254.
-    parts.push(Math.floor(Math.random() * 254) + 1);
-  }
-  var ip = parts.join('.');
-
-  socket.send(buf, 0, buf.length, 1, ip, afterSend);
-  socket.send(buf, 0, buf.length, common.PORT, '127.0.0.1', afterSend);
-}
-
-process.on('exit', function() {
-  console.log(packetsSent + ' UDP packets sent, ' +
-              packetsReceived + ' received');
-
-  assert.strictEqual(packetsSent, ITERATIONS * 2);
-  assert.strictEqual(packetsReceived, ITERATIONS);
-});
diff --git a/test/disabled/test-setuidgid.js b/test/disabled/test-setuidgid.js
deleted file mode 100644
index ff674f869039d2..00000000000000
--- a/test/disabled/test-setuidgid.js
+++ /dev/null
@@ -1,23 +0,0 @@
-'use strict';
-// Requires special privileges
-var common = require('../common');
-var assert = require('assert');
-
-var oldgid = process.getgid();
-process.setgid('nobody');
-var newgid = process.getgid();
-assert.notEqual(newgid, oldgid, 'gids expected to be different');
-
-var olduid = process.getuid();
-process.setuid('nobody');
-var newuid = process.getuid();
-assert.notEqual(newuid, olduid, 'uids expected to be different');
-
-try {
-  process.setuid('nobody1234');
-} catch (e) {
-  assert.strictEqual(e.message,
-               'failed to resolve group',
-               'unexpected error message'
-  );
-}
diff --git a/test/disabled/tls_server.js b/test/disabled/tls_server.js
deleted file mode 100644
index 1e72809a8a04ad..00000000000000
--- a/test/disabled/tls_server.js
+++ /dev/null
@@ -1,47 +0,0 @@
-'use strict';
-var common = require('../common');
-var assert = require('assert');
-
-var util = require('util');
-var net = require('net');
-var fs = require('fs');
-var crypto = require('crypto');
-
-var keyPem = fs.readFileSync(common.fixturesDir + '/cert.pem');
-var certPem = fs.readFileSync(common.fixturesDir + '/cert.pem');
-
-try {
-  var credentials = crypto.createCredentials({key: keyPem, cert: certPem});
-} catch (e) {
-  common.skip('node compiled without OpenSSL.');
-  return;
-}
-var i = 0;
-var server = net.createServer(function(connection) {
-  connection.setSecure(credentials);
-  connection.setEncoding('latin1');
-
-  connection.on('secure', function() {
-    //console.log('Secure');
-  });
-
-  connection.on('data', function(chunk) {
-    console.log('recved: ' + JSON.stringify(chunk));
-    connection.write('HTTP/1.0 200 OK\r\n' +
-                     'Content-type: text/plain\r\n' +
-                     'Content-length: 9\r\n' +
-                     '\r\n' +
-                     'OK : ' + i +
-                     '\r\n\r\n');
-    i = i + 1;
-    connection.end();
-  });
-
-  connection.on('end', function() {
-    connection.end();
-  });
-
-});
-server.listen(4443);
-
-
diff --git a/test/doctool/test-doctool-html.js b/test/doctool/test-doctool-html.js
index 442381b54d7b72..58ec2bc731a596 100644
--- a/test/doctool/test-doctool-html.js
+++ b/test/doctool/test-doctool-html.js
@@ -94,7 +94,7 @@ testData.forEach((item) => {
         {
           input: preprocessed,
           filename: 'foo',
-          template: 'doc/template.html',
+          template: path.resolve(__dirname, '../../doc/template.html'),
           nodeVersion: process.version,
           analytics: item.analyticsId,
         },
diff --git a/test/fixtures/.empty-hidden-repl-history-file b/test/fixtures/.empty-hidden-repl-history-file
new file mode 100644
index 00000000000000..e69de29bb2d1d6
diff --git a/test/inspector/test-inspector.js b/test/inspector/test-inspector.js
index 08c0938c87e832..ae4cfc65b20419 100644
--- a/test/inspector/test-inspector.js
+++ b/test/inspector/test-inspector.js
@@ -34,7 +34,7 @@ function checkBadPath(err, response) {
 function expectMainScriptSource(result) {
   const expected = helper.mainScriptSource();
   const source = result['scriptSource'];
-  assert(source && (source.indexOf(expected) >= 0),
+  assert(source && (source.includes(expected)),
          'Script source is wrong: ' + source);
 }
 
diff --git a/test/parallel/test-buffer-alloc.js b/test/parallel/test-buffer-alloc.js
index 7f910807917063..7ebe34b21edb1e 100644
--- a/test/parallel/test-buffer-alloc.js
+++ b/test/parallel/test-buffer-alloc.js
@@ -984,8 +984,8 @@ Buffer.poolSize = ps;
 assert.throws(() => Buffer.allocUnsafe(10).copy(),
               /TypeError: argument should be a Buffer/);
 
-const regErrorMsg = new RegExp('First argument must be a string, Buffer, ' +
-                               'ArrayBuffer, Array, or array-like object.');
+const regErrorMsg =
+  /First argument must be a string, Buffer, ArrayBuffer, Array, or array-like object\./;
 
 assert.throws(() => Buffer.from(), regErrorMsg);
 assert.throws(() => Buffer.from(null), regErrorMsg);
diff --git a/test/parallel/test-child-process-default-options.js b/test/parallel/test-child-process-default-options.js
index 37e7ea7494670e..8b5f469ea258d5 100644
--- a/test/parallel/test-child-process-default-options.js
+++ b/test/parallel/test-child-process-default-options.js
@@ -23,6 +23,6 @@ child.stdout.on('data', function(chunk) {
 });
 
 process.on('exit', function() {
-  assert.ok(response.indexOf('HELLO=WORLD') >= 0,
+  assert.ok(response.includes('HELLO=WORLD'),
             'spawn did not use process.env as default');
 });
diff --git a/test/parallel/test-child-process-env.js b/test/parallel/test-child-process-env.js
index ad41f978e21768..d780050e2b6012 100644
--- a/test/parallel/test-child-process-env.js
+++ b/test/parallel/test-child-process-env.js
@@ -29,6 +29,6 @@ child.stdout.on('data', function(chunk) {
 });
 
 process.on('exit', function() {
-  assert.ok(response.indexOf('HELLO=WORLD') >= 0);
-  assert.ok(response.indexOf('FOO=BAR') >= 0);
+  assert.ok(response.includes('HELLO=WORLD'));
+  assert.ok(response.includes('FOO=BAR'));
 });
diff --git a/test/parallel/test-child-process-exec-env.js b/test/parallel/test-child-process-exec-env.js
index 6af3bea2113a89..99fd2447ccc277 100644
--- a/test/parallel/test-child-process-exec-env.js
+++ b/test/parallel/test-child-process-exec-env.js
@@ -35,5 +35,5 @@ process.on('exit', function() {
   console.log('response: ', response);
   assert.strictEqual(1, success_count);
   assert.strictEqual(0, error_count);
-  assert.ok(response.indexOf('HELLO=WORLD') >= 0);
+  assert.ok(response.includes('HELLO=WORLD'));
 });
diff --git a/test/parallel/test-child-process-send-utf8.js b/test/parallel/test-child-process-send-utf8.js
index c5d0943301c730..4cedc589b1db95 100644
--- a/test/parallel/test-child-process-send-utf8.js
+++ b/test/parallel/test-child-process-send-utf8.js
@@ -3,7 +3,7 @@ const common = require('../common');
 const assert = require('assert');
 const fork = require('child_process').fork;
 
-const expected = Array(1e5).join('ßßßß');
+const expected = 'ßßßß'.repeat(1e5 - 1);
 if (process.argv[2] === 'child') {
   process.send(expected);
 } else {
diff --git a/test/parallel/test-child-process-spawnsync-input.js b/test/parallel/test-child-process-spawnsync-input.js
index 1bda3d5dcf9da2..5e1de1c616cc7b 100644
--- a/test/parallel/test-child-process-spawnsync-input.js
+++ b/test/parallel/test-child-process-spawnsync-input.js
@@ -31,7 +31,7 @@ function verifyBufOutput(ret) {
   assert.deepStrictEqual(ret.stderr, msgErrBuf);
 }
 
-if (process.argv.indexOf('spawnchild') !== -1) {
+if (process.argv.includes('spawnchild')) {
   switch (process.argv[3]) {
     case '1':
       ret = spawnSync(process.execPath, args, { stdio: 'inherit' });
diff --git a/test/parallel/test-cli-eval.js b/test/parallel/test-cli-eval.js
index 93de319a56a58e..9465d5cecc7205 100644
--- a/test/parallel/test-cli-eval.js
+++ b/test/parallel/test-cli-eval.js
@@ -73,6 +73,8 @@ child.exec(`${nodejs} --print "os.platform()"`,
            }));
 
 // Module path resolve bug regression test.
+const cwd = process.cwd();
+process.chdir(path.resolve(__dirname, '../../'));
 child.exec(`${nodejs} --eval "require('./test/parallel/test-cli-eval.js')"`,
            common.mustCall((err, stdout, stderr) => {
              assert.strictEqual(err.code, 42);
@@ -80,6 +82,7 @@ child.exec(`${nodejs} --eval "require('./test/parallel/test-cli-eval.js')"`,
                stdout, 'Loaded as a module, exiting with status code 42.\n');
              assert.strictEqual(stderr, '');
            }));
+process.chdir(cwd);
 
