diff --git a/Android.bp b/Android.bp
index 376c250..72ab6c0 100644
--- a/Android.bp
+++ b/Android.bp
@@ -20,6 +20,7 @@
     src: "dummy_mountpoint",
     library: true,
     symlinks: ["libc.so"],
+    mountsource: "libc",
 }
 
 bionic_mountpoint {
@@ -28,6 +29,7 @@
     src: "dummy_mountpoint",
     library: true,
     symlinks: ["libdl.so"],
+    mountsource: "libdl",
 }
 
 bionic_mountpoint {
@@ -36,6 +38,7 @@
     src: "dummy_mountpoint",
     library: true,
     symlinks: ["libm.so"],
+    mountsource: "libm",
 }
 
 bionic_mountpoint {
@@ -49,4 +52,5 @@
     src: "dummy_mountpoint",
     binary: true,
     symlinks: ["linker", "linker_asan"],
+    mountsource: "linker",
 }
diff --git a/build/Android.bp b/build/Android.bp
index 6cc160a..acd0ee2 100644
--- a/build/Android.bp
+++ b/build/Android.bp
@@ -24,6 +24,7 @@
         "blueprint-proptools",
         "soong",
         "soong-android",
+        "soong-cc",
     ],
     srcs: [
         "bionic.go",
diff --git a/build/bionic.go b/build/bionic.go
index 3522aca..54ad10b 100644
--- a/build/bionic.go
+++ b/build/bionic.go
@@ -19,9 +19,11 @@
 	"io"
 	"strings"
 
+	"github.com/google/blueprint"
 	"github.com/google/blueprint/proptools"
 
 	"android/soong/android"
+	"android/soong/cc"
 )
 
 // bionic_mountpoint is a module type that is specialized to create
@@ -60,17 +62,24 @@
 	outputFile android.Path
 	pathInPartition string
 	stem string
+	unstrippedOutputFile android.Path
 }
 
 type bionicMountpointProperties struct {
 	// The file that is installed as the mount point
 	Src *string
 
+	// TODO(jiyong) remove these two properties (probably Stem and Suffix
+	// as well, as they can be inteffered from Mountsource
+
 	// True if the mount point is for a Bionic library such libc.so
 	Library *bool
 	// True if the mount point is for a Bionic binary such as linker
 	Binary *bool
 
+	// The module that this module is a mount point for
+	Mountsource *string
+
 	// Base name of the mount point
 	Stem *string `android:"arch_variant"`
 
@@ -80,6 +89,41 @@
 	// Symlinks to the mountpoints from the system and recovery partitions
 	// Symlinks names will have the same suffix as the mount point
 	Symlinks []string
+
+	// List of sanitizer names that this APEX is enabled for
+	SanitizerNames []string `blueprint:"mutated"`
+}
+
+type dependencyTag struct {
+	blueprint.BaseDependencyTag
+	name string
+}
+
+var mountsourceTag = dependencyTag{name: "mountsource"}
+
+
+func (m *bionicMountpoint) EnableSanitizer(sanitizerName string) {
+	if !android.InList(sanitizerName, m.properties.SanitizerNames) {
+		m.properties.SanitizerNames = append(m.properties.SanitizerNames, sanitizerName)
+	}
+}
+
+func (m *bionicMountpoint) IsSanitizerEnabled(ctx android.BaseModuleContext, sanitizerName string) bool {
+	if android.InList(sanitizerName, m.properties.SanitizerNames) {
+		return true
+	}
+
+	// Then follow the global setting
+	globalSanitizerNames := []string{}
+	if m.Host() {
+		globalSanitizerNames = ctx.Config().SanitizeHost()
+	} else {
+		arches := ctx.Config().SanitizeDeviceArch()
+		if len(arches) == 0 || android.InList(m.Arch().ArchType.Name, arches) {
+			globalSanitizerNames = ctx.Config().SanitizeDevice()
+		}
+	}
+	return android.InList(sanitizerName, globalSanitizerNames)
 }
 
 func (m *bionicMountpoint) DepsMutator(ctx android.BottomUpMutatorContext) {
@@ -95,6 +139,17 @@
 		ctx.PropertyErrorf("src", "src must be set")
 	}
 	android.ExtractSourceDeps(ctx, m.properties.Src)
+
+	if m.properties.Mountsource == nil {
+		ctx.PropertyErrorf("mountsource", "mountsource must be set")
+		return
+	}
+
+	ctx.AddFarVariationDependencies([]blueprint.Variation{
+		{Mutator: "arch", Variation: ctx.Target().String()},
+		{Mutator: "image", Variation: "core"},
+		{Mutator: "link", Variation: "shared"},
+	}, mountsourceTag, String(m.properties.Mountsource))
 }
 
 func (m *bionicMountpoint) GenerateAndroidBuildActions(ctx android.ModuleContext) {
@@ -110,6 +165,12 @@
 	m.stem = String(m.properties.Stem) + String(m.properties.Suffix)
 
 	m.outputFile = ctx.ExpandSource(String(m.properties.Src), "src")
+
+	ctx.VisitDirectDepsWithTag(mountsourceTag, func(module android.Module) {
+		if cc, ok := module.(*cc.Module); ok {
+			m.unstrippedOutputFile = cc.UnstrippedOutputFile()
+		}
+	})
 }
 
 func (m *bionicMountpoint) AndroidMk() android.AndroidMkData {
@@ -148,7 +209,10 @@
 				}
 				fmt.Fprintln(w, "LOCAL_POST_INSTALL_CMD := " + strings.Join(cmds, " && "))
 			}
-			fmt.Fprintln(w, "include $(BUILD_PREBUILT)")
+			if m.unstrippedOutputFile != nil {
+				fmt.Fprintln(w, "LOCAL_SOONG_UNSTRIPPED_BINARY :=", m.unstrippedOutputFile.String())
+			}
+			fmt.Fprintln(w, "include $(BUILD_SYSTEM)/soong_cc_prebuilt.mk")
 		},
 	}
 }
diff --git a/libc/Android.bp b/libc/Android.bp
index dc437d8..262d951 100644
--- a/libc/Android.bp
+++ b/libc/Android.bp
@@ -77,8 +77,14 @@
     native_coverage: false,
     recovery_available: true,
 
-    // TODO(ivanlozano): Remove after b/118321713
-    xom: false,
+    arch: {
+        x86: {
+            no_libcrt: true,
+        },
+        x86_64: {
+            no_libcrt: true,
+        },
+    },
 }
 
 // ========================================================
@@ -764,7 +770,7 @@
                 "arch-arm/bionic/atomics_arm.c",
                 "arch-arm/bionic/__bionic_clone.S",
                 "arch-arm/bionic/_exit_with_stack_teardown.S",
-                "arch-arm/bionic/libgcc_compat.c",
+                "arch-arm/bionic/libcrt_compat.c",
                 "arch-arm/bionic/popcount_tab.c",
                 "arch-arm/bionic/__restore.S",
                 "arch-arm/bionic/setjmp.S",
@@ -848,7 +854,7 @@
                 "arch-mips/bionic/__bionic_clone.S",
                 "arch-mips/bionic/cacheflush.cpp",
                 "arch-mips/bionic/_exit_with_stack_teardown.S",
-                "arch-mips/bionic/libgcc_compat.c",
+                "arch-mips/bionic/libcrt_compat.c",
                 "arch-mips/bionic/setjmp.S",
                 "arch-mips/bionic/syscall.S",
                 "arch-mips/bionic/vfork.S",
@@ -918,7 +924,7 @@
 
                 "arch-x86/bionic/__bionic_clone.S",
                 "arch-x86/bionic/_exit_with_stack_teardown.S",
-                "arch-x86/bionic/libgcc_compat.c",
+                "arch-x86/bionic/libcrt_compat.c",
                 "arch-x86/bionic/__restore.S",
                 "arch-x86/bionic/setjmp.S",
                 "arch-x86/bionic/syscall.S",
@@ -1300,7 +1306,9 @@
 cc_library_static {
     name: "libc_ndk",
     defaults: ["libc_defaults"],
-    srcs: libc_common_src_files + ["bionic/malloc_common.cpp"],
+    srcs: libc_common_src_files + [
+        "bionic/malloc_common.cpp",
+    ],
     multilib: {
         lib32: {
             srcs: libc_common_src_files_32,
@@ -1493,6 +1501,8 @@
         "arch-common/bionic/crtbrand.S",
         "bionic/icu.cpp",
         "bionic/malloc_common.cpp",
+        "bionic/malloc_common_dynamic.cpp",
+        "bionic/malloc_heapprofd.cpp",
         "bionic/NetdClient.cpp",
         "arch-common/bionic/crtend_so.S",
     ],
diff --git a/libc/arch-arm/bionic/libgcc_compat.c b/libc/arch-arm/bionic/libcrt_compat.c
similarity index 95%
rename from libc/arch-arm/bionic/libgcc_compat.c
rename to libc/arch-arm/bionic/libcrt_compat.c
index abd1422..22a3387 100644
--- a/libc/arch-arm/bionic/libgcc_compat.c
+++ b/libc/arch-arm/bionic/libcrt_compat.c
@@ -90,6 +90,8 @@
 extern char __floatunsisf;
 extern char __gedf2;
 extern char __gtdf2;
+extern char __gnu_ldivmod_helper;
+extern char __gnu_uldivmod_helper;
 extern char __ledf2;
 extern char __ltdf2;
 extern char __muldf3;
@@ -101,10 +103,11 @@
 extern char __subdf3;
 extern char __subsf3;
 extern char __truncdfsf2;
+extern char __udivdi3;
 extern char __unorddf2;
 extern char __unordsf2;
 
-void* __bionic_libgcc_compat_symbols[] = {
+void* __bionic_libcrt_compat_symbols[] = {
     &__adddf3,
     &__addsf3,
     &__aeabi_cdcmpeq,
@@ -169,6 +172,8 @@
     &__floatunsisf,
     &__gedf2,
     &__gtdf2,
+    &__gnu_ldivmod_helper,
+    &__gnu_uldivmod_helper,
     &__ledf2,
     &__ltdf2,
     &__muldf3,
@@ -180,6 +185,7 @@
     &__subdf3,
     &__subsf3,
     &__truncdfsf2,
+    &__udivdi3,
     &__unorddf2,
     &__unordsf2,
 };
diff --git a/libc/arch-mips/bionic/libgcc_compat.c b/libc/arch-mips/bionic/libcrt_compat.c
similarity index 97%
rename from libc/arch-mips/bionic/libgcc_compat.c
rename to libc/arch-mips/bionic/libcrt_compat.c
index 1a0f566..cfa41f2 100644
--- a/libc/arch-mips/bionic/libgcc_compat.c
+++ b/libc/arch-mips/bionic/libcrt_compat.c
@@ -32,7 +32,7 @@
 extern char __udivdi3;
 extern char __umoddi3;
 
-void* __bionic_libgcc_compat_symbols[] = {
+void* __bionic_libcrt_compat_symbols[] = {
     &__divdi3,
     &__moddi3,
     &__popcountsi2,
diff --git a/libc/arch-x86/bionic/__libc_init_sysinfo.cpp b/libc/arch-x86/bionic/__libc_init_sysinfo.cpp
index 849d253..5c44b4e 100644
--- a/libc/arch-x86/bionic/__libc_init_sysinfo.cpp
+++ b/libc/arch-x86/bionic/__libc_init_sysinfo.cpp
@@ -32,6 +32,10 @@
 // This file is compiled without stack protection, because it runs before TLS
 // has been set up.
 
+__LIBC_HIDDEN__ __attribute__((__naked__)) void __libc_int0x80() {
+  __asm__ volatile("int $0x80; ret");
+}
+
 __LIBC_HIDDEN__ void __libc_init_sysinfo() {
   bool dummy;
   __libc_sysinfo = reinterpret_cast<void*>(__bionic_getauxval(AT_SYSINFO, dummy));
diff --git a/libc/arch-x86/bionic/libgcc_compat.c b/libc/arch-x86/bionic/libcrt_compat.c
similarity index 97%
rename from libc/arch-x86/bionic/libgcc_compat.c
rename to libc/arch-x86/bionic/libcrt_compat.c
index 1a0f566..cfa41f2 100644
--- a/libc/arch-x86/bionic/libgcc_compat.c
+++ b/libc/arch-x86/bionic/libcrt_compat.c
@@ -32,7 +32,7 @@
 extern char __udivdi3;
 extern char __umoddi3;
 
-void* __bionic_libgcc_compat_symbols[] = {
+void* __bionic_libcrt_compat_symbols[] = {
     &__divdi3,
     &__moddi3,
     &__popcountsi2,
diff --git a/libc/async_safe/Android.bp b/libc/async_safe/Android.bp
index a54d3b0..6ae1c42 100644
--- a/libc/async_safe/Android.bp
+++ b/libc/async_safe/Android.bp
@@ -12,7 +12,19 @@
     recovery_available: true,
 
     include_dirs: ["bionic/libc"],
-    header_libs: ["libc_headers"],
+    header_libs: ["libc_headers", "liblog_headers"],
 
     export_include_dirs: ["include"],
+    export_header_lib_headers: ["liblog_headers"],
+    stl: "none",
+}
+
+cc_library_headers {
+    name: "libasync_safe_headers",
+    recovery_available: true,
+
+    export_include_dirs: ["include"],
+
+    system_shared_libs: [],
+    stl: "none",
 }
diff --git a/libc/arch-mips/bionic/libgcc_compat.c b/libc/async_safe/include/async_safe/CHECK.h
similarity index 74%
copy from libc/arch-mips/bionic/libgcc_compat.c
copy to libc/async_safe/include/async_safe/CHECK.h
index 1a0f566..bec89a3 100644
--- a/libc/arch-mips/bionic/libgcc_compat.c
+++ b/libc/async_safe/include/async_safe/CHECK.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2016 The Android Open Source Project
+ * Copyright (C) 2019 The Android Open Source Project
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -26,16 +26,22 @@
  * SUCH DAMAGE.
  */
 
-extern char __divdi3;
-extern char __moddi3;
-extern char __popcountsi2;
-extern char __udivdi3;
-extern char __umoddi3;
+#pragma once
 
-void* __bionic_libgcc_compat_symbols[] = {
-    &__divdi3,
-    &__moddi3,
-    &__popcountsi2,
-    &__udivdi3,
-    &__umoddi3,
-};
+#include <sys/cdefs.h>
+
+#include <async_safe/log.h>
+
+__BEGIN_DECLS
+
+// TODO: replace this with something more like <android-base/logging.h>'s family of macros.
+
+#define CHECK(predicate) \
+  do { \
+    if (!(predicate)) { \
+      async_safe_fatal("%s:%d: %s CHECK '" #predicate "' failed", \
+          __FILE__, __LINE__, __FUNCTION__); \
+    } \
+  } while(0)
+
+__END_DECLS
diff --git a/libc/async_safe/include/async_safe/log.h b/libc/async_safe/include/async_safe/log.h
index df68062..0e02ea7 100644
--- a/libc/async_safe/include/async_safe/log.h
+++ b/libc/async_safe/include/async_safe/log.h
@@ -34,36 +34,14 @@
 #include <stdint.h>
 #include <stdlib.h>
 
+// This file is an alternative to <android/log.h>, but reuses
+// `android_LogPriority` and should not have conflicting identifiers.
+#include <android/log.h>
+
 // These functions do not allocate memory to send data to the log.
 
