diff --git a/cmds/bootanimation/BootAnimation.cpp b/cmds/bootanimation/BootAnimation.cpp
index e659b2b..08923119 100644
--- a/cmds/bootanimation/BootAnimation.cpp
+++ b/cmds/bootanimation/BootAnimation.cpp
@@ -397,6 +397,31 @@
     }
 }
 
+// Parse a color represented as an HTML-style 'RRGGBB' string: each pair of
+// characters in str is a hex number in [0, 255], which are converted to
+// floating point values in the range [0.0, 1.0] and placed in the
+// corresponding elements of color.
+//
+// If the input string isn't valid, parseColor returns false and color is
+// left unchanged.
+static bool parseColor(const char str[7], float color[3]) {
+    float tmpColor[3];
+    for (int i = 0; i < 3; i++) {
+        int val = 0;
+        for (int j = 0; j < 2; j++) {
+            val *= 16;
+            char c = str[2*i + j];
+            if      (c >= '0' && c <= '9') val += c - '0';
+            else if (c >= 'A' && c <= 'F') val += (c - 'A') + 10;
+            else if (c >= 'a' && c <= 'f') val += (c - 'a') + 10;
+            else                           return false;
+        }
+        tmpColor[i] = static_cast<float>(val) / 255.0f;
+    }
+    memcpy(color, tmpColor, sizeof(tmpColor));
+    return true;
+}
+
 bool BootAnimation::movie()
 {
     ZipEntryRO desc = mZip->findEntryByName("desc.txt");
@@ -427,20 +452,28 @@
         const char* l = line.string();
         int fps, width, height, count, pause;
         char path[ANIM_ENTRY_NAME_MAX];
+        char color[7] = "000000"; // default to black if unspecified
+
         char pathType;
         if (sscanf(l, "%d %d %d", &width, &height, &fps) == 3) {
-            //LOGD("> w=%d, h=%d, fps=%d", width, height, fps);
+            // ALOGD("> w=%d, h=%d, fps=%d", width, height, fps);
             animation.width = width;
             animation.height = height;
             animation.fps = fps;
         }
-        else if (sscanf(l, " %c %d %d %s", &pathType, &count, &pause, path) == 4) {
-            //LOGD("> type=%c, count=%d, pause=%d, path=%s", pathType, count, pause, path);
+        else if (sscanf(l, " %c %d %d %s #%6s", &pathType, &count, &pause, path, color) >= 4) {
+            // ALOGD("> type=%c, count=%d, pause=%d, path=%s, color=%s", pathType, count, pause, path, color);
             Animation::Part part;
             part.playUntilComplete = pathType == 'c';
             part.count = count;
             part.pause = pause;
             part.path = path;
+            if (!parseColor(color, part.backgroundColor)) {
+                ALOGE("> invalid color '#%s'", color);
+                part.backgroundColor[0] = 0.0f;
+                part.backgroundColor[1] = 0.0f;
+                part.backgroundColor[2] = 0.0f;
+            }
             animation.parts.add(part);
         }
 
@@ -526,6 +559,12 @@
             if(exitPending() && !part.playUntilComplete)
                 break;
 
+            glClearColor(
+                    part.backgroundColor[0],
+                    part.backgroundColor[1],
+                    part.backgroundColor[2],
+                    1.0f);
+
             for (size_t j=0 ; j<fcount && (!exitPending() || part.playUntilComplete) ; j++) {
                 const Animation::Frame& frame(part.frames[j]);
                 nsecs_t lastFrame = systemTime();
diff --git a/cmds/bootanimation/BootAnimation.h b/cmds/bootanimation/BootAnimation.h
index ba1c507..72cd62b 100644
--- a/cmds/bootanimation/BootAnimation.h
+++ b/cmds/bootanimation/BootAnimation.h
@@ -71,6 +71,7 @@
             String8 path;
             SortedVector<Frame> frames;
             bool playUntilComplete;
+            float backgroundColor[3];
         };
         int fps;
         int width;
diff --git a/core/java/android/os/Binder.java b/core/java/android/os/Binder.java
index ba71605..362afba 100644
--- a/core/java/android/os/Binder.java
+++ b/core/java/android/os/Binder.java
@@ -17,6 +17,7 @@
 package android.os;
 