 // Missing argument should not crash.
 child.exec(`${nodejs} -e`, common.mustCall((err, stdout, stderr) => {
diff --git a/test/parallel/test-cluster-master-error.js b/test/parallel/test-cluster-master-error.js
index 11ed09c64ed04e..c69c867bf08033 100644
--- a/test/parallel/test-cluster-master-error.js
+++ b/test/parallel/test-cluster-master-error.js
@@ -10,7 +10,7 @@ if (cluster.isWorker) {
   const http = require('http');
   http.Server(() => {
 
-  }).listen(common.PORT, '127.0.0.1');
+  }).listen(0, '127.0.0.1');
 
 } else if (process.argv[2] === 'cluster') {
 
diff --git a/test/parallel/test-cluster-master-kill.js b/test/parallel/test-cluster-master-kill.js
index 094e5ad256de7d..ba5414c11e1d48 100644
--- a/test/parallel/test-cluster-master-kill.js
+++ b/test/parallel/test-cluster-master-kill.js
@@ -7,7 +7,7 @@ if (cluster.isWorker) {
 
   // keep the worker alive
   const http = require('http');
-  http.Server().listen(common.PORT, '127.0.0.1');
+  http.Server().listen(0, '127.0.0.1');
 
 } else if (process.argv[2] === 'cluster') {
 
diff --git a/test/parallel/test-cluster-net-send.js b/test/parallel/test-cluster-net-send.js
index d375920e91b18b..73442bd4594a9f 100644
--- a/test/parallel/test-cluster-net-send.js
+++ b/test/parallel/test-cluster-net-send.js
@@ -46,8 +46,8 @@ if (process.argv[2] !== 'child') {
     socketConnected();
   });
 
-  server.listen(common.PORT, function() {
-    socket = net.connect(common.PORT, '127.0.0.1', socketConnected);
+  server.listen(0, function() {
+    socket = net.connect(server.address().port, '127.0.0.1', socketConnected);
   });
 
   process.on('disconnect', function() {
diff --git a/test/parallel/test-cluster-rr-domain-listen.js b/test/parallel/test-cluster-rr-domain-listen.js
index ee507cd47b2a23..44d6aea560d3c8 100644
--- a/test/parallel/test-cluster-rr-domain-listen.js
+++ b/test/parallel/test-cluster-rr-domain-listen.js
@@ -1,5 +1,5 @@
 'use strict';
-const common = require('../common');
+require('../common');
 const cluster = require('cluster');
 const domain = require('domain');
 
@@ -11,7 +11,7 @@ if (cluster.isWorker) {
   d.run(function() { });
 
   const http = require('http');
-  http.Server(function() { }).listen(common.PORT, '127.0.0.1');
+  http.Server(function() { }).listen(0, '127.0.0.1');
 
 } else if (cluster.isMaster) {
   let worker;
diff --git a/test/parallel/test-cluster-rr-ref.js b/test/parallel/test-cluster-rr-ref.js
index 19420fed83f9f1..cf5e4f346bf7e2 100644
--- a/test/parallel/test-cluster-rr-ref.js
+++ b/test/parallel/test-cluster-rr-ref.js
@@ -10,7 +10,7 @@ if (cluster.isMaster) {
   });
 } else {
   const server = net.createServer(common.mustNotCall());
-  server.listen(common.PORT, function() {
+  server.listen(0, function() {
     server.unref();
     server.ref();
     server.close(function() {
diff --git a/test/parallel/test-cluster-shared-leak.js b/test/parallel/test-cluster-shared-leak.js
index d578ee6373f3b6..a7b3023f3ed3ba 100644
--- a/test/parallel/test-cluster-shared-leak.js
+++ b/test/parallel/test-cluster-shared-leak.js
@@ -13,10 +13,10 @@ if (cluster.isMaster) {
   let conn, worker2;
 
   const worker1 = cluster.fork();
-  worker1.on('message', common.mustCall(function() {
+  worker1.on('listening', common.mustCall(function(address) {
     worker2 = cluster.fork();
     worker2.on('online', function() {
-      conn = net.connect(common.PORT, common.mustCall(function() {
+      conn = net.connect(address.port, common.mustCall(function() {
         worker1.disconnect();
         worker2.disconnect();
       }));
@@ -48,6 +48,4 @@ const server = net.createServer(function(c) {
   c.end('bye');
 });
 
-server.listen(common.PORT, function() {
-  process.send('listening');
-});
+server.listen(0);
diff --git a/test/parallel/test-cluster-worker-no-exit.js b/test/parallel/test-cluster-worker-no-exit.js
index 9cfd8401a0c678..11ecbfef144154 100644
--- a/test/parallel/test-cluster-worker-no-exit.js
+++ b/test/parallel/test-cluster-worker-no-exit.js
@@ -1,5 +1,5 @@
 'use strict';
-const common = require('../common');
+require('../common');
 const assert = require('assert');
 const cluster = require('cluster');
 const net = require('net');
@@ -34,7 +34,7 @@ if (cluster.isMaster) {
       success = true;
     });
 
-  }).listen(common.PORT, function() {
+  }).listen(0, function() {
     const port = this.address().port;
 
     worker = cluster.fork()
diff --git a/test/parallel/test-cluster-worker-wait-server-close.js b/test/parallel/test-cluster-worker-wait-server-close.js
index d1a0d73678d67a..1d19398a3d8799 100644
--- a/test/parallel/test-cluster-worker-wait-server-close.js
+++ b/test/parallel/test-cluster-worker-wait-server-close.js
@@ -12,7 +12,7 @@ if (cluster.isWorker) {
     // Wait for any data, then close connection
     socket.write('.');
     socket.on('data', function discard() {});
-  }).listen(common.PORT, common.localhostIPv4);
+  }).listen(0, common.localhostIPv4);
 
   server.once('close', function() {
     serverClosed = true;
@@ -33,8 +33,8 @@ if (cluster.isWorker) {
   const worker = cluster.fork();
 
   // Disconnect worker when it is ready
-  worker.once('listening', function() {
-    const socket = net.createConnection(common.PORT, common.localhostIPv4);
+  worker.once('listening', function(address) {
+    const socket = net.createConnection(address.port, common.localhostIPv4);
 
     socket.on('connect', function() {
       socket.on('data', function() {
diff --git a/test/parallel/test-crypto-dh.js b/test/parallel/test-crypto-dh.js
index cfe896026f6af5..50b0b2d07b9aea 100644
--- a/test/parallel/test-crypto-dh.js
+++ b/test/parallel/test-crypto-dh.js
@@ -270,6 +270,26 @@ ecdh5.setPrivateKey(cafebabeKey, 'hex');
   assert.strictEqual(ecdh5.getPrivateKey('hex'), cafebabeKey);
 });
 
+// Use of invalid keys was not cleaning up ERR stack, and was causing
+// unexpected failure in subsequent signing operations.
+const ecdh6 = crypto.createECDH('prime256v1');
+const invalidKey = Buffer.alloc(65);
+invalidKey.fill('\0');
+ecdh6.generateKeys();
+assert.throws(() => {
+  ecdh6.computeSecret(invalidKey);
+}, /^Error: Failed to translate Buffer to a EC_POINT$/);
+// Check that signing operations are not impacted by the above error.
+const ecPrivateKey =
+  '-----BEGIN EC PRIVATE KEY-----\n' +
+  'MHcCAQEEIF+jnWY1D5kbVYDNvxxo/Y+ku2uJPDwS0r/VuPZQrjjVoAoGCCqGSM49\n' +
+  'AwEHoUQDQgAEurOxfSxmqIRYzJVagdZfMMSjRNNhB8i3mXyIMq704m2m52FdfKZ2\n' +
+  'pQhByd5eyj3lgZ7m7jbchtdgyOF8Io/1ng==\n' +
+  '-----END EC PRIVATE KEY-----';
+assert.doesNotThrow(() => {
+  crypto.createSign('SHA256').sign(ecPrivateKey);
+});
+
 // invalid test: curve argument is undefined
 assert.throws(() => {
   crypto.createECDH();
diff --git a/test/parallel/test-crypto-hash.js b/test/parallel/test-crypto-hash.js
index 0d55d4236a656e..28f0f2f30349ba 100644
--- a/test/parallel/test-crypto-hash.js
+++ b/test/parallel/test-crypto-hash.js
@@ -108,10 +108,12 @@ const h3 = crypto.createHash('sha256');
 h3.digest();
 assert.throws(function() {
   h3.digest();
-},
-              /Digest already called/);
+}, /Digest already called/);
 
 assert.throws(function() {
   h3.update('foo');
-},
-              /Digest already called/);
+}, /Digest already called/);
+
+assert.throws(function() {
+  crypto.createHash('sha256').digest('ucs2');
+}, /^Error: hash\.digest\(\) does not support UTF-16$/);
diff --git a/test/parallel/test-crypto-hmac.js b/test/parallel/test-crypto-hmac.js
index a3372bcb7242b9..94c5cefa058d02 100644
--- a/test/parallel/test-crypto-hmac.js
+++ b/test/parallel/test-crypto-hmac.js
@@ -377,3 +377,7 @@ for (let i = 0, l = rfc2202_sha1.length; i < l; i++) {
     `Test HMAC-SHA1 : Test case ${i + 1} rfc 2202`
   );
 }
+
+assert.throws(function() {
+  crypto.createHmac('sha256', 'w00t').digest('ucs2');
+}, /^Error: hmac\.digest\(\) does not support UTF-16$/);
diff --git a/test/parallel/test-domain-throw-error-then-throw-from-uncaught-exception-handler.js b/test/parallel/test-domain-throw-error-then-throw-from-uncaught-exception-handler.js
index d2de9b2a448cf9..cce6af84a22dde 100644
--- a/test/parallel/test-domain-throw-error-then-throw-from-uncaught-exception-handler.js
+++ b/test/parallel/test-domain-throw-error-then-throw-from-uncaught-exception-handler.js
@@ -17,7 +17,7 @@ const RAN_UNCAUGHT_EXCEPTION_HANDLER_EXIT_CODE = 42;
 