 __BEGIN_DECLS
 
-enum {
-  ANDROID_LOG_UNKNOWN = 0,
-  ANDROID_LOG_DEFAULT,    /* only for SetMinPriority() */
-
-  ANDROID_LOG_VERBOSE,
-  ANDROID_LOG_DEBUG,
-  ANDROID_LOG_INFO,
-  ANDROID_LOG_WARN,
-  ANDROID_LOG_ERROR,
-  ANDROID_LOG_FATAL,
-
-  ANDROID_LOG_SILENT,     /* only for SetMinPriority(); must be last */
-};
-
-enum {
-  LOG_ID_MIN = 0,
-
-  LOG_ID_MAIN = 0,
-  LOG_ID_RADIO = 1,
-  LOG_ID_EVENTS = 2,
-  LOG_ID_SYSTEM = 3,
-  LOG_ID_CRASH = 4,
-
-  LOG_ID_MAX
-};
-
 // Formats a message to the log (priority 'fatal'), then aborts.
 // Implemented as a macro so that async_safe_fatal isn't on the stack when we crash:
 // we appear to go straight from the caller to abort, saving an uninteresting stack
@@ -91,16 +69,8 @@
 
 int async_safe_format_fd(int fd, const char* format , ...) __printflike(2, 3);
 int async_safe_format_fd_va_list(int fd, const char* format, va_list args);
-int async_safe_format_log(int pri, const char* tag, const char* fmt, ...) __printflike(3, 4);
-int async_safe_format_log_va_list(int pri, const char* tag, const char* fmt, va_list ap);
-int async_safe_write_log(int pri, const char* tag, const char* msg);
-
-#define CHECK(predicate) \
-  do { \
-    if (!(predicate)) { \
-      async_safe_fatal("%s:%d: %s CHECK '" #predicate "' failed", \
-          __FILE__, __LINE__, __FUNCTION__); \
-    } \
-  } while(0)
+int async_safe_format_log(int priority, const char* tag, const char* fmt, ...) __printflike(3, 4);
+int async_safe_format_log_va_list(int priority, const char* tag, const char* fmt, va_list ap);
+int async_safe_write_log(int priority, const char* tag, const char* msg);
 
 __END_DECLS
diff --git a/libc/bionic/bionic_allocator.cpp b/libc/bionic/bionic_allocator.cpp
index d9302ad..da0f7d0 100644
--- a/libc/bionic/bionic_allocator.cpp
+++ b/libc/bionic/bionic_allocator.cpp
@@ -38,6 +38,7 @@
 #include <new>
 
 #include <async_safe/log.h>
+#include <async_safe/CHECK.h>
 
 #include "private/bionic_macros.h"
 #include "private/bionic_page.h"
diff --git a/libc/bionic/icu.cpp b/libc/bionic/icu.cpp
index 41a0729..72dac9b 100644
--- a/libc/bionic/icu.cpp
+++ b/libc/bionic/icu.cpp
@@ -36,53 +36,12 @@
 
 #include <async_safe/log.h>
 
-// Allowed icu4c version numbers are in the range [44, 999].
-// Gingerbread's icu4c 4.4 is the minimum supported ICU version.
-static constexpr auto ICUDATA_VERSION_MIN_LENGTH = 2;
-static constexpr auto ICUDATA_VERSION_MAX_LENGTH = 3;
-static constexpr auto ICUDATA_VERSION_MIN = 44;
-
-static char g_icudata_version[ICUDATA_VERSION_MAX_LENGTH + 1];
-
 static void* g_libicuuc_handle = nullptr;
 
-static int __icu_dat_file_filter(const dirent* dirp) {
-  const char* name = dirp->d_name;
-
-  // Is the name the right length to match 'icudt(\d\d\d)l.dat'?
-  const size_t len = strlen(name);
-  if (len < 10 + ICUDATA_VERSION_MIN_LENGTH || len > 10 + ICUDATA_VERSION_MAX_LENGTH) return 0;
-
-  return !strncmp(name, "icudt", 5) && !strncmp(&name[len - 5], "l.dat", 5);
-}
-
 static bool __find_icu() {
-  dirent** namelist = nullptr;
-  int n = scandir("/apex/com.android.runtime/etc/icu", &namelist, &__icu_dat_file_filter,
-                  alphasort);
-  if (n < 0) {
-    async_safe_write_log(ANDROID_LOG_ERROR, "bionic-icu", "couldn't find ICU folder");
-    return false;
-  }
-  int max_version = -1;
-  while (n--) {
-    // We prefer the latest version available.
-    int version = atoi(&namelist[n]->d_name[strlen("icudt")]);
-    if (version != 0 && version > max_version) max_version = version;
-    free(namelist[n]);
-  }
-  free(namelist);
-
-  if (max_version < ICUDATA_VERSION_MIN) {
-    async_safe_write_log(ANDROID_LOG_ERROR, "bionic-icu", "couldn't find an ICU .dat file");
-    return false;
-  }
-
-  snprintf(g_icudata_version, sizeof(g_icudata_version), "_%d", max_version);
-
-  g_libicuuc_handle = dlopen("libicuuc.so", RTLD_LOCAL);
+  g_libicuuc_handle = dlopen("libandroidicu.so", RTLD_LOCAL);
   if (g_libicuuc_handle == nullptr) {
-    async_safe_format_log(ANDROID_LOG_ERROR, "bionic-icu", "couldn't open libicuuc.so: %s",
+    async_safe_format_log(ANDROID_LOG_ERROR, "bionic-icu", "couldn't open libandroidicu.so: %s",
                           dlerror());
     return false;
   }
@@ -94,9 +53,9 @@
   static bool found_icu = __find_icu();
   if (!found_icu) return nullptr;
 
-  char versioned_symbol_name[strlen(symbol_name) + sizeof(g_icudata_version)];
-  snprintf(versioned_symbol_name, sizeof(versioned_symbol_name), "%s%s",
-           symbol_name, g_icudata_version);
+  char versioned_symbol_name[strlen(symbol_name) + strlen("_android") + 1];
+  snprintf(versioned_symbol_name, sizeof(versioned_symbol_name), "%s_android",
+           symbol_name);
 
   void* symbol = dlsym(g_libicuuc_handle, versioned_symbol_name);
   if (symbol == nullptr) {
diff --git a/libc/bionic/libc_init_dynamic.cpp b/libc/bionic/libc_init_dynamic.cpp
index 7140776..4f3b4f7 100644
--- a/libc/bionic/libc_init_dynamic.cpp
+++ b/libc/bionic/libc_init_dynamic.cpp
@@ -66,9 +66,6 @@
 // Use an initializer so __libc_sysinfo will have a fallback implementation
 // while .preinit_array constructors run.
 #if defined(__i386__)
-static __attribute__((__naked__)) void __libc_int0x80() {
-  __asm__ volatile("int $0x80; ret");
-}
 __LIBC_HIDDEN__ void* __libc_sysinfo = reinterpret_cast<void*>(__libc_int0x80);
 #endif
 
diff --git a/libc/bionic/malloc_common.cpp b/libc/bionic/malloc_common.cpp
index 50c2fec..80e82f7 100644
--- a/libc/bionic/malloc_common.cpp
+++ b/libc/bionic/malloc_common.cpp
@@ -41,71 +41,17 @@
 //                          get_malloc_leak_info.
 //   write_malloc_leak_info: Writes the leak info data to a file.
 
-#include <pthread.h>
-#include <stdatomic.h>
+#include <stdint.h>
 
-#include <private/bionic_defs.h>
 #include <private/bionic_config.h>
-#include <private/bionic_globals.h>
-#include <private/bionic_malloc.h>
-#include <private/bionic_malloc_dispatch.h>
 
-#if __has_feature(hwaddress_sanitizer)
-// FIXME: implement these in HWASan allocator.
-extern "C" int __sanitizer_iterate(uintptr_t base __unused, size_t size __unused,
-                                   void (*callback)(uintptr_t base, size_t size, void* arg) __unused,
-                                   void* arg __unused) {
-  return 0;
-}
+#include "malloc_common.h"
 
-extern "C" void __sanitizer_malloc_disable() {
-}
+// =============================================================================
+// Global variables instantations.
+// =============================================================================
 
-extern "C" void __sanitizer_malloc_enable() {
-}
-#include <sanitizer/hwasan_interface.h>
-#define Malloc(function)  __sanitizer_ ## function
-
-#else // __has_feature(hwaddress_sanitizer)
-#include "jemalloc.h"
-#define Malloc(function)  je_ ## function
-#endif
-
-template <typename T>
-static T* RemoveConst(const T* x) {
-  return const_cast<T*>(x);
-}
-
-// RemoveConst is a workaround for bug in current libcxx. Fix in
-// https://reviews.llvm.org/D47613
-#define atomic_load_explicit_const(obj, order) atomic_load_explicit(RemoveConst(obj), order)
-
-static constexpr memory_order default_read_memory_order = memory_order_acquire;
-
-static constexpr MallocDispatch __libc_malloc_default_dispatch
-  __attribute__((unused)) = {
-    Malloc(calloc),
-    Malloc(free),
-    Malloc(mallinfo),
-    Malloc(malloc),
-    Malloc(malloc_usable_size),
-    Malloc(memalign),
-    Malloc(posix_memalign),
-#if defined(HAVE_DEPRECATED_MALLOC_FUNCS)
-    Malloc(pvalloc),
-#endif
-    Malloc(realloc),
-#if defined(HAVE_DEPRECATED_MALLOC_FUNCS)
-    Malloc(valloc),
-#endif
-    Malloc(iterate),
-    Malloc(malloc_disable),
-    Malloc(malloc_enable),
-    Malloc(mallopt),
-    Malloc(aligned_alloc),
-  };
-
-// Malloc hooks.
+// Malloc hooks globals.
 void* (*volatile __malloc_hook)(size_t, const void*);
 void* (*volatile __realloc_hook)(void*, size_t, const void*);
 void (*volatile __free_hook)(void*, const void*);
@@ -113,107 +59,88 @@
 
 // In a VM process, this is set to 1 after fork()ing out of zygote.
 int gMallocLeakZygoteChild = 0;
+// =============================================================================
 
 // =============================================================================
 // Allocation functions
 // =============================================================================
 extern "C" void* calloc(size_t n_elements, size_t elem_size) {
-  auto _calloc = atomic_load_explicit_const(
-      &__libc_globals->malloc_dispatch.calloc,
-      default_read_memory_order);
-  if (__predict_false(_calloc != nullptr)) {
-    return _calloc(n_elements, elem_size);
+  auto dispatch_table = GetDispatchTable();
+  if (__predict_false(dispatch_table != nullptr)) {
+    return dispatch_table->calloc(n_elements, elem_size);
   }
   return Malloc(calloc)(n_elements, elem_size);
 }
 
 extern "C" void free(void* mem) {
-  auto _free = atomic_load_explicit_const(
-      &__libc_globals->malloc_dispatch.free,
-      default_read_memory_order);
-  if (__predict_false(_free != nullptr)) {
-    _free(mem);
+  auto dispatch_table = GetDispatchTable();
+  if (__predict_false(dispatch_table != nullptr)) {
+    dispatch_table->free(mem);
   } else {
     Malloc(free)(mem);
   }
 }
 
 extern "C" struct mallinfo mallinfo() {
-  auto _mallinfo = atomic_load_explicit_const(
-      &__libc_globals->malloc_dispatch.mallinfo,
-      default_read_memory_order);
-  if (__predict_false(_mallinfo != nullptr)) {
-    return _mallinfo();
+  auto dispatch_table = GetDispatchTable();
+  if (__predict_false(dispatch_table != nullptr)) {
+    return dispatch_table->mallinfo();
   }
   return Malloc(mallinfo)();
 }
 
 extern "C" int mallopt(int param, int value) {
-  auto _mallopt = atomic_load_explicit_const(
-      &__libc_globals->malloc_dispatch.mallopt,
-      default_read_memory_order);
-  if (__predict_false(_mallopt != nullptr)) {
-    return _mallopt(param, value);
+  auto dispatch_table = GetDispatchTable();
+  if (__predict_false(dispatch_table != nullptr)) {
+    return dispatch_table->mallopt(param, value);
   }
   return Malloc(mallopt)(param, value);
 }
 
 extern "C" void* malloc(size_t bytes) {
-  auto _malloc = atomic_load_explicit_const(
-      &__libc_globals->malloc_dispatch.malloc,
-      default_read_memory_order);
-  if (__predict_false(_malloc != nullptr)) {
-    return _malloc(bytes);
+  auto dispatch_table = GetDispatchTable();
+  if (__predict_false(dispatch_table != nullptr)) {
+    return dispatch_table->malloc(bytes);
   }
   return Malloc(malloc)(bytes);
 }
 
 extern "C" size_t malloc_usable_size(const void* mem) {
-  auto _malloc_usable_size = atomic_load_explicit_const(
-      &__libc_globals->malloc_dispatch.malloc_usable_size,
-      default_read_memory_order);
-  if (__predict_false(_malloc_usable_size != nullptr)) {
-    return _malloc_usable_size(mem);
+  auto dispatch_table = GetDispatchTable();
+  if (__predict_false(dispatch_table != nullptr)) {
+    return dispatch_table->malloc_usable_size(mem);
   }
   return Malloc(malloc_usable_size)(mem);
 }
 
 extern "C" void* memalign(size_t alignment, size_t bytes) {
-  auto _memalign = atomic_load_explicit_const(
-      &__libc_globals->malloc_dispatch.memalign,
-      default_read_memory_order);
-  if (__predict_false(_memalign != nullptr)) {
-    return _memalign(alignment, bytes);
+  auto dispatch_table = GetDispatchTable();
+  if (__predict_false(dispatch_table != nullptr)) {
+    return dispatch_table->memalign(alignment, bytes);
   }
   return Malloc(memalign)(alignment, bytes);
 }
 
 extern "C" int posix_memalign(void** memptr, size_t alignment, size_t size) {
-  auto _posix_memalign = atomic_load_explicit_const(
-      &__libc_globals->malloc_dispatch.posix_memalign,
-      default_read_memory_order);
-  if (__predict_false(_posix_memalign != nullptr)) {
-    return _posix_memalign(memptr, alignment, size);
+  auto dispatch_table = GetDispatchTable();
+  if (__predict_false(dispatch_table != nullptr)) {
+    return dispatch_table->posix_memalign(memptr, alignment, size);
   }
   return Malloc(posix_memalign)(memptr, alignment, size);
 }
 
 extern "C" void* aligned_alloc(size_t alignment, size_t size) {
-  auto _aligned_alloc = atomic_load_explicit_const(
-      &__libc_globals->malloc_dispatch.aligned_alloc,
-      default_read_memory_order);
-  if (__predict_false(_aligned_alloc != nullptr)) {
-    return _aligned_alloc(alignment, size);
+  auto dispatch_table = GetDispatchTable();
+  if (__predict_false(dispatch_table != nullptr)) {
+    return dispatch_table->aligned_alloc(alignment, size);
   }
   return Malloc(aligned_alloc)(alignment, size);
 }
 
 extern "C" void* realloc(void* old_mem, size_t bytes) {
-  auto _realloc = atomic_load_explicit_const(
-      &__libc_globals->malloc_dispatch.realloc,
-      default_read_memory_order);
-  if (__predict_false(_realloc != nullptr)) {
-    return _realloc(old_mem, bytes);
+  auto dispatch_table = GetDispatchTable();
+  if (__predict_false(dispatch_table != nullptr)) {
+    return dispatch_table->realloc(old_mem, bytes);
   }
   return Malloc(realloc)(old_mem, bytes);
 }
@@ -229,607 +156,22 @@
 
 #if defined(HAVE_DEPRECATED_MALLOC_FUNCS)
 extern "C" void* pvalloc(size_t bytes) {
-  auto _pvalloc = atomic_load_explicit_const(
-      &__libc_globals->malloc_dispatch.pvalloc,
-      default_read_memory_order);
-  if (__predict_false(_pvalloc != nullptr)) {
-    return _pvalloc(bytes);
+  auto dispatch_table = GetDispatchTable();
+  if (__predict_false(dispatch_table != nullptr)) {
+    return dispatch_table->pvalloc(bytes);
   }
   return Malloc(pvalloc)(bytes);
 }
 
