Backed out changeset ed586ca080c0 (bug 1053966) for the same Mnw permafails it was backed out for previously.

b2g/chrome/content/payment.js

@@ -178,12 +178,13 @@ PaymentSettings.prototype = {
     }
 
     try {
-      if (!aSubject.key ||
-          (aSubject.key !== kRilDefaultDataServiceId &&
-           aSubject.key !== kRilDefaultPaymentServiceId)) {
+      let setting = JSON.parse(aData);
+      if (!setting.key ||
+          (setting.key !== kRilDefaultDataServiceId &&
+           setting.key !== kRilDefaultPaymentServiceId)) {
         return;
       }
-      this.setServiceId(aSubject.key, aSubject.value);
+      this.setServiceId(setting.key, setting.value);
     } catch (e) {
       LOGE(e);
     }

dom/audiochannel/AudioChannelService.cpp

@@ -20,7 +20,6 @@
 #include "nsComponentManagerUtils.h"
 #include "nsPIDOMWindow.h"
 #include "nsServiceManagerUtils.h"
-#include "mozilla/dom/SettingChangeNotificationBinding.h"
 
 #ifdef MOZ_WIDGET_GONK
 #include "nsJSUtils.h"
@@ -802,33 +801,48 @@ AudioChannelService::Observe(nsISupports* aSubject, const char* aTopic, const ch
   // To process the volume control on each audio channel according to
   // change of settings
   else if (!strcmp(aTopic, "mozsettings-changed")) {
-    AutoJSAPI jsapi;
-    jsapi.Init();
-    JSContext* cx = jsapi.cx();
-    RootedDictionary<SettingChangeNotification> setting(cx);
-    if (!WrappedJSToDictionary(cx, aSubject, setting)) {
+    AutoSafeJSContext cx;
+    nsDependentString dataStr(aData);
+    JS::Rooted<JS::Value> val(cx);
+    if (!JS_ParseJSON(cx, dataStr.get(), dataStr.Length(), &val) ||
+        !val.isObject()) {
       return NS_OK;
     }
-    if (!StringBeginsWith(setting.mKey, NS_LITERAL_STRING("audio.volume."))) {
+
+    JS::Rooted<JSObject*> obj(cx, &val.toObject());
+    JS::Rooted<JS::Value> key(cx);
+    if (!JS_GetProperty(cx, obj, "key", &key) ||
+        !key.isString()) {
       return NS_OK;
     }
-    if (!setting.mValue.isNumber()) {
+
+    JS::Rooted<JSString*> jsKey(cx, JS::ToString(cx, key));
+    if (!jsKey) {
       return NS_OK;
     }
-    
+    nsAutoJSString keyStr;
+    if (!keyStr.init(cx, jsKey) || keyStr.Find("audio.volume.", 0, false)) {
+      return NS_OK;
+    }
+
+    JS::Rooted<JS::Value> value(cx);
+    if (!JS_GetProperty(cx, obj, "value", &value) || !value.isInt32()) {
+      return NS_OK;
+    }
+
     nsCOMPtr<nsIAudioManager> audioManager = do_GetService(NS_AUDIOMANAGER_CONTRACTID);
     NS_ENSURE_TRUE(audioManager, NS_OK);
 
-    int32_t index = setting.mValue.toNumber();
-    if (setting.mKey.EqualsLiteral("audio.volume.content")) {
+    int32_t index = value.toInt32();
+    if (keyStr.EqualsLiteral("audio.volume.content")) {
       audioManager->SetAudioChannelVolume((int32_t)AudioChannel::Content, index);
-    } else if (setting.mKey.EqualsLiteral("audio.volume.notification")) {
+    } else if (keyStr.EqualsLiteral("audio.volume.notification")) {
       audioManager->SetAudioChannelVolume((int32_t)AudioChannel::Notification, index);
-    } else if (setting.mKey.EqualsLiteral("audio.volume.alarm")) {
+    } else if (keyStr.EqualsLiteral("audio.volume.alarm")) {
       audioManager->SetAudioChannelVolume((int32_t)AudioChannel::Alarm, index);
-    } else if (setting.mKey.EqualsLiteral("audio.volume.telephony")) {
+    } else if (keyStr.EqualsLiteral("audio.volume.telephony")) {
       audioManager->SetAudioChannelVolume((int32_t)AudioChannel::Telephony, index);
-    } else if (!setting.mKey.EqualsLiteral("audio.volume.bt_sco")) {
+    } else if (!keyStr.EqualsLiteral("audio.volume.bt_sco")) {
       // bt_sco is not a valid audio channel so we manipulate it in
       // AudioManager.cpp. And the others should not be used.
       // We didn't use MOZ_CRASH or MOZ_MAKE_COMPILER_ASSUME_IS_UNREACHABLE here

dom/bindings/BindingUtils.h

@@ -2959,21 +2959,25 @@ CallerSubsumes(JS::Handle<JS::Value> aValue)
 
 template<class T>
 inline bool
-WrappedJSToDictionary(JSContext* aCx, nsISupports* aObject, T& aDictionary)
+WrappedJSToDictionary(nsISupports* aObject, T& aDictionary)
 {
   nsCOMPtr<nsIXPConnectWrappedJS> wrappedObj = do_QueryInterface(aObject);
   if (!wrappedObj) {
     return false;
   }
 