 import android.util.Log;
+import android.util.Slog;
 import com.android.internal.util.FastPrintWriter;
 
 import java.io.FileDescriptor;
@@ -48,7 +49,7 @@
      * of classes can potentially create leaks.
      */
     private static final boolean FIND_POTENTIAL_LEAKS = false;
-    private static final String TAG = "Binder";
+    static final String TAG = "Binder";
 
     /**
      * Control whether dump() calls are allowed.
@@ -385,7 +386,14 @@
             super.finalize();
         }
     }
-    
+
+    static void checkParcel(Parcel parcel, String msg) {
+        if (parcel.dataSize() >= 800*1024) {
+            // Trying to send > 800k, this is way too much
+            Slog.wtfStack(TAG, msg + parcel.dataSize());
+        }
+    }
+
     private native final void init();
     private native final void destroy();
 
@@ -424,6 +432,7 @@
             reply.writeException(re);
             res = true;
         }
+        checkParcel(reply, "Unreasonably large binder reply buffer: ");
         reply.recycle();
         data.recycle();
         return res;
@@ -433,13 +442,18 @@
 final class BinderProxy implements IBinder {
     public native boolean pingBinder();
     public native boolean isBinderAlive();
-    
+
     public IInterface queryLocalInterface(String descriptor) {
         return null;
     }
-    
+
+    public boolean transact(int code, Parcel data, Parcel reply, int flags) throws RemoteException {
+        Binder.checkParcel(data, "Unreasonably large binder buffer: ");
+        return transactNative(code, data, reply, flags);
+    }
+
     public native String getInterfaceDescriptor() throws RemoteException;
-    public native boolean transact(int code, Parcel data, Parcel reply,
+    public native boolean transactNative(int code, Parcel data, Parcel reply,
             int flags) throws RemoteException;
     public native void linkToDeath(DeathRecipient recipient, int flags)
             throws RemoteException;
diff --git a/core/java/android/widget/AbsListView.java b/core/java/android/widget/AbsListView.java
index 2b8b4dc..0439168 100644
--- a/core/java/android/widget/AbsListView.java
+++ b/core/java/android/widget/AbsListView.java
@@ -1493,11 +1493,11 @@
         super.onInitializeAccessibilityNodeInfo(info);
         info.setClassName(AbsListView.class.getName());
         if (isEnabled()) {
-            if (getFirstVisiblePosition() > 0) {
+            if (canScrollUp()) {
                 info.addAction(AccessibilityNodeInfo.ACTION_SCROLL_BACKWARD);
                 info.setScrollable(true);
             }
-            if (getLastVisiblePosition() < getCount() - 1) {
+            if (canScrollDown()) {
                 info.addAction(AccessibilityNodeInfo.ACTION_SCROLL_FORWARD);
                 info.setScrollable(true);
             }
@@ -2203,38 +2203,46 @@
 
     void updateScrollIndicators() {
         if (mScrollUp != null) {
-            boolean canScrollUp;
-            // 0th element is not visible
-            canScrollUp = mFirstPosition > 0;
-
-            // ... Or top of 0th element is not visible
-            if (!canScrollUp) {
-                if (getChildCount() > 0) {
-                    View child = getChildAt(0);
-                    canScrollUp = child.getTop() < mListPadding.top;
-                }
-            }
-
-            mScrollUp.setVisibility(canScrollUp ? View.VISIBLE : View.INVISIBLE);
+            mScrollUp.setVisibility(canScrollUp() ? View.VISIBLE : View.INVISIBLE);
         }
 
