Merge b2g-inbound and mozilla-central on a CLOSED TREE
authorWes Kocher <wkocher@mozilla.com>
Wed, 04 Sep 2013 17:22:09 -0700
changeset 159379 77ed46bf4c1a98ebdd79e45ffce947d3a92642c3
parent 159328 99bd249e5a2063029f1527cc9a68e9fac09e107e (current diff)
parent 159378 01085e7665c524e3a23571c51576a1340c91c460 (diff)
child 159443 a40169f091ea751e074d6cc21015500b38036fce
child 159467 b3cf6b53a99046007905c14ce7d6dfbc2bfc38d4
child 159479 4fffd0f9a19818a6bb7799d08a96275e21494867
child 159506 2c7fecacbdc1a5a12d24666f3a4e317b6ce1d50d
child 171257 2b0fd3a2a0e754272801462ce9c5e744e21ecbc3
push id407
push userlsblakk@mozilla.com
push dateTue, 03 Dec 2013 03:32:50 +0000
treeherdermozilla-release@babf8c9ebc52 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
milestone26.0a1
first release with
nightly linux32
77ed46bf4c1a / 26.0a1 / 20130905030206 / files
nightly linux64
77ed46bf4c1a / 26.0a1 / 20130905030206 / files
nightly mac
77ed46bf4c1a / 26.0a1 / 20130905030206 / files
nightly win32
77ed46bf4c1a / 26.0a1 / 20130905030206 / files
nightly win64
77ed46bf4c1a / 26.0a1 / 20130905030206 / files
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
releases
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Merge b2g-inbound and mozilla-central on a CLOSED TREE
dom/bindings/Bindings.conf
--- a/b2g/chrome/content/settings.js
+++ b/b2g/chrome/content/settings.js
@@ -1,72 +1,90 @@
 /* -*- Mode: Java; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- /
 /* vim: set shiftwidth=2 tabstop=2 autoindent cindent expandtab: */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this file,
  * You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-"use strict;"
+"use strict";
 
 const Cc = Components.classes;
 const Ci = Components.interfaces;
 const Cu = Components.utils;
 const Cr = Components.results;
 
 Cu.import('resource://gre/modules/XPCOMUtils.jsm');
 Cu.import('resource://gre/modules/Services.jsm');
 
 #ifdef MOZ_WIDGET_GONK
 XPCOMUtils.defineLazyGetter(this, "libcutils", function () {
   Cu.import("resource://gre/modules/systemlibs.js");
   return libcutils;
 });
 #endif
 
-// Once Bug 731746 - Allow chrome JS object to implement nsIDOMEventTarget
-// is resolved this helper could be removed.
 var SettingsListener = {
-  _callbacks: {},
+  // Timer to remove the lock.
+  _timer: null,
+
+  // lock stores here
+  _lock: null,
 
-  init: function sl_init() {
-    if ('mozSettings' in navigator && navigator.mozSettings) {
-      navigator.mozSettings.onsettingchange = this.onchange.bind(this);
-    }
-  },
+  /**
+   * getSettingsLock: create a lock or retrieve one that we saved.
+   * mozSettings.createLock() is expensive and lock should be reused
+   * whenever possible.
+   */
+  getSettingsLock: function sl_getSettingsLock() {
+    // Each time there is a getSettingsLock call, we postpone the removal.
+    clearTimeout(this._timer);
+    this._timer = setTimeout((function() {
+      this._lock = null;
+    }).bind(this), 0);
 
-  onchange: function sl_onchange(evt) {
-    var callback = this._callbacks[evt.settingName];
-    if (callback) {
-      callback(evt.settingValue);
+    // If there is a lock present we return that.
+    if (this._lock) {
+      return this._lock;
     }
+
+    // If there isn't we create a new one.
+    let settings = window.navigator.mozSettings;
+
+    return (this._lock = settings.createLock());
   },
 
   observe: function sl_observe(name, defaultValue, callback) {
-    var settings = window.navigator.mozSettings;
-    if (!settings) {
-      window.setTimeout(function() { callback(defaultValue); });
-      return;
+    let settings = window.navigator.mozSettings;
+
+    let req;
+    try {
+      req = this.getSettingsLock().get(name);
+    } catch (e) {
+      // It is possible (but rare) for getSettingsLock() to return
+      // a SettingsLock object that is no longer valid.
+      // Until https://bugzilla.mozilla.org/show_bug.cgi?id=793239
+      // is fixed, we just catch the resulting exception and try
+      // again with a fresh lock
+      console.warn('Stale lock in settings.js.',
+                   'See https://bugzilla.mozilla.org/show_bug.cgi?id=793239');
+      this._lock = null;
+      req = this.getSettingsLock().get(name);
     }
 
-    if (!callback || typeof callback !== 'function') {
-      throw new Error('Callback is not a function');
-    }
-
-    var req = settings.createLock().get(name);
     req.addEventListener('success', (function onsuccess() {
       callback(typeof(req.result[name]) != 'undefined' ?
         req.result[name] : defaultValue);
     }));
 
-    this._callbacks[name] = callback;
+    settings.addObserver(name, function settingChanged(evt) {
+      callback(evt.settingValue);
+    });
   }
 };
 
-SettingsListener.init();
-
 // =================== Console ======================
 
 SettingsListener.observe('debug.console.enabled', true, function(value) {
   Services.prefs.setBoolPref('consoleservice.enabled', value);
   Services.prefs.setBoolPref('layout.css.report_errors', value);
 });
 
 // =================== Languages ====================
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "752ced5b3cc3208f79806eccf8d8768910f17f2b", 
+    "revision": "4296bbf526e4ed8d0ae443f20947bd2d7189aa0e", 
     "repo_path": "/integration/gaia-central"
 }
--- a/dom/bluetooth/BluetoothHfpManager.cpp
+++ b/dom/bluetooth/BluetoothHfpManager.cpp
@@ -641,17 +641,20 @@ BluetoothHfpManager::HandleIccInfoChange
 {
   nsCOMPtr<nsIIccProvider> icc =
     do_GetService(NS_RILCONTENTHELPER_CONTRACTID);
   NS_ENSURE_TRUE_VOID(icc);
 
   nsCOMPtr<nsIDOMMozIccInfo> iccInfo;
   icc->GetIccInfo(getter_AddRefs(iccInfo));
   NS_ENSURE_TRUE_VOID(iccInfo);
-  iccInfo->GetMsisdn(mMsisdn);
+
+  nsCOMPtr<nsIDOMMozGsmIccInfo> gsmIccInfo = do_QueryInterface(iccInfo);
+  NS_ENSURE_TRUE_VOID(gsmIccInfo);
+  gsmIccInfo->GetMsisdn(mMsisdn);
 }
 
 void
 BluetoothHfpManager::HandleShutdown()
 {
   MOZ_ASSERT(NS_IsMainThread());
   sInShutdown = true;
   Disconnect();
--- a/dom/bluetooth/BluetoothService.cpp
+++ b/dom/bluetooth/BluetoothService.cpp
@@ -20,16 +20,17 @@
 #include "jsapi.h"
 #include "mozilla/Services.h"
 #include "mozilla/StaticPtr.h"
 #include "mozilla/unused.h"
 #include "mozilla/Util.h"
 #include "mozilla/dom/ContentParent.h"
 #include "mozilla/dom/bluetooth/BluetoothTypes.h"
 #include "mozilla/ipc/UnixSocket.h"
+#include "mozilla/LazyIdleThread.h"
 #include "nsContentUtils.h"
 #include "nsCxPusher.h"
 #include "nsIObserverService.h"
 #include "nsISettingsService.h"
 #include "nsISystemMessagesInternal.h"
 #include "nsITimer.h"
 #include "nsThreadUtils.h"
 #include "nsXPCOM.h"
@@ -49,16 +50,17 @@
 #endif
 
 #define MOZSETTINGS_CHANGED_ID      "mozsettings-changed"
 #define BLUETOOTH_ENABLED_SETTING   "bluetooth.enabled"
 #define BLUETOOTH_DEBUGGING_SETTING "bluetooth.debugging.enabled"
 
 #define PROP_BLUETOOTH_ENABLED      "bluetooth.isEnabled"
 
+#define DEFAULT_THREAD_TIMEOUT_MS 3000
 #define DEFAULT_SHUTDOWN_TIMER_MS 5000
 
 bool gBluetoothDebugFlag = false;
 
 using namespace mozilla;
 using namespace mozilla::dom;
 USING_BLUETOOTH_NAMESPACE
 
@@ -140,29 +142,18 @@ public:
       } else {
         signalName = NS_LITERAL_STRING("Disabled");
       }
       signalPath = NS_LITERAL_STRING(KEY_MANAGER);
       BluetoothSignal signal(signalName, signalPath, v);
       gBluetoothService->DistributeSignal(signal);
     }
 
-    if (!mEnabled || gInShutdown) {
-      // Shut down the command thread if it still exists.
-      if (gBluetoothService->mBluetoothCommandThread) {
-        nsCOMPtr<nsIThread> thread;
-        gBluetoothService->mBluetoothCommandThread.swap(thread);
-        if (NS_FAILED(thread->Shutdown())) {
-          NS_WARNING("Failed to shut down the bluetooth command thread!");
-        }
-      }
-
-      if (gInShutdown) {
-        gBluetoothService = nullptr;
-      }
+    if (gInShutdown) {
+      gBluetoothService = nullptr;
     }
 
     return NS_OK;
   }
 
 private:
   bool mEnabled;
 };
@@ -456,42 +447,39 @@ BluetoothService::StartStopBluetooth(boo
 
   if (gInShutdown) {
     if (aStart) {
       // Don't try to start if we're already shutting down.
       MOZ_ASSERT(false, "Start called while in shutdown!");
       return NS_ERROR_FAILURE;
     }
 
-    if (!mBluetoothCommandThread) {
+    if (!mBluetoothThread) {
       // Don't create a new thread after we've begun shutdown since bluetooth
       // can't be running.
       return NS_OK;
     }
   }
 
-  nsresult rv;
-  if (!mBluetoothCommandThread) {
-    MOZ_ASSERT(!gInShutdown);
-
-    rv = NS_NewNamedThread("BluetoothCmd",
-                           getter_AddRefs(mBluetoothCommandThread));
-    NS_ENSURE_SUCCESS(rv, rv);
-  }
-
   if (!aStart) {
     BluetoothHfpManager* hfp = BluetoothHfpManager::Get();
     hfp->Disconnect();
 
     BluetoothOppManager* opp = BluetoothOppManager::Get();
     opp->Disconnect();
   }
 
+  if (!mBluetoothThread) {
+    mBluetoothThread = new LazyIdleThread(DEFAULT_THREAD_TIMEOUT_MS,
+                                          NS_LITERAL_CSTRING("Bluetooth"),
+                                          LazyIdleThread::ManualShutdown);
+  }
+
   nsCOMPtr<nsIRunnable> runnable = new ToggleBtTask(aStart, aIsStartup);
-  rv = mBluetoothCommandThread->Dispatch(runnable, NS_DISPATCH_NORMAL);
+  nsresult rv = mBluetoothThread->Dispatch(runnable, NS_DISPATCH_NORMAL);
   NS_ENSURE_SUCCESS(rv, rv);
 
   return NS_OK;
 }
 
 void
 BluetoothService::SetEnabled(bool aEnabled)
 {
@@ -809,18 +797,8 @@ BluetoothService::Notify(const Bluetooth
   nsCOMPtr<nsISystemMessagesInternal> systemMessenger =
     do_GetService("@mozilla.org/system-message-internal;1");
   NS_ENSURE_TRUE_VOID(systemMessenger);
 
   systemMessenger->BroadcastMessage(type,
                                     OBJECT_TO_JSVAL(obj),
                                     JS::UndefinedValue());
 }
-
-void
-BluetoothService::DispatchToCommandThread(nsRunnable* aRunnable)
-{
-  MOZ_ASSERT(NS_IsMainThread());
-  MOZ_ASSERT(aRunnable);
-  MOZ_ASSERT(mBluetoothCommandThread);
-
-  mBluetoothCommandThread->Dispatch(aRunnable, NS_DISPATCH_NORMAL);
-}
--- a/dom/bluetooth/BluetoothService.h
+++ b/dom/bluetooth/BluetoothService.h
@@ -42,48 +42,48 @@ class BluetoothService : public nsIObser
 
   class StartupTask;
   friend class StartupTask;
 
 public:
   NS_DECL_ISUPPORTS
   NS_DECL_NSIOBSERVER
 
-  /** 
+  /**
    * Add a message handler object from message distribution observer.
    * Must be called from the main thread.
    *
    * @param aNodeName Node name of the object
    * @param aMsgHandler Weak pointer to the object
    */
   virtual void
   RegisterBluetoothSignalHandler(const nsAString& aNodeName,
                                  BluetoothSignalObserver* aMsgHandler);
 
-  /** 
+  /**
    * Remove a message handler object from message distribution observer.
    * Must be called from the main thread.
    *
    * @param aNodeName Node name of the object
    * @param aMsgHandler Weak pointer to the object
    */
   virtual void
   UnregisterBluetoothSignalHandler(const nsAString& aNodeName,
                                    BluetoothSignalObserver* aMsgHandler);
 
-  /** 
+  /**
    * Remove a message handlers for the given observer.
    * Must be called from the main thread.
    *
    * @param aMsgHandler Weak pointer to the object
    */
   void
   UnregisterAllSignalHandlers(BluetoothSignalObserver* aMsgHandler);
 
-  /** 
+  /**
    * Distribute a signal to the observer list
    *
    * @param aSignal Signal object to distribute
    *
    * @return NS_OK if signal distributed, NS_ERROR_FAILURE on error
    */
   void
   DistributeSignal(const BluetoothSignal& aEvent);
@@ -145,17 +145,17 @@ public:
   /**
    * Stop device discovery (platform specific implementation)
    *
    * @return NS_OK if discovery stopped correctly, false otherwise
    */
   virtual nsresult
   StopDiscoveryInternal(BluetoothReplyRunnable* aRunnable) = 0;
 
-  /** 
+  /**
    * Start device discovery (platform specific implementation)
    *
    * @return NS_OK if discovery stopped correctly, false otherwise
    */
   virtual nsresult
   StartDiscoveryInternal(BluetoothReplyRunnable* aRunnable) = 0;
 
   /**
@@ -302,19 +302,16 @@ public:
   }
 
   bool
   IsToggling() const;
 
   void
   RemoveObserverFromTable(const nsAString& key);
 
-  void
-  DispatchToCommandThread(nsRunnable* aRunnable);
-
 protected:
   BluetoothService()
   : mEnabled(false)
   {
     mBluetoothSignalObserverTable.Init();
   }
 
   virtual ~BluetoothService();
@@ -323,17 +320,17 @@ protected:
   Init();
 
   void
   Cleanup();
 
   nsresult
   StartStopBluetooth(bool aStart, bool aIsStartup);
 
-  /** 
+  /**
    * Platform specific startup functions go here. Usually deals with member
    * variables, so not static. Guaranteed to be called outside of main thread.
    *
    * @return NS_OK on correct startup, NS_ERROR_FAILURE otherwise
    */
   virtual nsresult
   StartInternal() = 0;
 
@@ -382,33 +379,28 @@ protected:
   // Called by ToggleBtAck.
   void
   SetEnabled(bool aEnabled);
 
   // Called by Get().
   static BluetoothService*
   Create();
 
-  /**
-   * Due to the fact that some operations require multiple calls, a
-   * CommandThread is created that can run blocking, platform-specific calls
-   * where either no asynchronous equivilent exists, or else where multiple
-   * asynchronous calls would require excessive runnable bouncing between main
-   * thread and IO thread.
-   *
-   * For instance, when we retrieve an Adapter object, we would like it to come
-   * with all of its properties filled in and registered as an agent, which
-   * requires a minimum of 3 calls to platform specific code on some platforms.
-   *
-   */
-  nsCOMPtr<nsIThread> mBluetoothCommandThread;
-
   typedef nsClassHashtable<nsStringHashKey, BluetoothSignalObserverList >
   BluetoothSignalObserverTable;
 
   BluetoothSignalObserverTable mBluetoothSignalObserverTable;
 
   bool mEnabled;
+
+private:
+  /**
+   * Due to the fact that the startup and shutdown of the Bluetooth system
+   * can take an indefinite amount of time, a command thread is created
+   * that can run blocking calls. The thread is not intended for regular
+   * Bluetooth operations though.
+   */
+  nsCOMPtr<nsIThread> mBluetoothThread;
 };
 
 END_BLUETOOTH_NAMESPACE
 
 #endif
--- a/dom/browser-element/BrowserElementPanning.js
+++ b/dom/browser-element/BrowserElementPanning.js
@@ -178,16 +178,22 @@ const ContentPanning = {
       KineticPanning.stop();
 
       if (oldTarget && oldTarget == this.target)
         this.preventNextClick = true;
     }
 
     this.position.set(screenX, screenY);
     KineticPanning.record(new Point(0, 0), evt.timeStamp);
+
+    // We prevent start events to avoid sending a focus event at the end of this
+    // touch series. See bug 889717.
+    if (this.panning || this.preventNextClick) {
+      evt.preventDefault();
+    }
   },
 
   onTouchEnd: function cp_onTouchEnd(evt) {
     let touch = null;
     if (!this.dragging ||
         (this.watchedEventsType == 'touch' &&
          !(touch = this.findPrimaryPointer(evt.changedTouches)))) {
       return;
@@ -209,20 +215,25 @@ const ContentPanning = {
     // same element.
     if (this.hybridEvents) {
       let target =
         content.document.elementFromPoint(touch.clientX, touch.clientY);
       click |= (target === this.pointerDownTarget);
     }
 
     if (this.target && click && (this.panning || this.preventNextClick)) {
-      let target = this.target;
-      let view = target.ownerDocument ? target.ownerDocument.defaultView
-                                      : target;
-      view.addEventListener('click', this, true, true);
+      if (this.hybridEvents) {
+        let target = this.target;
+        let view = target.ownerDocument ? target.ownerDocument.defaultView
+                                        : target;
+        view.addEventListener('click', this, true, true);
+      } else {
+        // We prevent end events to avoid sending a focus event. See bug 889717.
+        evt.preventDefault();
+      }
     }
 
     this._finishPanning();
 
     // Now that we're done, avoid entraining the thing we just panned.
     this.pointerDownTarget = null;
   },
 
--- a/dom/icc/interfaces/nsIDOMIccInfo.idl
+++ b/dom/icc/interfaces/nsIDOMIccInfo.idl
@@ -1,18 +1,25 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this file,
  * You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "nsISupports.idl"
 
-[scriptable, uuid(a45c0fe0-c911-11e2-8b8b-0800200c9a66)]
+[scriptable, uuid(dd9f229c-e5a6-453a-8388-950af0ff9918)]
 interface nsIDOMMozIccInfo : nsISupports
 {
-   /**
+  /**
+   * Integrated Circuit Card Type.
+   *
+   * Possible values: "sim", "usim", "ruim".
+   */
+  readonly attribute DOMString iccType;
+
+  /**
    * Integrated Circuit Card Identifier.
    */
   readonly attribute DOMString iccid;
 
   /**
    * Mobile Country Code (MCC) of the subscriber's home network.
    */
   readonly attribute DOMString mcc;
@@ -31,15 +38,33 @@ interface nsIDOMMozIccInfo : nsISupports
    * Network name must be a part of displayed carrier name.
    */
   readonly attribute boolean isDisplayNetworkNameRequired;
 
   /**
    * Service provider name must be a part of displayed carrier name.
    */
   readonly attribute boolean isDisplaySpnRequired;
+};
 
+[scriptable, uuid(3c237e39-7af3-4748-baf4-4a3b6c3e0e66)]
+interface nsIDOMMozGsmIccInfo : nsIDOMMozIccInfo
+{
   /**
-   * Mobile Station ISDN Number (MSISDN) of the subscriber's, aka
+   * Mobile Station ISDN Number (MSISDN) of the subscriber, aka
    * his phone number.
    */
   readonly attribute DOMString msisdn;
 };
+
+[scriptable, uuid(013e973e-8b56-4525-b634-d23166b86edb)]
+interface nsIDOMMozCdmaIccInfo : nsIDOMMozIccInfo
+{
+  /**
+   * Mobile Directory Number (MDN) of the subscriber, aka his phone number.
+   */
+  readonly attribute DOMString mdn;
+
+  /**
+   * Mobile Identification Number (MIN) of the subscriber.
+   */
+  readonly attribute DOMString min;
+};
--- a/dom/icc/interfaces/nsIDOMIccManager.idl
+++ b/dom/icc/interfaces/nsIDOMIccManager.idl
@@ -275,16 +275,18 @@ interface nsIDOMMozIccManager : nsIDOMEv
    * ICC.
    */
   [implicit_jscontext] attribute jsval onstksessionend;
 
   // UICC Card Information.
 