 extern "C" void* valloc(size_t bytes) {
-  auto _valloc = atomic_load_explicit_const(
-      &__libc_globals->malloc_dispatch.valloc,
-      default_read_memory_order);
-  if (__predict_false(_valloc != nullptr)) {
-    return _valloc(bytes);
+  auto dispatch_table = GetDispatchTable();
+  if (__predict_false(dispatch_table != nullptr)) {
+    return dispatch_table->valloc(bytes);
   }
   return Malloc(valloc)(bytes);
 }
 #endif
-
-// We implement malloc debugging only in libc.so, so the code below
-// must be excluded if we compile this file for static libc.a
-#if !defined(LIBC_STATIC)
-
-#include <dlfcn.h>
-#include <fcntl.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <unistd.h>
-
-#include <async_safe/log.h>
-#include <sys/system_properties.h>
-
-extern "C" int __cxa_atexit(void (*func)(void *), void *arg, void *dso);
-
-static const char* HOOKS_SHARED_LIB = "libc_malloc_hooks.so";
-static const char* HOOKS_PROPERTY_ENABLE = "libc.debug.hooks.enable";
-static const char* HOOKS_ENV_ENABLE = "LIBC_HOOKS_ENABLE";
-
-static const char* DEBUG_SHARED_LIB = "libc_malloc_debug.so";
-static const char* DEBUG_PROPERTY_OPTIONS = "libc.debug.malloc.options";
-static const char* DEBUG_PROPERTY_PROGRAM = "libc.debug.malloc.program";
-static const char* DEBUG_ENV_OPTIONS = "LIBC_DEBUG_MALLOC_OPTIONS";
-
-static const char* HEAPPROFD_SHARED_LIB = "heapprofd_client.so";
-static const char* HEAPPROFD_PREFIX = "heapprofd";
-static const char* HEAPPROFD_PROPERTY_ENABLE = "heapprofd.enable";
-static const int HEAPPROFD_SIGNAL = __SIGRTMIN + 4;
-
-enum FunctionEnum : uint8_t {
-  FUNC_INITIALIZE,
-  FUNC_FINALIZE,
-  FUNC_GET_MALLOC_LEAK_INFO,
-  FUNC_FREE_MALLOC_LEAK_INFO,
-  FUNC_MALLOC_BACKTRACE,
-  FUNC_WRITE_LEAK_INFO,
-  FUNC_LAST,
-};
-static void* g_functions[FUNC_LAST];
-
-typedef void (*finalize_func_t)();
-typedef bool (*init_func_t)(const MallocDispatch*, int*, const char*);
-typedef void (*get_malloc_leak_info_func_t)(uint8_t**, size_t*, size_t*, size_t*, size_t*);
-typedef void (*free_malloc_leak_info_func_t)(uint8_t*);
-typedef bool (*write_malloc_leak_info_func_t)(FILE*);
-typedef ssize_t (*malloc_backtrace_func_t)(void*, uintptr_t*, size_t);
-
 // =============================================================================
-// Log functions
-// =============================================================================
-#define error_log(format, ...)  \
-    async_safe_format_log(ANDROID_LOG_ERROR, "libc", (format), ##__VA_ARGS__ )
-#define info_log(format, ...)  \
-    async_safe_format_log(ANDROID_LOG_INFO, "libc", (format), ##__VA_ARGS__ )
-// =============================================================================
-
-// In a Zygote child process, this is set to true if profiling of this process
-// is allowed. Note that this set at a later time than the above
-// gMallocLeakZygoteChild. The latter is set during the fork (while still in
-// zygote's SELinux domain). While this bit is set after the child is
-// specialized (and has transferred SELinux domains if applicable).
-static _Atomic bool gMallocZygoteChildProfileable = false;
-
-// =============================================================================
-// Exported for use by ddms.
-// =============================================================================
-
-// Retrieve native heap information.
-//
-// "*info" is set to a buffer we allocate
-// "*overall_size" is set to the size of the "info" buffer
-// "*info_size" is set to the size of a single entry
-// "*total_memory" is set to the sum of all allocations we're tracking; does
-//   not include heap overhead
-// "*backtrace_size" is set to the maximum number of entries in the back trace
-extern "C" void get_malloc_leak_info(uint8_t** info, size_t* overall_size,
-    size_t* info_size, size_t* total_memory, size_t* backtrace_size) {
-  void* func = g_functions[FUNC_GET_MALLOC_LEAK_INFO];
-  if (func == nullptr) {
-    return;
-  }
-  reinterpret_cast<get_malloc_leak_info_func_t>(func)(info, overall_size, info_size, total_memory,
-                                                      backtrace_size);
-}
-
-extern "C" void free_malloc_leak_info(uint8_t* info) {
-  void* func = g_functions[FUNC_FREE_MALLOC_LEAK_INFO];
-  if (func == nullptr) {
-    return;
-  }
-  reinterpret_cast<free_malloc_leak_info_func_t>(func)(info);
-}
-
-extern "C" void write_malloc_leak_info(FILE* fp) {
-  if (fp == nullptr) {
-    error_log("write_malloc_leak_info called with a nullptr");
-    return;
-  }
-
-  void* func = g_functions[FUNC_WRITE_LEAK_INFO];
-  bool written = false;
-  if (func != nullptr) {
-    written = reinterpret_cast<write_malloc_leak_info_func_t>(func)(fp);
-  }
-
-  if (!written) {
-    fprintf(fp, "Native heap dump not available. To enable, run these commands (requires root):\n");
-    fprintf(fp, "# adb shell stop\n");
-    fprintf(fp, "# adb shell setprop libc.debug.malloc.options backtrace\n");
-    fprintf(fp, "# adb shell start\n");
-  }
-}
-
-// =============================================================================
-
-template<typename FunctionType>
-static bool InitMallocFunction(void* malloc_impl_handler, _Atomic(FunctionType)* func, const char* prefix, const char* suffix) {
-  char symbol[128];
-  snprintf(symbol, sizeof(symbol), "%s_%s", prefix, suffix);
-  *func = reinterpret_cast<FunctionType>(dlsym(malloc_impl_handler, symbol));
-  if (*func == nullptr) {
-    error_log("%s: dlsym(\"%s\") failed", getprogname(), symbol);
-    return false;
-  }
-  return true;
-}
-
-static bool InitMallocFunctions(void* impl_handler, MallocDispatch* table, const char* prefix) {
-  if (!InitMallocFunction<MallocFree>(impl_handler, &table->free, prefix, "free")) {
-    return false;
-  }
-  if (!InitMallocFunction<MallocCalloc>(impl_handler, &table->calloc, prefix, "calloc")) {
-    return false;
-  }
-  if (!InitMallocFunction<MallocMallinfo>(impl_handler, &table->mallinfo, prefix, "mallinfo")) {
-    return false;
-  }
-  if (!InitMallocFunction<MallocMallopt>(impl_handler, &table->mallopt, prefix, "mallopt")) {
-    return false;
-  }
-  if (!InitMallocFunction<MallocMalloc>(impl_handler, &table->malloc, prefix, "malloc")) {
-    return false;
-  }
-  if (!InitMallocFunction<MallocMallocUsableSize>(impl_handler, &table->malloc_usable_size, prefix,
-                                                  "malloc_usable_size")) {
-    return false;
-  }
-  if (!InitMallocFunction<MallocMemalign>(impl_handler, &table->memalign, prefix, "memalign")) {
-    return false;
-  }
-  if (!InitMallocFunction<MallocPosixMemalign>(impl_handler, &table->posix_memalign, prefix,
-                                               "posix_memalign")) {
-    return false;
-  }
-  if (!InitMallocFunction<MallocAlignedAlloc>(impl_handler, &table->aligned_alloc,
-                                              prefix, "aligned_alloc")) {
-    return false;
-  }
-  if (!InitMallocFunction<MallocRealloc>(impl_handler, &table->realloc, prefix, "realloc")) {
-    return false;
-  }
-  if (!InitMallocFunction<MallocIterate>(impl_handler, &table->iterate, prefix, "iterate")) {
-    return false;
-  }
-  if (!InitMallocFunction<MallocMallocDisable>(impl_handler, &table->malloc_disable, prefix,
-                                               "malloc_disable")) {
-    return false;
-  }
-  if (!InitMallocFunction<MallocMallocEnable>(impl_handler, &table->malloc_enable, prefix,
-                                              "malloc_enable")) {
-    return false;
-  }
-#if defined(HAVE_DEPRECATED_MALLOC_FUNCS)
-  if (!InitMallocFunction<MallocPvalloc>(impl_handler, &table->pvalloc, prefix, "pvalloc")) {
-    return false;
-  }
-  if (!InitMallocFunction<MallocValloc>(impl_handler, &table->valloc, prefix, "valloc")) {
-    return false;
-  }
-#endif
-
-  return true;
-}
-
-static void malloc_fini_impl(void*) {
-  // Our BSD stdio implementation doesn't close the standard streams,
-  // it only flushes them. Other unclosed FILE*s will show up as
-  // malloc leaks, but to avoid the standard streams showing up in
-  // leak reports, close them here.
-  fclose(stdin);
-  fclose(stdout);
-  fclose(stderr);
-
-  reinterpret_cast<finalize_func_t>(g_functions[FUNC_FINALIZE])();
-}
-
-static bool CheckLoadMallocHooks(char** options) {
-  char* env = getenv(HOOKS_ENV_ENABLE);
-  if ((env == nullptr || env[0] == '\0' || env[0] == '0') &&
-    (__system_property_get(HOOKS_PROPERTY_ENABLE, *options) == 0 || *options[0] == '\0' || *options[0] == '0')) {
-    return false;
-  }
-  *options = nullptr;
-  return true;
-}
-
-static bool CheckLoadMallocDebug(char** options) {
-  // If DEBUG_MALLOC_ENV_OPTIONS is set then it overrides the system properties.
-  char* env = getenv(DEBUG_ENV_OPTIONS);
-  if (env == nullptr || env[0] == '\0') {
-    if (__system_property_get(DEBUG_PROPERTY_OPTIONS, *options) == 0 || *options[0] == '\0') {
-      return false;
-    }
-
-    // Check to see if only a specific program should have debug malloc enabled.
-    char program[PROP_VALUE_MAX];
-    if (__system_property_get(DEBUG_PROPERTY_PROGRAM, program) != 0 &&
-        strstr(getprogname(), program) == nullptr) {
-      return false;
-    }
-  } else {
-    *options = env;
-  }
-  return true;
-}
-
-static bool GetHeapprofdProgramProperty(char* data, size_t size) {
-  constexpr char prefix[] = "heapprofd.enable.";
-  // - 1 to skip nullbyte, which we will write later.
-  constexpr size_t prefix_size = sizeof(prefix) - 1;
-  if (size < prefix_size) {
-    error_log("%s: Overflow constructing heapprofd property", getprogname());
-    return false;
-  }
-  memcpy(data, prefix, prefix_size);
-
-  int fd = open("/proc/self/cmdline", O_RDONLY | O_CLOEXEC);
-  if (fd == -1) {
-    error_log("%s: Failed to open /proc/self/cmdline", getprogname());
-    return false;
-  }
-  char cmdline[128];
-  ssize_t rd = read(fd, cmdline, sizeof(cmdline) - 1);
-  close(fd);
-  if (rd == -1) {
-    error_log("%s: Failed to read /proc/self/cmdline", getprogname());
-    return false;
-  }
-  cmdline[rd] = '\0';
-  char* first_arg = static_cast<char*>(memchr(cmdline, '\0', rd));
-  if (first_arg == nullptr || first_arg == cmdline + size - 1) {
-    error_log("%s: Overflow reading cmdline", getprogname());
-    return false;
-  }
-  // For consistency with what we do with Java app cmdlines, trim everything
-  // after the @ sign of the first arg.
-  char* first_at = static_cast<char*>(memchr(cmdline, '@', rd));
-  if (first_at != nullptr && first_at < first_arg) {
-    *first_at = '\0';
-    first_arg = first_at;
-  }
-
-  char* start = static_cast<char*>(memrchr(cmdline, '/', first_arg - cmdline));
-  if (start == first_arg) {
-    // The first argument ended in a slash.
-    error_log("%s: cmdline ends in /", getprogname());
-    return false;
-  } else if (start == nullptr) {
-    start = cmdline;
-  } else {
-    // Skip the /.
-    start++;
-  }
-
-  size_t name_size = static_cast<size_t>(first_arg - start);
-  if (name_size >= size - prefix_size) {
-    error_log("%s: overflow constructing heapprofd property.", getprogname());
-    return false;
-  }
-  // + 1 to also copy the trailing null byte.
-  memcpy(data + prefix_size, start, name_size + 1);
-  return true;
-}
-
-static bool CheckLoadHeapprofd() {
-  // First check for heapprofd.enable. If it is set to "all", enable
-  // heapprofd for all processes. Otherwise, check heapprofd.enable.${prog},
-  // if it is set and not 0, enable heap profiling for this process.
-  char property_value[PROP_VALUE_MAX];
-  if (__system_property_get(HEAPPROFD_PROPERTY_ENABLE, property_value) == 0) {
-    return false;
-  }
-  if (strcmp(property_value, "all") == 0) {
-    return true;
-  }
-
-  char program_property[128];
-  if (!GetHeapprofdProgramProperty(program_property,
-                                   sizeof(program_property))) {
-    return false;
-  }
-  if (__system_property_get(program_property, property_value) == 0) {
-    return false;
-  }
-  return program_property[0] != '\0';
-}
-
-static void ClearGlobalFunctions() {
-  for (size_t i = 0; i < FUNC_LAST; i++) {
-    g_functions[i] = nullptr;
-  }
-}
-
-static bool InitSharedLibrary(void* impl_handle, const char* shared_lib, const char* prefix, MallocDispatch* dispatch_table) {
-  static constexpr const char* names[] = {
-    "initialize",
-    "finalize",
-    "get_malloc_leak_info",
-    "free_malloc_leak_info",
-    "malloc_backtrace",
-    "write_malloc_leak_info",
-  };
-  for (size_t i = 0; i < FUNC_LAST; i++) {
-    char symbol[128];
-    snprintf(symbol, sizeof(symbol), "%s_%s", prefix, names[i]);
-    g_functions[i] = dlsym(impl_handle, symbol);
-    if (g_functions[i] == nullptr) {
-      error_log("%s: %s routine not found in %s", getprogname(), symbol, shared_lib);
-      ClearGlobalFunctions();
-      return false;
-    }
-  }
-
-  if (!InitMallocFunctions(impl_handle, dispatch_table, prefix)) {
-    ClearGlobalFunctions();
-    return false;
-  }
-  return true;
-}
-
-static void* LoadSharedLibrary(const char* shared_lib, const char* prefix, MallocDispatch* dispatch_table) {
-  void* impl_handle = dlopen(shared_lib, RTLD_NOW | RTLD_LOCAL);
-  if (impl_handle == nullptr) {
-    error_log("%s: Unable to open shared library %s: %s", getprogname(), shared_lib, dlerror());
-    return nullptr;
-  }
-
-  if (!InitSharedLibrary(impl_handle, shared_lib, prefix, dispatch_table)) {
-    dlclose(impl_handle);
-    impl_handle = nullptr;
-  }
-
-  return impl_handle;
-}
-
-// The handle returned by dlopen when previously loading the heapprofd
-// hooks. nullptr if they had not been loaded before.
-static _Atomic (void*) g_heapprofd_handle = nullptr;
-
-static void install_hooks(libc_globals* globals, const char* options,
-                          const char* prefix, const char* shared_lib) {
-  MallocDispatch dispatch_table;
-
-  void* impl_handle = atomic_load(&g_heapprofd_handle);
-  bool reusing_handle = impl_handle != nullptr;
-  if (reusing_handle) {
-    if (!InitSharedLibrary(impl_handle, shared_lib, prefix, &dispatch_table)) {
-      return;
-    }
-  } else {
-    impl_handle = LoadSharedLibrary(shared_lib, prefix, &dispatch_table);
-    if (impl_handle == nullptr) {
-      return;
-    }
-  }
-  init_func_t init_func = reinterpret_cast<init_func_t>(g_functions[FUNC_INITIALIZE]);
-  if (!init_func(&__libc_malloc_default_dispatch, &gMallocLeakZygoteChild, options)) {
-    error_log("%s: failed to enable malloc %s", getprogname(), prefix);
-    if (!reusing_handle) {
-      // We should not close if we are re-using an old handle, as we cannot be
-      // sure other threads are not currently in the hooks.
-      dlclose(impl_handle);
-    }
-    ClearGlobalFunctions();
-    return;
-  }
-
-  // We assign free  first explicitly to prevent the case where we observe a
-  // alloc, but miss the corresponding free because of initialization order.
-  //
-  // This is safer than relying on the declaration order inside
-  // MallocDispatch at the cost of an extra atomic pointer write on
-  // initialization.
-  atomic_store(&globals->malloc_dispatch.free, dispatch_table.free);
-  // The struct gets assigned elementwise and each of the elements is an
-  // _Atomic. Assigning to an _Atomic is an atomic_store operation.
-  // The assignment is done in declaration order.
-  globals->malloc_dispatch = dispatch_table;
-  atomic_store(&g_heapprofd_handle, impl_handle);
-
-  info_log("%s: malloc %s enabled", getprogname(), prefix);
-
-  // Use atexit to trigger the cleanup function. This avoids a problem
-  // where another atexit function is used to cleanup allocated memory,
-  // but the finalize function was already called. This particular error
-  // seems to be triggered by a zygote spawned process calling exit.
-  int ret_value = __cxa_atexit(malloc_fini_impl, nullptr, nullptr);
-  if (ret_value != 0) {
-    error_log("failed to set atexit cleanup function: %d", ret_value);
-  }
-}
-
-// The logic for triggering heapprofd (at runtime) is as follows:
-// 1. HEAPPROFD_SIGNAL is received by the process, entering the
-//    MaybeInstallInitHeapprofdHook signal handler.
-// 2. If the initialization is not already in flight
-//    (g_heapprofd_init_in_progress is false), the malloc hook is set to
-//    point at InitHeapprofdHook, and g_heapprofd_init_in_progress is set to
-//    true.
-// 3. The next malloc call enters InitHeapprofdHook, which removes the malloc
-//    hook, and spawns a detached pthread to run the InitHeapprofd task.
-//    (g_heapprofd_init_hook_installed atomic is used to perform this once.)
-// 4. InitHeapprofd, on a dedicated pthread, loads the heapprofd client library,
-//    installs the full set of heapprofd hooks, and invokes the client's
-//    initializer. The dedicated pthread then terminates.
-// 5. g_heapprofd_init_in_progress and g_heapprofd_init_hook_installed are
-//    reset to false such that heapprofd can be reinitialized. Reinitialization
-//    means that a new profiling session is started, and any still active is
-//    torn down.
-//
-// The incremental hooking and a dedicated task thread are used since we cannot
-// do heavy work within a signal handler, or when blocking a malloc invocation.
-
-static _Atomic bool g_heapprofd_init_in_progress = false;
-static _Atomic bool g_heapprofd_init_hook_installed = false;
-
-extern "C" void MaybeInstallInitHeapprofdHook(int);
-
-// Initializes memory allocation framework once per process.
-static void malloc_init_impl(libc_globals* globals) {
-  struct sigaction action = {};
-  action.sa_handler = MaybeInstallInitHeapprofdHook;
-  sigaction(HEAPPROFD_SIGNAL, &action, nullptr);
-
-  const char* prefix;
-  const char* shared_lib;
-  char prop[PROP_VALUE_MAX];
-  char* options = prop;
-  // Prefer malloc debug since it existed first and is a more complete
-  // malloc interceptor than the hooks.
-  if (CheckLoadMallocDebug(&options)) {
-    prefix = "debug";
-    shared_lib = DEBUG_SHARED_LIB;
-  } else if (CheckLoadMallocHooks(&options)) {
-    prefix = "hooks";
-    shared_lib = HOOKS_SHARED_LIB;
-  } else if (CheckLoadHeapprofd()) {
-    prefix = "heapprofd";
-    shared_lib = HEAPPROFD_SHARED_LIB;
-  } else {
-    return;
-  }
-  if (!atomic_exchange(&g_heapprofd_init_in_progress, true)) {
-    install_hooks(globals, options, prefix, shared_lib);
-    atomic_store(&g_heapprofd_init_in_progress, false);
-  }
-}
-
-// Initializes memory allocation framework.
-// This routine is called from __libc_init routines in libc_init_dynamic.cpp.
-__BIONIC_WEAK_FOR_NATIVE_BRIDGE
-__LIBC_HIDDEN__ void __libc_init_malloc(libc_globals* globals) {
-  malloc_init_impl(globals);
-}
-
-static void* InitHeapprofd(void*) {
-  __libc_globals.mutate([](libc_globals* globals) {
-    install_hooks(globals, nullptr, HEAPPROFD_PREFIX, HEAPPROFD_SHARED_LIB);
-  });
-  atomic_store(&g_heapprofd_init_in_progress, false);
-  // Allow to install hook again to re-initialize heap profiling after the
-  // current session finished.
-  atomic_store(&g_heapprofd_init_hook_installed, false);
-  return nullptr;
-}
-
-static void* InitHeapprofdHook(size_t bytes) {
-  if (!atomic_exchange(&g_heapprofd_init_hook_installed, true)) {
-    __libc_globals.mutate([](libc_globals* globals) {
-      atomic_store(&globals->malloc_dispatch.malloc, nullptr);
-    });
-
-    pthread_t thread_id;
-    if (pthread_create(&thread_id, nullptr, InitHeapprofd, nullptr) == -1)
-      error_log("%s: heapprofd: failed to pthread_create.", getprogname());
-    else if (pthread_detach(thread_id) == -1)
-      error_log("%s: heapprofd: failed to pthread_detach", getprogname());
-    if (pthread_setname_np(thread_id, "heapprofdinit") == -1)
-      error_log("%s: heapprod: failed to pthread_setname_np", getprogname());
-  }
-  return Malloc(malloc)(bytes);
-}
-
-extern "C" void MaybeInstallInitHeapprofdHook(int) {
-  // Zygote child processes must be marked profileable.
-  if (gMallocLeakZygoteChild &&
-      !atomic_load_explicit_const(&gMallocZygoteChildProfileable, memory_order_acquire)) {
-    return;
-  }
-
-  if (!atomic_exchange(&g_heapprofd_init_in_progress, true)) {
-    __libc_globals.mutate([](libc_globals* globals) {
-      atomic_store(&globals->malloc_dispatch.malloc, InitHeapprofdHook);
-    });
-  }
-}
-
-#endif  // !LIBC_STATIC
-
-// =============================================================================
-// Platform-internal mallopt variant.
-// =============================================================================
-
-#if !defined(LIBC_STATIC)
-bool MallocDispatchReset() {
-  if (!atomic_exchange(&g_heapprofd_init_in_progress, true)) {
-    __libc_globals.mutate([](libc_globals* globals) {
-      globals->malloc_dispatch = __libc_malloc_default_dispatch;
-    });
-    atomic_store(&g_heapprofd_init_in_progress, false);
-    return true;
-  }
-  errno = EAGAIN;
-  return false;
-}
-
-// Marks this process as a profileable zygote child.
-bool HandleInitZygoteChildProfiling() {
-  atomic_store_explicit(&gMallocZygoteChildProfileable, true,
-                        memory_order_release);
-
-  // Conditionally start "from startup" profiling.
-  if (CheckLoadHeapprofd()) {
-    // Directly call the signal handler (will correctly guard against
-    // concurrent signal delivery).
-    MaybeInstallInitHeapprofdHook(HEAPPROFD_SIGNAL);
-  }
-  return true;
-}
-
-#else
-
-bool MallocDispatchReset() {
-  return true;
-}
-
-bool HandleInitZygoteChildProfiling() {
-  return true;
-}
-
-#endif  // !defined(LIBC_STATIC)
-
-bool android_mallopt(int opcode, void* arg, size_t arg_size) {
-  if (opcode == M_INIT_ZYGOTE_CHILD_PROFILING) {
-    if (arg != nullptr || arg_size != 0) {
-      errno = EINVAL;
-      return false;
-    }
-    return HandleInitZygoteChildProfiling();
-  }
-  if (opcode == M_RESET_HOOKS) {
-    if (arg != nullptr || arg_size != 0) {
-      errno = EINVAL;
-      return false;
-    }
-    return MallocDispatchReset();
-  }
-
-  errno = ENOTSUP;
-  return false;
-}
 
