diff --git a/infra/oss-fuzz/build_fuzzers b/infra/oss-fuzz/build_fuzzers
index 7d18aa1..792f2ed 100755
--- a/infra/oss-fuzz/build_fuzzers
+++ b/infra/oss-fuzz/build_fuzzers
@@ -6,13 +6,20 @@
 
 mkdir -p $WORK/build
 
+# sanitize=vptr needs RTTI, which we do not compile with.
+CXXFLAGS="$CXXFLAGS -fno-sanitize=vptr"
+
 GN_ARGS="is_clang=true is_debug=false is_fuzzer=true use_libfuzzer=false \
-link_fuzzer=\"-lFuzzingEngine\" is_asan=true is_hermetic_clang=false \
+link_fuzzer=\"-lFuzzingEngine\" is_hermetic_clang=false \
 use_custom_libcxx=false \
 extra_cflags=\"$CFLAGS -Wno-implicit-int-float-conversion\" \
 extra_cxxflags=\"$CXXFLAGS\" extra_ldflags=\"$CXXFLAGS\" \
 is_system_compiler=true cc=\"$CC\" cxx=\"$CXX\" linker=\"gold\""
 
+if [ "$SANITIZER" = "address" ]; then
+  GN_ARGS="$GN_ARGS is_asan=true";
+fi;
+
 OUTDIR=$WORK/build
 $SRC/perfetto/tools/gn gen "$OUTDIR" --args="${GN_ARGS}" --check
 
diff --git a/protos/perfetto/trace/perfetto_trace.proto b/protos/perfetto/trace/perfetto_trace.proto
index 03e659e..97a465e 100644
--- a/protos/perfetto/trace/perfetto_trace.proto
+++ b/protos/perfetto/trace/perfetto_trace.proto
@@ -6335,6 +6335,9 @@
 message ChromeMessagePump {
   // True if there are sent messages in the queue.
   optional bool sent_messages_in_queue = 1;
+  // Interned SourceLocation of IO handler that MessagePumpForIO is about to
+  // invoke.
+  optional uint64 io_handler_location_iid = 2;
 }
 
 // End of protos/perfetto/trace/track_event/chrome_message_pump.proto
diff --git a/protos/perfetto/trace/track_event/chrome_message_pump.proto b/protos/perfetto/trace/track_event/chrome_message_pump.proto
index 56bf50a..866fdfb 100644
--- a/protos/perfetto/trace/track_event/chrome_message_pump.proto
+++ b/protos/perfetto/trace/track_event/chrome_message_pump.proto
@@ -22,4 +22,7 @@
 message ChromeMessagePump {
   // True if there are sent messages in the queue.
   optional bool sent_messages_in_queue = 1;
+  // Interned SourceLocation of IO handler that MessagePumpForIO is about to
+  // invoke.
+  optional uint64 io_handler_location_iid = 2;
 }
diff --git a/src/profiling/symbolizer/filesystem_posix.cc b/src/profiling/symbolizer/filesystem_posix.cc
index f66cbca..cc983e2 100644
--- a/src/profiling/symbolizer/filesystem_posix.cc
+++ b/src/profiling/symbolizer/filesystem_posix.cc
@@ -33,6 +33,7 @@
 #if PERFETTO_BUILDFLAG(PERFETTO_LOCAL_SYMBOLIZER)
 bool WalkDirectories(std::vector<std::string> dirs, FileCallback fn) {
   std::vector<char*> dir_cstrs;
+  dir_cstrs.reserve(dirs.size());
   for (std::string& dir : dirs)
     dir_cstrs.emplace_back(&dir[0]);
   dir_cstrs.push_back(nullptr);
diff --git a/src/profiling/symbolizer/subprocess_posix.cc b/src/profiling/symbolizer/subprocess_posix.cc
index 26408a8..691aa1b 100644
--- a/src/profiling/symbolizer/subprocess_posix.cc
+++ b/src/profiling/symbolizer/subprocess_posix.cc
@@ -32,6 +32,7 @@
     : input_pipe_(base::Pipe::Create(base::Pipe::kBothBlock)),
       output_pipe_(base::Pipe::Create(base::Pipe::kBothBlock)) {
   std::vector<char*> c_str_args;
+  c_str_args.reserve(args.size());
   for (std::string& arg : args)
     c_str_args.push_back(&(arg[0]));
   c_str_args.push_back(nullptr);
diff --git a/src/protozero/protoc_plugin/protozero_plugin.cc b/src/protozero/protoc_plugin/protozero_plugin.cc
index 531a772..1537c71 100644
--- a/src/protozero/protoc_plugin/protozero_plugin.cc
+++ b/src/protozero/protoc_plugin/protozero_plugin.cc
@@ -246,6 +246,7 @@
   void CollectDescriptors() {
     // Collect message descriptors in DFS order.
     std::vector<const Descriptor*> stack;
+    stack.reserve(static_cast<size_t>(source_->message_type_count()));
     for (int i = 0; i < source_->message_type_count(); ++i)
       stack.push_back(source_->message_type(i));
 