   /**
    * Information stored in the device's ICC card.
+   *
+   * Null if the card is not detected.
    */
   readonly attribute nsIDOMMozIccInfo iccInfo;
 
   /**
    * The 'iccinfochange' event is notified whenever the icc info object
    * changes.
    */
   [implicit_jscontext] attribute jsval oniccinfochange;
--- a/dom/icc/tests/marionette/test_icc_info.js
+++ b/dom/icc/tests/marionette/test_icc_info.js
@@ -12,38 +12,32 @@ let icc;
 let iccInfo;
 ifr.onload = function() {
   icc = ifr.contentWindow.navigator.mozIccManager;
   ok(icc instanceof ifr.contentWindow.MozIccManager,
      "icc is instanceof " + icc.constructor);
 
   iccInfo = icc.iccInfo;
 
+  is(iccInfo.iccType, "sim");
+
   // The emulator's hard coded iccid value.
   // See it here {B2G_HOME}/external/qemu/telephony/sim_card.c#L299.
   is(iccInfo.iccid, 89014103211118510720);
 
   // The emulator's hard coded mcc and mnc codes.
   // See it here {B2G_HOME}/external/qemu/telephony/android_modem.c#L2465.
   is(iccInfo.mcc, 310);
   is(iccInfo.mnc, 260);
   is(iccInfo.spn, "Android");
   // Phone number is hardcoded in MSISDN
   // See {B2G_HOME}/external/qemu/telephony/sim_card.c, in asimcard_io()
   is(iccInfo.msisdn, "15555215554");
 
-  testDisplayConditionChange(testSPN, [
-    // [MCC, MNC, isDisplayNetworkNameRequired, isDisplaySpnRequired]
-    [123, 456, false, true], // Not in HPLMN.
-    [234, 136,  true, true], // Not in HPLMN, but in PLMN specified in SPDI.
-    [123, 456, false, true], // Not in HPLMN. Triggering iccinfochange
-    [466,  92,  true, true], // Not in HPLMN, but in another PLMN specified in SPDI.
-    [123, 456, false, true], // Not in HPLMN. Triggering iccinfochange
-    [310, 260,  true, true], // inside HPLMN.
-  ], finalize);
+  runNextTest();
 };
 document.body.appendChild(ifr);
 
 let emulatorCmdPendingCount = 0;
 function sendEmulatorCommand(cmd, callback) {
   emulatorCmdPendingCount++;
   runEmulatorCmd(cmd, function (result) {
     emulatorCmdPendingCount--;
@@ -55,26 +49,51 @@ function sendEmulatorCommand(cmd, callba
 function setEmulatorMccMnc(mcc, mnc) {
   let cmd = "operator set 0 Android,Android," + mcc + mnc;
   sendEmulatorCommand(cmd, function (result) {
     let re = new RegExp("" + mcc + mnc + "$");
     ok(result[0].match(re), "MCC/MNC should be changed.");
   });
 }
 
+function setAirplaneModeEnabled(enabled) {
+  let settings = ifr.contentWindow.navigator.mozSettings;
+  let setLock = settings.createLock();
+  let obj = {
+    "ril.radio.disabled": enabled
+  };
+  let setReq = setLock.set(obj);
+
+  log("set airplane mode to " + enabled);
+
+  setReq.addEventListener("success", function onSetSuccess() {
+    log("set 'ril.radio.disabled' to " + enabled);
+  });
+
+  setReq.addEventListener("error", function onSetError() {
+    ok(false, "cannot set 'ril.radio.disabled' to " + enabled);
+  });
+}
+
 function waitForIccInfoChange(callback) {
   icc.addEventListener("iccinfochange", function handler() {
     icc.removeEventListener("iccinfochange", handler);
     callback();
   });
 }
 
-function finalize() {
-  SpecialPowers.removePermission("mobileconnection", document);
-  finish();
+function waitForCardStateChange(expectedCardState, callback) {
+  icc.addEventListener("cardstatechange", function oncardstatechange() {
+    log("card state changes to " + icc.cardState);
+    if (icc.cardState === expectedCardState) {
+      log("got expected card state: " + icc.cardState);
+      icc.removeEventListener("cardstatechange", oncardstatechange);
+      callback();
+    }
+  });
 }
 
 // Test display condition change.
 function testDisplayConditionChange(func, caseArray, oncomplete) {
   (function do_call(index) {
     let next = index < (caseArray.length - 1) ? do_call.bind(null, index + 1) : oncomplete;
     caseArray[index].push(next);
     func.apply(null, caseArray[index]);
@@ -88,8 +107,50 @@ function testSPN(mcc, mnc, expectedIsDis
        expectedIsDisplayNetworkNameRequired);
     is(iccInfo.isDisplaySpnRequired,
        expectedIsDisplaySpnRequired);
     // operatorchange will be ignored if we send commands too soon.
     window.setTimeout(callback, 100);
   });
   setEmulatorMccMnc(mcc, mnc);
 }
+
+// Test iccInfo when card is not ready
+function testCardIsNotReady() {
+  // Enable airplane mode
+  setAirplaneModeEnabled(true);
+
+  waitForCardStateChange(null, function callback() {
+    is(icc.iccInfo, null);
+
+    // Disable airplane mode
+    setAirplaneModeEnabled(false);
+    waitForCardStateChange("ready", runNextTest);
+  });
+}
+
+let tests = [
+  testDisplayConditionChange.bind(this, testSPN, [
+    // [MCC, MNC, isDisplayNetworkNameRequired, isDisplaySpnRequired]
+    [123, 456, false, true], // Not in HPLMN.
+    [234, 136,  true, true], // Not in HPLMN, but in PLMN specified in SPDI.
+    [123, 456, false, true], // Not in HPLMN. Triggering iccinfochange
+    [466,  92,  true, true], // Not in HPLMN, but in another PLMN specified in SPDI.
+    [123, 456, false, true], // Not in HPLMN. Triggering iccinfochange
+    [310, 260,  true, true], // inside HPLMN.
+  ], runNextTest),
+  testCardIsNotReady
+];
+
+function runNextTest() {
+  let test = tests.shift();
+  if (!test) {
+    finalize();
+    return;
+  }
+
+  test();
+}
+
+function finalize() {
+  SpecialPowers.removePermission("mobileconnection", document);
+  finish();
+}
--- a/dom/mobilemessage/interfaces/nsIDOMMobileMessageManager.idl
+++ b/dom/mobilemessage/interfaces/nsIDOMMobileMessageManager.idl
@@ -6,20 +6,20 @@
 
 interface nsIDOMEventListener;
 interface nsIDOMMozSmsFilter;
 interface nsIDOMMozSmsSegmentInfo;
 interface nsIDOMDOMCursor;
 interface nsIDOMDOMRequest;
 interface nsIDOMBlob;
 
-[scriptable, builtinclass, uuid(efff5276-0f3f-4137-9b16-66e894400e01)]
+[scriptable, builtinclass, uuid(3f81dcbc-00cf-11e3-ae66-538115636543)]
 interface nsIDOMMozMobileMessageManager : nsIDOMEventTarget
 {
-  nsIDOMMozSmsSegmentInfo getSegmentInfoForText(in DOMString text);
+  nsIDOMDOMRequest getSegmentInfoForText(in DOMString text);
 
   // The first parameter can be either a DOMString (only one number) or an array
   // of DOMStrings.
   // The method returns a DOMRequest object if one number has been passed.
   // An array of DOMRequest objects otherwise.
   jsval send(in jsval number, in DOMString message);
 
   nsIDOMDOMRequest sendMMS(in jsval parameters /* MmsParameters */);
--- a/dom/mobilemessage/interfaces/nsIMobileMessageCallback.idl
+++ b/dom/mobilemessage/interfaces/nsIMobileMessageCallback.idl
@@ -1,24 +1,25 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "nsISupports.idl"
+#include "nsIDOMSmsSegmentInfo.idl"
 
 dictionary SmsThreadListItem
 {
   unsigned long long id;
   DOMString senderOrReceiver;
   unsigned long long timestamp;
   DOMString body;
   unsigned long long unreadCount;
 };
 
-[scriptable, uuid(ea5fb581-bee7-40a6-b2dc-c98b99a2dc49)]
+[scriptable, uuid(399125a8-00d2-11e3-8d12-3fba4465c097)]
 interface nsIMobileMessageCallback : nsISupports
 {
   /**
    * All SMS related errors.
    * Make sure to keep this list in sync with the list in:
    * embedding/android/GeckoSmsManager.java
    */
   const unsigned short SUCCESS_NO_ERROR          = 0;
@@ -43,9 +44,12 @@ interface nsIMobileMessageCallback : nsI
   void notifyGetMessageFailed(in long error);
 
   void notifyMessageDeleted([array, size_is(count)] in boolean deleted,
                             in uint32_t count);
   void notifyDeleteMessageFailed(in long error);
 
   void notifyMessageMarkedRead(in boolean read);
   void notifyMarkMessageReadFailed(in long error);
+
+  void notifySegmentInfoForTextGot(in nsIDOMMozSmsSegmentInfo info);
+  void notifyGetSegmentInfoForTextFailed(in long error);
 };
--- a/dom/mobilemessage/interfaces/nsISmsService.idl
+++ b/dom/mobilemessage/interfaces/nsISmsService.idl
@@ -8,22 +8,23 @@ interface nsIDOMMozSmsMessage;
 interface nsIDOMMozSmsSegmentInfo;
 interface nsIMobileMessageCallback;
 
 %{C++
 #define SMS_SERVICE_CID { 0xbada3cb8, 0xa568, 0x4dff, { 0xb5, 0x43, 0x52, 0xbb, 0xb3, 0x14, 0x31, 0x21 } }
 #define SMS_SERVICE_CONTRACTID "@mozilla.org/sms/smsservice;1"
 %}
 
-[scriptable, builtinclass, uuid(f0d5d11b-0326-4cb1-bb76-a3f912212287)]
+[scriptable, builtinclass, uuid(0f3f75ec-00dd-11e3-87ac-0b1d5c79afdf)]
 interface nsISmsService : nsISupports
 {
   boolean hasSupport();
 
-  nsIDOMMozSmsSegmentInfo getSegmentInfoForText(in DOMString text);
+  void getSegmentInfoForText(in DOMString text,
+                             in nsIMobileMessageCallback request);
 
   void send(in DOMString number,
             in DOMString message,
             in boolean silent,
             in nsIMobileMessageCallback request);
 
   boolean isSilentNumber(in DOMString number);
   void addSilentNumber(in DOMString number);
--- a/dom/mobilemessage/src/MobileMessageCallback.cpp
+++ b/dom/mobilemessage/src/MobileMessageCallback.cpp
@@ -3,16 +3,17 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "MobileMessageCallback.h"
 #include "nsContentUtils.h"
 #include "nsCxPusher.h"
 #include "nsIDOMMozSmsMessage.h"
 #include "nsIDOMMozMmsMessage.h"
+#include "nsIDOMSmsSegmentInfo.h"
 #include "nsIScriptGlobalObject.h"
 #include "nsPIDOMWindow.h"
 #include "MmsMessage.h"
 #include "jsapi.h"
 #include "xpcpublic.h"
 #include "nsServiceManagerUtils.h"
 #include "nsTArrayHelpers.h"
 
@@ -34,24 +35,32 @@ MobileMessageCallback::MobileMessageCall
 }
 
 MobileMessageCallback::~MobileMessageCallback()
 {
 }
 
 
 nsresult
-MobileMessageCallback::NotifySuccess(JS::Handle<JS::Value> aResult)
+MobileMessageCallback::NotifySuccess(JS::Handle<JS::Value> aResult, bool aAsync)
 {
+  if (aAsync) {
+    nsCOMPtr<nsIDOMRequestService> rs =
+      do_GetService(DOMREQUEST_SERVICE_CONTRACTID);
+    NS_ENSURE_TRUE(rs, NS_ERROR_FAILURE);
+
+    return rs->FireSuccessAsync(mDOMRequest, aResult);
+  }
+
   mDOMRequest->FireSuccess(aResult);
   return NS_OK;
 }
 
 nsresult
-MobileMessageCallback::NotifySuccess(nsISupports *aMessage)
+MobileMessageCallback::NotifySuccess(nsISupports *aMessage, bool aAsync)
 {
   nsresult rv;
   nsIScriptContext* scriptContext = mDOMRequest->GetContextForEventHandlers(&rv);
   NS_ENSURE_SUCCESS(rv, rv);
   NS_ENSURE_TRUE(scriptContext, NS_ERROR_FAILURE);
 
   AutoPushJSContext cx(scriptContext->GetNativeContext());
   NS_ENSURE_TRUE(cx, NS_ERROR_FAILURE);
@@ -61,48 +70,58 @@ MobileMessageCallback::NotifySuccess(nsI
 
   JSAutoCompartment ac(cx, global);
 
   JS::Rooted<JS::Value> wrappedMessage(cx);
   rv = nsContentUtils::WrapNative(cx, global, aMessage,
                                   wrappedMessage.address());
   NS_ENSURE_SUCCESS(rv, rv);
 
-  return NotifySuccess(wrappedMessage);
+  return NotifySuccess(wrappedMessage, aAsync);
 }
 
 nsresult
-MobileMessageCallback::NotifyError(int32_t aError)
+MobileMessageCallback::NotifyError(int32_t aError, bool aAsync)
 {
+  nsAutoString errorStr;
   switch (aError) {
     case nsIMobileMessageCallback::NO_SIGNAL_ERROR:
-      mDOMRequest->FireError(NS_LITERAL_STRING("NoSignalError"));
+      errorStr = NS_LITERAL_STRING("NoSignalError");
       break;
     case nsIMobileMessageCallback::NOT_FOUND_ERROR:
-      mDOMRequest->FireError(NS_LITERAL_STRING("NotFoundError"));
+      errorStr = NS_LITERAL_STRING("NotFoundError");
       break;
     case nsIMobileMessageCallback::UNKNOWN_ERROR:
-      mDOMRequest->FireError(NS_LITERAL_STRING("UnknownError"));
+      errorStr = NS_LITERAL_STRING("UnknownError");
       break;
     case nsIMobileMessageCallback::INTERNAL_ERROR:
-      mDOMRequest->FireError(NS_LITERAL_STRING("InternalError"));
+      errorStr = NS_LITERAL_STRING("InternalError");
       break;
     case nsIMobileMessageCallback::NO_SIM_CARD_ERROR:
-      mDOMRequest->FireError(NS_LITERAL_STRING("NoSimCardError"));
+      errorStr = NS_LITERAL_STRING("NoSimCardError");
       break;
     case nsIMobileMessageCallback::RADIO_DISABLED_ERROR:
-      mDOMRequest->FireError(NS_LITERAL_STRING("RadioDisabledError"));
+      errorStr = NS_LITERAL_STRING("RadioDisabledError");
       break;
     case nsIMobileMessageCallback::INVALID_ADDRESS_ERROR:
-      mDOMRequest->FireError(NS_LITERAL_STRING("InvalidAddressError"));
+      errorStr = NS_LITERAL_STRING("InvalidAddressError");
       break;
     default: // SUCCESS_NO_ERROR is handled above.
       MOZ_CRASH("Should never get here!");
   }
 
+  if (aAsync) {
+    nsCOMPtr<nsIDOMRequestService> rs =
+      do_GetService(DOMREQUEST_SERVICE_CONTRACTID);
+    NS_ENSURE_TRUE(rs, NS_ERROR_FAILURE);
+
+    return rs->FireErrorAsync(mDOMRequest, errorStr);
+  }
+
+  mDOMRequest->FireError(errorStr);
   return NS_OK;
 }
 
 NS_IMETHODIMP
 MobileMessageCallback::NotifyMessageSent(nsISupports *aMessage)
 {
   return NotifySuccess(aMessage);
 }
@@ -168,11 +187,23 @@ MobileMessageCallback::NotifyMessageMark
 }
 
 NS_IMETHODIMP
 MobileMessageCallback::NotifyMarkMessageReadFailed(int32_t aError)
 {
   return NotifyError(aError);
 }
 
+NS_IMETHODIMP
+MobileMessageCallback::NotifySegmentInfoForTextGot(nsIDOMMozSmsSegmentInfo *aInfo)
+{
+  return NotifySuccess(aInfo, true);
+}
+
+NS_IMETHODIMP
+MobileMessageCallback::NotifyGetSegmentInfoForTextFailed(int32_t aError)
+{
+  return NotifyError(aError, true);
+}
+
 } // namesapce mobilemessage
 } // namespace dom
 } // namespace mozilla
--- a/dom/mobilemessage/src/MobileMessageCallback.h
+++ b/dom/mobilemessage/src/MobileMessageCallback.h
@@ -24,18 +24,18 @@ public:
 
   MobileMessageCallback(DOMRequest* aDOMRequest);
 
 private:
   ~MobileMessageCallback();
 
   nsRefPtr<DOMRequest> mDOMRequest;
 
-  nsresult NotifySuccess(JS::Handle<JS::Value> aResult);
-  nsresult NotifySuccess(nsISupports *aMessage);
-  nsresult NotifyError(int32_t aError);
+  nsresult NotifySuccess(JS::Handle<JS::Value> aResult, bool aAsync = false);
+  nsresult NotifySuccess(nsISupports *aMessage, bool aAsync = false);
+  nsresult NotifyError(int32_t aError, bool aAsync = false);
 };
 
 } // namespace mobilemessage
 } // namespace dom
 } // namespace mozilla
 
 #endif // mozilla_dom_mobilemessage_MobileMessageCallback_h
--- a/dom/mobilemessage/src/MobileMessageManager.cpp
+++ b/dom/mobilemessage/src/MobileMessageManager.cpp
@@ -96,22 +96,29 @@ MobileMessageManager::Shutdown()
   obs->RemoveObserver(this, kSmsSentObserverTopic);
   obs->RemoveObserver(this, kSmsFailedObserverTopic);
   obs->RemoveObserver(this, kSmsDeliverySuccessObserverTopic);
   obs->RemoveObserver(this, kSmsDeliveryErrorObserverTopic);
 }
 
 NS_IMETHODIMP
 MobileMessageManager::GetSegmentInfoForText(const nsAString& aText,
-                                            nsIDOMMozSmsSegmentInfo** aResult)
+                                            nsIDOMDOMRequest** aRequest)
 {
   nsCOMPtr<nsISmsService> smsService = do_GetService(SMS_SERVICE_CONTRACTID);
   NS_ENSURE_TRUE(smsService, NS_ERROR_FAILURE);
 
-  return smsService->GetSegmentInfoForText(aText, aResult);
+  nsRefPtr<DOMRequest> request = new DOMRequest(GetOwner());
+  nsCOMPtr<nsIMobileMessageCallback> msgCallback =
+    new MobileMessageCallback(request);
+  nsresult rv = smsService->GetSegmentInfoForText(aText, msgCallback);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  request.forget(aRequest);
+  return NS_OK;
 }
 
 nsresult
 MobileMessageManager::Send(JSContext* aCx, JS::Handle<JSObject*> aGlobal,
                            JS::Handle<JSString*> aNumber,
                            const nsAString& aMessage, JS::Value* aRequest)
 {
   nsCOMPtr<nsISmsService> smsService = do_GetService(SMS_SERVICE_CONTRACTID);
--- a/dom/mobilemessage/src/SmsSegmentInfo.cpp
+++ b/dom/mobilemessage/src/SmsSegmentInfo.cpp
@@ -50,10 +50,16 @@ SmsSegmentInfo::GetCharsPerSegment(int32
 
 NS_IMETHODIMP
 SmsSegmentInfo::GetCharsAvailableInLastSegment(int32_t* aCharsAvailableInLastSegment)
 {
   *aCharsAvailableInLastSegment = mData.charsAvailableInLastSegment();
   return NS_OK;
 }
 
+const SmsSegmentInfoData&
+SmsSegmentInfo::GetData() const
+{
+  return mData;
+}
+
 } // namespace dom
 } // namespace mozilla
--- a/dom/mobilemessage/src/SmsSegmentInfo.h
+++ b/dom/mobilemessage/src/SmsSegmentInfo.h
@@ -17,18 +17,21 @@ class SmsSegmentInfo MOZ_FINAL : public 
 {
 public:
   NS_DECL_ISUPPORTS
   NS_DECL_NSIDOMMOZSMSSEGMENTINFO
 
   SmsSegmentInfo(int32_t aSegments,
                  int32_t aCharsPerSegment,
                  int32_t aCharsAvailableInLastSegment);
+
   SmsSegmentInfo(const mobilemessage::SmsSegmentInfoData& aData);
 
+  const mobilemessage::SmsSegmentInfoData& GetData() const;
+
 private:
   mobilemessage::SmsSegmentInfoData mData;
 };
 
 } // namespace dom
 } // namespace mozilla
 
 #endif // mozilla_dom_mobilemessage_SmsSegmentInfo_h
--- a/dom/mobilemessage/src/android/SmsService.cpp
+++ b/dom/mobilemessage/src/android/SmsService.cpp
@@ -18,29 +18,26 @@ NS_IMPL_ISUPPORTS1(SmsService, nsISmsSer
 NS_IMETHODIMP
 SmsService::HasSupport(bool* aHasSupport)
 {
   *aHasSupport = true;
   return NS_OK;
 }
 
