diff --git a/core/Makefile b/core/Makefile
index 7c4c28b..82d68a3 100644
--- a/core/Makefile
+++ b/core/Makefile
@@ -1110,8 +1110,8 @@
     $(hide) mkdir -p $(4)/lib/modules/0.0/$(3)lib/modules
     $(hide) cp $(1) $(4)/lib/modules/0.0/$(3)lib/modules
     $(hide) $(DEPMOD) -b $(4) 0.0
-    $(hide) sed -e 's/\(.*modules.*\):/\/\1:/g' -e 's/ \([^ ]*modules[^ ]*\)/ \/\1/g' -i $(4)/lib/modules/0.0/modules.dep
-    $(hide) cp $(4)/lib/modules/0.0/modules.dep $(2)/lib/modules
+    $(hide) sed -e 's/\(.*modules.*\):/\/\1:/g' -e 's/ \([^ ]*modules[^ ]*\)/ \/\1/g' $(4)/lib/modules/0.0/modules.dep > $(2)/lib/modules/modules.dep
+    $(hide) cp $(4)/lib/modules/0.0/modules.alias $(2)/lib/modules
 endef
 
 # $(1): output file
diff --git a/core/combo/javac.mk b/core/combo/javac.mk
index 5c2668c..36ac2aa 100644
--- a/core/combo/javac.mk
+++ b/core/combo/javac.mk
@@ -16,16 +16,20 @@
 
 common_jdk_flags := -Xmaxerrs 9999999
 
+ANDROID_JAVA_HOME := prebuilts/jdk/jdk8/$(HOST_PREBUILT_TAG)
+ANDROID_JAVA_TOOLCHAIN := $(ANDROID_JAVA_HOME)/bin
+export JAVA_HOME := $(abspath $(ANDROID_JAVA_HOME))
+
 # Use the indexer wrapper to index the codebase instead of the javac compiler
 ifeq ($(ALTERNATE_JAVAC),)
-JAVACC := javac
+JAVACC := $(ANDROID_JAVA_TOOLCHAIN)/javac
 else
 JAVACC := $(ALTERNATE_JAVAC)
 endif
 
-JAVA := java
-JAVADOC := javadoc
-JAR := jar
+JAVA := $(ANDROID_JAVA_TOOLCHAIN)/java
+JAVADOC := $(ANDROID_JAVA_TOOLCHAIN)/javadoc
+JAR := $(ANDROID_JAVA_TOOLCHAIN)/jar
 
 # The actual compiler can be wrapped by setting the JAVAC_WRAPPER var.
 ifdef JAVAC_WRAPPER
@@ -34,16 +38,8 @@
     endif
 endif
 
-# Whatever compiler is on this system.
 COMMON_JAVAC := $(JAVACC) -J-Xmx2048M $(common_jdk_flags)
 
-# Eclipse.
-ifeq ($(CUSTOM_JAVA_COMPILER), eclipse)
-    COMMON_JAVAC := java -Xmx256m -jar prebuilt/common/ecj/ecj.jar -5 \
-        -maxProblems 9999999 -nowarn
-    $(info CUSTOM_JAVA_COMPILER=eclipse)
-endif
-
 GLOBAL_JAVAC_DEBUG_FLAGS := -g
 
 HOST_JAVAC ?= $(COMMON_JAVAC)
diff --git a/core/config.mk b/core/config.mk
index 41f2a44..351802d 100644
--- a/core/config.mk
+++ b/core/config.mk
@@ -676,22 +676,13 @@
 
 COLUMN:= column
 
-# We may not have the right JAVA_HOME/PATH set up yet when this is run from envsetup.sh.
-ifneq ($(CALLED_FROM_SETUP),true)
-
 # Path to tools.jar, or empty if EXPERIMENTAL_USE_OPENJDK9 is set
 HOST_JDK_TOOLS_JAR :=
 # TODO: Remove HOST_JDK_TOOLS_JAR and all references to it once OpenJDK 8
 # toolchains are no longer supported (i.e. when what is now
 # EXPERIMENTAL_USE_OPENJDK9 becomes the standard). http://b/38418220
 ifeq ($(EXPERIMENTAL_USE_OPENJDK9),)
-HOST_JDK_TOOLS_JAR := $(shell $(BUILD_SYSTEM)/find-jdk-tools-jar.sh)
-
-ifneq ($(HOST_JDK_TOOLS_JAR),)
-ifeq ($(wildcard $(HOST_JDK_TOOLS_JAR)),)
-$(error Error: could not find jdk tools.jar at $(HOST_JDK_TOOLS_JAR), please check if your JDK was installed correctly)
-endif
-endif
+HOST_JDK_TOOLS_JAR := $(ANDROID_JAVA_TOOLCHAIN)/../lib/tools.jar
 endif # ifeq ($(EXPERIMENTAL_USE_OPENJDK9),)
 
