diff --git a/core/java/android/content/ContentProviderNative.java b/core/java/android/content/ContentProviderNative.java
index 064755e..b089bf2 100644
--- a/core/java/android/content/ContentProviderNative.java
+++ b/core/java/android/content/ContentProviderNative.java
@@ -108,21 +108,22 @@
                     String sortOrder = data.readString();
                     IContentObserver observer = IContentObserver.Stub.asInterface(
                             data.readStrongBinder());
-                    CursorWindow window = CursorWindow.CREATOR.createFromParcel(data);
 
                     Cursor cursor = query(url, projection, selection, selectionArgs, sortOrder);
                     if (cursor != null) {
                         CursorToBulkCursorAdaptor adaptor = new CursorToBulkCursorAdaptor(
-                                cursor, observer, getProviderName(), window);
+                                cursor, observer, getProviderName());
                         final IBinder binder = adaptor.asBinder();
                         final int count = adaptor.count();
                         final int index = BulkCursorToCursorAdaptor.findRowIdColumnIndex(
                                 adaptor.getColumnNames());
+                        final boolean wantsAllOnMoveCalls = adaptor.getWantsAllOnMoveCalls();
 
                         reply.writeNoException();
                         reply.writeStrongBinder(binder);
                         reply.writeInt(count);
                         reply.writeInt(index);
+                        reply.writeInt(wantsAllOnMoveCalls ? 1 : 0);
                     } else {
                         reply.writeNoException();
                         reply.writeStrongBinder(null);
@@ -324,67 +325,58 @@
 
     public Cursor query(Uri url, String[] projection, String selection,
             String[] selectionArgs, String sortOrder) throws RemoteException {
-        CursorWindow window = new CursorWindow(false /* window will be used remotely */);
+        BulkCursorToCursorAdaptor adaptor = new BulkCursorToCursorAdaptor();
+        Parcel data = Parcel.obtain();
+        Parcel reply = Parcel.obtain();
         try {
-            BulkCursorToCursorAdaptor adaptor = new BulkCursorToCursorAdaptor();
-            Parcel data = Parcel.obtain();
-            Parcel reply = Parcel.obtain();
-            try {
-                data.writeInterfaceToken(IContentProvider.descriptor);
+            data.writeInterfaceToken(IContentProvider.descriptor);
 
-                url.writeToParcel(data, 0);
-                int length = 0;
-                if (projection != null) {
-                    length = projection.length;
-                }
-                data.writeInt(length);
-                for (int i = 0; i < length; i++) {
-                    data.writeString(projection[i]);
-                }
-                data.writeString(selection);
-                if (selectionArgs != null) {
-                    length = selectionArgs.length;
-                } else {
-                    length = 0;
-                }
-                data.writeInt(length);
-                for (int i = 0; i < length; i++) {
-                    data.writeString(selectionArgs[i]);
-                }
-                data.writeString(sortOrder);
-                data.writeStrongBinder(adaptor.getObserver().asBinder());
-                window.writeToParcel(data, 0);
-
-                mRemote.transact(IContentProvider.QUERY_TRANSACTION, data, reply, 0);
-
-                DatabaseUtils.readExceptionFromParcel(reply);
-
-                IBulkCursor bulkCursor = BulkCursorNative.asInterface(reply.readStrongBinder());
-                if (bulkCursor != null) {
-                    int rowCount = reply.readInt();
-                    int idColumnPosition = reply.readInt();
-                    adaptor.initialize(bulkCursor, rowCount, idColumnPosition);
-                } else {
-                    adaptor.close();
-                    adaptor = null;
-                }
-                return adaptor;
-            } catch (RemoteException ex) {
-                adaptor.close();
-                throw ex;
-            } catch (RuntimeException ex) {
-                adaptor.close();
-                throw ex;
-            } finally {
-                data.recycle();
-                reply.recycle();
+            url.writeToParcel(data, 0);
+            int length = 0;
+            if (projection != null) {
+                length = projection.length;
             }
+            data.writeInt(length);
+            for (int i = 0; i < length; i++) {
+                data.writeString(projection[i]);
+            }
+            data.writeString(selection);
+            if (selectionArgs != null) {
+                length = selectionArgs.length;
+            } else {
+                length = 0;
+            }
+            data.writeInt(length);
+            for (int i = 0; i < length; i++) {
+                data.writeString(selectionArgs[i]);
+            }
+            data.writeString(sortOrder);
+            data.writeStrongBinder(adaptor.getObserver().asBinder());
+
+            mRemote.transact(IContentProvider.QUERY_TRANSACTION, data, reply, 0);
+
+            DatabaseUtils.readExceptionFromParcel(reply);
+
+            IBulkCursor bulkCursor = BulkCursorNative.asInterface(reply.readStrongBinder());
+            if (bulkCursor != null) {
+                int rowCount = reply.readInt();
+                int idColumnPosition = reply.readInt();
+                boolean wantsAllOnMoveCalls = reply.readInt() != 0;
+                adaptor.initialize(bulkCursor, rowCount, idColumnPosition, wantsAllOnMoveCalls);
+            } else {
+                adaptor.close();
+                adaptor = null;
+            }
+            return adaptor;
+        } catch (RemoteException ex) {
+            adaptor.close();
+            throw ex;
+        } catch (RuntimeException ex) {
+            adaptor.close();
+            throw ex;
         } finally {
-            // We close the window now because the cursor adaptor does not
-            // take ownership of the window until the first call to onMove.
-            // The adaptor will obtain a fresh reference to the window when
-            // it is filled.
-            window.close();
+            data.recycle();
+            reply.recycle();
         }
     }
 
diff --git a/core/java/android/database/AbstractWindowedCursor.java b/core/java/android/database/AbstractWindowedCursor.java
index 5836265..d0aedd2 100644
--- a/core/java/android/database/AbstractWindowedCursor.java
+++ b/core/java/android/database/AbstractWindowedCursor.java
@@ -189,12 +189,14 @@
     /**
      * If there is a window, clear it.
      * Otherwise, creates a local window.
+     *
+     * @param name The window name.
      * @hide
      */
-    protected void clearOrCreateLocalWindow() {
+    protected void clearOrCreateLocalWindow(String name) {
         if (mWindow == null) {
             // If there isn't a window set already it will only be accessed locally
-            mWindow = new CursorWindow(true /* the window is local only */);
+            mWindow = new CursorWindow(name, true /* the window is local only */);
         } else {
             mWindow.clear();
         }
diff --git a/core/java/android/database/BulkCursorNative.java b/core/java/android/database/BulkCursorNative.java
index 4fada8c..20a9c67 100644
--- a/core/java/android/database/BulkCursorNative.java
+++ b/core/java/android/database/BulkCursorNative.java
@@ -109,9 +109,8 @@
                 case REQUERY_TRANSACTION: {
                     data.enforceInterface(IBulkCursor.descriptor);
                     IContentObserver observer =
-                        IContentObserver.Stub.asInterface(data.readStrongBinder());
-                    CursorWindow window = CursorWindow.CREATOR.createFromParcel(data);
-                    int count = requery(observer, window);
+                            IContentObserver.Stub.asInterface(data.readStrongBinder());
+                    int count = requery(observer);
                     reply.writeNoException();
                     reply.writeInt(count);
                     reply.writeBundle(getExtras());
@@ -294,13 +293,12 @@
         }
     }
     
-    public int requery(IContentObserver observer, CursorWindow window) throws RemoteException {
+    public int requery(IContentObserver observer) throws RemoteException {
         Parcel data = Parcel.obtain();
         Parcel reply = Parcel.obtain();
         try {
             data.writeInterfaceToken(IBulkCursor.descriptor);
             data.writeStrongInterface(observer);
-            window.writeToParcel(data, 0);
 
             boolean result = mRemote.transact(REQUERY_TRANSACTION, data, reply, 0);
             DatabaseUtils.readExceptionFromParcel(reply);
diff --git a/core/java/android/database/BulkCursorToCursorAdaptor.java b/core/java/android/database/BulkCursorToCursorAdaptor.java
index cbdd07fb..885046b 100644
--- a/core/java/android/database/BulkCursorToCursorAdaptor.java
+++ b/core/java/android/database/BulkCursorToCursorAdaptor.java
@@ -38,11 +38,13 @@
      * Initializes the adaptor.
      * Must be called before first use.
      */
-    public void initialize(IBulkCursor bulkCursor, int count, int idIndex) {
+    public void initialize(IBulkCursor bulkCursor, int count, int idIndex,
+            boolean wantsAllOnMoveCalls) {
         mBulkCursor = bulkCursor;
         mColumns = null;  // lazily retrieved
         mCount = count;
         mRowIdColumnIndex = idIndex;
+        mWantsAllOnMoveCalls = wantsAllOnMoveCalls;
     }
 
     /**
@@ -86,15 +88,12 @@
 
         try {
             // Make sure we have the proper window
-            if (mWindow != null) {
-                if (newPosition < mWindow.getStartPosition() ||
-                        newPosition >= (mWindow.getStartPosition() + mWindow.getNumRows())) {
-                    setWindow(mBulkCursor.getWindow(newPosition));
-                } else if (mWantsAllOnMoveCalls) {
-                    mBulkCursor.onMove(newPosition);
-                }
-            } else {
+            if (mWindow == null
+                    || newPosition < mWindow.getStartPosition()
+                    || newPosition >= mWindow.getStartPosition() + mWindow.getNumRows()) {
                 setWindow(mBulkCursor.getWindow(newPosition));
+            } else if (mWantsAllOnMoveCalls) {
+                mBulkCursor.onMove(newPosition);
             }
         } catch (RemoteException ex) {
             // We tried to get a window and failed
@@ -145,25 +144,19 @@
         throwIfCursorIsClosed();
 
         try {
-            CursorWindow newWindow = new CursorWindow(false /* create a remote window */);
-            try {
-                mCount = mBulkCursor.requery(getObserver(), newWindow);
-                if (mCount != -1) {
-                    mPos = -1;
-                    closeWindow();
+            mCount = mBulkCursor.requery(getObserver());
+            if (mCount != -1) {
+                mPos = -1;
+                closeWindow();
 
-                    // super.requery() will call onChanged. Do it here instead of relying on the
-                    // observer from the far side so that observers can see a correct value for mCount
-                    // when responding to onChanged.
-                    super.requery();
-                    return true;
-                } else {
-                    deactivate();
-                    return false;
-                }
-            } finally {
-                // Don't take ownership of the window until the next call to onMove.
-                newWindow.close();
+                // super.requery() will call onChanged. Do it here instead of relying on the
+                // observer from the far side so that observers can see a correct value for mCount
+                // when responding to onChanged.
+                super.requery();
+                return true;
+            } else {
+                deactivate();
+                return false;
             }
         } catch (Exception ex) {
             Log.e(TAG, "Unable to requery because the remote process exception " + ex.getMessage());
diff --git a/core/java/android/database/CursorToBulkCursorAdaptor.java b/core/java/android/database/CursorToBulkCursorAdaptor.java
index a65b3b3..dd2c9b7 100644
--- a/core/java/android/database/CursorToBulkCursorAdaptor.java
+++ b/core/java/android/database/CursorToBulkCursorAdaptor.java
@@ -53,6 +53,7 @@
      * for managing the lifetime of their window.
      */
     private CursorWindow mWindowForNonWindowedCursor;
+    private boolean mWindowForNonWindowedCursorWasFilled;
 
     private static final class ContentObserverProxy extends ContentObserver {
         protected IContentObserver mRemote;
@@ -87,26 +88,11 @@
         }
     }
 
-    public CursorToBulkCursorAdaptor(Cursor cursor, IContentObserver observer, String providerName,
-            CursorWindow window) {
+    public CursorToBulkCursorAdaptor(Cursor cursor, IContentObserver observer,
+            String providerName) {
         try {
             mCursor = (CrossProcessCursor) cursor;
-            if (mCursor instanceof AbstractWindowedCursor) {
-                AbstractWindowedCursor windowedCursor = (AbstractWindowedCursor) cursor;
-                if (windowedCursor.hasWindow()) {
-                    if (Log.isLoggable(TAG, Log.VERBOSE) || false) {
-                        Log.v(TAG, "Cross process cursor has a local window before setWindow in "
-                                + providerName, new RuntimeException());
-                    }
-                }
-                windowedCursor.setWindow(window); // cursor takes ownership of window
-            } else {
-                mWindowForNonWindowedCursor = window; // we own the window
-                mCursor.fillWindow(0, window);
-            }
         } catch (ClassCastException e) {
-            // TODO Implement this case.
-            window.close();
             throw new UnsupportedOperationException(
                     "Only CrossProcessCursor cursors are supported across process for now", e);
         }
@@ -117,17 +103,22 @@
         }
     }
 
-    private void closeCursorAndWindowLocked() {
+    private void closeWindowForNonWindowedCursorLocked() {
+        if (mWindowForNonWindowedCursor != null) {
+            mWindowForNonWindowedCursor.close();
+            mWindowForNonWindowedCursor = null;
+            mWindowForNonWindowedCursorWasFilled = false;
+        }
+    }
+
+    private void disposeLocked() {
         if (mCursor != null) {
             unregisterObserverProxyLocked();
             mCursor.close();
             mCursor = null;
         }
 
-        if (mWindowForNonWindowedCursor != null) {
-            mWindowForNonWindowedCursor.close();
-            mWindowForNonWindowedCursor = null;
-        }
+        closeWindowForNonWindowedCursorLocked();
     }
 
     private void throwIfCursorIsClosed() {
@@ -139,7 +130,7 @@
     @Override
     public void binderDied() {
         synchronized (mLock) {
-            closeCursorAndWindowLocked();
+            disposeLocked();
         }
     }
 
@@ -148,17 +139,30 @@
         synchronized (mLock) {
             throwIfCursorIsClosed();
 