 // =============================================================================
 // Exported for use by libmemunreachable.
@@ -839,11 +181,9 @@
 // [base, base+size).  Must be called between malloc_disable and malloc_enable.
 extern "C" int malloc_iterate(uintptr_t base, size_t size,
     void (*callback)(uintptr_t base, size_t size, void* arg), void* arg) {
-  auto _iterate = atomic_load_explicit_const(
-      &__libc_globals->malloc_dispatch.iterate,
-      default_read_memory_order);
-  if (__predict_false(_iterate != nullptr)) {
-    return _iterate(base, size, callback, arg);
+  auto dispatch_table = GetDispatchTable();
+  if (__predict_false(dispatch_table != nullptr)) {
+    return dispatch_table->iterate(base, size, callback, arg);
   }
   return Malloc(iterate)(base, size, callback, arg);
 }
@@ -851,36 +191,52 @@
 // Disable calls to malloc so malloc_iterate gets a consistent view of
 // allocated memory.
 extern "C" void malloc_disable() {
-  auto _malloc_disable = atomic_load_explicit_const(
-     & __libc_globals->malloc_dispatch.malloc_disable,
-      default_read_memory_order);
-  if (__predict_false(_malloc_disable != nullptr)) {
-    return _malloc_disable();
+  auto dispatch_table = GetDispatchTable();
+  if (__predict_false(dispatch_table != nullptr)) {
+    return dispatch_table->malloc_disable();
   }
   return Malloc(malloc_disable)();
 }
 
 // Re-enable calls to malloc after a previous call to malloc_disable.
 extern "C" void malloc_enable() {
-  auto _malloc_enable = atomic_load_explicit_const(
-      &__libc_globals->malloc_dispatch.malloc_enable,
-      default_read_memory_order);
-  if (__predict_false(_malloc_enable != nullptr)) {
-    return _malloc_enable();
+  auto dispatch_table = GetDispatchTable();
+  if (__predict_false(dispatch_table != nullptr)) {
+    return dispatch_table->malloc_enable();
   }
   return Malloc(malloc_enable)();
 }
 
-#ifndef LIBC_STATIC
-extern "C" ssize_t malloc_backtrace(void* pointer, uintptr_t* frames, size_t frame_count) {
-  void* func = g_functions[FUNC_MALLOC_BACKTRACE];
-  if (func == nullptr) {
-    return 0;
-  }
-  return reinterpret_cast<malloc_backtrace_func_t>(func)(pointer, frames, frame_count);
-}
-#else
+#if defined(LIBC_STATIC)
 extern "C" ssize_t malloc_backtrace(void*, uintptr_t*, size_t) {
   return 0;
 }
 #endif
+
+#if __has_feature(hwaddress_sanitizer)
+// FIXME: implement these in HWASan allocator.
+extern "C" int __sanitizer_iterate(uintptr_t base __unused, size_t size __unused,
+                                   void (*callback)(uintptr_t base, size_t size, void* arg) __unused,
+                                   void* arg __unused) {
+  return 0;
+}
+
+extern "C" void __sanitizer_malloc_disable() {
+}
+
+extern "C" void __sanitizer_malloc_enable() {
+}
+#endif
+// =============================================================================
+
+// =============================================================================
+// Platform-internal mallopt variant.
+// =============================================================================
+#if defined(LIBC_STATIC)
+extern "C" bool android_mallopt(int, void*, size_t) {
+  // There are no options supported on static executables.
+  errno = ENOTSUP;
+  return false;
+}
+#endif
+// =============================================================================
diff --git a/libc/bionic/malloc_common.h b/libc/bionic/malloc_common.h
new file mode 100644
index 0000000..a2f338a
--- /dev/null
+++ b/libc/bionic/malloc_common.h
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2019 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include <stdatomic.h>
+
+#include <async_safe/log.h>
+#include <private/bionic_globals.h>
+#include <private/bionic_malloc_dispatch.h>
+
+#if __has_feature(hwaddress_sanitizer)
+
+#include <sanitizer/hwasan_interface.h>
+
+__BEGIN_DECLS
+
+// FIXME: implement these in HWASan allocator.
+int __sanitizer_iterate(uintptr_t base, size_t size,
+                        void (*callback)(uintptr_t base, size_t size, void* arg),
+                        void* arg);
+void __sanitizer_malloc_disable();
+void __sanitizer_malloc_enable();
+
+__END_DECLS
+
+#define Malloc(function)  __sanitizer_ ## function
+
+#else // __has_feature(hwaddress_sanitizer)
+
+#include "jemalloc.h"
+#define Malloc(function)  je_ ## function
+
+#endif
+
+extern int gMallocLeakZygoteChild;
+
+static inline const MallocDispatch* GetDispatchTable() {
+  return atomic_load_explicit(&__libc_globals->current_dispatch_table, memory_order_acquire);
+}
+
+// =============================================================================
+// Log functions
+// =============================================================================
+#define error_log(format, ...)  \
+    async_safe_format_log(ANDROID_LOG_ERROR, "libc", (format), ##__VA_ARGS__ )
+#define info_log(format, ...)  \
+    async_safe_format_log(ANDROID_LOG_INFO, "libc", (format), ##__VA_ARGS__ )
+// =============================================================================
diff --git a/libc/bionic/malloc_common_dynamic.cpp b/libc/bionic/malloc_common_dynamic.cpp
new file mode 100644
index 0000000..ce3e761
--- /dev/null
+++ b/libc/bionic/malloc_common_dynamic.cpp
@@ -0,0 +1,431 @@
+/*
+ * Copyright (C) 2009 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#if defined(LIBC_STATIC)
+#error This file should not be compiled for static targets.
+#endif
+
+// Contains a thin layer that calls whatever real native allocator
+// has been defined. For the libc shared library, this allows the
+// implementation of a debug malloc that can intercept all of the allocation
+// calls and add special debugging code to attempt to catch allocation
+// errors. All of the debugging code is implemented in a separate shared
+// library that is only loaded when the property "libc.debug.malloc.options"
+// is set to a non-zero value. There are three functions exported to
+// allow ddms, or other external users to get information from the debug
+// allocation.
+//   get_malloc_leak_info: Returns information about all of the known native
+//                         allocations that are currently in use.
+//   free_malloc_leak_info: Frees the data allocated by the call to
+//                          get_malloc_leak_info.
+//   write_malloc_leak_info: Writes the leak info data to a file.
+
+#include <dlfcn.h>
+#include <fcntl.h>
+#include <pthread.h>
+#include <stdatomic.h>
+#include <stdbool.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+#include <private/bionic_config.h>
+#include <private/bionic_defs.h>
+#include <private/bionic_malloc_dispatch.h>
+
+#include <sys/system_properties.h>
+
+#include "malloc_common.h"
+#include "malloc_common_dynamic.h"
+#include "malloc_heapprofd.h"
+
+static constexpr MallocDispatch __libc_malloc_default_dispatch
+  __attribute__((unused)) = {
+    Malloc(calloc),
+    Malloc(free),
+    Malloc(mallinfo),
+    Malloc(malloc),
+    Malloc(malloc_usable_size),
+    Malloc(memalign),
+    Malloc(posix_memalign),
+#if defined(HAVE_DEPRECATED_MALLOC_FUNCS)
+    Malloc(pvalloc),
+#endif
+    Malloc(realloc),
+#if defined(HAVE_DEPRECATED_MALLOC_FUNCS)
+    Malloc(valloc),
+#endif
+    Malloc(iterate),
+    Malloc(malloc_disable),
+    Malloc(malloc_enable),
+    Malloc(mallopt),
+    Malloc(aligned_alloc),
+  };
+
+static constexpr char kHooksSharedLib[] = "libc_malloc_hooks.so";
+static constexpr char kHooksPrefix[] = "hooks";
+static constexpr char kHooksPropertyEnable[] = "libc.debug.hooks.enable";
+static constexpr char kHooksEnvEnable[] = "LIBC_HOOKS_ENABLE";
+
+static constexpr char kDebugSharedLib[] = "libc_malloc_debug.so";
+static constexpr char kDebugPrefix[] = "debug";
+static constexpr char kDebugPropertyOptions[] = "libc.debug.malloc.options";
+static constexpr char kDebugPropertyProgram[] = "libc.debug.malloc.program";
+static constexpr char kDebugEnvOptions[] = "LIBC_DEBUG_MALLOC_OPTIONS";
+
+typedef void (*finalize_func_t)();
+typedef bool (*init_func_t)(const MallocDispatch*, int*, const char*);
+typedef void (*get_malloc_leak_info_func_t)(uint8_t**, size_t*, size_t*, size_t*, size_t*);
+typedef void (*free_malloc_leak_info_func_t)(uint8_t*);
+typedef bool (*write_malloc_leak_info_func_t)(FILE*);
+typedef ssize_t (*malloc_backtrace_func_t)(void*, uintptr_t*, size_t);
+
+enum FunctionEnum : uint8_t {
+  FUNC_INITIALIZE,
+  FUNC_FINALIZE,
+  FUNC_GET_MALLOC_LEAK_INFO,
+  FUNC_FREE_MALLOC_LEAK_INFO,
+  FUNC_MALLOC_BACKTRACE,
+  FUNC_WRITE_LEAK_INFO,
+  FUNC_LAST,
+};
+static void* gFunctions[FUNC_LAST];
+
+extern "C" int __cxa_atexit(void (*func)(void *), void *arg, void *dso);
+
+template<typename FunctionType>
+static bool InitMallocFunction(void* malloc_impl_handler, FunctionType* func, const char* prefix, const char* suffix) {
+  char symbol[128];
+  snprintf(symbol, sizeof(symbol), "%s_%s", prefix, suffix);
+  *func = reinterpret_cast<FunctionType>(dlsym(malloc_impl_handler, symbol));
+  if (*func == nullptr) {
+    error_log("%s: dlsym(\"%s\") failed", getprogname(), symbol);
+    return false;
+  }
+  return true;
+}
+
+static bool InitMallocFunctions(void* impl_handler, MallocDispatch* table, const char* prefix) {
+  if (!InitMallocFunction<MallocFree>(impl_handler, &table->free, prefix, "free")) {
+    return false;
+  }
+  if (!InitMallocFunction<MallocCalloc>(impl_handler, &table->calloc, prefix, "calloc")) {
+    return false;
+  }
+  if (!InitMallocFunction<MallocMallinfo>(impl_handler, &table->mallinfo, prefix, "mallinfo")) {
+    return false;
+  }
+  if (!InitMallocFunction<MallocMallopt>(impl_handler, &table->mallopt, prefix, "mallopt")) {
+    return false;
+  }
+  if (!InitMallocFunction<MallocMalloc>(impl_handler, &table->malloc, prefix, "malloc")) {
+    return false;
+  }
+  if (!InitMallocFunction<MallocMallocUsableSize>(impl_handler, &table->malloc_usable_size, prefix,
+                                                  "malloc_usable_size")) {
+    return false;
+  }
+  if (!InitMallocFunction<MallocMemalign>(impl_handler, &table->memalign, prefix, "memalign")) {
+    return false;
+  }
+  if (!InitMallocFunction<MallocPosixMemalign>(impl_handler, &table->posix_memalign, prefix,
+                                               "posix_memalign")) {
+    return false;
+  }
+  if (!InitMallocFunction<MallocAlignedAlloc>(impl_handler, &table->aligned_alloc,
+                                              prefix, "aligned_alloc")) {
+    return false;
+  }
+  if (!InitMallocFunction<MallocRealloc>(impl_handler, &table->realloc, prefix, "realloc")) {
+    return false;
+  }
+  if (!InitMallocFunction<MallocIterate>(impl_handler, &table->iterate, prefix, "iterate")) {
+    return false;
+  }
+  if (!InitMallocFunction<MallocMallocDisable>(impl_handler, &table->malloc_disable, prefix,
+                                               "malloc_disable")) {
+    return false;
+  }
+  if (!InitMallocFunction<MallocMallocEnable>(impl_handler, &table->malloc_enable, prefix,
+                                              "malloc_enable")) {
+    return false;
+  }
+#if defined(HAVE_DEPRECATED_MALLOC_FUNCS)
+  if (!InitMallocFunction<MallocPvalloc>(impl_handler, &table->pvalloc, prefix, "pvalloc")) {
+    return false;
+  }
+  if (!InitMallocFunction<MallocValloc>(impl_handler, &table->valloc, prefix, "valloc")) {
+    return false;
+  }
+#endif
+
+  return true;
+}
+
+static void MallocFiniImpl(void*) {
+  // Our BSD stdio implementation doesn't close the standard streams,
+  // it only flushes them. Other unclosed FILE*s will show up as
+  // malloc leaks, but to avoid the standard streams showing up in
+  // leak reports, close them here.
+  fclose(stdin);
+  fclose(stdout);
+  fclose(stderr);
+
+  reinterpret_cast<finalize_func_t>(gFunctions[FUNC_FINALIZE])();
+}
+
+static bool CheckLoadMallocHooks(char** options) {
+  char* env = getenv(kHooksEnvEnable);
+  if ((env == nullptr || env[0] == '\0' || env[0] == '0') &&
+    (__system_property_get(kHooksPropertyEnable, *options) == 0 || *options[0] == '\0' || *options[0] == '0')) {
+    return false;
+  }
+  *options = nullptr;
+  return true;
+}
+
+static bool CheckLoadMallocDebug(char** options) {
+  // If kDebugMallocEnvOptions is set then it overrides the system properties.
+  char* env = getenv(kDebugEnvOptions);
+  if (env == nullptr || env[0] == '\0') {
+    if (__system_property_get(kDebugPropertyOptions, *options) == 0 || *options[0] == '\0') {
+      return false;
+    }
+
+    // Check to see if only a specific program should have debug malloc enabled.
+    char program[PROP_VALUE_MAX];
+    if (__system_property_get(kDebugPropertyProgram, program) != 0 &&
+        strstr(getprogname(), program) == nullptr) {
+      return false;
+    }
+  } else {
+    *options = env;
+  }
+  return true;
+}
+
+static void ClearGlobalFunctions() {
+  for (size_t i = 0; i < FUNC_LAST; i++) {
+    gFunctions[i] = nullptr;
+  }
+}
+
+bool InitSharedLibrary(void* impl_handle, const char* shared_lib, const char* prefix, MallocDispatch* dispatch_table) {
+  static constexpr const char* names[] = {
+    "initialize",
+    "finalize",
+    "get_malloc_leak_info",
+    "free_malloc_leak_info",
+    "malloc_backtrace",
+    "write_malloc_leak_info",
+  };
+  for (size_t i = 0; i < FUNC_LAST; i++) {
+    char symbol[128];
+    snprintf(symbol, sizeof(symbol), "%s_%s", prefix, names[i]);
+    gFunctions[i] = dlsym(impl_handle, symbol);
+    if (gFunctions[i] == nullptr) {
+      error_log("%s: %s routine not found in %s", getprogname(), symbol, shared_lib);
+      ClearGlobalFunctions();
+      return false;
+    }
+  }
+
+  if (!InitMallocFunctions(impl_handle, dispatch_table, prefix)) {
+    ClearGlobalFunctions();
+    return false;
+  }
+  return true;
+}
+
+void* LoadSharedLibrary(const char* shared_lib, const char* prefix, MallocDispatch* dispatch_table) {
+  void* impl_handle = dlopen(shared_lib, RTLD_NOW | RTLD_LOCAL);
+  if (impl_handle == nullptr) {
+    error_log("%s: Unable to open shared library %s: %s", getprogname(), shared_lib, dlerror());
+    return nullptr;
+  }
+
+  if (!InitSharedLibrary(impl_handle, shared_lib, prefix, dispatch_table)) {
+    dlclose(impl_handle);
+    impl_handle = nullptr;
+  }
+
+  return impl_handle;
+}
+
+bool FinishInstallHooks(libc_globals* globals, const char* options, const char* prefix) {
+  init_func_t init_func = reinterpret_cast<init_func_t>(gFunctions[FUNC_INITIALIZE]);
+  if (!init_func(&__libc_malloc_default_dispatch, &gMallocLeakZygoteChild, options)) {
+    error_log("%s: failed to enable malloc %s", getprogname(), prefix);
+    ClearGlobalFunctions();
+    return false;
+  }
+
+  // Do a pointer swap so that all of the functions become valid at once to
+  // avoid any initialization order problems.
+  atomic_store(&globals->current_dispatch_table, &globals->malloc_dispatch_table);
+
+  info_log("%s: malloc %s enabled", getprogname(), prefix);
+
+  // Use atexit to trigger the cleanup function. This avoids a problem
+  // where another atexit function is used to cleanup allocated memory,
+  // but the finalize function was already called. This particular error
+  // seems to be triggered by a zygote spawned process calling exit.
+  int ret_value = __cxa_atexit(MallocFiniImpl, nullptr, nullptr);
+  if (ret_value != 0) {
+    // We don't consider this a fatal error.
+    info_log("failed to set atexit cleanup function: %d", ret_value);
+  }
+  return true;
+}
+
+static bool InstallHooks(libc_globals* globals, const char* options, const char* prefix,
+                         const char* shared_lib) {
+  void* impl_handle = LoadSharedLibrary(shared_lib, prefix, &globals->malloc_dispatch_table);
+  if (impl_handle == nullptr) {
+    return false;
+  }
+
+  init_func_t init_func = reinterpret_cast<init_func_t>(gFunctions[FUNC_INITIALIZE]);
+  if (!init_func(&__libc_malloc_default_dispatch, &gMallocLeakZygoteChild, options)) {
+    error_log("%s: failed to enable malloc %s", getprogname(), prefix);
+    ClearGlobalFunctions();
+    return false;
+  }
+
+  if (!FinishInstallHooks(globals, options, prefix)) {
+    dlclose(impl_handle);
+    return false;
+  }
+  return true;
+}
+
+// Initializes memory allocation framework once per process.
+static void MallocInitImpl(libc_globals* globals) {
+  char prop[PROP_VALUE_MAX];
+  char* options = prop;
+
+  // Prefer malloc debug since it existed first and is a more complete
+  // malloc interceptor than the hooks.
+  bool hook_installed = false;
+  if (CheckLoadMallocDebug(&options)) {
+    hook_installed = InstallHooks(globals, options, kDebugPrefix, kDebugSharedLib);
+  } else if (CheckLoadMallocHooks(&options)) {
+    hook_installed = InstallHooks(globals, options, kHooksPrefix, kHooksSharedLib);
+  }
+
+  if (!hook_installed) {
+    if (HeapprofdShouldLoad()) {
+      HeapprofdInstallHooksAtInit(globals);
+    }
+
+    // Install this last to avoid as many race conditions as possible.
+    HeapprofdInstallSignalHandler();
+  } else {
+    // Install a signal handler that prints an error since we don't support
+    // heapprofd and any other hook to be installed at the same time.
+    HeapprofdInstallErrorSignalHandler();
+  }
+}
+
+// Initializes memory allocation framework.
+// This routine is called from __libc_init routines in libc_init_dynamic.cpp.
+__BIONIC_WEAK_FOR_NATIVE_BRIDGE
+__LIBC_HIDDEN__ void __libc_init_malloc(libc_globals* globals) {
+  MallocInitImpl(globals);
+}
+
+// =============================================================================
+// Functions to support dumping of native heap allocations using malloc debug.
+// =============================================================================
+
+// Retrieve native heap information.
+//
+// "*info" is set to a buffer we allocate
+// "*overall_size" is set to the size of the "info" buffer
+// "*info_size" is set to the size of a single entry
+// "*total_memory" is set to the sum of all allocations we're tracking; does
+//   not include heap overhead
+// "*backtrace_size" is set to the maximum number of entries in the back trace
+extern "C" void get_malloc_leak_info(uint8_t** info, size_t* overall_size,
+    size_t* info_size, size_t* total_memory, size_t* backtrace_size) {
+  void* func = gFunctions[FUNC_GET_MALLOC_LEAK_INFO];
+  if (func == nullptr) {
+    return;
+  }
+  reinterpret_cast<get_malloc_leak_info_func_t>(func)(info, overall_size, info_size, total_memory,
+                                                      backtrace_size);
+}
+
+extern "C" void free_malloc_leak_info(uint8_t* info) {
+  void* func = gFunctions[FUNC_FREE_MALLOC_LEAK_INFO];
+  if (func == nullptr) {
+    return;
+  }
+  reinterpret_cast<free_malloc_leak_info_func_t>(func)(info);
+}
+
+extern "C" void write_malloc_leak_info(FILE* fp) {
+  if (fp == nullptr) {
+    error_log("write_malloc_leak_info called with a nullptr");
+    return;
+  }
+
+  void* func = gFunctions[FUNC_WRITE_LEAK_INFO];
+  bool written = false;
+  if (func != nullptr) {
+    written = reinterpret_cast<write_malloc_leak_info_func_t>(func)(fp);
+  }
+
+  if (!written) {
+    fprintf(fp, "Native heap dump not available. To enable, run these commands (requires root):\n");
+    fprintf(fp, "# adb shell stop\n");
+    fprintf(fp, "# adb shell setprop libc.debug.malloc.options backtrace\n");
+    fprintf(fp, "# adb shell start\n");
+  }
+}
+// =============================================================================
+
+// =============================================================================
+// Exported for use by libmemunreachable.
+// =============================================================================
+extern "C" ssize_t malloc_backtrace(void* pointer, uintptr_t* frames, size_t frame_count) {
+  void* func = gFunctions[FUNC_MALLOC_BACKTRACE];
+  if (func == nullptr) {
+    return 0;
+  }
+  return reinterpret_cast<malloc_backtrace_func_t>(func)(pointer, frames, frame_count);
+}
+// =============================================================================
+
+// =============================================================================
+// Platform-internal mallopt variant.
+// =============================================================================
+extern "C" bool android_mallopt(int opcode, void* arg, size_t arg_size) {
+  return HeapprofdMallopt(opcode, arg, arg_size);
+}
+// =============================================================================
diff --git a/libc/arch-mips/bionic/libgcc_compat.c b/libc/bionic/malloc_common_dynamic.h
similarity index 71%
copy from libc/arch-mips/bionic/libgcc_compat.c
copy to libc/bionic/malloc_common_dynamic.h
index 1a0f566..8794ed0 100644
--- a/libc/arch-mips/bionic/libgcc_compat.c
+++ b/libc/bionic/malloc_common_dynamic.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2016 The Android Open Source Project
+ * Copyright (C) 2019 The Android Open Source Project
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -26,16 +26,17 @@
  * SUCH DAMAGE.
  */
 