 if (process.argv[2] === 'child') {
   process.on('uncaughtException', common.mustCall(function onUncaught() {
-    if (process.execArgv.indexOf('--abort-on-uncaught-exception') !== -1) {
+    if (process.execArgv.includes('--abort-on-uncaught-exception')) {
       // When passing --abort-on-uncaught-exception to the child process,
       // we want to make sure that this handler (the process' uncaughtException
       // event handler) wasn't called. Unfortunately we can't parse the child
diff --git a/test/parallel/test-domain-with-abort-on-uncaught-exception.js b/test/parallel/test-domain-with-abort-on-uncaught-exception.js
index 0da8f1368f7c98..db530fbccb814b 100644
--- a/test/parallel/test-domain-with-abort-on-uncaught-exception.js
+++ b/test/parallel/test-domain-with-abort-on-uncaught-exception.js
@@ -43,11 +43,11 @@ if (process.argv[2] === 'child') {
   d.on('error', function(err) {
     // Swallowing the error on purpose if 'throwInDomainErrHandler' is not
     // set
-    if (process.argv.indexOf('throwInDomainErrHandler') !== -1) {
+    if (process.argv.includes('throwInDomainErrHandler')) {
       // If useTryCatch is set, wrap the throw in a try/catch block.
       // This is to make sure that a caught exception does not trigger
       // an abort.
-      if (process.argv.indexOf('useTryCatch') !== -1) {
+      if (process.argv.includes('useTryCatch')) {
         try {
           throw new Error(domainErrHandlerExMessage);
         } catch (e) {
diff --git a/test/parallel/test-error-reporting.js b/test/parallel/test-error-reporting.js
index fa7332a67a482b..8ab612b9be2641 100644
--- a/test/parallel/test-error-reporting.js
+++ b/test/parallel/test-error-reporting.js
@@ -15,7 +15,7 @@ function errExec(script, callback) {
     assert.ok(stderr.split('\n').length > 2);
 
     // Assert the script is mentioned in error output.
-    assert.ok(stderr.indexOf(script) >= 0);
+    assert.ok(stderr.includes(script));
 
     // Proxy the args for more tests.
     callback(err, stdout, stderr);
diff --git a/test/parallel/test-fs-chmod.js b/test/parallel/test-fs-chmod.js
index 5121fd89f99466..cbe9ef54bac6b3 100644
--- a/test/parallel/test-fs-chmod.js
+++ b/test/parallel/test-fs-chmod.js
@@ -93,7 +93,7 @@ fs.open(file2, 'a', common.mustCall((err, fd) => {
       assert.strictEqual(mode_sync, fs.fstatSync(fd).mode & 0o777);
     }
 
-    fs.close(fd);
+    fs.close(fd, assert.ifError);
   }));
 }));
 
diff --git a/test/parallel/test-fs-error-messages.js b/test/parallel/test-fs-error-messages.js
index f2ea85531bf463..0ed68ceb06fdbf 100644
--- a/test/parallel/test-fs-error-messages.js
+++ b/test/parallel/test-fs-error-messages.js
@@ -13,66 +13,66 @@ const existingDir2 = path.join(common.fixturesDir, 'keys');
 
 fs.stat(fn, function(err) {
   assert.strictEqual(fn, err.path);
-  assert.ok(0 <= err.message.indexOf(fn));
+  assert.ok(err.message.includes(fn));
 });
 
 fs.lstat(fn, function(err) {
-  assert.ok(0 <= err.message.indexOf(fn));
+  assert.ok(err.message.includes(fn));
 });
 
 fs.readlink(fn, function(err) {
-  assert.ok(0 <= err.message.indexOf(fn));
+  assert.ok(err.message.includes(fn));
 });
 
 fs.link(fn, 'foo', function(err) {
-  assert.ok(0 <= err.message.indexOf(fn));
+  assert.ok(err.message.includes(fn));
 });
 
 fs.link(existingFile, existingFile2, function(err) {
-  assert.ok(0 <= err.message.indexOf(existingFile));
-  assert.ok(0 <= err.message.indexOf(existingFile2));
+  assert.ok(err.message.includes(existingFile));
+  assert.ok(err.message.includes(existingFile2));
 });
 
 fs.symlink(existingFile, existingFile2, function(err) {
-  assert.ok(0 <= err.message.indexOf(existingFile));
-  assert.ok(0 <= err.message.indexOf(existingFile2));
+  assert.ok(err.message.includes(existingFile));
+  assert.ok(err.message.includes(existingFile2));
 });
 
 fs.unlink(fn, function(err) {
-  assert.ok(0 <= err.message.indexOf(fn));
+  assert.ok(err.message.includes(fn));
 });
 
 fs.rename(fn, 'foo', function(err) {
-  assert.ok(0 <= err.message.indexOf(fn));
+  assert.ok(err.message.includes(fn));
 });
 
 fs.rename(existingDir, existingDir2, function(err) {
-  assert.ok(0 <= err.message.indexOf(existingDir));
-  assert.ok(0 <= err.message.indexOf(existingDir2));
+  assert.ok(err.message.includes(existingDir));
+  assert.ok(err.message.includes(existingDir2));
 });
 
 fs.rmdir(fn, function(err) {
-  assert.ok(0 <= err.message.indexOf(fn));
+  assert.ok(err.message.includes(fn));
 });
 
 fs.mkdir(existingFile, 0o666, function(err) {
-  assert.ok(0 <= err.message.indexOf(existingFile));
+  assert.ok(err.message.includes(existingFile));
 });
 
 fs.rmdir(existingFile, function(err) {
-  assert.ok(0 <= err.message.indexOf(existingFile));
+  assert.ok(err.message.includes(existingFile));
 });
 
 fs.chmod(fn, 0o666, function(err) {
-  assert.ok(0 <= err.message.indexOf(fn));
+  assert.ok(err.message.includes(fn));
 });
 
 fs.open(fn, 'r', 0o666, function(err) {
-  assert.ok(0 <= err.message.indexOf(fn));
+  assert.ok(err.message.includes(fn));
 });
 
 fs.readFile(fn, function(err) {
-  assert.ok(0 <= err.message.indexOf(fn));
+  assert.ok(err.message.includes(fn));
 });
 
 // Sync
@@ -85,7 +85,7 @@ try {
   fs.statSync(fn);
 } catch (err) {
   errors.push('stat');
-  assert.ok(0 <= err.message.indexOf(fn));
+  assert.ok(err.message.includes(fn));
 }
 
 try {
@@ -93,7 +93,7 @@ try {
   fs.mkdirSync(existingFile, 0o666);
 } catch (err) {
   errors.push('mkdir');
-  assert.ok(0 <= err.message.indexOf(existingFile));
+  assert.ok(err.message.includes(existingFile));
 }
 
 try {
@@ -101,7 +101,7 @@ try {
   fs.chmodSync(fn, 0o666);
 } catch (err) {
   errors.push('chmod');
-  assert.ok(0 <= err.message.indexOf(fn));
+  assert.ok(err.message.includes(fn));
 }
 
 try {
@@ -109,7 +109,7 @@ try {
   fs.lstatSync(fn);
 } catch (err) {
   errors.push('lstat');
-  assert.ok(0 <= err.message.indexOf(fn));
+  assert.ok(err.message.includes(fn));
 }
 
 try {
@@ -117,7 +117,7 @@ try {
   fs.readlinkSync(fn);
 } catch (err) {
   errors.push('readlink');
-  assert.ok(0 <= err.message.indexOf(fn));
+  assert.ok(err.message.includes(fn));
 }
 
 try {
@@ -125,7 +125,7 @@ try {
   fs.linkSync(fn, 'foo');
 } catch (err) {
   errors.push('link');
-  assert.ok(0 <= err.message.indexOf(fn));
+  assert.ok(err.message.includes(fn));
 }
 
 try {
@@ -133,8 +133,8 @@ try {
   fs.linkSync(existingFile, existingFile2);
 } catch (err) {
   errors.push('link');
-  assert.ok(0 <= err.message.indexOf(existingFile));
-  assert.ok(0 <= err.message.indexOf(existingFile2));
+  assert.ok(err.message.includes(existingFile));
+  assert.ok(err.message.includes(existingFile2));
 }
 
 try {
@@ -142,8 +142,8 @@ try {
   fs.symlinkSync(existingFile, existingFile2);
 } catch (err) {
   errors.push('symlink');
-  assert.ok(0 <= err.message.indexOf(existingFile));
-  assert.ok(0 <= err.message.indexOf(existingFile2));
+  assert.ok(err.message.includes(existingFile));
+  assert.ok(err.message.includes(existingFile2));
 }
 
 try {
@@ -151,7 +151,7 @@ try {
   fs.unlinkSync(fn);
 } catch (err) {
   errors.push('unlink');
-  assert.ok(0 <= err.message.indexOf(fn));
+  assert.ok(err.message.includes(fn));
 }
 
 try {
@@ -159,7 +159,7 @@ try {
   fs.rmdirSync(fn);
 } catch (err) {
   errors.push('rmdir');
-  assert.ok(0 <= err.message.indexOf(fn));
+  assert.ok(err.message.includes(fn));
 }
 
 try {
@@ -167,7 +167,7 @@ try {
   fs.rmdirSync(existingFile);
 } catch (err) {
   errors.push('rmdir');
-  assert.ok(0 <= err.message.indexOf(existingFile));
+  assert.ok(err.message.includes(existingFile));
 }
 