diff --git a/src/trace_processor/importers/proto/track_event_parser.cc b/src/trace_processor/importers/proto/track_event_parser.cc
index 4b6c1981..4e7a91c 100644
--- a/src/trace_processor/importers/proto/track_event_parser.cc
+++ b/src/trace_processor/importers/proto/track_event_parser.cc
@@ -723,7 +723,11 @@
     auto opt_slice_id = context_->slice_tracker->Scoped(
         ts_, track_id_, category_id_, name_id_, duration_ns,
         [this](BoundInserter* inserter) { ParseTrackEventArgs(inserter); });
-    if (utid_ && opt_slice_id.has_value()) {
+    if (!opt_slice_id.has_value()) {
+      return util::OkStatus();
+    }
+    MaybeParseFlowEvents();
+    if (utid_) {
       auto* thread_slices = storage_->mutable_thread_slices();
       PERFETTO_DCHECK(!thread_slices->slice_count() ||
                       thread_slices->slice_ids().back() < opt_slice_id.value());
@@ -738,9 +742,13 @@
     auto opt_slice_id = context_->slice_tracker->Begin(
         ts_, track_id_, category_id_, name_id_,
         [this](BoundInserter* inserter) { ParseTrackEventArgs(inserter); });
+    if (!opt_slice_id.has_value()) {
+      return util::OkStatus();
+    }
+    MaybeParseFlowEvents();
     // For the time beeing, we only create vtrack slice rows if we need to
     // store thread timestamps/counters.
-    if (legacy_event_.use_async_tts() && opt_slice_id.has_value()) {
+    if (legacy_event_.use_async_tts()) {
       auto* vtrack_slices = storage_->mutable_virtual_track_slices();
       PERFETTO_DCHECK(!vtrack_slices->slice_count() ||
                       vtrack_slices->slice_ids().back() < opt_slice_id.value());
@@ -773,7 +781,11 @@
     auto opt_slice_id = context_->slice_tracker->Scoped(
         ts_, track_id_, category_id_, name_id_, duration_ns,
         [this](BoundInserter* inserter) { ParseTrackEventArgs(inserter); });
-    if (legacy_event_.use_async_tts() && opt_slice_id.has_value()) {
+    if (!opt_slice_id.has_value()) {
+      return util::OkStatus();
+    }
+    MaybeParseFlowEvents();
+    if (legacy_event_.use_async_tts()) {
       auto* vtrack_slices = storage_->mutable_virtual_track_slices();
       PERFETTO_DCHECK(!vtrack_slices->slice_count() ||
                       vtrack_slices->slice_ids().back() < opt_slice_id.value());
diff --git a/src/traced/probes/ftrace/atrace_hal_wrapper.cc b/src/traced/probes/ftrace/atrace_hal_wrapper.cc
index 78f4114..361c00a 100644
--- a/src/traced/probes/ftrace/atrace_hal_wrapper.cc
+++ b/src/traced/probes/ftrace/atrace_hal_wrapper.cc
@@ -57,6 +57,7 @@
     if (!enable_categories_)
       return false;
     std::vector<const char*> args;
+    args.reserve(categories.size());
     for (const std::string& category : categories) {
       args.push_back(category.c_str());
     }
diff --git a/test/end_to_end_shared_memory_fuzzer.cc b/test/end_to_end_shared_memory_fuzzer.cc
index 782cc30..91f3629 100644
--- a/test/end_to_end_shared_memory_fuzzer.cc
+++ b/test/end_to_end_shared_memory_fuzzer.cc
@@ -140,12 +140,20 @@
   std::function<void()> on_produced_and_committed_;
 };
 
+class FuzzTestHelper : public TestHelper {
+ public:
+  explicit FuzzTestHelper(base::TestTaskRunner* task_runner)
+      : TestHelper(task_runner) {}
+  // Do not verify the data, as it will most likely be corrupted.
+  void ReadTraceData(std::vector<TracePacket>) override {}
+};
+
 int FuzzSharedMemory(const uint8_t* data, size_t size);
 
 int FuzzSharedMemory(const uint8_t* data, size_t size) {
   base::TestTaskRunner task_runner;
 