 # Is the host JDK 64-bit version?
@@ -699,7 +690,6 @@
 ifneq ($(filter 64-Bit, $(shell $(JAVA) -version 2>&1)),)
 HOST_JDK_IS_64BIT_VERSION := true
 endif
-endif  # CALLED_FROM_SETUP not true
 
 # It's called md5 on Mac OS and md5sum on Linux
 ifeq ($(HOST_OS),darwin)
@@ -849,6 +839,17 @@
 unexport JAVA_HOME
 export ANDROID_BUILD_PATHS:=$(abspath $(BUILD_SYSTEM)/no_java_path):$(ANDROID_BUILD_PATHS)
 export PATH:=$(abspath $(BUILD_SYSTEM)/no_java_path):$(PATH)
+else
+  # Put java first on the path
+  # TODO(ccross): remove this once tools run during the build no longer depend on
+  # finding java in the path
+  ifeq (,$(strip $(CALLED_FROM_SETUP)))
+    ifneq ($(shell which java),$(abspath $(ANDROID_JAVA_TOOLCHAIN)/java))
+      $(warning Found incorrect java $(shell which java) in $$PATH)
+      $(warning Adding $(abspath $(ANDROID_JAVA_TOOLCHAIN)) to $$PATH)
+      export PATH:=$(abspath $(ANDROID_JAVA_TOOLCHAIN)):$(PATH)
+    endif
+  endif
 endif
 
 # Projects clean of compiler warnings should be compiled with -Werror.
diff --git a/core/config_sanitizers.mk b/core/config_sanitizers.mk
index ce7ece3..c011284 100644
--- a/core/config_sanitizers.mk
+++ b/core/config_sanitizers.mk
@@ -22,6 +22,18 @@
   endif
 endif
 
+# Disable global integer_overflow in excluded paths.
+ifneq ($(filter integer_overflow, $(my_global_sanitize)),)
+  combined_exclude_paths := $(INTEGER_OVERFLOW_EXCLUDE_PATHS) \
+                            $(PRODUCT_INTEGER_OVERFLOW_EXCLUDE_PATHS)
+
+  ifneq ($(strip $(foreach dir,$(subst $(comma),$(space),$(combined_exclude_paths)),\
+         $(filter $(dir)%,$(LOCAL_PATH)))),)
+    my_global_sanitize := $(filter-out integer_overflow,$(my_global_sanitize))
+    my_global_sanitize_diag := $(filter-out integer_overflow,$(my_global_sanitize_diag))
+  endif
+endif
+
 ifneq ($(my_global_sanitize),)
   my_sanitize := $(my_global_sanitize) $(my_sanitize)
 endif
@@ -103,17 +115,8 @@
   endif
 endif
 
+# Disable integer_overflow if LOCAL_NOSANITIZE=integer.
 ifneq ($(filter integer_overflow, $(my_global_sanitize) $(my_sanitize)),)
-  # Disable integer_overflow in excluded paths.
-  combined_exclude_paths := $(INTEGER_OVERFLOW_EXCLUDE_PATHS) \
-                            $(PRODUCT_INTEGER_OVERFLOW_EXCLUDE_PATHS)
-
-  ifneq ($(strip $(foreach dir,$(subst $(comma),$(space),$(combined_exclude_paths)),\
-         $(filter $(dir)%,$(LOCAL_PATH)))),)
-    my_sanitize := $(filter-out integer_overflow,$(my_sanitize))
-    my_sanitize_diag := $(filter-out integer_overflow,$(my_sanitize_diag))
-  endif
-  # Disable integer_overflow if LOCAL_NOSANITIZE=integer.
   ifneq ($(filter integer, $(strip $(LOCAL_NOSANITIZE))),)
     my_sanitize := $(filter-out integer_overflow,$(my_sanitize))
     my_sanitize_diag := $(filter-out integer_overflow,$(my_sanitize_diag))
diff --git a/core/definitions.mk b/core/definitions.mk
index d436820..a36b34c 100644
--- a/core/definitions.mk
+++ b/core/definitions.mk
@@ -2527,6 +2527,7 @@
 endef
 