 NS_IMETHODIMP
-SmsService::GetSegmentInfoForText(const nsAString & aText,
-                                  nsIDOMMozSmsSegmentInfo** aResult)
+SmsService::GetSegmentInfoForText(const nsAString& aText,
+                                  nsIMobileMessageCallback* aRequest)
 {
   if (!AndroidBridge::Bridge()) {
     return NS_ERROR_FAILURE;
   }
 
-  SmsSegmentInfoData data;
-  nsresult rv = AndroidBridge::Bridge()->GetSegmentInfoForText(aText, &data);
+  nsresult rv = AndroidBridge::Bridge()->GetSegmentInfoForText(aText, aRequest);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  nsCOMPtr<nsIDOMMozSmsSegmentInfo> info = new SmsSegmentInfo(data);
-  info.forget(aResult);
   return NS_OK;
 }
 
 NS_IMETHODIMP
 SmsService::Send(const nsAString& aNumber,
                  const nsAString& aMessage,
                  const bool       aSilent,
                  nsIMobileMessageCallback* aRequest)
--- a/dom/mobilemessage/src/fallback/SmsService.cpp
+++ b/dom/mobilemessage/src/fallback/SmsService.cpp
@@ -17,18 +17,18 @@ NS_IMPL_ISUPPORTS1(SmsService, nsISmsSer
 NS_IMETHODIMP
 SmsService::HasSupport(bool* aHasSupport)
 {
   *aHasSupport = false;
   return NS_OK;
 }
 
 NS_IMETHODIMP
-SmsService::GetSegmentInfoForText(const nsAString & aText,
-                                  nsIDOMMozSmsSegmentInfo** aResult)
+SmsService::GetSegmentInfoForText(const nsAString& aText,
+                                  nsIMobileMessageCallback* aRequest)
 {
   NS_ERROR("We should not be here!");
   return NS_ERROR_FAILURE;
 }
 
 NS_IMETHODIMP
 SmsService::Send(const nsAString& aNumber,
                  const nsAString& aMessage,
--- a/dom/mobilemessage/src/gonk/MmsPduHelper.jsm
+++ b/dom/mobilemessage/src/gonk/MmsPduHelper.jsm
@@ -6,16 +6,18 @@
 
 const {classes: Cc, interfaces: Ci, utils: Cu, results: Cr} = Components;
 
 let WSP = {};
 Cu.import("resource://gre/modules/WspPduHelper.jsm", WSP);
 
 Cu.import("resource://gre/modules/mms_consts.js");
 
+Cu.import("resource://gre/modules/PhoneNumberUtils.jsm");
+
 let DEBUG; // set to true to see debug messages
 
 this.MMS_VERSION = (function () {
   Cu.import("resource://gre/modules/Services.jsm");
 
   try {
     return Services.prefs.getIntPref("dom.mms.version");
   } catch(ex) {}
@@ -173,29 +175,60 @@ this.Address = {
     }
 
     if (!str) {
       throw new WSP.CodeError("Address: invalid value: " + JSON.stringify(value));
     }
 
     EncodedStringValue.encode(data, str);
   },
+
+  /**
+   * @param address
+   *        Address string which want to find the type.
+   *
+   * @return Address type.
+   */
+  resolveType: function resolveType(address) {
+    if (address.match(this.REGEXP_EMAIL)) {
+      return "email";
+    }
+
+    if (address.match(this.REGEXP_IPV4)) {
+      return "IPv4";
+    }
+
+    if (address.match(this.REGEXP_IPV6)) {
+      return "IPv6";
+    }
+
+    let normalizedAddress = PhoneNumberUtils.normalize(address, false);
+    if (PhoneNumberUtils.isPlainPhoneNumber(normalizedAddress)) {
+      return "PLMN";
+    }
+
+    return "Others";
+  },
 };
 
 defineLazyRegExp(Address, "REGEXP_DECODE_PLMN",        "^(\\+?[\\d.-]+)\\/TYPE=(PLMN)$");
 defineLazyRegExp(Address, "REGEXP_DECODE_IPV4",        "^(\\d{1,3}(?:\\.\\d{1,3}){3})\\/TYPE=(IPv4)$");
 defineLazyRegExp(Address, "REGEXP_DECODE_IPV6",        "^([\\da-fA-F]{4}(?::[\\da-fA-F]{4}){7})\\/TYPE=(IPv6)$");
 defineLazyRegExp(Address, "REGEXP_DECODE_CUSTOM",      "^([\\w\\+\\-.%]+)\\/TYPE=(\\w+)$");
 defineLazyRegExp(Address, "REGEXP_ENCODE_PLMN",        "^\\+?[\\d.-]+$");
 defineLazyRegExp(Address, "REGEXP_ENCODE_IPV4",        "^\\d{1,3}(?:\\.\\d{1,3}){3}$");
 defineLazyRegExp(Address, "REGEXP_ENCODE_IPV6",        "^[\\da-fA-F]{4}(?::[\\da-fA-F]{4}){7}$");
 defineLazyRegExp(Address, "REGEXP_ENCODE_CUSTOM_TYPE", "^\\w+$");
 defineLazyRegExp(Address, "REGEXP_ENCODE_CUSTOM_ADDR", "^[\\w\\+\\-.%]+$");
 defineLazyRegExp(Address, "REGEXP_NUM",                "^[\\+*#]\\d+$");
 defineLazyRegExp(Address, "REGEXP_ALPHANUM",           "^\\w+$");
+defineLazyRegExp(Address, "REGEXP_PLMN",               "^\\?[\\d.-]$");
+defineLazyRegExp(Address, "REGEXP_IPV4",               "^\\d{1,3}(?:\\.\\d{1,3}){3}$");
+defineLazyRegExp(Address, "REGEXP_IPV6",               "^[\\da-fA-F]{4}(?::[\\da-fA-F]{4}){7}$");
+defineLazyRegExp(Address, "REGEXP_EMAIL",              "@");
 
 /**
  * Header-field = MMS-header | Application-header
  *
  * @see OMA-TS-MMS_ENC-V1_3-20110913-A clause 7.2
  */
 this.HeaderField = {
   /**
--- a/dom/mobilemessage/src/gonk/MmsService.js
+++ b/dom/mobilemessage/src/gonk/MmsService.js
@@ -1682,28 +1682,32 @@ MmsService.prototype = {
     let smil = aParams.smil;
 
     // |aMessage.headers|
     let headers = aMessage["headers"] = {};
     let receivers = aParams.receivers;
     if (receivers.length != 0) {
       let headersTo = headers["to"] = [];
       for (let i = 0; i < receivers.length; i++) {
-        let normalizedAddress = PhoneNumberUtils.normalize(receivers[i], false);
-        if (DEBUG) debug("createSavableFromParams: normalize phone number " +
-                         "from " + receivers[i] + " to " + normalizedAddress);
-
-        headersTo.push({"address": normalizedAddress, "type": "PLMN"});
-
-        // Check if the address is valid to send MMS.
-        if (!PhoneNumberUtils.isPlainPhoneNumber(normalizedAddress)) {
-          if (DEBUG) debug("Error! Address is invalid to send MMS: " +
-                           normalizedAddress);
+        let receiver = receivers[i];
+        let type = MMS.Address.resolveType(receiver);
+        let address;
+        if (type == "PLMN") {
+          address = PhoneNumberUtils.normalize(receiver, false);
+          if (!PhoneNumberUtils.isPlainPhoneNumber(address)) {
+            isAddrValid = false;
+          }
+          if (DEBUG) debug("createSavableFromParams: normalize phone number " +
+                           "from " + receiver + " to " + address);
+        } else {
+          address = receiver;
           isAddrValid = false;
+          if (DEBUG) debug("Error! Address is invalid to send MMS: " + address);
         }
+        headersTo.push({"address": address, "type": type});
       }
     }
     if (aParams.subject) {
       headers["subject"] = aParams.subject;
     }
 
     // |aMessage.parts|
     let attachments = aParams.attachments;
--- a/dom/mobilemessage/src/gonk/SmsService.cpp
+++ b/dom/mobilemessage/src/gonk/SmsService.cpp
@@ -26,22 +26,22 @@ SmsService::SmsService()
 NS_IMETHODIMP
 SmsService::HasSupport(bool* aHasSupport)
 {
   *aHasSupport = true;
   return NS_OK;
 }
 
 NS_IMETHODIMP
-SmsService::GetSegmentInfoForText(const nsAString & aText,
-                                  nsIDOMMozSmsSegmentInfo** aResult)
+SmsService::GetSegmentInfoForText(const nsAString& aText,
+                                  nsIMobileMessageCallback* aRequest)
 {
   NS_ENSURE_TRUE(mRadioInterface, NS_ERROR_FAILURE);
 
-  return mRadioInterface->GetSegmentInfoForText(aText, aResult);
+  return mRadioInterface->GetSegmentInfoForText(aText, aRequest);
 }
 
 NS_IMETHODIMP
 SmsService::Send(const nsAString& aNumber,
                  const nsAString& aMessage,
                  const bool       aSilent,
                  nsIMobileMessageCallback* aRequest)
 {
--- a/dom/mobilemessage/src/ipc/PSms.ipdl
+++ b/dom/mobilemessage/src/ipc/PSms.ipdl
@@ -57,27 +57,33 @@ struct CreateMessageCursorRequest
 };
 
 struct MarkMessageReadRequest
 {
   int32_t messageId;
   bool value;
 };
 
+struct GetSegmentInfoForTextRequest
+{
+  nsString text;
+};
+
 struct CreateThreadCursorRequest
 {
 };
 
 union IPCSmsRequest
 {
   SendMessageRequest;
   RetrieveMessageRequest;
   GetMessageRequest;
   DeleteMessageRequest;
   MarkMessageReadRequest;
+  GetSegmentInfoForTextRequest;
 };
 
 union IPCMobileMessageCursor
 {
   CreateMessageCursorRequest;
   CreateThreadCursorRequest;
 };
 
@@ -117,18 +123,15 @@ parent:
   /**
    * Sent when the child makes an asynchronous cursor to the parent.
    */
   PMobileMessageCursor(IPCMobileMessageCursor request);
 
   sync HasSupport()
       returns (bool aHasSupport);
 
-  sync GetSegmentInfoForText(nsString aText)
-      returns (SmsSegmentInfoData aResult);
-
   AddSilentNumber(nsString aNumber);
   RemoveSilentNumber(nsString aNumber);
 };
 
 } // namespace mobilemessage
 } // namespace dom
 } // namespace mozilla
--- a/dom/mobilemessage/src/ipc/PSmsRequest.ipdl
+++ b/dom/mobilemessage/src/ipc/PSmsRequest.ipdl
@@ -61,23 +61,35 @@ struct ReplyMarkeMessageRead
   bool read;
 };
 
 struct ReplyMarkeMessageReadFail
 {
   int32_t error;
 };
 
+struct ReplyGetSegmentInfoForText
+{
+  SmsSegmentInfoData infoData;
+};
+
+struct ReplyGetSegmentInfoForTextFail
+{
+  int32_t error;
+};
+
 union MessageReply
 {
   ReplyMessageSend;
   ReplyMessageSendFail;
   ReplyGetMessage;
   ReplyGetMessageFail;
   ReplyMessageDelete;
   ReplyMessageDeleteFail;
   ReplyMarkeMessageRead;
   ReplyMarkeMessageReadFail;
+  ReplyGetSegmentInfoForText;
+  ReplyGetSegmentInfoForTextFail;
 };
 
 } // namespace mobilemessage
 } // namespace dom
 } // namespace mozilla
--- a/dom/mobilemessage/src/ipc/SmsChild.cpp
+++ b/dom/mobilemessage/src/ipc/SmsChild.cpp
@@ -1,15 +1,16 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this file,
  * You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "SmsChild.h"
 #include "SmsMessage.h"
 #include "MmsMessage.h"
+#include "SmsSegmentInfo.h"
 #include "Constants.h"
 #include "nsIObserverService.h"
 #include "mozilla/Services.h"
 #include "mozilla/dom/ContentChild.h"
 #include "MobileMessageThread.h"
 
 using namespace mozilla;
 using namespace mozilla::dom;
@@ -17,17 +18,17 @@ using namespace mozilla::dom::mobilemess
 
 namespace {
 
 already_AddRefed<nsISupports>
 CreateMessageFromMessageData(const MobileMessageData& aData)
 {
   nsCOMPtr<nsISupports> message;
 
-  switch(aData. type()) {
+  switch(aData.type()) {
     case MobileMessageData::TMmsMessageData:
       message = new MmsMessage(aData.get_MmsMessageData());
       break;
     case MobileMessageData::TSmsMessageData:
       message = new SmsMessage(aData.get_SmsMessageData());
       break;
     default:
       MOZ_CRASH("Unexpected type of MobileMessageData");
@@ -198,16 +199,27 @@ SmsRequestChild::Recv__delete__(const Me
       mReplyRequest->NotifyDeleteMessageFailed(aReply.get_ReplyMessageDeleteFail().error());
       break;
     case MessageReply::TReplyMarkeMessageRead:
       mReplyRequest->NotifyMessageMarkedRead(aReply.get_ReplyMarkeMessageRead().read());
       break;
     case MessageReply::TReplyMarkeMessageReadFail:
       mReplyRequest->NotifyMarkMessageReadFailed(aReply.get_ReplyMarkeMessageReadFail().error());
       break;
+    case MessageReply::TReplyGetSegmentInfoForText: {
+        const SmsSegmentInfoData& data =
+          aReply.get_ReplyGetSegmentInfoForText().infoData();
+        nsCOMPtr<nsIDOMMozSmsSegmentInfo> info = new SmsSegmentInfo(data);
+        mReplyRequest->NotifySegmentInfoForTextGot(info);
+      }
+      break;
+    case MessageReply::TReplyGetSegmentInfoForTextFail:
+      mReplyRequest->NotifyGetSegmentInfoForTextFailed(
+        aReply.get_ReplyGetSegmentInfoForTextFail().error());
+      break;
     default:
       MOZ_CRASH("Received invalid response parameters!");
   }
 
   return true;
 }
 
 /*******************************************************************************
--- a/dom/mobilemessage/src/ipc/SmsIPCService.cpp
+++ b/dom/mobilemessage/src/ipc/SmsIPCService.cpp
@@ -91,29 +91,21 @@ SmsIPCService::HasSupport(bool* aHasSupp
   NS_ENSURE_TRUE(smsChild, NS_ERROR_FAILURE);
 
   smsChild->SendHasSupport(aHasSupport);
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
-SmsIPCService::GetSegmentInfoForText(const nsAString & aText,
-                                     nsIDOMMozSmsSegmentInfo** aResult)
+SmsIPCService::GetSegmentInfoForText(const nsAString& aText,
+                                     nsIMobileMessageCallback* aRequest)
 {
-  PSmsChild* smsChild = GetSmsChild();
-  NS_ENSURE_TRUE(smsChild, NS_ERROR_FAILURE);
-
-  SmsSegmentInfoData data;
-  bool ok = smsChild->SendGetSegmentInfoForText(nsString(aText), &data);
-  NS_ENSURE_TRUE(ok, NS_ERROR_FAILURE);
-
-  nsCOMPtr<nsIDOMMozSmsSegmentInfo> info = new SmsSegmentInfo(data);
-  info.forget(aResult);
-  return NS_OK;
+  return SendRequest(GetSegmentInfoForTextRequest(nsString(aText)),
+                                                  aRequest);
 }
 
 NS_IMETHODIMP
 SmsIPCService::Send(const nsAString& aNumber,
                     const nsAString& aMessage,
                     const bool aSilent,
                     nsIMobileMessageCallback* aRequest)
 {
--- a/dom/mobilemessage/src/ipc/SmsParent.cpp
+++ b/dom/mobilemessage/src/ipc/SmsParent.cpp
@@ -307,45 +307,16 @@ SmsParent::RecvHasSupport(bool* aHasSupp
   nsCOMPtr<nsISmsService> smsService = do_GetService(SMS_SERVICE_CONTRACTID);
   NS_ENSURE_TRUE(smsService, true);
 
   smsService->HasSupport(aHasSupport);
   return true;
 }
 
 bool
-SmsParent::RecvGetSegmentInfoForText(const nsString& aText,
-                                     SmsSegmentInfoData* aResult)
-{
-  aResult->segments() = 0;
-  aResult->charsPerSegment() = 0;
-  aResult->charsAvailableInLastSegment() = 0;
-
-  nsCOMPtr<nsISmsService> smsService = do_GetService(SMS_SERVICE_CONTRACTID);
-  NS_ENSURE_TRUE(smsService, true);
-
-  nsCOMPtr<nsIDOMMozSmsSegmentInfo> info;
-  nsresult rv = smsService->GetSegmentInfoForText(aText, getter_AddRefs(info));
-  NS_ENSURE_SUCCESS(rv, true);
-
-  int segments, charsPerSegment, charsAvailableInLastSegment;
-  if (NS_FAILED(info->GetSegments(&segments)) ||
-      NS_FAILED(info->GetCharsPerSegment(&charsPerSegment)) ||
-      NS_FAILED(info->GetCharsAvailableInLastSegment(&charsAvailableInLastSegment))) {
-    NS_ERROR("Can't get attribute values from nsIDOMMozSmsSegmentInfo");
-    return true;
-  }
-
-  aResult->segments() = segments;
-  aResult->charsPerSegment() = charsPerSegment;
-  aResult->charsAvailableInLastSegment() = charsAvailableInLastSegment;
-  return true;
-}
-
-bool
 SmsParent::RecvAddSilentNumber(const nsString& aNumber)
 {
   if (mSilentNumbers.Contains(aNumber)) {
     return true;
   }
 
   nsCOMPtr<nsISmsService> smsService = do_GetService(SMS_SERVICE_CONTRACTID);
   NS_ENSURE_TRUE(smsService, true);
@@ -388,16 +359,18 @@ SmsParent::RecvPSmsRequestConstructor(PS
     case IPCSmsRequest::TRetrieveMessageRequest:
       return actor->DoRequest(aRequest.get_RetrieveMessageRequest());
     case IPCSmsRequest::TGetMessageRequest:
       return actor->DoRequest(aRequest.get_GetMessageRequest());
     case IPCSmsRequest::TDeleteMessageRequest:
       return actor->DoRequest(aRequest.get_DeleteMessageRequest());
     case IPCSmsRequest::TMarkMessageReadRequest:
       return actor->DoRequest(aRequest.get_MarkMessageReadRequest());
+    case IPCSmsRequest::TGetSegmentInfoForTextRequest:
+      return actor->DoRequest(aRequest.get_GetSegmentInfoForTextRequest());
     default:
       MOZ_CRASH("Unknown type!");
   }
 
   return false;
 }
 
 PSmsRequestParent*
@@ -572,16 +545,34 @@ SmsRequestParent::DoRequest(const MarkMe
 
   if (NS_FAILED(rv)) {
     return NS_SUCCEEDED(NotifyMarkMessageReadFailed(nsIMobileMessageCallback::INTERNAL_ERROR));
   }
 
   return true;
 }
 
+bool
+SmsRequestParent::DoRequest(const GetSegmentInfoForTextRequest& aRequest)
+{
+  nsresult rv = NS_ERROR_FAILURE;
+
+  nsCOMPtr<nsISmsService> smsService = do_GetService(SMS_SERVICE_CONTRACTID);
+  if (smsService) {
+    rv = smsService->GetSegmentInfoForText(aRequest.text(), this);
+  }
+
+  if (NS_FAILED(rv)) {
+    return NS_SUCCEEDED(NotifyGetSegmentInfoForTextFailed(
+                          nsIMobileMessageCallback::INTERNAL_ERROR));
+  }
+
+  return true;
+}
+
 nsresult
 SmsRequestParent::SendReply(const MessageReply& aReply)
 {
   // The child process could die before this asynchronous notification, in which
   // case ActorDestroy() was called and mActorDestroyed is set to true. Return
   // an error here to avoid sending a message to the dead process.
   NS_ENSURE_TRUE(!mActorDestroyed, NS_ERROR_FAILURE);
 
@@ -669,16 +660,29 @@ SmsRequestParent::NotifyMessageMarkedRea
 }
 
 NS_IMETHODIMP
 SmsRequestParent::NotifyMarkMessageReadFailed(int32_t aError)
 {
   return SendReply(ReplyMarkeMessageReadFail(aError));
 }
 
+NS_IMETHODIMP
+SmsRequestParent::NotifySegmentInfoForTextGot(nsIDOMMozSmsSegmentInfo *aInfo)
+{
+  SmsSegmentInfo* info = static_cast<SmsSegmentInfo*>(aInfo);
+  return SendReply(ReplyGetSegmentInfoForText(info->GetData()));
+}
+
+NS_IMETHODIMP
+SmsRequestParent::NotifyGetSegmentInfoForTextFailed(int32_t aError)
+{
+  return SendReply(ReplyGetSegmentInfoForTextFail(aError));
+}
+
 /*******************************************************************************
  * MobileMessageCursorParent
  ******************************************************************************/
 