-            mCursor.moveToPosition(startPos);
-
-            final CursorWindow window;
+            CursorWindow window;
             if (mCursor instanceof AbstractWindowedCursor) {
-                window = ((AbstractWindowedCursor)mCursor).getWindow();
+                AbstractWindowedCursor windowedCursor = (AbstractWindowedCursor)mCursor;
+                window = windowedCursor.getWindow();
+                if (window == null) {
+                    window = new CursorWindow(mProviderName, false /*localOnly*/);
+                    windowedCursor.setWindow(window);
+                }
+
+                mCursor.moveToPosition(startPos);
             } else {
                 window = mWindowForNonWindowedCursor;
-                if (window != null
-                        && (startPos < window.getStartPosition() ||
-                                startPos >= (window.getStartPosition() + window.getNumRows()))) {
+                if (window == null) {
+                    window = new CursorWindow(mProviderName, false /*localOnly*/);
+                    mWindowForNonWindowedCursor = window;
+                }
+
+                mCursor.moveToPosition(startPos);
+
+                if (!mWindowForNonWindowedCursorWasFilled
+                        || startPos < window.getStartPosition()
+                        || startPos >= window.getStartPosition() + window.getNumRows()) {
                     mCursor.fillWindow(startPos, window);
+                    mWindowForNonWindowedCursorWasFilled = true;
                 }
             }
 
@@ -206,29 +210,24 @@
                 unregisterObserverProxyLocked();
                 mCursor.deactivate();
             }
+
+            closeWindowForNonWindowedCursorLocked();
         }
     }
 
     @Override
     public void close() {
         synchronized (mLock) {
-            closeCursorAndWindowLocked();
+            disposeLocked();
         }
     }
 
     @Override
-    public int requery(IContentObserver observer, CursorWindow window) {
+    public int requery(IContentObserver observer) {
         synchronized (mLock) {
             throwIfCursorIsClosed();
 
-            if (mCursor instanceof AbstractWindowedCursor) {
-                ((AbstractWindowedCursor) mCursor).setWindow(window);
-            } else {
-                if (mWindowForNonWindowedCursor != null) {
-                    mWindowForNonWindowedCursor.close();
-                }
-                mWindowForNonWindowedCursor = window;
-            }
+            closeWindowForNonWindowedCursorLocked();
 
             try {
                 if (!mCursor.requery()) {
@@ -241,12 +240,6 @@
                 throw leakProgram;
             }
 
-            if (!(mCursor instanceof AbstractWindowedCursor)) {
-                if (window != null) {
-                    mCursor.fillWindow(0, window);
-                }
-            }
-
             unregisterObserverProxyLocked();
             createAndRegisterObserverProxyLocked(observer);
             return mCursor.getCount();
diff --git a/core/java/android/database/CursorWindow.java b/core/java/android/database/CursorWindow.java
index 5a91b80..a18a721 100644
--- a/core/java/android/database/CursorWindow.java
+++ b/core/java/android/database/CursorWindow.java
@@ -22,7 +22,6 @@
 import android.database.sqlite.SQLiteClosable;
 import android.database.sqlite.SQLiteException;
 import android.os.Binder;
-import android.os.IBinder;
 import android.os.Parcel;
 import android.os.Parcelable;
 import android.os.Process;
@@ -31,6 +30,13 @@
 
 /**
  * A buffer containing multiple cursor rows.
+ * <p>
+ * A {@link CursorWindow} is read-write when created and used locally.  When sent
+ * to a remote process (by writing it to a {@link Parcel}), the remote process
+ * receives a read-only view of the cursor window.  Typically the cursor window
+ * will be allocated by the producer, filled with data, and then sent to the
+ * consumer for reading.
+ * </p>
  */
 public class CursorWindow extends SQLiteClosable implements Parcelable {
     private static final String STATS_TAG = "CursorWindowStats";
@@ -52,10 +58,11 @@
 
     private final CloseGuard mCloseGuard = CloseGuard.get();
 
-    private static native int nativeInitializeEmpty(int cursorWindowSize, boolean localOnly);
-    private static native int nativeInitializeFromBinder(IBinder nativeBinder);
+    private static native int nativeCreate(String name,
+            int cursorWindowSize, boolean localOnly);
+    private static native int nativeCreateFromParcel(Parcel parcel);
     private static native void nativeDispose(int windowPtr);
-    private static native IBinder nativeGetBinder(int windowPtr);
+    private static native void nativeWriteToParcel(int windowPtr, Parcel parcel);
 
     private static native void nativeClear(int windowPtr);
 
@@ -79,6 +86,30 @@
     private static native boolean nativePutNull(int windowPtr, int row, int column);
 
     /**
+     * Creates a new empty cursor window and gives it a name.
+     * <p>
+     * The cursor initially has no rows or columns.  Call {@link #setNumColumns(int)} to
+     * set the number of columns before adding any rows to the cursor.
+     * </p>
+     *
+     * @param name The name of the cursor window, or null if none.
+     * @param localWindow True if this window will be used in this process only,
+     * false if it might be sent to another processes.
+     *
+     * @hide
+     */
+    public CursorWindow(String name, boolean localWindow) {
+        mStartPos = 0;
+        mWindowPtr = nativeCreate(name, sCursorWindowSize, localWindow);
+        if (mWindowPtr == 0) {
+            throw new CursorWindowAllocationException("Cursor window allocation of " +
+                    (sCursorWindowSize / 1024) + " kb failed. " + printStats());
+        }
+        mCloseGuard.open("close");
+        recordNewWindow(Binder.getCallingPid(), mWindowPtr);
+    }
+
+    /**
      * Creates a new empty cursor window.
      * <p>
      * The cursor initially has no rows or columns.  Call {@link #setNumColumns(int)} to
@@ -89,20 +120,12 @@
      * false if it might be sent to another processes.
      */
     public CursorWindow(boolean localWindow) {
-        mStartPos = 0;
-        mWindowPtr = nativeInitializeEmpty(sCursorWindowSize, localWindow);
-        if (mWindowPtr == 0) {
-            throw new CursorWindowAllocationException("Cursor window allocation of " +
-                    (sCursorWindowSize / 1024) + " kb failed. " + printStats());
-        }
-        mCloseGuard.open("close");
-        recordNewWindow(Binder.getCallingPid(), mWindowPtr);
+        this(null, localWindow);
     }
 
     private CursorWindow(Parcel source) {
-        IBinder binder = source.readStrongBinder();
         mStartPos = source.readInt();
-        mWindowPtr = nativeInitializeFromBinder(binder);
+        mWindowPtr = nativeCreateFromParcel(source);
         if (mWindowPtr == 0) {
             throw new CursorWindowAllocationException("Cursor window could not be "
                     + "created from binder.");
@@ -687,8 +710,8 @@
     }
 
     public void writeToParcel(Parcel dest, int flags) {
-        dest.writeStrongBinder(nativeGetBinder(mWindowPtr));
         dest.writeInt(mStartPos);
+        nativeWriteToParcel(mWindowPtr, dest);
 
         if ((flags & Parcelable.PARCELABLE_WRITE_RETURN_VALUE) != 0) {
             releaseReference();
diff --git a/core/java/android/database/IBulkCursor.java b/core/java/android/database/IBulkCursor.java
index 244c88f..7c96797 100644
--- a/core/java/android/database/IBulkCursor.java
+++ b/core/java/android/database/IBulkCursor.java
@@ -56,7 +56,7 @@
 
     public void close() throws RemoteException;
 
-    public int requery(IContentObserver observer, CursorWindow window) throws RemoteException;
+    public int requery(IContentObserver observer) throws RemoteException;
 
     boolean getWantsAllOnMoveCalls() throws RemoteException;
 
diff --git a/core/java/android/database/sqlite/SQLiteCursor.java b/core/java/android/database/sqlite/SQLiteCursor.java
index 9d7e152..a1c36e2 100644
--- a/core/java/android/database/sqlite/SQLiteCursor.java
+++ b/core/java/android/database/sqlite/SQLiteCursor.java
@@ -155,7 +155,7 @@
     }
 
     private void fillWindow(int startPos) {
-        clearOrCreateLocalWindow();
+        clearOrCreateLocalWindow(getDatabase().getPath());
         mWindow.setStartPosition(startPos);
         int count = getQuery().fillWindow(mWindow);
         if (startPos == 0) { // fillWindow returns count(*) only for startPos = 0
diff --git a/core/java/android/widget/AdapterView.java b/core/java/android/widget/AdapterView.java
index fd19b5f..e16a8bd 100644
--- a/core/java/android/widget/AdapterView.java
+++ b/core/java/android/widget/AdapterView.java
@@ -922,15 +922,20 @@
         if (selectedView != null) {
             event.setEnabled(selectedView.isEnabled());
         }
+        event.setCurrentItemIndex(getSelectedItemPosition());
         event.setFromIndex(getFirstVisiblePosition());
         event.setToIndex(getLastVisiblePosition());
         event.setItemCount(getAdapter().getCount());
     }
 
     private boolean isScrollableForAccessibility() {
-        final int itemCount = getAdapter().getCount();
-        return itemCount > 0
-            && (getFirstVisiblePosition() > 0 || getLastVisiblePosition() < itemCount - 1);
+        T adapter = getAdapter();
+        if (adapter != null) {
+            final int itemCount = adapter.getCount();
+            return itemCount > 0
+                && (getFirstVisiblePosition() > 0 || getLastVisiblePosition() < itemCount - 1);
+        }
+        return false;
     }
 
     @Override
diff --git a/core/java/com/android/internal/view/menu/ActionMenuPresenter.java b/core/java/com/android/internal/view/menu/ActionMenuPresenter.java
index aabea2c..f25d65f 100644
--- a/core/java/com/android/internal/view/menu/ActionMenuPresenter.java
+++ b/core/java/com/android/internal/view/menu/ActionMenuPresenter.java
@@ -31,9 +31,6 @@
 import android.view.View.MeasureSpec;
 import android.view.ViewConfiguration;
 import android.view.ViewGroup;
-import android.view.ViewParent;
-import android.view.accessibility.AccessibilityEvent;
-import android.view.accessibility.AccessibilityNodeInfo;
 import android.widget.ImageButton;
 
 import java.util.ArrayList;
@@ -71,8 +68,8 @@
     final PopupPresenterCallback mPopupPresenterCallback = new PopupPresenterCallback();
     int mOpenSubMenuId;
 
-    public ActionMenuPresenter() {
-        super(com.android.internal.R.layout.action_menu_layout,
+    public ActionMenuPresenter(Context context) {
+        super(context, com.android.internal.R.layout.action_menu_layout,
                 com.android.internal.R.layout.action_menu_item_layout);
     }
 
@@ -98,7 +95,7 @@
         int width = mWidthLimit;
         if (mReserveOverflow) {
             if (mOverflowButton == null) {
-                mOverflowButton = new OverflowMenuButton(mContext);
+                mOverflowButton = new OverflowMenuButton(mSystemContext);
                 final int spec = MeasureSpec.makeMeasureSpec(0, MeasureSpec.UNSPECIFIED);
                 mOverflowButton.measure(spec, spec);
             }
@@ -215,7 +212,7 @@
 
         if (hasOverflow) {
             if (mOverflowButton == null) {
-                mOverflowButton = new OverflowMenuButton(mContext);
+                mOverflowButton = new OverflowMenuButton(mSystemContext);
             }
             ViewGroup parent = (ViewGroup) mOverflowButton.getParent();
             if (parent != mMenuView) {
diff --git a/core/java/com/android/internal/view/menu/BaseMenuPresenter.java b/core/java/com/android/internal/view/menu/BaseMenuPresenter.java
index bec437a..1e06b5a 100644
--- a/core/java/com/android/internal/view/menu/BaseMenuPresenter.java
+++ b/core/java/com/android/internal/view/menu/BaseMenuPresenter.java
@@ -29,8 +29,10 @@
  * be reused if possible when items change.
  */
 public abstract class BaseMenuPresenter implements MenuPresenter {
+    protected Context mSystemContext;
     protected Context mContext;
     protected MenuBuilder mMenu;
+    protected LayoutInflater mSystemInflater;
     protected LayoutInflater mInflater;
     private Callback mCallback;
 
@@ -44,10 +46,13 @@
     /**
      * Construct a new BaseMenuPresenter.
      *
+     * @param context Context for generating system-supplied views
      * @param menuLayoutRes Layout resource ID for the menu container view
      * @param itemLayoutRes Layout resource ID for a single item view
      */
-    public BaseMenuPresenter(int menuLayoutRes, int itemLayoutRes) {
+    public BaseMenuPresenter(Context context, int menuLayoutRes, int itemLayoutRes) {
+        mSystemContext = context;
+        mSystemInflater = LayoutInflater.from(context);
         mMenuLayoutRes = menuLayoutRes;
         mItemLayoutRes = itemLayoutRes;
     }
@@ -62,7 +67,7 @@
     @Override
     public MenuView getMenuView(ViewGroup root) {
         if (mMenuView == null) {
-            mMenuView = (MenuView) mInflater.inflate(mMenuLayoutRes, root, false);
+            mMenuView = (MenuView) mSystemInflater.inflate(mMenuLayoutRes, root, false);
             mMenuView.initialize(mMenu);
             updateMenuView(true);
         }
@@ -138,7 +143,7 @@
      * @return The new item view
      */
     public MenuView.ItemView createItemView(ViewGroup parent) {
-        return (MenuView.ItemView) mInflater.inflate(mItemLayoutRes, parent, false);
+        return (MenuView.ItemView) mSystemInflater.inflate(mItemLayoutRes, parent, false);
     }
 
     /**
diff --git a/core/java/com/android/internal/view/menu/IconMenuPresenter.java b/core/java/com/android/internal/view/menu/IconMenuPresenter.java
index 24ddad6..3b1decd 100644
--- a/core/java/com/android/internal/view/menu/IconMenuPresenter.java
+++ b/core/java/com/android/internal/view/menu/IconMenuPresenter.java
@@ -43,8 +43,8 @@
     private static final String VIEWS_TAG = "android:menu:icon";
     private static final String OPEN_SUBMENU_KEY = "android:menu:icon:submenu";
 
