Merge changes I59024a0a,Iafd12e5a

* changes:
  __loader_cfi_fail: acquire g_dl_mutex
  android_get_exported_namespace: acquire g_dl_mutex
diff --git a/libc/Android.bp b/libc/Android.bp
index 6e5db65..a5442e1 100644
--- a/libc/Android.bp
+++ b/libc/Android.bp
@@ -906,6 +906,7 @@
                 "arch-x86/bionic/setjmp.S",
                 "arch-x86/bionic/syscall.S",
                 "arch-x86/bionic/vfork.S",
+                "arch-x86/bionic/__x86.get_pc_thunk.S",
 
                 // ssse3 functions
                 "arch-x86/atom/string/ssse3-strcat-atom.S",
diff --git a/libc/arch-x86/atom/string/sse2-memset-atom.S b/libc/arch-x86/atom/string/sse2-memset-atom.S
index 016c49e..e4cd038 100644
--- a/libc/arch-x86/atom/string/sse2-memset-atom.S
+++ b/libc/arch-x86/atom/string/sse2-memset-atom.S
@@ -77,15 +77,6 @@
     /* We loaded the jump table and adjusted EDX. Go.  */	\
     jmp		*%ebx
 
-	.section	.gnu.linkonce.t.__x86.get_pc_thunk.bx,"ax",@progbits
-	.globl	__x86.get_pc_thunk.bx
-	.hidden	__x86.get_pc_thunk.bx
-	ALIGN(4)
-	.type	__x86.get_pc_thunk.bx,@function
-__x86.get_pc_thunk.bx:
-	movl	(%esp), %ebx
-	ret
-
 ENTRY(__memset_chk_atom)
   ENTRANCE
 
diff --git a/libc/arch-x86/bionic/__x86.get_pc_thunk.S b/libc/arch-x86/bionic/__x86.get_pc_thunk.S
new file mode 100644
index 0000000..58dbb08
--- /dev/null
+++ b/libc/arch-x86/bionic/__x86.get_pc_thunk.S
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2020 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+// Typically GCC outputs functions like these into any object file that needs a PIC base register,
+// and one of the copies for each register is used. Clang doesn't use these functions, but some of
+// the quasi-hand-written assembly in the optimized string routines does.
+
+    .section .text.__x86.get_pc_thunk.bx,"axG",@progbits,__x86.get_pc_thunk.bx,comdat
+    .globl __x86.get_pc_thunk.bx
+    .hidden __x86.get_pc_thunk.bx
+    .p2align 4
+    .type __x86.get_pc_thunk.bx,@function
+__x86.get_pc_thunk.bx:
+    .cfi_startproc
+    movl (%esp), %ebx
+    ret
+    .cfi_endproc
+
+    .section .text.__x86.get_pc_thunk.cx,"axG",@progbits,__x86.get_pc_thunk.cx,comdat
+    .globl __x86.get_pc_thunk.cx
+    .hidden __x86.get_pc_thunk.cx
+    .p2align 4
+    .type __x86.get_pc_thunk.cx,@function
+__x86.get_pc_thunk.cx:
+    .cfi_startproc
+    movl (%esp), %ecx
+    ret
+    .cfi_endproc
diff --git a/libc/arch-x86/silvermont/string/sse2-memset-slm.S b/libc/arch-x86/silvermont/string/sse2-memset-slm.S
index adaccae..b7633f5 100644
--- a/libc/arch-x86/silvermont/string/sse2-memset-slm.S
+++ b/libc/arch-x86/silvermont/string/sse2-memset-slm.S
@@ -77,15 +77,6 @@
     /* We loaded the jump table and adjusted EDX. Go.  */	\
     jmp		*%ebx
 
-	.section	.gnu.linkonce.t.__x86.get_pc_thunk.bx,"ax",@progbits
-	.globl	__x86.get_pc_thunk.bx
-	.hidden	__x86.get_pc_thunk.bx
-	ALIGN(4)
-	.type	__x86.get_pc_thunk.bx,@function
-__x86.get_pc_thunk.bx:
-	movl	(%esp), %ebx
-	ret
-
 ENTRY(__memset_chk_generic)
   ENTRANCE
 
diff --git a/libc/bionic/malloc_tagged_pointers.h b/libc/bionic/malloc_tagged_pointers.h
index 212459b..de3cc2e 100644
--- a/libc/bionic/malloc_tagged_pointers.h
+++ b/libc/bionic/malloc_tagged_pointers.h
@@ -43,10 +43,11 @@
 // is also deliberately different from the standard pattern-init tag (0xAA), as
 // to be distinguishable from an uninitialized-pointer access. The first and
 // second nibbles are also deliberately designed to be the bitset-mirror of each
-// other (0b1100, 0b0011) in order to reduce incidental matches. Users must not
-// rely on the implementation-defined value of this pointer tag, as it may
-// change.
-static constexpr uintptr_t POINTER_TAG = 0x3C;
+// other (0b1011, 0b0100) in order to reduce incidental matches. We also ensure
+// that the top bit is set, as this catches incorrect code that assumes that a
+// "negative" pointer indicates error. Users must not rely on the
+// implementation-defined value of this pointer tag, as it may change.
+static constexpr uintptr_t POINTER_TAG = 0xB4;
 static constexpr unsigned UNTAG_SHIFT = 40;
 static constexpr unsigned CHECK_SHIFT = 48;
 static constexpr unsigned TAG_SHIFT = 56;