 try {
@@ -175,7 +175,7 @@ try {
   fs.openSync(fn, 'r');
 } catch (err) {
   errors.push('opens');
-  assert.ok(0 <= err.message.indexOf(fn));
+  assert.ok(err.message.includes(fn));
 }
 
 try {
@@ -183,7 +183,7 @@ try {
   fs.renameSync(fn, 'foo');
 } catch (err) {
   errors.push('rename');
-  assert.ok(0 <= err.message.indexOf(fn));
+  assert.ok(err.message.includes(fn));
 }
 
 try {
@@ -191,8 +191,8 @@ try {
   fs.renameSync(existingDir, existingDir2);
 } catch (err) {
   errors.push('rename');
-  assert.ok(0 <= err.message.indexOf(existingDir));
-  assert.ok(0 <= err.message.indexOf(existingDir2));
+  assert.ok(err.message.includes(existingDir));
+  assert.ok(err.message.includes(existingDir2));
 }
 
 try {
@@ -200,7 +200,7 @@ try {
   fs.readdirSync(fn);
 } catch (err) {
   errors.push('readdir');
-  assert.ok(0 <= err.message.indexOf(fn));
+  assert.ok(err.message.includes(fn));
 }
 
 process.on('exit', function() {
diff --git a/test/parallel/test-fs-stat.js b/test/parallel/test-fs-stat.js
index 00fcc1df21c586..0c3a2e8b4801c2 100644
--- a/test/parallel/test-fs-stat.js
+++ b/test/parallel/test-fs-stat.js
@@ -28,7 +28,7 @@ fs.open('.', 'r', undefined, common.mustCall(function(err, fd) {
   fs.fstat(fd, common.mustCall(function(err, stats) {
     assert.ifError(err);
     assert.ok(stats.mtime instanceof Date);
-    fs.close(fd);
+    fs.close(fd, assert.ifError);
     assert.strictEqual(this, global);
   }));
 
@@ -47,7 +47,7 @@ fs.open('.', 'r', undefined, common.mustCall(function(err, fd) {
     console.dir(stats);
     assert.ok(stats.mtime instanceof Date);
   }
-  fs.close(fd);
+  fs.close(fd, assert.ifError);
 }));
 
 console.log(`stating:  ${__filename}`);
diff --git a/test/parallel/test-http-client-parse-error.js b/test/parallel/test-http-client-parse-error.js
index e649f983a51626..77cd2cb193a680 100644
--- a/test/parallel/test-http-client-parse-error.js
+++ b/test/parallel/test-http-client-parse-error.js
@@ -26,7 +26,7 @@ net.createServer(function(c) {
       path: '/'
     }).on('error', function(e) {
       console.log('got error from client');
-      assert.ok(e.message.indexOf('Parse Error') >= 0);
+      assert.ok(e.message.includes('Parse Error'));
       assert.strictEqual(e.code, 'HPE_INVALID_CONSTANT');
       parseErrors++;
     }).end();
diff --git a/test/parallel/test-http-extra-response.js b/test/parallel/test-http-extra-response.js
index 5e994134c2e2ad..2a57c3374757e6 100644
--- a/test/parallel/test-http-extra-response.js
+++ b/test/parallel/test-http-extra-response.js
@@ -28,7 +28,7 @@ const server = net.createServer(function(socket) {
   socket.on('data', function(chunk) {
     postBody += chunk;
 
-    if (postBody.indexOf('\r\n') > -1) {
+    if (postBody.includes('\r\n')) {
       socket.write(fullResponse);
       // omg, I wrote the response twice, what a terrible HTTP server I am.
       socket.end(fullResponse);
diff --git a/test/parallel/test-http-get-pipeline-problem.js b/test/parallel/test-http-get-pipeline-problem.js
index 56bfb33456dff7..69d6264acbb954 100644
--- a/test/parallel/test-http-get-pipeline-problem.js
+++ b/test/parallel/test-http-get-pipeline-problem.js
@@ -72,7 +72,7 @@ function checkFiles() {
 
   for (let i = 0; i < total; i++) {
     const fn = i + '.jpg';
-    assert.ok(files.indexOf(fn) >= 0, "couldn't find '" + fn + "'");
+    assert.ok(files.includes(fn), "couldn't find '" + fn + "'");
     const stat = fs.statSync(common.tmpDir + '/' + fn);
     assert.strictEqual(image.length, stat.size,
                        "size doesn't match on '" + fn +
diff --git a/test/parallel/test-http-outgoing-first-chunk-singlebyte-encoding.js b/test/parallel/test-http-outgoing-first-chunk-singlebyte-encoding.js
new file mode 100644
index 00000000000000..214287a6ffc157
--- /dev/null
+++ b/test/parallel/test-http-outgoing-first-chunk-singlebyte-encoding.js
@@ -0,0 +1,36 @@
+'use strict';
+const common = require('../common');
+
+// Regression test for https://github.com/nodejs/node/issues/11788.
+
+const assert = require('assert');
+const http = require('http');
+const net = require('net');
+
+for (const enc of ['utf8', 'utf16le', 'latin1', 'UTF-8']) {
+  const server = http.createServer(common.mustCall((req, res) => {
+    res.setHeader('content-type', `text/plain; charset=${enc}`);
+    res.write('helloworld', enc);
+    res.end();
+  })).listen(0);
+
+  server.on('listening', common.mustCall(() => {
+    const buffers = [];
+    const socket = net.connect(server.address().port);
+    socket.write('GET / HTTP/1.0\r\n\r\n');
+    socket.on('data', (data) => buffers.push(data));
+    socket.on('end', common.mustCall(() => {
+      const received = Buffer.concat(buffers);
+      const headerEnd = received.indexOf('\r\n\r\n', 'utf8');
+      assert.notStrictEqual(headerEnd, -1);
+
+      const header = received.toString('utf8', 0, headerEnd).split(/\r\n/g);
+      const body = received.toString(enc, headerEnd + 4);
+
+      assert.strictEqual(header[0], 'HTTP/1.1 200 OK');
+      assert.strictEqual(header[1], `content-type: text/plain; charset=${enc}`);
+      assert.strictEqual(body, 'helloworld');
+      server.close();
+    }));
+  }));
+}
diff --git a/test/parallel/test-https-strict.js b/test/parallel/test-https-strict.js
index d36b413021643f..9f417ce4914c3f 100644
--- a/test/parallel/test-https-strict.js
+++ b/test/parallel/test-https-strict.js
@@ -111,11 +111,11 @@ function makeReq(path, port, error, host, ca) {
     options.agent = agent0;
   } else {
     if (!Array.isArray(ca)) ca = [ca];
-    if (-1 !== ca.indexOf(ca1) && -1 !== ca.indexOf(ca2)) {
+    if (ca.includes(ca1) && ca.includes(ca2)) {
       options.agent = agent3;
-    } else if (-1 !== ca.indexOf(ca1)) {
+    } else if (ca.includes(ca1)) {
       options.agent = agent1;
-    } else if (-1 !== ca.indexOf(ca2)) {
+    } else if (ca.includes(ca2)) {
       options.agent = agent2;
     } else {
       options.agent = agent0;
diff --git a/test/parallel/test-internal-socket-list-receive.js b/test/parallel/test-internal-socket-list-receive.js
new file mode 100644
index 00000000000000..db781cb505c981
--- /dev/null
+++ b/test/parallel/test-internal-socket-list-receive.js
@@ -0,0 +1,67 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const EventEmitter = require('events');
+const SocketListReceive = require('internal/socket_list').SocketListReceive;
+
+const key = 'test-key';
+
+// Verify that the message won't be sent when slave is not connected.
+{
+  const slave = Object.assign(new EventEmitter(), {
+    connected: false,
+    send: common.mustNotCall()
+  });
+
+  const list = new SocketListReceive(slave, key);
+  list.slave.emit('internalMessage', { key, cmd: 'NODE_SOCKET_NOTIFY_CLOSE' });
+}
+
+// Verify that a "NODE_SOCKET_ALL_CLOSED" message will be sent.
+{
+  const slave = Object.assign(new EventEmitter(), {
+    connected: true,
+    send: common.mustCall((msg) => {
+      assert.strictEqual(msg.cmd, 'NODE_SOCKET_ALL_CLOSED');
+      assert.strictEqual(msg.key, key);
+    })
+  });
+
+  const list = new SocketListReceive(slave, key);
+  list.slave.emit('internalMessage', { key, cmd: 'NODE_SOCKET_NOTIFY_CLOSE' });
+}
+
+// Verify that a "NODE_SOCKET_COUNT" message will be sent.
+{
+  const slave = Object.assign(new EventEmitter(), {
+    connected: true,
+    send: common.mustCall((msg) => {
+      assert.strictEqual(msg.cmd, 'NODE_SOCKET_COUNT');
+      assert.strictEqual(msg.key, key);
+      assert.strictEqual(msg.count, 0);
+    })
+  });
+
+  const list = new SocketListReceive(slave, key);
+  list.slave.emit('internalMessage', { key, cmd: 'NODE_SOCKET_GET_COUNT' });
+}
+
+// Verify that the connections count is added and an "empty" event
+// will be emitted when all sockets in obj were closed.
+{
+  const slave = new EventEmitter();
+  const obj = { socket: new EventEmitter() };
+
+  const list = new SocketListReceive(slave, key);
+  assert.strictEqual(list.connections, 0);
+
+  list.add(obj);
+  assert.strictEqual(list.connections, 1);
+
+  list.on('empty', common.mustCall((self) => assert.strictEqual(self, list)));
+
+  obj.socket.emit('close');
+  assert.strictEqual(list.connections, 0);
+}
diff --git a/test/parallel/test-internal-socket-list-send.js b/test/parallel/test-internal-socket-list-send.js
new file mode 100644
index 00000000000000..391ecc234076d5
--- /dev/null
+++ b/test/parallel/test-internal-socket-list-send.js
@@ -0,0 +1,114 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const EventEmitter = require('events');
+const SocketListSend = require('internal/socket_list').SocketListSend;
+
+const key = 'test-key';
+
+// Verify that an error will be received in callback when slave is not
+// connected.
+{
+  const slave = Object.assign(new EventEmitter(), { connected: false });
+  assert.strictEqual(slave.listenerCount('internalMessage'), 0);
+
+  const list = new SocketListSend(slave, 'test');
+
+  list._request('msg', 'cmd', common.mustCall((err) => {
+    assert.strictEqual(err.message, 'Slave closed before reply');
+    assert.strictEqual(slave.listenerCount('internalMessage'), 0);
+  }));
+}
+
+// Verify that the given message will be received in callback.
+{
+  const slave = Object.assign(new EventEmitter(), {
+    connected: true,
+    send: function(msg) {
+      process.nextTick(() =>
+        this.emit('internalMessage', { key, cmd: 'cmd' })
+      );
+    }
+  });
+
+  const list = new SocketListSend(slave, key);
+
+  list._request('msg', 'cmd', common.mustCall((err, msg) => {
+    assert.strictEqual(err, null);
+    assert.strictEqual(msg.cmd, 'cmd');
+    assert.strictEqual(msg.key, key);
+    assert.strictEqual(slave.listenerCount('internalMessage'), 0);
+    assert.strictEqual(slave.listenerCount('disconnect'), 0);
+  }));
+}
+
+// Verify that an error will be received in callback when slave was
+// disconnected.
+{
+  const slave = Object.assign(new EventEmitter(), {
+    connected: true,
+    send: function(msg) { process.nextTick(() => this.emit('disconnect')); }
+  });
+
+  const list = new SocketListSend(slave, key);
+
+  list._request('msg', 'cmd', common.mustCall((err) => {
+    assert.strictEqual(err.message, 'Slave closed before reply');
+    assert.strictEqual(slave.listenerCount('internalMessage'), 0);
+  }));
+}
+
+// Verify that a "NODE_SOCKET_ALL_CLOSED" message will be received
+// in callback.
+{
+  const slave = Object.assign(new EventEmitter(), {
+    connected: true,
+    send: function(msg) {
+      assert.strictEqual(msg.cmd, 'NODE_SOCKET_NOTIFY_CLOSE');
+      assert.strictEqual(msg.key, key);
+      process.nextTick(() =>
+        this.emit('internalMessage', { key, cmd: 'NODE_SOCKET_ALL_CLOSED' })
+      );
+    }
+  });
+
+  const list = new SocketListSend(slave, key);
+
+  list.close(common.mustCall((err, msg) => {
+    assert.strictEqual(err, null);
+    assert.strictEqual(msg.cmd, 'NODE_SOCKET_ALL_CLOSED');
+    assert.strictEqual(msg.key, key);
+    assert.strictEqual(slave.listenerCount('internalMessage'), 0);
+    assert.strictEqual(slave.listenerCount('disconnect'), 0);
+  }));
+}
+
+// Verify that the count of connections will be received in callback.
+{
+  const count = 1;
+  const slave = Object.assign(new EventEmitter(), {
+    connected: true,
+    send: function(msg) {
+      assert.strictEqual(msg.cmd, 'NODE_SOCKET_GET_COUNT');
+      assert.strictEqual(msg.key, key);
+      process.nextTick(() =>
+        this.emit('internalMessage', {
+          key,
+          count,
+          cmd: 'NODE_SOCKET_COUNT'
+        })
+      );
+    }
+  });
+
+  const list = new SocketListSend(slave, key);
+
+  list.getConnections(common.mustCall((err, msg) => {
+    assert.strictEqual(err, null);
+    assert.strictEqual(msg, count);
+    assert.strictEqual(slave.listenerCount('internalMessage'), 0);
+    assert.strictEqual(slave.listenerCount('disconnect'), 0);
+  }));
+}
diff --git a/test/parallel/test-intl.js b/test/parallel/test-intl.js
index 3b56defe471af0..6bbe71ec147b42 100644
--- a/test/parallel/test-intl.js
+++ b/test/parallel/test-intl.js
@@ -16,7 +16,7 @@ const haveIntl = (global.Intl !== undefined);
 // Else, returns false
 function haveLocale(loc) {
   const locs = process.config.variables.icu_locales.split(',');
-  return locs.indexOf(loc) !== -1;
+  return locs.includes(loc);
 }
 