-  TestHelper helper(&task_runner);
+  FuzzTestHelper helper(&task_runner);
   helper.StartServiceIfRequired();
 
   auto cp =
diff --git a/test/test_helper.cc b/test/test_helper.cc
index 9885e84..840751b 100644
--- a/test/test_helper.cc
+++ b/test/test_helper.cc
@@ -59,7 +59,7 @@
   on_stop_tracing_callback_ = nullptr;
 }
 
-void TestHelper::OnTraceData(std::vector<TracePacket> packets, bool has_more) {
+void TestHelper::ReadTraceData(std::vector<TracePacket> packets) {
   for (auto& encoded_packet : packets) {
     protos::gen::TracePacket packet;
     PERFETTO_CHECK(
@@ -73,7 +73,10 @@
     PERFETTO_CHECK(packet.has_trusted_uid());
     trace_.push_back(std::move(packet));
   }
+}
 
+void TestHelper::OnTraceData(std::vector<TracePacket> packets, bool has_more) {
+  ReadTraceData(std::move(packets));
   if (!has_more) {
     std::move(on_packets_finished_callback_)();
   }
diff --git a/test/test_helper.h b/test/test_helper.h
index 8985cf5..771ee2a 100644
--- a/test/test_helper.h
+++ b/test/test_helper.h
@@ -196,6 +196,7 @@
   void OnConnect() override;
   void OnDisconnect() override;
   void OnTracingDisabled(const std::string& error) override;
+  virtual void ReadTraceData(std::vector<TracePacket> packets);
   void OnTraceData(std::vector<TracePacket> packets, bool has_more) override;
   void OnDetach(bool) override;
   void OnAttach(bool, const TraceConfig&) override;
diff --git a/test/trace_processor/track_event/flow_events_track_event.out b/test/trace_processor/track_event/flow_events_track_event.out
index df28e99..895f2a1 100644
--- a/test/trace_processor/track_event/flow_events_track_event.out
+++ b/test/trace_processor/track_event/flow_events_track_event.out
@@ -2,3 +2,6 @@
 "FlowSlice1Start","FlowSlice1End"
 "FlowSlice1Start2Start","FlowSlice1End"
 "FlowSlice1Start2Start","FlowSlice2End"
+"FlowSlice3Begin","FlowSlice3End4Begin"
+"FlowSlice3End4Begin","FlowSlice4Step"
+"FlowSlice4Step","FlowSlice4End"
diff --git a/test/trace_processor/track_event/flow_events_track_event.textproto b/test/trace_processor/track_event/flow_events_track_event.textproto
index fcd3788..af20150 100644
--- a/test/trace_processor/track_event/flow_events_track_event.textproto
+++ b/test/trace_processor/track_event/flow_events_track_event.textproto
@@ -79,6 +79,20 @@
     }
   }
 }
+
+packet {
+  timestamp: 58000
+  trusted_packet_sequence_id: 1
+  track_event {
+    name: "FlowSlice3Begin"
+    categories: "test"
+    track_uuid: 2,
+    flow_ids: 3,
+    legacy_event {
+      phase: 73 # 'I'
+    }
+  }
+}
 packet {
   timestamp: 59000
   trusted_packet_sequence_id: 1
@@ -93,3 +107,70 @@
     }
   }
 }
+packet {
+  trusted_packet_sequence_id: 1
+  timestamp: 0
+  track_descriptor {
+    uuid: 11
+    name: "async"
+  }
+}
+packet {
+  timestamp: 60000
+  trusted_packet_sequence_id: 1
+  track_event {
+    name: "FlowSlice3End4Begin"
+    categories: "test"
+    track_uuid: 11,
+    terminating_flow_ids: 3,
+    flow_ids: 4,
+    type: 1, # 'TYPE_SLICE_BEGIN'
+  }
+}
+packet {
+  timestamp: 61000
+  trusted_packet_sequence_id: 1
+  track_event {
+    name: "FlowSlice4Step"
+    categories: "test"
+    track_uuid: 11,
+    flow_ids: 4,
+    type: 3, # 'TYPE_SLICE_INSTANT'
+  }
+}
+packet {
+  timestamp: 62000
+  trusted_packet_sequence_id: 1
+  track_event {
+    name: "FlowSlice3End4Begin"
+    categories: "test"
+    track_uuid: 11,
+    type: 2, # 'TYPE_SLICE_END'
+  }
+}
+packet {
+  trusted_packet_sequence_id: 1
+  timestamp: 0
+  track_descriptor {
+    uuid: 13
+    name: "processTrack"
+    process {
+      pid: 3
+      process_name: "processTrack"
+    }
+  }
+}
+packet {
+  timestamp: 65000
+  trusted_packet_sequence_id: 1
+  track_event {
+    name: "FlowSlice4End"
+    categories: "test"
+    track_uuid: 13,
+    terminating_flow_ids: 4,
+    legacy_event {
+      phase: 105  # 'i'
+      instant_event_scope: 2  # SCOPE_PROCESS
+    }
+  }
+}
diff --git a/ui/src/common/actions.ts b/ui/src/common/actions.ts
index 7a590ef..7ddd662 100644
--- a/ui/src/common/actions.ts
+++ b/ui/src/common/actions.ts
@@ -244,6 +244,9 @@
       COUNTER_TRACK_KIND,
       ASYNC_SLICE_TRACK_KIND
     ];
+    // Use a numeric collator so threads are sorted as T1, T2, ..., T10, T11,
+    // rather than T1, T10, T11, ..., T2, T20, T21 .
+    const coll = new Intl.Collator([], {sensitivity: 'base', numeric: true});
     for (const group of Object.values(state.trackGroups)) {
       group.tracks.sort((a: string, b: string) => {
         const aKind = threadTrackOrder.indexOf(state.tracks[a].kind);
@@ -258,13 +261,7 @@
           } else if (state.tracks[b].isMainThread) {
             return 1;
           }
-          if (aName > bName) {
-            return 1;
-          } else if (aName === bName) {
-            return 0;
-          } else {
-            return -1;
-          }
+          return coll.compare(aName, bName);
         } else {
           if (aKind === -1) return 1;
           if (bKind === -1) return -1;
diff --git a/ui/src/controller/track_decider.ts b/ui/src/controller/track_decider.ts
index 9e4863a..c59f5af 100644
--- a/ui/src/controller/track_decider.ts
+++ b/ui/src/controller/track_decider.ts
@@ -444,7 +444,7 @@
     from thread_counter_track
     join thread using(utid)
     left join process using(upid)
-    where thread_counter_track.name not in ('time_in_state')
+    where thread_counter_track.name not in ('time_in_state', 'thread_time')
   `);
 
