diff --git a/src/com/android/phone/TelephonyShellCommand.java b/src/com/android/phone/TelephonyShellCommand.java
index 512ca03..d24b4e3 100644
--- a/src/com/android/phone/TelephonyShellCommand.java
+++ b/src/com/android/phone/TelephonyShellCommand.java
@@ -24,13 +24,14 @@
 import android.os.RemoteException;
 import android.provider.BlockedNumberContract;
 import android.telephony.CarrierConfigManager;
-import android.telephony.SubscriptionInfo;
 import android.telephony.SubscriptionManager;
 import android.telephony.emergency.EmergencyNumber;
 import android.telephony.ims.feature.ImsFeature;
 import android.util.Log;
 
 import com.android.internal.telephony.ITelephony;
+import com.android.internal.telephony.Phone;
+import com.android.internal.telephony.PhoneFactory;
 import com.android.internal.telephony.emergency.EmergencyNumberTracker;
 import com.android.internal.telephony.util.TelephonyUtils;
 
@@ -739,17 +740,21 @@
         try {
             slotId = Integer.parseInt(slotString);
         } catch (NumberFormatException e) {
+            getErrPrintWriter().println(tag + slotString + " is not a valid number for SLOT_ID.");
+            return SubscriptionManager.INVALID_SUBSCRIPTION_ID;
+        }
+
+        if (!SubscriptionManager.isValidPhoneId(slotId)) {
             getErrPrintWriter().println(tag + slotString + " is not a valid SLOT_ID.");
             return SubscriptionManager.INVALID_SUBSCRIPTION_ID;
         }
 
-        SubscriptionInfo subInfo =
-                mSubscriptionManager.getActiveSubscriptionInfoForSimSlotIndex(slotId);
-        if (subInfo == null) {
+        Phone phone = PhoneFactory.getPhone(slotId);
+        if (phone == null) {
             getErrPrintWriter().println(tag + "No subscription found in slot " + slotId + ".");
             return SubscriptionManager.INVALID_SUBSCRIPTION_ID;
         }
-        return subInfo.getSubscriptionId();
+        return phone.getSubId();
     }
 
     private boolean checkShellUid() {
diff --git a/src/com/android/services/telephony/ImsConference.java b/src/com/android/services/telephony/ImsConference.java
index 06f3bf0..76cdd53 100644
--- a/src/com/android/services/telephony/ImsConference.java
+++ b/src/com/android/services/telephony/ImsConference.java
@@ -438,6 +438,7 @@
 
         mTelephonyConnectionService = telephonyConnectionService;
         setConferenceHost(conferenceHost);
+        setVideoProvider(conferenceHost, conferenceHost.getVideoProvider());
 
         int capabilities = Connection.CAPABILITY_MUTE |
                 Connection.CAPABILITY_CONFERENCE_HAS_NO_CHILDREN;
diff --git a/src/com/android/services/telephony/ImsConferenceController.java b/src/com/android/services/telephony/ImsConferenceController.java
index 6d3d4c2..7cf9415 100644
--- a/src/com/android/services/telephony/ImsConferenceController.java
+++ b/src/com/android/services/telephony/ImsConferenceController.java
@@ -403,6 +403,20 @@
         conferenceHostConnection.setVideoPauseSupported(connection.getVideoPauseSupported());
         conferenceHostConnection.setManageImsConferenceCallSupported(
                 connection.isManageImsConferenceCallSupported());
+        // WARNING: do not try to copy the video provider from connection to
+        // conferenceHostConnection here.  In connection.cloneConnection, part of the clone
+        // process is to set the original connection so it's already set:
+        // conferenceHostConnection.setVideoProvider(connection.getVideoProvider());
+        // There is a subtle concurrency issue here where at the time of merge, the
+        // TelephonyConnection potentially has the WRONG video provider set on it (compared to
+        // the ImsPhoneConnection (ie original connection) which has the correct one.
+        // If you follow the logic in ImsPhoneCallTracker#onCallMerged through, what happens is the
+        // new post-merge video provider is set on the ImsPhoneConnection.  That informs it's
+        // listeners (e.g. TelephonyConnection) via a handler.  We immediately change the multiparty
+        // start of the host connection and ImsPhoneCallTracker starts the setup we are
+        // performing here.  When cloning TelephonyConnection, we get the right VideoProvider
+        // because it is copied from the originalConnection, not using the potentially stale value
+        // in the TelephonyConnection.
 
         PhoneAccountHandle phoneAccountHandle = null;