diff --git a/lib/thirdpartylibs.xml b/lib/thirdpartylibs.xml
index 71400eaf826..646bbda24b7 100644
--- a/lib/thirdpartylibs.xml
+++ b/lib/thirdpartylibs.xml
@@ -193,7 +193,7 @@
     <location>xhprof</location>
     <name>XHProf</name>
     <license>Apache</license>
-    <version>0.9.2</version>
+    <version>0.9.4</version>
     <licenseversion>2.0</licenseversion>
   </library>
   <library>
diff --git a/lib/xhprof/CREDITS b/lib/xhprof/CREDITS
index fd032202e5f..1b9af6b82b1 100644
--- a/lib/xhprof/CREDITS
+++ b/lib/xhprof/CREDITS
@@ -1,5 +1,7 @@
 Originally developed at Facebook, XHProf was open sourced in Mar, 2009.
 
+XHProf is now maintained by Phacility.
+
 Creators:
   Changhao Jiang
   Kannan Muthukkaruppan
@@ -9,4 +11,3 @@ Creators:
 Additional Contributors:
   George Cabrera      - UI enhancements
   Paul Saab           - FreeBSD port
-
diff --git a/lib/xhprof/LICENSE b/lib/xhprof/LICENSE
index f433b1a53f5..d9a10c0d8e8 100644
--- a/lib/xhprof/LICENSE
+++ b/lib/xhprof/LICENSE
@@ -1,4 +1,3 @@
-
                                  Apache License
                            Version 2.0, January 2004
                         http://www.apache.org/licenses/
diff --git a/lib/xhprof/README b/lib/xhprof/README
index 309dcfe2a6f..a8c15fa9283 100644
--- a/lib/xhprof/README
+++ b/lib/xhprof/README
@@ -3,5 +3,3 @@ For installation and usage notes refer to:
 
 To view the latest version of the doc, go to:
   http://pecl.php.net/package/xhprof ---> [View Documentation]
-
-
diff --git a/lib/xhprof/readme_moodle.txt b/lib/xhprof/readme_moodle.txt
index c9b85f09e81..0b03949283c 100644
--- a/lib/xhprof/readme_moodle.txt
+++ b/lib/xhprof/readme_moodle.txt
@@ -1,4 +1,4 @@
-Description of XHProf 0.9.2 library/viewer import into Moodle
+Description of XHProf 0.9.4 library/viewer import into Moodle
 
 Removed (commit #1):
  * .arcconfig - Definitions for arcanist/phabricator removed completely
@@ -37,3 +37,4 @@ TODO:
 20110318 - MDL-26891 - Eloy Lafuente (stronk7): Implemented earlier profiling runs
 20130621 - MDL-39733 - Eloy Lafuente (stronk7): Export & import of profiling runs
 20160721 - MDL-55292 - Russell Smith (mr-russ): Add support for tideways profiler collection for PHP7
+20171002 - MDL-60313 - Marina Glancy (marinaglancy): Upgrade to 0.9.4 release
\ No newline at end of file
diff --git a/lib/xhprof/xhprof_html/css/xhprof.css b/lib/xhprof/xhprof_html/css/xhprof.css
index fc727d9d789..250b9903fc3 100644
--- a/lib/xhprof/xhprof_html/css/xhprof.css
+++ b/lib/xhprof/xhprof_html/css/xhprof.css
@@ -85,4 +85,3 @@ ul.xhprof_actions li a:hover {
   background:#3B5998 none repeat scroll 0 0;
   color:#FFFFFF;
 }
-
diff --git a/lib/xhprof/xhprof_lib/display/typeahead_common.php b/lib/xhprof/xhprof_lib/display/typeahead_common.php
index 7b1098f417d..0cd304d62da 100644
--- a/lib/xhprof/xhprof_lib/display/typeahead_common.php
+++ b/lib/xhprof/xhprof_lib/display/typeahead_common.php
@@ -77,4 +77,3 @@ if (in_array($q, $functions)) {
 foreach ($functions as $f) {
   echo $f."\n";
 }
-
diff --git a/lib/xhprof/xhprof_lib/display/xhprof.php b/lib/xhprof/xhprof_lib/display/xhprof.php
index b6a7306e00e..a57ec175a4e 100644
--- a/lib/xhprof/xhprof_lib/display/xhprof.php
+++ b/lib/xhprof/xhprof_lib/display/xhprof.php
@@ -42,7 +42,7 @@ require_once $GLOBALS['XHPROF_LIB_ROOT'].'/utils/xhprof_runs.php';
  * Our coding convention disallows relative paths in hrefs.
  * Get the base URL path from the SCRIPT_NAME.
  */
-$base_path = rtrim(dirname($_SERVER['SCRIPT_NAME']), "/");
+$base_path = rtrim(dirname($_SERVER['SCRIPT_NAME']), '/\\');
 