         if (mScrollDown != null) {
-            boolean canScrollDown;
-            int count = getChildCount();
-
-            // Last item is not visible
-            canScrollDown = (mFirstPosition + count) < mItemCount;
-
-            // ... Or bottom of the last element is not visible
-            if (!canScrollDown && count > 0) {
-                View child = getChildAt(count - 1);
-                canScrollDown = child.getBottom() > mBottom - mListPadding.bottom;
-            }
-
-            mScrollDown.setVisibility(canScrollDown ? View.VISIBLE : View.INVISIBLE);
+            mScrollDown.setVisibility(canScrollDown() ? View.VISIBLE : View.INVISIBLE);
         }
     }
 
+    private boolean canScrollUp() {
+        boolean canScrollUp;
+        // 0th element is not visible
+        canScrollUp = mFirstPosition > 0;
+
+        // ... Or top of 0th element is not visible
+        if (!canScrollUp) {
+            if (getChildCount() > 0) {
+                View child = getChildAt(0);
+                canScrollUp = child.getTop() < mListPadding.top;
+            }
+        }
+
+        return canScrollUp;
+    }
+
+    private boolean canScrollDown() {
+        boolean canScrollDown;
+        int count = getChildCount();
+
+        // Last item is not visible
+        canScrollDown = (mFirstPosition + count) < mItemCount;
+
+        // ... Or bottom of the last element is not visible
+        if (!canScrollDown && count > 0) {
+            View child = getChildAt(count - 1);
+            canScrollDown = child.getBottom() > mBottom - mListPadding.bottom;
+        }
+
+        return canScrollDown;
+    }
+
     @Override
     @ViewDebug.ExportedProperty
     public View getSelectedView() {
diff --git a/core/java/com/android/internal/app/ResolverActivity.java b/core/java/com/android/internal/app/ResolverActivity.java
index 22600de..5685ad7 100644
--- a/core/java/com/android/internal/app/ResolverActivity.java
+++ b/core/java/com/android/internal/app/ResolverActivity.java
@@ -128,7 +128,10 @@
                 com.android.internal.R.string.whichSendApplicationNamed),
         DEFAULT(null,
                 com.android.internal.R.string.whichApplication,
-                com.android.internal.R.string.whichApplicationNamed);
+                com.android.internal.R.string.whichApplicationNamed),
+        HOME(Intent.ACTION_MAIN,
+                com.android.internal.R.string.whichHomeApplication,
+                com.android.internal.R.string.whichHomeApplicationNamed);
 
         public final String action;
         public final int titleRes;
@@ -142,7 +145,7 @@
 
         public static ActionTitle forAction(String action) {
             for (ActionTitle title : values()) {
-                if (action != null && action.equals(title.action)) {
+                if (title != HOME && action != null && action.equals(title.action)) {
                     return title;
                 }
             }
@@ -165,26 +168,19 @@
     @Override
     protected void onCreate(Bundle savedInstanceState) {
         // Use a specialized prompt when we're handling the 'Home' app startActivity()
-        final int titleResource;
         final Intent intent = makeMyIntent();
         final Set<String> categories = intent.getCategories();
         if (Intent.ACTION_MAIN.equals(intent.getAction())
                 && categories != null
                 && categories.size() == 1
                 && categories.contains(Intent.CATEGORY_HOME)) {
-            titleResource = com.android.internal.R.string.whichHomeApplication;
-
             // Note: this field is not set to true in the compatibility version.
             mResolvingHome = true;
-        } else {
-            titleResource = 0;
         }
 
         setSafeForwardingMode(true);
 
-        onCreate(savedInstanceState, intent,
-                titleResource != 0 ? getResources().getText(titleResource) : null, titleResource,
-                null, null, true);
+        onCreate(savedInstanceState, intent, null, 0, null, null, true);
     }
 
