Previously this was mixed with vcruntime, with some objects being shared. But this is messy. Instead use a separate library and link ucrtbase to this as well. This also matches more closely how native libraries are organized, where vcstartup is merged into the CRT import libraries, while vcruntime is merged into the static CRT libraries.
GCC was optimizing away the xor with __security_cookie when passing nullptr_t, because the return value was also nullptr_t, assuming it must be nullptr.
__acrt_initialize is here as a stub to later support linking ucrt statically. When it is statically linked the real function should be called, but when the executable links to ucrtdll, the initialization happens when the DLL is loaded, so we call a stub here.
vcruntime contains the code that is linked into ucrtbase (in VS it is also provided as vcruntime140.dll)
vcstartup contains the code that is statically linked into executables that link to ucrtbase.dll. In Visual Studio this is part of msvcrt.lib (the import library for msvcrt), similar to our current msvcrtex, and it gets linked when you link to ucrtbase as well. The name is based on the folder name in the library.
Both libraries share some code, but each file is only compiled once.
Timo Kreuzer