 
 /**
@@ -58,7 +58,7 @@ $base_path = rtrim(dirname($_SERVER['SCRIPT_NAME']), "/");
 function xhprof_include_js_css($ui_dir_url_path = null) {
 
   if (empty($ui_dir_url_path)) {
-    $ui_dir_url_path = rtrim(dirname($_SERVER['SCRIPT_NAME']), "/");
+    $ui_dir_url_path = rtrim(dirname($_SERVER['SCRIPT_NAME']), '/\\');
   }
 
   // style sheets
@@ -621,7 +621,7 @@ function print_td_num($num, $fmt_func, $bold=false, $attributes=null) {
 
   $class = get_print_class($num, $bold);
 
-  if (!empty($fmt_func)) {
+  if (!empty($fmt_func) && is_numeric($num) ) {
     $num = call_user_func($fmt_func, $num);
   }
 
@@ -1003,7 +1003,7 @@ function print_pc_array($url_params, $results, $base_ct, $base_info, $parent,
 
 function print_source_link($info) {
   if (strncmp($info['fn'], 'run_init', 8) && $info['fn'] !== 'main()') {
-	if (defined('XHPROF_SYMBOL_LOOKUP_URL')) {
+    if (defined('XHPROF_SYMBOL_LOOKUP_URL')) {
       $link = xhprof_render_link(
         'source',
         XHPROF_SYMBOL_LOOKUP_URL . '?symbol='.rawurlencode($info["fn"]));
diff --git a/lib/xhprof/xhprof_lib/utils/callgraph_utils.php b/lib/xhprof/xhprof_lib/utils/callgraph_utils.php
index 93ccaa63daa..3a70aa0b06e 100644
--- a/lib/xhprof/xhprof_lib/utils/callgraph_utils.php
+++ b/lib/xhprof/xhprof_lib/utils/callgraph_utils.php
@@ -113,7 +113,7 @@ function xhprof_generate_image_by_dot($dot_script, $type) {
   $cmd = (!empty($CFG->pathtodot) ? $CFG->pathtodot : 'dot') . ' -T' . $type;
   // End moodle modification.
 
-  $process = proc_open($cmd, $descriptorspec, $pipes, "/tmp", array());
+  $process = proc_open( $cmd, $descriptorspec, $pipes, sys_get_temp_dir(), array( 'PATH' => getenv( 'PATH' ) ) );
   if (is_resource($process)) {
     fwrite($pipes[0], $dot_script);
     fclose($pipes[0]);
@@ -382,7 +382,7 @@ function xhprof_generate_dot_script($raw_data, $threshold, $source, $page,
 
       $result .= "N" . $sym_table[$parent]["id"] . " -> N"
                  . $sym_table[$child]["id"];
-      $result .= "[arrowsize=$arrow_size, style=\"setlinewidth($linewidth)\","
+      $result .= "[arrowsize=$arrow_size, color=grey, style=\"setlinewidth($linewidth)\","
                  ." label=\""
                  .$label."\", headlabel=\"".$headlabel
                  ."\", taillabel=\"".$taillabel."\" ]";
diff --git a/lib/xhprof/xhprof_lib/utils/xhprof_lib.php b/lib/xhprof/xhprof_lib/utils/xhprof_lib.php
index 12935dffd8c..4a07e900f1c 100644
--- a/lib/xhprof/xhprof_lib/utils/xhprof_lib.php
+++ b/lib/xhprof/xhprof_lib/utils/xhprof_lib.php
@@ -98,7 +98,7 @@ function init_metrics($xhprof_data, $rep_symbol, $sort, $diff_report = false) {
 
   $pc_stats = $stats;
 
-  $possible_metrics = xhprof_get_possible_metrics($xhprof_data);
+  $possible_metrics = xhprof_get_possible_metrics();
   foreach ($possible_metrics as $metric => $desc) {
     if (isset($xhprof_data["main()"][$metric])) {
       $metrics[] = $metric;
@@ -905,6 +905,10 @@ function xhprof_param_init($params) {
       exit();
     }
 
+    if ($k === 'run') {
+      $p = implode(',', array_filter(explode(',', $p), 'ctype_xdigit'));
+    }
+
     // create a global variable using the parameter name.
     $GLOBALS[$k] = $p;
   }
@@ -939,4 +943,3 @@ function xhprof_get_matching_functions($q, $xhprof_data) {
 
   return ($res);
 }
-
diff --git a/lib/xhprof/xhprof_lib/utils/xhprof_runs.php b/lib/xhprof/xhprof_lib/utils/xhprof_runs.php
index cde5ff556bf..2a22a5dceb1 100644
--- a/lib/xhprof/xhprof_lib/utils/xhprof_runs.php
+++ b/lib/xhprof/xhprof_lib/utils/xhprof_runs.php
@@ -95,8 +95,7 @@ class XHProfRuns_Default implements iXHProfRuns {
       $dir = ini_get("xhprof.output_dir");
       if (empty($dir)) {
 
-        // some default that at least works on unix...
-        $dir = "/tmp";
+        $dir = sys_get_temp_dir();
 
         xhprof_error("Warning: Must specify directory location for XHProf runs. ".
                      "Trying {$dir} as default. You can either pass the " .