 NS_IMPL_ISUPPORTS1(MobileMessageCursorParent, nsIMobileMessageCursorCallback)
 
 void
 MobileMessageCursorParent::ActorDestroy(ActorDestroyReason aWhy)
--- a/dom/mobilemessage/src/ipc/SmsParent.h
+++ b/dom/mobilemessage/src/ipc/SmsParent.h
@@ -30,19 +30,16 @@ public:
   NS_DECL_ISUPPORTS
   NS_DECL_NSIOBSERVER
 
 protected:
   virtual bool
   RecvHasSupport(bool* aHasSupport) MOZ_OVERRIDE;
 
   virtual bool
-  RecvGetSegmentInfoForText(const nsString& aText, SmsSegmentInfoData* aResult) MOZ_OVERRIDE;
-
-  virtual bool
   RecvAddSilentNumber(const nsString& aNumber) MOZ_OVERRIDE;
 
   virtual bool
   RecvRemoveSilentNumber(const nsString& aNumber) MOZ_OVERRIDE;
 
   SmsParent();
   virtual ~SmsParent()
   {
@@ -115,16 +112,19 @@ protected:
   DoRequest(const GetMessageRequest& aRequest);
 
   bool
   DoRequest(const DeleteMessageRequest& aRequest);
 
   bool
   DoRequest(const MarkMessageReadRequest& aRequest);
 
+  bool
+  DoRequest(const GetSegmentInfoForTextRequest& aRequest);
+
   nsresult
   SendReply(const MessageReply& aReply);
 };
 
 class MobileMessageCursorParent : public PMobileMessageCursorParent
                                 , public nsIMobileMessageCursorCallback
 {
   friend class SmsParent;
--- a/dom/mobilemessage/tests/marionette/test_getsegmentinfofortext.js
+++ b/dom/mobilemessage/tests/marionette/test_getsegmentinfofortext.js
@@ -44,33 +44,51 @@ let tasks = {
   run: function run() {
     this.next();
   }
 };
 
 function addTest(text, segments, charsPerSegment, charsAvailableInLastSegment) {
   tasks.push(function () {
     log("Testing '" + text + "' ...");
-    let info = manager.getSegmentInfoForText(text);
-    is(info.segments, segments, "info.segments");
-    is(info.charsPerSegment, charsPerSegment, "info.charsPerSegment");
-    is(info.charsAvailableInLastSegment, charsAvailableInLastSegment,
-       "info.charsAvailableInLastSegment");
+    let domRequest = manager.getSegmentInfoForText(text);
+    ok(domRequest, "DOMRequest object returned.");
+
+    domRequest.onsuccess = function(e) {
+      log("Received 'onsuccess' DOMRequest event.");
+
+      let result = e.target.result;
+      if (!result) {
+        ok(false, "getSegmentInfoForText() result is not valid.");
+        tasks.finish();
+        return;
+      }
 
-    tasks.next();
+      is(result.segments, segments, "info.segments");
+      is(result.charsPerSegment, charsPerSegment, "info.charsPerSegment");
+      is(result.charsAvailableInLastSegment, charsAvailableInLastSegment,
+         "info.charsAvailableInLastSegment");
+
+      tasks.next();
+    };
+
+    domRequest.onerror = function(e) {
+      ok(false, "Failed to call getSegmentInfoForText().");
+      tasks.finish();
+    };
   });
 }
 
 function addTestThrows(text) {
   tasks.push(function () {
     log("Testing '" + text + "' ...");
     try {
-      let info = manager.getSegmentInfoForText(text);
+      let domRequest = manager.getSegmentInfoForText(text);
 
-      ok(false, "Not thrown");
+      ok(false, "Not thrown.");
       tasks.finish();
     } catch (e) {
       tasks.next();
     }
   });
 }
 
 addTestThrows(null);
--- a/dom/mobilemessage/tests/marionette/test_segment_info.js
+++ b/dom/mobilemessage/tests/marionette/test_segment_info.js
@@ -7,123 +7,182 @@ const LEN_7BIT = 160;
 const LEN_7BIT_WITH_8BIT_REF = 153;
 const LEN_7BIT_WITH_16BIT_REF = 152;
 const LEN_UCS2 = 70;
 const LEN_UCS2_WITH_8BIT_REF = 67;
 const LEN_UCS2_WITH_16BIT_REF = 66;
 
 SpecialPowers.setBoolPref("dom.sms.enabled", true);
 let currentStrict7BitEncoding = false;
-SpecialPowers.setBoolPref("dom.sms.strict7BitEncoding", currentStrict7BitEncoding);
+SpecialPowers.setBoolPref("dom.sms.strict7BitEncoding",
+                          currentStrict7BitEncoding);
 SpecialPowers.addPermission("sms", true, document);
 
 let manager = window.navigator.mozMobileMessage;
 ok(manager instanceof MozMobileMessageManager,
    "manager is instance of " + manager.constructor);
 
 function times(str, n) {
   return (new Array(n + 1)).join(str);
 }
 
-function doTest(text, strict7BitEncoding, expected) {
-  if (strict7BitEncoding != currentStrict7BitEncoding) {
-    currentStrict7BitEncoding = strict7BitEncoding;
-    SpecialPowers.setBoolPref("dom.sms.strict7BitEncoding", currentStrict7BitEncoding);
+let tasks = {
+  // List of test fuctions. Each of them should call |tasks.next()| when
+  // completed or |tasks.finish()| to jump to the last one.
+  _tasks: [],
+  _nextTaskIndex: 0,
+
+  push: function push(func) {
+    this._tasks.push(func);
+  },
+
+  next: function next() {
+    let index = this._nextTaskIndex++;
+    let task = this._tasks[index];
+    try {
+      task();
+    } catch (ex) {
+      ok(false, "test task[" + index + "] throws: " + ex);
+      // Run last task as clean up if possible.
+      if (index != this._tasks.length - 1) {
+        this.finish();
+      }
+    }
+  },
+
+  finish: function finish() {
+    this._tasks[this._tasks.length - 1]();
+  },
+
+  run: function run() {
+    this.next();
   }
+};
 
-  let result = manager.getSegmentInfoForText(text);
-  ok(result, "result of GetSegmentInfoForText is valid");
-  is(result.segments, expected[0], "segments");
-  is(result.charsPerSegment, expected[1], "charsPerSegment");
-  is(result.charsAvailableInLastSegment, expected[2], "charsAvailableInLastSegment");
-}
+function addTest(text, strict7BitEncoding, expected) {
+  tasks.push(function () {
+    if (strict7BitEncoding != currentStrict7BitEncoding) {
+      currentStrict7BitEncoding = strict7BitEncoding;
+      SpecialPowers.setBoolPref("dom.sms.strict7BitEncoding",
+                                currentStrict7BitEncoding);
+    }
+
+    let domRequest = manager.getSegmentInfoForText(text);
+    ok(domRequest, "DOMRequest object returned.");
+
+    domRequest.onsuccess = function(e) {
+      log("Received 'onsuccess' DOMRequest event.");
 
-function cleanUp() {
-  SpecialPowers.removePermission("sms", document);
-  SpecialPowers.clearUserPref("dom.sms.enabled");
-  SpecialPowers.clearUserPref("dom.sms.strict7BitEncoding");
-  finish();
+      let result = e.target.result;
+      if (!result) {
+        ok(false, "getSegmentInfoForText() result is not valid.");
+        tasks.finish();
+        return;
+      }
+
+      is(result.segments, expected[0], "segments");
+      is(result.charsPerSegment, expected[1], "charsPerSegment");
+      is(result.charsAvailableInLastSegment, expected[2],
+         "charsAvailableInLastSegment");
+
+      tasks.next();
+    };
+
+    domRequest.onerror = function(e) {
+      ok(false, "Failed to call getSegmentInfoForText().");
+      tasks.finish();
+    };
+  });
 }
 
 // GSM 7Bit Alphabets:
 //
 // 'a' is in GSM default locking shift table, so it takes 1 septet.
-doTest("a", false, [1, LEN_7BIT, LEN_7BIT - 1]);
+addTest("a", false, [1, LEN_7BIT, LEN_7BIT - 1]);
 // '\u20ac' is in GSM default single shift table, so it takes 2 septets.
-doTest("\u20ac", false, [1, LEN_7BIT, LEN_7BIT - 2]);
+addTest("\u20ac", false, [1, LEN_7BIT, LEN_7BIT - 2]);
 // SP is defined in both locking shift and single shift tables.
-doTest(" ", false, [1, LEN_7BIT, LEN_7BIT - 1]);
+addTest(" ", false, [1, LEN_7BIT, LEN_7BIT - 1]);
 // Some combinations.
-doTest("a\u20ac", false, [1, LEN_7BIT, LEN_7BIT - 3]);
-doTest("a ", false, [1, LEN_7BIT, LEN_7BIT - 2]);
-doTest("\u20aca", false, [1, LEN_7BIT, LEN_7BIT - 3]);
-doTest("\u20ac ", false, [1, LEN_7BIT, LEN_7BIT - 3]);
-doTest(" \u20ac", false, [1, LEN_7BIT, LEN_7BIT - 3]);
-doTest(" a", false, [1, LEN_7BIT, LEN_7BIT - 2]);
+addTest("a\u20ac", false, [1, LEN_7BIT, LEN_7BIT - 3]);
+addTest("a ", false, [1, LEN_7BIT, LEN_7BIT - 2]);
+addTest("\u20aca", false, [1, LEN_7BIT, LEN_7BIT - 3]);
+addTest("\u20ac ", false, [1, LEN_7BIT, LEN_7BIT - 3]);
+addTest(" \u20ac", false, [1, LEN_7BIT, LEN_7BIT - 3]);
+addTest(" a", false, [1, LEN_7BIT, LEN_7BIT - 2]);
 
 // GSM 7Bit Alphabets (multipart):
 //
 // Exactly 160 locking shift table chararacters.
-doTest(times("a", LEN_7BIT), false, [1, LEN_7BIT, 0]);
+addTest(times("a", LEN_7BIT), false, [1, LEN_7BIT, 0]);
 // 161 locking shift table chararacters. We'll have |161 - 153 = 8| septets in
 // the 2nd segment.
-doTest(times("a", LEN_7BIT + 1), false,
-       [2, LEN_7BIT_WITH_8BIT_REF, LEN_7BIT_WITH_8BIT_REF - 8]);
+addTest(times("a", LEN_7BIT + 1), false,
+        [2, LEN_7BIT_WITH_8BIT_REF, LEN_7BIT_WITH_8BIT_REF - 8]);
 // |LEN_7BIT_WITH_8BIT_REF * 2| locking shift table chararacters.
-doTest(times("a", LEN_7BIT_WITH_8BIT_REF * 2), false,
-       [2, LEN_7BIT_WITH_8BIT_REF, 0]);
+addTest(times("a", LEN_7BIT_WITH_8BIT_REF * 2), false,
+        [2, LEN_7BIT_WITH_8BIT_REF, 0]);
 // |LEN_7BIT_WITH_8BIT_REF * 2 + 1| locking shift table chararacters.
-doTest(times("a", LEN_7BIT_WITH_8BIT_REF * 2 + 1), false,
-       [3, LEN_7BIT_WITH_8BIT_REF, LEN_7BIT_WITH_8BIT_REF - 1]);
+addTest(times("a", LEN_7BIT_WITH_8BIT_REF * 2 + 1), false,
+        [3, LEN_7BIT_WITH_8BIT_REF, LEN_7BIT_WITH_8BIT_REF - 1]);
 // Exactly 80 single shift table chararacters.
-doTest(times("\u20ac", LEN_7BIT / 2), false, [1, LEN_7BIT, 0]);
+addTest(times("\u20ac", LEN_7BIT / 2), false, [1, LEN_7BIT, 0]);
 // 81 single shift table chararacters. Because |Math.floor(153 / 2) = 76|, it
 // should left 5 septets in the 2nd segment.
-doTest(times("\u20ac", LEN_7BIT / 2 + 1), false,
-       [2, LEN_7BIT_WITH_8BIT_REF, LEN_7BIT_WITH_8BIT_REF - 10]);
+addTest(times("\u20ac", LEN_7BIT / 2 + 1), false,
+        [2, LEN_7BIT_WITH_8BIT_REF, LEN_7BIT_WITH_8BIT_REF - 10]);
 // |1 + 2 * 76| single shift table chararacters. We have only |153 - 76 * 2 = 1|
 // space left, but each single shift table character takes 2, so it will be
 // filled in the 3rd segment.
-doTest(times("\u20ac", 1 + 2 * Math.floor(LEN_7BIT_WITH_8BIT_REF / 2)), false,
-       [3, LEN_7BIT_WITH_8BIT_REF, LEN_7BIT_WITH_8BIT_REF - 2]);
+addTest(times("\u20ac", 1 + 2 * Math.floor(LEN_7BIT_WITH_8BIT_REF / 2)), false,
+        [3, LEN_7BIT_WITH_8BIT_REF, LEN_7BIT_WITH_8BIT_REF - 2]);
 // |2 * 76| single shift table chararacters + 1 locking shift table chararacter.
-doTest("a" + times("\u20ac", 2 * Math.floor(LEN_7BIT_WITH_8BIT_REF / 2)), false,
-       [2, LEN_7BIT_WITH_8BIT_REF, 1]);
-doTest(times("\u20ac", 2 * Math.floor(LEN_7BIT_WITH_8BIT_REF / 2)) + "a", false,
-       [2, LEN_7BIT_WITH_8BIT_REF, 0]);
+addTest("a" + times("\u20ac", 2 * Math.floor(LEN_7BIT_WITH_8BIT_REF / 2)), false,
+        [2, LEN_7BIT_WITH_8BIT_REF, 1]);
+addTest(times("\u20ac", 2 * Math.floor(LEN_7BIT_WITH_8BIT_REF / 2)) + "a", false,
+        [2, LEN_7BIT_WITH_8BIT_REF, 0]);
 
 // UCS2:
 //
 // '\u6afb' should be encoded as UCS2.
-doTest("\u6afb", false, [1, LEN_UCS2, LEN_UCS2 - 1]);
+addTest("\u6afb", false, [1, LEN_UCS2, LEN_UCS2 - 1]);
 // Combination of GSM 7bit alphabets.
-doTest("\u6afba", false, [1, LEN_UCS2, LEN_UCS2 - 2]);
-doTest("\u6afb\u20ac", false, [1, LEN_UCS2, LEN_UCS2 - 2]);
-doTest("\u6afb ", false, [1, LEN_UCS2, LEN_UCS2 - 2]);
+addTest("\u6afba", false, [1, LEN_UCS2, LEN_UCS2 - 2]);
+addTest("\u6afb\u20ac", false, [1, LEN_UCS2, LEN_UCS2 - 2]);
+addTest("\u6afb ", false, [1, LEN_UCS2, LEN_UCS2 - 2]);
 
 // UCS2 (multipart):
 //
 // Exactly 70 UCS2 chararacters.
-doTest(times("\u6afb", LEN_UCS2), false, [1, LEN_UCS2, 0]);
+addTest(times("\u6afb", LEN_UCS2), false, [1, LEN_UCS2, 0]);
 // 71 UCS2 chararacters. We'll have |71 - 67 = 4| chararacters in the 2nd
 // segment.
-doTest(times("\u6afb", LEN_UCS2 + 1), false,
-       [2, LEN_UCS2_WITH_8BIT_REF, LEN_UCS2_WITH_8BIT_REF - 4]);
+addTest(times("\u6afb", LEN_UCS2 + 1), false,
+        [2, LEN_UCS2_WITH_8BIT_REF, LEN_UCS2_WITH_8BIT_REF - 4]);
 // |LEN_UCS2_WITH_8BIT_REF * 2| ucs2 chararacters.
-doTest(times("\u6afb", LEN_UCS2_WITH_8BIT_REF * 2), false,
-       [2, LEN_UCS2_WITH_8BIT_REF, 0]);
+addTest(times("\u6afb", LEN_UCS2_WITH_8BIT_REF * 2), false,
+        [2, LEN_UCS2_WITH_8BIT_REF, 0]);
 // |LEN_7BIT_WITH_8BIT_REF * 2 + 1| ucs2 chararacters.
-doTest(times("\u6afb", LEN_UCS2_WITH_8BIT_REF * 2 + 1), false,
-       [3, LEN_UCS2_WITH_8BIT_REF, LEN_UCS2_WITH_8BIT_REF - 1]);
+addTest(times("\u6afb", LEN_UCS2_WITH_8BIT_REF * 2 + 1), false,
+        [3, LEN_UCS2_WITH_8BIT_REF, LEN_UCS2_WITH_8BIT_REF - 1]);
 
 // Strict 7-Bit Encoding:
 //
 // Should have no effect on GSM default alphabet characters.
-doTest("\u0041", true, [1, LEN_7BIT, LEN_7BIT - 1]);
+addTest("\u0041", true, [1, LEN_7BIT, LEN_7BIT - 1]);
 // "\u00c0"(À) should be mapped to "\u0041"(A).
-doTest("\u00c0", true, [1, LEN_7BIT, LEN_7BIT - 1]);
+addTest("\u00c0", true, [1, LEN_7BIT, LEN_7BIT - 1]);
 // Mixing mapped characters with unmapped ones.
-doTest("\u00c0\u0041", true, [1, LEN_7BIT, LEN_7BIT - 2]);
-doTest("\u0041\u00c0", true, [1, LEN_7BIT, LEN_7BIT - 2]);
+addTest("\u00c0\u0041", true, [1, LEN_7BIT, LEN_7BIT - 2]);
+addTest("\u0041\u00c0", true, [1, LEN_7BIT, LEN_7BIT - 2]);
 // UCS2 characters should be mapped to '*'.
-doTest("\u1234", true, [1, LEN_7BIT, LEN_7BIT - 1]);
+addTest("\u1234", true, [1, LEN_7BIT, LEN_7BIT - 1]);
+
 
-cleanUp();
+// WARNING: All tasks should be pushed before this!!!
+tasks.push(function cleanUp() {
+  SpecialPowers.removePermission("sms", document);
+  SpecialPowers.clearUserPref("dom.sms.enabled");
+  SpecialPowers.clearUserPref("dom.sms.strict7BitEncoding");
+  finish();
+});
+
+tasks.run();
--- a/dom/network/interfaces/nsIDOMMobileConnection.idl
+++ b/dom/network/interfaces/nsIDOMMobileConnection.idl
@@ -204,49 +204,49 @@ interface nsIDOMMozMobileConnection : ns
    *
    * @param CFInfo
    *        An object containing the call forward rule to set.
    *
    * If successful, the request's onsuccess will be called.
    *
    * Otherwise, the request's onerror will be called, and the request's error
    * will be either 'RadioNotAvailable', 'RequestNotSupported',
-   * 'IllegalSIMorME', or 'GenericFailure'
+   * 'IllegalSIMorME', 'InvalidParameter', or 'GenericFailure'
    */
   nsIDOMDOMRequest setCallForwardingOption(in nsIDOMMozMobileCFInfo CFInfo);
 
   /**
    * Queries current call forward options.
    *
    * @param reason
    *        Indicates the reason the call is being forwarded. It will be either
    *        unconditional (0), mobile busy (1), no reply (2), not reachable (3),
    *        all call forwarding (4), or all conditional call forwarding (5).
    *
    * If successful, the request's onsuccess will be called, and the request's
    * result will be an array of nsIDOMMozMobileCFInfo.
    *
    * Otherwise, the request's onerror will be called, and the request's error
    * will be either 'RadioNotAvailable', 'RequestNotSupported',
-   * or 'GenericFailure'.
+   * 'InvalidParameter', or 'GenericFailure'.
    */
   nsIDOMDOMRequest getCallForwardingOption(in unsigned short reason);
 
   /**
    * Configures call barring option.
    *
    * @param option
    *        An object containing the call barring rule to set.
    * @see MozCallBarringOption for the detail of info.
    *
    * If successful, the request's onsuccess will be called.
    *
    * Otherwise, the request's onerror will be called, and the request's error
    * will be either 'RadioNotAvailable', 'RequestNotSupported',
-   * 'IllegalSIMorME', 'InvalidCallBarringOption' or 'GenericFailure'
+   * 'IllegalSIMorME', 'InvalidParameter', or 'GenericFailure'
    */
   nsIDOMDOMRequest setCallBarringOption(in jsval option);
 