-    public IconMenuPresenter() {
-        super(com.android.internal.R.layout.icon_menu_layout,
+    public IconMenuPresenter(Context context) {
+        super(context, com.android.internal.R.layout.icon_menu_layout,
                 com.android.internal.R.layout.icon_menu_item_layout);
     }
 
diff --git a/core/java/com/android/internal/widget/ActionBarContextView.java b/core/java/com/android/internal/widget/ActionBarContextView.java
index acffa5c..446dab1 100644
--- a/core/java/com/android/internal/widget/ActionBarContextView.java
+++ b/core/java/com/android/internal/widget/ActionBarContextView.java
@@ -207,7 +207,7 @@
         });
 
         final MenuBuilder menu = (MenuBuilder) mode.getMenu();
-        mActionMenuPresenter = new ActionMenuPresenter();
+        mActionMenuPresenter = new ActionMenuPresenter(mContext);
         mActionMenuPresenter.setReserveOverflow(true);
 
         final LayoutParams layoutParams = new LayoutParams(LayoutParams.WRAP_CONTENT,
diff --git a/core/java/com/android/internal/widget/ActionBarView.java b/core/java/com/android/internal/widget/ActionBarView.java
index 6d2e823..61bce60 100644
--- a/core/java/com/android/internal/widget/ActionBarView.java
+++ b/core/java/com/android/internal/widget/ActionBarView.java
@@ -373,7 +373,7 @@
             }
         }
         if (mActionMenuPresenter == null) {
-            mActionMenuPresenter = new ActionMenuPresenter();
+            mActionMenuPresenter = new ActionMenuPresenter(mContext);
             mActionMenuPresenter.setCallback(cb);
             mActionMenuPresenter.setId(com.android.internal.R.id.action_menu_presenter);
             mExpandedMenuPresenter = new ExpandedActionViewMenuPresenter();
diff --git a/core/jni/android_database_CursorWindow.cpp b/core/jni/android_database_CursorWindow.cpp
index fe1aca0..722aeea 100644
--- a/core/jni/android_database_CursorWindow.cpp
+++ b/core/jni/android_database_CursorWindow.cpp
@@ -57,14 +57,23 @@
     jniThrowException(env, "java/lang/IllegalStateException", msg.string());
 }
 
-static jint nativeInitializeEmpty(JNIEnv* env, jclass clazz,
-        jint cursorWindowSize, jboolean localOnly) {
-    CursorWindow* window = new CursorWindow(cursorWindowSize);
-    if (!window) {
-        return 0;
+static jint nativeCreate(JNIEnv* env, jclass clazz,
+        jstring nameObj, jint cursorWindowSize, jboolean localOnly) {
+    String8 name;
+    if (nameObj) {
+        const char* nameStr = env->GetStringUTFChars(nameObj, NULL);
+        name.setTo(nameStr);
+        env->ReleaseStringUTFChars(nameObj, nameStr);
     }
-    if (!window->initBuffer(localOnly)) {
-        delete window;
+    if (name.size() == 0) {
+        name.setTo("<unnamed>");
+    }
+
+    CursorWindow* window;
+    status_t status = CursorWindow::create(name, cursorWindowSize, localOnly, &window);
+    if (status || !window) {
+        LOGE("Could not allocate CursorWindow '%s' of size %d due to error %d.",
+                name.string(), cursorWindowSize, status);
         return 0;
     }
 
@@ -72,19 +81,13 @@
     return reinterpret_cast<jint>(window);
 }
 
-static jint nativeInitializeFromBinder(JNIEnv* env, jclass clazz, jobject binderObj) {
-    sp<IMemory> memory = interface_cast<IMemory>(ibinderForJavaObject(env, binderObj));
-    if (memory == NULL) {
-        jniThrowException(env, "java/lang/IllegalStateException", "Couldn't get native binder");
-        return 0;
-    }
+static jint nativeCreateFromParcel(JNIEnv* env, jclass clazz, jobject parcelObj) {
+    Parcel* parcel = parcelForJavaObject(env, parcelObj);
 
-    CursorWindow* window = new CursorWindow();
-    if (!window) {
-        return 0;
-    }
-    if (!window->setMemory(memory)) {
-        delete window;
+    CursorWindow* window;
+    status_t status = CursorWindow::createFromParcel(parcel, &window);
+    if (status || !window) {
+        LOGE("Could not create CursorWindow from Parcel due to error %d.", status);
         return 0;
     }
 
@@ -101,22 +104,26 @@
     }
 }
 
-static jobject nativeGetBinder(JNIEnv * env, jclass clazz, jint windowPtr) {
+static void nativeWriteToParcel(JNIEnv * env, jclass clazz, jint windowPtr,
+        jobject parcelObj) {
     CursorWindow* window = reinterpret_cast<CursorWindow*>(windowPtr);
-    if (window) {
-        sp<IMemory> memory = window->getMemory();
-        if (memory != NULL) {
-            sp<IBinder> binder = memory->asBinder();
-            return javaObjectForIBinder(env, binder);
-        }
+    Parcel* parcel = parcelForJavaObject(env, parcelObj);
+
+    status_t status = window->writeToParcel(parcel);
+    if (status) {
+        String8 msg;
+        msg.appendFormat("Could not write CursorWindow to Parcel due to error %d.", status);
+        jniThrowRuntimeException(env, msg.string());
     }
-    return NULL;
 }
 
 static void nativeClear(JNIEnv * env, jclass clazz, jint windowPtr) {
     CursorWindow* window = reinterpret_cast<CursorWindow*>(windowPtr);
     LOG_WINDOW("Clearing window %p", window);
-    window->clear();
+    status_t status = window->clear();
+    if (status) {
+        LOG_WINDOW("Could not clear window. error=%d", status);
+    }
 }
 
 static jint nativeGetNumRows(JNIEnv* env, jclass clazz, jint windowPtr) {
@@ -127,12 +134,14 @@
 static jboolean nativeSetNumColumns(JNIEnv* env, jclass clazz, jint windowPtr,
         jint columnNum) {
     CursorWindow* window = reinterpret_cast<CursorWindow*>(windowPtr);
-    return window->setNumColumns(columnNum);
+    status_t status = window->setNumColumns(columnNum);
+    return status == OK;
 }
 
 static jboolean nativeAllocRow(JNIEnv* env, jclass clazz, jint windowPtr) {
     CursorWindow* window = reinterpret_cast<CursorWindow*>(windowPtr);
-    return window->allocRow() != NULL;
+    status_t status = window->allocRow();
+    return status == OK;
 }
 
 static void nativeFreeLastRow(JNIEnv* env, jclass clazz, jint windowPtr) {
@@ -145,14 +154,14 @@
     CursorWindow* window = reinterpret_cast<CursorWindow*>(windowPtr);
     LOG_WINDOW("returning column type affinity for %d,%d from %p", row, column, window);
 
-    field_slot_t* fieldSlot = window->getFieldSlotWithCheck(row, column);
+    CursorWindow::FieldSlot* fieldSlot = window->getFieldSlot(row, column);
     if (!fieldSlot) {
         // FIXME: This is really broken but we have CTS tests that depend
         // on this legacy behavior.
         //throwExceptionWithRowCol(env, row, column);
-        return FIELD_TYPE_NULL;
+        return CursorWindow::FIELD_TYPE_NULL;
     }
-    return fieldSlot->type;
+    return window->getFieldSlotType(fieldSlot);
 }
 
 static jbyteArray nativeGetBlob(JNIEnv* env, jclass clazz, jint windowPtr,
@@ -160,29 +169,29 @@
     CursorWindow* window = reinterpret_cast<CursorWindow*>(windowPtr);
     LOG_WINDOW("Getting blob for %d,%d from %p", row, column, window);
 
-    field_slot_t* fieldSlot = window->getFieldSlotWithCheck(row, column);
+    CursorWindow::FieldSlot* fieldSlot = window->getFieldSlot(row, column);
     if (!fieldSlot) {
         throwExceptionWithRowCol(env, row, column);
         return NULL;
     }
 
-    uint8_t type = fieldSlot->type;
-    if (type == FIELD_TYPE_BLOB || type == FIELD_TYPE_STRING) {
-        uint32_t size = fieldSlot->data.buffer.size;
+    int32_t type = window->getFieldSlotType(fieldSlot);
+    if (type == CursorWindow::FIELD_TYPE_BLOB || type == CursorWindow::FIELD_TYPE_STRING) {
+        size_t size;
+        const void* value = window->getFieldSlotValueBlob(fieldSlot, &size);
         jbyteArray byteArray = env->NewByteArray(size);
         if (!byteArray) {
             env->ExceptionClear();
             throw_sqlite3_exception(env, "Native could not create new byte[]");
             return NULL;
         }
-        env->SetByteArrayRegion(byteArray, 0, size,
-                reinterpret_cast<jbyte*>(window->offsetToPtr(fieldSlot->data.buffer.offset)));
+        env->SetByteArrayRegion(byteArray, 0, size, static_cast<const jbyte*>(value));
         return byteArray;
-    } else if (type == FIELD_TYPE_INTEGER) {
+    } else if (type == CursorWindow::FIELD_TYPE_INTEGER) {
         throw_sqlite3_exception(env, "INTEGER data in nativeGetBlob ");
-    } else if (type == FIELD_TYPE_FLOAT) {
+    } else if (type == CursorWindow::FIELD_TYPE_FLOAT) {
         throw_sqlite3_exception(env, "FLOAT data in nativeGetBlob ");
-    } else if (type == FIELD_TYPE_NULL) {
+    } else if (type == CursorWindow::FIELD_TYPE_NULL) {
         // do nothing
     } else {
         throwUnknownTypeException(env, type);
@@ -195,43 +204,37 @@
     CursorWindow* window = reinterpret_cast<CursorWindow*>(windowPtr);
     LOG_WINDOW("Getting string for %d,%d from %p", row, column, window);
 
-    field_slot_t* fieldSlot = window->getFieldSlotWithCheck(row, column);
+    CursorWindow::FieldSlot* fieldSlot = window->getFieldSlot(row, column);
     if (!fieldSlot) {
         throwExceptionWithRowCol(env, row, column);
         return NULL;
     }
 
-    uint8_t type = fieldSlot->type;
-    if (type == FIELD_TYPE_STRING) {
-        uint32_t size = fieldSlot->data.buffer.size;
-#if WINDOW_STORAGE_UTF8
-        if (size <= 1) {
+    int32_t type = window->getFieldSlotType(fieldSlot);
+    if (type == CursorWindow::FIELD_TYPE_STRING) {
+        size_t sizeIncludingNull;
+        const char* value = window->getFieldSlotValueString(fieldSlot, &sizeIncludingNull);
+        if (sizeIncludingNull <= 1) {
             return gEmptyString;
         }
         // Convert to UTF-16 here instead of calling NewStringUTF.  NewStringUTF
         // doesn't like UTF-8 strings with high codepoints.  It actually expects
         // Modified UTF-8 with encoded surrogate pairs.
-        String16 utf16(window->getFieldSlotValueString(fieldSlot), size - 1);
+        String16 utf16(value, sizeIncludingNull - 1);
         return env->NewString(reinterpret_cast<const jchar*>(utf16.string()), utf16.size());
-#else
-        size_t chars = size / sizeof(char16_t);
-        return chars ? env->NewString(reinterpret_cast<jchar*>(
-                window->getFieldSlotValueString(fieldSlot)), chars)
-                : gEmptyString;
-#endif
-    } else if (type == FIELD_TYPE_INTEGER) {
+    } else if (type == CursorWindow::FIELD_TYPE_INTEGER) {
         int64_t value = window->getFieldSlotValueLong(fieldSlot);
         char buf[32];
         snprintf(buf, sizeof(buf), "%lld", value);
         return env->NewStringUTF(buf);
-    } else if (type == FIELD_TYPE_FLOAT) {
+    } else if (type == CursorWindow::FIELD_TYPE_FLOAT) {
         double value = window->getFieldSlotValueDouble(fieldSlot);
         char buf[32];
         snprintf(buf, sizeof(buf), "%g", value);
         return env->NewStringUTF(buf);
-    } else if (type == FIELD_TYPE_NULL) {
+    } else if (type == CursorWindow::FIELD_TYPE_NULL) {
         return NULL;
-    } else if (type == FIELD_TYPE_BLOB) {
+    } else if (type == CursorWindow::FIELD_TYPE_BLOB) {
         throw_sqlite3_exception(env, "Unable to convert BLOB to string");
         return NULL;
     } else {
@@ -281,21 +284,6 @@
     }
 }
 
-#if !WINDOW_STORAGE_UTF8
-static void fillCharArrayBuffer(JNIEnv* env, jobject bufferObj,
-        const char16_t* str, size_t len) {
-    jcharArray dataObj = allocCharArrayBuffer(env, bufferObj, len);
-    if (dataObj) {
-        if (len) {
-            jchar* data = static_cast<jchar*>(env->GetPrimitiveArrayCritical(dataObj, NULL));
-            memcpy(data, str, len * sizeof(jchar));
-            env->ReleasePrimitiveArrayCritical(dataObj, data, 0);
-        }
-        env->SetIntField(bufferObj, gCharArrayBufferClassInfo.sizeCopied, len);
-    }
-}
-#endif
-
 static void clearCharArrayBuffer(JNIEnv* env, jobject bufferObj) {
     jcharArray dataObj = allocCharArrayBuffer(env, bufferObj, 0);
     if (dataObj) {
@@ -308,44 +296,34 @@
     CursorWindow* window = reinterpret_cast<CursorWindow*>(windowPtr);
     LOG_WINDOW("Copying string for %d,%d from %p", row, column, window);
 
-    field_slot_t* fieldSlot = window->getFieldSlotWithCheck(row, column);
+    CursorWindow::FieldSlot* fieldSlot = window->getFieldSlot(row, column);
     if (!fieldSlot) {
         throwExceptionWithRowCol(env, row, column);
         return;
     }
 