-  JS::Rooted<JSObject*> obj(aCx, wrappedObj->GetJSObject());
+  AutoJSAPI jsapi;
+  jsapi.Init();
+
+  JSContext* cx = jsapi.cx();
+  JS::Rooted<JSObject*> obj(cx, wrappedObj->GetJSObject());
   if (!obj) {
     return false;
   }
 
-  JSAutoCompartment ac(aCx, obj);
-  JS::Rooted<JS::Value> v(aCx, JS::ObjectValue(*obj));
-  return aDictionary.Init(aCx, v);
+  JSAutoCompartment ac(cx, obj);
+  JS::Rooted<JS::Value> v(cx, OBJECT_TO_JSVAL(obj));
+  return aDictionary.Init(cx, v);
 }
 
 

dom/bluetooth/BluetoothService.cpp

@@ -36,7 +36,6 @@
 #include "nsITimer.h"
 #include "nsServiceManagerUtils.h"
 #include "nsXPCOM.h"
-#include "mozilla/dom/SettingChangeNotificationBinding.h"
 
 #if defined(MOZ_WIDGET_GONK)
 #include "cutils/properties.h"
@@ -563,44 +562,91 @@ BluetoothService::HandleStartupSettingsCheck(bool aEnable)
 }
 
 nsresult
-BluetoothService::HandleSettingsChanged(nsISupports* aSubject)
+BluetoothService::HandleSettingsChanged(const nsAString& aData)
 {
   MOZ_ASSERT(NS_IsMainThread());
 
   // The string that we're interested in will be a JSON string that looks like:
   //  {"key":"bluetooth.enabled","value":true}
 
-  AutoJSAPI jsapi;
-  jsapi.Init();
-  JSContext* cx = jsapi.cx();
-  RootedDictionary<SettingChangeNotification> setting(cx);
-  if (!WrappedJSToDictionary(cx, aSubject, setting)) {
+  AutoSafeJSContext cx;
+  if (!cx) {
     return NS_OK;
   }
-  if (setting.mKey.EqualsASCII(BLUETOOTH_DEBUGGING_SETTING)) {
-    if (!setting.mValue.isBoolean()) {
+
+  JS::Rooted<JS::Value> val(cx);
+  if (!JS_ParseJSON(cx, aData.BeginReading(), aData.Length(), &val)) {
+    return JS_ReportPendingException(cx) ? NS_OK : NS_ERROR_OUT_OF_MEMORY;
+  }
+
+  if (!val.isObject()) {
+    return NS_OK;
+  }
+
+  JS::Rooted<JSObject*> obj(cx, &val.toObject());
+
+  JS::Rooted<JS::Value> key(cx);
+  if (!JS_GetProperty(cx, obj, "key", &key)) {
+    MOZ_ASSERT(!JS_IsExceptionPending(cx));
+    return NS_ERROR_OUT_OF_MEMORY;
+  }
+
+  if (!key.isString()) {
+    return NS_OK;
+  }
+
+  // First, check if the string equals to BLUETOOTH_DEBUGGING_SETTING
+  bool match;
+  if (!JS_StringEqualsAscii(cx, key.toString(), BLUETOOTH_DEBUGGING_SETTING, &match)) {
+    MOZ_ASSERT(!JS_IsExceptionPending(cx));
+    return NS_ERROR_OUT_OF_MEMORY;
+  }
+
+  if (match) {
+    JS::Rooted<JS::Value> value(cx);
+    if (!JS_GetProperty(cx, obj, "value", &value)) {
+      MOZ_ASSERT(!JS_IsExceptionPending(cx));
+      return NS_ERROR_OUT_OF_MEMORY;
+    }
+
+    if (!value.isBoolean()) {
       MOZ_ASSERT(false, "Expecting a boolean for 'bluetooth.debugging.enabled'!");
       return NS_ERROR_UNEXPECTED;
     }
-  
-    SWITCH_BT_DEBUG(setting.mValue.toBoolean());
+
+    SWITCH_BT_DEBUG(value.toBoolean());
 
     return NS_OK;
   }
 
   // Second, check if the string is BLUETOOTH_ENABLED_SETTING
-  if (!setting.mKey.EqualsASCII(BLUETOOTH_ENABLED_SETTING)) {
-    return NS_OK;
-  }
-  if (!setting.mValue.isBoolean()) {
-    MOZ_ASSERT(false, "Expecting a boolean for 'bluetooth.enabled'!");
-    return NS_ERROR_UNEXPECTED;
+  if (!JS_StringEqualsAscii(cx, key.toString(), BLUETOOTH_ENABLED_SETTING, &match)) {
+    MOZ_ASSERT(!JS_IsExceptionPending(cx));
+    return NS_ERROR_OUT_OF_MEMORY;
   }
 