     /**
@@ -336,7 +332,7 @@
     }
 
     protected CharSequence getTitleForAction(String action, int defaultTitleRes) {
-        final ActionTitle title = ActionTitle.forAction(action);
+        final ActionTitle title = mResolvingHome ? ActionTitle.HOME : ActionTitle.forAction(action);
         final boolean named = mAdapter.hasFilteredItem();
         if (title == ActionTitle.DEFAULT && defaultTitleRes != 0) {
             return getString(defaultTitleRes);
diff --git a/core/jni/android_util_Binder.cpp b/core/jni/android_util_Binder.cpp
index 81e887d..2dbd382 100644
--- a/core/jni/android_util_Binder.cpp
+++ b/core/jni/android_util_Binder.cpp
@@ -1239,7 +1239,7 @@
     {"pingBinder",          "()Z", (void*)android_os_BinderProxy_pingBinder},
     {"isBinderAlive",       "()Z", (void*)android_os_BinderProxy_isBinderAlive},
     {"getInterfaceDescriptor", "()Ljava/lang/String;", (void*)android_os_BinderProxy_getInterfaceDescriptor},
-    {"transact",            "(ILandroid/os/Parcel;Landroid/os/Parcel;I)Z", (void*)android_os_BinderProxy_transact},
+    {"transactNative",      "(ILandroid/os/Parcel;Landroid/os/Parcel;I)Z", (void*)android_os_BinderProxy_transact},
     {"linkToDeath",         "(Landroid/os/IBinder$DeathRecipient;I)V", (void*)android_os_BinderProxy_linkToDeath},
     {"unlinkToDeath",       "(Landroid/os/IBinder$DeathRecipient;I)Z", (void*)android_os_BinderProxy_unlinkToDeath},
     {"destroy",             "()V", (void*)android_os_BinderProxy_destroy},
diff --git a/core/res/res/values/strings.xml b/core/res/res/values/strings.xml
index fd4b40f..9fc7801 100644
--- a/core/res/res/values/strings.xml
+++ b/core/res/res/values/strings.xml
@@ -3440,7 +3440,10 @@
          and a previously used application is known. -->
     <string name="whichSendApplicationNamed">Share with %1$s</string>
     <!-- Title of intent resolver dialog when selecting a HOME application to run. -->
-    <string name="whichHomeApplication">Select a home app</string>
+    <string name="whichHomeApplication">Select a Home app</string>
+    <!-- Title of intent resolver dialog when selecting a HOME application to run
+         and a previously used application is known. -->
+    <string name="whichHomeApplicationNamed">Use %1$s as Home</string>
     <!-- Option to always use the selected application resolution in the future. See the "Complete action using" dialog title-->
     <string name="alwaysUse">Use by default for this action.</string>
     <!-- Title of the list of alternate options to complete an action shown when the
diff --git a/core/res/res/values/symbols.xml b/core/res/res/values/symbols.xml
index 2620c27..72f756a 100644
--- a/core/res/res/values/symbols.xml
+++ b/core/res/res/values/symbols.xml
@@ -2067,4 +2067,5 @@
   <java-symbol type="bool" name="config_restart_radio_on_pdp_fail_regular_deactivation" />
   <java-symbol type="array" name="networks_not_clear_data" />
   <java-symbol type="bool" name="config_switch_phone_on_voice_reg_state_change" />
+  <java-symbol type="string" name="whichHomeApplicationNamed" />
 </resources>
diff --git a/services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java b/services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java
index b05d82b..be3fc47 100644
--- a/services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java
+++ b/services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java
@@ -759,7 +759,7 @@
     }
 
     int getActiveWindowId() {
-        return mSecurityPolicy.mActiveWindowId;
+        return mSecurityPolicy.getActiveWindowId();
     }
 
     void onTouchInteractionStart() {
@@ -2823,7 +2823,7 @@
 
         private int resolveAccessibilityWindowIdLocked(int accessibilityWindowId) {
             if (accessibilityWindowId == AccessibilityNodeInfo.ACTIVE_WINDOW_ID) {
-                return mSecurityPolicy.mActiveWindowId;
+                return mSecurityPolicy.getActiveWindowId();
             }
             return accessibilityWindowId;
         }
@@ -3284,7 +3284,9 @@
 
         public void clearWindowsLocked() {
             List<AccessibilityWindowInfo> windows = Collections.emptyList();
+            final int activeWindowId = mActiveWindowId;
             updateWindowsLocked(windows);
+            mActiveWindowId = activeWindowId;
             mWindows = null;
         }
 