-    uint8_t type = fieldSlot->type;
-    if (type == FIELD_TYPE_STRING) {
-        uint32_t size = fieldSlot->data.buffer.size;
-#if WINDOW_STORAGE_UTF8
-        if (size > 1) {
-            fillCharArrayBufferUTF(env, bufferObj,
-                    window->getFieldSlotValueString(fieldSlot), size - 1);
+    int32_t type = window->getFieldSlotType(fieldSlot);
+    if (type == CursorWindow::FIELD_TYPE_STRING) {
+        size_t sizeIncludingNull;
+        const char* value = window->getFieldSlotValueString(fieldSlot, &sizeIncludingNull);
+        if (sizeIncludingNull > 1) {
+            fillCharArrayBufferUTF(env, bufferObj, value, sizeIncludingNull - 1);
         } else {
             clearCharArrayBuffer(env, bufferObj);
         }
-#else
-        size_t chars = size / sizeof(char16_t);
-        if (chars) {
-            fillCharArrayBuffer(env, bufferObj,
-                    window->getFieldSlotValueString(fieldSlot), chars);
-        } else {
-            clearCharArrayBuffer(env, bufferObj);
-        }
-#endif
-    } else if (type == FIELD_TYPE_INTEGER) {
+    } else if (type == CursorWindow::FIELD_TYPE_INTEGER) {
         int64_t value = window->getFieldSlotValueLong(fieldSlot);
         char buf[32];
         snprintf(buf, sizeof(buf), "%lld", value);
         fillCharArrayBufferUTF(env, bufferObj, buf, strlen(buf));
-    } else if (type == FIELD_TYPE_FLOAT) {
+    } else if (type == CursorWindow::FIELD_TYPE_FLOAT) {
         double value = window->getFieldSlotValueDouble(fieldSlot);
         char buf[32];
         snprintf(buf, sizeof(buf), "%g", value);
         fillCharArrayBufferUTF(env, bufferObj, buf, strlen(buf));
-    } else if (type == FIELD_TYPE_NULL) {
+    } else if (type == CursorWindow::FIELD_TYPE_NULL) {
         clearCharArrayBuffer(env, bufferObj);
-    } else if (type == FIELD_TYPE_BLOB) {
+    } else if (type == CursorWindow::FIELD_TYPE_BLOB) {
         throw_sqlite3_exception(env, "Unable to convert BLOB to string");
     } else {
         throwUnknownTypeException(env, type);
@@ -357,29 +335,24 @@
     CursorWindow* window = reinterpret_cast<CursorWindow*>(windowPtr);
     LOG_WINDOW("Getting long for %d,%d from %p", row, column, window);
 
-    field_slot_t* fieldSlot = window->getFieldSlotWithCheck(row, column);
+    CursorWindow::FieldSlot* fieldSlot = window->getFieldSlot(row, column);
     if (!fieldSlot) {
         throwExceptionWithRowCol(env, row, column);
         return 0;
     }
 
-    uint8_t type = fieldSlot->type;
-    if (type == FIELD_TYPE_INTEGER) {
+    int32_t type = window->getFieldSlotType(fieldSlot);
+    if (type == CursorWindow::FIELD_TYPE_INTEGER) {
         return window->getFieldSlotValueLong(fieldSlot);
-    } else if (type == FIELD_TYPE_STRING) {
-        uint32_t size = fieldSlot->data.buffer.size;
-#if WINDOW_STORAGE_UTF8
-        return size > 1 ? strtoll(window->getFieldSlotValueString(fieldSlot), NULL, 0) : 0L;
-#else
-        size_t chars = size / sizeof(char16_t);
-        return chars ? strtoll(String8(window->getFieldSlotValueString(fieldSlot), chars)
-                .string(), NULL, 0) : 0L;
-#endif
-    } else if (type == FIELD_TYPE_FLOAT) {
+    } else if (type == CursorWindow::FIELD_TYPE_STRING) {
+        size_t sizeIncludingNull;
+        const char* value = window->getFieldSlotValueString(fieldSlot, &sizeIncludingNull);
+        return sizeIncludingNull > 1 ? strtoll(value, NULL, 0) : 0L;
+    } else if (type == CursorWindow::FIELD_TYPE_FLOAT) {
         return jlong(window->getFieldSlotValueDouble(fieldSlot));
-    } else if (type == FIELD_TYPE_NULL) {
+    } else if (type == CursorWindow::FIELD_TYPE_NULL) {
         return 0;
-    } else if (type == FIELD_TYPE_BLOB) {
+    } else if (type == CursorWindow::FIELD_TYPE_BLOB) {
         throw_sqlite3_exception(env, "Unable to convert BLOB to long");
         return 0;
     } else {
@@ -393,29 +366,24 @@
     CursorWindow* window = reinterpret_cast<CursorWindow*>(windowPtr);
     LOG_WINDOW("Getting double for %d,%d from %p", row, column, window);
 
-    field_slot_t* fieldSlot = window->getFieldSlotWithCheck(row, column);
+    CursorWindow::FieldSlot* fieldSlot = window->getFieldSlot(row, column);
     if (!fieldSlot) {
         throwExceptionWithRowCol(env, row, column);
         return 0.0;
     }
 
-    uint8_t type = fieldSlot->type;
-    if (type == FIELD_TYPE_FLOAT) {
+    int32_t type = window->getFieldSlotType(fieldSlot);
+    if (type == CursorWindow::FIELD_TYPE_FLOAT) {
         return window->getFieldSlotValueDouble(fieldSlot);
-    } else if (type == FIELD_TYPE_STRING) {
-        uint32_t size = fieldSlot->data.buffer.size;
-#if WINDOW_STORAGE_UTF8
-        return size > 1 ? strtod(window->getFieldSlotValueString(fieldSlot), NULL) : 0.0;
-#else
-        size_t chars = size / sizeof(char16_t);
-        return chars ? strtod(String8(window->getFieldSlotValueString(fieldSlot), chars)
-                .string(), NULL) : 0.0;
-#endif
-    } else if (type == FIELD_TYPE_INTEGER) {
+    } else if (type == CursorWindow::FIELD_TYPE_STRING) {
+        size_t sizeIncludingNull;
+        const char* value = window->getFieldSlotValueString(fieldSlot, &sizeIncludingNull);
+        return sizeIncludingNull > 1 ? strtod(value, NULL) : 0.0;
+    } else if (type == CursorWindow::FIELD_TYPE_INTEGER) {
         return jdouble(window->getFieldSlotValueLong(fieldSlot));
-    } else if (type == FIELD_TYPE_NULL) {
+    } else if (type == CursorWindow::FIELD_TYPE_NULL) {
         return 0.0;
-    } else if (type == FIELD_TYPE_BLOB) {
+    } else if (type == CursorWindow::FIELD_TYPE_BLOB) {
         throw_sqlite3_exception(env, "Unable to convert BLOB to double");
         return 0.0;
     } else {
@@ -427,82 +395,50 @@
 static jboolean nativePutBlob(JNIEnv* env, jclass clazz, jint windowPtr,
         jbyteArray valueObj, jint row, jint column) {
     CursorWindow* window = reinterpret_cast<CursorWindow*>(windowPtr);
-    field_slot_t * fieldSlot = window->getFieldSlotWithCheck(row, column);
-    if (fieldSlot == NULL) {
-        LOG_WINDOW(" getFieldSlotWithCheck error ");
-        return false;
-    }
-
     jsize len = env->GetArrayLength(valueObj);
-    uint32_t offset = window->alloc(len);
-    if (!offset) {
-        LOG_WINDOW("Failed allocating %u bytes", len);
-        return false;
-    }
 
     void* value = env->GetPrimitiveArrayCritical(valueObj, NULL);
-    window->copyIn(offset, static_cast<const uint8_t*>(value), len);
+    status_t status = window->putBlob(row, column, value, len);
     env->ReleasePrimitiveArrayCritical(valueObj, value, JNI_ABORT);
 
-    fieldSlot->type = FIELD_TYPE_BLOB;
-    fieldSlot->data.buffer.offset = offset;
-    fieldSlot->data.buffer.size = len;
-    LOG_WINDOW("%d,%d is BLOB with %u bytes @ %d", row, column, len, offset);
+    if (status) {
+        LOG_WINDOW("Failed to put blob. error=%d", status);
+        return false;
+    }
+
+    LOG_WINDOW("%d,%d is BLOB with %u bytes", row, column, len);
     return true;
 }
 
 static jboolean nativePutString(JNIEnv* env, jclass clazz, jint windowPtr,
         jstring valueObj, jint row, jint column) {
     CursorWindow* window = reinterpret_cast<CursorWindow*>(windowPtr);
-    field_slot_t * fieldSlot = window->getFieldSlotWithCheck(row, column);
-    if (fieldSlot == NULL) {
-        LOG_WINDOW(" getFieldSlotWithCheck error ");
-        return false;
-    }
 
-#if WINDOW_STORAGE_UTF8
-    size_t size = env->GetStringUTFLength(valueObj) + 1;
+    size_t sizeIncludingNull = env->GetStringUTFLength(valueObj) + 1;
     const char* valueStr = env->GetStringUTFChars(valueObj, NULL);
-#else
-    size_t size = env->GetStringLength(valueObj) * sizeof(jchar);
-    const jchar* valueStr = env->GetStringChars(valueObj, NULL);
-#endif
     if (!valueStr) {
-        LOG_WINDOW("value can't be transfer to UTFChars");
+        LOG_WINDOW("value can't be transferred to UTFChars");
         return false;
     }
-
-    uint32_t offset = window->alloc(size);
-    if (!offset) {
-        LOG_WINDOW("Failed allocating %u bytes", size);
-#if WINDOW_STORAGE_UTF8
-        env->ReleaseStringUTFChars(valueObj, valueStr);
-#else
-        env->ReleaseStringChars(valueObj, valueStr);
-#endif
-        return false;
-    }
-
-    window->copyIn(offset, reinterpret_cast<const uint8_t*>(valueStr), size);
-
-#if WINDOW_STORAGE_UTF8
+    status_t status = window->putString(row, column, valueStr, sizeIncludingNull);
     env->ReleaseStringUTFChars(valueObj, valueStr);
-#else
-    env->ReleaseStringChars(valueObj, valueStr);
-#endif
 
-    fieldSlot->type = FIELD_TYPE_STRING;
-    fieldSlot->data.buffer.offset = offset;
-    fieldSlot->data.buffer.size = size;
-    LOG_WINDOW("%d,%d is TEXT with %u bytes @ %d", row, column, size, offset);
+    if (status) {
+        LOG_WINDOW("Failed to put string. error=%d", status);
+        return false;
+    }
+
+    LOG_WINDOW("%d,%d is TEXT with %u bytes", row, column, sizeIncludingNull);
     return true;
 }
 
 static jboolean nativePutLong(JNIEnv* env, jclass clazz, jint windowPtr,
         jlong value, jint row, jint column) {
     CursorWindow* window = reinterpret_cast<CursorWindow*>(windowPtr);
-    if (!window->putLong(row, column, value)) {
-        LOG_WINDOW(" getFieldSlotWithCheck error ");
+    status_t status = window->putLong(row, column, value);
+
+    if (status) {
+        LOG_WINDOW("Failed to put long. error=%d", status);
         return false;
     }
 
@@ -513,8 +449,10 @@
 static jboolean nativePutDouble(JNIEnv* env, jclass clazz, jint windowPtr,
         jdouble value, jint row, jint column) {
     CursorWindow* window = reinterpret_cast<CursorWindow*>(windowPtr);
-    if (!window->putDouble(row, column, value)) {
-        LOG_WINDOW(" getFieldSlotWithCheck error ");
+    status_t status = window->putDouble(row, column, value);
+
+    if (status) {
+        LOG_WINDOW("Failed to put double. error=%d", status);
         return false;
     }
 
@@ -525,8 +463,10 @@
 static jboolean nativePutNull(JNIEnv* env, jclass clazz, jint windowPtr,
         jint row, jint column) {
     CursorWindow* window = reinterpret_cast<CursorWindow*>(windowPtr);
-    if (!window->putNull(row, column)) {
-        LOG_WINDOW(" getFieldSlotWithCheck error ");
+    status_t status = window->putNull(row, column);
+
+    if (status) {
+        LOG_WINDOW("Failed to put null. error=%d", status);
         return false;
     }
 
@@ -537,14 +477,14 @@
 static JNINativeMethod sMethods[] =
 {
     /* name, signature, funcPtr */
-    { "nativeInitializeEmpty", "(IZ)I",
-            (void*)nativeInitializeEmpty },
-    { "nativeInitializeFromBinder", "(Landroid/os/IBinder;)I",
-            (void*)nativeInitializeFromBinder },
+    { "nativeCreate", "(Ljava/lang/String;IZ)I",
+            (void*)nativeCreate },
+    { "nativeCreateFromParcel", "(Landroid/os/Parcel;)I",
+            (void*)nativeCreateFromParcel },
     { "nativeDispose", "(I)V",
             (void*)nativeDispose },
-    { "nativeGetBinder", "(I)Landroid/os/IBinder;",
-            (void*)nativeGetBinder },
+    { "nativeWriteToParcel", "(ILandroid/os/Parcel;)V",
+            (void*)nativeWriteToParcel },
     { "nativeClear", "(I)V",
             (void*)nativeClear },
     { "nativeGetNumRows", "(I)I",
diff --git a/core/jni/android_database_SQLiteQuery.cpp b/core/jni/android_database_SQLiteQuery.cpp
index 022a64c..8170f46 100644
--- a/core/jni/android_database_SQLiteQuery.cpp
+++ b/core/jni/android_database_SQLiteQuery.cpp
@@ -61,7 +61,8 @@
             window->getNumRows(), window->size(), window->freeSpace());
 
