Revert "Use ashmem for CursorWindows."

This reverts commit 0cde89f5f025b7826be009ebb9673b970e180e32.
diff --git a/core/java/android/content/ContentProviderNative.java b/core/java/android/content/ContentProviderNative.java
index b089bf2..064755e 100644
--- a/core/java/android/content/ContentProviderNative.java
+++ b/core/java/android/content/ContentProviderNative.java
@@ -108,22 +108,21 @@
                     String sortOrder = data.readString();
                     IContentObserver observer = IContentObserver.Stub.asInterface(
                             data.readStrongBinder());
+                    CursorWindow window = CursorWindow.CREATOR.createFromParcel(data);
 
                     Cursor cursor = query(url, projection, selection, selectionArgs, sortOrder);
                     if (cursor != null) {
                         CursorToBulkCursorAdaptor adaptor = new CursorToBulkCursorAdaptor(
-                                cursor, observer, getProviderName());
+                                cursor, observer, getProviderName(), window);
                         final IBinder binder = adaptor.asBinder();
                         final int count = adaptor.count();
                         final int index = BulkCursorToCursorAdaptor.findRowIdColumnIndex(
                                 adaptor.getColumnNames());
-                        final boolean wantsAllOnMoveCalls = adaptor.getWantsAllOnMoveCalls();
 
                         reply.writeNoException();
                         reply.writeStrongBinder(binder);
                         reply.writeInt(count);
                         reply.writeInt(index);
-                        reply.writeInt(wantsAllOnMoveCalls ? 1 : 0);
                     } else {
                         reply.writeNoException();
                         reply.writeStrongBinder(null);
@@ -325,58 +324,67 @@
 
     public Cursor query(Uri url, String[] projection, String selection,
             String[] selectionArgs, String sortOrder) throws RemoteException {
-        BulkCursorToCursorAdaptor adaptor = new BulkCursorToCursorAdaptor();
-        Parcel data = Parcel.obtain();
-        Parcel reply = Parcel.obtain();
+        CursorWindow window = new CursorWindow(false /* window will be used remotely */);
         try {
-            data.writeInterfaceToken(IContentProvider.descriptor);
+            BulkCursorToCursorAdaptor adaptor = new BulkCursorToCursorAdaptor();
+            Parcel data = Parcel.obtain();
+            Parcel reply = Parcel.obtain();
+            try {
+                data.writeInterfaceToken(IContentProvider.descriptor);
 
-            url.writeToParcel(data, 0);
-            int length = 0;
-            if (projection != null) {
-                length = projection.length;
-            }
-            data.writeInt(length);
-            for (int i = 0; i < length; i++) {
-                data.writeString(projection[i]);
-            }
-            data.writeString(selection);
-            if (selectionArgs != null) {
-                length = selectionArgs.length;
-            } else {
-                length = 0;
-            }
-            data.writeInt(length);
-            for (int i = 0; i < length; i++) {
-                data.writeString(selectionArgs[i]);
-            }
-            data.writeString(sortOrder);
-            data.writeStrongBinder(adaptor.getObserver().asBinder());
+                url.writeToParcel(data, 0);
+                int length = 0;
+                if (projection != null) {
+                    length = projection.length;
+                }
+                data.writeInt(length);
+                for (int i = 0; i < length; i++) {
+                    data.writeString(projection[i]);
+                }
+                data.writeString(selection);
+                if (selectionArgs != null) {
+                    length = selectionArgs.length;
+                } else {
+                    length = 0;
+                }
+                data.writeInt(length);
+                for (int i = 0; i < length; i++) {
+                    data.writeString(selectionArgs[i]);
+                }
+                data.writeString(sortOrder);
+                data.writeStrongBinder(adaptor.getObserver().asBinder());
+                window.writeToParcel(data, 0);
 
-            mRemote.transact(IContentProvider.QUERY_TRANSACTION, data, reply, 0);
+                mRemote.transact(IContentProvider.QUERY_TRANSACTION, data, reply, 0);
 
-            DatabaseUtils.readExceptionFromParcel(reply);
+                DatabaseUtils.readExceptionFromParcel(reply);
 
-            IBulkCursor bulkCursor = BulkCursorNative.asInterface(reply.readStrongBinder());
-            if (bulkCursor != null) {
-                int rowCount = reply.readInt();
-                int idColumnPosition = reply.readInt();
-                boolean wantsAllOnMoveCalls = reply.readInt() != 0;
-                adaptor.initialize(bulkCursor, rowCount, idColumnPosition, wantsAllOnMoveCalls);
-            } else {
+                IBulkCursor bulkCursor = BulkCursorNative.asInterface(reply.readStrongBinder());
+                if (bulkCursor != null) {
+                    int rowCount = reply.readInt();
+                    int idColumnPosition = reply.readInt();
+                    adaptor.initialize(bulkCursor, rowCount, idColumnPosition);
+                } else {
+                    adaptor.close();
+                    adaptor = null;
+                }
+                return adaptor;
+            } catch (RemoteException ex) {
                 adaptor.close();
-                adaptor = null;
+                throw ex;
+            } catch (RuntimeException ex) {
+                adaptor.close();
+                throw ex;
+            } finally {
+                data.recycle();
+                reply.recycle();
             }
-            return adaptor;
-        } catch (RemoteException ex) {
-            adaptor.close();
-            throw ex;
-        } catch (RuntimeException ex) {
-            adaptor.close();
-            throw ex;
         } finally {
-            data.recycle();
-            reply.recycle();
+            // We close the window now because the cursor adaptor does not
+            // take ownership of the window until the first call to onMove.
+            // The adaptor will obtain a fresh reference to the window when
+            // it is filled.
+            window.close();
         }
     }
 
diff --git a/core/java/android/database/AbstractWindowedCursor.java b/core/java/android/database/AbstractWindowedCursor.java
index d0aedd2..5836265 100644
--- a/core/java/android/database/AbstractWindowedCursor.java
+++ b/core/java/android/database/AbstractWindowedCursor.java
@@ -189,14 +189,12 @@
     /**
      * If there is a window, clear it.
      * Otherwise, creates a local window.
-     *
-     * @param name The window name.
      * @hide
      */
-    protected void clearOrCreateLocalWindow(String name) {
+    protected void clearOrCreateLocalWindow() {
         if (mWindow == null) {
             // If there isn't a window set already it will only be accessed locally
-            mWindow = new CursorWindow(name, true /* the window is local only */);
+            mWindow = new CursorWindow(true /* the window is local only */);
         } else {
             mWindow.clear();
         }
diff --git a/core/java/android/database/BulkCursorNative.java b/core/java/android/database/BulkCursorNative.java
index 20a9c67..4fada8c 100644
--- a/core/java/android/database/BulkCursorNative.java
+++ b/core/java/android/database/BulkCursorNative.java
@@ -109,8 +109,9 @@
                 case REQUERY_TRANSACTION: {
                     data.enforceInterface(IBulkCursor.descriptor);
                     IContentObserver observer =
-                            IContentObserver.Stub.asInterface(data.readStrongBinder());
-                    int count = requery(observer);
+                        IContentObserver.Stub.asInterface(data.readStrongBinder());
+                    CursorWindow window = CursorWindow.CREATOR.createFromParcel(data);
+                    int count = requery(observer, window);
                     reply.writeNoException();
                     reply.writeInt(count);
                     reply.writeBundle(getExtras());
@@ -293,12 +294,13 @@
         }
     }
     
-    public int requery(IContentObserver observer) throws RemoteException {
+    public int requery(IContentObserver observer, CursorWindow window) throws RemoteException {
         Parcel data = Parcel.obtain();
         Parcel reply = Parcel.obtain();
         try {
             data.writeInterfaceToken(IBulkCursor.descriptor);
             data.writeStrongInterface(observer);
+            window.writeToParcel(data, 0);
 
             boolean result = mRemote.transact(REQUERY_TRANSACTION, data, reply, 0);
             DatabaseUtils.readExceptionFromParcel(reply);
diff --git a/core/java/android/database/BulkCursorToCursorAdaptor.java b/core/java/android/database/BulkCursorToCursorAdaptor.java
index 885046b..cbdd07fb 100644
--- a/core/java/android/database/BulkCursorToCursorAdaptor.java
+++ b/core/java/android/database/BulkCursorToCursorAdaptor.java
@@ -38,13 +38,11 @@
      * Initializes the adaptor.
      * Must be called before first use.
      */
-    public void initialize(IBulkCursor bulkCursor, int count, int idIndex,
-            boolean wantsAllOnMoveCalls) {
+    public void initialize(IBulkCursor bulkCursor, int count, int idIndex) {
         mBulkCursor = bulkCursor;
         mColumns = null;  // lazily retrieved
         mCount = count;
         mRowIdColumnIndex = idIndex;
-        mWantsAllOnMoveCalls = wantsAllOnMoveCalls;
     }
 
     /**
@@ -88,12 +86,15 @@
 
         try {
             // Make sure we have the proper window
-            if (mWindow == null
-                    || newPosition < mWindow.getStartPosition()
-                    || newPosition >= mWindow.getStartPosition() + mWindow.getNumRows()) {
+            if (mWindow != null) {
+                if (newPosition < mWindow.getStartPosition() ||
+                        newPosition >= (mWindow.getStartPosition() + mWindow.getNumRows())) {
+                    setWindow(mBulkCursor.getWindow(newPosition));
+                } else if (mWantsAllOnMoveCalls) {
+                    mBulkCursor.onMove(newPosition);
+                }
+            } else {
                 setWindow(mBulkCursor.getWindow(newPosition));
-            } else if (mWantsAllOnMoveCalls) {
-                mBulkCursor.onMove(newPosition);
             }
         } catch (RemoteException ex) {
             // We tried to get a window and failed
@@ -144,19 +145,25 @@
         throwIfCursorIsClosed();
 
         try {
-            mCount = mBulkCursor.requery(getObserver());
-            if (mCount != -1) {
-                mPos = -1;
-                closeWindow();
+            CursorWindow newWindow = new CursorWindow(false /* create a remote window */);
+            try {
+                mCount = mBulkCursor.requery(getObserver(), newWindow);
+                if (mCount != -1) {
+                    mPos = -1;
+                    closeWindow();
 
-                // super.requery() will call onChanged. Do it here instead of relying on the
-                // observer from the far side so that observers can see a correct value for mCount
-                // when responding to onChanged.
-                super.requery();
-                return true;
-            } else {
-                deactivate();
-                return false;
+                    // super.requery() will call onChanged. Do it here instead of relying on the
+                    // observer from the far side so that observers can see a correct value for mCount
+                    // when responding to onChanged.
+                    super.requery();
+                    return true;
+                } else {
+                    deactivate();
+                    return false;
+                }
+            } finally {
+                // Don't take ownership of the window until the next call to onMove.
+                newWindow.close();
             }
         } catch (Exception ex) {
             Log.e(TAG, "Unable to requery because the remote process exception " + ex.getMessage());
diff --git a/core/java/android/database/CursorToBulkCursorAdaptor.java b/core/java/android/database/CursorToBulkCursorAdaptor.java
index dd2c9b7..a65b3b3 100644
--- a/core/java/android/database/CursorToBulkCursorAdaptor.java
+++ b/core/java/android/database/CursorToBulkCursorAdaptor.java
@@ -53,7 +53,6 @@
      * for managing the lifetime of their window.
      */
     private CursorWindow mWindowForNonWindowedCursor;
-    private boolean mWindowForNonWindowedCursorWasFilled;
 
     private static final class ContentObserverProxy extends ContentObserver {
         protected IContentObserver mRemote;
@@ -88,11 +87,26 @@
         }
     }
 
