diff --git a/cmds/dumpstate/dumpstate.c b/cmds/dumpstate/dumpstate.c
index 35f0249..d309ef9 100644
--- a/cmds/dumpstate/dumpstate.c
+++ b/cmds/dumpstate/dumpstate.c
@@ -84,7 +84,7 @@
         LOGI("wrote screenshot: %s\n", screenshot_path);
     }
 
-    run_command("SYSTEM LOG", 20, "logcat", "-v", "time", "-d", "*:v", NULL);
+    run_command("SYSTEM LOG", 20, "logcat", "-v", "threadtime", "-d", "*:v", NULL);
 
     /* show the traces we collected in main(), if that was done */
     if (dump_traces_path != NULL) {
@@ -104,8 +104,8 @@
     }
 
     // dump_file("EVENT LOG TAGS", "/etc/event-log-tags");
-    run_command("EVENT LOG", 20, "logcat", "-b", "events", "-v", "time", "-d", "*:v", NULL);
-    run_command("RADIO LOG", 20, "logcat", "-b", "radio", "-v", "time", "-d", "*:v", NULL);
+    run_command("EVENT LOG", 20, "logcat", "-b", "events", "-v", "threadtime", "-d", "*:v", NULL);
+    run_command("RADIO LOG", 20, "logcat", "-b", "radio", "-v", "threadtime", "-d", "*:v", NULL);
 
     run_command("NETWORK INTERFACES", 10, "netcfg", NULL);
     dump_file("NETWORK ROUTES", "/proc/net/route");
@@ -174,6 +174,14 @@
        to increase its timeout.  we really need to do the timeouts in
        dumpsys itself... */
     run_command("DUMPSYS", 60, "dumpsys", NULL);
+
+    printf("========================================================\n");
+    printf("== Application Services\n");
+    printf("========================================================\n");
+
+    /* Instead of a 60s timeout, we should give each service a 5 second timeout */
+    run_command("APP SERVICES", 60, "dumpsys", "activity", "service", NULL);
+
 }
 
 static void usage() {
diff --git a/core/java/android/webkit/CookieManager.java b/core/java/android/webkit/CookieManager.java
index e7aab9f..61a8cda 100644
--- a/core/java/android/webkit/CookieManager.java
+++ b/core/java/android/webkit/CookieManager.java
@@ -524,6 +524,11 @@
      * Remove all cookies
      */
     public void removeAllCookie() {
+        // Clear cookies for the Chromium HTTP stack
+        nativeRemoveAllCookie();
+        // Clear cookies for the Android HTTP stack
+        // TODO: Remove this if/when we permanently switch to the Chromium HTTP stack
+        // http:/b/3118772
         final Runnable clearCache = new Runnable() {
             public void run() {
                 synchronized(CookieManager.this) {
@@ -1016,4 +1021,7 @@
         }
         return ret;
     }
+
+    // Native functions
+    private static native void nativeRemoveAllCookie();
 }
diff --git a/core/java/android/webkit/WebView.java b/core/java/android/webkit/WebView.java
index be1af65..c095199 100644
--- a/core/java/android/webkit/WebView.java
+++ b/core/java/android/webkit/WebView.java
@@ -2388,7 +2388,7 @@
         if (!rect.equals(mLastVisibleRectSent)) {
             Point pos = new Point(rect.left, rect.top);
             mWebViewCore.sendMessage(EventHub.SET_SCROLL_OFFSET,
-                    nativeMoveGeneration(), 0, pos);
+                    nativeMoveGeneration(), mUserScroll ? 1 : 0, pos);
             mLastVisibleRectSent = rect;
         }
         Rect globalRect = new Rect();
@@ -3966,7 +3966,9 @@
                 imm.restartInput(mWebTextView);
             }
         }
-        mWebTextView.requestFocus();
+        if (isFocused()) {
+            mWebTextView.requestFocus();
+        }
     }
 
