--- a/dom/push/PushServiceAndroidGCM.jsm
+++ b/dom/push/PushServiceAndroidGCM.jsm
@@ -177,16 +177,17 @@ this.PushServiceAndroidGCM = {
     console.debug("connect:", records);
     // It's possible for the registration or subscriptions backing the
     // PushService to not be registered with the underlying AndroidPushService.
     // Expire those that are unrecognized.
     return EventDispatcher.instance.sendRequestForResult({
       type: "PushServiceAndroidGCM:DumpSubscriptions",
     })
     .then(subscriptions => {
+      subscriptions = JSON.parse(subscriptions);
       console.debug("connect:", subscriptions);
       // subscriptions maps chid => subscription data.
       return Promise.all(records.map(record => {
         if (subscriptions.hasOwnProperty(record.keyID)) {
           console.debug("connect:", "hasOwnProperty", record.keyID);
           return Promise.resolve();
         }
         console.debug("connect:", "!hasOwnProperty", record.keyID);
@@ -220,16 +221,17 @@ this.PushServiceAndroidGCM = {
       appServerKey: appServerKey,
     }
     if (record.scope == FXA_PUSH_SCOPE) {
       message.service = "fxa";
     }
     // Caller handles errors.
     return EventDispatcher.instance.sendRequestForResult(message)
     .then(data => {
+      data = JSON.parse(data);
       console.debug("Got data:", data);
       return PushCrypto.generateKeys()
         .then(exportedKeys =>
           new PushRecordAndroidGCM({
             // Straight from autopush.
             channelID: data.channelID,
             pushEndpoint: data.endpoint,
             // Common to all PushRecord implementations.

--- a/mobile/android/base/java/org/mozilla/gecko/push/PushService.java
+++ b/mobile/android/base/java/org/mozilla/gecko/push/PushService.java
@@ -305,17 +305,17 @@ public class PushService implements Bund
             if ("PushServiceAndroidGCM:DumpSubscriptions".equals(event)) {
                 try {
                     final Map<String, PushSubscription> result = pushManager.allSubscriptionsForProfile(geckoProfile.getName());
 
                     final JSONObject json = new JSONObject();
                     for (Map.Entry<String, PushSubscription> entry : result.entrySet()) {
                         json.put(entry.getKey(), entry.getValue().toJSONObject());
                     }
-                    callback.sendSuccess(json);
+                    callback.sendSuccess(json.toString());
                 } catch (JSONException e) {
                     callback.sendError("Got exception handling message [" + event + "]: " + e.toString());
                 }
                 return;
             }
             if ("PushServiceAndroidGCM:RegisterUserAgent".equals(event)) {
                 try {
                     pushManager.registerUserAgent(geckoProfile.getName(), System.currentTimeMillis()); // For side-effects.
@@ -365,17 +365,17 @@ public class PushService implements Bund
                     json.put("endpoint", subscription.webpushEndpoint);
                 } catch (JSONException e) {
                     Log.e(LOG_TAG, "Got exception in " + event, e);
                     callback.sendError("Got exception handling message [" + event + "]: " + e.toString());
                     return;
                 }
 
                 Telemetry.sendUIEvent(TelemetryContract.Event.SAVE, TelemetryContract.Method.SERVICE, "dom-push-api");
-                callback.sendSuccess(json);
+                callback.sendSuccess(json.toString());
                 return;
             }
             if ("PushServiceAndroidGCM:UnsubscribeChannel".equals(event)) {
                 final String channelID = message.getString("channelID");
                 if (channelID == null) {
                     callback.sendError("channelID must not be null in " + event);
                     return;
                 }