http: protect against response splitting attacks

This patch is a back-port of 3c293ba.
Closes #4696
blog: v0.9.9
blog: v0.9.9 is unstable, not stable
test: disable simple/test-dgram-send-error

It's not a good citizen, it spams random IP addresses with UDP packets.

Fixes #4730.
test: fix common.mustCall

Don't run the 'has function been called?' checks if the test is exiting
with an error because a failed check will mask the real exception.

v0.8 doesn't have the _fatalException machinery in src/node.js and
src/node.cc so it doesn't have this issue.
node: don't malloc in FromConstructorTemplate

* allocate space for argv on the stack
* move the declaration to node_internals.h
typed arrays: make call-as-function work for ctors

Turn call-as-function calls into constructor calls. Makes the following
snippet work:

  var buf = ArrayBuffer(32);  // no 'new' but does the right thing
fs: fix immediate WriteStream#end()

Fix an exception that was raised when the WriteStream was closed
immediately after creating it:

  TypeError: Cannot read property 'fd' of undefined
      at WriteStream.close (fs.js:1537:18)
      <snip>

Avoid the TypeError and make sure the file descriptor is closed.

Fixes #4745.
net: don't suppress ECONNRESET

Let ECONNRESET network errors bubble up so clients can detect them.

Commit c4454d2e suppressed and turned them into regular end-of-stream
events to fix the then-failing simple/test-regress-GH-1531 test. See
also issue #1571 for (scant) details.

It turns out that special handling is no longer necessary. Remove the
special casing and let the error bubble up naturally.

pummel/test-https-ci-reneg-attack and pummel/test-tls-ci-reneg-attack
are updated because they expected an EPIPE error code that is now an
ECONNRESET. Suppression of the ECONNRESET prevented the test from
detecting that the connection has been severed whereupon the next
write would fail with an EPIPE.

Fixes #1776.
test: update http tests for ECONNRESET change
crypto: improve cipher/decipher error messages

Throw the OpenSSL error string instead of the rather less informative
error message "fail".
stream: Empty strings/buffers do not signal EOF any longer
stream: read(0) should not always trigger _read(n,cb)

This is causing the CryptoStreams to get into an awful state when
there is a tight loop calling connection.write(chunk) waiting for
a false return.

Because CryptoStreams use read(0) to cycle data, this was causing
the encrypted side to pull way too much data in from the cleartext
side, since the read(0) would make it always call _read.

The unfortunate side effect, fixed in the next patch, is that
CryptoStreams don't automatically cycle when the Socket drains.
tls: Cycle data when underlying socket drains
Fix crypto.hmac behavior with empty keys.

node 0.9.6 introduced Buffer changes that cause the key argument of
Hmac::HmacInit (used in crypto.createHmac) to be NULL when the key is
empty. This argument is passed to OpenSSL's HMAC_Init, which does not
like NULL keys.

This change works around the issue by passing an empty string to
HMAC_Init when the key is empty, and adds crypto.createHmac tests for
the edge cases of empty keys and values.
test: fix tests after ECONNRESET patch
bench: make io.c file path configurable
blog: Peer Dependencies article

Thanks, @domenic
blog: Forgot slug on peer-dependencies article
net: Respect the 'readable' flag on sockets

Previously, we were only destroying sockets on end if their readable
side had already been ended.  This causes a problem for non-readable
streams, since we don't expect to ever see an 'end' event from those.

Treat the lack of a 'readable' flag the same as if it was an ended
readable stream.

Fix #4751