@@ -3497,6 +3499,13 @@
             }
         }
 
+        public int getActiveWindowId() {
+            if (mActiveWindowId == INVALID_WINDOW_ID && !mTouchInteractionInProgress) {
+                mActiveWindowId = getFocusedWindowId();
+            }
+            return mActiveWindowId;
+        }
+
         private void setActiveWindowLocked(int windowId) {
             if (mActiveWindowId != windowId) {
                 mActiveWindowId = windowId;
diff --git a/services/core/java/com/android/server/am/ActiveServices.java b/services/core/java/com/android/server/am/ActiveServices.java
index 8e8e4a6..01e80b7 100755
--- a/services/core/java/com/android/server/am/ActiveServices.java
+++ b/services/core/java/com/android/server/am/ActiveServices.java
@@ -2134,7 +2134,8 @@
                     if (!hasCreate) {
                         continue;
                     }
-                    if (proc != null && !proc.persistent && proc.thread != null
+                    // XXX turned off for now until we have more time to get a better policy.
+                    if (false && proc != null && !proc.persistent && proc.thread != null
                             && proc.pid != 0 && proc.pid != ActivityManagerService.MY_PID
                             && proc.setProcState >= ActivityManager.PROCESS_STATE_LAST_ACTIVITY) {
                         proc.kill("bound to service " + sr.name.flattenToShortString()
diff --git a/services/core/java/com/android/server/am/ActivityManagerService.java b/services/core/java/com/android/server/am/ActivityManagerService.java
index d2e3d25..4d2fd4c 100755
--- a/services/core/java/com/android/server/am/ActivityManagerService.java
+++ b/services/core/java/com/android/server/am/ActivityManagerService.java
@@ -4690,8 +4690,8 @@
     private final void handleAppDiedLocked(ProcessRecord app,
             boolean restarting, boolean allowRestart) {
         int pid = app.pid;
-        cleanUpApplicationRecordLocked(app, restarting, allowRestart, -1);
-        if (!restarting) {
+        boolean kept = cleanUpApplicationRecordLocked(app, restarting, allowRestart, -1);
+        if (!kept && !restarting) {
             removeLruProcessLocked(app);
             if (pid > 0) {
                 ProcessList.remove(pid);
@@ -4816,6 +4816,14 @@
     }
 
     final void appDiedLocked(ProcessRecord app, int pid, IApplicationThread thread) {
+        // First check if this ProcessRecord is actually active for the pid.
+        synchronized (mPidsSelfLocked) {
+            ProcessRecord curProc = mPidsSelfLocked.get(pid);
+            if (curProc != app) {
+                Slog.w(TAG, "Spurious death for " + app + ", curProc for " + pid + ": " + curProc);
+                return;
+            }
+        }
 
         BatteryStatsImpl stats = mBatteryStatsService.getActiveStatistics();
         synchronized (stats) {
@@ -4833,7 +4841,7 @@
             boolean doOomAdj = doLowMem;
             if (!app.killedByAm) {
                 Slog.i(TAG, "Process " + app.processName + " (pid " + pid
-                        + ") has died.");
+                        + ") has died");
                 mAllowLowerMemLevel = true;
             } else {
                 // Note that we always want to do oom adj to update our state with the
@@ -14310,8 +14318,11 @@
      * Main code for cleaning up a process when it has gone away.  This is
      * called both as a result of the process dying, or directly when stopping
      * a process when running in single process mode.
+     *
+     * @return Returns true if the given process has been restarted, so the
+     * app that was passed in must remain on the process lists.
      */
-    private final void cleanUpApplicationRecordLocked(ProcessRecord app,
+    private final boolean cleanUpApplicationRecordLocked(ProcessRecord app,
             boolean restarting, boolean allowRestart, int index) {
         if (index >= 0) {
             removeLruProcessLocked(app);
@@ -14434,7 +14445,7 @@
         // If the caller is restarting this app, then leave it in its
         // current lists and let the caller take care of it.
         if (restarting) {
-            return;
+            return false;
         }
 