   /**
    * Queries current call barring status.
    *
    * @param info
    *        An object containing the call barring rule to query. No need to
@@ -254,17 +254,17 @@ interface nsIDOMMozMobileConnection : ns
    * @see MozCallBarringOption for the detail of info.
    *
    * If successful, the request's onsuccess will be called, and the request's
    * result will be an object of MozCallBarringOption with correct 'enabled'
    * property indicating the status of this rule.
    *
    * Otherwise, the request's onerror will be called, and the request's error
    * will be either 'RadioNotAvailable', 'RequestNotSupported',
-   * 'InvalidCallBarringOption' or 'GenericFailure'.
+   * 'InvalidParameter', or 'GenericFailure'.
    */
   nsIDOMDOMRequest getCallBarringOption(in jsval option);
 
   /**
    * Change call barring facility password.
    *
    * @param info
    *        An object containing information about pin and newPin, and,
--- a/dom/network/tests/marionette/test_call_barring_set_error.js
+++ b/dom/network/tests/marionette/test_call_barring_set_error.js
@@ -48,17 +48,17 @@ function buildOption(program, enabled, p
 function testSetCallBarringOptionError(option) {
   let request = connection.setCallBarringOption(option);
   request.onsuccess = function() {
     ok(false,
        'should not fire onsuccess for invaild call barring option: '
        + JSON.stringify(option));
   };
   request.onerror = function(event) {
-    is(event.target.error.name, 'InvalidCallBarringOption', JSON.stringify(option));
+    is(event.target.error.name, 'InvalidParameter', JSON.stringify(option));
     nextTest();
   };
 }
 
 function nextTest() {
   if (caseId >= options.length) {
     cleanUp();
   } else {
--- a/dom/phonenumberutils/PhoneNumberUtils.jsm
+++ b/dom/phonenumberutils/PhoneNumberUtils.jsm
@@ -43,17 +43,17 @@ this.PhoneNumberUtils = {
     // Get network mcc
     let voice = mobileConnection.voiceConnectionInfo;
     if (voice && voice.network && voice.network.mcc) {
       mcc = voice.network.mcc;
     }
 
     // Get SIM mcc
     let iccInfo = mobileConnection.iccInfo;
-    if (!mcc && iccInfo.mcc) {
+    if (!mcc && iccInfo && iccInfo.mcc) {
       mcc = iccInfo.mcc;
     }
 
     // Attempt to grab last known sim mcc from prefs
     if (!mcc) {
       try {
         mcc = Services.prefs.getCharPref("ril.lastKnownSimMcc");
       } catch (e) {}
--- a/dom/system/gonk/GonkGPSGeolocationProvider.cpp
+++ b/dom/system/gonk/GonkGPSGeolocationProvider.cpp
@@ -421,18 +421,21 @@ GonkGPSGeolocationProvider::RequestSetID
       type = AGPS_SETID_TYPE_IMSI;
       rilCtx->GetImsi(id);
     }
 
     if (flags & AGPS_RIL_REQUEST_SETID_MSISDN) {
       nsCOMPtr<nsIDOMMozIccInfo> iccInfo;
       rilCtx->GetIccInfo(getter_AddRefs(iccInfo));
       if (iccInfo) {
-        type = AGPS_SETID_TYPE_MSISDN;
-        iccInfo->GetMsisdn(id);
+        nsCOMPtr<nsIDOMMozGsmIccInfo> gsmIccInfo = do_QueryInterface(iccInfo);
+        if (gsmIccInfo) {
+          type = AGPS_SETID_TYPE_MSISDN;
+          gsmIccInfo->GetMsisdn(id);
+        }
       }
     }
 
     NS_ConvertUTF16toUTF8 idBytes(id);
     mAGpsRilInterface->set_set_id(type, idBytes.get());
   }
 }
 
--- a/dom/system/gonk/RILContentHelper.js
+++ b/dom/system/gonk/RILContentHelper.js
@@ -40,18 +40,20 @@ if (DEBUG) {
     dump("-*- RILContentHelper: " + s + "\n");
   };
 } else {
   debug = function (s) {};
 }
 
 const RILCONTENTHELPER_CID =
   Components.ID("{472816e1-1fd6-4405-996c-806f9ea68174}");
-const ICCINFO_CID =
-  Components.ID("{fab2c0f0-d73a-11e2-8b8b-0800200c9a66}");
+const GSMICCINFO_CID =
+  Components.ID("{e0fa785b-ad3f-46ed-bc56-fcb0d6fe4fa8}");
+const CDMAICCINFO_CID =
+  Components.ID("{3d1f844f-9ec5-48fb-8907-aed2e5421709}");
 const MOBILECONNECTIONINFO_CID =
   Components.ID("{a35cfd39-2d93-4489-ac7d-396475dacb27}");
 const MOBILENETWORKINFO_CID =
   Components.ID("{a6c8416c-09b4-46d1-bf29-6520d677d085}");
 const MOBILECELLINFO_CID =
   Components.ID("{ae724dd4-ccaf-4006-98f1-6ce66a092464}");
 const VOICEMAILSTATUS_CID=
   Components.ID("{5467f2eb-e214-43ea-9b89-67711241ec8e}");
@@ -143,34 +145,60 @@ function MobileIccCardLockRetryCount(opt
 MobileIccCardLockRetryCount.prototype = {
   __exposedProps__ : {lockType: 'r',
                       retryCount: 'r',
                       success: 'r'}
 };
 
 function IccInfo() {}
 IccInfo.prototype = {
-  QueryInterface: XPCOMUtils.generateQI([Ci.nsIDOMMozIccInfo]),
-  classID:        ICCINFO_CID,
-  classInfo:      XPCOMUtils.generateCI({
-    classID:          ICCINFO_CID,
-    classDescription: "IccInfo",
-    flags:            Ci.nsIClassInfo.DOM_OBJECT,
-    interfaces:       [Ci.nsIDOMMozIccInfo]
-  }),
-
-  // nsIDOMMozIccInfo
-
+  iccType: null,
   iccid: null,
   mcc: null,
   mnc: null,
   spn: null,
+  isDisplayNetworkNameRequired: null,
+  isDisplaySpnRequired: null
+};
+
+function GsmIccInfo() {}
+GsmIccInfo.prototype = {
+  __proto__: IccInfo.prototype,
+  QueryInterface: XPCOMUtils.generateQI([Ci.nsIDOMMozGsmIccInfo]),
+  classID: GSMICCINFO_CID,
+  classInfo: XPCOMUtils.generateCI({
+    classID:          GSMICCINFO_CID,
+    classDescription: "MozGsmIccInfo",
+    flags:            Ci.nsIClassInfo.DOM_OBJECT,
+    interfaces:       [Ci.nsIDOMMozGsmIccInfo]
+  }),
+
+  // nsIDOMMozGsmIccInfo
+
   msisdn: null
 };
 
+function CdmaIccInfo() {}
+CdmaIccInfo.prototype = {
+  __proto__: IccInfo.prototype,
+  QueryInterface: XPCOMUtils.generateQI([Ci.nsIDOMMozCdmaIccInfo]),
+  classID: CDMAICCINFO_CID,
+  classInfo: XPCOMUtils.generateCI({
+    classID:          CDMAICCINFO_CID,
+    classDescription: "MozCdmaIccInfo",
+    flags:            Ci.nsIClassInfo.DOM_OBJECT,
+    interfaces:       [Ci.nsIDOMMozCdmaIccInfo]
+  }),
+
+  // nsIDOMMozCdmaIccInfo
+
+  mdn: null,
+  min: null
+};
+
 function VoicemailInfo() {}
 VoicemailInfo.prototype = {
   number: null,
   displayName: null
 };
 
 function MobileConnectionInfo() {}
 MobileConnectionInfo.prototype = {
@@ -399,17 +427,17 @@ DOMMMIError.prototype = {
     this.additionalInformation = additionalInformation;
   },
 };
 
 function RILContentHelper() {
   this.rilContext = {
     cardState:            RIL.GECKO_CARDSTATE_UNKNOWN,
     networkSelectionMode: RIL.GECKO_NETWORK_SELECTION_UNKNOWN,
-    iccInfo:              new IccInfo(),
+    iccInfo:              null,
     voiceConnectionInfo:  new MobileConnectionInfo(),
     dataConnectionInfo:   new MobileConnectionInfo()
   };
   this.voicemailInfo = new VoicemailInfo();
 
   this.initDOMRequestHelper(/* aWindow */ null, RIL_IPC_MSG_NAMES);
   this._windowsMap = [];
   Services.obs.addObserver(this, "xpcom-shutdown", false);
@@ -467,17 +495,41 @@ RILContentHelper.prototype = {
     }
 
     let network = destInfo.network;
     if (!network) {
       network = destInfo.network = new MobileNetworkInfo();
     }
 
     this.updateInfo(srcNetwork, network);
- },
+  },
+
+  /**
+   * We need to consider below cases when update iccInfo:
+   * 1. Should clear iccInfo to null if there is no card detected.
+   * 2. Need to create corresponding object based on iccType.
+   */
+  updateIccInfo: function updateIccInfo(newInfo) {
+    // Card is not detected, clear iccInfo to null.
+    if (!newInfo || !newInfo.iccType) {
+      this.rilContext.iccInfo = null;
+      return;
+    }
+
+    // If iccInfo is null, new corresponding object based on iccType.
+    if (!this.rilContext.iccInfo) {
+      if (newInfo.iccType === "ruim" || newInfo.iccType === "csim") {
+        this.rilContext.iccInfo = new CdmaIccInfo();
+      } else {
+        this.rilContext.iccInfo = new GsmIccInfo();
+      }
+    }
+
+    this.updateInfo(newInfo, this.rilContext.iccInfo);
+  },
 
   _windowsMap: null,
 
   rilContext: null,
 
   getRilContext: function getRilContext() {
     // Update ril context by sending IPC message to chrome only when the first
     // time we require it. The information will be updated by following info
@@ -489,17 +541,17 @@ RILContentHelper.prototype = {
     let rilContext =
       cpmm.sendSyncMessage("RIL:GetRilContext", {clientId: 0})[0];
     if (!rilContext) {
       debug("Received null rilContext from chrome process.");
       return;
     }
     this.rilContext.cardState = rilContext.cardState;
     this.rilContext.networkSelectionMode = rilContext.networkSelectionMode;
-    this.updateInfo(rilContext.iccInfo, this.rilContext.iccInfo);
+    this.updateIccInfo(rilContext.iccInfo);
     this.updateConnectionInfo(rilContext.voice, this.rilContext.voiceConnectionInfo);
     this.updateConnectionInfo(rilContext.data, this.rilContext.dataConnectionInfo);
 
     return this.rilContext;
   },
 
   /**
    * nsIMobileConnectionProvider
@@ -638,17 +690,18 @@ RILContentHelper.prototype = {
       throw Components.Exception("Can't get window object",
                                   Cr.NS_ERROR_UNEXPECTED);
     }
 
     let request = Services.DOMRequest.createRequest(window);
     let requestId = this.getRequestId(request);
 
     if (!mode) {
-      this.dispatchFireRequestError(requestId, "InvalidParameter");
+      this.dispatchFireRequestError(requestId,
+                                    RIL.GECKO_ERROR_INVALID_PARAMETER);
       return request;
     }
 
     cpmm.sendAsyncMessage("RIL:SetRoamingPreference", {
       clientId: 0,
       data: {
         requestId: requestId,
         mode: mode
@@ -1001,17 +1054,18 @@ RILContentHelper.prototype = {
     if (window == null) {
       throw Components.Exception("Can't get window object",
                                   Cr.NS_ERROR_UNEXPECTED);
     }
     let request = Services.DOMRequest.createRequest(window);
     let requestId = this.getRequestId(request);
 
     if (!this._isValidCFReason(reason)){
-      this.dispatchFireRequestError(requestId, "Invalid call forwarding reason.");
+      this.dispatchFireRequestError(requestId,
+                                    RIL.GECKO_ERROR_INVALID_PARAMETER);
       return request;
     }
 
     cpmm.sendAsyncMessage("RIL:GetCallForwardingOption", {
       clientId: 0,
       data: {
         requestId: requestId,
         reason: reason
@@ -1027,17 +1081,18 @@ RILContentHelper.prototype = {
                                   Cr.NS_ERROR_UNEXPECTED);
     }
     let request = Services.DOMRequest.createRequest(window);
     let requestId = this.getRequestId(request);
 
     if (!cfInfo ||
         !this._isValidCFReason(cfInfo.reason) ||
         !this._isValidCFAction(cfInfo.action)){
-      this.dispatchFireRequestError(requestId, "Invalid call forwarding rule definition.");
+      this.dispatchFireRequestError(requestId,
+                                    RIL.GECKO_ERROR_INVALID_PARAMETER);
       return request;
     }
 
     cpmm.sendAsyncMessage("RIL:SetCallForwardingOption", {
       clientId: 0,
       data: {
         requestId: requestId,
         active: cfInfo.active,
@@ -1056,17 +1111,18 @@ RILContentHelper.prototype = {
       throw Components.Exception("Can't get window object",
                                   Cr.NS_ERROR_UNEXPECTED);
     }
     let request = Services.DOMRequest.createRequest(window);
     let requestId = this.getRequestId(request);
 
     if (DEBUG) debug("getCallBarringOption: " + JSON.stringify(option));
     if (!this._isValidCallBarringOption(option)) {
-      this.dispatchFireRequestError(requestId, "InvalidCallBarringOption");
+      this.dispatchFireRequestError(requestId,
+                                    RIL.GECKO_ERROR_INVALID_PARAMETER);
       return request;
     }
 
     cpmm.sendAsyncMessage("RIL:GetCallBarringOption", {
       clientId: 0,
       data: {
         requestId: requestId,
         program: option.program,
@@ -1082,17 +1138,18 @@ RILContentHelper.prototype = {
       throw Components.Exception("Can't get window object",
                                   Cr.NS_ERROR_UNEXPECTED);
     }
     let request = Services.DOMRequest.createRequest(window);
     let requestId = this.getRequestId(request);
 
     if (DEBUG) debug("setCallBarringOption: " + JSON.stringify(option));
     if (!this._isValidCallBarringOption(option, true)) {
-      this.dispatchFireRequestError(requestId, "InvalidCallBarringOption");
+      this.dispatchFireRequestError(requestId,
+                                    RIL.GECKO_ERROR_INVALID_PARAMETER);
       return request;
     }
 
     cpmm.sendAsyncMessage("RIL:SetCallBarringOption", {
       clientId: 0,
       data: {
         requestId: requestId,
         program: option.program,
@@ -1536,17 +1593,17 @@ RILContentHelper.prototype = {
           this.rilContext.cardState = data.cardState;
           this._deliverEvent("_iccListeners",
                              "notifyCardStateChanged",
                              null);
         }
         break;
       }
       case "RIL:IccInfoChanged":
-        this.updateInfo(msg.json.data, this.rilContext.iccInfo);
+        this.updateIccInfo(msg.json.data);
         this._deliverEvent("_iccListeners", "notifyIccInfoChanged", null);
         break;
       case "RIL:VoiceInfoChanged":
         this.updateConnectionInfo(msg.json.data,
                                   this.rilContext.voiceConnectionInfo);
         this._deliverEvent("_mobileConnectionListeners",
                            "notifyVoiceChanged",
                            null);
--- a/dom/system/gonk/RadioInterfaceLayer.js
+++ b/dom/system/gonk/RadioInterfaceLayer.js
@@ -2217,31 +2217,24 @@ RadioInterface.prototype = {
     gMessageManager.sendVoicemailMessage("RIL:VoicemailInfoChanged",
                                          this.clientId, voicemailInfo);
   },
 
   handleIccInfoChange: function handleIccInfoChange(message) {
     let oldIccInfo = this.rilContext.iccInfo;
     this.rilContext.iccInfo = message;
 
-    let iccInfoChanged = !oldIccInfo ||
-                          oldIccInfo.iccid != message.iccid ||
-                          oldIccInfo.mcc != message.mcc ||
-                          oldIccInfo.mnc != message.mnc ||
-                          oldIccInfo.spn != message.spn ||
-                          oldIccInfo.isDisplayNetworkNameRequired != message.isDisplayNetworkNameRequired ||
-                          oldIccInfo.isDisplaySpnRequired != message.isDisplaySpnRequired ||
-                          oldIccInfo.msisdn != message.msisdn;
-    if (!iccInfoChanged) {
+    if (!this.isInfoChanged(message, oldIccInfo)) {
       return;
     }
     // RIL:IccInfoChanged corresponds to a DOM event that gets fired only
-    // when the MCC or MNC codes have changed.
+    // when iccInfo has changed.
     gMessageManager.sendIccMessage("RIL:IccInfoChanged",
-                                   this.clientId, message);
+                                   this.clientId,
+                                   message.iccType ? message : null);
 
     // Update lastKnownSimMcc.
     if (message.mcc) {
       try {
         Services.prefs.setCharPref("ril.lastKnownSimMcc",
                                    message.mcc.toString());
       } catch (e) {}
     }
@@ -2989,17 +2982,17 @@ RadioInterface.prototype = {
     }
 
     // Re-sync options.segmentMaxSeq with actual length of returning array.
     options.segmentMaxSeq = options.segments.length;
 
     return options;
   },
 
-  getSegmentInfoForText: function getSegmentInfoForText(text) {
+  getSegmentInfoForText: function getSegmentInfoForText(text, request) {
     let strict7BitEncoding;
     try {
       strict7BitEncoding = Services.prefs.getBoolPref("dom.sms.strict7BitEncoding");
     } catch (e) {
       strict7BitEncoding = false;
     }
 
     let options = this._fragmentText(text, null, strict7BitEncoding);
@@ -3010,20 +3003,21 @@ RadioInterface.prototype = {
       if (options.dcs == RIL.PDU_DCS_MSG_CODING_16BITS_ALPHABET) {
         // In UCS2 encoding, encodedBodyLength is in octets.
         charsInLastSegment /= 2;
       }
     } else {
       charsInLastSegment = 0;
     }
 
-    let result = gMobileMessageService.createSmsSegmentInfo(options.segmentMaxSeq,
-                                                            options.segmentChars,
-                                                            options.segmentChars - charsInLastSegment);
-    return result;
+    let result = gMobileMessageService
+                 .createSmsSegmentInfo(options.segmentMaxSeq,
+                                       options.segmentChars,
+                                       options.segmentChars - charsInLastSegment);
+    request.notifySegmentInfoForTextGot(result);
   },
 
   sendSMS: function sendSMS(number, message, silent, request) {
     let strict7BitEncoding;
     try {
       strict7BitEncoding = Services.prefs.getBoolPref("dom.sms.strict7BitEncoding");
     } catch (e) {
       strict7BitEncoding = false;
--- a/dom/system/gonk/nsIRadioInterfaceLayer.idl
+++ b/dom/system/gonk/nsIRadioInterfaceLayer.idl
@@ -1,17 +1,16 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "nsISupports.idl"
 
 interface nsIDOMMozIccInfo;
 interface nsIDOMMozMobileConnectionInfo;
-interface nsIDOMMozSmsSegmentInfo;
 interface nsIMobileMessageCallback;
 
 [scriptable, uuid(1e602d20-d066-4399-8997-daf36b3158ef)]
 interface nsIRILDataCallInfo : nsISupports
 {
   /**
    * Current data call state, one of the
    * nsINetworkInterface::NETWORK_STATE_* constants.
@@ -74,17 +73,17 @@ interface nsIRilContext : nsISupports
 
   readonly attribute nsIDOMMozIccInfo iccInfo;
 
   readonly attribute nsIDOMMozMobileConnectionInfo voice;
 
   readonly attribute nsIDOMMozMobileConnectionInfo data;
 };
 
-[scriptable, uuid(5efcd358-080e-46d6-a7f7-4f36c204eec3)]
+[scriptable, uuid(a50d65aa-00da-11e3-b954-7bfb233d98fc)]
 interface nsIRadioInterface : nsISupports
 {
   readonly attribute nsIRilContext rilContext;
 
   /**
    * PDP APIs
    */
   void setupDataCallByType(in DOMString apntype);
@@ -94,17 +93,18 @@ interface nsIRadioInterface : nsISupport
   void registerDataCallCallback(in nsIRILDataCallback callback);
   void unregisterDataCallCallback(in nsIRILDataCallback callback);
 
   void updateRILNetworkInterface();
 
   /**
    * SMS-related functionality.
    */
-  nsIDOMMozSmsSegmentInfo getSegmentInfoForText(in DOMString text);
+  void getSegmentInfoForText(in DOMString text,
+                             in nsIMobileMessageCallback request);
 
   void sendSMS(in DOMString number,
                in DOMString message,
                in boolean silent,
                in nsIMobileMessageCallback request);
 };
 
 [scriptable, uuid(44b03951-1444-4c03-bd37-0bcb3a01b56f)]
--- a/dom/system/gonk/ril_consts.js
+++ b/dom/system/gonk/ril_consts.js
@@ -365,16 +365,25 @@ this.CARD_APPTYPE_UNKNOWN = 0;
 this.CARD_APPTYPE_SIM = 1;
 this.CARD_APPTYPE_USIM = 2;
 this.CARD_APPTYPE_RUIM = 3;
 this.CARD_APPTYPE_CSIM = 4;
 this.CARD_APPTYPE_ISIM = 5;
 
 this.CARD_MAX_APPS = 8;
 