-extern char __divdi3;
-extern char __moddi3;
-extern char __popcountsi2;
-extern char __udivdi3;
-extern char __umoddi3;
+#pragma once
 
-void* __bionic_libgcc_compat_symbols[] = {
-    &__divdi3,
-    &__moddi3,
-    &__popcountsi2,
-    &__udivdi3,
-    &__umoddi3,
-};
+#include <stdbool.h>
+
+#include <private/bionic_globals.h>
+#include <private/bionic_malloc_dispatch.h>
+
+// Function prototypes.
+bool InitSharedLibrary(void* impl_handle, const char* shared_lib, const char* prefix,
+                       MallocDispatch* dispatch_table);
+
+void* LoadSharedLibrary(const char* shared_lib, const char* prefix, MallocDispatch* dispatch_table);
+
+bool FinishInstallHooks(libc_globals* globals, const char* options, const char* prefix);
diff --git a/libc/bionic/malloc_heapprofd.cpp b/libc/bionic/malloc_heapprofd.cpp
new file mode 100644
index 0000000..c492bac
--- /dev/null
+++ b/libc/bionic/malloc_heapprofd.cpp
@@ -0,0 +1,324 @@
+/*
+ * Copyright (C) 2019 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#if defined(LIBC_STATIC)
+#error This file should not be compiled for static targets.
+#endif
+
+#include <dlfcn.h>
+#include <fcntl.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+#include <private/bionic_config.h>
+#include <private/bionic_malloc.h>
+#include <private/bionic_malloc_dispatch.h>
+#include <sys/system_properties.h>
+
+#include "malloc_common.h"
+#include "malloc_common_dynamic.h"
+#include "malloc_heapprofd.h"
+
+static constexpr char kHeapprofdSharedLib[] = "heapprofd_client.so";
+static constexpr char kHeapprofdPrefix[] = "heapprofd";
+static constexpr char kHeapprofdPropertyEnable[] = "heapprofd.enable";
+static constexpr int kHeapprofdSignal = __SIGRTMIN + 4;
+
+// The logic for triggering heapprofd (at runtime) is as follows:
+// 1. HEAPPROFD_SIGNAL is received by the process, entering the
+//    MaybeInstallInitHeapprofdHook signal handler.
+// 2. If the initialization is not already in flight
+//    (gHeapprofdInitInProgress is false), the malloc hook is set to
+//    point at InitHeapprofdHook, and gHeapprofdInitInProgress is set to
+//    true.
+// 3. The next malloc call enters InitHeapprofdHook, which removes the malloc
+//    hook, and spawns a detached pthread to run the InitHeapprofd task.
+//    (gHeapprofdInitHook_installed atomic is used to perform this once.)
+// 4. InitHeapprofd, on a dedicated pthread, loads the heapprofd client library,
+//    installs the full set of heapprofd hooks, and invokes the client's
+//    initializer. The dedicated pthread then terminates.
+// 5. gHeapprofdInitInProgress and gHeapprofdInitHookInstalled are
+//    reset to false such that heapprofd can be reinitialized. Reinitialization
+//    means that a new profiling session is started, and any still active is
+//    torn down.
+//
+// The incremental hooking and a dedicated task thread are used since we cannot
+// do heavy work within a signal handler, or when blocking a malloc invocation.
+
+// The handle returned by dlopen when previously loading the heapprofd
+// hooks. nullptr if shared library has not been already been loaded.
+static _Atomic (void*) gHeapprofdHandle = nullptr;
+
+static _Atomic bool gHeapprofdInitInProgress = false;
+static _Atomic bool gHeapprofdInitHookInstalled = false;
+
+// In a Zygote child process, this is set to true if profiling of this process
+// is allowed. Note that this is set at a later time than the global
+// gMallocLeakZygoteChild. The latter is set during the fork (while still in
+// zygote's SELinux domain). While this bit is set after the child is
+// specialized (and has transferred SELinux domains if applicable).
+static _Atomic bool gMallocZygoteChildProfileable = false;
+
+extern "C" void* MallocInitHeapprofdHook(size_t);
+
+static constexpr MallocDispatch __heapprofd_init_dispatch
+  __attribute__((unused)) = {
+    Malloc(calloc),
+    Malloc(free),
+    Malloc(mallinfo),
+    MallocInitHeapprofdHook,
+    Malloc(malloc_usable_size),
+    Malloc(memalign),
+    Malloc(posix_memalign),
+#if defined(HAVE_DEPRECATED_MALLOC_FUNCS)
+    Malloc(pvalloc),
+#endif
+    Malloc(realloc),
+#if defined(HAVE_DEPRECATED_MALLOC_FUNCS)
+    Malloc(valloc),
+#endif
+    Malloc(iterate),
+    Malloc(malloc_disable),
+    Malloc(malloc_enable),
+    Malloc(mallopt),
+    Malloc(aligned_alloc),
+  };
+
+static void MaybeInstallInitHeapprofdHook(int) {
+  // Zygote child processes must be marked profileable.
+  if (gMallocLeakZygoteChild &&
+      !atomic_load_explicit(&gMallocZygoteChildProfileable, memory_order_acquire)) {
+    return;
+  }
+
+  if (!atomic_exchange(&gHeapprofdInitInProgress, true)) {
+    __libc_globals.mutate([](libc_globals* globals) {
+      atomic_store(&globals->current_dispatch_table, &__heapprofd_init_dispatch);
+    });
+  }
+}
+
+static bool GetHeapprofdProgramProperty(char* data, size_t size) {
+  constexpr char prefix[] = "heapprofd.enable.";
+  // - 1 to skip nullbyte, which we will write later.
+  constexpr size_t prefix_size = sizeof(prefix) - 1;
+  if (size < prefix_size) {
+    error_log("%s: Overflow constructing heapprofd property", getprogname());
+    return false;
+  }
+  memcpy(data, prefix, prefix_size);
+
+  int fd = open("/proc/self/cmdline", O_RDONLY | O_CLOEXEC);
+  if (fd == -1) {
+    error_log("%s: Failed to open /proc/self/cmdline", getprogname());
+    return false;
+  }
+  char cmdline[128];
+  ssize_t rd = read(fd, cmdline, sizeof(cmdline) - 1);
+  close(fd);
+  if (rd == -1) {
+    error_log("%s: Failed to read /proc/self/cmdline", getprogname());
+    return false;
+  }
+  cmdline[rd] = '\0';
+  char* first_arg = static_cast<char*>(memchr(cmdline, '\0', rd));
+  if (first_arg == nullptr || first_arg == cmdline + size - 1) {
+    error_log("%s: Overflow reading cmdline", getprogname());
+    return false;
+  }
+  // For consistency with what we do with Java app cmdlines, trim everything
+  // after the @ sign of the first arg.
+  char* first_at = static_cast<char*>(memchr(cmdline, '@', rd));
+  if (first_at != nullptr && first_at < first_arg) {
+    *first_at = '\0';
+    first_arg = first_at;
+  }
+
+  char* start = static_cast<char*>(memrchr(cmdline, '/', first_arg - cmdline));
+  if (start == first_arg) {
+    // The first argument ended in a slash.
+    error_log("%s: cmdline ends in /", getprogname());
+    return false;
+  } else if (start == nullptr) {
+    start = cmdline;
+  } else {
+    // Skip the /.
+    start++;
+  }
+
+  size_t name_size = static_cast<size_t>(first_arg - start);
+  if (name_size >= size - prefix_size) {
+    error_log("%s: overflow constructing heapprofd property.", getprogname());
+    return false;
+  }
+  // + 1 to also copy the trailing null byte.
+  memcpy(data + prefix_size, start, name_size + 1);
+  return true;
+}
+
+bool HeapprofdShouldLoad() {
+  // First check for heapprofd.enable. If it is set to "all", enable
+  // heapprofd for all processes. Otherwise, check heapprofd.enable.${prog},
+  // if it is set and not 0, enable heap profiling for this process.
+  char property_value[PROP_VALUE_MAX];
+  if (__system_property_get(kHeapprofdPropertyEnable, property_value) == 0) {
+    return false;
+  }
+  if (strcmp(property_value, "all") == 0) {
+    return true;
+  }
+
+  char program_property[128];
+  if (!GetHeapprofdProgramProperty(program_property,
+                                   sizeof(program_property))) {
+    return false;
+  }
+  if (__system_property_get(program_property, property_value) == 0) {
+    return false;
+  }
+  return program_property[0] != '\0';
+}
+
+void HeapprofdInstallSignalHandler() {
+  struct sigaction action = {};
+  action.sa_handler = MaybeInstallInitHeapprofdHook;
+  sigaction(kHeapprofdSignal, &action, nullptr);
+}
+
+static void DisplayError(int) {
+  error_log("Cannot install heapprofd while malloc debug/malloc hooks are enabled.");
+}
+
+void HeapprofdInstallErrorSignalHandler() {
+  struct sigaction action = {};
+  action.sa_handler = DisplayError;
+  sigaction(kHeapprofdSignal, &action, nullptr);
+}
+
+static void CommonInstallHooks(libc_globals* globals) {
+  void* impl_handle = atomic_load(&gHeapprofdHandle);
+  bool reusing_handle = impl_handle != nullptr;
+  if (!reusing_handle) {
+    impl_handle = LoadSharedLibrary(kHeapprofdSharedLib, kHeapprofdPrefix, &globals->malloc_dispatch_table);
+    if (impl_handle == nullptr) {
+      return;
+    }
+  } else if (!InitSharedLibrary(impl_handle, kHeapprofdSharedLib, kHeapprofdPrefix, &globals->malloc_dispatch_table)) {
+    return;
+  }
+
+  if (FinishInstallHooks(globals, nullptr, kHeapprofdPrefix)) {
+    atomic_store(&gHeapprofdHandle, impl_handle);
+  } else if (!reusing_handle) {
+    dlclose(impl_handle);
+  }
+
+  atomic_store(&gHeapprofdInitInProgress, false);
+}
+
+void HeapprofdInstallHooksAtInit(libc_globals* globals) {
+  if (atomic_exchange(&gHeapprofdInitInProgress, true)) {
+    return;
+  }
+  CommonInstallHooks(globals);
+}
+
+static void* InitHeapprofd(void*) {
+  __libc_globals.mutate([](libc_globals* globals) {
+    CommonInstallHooks(globals);
+  });
+
+  // Allow to install hook again to re-initialize heap profiling after the
+  // current session finished.
+  atomic_store(&gHeapprofdInitHookInstalled, false);
+  return nullptr;
+}
+
+extern "C" void* MallocInitHeapprofdHook(size_t bytes) {
+  if (!atomic_exchange(&gHeapprofdInitHookInstalled, true)) {
+    __libc_globals.mutate([](libc_globals* globals) {
+      atomic_store(&globals->current_dispatch_table, nullptr);
+    });
+
+    pthread_t thread_id;
+    if (pthread_create(&thread_id, nullptr, InitHeapprofd, nullptr) != 0) {
+      error_log("%s: heapprofd: failed to pthread_create.", getprogname());
+    } else if (pthread_detach(thread_id) != 0) {
+      error_log("%s: heapprofd: failed to pthread_detach", getprogname());
+    }
+    if (pthread_setname_np(thread_id, "heapprofdinit") != 0) {
+      error_log("%s: heapprod: failed to pthread_setname_np", getprogname());
+    }
+  }
+  return Malloc(malloc)(bytes);
+}
+
+// Marks this process as a profileable zygote child.
+static bool HandleInitZygoteChildProfiling() {
+  atomic_store_explicit(&gMallocZygoteChildProfileable, true, memory_order_release);
+
+  // Conditionally start "from startup" profiling.
+  if (HeapprofdShouldLoad()) {
+    // Directly call the signal handler (will correctly guard against
+    // concurrent signal delivery).
+    MaybeInstallInitHeapprofdHook(kHeapprofdSignal);
+  }
+  return true;
+}
+
+static bool DispatchReset() {
+  if (!atomic_exchange(&gHeapprofdInitInProgress, true)) {
+    __libc_globals.mutate([](libc_globals* globals) {
+      atomic_store(&globals->current_dispatch_table, nullptr);
+    });
+    atomic_store(&gHeapprofdInitInProgress, false);
+    return true;
+  }
+  errno = EAGAIN;
+  return false;
+}
+
+bool HeapprofdMallopt(int opcode, void* arg, size_t arg_size) {
+  if (opcode == M_INIT_ZYGOTE_CHILD_PROFILING) {
+    if (arg != nullptr || arg_size != 0) {
+      errno = EINVAL;
+      return false;
+    }
+    return HandleInitZygoteChildProfiling();
+  }
+  if (opcode == M_RESET_HOOKS) {
+    if (arg != nullptr || arg_size != 0) {
+      errno = EINVAL;
+      return false;
+    }
+    return DispatchReset();
+  }
+  errno = ENOTSUP;
+  return false;
+}
diff --git a/libc/arch-mips/bionic/libgcc_compat.c b/libc/bionic/malloc_heapprofd.h
similarity index 78%
copy from libc/arch-mips/bionic/libgcc_compat.c
copy to libc/bionic/malloc_heapprofd.h
index 1a0f566..5a766fc 100644
--- a/libc/arch-mips/bionic/libgcc_compat.c
+++ b/libc/bionic/malloc_heapprofd.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2016 The Android Open Source Project
+ * Copyright (C) 2019 The Android Open Source Project
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -26,16 +26,18 @@
  * SUCH DAMAGE.
  */
 
