diff --git a/core/java/android/webkit/MimeTypeMap.java b/core/java/android/webkit/MimeTypeMap.java
index a9d6ff6..3ed9851 100644
--- a/core/java/android/webkit/MimeTypeMap.java
+++ b/core/java/android/webkit/MimeTypeMap.java
@@ -368,6 +368,7 @@
             sMimeTypeMap.loadEntry("application/x-xcf", "xcf");
             sMimeTypeMap.loadEntry("application/x-xfig", "fig");
             sMimeTypeMap.loadEntry("application/xhtml+xml", "xhtml");
+            sMimeTypeMap.loadEntry("audio/3gpp", "3gpp");
             sMimeTypeMap.loadEntry("audio/basic", "snd");
             sMimeTypeMap.loadEntry("audio/midi", "mid");
             sMimeTypeMap.loadEntry("audio/midi", "midi");
diff --git a/graphics/java/android/graphics/AvoidXfermode.java b/graphics/java/android/graphics/AvoidXfermode.java
index 2ed042b..7e2722d 100644
--- a/graphics/java/android/graphics/AvoidXfermode.java
+++ b/graphics/java/android/graphics/AvoidXfermode.java
@@ -38,15 +38,15 @@
      *
      * There are two modes, and each mode interprets a tolerance value.
      *
-     * AVOID: In this mode, drawing is allowed only on destination pixels that
+     * Avoid: In this mode, drawing is allowed only on destination pixels that
      * are different from the op-color.
-     *   Tolerance near 0: avoid anything close to the op-color
-     *   Tolerance near 255: avoid only colors very close to the op-color
-     *
-     * TARGET: In this mode, drawing only occurs on destination pixels that
+     * Tolerance near 0: avoid any colors even remotely similar to the op-color
+     * Tolerance near 255: avoid only colors nearly identical to the op-color
+     
+     * Target: In this mode, drawing only occurs on destination pixels that
      * are similar to the op-color
-     *   Tolerance near 0: draw on colors that are very close to op-color
-     *   Tolerance near 255: draw on colors that  to the op-color
+     * Tolerance near 0: draw only on colors that are nearly identical to the op-color
+     * Tolerance near 255: draw on any colors even remotely similar to the op-color
      */
     public AvoidXfermode(int opColor, int tolerance, Mode mode) {
         if (tolerance < 0 || tolerance > 255) {
diff --git a/include/ui/Region.h b/include/ui/Region.h
index 2bcad5b..925fd06 100644
--- a/include/ui/Region.h
+++ b/include/ui/Region.h
@@ -21,7 +21,6 @@
 #include <sys/types.h>
 
 #include <utils/Vector.h>
-#include <binder/Parcel.h>
 
 #include <ui/Rect.h>
 
@@ -39,7 +38,6 @@
                         Region();
                         Region(const Region& rhs);
     explicit            Region(const Rect& rhs);
-    explicit            Region(const Parcel& parcel);
     explicit            Region(const void* buffer);
                         ~Region();
                         
@@ -118,10 +116,6 @@
             // be sorted in Y and X and must not make the region invalid.
             void        addRectUnchecked(int l, int t, int r, int b);
 
-            // flatten/unflatten a region to/from a Parcel
-            status_t    write(Parcel& parcel) const;
-            status_t    read(const Parcel& parcel);
-
             // flatten/unflatten a region to/from a raw buffer
             ssize_t     write(void* buffer, size_t size) const;
     static  ssize_t     writeEmpty(void* buffer, size_t size);
diff --git a/libs/surfaceflinger_client/LayerState.cpp b/libs/surfaceflinger_client/LayerState.cpp
index 114a9e9..01c4c7e 100644
--- a/libs/surfaceflinger_client/LayerState.cpp
+++ b/libs/surfaceflinger_client/LayerState.cpp
@@ -22,17 +22,37 @@
 
 status_t layer_state_t::write(Parcel& output) const
 {
+    status_t err;
+
+    size_t len = transparentRegion.write(NULL, 0);
+    err = output.writeInt32(len);
+    if (err < NO_ERROR) return err;
+
+    void* buf = output.writeInplace(len);
+    if (buf == NULL) return NO_MEMORY;
+
+    err = transparentRegion.write(buf, len);
+    if (err < NO_ERROR) return err;
+
+    // NOTE: regions are at the end of the structure
     size_t size = sizeof(layer_state_t);
-    transparentRegion.write(output);
     size -= sizeof(transparentRegion);
-    output.write(this, size);
-    return NO_ERROR;
+    err = output.write(this, size);
+    return err;
 }
 