-    public CursorToBulkCursorAdaptor(Cursor cursor, IContentObserver observer,
-            String providerName) {
+    public CursorToBulkCursorAdaptor(Cursor cursor, IContentObserver observer, String providerName,
+            CursorWindow window) {
         try {
             mCursor = (CrossProcessCursor) cursor;
+            if (mCursor instanceof AbstractWindowedCursor) {
+                AbstractWindowedCursor windowedCursor = (AbstractWindowedCursor) cursor;
+                if (windowedCursor.hasWindow()) {
+                    if (Log.isLoggable(TAG, Log.VERBOSE) || false) {
+                        Log.v(TAG, "Cross process cursor has a local window before setWindow in "
+                                + providerName, new RuntimeException());
+                    }
+                }
+                windowedCursor.setWindow(window); // cursor takes ownership of window
+            } else {
+                mWindowForNonWindowedCursor = window; // we own the window
+                mCursor.fillWindow(0, window);
+            }
         } catch (ClassCastException e) {
+            // TODO Implement this case.
+            window.close();
             throw new UnsupportedOperationException(
                     "Only CrossProcessCursor cursors are supported across process for now", e);
         }
@@ -103,22 +117,17 @@
         }
     }
 
-    private void closeWindowForNonWindowedCursorLocked() {
-        if (mWindowForNonWindowedCursor != null) {
-            mWindowForNonWindowedCursor.close();
-            mWindowForNonWindowedCursor = null;
-            mWindowForNonWindowedCursorWasFilled = false;
-        }
-    }
-
-    private void disposeLocked() {
+    private void closeCursorAndWindowLocked() {
         if (mCursor != null) {
             unregisterObserverProxyLocked();
             mCursor.close();
             mCursor = null;
         }
 
-        closeWindowForNonWindowedCursorLocked();
+        if (mWindowForNonWindowedCursor != null) {
+            mWindowForNonWindowedCursor.close();
+            mWindowForNonWindowedCursor = null;
+        }
     }
 
     private void throwIfCursorIsClosed() {
@@ -130,7 +139,7 @@
     @Override
     public void binderDied() {
         synchronized (mLock) {
-            disposeLocked();
+            closeCursorAndWindowLocked();
         }
     }
 
@@ -139,30 +148,17 @@
         synchronized (mLock) {
             throwIfCursorIsClosed();
 
-            CursorWindow window;
-            if (mCursor instanceof AbstractWindowedCursor) {
-                AbstractWindowedCursor windowedCursor = (AbstractWindowedCursor)mCursor;
-                window = windowedCursor.getWindow();
-                if (window == null) {
-                    window = new CursorWindow(mProviderName, false /*localOnly*/);
-                    windowedCursor.setWindow(window);
-                }
+            mCursor.moveToPosition(startPos);
 
-                mCursor.moveToPosition(startPos);
+            final CursorWindow window;
+            if (mCursor instanceof AbstractWindowedCursor) {
+                window = ((AbstractWindowedCursor)mCursor).getWindow();
             } else {
                 window = mWindowForNonWindowedCursor;
-                if (window == null) {
-                    window = new CursorWindow(mProviderName, false /*localOnly*/);
-                    mWindowForNonWindowedCursor = window;
-                }
-
-                mCursor.moveToPosition(startPos);
-
-                if (!mWindowForNonWindowedCursorWasFilled
-                        || startPos < window.getStartPosition()
-                        || startPos >= window.getStartPosition() + window.getNumRows()) {
+                if (window != null
+                        && (startPos < window.getStartPosition() ||
+                                startPos >= (window.getStartPosition() + window.getNumRows()))) {
                     mCursor.fillWindow(startPos, window);
-                    mWindowForNonWindowedCursorWasFilled = true;
                 }
             }
 
@@ -210,24 +206,29 @@
                 unregisterObserverProxyLocked();
                 mCursor.deactivate();
             }
-
-            closeWindowForNonWindowedCursorLocked();
         }
     }
 
     @Override
     public void close() {
         synchronized (mLock) {
-            disposeLocked();
+            closeCursorAndWindowLocked();
         }
     }
 
     @Override
-    public int requery(IContentObserver observer) {
+    public int requery(IContentObserver observer, CursorWindow window) {
         synchronized (mLock) {
             throwIfCursorIsClosed();
 
-            closeWindowForNonWindowedCursorLocked();
+            if (mCursor instanceof AbstractWindowedCursor) {
+                ((AbstractWindowedCursor) mCursor).setWindow(window);
+            } else {
+                if (mWindowForNonWindowedCursor != null) {
+                    mWindowForNonWindowedCursor.close();
+                }
+                mWindowForNonWindowedCursor = window;
+            }
 
             try {
                 if (!mCursor.requery()) {
@@ -240,6 +241,12 @@
                 throw leakProgram;
             }
 
+            if (!(mCursor instanceof AbstractWindowedCursor)) {
+                if (window != null) {
+                    mCursor.fillWindow(0, window);
+                }
+            }
+
             unregisterObserverProxyLocked();
             createAndRegisterObserverProxyLocked(observer);
             return mCursor.getCount();
diff --git a/core/java/android/database/CursorWindow.java b/core/java/android/database/CursorWindow.java
index a18a721..5a91b80 100644
--- a/core/java/android/database/CursorWindow.java
+++ b/core/java/android/database/CursorWindow.java
@@ -22,6 +22,7 @@
 import android.database.sqlite.SQLiteClosable;
 import android.database.sqlite.SQLiteException;
 import android.os.Binder;
+import android.os.IBinder;
 import android.os.Parcel;
 import android.os.Parcelable;
 import android.os.Process;
@@ -30,13 +31,6 @@
 
 /**
  * A buffer containing multiple cursor rows.
- * <p>
- * A {@link CursorWindow} is read-write when created and used locally.  When sent
- * to a remote process (by writing it to a {@link Parcel}), the remote process
- * receives a read-only view of the cursor window.  Typically the cursor window
- * will be allocated by the producer, filled with data, and then sent to the
- * consumer for reading.
- * </p>
  */
 public class CursorWindow extends SQLiteClosable implements Parcelable {
     private static final String STATS_TAG = "CursorWindowStats";
@@ -58,11 +52,10 @@
 
     private final CloseGuard mCloseGuard = CloseGuard.get();
 
-    private static native int nativeCreate(String name,
-            int cursorWindowSize, boolean localOnly);
-    private static native int nativeCreateFromParcel(Parcel parcel);
+    private static native int nativeInitializeEmpty(int cursorWindowSize, boolean localOnly);
+    private static native int nativeInitializeFromBinder(IBinder nativeBinder);
     private static native void nativeDispose(int windowPtr);
-    private static native void nativeWriteToParcel(int windowPtr, Parcel parcel);
+    private static native IBinder nativeGetBinder(int windowPtr);
 
     private static native void nativeClear(int windowPtr);
 
@@ -86,30 +79,6 @@
     private static native boolean nativePutNull(int windowPtr, int row, int column);
 
     /**
-     * Creates a new empty cursor window and gives it a name.
-     * <p>
-     * The cursor initially has no rows or columns.  Call {@link #setNumColumns(int)} to
-     * set the number of columns before adding any rows to the cursor.
-     * </p>
-     *
-     * @param name The name of the cursor window, or null if none.
-     * @param localWindow True if this window will be used in this process only,
-     * false if it might be sent to another processes.
-     *
-     * @hide
-     */
-    public CursorWindow(String name, boolean localWindow) {
-        mStartPos = 0;
-        mWindowPtr = nativeCreate(name, sCursorWindowSize, localWindow);
-        if (mWindowPtr == 0) {
-            throw new CursorWindowAllocationException("Cursor window allocation of " +
-                    (sCursorWindowSize / 1024) + " kb failed. " + printStats());
-        }
-        mCloseGuard.open("close");
-        recordNewWindow(Binder.getCallingPid(), mWindowPtr);
-    }
-
-    /**
      * Creates a new empty cursor window.
      * <p>
      * The cursor initially has no rows or columns.  Call {@link #setNumColumns(int)} to
@@ -120,12 +89,20 @@
      * false if it might be sent to another processes.
      */
     public CursorWindow(boolean localWindow) {
-        this(null, localWindow);
+        mStartPos = 0;
+        mWindowPtr = nativeInitializeEmpty(sCursorWindowSize, localWindow);
+        if (mWindowPtr == 0) {
+            throw new CursorWindowAllocationException("Cursor window allocation of " +
+                    (sCursorWindowSize / 1024) + " kb failed. " + printStats());
+        }
+        mCloseGuard.open("close");
+        recordNewWindow(Binder.getCallingPid(), mWindowPtr);
     }
 
     private CursorWindow(Parcel source) {
+        IBinder binder = source.readStrongBinder();
         mStartPos = source.readInt();
-        mWindowPtr = nativeCreateFromParcel(source);
+        mWindowPtr = nativeInitializeFromBinder(binder);
         if (mWindowPtr == 0) {
             throw new CursorWindowAllocationException("Cursor window could not be "
                     + "created from binder.");
@@ -710,8 +687,8 @@
     }
 
     public void writeToParcel(Parcel dest, int flags) {
+        dest.writeStrongBinder(nativeGetBinder(mWindowPtr));
         dest.writeInt(mStartPos);
-        nativeWriteToParcel(mWindowPtr, dest);
 
         if ((flags & Parcelable.PARCELABLE_WRITE_RETURN_VALUE) != 0) {
             releaseReference();
diff --git a/core/java/android/database/IBulkCursor.java b/core/java/android/database/IBulkCursor.java
index 7c96797..244c88f 100644
--- a/core/java/android/database/IBulkCursor.java
+++ b/core/java/android/database/IBulkCursor.java
@@ -56,7 +56,7 @@
 
     public void close() throws RemoteException;
 
-    public int requery(IContentObserver observer) throws RemoteException;
+    public int requery(IContentObserver observer, CursorWindow window) throws RemoteException;
 
     boolean getWantsAllOnMoveCalls() throws RemoteException;
 
diff --git a/core/java/android/database/sqlite/SQLiteCursor.java b/core/java/android/database/sqlite/SQLiteCursor.java
index a1c36e2..9d7e152 100644
--- a/core/java/android/database/sqlite/SQLiteCursor.java
+++ b/core/java/android/database/sqlite/SQLiteCursor.java
@@ -155,7 +155,7 @@
     }
 
     private void fillWindow(int startPos) {
-        clearOrCreateLocalWindow(getDatabase().getPath());
+        clearOrCreateLocalWindow();
         mWindow.setStartPosition(startPos);
         int count = getQuery().fillWindow(mWindow);
         if (startPos == 0) { // fillWindow returns count(*) only for startPos = 0
diff --git a/core/jni/android_database_CursorWindow.cpp b/core/jni/android_database_CursorWindow.cpp
index 722aeea..fe1aca0 100644
--- a/core/jni/android_database_CursorWindow.cpp
+++ b/core/jni/android_database_CursorWindow.cpp
@@ -57,23 +57,14 @@
     jniThrowException(env, "java/lang/IllegalStateException", msg.string());
 }
 
