diff --git a/Android.bp b/Android.bp
index 376c250..72ab6c0 100644
--- a/Android.bp
+++ b/Android.bp
@@ -20,6 +20,7 @@
     src: "dummy_mountpoint",
     library: true,
     symlinks: ["libc.so"],
+    mountsource: "libc",
 }
 
 bionic_mountpoint {
@@ -28,6 +29,7 @@
     src: "dummy_mountpoint",
     library: true,
     symlinks: ["libdl.so"],
+    mountsource: "libdl",
 }
 
 bionic_mountpoint {
@@ -36,6 +38,7 @@
     src: "dummy_mountpoint",
     library: true,
     symlinks: ["libm.so"],
+    mountsource: "libm",
 }
 
 bionic_mountpoint {
@@ -49,4 +52,5 @@
     src: "dummy_mountpoint",
     binary: true,
     symlinks: ["linker", "linker_asan"],
+    mountsource: "linker",
 }
diff --git a/build/Android.bp b/build/Android.bp
index 6cc160a..acd0ee2 100644
--- a/build/Android.bp
+++ b/build/Android.bp
@@ -24,6 +24,7 @@
         "blueprint-proptools",
         "soong",
         "soong-android",
+        "soong-cc",
     ],
     srcs: [
         "bionic.go",
diff --git a/build/bionic.go b/build/bionic.go
index 3522aca..93c2494 100644
--- a/build/bionic.go
+++ b/build/bionic.go
@@ -19,9 +19,11 @@
 	"io"
 	"strings"
 
+	"github.com/google/blueprint"
 	"github.com/google/blueprint/proptools"
 
 	"android/soong/android"
+	"android/soong/cc"
 )
 
 // bionic_mountpoint is a module type that is specialized to create
@@ -60,17 +62,24 @@
 	outputFile android.Path
 	pathInPartition string
 	stem string
+	unstrippedOutputFile android.Path
 }
 
 type bionicMountpointProperties struct {
 	// The file that is installed as the mount point
 	Src *string
 
+	// TODO(jiyong) remove these two properties (probably Stem and Suffix
+	// as well, as they can be inteffered from Mountsource
+
 	// True if the mount point is for a Bionic library such libc.so
 	Library *bool
 	// True if the mount point is for a Bionic binary such as linker
 	Binary *bool
 
+	// The module that this module is a mount point for
+	Mountsource *string
+
 	// Base name of the mount point
 	Stem *string `android:"arch_variant"`
 
@@ -82,6 +91,13 @@
 	Symlinks []string
 }
 
+type dependencyTag struct {
+	blueprint.BaseDependencyTag
+	name string
+}
+
+var mountsourceTag = dependencyTag{name: "mountsource"}
+
 func (m *bionicMountpoint) DepsMutator(ctx android.BottomUpMutatorContext) {
 	if Bool(m.properties.Library) == Bool(m.properties.Binary) {
 		ctx.ModuleErrorf("either binary or library must be set to true")
@@ -95,6 +111,17 @@
 		ctx.PropertyErrorf("src", "src must be set")
 	}
 	android.ExtractSourceDeps(ctx, m.properties.Src)
+
+	if m.properties.Mountsource == nil {
+		ctx.PropertyErrorf("mountsource", "mountsource must be set")
+		return
+	}
+
+	ctx.AddFarVariationDependencies([]blueprint.Variation{
+		{Mutator: "arch", Variation: ctx.Target().String()},
+		{Mutator: "image", Variation: "core"},
+		{Mutator: "link", Variation: "shared"},
+	}, mountsourceTag, String(m.properties.Mountsource))
 }
 
 func (m *bionicMountpoint) GenerateAndroidBuildActions(ctx android.ModuleContext) {
@@ -110,6 +137,12 @@
 	m.stem = String(m.properties.Stem) + String(m.properties.Suffix)
 
 	m.outputFile = ctx.ExpandSource(String(m.properties.Src), "src")
+
+	ctx.VisitDirectDepsWithTag(mountsourceTag, func(module android.Module) {
+		if cc, ok := module.(*cc.Module); ok {
+			m.unstrippedOutputFile = cc.UnstrippedOutputFile()
+		}
+	})
 }
 