-extern char __divdi3;
-extern char __moddi3;
-extern char __popcountsi2;
-extern char __udivdi3;
-extern char __umoddi3;
+#pragma once
 
-void* __bionic_libgcc_compat_symbols[] = {
-    &__divdi3,
-    &__moddi3,
-    &__popcountsi2,
-    &__udivdi3,
-    &__umoddi3,
-};
+#include <stdint.h>
+
+#include <private/bionic_globals.h>
+
+bool HeapprofdShouldLoad();
+
+void HeapprofdInstallHooksAtInit(libc_globals* globals);
+
+void HeapprofdInstallSignalHandler();
+
+void HeapprofdInstallErrorSignalHandler();
+
+bool HeapprofdMallopt(int optcode, void* arg, size_t arg_size);
diff --git a/libc/bionic/system_property_set.cpp b/libc/bionic/system_property_set.cpp
index bc3ba76..c508db1 100644
--- a/libc/bionic/system_property_set.cpp
+++ b/libc/bionic/system_property_set.cpp
@@ -42,6 +42,7 @@
 #include <unistd.h>
 
 #include <async_safe/log.h>
+#include <async_safe/CHECK.h>
 
 #include "private/bionic_defs.h"
 #include "private/bionic_macros.h"
diff --git a/libc/libc.map.txt b/libc/libc.map.txt
index 6a6ea7d..62aea27 100644
--- a/libc/libc.map.txt
+++ b/libc/libc.map.txt
@@ -1561,7 +1561,7 @@
     __ashldi3; # arm
     __ashrdi3; # arm
     __bionic_brk; # arm x86 mips
-    __bionic_libgcc_compat_symbols; # arm x86
+    __bionic_libcrt_compat_symbols; # arm x86
     __cmpdf2; # arm
     __divdf3; # arm
     __divdi3; # arm x86 mips
diff --git a/libc/malloc_debug/PointerData.cpp b/libc/malloc_debug/PointerData.cpp
index 638061b..6e9d24f 100644
--- a/libc/malloc_debug/PointerData.cpp
+++ b/libc/malloc_debug/PointerData.cpp
@@ -266,12 +266,12 @@
   error_log("  hash_index %zu does not have matching frame data.", hash_index);
 }
 
-void PointerData::LogFreeError(const FreePointerInfoType& info, size_t usable_size) {
+void PointerData::LogFreeError(const FreePointerInfoType& info, size_t max_cmp_bytes) {
   error_log(LOG_DIVIDER);
   uint8_t* memory = reinterpret_cast<uint8_t*>(info.pointer);
   error_log("+++ ALLOCATION %p USED AFTER FREE", memory);
   uint8_t fill_free_value = g_debug->config().fill_free_value();
-  for (size_t i = 0; i < usable_size; i++) {
+  for (size_t i = 0; i < max_cmp_bytes; i++) {
     if (memory[i] != fill_free_value) {
       error_log("  allocation[%zu] = 0x%02x (expected 0x%02x)", i, memory[i], fill_free_value);
     }
@@ -314,11 +314,12 @@
   size_t bytes = (usable_size < g_debug->config().fill_on_free_bytes())
                      ? usable_size
                      : g_debug->config().fill_on_free_bytes();
+  size_t max_cmp_bytes = bytes;
   const uint8_t* memory = reinterpret_cast<const uint8_t*>(info.pointer);
   while (bytes > 0) {
     size_t bytes_to_cmp = (bytes < g_cmp_mem.size()) ? bytes : g_cmp_mem.size();
     if (memcmp(memory, g_cmp_mem.data(), bytes_to_cmp) != 0) {
-      LogFreeError(info, usable_size);
+      LogFreeError(info, max_cmp_bytes);
     }
     bytes -= bytes_to_cmp;
     memory = &memory[bytes_to_cmp];
diff --git a/libc/malloc_debug/tests/malloc_debug_unit_tests.cpp b/libc/malloc_debug/tests/malloc_debug_unit_tests.cpp
index 44f9795..6da95ca 100644
--- a/libc/malloc_debug/tests/malloc_debug_unit_tests.cpp
+++ b/libc/malloc_debug/tests/malloc_debug_unit_tests.cpp
@@ -990,6 +990,35 @@
   ASSERT_STREQ("", getFakeLogPrint().c_str());
 }
 
+TEST_F(MallocDebugTest, free_track_pointer_modified_after_free) {
+  Init("free_track=4 fill_on_free=2 free_track_backtrace_num_frames=0");
+
+  void* pointers[5];
+  for (size_t i = 0; i < sizeof(pointers) / sizeof(void*); i++) {
+    pointers[i] = debug_malloc(100);
+    ASSERT_TRUE(pointers[i] != nullptr);
+    memset(pointers[i], 0, 100);
+  }
+
+  debug_free(pointers[0]);
+
+  // overwrite the whole pointer, only expect errors on the fill bytes we check.
+  memset(pointers[0], 0x20, 100);
+
+  for (size_t i = 1; i < sizeof(pointers) / sizeof(void*); i++) {
+    debug_free(pointers[i]);
+  }
+
+  std::string expected_log(DIVIDER);
+  expected_log += android::base::StringPrintf("6 malloc_debug +++ ALLOCATION %p USED AFTER FREE\n",
+                                              pointers[0]);
+  expected_log += "6 malloc_debug   allocation[0] = 0x20 (expected 0xef)\n";
+  expected_log += "6 malloc_debug   allocation[1] = 0x20 (expected 0xef)\n";
+  expected_log += DIVIDER;
+  ASSERT_STREQ("", getFakeLogBuf().c_str());
+  ASSERT_STREQ(expected_log.c_str(), getFakeLogPrint().c_str());
+}
+
 TEST_F(MallocDebugTest, get_malloc_leak_info_invalid) {
   Init("fill");
 
diff --git a/libc/private/bionic_globals.h b/libc/private/bionic_globals.h
index 21a2a24..447b3b9 100644
--- a/libc/private/bionic_globals.h
+++ b/libc/private/bionic_globals.h
@@ -29,6 +29,7 @@
 #ifndef _PRIVATE_BIONIC_GLOBALS_H
 #define _PRIVATE_BIONIC_GLOBALS_H
 
+#include <stdatomic.h>
 #include <sys/cdefs.h>
 #include <link.h>
 #include <pthread.h>
@@ -43,7 +44,18 @@
 struct libc_globals {
   vdso_entry vdso[VDSO_END];
   long setjmp_cookie;
-  MallocDispatch malloc_dispatch;
+
+  // In order to allow a complete switch between dispatch tables without
+  // the need for copying each function by function in the structure,
+  // use a single atomic pointer to switch.
+  // The current_dispatch_table pointer can only ever be set to a complete
+  // table. Any dispatch table that is pointed to by current_dispatch_table
+  // cannot be modified after that. If the pointer changes in the future,
+  // the old pointer must always stay valid.
+  // The malloc_dispatch_table is modified by malloc debug, malloc hooks,
+  // and heaprofd. Only one of these modes can be active at any given time.
+  _Atomic(const MallocDispatch*) current_dispatch_table;
+  MallocDispatch malloc_dispatch_table;
 };
 
 __LIBC_HIDDEN__ extern WriteProtected<libc_globals> __libc_globals;
@@ -87,6 +99,7 @@
 
 #if defined(__i386__)
 __LIBC_HIDDEN__ extern void* __libc_sysinfo;
+__LIBC_HIDDEN__ void __libc_int0x80();
 __LIBC_HIDDEN__ void __libc_init_sysinfo();
 #endif
 
diff --git a/libc/private/bionic_malloc_dispatch.h b/libc/private/bionic_malloc_dispatch.h
index f15b72c..0dce03d 100644
--- a/libc/private/bionic_malloc_dispatch.h
+++ b/libc/private/bionic_malloc_dispatch.h
@@ -31,7 +31,6 @@
 
 #include <stddef.h>
 #include <stdint.h>
-#include <stdatomic.h>
 #include <private/bionic_config.h>
 
 // Entry in malloc dispatch table.
@@ -55,25 +54,25 @@
 #endif
 
 struct MallocDispatch {
-  _Atomic MallocCalloc calloc;
-  _Atomic MallocFree free;
-  _Atomic MallocMallinfo mallinfo;
-  _Atomic MallocMalloc malloc;
-  _Atomic MallocMallocUsableSize malloc_usable_size;
-  _Atomic MallocMemalign memalign;
-  _Atomic MallocPosixMemalign posix_memalign;
+  MallocCalloc calloc;
+  MallocFree free;
+  MallocMallinfo mallinfo;
+  MallocMalloc malloc;
+  MallocMallocUsableSize malloc_usable_size;
+  MallocMemalign memalign;
+  MallocPosixMemalign posix_memalign;
 #if defined(HAVE_DEPRECATED_MALLOC_FUNCS)
-  _Atomic MallocPvalloc pvalloc;
+  MallocPvalloc pvalloc;
 #endif
-  _Atomic MallocRealloc realloc;
+  MallocRealloc realloc;
 #if defined(HAVE_DEPRECATED_MALLOC_FUNCS)
-  _Atomic MallocValloc valloc;
+  MallocValloc valloc;
 #endif
-  _Atomic MallocIterate iterate;
-  _Atomic MallocMallocDisable malloc_disable;
-  _Atomic MallocMallocEnable malloc_enable;
-  _Atomic MallocMallopt mallopt;
-  _Atomic MallocAlignedAlloc aligned_alloc;
+  MallocIterate iterate;
+  MallocMallocDisable malloc_disable;
+  MallocMallocEnable malloc_enable;
+  MallocMallopt mallopt;
+  MallocAlignedAlloc aligned_alloc;
 } __attribute__((aligned(32)));
 
 #endif
diff --git a/libc/symbol_ordering b/libc/symbol_ordering
index b672b35..6fcc09e 100644
--- a/libc/symbol_ordering
+++ b/libc/symbol_ordering
@@ -3,11 +3,9 @@
 # symbols by size, we usually have less dirty pages at runtime, because small
 # symbols are grouped together.
 
-je_background_thread_enabled_state
-je_can_enable_background_thread
 _ZZ17__find_icu_symbolPKcE9found_icu
-_ZL28g_heapprofd_init_in_progress
-_ZL31g_heapprofd_init_hook_installed
+_ZL24gHeapprofdInitInProgress
+_ZL27gHeapprofdInitHookInstalled
 je_opt_abort
 je_opt_abort_conf
 je_opt_junk_alloc
@@ -19,7 +17,6 @@
 had_conf_error
 malloc_slow_flags
 je_opt_background_thread
-background_thread_enabled_at_fork
 ctl_initialized
 je_log_init_done
 mmap_flags
@@ -46,7 +43,6 @@
 optreset
 _rs_forked
 daylight
-_ZL17g_icudata_version
 gMallocLeakZygoteChild
 _ZL18netdClientInitOnce
 je_opt_narenas
@@ -71,8 +67,6 @@
 seed48.sseed
 ether_aton.addr
 je_background_thread_info
-je_max_background_threads
-je_n_background_threads
 je_malloc_message
 je_tcache_bin_info
 je_tcache_maxclass
@@ -93,7 +87,6 @@
 je_opt_muzzy_decay_ms
 dirty_decay_ms_default.0
 muzzy_decay_ms_default.0
-pthread_create_fptr
 b0
 ctl_arenas
 ctl_stats
@@ -175,7 +168,7 @@
 __res_randomid.__libc_mutex_random
 locallock
 g_atexit_lock
-_ZL11g_functions
+_ZL10gFunctions
 _ZL13vendor_passwd
 _ZL12vendor_group
 tm
diff --git a/libc/system_properties/Android.bp b/libc/system_properties/Android.bp
index f94cda9..911afb1 100644
--- a/libc/system_properties/Android.bp
+++ b/libc/system_properties/Android.bp
@@ -12,8 +12,8 @@
     whole_static_libs: [
         "libpropertyinfoparser",
     ],
-    static_libs: [
-        "libasync_safe",
+    header_libs: [
+        "libasync_safe_headers",
     ],
 
     include_dirs: [
diff --git a/libc/upstream-netbsd/common/lib/libc/stdlib/random.c b/libc/upstream-netbsd/common/lib/libc/stdlib/random.c
index e7503c7..0e6eac0 100644
--- a/libc/upstream-netbsd/common/lib/libc/stdlib/random.c
+++ b/libc/upstream-netbsd/common/lib/libc/stdlib/random.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: random.c,v 1.4 2014/06/12 20:59:46 christos Exp $	*/
+/*	$NetBSD: random.c,v 1.5 2016/02/08 05:27:24 dholland Exp $	*/
 
 /*
  * Copyright (c) 1983, 1993
@@ -35,7 +35,7 @@
 #if 0
 static char sccsid[] = "@(#)random.c	8.2 (Berkeley) 5/19/95";
 #else
-__RCSID("$NetBSD: random.c,v 1.4 2014/06/12 20:59:46 christos Exp $");
+__RCSID("$NetBSD: random.c,v 1.5 2016/02/08 05:27:24 dholland Exp $");
 #endif
 #endif /* LIBC_SCCS and not lint */
 