-static jint nativeCreate(JNIEnv* env, jclass clazz,
-        jstring nameObj, jint cursorWindowSize, jboolean localOnly) {
-    String8 name;
-    if (nameObj) {
-        const char* nameStr = env->GetStringUTFChars(nameObj, NULL);
-        name.setTo(nameStr);
-        env->ReleaseStringUTFChars(nameObj, nameStr);
+static jint nativeInitializeEmpty(JNIEnv* env, jclass clazz,
+        jint cursorWindowSize, jboolean localOnly) {
+    CursorWindow* window = new CursorWindow(cursorWindowSize);
+    if (!window) {
+        return 0;
     }
-    if (name.size() == 0) {
-        name.setTo("<unnamed>");
-    }
-
-    CursorWindow* window;
-    status_t status = CursorWindow::create(name, cursorWindowSize, localOnly, &window);
-    if (status || !window) {
-        LOGE("Could not allocate CursorWindow '%s' of size %d due to error %d.",
-                name.string(), cursorWindowSize, status);
+    if (!window->initBuffer(localOnly)) {
+        delete window;
         return 0;
     }
 
@@ -81,13 +72,19 @@
     return reinterpret_cast<jint>(window);
 }
 
-static jint nativeCreateFromParcel(JNIEnv* env, jclass clazz, jobject parcelObj) {
-    Parcel* parcel = parcelForJavaObject(env, parcelObj);
+static jint nativeInitializeFromBinder(JNIEnv* env, jclass clazz, jobject binderObj) {
+    sp<IMemory> memory = interface_cast<IMemory>(ibinderForJavaObject(env, binderObj));
+    if (memory == NULL) {
+        jniThrowException(env, "java/lang/IllegalStateException", "Couldn't get native binder");
+        return 0;
+    }
 
-    CursorWindow* window;
-    status_t status = CursorWindow::createFromParcel(parcel, &window);
-    if (status || !window) {
-        LOGE("Could not create CursorWindow from Parcel due to error %d.", status);
+    CursorWindow* window = new CursorWindow();
+    if (!window) {
+        return 0;
+    }
+    if (!window->setMemory(memory)) {
+        delete window;
         return 0;
     }
 
@@ -104,26 +101,22 @@
     }
 }
 
-static void nativeWriteToParcel(JNIEnv * env, jclass clazz, jint windowPtr,
-        jobject parcelObj) {
+static jobject nativeGetBinder(JNIEnv * env, jclass clazz, jint windowPtr) {
     CursorWindow* window = reinterpret_cast<CursorWindow*>(windowPtr);
-    Parcel* parcel = parcelForJavaObject(env, parcelObj);
-
-    status_t status = window->writeToParcel(parcel);
-    if (status) {
-        String8 msg;
-        msg.appendFormat("Could not write CursorWindow to Parcel due to error %d.", status);
-        jniThrowRuntimeException(env, msg.string());
+    if (window) {
+        sp<IMemory> memory = window->getMemory();
+        if (memory != NULL) {
+            sp<IBinder> binder = memory->asBinder();
+            return javaObjectForIBinder(env, binder);
+        }
     }
+    return NULL;
 }
 
 static void nativeClear(JNIEnv * env, jclass clazz, jint windowPtr) {
     CursorWindow* window = reinterpret_cast<CursorWindow*>(windowPtr);
     LOG_WINDOW("Clearing window %p", window);
-    status_t status = window->clear();
-    if (status) {
-        LOG_WINDOW("Could not clear window. error=%d", status);
-    }
+    window->clear();
 }
 
 static jint nativeGetNumRows(JNIEnv* env, jclass clazz, jint windowPtr) {
@@ -134,14 +127,12 @@
 static jboolean nativeSetNumColumns(JNIEnv* env, jclass clazz, jint windowPtr,
         jint columnNum) {
     CursorWindow* window = reinterpret_cast<CursorWindow*>(windowPtr);
-    status_t status = window->setNumColumns(columnNum);
-    return status == OK;
+    return window->setNumColumns(columnNum);
 }
 
 static jboolean nativeAllocRow(JNIEnv* env, jclass clazz, jint windowPtr) {
     CursorWindow* window = reinterpret_cast<CursorWindow*>(windowPtr);
-    status_t status = window->allocRow();
-    return status == OK;
+    return window->allocRow() != NULL;
 }
 
 static void nativeFreeLastRow(JNIEnv* env, jclass clazz, jint windowPtr) {
@@ -154,14 +145,14 @@
     CursorWindow* window = reinterpret_cast<CursorWindow*>(windowPtr);
     LOG_WINDOW("returning column type affinity for %d,%d from %p", row, column, window);
 
-    CursorWindow::FieldSlot* fieldSlot = window->getFieldSlot(row, column);
+    field_slot_t* fieldSlot = window->getFieldSlotWithCheck(row, column);
     if (!fieldSlot) {
         // FIXME: This is really broken but we have CTS tests that depend
         // on this legacy behavior.
         //throwExceptionWithRowCol(env, row, column);
-        return CursorWindow::FIELD_TYPE_NULL;
+        return FIELD_TYPE_NULL;
     }
-    return window->getFieldSlotType(fieldSlot);
+    return fieldSlot->type;
 }
 
 static jbyteArray nativeGetBlob(JNIEnv* env, jclass clazz, jint windowPtr,
@@ -169,29 +160,29 @@
     CursorWindow* window = reinterpret_cast<CursorWindow*>(windowPtr);
     LOG_WINDOW("Getting blob for %d,%d from %p", row, column, window);
 
-    CursorWindow::FieldSlot* fieldSlot = window->getFieldSlot(row, column);
+    field_slot_t* fieldSlot = window->getFieldSlotWithCheck(row, column);
     if (!fieldSlot) {
         throwExceptionWithRowCol(env, row, column);
         return NULL;
     }
 
-    int32_t type = window->getFieldSlotType(fieldSlot);
-    if (type == CursorWindow::FIELD_TYPE_BLOB || type == CursorWindow::FIELD_TYPE_STRING) {
-        size_t size;
-        const void* value = window->getFieldSlotValueBlob(fieldSlot, &size);
+    uint8_t type = fieldSlot->type;
+    if (type == FIELD_TYPE_BLOB || type == FIELD_TYPE_STRING) {
+        uint32_t size = fieldSlot->data.buffer.size;
         jbyteArray byteArray = env->NewByteArray(size);
         if (!byteArray) {
             env->ExceptionClear();
             throw_sqlite3_exception(env, "Native could not create new byte[]");
             return NULL;
         }
-        env->SetByteArrayRegion(byteArray, 0, size, static_cast<const jbyte*>(value));
+        env->SetByteArrayRegion(byteArray, 0, size,
+                reinterpret_cast<jbyte*>(window->offsetToPtr(fieldSlot->data.buffer.offset)));
         return byteArray;
-    } else if (type == CursorWindow::FIELD_TYPE_INTEGER) {
+    } else if (type == FIELD_TYPE_INTEGER) {
         throw_sqlite3_exception(env, "INTEGER data in nativeGetBlob ");
-    } else if (type == CursorWindow::FIELD_TYPE_FLOAT) {
+    } else if (type == FIELD_TYPE_FLOAT) {
         throw_sqlite3_exception(env, "FLOAT data in nativeGetBlob ");
-    } else if (type == CursorWindow::FIELD_TYPE_NULL) {
+    } else if (type == FIELD_TYPE_NULL) {
         // do nothing
     } else {
         throwUnknownTypeException(env, type);
@@ -204,37 +195,43 @@
     CursorWindow* window = reinterpret_cast<CursorWindow*>(windowPtr);
     LOG_WINDOW("Getting string for %d,%d from %p", row, column, window);
 
-    CursorWindow::FieldSlot* fieldSlot = window->getFieldSlot(row, column);
+    field_slot_t* fieldSlot = window->getFieldSlotWithCheck(row, column);
     if (!fieldSlot) {
         throwExceptionWithRowCol(env, row, column);
         return NULL;
     }
 
-    int32_t type = window->getFieldSlotType(fieldSlot);
-    if (type == CursorWindow::FIELD_TYPE_STRING) {
-        size_t sizeIncludingNull;
-        const char* value = window->getFieldSlotValueString(fieldSlot, &sizeIncludingNull);
-        if (sizeIncludingNull <= 1) {
+    uint8_t type = fieldSlot->type;
+    if (type == FIELD_TYPE_STRING) {
+        uint32_t size = fieldSlot->data.buffer.size;
+#if WINDOW_STORAGE_UTF8
+        if (size <= 1) {
             return gEmptyString;
         }
         // Convert to UTF-16 here instead of calling NewStringUTF.  NewStringUTF
         // doesn't like UTF-8 strings with high codepoints.  It actually expects
         // Modified UTF-8 with encoded surrogate pairs.
-        String16 utf16(value, sizeIncludingNull - 1);
+        String16 utf16(window->getFieldSlotValueString(fieldSlot), size - 1);
         return env->NewString(reinterpret_cast<const jchar*>(utf16.string()), utf16.size());
-    } else if (type == CursorWindow::FIELD_TYPE_INTEGER) {
+#else
+        size_t chars = size / sizeof(char16_t);
+        return chars ? env->NewString(reinterpret_cast<jchar*>(
+                window->getFieldSlotValueString(fieldSlot)), chars)
+                : gEmptyString;
+#endif
+    } else if (type == FIELD_TYPE_INTEGER) {
         int64_t value = window->getFieldSlotValueLong(fieldSlot);
         char buf[32];
         snprintf(buf, sizeof(buf), "%lld", value);
         return env->NewStringUTF(buf);
-    } else if (type == CursorWindow::FIELD_TYPE_FLOAT) {
+    } else if (type == FIELD_TYPE_FLOAT) {
         double value = window->getFieldSlotValueDouble(fieldSlot);
         char buf[32];
         snprintf(buf, sizeof(buf), "%g", value);
         return env->NewStringUTF(buf);
-    } else if (type == CursorWindow::FIELD_TYPE_NULL) {
+    } else if (type == FIELD_TYPE_NULL) {
         return NULL;
-    } else if (type == CursorWindow::FIELD_TYPE_BLOB) {
+    } else if (type == FIELD_TYPE_BLOB) {
         throw_sqlite3_exception(env, "Unable to convert BLOB to string");
         return NULL;
     } else {
@@ -284,6 +281,21 @@
     }
 }
 
+#if !WINDOW_STORAGE_UTF8
+static void fillCharArrayBuffer(JNIEnv* env, jobject bufferObj,
+        const char16_t* str, size_t len) {
+    jcharArray dataObj = allocCharArrayBuffer(env, bufferObj, len);
+    if (dataObj) {
+        if (len) {
+            jchar* data = static_cast<jchar*>(env->GetPrimitiveArrayCritical(dataObj, NULL));
+            memcpy(data, str, len * sizeof(jchar));
+            env->ReleasePrimitiveArrayCritical(dataObj, data, 0);
+        }
+        env->SetIntField(bufferObj, gCharArrayBufferClassInfo.sizeCopied, len);
+    }
+}
+#endif
+
 static void clearCharArrayBuffer(JNIEnv* env, jobject bufferObj) {
     jcharArray dataObj = allocCharArrayBuffer(env, bufferObj, 0);
     if (dataObj) {
@@ -296,34 +308,44 @@
     CursorWindow* window = reinterpret_cast<CursorWindow*>(windowPtr);
     LOG_WINDOW("Copying string for %d,%d from %p", row, column, window);
 
-    CursorWindow::FieldSlot* fieldSlot = window->getFieldSlot(row, column);
+    field_slot_t* fieldSlot = window->getFieldSlotWithCheck(row, column);
     if (!fieldSlot) {
         throwExceptionWithRowCol(env, row, column);
         return;
     }
 