     int numColumns = sqlite3_column_count(statement);
-    if (!window->setNumColumns(numColumns)) {
+    status_t status = window->setNumColumns(numColumns);
+    if (status) {
         LOGE("Failed to change column count from %d to %d", window->getNumColumns(), numColumns);
         jniThrowException(env, "java/lang/IllegalStateException", "numColumns mismatch");
         return 0;
@@ -88,10 +89,10 @@
             // Allocate a new field directory for the row. This pointer is not reused
             // since it may be possible for it to be relocated on a call to alloc() when
             // the field data is being allocated.
-            field_slot_t* fieldDir = window->allocRow();
-            if (!fieldDir) {
-                LOG_WINDOW("Failed allocating fieldDir at startPos %d row %d",
-                        startPos, addedRows);
+            status = window->allocRow();
+            if (status) {
+                LOG_WINDOW("Failed allocating fieldDir at startPos %d row %d, error=%d",
+                        startPos, addedRows, status);
                 windowFull = true;
                 continue;
             }
@@ -101,37 +102,28 @@
                 int type = sqlite3_column_type(statement, i);
                 if (type == SQLITE_TEXT) {
                     // TEXT data
-#if WINDOW_STORAGE_UTF8
-                    const uint8_t* text = reinterpret_cast<const uint8_t*>(
+                    const char* text = reinterpret_cast<const char*>(
                             sqlite3_column_text(statement, i));
                     // SQLite does not include the NULL terminator in size, but does
                     // ensure all strings are NULL terminated, so increase size by
                     // one to make sure we store the terminator.
-                    size_t size = sqlite3_column_bytes(statement, i) + 1;
-#else
-                    const uint8_t* text = reinterpret_cast<const uint8_t*>(
-                            sqlite3_column_text16(statement, i));
-                    size_t size = sqlite3_column_bytes16(statement, i);
-#endif
-                    int offset = window->alloc(size);
-                    if (!offset) {
-                        LOG_WINDOW("Failed allocating %u bytes for text/blob at %d,%d", size,
-                                   startPos + addedRows, i);
+                    size_t sizeIncludingNull = sqlite3_column_bytes(statement, i) + 1;
+                    status = window->putString(addedRows, i, text, sizeIncludingNull);
+                    if (status) {
+                        LOG_WINDOW("Failed allocating %u bytes for text at %d,%d, error=%d",
+                                sizeIncludingNull, startPos + addedRows, i, status);
                         windowFull = true;
                         break;
                     }
-                    window->copyIn(offset, text, size);
-
-                    field_slot_t* fieldSlot = window->getFieldSlot(addedRows, i);
-                    fieldSlot->type = FIELD_TYPE_STRING;
-                    fieldSlot->data.buffer.offset = offset;
-                    fieldSlot->data.buffer.size = size;
-                    LOG_WINDOW("%d,%d is TEXT with %u bytes", startPos + addedRows, i, size);
+                    LOG_WINDOW("%d,%d is TEXT with %u bytes",
+                            startPos + addedRows, i, sizeIncludingNull);
                 } else if (type == SQLITE_INTEGER) {
                     // INTEGER data
                     int64_t value = sqlite3_column_int64(statement, i);
-                    if (!window->putLong(addedRows, i, value)) {
-                        LOG_WINDOW("Failed allocating space for a long in column %d", i);
+                    status = window->putLong(addedRows, i, value);
+                    if (status) {
+                        LOG_WINDOW("Failed allocating space for a long in column %d, error=%d",
+                                i, status);
                         windowFull = true;
                         break;
                     }
@@ -139,35 +131,33 @@
                 } else if (type == SQLITE_FLOAT) {
                     // FLOAT data
                     double value = sqlite3_column_double(statement, i);
-                    if (!window->putDouble(addedRows, i, value)) {
-                        LOG_WINDOW("Failed allocating space for a double in column %d", i);
+                    status = window->putDouble(addedRows, i, value);
+                    if (status) {
+                        LOG_WINDOW("Failed allocating space for a double in column %d, error=%d",
+                                i, status);
                         windowFull = true;
                         break;
                     }
                     LOG_WINDOW("%d,%d is FLOAT %lf", startPos + addedRows, i, value);
                 } else if (type == SQLITE_BLOB) {
                     // BLOB data
-                    uint8_t const * blob = (uint8_t const *)sqlite3_column_blob(statement, i);
-                    size_t size = sqlite3_column_bytes16(statement, i);
-                    int offset = window->alloc(size);
-                    if (!offset) {
-                        LOG_WINDOW("Failed allocating %u bytes for blob at %d,%d", size,
-                                startPos + addedRows, i);
+                    const void* blob = sqlite3_column_blob(statement, i);
+                    size_t size = sqlite3_column_bytes(statement, i);
+                    status = window->putBlob(addedRows, i, blob, size);
+                    if (status) {
+                        LOG_WINDOW("Failed allocating %u bytes for blob at %d,%d, error=%d",
+                                size, startPos + addedRows, i, status);
                         windowFull = true;
                         break;
                     }
-                    window->copyIn(offset, blob, size);
-
-                    field_slot_t* fieldSlot = window->getFieldSlot(addedRows, i);
-                    fieldSlot->type = FIELD_TYPE_BLOB;
-                    fieldSlot->data.buffer.offset = offset;
-                    fieldSlot->data.buffer.size = size;
-                    LOG_WINDOW("%d,%d is Blob with %u bytes @ %d",
-                            startPos + addedRows, i, size, offset);
+                    LOG_WINDOW("%d,%d is Blob with %u bytes",
+                            startPos + addedRows, i, size);
                 } else if (type == SQLITE_NULL) {
                     // NULL field
-                    if (!window->putNull(addedRows, i)) {
-                        LOG_WINDOW("Failed allocating space for a null in column %d", i);
+                    status = window->putNull(addedRows, i);
+                    if (status) {
+                        LOG_WINDOW("Failed allocating space for a null in column %d, error=%d",
+                                i, status);
                         windowFull = true;
                         break;
                     }
diff --git a/docs/html/guide/topics/manifest/activity-element.jd b/docs/html/guide/topics/manifest/activity-element.jd
index b2a78fe..5a9313e 100644
--- a/docs/html/guide/topics/manifest/activity-element.jd
+++ b/docs/html/guide/topics/manifest/activity-element.jd
@@ -581,8 +581,9 @@
 </p></dd>
 
 <dt><a name="screen"></a>{@code android:screenOrientation}</dt>
-<dd>The orientation of the activity's display on the device.
-The value can be any one of the following strings:
+<dd>The orientation of the activity's display on the device. 
+  
+<p>The value can be any one of the following strings:</p>
 
 <table>
 <tr>
@@ -640,7 +641,23 @@
 distinction, the system chooses the orientation using the same policy as for the "{@code
 unspecified}" setting.</td>
 </tr>
-</table></dd>
+</table>
+
+<p class="note"><strong>Note:</strong> When you declare one of the landscape or portrait values,
+it is considered a hard requirement for the orientation in which the activity runs. As such,
+the value you declare enables filtering by services such as Android Market so your application is
+available only to devices that support the orientation required by your activities. For
+example, if you declare either {@code "landscape"}, {@code "reverseLandscape"}, or
+{@code "sensorLandscape"}, then your application will be available only to devices that support
+landscape orientation. However, you should also explicitly declare that
+your application requires either portrait or landscape orientation with the <a
+href="{@docRoot}guide/topics/manifest/uses-feature-element.html">{@code &lt;uses-feature&gt;}</a>
+element. For example, <code>&lt;uses-feature
+android:name="android.hardware.screen.portrait"/></code>. This is purely a filtering behavior
+provided by Android Market (and other services that support it) and the platform itself does not
+control whether your app can be installed when a device supports only certain orientations.</p>
+
+</dd>
 
 <dt><a name="state"></a>{@code android:stateNotNeeded}</dt>
 <dd>Whether or not the activity can be killed and successfully restarted 
diff --git a/docs/html/guide/topics/manifest/uses-feature-element.jd b/docs/html/guide/topics/manifest/uses-feature-element.jd
index 49d6b62..9f80638 100644
--- a/docs/html/guide/topics/manifest/uses-feature-element.jd
+++ b/docs/html/guide/topics/manifest/uses-feature-element.jd
@@ -111,7 +111,7 @@
 with your application. For this reason, it's very important that you declare all of
 the features (from the list below) that your application uses. </p>
 
-<p>For some features, there may exist a specfic attribute that allows you to define
+<p>For some features, there may exist a specific attribute that allows you to define
 a version of the feature, such as the version of Open GL used (declared with
 <a href="#glEsVersion"><code>glEsVersion</code></a>). Other features that either do or do not
 exist for a device, such as a camera, are declared using the
@@ -277,7 +277,7 @@
 it (<code>"true"</code>), or whether the application prefers to use the feature
 if available, but is designed to run without it (<code>"false"</code>).</p>
 
-<p>Android Market handles explictly declared features in this way: </p>
+<p>Android Market handles explicitly declared features in this way: </p>
 
 <ul>
 <li>If a feature is explicitly declared as being required, Android Market adds
@@ -287,7 +287,7 @@
 <pre>&lt;uses-feature android:name="android.hardware.camera" android:required="true" /&gt;</pre></li>
 <li>If a feature is explicitly declared as <em>not</em> being required, Android
 Market <em>does not</em> add the feature to the list of required features. For
-that reason, an explicity declared non-required feature is never considered when
+that reason, an explicitly declared non-required feature is never considered when
 filtering the application. Even if the device does not provide the declared
 feature, Android Market will still consider the application compatible with the
 device and will show it to the user, unless other filtering rules apply. For
@@ -650,6 +650,40 @@
   <td>The application uses the device's proximity sensor.</td>
   <td></td>
 </tr>
+
+<tr>
+  <td rowspan="2">Screen</td>
+  <td><code>android.hardware.screen.landscape</code></td>
+  <td>The application requires landscape orientation.</td>
+  <td rowspan="2">
+     <p>For example, if your app requires portrait orientation, you should declare
+<code>&lt;uses-feature android:name="android.hardware.screen.portrait"/></code> so that only devices
+that support portrait orientation (whether always or by user choice) can install your app. If your
+application <em>supports</em> both orientations, then you don't need to declare either.</p>
+    <p>Both orientations are assumed <em>not required</em>, by default, so your app may be installed
+on devices that support one or both orientations. However, if any of your activities request that
+they run in a specific orientation, using the <a
+href="{@docRoot}guide/topics/manifest/activity-element.html#screen">{@code
+android:screenOrientation}</a> attribute, then this also declares that the application requires that
+orientation. For example, if you declare <a
+href="{@docRoot}guide/topics/manifest/activity-element.html#screen">{@code
+android:screenOrientation}</a> with either {@code "landscape"}, {@code "reverseLandscape"}, or
+{@code "sensorLandscape"}, then your application will be available only to devices that support
+landscape orientation. As a best practice, you should still declare your requirement for this
+orientation using a {@code &lt;uses-feature&gt;} element. If you declare an orientation for your
+activity using <a href="{@docRoot}guide/topics/manifest/activity-element.html#screen">{@code
+android:screenOrientation}</a>, but don't actually <em>require</em> it, you can disable the
+requirement by declaring the orientation with a {@code &lt;uses-feature&gt;} element and include
+{@code android:required="false"}.</p>
+    <p>For backwards compatibility, any device running a platform version that supports only API
+level 12 or lower is assumed to support both landscape and portrait.</p>
+  </td>
+</tr>
+<tr>
+  <td><code>android.hardware.screen.portrait</code></td>
+  <td>The application requires portrait orientation.</td>
+</tr>
+
 <tr>
   <td rowspan="3">Telephony</td>
   <td><code>android.hardware.telephony</code></td>
@@ -672,17 +706,18 @@
 </tr>
 
 <tr>
-  <td rowspan="5">Touchscreen</td>
+  <td rowspan="7">Touchscreen</td>
   <td><code>android.hardware.faketouch</code></td>
   <td>The application uses basic touch interaction events, such as "click down", "click
 up", and drag.</td>
-  <td>When declared, this indicates that the application is compatible with a device that offers an
-emulated touchscreen ("fake touch" interface), or better. A device that offers a fake touch 
-interface provides a user input system that emulates a subset of touchscreen capabilities. For
-example, a mouse or remote control that drives an on-screen cursor provides a fake touch interface.
-If your application requires only basic point and click interaction, you should declare this
-feature. Because this is the minimum level of touch interaction, your app will also be compatible
-with devices that offer more complex touch interfaces.
+  <td><p>When declared as required, this indicates that the application is compatible with a device
+only if it offers an emulated touchscreen ("fake touch" interface), or better. A device that offers
+a fake touch interface provides a user input system that emulates a subset of touchscreen
+capabilities. For example, a mouse or remote control that drives an on-screen cursor provides a fake
+touch interface. If your application requires basic point and click interaction (in other
+words, it won't work with <em>only</em> a d-pad controller), you should declare this feature.
+Because this is the minimum level of touch interaction, your app will also be compatible with
+devices that offer more complex touch interfaces.</p>
   <p class="note"><strong>Note:</strong> Because applications require the {@code
 android.hardware.touchscreen} feature by default, if you want your application to be available to
 devices that provide a fake touch interface, you must also explicitly declare that a touch screen is
@@ -690,18 +725,53 @@
 android:name="android.hardware.touchscreen" <strong>android:required="false"</strong>
 /&gt;}</p></td>
 </tr>
+
+<tr>
+  <td><code>android.hardware.faketouch.multitouch.distinct</code></td>
+  <td>The application performs distinct tracking of two or more "fingers" on a fake touch
+interface. This is a superset of the faketouch feature.</td>
+  <td><p>When declared as required, this indicates that the application is compatible with a device
+only if it supports touch emulation for events that supports distinct tracking of two or more
+fingers, or better.</p>
+  <p>Unlike the distinct multitouch defined by {@code
+android.hardware.touchscreen.multitouch.distinct}, input devices that support distinct multi-touch
+with a fake touch interface will not support all two-finger gestures, because the input is
+being transformed to cursor movement on the screen. That is, single finger gestures on such a device
+move a cursor; two-finger swipes will result in single-finger touch events; other two-finger
+gestures will result in the corresponding two-finger touch event. An example device that supports
+distinct multi-touch with a fake touch interface is one that provides a trackpad for cursor movement
+which also supports two or more fingers.</p></td>
+</tr>
+
+<tr>
+  <td><code>android.hardware.faketouch.multitouch.jazzhand</code></td>
+  <td>The application performs distinct tracking of five or more "fingers" on a fake touch
+interface. This is a superset of the faketouch feature.</td>
+  <td><p>When declared as required, this indicates that the application is compatible with a device
+only if it supports touch emulation for events that supports distinct tracking of five or more
+fingers.</p>
+  <p>Unlike the distinct multitouch defined by {@code
+android.hardware.touchscreen.multitouch.jazzhand}, input devices that support jazzhand multi-touch
+with a fake touch interface will not support all five-finger gestures, because the input is being
+transformed to cursor movement on the screen. That is, single finger gestures on such a device move
+a cursor; multi-finger gestures will result in single-finger touch events; other multi-finger
+gestures will result in the corresponding multi-finger touch event. An example device that supports
+distinct multi-touch with a fake touch interface is one that provides a trackpad for cursor movement
+which also supports five or more fingers.</p></td>
+</tr>
+
 <tr>
   <td><code>android.hardware.touchscreen</code></td>
   <td>The application uses touchscreen capabilities for gestures that are more interactive
-than basic touch events, such as a fling. This is a superset of the faketouch features.</td>
-  <td>By default, your application requires this. As such, your application is
-<em>not</em> available to devices that provide only an emulated touch interface ("fake touch"), by
-default. If you want your application available to devices that provide a fake touch interface,
-you must explicitly declare that a touch screen is not required, by
-declaring {@code android.hardware.touchscreen} with {@code android:required="false"}. You should
-do so even if your application uses&mdash;but does not <em>require</em>&mdash;a real touch screen
-interface.
-<p>If your application <em>does require</em> a basic touch interface (in order to perform touch
+than basic touch events, such as a fling. This is a superset of the basic faketouch feature.</td>
+  <td><p>By default, your application requires this. As such, your application is <em>not</em>
+available to devices that provide only an emulated touch interface ("fake touch"), by default. If
+you want your application available to devices that provide a fake touch interface (or even devices
+that provide only a d-pad controller), you must explicitly declare that a touch screen is not
+required, by declaring {@code android.hardware.touchscreen} with {@code android:required="false"}.
+You should do so even if your application uses&mdash;but does not <em>require</em>&mdash;a real
+touch screen interface.</p>
+<p>If your application <em>does require</em> a touch interface (in order to perform touch
 gestures such as a fling), then you don't need to do anything, because this is required by default.
 However, it's best if you explicitly declare all features used by your application, so you should
 still declare this if your app uses it.</p>
@@ -712,7 +782,7 @@
   <td><code>android.hardware.touchscreen.multitouch</code></td>
   <td>The application uses basic two-point multitouch capabilities on the device
 screen, such as for pinch gestures, but does not need to track touches independently. This
-is a superset of touchscreen features.</td>
+is a superset of touchscreen feature.</td>
   <td>This implicitly declares the <code>android.hardware.touchscreen</code> parent feature, unless
 declared with <code>android:required="false"</code>. </td>
 </tr>
@@ -720,7 +790,7 @@
   <td><code>android.hardware.touchscreen.multitouch.distinct</code></td>
   <td>Subfeature. The application uses advanced multipoint multitouch
 capabilities on the device screen, such as for tracking two or more points fully
-independently. This is a superset of multitouch features.</td>
+independently. This is a superset of multitouch feature.</td>
   <td rowspan="2">This implicitly declares the <code>android.hardware.touchscreen.multitouch</code>
 parent feature, unless declared with <code>android:required="false"</code>. </td>
 </tr>
@@ -728,7 +798,7 @@
   <td><code>android.hardware.touchscreen.multitouch.jazzhand</code></td>
   <td>The application uses advanced multipoint multitouch
 capabilities on the device screen, for tracking up to five points fully
-independently. This is a superset of distinct multitouch features.</td>
+independently. This is a superset of distinct multitouch feature.</td>
 </tr>
 