 func (m *bionicMountpoint) AndroidMk() android.AndroidMkData {
@@ -148,7 +181,10 @@
 				}
 				fmt.Fprintln(w, "LOCAL_POST_INSTALL_CMD := " + strings.Join(cmds, " && "))
 			}
-			fmt.Fprintln(w, "include $(BUILD_PREBUILT)")
+			if m.unstrippedOutputFile != nil {
+				fmt.Fprintln(w, "LOCAL_SOONG_UNSTRIPPED_BINARY :=", m.unstrippedOutputFile.String())
+			}
+			fmt.Fprintln(w, "include $(BUILD_SYSTEM)/soong_cc_prebuilt.mk")
 		},
 	}
 }
diff --git a/libc/Android.bp b/libc/Android.bp
index 40f0aae..1487975 100644
--- a/libc/Android.bp
+++ b/libc/Android.bp
@@ -78,6 +78,7 @@
     recovery_available: true,
 
     // TODO(ivanlozano): Remove after b/118321713
+    no_libcrt: true,
     xom: false,
 }
 
diff --git a/libc/bionic/malloc_common.h b/libc/bionic/malloc_common.h
index 94a6df4..a2f338a 100644
--- a/libc/bionic/malloc_common.h
+++ b/libc/bionic/malloc_common.h
@@ -37,6 +37,18 @@
 #if __has_feature(hwaddress_sanitizer)
 
 #include <sanitizer/hwasan_interface.h>
+
+__BEGIN_DECLS
+
+// FIXME: implement these in HWASan allocator.
+int __sanitizer_iterate(uintptr_t base, size_t size,
+                        void (*callback)(uintptr_t base, size_t size, void* arg),
+                        void* arg);
+void __sanitizer_malloc_disable();
+void __sanitizer_malloc_enable();
+
+__END_DECLS
+
 #define Malloc(function)  __sanitizer_ ## function
 
 #else // __has_feature(hwaddress_sanitizer)
diff --git a/libc/bionic/malloc_common_dynamic.cpp b/libc/bionic/malloc_common_dynamic.cpp
index 1c3f53f..ce3e761 100644
--- a/libc/bionic/malloc_common_dynamic.cpp
+++ b/libc/bionic/malloc_common_dynamic.cpp
@@ -303,23 +303,25 @@
   return true;
 }
 
-static void InstallHooks(libc_globals* globals, const char* options, const char* prefix,
+static bool InstallHooks(libc_globals* globals, const char* options, const char* prefix,
                          const char* shared_lib) {
   void* impl_handle = LoadSharedLibrary(shared_lib, prefix, &globals->malloc_dispatch_table);
   if (impl_handle == nullptr) {
-    return;
+    return false;
   }
 
   init_func_t init_func = reinterpret_cast<init_func_t>(gFunctions[FUNC_INITIALIZE]);
   if (!init_func(&__libc_malloc_default_dispatch, &gMallocLeakZygoteChild, options)) {
     error_log("%s: failed to enable malloc %s", getprogname(), prefix);
     ClearGlobalFunctions();
-    return;
+    return false;
   }
 
   if (!FinishInstallHooks(globals, options, prefix)) {
     dlclose(impl_handle);
+    return false;
   }
+  return true;
 }
 
 // Initializes memory allocation framework once per process.
@@ -329,16 +331,25 @@
 
   // Prefer malloc debug since it existed first and is a more complete
   // malloc interceptor than the hooks.
+  bool hook_installed = false;
   if (CheckLoadMallocDebug(&options)) {
-    InstallHooks(globals, options, kDebugPrefix, kDebugSharedLib);
+    hook_installed = InstallHooks(globals, options, kDebugPrefix, kDebugSharedLib);
   } else if (CheckLoadMallocHooks(&options)) {
-    InstallHooks(globals, options, kHooksPrefix, kHooksSharedLib);
-  } else if (HeapprofdShouldLoad()) {
-    HeapprofdInstallHooksAtInit(globals);
+    hook_installed = InstallHooks(globals, options, kHooksPrefix, kHooksSharedLib);
   }
 