+this.GECKO_CARD_TYPE = [
+  null,
+  "sim",
+  "usim",
+  "ruim",
+  "csim",
+  "isim"
+];
+
 this.NETWORK_STATE_UNKNOWN = "unknown";
 this.NETWORK_STATE_AVAILABLE = "available";
 this.NETWORK_STATE_CONNECTED = "connected";
 this.NETWORK_STATE_FORBIDDEN = "forbidden";
 
 this.NETWORK_SELECTION_MODE_AUTOMATIC = 0;
 this.NETWORK_SELECTION_MODE_MANUAL = 1;
 
--- a/dom/system/gonk/ril_worker.js
+++ b/dom/system/gonk/ril_worker.js
@@ -91,17 +91,109 @@ let RILQUIRKS_SIM_APP_STATE_EXTRA_FIELDS
 // Needed for call-waiting on Peak device
 let RILQUIRKS_EXTRA_UINT32_2ND_CALL = libcutils.property_get("ro.moz.ril.extra_int_2nd_call", "false") == "true";
 // On the emulator we support querying the number of lock retries
 let RILQUIRKS_HAVE_QUERY_ICC_LOCK_RETRY_COUNT = libcutils.property_get("ro.moz.ril.query_icc_count", "false") == "true";
 
 // Marker object.
 let PENDING_NETWORK_TYPE = {};
 
-let Buf = require("resource://gre/modules/workers/worker_buf.js");
+let Buf = {
+  __proto__: (function(){
+    return require("resource://gre/modules/workers/worker_buf.js").Buf;
+  })(),
+
+  mToken: 0,
+  mTokenRequestMap: null,
+
+  init: function init() {
+    this._init();
+
+    // This gets incremented each time we send out a parcel.
+    this.mToken = 1;
+
+    // Maps tokens we send out with requests to the request type, so that
+    // when we get a response parcel back, we know what request it was for.
+    this.mTokenRequestMap = {};
+  },
+
+  /**
+   * Process one parcel.
+   */
+  processParcel: function processParcel() {
+    let response_type = this.readUint32();
+
+    let request_type, options;
+    if (response_type == RESPONSE_TYPE_SOLICITED) {
+      let token = this.readUint32();
+      let error = this.readUint32();
+
+      options = this.mTokenRequestMap[token];
+      if (!options) {
+        if (DEBUG) {
+          debug("Suspicious uninvited request found: " + token + ". Ignored!");
+        }
+        return;
+      }
+
+      delete this.mTokenRequestMap[token];
+      request_type = options.rilRequestType;
+
+      options.rilRequestError = error;
+      if (DEBUG) {
+        debug("Solicited response for request type " + request_type +
+              ", token " + token + ", error " + error);
+      }
+    } else if (response_type == RESPONSE_TYPE_UNSOLICITED) {
+      request_type = this.readUint32();
+      if (DEBUG) debug("Unsolicited response for request type " + request_type);
+    } else {
+      if (DEBUG) debug("Unknown response type: " + response_type);
+      return;
+    }
+
+    RIL.handleParcel(request_type, this.mReadAvailable, options);
+  },
+
+  /**
+   * Start a new outgoing parcel.
+   *
+   * @param type
+   *        Integer specifying the request type.
+   * @param options [optional]
+   *        Object containing information about the request, e.g. the
+   *        original main thread message object that led to the RIL request.
+   */
+  newParcel: function newParcel(type, options) {
+    if (DEBUG) debug("New outgoing parcel of type " + type);
+
+    // We're going to leave room for the parcel size at the beginning.
+    this.mOutgoingIndex = this.PARCEL_SIZE_SIZE;
+    this.writeUint32(type);
+    this.writeUint32(this.mToken);
+
+    if (!options) {
+      options = {};
+    }
+    options.rilRequestType = type;
+    options.rilRequestError = null;
+    this.mTokenRequestMap[this.mToken] = options;
+    this.mToken++;
+    return this.mToken;
+  },
+
+  simpleRequest: function simpleRequest(type, options) {
+    this.newParcel(type, options);
+    this.sendParcel();
+  },
+
+  onSendParcel: function onSendParcel(parcel) {
+    postRILMessage(CLIENT_ID, parcel);
+  }
+};
 
 /**
  * The RIL state machine.
  *
  * This object communicates with rild via parcels and with the main thread
  * via post messages. It maintains state about the radio, ICC, calls, etc.
  * and acts upon state changes accordingly.
  */
@@ -1217,16 +1309,20 @@ let RIL = {
   getBasebandVersion: function getBasebandVersion() {
     Buf.simpleRequest(REQUEST_BASEBAND_VERSION);
   },
 
   sendExitEmergencyCbModeRequest: function sendExitEmergencyCbModeRequest(options) {
     Buf.simpleRequest(REQUEST_EXIT_EMERGENCY_CALLBACK_MODE, options);
   },
 
+  getCdmaSubscription: function getCdmaSubscription() {
+    Buf.simpleRequest(REQUEST_CDMA_SUBSCRIPTION);
+  },
+
   exitEmergencyCbMode: function exitEmergencyCbMode(options) {
     // The function could be called by an API from RadioInterfaceLayer or by
     // ril_worker itself. From ril_worker, we won't pass the parameter
     // 'options'. In this case, it is marked as internal.
     if (!options) {
       options = {internal: true};
     }
     this._cancelEmergencyCbModeTimeout();
@@ -2832,16 +2928,19 @@ let RIL = {
             debug("ICC absent");
           }
           newCardState = GECKO_CARDSTATE_ABSENT;
           break;
       }
       if (newCardState == this.cardState) {
         return;
       }
+      this.iccInfo = {iccType: null};
+      ICCUtilsHelper.handleICCInfoChange();
+
       this.cardState = newCardState;
       this.sendChromeMessage({rilMessageType: "cardstatechange",
                               cardState: this.cardState});
       return;
     }
 
     let index = this._isCdma ? iccStatus.cdmaSubscriptionAppIndex :
                                iccStatus.gsmUmtsSubscriptionAppIndex;
@@ -2883,16 +2982,18 @@ let RIL = {
 
     if (this.cardState == newCardState) {
       return;
     }
 
     // This was moved down from CARD_APPSTATE_READY
     this.requestNetworkInfo();
     if (newCardState == GECKO_CARDSTATE_READY) {
+      this.iccInfo.iccType = GECKO_CARD_TYPE[this.appType];
+
       // For type SIM, we need to check EF_phase first.
       // Other types of ICC we can send Terminal_Profile immediately.
       if (this.appType == CARD_APPTYPE_SIM) {
         ICCRecordHelper.readICCPhase();
         ICCRecordHelper.fetchICCRecords();
       } else if (this.appType == CARD_APPTYPE_USIM) {
         this.sendStkTerminalProfile(STK_SUPPORTED_TERMINAL_PROFILE);
         ICCRecordHelper.fetchICCRecords();
@@ -5666,17 +5767,31 @@ RIL[REQUEST_GSM_SET_BROADCAST_SMS_CONFIG
   if (options.rilRequestError == ERROR_SUCCESS) {
     this.setSmsBroadcastActivation(true);
   }
 };
 RIL[REQUEST_GSM_SMS_BROADCAST_ACTIVATION] = null;
 RIL[REQUEST_CDMA_GET_BROADCAST_SMS_CONFIG] = null;
 RIL[REQUEST_CDMA_SET_BROADCAST_SMS_CONFIG] = null;
 RIL[REQUEST_CDMA_SMS_BROADCAST_ACTIVATION] = null;
-RIL[REQUEST_CDMA_SUBSCRIPTION] = null;
+RIL[REQUEST_CDMA_SUBSCRIPTION] = function REQUEST_CDMA_SUBSCRIPTION(length, options) {
+  if (options.rilRequestError) {
+    return;
+  }
+
+  let result = Buf.readStringList();
+
+  this.iccInfo.mdn = result[0];
+  // The result[1] is Home SID. (Already be handled in readCDMAHome())
+  // The result[2] is Home NID. (Already be handled in readCDMAHome())
+  this.iccInfo.min = result[3];
+  // The result[4] is PRL version.
+
+  ICCUtilsHelper.handleICCInfoChange();
+};
 RIL[REQUEST_CDMA_WRITE_SMS_TO_RUIM] = null;
 RIL[REQUEST_CDMA_DELETE_SMS_ON_RUIM] = null;
 RIL[REQUEST_DEVICE_IDENTITY] = function REQUEST_DEVICE_IDENTITY(length, options) {
   if (options.rilRequestError) {
     return;
   }
 
   let result = Buf.readStringList();
@@ -10980,21 +11095,21 @@ let ICCRecordHelper = {
    * Read ICC MBDN. (Mailbox Dialling Number)
    *
    * @see TS 131.102, clause 4.2.60
    */
   readMBDN: function readMBDN() {
     function callback(options) {
       let contact = GsmPDUHelper.readAlphaIdDiallingNumber(options.recordSize);
       if (!contact ||
-          (RIL.iccInfo.mbdn !== undefined &&
-           RIL.iccInfo.mbdn === contact.number)) {
+          (RIL.iccInfoPrivate.mbdn !== undefined &&
+           RIL.iccInfoPrivate.mbdn === contact.number)) {
         return;
       }
-      RIL.iccInfo.mbdn = contact.number;
+      RIL.iccInfoPrivate.mbdn = contact.number;
       if (DEBUG) {
         debug("MBDN, alphaId="+contact.alphaId+" number="+contact.number);
       }
       contact.rilMessageType = "iccmbdn";
       RIL.sendChromeMessage(contact);
     }
 
     ICCIOHelper.loadLinearFixedEF({fileId: ICC_EF_MBDN,
@@ -12663,16 +12778,17 @@ let ICCContactHelper = {
 };
 
 let RuimRecordHelper = {
   fetchRuimRecords: function fetchRuimRecords() {
     ICCRecordHelper.readICCID();
     RIL.getIMSI();
     this.readCST();
     this.readCDMAHome();
+    RIL.getCdmaSubscription();
   },
 
   /**
    * Read CDMAHOME for CSIM.
    * See 3GPP2 C.S0023 Sec. 3.4.8.
    */
   readCDMAHome: function readCDMAHome() {
     function callback(options) {
@@ -12787,19 +12903,16 @@ let RuimRecordHelper = {
 
 /**
  * Global stuff.
  */
 
 // Initialize buffers. This is a separate function so that unit tests can
 // re-initialize the buffers at will.
 Buf.init();
-Buf.setOutputStream(function (parcel) {
-  postRILMessage(CLIENT_ID, parcel);
-});
 
 function onRILMessage(data) {
   Buf.processIncoming(data);
 }
 
 onmessage = function onmessage(event) {
   RIL.handleChromeMessage(event.data);
 };
--- a/dom/system/gonk/worker_buf.js
+++ b/dom/system/gonk/worker_buf.js
@@ -1,676 +1,609 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this file,
  * You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 const INT32_MAX   = 2147483647;
 const UINT8_SIZE  = 1;
 const UINT16_SIZE = 2;
 const UINT32_SIZE = 4;
-const PARCEL_SIZE_SIZE = UINT32_SIZE;
 
 /**
  * This object contains helpers buffering incoming data & deconstructing it
  * into parcels as well as buffering outgoing data & constructing parcels.
  * For that it maintains two buffers and corresponding uint8 views, indexes.
  *
  * The incoming buffer is a circular buffer where we store incoming data.
  * As soon as a complete parcel is received, it is processed right away, so
  * the buffer only needs to be large enough to hold one parcel.
  *
  * The outgoing buffer is to prepare outgoing parcels. The index is reset
  * every time a parcel is sent.
  */
 
-let mIncomingBufferLength = 1024;
-let mOutgoingBufferLength = 1024;
-let mIncomingBuffer, mOutgoingBuffer, mIncomingBytes, mOutgoingBytes,
-    mIncomingWriteIndex, mIncomingReadIndex, mOutgoingIndex, mReadIncoming,
-    mReadAvailable, mCurrentParcelSize, mToken, mTokenRequestMap,
-    mLasSolicitedToken, mOutgoingBufferCalSizeQueue, mOutputStream;
-
-function init() {
-  mIncomingBuffer = new ArrayBuffer(mIncomingBufferLength);
-  mOutgoingBuffer = new ArrayBuffer(mOutgoingBufferLength);
-
-  mIncomingBytes = new Uint8Array(mIncomingBuffer);
-  mOutgoingBytes = new Uint8Array(mOutgoingBuffer);
-
-  // Track where incoming data is read from and written to.
-  mIncomingWriteIndex = 0;
-  mIncomingReadIndex = 0;
-
-  // Leave room for the parcel size for outgoing parcels.
-  mOutgoingIndex = PARCEL_SIZE_SIZE;
+let Buf = {
+  PARCEL_SIZE_SIZE: UINT32_SIZE,
 
-  // How many bytes we've read for this parcel so far.
-  mReadIncoming = 0;
-
-  // How many bytes available as parcel data.
-  mReadAvailable = 0;
-
-  // Size of the incoming parcel. If this is zero, we're expecting a new
-  // parcel.
-  mCurrentParcelSize = 0;
+  mIncomingBufferLength: 1024,
+  mIncomingBuffer: null,
+  mIncomingBytes: null,
+  mIncomingWriteIndex: 0,
+  mIncomingReadIndex: 0,
+  mReadIncoming: 0,
+  mReadAvailable: 0,
+  mCurrentParcelSize: 0,
 
-  // This gets incremented each time we send out a parcel.
-  mToken = 1;
-
-  // Maps tokens we send out with requests to the request type, so that
-  // when we get a response parcel back, we know what request it was for.
-  mTokenRequestMap = {};
+  mOutgoingBufferLength: 1024,
+  mOutgoingBuffer: null,
+  mOutgoingBytes: null,
+  mOutgoingIndex: 0,
+  mOutgoingBufferCalSizeQueue: null,
 
-  // This is the token of last solicited response.
-  mLasSolicitedToken = 0;
-
-  // Queue for storing outgoing override points
-  mOutgoingBufferCalSizeQueue = [];
-}
+  _init: function _init() {
+    this.mIncomingBuffer = new ArrayBuffer(this.mIncomingBufferLength);
+    this.mOutgoingBuffer = new ArrayBuffer(this.mOutgoingBufferLength);
 
-/**
- * Mark current mOutgoingIndex as start point for calculation length of data
- * written to mOutgoingBuffer.
- * Mark can be nested for here uses queue to remember marks.
- *
- * @param writeFunction
- *        Function to write data length into mOutgoingBuffer, this function is
- *        also used to allocate buffer for data length.
- *        Raw data size(in Uint8) is provided as parameter calling writeFunction.
- *        If raw data size is not in proper unit for writing, user can adjust
- *        the length value in writeFunction before writing.
- **/
-function startCalOutgoingSize(writeFunction) {
-  let sizeInfo = {index: mOutgoingIndex,
-                  write: writeFunction};
+    this.mIncomingBytes = new Uint8Array(this.mIncomingBuffer);
+    this.mOutgoingBytes = new Uint8Array(this.mOutgoingBuffer);
 
-  // Allocate buffer for data lemgtj.
-  writeFunction.call(0);
+    // Track where incoming data is read from and written to.
+    this.mIncomingWriteIndex = 0;
+    this.mIncomingReadIndex = 0;
 
-  // Get size of data length buffer for it is not counted into data size.
-  sizeInfo.size = mOutgoingIndex - sizeInfo.index;
+    // Leave room for the parcel size for outgoing parcels.
+    this.mOutgoingIndex = this.PARCEL_SIZE_SIZE;
 
-  // Enqueue size calculation information.
-  mOutgoingBufferCalSizeQueue.push(sizeInfo);
-}
+    // How many bytes we've read for this parcel so far.
+    this.mReadIncoming = 0;
 
-/**
- * Calculate data length since last mark, and write it into mark position.
- **/
-function stopCalOutgoingSize() {
-  let sizeInfo = mOutgoingBufferCalSizeQueue.pop();
+    // How many bytes available as parcel data.
+    this.mReadAvailable = 0;
 
-  // Remember current mOutgoingIndex.
-  let currentOutgoingIndex = mOutgoingIndex;
-  // Calculate data length, in uint8.
-  let writeSize = mOutgoingIndex - sizeInfo.index - sizeInfo.size;
+    // Size of the incoming parcel. If this is zero, we're expecting a new
+    // parcel.
+    this.mCurrentParcelSize = 0;
 
-  // Write data length to mark, use same function for allocating buffer to make
-  // sure there is no buffer overloading.
-  mOutgoingIndex = sizeInfo.index;
-  sizeInfo.write(writeSize);
-
-  // Restore mOutgoingIndex.
-  mOutgoingIndex = currentOutgoingIndex;
-}
+    // Queue for storing outgoing override points
+    this.mOutgoingBufferCalSizeQueue = [];
+  },
 
-/**
- * Grow the incoming buffer.
- *
- * @param min_size
- *        Minimum new size. The actual new size will be the the smallest
- *        power of 2 that's larger than this number.
- */
-function growIncomingBuffer(min_size) {
-  if (DEBUG) {
-    debug("Current buffer of " + mIncomingBufferLength +
-          " can't handle incoming " + min_size + " bytes.");
-  }
-  let oldBytes = mIncomingBytes;
-  mIncomingBufferLength =
-    2 << Math.floor(Math.log(min_size)/Math.log(2));
-  if (DEBUG) debug("New incoming buffer size: " + mIncomingBufferLength);
-  mIncomingBuffer = new ArrayBuffer(mIncomingBufferLength);
-  mIncomingBytes = new Uint8Array(mIncomingBuffer);
-  if (mIncomingReadIndex <= mIncomingWriteIndex) {
-    // Read and write index are in natural order, so we can just copy
-    // the old buffer over to the bigger one without having to worry
-    // about the indexes.
-    mIncomingBytes.set(oldBytes, 0);
-  } else {
-    // The write index has wrapped around but the read index hasn't yet.
-    // Write whatever the read index has left to read until it would
-    // circle around to the beginning of the new buffer, and the rest
-    // behind that.
-    let head = oldBytes.subarray(mIncomingReadIndex);
-    let tail = oldBytes.subarray(0, mIncomingReadIndex);
-    mIncomingBytes.set(head, 0);
-    mIncomingBytes.set(tail, head.length);
-    mIncomingReadIndex = 0;
-    mIncomingWriteIndex += head.length;
-  }
-  if (DEBUG) {
-    debug("New incoming buffer size is " + mIncomingBufferLength);
-  }
-}
+  /**
+   * Mark current mOutgoingIndex as start point for calculation length of data
+   * written to mOutgoingBuffer.
+   * Mark can be nested for here uses queue to remember marks.
+   *
+   * @param writeFunction
+   *        Function to write data length into mOutgoingBuffer, this function is
+   *        also used to allocate buffer for data length.
+   *        Raw data size(in Uint8) is provided as parameter calling writeFunction.
+   *        If raw data size is not in proper unit for writing, user can adjust
+   *        the length value in writeFunction before writing.
+   **/
+  startCalOutgoingSize: function startCalOutgoingSize(writeFunction) {
+    let sizeInfo = {index: this.mOutgoingIndex,
+                    write: writeFunction};
 
-/**
- * Grow the outgoing buffer.
- *
- * @param min_size
- *        Minimum new size. The actual new size will be the the smallest
- *        power of 2 that's larger than this number.
- */
-function growOutgoingBuffer(min_size) {
-  if (DEBUG) {
-    debug("Current buffer of " + mOutgoingBufferLength +
-          " is too small.");
-  }
-  let oldBytes = mOutgoingBytes;
-  mOutgoingBufferLength =
-    2 << Math.floor(Math.log(min_size)/Math.log(2));
-  mOutgoingBuffer = new ArrayBuffer(mOutgoingBufferLength);
-  mOutgoingBytes = new Uint8Array(mOutgoingBuffer);
-  mOutgoingBytes.set(oldBytes, 0);
-  if (DEBUG) {
-    debug("New outgoing buffer size is " + mOutgoingBufferLength);
-  }
-}
+    // Allocate buffer for data lemgtj.
+    writeFunction.call(0);
 
-/**
- * Functions for reading data from the incoming buffer.
- *
- * These are all little endian, apart from readParcelSize();
- */
+    // Get size of data length buffer for it is not counted into data size.
+    sizeInfo.size = this.mOutgoingIndex - sizeInfo.index;
 
-/**
- * Ensure position specified is readable.
- *
- * @param index
- *        Data position in incoming parcel, valid from 0 to
- *        mCurrentParcelSize.
- */
-function ensureIncomingAvailable(index) {
-  if (index >= mCurrentParcelSize) {
-    throw new Error("Trying to read data beyond the parcel end!");
-  } else if (index < 0) {
-    throw new Error("Trying to read data before the parcel begin!");
-  }
-}
+    // Enqueue size calculation information.
+    this.mOutgoingBufferCalSizeQueue.push(sizeInfo);
+  },
 