-    int32_t type = window->getFieldSlotType(fieldSlot);
-    if (type == CursorWindow::FIELD_TYPE_STRING) {
-        size_t sizeIncludingNull;
-        const char* value = window->getFieldSlotValueString(fieldSlot, &sizeIncludingNull);
-        if (sizeIncludingNull > 1) {
-            fillCharArrayBufferUTF(env, bufferObj, value, sizeIncludingNull - 1);
+    uint8_t type = fieldSlot->type;
+    if (type == FIELD_TYPE_STRING) {
+        uint32_t size = fieldSlot->data.buffer.size;
+#if WINDOW_STORAGE_UTF8
+        if (size > 1) {
+            fillCharArrayBufferUTF(env, bufferObj,
+                    window->getFieldSlotValueString(fieldSlot), size - 1);
         } else {
             clearCharArrayBuffer(env, bufferObj);
         }
-    } else if (type == CursorWindow::FIELD_TYPE_INTEGER) {
+#else
+        size_t chars = size / sizeof(char16_t);
+        if (chars) {
+            fillCharArrayBuffer(env, bufferObj,
+                    window->getFieldSlotValueString(fieldSlot), chars);
+        } else {
+            clearCharArrayBuffer(env, bufferObj);
+        }
+#endif
+    } else if (type == FIELD_TYPE_INTEGER) {
         int64_t value = window->getFieldSlotValueLong(fieldSlot);
         char buf[32];
         snprintf(buf, sizeof(buf), "%lld", value);
         fillCharArrayBufferUTF(env, bufferObj, buf, strlen(buf));
-    } else if (type == CursorWindow::FIELD_TYPE_FLOAT) {
+    } else if (type == FIELD_TYPE_FLOAT) {
         double value = window->getFieldSlotValueDouble(fieldSlot);
         char buf[32];
         snprintf(buf, sizeof(buf), "%g", value);
         fillCharArrayBufferUTF(env, bufferObj, buf, strlen(buf));
-    } else if (type == CursorWindow::FIELD_TYPE_NULL) {
+    } else if (type == FIELD_TYPE_NULL) {
         clearCharArrayBuffer(env, bufferObj);
-    } else if (type == CursorWindow::FIELD_TYPE_BLOB) {
+    } else if (type == FIELD_TYPE_BLOB) {
         throw_sqlite3_exception(env, "Unable to convert BLOB to string");
     } else {
         throwUnknownTypeException(env, type);
@@ -335,24 +357,29 @@
     CursorWindow* window = reinterpret_cast<CursorWindow*>(windowPtr);
     LOG_WINDOW("Getting long for %d,%d from %p", row, column, window);
 
-    CursorWindow::FieldSlot* fieldSlot = window->getFieldSlot(row, column);
+    field_slot_t* fieldSlot = window->getFieldSlotWithCheck(row, column);
     if (!fieldSlot) {
         throwExceptionWithRowCol(env, row, column);
         return 0;
     }
 
-    int32_t type = window->getFieldSlotType(fieldSlot);
-    if (type == CursorWindow::FIELD_TYPE_INTEGER) {
+    uint8_t type = fieldSlot->type;
+    if (type == FIELD_TYPE_INTEGER) {
         return window->getFieldSlotValueLong(fieldSlot);
-    } else if (type == CursorWindow::FIELD_TYPE_STRING) {
-        size_t sizeIncludingNull;
-        const char* value = window->getFieldSlotValueString(fieldSlot, &sizeIncludingNull);
-        return sizeIncludingNull > 1 ? strtoll(value, NULL, 0) : 0L;
-    } else if (type == CursorWindow::FIELD_TYPE_FLOAT) {
+    } else if (type == FIELD_TYPE_STRING) {
+        uint32_t size = fieldSlot->data.buffer.size;
+#if WINDOW_STORAGE_UTF8
+        return size > 1 ? strtoll(window->getFieldSlotValueString(fieldSlot), NULL, 0) : 0L;
+#else
+        size_t chars = size / sizeof(char16_t);
+        return chars ? strtoll(String8(window->getFieldSlotValueString(fieldSlot), chars)
+                .string(), NULL, 0) : 0L;
+#endif
+    } else if (type == FIELD_TYPE_FLOAT) {
         return jlong(window->getFieldSlotValueDouble(fieldSlot));
-    } else if (type == CursorWindow::FIELD_TYPE_NULL) {
+    } else if (type == FIELD_TYPE_NULL) {
         return 0;
-    } else if (type == CursorWindow::FIELD_TYPE_BLOB) {
+    } else if (type == FIELD_TYPE_BLOB) {
         throw_sqlite3_exception(env, "Unable to convert BLOB to long");
         return 0;
     } else {
@@ -366,24 +393,29 @@
     CursorWindow* window = reinterpret_cast<CursorWindow*>(windowPtr);
     LOG_WINDOW("Getting double for %d,%d from %p", row, column, window);
 
-    CursorWindow::FieldSlot* fieldSlot = window->getFieldSlot(row, column);
+    field_slot_t* fieldSlot = window->getFieldSlotWithCheck(row, column);
     if (!fieldSlot) {
         throwExceptionWithRowCol(env, row, column);
         return 0.0;
     }
 
-    int32_t type = window->getFieldSlotType(fieldSlot);
-    if (type == CursorWindow::FIELD_TYPE_FLOAT) {
+    uint8_t type = fieldSlot->type;
+    if (type == FIELD_TYPE_FLOAT) {
         return window->getFieldSlotValueDouble(fieldSlot);
-    } else if (type == CursorWindow::FIELD_TYPE_STRING) {
-        size_t sizeIncludingNull;
-        const char* value = window->getFieldSlotValueString(fieldSlot, &sizeIncludingNull);
-        return sizeIncludingNull > 1 ? strtod(value, NULL) : 0.0;
-    } else if (type == CursorWindow::FIELD_TYPE_INTEGER) {
+    } else if (type == FIELD_TYPE_STRING) {
+        uint32_t size = fieldSlot->data.buffer.size;
+#if WINDOW_STORAGE_UTF8
+        return size > 1 ? strtod(window->getFieldSlotValueString(fieldSlot), NULL) : 0.0;
+#else
+        size_t chars = size / sizeof(char16_t);
+        return chars ? strtod(String8(window->getFieldSlotValueString(fieldSlot), chars)
+                .string(), NULL) : 0.0;
+#endif
+    } else if (type == FIELD_TYPE_INTEGER) {
         return jdouble(window->getFieldSlotValueLong(fieldSlot));
-    } else if (type == CursorWindow::FIELD_TYPE_NULL) {
+    } else if (type == FIELD_TYPE_NULL) {
         return 0.0;
-    } else if (type == CursorWindow::FIELD_TYPE_BLOB) {
+    } else if (type == FIELD_TYPE_BLOB) {
         throw_sqlite3_exception(env, "Unable to convert BLOB to double");
         return 0.0;
     } else {
@@ -395,50 +427,82 @@
 static jboolean nativePutBlob(JNIEnv* env, jclass clazz, jint windowPtr,
         jbyteArray valueObj, jint row, jint column) {
     CursorWindow* window = reinterpret_cast<CursorWindow*>(windowPtr);
-    jsize len = env->GetArrayLength(valueObj);
-
-    void* value = env->GetPrimitiveArrayCritical(valueObj, NULL);
-    status_t status = window->putBlob(row, column, value, len);
-    env->ReleasePrimitiveArrayCritical(valueObj, value, JNI_ABORT);
-
-    if (status) {
-        LOG_WINDOW("Failed to put blob. error=%d", status);
+    field_slot_t * fieldSlot = window->getFieldSlotWithCheck(row, column);
+    if (fieldSlot == NULL) {
+        LOG_WINDOW(" getFieldSlotWithCheck error ");
         return false;
     }
 
-    LOG_WINDOW("%d,%d is BLOB with %u bytes", row, column, len);
+    jsize len = env->GetArrayLength(valueObj);
+    uint32_t offset = window->alloc(len);
+    if (!offset) {
+        LOG_WINDOW("Failed allocating %u bytes", len);
+        return false;
+    }
+
+    void* value = env->GetPrimitiveArrayCritical(valueObj, NULL);
+    window->copyIn(offset, static_cast<const uint8_t*>(value), len);
+    env->ReleasePrimitiveArrayCritical(valueObj, value, JNI_ABORT);
+
+    fieldSlot->type = FIELD_TYPE_BLOB;
+    fieldSlot->data.buffer.offset = offset;
+    fieldSlot->data.buffer.size = len;
+    LOG_WINDOW("%d,%d is BLOB with %u bytes @ %d", row, column, len, offset);
     return true;
 }
 
 static jboolean nativePutString(JNIEnv* env, jclass clazz, jint windowPtr,
         jstring valueObj, jint row, jint column) {
     CursorWindow* window = reinterpret_cast<CursorWindow*>(windowPtr);
+    field_slot_t * fieldSlot = window->getFieldSlotWithCheck(row, column);
+    if (fieldSlot == NULL) {
+        LOG_WINDOW(" getFieldSlotWithCheck error ");
+        return false;
+    }
 
-    size_t sizeIncludingNull = env->GetStringUTFLength(valueObj) + 1;
+#if WINDOW_STORAGE_UTF8
+    size_t size = env->GetStringUTFLength(valueObj) + 1;
     const char* valueStr = env->GetStringUTFChars(valueObj, NULL);
+#else
+    size_t size = env->GetStringLength(valueObj) * sizeof(jchar);
+    const jchar* valueStr = env->GetStringChars(valueObj, NULL);
+#endif
     if (!valueStr) {
-        LOG_WINDOW("value can't be transferred to UTFChars");
+        LOG_WINDOW("value can't be transfer to UTFChars");
         return false;
     }
-    status_t status = window->putString(row, column, valueStr, sizeIncludingNull);
+
+    uint32_t offset = window->alloc(size);
+    if (!offset) {
+        LOG_WINDOW("Failed allocating %u bytes", size);
+#if WINDOW_STORAGE_UTF8
+        env->ReleaseStringUTFChars(valueObj, valueStr);
+#else
+        env->ReleaseStringChars(valueObj, valueStr);
+#endif
+        return false;
+    }
+
+    window->copyIn(offset, reinterpret_cast<const uint8_t*>(valueStr), size);
+
+#if WINDOW_STORAGE_UTF8
     env->ReleaseStringUTFChars(valueObj, valueStr);
+#else
+    env->ReleaseStringChars(valueObj, valueStr);
+#endif
 
-    if (status) {
-        LOG_WINDOW("Failed to put string. error=%d", status);
-        return false;
-    }
-
-    LOG_WINDOW("%d,%d is TEXT with %u bytes", row, column, sizeIncludingNull);
+    fieldSlot->type = FIELD_TYPE_STRING;
+    fieldSlot->data.buffer.offset = offset;
+    fieldSlot->data.buffer.size = size;
+    LOG_WINDOW("%d,%d is TEXT with %u bytes @ %d", row, column, size, offset);
     return true;
 }
 
 static jboolean nativePutLong(JNIEnv* env, jclass clazz, jint windowPtr,
         jlong value, jint row, jint column) {
     CursorWindow* window = reinterpret_cast<CursorWindow*>(windowPtr);
-    status_t status = window->putLong(row, column, value);
-
-    if (status) {
-        LOG_WINDOW("Failed to put long. error=%d", status);
+    if (!window->putLong(row, column, value)) {
+        LOG_WINDOW(" getFieldSlotWithCheck error ");
         return false;
     }
 
@@ -449,10 +513,8 @@
 static jboolean nativePutDouble(JNIEnv* env, jclass clazz, jint windowPtr,
         jdouble value, jint row, jint column) {
     CursorWindow* window = reinterpret_cast<CursorWindow*>(windowPtr);
-    status_t status = window->putDouble(row, column, value);
-
-    if (status) {
-        LOG_WINDOW("Failed to put double. error=%d", status);
+    if (!window->putDouble(row, column, value)) {
+        LOG_WINDOW(" getFieldSlotWithCheck error ");
         return false;
     }
 