-  // Install this last to avoid as many race conditions as possible.
-  HeapprofdInstallSignalHandler();
+  if (!hook_installed) {
+    if (HeapprofdShouldLoad()) {
+      HeapprofdInstallHooksAtInit(globals);
+    }
+
+    // Install this last to avoid as many race conditions as possible.
+    HeapprofdInstallSignalHandler();
+  } else {
+    // Install a signal handler that prints an error since we don't support
+    // heapprofd and any other hook to be installed at the same time.
+    HeapprofdInstallErrorSignalHandler();
+  }
 }
 
 // Initializes memory allocation framework.
diff --git a/libc/bionic/malloc_heapprofd.cpp b/libc/bionic/malloc_heapprofd.cpp
index fb7266a..c492bac 100644
--- a/libc/bionic/malloc_heapprofd.cpp
+++ b/libc/bionic/malloc_heapprofd.cpp
@@ -211,6 +211,16 @@
   sigaction(kHeapprofdSignal, &action, nullptr);
 }
 
+static void DisplayError(int) {
+  error_log("Cannot install heapprofd while malloc debug/malloc hooks are enabled.");
+}
+
+void HeapprofdInstallErrorSignalHandler() {
+  struct sigaction action = {};
+  action.sa_handler = DisplayError;
+  sigaction(kHeapprofdSignal, &action, nullptr);
+}
+
 static void CommonInstallHooks(libc_globals* globals) {
   void* impl_handle = atomic_load(&gHeapprofdHandle);
   bool reusing_handle = impl_handle != nullptr;
diff --git a/libc/bionic/malloc_heapprofd.h b/libc/bionic/malloc_heapprofd.h
index 91188b9..5a766fc 100644
--- a/libc/bionic/malloc_heapprofd.h
+++ b/libc/bionic/malloc_heapprofd.h
@@ -38,4 +38,6 @@
 
 void HeapprofdInstallSignalHandler();
 
+void HeapprofdInstallErrorSignalHandler();
+
 bool HeapprofdMallopt(int optcode, void* arg, size_t arg_size);
diff --git a/libc/malloc_debug/PointerData.cpp b/libc/malloc_debug/PointerData.cpp
index 638061b..6e9d24f 100644
--- a/libc/malloc_debug/PointerData.cpp
+++ b/libc/malloc_debug/PointerData.cpp
@@ -266,12 +266,12 @@
   error_log("  hash_index %zu does not have matching frame data.", hash_index);
 }
 
-void PointerData::LogFreeError(const FreePointerInfoType& info, size_t usable_size) {
+void PointerData::LogFreeError(const FreePointerInfoType& info, size_t max_cmp_bytes) {
   error_log(LOG_DIVIDER);
   uint8_t* memory = reinterpret_cast<uint8_t*>(info.pointer);
   error_log("+++ ALLOCATION %p USED AFTER FREE", memory);
   uint8_t fill_free_value = g_debug->config().fill_free_value();
-  for (size_t i = 0; i < usable_size; i++) {
+  for (size_t i = 0; i < max_cmp_bytes; i++) {
     if (memory[i] != fill_free_value) {
       error_log("  allocation[%zu] = 0x%02x (expected 0x%02x)", i, memory[i], fill_free_value);
     }
@@ -314,11 +314,12 @@
   size_t bytes = (usable_size < g_debug->config().fill_on_free_bytes())
                      ? usable_size
                      : g_debug->config().fill_on_free_bytes();
+  size_t max_cmp_bytes = bytes;
   const uint8_t* memory = reinterpret_cast<const uint8_t*>(info.pointer);
   while (bytes > 0) {
     size_t bytes_to_cmp = (bytes < g_cmp_mem.size()) ? bytes : g_cmp_mem.size();
     if (memcmp(memory, g_cmp_mem.data(), bytes_to_cmp) != 0) {
-      LogFreeError(info, usable_size);
+      LogFreeError(info, max_cmp_bytes);
     }
     bytes -= bytes_to_cmp;
     memory = &memory[bytes_to_cmp];
diff --git a/libc/malloc_debug/tests/malloc_debug_unit_tests.cpp b/libc/malloc_debug/tests/malloc_debug_unit_tests.cpp
index 44f9795..6da95ca 100644
--- a/libc/malloc_debug/tests/malloc_debug_unit_tests.cpp
+++ b/libc/malloc_debug/tests/malloc_debug_unit_tests.cpp
@@ -990,6 +990,35 @@
   ASSERT_STREQ("", getFakeLogPrint().c_str());
 }
 