 <tr>
diff --git a/docs/html/sdk/android-3.2.jd b/docs/html/sdk/android-3.2.jd
index ea2b4ed..aeaf9c8 100644
--- a/docs/html/sdk/android-3.2.jd
+++ b/docs/html/sdk/android-3.2.jd
@@ -550,7 +550,11 @@
 
 <p>A typical application that functions properly in both landscape and portrait orientations would not normally need to declare an orientation requirement. Rather, an application designed primarily for one orientation, such as an app designed for a television, could declare one of the constants to ensure that it isn't available to devices that don't provide that orientation.</p>
 
-<p>If the application is targeting API level 12 or lower, the platform assumes that if app has not specified whether it requires portrait or landscape, both orientations are required.</p>
+<p>If any of activities declared in the manifest request that they run in a specific orientation,
+using the <a href="{@docRoot}guide/topics/manifest/activity-element.html#screen">{@code
+android:screenOrientation}</a> attribute, then this also declares that the application
+requires that orientation.</p>
+
 </li>
 <li>Other feature constants
 
diff --git a/include/binder/CursorWindow.h b/include/binder/CursorWindow.h
index d227244..5d490ed 100644
--- a/include/binder/CursorWindow.h
+++ b/include/binder/CursorWindow.h
@@ -21,18 +21,8 @@
 #include <stddef.h>
 #include <stdint.h>
 
-#include <binder/IMemory.h>
-#include <utils/RefBase.h>
-
-#define DEFAULT_WINDOW_SIZE 4096
-#define WINDOW_ALLOCATION_SIZE 4096
-
-#define ROW_SLOT_CHUNK_NUM_ROWS 16
-
-// Row slots are allocated in chunks of ROW_SLOT_CHUNK_NUM_ROWS,
-// with an offset after the rows that points to the next chunk
-#define ROW_SLOT_CHUNK_SIZE ((ROW_SLOT_CHUNK_NUM_ROWS * sizeof(row_slot_t)) + sizeof(uint32_t))
-
+#include <binder/Parcel.h>
+#include <utils/String8.h>
 
 #if LOG_NDEBUG
 
@@ -46,176 +36,157 @@
 
 #endif
 
-
-// When defined to true strings are stored as UTF8, otherwise they're UTF16
-#define WINDOW_STORAGE_UTF8 1
-
-// When defined to true numberic values are stored inline in the field_slot_t, otherwise they're allocated in the window
-#define WINDOW_STORAGE_INLINE_NUMERICS 1
-
 namespace android {
 
-typedef struct
-{
-    uint32_t numRows;
-    uint32_t numColumns;
-} window_header_t;
-
-typedef struct
-{
-    uint32_t offset;
-} row_slot_t;
-
-typedef struct
-{
-    uint8_t type;
-    union {
-        double d;
-        int64_t l;
-        struct {
-            uint32_t offset;
-            uint32_t size;
-        } buffer;
-    } data;
-} __attribute__((packed)) field_slot_t;
-
-#define FIELD_TYPE_NULL 0
-#define FIELD_TYPE_INTEGER 1
-#define FIELD_TYPE_FLOAT 2
-#define FIELD_TYPE_STRING 3
-#define FIELD_TYPE_BLOB 4
-
 /**
  * This class stores a set of rows from a database in a buffer. The begining of the
- * window has first chunk of row_slot_ts, which are offsets to the row directory, followed by
- * an offset to the next chunk in a linked-list of additional chunk of row_slot_ts in case
+ * window has first chunk of RowSlots, which are offsets to the row directory, followed by
+ * an offset to the next chunk in a linked-list of additional chunk of RowSlots in case
  * the pre-allocated chunk isn't big enough to refer to all rows. Each row directory has a
- * field_slot_t per column, which has the size, offset, and type of the data for that field.
+ * FieldSlot per column, which has the size, offset, and type of the data for that field.
  * Note that the data types come from sqlite3.h.
+ *
+ * Strings are stored in UTF-8.
  */
-class CursorWindow
-{
+class CursorWindow {
+    CursorWindow(const String8& name, int ashmemFd,
+            void* data, size_t size, bool readOnly);
+
 public:
-                        CursorWindow(size_t maxSize);
-                        CursorWindow(){}
-    bool                setMemory(const sp<IMemory>&);
-                        ~CursorWindow();
+    /* Field types. */
+    enum {
+        FIELD_TYPE_NULL = 0,
+        FIELD_TYPE_INTEGER = 1,
+        FIELD_TYPE_FLOAT = 2,
+        FIELD_TYPE_STRING = 3,
+        FIELD_TYPE_BLOB = 4,
+    };
 
-    bool                initBuffer(bool localOnly);
-    sp<IMemory>         getMemory() {return mMemory;}
+    /* Opaque type that describes a field slot. */
+    struct FieldSlot {
+    private:
+        int32_t type;
+        union {
+            double d;
+            int64_t l;
+            struct {
+                uint32_t offset;
+                uint32_t size;
+            } buffer;
+        } data;
 
-    size_t              size() {return mSize;}
-    uint8_t *           data() {return mData;}
-    uint32_t            getNumRows() {return mHeader->numRows;}
-    uint32_t            getNumColumns() {return mHeader->numColumns;}
-    void                freeLastRow() {
-                            if (mHeader->numRows > 0) {
-                                mHeader->numRows--;
-                            }
-                        }
-    bool                setNumColumns(uint32_t numColumns)
-                            {
-                                uint32_t cur = mHeader->numColumns;
-                                if (cur > 0 && cur != numColumns) {
-                                    LOGE("Trying to go from %d columns to %d", cur, numColumns);
-                                    return false;
-                                }
-                                mHeader->numColumns = numColumns;
-                                return true;
-                            }
+        friend class CursorWindow;
+    } __attribute((packed));
 
-    int32_t             freeSpace();
+    ~CursorWindow();
 
-    void                clear();
+    static status_t create(const String8& name, size_t size, bool localOnly,
+            CursorWindow** outCursorWindow);
+    static status_t createFromParcel(Parcel* parcel, CursorWindow** outCursorWindow);
 
-                        /**
-                         * Allocate a row slot and its directory. The returned
-                         * pointer points to the begining of the row's directory
-                         * or NULL if there wasn't room. The directory is
-                         * initialied with NULL entries for each field.
-                         */
-    field_slot_t *      allocRow();
+    status_t writeToParcel(Parcel* parcel);
 
-                        /**
-                         * Allocate a portion of the window. Returns the offset
-                         * of the allocation, or 0 if there isn't enough space.
-                         * If aligned is true, the allocation gets 4 byte alignment.
-                         */
-    uint32_t            alloc(size_t size, bool aligned = false);
+    inline String8 name() { return mName; }
+    inline size_t size() { return mSize; }
+    inline size_t freeSpace() { return mSize - mHeader->freeOffset; }
+    inline uint32_t getNumRows() { return mHeader->numRows; }
+    inline uint32_t getNumColumns() { return mHeader->numColumns; }
 
-                        /**
-                         * Copy data into the window at the given offset.
-                         */
-    void                copyIn(uint32_t offset, uint8_t const * data, size_t size);
-    void                copyIn(uint32_t offset, int64_t data);
-    void                copyIn(uint32_t offset, double data);
-
-    void                copyOut(uint32_t offset, uint8_t * data, size_t size);
-    int64_t             copyOutLong(uint32_t offset);
-    double              copyOutDouble(uint32_t offset);
-
-    bool                putLong(unsigned int row, unsigned int col, int64_t value);
-    bool                putDouble(unsigned int row, unsigned int col, double value);
-    bool                putNull(unsigned int row, unsigned int col);
-
-    bool                getLong(unsigned int row, unsigned int col, int64_t * valueOut);
-    bool                getDouble(unsigned int row, unsigned int col, double * valueOut);
-    bool                getNull(unsigned int row, unsigned int col, bool * valueOut);
-
-    uint8_t *           offsetToPtr(uint32_t offset) {return mData + offset;}
-
-    row_slot_t *        allocRowSlot();
-
-    row_slot_t *        getRowSlot(int row);
-
-                        /**
-                         * return NULL if Failed to find rowSlot or
-                         * Invalid rowSlot
-                         */
-    field_slot_t *      getFieldSlotWithCheck(int row, int column);
-    field_slot_t *      getFieldSlot(int row, int column)
-                            {
-                                int fieldDirOffset = getRowSlot(row)->offset;
-                                return ((field_slot_t *)offsetToPtr(fieldDirOffset)) + column;
-                            }
-
-    int64_t getFieldSlotValueLong(field_slot_t* fieldSlot) {
-#if WINDOW_STORAGE_INLINE_NUMERICS
-        return fieldSlot->data.l;
-#else
-        return copyOutLong(fieldSlot->data.buffer.offset);
-#endif
-    }
-
-    double getFieldSlotValueDouble(field_slot_t* fieldSlot) {
-#if WINDOW_STORAGE_INLINE_NUMERICS
-        return fieldSlot->data.d;
-#else
-        return copyOutDouble(fieldSlot->data.buffer.offset);
-#endif
-    }
-
-#if WINDOW_STORAGE_UTF8
-    char* getFieldSlotValueString(field_slot_t* fieldSlot) {
-        return reinterpret_cast<char*>(offsetToPtr(fieldSlot->data.buffer.offset));
-    }
-#else
-    char16_t* getFieldSlotValueString(field_slot_t* fieldSlot) {
-        return reinterpret_cast<char16_t*>(offsetToPtr(fieldSlot->data.buffer.offset));
-    }
-#endif
-
-private:
-    uint8_t * mData;
-    size_t mSize;
-    size_t mMaxSize;
-    window_header_t * mHeader;
-    sp<IMemory> mMemory;
+    status_t clear();
+    status_t setNumColumns(uint32_t numColumns);
 
     /**
-     * Offset of the lowest unused data byte in the array.
+     * Allocate a row slot and its directory.
+     * The row is initialized will null entries for each field.
      */
-    uint32_t mFreeOffset;
+    status_t allocRow();
+    status_t freeLastRow();
+
+    status_t putBlob(uint32_t row, uint32_t column, const void* value, size_t size);
+    status_t putString(uint32_t row, uint32_t column, const char* value, size_t sizeIncludingNull);
+    status_t putLong(uint32_t row, uint32_t column, int64_t value);
+    status_t putDouble(uint32_t row, uint32_t column, double value);
+    status_t putNull(uint32_t row, uint32_t column);
+
+    /**
+     * Gets the field slot at the specified row and column.
+     * Returns null if the requested row or column is not in the window.
+     */
+    FieldSlot* getFieldSlot(uint32_t row, uint32_t column);
+
+    inline int32_t getFieldSlotType(FieldSlot* fieldSlot) {
+        return fieldSlot->type;
+    }
+
+    inline int64_t getFieldSlotValueLong(FieldSlot* fieldSlot) {
+        return fieldSlot->data.l;
+    }
+
+    inline double getFieldSlotValueDouble(FieldSlot* fieldSlot) {
+        return fieldSlot->data.d;
+    }
+
+    inline const char* getFieldSlotValueString(FieldSlot* fieldSlot,
+            size_t* outSizeIncludingNull) {
+        *outSizeIncludingNull = fieldSlot->data.buffer.size;
+        return static_cast<char*>(offsetToPtr(fieldSlot->data.buffer.offset));
+    }
+
+    inline const void* getFieldSlotValueBlob(FieldSlot* fieldSlot, size_t* outSize) {
+        *outSize = fieldSlot->data.buffer.size;
+        return offsetToPtr(fieldSlot->data.buffer.offset);
+    }
+
+private:
+    static const size_t ROW_SLOT_CHUNK_NUM_ROWS = 100;
+
+    struct Header {
+        // Offset of the lowest unused byte in the window.
+        uint32_t freeOffset;
+
+        // Offset of the first row slot chunk.
+        uint32_t firstChunkOffset;
+
+        uint32_t numRows;
+        uint32_t numColumns;
+    };
+
+    struct RowSlot {
+        uint32_t offset;
+    };
+
+    struct RowSlotChunk {
+        RowSlot slots[ROW_SLOT_CHUNK_NUM_ROWS];
+        uint32_t nextChunkOffset;
+    };
+
+    String8 mName;
+    int mAshmemFd;
+    void* mData;
+    size_t mSize;
+    bool mReadOnly;
+    Header* mHeader;
+
+    inline void* offsetToPtr(uint32_t offset) {
+        return static_cast<uint8_t*>(mData) + offset;
+    }
+
+    inline uint32_t offsetFromPtr(void* ptr) {
+        return static_cast<uint8_t*>(ptr) - static_cast<uint8_t*>(mData);
+    }
+
+    /**
+     * Allocate a portion of the window. Returns the offset
+     * of the allocation, or 0 if there isn't enough space.
+     * If aligned is true, the allocation gets 4 byte alignment.
+     */
+    uint32_t alloc(size_t size, bool aligned = false);
+
+    RowSlot* getRowSlot(uint32_t row);
+    RowSlot* allocRowSlot();
+
+    status_t putBlobOrString(uint32_t row, uint32_t column,
+            const void* value, size_t size, int32_t type);
 };
 