     /**
@@ -6442,6 +6444,7 @@
                 }
                 case NEW_PICTURE_MSG_ID: {
                     // called for new content
+                    mUserScroll = false;
                     final WebViewCore.DrawData draw = (WebViewCore.DrawData) msg.obj;
                     setBaseLayer(draw.mBaseLayer, draw.mInvalRegion.getBounds());
                     final Point viewSize = draw.mViewPoint;
diff --git a/core/java/android/webkit/WebViewCore.java b/core/java/android/webkit/WebViewCore.java
index 8cd9f68..71da36d 100644
--- a/core/java/android/webkit/WebViewCore.java
+++ b/core/java/android/webkit/WebViewCore.java
@@ -1074,7 +1074,7 @@
                             // note: these are in document coordinates
                             // (inv-zoom)
                             Point pt = (Point) msg.obj;
-                            nativeSetScrollOffset(msg.arg1, pt.x, pt.y);
+                            nativeSetScrollOffset(msg.arg1, msg.arg2, pt.x, pt.y);
                             break;
 
                         case SET_GLOBAL_BOUNDS:
@@ -2347,7 +2347,7 @@
     private native void nativeScrollFocusedTextInput(float xPercent, int y);
 
     // these must be in document space (i.e. not scaled/zoomed).
-    private native void nativeSetScrollOffset(int gen, int dx, int dy);
+    private native void nativeSetScrollOffset(int gen, int userScrolled, int dx, int dy);
 
     private native void nativeSetGlobalBounds(int x, int y, int w, int h);
 
diff --git a/core/jni/android/graphics/Bitmap.cpp b/core/jni/android/graphics/Bitmap.cpp
index f8a80b0..8956e39 100644
--- a/core/jni/android/graphics/Bitmap.cpp
+++ b/core/jni/android/graphics/Bitmap.cpp
@@ -256,20 +256,20 @@
 #ifdef USE_OPENGL_RENDERER
     if (android::uirenderer::Caches::hasInstance()) {
         android::uirenderer::Caches::getInstance().resourceCache.destructor(bitmap);
+        return;
     }
-#else // !USE_OPENGL_RENDERER
+#endif // USE_OPENGL_RENDERER
     delete bitmap;
-#endif
 }
 
 static void Bitmap_recycle(JNIEnv* env, jobject, SkBitmap* bitmap) {
 #ifdef USE_OPENGL_RENDERER
     if (android::uirenderer::Caches::hasInstance()) {
         android::uirenderer::Caches::getInstance().resourceCache.recycle(bitmap);
+        return;
     }
-#else // !USE_OPENGL_RENDERER
-    bitmap->setPixels(NULL, NULL);
 #endif // USE_OPENGL_RENDERER
+    bitmap->setPixels(NULL, NULL);
 }
 
 // These must match the int values in Bitmap.java
diff --git a/core/jni/android/graphics/Matrix.cpp b/core/jni/android/graphics/Matrix.cpp
index 6667756..b305506 100644
--- a/core/jni/android/graphics/Matrix.cpp
+++ b/core/jni/android/graphics/Matrix.cpp
@@ -35,10 +35,10 @@
 #ifdef USE_OPENGL_RENDERER
         if (android::uirenderer::Caches::hasInstance()) {
             android::uirenderer::Caches::getInstance().resourceCache.destructor(obj);
+            return;
         }
-#else // !USE_OPENGL_RENDERER
+#endif // USE_OPENGL_RENDERER
         delete obj;
-#endif
     }
 
     static SkMatrix* create(JNIEnv* env, jobject clazz, const SkMatrix* src) {
diff --git a/core/jni/android/graphics/Paint.cpp b/core/jni/android/graphics/Paint.cpp
index 339c1a4..79a02f1 100644
--- a/core/jni/android/graphics/Paint.cpp
+++ b/core/jni/android/graphics/Paint.cpp
@@ -66,10 +66,10 @@
 #ifdef USE_OPENGL_RENDERER
         if (android::uirenderer::Caches::hasInstance()) {
             android::uirenderer::Caches::getInstance().resourceCache.destructor(obj);
+            return;
         }
-#else // !USE_OPENGL_RENDERER
+#endif // USE_OPENGL_RENDERER
         delete obj;
-#endif
     }
 
     static SkPaint* init(JNIEnv* env, jobject clazz) {
diff --git a/core/jni/android_nfc_NdefMessage.cpp b/core/jni/android_nfc_NdefMessage.cpp
index 99295f4..eaf989d 100644
--- a/core/jni/android_nfc_NdefMessage.cpp
+++ b/core/jni/android_nfc_NdefMessage.cpp
@@ -16,6 +16,8 @@
 