@@ -463,10 +525,8 @@
 static jboolean nativePutNull(JNIEnv* env, jclass clazz, jint windowPtr,
         jint row, jint column) {
     CursorWindow* window = reinterpret_cast<CursorWindow*>(windowPtr);
-    status_t status = window->putNull(row, column);
-
-    if (status) {
-        LOG_WINDOW("Failed to put null. error=%d", status);
+    if (!window->putNull(row, column)) {
+        LOG_WINDOW(" getFieldSlotWithCheck error ");
         return false;
     }
 
@@ -477,14 +537,14 @@
 static JNINativeMethod sMethods[] =
 {
     /* name, signature, funcPtr */
-    { "nativeCreate", "(Ljava/lang/String;IZ)I",
-            (void*)nativeCreate },
-    { "nativeCreateFromParcel", "(Landroid/os/Parcel;)I",
-            (void*)nativeCreateFromParcel },
+    { "nativeInitializeEmpty", "(IZ)I",
+            (void*)nativeInitializeEmpty },
+    { "nativeInitializeFromBinder", "(Landroid/os/IBinder;)I",
+            (void*)nativeInitializeFromBinder },
     { "nativeDispose", "(I)V",
             (void*)nativeDispose },
-    { "nativeWriteToParcel", "(ILandroid/os/Parcel;)V",
-            (void*)nativeWriteToParcel },
+    { "nativeGetBinder", "(I)Landroid/os/IBinder;",
+            (void*)nativeGetBinder },
     { "nativeClear", "(I)V",
             (void*)nativeClear },
     { "nativeGetNumRows", "(I)I",
diff --git a/core/jni/android_database_SQLiteQuery.cpp b/core/jni/android_database_SQLiteQuery.cpp
index 8170f46..022a64c 100644
--- a/core/jni/android_database_SQLiteQuery.cpp
+++ b/core/jni/android_database_SQLiteQuery.cpp
@@ -61,8 +61,7 @@
             window->getNumRows(), window->size(), window->freeSpace());
 
     int numColumns = sqlite3_column_count(statement);
-    status_t status = window->setNumColumns(numColumns);
-    if (status) {
+    if (!window->setNumColumns(numColumns)) {
         LOGE("Failed to change column count from %d to %d", window->getNumColumns(), numColumns);
         jniThrowException(env, "java/lang/IllegalStateException", "numColumns mismatch");
         return 0;
@@ -89,10 +88,10 @@
             // Allocate a new field directory for the row. This pointer is not reused
             // since it may be possible for it to be relocated on a call to alloc() when
             // the field data is being allocated.
-            status = window->allocRow();
-            if (status) {
-                LOG_WINDOW("Failed allocating fieldDir at startPos %d row %d, error=%d",
-                        startPos, addedRows, status);
+            field_slot_t* fieldDir = window->allocRow();
+            if (!fieldDir) {
+                LOG_WINDOW("Failed allocating fieldDir at startPos %d row %d",
+                        startPos, addedRows);
                 windowFull = true;
                 continue;
             }
@@ -102,28 +101,37 @@
                 int type = sqlite3_column_type(statement, i);
                 if (type == SQLITE_TEXT) {
                     // TEXT data
-                    const char* text = reinterpret_cast<const char*>(
+#if WINDOW_STORAGE_UTF8
+                    const uint8_t* text = reinterpret_cast<const uint8_t*>(
                             sqlite3_column_text(statement, i));
                     // SQLite does not include the NULL terminator in size, but does
                     // ensure all strings are NULL terminated, so increase size by
                     // one to make sure we store the terminator.
-                    size_t sizeIncludingNull = sqlite3_column_bytes(statement, i) + 1;
-                    status = window->putString(addedRows, i, text, sizeIncludingNull);
-                    if (status) {
-                        LOG_WINDOW("Failed allocating %u bytes for text at %d,%d, error=%d",
-                                sizeIncludingNull, startPos + addedRows, i, status);
+                    size_t size = sqlite3_column_bytes(statement, i) + 1;
+#else
+                    const uint8_t* text = reinterpret_cast<const uint8_t*>(
+                            sqlite3_column_text16(statement, i));
+                    size_t size = sqlite3_column_bytes16(statement, i);
+#endif
+                    int offset = window->alloc(size);
+                    if (!offset) {
+                        LOG_WINDOW("Failed allocating %u bytes for text/blob at %d,%d", size,
+                                   startPos + addedRows, i);
                         windowFull = true;
                         break;
                     }
-                    LOG_WINDOW("%d,%d is TEXT with %u bytes",
-                            startPos + addedRows, i, sizeIncludingNull);
+                    window->copyIn(offset, text, size);
+
+                    field_slot_t* fieldSlot = window->getFieldSlot(addedRows, i);
+                    fieldSlot->type = FIELD_TYPE_STRING;
+                    fieldSlot->data.buffer.offset = offset;
+                    fieldSlot->data.buffer.size = size;
+                    LOG_WINDOW("%d,%d is TEXT with %u bytes", startPos + addedRows, i, size);
                 } else if (type == SQLITE_INTEGER) {
                     // INTEGER data
                     int64_t value = sqlite3_column_int64(statement, i);
-                    status = window->putLong(addedRows, i, value);
-                    if (status) {
-                        LOG_WINDOW("Failed allocating space for a long in column %d, error=%d",
-                                i, status);
+                    if (!window->putLong(addedRows, i, value)) {
+                        LOG_WINDOW("Failed allocating space for a long in column %d", i);
                         windowFull = true;
                         break;
                     }
@@ -131,33 +139,35 @@
                 } else if (type == SQLITE_FLOAT) {
                     // FLOAT data
                     double value = sqlite3_column_double(statement, i);
-                    status = window->putDouble(addedRows, i, value);
-                    if (status) {
-                        LOG_WINDOW("Failed allocating space for a double in column %d, error=%d",
-                                i, status);
+                    if (!window->putDouble(addedRows, i, value)) {
+                        LOG_WINDOW("Failed allocating space for a double in column %d", i);
                         windowFull = true;
                         break;
                     }
                     LOG_WINDOW("%d,%d is FLOAT %lf", startPos + addedRows, i, value);
                 } else if (type == SQLITE_BLOB) {
                     // BLOB data
-                    const void* blob = sqlite3_column_blob(statement, i);
-                    size_t size = sqlite3_column_bytes(statement, i);
-                    status = window->putBlob(addedRows, i, blob, size);
-                    if (status) {
-                        LOG_WINDOW("Failed allocating %u bytes for blob at %d,%d, error=%d",
-                                size, startPos + addedRows, i, status);
+                    uint8_t const * blob = (uint8_t const *)sqlite3_column_blob(statement, i);
+                    size_t size = sqlite3_column_bytes16(statement, i);
+                    int offset = window->alloc(size);
+                    if (!offset) {
+                        LOG_WINDOW("Failed allocating %u bytes for blob at %d,%d", size,
+                                startPos + addedRows, i);
                         windowFull = true;
                         break;
                     }
-                    LOG_WINDOW("%d,%d is Blob with %u bytes",
-                            startPos + addedRows, i, size);
+                    window->copyIn(offset, blob, size);
+
+                    field_slot_t* fieldSlot = window->getFieldSlot(addedRows, i);
+                    fieldSlot->type = FIELD_TYPE_BLOB;
+                    fieldSlot->data.buffer.offset = offset;
+                    fieldSlot->data.buffer.size = size;
+                    LOG_WINDOW("%d,%d is Blob with %u bytes @ %d",
+                            startPos + addedRows, i, size, offset);
                 } else if (type == SQLITE_NULL) {
                     // NULL field
-                    status = window->putNull(addedRows, i);
-                    if (status) {
-                        LOG_WINDOW("Failed allocating space for a null in column %d, error=%d",
-                                i, status);
+                    if (!window->putNull(addedRows, i)) {
+                        LOG_WINDOW("Failed allocating space for a null in column %d", i);
                         windowFull = true;
                         break;
                     }
diff --git a/include/binder/CursorWindow.h b/include/binder/CursorWindow.h
index 5d490ed..d227244 100644
--- a/include/binder/CursorWindow.h
+++ b/include/binder/CursorWindow.h
@@ -21,8 +21,18 @@
 #include <stddef.h>
 #include <stdint.h>
 
-#include <binder/Parcel.h>
-#include <utils/String8.h>
+#include <binder/IMemory.h>
+#include <utils/RefBase.h>
+
+#define DEFAULT_WINDOW_SIZE 4096
+#define WINDOW_ALLOCATION_SIZE 4096
+
+#define ROW_SLOT_CHUNK_NUM_ROWS 16
+
+// Row slots are allocated in chunks of ROW_SLOT_CHUNK_NUM_ROWS,
+// with an offset after the rows that points to the next chunk
+#define ROW_SLOT_CHUNK_SIZE ((ROW_SLOT_CHUNK_NUM_ROWS * sizeof(row_slot_t)) + sizeof(uint32_t))
+
 
 #if LOG_NDEBUG
 
@@ -36,157 +46,176 @@
 
 #endif
 
+
+// When defined to true strings are stored as UTF8, otherwise they're UTF16
+#define WINDOW_STORAGE_UTF8 1
+
+// When defined to true numberic values are stored inline in the field_slot_t, otherwise they're allocated in the window
+#define WINDOW_STORAGE_INLINE_NUMERICS 1
+
 namespace android {
 
+typedef struct
+{
+    uint32_t numRows;
+    uint32_t numColumns;
+} window_header_t;
+
+typedef struct
+{
+    uint32_t offset;
+} row_slot_t;
+
+typedef struct
+{
+    uint8_t type;
+    union {
+        double d;
+        int64_t l;
+        struct {
+            uint32_t offset;
+            uint32_t size;
+        } buffer;
+    } data;
+} __attribute__((packed)) field_slot_t;
+
+#define FIELD_TYPE_NULL 0
+#define FIELD_TYPE_INTEGER 1
+#define FIELD_TYPE_FLOAT 2
+#define FIELD_TYPE_STRING 3
+#define FIELD_TYPE_BLOB 4
+
 /**
  * This class stores a set of rows from a database in a buffer. The begining of the
- * window has first chunk of RowSlots, which are offsets to the row directory, followed by
- * an offset to the next chunk in a linked-list of additional chunk of RowSlots in case
+ * window has first chunk of row_slot_ts, which are offsets to the row directory, followed by
+ * an offset to the next chunk in a linked-list of additional chunk of row_slot_ts in case
  * the pre-allocated chunk isn't big enough to refer to all rows. Each row directory has a
- * FieldSlot per column, which has the size, offset, and type of the data for that field.
+ * field_slot_t per column, which has the size, offset, and type of the data for that field.
  * Note that the data types come from sqlite3.h.
- *
- * Strings are stored in UTF-8.
  */
-class CursorWindow {
-    CursorWindow(const String8& name, int ashmemFd,
-            void* data, size_t size, bool readOnly);
-
+class CursorWindow
+{
 public:
-    /* Field types. */
-    enum {
-        FIELD_TYPE_NULL = 0,
-        FIELD_TYPE_INTEGER = 1,
-        FIELD_TYPE_FLOAT = 2,
-        FIELD_TYPE_STRING = 3,
-        FIELD_TYPE_BLOB = 4,
-    };
+                        CursorWindow(size_t maxSize);
+                        CursorWindow(){}
+    bool                setMemory(const sp<IMemory>&);
+                        ~CursorWindow();
 