 if (!haveIntl) {
diff --git a/test/parallel/test-listen-fd-detached-inherit.js b/test/parallel/test-listen-fd-detached-inherit.js
index 36e4df28897383..f921ba0bbf8d6d 100644
--- a/test/parallel/test-listen-fd-detached-inherit.js
+++ b/test/parallel/test-listen-fd-detached-inherit.js
@@ -29,7 +29,7 @@ function test() {
   let json = '';
   parent.stdout.on('data', function(c) {
     json += c.toString();
-    if (json.indexOf('\n') !== -1) next();
+    if (json.includes('\n')) next();
   });
   function next() {
     console.error('output from parent = %s', json);
diff --git a/test/parallel/test-listen-fd-detached.js b/test/parallel/test-listen-fd-detached.js
index ec9d039e96e3f2..de878726af5761 100644
--- a/test/parallel/test-listen-fd-detached.js
+++ b/test/parallel/test-listen-fd-detached.js
@@ -29,7 +29,7 @@ function test() {
   let json = '';
   parent.stdout.on('data', function(c) {
     json += c.toString();
-    if (json.indexOf('\n') !== -1) next();
+    if (json.includes('\n')) next();
   });
   function next() {
     console.error('output from parent = %s', json);
diff --git a/test/parallel/test-module-globalpaths-nodepath.js b/test/parallel/test-module-globalpaths-nodepath.js
index a4781d27a7a9c6..6bb55d3d8465d9 100644
--- a/test/parallel/test-module-globalpaths-nodepath.js
+++ b/test/parallel/test-module-globalpaths-nodepath.js
@@ -19,8 +19,8 @@ if (common.isWindows) {
 
 mod._initPaths();
 
-assert.ok(mod.globalPaths.indexOf(partA) !== -1);
-assert.ok(mod.globalPaths.indexOf(partB) !== -1);
-assert.ok(mod.globalPaths.indexOf(partC) === -1);
+assert.ok(mod.globalPaths.includes(partA));
+assert.ok(mod.globalPaths.includes(partB));
+assert.ok(!mod.globalPaths.includes(partC));
 
 assert.ok(Array.isArray(mod.globalPaths));
diff --git a/test/parallel/test-net-eaddrinuse.js b/test/parallel/test-net-eaddrinuse.js
index cf4293e8230875..9c30f933108d6f 100644
--- a/test/parallel/test-net-eaddrinuse.js
+++ b/test/parallel/test-net-eaddrinuse.js
@@ -9,7 +9,7 @@ const server2 = net.createServer(function(socket) {
 });
 server1.listen(0, function() {
   server2.on('error', function(error) {
-    assert.strictEqual(true, error.message.indexOf('EADDRINUSE') >= 0);
+    assert.strictEqual(true, error.message.includes('EADDRINUSE'));
     server1.close();
   });
   server2.listen(this.address().port);
diff --git a/test/parallel/test-process-chdir.js b/test/parallel/test-process-chdir.js
index f54026467eb6cd..b137be4611c20d 100644
--- a/test/parallel/test-process-chdir.js
+++ b/test/parallel/test-process-chdir.js
@@ -5,6 +5,7 @@ const assert = require('assert');
 const fs = require('fs');
 const path = require('path');
 
+process.chdir('..');
 assert.notStrictEqual(process.cwd(), __dirname);
 process.chdir(__dirname);
 assert.strictEqual(process.cwd(), __dirname);
diff --git a/test/parallel/test-process-getactivehandles.js b/test/parallel/test-process-getactivehandles.js
index 8ceb2bcd2a32f7..2db3da3c563e6e 100644
--- a/test/parallel/test-process-getactivehandles.js
+++ b/test/parallel/test-process-getactivehandles.js
@@ -33,15 +33,15 @@ function checkAll() {
   const handles = process._getActiveHandles();
 
   clients.forEach(function(item) {
-    assert.ok(handles.indexOf(item) > -1);
+    assert.ok(handles.includes(item));
     item.destroy();
   });
 
   connections.forEach(function(item) {
-    assert.ok(handles.indexOf(item) > -1);
+    assert.ok(handles.includes(item));
     item.end();
   });
 