 status_t layer_state_t::read(const Parcel& input)
 {
+    status_t err;
+    size_t len = input.readInt32();
+    void const* buf = input.readInplace(len);
+    if (buf == NULL) return NO_MEMORY;
+
+    err = transparentRegion.read(buf);
+    if (err < NO_ERROR) return err;
+
+    // NOTE: regions are at the end of the structure
     size_t size = sizeof(layer_state_t);
-    transparentRegion.read(input);
     size -= sizeof(transparentRegion);
     input.read(this, size);
     return NO_ERROR;
diff --git a/libs/ui/Region.cpp b/libs/ui/Region.cpp
index d21ed57..12db908 100644
--- a/libs/ui/Region.cpp
+++ b/libs/ui/Region.cpp
@@ -63,16 +63,10 @@
 {
 }
 
-Region::Region(const Parcel& parcel)
-{
-    status_t err = read(parcel);
-    LOGE_IF(err<0, "error %s reading Region from parcel", strerror(err));
-}
-
 Region::Region(const void* buffer)
 {
     status_t err = read(buffer);
-    LOGE_IF(err<0, "error %s reading Region from parcel", strerror(err));
+    LOGE_IF(err<0, "error %s reading Region from buffer", strerror(err));
 }
 
 Region::~Region()
@@ -532,37 +526,6 @@
 
 // ----------------------------------------------------------------------------
 
-status_t Region::write(Parcel& parcel) const
-{
-#if VALIDATE_REGIONS
-    validate(*this, "write(Parcel)");
-#endif
-    status_t err;
-    const size_t count = mStorage.size();
-    const size_t sizeNeeded = sizeof(int32_t) + (1+count)*sizeof(Rect);
-    void* buffer = parcel.writeInplace(sizeNeeded);
-    if (!buffer) return NO_MEMORY;
-    ssize_t written = Region::write(buffer, sizeNeeded);
-    if (written < 0) return status_t(written);
-    return NO_ERROR;
-}
-
-status_t Region::read(const Parcel& parcel)
-{
-    void const* buffer = parcel.readInplace(sizeof(int32_t));
-    if (!buffer) return NO_MEMORY;
-    const size_t count = *static_cast<int32_t const *>(buffer);
-    void const* dummy = parcel.readInplace((1+count)*sizeof(Rect));
-    if (!dummy) return NO_MEMORY;
-    const size_t sizeNeeded = sizeof(int32_t) + (1+count)*sizeof(Rect);
-    const ssize_t read = Region::read(buffer);
-    if (read < 0) return status_t(read);
-#if VALIDATE_REGIONS
-    validate(*this, "read(Parcel)");
-#endif
-    return NO_ERROR;
-}
-
 ssize_t Region::write(void* buffer, size_t size) const
 {
 #if VALIDATE_REGIONS
@@ -570,12 +533,14 @@
 #endif
     const size_t count = mStorage.size();
     const size_t sizeNeeded = sizeof(int32_t) + (1+count)*sizeof(Rect);
-    if (sizeNeeded > size) return NO_MEMORY;
-    int32_t* const p = static_cast<int32_t*>(buffer); 
-    *p = count;
-    memcpy(p+1, &mBounds, sizeof(Rect));
-    if (count) {
-        memcpy(p+5, mStorage.array(), count*sizeof(Rect));
+    if (buffer != NULL) {
+        if (sizeNeeded > size) return NO_MEMORY;
+        int32_t* const p = static_cast<int32_t*>(buffer);
+        *p = count;
+        memcpy(p+1, &mBounds, sizeof(Rect));
+        if (count) {
+            memcpy(p+5, mStorage.array(), count*sizeof(Rect));
+        }
     }
     return ssize_t(sizeNeeded);
 }
diff --git a/services/java/com/android/server/LocationManagerService.java b/services/java/com/android/server/LocationManagerService.java
index 9068966..004fcf13 100644
--- a/services/java/com/android/server/LocationManagerService.java
+++ b/services/java/com/android/server/LocationManagerService.java
@@ -561,7 +561,8 @@
     }
 
     private boolean isAllowedProviderSafe(String provider) {
-        if (LocationManager.GPS_PROVIDER.equals(provider)
+        if ((LocationManager.GPS_PROVIDER.equals(provider)
+                || LocationManager.PASSIVE_PROVIDER.equals(provider))
             && (mContext.checkCallingOrSelfPermission(ACCESS_FINE_LOCATION)
                 != PackageManager.PERMISSION_GRANTED)) {
             return false;