 # --add-opens is required because desugar reflects via java.lang.invoke.MethodHandles.Lookup
+# --desugar_try_with_resources_if_needed=false is needed due to b/63180735, b/63901645, b/63900665
 define desugar-classes-jar
 @echo Desugar: $@
 @mkdir -p $(dir $@)
@@ -2540,6 +2541,7 @@
     $(addprefix --bootclasspath_entry ,$(call desugar-bootclasspath,$(PRIVATE_BOOTCLASSPATH))) \
     $(addprefix --classpath_entry ,$(PRIVATE_ALL_JAVA_LIBRARIES)) \
     --min_sdk_version $(call codename-or-sdk-to-sdk,$(PRIVATE_DEFAULT_APP_TARGET_SDK)) \
+    --desugar_try_with_resources_if_needed=false \
     --allow_empty_bootclasspath \
     $(if $(filter --core-library,$(PRIVATE_DX_FLAGS)),--core_library) \
     -i $< -o $@.tmp
diff --git a/core/droiddoc.mk b/core/droiddoc.mk
index 4f5b1bc..e98df2f 100644
--- a/core/droiddoc.mk
+++ b/core/droiddoc.mk
@@ -86,8 +86,7 @@
 full_java_lib_deps := $(call java-lib-deps,$(LOCAL_JAVA_LIBRARIES)) $(LOCAL_CLASSPATH)
 endif # !LOCAL_IS_HOST_MODULE
 
-$(full_target): PRIVATE_CLASSPATH := $(subst $(space),:,$(full_java_libs))
-
+$(full_target): PRIVATE_CLASSPATH := $(call normalize-path-list,$(full_java_libs))
 
 intermediates.COMMON := $(call local-intermediates-dir,COMMON)
 
diff --git a/core/find-jdk-tools-jar.sh b/core/find-jdk-tools-jar.sh
deleted file mode 100755
index ac0b3b6..0000000
--- a/core/find-jdk-tools-jar.sh
+++ /dev/null
@@ -1,20 +0,0 @@
-#!/bin/sh
-if [ "x$ANDROID_JAVA_HOME" != x ] && [ -e "$ANDROID_JAVA_HOME/lib/tools.jar" ] ; then
-    echo $ANDROID_JAVA_HOME/lib/tools.jar
-else
-    JAVAC=$(realpath $(which javac) 2>/dev/null)
-    if [ -z "$JAVAC" ]; then
-        JAVAC=$(readlink -f $(which javac) 2>/dev/null)
-    fi
-    if [ -z "$JAVAC" ]; then
-        JAVAC=$(which javac)
-    fi
-    if [ -z "$JAVAC" ] ; then
-        exit 1
-    fi
-    while [ -L "$JAVAC" ] ; do
-        LSLINE=$(ls -l "$JAVAC")
-        JAVAC=$(echo -n "$LSLINE" | sed -e "s/.* -> //")
-    done
-    echo $JAVAC | sed -e 's:\(.*\)/javac$:\1/../lib/tools.jar:'
-fi
diff --git a/envsetup.sh b/envsetup.sh
index d2bcd36..dca817a 100644
--- a/envsetup.sh
+++ b/envsetup.sh
@@ -248,13 +248,11 @@
     export PATH=$ANDROID_BUILD_PATHS$PATH
     export PYTHONPATH=$T/development/python-packages:$PYTHONPATH
 
-    unset ANDROID_JAVA_TOOLCHAIN
-    unset ANDROID_PRE_BUILD_PATHS
-    if [ -n "$JAVA_HOME" ]; then
-        export ANDROID_JAVA_TOOLCHAIN=$JAVA_HOME/bin
-        export ANDROID_PRE_BUILD_PATHS=$ANDROID_JAVA_TOOLCHAIN:
-        export PATH=$ANDROID_PRE_BUILD_PATHS$PATH
-    fi
+    export ANDROID_JAVA_HOME=$(get_abs_build_var ANDROID_JAVA_HOME)
+    export JAVA_HOME=$ANDROID_JAVA_HOME
+    export ANDROID_JAVA_TOOLCHAIN=$(get_abs_build_var ANDROID_JAVA_TOOLCHAIN)
+    export ANDROID_PRE_BUILD_PATHS=$ANDROID_JAVA_TOOLCHAIN:
+    export PATH=$ANDROID_PRE_BUILD_PATHS$PATH
 
     unset ANDROID_PRODUCT_OUT
     export ANDROID_PRODUCT_OUT=$(get_abs_build_var PRODUCT_OUT)
@@ -287,7 +285,6 @@
 function set_stuff_for_environment()
 {
     settitle
-    set_java_home
     setpaths
     set_sequence_number
 