+TEST_F(MallocDebugTest, free_track_pointer_modified_after_free) {
+  Init("free_track=4 fill_on_free=2 free_track_backtrace_num_frames=0");
+
+  void* pointers[5];
+  for (size_t i = 0; i < sizeof(pointers) / sizeof(void*); i++) {
+    pointers[i] = debug_malloc(100);
+    ASSERT_TRUE(pointers[i] != nullptr);
+    memset(pointers[i], 0, 100);
+  }
+
+  debug_free(pointers[0]);
+
+  // overwrite the whole pointer, only expect errors on the fill bytes we check.
+  memset(pointers[0], 0x20, 100);
+
+  for (size_t i = 1; i < sizeof(pointers) / sizeof(void*); i++) {
+    debug_free(pointers[i]);
+  }
+
+  std::string expected_log(DIVIDER);
+  expected_log += android::base::StringPrintf("6 malloc_debug +++ ALLOCATION %p USED AFTER FREE\n",
+                                              pointers[0]);
+  expected_log += "6 malloc_debug   allocation[0] = 0x20 (expected 0xef)\n";
+  expected_log += "6 malloc_debug   allocation[1] = 0x20 (expected 0xef)\n";
+  expected_log += DIVIDER;
+  ASSERT_STREQ("", getFakeLogBuf().c_str());
+  ASSERT_STREQ(expected_log.c_str(), getFakeLogPrint().c_str());
+}
+
 TEST_F(MallocDebugTest, get_malloc_leak_info_invalid) {
   Init("fill");
 
diff --git a/libc/upstream-netbsd/common/lib/libc/stdlib/random.c b/libc/upstream-netbsd/common/lib/libc/stdlib/random.c
index e7503c7..0e6eac0 100644
--- a/libc/upstream-netbsd/common/lib/libc/stdlib/random.c
+++ b/libc/upstream-netbsd/common/lib/libc/stdlib/random.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: random.c,v 1.4 2014/06/12 20:59:46 christos Exp $	*/
+/*	$NetBSD: random.c,v 1.5 2016/02/08 05:27:24 dholland Exp $	*/
 
 /*
  * Copyright (c) 1983, 1993
@@ -35,7 +35,7 @@
 #if 0
 static char sccsid[] = "@(#)random.c	8.2 (Berkeley) 5/19/95";
 #else
-__RCSID("$NetBSD: random.c,v 1.4 2014/06/12 20:59:46 christos Exp $");
+__RCSID("$NetBSD: random.c,v 1.5 2016/02/08 05:27:24 dholland Exp $");
 #endif
 #endif /* LIBC_SCCS and not lint */
 
@@ -92,7 +92,7 @@
  * state information, which will allow a degree seven polynomial.  (Note:
  * the zeroeth word of state information also has some other information
  * stored in it -- see setstate() for details).
- * 
+ *
  * The random number generation technique is a linear feedback shift register
  * approach, employing trinomials (since there are fewer terms to sum up that
  * way).  In this approach, the least significant bit of all the numbers in
@@ -318,12 +318,12 @@
  * the break values for the different R.N.G.'s, we choose the best (largest)
  * one we can and set things up for it.  srandom() is then called to
  * initialize the state information.
- * 
+ *
  * Note that on return from srandom(), we set state[-1] to be the type
  * multiplexed with the current value of the rear pointer; this is so
  * successive calls to initstate() won't lose this information and will be
  * able to restart with setstate().
- * 
+ *
  * Note: the first thing we do is save the current state, if any, just like
  * setstate() so that it doesn't matter when initstate is called.
  *
@@ -511,7 +511,7 @@
 {
 	static u_long randseed = 1;
 	long x, hi, lo, t;
- 
+
 	/*
 	 * Compute x[n + 1] = (7^5 * x[n]) mod (2^31 - 1).
 	 * From "Random number generators: good ones are hard to find",
diff --git a/libc/upstream-netbsd/lib/libc/include/isc/dst.h b/libc/upstream-netbsd/lib/libc/include/isc/dst.h
index 5537e3d..a25cf01 100644
--- a/libc/upstream-netbsd/lib/libc/include/isc/dst.h
+++ b/libc/upstream-netbsd/lib/libc/include/isc/dst.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: dst.h,v 1.1.1.4 2009/04/12 16:35:44 christos Exp $	*/
+/*	$NetBSD: dst.h,v 1.2 2014/08/03 19:14:24 wiz Exp $	*/
 