 #define LOG_TAG "NdefMessage"
 
+#include <stdlib.h>
+
 #include "jni.h"
 #include "JNIHelp.h"
 
diff --git a/core/jni/android_nfc_NdefRecord.cpp b/core/jni/android_nfc_NdefRecord.cpp
index 9d20d6d..0a3a519 100644
--- a/core/jni/android_nfc_NdefRecord.cpp
+++ b/core/jni/android_nfc_NdefRecord.cpp
@@ -16,6 +16,8 @@
 
 #define LOG_TAG "NdefRecord"
 
+#include <stdlib.h>
+
 #include "jni.h"
 #include "JNIHelp.h"
 
diff --git a/libs/utils/ZipFileRO.cpp b/libs/utils/ZipFileRO.cpp
index 5ff1f8f..4261196 100644
--- a/libs/utils/ZipFileRO.cpp
+++ b/libs/utils/ZipFileRO.cpp
@@ -412,10 +412,18 @@
 /*
  * Find a matching entry.
  *
- * Returns 0 if not found.
+ * Returns NULL if not found.
  */
 ZipEntryRO ZipFileRO::findEntryByName(const char* fileName) const
 {
+    /*
+     * If the ZipFileRO instance is not initialized, the entry number will
+     * end up being garbage since mHashTableSize is -1.
+     */
+    if (mHashTableSize <= 0) {
+        return NULL;
+    }
+
     int nameLen = strlen(fileName);
     unsigned int hash = computeHash(fileName, nameLen);
     int ent = hash & (mHashTableSize-1);
diff --git a/packages/SystemUI/res/drawable-mdpi/status_bar_back_default.png b/packages/SystemUI/res/drawable-mdpi/status_bar_back_default.png
index 5c57802..5aed42f 100644
--- a/packages/SystemUI/res/drawable-mdpi/status_bar_back_default.png
+++ b/packages/SystemUI/res/drawable-mdpi/status_bar_back_default.png
Binary files differ
diff --git a/packages/SystemUI/res/drawable-mdpi/status_bar_back_pressed.png b/packages/SystemUI/res/drawable-mdpi/status_bar_back_pressed.png
index a2527b3..5aed42f 100644
--- a/packages/SystemUI/res/drawable-mdpi/status_bar_back_pressed.png
+++ b/packages/SystemUI/res/drawable-mdpi/status_bar_back_pressed.png
Binary files differ
diff --git a/packages/SystemUI/res/drawable-mdpi/status_bar_home_default.png b/packages/SystemUI/res/drawable-mdpi/status_bar_home_default.png
index f219ded..7e8ade5 100644
--- a/packages/SystemUI/res/drawable-mdpi/status_bar_home_default.png
+++ b/packages/SystemUI/res/drawable-mdpi/status_bar_home_default.png
Binary files differ
diff --git a/packages/SystemUI/res/drawable-mdpi/status_bar_home_pressed.png b/packages/SystemUI/res/drawable-mdpi/status_bar_home_pressed.png
index 9e64fe8..7e8ade5 100644
--- a/packages/SystemUI/res/drawable-mdpi/status_bar_home_pressed.png
+++ b/packages/SystemUI/res/drawable-mdpi/status_bar_home_pressed.png
Binary files differ
diff --git a/packages/SystemUI/res/drawable-mdpi/status_bar_recent_default.png b/packages/SystemUI/res/drawable-mdpi/status_bar_recent_default.png
index 4dd8dc7..7de67b0 100644
--- a/packages/SystemUI/res/drawable-mdpi/status_bar_recent_default.png
+++ b/packages/SystemUI/res/drawable-mdpi/status_bar_recent_default.png
Binary files differ
diff --git a/packages/SystemUI/res/drawable-mdpi/status_bar_recent_pressed.png b/packages/SystemUI/res/drawable-mdpi/status_bar_recent_pressed.png
index 350a3e9..7de67b0 100644
--- a/packages/SystemUI/res/drawable-mdpi/status_bar_recent_pressed.png
+++ b/packages/SystemUI/res/drawable-mdpi/status_bar_recent_pressed.png
Binary files differ
diff --git a/packages/SystemUI/res/layout-xlarge/status_bar.xml b/packages/SystemUI/res/layout-xlarge/status_bar.xml
index 8824028..ed52ad5 100644
--- a/packages/SystemUI/res/layout-xlarge/status_bar.xml
+++ b/packages/SystemUI/res/layout-xlarge/status_bar.xml
@@ -41,25 +41,11 @@
             android:layout_width="wrap_content"
             android:layout_height="match_parent"
             android:layout_toRightOf="@+id/expand"
-            android:layout_toLeftOf="@+id/systemInfo"
             android:gravity="center_vertical"
             android:orientation="horizontal"
             android:visibility="gone"
             >
 