-  assert.ok(handles.indexOf(server) > -1);
+  assert.ok(handles.includes(server));
   server.close();
 }
diff --git a/test/parallel/test-process-setuid-setgid.js b/test/parallel/test-process-setuid-setgid.js
new file mode 100644
index 00000000000000..080bc54a8fba1b
--- /dev/null
+++ b/test/parallel/test-process-setuid-setgid.js
@@ -0,0 +1,48 @@
+'use strict';
+
+const common = require('../common');
+
+const assert = require('assert');
+
+if (common.isWindows) {
+  // uid/gid functions are POSIX only
+  assert.strictEqual(process.getuid, undefined);
+  assert.strictEqual(process.setuid, undefined);
+  assert.strictEqual(process.getgid, undefined);
+  assert.strictEqual(process.setgid, undefined);
+  return;
+}
+
+assert.throws(() => {
+  process.setuid('fhqwhgadshgnsdhjsdbkhsdabkfabkveybvf');
+}, /^Error: setuid user id does not exist$/);
+
+// If we're not running as super user...
+if (process.getuid() !== 0) {
+  assert.doesNotThrow(() => {
+    process.getgid();
+    process.getuid();
+  });
+
+  assert.throws(
+    () => { process.setgid('nobody'); },
+    /^Error: (EPERM, .+|setgid group id does not exist)$/
+  );
+
+  assert.throws(
+    () => { process.setuid('nobody'); },
+    /^Error: EPERM, /
+  );
+  return;
+}
+
+// If we are running as super user...
+const oldgid = process.getgid();
+process.setgid('nobody');
+const newgid = process.getgid();
+assert.notStrictEqual(newgid, oldgid);
+
+const olduid = process.getuid();
+process.setuid('nobody');
+const newuid = process.getuid();
+assert.notStrictEqual(newuid, olduid);
diff --git a/test/parallel/test-readline.js b/test/parallel/test-readline.js
new file mode 100644
index 00000000000000..62a4fe6f4830fd
--- /dev/null
+++ b/test/parallel/test-readline.js
@@ -0,0 +1,45 @@
+'use strict';
+const common = require('../common');
+const { PassThrough } = require('stream');
+const readline = require('readline');
+const assert = require('assert');
+
+{
+  const input = new PassThrough();
+  const rl = readline.createInterface({
+    terminal: true,
+    input: input
+  });
+
+  rl.on('line', common.mustCall((data) => {
+    assert.strictEqual(data, 'abc');
+  }));
+
+  input.end('abc');
+}
+
+{
+  const input = new PassThrough();
+  const rl = readline.createInterface({
+    terminal: true,
+    input: input
+  });
+
+  rl.on('line', common.mustNotCall('must not be called before newline'));
+
+  input.write('abc');
+}
+
+{
+  const input = new PassThrough();
+  const rl = readline.createInterface({
+    terminal: true,
+    input: input
+  });
+
+  rl.on('line', common.mustCall((data) => {
+    assert.strictEqual(data, 'abc');
+  }));
+
+  input.write('abc\n');
+}
diff --git a/test/parallel/test-regress-GH-5051.js b/test/parallel/test-regress-GH-5051.js
index f2562bd7eb8020..ecaf55d625b815 100644
--- a/test/parallel/test-regress-GH-5051.js
+++ b/test/parallel/test-regress-GH-5051.js
@@ -1,5 +1,5 @@
 'use strict';
-const common = require('../common');
+require('../common');
 const assert = require('assert');
 const agent = require('http').globalAgent;
 
@@ -12,20 +12,22 @@ agent.maxSockets = 0;
 
 // localAddress is used when naming requests / sockets
 // while using the Legacy API
-agent.addRequest(req, 'localhost', common.PORT, '127.0.0.1');
+// port 8080 is hardcoded since this does not create a network connection
+agent.addRequest(req, 'localhost', 8080, '127.0.0.1');
 assert.strictEqual(Object.keys(agent.requests).length, 1);
 assert.strictEqual(
   Object.keys(agent.requests)[0],
-  'localhost:' + common.PORT + ':127.0.0.1');
+  'localhost:8080:127.0.0.1');
 
 // path is *not* used when naming requests / sockets
+// port 8080 is hardcoded since this does not create a network connection
 agent.addRequest(req, {
   host: 'localhost',
-  port: common.PORT,
+  port: 8080,
   localAddress: '127.0.0.1',
   path: '/foo'
 });
 assert.strictEqual(Object.keys(agent.requests).length, 1);
 assert.strictEqual(
   Object.keys(agent.requests)[0],
-  'localhost:' + common.PORT + ':127.0.0.1');
+  'localhost:8080:127.0.0.1');
diff --git a/test/parallel/test-regress-GH-5727.js b/test/parallel/test-regress-GH-5727.js
index 8cbec2a178a5f7..7cedd831b2f783 100644
--- a/test/parallel/test-regress-GH-5727.js
+++ b/test/parallel/test-regress-GH-5727.js
@@ -6,9 +6,9 @@ const net = require('net');
 const invalidPort = -1 >>> 0;
 const errorMessage = /"port" argument must be >= 0 and < 65536/;
 
-net.Server().listen(common.PORT, function() {
+net.Server().listen(0, function() {
   const address = this.address();
-  const key = `${address.family.slice(-1)}:${address.address}:${common.PORT}`;
+  const key = `${address.family.slice(-1)}:${address.address}:0`;
 
   assert.strictEqual(this._connectionKey, key);
   this.close();
diff --git a/test/parallel/test-repl-persistent-history.js b/test/parallel/test-repl-persistent-history.js
index 2b0ceac530a65f..0ce25a4dd5c7f0 100644
--- a/test/parallel/test-repl-persistent-history.js
+++ b/test/parallel/test-repl-persistent-history.js
@@ -76,6 +76,10 @@ const oldHistoryPath = path.join(fixtures, 'old-repl-history-file.json');
 const enoentHistoryPath = path.join(fixtures, 'enoent-repl-history-file.json');
 const emptyHistoryPath = path.join(fixtures, '.empty-repl-history-file');
 const defaultHistoryPath = path.join(common.tmpDir, '.node_repl_history');
+const emptyHiddenHistoryPath = path.join(fixtures,
+                                         '.empty-hidden-repl-history-file');
+const devNullHistoryPath = path.join(common.tmpDir,
+                                     '.dev-null-repl-history-file');
 
 const tests = [
   {
@@ -163,6 +167,28 @@ const tests = [
     test: [UP],
     expected: [prompt, replFailedRead, prompt, replDisabled, prompt]
   },
+  {
+    before: function before() {
+      if (common.isWindows) {
+        const execSync = require('child_process').execSync;
+        execSync(`ATTRIB +H "${emptyHiddenHistoryPath}"`, (err) => {
+          assert.ifError(err);
+        });
+      }
+    },
+    env: { NODE_REPL_HISTORY: emptyHiddenHistoryPath },
+    test: [UP],
+    expected: [prompt]
+  },
+  {
+    before: function before() {
+      if (!common.isWindows)
+        fs.symlinkSync('/dev/null', devNullHistoryPath);
+    },
+    env: { NODE_REPL_HISTORY: devNullHistoryPath },
+    test: [UP],
+    expected: [prompt]
+  },
   { // Make sure this is always the last test, since we change os.homedir()
     before: function before() {
       // Mock os.homedir() failure
diff --git a/test/parallel/test-repl.js b/test/parallel/test-repl.js
index 49ace9e68b45f4..5e3e9b7b663ba8 100644
--- a/test/parallel/test-repl.js
+++ b/test/parallel/test-repl.js
@@ -68,7 +68,7 @@ function error_test() {
                   client_unix.expect :
                   JSON.stringify(client_unix.expect)));
 
-    if (read_buffer.indexOf(prompt_unix) !== -1) {
+    if (read_buffer.includes(prompt_unix)) {
       // if it's an exact match, then don't do the regexp
       if (read_buffer !== client_unix.expect) {
         let expect = client_unix.expect;
@@ -89,7 +89,7 @@ function error_test() {
         tcp_test();
       }
 
-    } else if (read_buffer.indexOf(prompt_multiline) !== -1) {
+    } else if (read_buffer.includes(prompt_multiline)) {
       // Check that you meant to send a multiline test
       assert.strictEqual(prompt_multiline, client_unix.expect);
       read_buffer = '';
@@ -427,7 +427,7 @@ function tcp_test() {
       read_buffer += data.toString('ascii', 0, data.length);
       console.error('TCP data: ' + JSON.stringify(read_buffer) +
                    ', expecting ' + JSON.stringify(client_tcp.expect));
-      if (read_buffer.indexOf(prompt_tcp) !== -1) {
+      if (read_buffer.includes(prompt_tcp)) {
         assert.strictEqual(client_tcp.expect, read_buffer);
         console.error('match');
         read_buffer = '';
@@ -497,7 +497,7 @@ function unix_test() {
       read_buffer += data.toString('ascii', 0, data.length);
       console.error('Unix data: ' + JSON.stringify(read_buffer) +
                    ', expecting ' + JSON.stringify(client_unix.expect));
-      if (read_buffer.indexOf(prompt_unix) !== -1) {
+      if (read_buffer.includes(prompt_unix)) {
         assert.strictEqual(client_unix.expect, read_buffer);
         console.error('match');
         read_buffer = '';
diff --git a/test/parallel/test-stream-base-typechecking.js b/test/parallel/test-stream-base-typechecking.js
new file mode 100644
index 00000000000000..8d559a42dfc54a
--- /dev/null
+++ b/test/parallel/test-stream-base-typechecking.js
@@ -0,0 +1,14 @@
+'use strict';
+const common = require('../common');
+const assert = require('assert');
+const net = require('net');
+
+const server = net.createServer().listen(0, common.mustCall(() => {
+  const client = net.connect(server.address().port, common.mustCall(() => {
+    assert.throws(() => {
+      client.write('broken', 'buffer');
+    }, /^TypeError: Second argument must be a buffer$/);
+    client.destroy();
+    server.close();
+  }));
+}));
diff --git a/test/parallel/test-stream-big-packet.js b/test/parallel/test-stream-big-packet.js
index 8e5af3ea4ba342..72c4526973a9ad 100644
--- a/test/parallel/test-stream-big-packet.js
+++ b/test/parallel/test-stream-big-packet.js
@@ -22,7 +22,7 @@ util.inherits(TestStream, stream.Transform);
 TestStream.prototype._transform = function(chunk, encoding, done) {
   if (!passed) {
     // Char 'a' only exists in the last write
-    passed = chunk.toString().indexOf('a') >= 0;
+    passed = chunk.toString().includes('a');
   }
   done();
 };
diff --git a/test/parallel/test-stringbytes-external.js b/test/parallel/test-stringbytes-external.js
index 94b58d9c6eadf0..3775ecc13ec2dd 100644
--- a/test/parallel/test-stringbytes-external.js
+++ b/test/parallel/test-stringbytes-external.js
@@ -23,9 +23,9 @@ assert.strictEqual(b[1], 0);
 assert.strictEqual(ucs2_control, c);
 