@@ -92,7 +92,7 @@
  * state information, which will allow a degree seven polynomial.  (Note:
  * the zeroeth word of state information also has some other information
  * stored in it -- see setstate() for details).
- * 
+ *
  * The random number generation technique is a linear feedback shift register
  * approach, employing trinomials (since there are fewer terms to sum up that
  * way).  In this approach, the least significant bit of all the numbers in
@@ -318,12 +318,12 @@
  * the break values for the different R.N.G.'s, we choose the best (largest)
  * one we can and set things up for it.  srandom() is then called to
  * initialize the state information.
- * 
+ *
  * Note that on return from srandom(), we set state[-1] to be the type
  * multiplexed with the current value of the rear pointer; this is so
  * successive calls to initstate() won't lose this information and will be
  * able to restart with setstate().
- * 
+ *
  * Note: the first thing we do is save the current state, if any, just like
  * setstate() so that it doesn't matter when initstate is called.
  *
@@ -511,7 +511,7 @@
 {
 	static u_long randseed = 1;
 	long x, hi, lo, t;
- 
+
 	/*
 	 * Compute x[n + 1] = (7^5 * x[n]) mod (2^31 - 1).
 	 * From "Random number generators: good ones are hard to find",
diff --git a/libc/upstream-netbsd/lib/libc/include/isc/dst.h b/libc/upstream-netbsd/lib/libc/include/isc/dst.h
index 5537e3d..a25cf01 100644
--- a/libc/upstream-netbsd/lib/libc/include/isc/dst.h
+++ b/libc/upstream-netbsd/lib/libc/include/isc/dst.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: dst.h,v 1.1.1.4 2009/04/12 16:35:44 christos Exp $	*/
+/*	$NetBSD: dst.h,v 1.2 2014/08/03 19:14:24 wiz Exp $	*/
 
 #ifndef DST_H
 #define DST_H
@@ -55,7 +55,7 @@
 #define	dst_write_key		__dst_write_key
 
 /* 
- * DST Crypto API defintions 
+ * DST Crypto API definitions 
  */
 void     dst_init(void);
 int      dst_check_algorithm(const int);
diff --git a/libc/upstream-netbsd/lib/libc/regex/regcomp.c b/libc/upstream-netbsd/lib/libc/regex/regcomp.c
index 6af9734..4a0d99a 100644
--- a/libc/upstream-netbsd/lib/libc/regex/regcomp.c
+++ b/libc/upstream-netbsd/lib/libc/regex/regcomp.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: regcomp.c,v 1.36 2015/09/12 19:08:47 christos Exp $	*/
+/*	$NetBSD: regcomp.c,v 1.38 2019/02/07 22:22:31 christos Exp $	*/
 
 /*-
  * Copyright (c) 1992, 1993, 1994
@@ -76,7 +76,7 @@
 #if 0
 static char sccsid[] = "@(#)regcomp.c	8.5 (Berkeley) 3/20/94";
 #else
-__RCSID("$NetBSD: regcomp.c,v 1.36 2015/09/12 19:08:47 christos Exp $");
+__RCSID("$NetBSD: regcomp.c,v 1.38 2019/02/07 22:22:31 christos Exp $");
 #endif
 #endif /* LIBC_SCCS and not lint */
 
@@ -474,6 +474,8 @@
 		REQUIRE(!MORE() || !isdigit((unsigned char)PEEK()), REG_BADRPT);
 		/* FALLTHROUGH */
 	default:
+		if (p->error != 0)
+			return;
 		ordinary(p, c);
 		break;
 	}
@@ -692,6 +694,8 @@
 		REQUIRE(starordinary, REG_BADRPT);
 		/* FALLTHROUGH */
 	default:
+		if (p->error != 0)
+			return(0);
 		ordinary(p, c &~ BACKSL);
 		break;
 	}
@@ -1007,7 +1011,7 @@
 	}
 	len = p->next - sp;
 	for (cp = cnames; cp->name != NULL; cp++)
-		if (strncmp(cp->name, sp, len) == 0 && cp->name[len] == '\0')
+		if (strncmp(cp->name, sp, len) == 0 && strlen(cp->name) == len)
 			return(cp->code);	/* known name */
 	if (len == 1)
 		return(*sp);	/* single character */
diff --git a/libdl/Android.bp b/libdl/Android.bp
index c17e72e..642cc7a 100644
--- a/libdl/Android.bp
+++ b/libdl/Android.bp
@@ -93,6 +93,9 @@
     nocrt: true,
     system_shared_libs: [],
 
+    // Opt out of native_coverage when opting out of system_shared_libs
+    native_coverage: false,
+
     // This is placeholder library the actual implementation is (currently)
     // provided by the linker.
     shared_libs: ["ld-android"],
diff --git a/libm/Android.bp b/libm/Android.bp
index 079220b..ec319e2 100644
--- a/libm/Android.bp
+++ b/libm/Android.bp
@@ -509,6 +509,7 @@
     stl: "none",
 
     // TODO(ivanlozano): Remove after b/118321713
+    no_libcrt: true,
     xom: false,
 
     stubs: {
diff --git a/linker/Android.bp b/linker/Android.bp
index fed921d..613be3d 100644
--- a/linker/Android.bp
+++ b/linker/Android.bp
@@ -296,6 +296,10 @@
         },
     },
     system_shared_libs: [],
+
+    // Opt out of native_coverage when opting out of system_shared_libs
+    native_coverage: false,
+
     target: {
         android: {
             static_libs: ["libdebuggerd_handler_fallback"],
@@ -364,7 +368,46 @@
     nocrt: true,
     system_shared_libs: [],
 
+    // Opt out of native_coverage when opting out of system_shared_libs
+    native_coverage: false,
+
     sanitize: {
         never: true,
     },
 }
+
+cc_test {
+    name: "linker-unit-tests",
+
+    cflags: [
+        "-g",
+        "-Wall",
+        "-Wextra",
+        "-Wunused",
+        "-Werror",
+    ],
+
+    // We need to access Bionic private headers in the linker.
+    include_dirs: ["bionic/libc"],
+
+    srcs: [
+        // Tests.
+        "linker_block_allocator_test.cpp",
+        "linker_config_test.cpp",
+        "linked_list_test.cpp",
+        "linker_sleb128_test.cpp",
+        "linker_utils_test.cpp",
+
+        // Parts of the linker that we're testing.
+        "linker_block_allocator.cpp",
+        "linker_config.cpp",
+        "linker_test_globals.cpp",
+        "linker_utils.cpp",
+    ],
+
+    static_libs: [
+        "libasync_safe",
+        "libbase",
+        "liblog",
+    ],
+}
diff --git a/linker/Android.mk b/linker/Android.mk
deleted file mode 100644
index ea7451c..0000000
--- a/linker/Android.mk
+++ /dev/null
@@ -1,3 +0,0 @@
-LOCAL_PATH := $(call my-dir)
-
-include $(call first-makefiles-under,$(LOCAL_PATH))
diff --git a/linker/tests/linked_list_test.cpp b/linker/linked_list_test.cpp
similarity index 99%
rename from linker/tests/linked_list_test.cpp
rename to linker/linked_list_test.cpp
index 2b88ed0..71a7d09 100644
--- a/linker/tests/linked_list_test.cpp
+++ b/linker/linked_list_test.cpp
@@ -32,7 +32,7 @@
 
 #include <gtest/gtest.h>
 
-#include "../linked_list.h"
+#include "linked_list.h"
 
 namespace {
 
diff --git a/linker/linker.cpp b/linker/linker.cpp
index fafead4..8a70ca9 100644
--- a/linker/linker.cpp
+++ b/linker/linker.cpp
@@ -1158,14 +1158,6 @@
     fd = open_library_on_paths(zip_archive_cache, name, file_offset, ns->get_default_library_paths(), realpath);
   }
 
-  // TODO(dimitry): workaround for http://b/26394120 (the grey-list)
-  if (fd == -1 && ns->is_greylist_enabled() && is_greylisted(ns, name, needed_by)) {
-    // try searching for it on default_namespace default_library_path
-    fd = open_library_on_paths(zip_archive_cache, name, file_offset,
-                               g_default_namespace.get_default_library_paths(), realpath);
-  }
-  // END OF WORKAROUND
-
   return fd;
 }
 
@@ -1544,6 +1536,20 @@
     return true;
   }
 
+  // TODO(dimitry): workaround for http://b/26394120 (the grey-list)
+  if (ns->is_greylist_enabled() && is_greylisted(ns, task->get_name(), task->get_needed_by())) {
+    // For the libs in the greylist, switch to the default namespace and then
+    // try the load again from there. The library could be loaded from the
+    // default namespace or from another namespace (e.g. runtime) that is linked
+    // from the default namespace.
+    ns = &g_default_namespace;
+    if (load_library(ns, task, zip_archive_cache, load_tasks, rtld_flags,
+                     search_linked_namespaces)) {
+      return true;
+    }
+  }
+  // END OF WORKAROUND
+
   if (search_linked_namespaces) {
     // if a library was not found - look into linked namespaces
     // preserve current dlerror in the case it fails.
diff --git a/linker/tests/linker_block_allocator_test.cpp b/linker/linker_block_allocator_test.cpp
similarity index 98%
rename from linker/tests/linker_block_allocator_test.cpp
rename to linker/linker_block_allocator_test.cpp
index d5eb97c..359eefb 100644
--- a/linker/tests/linker_block_allocator_test.cpp
+++ b/linker/linker_block_allocator_test.cpp
@@ -32,7 +32,7 @@
 
 #include <gtest/gtest.h>
 
-#include "../linker_block_allocator.h"
+#include "linker_block_allocator.h"
 
 #include <unistd.h>
 
@@ -145,4 +145,3 @@
   testing::FLAGS_gtest_death_test_style = "threadsafe";
   ASSERT_EXIT(protect_all(), testing::KilledBySignal(SIGSEGV), "trying to access protected page");
 }
-
diff --git a/linker/tests/linker_config_test.cpp b/linker/linker_config_test.cpp
similarity index 99%
rename from linker/tests/linker_config_test.cpp
rename to linker/linker_config_test.cpp
index 14fd132..6a55bb2 100644
--- a/linker/tests/linker_config_test.cpp
+++ b/linker/linker_config_test.cpp
@@ -32,8 +32,8 @@
 
 #include <gtest/gtest.h>
 
-#include "../linker_config.h"
-#include "../linker_utils.h"
+#include "linker_config.h"
+#include "linker_utils.h"
 
 #include <unistd.h>
 
diff --git a/linker/linker_debug.h b/linker/linker_debug.h
index 862ea12..7a1cb3c 100644
--- a/linker/linker_debug.h
+++ b/linker/linker_debug.h
@@ -56,6 +56,7 @@
 #include <unistd.h>
 
 #include <async_safe/log.h>
+#include <async_safe/CHECK.h>
 
 __LIBC_HIDDEN__ extern int g_ld_debug_verbosity;
 
diff --git a/linker/linker_main.cpp b/linker/linker_main.cpp
index 7486cd7..9129a52 100644
--- a/linker/linker_main.cpp
+++ b/linker/linker_main.cpp
@@ -553,6 +553,24 @@
   async_safe_fatal("Could not find a PHDR: broken executable?");
 }
 
+// Detect an attempt to run the linker on itself. e.g.:
+//   /system/bin/linker64 /system/bin/linker64
+// Use priority-1 to run this constructor before other constructors.
+__attribute__((constructor(1))) static void detect_self_exec() {
+  // Normally, the linker initializes the auxv global before calling its
+  // constructors. If the linker loads itself, though, the first loader calls
+  // the second loader's constructors before calling __linker_init.
+  if (__libc_shared_globals()->auxv != nullptr) {
+    return;
+  }
+#if defined(__i386__)
+  // We don't have access to the auxv struct from here, so use the int 0x80
+  // fallback.
+  __libc_sysinfo = reinterpret_cast<void*>(__libc_int0x80);
+#endif
+  __linker_error("error: linker cannot load itself\n");
+}
+
 static ElfW(Addr) __attribute__((noinline))
 __linker_init_post_relocation(KernelArgumentBlock& args, soinfo& linker_so);
 
@@ -575,18 +593,8 @@
   // another program), AT_BASE is 0.
   ElfW(Addr) linker_addr = getauxval(AT_BASE);
   if (linker_addr == 0) {
-    // Detect an attempt to run the linker on itself (e.g.
-    // `linker64 /system/bin/linker64`). If the kernel loaded this instance of
-    // the linker, then AT_ENTRY will refer to &_start. If it doesn't, then
-    // something else must have loaded this instance of the linker. It's
-    // simpler if we only allow one copy of the linker to be loaded at a time.
-    if (getauxval(AT_ENTRY) != reinterpret_cast<uintptr_t>(&_start)) {
-      // The first linker already relocated this one and set up TLS, so we don't
-      // need further libc initialization.
-      __linker_error("error: linker cannot load itself\n");
-    }
-    // Otherwise, the AT_PHDR and AT_PHNUM aux values describe this linker
-    // instance, so use the phdr to find the linker's base address.
+    // The AT_PHDR and AT_PHNUM aux values describe this linker instance, so use
+    // the phdr to find the linker's base address.
     ElfW(Addr) load_bias;
     get_elf_base_from_phdr(
       reinterpret_cast<ElfW(Phdr)*>(getauxval(AT_PHDR)), getauxval(AT_PHNUM),
diff --git a/linker/tests/linker_sleb128_test.cpp b/linker/linker_sleb128_test.cpp
similarity index 98%
rename from linker/tests/linker_sleb128_test.cpp
rename to linker/linker_sleb128_test.cpp
index 551faf2..9e819c6 100644
--- a/linker/tests/linker_sleb128_test.cpp
+++ b/linker/linker_sleb128_test.cpp
@@ -32,7 +32,7 @@
 
 #include <gtest/gtest.h>
 
-#include "../linker_sleb128.h"
+#include "linker_sleb128.h"
 
 TEST(linker_sleb128, smoke) {
   std::vector<uint8_t> encoding;
diff --git a/linker/tests/linker_globals.cpp b/linker/linker_test_globals.cpp
similarity index 100%
rename from linker/tests/linker_globals.cpp
rename to linker/linker_test_globals.cpp
diff --git a/linker/linker_tls.cpp b/linker/linker_tls.cpp
index a3aa9bf..d2edbb3 100644
--- a/linker/linker_tls.cpp
+++ b/linker/linker_tls.cpp
@@ -30,6 +30,7 @@
 
 #include <vector>
 
+#include "async_safe/CHECK.h"
 #include "private/ScopedRWLock.h"
 #include "private/ScopedSignalBlocker.h"
 #include "private/bionic_defs.h"
diff --git a/linker/tests/linker_utils_test.cpp b/linker/linker_utils_test.cpp
similarity index 99%
rename from linker/tests/linker_utils_test.cpp
rename to linker/linker_utils_test.cpp
index e406af5..44907da 100644
--- a/linker/tests/linker_utils_test.cpp
+++ b/linker/linker_utils_test.cpp
@@ -32,7 +32,7 @@
 
 #include <gtest/gtest.h>
 
-#include "../linker_utils.h"
+#include "linker_utils.h"
 
 TEST(linker_utils, format_string) {
   std::vector<std::pair<std::string, std::string>> params = {{ "LIB", "lib32"}, { "SDKVER", "42"}};
diff --git a/linker/tests/Android.mk b/linker/tests/Android.mk
deleted file mode 100644
index 63e0555..0000000
--- a/linker/tests/Android.mk
+++ /dev/null
@@ -1,54 +0,0 @@
-#
-# Copyright (C) 2012 The Android Open Source Project
-# All rights reserved.
-#
-# Redistribution and use in source and binary forms, with or without
-# modification, are permitted provided that the following conditions
-# are met:
-#  * Redistributions of source code must retain the above copyright
-#    notice, this list of conditions and the following disclaimer.
-#  * Redistributions in binary form must reproduce the above copyright
-#    notice, this list of conditions and the following disclaimer in
-#    the documentation and/or other materials provided with the
-#    distribution.
-#
-# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
-# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
-# COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
-# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
-# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
-# OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
-# AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
-# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
-# OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
-# SUCH DAMAGE.
-#
-
-LOCAL_PATH:= $(call my-dir)
-
-include $(CLEAR_VARS)
-LOCAL_MODULE := linker-unit-tests
-LOCAL_MODULE_STEM_32 := $(LOCAL_MODULE)32
-LOCAL_MODULE_STEM_64 := $(LOCAL_MODULE)64
-
-LOCAL_ADDITIONAL_DEPENDENCIES := $(LOCAL_PATH)/Android.mk
-
-LOCAL_CFLAGS += -g -Wall -Wextra -Wunused -Werror
-LOCAL_C_INCLUDES := $(LOCAL_PATH)/../../libc/
-
-LOCAL_SRC_FILES := \
-  linker_block_allocator_test.cpp \
-  linker_config_test.cpp \
-  linker_globals.cpp \
-  linked_list_test.cpp \
-  linker_sleb128_test.cpp \
-  linker_utils_test.cpp \
-  ../linker_block_allocator.cpp \
-  ../linker_config.cpp \
-  ../linker_utils.cpp \
-
-LOCAL_STATIC_LIBRARIES += libasync_safe libbase liblog
-
-include $(BUILD_NATIVE_TEST)
diff --git a/tests/Android.bp b/tests/Android.bp
index c1d19fa..b039f00 100644
--- a/tests/Android.bp
+++ b/tests/Android.bp
@@ -40,7 +40,7 @@
     ],
     stl: "libc++",
     sanitize: {
-        never: true,
+        address: false,
     },
     bootstrap: true,
 }
diff --git a/tests/buffer_tests.cpp b/tests/buffer_tests.cpp
index 7563448..fb0b6d8 100644
--- a/tests/buffer_tests.cpp
+++ b/tests/buffer_tests.cpp
@@ -20,6 +20,7 @@
 
