diff --git a/build/apex/ld.config.txt b/build/apex/ld.config.txt
index 69e6543..014b115 100644
--- a/build/apex/ld.config.txt
+++ b/build/apex/ld.config.txt
@@ -24,4 +24,8 @@
 namespace.platform.isolated = true
 namespace.platform.search.paths = /system/${LIB}
 namespace.platform.links = default
-namespace.platform.link.default.shared_libs = libc.so:libdl.so:libm.so
+namespace.platform.link.default.shared_libs  = libc.so:libdl.so:libm.so
+namespace.platform.link.default.shared_libs += libart.so:libartd.so
+namespace.platform.link.default.shared_libs += libnativebridge.so
+namespace.platform.link.default.shared_libs += libnativehelper.so
+namespace.platform.link.default.shared_libs += libnativeloader.so
diff --git a/runtime/gc/space/image_space.cc b/runtime/gc/space/image_space.cc
index 4f9b3f9..9080ed6 100644
--- a/runtime/gc/space/image_space.cc
+++ b/runtime/gc/space/image_space.cc
@@ -1021,32 +1021,30 @@
           app_oat_(app_oat) {}
 
     // Return the relocated address of a heap object.
+    // Null checks must be performed in the caller (for performance reasons).
     template <typename T>
     ALWAYS_INLINE T* ForwardObject(T* src) const {
+      DCHECK(src != nullptr);
       const uintptr_t uint_src = reinterpret_cast<uintptr_t>(src);
       if (boot_image_.InSource(uint_src)) {
         return reinterpret_cast<T*>(boot_image_.ToDest(uint_src));
       }
-      if (app_image_.InSource(uint_src)) {
-        return reinterpret_cast<T*>(app_image_.ToDest(uint_src));
-      }
       // Since we are fixing up the app image, there should only be pointers to the app image and
       // boot image.
-      DCHECK(src == nullptr) << reinterpret_cast<const void*>(src);
-      return src;
+      DCHECK(app_image_.InSource(uint_src)) << reinterpret_cast<const void*>(src);
+      return reinterpret_cast<T*>(app_image_.ToDest(uint_src));
     }
 
     // Return the relocated address of a code pointer (contained by an oat file).
+    // Null checks must be performed in the caller (for performance reasons).
     ALWAYS_INLINE const void* ForwardCode(const void* src) const {
+      DCHECK(src != nullptr);
       const uintptr_t uint_src = reinterpret_cast<uintptr_t>(src);
       if (boot_image_.InSource(uint_src)) {
         return reinterpret_cast<const void*>(boot_image_.ToDest(uint_src));
       }
-      if (app_oat_.InSource(uint_src)) {
-        return reinterpret_cast<const void*>(app_oat_.ToDest(uint_src));
-      }
-      DCHECK(src == nullptr) << src;
-      return src;
+      DCHECK(app_oat_.InSource(uint_src)) << src;
+      return reinterpret_cast<const void*>(app_oat_.ToDest(uint_src));
     }
 
     // Must be called on pointers that already have been relocated to the destination relocation.
@@ -1116,9 +1114,12 @@
       // Space is not yet added to the heap, don't do a read barrier.
       mirror::Object* ref = obj->GetFieldObject<mirror::Object, kVerifyNone, kWithoutReadBarrier>(
           offset);
-      // Use SetFieldObjectWithoutWriteBarrier to avoid card marking since we are writing to the
-      // image.
-      obj->SetFieldObjectWithoutWriteBarrier<false, true, kVerifyNone>(offset, ForwardObject(ref));
+      if (ref != nullptr) {
+        // Use SetFieldObjectWithoutWriteBarrier to avoid card marking since we are writing to the
+        // image.
+        obj->SetFieldObjectWithoutWriteBarrier<false, true, kVerifyNone>(
+            offset, ForwardObject(ref));
+      }
     }
 
     // java.lang.ref.Reference visitor.
@@ -1126,9 +1127,11 @@
                     ObjPtr<mirror::Reference> ref) const
         REQUIRES_SHARED(Locks::mutator_lock_) REQUIRES(Locks::heap_bitmap_lock_) {
       mirror::Object* obj = ref->GetReferent<kWithoutReadBarrier>();
-      ref->SetFieldObjectWithoutWriteBarrier<false, true, kVerifyNone>(
-          mirror::Reference::ReferentOffset(),
-          ForwardObject(obj));
+      if (obj != nullptr) {
+        ref->SetFieldObjectWithoutWriteBarrier<false, true, kVerifyNone>(
+            mirror::Reference::ReferentOffset(),
+            ForwardObject(obj));
+      }
     }
 
     void operator()(mirror::Object* obj) const
diff --git a/tools/build_linux_bionic.sh b/tools/build_linux_bionic.sh
index 94ccc41..d3c1912 100755
--- a/tools/build_linux_bionic.sh
+++ b/tools/build_linux_bionic.sh
@@ -42,6 +42,7 @@
 
 out_dir=$(get_build_var OUT_DIR)
 host_out=$(get_build_var HOST_OUT)
+mk_product_out=$(get_build_var PRODUCT_OUT)
 
 # TODO(b/31559095) Figure out a better way to do this.
 #
@@ -52,6 +53,12 @@
 cat $out_dir/soong/soong.variables > ${tmp_soong_var}
 build/soong/soong_ui.bash --make-mode clean
 mkdir -p $out_dir/soong
+mkdir -p $mk_product_out
+
+# TODO(b/31559095) Soong will panic if this file isn't present. It contains
+# information from MAKE needed to let soong handle the invocation of dex2oat.
+# This would be great to have but for now isn't needed.
+echo "{}" > $mk_product_out/dexpreopt.config
 
 python3 <<END - ${tmp_soong_var} ${out_dir}/soong/soong.variables
 import json