-/**
- * Seek in current incoming parcel.
- *
- * @param offset
- *        Seek offset in relative to current position.
- */
-function seekIncoming(offset) {
-  // Translate to 0..mCurrentParcelSize
-  let cur = mCurrentParcelSize - mReadAvailable;
-
-  let newIndex = cur + offset;
-  ensureIncomingAvailable(newIndex);
-
-  // ... mIncomingReadIndex -->|
-  // 0               new     cur           mCurrentParcelSize
-  // |================|=======|===================|
-  // |<--        cur       -->|<- mReadAvailable ->|
-  // |<-- newIndex -->|<--  new mReadAvailable  -->|
-  mReadAvailable = mCurrentParcelSize - newIndex;
+  /**
+   * Calculate data length since last mark, and write it into mark position.
+   **/
+  stopCalOutgoingSize: function stopCalOutgoingSize() {
+    let sizeInfo = this.mOutgoingBufferCalSizeQueue.pop();
 
-  // Translate back:
-  if (mIncomingReadIndex < cur) {
-    // The mIncomingReadIndex is wrapped.
-    newIndex += mIncomingBufferLength;
-  }
-  newIndex += (mIncomingReadIndex - cur);
-  newIndex %= mIncomingBufferLength;
-  mIncomingReadIndex = newIndex;
-}
-
-function readUint8Unchecked() {
-  let value = mIncomingBytes[mIncomingReadIndex];
-  mIncomingReadIndex = (mIncomingReadIndex + 1) %
-                           mIncomingBufferLength;
-  return value;
-}
+    // Remember current mOutgoingIndex.
+    let currentOutgoingIndex = this.mOutgoingIndex;
+    // Calculate data length, in uint8.
+    let writeSize = this.mOutgoingIndex - sizeInfo.index - sizeInfo.size;
 
-function readUint8() {
-  // Translate to 0..mCurrentParcelSize
-  let cur = mCurrentParcelSize - mReadAvailable;
-  ensureIncomingAvailable(cur);
-
-  mReadAvailable--;
-  return readUint8Unchecked();
-}
+    // Write data length to mark, use same function for allocating buffer to make
+    // sure there is no buffer overloading.
+    this.mOutgoingIndex = sizeInfo.index;
+    sizeInfo.write(writeSize);
 
-function readUint8Array(length) {
-  // Translate to 0..mCurrentParcelSize
-  let last = mCurrentParcelSize - mReadAvailable;
-  last += (length - 1);
-  ensureIncomingAvailable(last);
-
-  let array = new Uint8Array(length);
-  for (let i = 0; i < length; i++) {
-    array[i] = readUint8Unchecked();
-  }
-
-  mReadAvailable -= length;
-  return array;
-}
+    // Restore mOutgoingIndex.
+    this.mOutgoingIndex = currentOutgoingIndex;
+  },
 
-function readUint16() {
-  return readUint8() | readUint8() << 8;
-}
-
-function readUint32() {
-  return readUint8()       | readUint8() <<  8 |
-         readUint8() << 16 | readUint8() << 24;
-}
-
-function readUint32List() {
-  let length = readUint32();
-  let ints = [];
-  for (let i = 0; i < length; i++) {
-    ints.push(readUint32());
-  }
-  return ints;
-}
-
-function readString() {
-  let string_len = readUint32();
-  if (string_len < 0 || string_len >= INT32_MAX) {
-    return null;
-  }
-  let s = "";
-  for (let i = 0; i < string_len; i++) {
-    s += String.fromCharCode(readUint16());
-  }
-  // Strings are \0\0 delimited, but that isn't part of the length. And
-  // if the string length is even, the delimiter is two characters wide.
-  // It's insane, I know.
-  readStringDelimiter(string_len);
-  return s;
-}
-
-function readStringList() {
-  let num_strings = readUint32();
-  let strings = [];
-  for (let i = 0; i < num_strings; i++) {
-    strings.push(readString());
-  }
-  return strings;
-}
-
-function readStringDelimiter(length) {
-  let delimiter = readUint16();
-  if (!(length & 1)) {
-    delimiter |= readUint16();
-  }
-  if (DEBUG) {
-    if (delimiter !== 0) {
-      debug("Something's wrong, found string delimiter: " + delimiter);
+  /**
+   * Grow the incoming buffer.
+   *
+   * @param min_size
+   *        Minimum new size. The actual new size will be the the smallest
+   *        power of 2 that's larger than this number.
+   */
+  growIncomingBuffer: function growIncomingBuffer(min_size) {
+    if (DEBUG) {
+      debug("Current buffer of " + this.mIncomingBufferLength +
+            " can't handle incoming " + min_size + " bytes.");
     }
-  }
-}
+    let oldBytes = this.mIncomingBytes;
+    this.mIncomingBufferLength =
+      2 << Math.floor(Math.log(min_size)/Math.log(2));
+    if (DEBUG) debug("New incoming buffer size: " + this.mIncomingBufferLength);
+    this.mIncomingBuffer = new ArrayBuffer(this.mIncomingBufferLength);
+    this.mIncomingBytes = new Uint8Array(this.mIncomingBuffer);
+    if (this.mIncomingReadIndex <= this.mIncomingWriteIndex) {
+      // Read and write index are in natural order, so we can just copy
+      // the old buffer over to the bigger one without having to worry
+      // about the indexes.
+      this.mIncomingBytes.set(oldBytes, 0);
+    } else {
+      // The write index has wrapped around but the read index hasn't yet.
+      // Write whatever the read index has left to read until it would
+      // circle around to the beginning of the new buffer, and the rest
+      // behind that.
+      let head = oldBytes.subarray(this.mIncomingReadIndex);
+      let tail = oldBytes.subarray(0, this.mIncomingReadIndex);
+      this.mIncomingBytes.set(head, 0);
+      this.mIncomingBytes.set(tail, head.length);
+      this.mIncomingReadIndex = 0;
+      this.mIncomingWriteIndex += head.length;
+    }
+    if (DEBUG) {
+      debug("New incoming buffer size is " + this.mIncomingBufferLength);
+    }
+  },
 
-function readParcelSize() {
-  return readUint8Unchecked() << 24 |
-         readUint8Unchecked() << 16 |
-         readUint8Unchecked() <<  8 |
-         readUint8Unchecked();
-}
-
-/**
- * Functions for writing data to the outgoing buffer.
- */
-
-/**
- * Ensure position specified is writable.
- *
- * @param index
- *        Data position in outgoing parcel, valid from 0 to
- *        mOutgoingBufferLength.
- */
-function ensureOutgoingAvailable(index) {
-  if (index >= mOutgoingBufferLength) {
-    growOutgoingBuffer(index + 1);
-  }
-}
-
-function writeUint8(value) {
-  ensureOutgoingAvailable(mOutgoingIndex);
-
-  mOutgoingBytes[mOutgoingIndex] = value;
-  mOutgoingIndex++;
-}
+  /**
+   * Grow the outgoing buffer.
+   *
+   * @param min_size
+   *        Minimum new size. The actual new size will be the the smallest
+   *        power of 2 that's larger than this number.
+   */
+  growOutgoingBuffer: function growOutgoingBuffer(min_size) {
+    if (DEBUG) {
+      debug("Current buffer of " + this.mOutgoingBufferLength +
+            " is too small.");
+    }
+    let oldBytes = this.mOutgoingBytes;
+    this.mOutgoingBufferLength =
+      2 << Math.floor(Math.log(min_size)/Math.log(2));
+    this.mOutgoingBuffer = new ArrayBuffer(this.mOutgoingBufferLength);
+    this.mOutgoingBytes = new Uint8Array(this.mOutgoingBuffer);
+    this.mOutgoingBytes.set(oldBytes, 0);
+    if (DEBUG) {
+      debug("New outgoing buffer size is " + this.mOutgoingBufferLength);
+    }
+  },
 
-function writeUint16(value) {
-  writeUint8(value & 0xff);
-  writeUint8((value >> 8) & 0xff);
-}
-
-function writeUint32(value) {
-  writeUint8(value & 0xff);
-  writeUint8((value >> 8) & 0xff);
-  writeUint8((value >> 16) & 0xff);
-  writeUint8((value >> 24) & 0xff);
-}
-
-function writeString(value) {
-  if (value == null) {
-    writeUint32(-1);
-    return;
-  }
-  writeUint32(value.length);
-  for (let i = 0; i < value.length; i++) {
-    writeUint16(value.charCodeAt(i));
-  }
-  // Strings are \0\0 delimited, but that isn't part of the length. And
-  // if the string length is even, the delimiter is two characters wide.
-  // It's insane, I know.
-  writeStringDelimiter(value.length);
-}
-
-function writeStringList(strings) {
-  writeUint32(strings.length);
-  for (let i = 0; i < strings.length; i++) {
-    writeString(strings[i]);
-  }
-}
+  /**
+   * Functions for reading data from the incoming buffer.
+   *
+   * These are all little endian, apart from readParcelSize();
+   */
 
-function writeStringDelimiter(length) {
-  writeUint16(0);
-  if (!(length & 1)) {
-    writeUint16(0);
-  }
-}
-
-function writeParcelSize(value) {
   /**
-   *  Parcel size will always be the first thing in the parcel byte
-   *  array, but the last thing written. Store the current index off
-   *  to a temporary to be reset after we write the size.
+   * Ensure position specified is readable.
+   *
+   * @param index
+   *        Data position in incoming parcel, valid from 0 to
+   *        mCurrentParcelSize.
    */
-  let currentIndex = mOutgoingIndex;
-  mOutgoingIndex = 0;
-  writeUint8((value >> 24) & 0xff);
-  writeUint8((value >> 16) & 0xff);
-  writeUint8((value >> 8) & 0xff);
-  writeUint8(value & 0xff);
-  mOutgoingIndex = currentIndex;
-}
-
-function copyIncomingToOutgoing(length) {
-  if (!length || (length < 0)) {
-    return;
-  }
+  ensureIncomingAvailable: function ensureIncomingAvailable(index) {
+    if (index >= this.mCurrentParcelSize) {
+      throw new Error("Trying to read data beyond the parcel end!");
+    } else if (index < 0) {
+      throw new Error("Trying to read data before the parcel begin!");
+    }
+  },
 
-  let translatedReadIndexEnd = mCurrentParcelSize - mReadAvailable + length - 1;
-  ensureIncomingAvailable(translatedReadIndexEnd);
-
-  let translatedWriteIndexEnd = mOutgoingIndex + length - 1;
-  ensureOutgoingAvailable(translatedWriteIndexEnd);
+  /**
+   * Seek in current incoming parcel.
+   *
+   * @param offset
+   *        Seek offset in relative to current position.
+   */
+  seekIncoming: function seekIncoming(offset) {
+    // Translate to 0..mCurrentParcelSize
+    let cur = this.mCurrentParcelSize - this.mReadAvailable;
 
-  let newIncomingReadIndex = mIncomingReadIndex + length;
-  if (newIncomingReadIndex < mIncomingBufferLength) {
-    // Reading won't cause wrapping, go ahead with builtin copy.
-    mOutgoingBytes.set(mIncomingBytes.subarray(mIncomingReadIndex, newIncomingReadIndex),
-                           mOutgoingIndex);
-  } else {
-    // Not so lucky.
-    newIncomingReadIndex %= mIncomingBufferLength;
-    mOutgoingBytes.set(mIncomingBytes.subarray(mIncomingReadIndex, mIncomingBufferLength),
-                           mOutgoingIndex);
-    if (newIncomingReadIndex) {
-      let firstPartLength = mIncomingBufferLength - mIncomingReadIndex;
-      mOutgoingBytes.set(mIncomingBytes.subarray(0, newIncomingReadIndex),
-                             mOutgoingIndex + firstPartLength);
-    }
-  }
+    let newIndex = cur + offset;
+    this.ensureIncomingAvailable(newIndex);
 
-  mIncomingReadIndex = newIncomingReadIndex;
-  mReadAvailable -= length;
-  mOutgoingIndex += length;
-}
-
-/**
- * Parcel management
- */
+    // ... mIncomingReadIndex -->|
+    // 0               new     cur           mCurrentParcelSize
+    // |================|=======|====================|
+    // |<--        cur       -->|<- mReadAvailable ->|
+    // |<-- newIndex -->|<--  new mReadAvailable  -->|
+    this.mReadAvailable = this.mCurrentParcelSize - newIndex;
 
-/**
- * Write incoming data to the circular buffer.
- *
- * @param incoming
- *        Uint8Array containing the incoming data.
- */
-function writeToIncoming(incoming) {
-  // We don't have to worry about the head catching the tail since
-  // we process any backlog in parcels immediately, before writing
-  // new data to the buffer. So the only edge case we need to handle
-  // is when the incoming data is larger than the buffer size.
-  let minMustAvailableSize = incoming.length + mReadIncoming;
-  if (minMustAvailableSize > mIncomingBufferLength) {
-    growIncomingBuffer(minMustAvailableSize);
-  }
+    // Translate back:
+    if (this.mIncomingReadIndex < cur) {
+      // The mIncomingReadIndex is wrapped.
+      newIndex += this.mIncomingBufferLength;
+    }
+    newIndex += (this.mIncomingReadIndex - cur);
+    newIndex %= this.mIncomingBufferLength;
+    this.mIncomingReadIndex = newIndex;
+  },
+
+  readUint8Unchecked: function readUint8Unchecked() {
+    let value = this.mIncomingBytes[this.mIncomingReadIndex];
+    this.mIncomingReadIndex = (this.mIncomingReadIndex + 1) %
+                             this.mIncomingBufferLength;
+    return value;
+  },
 
-  // We can let the typed arrays do the copying if the incoming data won't
-  // wrap around the edges of the circular buffer.
-  let remaining = mIncomingBufferLength - mIncomingWriteIndex;
-  if (remaining >= incoming.length) {
-    mIncomingBytes.set(incoming, mIncomingWriteIndex);
-  } else {
-    // The incoming data would wrap around it.
-    let head = incoming.subarray(0, remaining);
-    let tail = incoming.subarray(remaining);
-    mIncomingBytes.set(head, mIncomingWriteIndex);
-    mIncomingBytes.set(tail, 0);
-  }
-  mIncomingWriteIndex = (mIncomingWriteIndex + incoming.length) %
-                            mIncomingBufferLength;
-}
+  readUint8: function readUint8() {
+    // Translate to 0..mCurrentParcelSize
+    let cur = this.mCurrentParcelSize - this.mReadAvailable;
+    this.ensureIncomingAvailable(cur);
+
+    this.mReadAvailable--;
+    return this.readUint8Unchecked();
+  },
 
-/**
- * Process incoming data.
- *
- * @param incoming
- *        Uint8Array containing the incoming data.
- */
-function processIncoming(incoming) {
-  if (DEBUG) {
-    debug("Received " + incoming.length + " bytes.");
-    debug("Already read " + mReadIncoming);
-  }
+  readUint8Array: function readUint8Array(length) {
+    // Translate to 0..mCurrentParcelSize
+    let last = this.mCurrentParcelSize - this.mReadAvailable;
+    last += (length - 1);
+    this.ensureIncomingAvailable(last);
 
-  writeToIncoming(incoming);
-  mReadIncoming += incoming.length;
-  while (true) {
-    if (!mCurrentParcelSize) {
-      // We're expecting a new parcel.
-      if (mReadIncoming < PARCEL_SIZE_SIZE) {
-        // We don't know how big the next parcel is going to be, need more
-        // data.
-        if (DEBUG) debug("Next parcel size unknown, going to sleep.");
-        return;
-      }
-      mCurrentParcelSize = readParcelSize();
-      if (DEBUG) debug("New incoming parcel of size " +
-                       mCurrentParcelSize);
-      // The size itself is not included in the size.
-      mReadIncoming -= PARCEL_SIZE_SIZE;
+    let array = new Uint8Array(length);
+    for (let i = 0; i < length; i++) {
+      array[i] = this.readUint8Unchecked();
     }
 
-    if (mReadIncoming < mCurrentParcelSize) {
-      // We haven't read enough yet in order to be able to process a parcel.
-      if (DEBUG) debug("Read " + mReadIncoming + ", but parcel size is "
-                       + mCurrentParcelSize + ". Going to sleep.");
+    this.mReadAvailable -= length;
+    return array;
+  },
+
+  readUint16: function readUint16() {
+    return this.readUint8() | this.readUint8() << 8;
+  },
+
+  readUint32: function readUint32() {
+    return this.readUint8()       | this.readUint8() <<  8 |
+           this.readUint8() << 16 | this.readUint8() << 24;
+  },
+
+  readUint32List: function readUint32List() {
+    let length = this.readUint32();
+    let ints = [];
+    for (let i = 0; i < length; i++) {
+      ints.push(this.readUint32());
+    }
+    return ints;
+  },
+
+  readString: function readString() {
+    let string_len = this.readUint32();
+    if (string_len < 0 || string_len >= INT32_MAX) {
+      return null;
+    }
+    let s = "";
+    for (let i = 0; i < string_len; i++) {
+      s += String.fromCharCode(this.readUint16());
+    }
+    // Strings are \0\0 delimited, but that isn't part of the length. And
+    // if the string length is even, the delimiter is two characters wide.
+    // It's insane, I know.
+    this.readStringDelimiter(string_len);
+    return s;
+  },
+
+  readStringList: function readStringList() {
+    let num_strings = this.readUint32();
+    let strings = [];
+    for (let i = 0; i < num_strings; i++) {
+      strings.push(this.readString());
+    }
+    return strings;
+  },
+
+  readStringDelimiter: function readStringDelimiter(length) {
+    let delimiter = this.readUint16();
+    if (!(length & 1)) {
+      delimiter |= this.readUint16();
+    }
+    if (DEBUG) {
+      if (delimiter !== 0) {
+        debug("Something's wrong, found string delimiter: " + delimiter);
+      }
+    }
+  },
+
+  readParcelSize: function readParcelSize() {
+    return this.readUint8Unchecked() << 24 |
+           this.readUint8Unchecked() << 16 |
+           this.readUint8Unchecked() <<  8 |
+           this.readUint8Unchecked();
+  },
+
+  /**
+   * Functions for writing data to the outgoing buffer.
+   */
+
+  /**
+   * Ensure position specified is writable.
+   *
+   * @param index
+   *        Data position in outgoing parcel, valid from 0 to
+   *        mOutgoingBufferLength.
+   */
+  ensureOutgoingAvailable: function ensureOutgoingAvailable(index) {
+    if (index >= this.mOutgoingBufferLength) {
+      this.growOutgoingBuffer(index + 1);
+    }
+  },
+
+  writeUint8: function writeUint8(value) {
+    this.ensureOutgoingAvailable(this.mOutgoingIndex);
+
+    this.mOutgoingBytes[this.mOutgoingIndex] = value;
+    this.mOutgoingIndex++;
+  },
+
+  writeUint16: function writeUint16(value) {
+    this.writeUint8(value & 0xff);
+    this.writeUint8((value >> 8) & 0xff);
+  },
+
+  writeUint32: function writeUint32(value) {
+    this.writeUint8(value & 0xff);
+    this.writeUint8((value >> 8) & 0xff);
+    this.writeUint8((value >> 16) & 0xff);
+    this.writeUint8((value >> 24) & 0xff);
+  },
+
+  writeString: function writeString(value) {
+    if (value == null) {
+      this.writeUint32(-1);
+      return;
+    }
+    this.writeUint32(value.length);
+    for (let i = 0; i < value.length; i++) {
+      this.writeUint16(value.charCodeAt(i));
+    }
+    // Strings are \0\0 delimited, but that isn't part of the length. And
+    // if the string length is even, the delimiter is two characters wide.
+    // It's insane, I know.
+    this.writeStringDelimiter(value.length);
+  },
+
+  writeStringList: function writeStringList(strings) {
+    this.writeUint32(strings.length);
+    for (let i = 0; i < strings.length; i++) {
+      this.writeString(strings[i]);
+    }
+  },
+
+  writeStringDelimiter: function writeStringDelimiter(length) {
+    this.writeUint16(0);
+    if (!(length & 1)) {
+      this.writeUint16(0);
+    }
+  },
+
+  writeParcelSize: function writeParcelSize(value) {
+    /**
+     *  Parcel size will always be the first thing in the parcel byte
+     *  array, but the last thing written. Store the current index off
+     *  to a temporary to be reset after we write the size.
+     */
+    let currentIndex = this.mOutgoingIndex;
+    this.mOutgoingIndex = 0;
+    this.writeUint8((value >> 24) & 0xff);
+    this.writeUint8((value >> 16) & 0xff);
+    this.writeUint8((value >> 8) & 0xff);
+    this.writeUint8(value & 0xff);
+    this.mOutgoingIndex = currentIndex;
+  },
+
+  copyIncomingToOutgoing: function copyIncomingToOutgoing(length) {
+    if (!length || (length < 0)) {
       return;
     }
 