 #include <gtest/gtest.h>
 #include "buffer_tests.h"
+#include "utils.h"
 
 // For the comparison buffer tests, the maximum length to test for the
 // miscompare checks.
@@ -227,16 +228,11 @@
   }
 }
 
-// Malloc can return a tagged pointer, which is not accepted in mm system calls like mprotect.
-// Clear top 8 bits of the address on 64-bit platforms.
+// Malloc can return a tagged pointer, which is not accepted in mm system calls like mprotect
+// in the preliminary version of the syscall tagging support in the current Pixel 2 kernel.
+// Note: the final version of the kernel patchset may relax this requirement.
 static int MprotectHeap(void* addr, size_t len, int prot) {
-#if defined(__LP64__)
-  constexpr uintptr_t mask = (static_cast<uintptr_t>(1) << 56) - 1;
-  void* untagged_addr = reinterpret_cast<void*>(reinterpret_cast<uintptr_t>(addr) & mask);
-#else
-  void* untagged_addr = addr;
-#endif
-  return mprotect(untagged_addr, len, prot);
+  return mprotect(untag_address(addr), len, prot);
 }
 
 void RunSingleBufferAlignTest(
diff --git a/tests/dl_test.cpp b/tests/dl_test.cpp
index aea92b4..468ce3d 100644
--- a/tests/dl_test.cpp
+++ b/tests/dl_test.cpp
@@ -138,7 +138,7 @@
 
 TEST(dl, preinit_system_calls) {
 #if defined(__BIONIC__)
-  SKIP_WITH_HWASAN; // hwasan not initialized in preinit_array
+  SKIP_WITH_HWASAN; // hwasan not initialized in preinit_array, b/124007027
   std::string helper = GetTestlibRoot() +
       "/preinit_syscall_test_helper/preinit_syscall_test_helper";
   chmod(helper.c_str(), 0755); // TODO: "x" lost in CTS, b/34945607
@@ -150,6 +150,7 @@
 
 TEST(dl, preinit_getauxval) {
 #if defined(__BIONIC__)
+  SKIP_WITH_HWASAN; // hwasan not initialized in preinit_array, b/124007027
   std::string helper = GetTestlibRoot() +
       "/preinit_getauxval_test_helper/preinit_getauxval_test_helper";
   chmod(helper.c_str(), 0755); // TODO: "x" lost in CTS, b/34945607
diff --git a/tests/elftls_dl_test.cpp b/tests/elftls_dl_test.cpp
index e908fb9..36bdc3b 100644
--- a/tests/elftls_dl_test.cpp
+++ b/tests/elftls_dl_test.cpp
@@ -32,6 +32,7 @@
 #include <thread>
 
 #include "gtest_globals.h"
+#include "private/__get_tls.h"
 #include "utils.h"
 
 #if defined(__BIONIC__)
@@ -114,11 +115,25 @@
   }).join();
 }
 
+extern "C" int* missing_weak_tls_addr();
+
+// The Bionic linker resolves a TPREL relocation to an unresolved weak TLS
+// symbol to 0, which is added to the thread pointer. N.B.: A TPREL relocation
+// in a static executable is resolved by the static linker instead, and static
+// linker behavior varies (especially with bfd and gold). See
+// https://bugs.llvm.org/show_bug.cgi?id=40570.
+TEST(elftls_dl, tprel_missing_weak) {
+  ASSERT_EQ(static_cast<void*>(__get_tls()), missing_weak_tls_addr());
+  std::thread([] {
+    ASSERT_EQ(static_cast<void*>(__get_tls()), missing_weak_tls_addr());
+  }).join();
+}
+
 // The behavior of accessing an unresolved weak TLS symbol using a dynamic TLS
 // relocation depends on which kind of implementation the target uses. With
 // TLSDESC, the result is NULL. With __tls_get_addr, the result is the
 // generation count (or maybe undefined behavior)? This test only tests TLSDESC.
-TEST(elftls_dl, missing_weak) {
+TEST(elftls_dl, tlsdesc_missing_weak) {
 #if defined(__aarch64__)
   void* lib = dlopen("libtest_elftls_dynamic.so", RTLD_LOCAL | RTLD_NOW);
   ASSERT_NE(nullptr, lib);
diff --git a/tests/elftls_test.cpp b/tests/elftls_test.cpp
index 2d83d70..7c072b6 100644
--- a/tests/elftls_test.cpp
+++ b/tests/elftls_test.cpp
@@ -30,8 +30,6 @@
 
 #include <thread>
 
-#include "private/__get_tls.h"
-
 // Specify the LE access model explicitly. This file is compiled into the
 // bionic-unit-tests executable, but the compiler sees an -fpic object file
 // output into a static library, so it defaults to dynamic TLS accesses.
@@ -64,17 +62,9 @@
   }).join();
 }
 
-extern "C" int* missing_weak_tls_addr();
 extern "C" int bump_static_tls_var_1();
 extern "C" int bump_static_tls_var_2();
 
-TEST(elftls, tprel_missing_weak) {
-  ASSERT_EQ(static_cast<void*>(__get_tls()), missing_weak_tls_addr());
-  std::thread([] {
-    ASSERT_EQ(static_cast<void*>(__get_tls()), missing_weak_tls_addr());
-  }).join();
-}
-
 TEST(elftls, tprel_addend) {
   ASSERT_EQ(4, bump_static_tls_var_1());
   ASSERT_EQ(8, bump_static_tls_var_2());
diff --git a/tests/malloc_iterate_test.cpp b/tests/malloc_iterate_test.cpp
index 5e60a6d..76583eb 100644
--- a/tests/malloc_iterate_test.cpp
+++ b/tests/malloc_iterate_test.cpp
@@ -92,14 +92,15 @@
   test_data->total_allocated_bytes = 0;
 
   // Find all of the maps that are [anon:libc_malloc].
-  ASSERT_TRUE(android::procinfo::ReadMapFile("/proc/self/maps",
-    [&](uint64_t start, uint64_t end, uint16_t, uint64_t, const char* name) {
-    if (std::string(name) == "[anon:libc_malloc]") {
-      malloc_disable();
-      malloc_iterate(start, end - start, SavePointers, test_data);
-      malloc_enable();
-    }
-  }));
+  ASSERT_TRUE(android::procinfo::ReadMapFile(
+      "/proc/self/maps",
+      [&](uint64_t start, uint64_t end, uint16_t, uint64_t, ino_t, const char* name) {
+        if (std::string(name) == "[anon:libc_malloc]") {
+          malloc_disable();
+          malloc_iterate(start, end - start, SavePointers, test_data);
+          malloc_enable();
+        }
+      }));
 
   for (size_t i = 0; i < test_data->allocs.size(); i++) {
     EXPECT_EQ(1UL, test_data->allocs[i].count) << "Failed on size " << test_data->allocs[i].size;
@@ -180,14 +181,15 @@
   TestDataType test_data = {};
 
   // Find all of the maps that are not [anon:libc_malloc].
-  ASSERT_TRUE(android::procinfo::ReadMapFile("/proc/self/maps",
-    [&](uint64_t start, uint64_t end, uint16_t, uint64_t, const char* name) {
-    if (std::string(name) != "[anon:libc_malloc]") {
-      malloc_disable();
-      malloc_iterate(start, end - start, SavePointers, &test_data);
-      malloc_enable();
-    }
-  }));
+  ASSERT_TRUE(android::procinfo::ReadMapFile(
+      "/proc/self/maps",
+      [&](uint64_t start, uint64_t end, uint16_t, uint64_t, ino_t, const char* name) {
+        if (std::string(name) != "[anon:libc_malloc]") {
+          malloc_disable();
+          malloc_iterate(start, end - start, SavePointers, &test_data);
+          malloc_enable();
+        }
+      }));
 
   ASSERT_EQ(0UL, test_data.total_allocated_bytes);
 #else
diff --git a/tests/malloc_test.cpp b/tests/malloc_test.cpp
index 2506691..658f8bd 100644
--- a/tests/malloc_test.cpp
+++ b/tests/malloc_test.cpp
@@ -16,6 +16,7 @@
 
 #include <gtest/gtest.h>
 
+#include <elf.h>
 #include <limits.h>
 #include <stdint.h>
 #include <stdlib.h>
@@ -24,6 +25,8 @@
 
 #include <tinyxml2.h>
 
+#include <android-base/file.h>
+
 #include "private/bionic_config.h"
 #include "private/bionic_malloc.h"
 #include "utils.h"
@@ -515,6 +518,7 @@
 
 TEST(malloc, mallopt_decay) {
 #if defined(__BIONIC__)
+  SKIP_WITH_HWASAN; // hwasan does not implement mallopt
   errno = 0;
   ASSERT_EQ(1, mallopt(M_DECAY_TIME, 1));
   ASSERT_EQ(1, mallopt(M_DECAY_TIME, 0));
@@ -527,6 +531,7 @@
 
 TEST(malloc, mallopt_purge) {
 #if defined(__BIONIC__)
+  SKIP_WITH_HWASAN; // hwasan does not implement mallopt
   errno = 0;
   ASSERT_EQ(1, mallopt(M_PURGE, 0));
 #else
@@ -564,6 +569,7 @@
 
 TEST(malloc, mallinfo) {
 #if defined(__BIONIC__)
+  SKIP_WITH_HWASAN; // hwasan does not implement mallinfo
   static size_t sizes[] = {
     8, 32, 128, 4096, 32768, 131072, 1024000, 10240000, 20480000, 300000000
   };
@@ -585,10 +591,13 @@
       size_t new_allocated = mallinfo().uordblks;
       if (allocated != new_allocated) {
         size_t usable_size = malloc_usable_size(ptrs[i]);
-        ASSERT_GE(new_allocated, allocated + usable_size)
-            << "Failed at size " << size << " usable size " << usable_size;
-        pass = true;
-        break;
+        // Only check if the total got bigger by at least allocation size.
+        // Sometimes the mallinfo numbers can go backwards due to compaction
+        // and/or freeing of cached data.
+        if (new_allocated >= allocated + usable_size) {
+          pass = true;
+          break;
+        }
       }
     }
     for (void* ptr : ptrs) {
@@ -614,20 +623,48 @@
 #endif
 }
 
+bool IsDynamic() {
+#if defined(__LP64__)
+  Elf64_Ehdr ehdr;
+#else
+  Elf32_Ehdr ehdr;
+#endif
+  std::string path(android::base::GetExecutablePath());
+
+  int fd = open(path.c_str(), O_RDONLY | O_CLOEXEC);
+  if (fd == -1) {
+    // Assume dynamic on error.
+    return true;
+  }
+  bool read_completed = android::base::ReadFully(fd, &ehdr, sizeof(ehdr));
+  close(fd);
+  // Assume dynamic in error cases.
+  return !read_completed || ehdr.e_type == ET_DYN;
+}
+
 TEST(android_mallopt, init_zygote_child_profiling) {
 #if defined(__BIONIC__)
   // Successful call.
   errno = 0;
-  EXPECT_EQ(true, android_mallopt(M_INIT_ZYGOTE_CHILD_PROFILING, nullptr, 0));
-  EXPECT_EQ(0, errno);
+  if (IsDynamic()) {
+    EXPECT_EQ(true, android_mallopt(M_INIT_ZYGOTE_CHILD_PROFILING, nullptr, 0));
+    EXPECT_EQ(0, errno);
+  } else {
+    // Not supported in static executables.
+    EXPECT_EQ(false, android_mallopt(M_INIT_ZYGOTE_CHILD_PROFILING, nullptr, 0));
+    EXPECT_EQ(ENOTSUP, errno);
+  }
 
   // Unexpected arguments rejected.
   errno = 0;
   char unexpected = 0;
   EXPECT_EQ(false, android_mallopt(M_INIT_ZYGOTE_CHILD_PROFILING, &unexpected, 1));
-  EXPECT_EQ(EINVAL, errno);
+  if (IsDynamic()) {
+    EXPECT_EQ(EINVAL, errno);
+  } else {
+    EXPECT_EQ(ENOTSUP, errno);
+  }
 #else
   GTEST_LOG_(INFO) << "This tests a bionic implementation detail.\n";
 #endif
 }
-
diff --git a/tests/pthread_test.cpp b/tests/pthread_test.cpp
index 8da54ce..973ca53 100644
--- a/tests/pthread_test.cpp
+++ b/tests/pthread_test.cpp
@@ -1553,7 +1553,7 @@
   void* maps_stack_hi = nullptr;
   std::vector<map_record> maps;
   ASSERT_TRUE(Maps::parse_maps(&maps));
-  uintptr_t stack_address = reinterpret_cast<uintptr_t>(&maps_stack_hi);
+  uintptr_t stack_address = reinterpret_cast<uintptr_t>(untag_address(&maps_stack_hi));
   for (const auto& map : maps) {
     if (map.addr_start <= stack_address && map.addr_end > stack_address){
       maps_stack_hi = reinterpret_cast<void*>(map.addr_end);
@@ -1632,9 +1632,9 @@
 
   // Verify if the stack used by the signal handler is the alternate stack just registered.
   ASSERT_LE(getstack_signal_handler_arg.signal_stack_base, &attr);
-  ASSERT_LT(static_cast<void*>(&attr),
+  ASSERT_LT(static_cast<void*>(untag_address(&attr)),
             static_cast<char*>(getstack_signal_handler_arg.signal_stack_base) +
-            getstack_signal_handler_arg.signal_stack_size);
+                getstack_signal_handler_arg.signal_stack_size);
 
   // Verify if the main thread's stack got in the signal handler is correct.
   ASSERT_EQ(getstack_signal_handler_arg.main_stack_base, stack_base);
@@ -1693,7 +1693,7 @@
 
   // Test whether &local_variable is in [stack_base, stack_base + stack_size).
   ASSERT_LE(reinterpret_cast<char*>(stack_base), &local_variable);
-  ASSERT_LT(&local_variable, reinterpret_cast<char*>(stack_base) + stack_size);
+  ASSERT_LT(untag_address(&local_variable), reinterpret_cast<char*>(stack_base) + stack_size);
 }
 
 // Check whether something on stack is in the range of
diff --git a/tests/stack_protector_test.cpp b/tests/stack_protector_test.cpp
index 34e3c11..7a85cc3 100644
--- a/tests/stack_protector_test.cpp
+++ b/tests/stack_protector_test.cpp
@@ -104,6 +104,11 @@
 TEST_F(stack_protector_DeathTest, modify_stack_protector) {
   // In another file to prevent inlining, which removes stack protection.
   extern void modify_stack_protector_test();
+#if __has_feature(hwaddress_sanitizer)
+  ASSERT_EXIT(modify_stack_protector_test(),
+              testing::KilledBySignal(SIGABRT), "tag-mismatch");
+#else
   ASSERT_EXIT(modify_stack_protector_test(),
               testing::KilledBySignal(SIGABRT), "stack corruption detected");
+#endif
 }
diff --git a/tests/sys_ptrace_test.cpp b/tests/sys_ptrace_test.cpp
index 83fd93b..04dcd4e 100644
--- a/tests/sys_ptrace_test.cpp
+++ b/tests/sys_ptrace_test.cpp
@@ -35,6 +35,8 @@
 #include <android-base/macros.h>
 #include <android-base/unique_fd.h>
 
+#include "utils.h"
+
 using namespace std::chrono_literals;
 
 using android::base::unique_fd;
@@ -193,7 +195,7 @@
     return;
   }
 
-  set_watchpoint(child, uintptr_t(&data) + offset, size);
+  set_watchpoint(child, uintptr_t(untag_address(&data)) + offset, size);
 
   ASSERT_EQ(0, ptrace(PTRACE_CONT, child, nullptr, nullptr)) << strerror(errno);
   ASSERT_EQ(child, TEMP_FAILURE_RETRY(waitpid(child, &status, __WALL))) << strerror(errno);
diff --git a/tests/unistd_test.cpp b/tests/unistd_test.cpp
index f4a7f1f..cb94e45 100644
--- a/tests/unistd_test.cpp
+++ b/tests/unistd_test.cpp
@@ -538,7 +538,7 @@
 
 static int CloneStartRoutine(int (*start_routine)(void*)) {
   void* child_stack[1024];
-  return clone(start_routine, &child_stack[1024], SIGCHLD, nullptr);
+  return clone(start_routine, untag_address(&child_stack[1024]), SIGCHLD, nullptr);
 }
 
 static int GetPidCachingCloneStartRoutine(void*) {
diff --git a/tests/utils.h b/tests/utils.h
index 5fc1d93..cc1aa8c 100644
--- a/tests/utils.h
+++ b/tests/utils.h
@@ -66,6 +66,16 @@
 
 #define SKIP_WITH_HWASAN if (running_with_hwasan()) { return; }
 
+static inline void* untag_address(void* addr) {
+#if defined(__LP64__)
+  if (running_with_hwasan()) {
+    constexpr uintptr_t mask = (static_cast<uintptr_t>(1) << 56) - 1;
+    addr = reinterpret_cast<void*>(reinterpret_cast<uintptr_t>(addr) & mask);
+  }
+#endif
+  return addr;
+}
+
 #if defined(__linux__)
 
 #include <sys/sysmacros.h>
diff --git a/tools/Android.mk b/tools/Android.mk
deleted file mode 100644
index 4dd66fe..0000000
--- a/tools/Android.mk
+++ /dev/null
@@ -1,19 +0,0 @@
-#
-# Copyright (C) 2015 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-
-LOCAL_PATH := $(call my-dir)
-
-include $(call all-subdir-makefiles)