 // now create big strings
-const size = 1 + (1 << 20);
-write_str = Array(size).join(write_str);
-ucs2_control = Array(size).join(ucs2_control);
+const size = 1 << 20;
+write_str = write_str.repeat(size);
+ucs2_control = ucs2_control.repeat(size);
 
 // check resultant buffer and output string
 b = Buffer.from(write_str, 'ucs2');
@@ -110,7 +110,7 @@ const PRE_3OF4_APEX = Math.ceil((EXTERN_APEX / 4) * 3) - RADIOS;
 
 // https://github.com/nodejs/node/issues/1024
 {
-  const a = Array(1 << 20).join('x');
+  const a = 'x'.repeat(1 << 20 - 1);
   const b = Buffer.from(a, 'ucs2').toString('ucs2');
   const c = Buffer.from(b, 'utf8').toString('utf8');
 
diff --git a/test/parallel/test-tls-env-bad-extra-ca.js b/test/parallel/test-tls-env-bad-extra-ca.js
index 9b42bbbbd5558e..c472789659e1d2 100644
--- a/test/parallel/test-tls-env-bad-extra-ca.js
+++ b/test/parallel/test-tls-env-bad-extra-ca.js
@@ -33,10 +33,9 @@ fork(__filename, opts)
     assert.strictEqual(status, 0, 'client did not succeed in connecting');
   }))
   .on('close', common.mustCall(function() {
-    assert(stderr.match(new RegExp(
-      'Warning: Ignoring extra certs from.*no-such-file-exists' +
-      '.* load failed:.*No such file or directory'
-    )), stderr);
+    assert(stderr.match(
+      /Warning: Ignoring extra certs from.*no-such-file-exists.* load failed:.*No such file or directory/
+    ), stderr);
   }))
   .stderr.setEncoding('utf8').on('data', function(str) {
     stderr += str;
diff --git a/test/parallel/test-tls-key-mismatch.js b/test/parallel/test-tls-key-mismatch.js
index 93c7e70d8c61f7..742282c91ed115 100644
--- a/test/parallel/test-tls-key-mismatch.js
+++ b/test/parallel/test-tls-key-mismatch.js
@@ -8,8 +8,8 @@ if (!common.hasCrypto) {
 const assert = require('assert');
 const tls = require('tls');
 const fs = require('fs');
-const errorMessageRegex = new RegExp('^Error: error:0B080074:x509 ' +
-  'certificate routines:X509_check_private_key:key values mismatch$');
+const errorMessageRegex =
+  /^Error: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch$/;
 
 const options = {
   key: fs.readFileSync(common.fixturesDir + '/keys/agent1-key.pem'),
diff --git a/test/parallel/test-util-inherits.js b/test/parallel/test-util-inherits.js
index 4ddf9ad35dd2d6..13094ef695081b 100644
--- a/test/parallel/test-util-inherits.js
+++ b/test/parallel/test-util-inherits.js
@@ -4,8 +4,7 @@ require('../common');
 const assert = require('assert');
 const inherits = require('util').inherits;
 const errCheck =
-  new RegExp('^TypeError: The super constructor to "inherits" must not be ' +
-                      'null or undefined$');
+  /^TypeError: The super constructor to "inherits" must not be null or undefined$/;
 
 
 // super constructor
diff --git a/test/parallel/test-vm-is-context.js b/test/parallel/test-vm-is-context.js
index e58b896fccaa43..e8b220ed6c3d68 100644
--- a/test/parallel/test-vm-is-context.js
+++ b/test/parallel/test-vm-is-context.js
@@ -5,7 +5,7 @@ const vm = require('vm');
 
 assert.throws(function() {
   vm.isContext('string is not supported');
-}, TypeError);
+}, /^TypeError: sandbox must be an object$/);
 
 assert.strictEqual(vm.isContext({}), false);
 assert.strictEqual(vm.isContext([]), false);
diff --git a/test/parallel/test-zlib-failed-init.js b/test/parallel/test-zlib-failed-init.js
new file mode 100644
index 00000000000000..afc2c82ddfca8e
--- /dev/null
+++ b/test/parallel/test-zlib-failed-init.js
@@ -0,0 +1,13 @@
+'use strict';
+
+require('../common');
+
+const assert = require('assert');
+const zlib = require('zlib');
+
+// For raw deflate encoding, requests for 256-byte windows are rejected as
+// invalid by zlib.
+// (http://zlib.net/manual.html#Advanced)
+assert.throws(() => {
+  zlib.createDeflateRaw({ windowBits: 8 });
+}, /^Error: Init error$/);
diff --git a/test/parallel/test-debug-brk-no-arg.js b/test/sequential/test-debug-brk-no-arg.js
similarity index 100%
rename from test/parallel/test-debug-brk-no-arg.js
rename to test/sequential/test-debug-brk-no-arg.js
diff --git a/test/parallel/test-debug-brk.js b/test/sequential/test-debug-brk.js
similarity index 100%
rename from test/parallel/test-debug-brk.js
rename to test/sequential/test-debug-brk.js
diff --git a/test/parallel/test-debug-no-context.js b/test/sequential/test-debug-no-context.js
similarity index 100%
rename from test/parallel/test-debug-no-context.js
rename to test/sequential/test-debug-no-context.js
diff --git a/test/parallel/test-debug-port-cluster.js b/test/sequential/test-debug-port-cluster.js
similarity index 100%
rename from test/parallel/test-debug-port-cluster.js
rename to test/sequential/test-debug-port-cluster.js
diff --git a/test/parallel/test-debug-port-from-cmdline.js b/test/sequential/test-debug-port-from-cmdline.js
similarity index 100%
rename from test/parallel/test-debug-port-from-cmdline.js
rename to test/sequential/test-debug-port-from-cmdline.js
diff --git a/test/parallel/test-debug-port-numbers.js b/test/sequential/test-debug-port-numbers.js
similarity index 100%
rename from test/parallel/test-debug-port-numbers.js
rename to test/sequential/test-debug-port-numbers.js
diff --git a/test/parallel/test-debug-signal-cluster.js b/test/sequential/test-debug-signal-cluster.js
similarity index 100%
rename from test/parallel/test-debug-signal-cluster.js
rename to test/sequential/test-debug-signal-cluster.js
diff --git a/test/parallel/test-debugger-util-regression.js b/test/sequential/test-debugger-util-regression.js
similarity index 100%
rename from test/parallel/test-debugger-util-regression.js
rename to test/sequential/test-debugger-util-regression.js
diff --git a/tools/doc/type-parser.js b/tools/doc/type-parser.js
index 38451b0e16b358..3f1ea9597c4fbe 100644
--- a/tools/doc/type-parser.js
+++ b/tools/doc/type-parser.js
@@ -5,12 +5,13 @@ const jsDocUrl = 'https://developer.mozilla.org/en-US/docs/Web/JavaScript/' +
 const jsPrimitiveUrl = 'https://developer.mozilla.org/en-US/docs/Web/' +
                        'JavaScript/Data_structures';
 const jsPrimitives = {
-  'Integer': 'Number',  // this is for extending
-  'Number': 'Number',
-  'String': 'String',
-  'Boolean': 'Boolean',
-  'Null': 'Null',
-  'Symbol': 'Symbol'
+  'boolean': 'Boolean',
+  'integer': 'Number', // not a primitive, used for clarification
+  'null': 'Null',
+  'number': 'Number',
+  'string': 'String',
+  'symbol': 'Symbol',
+  'undefined': 'Undefined'
 };
 const jsGlobalTypes = [
   'Error', 'Object', 'Function', 'Array', 'TypedArray', 'Uint8Array',
@@ -49,7 +50,16 @@ module.exports = {
       typeText = typeText.trim();
       if (typeText) {
         let typeUrl = null;
-        const primitive = jsPrimitives[typeText];
+
+        // To support type[], we store the full string and use
+        // the bracket-less version to lookup the type URL
+        const typeTextFull = typeText;
+        if (/\[]$/.test(typeText)) {
+          typeText = typeText.slice(0, -2);
+        }
+
+        const primitive = jsPrimitives[typeText.toLowerCase()];
+
         if (primitive !== undefined) {
           typeUrl = `${jsPrimitiveUrl}#${primitive}_type`;
         } else if (jsGlobalTypes.indexOf(typeText) !== -1) {
@@ -60,9 +70,10 @@ module.exports = {
 