         if (!app.persistent || app.isolated) {
@@ -14470,8 +14481,12 @@
         if (restart && !app.isolated) {
             // We have components that still need to be running in the
             // process, so re-launch it.
+            if (index < 0) {
+                ProcessList.remove(app.pid);
+            }
             mProcessNames.put(app.processName, app.uid, app);
             startProcessLocked(app, "restart", app.processName);
+            return true;
         } else if (app.pid > 0 && app.pid != MY_PID) {
             // Goodbye!
             boolean removed;
@@ -14485,6 +14500,7 @@
             }
             app.setPid(0);
         }
+        return false;
     }
 
     boolean checkAppInLaunchingProvidersLocked(ProcessRecord app, boolean alwaysBad) {
diff --git a/telecomm/java/android/telecom/RemoteConference.java b/telecomm/java/android/telecom/RemoteConference.java
index 796725b..b18cb96 100644
--- a/telecomm/java/android/telecom/RemoteConference.java
+++ b/telecomm/java/android/telecom/RemoteConference.java
@@ -166,6 +166,20 @@
         }
     }
 
+    public void merge() {
+        try {
+            mConnectionService.mergeConference(mId);
+        } catch (RemoteException e) {
+        }
+    }
+
+    public void swap() {
+        try {
+            mConnectionService.swapConference(mId);
+        } catch (RemoteException e) {
+        }
+    }
+
     public void hold() {
         try {
             mConnectionService.hold(mId);
diff --git a/tools/aapt/ResourceTable.cpp b/tools/aapt/ResourceTable.cpp
index b8c34543..77d3beb 100644
--- a/tools/aapt/ResourceTable.cpp
+++ b/tools/aapt/ResourceTable.cpp
@@ -3310,6 +3310,19 @@
     , mParentId(entry.mParentId)
     , mPos(entry.mPos) {}
 
+ResourceTable::Entry& ResourceTable::Entry::operator=(const Entry& entry) {
+    mName = entry.mName;
+    mParent = entry.mParent;
+    mType = entry.mType;
+    mItem = entry.mItem;
+    mItemFormat = entry.mItemFormat;
+    mBag = entry.mBag;
+    mNameIndex = entry.mNameIndex;
+    mParentId = entry.mParentId;
+    mPos = entry.mPos;
+    return *this;
+}
+
 status_t ResourceTable::Entry::makeItABag(const SourcePos& sourcePos)
 {
     if (mType == TYPE_BAG) {
@@ -4352,7 +4365,11 @@
                                     String8(entriesToAdd[i].value->getName()).string(),
                                     entriesToAdd[i].key.toString().string());
 
-                    c->addEntry(entriesToAdd[i].key, entriesToAdd[i].value);
+                    sp<Entry> newEntry = t->getEntry(c->getName(),
+                            entriesToAdd[i].value->getPos(),
+                            &entriesToAdd[i].key);
+
+                    *newEntry = *entriesToAdd[i].value;
                 }
             }
         }
diff --git a/tools/aapt/ResourceTable.h b/tools/aapt/ResourceTable.h
index c548a85..eac5dd3 100644
--- a/tools/aapt/ResourceTable.h
+++ b/tools/aapt/ResourceTable.h
@@ -316,6 +316,7 @@
         { }
 
         Entry(const Entry& entry);
+        Entry& operator=(const Entry& entry);
 
         virtual ~Entry() { }