@@ -1528,46 +1525,6 @@
     \cd $T/$pathname
 }
 
-# Force JAVA_HOME to point to java 1.7/1.8 if it isn't already set.
-function set_java_home() {
-    # Clear the existing JAVA_HOME value if we set it ourselves, so that
-    # we can reset it later, depending on the version of java the build
-    # system needs.
-    #
-    # If we don't do this, the JAVA_HOME value set by the first call to
-    # build/envsetup.sh will persist forever.
-    if [ -n "$ANDROID_SET_JAVA_HOME" ]; then
-      export JAVA_HOME=""
-    fi
-
-    if [ ! "$JAVA_HOME" ]; then
-      if [ -n "$LEGACY_USE_JAVA7" ]; then
-        echo Warning: Support for JDK 7 will be dropped. Switch to JDK 8.
-        case `uname -s` in
-            Darwin)
-                export JAVA_HOME=$(/usr/libexec/java_home -v 1.7)
-                ;;
-            *)
-                export JAVA_HOME=/usr/lib/jvm/java-7-openjdk-amd64
-                ;;
-        esac
-      else
-        case `uname -s` in
-            Darwin)
-                export JAVA_HOME=$(/usr/libexec/java_home -v 1.8)
-                ;;
-            *)
-                export JAVA_HOME=/usr/lib/jvm/java-8-openjdk-amd64
-                ;;
-        esac
-      fi
-
-      # Keep track of the fact that we set JAVA_HOME ourselves, so that
-      # we can change it on the next envsetup.sh, if required.
-      export ANDROID_SET_JAVA_HOME=true
-    fi
-}
-
 # Print colored exit condition
 function pez {
     "$@"
diff --git a/target/board/generic/sepolicy/goldfish_setup.te b/target/board/generic/sepolicy/goldfish_setup.te
index a863aa6..78d20fc 100644
--- a/target/board/generic/sepolicy/goldfish_setup.te
+++ b/target/board/generic/sepolicy/goldfish_setup.te
@@ -1,5 +1,5 @@
 # goldfish-setup service: runs init.goldfish.sh script
-type goldfish_setup, domain, domain_deprecated;
+type goldfish_setup, domain;
 type goldfish_setup_exec, exec_type, file_type;
 
 init_daemon_domain(goldfish_setup)
diff --git a/target/board/generic/sepolicy/qemu_props.te b/target/board/generic/sepolicy/qemu_props.te
index 95174d6..d5571fd 100644
--- a/target/board/generic/sepolicy/qemu_props.te
+++ b/target/board/generic/sepolicy/qemu_props.te
@@ -1,5 +1,5 @@
 # qemu-props service:  Sets system properties on boot.
-type qemu_props, domain, domain_deprecated;
+type qemu_props, domain;
 type qemu_props_exec, exec_type, file_type;
 
 init_daemon_domain(qemu_props)
diff --git a/target/board/generic/sepolicy/qemud.te b/target/board/generic/sepolicy/qemud.te
index 797cf5c..eee21c4 100644
--- a/target/board/generic/sepolicy/qemud.te
+++ b/target/board/generic/sepolicy/qemud.te
@@ -1,5 +1,5 @@
 # qemu support daemon
-type qemud, domain, domain_deprecated;
+type qemud, domain;
 type qemud_exec, exec_type, file_type;
 
 init_daemon_domain(qemud)
diff --git a/tools/releasetools/add_img_to_target_files.py b/tools/releasetools/add_img_to_target_files.py
index 4ff4213..1ce22e7 100755
--- a/tools/releasetools/add_img_to_target_files.py
+++ b/tools/releasetools/add_img_to_target_files.py
@@ -376,7 +376,27 @@
 
   args = OPTIONS.info_dict.get("avb_vbmeta_args")
   if args and args.strip():
-    cmd.extend(shlex.split(args))
+    split_args = shlex.split(args)
+    for index, arg in enumerate(split_args[:-1]):
+      # Sanity check that the image file exists. Some images might be defined
+      # as a path relative to source tree, which may not be available at the
+      # same location when running this script (we have the input target_files
+      # zip only). For such cases, we additionally scan other locations (e.g.
+      # IMAGES/, RADIO/, etc) before bailing out.
+      if arg == '--include_descriptors_from_image':
+        image_path = split_args[index + 1]
+        if os.path.exists(image_path):
+          continue
+        found = False
+        for dir in ['IMAGES', 'RADIO', 'VENDOR_IMAGES', 'PREBUILT_IMAGES']:
+          alt_path = os.path.join(
+              OPTIONS.input_tmp, dir, os.path.basename(image_path))
+          if os.path.exists(alt_path):
+            split_args[index + 1] = alt_path
+            found = True
+            break
+        assert found, 'failed to find %s' % (image_path,)
+    cmd.extend(split_args)
 
   p = common.Run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
   p.communicate()