 #ifndef DST_H
 #define DST_H
@@ -55,7 +55,7 @@
 #define	dst_write_key		__dst_write_key
 
 /* 
- * DST Crypto API defintions 
+ * DST Crypto API definitions 
  */
 void     dst_init(void);
 int      dst_check_algorithm(const int);
diff --git a/libc/upstream-netbsd/lib/libc/regex/regcomp.c b/libc/upstream-netbsd/lib/libc/regex/regcomp.c
index 6af9734..4a0d99a 100644
--- a/libc/upstream-netbsd/lib/libc/regex/regcomp.c
+++ b/libc/upstream-netbsd/lib/libc/regex/regcomp.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: regcomp.c,v 1.36 2015/09/12 19:08:47 christos Exp $	*/
+/*	$NetBSD: regcomp.c,v 1.38 2019/02/07 22:22:31 christos Exp $	*/
 
 /*-
  * Copyright (c) 1992, 1993, 1994
@@ -76,7 +76,7 @@
 #if 0
 static char sccsid[] = "@(#)regcomp.c	8.5 (Berkeley) 3/20/94";
 #else
-__RCSID("$NetBSD: regcomp.c,v 1.36 2015/09/12 19:08:47 christos Exp $");
+__RCSID("$NetBSD: regcomp.c,v 1.38 2019/02/07 22:22:31 christos Exp $");
 #endif
 #endif /* LIBC_SCCS and not lint */
 
@@ -474,6 +474,8 @@
 		REQUIRE(!MORE() || !isdigit((unsigned char)PEEK()), REG_BADRPT);
 		/* FALLTHROUGH */
 	default:
+		if (p->error != 0)
+			return;
 		ordinary(p, c);
 		break;
 	}
@@ -692,6 +694,8 @@
 		REQUIRE(starordinary, REG_BADRPT);
 		/* FALLTHROUGH */
 	default:
+		if (p->error != 0)
+			return(0);
 		ordinary(p, c &~ BACKSL);
 		break;
 	}
@@ -1007,7 +1011,7 @@
 	}
 	len = p->next - sp;
 	for (cp = cnames; cp->name != NULL; cp++)
-		if (strncmp(cp->name, sp, len) == 0 && cp->name[len] == '\0')
+		if (strncmp(cp->name, sp, len) == 0 && strlen(cp->name) == len)
 			return(cp->code);	/* known name */
 	if (len == 1)
 		return(*sp);	/* single character */
diff --git a/libdl/Android.bp b/libdl/Android.bp
index c17e72e..43ddbfe 100644
--- a/libdl/Android.bp
+++ b/libdl/Android.bp
@@ -92,6 +92,7 @@
 
     nocrt: true,
     system_shared_libs: [],
+    native_coverage: false,
 
     // This is placeholder library the actual implementation is (currently)
     // provided by the linker.
diff --git a/libm/Android.bp b/libm/Android.bp
index 079220b..ec319e2 100644
--- a/libm/Android.bp
+++ b/libm/Android.bp
@@ -509,6 +509,7 @@
     stl: "none",
 
     // TODO(ivanlozano): Remove after b/118321713
+    no_libcrt: true,
     xom: false,
 
     stubs: {
diff --git a/linker/Android.bp b/linker/Android.bp
index fed921d..06a942d 100644
--- a/linker/Android.bp
+++ b/linker/Android.bp
@@ -296,6 +296,10 @@
         },
     },
     system_shared_libs: [],
+
+    // Opt out of native_coverage when opting out of system_shared_libs
+    native_coverage: false,
+
     target: {
         android: {
             static_libs: ["libdebuggerd_handler_fallback"],
@@ -364,6 +368,9 @@
     nocrt: true,
     system_shared_libs: [],
 
+    // Opt out of native_coverage when opting out of system_shared_libs
+    native_coverage: false,
+
     sanitize: {
         never: true,
     },