   const it = iter(
diff --git a/ui/src/frontend/record_page.ts b/ui/src/frontend/record_page.ts
index d10b7a1..05b46a1 100644
--- a/ui/src/frontend/record_page.ts
+++ b/ui/src/frontend/record_page.ts
@@ -186,14 +186,32 @@
 }
 
 function PowerSettings(cssClass: string) {
+  const DOC_URL = 'https://perfetto.dev/docs/data-sources/battery-counters';
+  const descr =
+      [m('div',
+         m('span', `Polls charge counters and instantaneous power draw from
+                    the battery power management IC and the power rails from
+                    the PowerStats HAL (`),
+         m('a', {href: DOC_URL, target: '_blank'}, 'see docs for more'),
+         m('span', ')'))];
+  if (globals.isInternalUser) {
+    descr.push(m(
+        'div',
+        m('span', 'Googlers: See '),
+        m('a',
+          {href: 'http://go/power-rails-internal-doc', target: '_blank'},
+          'this doc'),
+        m('span', ` for instructions on how to change the refault rail selection
+                  on internal devices.`),
+        ));
+  }
   return m(
       `.record-section${cssClass}`,
       m(Probe,
         {
-          title: 'Battery drain',
+          title: 'Battery drain & power rails',
           img: 'rec_battery_counters.png',
-          descr: `Polls charge counters and instantaneous power draw from
-                    the battery power management IC.`,
+          descr,
           setEnabled: (cfg, val) => cfg.batteryDrain = val,
           isEnabled: (cfg) => cfg.batteryDrain
         } as ProbeAttrs,
diff --git a/ui/src/frontend/record_widgets.ts b/ui/src/frontend/record_widgets.ts
index 9558919..c31545e 100644
--- a/ui/src/frontend/record_widgets.ts
+++ b/ui/src/frontend/record_widgets.ts
@@ -51,7 +51,7 @@
 export interface ProbeAttrs {
   title: string;
   img: string|null;
-  descr: string;
+  descr: m.Children;
   isEnabled: Getter<boolean>;
   setEnabled: Setter<boolean>;
 }