 }; // namespace android
diff --git a/libs/binder/CursorWindow.cpp b/libs/binder/CursorWindow.cpp
index b02374f..1b85a71 100644
--- a/libs/binder/CursorWindow.cpp
+++ b/libs/binder/CursorWindow.cpp
@@ -19,8 +19,9 @@
 
 #include <utils/Log.h>
 #include <binder/CursorWindow.h>
-#include <binder/MemoryHeapBase.h>
-#include <binder/MemoryBase.h>
+
+#include <cutils/ashmem.h>
+#include <sys/mman.h>
 
 #include <assert.h>
 #include <string.h>
@@ -28,350 +29,325 @@
 
 namespace android {
 
-CursorWindow::CursorWindow(size_t maxSize) :
-    mMaxSize(maxSize)
-{
+CursorWindow::CursorWindow(const String8& name, int ashmemFd,
+        void* data, size_t size, bool readOnly) :
+        mName(name), mAshmemFd(ashmemFd), mData(data), mSize(size), mReadOnly(readOnly) {
+    mHeader = static_cast<Header*>(mData);
 }
 
-bool CursorWindow::setMemory(const sp<IMemory>& memory)
-{
-    mMemory = memory;
-    mData = (uint8_t *) memory->pointer();
-    if (mData == NULL) {
-        return false;
-    }
-    mHeader = (window_header_t *) mData;
-
-    // Make the window read-only
-    ssize_t size = memory->size();
-    mSize = size;
-    mMaxSize = size;
-    mFreeOffset = size;
-LOG_WINDOW("Created CursorWindow from existing IMemory: mFreeOffset = %d, numRows = %d, numColumns = %d, mSize = %d, mMaxSize = %d, mData = %p", mFreeOffset, mHeader->numRows, mHeader->numColumns, mSize, mMaxSize, mData);
-    return true;
+CursorWindow::~CursorWindow() {
+    ::munmap(mData, mSize);
+    ::close(mAshmemFd);
 }
 
-bool CursorWindow::initBuffer(bool localOnly)
-{
-    //TODO Use a non-memory dealer mmap region for localOnly
+status_t CursorWindow::create(const String8& name, size_t size, bool localOnly,
+        CursorWindow** outCursorWindow) {
+    String8 ashmemName("CursorWindow: ");
+    ashmemName.append(name);
+    ashmemName.append(localOnly ? " (local)" : " (remote)");
 
-    sp<MemoryHeapBase> heap;
-    heap = new MemoryHeapBase(mMaxSize, 0, "CursorWindow");
-    if (heap != NULL) {
-        mMemory = new MemoryBase(heap, 0, mMaxSize);
-        if (mMemory != NULL) {
-            mData = (uint8_t *) mMemory->pointer();
-            if (mData) {
-                mHeader = (window_header_t *) mData;
-                mSize = mMaxSize;
-
-                // Put the window into a clean state
-                clear();
-            LOG_WINDOW("Created CursorWindow with new MemoryDealer: mFreeOffset = %d, mSize = %d, mMaxSize = %d, mData = %p", mFreeOffset, mSize, mMaxSize, mData);
-                return true;                
-            }
-        } 
-        LOGE("CursorWindow heap allocation failed");
-        return false;
+    status_t result;
+    int ashmemFd = ashmem_create_region(ashmemName.string(), size);
+    if (ashmemFd < 0) {
+        result = -errno;
     } else {
-        LOGE("failed to create the CursorWindow heap");
-        return false;
+        result = ashmem_set_prot_region(ashmemFd, PROT_READ | PROT_WRITE);
+        if (result >= 0) {
+            void* data = ::mmap(NULL, size, PROT_READ | PROT_WRITE, MAP_SHARED, ashmemFd, 0);
+            if (data == MAP_FAILED) {
+                result = -errno;
+            } else {
+                result = ashmem_set_prot_region(ashmemFd, PROT_READ);
+                if (result >= 0) {
+                    CursorWindow* window = new CursorWindow(name, ashmemFd,
+                            data, size, false /*readOnly*/);
+                    result = window->clear();
+                    if (!result) {
+                        LOG_WINDOW("Created new CursorWindow: freeOffset=%d, "
+                                "numRows=%d, numColumns=%d, mSize=%d, mData=%p",
+                                window->mHeader->freeOffset,
+                                window->mHeader->numRows,
+                                window->mHeader->numColumns,
+                                window->mSize, window->mData);
+                        *outCursorWindow = window;
+                        return OK;
+                    }
+                    delete window;
+                }
+            }
+            ::munmap(data, size);
+        }
+        ::close(ashmemFd);
     }
+    *outCursorWindow = NULL;
+    return result;
 }
 
-CursorWindow::~CursorWindow()
-{
-    // Everything that matters is a smart pointer
+status_t CursorWindow::createFromParcel(Parcel* parcel, CursorWindow** outCursorWindow) {
+    String8 name = parcel->readString8();
+
+    status_t result;
+    int ashmemFd = parcel->readFileDescriptor();
+    if (ashmemFd == int(BAD_TYPE)) {
+        result = BAD_TYPE;
+    } else {
+        ssize_t size = ashmem_get_size_region(ashmemFd);
+        if (size < 0) {
+            result = UNKNOWN_ERROR;
+        } else {
+            int dupAshmemFd = ::dup(ashmemFd);
+            if (dupAshmemFd < 0) {
+                result = -errno;
+            } else {
+                void* data = ::mmap(NULL, size, PROT_READ, MAP_SHARED, dupAshmemFd, 0);
+                if (data == MAP_FAILED) {
+                    result = -errno;
+                } else {
+                    CursorWindow* window = new CursorWindow(name, dupAshmemFd,
+                            data, size, true /*readOnly*/);
+                    LOG_WINDOW("Created CursorWindow from parcel: freeOffset=%d, "
+                            "numRows=%d, numColumns=%d, mSize=%d, mData=%p",
+                            window->mHeader->freeOffset,
+                            window->mHeader->numRows,
+                            window->mHeader->numColumns,
+                            window->mSize, window->mData);
+                    *outCursorWindow = window;
+                    return OK;
+                }
+                ::close(dupAshmemFd);
+            }
+        }
+    }
+    *outCursorWindow = NULL;
+    return result;
 }
 
-void CursorWindow::clear()
-{
+status_t CursorWindow::writeToParcel(Parcel* parcel) {
+    status_t status = parcel->writeString8(mName);
+    if (!status) {
+        status = parcel->writeDupFileDescriptor(mAshmemFd);
+    }
+    return status;
+}
+
+status_t CursorWindow::clear() {
+    if (mReadOnly) {
+        return INVALID_OPERATION;
+    }
+
+    mHeader->freeOffset = sizeof(Header) + sizeof(RowSlotChunk);
+    mHeader->firstChunkOffset = sizeof(Header);
     mHeader->numRows = 0;
     mHeader->numColumns = 0;
-    mFreeOffset = sizeof(window_header_t) + ROW_SLOT_CHUNK_SIZE;
-    // Mark the first chunk's next 'pointer' as null
-    *((uint32_t *)(mData + mFreeOffset - sizeof(uint32_t))) = 0;
+
+    RowSlotChunk* firstChunk = static_cast<RowSlotChunk*>(offsetToPtr(mHeader->firstChunkOffset));
+    firstChunk->nextChunkOffset = 0;
+    return OK;
 }
 
-int32_t CursorWindow::freeSpace()
-{
-    int32_t freeSpace = mSize - mFreeOffset;
-    if (freeSpace < 0) {
-        freeSpace = 0;
+status_t CursorWindow::setNumColumns(uint32_t numColumns) {
+    if (mReadOnly) {
+        return INVALID_OPERATION;
     }
-    return freeSpace;
+
+    uint32_t cur = mHeader->numColumns;
+    if ((cur > 0 || mHeader->numRows > 0) && cur != numColumns) {
+        LOGE("Trying to go from %d columns to %d", cur, numColumns);
+        return INVALID_OPERATION;
+    }
+    mHeader->numColumns = numColumns;
+    return OK;
 }
 
-field_slot_t * CursorWindow::allocRow()
-{
+status_t CursorWindow::allocRow() {
+    if (mReadOnly) {
+        return INVALID_OPERATION;
+    }
+
     // Fill in the row slot
-    row_slot_t * rowSlot = allocRowSlot();
+    RowSlot* rowSlot = allocRowSlot();
     if (rowSlot == NULL) {
-        return NULL;
+        return NO_MEMORY;
     }
 
     // Allocate the slots for the field directory
-    size_t fieldDirSize = mHeader->numColumns * sizeof(field_slot_t);
-    uint32_t fieldDirOffset = alloc(fieldDirSize);
+    size_t fieldDirSize = mHeader->numColumns * sizeof(FieldSlot);
+    uint32_t fieldDirOffset = alloc(fieldDirSize, true /*aligned*/);
     if (!fieldDirOffset) {
         mHeader->numRows--;
-        LOG_WINDOW("The row failed, so back out the new row accounting from allocRowSlot %d", mHeader->numRows);
-        return NULL;
+        LOG_WINDOW("The row failed, so back out the new row accounting "
+                "from allocRowSlot %d", mHeader->numRows);
+        return NO_MEMORY;
     }
-    field_slot_t * fieldDir = (field_slot_t *)offsetToPtr(fieldDirOffset);
-    memset(fieldDir, 0x0, fieldDirSize);
+    FieldSlot* fieldDir = static_cast<FieldSlot*>(offsetToPtr(fieldDirOffset));
+    memset(fieldDir, 0, fieldDirSize);
 
-LOG_WINDOW("Allocated row %u, rowSlot is at offset %u, fieldDir is %d bytes at offset %u\n", (mHeader->numRows - 1), ((uint8_t *)rowSlot) - mData, fieldDirSize, fieldDirOffset);
+    LOG_WINDOW("Allocated row %u, rowSlot is at offset %u, fieldDir is %d bytes at offset %u\n",
+            mHeader->numRows - 1, offsetFromPtr(rowSlot), fieldDirSize, fieldDirOffset);
     rowSlot->offset = fieldDirOffset;
-
-    return fieldDir;
+    return OK;
 }
 
-uint32_t CursorWindow::alloc(size_t requestedSize, bool aligned)
-{
-    int32_t size;
+status_t CursorWindow::freeLastRow() {
+    if (mReadOnly) {
+        return INVALID_OPERATION;
+    }
+
+    if (mHeader->numRows > 0) {
+        mHeader->numRows--;
+    }
+    return OK;
+}
+
+uint32_t CursorWindow::alloc(size_t size, bool aligned) {
     uint32_t padding;
     if (aligned) {
         // 4 byte alignment
-        padding = 4 - (mFreeOffset & 0x3);
+        padding = (~mHeader->freeOffset + 1) & 3;
     } else {
         padding = 0;
     }
 
-    size = requestedSize + padding;
-
-    if (size > freeSpace()) {
-        LOGV("need to grow: mSize = %d, size = %d, freeSpace() = %d, numRows = %d", mSize, size,
-                freeSpace(), mHeader->numRows);
-        // Only grow the window if the first row doesn't fit
-        if (mHeader->numRows > 1) {
-            LOGV("not growing since there are already %d row(s), max size %d", mHeader->numRows,
-                    mMaxSize);
-            return 0;
-        }
-
-        // Find a new size that will fit the allocation
-        int allocated = mSize - freeSpace();
-        int newSize = mSize + WINDOW_ALLOCATION_SIZE;
-        while (size > (newSize - allocated)) {
-            newSize += WINDOW_ALLOCATION_SIZE;
-            if (newSize > mMaxSize) {
-                LOGE("Attempting to grow window beyond max size (%d)", mMaxSize);
-                return 0;
-            }
-        }
-LOG_WINDOW("found size %d", newSize);
-        mSize = newSize;
+    uint32_t offset = mHeader->freeOffset + padding;
+    uint32_t nextFreeOffset = offset + size;
+    if (nextFreeOffset > mSize) {
+        LOGE("Window is full: requested allocation %d bytes, "
+                "free space %d bytes, window size %d bytes",
+                size, freeSpace(), mSize);
+        return 0;
     }
 
-    uint32_t offset = mFreeOffset + padding;
-    mFreeOffset += size;
+    mHeader->freeOffset = nextFreeOffset;
     return offset;
 }
 
-row_slot_t * CursorWindow::getRowSlot(int row)
-{
-    LOG_WINDOW("enter getRowSlot current row num %d, this row %d", mHeader->numRows, row);
-    int chunkNum = row / ROW_SLOT_CHUNK_NUM_ROWS;
-    int chunkPos = row % ROW_SLOT_CHUNK_NUM_ROWS;
-    int chunkPtrOffset = sizeof(window_header_t) + ROW_SLOT_CHUNK_SIZE - sizeof(uint32_t);
-    uint8_t * rowChunk = mData + sizeof(window_header_t);
-    for (int i = 0; i < chunkNum; i++) {
-        rowChunk = offsetToPtr(*((uint32_t *)(mData + chunkPtrOffset)));
-        chunkPtrOffset = rowChunk - mData + (ROW_SLOT_CHUNK_NUM_ROWS * sizeof(row_slot_t));
+CursorWindow::RowSlot* CursorWindow::getRowSlot(uint32_t row) {
+    uint32_t chunkPos = row;
+    RowSlotChunk* chunk = static_cast<RowSlotChunk*>(
+            offsetToPtr(mHeader->firstChunkOffset));
+    while (chunkPos >= ROW_SLOT_CHUNK_NUM_ROWS) {
+        chunk = static_cast<RowSlotChunk*>(offsetToPtr(chunk->nextChunkOffset));
+        chunkPos -= ROW_SLOT_CHUNK_NUM_ROWS;
     }
-    return (row_slot_t *)(rowChunk + (chunkPos * sizeof(row_slot_t)));
-    LOG_WINDOW("exit getRowSlot current row num %d, this row %d", mHeader->numRows, row);    
+    return &chunk->slots[chunkPos];
 }
 