-    /* Opaque type that describes a field slot. */
-    struct FieldSlot {
-    private:
-        int32_t type;
-        union {
-            double d;
-            int64_t l;
-            struct {
-                uint32_t offset;
-                uint32_t size;
-            } buffer;
-        } data;
+    bool                initBuffer(bool localOnly);
+    sp<IMemory>         getMemory() {return mMemory;}
 
-        friend class CursorWindow;
-    } __attribute((packed));
+    size_t              size() {return mSize;}
+    uint8_t *           data() {return mData;}
+    uint32_t            getNumRows() {return mHeader->numRows;}
+    uint32_t            getNumColumns() {return mHeader->numColumns;}
+    void                freeLastRow() {
+                            if (mHeader->numRows > 0) {
+                                mHeader->numRows--;
+                            }
+                        }
+    bool                setNumColumns(uint32_t numColumns)
+                            {
+                                uint32_t cur = mHeader->numColumns;
+                                if (cur > 0 && cur != numColumns) {
+                                    LOGE("Trying to go from %d columns to %d", cur, numColumns);
+                                    return false;
+                                }
+                                mHeader->numColumns = numColumns;
+                                return true;
+                            }
 
-    ~CursorWindow();
+    int32_t             freeSpace();
 
-    static status_t create(const String8& name, size_t size, bool localOnly,
-            CursorWindow** outCursorWindow);
-    static status_t createFromParcel(Parcel* parcel, CursorWindow** outCursorWindow);
+    void                clear();
 
-    status_t writeToParcel(Parcel* parcel);
+                        /**
+                         * Allocate a row slot and its directory. The returned
+                         * pointer points to the begining of the row's directory
+                         * or NULL if there wasn't room. The directory is
+                         * initialied with NULL entries for each field.
+                         */
+    field_slot_t *      allocRow();
 
-    inline String8 name() { return mName; }
-    inline size_t size() { return mSize; }
-    inline size_t freeSpace() { return mSize - mHeader->freeOffset; }
-    inline uint32_t getNumRows() { return mHeader->numRows; }
-    inline uint32_t getNumColumns() { return mHeader->numColumns; }
+                        /**
+                         * Allocate a portion of the window. Returns the offset
+                         * of the allocation, or 0 if there isn't enough space.
+                         * If aligned is true, the allocation gets 4 byte alignment.
+                         */
+    uint32_t            alloc(size_t size, bool aligned = false);
 
-    status_t clear();
-    status_t setNumColumns(uint32_t numColumns);
+                        /**
+                         * Copy data into the window at the given offset.
+                         */
+    void                copyIn(uint32_t offset, uint8_t const * data, size_t size);
+    void                copyIn(uint32_t offset, int64_t data);
+    void                copyIn(uint32_t offset, double data);
 
-    /**
-     * Allocate a row slot and its directory.
-     * The row is initialized will null entries for each field.
-     */
-    status_t allocRow();
-    status_t freeLastRow();
+    void                copyOut(uint32_t offset, uint8_t * data, size_t size);
+    int64_t             copyOutLong(uint32_t offset);
+    double              copyOutDouble(uint32_t offset);
 
-    status_t putBlob(uint32_t row, uint32_t column, const void* value, size_t size);
-    status_t putString(uint32_t row, uint32_t column, const char* value, size_t sizeIncludingNull);
-    status_t putLong(uint32_t row, uint32_t column, int64_t value);
-    status_t putDouble(uint32_t row, uint32_t column, double value);
-    status_t putNull(uint32_t row, uint32_t column);
+    bool                putLong(unsigned int row, unsigned int col, int64_t value);
+    bool                putDouble(unsigned int row, unsigned int col, double value);
+    bool                putNull(unsigned int row, unsigned int col);
 
-    /**
-     * Gets the field slot at the specified row and column.
-     * Returns null if the requested row or column is not in the window.
-     */
-    FieldSlot* getFieldSlot(uint32_t row, uint32_t column);
+    bool                getLong(unsigned int row, unsigned int col, int64_t * valueOut);
+    bool                getDouble(unsigned int row, unsigned int col, double * valueOut);
+    bool                getNull(unsigned int row, unsigned int col, bool * valueOut);
 
-    inline int32_t getFieldSlotType(FieldSlot* fieldSlot) {
-        return fieldSlot->type;
-    }
+    uint8_t *           offsetToPtr(uint32_t offset) {return mData + offset;}
 
-    inline int64_t getFieldSlotValueLong(FieldSlot* fieldSlot) {
+    row_slot_t *        allocRowSlot();
+
+    row_slot_t *        getRowSlot(int row);
+
+                        /**
+                         * return NULL if Failed to find rowSlot or
+                         * Invalid rowSlot
+                         */
+    field_slot_t *      getFieldSlotWithCheck(int row, int column);
+    field_slot_t *      getFieldSlot(int row, int column)
+                            {
+                                int fieldDirOffset = getRowSlot(row)->offset;
+                                return ((field_slot_t *)offsetToPtr(fieldDirOffset)) + column;
+                            }
+
+    int64_t getFieldSlotValueLong(field_slot_t* fieldSlot) {
+#if WINDOW_STORAGE_INLINE_NUMERICS
         return fieldSlot->data.l;
+#else
+        return copyOutLong(fieldSlot->data.buffer.offset);
+#endif
     }
 
-    inline double getFieldSlotValueDouble(FieldSlot* fieldSlot) {
+    double getFieldSlotValueDouble(field_slot_t* fieldSlot) {
+#if WINDOW_STORAGE_INLINE_NUMERICS
         return fieldSlot->data.d;
+#else
+        return copyOutDouble(fieldSlot->data.buffer.offset);
+#endif
     }
 
-    inline const char* getFieldSlotValueString(FieldSlot* fieldSlot,
-            size_t* outSizeIncludingNull) {
-        *outSizeIncludingNull = fieldSlot->data.buffer.size;
-        return static_cast<char*>(offsetToPtr(fieldSlot->data.buffer.offset));
+#if WINDOW_STORAGE_UTF8
+    char* getFieldSlotValueString(field_slot_t* fieldSlot) {
+        return reinterpret_cast<char*>(offsetToPtr(fieldSlot->data.buffer.offset));
     }
-
-    inline const void* getFieldSlotValueBlob(FieldSlot* fieldSlot, size_t* outSize) {
-        *outSize = fieldSlot->data.buffer.size;
-        return offsetToPtr(fieldSlot->data.buffer.offset);
+#else
+    char16_t* getFieldSlotValueString(field_slot_t* fieldSlot) {
+        return reinterpret_cast<char16_t*>(offsetToPtr(fieldSlot->data.buffer.offset));
     }
+#endif
 
 private:
-    static const size_t ROW_SLOT_CHUNK_NUM_ROWS = 100;
-
-    struct Header {
-        // Offset of the lowest unused byte in the window.
-        uint32_t freeOffset;
-
-        // Offset of the first row slot chunk.
-        uint32_t firstChunkOffset;
-
-        uint32_t numRows;
-        uint32_t numColumns;
-    };
-
-    struct RowSlot {
-        uint32_t offset;
-    };
-
-    struct RowSlotChunk {
-        RowSlot slots[ROW_SLOT_CHUNK_NUM_ROWS];
-        uint32_t nextChunkOffset;
-    };
-
-    String8 mName;
-    int mAshmemFd;
-    void* mData;
+    uint8_t * mData;
     size_t mSize;
-    bool mReadOnly;
-    Header* mHeader;
-
-    inline void* offsetToPtr(uint32_t offset) {
-        return static_cast<uint8_t*>(mData) + offset;
-    }
-
-    inline uint32_t offsetFromPtr(void* ptr) {
-        return static_cast<uint8_t*>(ptr) - static_cast<uint8_t*>(mData);
-    }
+    size_t mMaxSize;
+    window_header_t * mHeader;
+    sp<IMemory> mMemory;
 
     /**
-     * Allocate a portion of the window. Returns the offset
-     * of the allocation, or 0 if there isn't enough space.
-     * If aligned is true, the allocation gets 4 byte alignment.
+     * Offset of the lowest unused data byte in the array.
      */
-    uint32_t alloc(size_t size, bool aligned = false);
-
-    RowSlot* getRowSlot(uint32_t row);
-    RowSlot* allocRowSlot();
-
-    status_t putBlobOrString(uint32_t row, uint32_t column,
-            const void* value, size_t size, int32_t type);
+    uint32_t mFreeOffset;
 };
 
 }; // namespace android
diff --git a/libs/binder/CursorWindow.cpp b/libs/binder/CursorWindow.cpp
index 1b85a71..b02374f 100644
--- a/libs/binder/CursorWindow.cpp
+++ b/libs/binder/CursorWindow.cpp
@@ -19,9 +19,8 @@
 
 #include <utils/Log.h>
 #include <binder/CursorWindow.h>
-
-#include <cutils/ashmem.h>
-#include <sys/mman.h>
+#include <binder/MemoryHeapBase.h>
+#include <binder/MemoryBase.h>
 
 #include <assert.h>
 #include <string.h>
@@ -29,325 +28,350 @@
 
 namespace android {
 
-CursorWindow::CursorWindow(const String8& name, int ashmemFd,
-        void* data, size_t size, bool readOnly) :
-        mName(name), mAshmemFd(ashmemFd), mData(data), mSize(size), mReadOnly(readOnly) {
-    mHeader = static_cast<Header*>(mData);
+CursorWindow::CursorWindow(size_t maxSize) :
+    mMaxSize(maxSize)
+{
 }
 
-CursorWindow::~CursorWindow() {
-    ::munmap(mData, mSize);
-    ::close(mAshmemFd);
+bool CursorWindow::setMemory(const sp<IMemory>& memory)
+{
+    mMemory = memory;
+    mData = (uint8_t *) memory->pointer();
+    if (mData == NULL) {
+        return false;
+    }
+    mHeader = (window_header_t *) mData;
+
+    // Make the window read-only
+    ssize_t size = memory->size();
+    mSize = size;
+    mMaxSize = size;
+    mFreeOffset = size;
+LOG_WINDOW("Created CursorWindow from existing IMemory: mFreeOffset = %d, numRows = %d, numColumns = %d, mSize = %d, mMaxSize = %d, mData = %p", mFreeOffset, mHeader->numRows, mHeader->numColumns, mSize, mMaxSize, mData);
+    return true;
 }
 
-status_t CursorWindow::create(const String8& name, size_t size, bool localOnly,
-        CursorWindow** outCursorWindow) {
-    String8 ashmemName("CursorWindow: ");
-    ashmemName.append(name);
-    ashmemName.append(localOnly ? " (local)" : " (remote)");
+bool CursorWindow::initBuffer(bool localOnly)
+{
+    //TODO Use a non-memory dealer mmap region for localOnly
 