-            <TextView android:id="@+id/do_not_disturb"
-                style="?android:attr/textAppearance"
-                android:layout_width="wrap_content"
-                android:layout_height="wrap_content"
-                android:layout_gravity="right|center_vertical"
-                android:layout_marginTop="2dip"
-                android:layout_marginBottom="1dip"
-                android:layout_marginRight="10dip"
-                android:padding="6dip"
-                android:textSize="14sp"
-                android:text="@string/status_bar_do_not_disturb_button"
-                />
-
             <TextView android:id="@+id/clear_all_button"
                 style="?android:attr/textAppearance"
                 android:layout_width="wrap_content"
@@ -73,23 +59,37 @@
                 android:text="@string/status_bar_clear_all_button"
                 />
 
+            <TextView android:id="@+id/do_not_disturb"
+                style="?android:attr/textAppearance"
+                android:layout_width="wrap_content"
+                android:layout_height="wrap_content"
+                android:layout_gravity="right|center_vertical"
+                android:layout_marginTop="2dip"
+                android:layout_marginBottom="1dip"
+                android:layout_marginRight="10dip"
+                android:padding="6dip"
+                android:textSize="14sp"
+                android:text="@string/status_bar_do_not_disturb_button"
+                />
+
         </LinearLayout>
 
         <com.android.systemui.statusbar.tablet.NotificationIconArea
             android:id="@+id/notificationIcons"
             android:layout_width="wrap_content"
             android:layout_height="match_parent"
-            android:layout_toRightOf="@+id/expand"
-            android:layout_toLeftOf="@+id/systemInfo"
+            android:layout_toLeftOf="@+id/expand"
             android:gravity="center_vertical"
             android:orientation="horizontal"
             >
-            <view
-                class="com.android.systemui.statusbar.tablet.NotificationIconArea$IconLayout"
-                android:id="@+id/icons"
+            <com.android.systemui.statusbar.tablet.InputMethodButton
+                android:id="@+id/imeButton"
                 android:layout_width="wrap_content"
-                android:layout_height="@*android:dimen/status_bar_icon_size"
+                android:layout_height="match_parent"
                 android:layout_marginLeft="8dip"
+                android:src="@drawable/ic_sysbar_ime_default"
+                android:background="@drawable/ic_sysbar_icon_bg"
+                android:visibility="invisible"
                 />
             <view
                 class="com.android.systemui.statusbar.tablet.NotificationIconArea$DraggerView"
@@ -99,14 +99,12 @@
                 android:background="@drawable/sysbar_hidenotification_handle"
                 android:layout_marginLeft="8dip"
                 />
-            <com.android.systemui.statusbar.tablet.InputMethodButton
-                android:id="@+id/imeButton"
+            <view
+                class="com.android.systemui.statusbar.tablet.NotificationIconArea$IconLayout"
+                android:id="@+id/icons"
                 android:layout_width="wrap_content"
-                android:layout_height="match_parent"
+                android:layout_height="@*android:dimen/status_bar_icon_size"
                 android:layout_marginLeft="8dip"
-                android:src="@drawable/ic_sysbar_ime_default"
-                android:background="@drawable/ic_sysbar_icon_bg"
-                android:visibility="visible"
                 />
         </com.android.systemui.statusbar.tablet.NotificationIconArea>
 