-row_slot_t * CursorWindow::allocRowSlot()
-{
-    int chunkNum = mHeader->numRows / ROW_SLOT_CHUNK_NUM_ROWS;
-    int chunkPos = mHeader->numRows % ROW_SLOT_CHUNK_NUM_ROWS;
-    int chunkPtrOffset = sizeof(window_header_t) + ROW_SLOT_CHUNK_SIZE - sizeof(uint32_t);
-    uint8_t * rowChunk = mData + sizeof(window_header_t);
-LOG_WINDOW("Allocating row slot, mHeader->numRows is %d, chunkNum is %d, chunkPos is %d", mHeader->numRows, chunkNum, chunkPos);
-    for (int i = 0; i < chunkNum; i++) {
-        uint32_t nextChunkOffset = *((uint32_t *)(mData + chunkPtrOffset));
-LOG_WINDOW("nextChunkOffset is %d", nextChunkOffset);
-        if (nextChunkOffset == 0) {
-            // Allocate a new row chunk
-            nextChunkOffset = alloc(ROW_SLOT_CHUNK_SIZE, true);
-            if (nextChunkOffset == 0) {
+CursorWindow::RowSlot* CursorWindow::allocRowSlot() {
+    uint32_t chunkPos = mHeader->numRows;
+    RowSlotChunk* chunk = static_cast<RowSlotChunk*>(
+            offsetToPtr(mHeader->firstChunkOffset));
+    while (chunkPos > ROW_SLOT_CHUNK_NUM_ROWS) {
+        chunk = static_cast<RowSlotChunk*>(offsetToPtr(chunk->nextChunkOffset));
+        chunkPos -= ROW_SLOT_CHUNK_NUM_ROWS;
+    }
+    if (chunkPos == ROW_SLOT_CHUNK_NUM_ROWS) {
+        if (!chunk->nextChunkOffset) {
+            chunk->nextChunkOffset = alloc(sizeof(RowSlotChunk), true /*aligned*/);
+            if (!chunk->nextChunkOffset) {
                 return NULL;
             }
-            rowChunk = offsetToPtr(nextChunkOffset);
-LOG_WINDOW("allocated new chunk at %d, rowChunk = %p", nextChunkOffset, rowChunk);
-            *((uint32_t *)(mData + chunkPtrOffset)) = rowChunk - mData;
-            // Mark the new chunk's next 'pointer' as null
-            *((uint32_t *)(rowChunk + ROW_SLOT_CHUNK_SIZE - sizeof(uint32_t))) = 0;
-        } else {
-LOG_WINDOW("follwing 'pointer' to next chunk, offset of next pointer is %d", chunkPtrOffset);
-            rowChunk = offsetToPtr(nextChunkOffset);
-            chunkPtrOffset = rowChunk - mData + (ROW_SLOT_CHUNK_NUM_ROWS * sizeof(row_slot_t));
         }
+        chunk = static_cast<RowSlotChunk*>(offsetToPtr(chunk->nextChunkOffset));
+        chunk->nextChunkOffset = 0;
+        chunkPos = 0;
     }
-    mHeader->numRows++;
-
-    return (row_slot_t *)(rowChunk + (chunkPos * sizeof(row_slot_t)));
+    mHeader->numRows += 1;
+    return &chunk->slots[chunkPos];
 }
 
-field_slot_t * CursorWindow::getFieldSlotWithCheck(int row, int column)
-{
-  if (row < 0 || row >= mHeader->numRows || column < 0 || column >= mHeader->numColumns) {
-      LOGE("Failed to read row# %d, column# from a CursorWindow which has %d rows, %d columns.",
-              row, column, mHeader->numRows, mHeader->numColumns);
-      return NULL;
-  }        
-  row_slot_t * rowSlot = getRowSlot(row);
-  if (!rowSlot) {
-      LOGE("Failed to find rowSlot for row %d", row);
-      return NULL;
-  }
-  if (rowSlot->offset == 0 || rowSlot->offset >= mSize) {
-      LOGE("Invalid rowSlot, offset = %d", rowSlot->offset);
-      return NULL;
-  }  
-  int fieldDirOffset = rowSlot->offset;
-  return ((field_slot_t *)offsetToPtr(fieldDirOffset)) + column;  
+CursorWindow::FieldSlot* CursorWindow::getFieldSlot(uint32_t row, uint32_t column) {
+    if (row >= mHeader->numRows || column >= mHeader->numColumns) {
+        LOGE("Failed to read row %d, column %d from a CursorWindow which "
+                "has %d rows, %d columns.",
+                row, column, mHeader->numRows, mHeader->numColumns);
+        return NULL;
+    }
+    RowSlot* rowSlot = getRowSlot(row);
+    if (!rowSlot) {
+        LOGE("Failed to find rowSlot for row %d.", row);
+        return NULL;
+    }
+    FieldSlot* fieldDir = static_cast<FieldSlot*>(offsetToPtr(rowSlot->offset));
+    return &fieldDir[column];
 }
 
-void CursorWindow::copyIn(uint32_t offset, uint8_t const * data, size_t size)
-{
-    assert(offset + size <= mSize);    
-    memcpy(mData + offset, data, size);
+status_t CursorWindow::putBlob(uint32_t row, uint32_t column, const void* value, size_t size) {
+    return putBlobOrString(row, column, value, size, FIELD_TYPE_BLOB);
 }
 
-void CursorWindow::copyIn(uint32_t offset, int64_t data)
-{
-    assert(offset + sizeof(int64_t) <= mSize);
-    memcpy(mData + offset, (uint8_t *)&data, sizeof(int64_t));
+status_t CursorWindow::putString(uint32_t row, uint32_t column, const char* value,
+        size_t sizeIncludingNull) {
+    return putBlobOrString(row, column, value, sizeIncludingNull, FIELD_TYPE_STRING);
 }
 
-void CursorWindow::copyIn(uint32_t offset, double data)
-{
-    assert(offset + sizeof(double) <= mSize);
-    memcpy(mData + offset, (uint8_t *)&data, sizeof(double));
-}
+status_t CursorWindow::putBlobOrString(uint32_t row, uint32_t column,
+        const void* value, size_t size, int32_t type) {
+    if (mReadOnly) {
+        return INVALID_OPERATION;
+    }
 
-void CursorWindow::copyOut(uint32_t offset, uint8_t * data, size_t size)
-{
-    assert(offset + size <= mSize);
-    memcpy(data, mData + offset, size);
-}
-
-int64_t CursorWindow::copyOutLong(uint32_t offset)
-{
-    int64_t value;
-    assert(offset + sizeof(int64_t) <= mSize);
-    memcpy(&value, mData + offset, sizeof(int64_t));
-    return value;
-}
-
-double CursorWindow::copyOutDouble(uint32_t offset)
-{
-    double value;
-    assert(offset + sizeof(double) <= mSize);
-    memcpy(&value, mData + offset, sizeof(double));
-    return value;
-}
-
-bool CursorWindow::putLong(unsigned int row, unsigned int col, int64_t value)
-{
-    field_slot_t * fieldSlot = getFieldSlotWithCheck(row, col);
+    FieldSlot* fieldSlot = getFieldSlot(row, column);
     if (!fieldSlot) {
-        return false;
+        return BAD_VALUE;
     }
 
-#if WINDOW_STORAGE_INLINE_NUMERICS
-    fieldSlot->data.l = value;
-#else
-    int offset = alloc(sizeof(int64_t));
+    uint32_t offset = alloc(size);
     if (!offset) {
-        return false;
+        return NO_MEMORY;
     }
 
-    copyIn(offset, value);
+    memcpy(offsetToPtr(offset), value, size);
 
+    fieldSlot->type = type;
     fieldSlot->data.buffer.offset = offset;
-    fieldSlot->data.buffer.size = sizeof(int64_t);
-#endif
+    fieldSlot->data.buffer.size = size;
+    return OK;
+}
+
+status_t CursorWindow::putLong(uint32_t row, uint32_t column, int64_t value) {
+    if (mReadOnly) {
+        return INVALID_OPERATION;
+    }
+
+    FieldSlot* fieldSlot = getFieldSlot(row, column);
+    if (!fieldSlot) {
+        return BAD_VALUE;
+    }
+
     fieldSlot->type = FIELD_TYPE_INTEGER;
-    return true;
+    fieldSlot->data.l = value;
+    return OK;
 }
 
-bool CursorWindow::putDouble(unsigned int row, unsigned int col, double value)
-{
-    field_slot_t * fieldSlot = getFieldSlotWithCheck(row, col);
+status_t CursorWindow::putDouble(uint32_t row, uint32_t column, double value) {
+    if (mReadOnly) {
+        return INVALID_OPERATION;
+    }
+
+    FieldSlot* fieldSlot = getFieldSlot(row, column);
     if (!fieldSlot) {
-        return false;
+        return BAD_VALUE;
     }
 
-#if WINDOW_STORAGE_INLINE_NUMERICS
-    fieldSlot->data.d = value;
-#else
-    int offset = alloc(sizeof(int64_t));
-    if (!offset) {
-        return false;
-    }
-
-    copyIn(offset, value);
-
-    fieldSlot->data.buffer.offset = offset;
-    fieldSlot->data.buffer.size = sizeof(double);
-#endif
     fieldSlot->type = FIELD_TYPE_FLOAT;
-    return true;
+    fieldSlot->data.d = value;
+    return OK;
 }
 
-bool CursorWindow::putNull(unsigned int row, unsigned int col)
-{
-    field_slot_t * fieldSlot = getFieldSlotWithCheck(row, col);
+status_t CursorWindow::putNull(uint32_t row, uint32_t column) {
+    if (mReadOnly) {
+        return INVALID_OPERATION;
+    }
+
+    FieldSlot* fieldSlot = getFieldSlot(row, column);
     if (!fieldSlot) {
-        return false;
+        return BAD_VALUE;
     }
 
     fieldSlot->type = FIELD_TYPE_NULL;
     fieldSlot->data.buffer.offset = 0;
     fieldSlot->data.buffer.size = 0;
-    return true;
-}
-
-bool CursorWindow::getLong(unsigned int row, unsigned int col, int64_t * valueOut)
-{
-    field_slot_t * fieldSlot = getFieldSlotWithCheck(row, col);
-    if (!fieldSlot || fieldSlot->type != FIELD_TYPE_INTEGER) {
-        return false;
-    }
-
-    *valueOut = getFieldSlotValueLong(fieldSlot);
-    return true;
-}
-
-bool CursorWindow::getDouble(unsigned int row, unsigned int col, double * valueOut)
-{
-    field_slot_t * fieldSlot = getFieldSlotWithCheck(row, col);
-    if (!fieldSlot || fieldSlot->type != FIELD_TYPE_FLOAT) {
-        return false;
-    }
-
-    *valueOut = getFieldSlotValueDouble(fieldSlot);
-    return true;
-}
-
-bool CursorWindow::getNull(unsigned int row, unsigned int col, bool * valueOut)
-{
-    field_slot_t * fieldSlot = getFieldSlotWithCheck(row, col);
-    if (!fieldSlot) {
-        return false;
-    }
-    
-    if (fieldSlot->type != FIELD_TYPE_NULL) {
-        *valueOut = false;
-    } else {
-        *valueOut = true;
-    }
-    return true;
+    return OK;
 }
 
 }; // namespace android
diff --git a/libs/binder/Parcel.cpp b/libs/binder/Parcel.cpp
index 608877e..c7180ce 100644
--- a/libs/binder/Parcel.cpp
+++ b/libs/binder/Parcel.cpp
@@ -752,7 +752,7 @@
 
     int result = ashmem_set_prot_region(fd, PROT_READ | PROT_WRITE);
     if (result < 0) {
-        status = -result;
+        status = result;
     } else {
         void* ptr = ::mmap(NULL, len, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);
         if (ptr == MAP_FAILED) {
@@ -760,7 +760,7 @@
         } else {
             result = ashmem_set_prot_region(fd, PROT_READ);
             if (result < 0) {
-                status = -result;
+                status = result;
             } else {
                 status = writeInt32(1);
                 if (!status) {
diff --git a/policy/src/com/android/internal/policy/impl/PhoneWindow.java b/policy/src/com/android/internal/policy/impl/PhoneWindow.java
index 2cd6eab..de8d41a2 100644
--- a/policy/src/com/android/internal/policy/impl/PhoneWindow.java
+++ b/policy/src/com/android/internal/policy/impl/PhoneWindow.java
@@ -1084,8 +1084,8 @@
         }
 
         MenuView menuView = st.isInListMode()
-                ? st.getListMenuView(mPanelMenuPresenterCallback)
-                : st.getIconMenuView(mPanelMenuPresenterCallback);
+                ? st.getListMenuView(getContext(), mPanelMenuPresenterCallback)
+                : st.getIconMenuView(getContext(), mPanelMenuPresenterCallback);
 
         st.shownPanelView = (View) menuView;
 
@@ -3251,11 +3251,11 @@
             }
         }
 
-        MenuView getListMenuView(MenuPresenter.Callback cb) {
+        MenuView getListMenuView(Context context, MenuPresenter.Callback cb) {
             if (menu == null) return null;
 
             if (!isCompact) {
-                getIconMenuView(cb); // Need this initialized to know where our offset goes
+                getIconMenuView(context, cb); // Need this initialized to know where our offset goes
             }
 
             if (listMenuPresenter == null) {
@@ -3275,11 +3275,11 @@
             return result;
         }
 
-        MenuView getIconMenuView(MenuPresenter.Callback cb) {
+        MenuView getIconMenuView(Context context, MenuPresenter.Callback cb) {
             if (menu == null) return null;
 
             if (iconMenuPresenter == null) {
-                iconMenuPresenter = new IconMenuPresenter();
+                iconMenuPresenter = new IconMenuPresenter(context);
                 iconMenuPresenter.setCallback(cb);
                 iconMenuPresenter.setId(com.android.internal.R.id.icon_menu_presenter);
                 menu.addMenuPresenter(iconMenuPresenter);