         if (typeUrl) {
           typeLinks.push('<a href="' + typeUrl + '" class="type">&lt;' +
-            typeText + '&gt;</a>');
+            typeTextFull + '&gt;</a>');
         } else {
-          typeLinks.push('<span class="type">&lt;' + typeText + '&gt;</span>');
+          typeLinks.push('<span class="type">&lt;' + typeTextFull +
+                         '&gt;</span>');
         }
       }
     });
diff --git a/tools/eslint-rules/assert-fail-single-argument.js b/tools/eslint-rules/assert-fail-single-argument.js
deleted file mode 100644
index 4ce790238181cc..00000000000000
--- a/tools/eslint-rules/assert-fail-single-argument.js
+++ /dev/null
@@ -1,30 +0,0 @@
-/**
- * @fileoverview Prohibit use of a single argument only in `assert.fail()`. It
- * is almost always an error.
- * @author Rich Trott
- */
-'use strict';
-
-//------------------------------------------------------------------------------
-// Rule Definition
-//------------------------------------------------------------------------------
-
-const msg = 'assert.fail() message should be third argument';
-
-function isAssert(node) {
-  return node.callee.object && node.callee.object.name === 'assert';
-}
-
-function isFail(node) {
-  return node.callee.property && node.callee.property.name === 'fail';
-}
-
-module.exports = function(context) {
-  return {
-    'CallExpression': function(node) {
-      if (isAssert(node) && isFail(node) && node.arguments.length === 1) {
-        context.report(node, msg);
-      }
-    }
-  };
-};
diff --git a/tools/eslint-rules/new-with-error.js b/tools/eslint-rules/new-with-error.js
deleted file mode 100644
index 655f34bf080956..00000000000000
--- a/tools/eslint-rules/new-with-error.js
+++ /dev/null
@@ -1,31 +0,0 @@
-/**
- * @fileoverview Require `throw new Error()` rather than `throw Error()`
- * @author Rich Trott
- */
-'use strict';
-
-//------------------------------------------------------------------------------
-// Rule Definition
-//------------------------------------------------------------------------------
-
-module.exports = function(context) {
-
-  var errorList = context.options.length !== 0 ? context.options : ['Error'];
-
-  return {
-    'ThrowStatement': function(node) {
-      if (node.argument.type === 'CallExpression' &&
-          errorList.indexOf(node.argument.callee.name) !== -1) {
-        context.report(node, 'Use new keyword when throwing.');
-      }
-    }
-  };
-};
-
-module.exports.schema = {
-  'type': 'array',
-  'additionalItems': {
-    'type': 'string'
-  },
-  'uniqueItems': true
-};
diff --git a/tools/test.py b/tools/test.py
index ff9ba7cbc49172..207f39ebfce1ed 100755
--- a/tools/test.py
+++ b/tools/test.py
@@ -77,7 +77,6 @@ def __init__(self, cases, flaky_tests_mode):
     self.failed = [ ]
     self.flaky_failed = [ ]
     self.crashed = 0
-    self.flaky_crashed = 0
     self.lock = threading.Lock()
     self.shutdown_event = threading.Event()
 
@@ -155,8 +154,6 @@ def RunSingle(self, parallel, thread_id):
       if output.UnexpectedOutput():
         if FLAKY in output.test.outcomes and self.flaky_tests_mode == DONTCARE:
           self.flaky_failed.append(output)
-          if output.HasCrashed():
-            self.flaky_crashed += 1
         else:
           self.failed.append(output)
           if output.HasCrashed():
@@ -541,9 +538,6 @@ def UnexpectedOutput(self):
       outcome = PASS
     return not outcome in self.test.outcomes
 
-  def HasPreciousOutput(self):
-    return self.UnexpectedOutput() and self.store_unexpected_output
-
   def HasCrashed(self):
     if utils.IsWindows():
       return 0x80000000 & self.output.exit_code and not (0x3FFFFF00 & self.output.exit_code)
@@ -770,11 +764,6 @@ def GetName(self):
     return self.name
 
 
-# Use this to run several variants of the tests, e.g.:
-# VARIANT_FLAGS = [[], ['--always_compact', '--noflush_code']]
-VARIANT_FLAGS = [[]]
-
-
 class TestRepository(TestSuite):
 
   def __init__(self, path):
@@ -793,10 +782,6 @@ def GetConfiguration(self, context):
       (file, pathname, description) = imp.find_module('testcfg', [ self.path ])
       module = imp.load_module('testcfg', file, pathname, description)
       self.config = module.GetConfiguration(context, self.path)
-      if hasattr(self.config, 'additional_flags'):
-        self.config.additional_flags += context.node_args
-      else:
-        self.config.additional_flags = context.node_args
     finally:
       if file:
         file.close()
@@ -806,13 +791,11 @@ def GetBuildRequirements(self, path, context):
     return self.GetConfiguration(context).GetBuildRequirements()
 
   def AddTestsToList(self, result, current_path, path, context, arch, mode):
-    for v in VARIANT_FLAGS:
-      tests = self.GetConfiguration(context).ListTests(current_path, path,
-                                                       arch, mode)
-      for t in tests: t.variant_flags = v
-      result += tests
-      for i in range(1, context.repeat):
-        result += copy.deepcopy(tests)
+    tests = self.GetConfiguration(context).ListTests(current_path, path,
+                                                     arch, mode)
+    result += tests
+    for i in range(1, context.repeat):
+      result += copy.deepcopy(tests)
 
   def GetTestStatus(self, context, sections, defs):
     self.GetConfiguration(context).GetTestStatus(sections, defs)
@@ -848,12 +831,6 @@ def GetTestStatus(self, context, sections, defs):
       test.GetTestStatus(context, sections, defs)
 
 
-SUFFIX = {
-    'debug'   : '_g',
-    'release' : '' }
-FLAGS = {
-    'debug'   : ['--enable-slow-asserts', '--debug-code', '--verify-heap'],
-    'release' : []}
 TIMEOUT_SCALEFACTOR = {
     'armv6' : { 'debug' : 12, 'release' : 3 },  # The ARM buildbots are slow.
     'arm'   : { 'debug' :  8, 'release' : 2 },
@@ -870,7 +847,6 @@ def __init__(self, workspace, buildspace, verbose, vm, args, expect_fail,
     self.workspace = workspace
     self.buildspace = buildspace
     self.verbose = verbose
-    self.vm_root = vm
     self.node_args = args
     self.expect_fail = expect_fail
     self.timeout = timeout
@@ -899,9 +875,6 @@ def GetVm(self, arch, mode):
 
     return name
 
-  def GetVmFlags(self, testcase, mode):
-    return testcase.variant_flags + FLAGS[mode]
-
   def GetTimeout(self, mode):
     return self.timeout * TIMEOUT_SCALEFACTOR[ARCH_GUESS or 'ia32'][mode]
 
@@ -986,18 +959,6 @@ def IsEmpty(self):
     return len(self.elms) == 0
 
 
-class Everything(Set):
-
-  def Intersect(self, that):
-    return that
-
-  def Union(self, that):
-    return self
-
-  def IsEmpty(self):
-    return False
-
-
 class Nothing(Set):
 
   def Intersect(self, that):
diff --git a/vcbuild.bat b/vcbuild.bat
index 3cf7fe910a6f26..8089c37a24b2ee 100644
--- a/vcbuild.bat
+++ b/vcbuild.bat
@@ -39,6 +39,7 @@ set enable_vtune_arg=
 set configure_flags=
 set build_addons=
 set dll=
+set enable_static=
 
 :next-arg
 if "%1"=="" goto args-done
@@ -56,8 +57,8 @@ if /i "%1"=="nosnapshot"    set nosnapshot=1&goto arg-ok
 if /i "%1"=="noetw"         set noetw=1&goto arg-ok
 if /i "%1"=="noperfctr"     set noperfctr=1&goto arg-ok
 if /i "%1"=="licensertf"    set licensertf=1&goto arg-ok
-if /i "%1"=="test"          set test_args=%test_args% addons doctool known_issues message parallel sequential -J&set jslint=1&set build_addons=1&goto arg-ok
-if /i "%1"=="test-ci"       set test_args=%test_args% %test_ci_args% -p tap --logfile test.tap addons doctool inspector known_issues message sequential parallel&set cctest_args=%cctest_args% --gtest_output=tap:cctest.tap&set build_addons=1&goto arg-ok
+if /i "%1"=="test"          set test_args=%test_args% doctool known_issues message parallel sequential addons -J&set jslint=1&set build_addons=1&goto arg-ok
+if /i "%1"=="test-ci"       set test_args=%test_args% %test_ci_args% -p tap --logfile test.tap doctool inspector known_issues message sequential parallel addons&set cctest_args=%cctest_args% --gtest_output=tap:cctest.tap&set build_addons=1&goto arg-ok
 if /i "%1"=="test-addons"   set test_args=%test_args% addons&set build_addons=1&goto arg-ok
 if /i "%1"=="test-simple"   set test_args=%test_args% sequential parallel -J&goto arg-ok
 if /i "%1"=="test-message"  set test_args=%test_args% message&goto arg-ok
@@ -82,6 +83,7 @@ if /i "%1"=="download-all"  set download_arg="--download=all"&goto arg-ok
 if /i "%1"=="ignore-flaky"  set test_args=%test_args% --flaky-tests=dontcare&goto arg-ok
 if /i "%1"=="enable-vtune"  set enable_vtune_arg=1&goto arg-ok
 if /i "%1"=="dll"           set dll=1&goto arg-ok
+if /i "%1"=="static"           set enable_static=1&goto arg-ok
 
 echo Error: invalid command line option `%1`.
 exit /b 1
@@ -113,6 +115,7 @@ if defined release_urlbase set configure_flags=%configure_flags% --release-urlba
 if defined download_arg set configure_flags=%configure_flags% %download_arg%
 if defined enable_vtune_arg set configure_flags=%configure_flags% --enable-vtune-profiling
 if defined dll set configure_flags=%configure_flags% --shared
+if defined enable_static set configure_flags=%configure_flags% --enable-static
 
 if "%i18n_arg%"=="full-icu" set configure_flags=%configure_flags% --with-intl=full-icu
 if "%i18n_arg%"=="small-icu" set configure_flags=%configure_flags% --with-intl=small-icu