@@ -115,8 +113,8 @@
             android:id="@+id/ticker"
             android:layout_width="wrap_content"
             android:layout_height="match_parent"
-            android:layout_alignParentLeft="true"
-            android:layout_toLeftOf="@+id/systemInfo"
+            android:layout_alignParentRight="true"
+            android:layout_toRightOf="@+id/systemInfo"
             android:paddingLeft="6dip"
             android:gravity="center_vertical"
             android:animateLayoutChanges="true"
@@ -132,9 +130,46 @@
             android:id="@+id/navigationArea"
             android:layout_width="wrap_content"
             android:layout_height="match_parent"
-            android:layout_alignParentRight="true"
+            android:layout_alignParentLeft="true"
             android:orientation="horizontal"
             >
+
+            <com.android.systemui.statusbar.KeyButtonView android:id="@+id/back"
+                android:layout_width="wrap_content"
+                android:layout_height="match_parent"
+                android:paddingLeft="4dip"
+                android:paddingRight="4dip"
+                android:src="@drawable/ic_sysbar_back"
+                android:background="@drawable/ic_sysbar_icon_bg"
+                systemui:keyCode="4"
+                />
+            <com.android.systemui.statusbar.KeyButtonView android:id="@+id/home"
+                android:layout_width="wrap_content"
+                android:layout_height="match_parent"
+                android:paddingLeft="4dip"
+                android:paddingRight="4dip"
+                android:src="@drawable/ic_sysbar_home"
+                android:background="@drawable/ic_sysbar_icon_bg"
+                systemui:keyCode="3"
+                />
+            <ImageButton android:id="@+id/recent"
+                android:layout_width="wrap_content"
+                android:layout_height="match_parent"
+                android:src="@drawable/ic_sysbar_recent"
+                android:background="@drawable/ic_sysbar_icon_bg"
+                android:paddingLeft="4dip"
+                android:paddingRight="4dip"
+                />
+            <com.android.systemui.statusbar.KeyButtonView android:id="@+id/menu"
+                android:layout_width="wrap_content"
+                android:layout_height="match_parent"
+                android:paddingLeft="4dip"
+                android:paddingRight="4dip"
+                android:src="@drawable/ic_sysbar_menu"
+                android:background="@drawable/ic_sysbar_icon_bg"
+                systemui:keyCode="82"
+                android:visibility="invisible"
+                />
             <com.android.systemui.statusbar.tablet.ShirtPocket
                 android:id="@+id/pocket"
                 android:layout_width="71dip"
@@ -156,42 +191,6 @@
                     android:gravity="center"
                     />
             </com.android.systemui.statusbar.tablet.ShirtPocket>
-            <com.android.systemui.statusbar.KeyButtonView android:id="@+id/menu"
-                android:layout_width="wrap_content"
-                android:layout_height="match_parent"
-                android:src="@drawable/ic_sysbar_menu"
-                android:background="@drawable/ic_sysbar_icon_bg"
-                android:paddingLeft="4dip"
-                android:paddingRight="4dip"
-                systemui:keyCode="82"
-                android:visibility="invisible"
-                />
-            <ImageButton android:id="@+id/recent"
-                android:layout_width="wrap_content"
-                android:layout_height="match_parent"
-                android:src="@drawable/ic_sysbar_recent"
-                android:background="@drawable/ic_sysbar_icon_bg"
-                android:paddingLeft="4dip"
-                android:paddingRight="4dip"
-                />
-            <com.android.systemui.statusbar.KeyButtonView android:id="@+id/home"
-                android:layout_width="wrap_content"
-                android:layout_height="match_parent"
-                android:paddingLeft="4dip"
-                android:paddingRight="4dip"
-                android:src="@drawable/ic_sysbar_home"
-                android:background="@drawable/ic_sysbar_icon_bg"
-                systemui:keyCode="3"
-                />
-            <com.android.systemui.statusbar.KeyButtonView android:id="@+id/back"
-                android:layout_width="wrap_content"
-                android:layout_height="match_parent"
-                android:paddingLeft="4dip"
-                android:paddingRight="4dip"
-                android:src="@drawable/ic_sysbar_back"
-                android:background="@drawable/ic_sysbar_icon_bg"
-                systemui:keyCode="4"
-                />
         </LinearLayout>
     </RelativeLayout>
 