-    status_t result;
-    int ashmemFd = ashmem_create_region(ashmemName.string(), size);
-    if (ashmemFd < 0) {
-        result = -errno;
-    } else {
-        result = ashmem_set_prot_region(ashmemFd, PROT_READ | PROT_WRITE);
-        if (result >= 0) {
-            void* data = ::mmap(NULL, size, PROT_READ | PROT_WRITE, MAP_SHARED, ashmemFd, 0);
-            if (data == MAP_FAILED) {
-                result = -errno;
-            } else {
-                result = ashmem_set_prot_region(ashmemFd, PROT_READ);
-                if (result >= 0) {
-                    CursorWindow* window = new CursorWindow(name, ashmemFd,
-                            data, size, false /*readOnly*/);
-                    result = window->clear();
-                    if (!result) {
-                        LOG_WINDOW("Created new CursorWindow: freeOffset=%d, "
-                                "numRows=%d, numColumns=%d, mSize=%d, mData=%p",
-                                window->mHeader->freeOffset,
-                                window->mHeader->numRows,
-                                window->mHeader->numColumns,
-                                window->mSize, window->mData);
-                        *outCursorWindow = window;
-                        return OK;
-                    }
-                    delete window;
-                }
+    sp<MemoryHeapBase> heap;
+    heap = new MemoryHeapBase(mMaxSize, 0, "CursorWindow");
+    if (heap != NULL) {
+        mMemory = new MemoryBase(heap, 0, mMaxSize);
+        if (mMemory != NULL) {
+            mData = (uint8_t *) mMemory->pointer();
+            if (mData) {
+                mHeader = (window_header_t *) mData;
+                mSize = mMaxSize;
+
+                // Put the window into a clean state
+                clear();
+            LOG_WINDOW("Created CursorWindow with new MemoryDealer: mFreeOffset = %d, mSize = %d, mMaxSize = %d, mData = %p", mFreeOffset, mSize, mMaxSize, mData);
+                return true;                
             }
-            ::munmap(data, size);
-        }
-        ::close(ashmemFd);
-    }
-    *outCursorWindow = NULL;
-    return result;
-}
-
-status_t CursorWindow::createFromParcel(Parcel* parcel, CursorWindow** outCursorWindow) {
-    String8 name = parcel->readString8();
-
-    status_t result;
-    int ashmemFd = parcel->readFileDescriptor();
-    if (ashmemFd == int(BAD_TYPE)) {
-        result = BAD_TYPE;
+        } 
+        LOGE("CursorWindow heap allocation failed");
+        return false;
     } else {
-        ssize_t size = ashmem_get_size_region(ashmemFd);
-        if (size < 0) {
-            result = UNKNOWN_ERROR;
-        } else {
-            int dupAshmemFd = ::dup(ashmemFd);
-            if (dupAshmemFd < 0) {
-                result = -errno;
-            } else {
-                void* data = ::mmap(NULL, size, PROT_READ, MAP_SHARED, dupAshmemFd, 0);
-                if (data == MAP_FAILED) {
-                    result = -errno;
-                } else {
-                    CursorWindow* window = new CursorWindow(name, dupAshmemFd,
-                            data, size, true /*readOnly*/);
-                    LOG_WINDOW("Created CursorWindow from parcel: freeOffset=%d, "
-                            "numRows=%d, numColumns=%d, mSize=%d, mData=%p",
-                            window->mHeader->freeOffset,
-                            window->mHeader->numRows,
-                            window->mHeader->numColumns,
-                            window->mSize, window->mData);
-                    *outCursorWindow = window;
-                    return OK;
-                }
-                ::close(dupAshmemFd);
-            }
-        }
+        LOGE("failed to create the CursorWindow heap");
+        return false;
     }
-    *outCursorWindow = NULL;
-    return result;
 }
 
-status_t CursorWindow::writeToParcel(Parcel* parcel) {
-    status_t status = parcel->writeString8(mName);
-    if (!status) {
-        status = parcel->writeDupFileDescriptor(mAshmemFd);
-    }
-    return status;
+CursorWindow::~CursorWindow()
+{
+    // Everything that matters is a smart pointer
 }
 
-status_t CursorWindow::clear() {
-    if (mReadOnly) {
-        return INVALID_OPERATION;
-    }
-
-    mHeader->freeOffset = sizeof(Header) + sizeof(RowSlotChunk);
-    mHeader->firstChunkOffset = sizeof(Header);
+void CursorWindow::clear()
+{
     mHeader->numRows = 0;
     mHeader->numColumns = 0;
-
-    RowSlotChunk* firstChunk = static_cast<RowSlotChunk*>(offsetToPtr(mHeader->firstChunkOffset));
-    firstChunk->nextChunkOffset = 0;
-    return OK;
+    mFreeOffset = sizeof(window_header_t) + ROW_SLOT_CHUNK_SIZE;
+    // Mark the first chunk's next 'pointer' as null
+    *((uint32_t *)(mData + mFreeOffset - sizeof(uint32_t))) = 0;
 }
 
-status_t CursorWindow::setNumColumns(uint32_t numColumns) {
-    if (mReadOnly) {
-        return INVALID_OPERATION;
+int32_t CursorWindow::freeSpace()
+{
+    int32_t freeSpace = mSize - mFreeOffset;
+    if (freeSpace < 0) {
+        freeSpace = 0;
     }
-
-    uint32_t cur = mHeader->numColumns;
-    if ((cur > 0 || mHeader->numRows > 0) && cur != numColumns) {
-        LOGE("Trying to go from %d columns to %d", cur, numColumns);
-        return INVALID_OPERATION;
-    }
-    mHeader->numColumns = numColumns;
-    return OK;
+    return freeSpace;
 }
 
-status_t CursorWindow::allocRow() {
-    if (mReadOnly) {
-        return INVALID_OPERATION;
-    }
-
+field_slot_t * CursorWindow::allocRow()
+{
     // Fill in the row slot
-    RowSlot* rowSlot = allocRowSlot();
+    row_slot_t * rowSlot = allocRowSlot();
     if (rowSlot == NULL) {
-        return NO_MEMORY;
+        return NULL;
     }
 
     // Allocate the slots for the field directory
-    size_t fieldDirSize = mHeader->numColumns * sizeof(FieldSlot);
-    uint32_t fieldDirOffset = alloc(fieldDirSize, true /*aligned*/);
+    size_t fieldDirSize = mHeader->numColumns * sizeof(field_slot_t);
+    uint32_t fieldDirOffset = alloc(fieldDirSize);
     if (!fieldDirOffset) {
         mHeader->numRows--;
-        LOG_WINDOW("The row failed, so back out the new row accounting "
-                "from allocRowSlot %d", mHeader->numRows);
-        return NO_MEMORY;
+        LOG_WINDOW("The row failed, so back out the new row accounting from allocRowSlot %d", mHeader->numRows);
+        return NULL;
     }
-    FieldSlot* fieldDir = static_cast<FieldSlot*>(offsetToPtr(fieldDirOffset));
-    memset(fieldDir, 0, fieldDirSize);
+    field_slot_t * fieldDir = (field_slot_t *)offsetToPtr(fieldDirOffset);
+    memset(fieldDir, 0x0, fieldDirSize);
 
-    LOG_WINDOW("Allocated row %u, rowSlot is at offset %u, fieldDir is %d bytes at offset %u\n",
-            mHeader->numRows - 1, offsetFromPtr(rowSlot), fieldDirSize, fieldDirOffset);
+LOG_WINDOW("Allocated row %u, rowSlot is at offset %u, fieldDir is %d bytes at offset %u\n", (mHeader->numRows - 1), ((uint8_t *)rowSlot) - mData, fieldDirSize, fieldDirOffset);
     rowSlot->offset = fieldDirOffset;
-    return OK;
+
+    return fieldDir;
 }
 
-status_t CursorWindow::freeLastRow() {
-    if (mReadOnly) {
-        return INVALID_OPERATION;
-    }
-
-    if (mHeader->numRows > 0) {
-        mHeader->numRows--;
-    }
-    return OK;
-}
-
-uint32_t CursorWindow::alloc(size_t size, bool aligned) {
+uint32_t CursorWindow::alloc(size_t requestedSize, bool aligned)
+{
+    int32_t size;
     uint32_t padding;
     if (aligned) {
         // 4 byte alignment
-        padding = (~mHeader->freeOffset + 1) & 3;
+        padding = 4 - (mFreeOffset & 0x3);
     } else {
         padding = 0;
     }
 
-    uint32_t offset = mHeader->freeOffset + padding;
-    uint32_t nextFreeOffset = offset + size;
-    if (nextFreeOffset > mSize) {
-        LOGE("Window is full: requested allocation %d bytes, "
-                "free space %d bytes, window size %d bytes",
-                size, freeSpace(), mSize);
-        return 0;
+    size = requestedSize + padding;
+
+    if (size > freeSpace()) {
+        LOGV("need to grow: mSize = %d, size = %d, freeSpace() = %d, numRows = %d", mSize, size,
+                freeSpace(), mHeader->numRows);
+        // Only grow the window if the first row doesn't fit
+        if (mHeader->numRows > 1) {
+            LOGV("not growing since there are already %d row(s), max size %d", mHeader->numRows,
+                    mMaxSize);
+            return 0;
+        }
+
+        // Find a new size that will fit the allocation
+        int allocated = mSize - freeSpace();
+        int newSize = mSize + WINDOW_ALLOCATION_SIZE;
+        while (size > (newSize - allocated)) {
+            newSize += WINDOW_ALLOCATION_SIZE;
+            if (newSize > mMaxSize) {
+                LOGE("Attempting to grow window beyond max size (%d)", mMaxSize);
+                return 0;
+            }
+        }
+LOG_WINDOW("found size %d", newSize);
+        mSize = newSize;
     }
 
-    mHeader->freeOffset = nextFreeOffset;
+    uint32_t offset = mFreeOffset + padding;
+    mFreeOffset += size;
     return offset;
 }
 
-CursorWindow::RowSlot* CursorWindow::getRowSlot(uint32_t row) {
-    uint32_t chunkPos = row;
-    RowSlotChunk* chunk = static_cast<RowSlotChunk*>(
-            offsetToPtr(mHeader->firstChunkOffset));
-    while (chunkPos >= ROW_SLOT_CHUNK_NUM_ROWS) {
-        chunk = static_cast<RowSlotChunk*>(offsetToPtr(chunk->nextChunkOffset));
-        chunkPos -= ROW_SLOT_CHUNK_NUM_ROWS;
+row_slot_t * CursorWindow::getRowSlot(int row)
+{
+    LOG_WINDOW("enter getRowSlot current row num %d, this row %d", mHeader->numRows, row);
+    int chunkNum = row / ROW_SLOT_CHUNK_NUM_ROWS;
+    int chunkPos = row % ROW_SLOT_CHUNK_NUM_ROWS;
+    int chunkPtrOffset = sizeof(window_header_t) + ROW_SLOT_CHUNK_SIZE - sizeof(uint32_t);
+    uint8_t * rowChunk = mData + sizeof(window_header_t);
+    for (int i = 0; i < chunkNum; i++) {
+        rowChunk = offsetToPtr(*((uint32_t *)(mData + chunkPtrOffset)));
+        chunkPtrOffset = rowChunk - mData + (ROW_SLOT_CHUNK_NUM_ROWS * sizeof(row_slot_t));
     }
-    return &chunk->slots[chunkPos];
+    return (row_slot_t *)(rowChunk + (chunkPos * sizeof(row_slot_t)));
+    LOG_WINDOW("exit getRowSlot current row num %d, this row %d", mHeader->numRows, row);    
 }
 