-    // Alright, we have enough data to process at least one whole parcel.
-    // Let's do that.
-    let expectedAfterIndex = (mIncomingReadIndex + mCurrentParcelSize)
-                             % mIncomingBufferLength;
+    let translatedReadIndexEnd =
+      this.mCurrentParcelSize - this.mReadAvailable + length - 1;
+    this.ensureIncomingAvailable(translatedReadIndexEnd);
+
+    let translatedWriteIndexEnd = this.mOutgoingIndex + length - 1;
+    this.ensureOutgoingAvailable(translatedWriteIndexEnd);
 
-    if (DEBUG) {
-      let parcel;
-      if (expectedAfterIndex < mIncomingReadIndex) {
-        let head = mIncomingBytes.subarray(mIncomingReadIndex);
-        let tail = mIncomingBytes.subarray(0, expectedAfterIndex);
-        parcel = Array.slice(head).concat(Array.slice(tail));
-      } else {
-        parcel = Array.slice(mIncomingBytes.subarray(
-          mIncomingReadIndex, expectedAfterIndex));
+    let newIncomingReadIndex = this.mIncomingReadIndex + length;
+    if (newIncomingReadIndex < this.mIncomingBufferLength) {
+      // Reading won't cause wrapping, go ahead with builtin copy.
+      this.mOutgoingBytes
+          .set(this.mIncomingBytes.subarray(this.mIncomingReadIndex,
+                                            newIncomingReadIndex),
+               this.mOutgoingIndex);
+    } else {
+      // Not so lucky.
+      newIncomingReadIndex %= this.mIncomingBufferLength;
+      this.mOutgoingBytes
+          .set(this.mIncomingBytes.subarray(this.mIncomingReadIndex,
+                                            this.mIncomingBufferLength),
+               this.mOutgoingIndex);
+      if (newIncomingReadIndex) {
+        let firstPartLength = this.mIncomingBufferLength - this.mIncomingReadIndex;
+        this.mOutgoingBytes.set(this.mIncomingBytes.subarray(0, newIncomingReadIndex),
+                               this.mOutgoingIndex + firstPartLength);
       }
-      debug("Parcel (size " + mCurrentParcelSize + "): " + parcel);
     }
 
-    if (DEBUG) debug("We have at least one complete parcel.");
-    try {
-      mReadAvailable = mCurrentParcelSize;
-      processParcel();
-    } catch (ex) {
-      if (DEBUG) debug("Parcel handling threw " + ex + "\n" + ex.stack);
+    this.mIncomingReadIndex = newIncomingReadIndex;
+    this.mReadAvailable -= length;
+    this.mOutgoingIndex += length;
+  },
+
+  /**
+   * Parcel management
+   */
+
+  /**
+   * Write incoming data to the circular buffer.
+   *
+   * @param incoming
+   *        Uint8Array containing the incoming data.
+   */
+  writeToIncoming: function writeToIncoming(incoming) {
+    // We don't have to worry about the head catching the tail since
+    // we process any backlog in parcels immediately, before writing
+    // new data to the buffer. So the only edge case we need to handle
+    // is when the incoming data is larger than the buffer size.
+    let minMustAvailableSize = incoming.length + this.mReadIncoming;
+    if (minMustAvailableSize > this.mIncomingBufferLength) {
+      this.growIncomingBuffer(minMustAvailableSize);
+    }
+
+    // We can let the typed arrays do the copying if the incoming data won't
+    // wrap around the edges of the circular buffer.
+    let remaining = this.mIncomingBufferLength - this.mIncomingWriteIndex;
+    if (remaining >= incoming.length) {
+      this.mIncomingBytes.set(incoming, this.mIncomingWriteIndex);
+    } else {
+      // The incoming data would wrap around it.
+      let head = incoming.subarray(0, remaining);
+      let tail = incoming.subarray(remaining);
+      this.mIncomingBytes.set(head, this.mIncomingWriteIndex);
+      this.mIncomingBytes.set(tail, 0);
+    }
+    this.mIncomingWriteIndex = (this.mIncomingWriteIndex + incoming.length) %
+                               this.mIncomingBufferLength;
+  },
+
+  /**
+   * Process incoming data.
+   *
+   * @param incoming
+   *        Uint8Array containing the incoming data.
+   */
+  processIncoming: function processIncoming(incoming) {
+    if (DEBUG) {
+      debug("Received " + incoming.length + " bytes.");
+      debug("Already read " + this.mReadIncoming);
     }
 
-    // Ensure that the whole parcel was consumed.
-    if (mIncomingReadIndex != expectedAfterIndex) {
-      if (DEBUG) {
-        debug("Parcel handler didn't consume whole parcel, " +
-              Math.abs(expectedAfterIndex - mIncomingReadIndex) +
-              " bytes left over");
+    this.writeToIncoming(incoming);
+    this.mReadIncoming += incoming.length;
+    while (true) {
+      if (!this.mCurrentParcelSize) {
+        // We're expecting a new parcel.
+        if (this.mReadIncoming < this.PARCEL_SIZE_SIZE) {
+          // We don't know how big the next parcel is going to be, need more
+          // data.
+          if (DEBUG) debug("Next parcel size unknown, going to sleep.");
+          return;
+        }
+        this.mCurrentParcelSize = this.readParcelSize();
+        if (DEBUG) {
+          debug("New incoming parcel of size " + this.mCurrentParcelSize);
+        }
+        // The size itself is not included in the size.
+        this.mReadIncoming -= this.PARCEL_SIZE_SIZE;
       }
-      mIncomingReadIndex = expectedAfterIndex;
-    }
-    mReadIncoming -= mCurrentParcelSize;
-    mReadAvailable = 0;
-    mCurrentParcelSize = 0;
-  }
-}
+
+      if (this.mReadIncoming < this.mCurrentParcelSize) {
+        // We haven't read enough yet in order to be able to process a parcel.
+        if (DEBUG) debug("Read " + this.mReadIncoming + ", but parcel size is "
+                         + this.mCurrentParcelSize + ". Going to sleep.");
+        return;
+      }
+
+      // Alright, we have enough data to process at least one whole parcel.
+      // Let's do that.
+      let expectedAfterIndex = (this.mIncomingReadIndex + this.mCurrentParcelSize)
+                               % this.mIncomingBufferLength;
 
-/**
- * Process one parcel.
- */
-function processParcel() {
-  let response_type = readUint32();
+      if (DEBUG) {
+        let parcel;
+        if (expectedAfterIndex < this.mIncomingReadIndex) {
+          let head = this.mIncomingBytes.subarray(this.mIncomingReadIndex);
+          let tail = this.mIncomingBytes.subarray(0, expectedAfterIndex);
+          parcel = Array.slice(head).concat(Array.slice(tail));
+        } else {
+          parcel = Array.slice(this.mIncomingBytes.subarray(
+            this.mIncomingReadIndex, expectedAfterIndex));
+        }
+        debug("Parcel (size " + this.mCurrentParcelSize + "): " + parcel);
+      }
 
-  let request_type, options;
-  if (response_type == RESPONSE_TYPE_SOLICITED) {
-    let token = readUint32();
-    let error = readUint32();
+      if (DEBUG) debug("We have at least one complete parcel.");
+      try {
+        this.mReadAvailable = this.mCurrentParcelSize;
+        this.processParcel();
+      } catch (ex) {
+        if (DEBUG) debug("Parcel handling threw " + ex + "\n" + ex.stack);
+      }
 
-    options = mTokenRequestMap[token];
-    if (!options) {
-      if (DEBUG) {
-        debug("Suspicious uninvited request found: " + token + ". Ignored!");
+      // Ensure that the whole parcel was consumed.
+      if (this.mIncomingReadIndex != expectedAfterIndex) {
+        if (DEBUG) {
+          debug("Parcel handler didn't consume whole parcel, " +
+                Math.abs(expectedAfterIndex - this.mIncomingReadIndex) +
+                " bytes left over");
+        }
+        this.mIncomingReadIndex = expectedAfterIndex;
       }
-      return;
+      this.mReadIncoming -= this.mCurrentParcelSize;
+      this.mReadAvailable = 0;
+      this.mCurrentParcelSize = 0;
     }
+  },
 
-    delete mTokenRequestMap[token];
-    request_type = options.rilRequestType;
+  /**
+   * Communicate with the IPC thread.
+   */
+  sendParcel: function sendParcel() {
+    // Compute the size of the parcel and write it to the front of the parcel
+    // where we left room for it. Note that he parcel size does not include
+    // the size itself.
+    let parcelSize = this.mOutgoingIndex - this.PARCEL_SIZE_SIZE;
+    this.writeParcelSize(parcelSize);
 
-    options.rilRequestError = error;
-    if (DEBUG) {
-      debug("Solicited response for request type " + request_type +
-            ", token " + token + ", error " + error);
-    }
-  } else if (response_type == RESPONSE_TYPE_UNSOLICITED) {
-    request_type = readUint32();
-    if (DEBUG) debug("Unsolicited response for request type " + request_type);
-  } else {
-    if (DEBUG) debug("Unknown response type: " + response_type);
-    return;
+    // This assumes that postRILMessage will make a copy of the ArrayBufferView
+    // right away!
+    let parcel = this.mOutgoingBytes.subarray(0, this.mOutgoingIndex);
+    if (DEBUG) debug("Outgoing parcel: " + Array.slice(parcel));
+    this.onSendParcel(parcel);
+    this.mOutgoingIndex = this.PARCEL_SIZE_SIZE;
+  },
+
+  getCurrentParcelSize: function getCurrentParcelSize() {
+    return this.mCurrentParcelSize;
+  },
+
+  getReadAvailable: function getReadAvailable() {
+    return this.mReadAvailable;
   }
 
-  RIL.handleParcel(request_type, mReadAvailable, options);
-}
-
-/**
- * Start a new outgoing parcel.
- *
- * @param type
- *        Integer specifying the request type.
- * @param options [optional]
- *        Object containing information about the request, e.g. the
- *        original main thread message object that led to the RIL request.
- */
-function newParcel(type, options) {
-  if (DEBUG) debug("New outgoing parcel of type " + type);
-
-  // We're going to leave room for the parcel size at the beginning.
-  mOutgoingIndex = PARCEL_SIZE_SIZE;
-  writeUint32(type);
-  writeUint32(mToken);
-
-  if (!options) {
-    options = {};
-  }
-  options.rilRequestType = type;
-  options.rilRequestError = null;
-  mTokenRequestMap[mToken] = options;
-  mToken++;
-  return mToken;
-}
-
-/**
- * Communicate with the RIL IPC thread.
- */
-function sendParcel() {
-  // Compute the size of the parcel and write it to the front of the parcel
-  // where we left room for it. Note that he parcel size does not include
-  // the size itself.
-  let parcelSize = mOutgoingIndex - PARCEL_SIZE_SIZE;
-  writeParcelSize(parcelSize);
+  /**
+   * Process one parcel.
+   *
+   * |processParcel| is an implementation provided incoming parcel processing
+   * function invoked when we have received a complete parcel.  Implementation
+   * may call multiple read functions to extract data from the incoming buffer.
+   */
+  //processParcel: function processParcel() {
+  //  let something = this.readUint32();
+  //  ...
+  //},
 
-  // This assumes that postRILMessage will make a copy of the ArrayBufferView
-  // right away!
-  let parcel = mOutgoingBytes.subarray(0, mOutgoingIndex);
-  if (DEBUG) debug("Outgoing parcel: " + Array.slice(parcel));
-  mOutputStream(parcel);
-  mOutgoingIndex = PARCEL_SIZE_SIZE;
-}
-
-function setOutputStream(func) {
-  mOutputStream = func;
-}
-
-function simpleRequest(type, options) {
-  newParcel(type, options);
-  sendParcel();
-}
-
-function getCurrentParcelSize() {
-  return mCurrentParcelSize;
-}
-
-function getReadAvailable() {
-  return mReadAvailable;
-}
+  /**
+   * Write raw data out to underlying channel.
+   *
+   * |onSendParcel| is an implementation provided stream output function
+   * invoked when we're really going to write something out.  We assume the
+   * data are completely copied to some output buffer in this call and may
+   * be destroyed when it's done.
+   *
+   * @param parcel
+   *        An array of numeric octet data.
+   */
+  //onSendParcel: function onSendParcel(parcel) {
+  //  ...
+  //}
+};
 
-module.exports = {
-  init: init,
-  startCalOutgoingSize: startCalOutgoingSize,
-  stopCalOutgoingSize: stopCalOutgoingSize,
-  seekIncoming: seekIncoming,
-  readUint8: readUint8,
-  readUint8Array: readUint8Array,
-  readUint16: readUint16,
-  readUint32: readUint32,
-  readUint32List: readUint32List,
-  readString: readString,
-  readStringList: readStringList,
-  readStringDelimiter: readStringDelimiter,
-  writeUint8: writeUint8,
-  writeUint16: writeUint16,
-  writeUint32: writeUint32,
-  writeString: writeString,
-  writeStringList: writeStringList,
-  writeStringDelimiter: writeStringDelimiter,
-  copyIncomingToOutgoing: copyIncomingToOutgoing,
-  processIncoming: processIncoming,
-  newParcel: newParcel,
-  sendParcel: sendParcel,
-  simpleRequest: simpleRequest,
-  setOutputStream: setOutputStream,
-  getCurrentParcelSize: getCurrentParcelSize,
-  getReadAvailable: getReadAvailable,
-};
+module.exports = { Buf: Buf };
--- a/ipc/dbus/DBusThread.cpp
+++ b/ipc/dbus/DBusThread.cpp
@@ -474,21 +474,23 @@ public:
           while (dbus_connection_dispatch(mConnection->GetConnection()) ==
                  DBUS_DISPATCH_DATA_REMAINS)
           {}
         }
         ++i;
       }
     }
 
+    mConnection->CleanUp();
+
     return NS_OK;
   }
 
 private:
-  DBusThread* mConnection;
+  nsRefPtr<DBusThread> mConnection;
 };
 
 static StaticRefPtr<DBusThread> gDBusThread;
 static StaticRefPtr<nsIThread>  gDBusServiceThread;
 
 // Startup/Shutdown utility functions
 
 bool
@@ -527,52 +529,48 @@ StartDBus()
 }
 
 bool
 StopDBus()
 {
   MOZ_ASSERT(!NS_IsMainThread());
   NS_ENSURE_TRUE(gDBusServiceThread, true);
 
-  if (gDBusThread) {
+  nsRefPtr<DBusThread> dbusThread(gDBusThread);
+  gDBusThread = nullptr;
+
+  if (dbusThread) {
     static const char data = DBUS_EVENT_LOOP_EXIT;
-    ssize_t wret = TEMP_FAILURE_RETRY(write(gDBusThread->mControlFdW.get(),
+    ssize_t wret = TEMP_FAILURE_RETRY(write(dbusThread->mControlFdW.get(),
                                             &data, sizeof(data)));
     NS_ENSURE_TRUE(wret == 1, false);
   }
 
-#ifdef DEBUG
-  LOG("DBus Thread Joining\n");
-#endif
-
-  if (NS_FAILED(gDBusServiceThread->Shutdown())) {
-    NS_WARNING("DBus thread shutdown failed!");
-  }
+  nsRefPtr<nsIThread> dbusServiceThread(gDBusServiceThread);
   gDBusServiceThread = nullptr;
 
-#ifdef DEBUG
-  LOG("DBus Thread Joined\n");
-#endif
-
-  if (gDBusThread) {
-    gDBusThread->CleanUp();
-    gDBusThread = nullptr;
-  }
+  nsRefPtr<nsIRunnable> runnable =
+    NS_NewRunnableMethod(dbusServiceThread, &nsIThread::Shutdown);
+  nsresult rv = NS_DispatchToMainThread(runnable);
+  NS_ENSURE_SUCCESS(rv, false);
 
   return true;
 }
 
 nsresult
 DispatchToDBusThread(nsIRunnable* event)
 {
-  MOZ_ASSERT(gDBusServiceThread);
-  MOZ_ASSERT(gDBusThread);
+  nsRefPtr<nsIThread> dbusServiceThread(gDBusServiceThread);
+  nsRefPtr<DBusThread> dbusThread(gDBusThread);
 
-  nsresult rv = gDBusServiceThread->Dispatch(event, NS_DISPATCH_NORMAL);
+  NS_ENSURE_TRUE(dbusServiceThread.get() && dbusThread.get(),
+                 NS_ERROR_NOT_INITIALIZED);
+
+  nsresult rv = dbusServiceThread->Dispatch(event, NS_DISPATCH_NORMAL);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  gDBusThread->WakeUp();
+  dbusThread->WakeUp();
 
   return NS_OK;
 }
 
 }
 }
--- a/widget/android/AndroidBridge.cpp
+++ b/widget/android/AndroidBridge.cpp
@@ -1653,26 +1653,28 @@ AndroidBridge::SetURITitle(const nsAStri
     AutoLocalJNIFrame jniFrame(env);
     jstring jstrURI = NewJavaString(&jniFrame, aURI);
     jstring jstrTitle = NewJavaString(&jniFrame, aTitle);
     env->CallStaticVoidMethod(mGeckoAppShellClass, jSetUriTitle, jstrURI, jstrTitle);
 }
 
 nsresult
 AndroidBridge::GetSegmentInfoForText(const nsAString& aText,
-                                     dom::mobilemessage::SmsSegmentInfoData* aData)
+                                     nsIMobileMessageCallback* aRequest)
 {
 #ifndef MOZ_WEBSMS_BACKEND
     return NS_ERROR_FAILURE;
 #else
     ALOG_BRIDGE("AndroidBridge::GetSegmentInfoForText");
 
-    aData->segments() = 0;
-    aData->charsPerSegment() = 0;
-    aData->charsAvailableInLastSegment() = 0;
+    dom::mobilemessage::SmsSegmentInfoData data;
+
+    data.segments() = 0;
+    data.charsPerSegment() = 0;
+    data.charsAvailableInLastSegment() = 0;
 
     JNIEnv *env = GetJNIEnv();
     if (!env)
         return NS_ERROR_FAILURE;
 
     AutoLocalJNIFrame jniFrame(env);
     jstring jText = NewJavaString(&jniFrame, aText);
     jobject obj = env->CallStaticObjectMethod(mAndroidSmsMessageClass,
@@ -1681,23 +1683,27 @@ AndroidBridge::GetSegmentInfoForText(con
         return NS_ERROR_FAILURE;
 
     jintArray arr = static_cast<jintArray>(obj);
     if (!arr || env->GetArrayLength(arr) != 4)
         return NS_ERROR_FAILURE;
 
     jint* info = env->GetIntArrayElements(arr, JNI_FALSE);
 
-    aData->segments() = info[0]; // msgCount
-    aData->charsPerSegment() = info[2]; // codeUnitsRemaining
+    data.segments() = info[0]; // msgCount
+    data.charsPerSegment() = info[2]; // codeUnitsRemaining
     // segmentChars = (codeUnitCount + codeUnitsRemaining) / msgCount
-    aData->charsAvailableInLastSegment() = (info[1] + info[2]) / info[0];
+    data.charsAvailableInLastSegment() = (info[1] + info[2]) / info[0];
 
     env->ReleaseIntArrayElements(arr, info, JNI_ABORT);
-    return NS_OK;
+
+    // TODO Bug 908598 - Should properly use |QueueSmsRequest(...)| to queue up
+    // the nsIMobileMessageCallback just like other functions.
+    nsCOMPtr<nsIDOMMozSmsSegmentInfo> info = new SmsSegmentInfo(data);
+    return aRequest->NotifySegmentInfoForTextGot(info);
 #endif
 }
 
 void
 AndroidBridge::SendMessage(const nsAString& aNumber,
                            const nsAString& aMessage,
                            nsIMobileMessageCallback* aRequest)
 {
--- a/widget/android/AndroidBridge.h
+++ b/widget/android/AndroidBridge.h
@@ -351,17 +351,17 @@ public:
 
     void CloseCamera();
 
     void EnableBatteryNotifications();
     void DisableBatteryNotifications();
     void GetCurrentBatteryInformation(hal::BatteryInformation* aBatteryInfo);
 
     nsresult GetSegmentInfoForText(const nsAString& aText,
-                                   dom::mobilemessage::SmsSegmentInfoData* aData);
+                                   nsIMobileMessageCallback* aRequest);
     void SendMessage(const nsAString& aNumber, const nsAString& aText,
                      nsIMobileMessageCallback* aRequest);
     void GetMessage(int32_t aMessageId, nsIMobileMessageCallback* aRequest);
     void DeleteMessage(int32_t aMessageId, nsIMobileMessageCallback* aRequest);
     void CreateMessageList(const dom::mobilemessage::SmsFilterData& aFilter,
                            bool aReverse, nsIMobileMessageCallback* aRequest);
     void GetNextMessageInList(int32_t aListId, nsIMobileMessageCallback* aRequest);
     void ClearMessageList(int32_t aListId);