diff --git a/packages/SystemUI/src/com/android/systemui/statusbar/tablet/TabletStatusBarService.java b/packages/SystemUI/src/com/android/systemui/statusbar/tablet/TabletStatusBarService.java
index 6426e7e..fd65e4d 100644
--- a/packages/SystemUI/src/com/android/systemui/statusbar/tablet/TabletStatusBarService.java
+++ b/packages/SystemUI/src/com/android/systemui/statusbar/tablet/TabletStatusBarService.java
@@ -132,7 +132,7 @@
                 WindowManager.LayoutParams.FLAG_LAYOUT_IN_SCREEN
                     | WindowManager.LayoutParams.FLAG_ALT_FOCUSABLE_IM,
                 PixelFormat.TRANSLUCENT);
-        lp.gravity = Gravity.BOTTOM | Gravity.LEFT;
+        lp.gravity = Gravity.BOTTOM | Gravity.RIGHT;
         lp.setTitle("NotificationPanel");
         lp.windowAnimations = com.android.internal.R.style.Animation_SlidingCard;
 
diff --git a/services/java/com/android/server/TelephonyRegistry.java b/services/java/com/android/server/TelephonyRegistry.java
index f5b7ca9..747af26 100644
--- a/services/java/com/android/server/TelephonyRegistry.java
+++ b/services/java/com/android/server/TelephonyRegistry.java
@@ -357,7 +357,6 @@
         if (!checkNotifyPermission("notifyDataActivity()" )) {
             return;
         }
-        handleRemoveListLocked();
         synchronized (mRecords) {
             mDataActivity = state;
             for (Record r : mRecords) {
diff --git a/services/java/com/android/server/am/ActivityManagerService.java b/services/java/com/android/server/am/ActivityManagerService.java
index b0ace2f..54a7aa1 100644
--- a/services/java/com/android/server/am/ActivityManagerService.java
+++ b/services/java/com/android/server/am/ActivityManagerService.java
@@ -7284,7 +7284,7 @@
                 }
                 return;
             } else if ("service".equals(cmd)) {
-                dumpService(fd, pw, args, opti, dumpAll);
+                dumpService(fd, pw, args, opti);
                 return;
             } else if ("services".equals(cmd) || "s".equals(cmd)) {
                 synchronized (this) {
@@ -7643,8 +7643,7 @@
      *  - the first arg isn't the flattened component name of an existing service:
      *    dump all services whose component contains the first arg as a substring
      */
-    protected void dumpService(FileDescriptor fd, PrintWriter pw, String[] args,
-            int opti, boolean dumpAll) {
+    protected void dumpService(FileDescriptor fd, PrintWriter pw, String[] args, int opti) {
         String[] newArgs;
         String componentNameString;
         ServiceRecord r;
@@ -7664,7 +7663,7 @@
         }
 