-CursorWindow::RowSlot* CursorWindow::allocRowSlot() {
-    uint32_t chunkPos = mHeader->numRows;
-    RowSlotChunk* chunk = static_cast<RowSlotChunk*>(
-            offsetToPtr(mHeader->firstChunkOffset));
-    while (chunkPos > ROW_SLOT_CHUNK_NUM_ROWS) {
-        chunk = static_cast<RowSlotChunk*>(offsetToPtr(chunk->nextChunkOffset));
-        chunkPos -= ROW_SLOT_CHUNK_NUM_ROWS;
-    }
-    if (chunkPos == ROW_SLOT_CHUNK_NUM_ROWS) {
-        if (!chunk->nextChunkOffset) {
-            chunk->nextChunkOffset = alloc(sizeof(RowSlotChunk), true /*aligned*/);
-            if (!chunk->nextChunkOffset) {
+row_slot_t * CursorWindow::allocRowSlot()
+{
+    int chunkNum = mHeader->numRows / ROW_SLOT_CHUNK_NUM_ROWS;
+    int chunkPos = mHeader->numRows % ROW_SLOT_CHUNK_NUM_ROWS;
+    int chunkPtrOffset = sizeof(window_header_t) + ROW_SLOT_CHUNK_SIZE - sizeof(uint32_t);
+    uint8_t * rowChunk = mData + sizeof(window_header_t);
+LOG_WINDOW("Allocating row slot, mHeader->numRows is %d, chunkNum is %d, chunkPos is %d", mHeader->numRows, chunkNum, chunkPos);
+    for (int i = 0; i < chunkNum; i++) {
+        uint32_t nextChunkOffset = *((uint32_t *)(mData + chunkPtrOffset));
+LOG_WINDOW("nextChunkOffset is %d", nextChunkOffset);
+        if (nextChunkOffset == 0) {
+            // Allocate a new row chunk
+            nextChunkOffset = alloc(ROW_SLOT_CHUNK_SIZE, true);
+            if (nextChunkOffset == 0) {
                 return NULL;
             }
+            rowChunk = offsetToPtr(nextChunkOffset);
+LOG_WINDOW("allocated new chunk at %d, rowChunk = %p", nextChunkOffset, rowChunk);
+            *((uint32_t *)(mData + chunkPtrOffset)) = rowChunk - mData;
+            // Mark the new chunk's next 'pointer' as null
+            *((uint32_t *)(rowChunk + ROW_SLOT_CHUNK_SIZE - sizeof(uint32_t))) = 0;
+        } else {
+LOG_WINDOW("follwing 'pointer' to next chunk, offset of next pointer is %d", chunkPtrOffset);
+            rowChunk = offsetToPtr(nextChunkOffset);
+            chunkPtrOffset = rowChunk - mData + (ROW_SLOT_CHUNK_NUM_ROWS * sizeof(row_slot_t));
         }
-        chunk = static_cast<RowSlotChunk*>(offsetToPtr(chunk->nextChunkOffset));
-        chunk->nextChunkOffset = 0;
-        chunkPos = 0;
     }
-    mHeader->numRows += 1;
-    return &chunk->slots[chunkPos];
+    mHeader->numRows++;
+
+    return (row_slot_t *)(rowChunk + (chunkPos * sizeof(row_slot_t)));
 }
 
-CursorWindow::FieldSlot* CursorWindow::getFieldSlot(uint32_t row, uint32_t column) {
-    if (row >= mHeader->numRows || column >= mHeader->numColumns) {
-        LOGE("Failed to read row %d, column %d from a CursorWindow which "
-                "has %d rows, %d columns.",
-                row, column, mHeader->numRows, mHeader->numColumns);
-        return NULL;
-    }
-    RowSlot* rowSlot = getRowSlot(row);
-    if (!rowSlot) {
-        LOGE("Failed to find rowSlot for row %d.", row);
-        return NULL;
-    }
-    FieldSlot* fieldDir = static_cast<FieldSlot*>(offsetToPtr(rowSlot->offset));
-    return &fieldDir[column];
+field_slot_t * CursorWindow::getFieldSlotWithCheck(int row, int column)
+{
+  if (row < 0 || row >= mHeader->numRows || column < 0 || column >= mHeader->numColumns) {
+      LOGE("Failed to read row# %d, column# from a CursorWindow which has %d rows, %d columns.",
+              row, column, mHeader->numRows, mHeader->numColumns);
+      return NULL;
+  }        
+  row_slot_t * rowSlot = getRowSlot(row);
+  if (!rowSlot) {
+      LOGE("Failed to find rowSlot for row %d", row);
+      return NULL;
+  }
+  if (rowSlot->offset == 0 || rowSlot->offset >= mSize) {
+      LOGE("Invalid rowSlot, offset = %d", rowSlot->offset);
+      return NULL;
+  }  
+  int fieldDirOffset = rowSlot->offset;
+  return ((field_slot_t *)offsetToPtr(fieldDirOffset)) + column;  
 }
 
-status_t CursorWindow::putBlob(uint32_t row, uint32_t column, const void* value, size_t size) {
-    return putBlobOrString(row, column, value, size, FIELD_TYPE_BLOB);
+void CursorWindow::copyIn(uint32_t offset, uint8_t const * data, size_t size)
+{
+    assert(offset + size <= mSize);    
+    memcpy(mData + offset, data, size);
 }
 
-status_t CursorWindow::putString(uint32_t row, uint32_t column, const char* value,
-        size_t sizeIncludingNull) {
-    return putBlobOrString(row, column, value, sizeIncludingNull, FIELD_TYPE_STRING);
+void CursorWindow::copyIn(uint32_t offset, int64_t data)
+{
+    assert(offset + sizeof(int64_t) <= mSize);
+    memcpy(mData + offset, (uint8_t *)&data, sizeof(int64_t));
 }
 
-status_t CursorWindow::putBlobOrString(uint32_t row, uint32_t column,
-        const void* value, size_t size, int32_t type) {
-    if (mReadOnly) {
-        return INVALID_OPERATION;
-    }
+void CursorWindow::copyIn(uint32_t offset, double data)
+{
+    assert(offset + sizeof(double) <= mSize);
+    memcpy(mData + offset, (uint8_t *)&data, sizeof(double));
+}
 
-    FieldSlot* fieldSlot = getFieldSlot(row, column);
+void CursorWindow::copyOut(uint32_t offset, uint8_t * data, size_t size)
+{
+    assert(offset + size <= mSize);
+    memcpy(data, mData + offset, size);
+}
+
+int64_t CursorWindow::copyOutLong(uint32_t offset)
+{
+    int64_t value;
+    assert(offset + sizeof(int64_t) <= mSize);
+    memcpy(&value, mData + offset, sizeof(int64_t));
+    return value;
+}
+
+double CursorWindow::copyOutDouble(uint32_t offset)
+{
+    double value;
+    assert(offset + sizeof(double) <= mSize);
+    memcpy(&value, mData + offset, sizeof(double));
+    return value;
+}
+
+bool CursorWindow::putLong(unsigned int row, unsigned int col, int64_t value)
+{
+    field_slot_t * fieldSlot = getFieldSlotWithCheck(row, col);
     if (!fieldSlot) {
-        return BAD_VALUE;
+        return false;
     }
 
-    uint32_t offset = alloc(size);
-    if (!offset) {
-        return NO_MEMORY;
-    }
-
-    memcpy(offsetToPtr(offset), value, size);
-
-    fieldSlot->type = type;
-    fieldSlot->data.buffer.offset = offset;
-    fieldSlot->data.buffer.size = size;
-    return OK;
-}
-
-status_t CursorWindow::putLong(uint32_t row, uint32_t column, int64_t value) {
-    if (mReadOnly) {
-        return INVALID_OPERATION;
-    }
-
-    FieldSlot* fieldSlot = getFieldSlot(row, column);
-    if (!fieldSlot) {
-        return BAD_VALUE;
-    }
-
-    fieldSlot->type = FIELD_TYPE_INTEGER;
+#if WINDOW_STORAGE_INLINE_NUMERICS
     fieldSlot->data.l = value;
-    return OK;
+#else
+    int offset = alloc(sizeof(int64_t));
+    if (!offset) {
+        return false;
+    }
+
+    copyIn(offset, value);
+
+    fieldSlot->data.buffer.offset = offset;
+    fieldSlot->data.buffer.size = sizeof(int64_t);
+#endif
+    fieldSlot->type = FIELD_TYPE_INTEGER;
+    return true;
 }
 
-status_t CursorWindow::putDouble(uint32_t row, uint32_t column, double value) {
-    if (mReadOnly) {
-        return INVALID_OPERATION;
-    }
-
-    FieldSlot* fieldSlot = getFieldSlot(row, column);
+bool CursorWindow::putDouble(unsigned int row, unsigned int col, double value)
+{
+    field_slot_t * fieldSlot = getFieldSlotWithCheck(row, col);
     if (!fieldSlot) {
-        return BAD_VALUE;
+        return false;
     }
 
-    fieldSlot->type = FIELD_TYPE_FLOAT;
+#if WINDOW_STORAGE_INLINE_NUMERICS
     fieldSlot->data.d = value;
-    return OK;
-}
-
-status_t CursorWindow::putNull(uint32_t row, uint32_t column) {
-    if (mReadOnly) {
-        return INVALID_OPERATION;
+#else
+    int offset = alloc(sizeof(int64_t));
+    if (!offset) {
+        return false;
     }
 
-    FieldSlot* fieldSlot = getFieldSlot(row, column);
+    copyIn(offset, value);
+
+    fieldSlot->data.buffer.offset = offset;
+    fieldSlot->data.buffer.size = sizeof(double);
+#endif
+    fieldSlot->type = FIELD_TYPE_FLOAT;
+    return true;
+}
+
+bool CursorWindow::putNull(unsigned int row, unsigned int col)
+{
+    field_slot_t * fieldSlot = getFieldSlotWithCheck(row, col);
     if (!fieldSlot) {
-        return BAD_VALUE;
+        return false;
     }
 
     fieldSlot->type = FIELD_TYPE_NULL;
     fieldSlot->data.buffer.offset = 0;
     fieldSlot->data.buffer.size = 0;
-    return OK;
+    return true;
+}
+
+bool CursorWindow::getLong(unsigned int row, unsigned int col, int64_t * valueOut)
+{
+    field_slot_t * fieldSlot = getFieldSlotWithCheck(row, col);
+    if (!fieldSlot || fieldSlot->type != FIELD_TYPE_INTEGER) {
+        return false;
+    }
+
+    *valueOut = getFieldSlotValueLong(fieldSlot);
+    return true;
+}
+
+bool CursorWindow::getDouble(unsigned int row, unsigned int col, double * valueOut)
+{
+    field_slot_t * fieldSlot = getFieldSlotWithCheck(row, col);
+    if (!fieldSlot || fieldSlot->type != FIELD_TYPE_FLOAT) {
+        return false;
+    }
+
+    *valueOut = getFieldSlotValueDouble(fieldSlot);
+    return true;
+}
+
+bool CursorWindow::getNull(unsigned int row, unsigned int col, bool * valueOut)
+{
+    field_slot_t * fieldSlot = getFieldSlotWithCheck(row, col);
+    if (!fieldSlot) {
+        return false;
+    }
+    
+    if (fieldSlot->type != FIELD_TYPE_NULL) {
+        *valueOut = false;
+    } else {
+        *valueOut = true;
+    }
+    return true;
 }
 
 }; // namespace android
diff --git a/libs/binder/Parcel.cpp b/libs/binder/Parcel.cpp
index c7180ce..608877e 100644
--- a/libs/binder/Parcel.cpp
+++ b/libs/binder/Parcel.cpp
@@ -752,7 +752,7 @@
 
     int result = ashmem_set_prot_region(fd, PROT_READ | PROT_WRITE);
     if (result < 0) {
-        status = result;
+        status = -result;
     } else {
         void* ptr = ::mmap(NULL, len, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);
         if (ptr == MAP_FAILED) {
@@ -760,7 +760,7 @@
         } else {
             result = ashmem_set_prot_region(fd, PROT_READ);
             if (result < 0) {
-                status = result;
+                status = -result;
             } else {
                 status = writeInt32(1);
                 if (!status) {