         if (r != null) {
-            dumpService(fd, pw, r, newArgs, dumpAll);
+            dumpService(fd, pw, r, newArgs);
         } else {
             ArrayList<ServiceRecord> services = new ArrayList<ServiceRecord>();
             synchronized (this) {
@@ -7676,7 +7675,7 @@
                 }
             }
             for (int i=0; i<services.size(); i++) {
-                dumpService(fd, pw, services.get(i), newArgs, dumpAll);
+                dumpService(fd, pw, services.get(i), newArgs);
             }
         }
     }
@@ -7685,16 +7684,10 @@
      * Invokes IApplicationThread.dumpService() on the thread of the specified service if
      * there is a thread associated with the service.
      */
-    private void dumpService(FileDescriptor fd, PrintWriter pw, ServiceRecord r, String[] args,
-            boolean dumpAll) {
-        pw.println("  Service " + r.name.flattenToString());
-        if (dumpAll) {
-            synchronized (this) {
-                pw.print("  * "); pw.println(r);
-                r.dump(pw, "    ");
-            }
-            pw.println("");
-        }
+    private void dumpService(FileDescriptor fd, PrintWriter pw, ServiceRecord r, String[] args) {
+        pw.println("------------------------------------------------------------"
+                + "-------------------");
+        pw.println("APP SERVICE: " + r.name.flattenToString());
         if (r.app != null && r.app.thread != null) {
             try {
                 // flush anything that is already in the PrintWriter since the thread is going
diff --git a/services/java/com/android/server/location/GpsLocationProvider.java b/services/java/com/android/server/location/GpsLocationProvider.java
index 4a6b5f4..755a228 100755
--- a/services/java/com/android/server/location/GpsLocationProvider.java
+++ b/services/java/com/android/server/location/GpsLocationProvider.java
@@ -1451,23 +1451,30 @@
                 mContext.getSystemService(Context.TELEPHONY_SERVICE);
         if (phone.getPhoneType() == TelephonyManager.PHONE_TYPE_GSM) {
             GsmCellLocation gsm_cell = (GsmCellLocation) phone.getCellLocation();
-            if ((gsm_cell != null) && (phone.getPhoneType() == TelephonyManager.PHONE_TYPE_GSM)
-                    && (phone.getNetworkOperator().length() > 3)) {
+            if ((gsm_cell != null) && (phone.getPhoneType() == TelephonyManager.PHONE_TYPE_GSM) &&
+                    (phone.getNetworkOperator() != null) &&
+                        (phone.getNetworkOperator().length() > 3)) {
                 int type;
                 int mcc = Integer.parseInt(phone.getNetworkOperator().substring(0,3));
                 int mnc = Integer.parseInt(phone.getNetworkOperator().substring(3));
-                if (phone.getNetworkType() == TelephonyManager.NETWORK_TYPE_UMTS)
+                int networkType = phone.getNetworkType();
+                if (networkType == TelephonyManager.NETWORK_TYPE_UMTS
+                    || networkType == TelephonyManager.NETWORK_TYPE_HSDPA
+                    || networkType == TelephonyManager.NETWORK_TYPE_HSUPA
+                    || networkType == TelephonyManager.NETWORK_TYPE_HSPA) {
                     type = AGPS_REF_LOCATION_TYPE_UMTS_CELLID;
-                else
+                } else {
                     type = AGPS_REF_LOCATION_TYPE_GSM_CELLID;
+                }
                 native_agps_set_ref_location_cellid(type, mcc, mnc,
                         gsm_cell.getLac(), gsm_cell.getCid());
-            }
-            else
+            } else {
                 Log.e(TAG,"Error getting cell location info.");
+            }
         }
-        else
+        else {
             Log.e(TAG,"CDMA not supported.");
+        }
     }
 
     private void sendMessage(int message, int arg, Object obj) {
diff --git a/voip/java/com/android/server/sip/SipService.java b/voip/java/com/android/server/sip/SipService.java
index 84e0803..f480fec 100644
--- a/voip/java/com/android/server/sip/SipService.java
+++ b/voip/java/com/android/server/sip/SipService.java
@@ -441,13 +441,26 @@
 
     private synchronized void addPendingSession(ISipSession session) {
         try {
+            cleanUpPendingSessions();
             mPendingSessions.put(session.getCallId(), session);
+            if (DEBUG) Log.d(TAG, "#pending sess=" + mPendingSessions.size());
         } catch (RemoteException e) {
             // should not happen with a local call
             Log.e(TAG, "addPendingSession()", e);
         }
     }
 
+    private void cleanUpPendingSessions() throws RemoteException {
+        Map.Entry<String, ISipSession>[] entries =
+                mPendingSessions.entrySet().toArray(
+                new Map.Entry[mPendingSessions.size()]);
+        for (Map.Entry<String, ISipSession> entry : entries) {
+            if (entry.getValue().getState() != SipSession.State.INCOMING_CALL) {
+                mPendingSessions.remove(entry.getKey());
+            }
+        }
+    }
+
     private synchronized boolean callingSelf(SipSessionGroupExt ringingGroup,
             SipSessionGroup.SipSessionImpl ringingSession) {
         String callId = ringingSession.getCallId();
@@ -1095,8 +1108,6 @@
         }
     }
 
-    // TODO: clean up pending SipSession(s) periodically
-
     /**
      * Timer that can schedule events to occur even when the device is in sleep.
      * Only used internally in this package.