-  sToggleInProgress = true;
+  if (match) {
+    JS::Rooted<JS::Value> value(cx);
+    if (!JS_GetProperty(cx, obj, "value", &value)) {
+      MOZ_ASSERT(!JS_IsExceptionPending(cx));
+      return NS_ERROR_OUT_OF_MEMORY;
+    }
 
-  nsresult rv = StartStopBluetooth(setting.mValue.toBoolean(), false);
-  NS_ENSURE_SUCCESS(rv, rv);
+    if (!value.isBoolean()) {
+      MOZ_ASSERT(false, "Expecting a boolean for 'bluetooth.enabled'!");
+      return NS_ERROR_UNEXPECTED;
+    }
+
+    if (sToggleInProgress || value.toBoolean() == IsEnabled()) {
+      // Nothing to do here.
+      return NS_OK;
+    }
+
+    sToggleInProgress = true;
+
+    nsresult rv = StartStopBluetooth(value.toBoolean(), false);
+    NS_ENSURE_SUCCESS(rv, rv);
+  }
 
   return NS_OK;
 }
@@ -711,7 +757,7 @@ BluetoothService::Observe(nsISupports* aSubject, const char* aTopic,
   }
 
   if (!strcmp(aTopic, MOZSETTINGS_CHANGED_ID)) {
-    return HandleSettingsChanged(aSubject);
+    return HandleSettingsChanged(nsDependentString(aData));
   }
 
   if (!strcmp(aTopic, NS_XPCOM_SHUTDOWN_OBSERVER_ID)) {

dom/bluetooth/BluetoothService.h

@@ -377,7 +377,7 @@ protected:
    * Called when "mozsettings-changed" observer topic fires.
    */
   nsresult
-  HandleSettingsChanged(nsISupports* aSubject);
+  HandleSettingsChanged(const nsAString& aData);
 
   /**
    * Called when XPCOM is shutting down.

dom/bluetooth/bluedroid/hfp/BluetoothHfpManager.cpp

@@ -27,8 +27,6 @@
 #include "nsRadioInterfaceLayer.h"
 #include "nsServiceManagerUtils.h"
 #include "nsThreadUtils.h"
-#include "mozilla/dom/BindingUtils.h"
-#include "mozilla/dom/SettingChangeNotificationBinding.h"
 
 #define MOZSETTINGS_CHANGED_ID               "mozsettings-changed"
 #define AUDIO_VOLUME_BT_SCO_ID               "audio.volume.bt_sco"
@@ -464,7 +462,7 @@ BluetoothHfpManager::Observe(nsISupports* aSubject,
                              const char16_t* aData)
 {
   if (!strcmp(aTopic, MOZSETTINGS_CHANGED_ID)) {
-    HandleVolumeChanged(aSubject);
+    HandleVolumeChanged(nsDependentString(aData));
   } else if (!strcmp(aTopic, NS_XPCOM_SHUTDOWN_OBSERVER_ID)) {
     HandleShutdown();
   } else {
@@ -563,28 +561,39 @@ public:
 };
 
 void
-BluetoothHfpManager::HandleVolumeChanged(nsISupports* aSubject)
+BluetoothHfpManager::HandleVolumeChanged(const nsAString& aData)
 {
   MOZ_ASSERT(NS_IsMainThread());
 
   // The string that we're interested in will be a JSON string that looks like:
   //  {"key":"volumeup", "value":10}
   //  {"key":"volumedown", "value":2}
-  AutoJSAPI jsapi;
-  jsapi.Init();
-  JSContext* cx = jsapi.cx();
-  RootedDictionary<dom::SettingChangeNotification> setting(cx);
-  if (!WrappedJSToDictionary(cx, aSubject, setting)) {
-    return;
-  }
-  if (!setting.mKey.EqualsASCII(AUDIO_VOLUME_BT_SCO_ID)) {
-    return;
-  }
-  if (!setting.mValue.isNumber()) {
+  JSContext* cx = nsContentUtils::GetSafeJSContext();
+  NS_ENSURE_TRUE_VOID(cx);
+
+  JS::Rooted<JS::Value> val(cx);
+  NS_ENSURE_TRUE_VOID(JS_ParseJSON(cx, aData.BeginReading(), aData.Length(), &val));
+  NS_ENSURE_TRUE_VOID(val.isObject());
+
+  JS::Rooted<JSObject*> obj(cx, &val.toObject());
+  JS::Rooted<JS::Value> key(cx);
+  if (!JS_GetProperty(cx, obj, "key", &key) || !key.isString()) {
     return;
   }
 
-  mCurrentVgs = setting.mValue.toNumber();
+  bool match;
+  if (!JS_StringEqualsAscii(cx, key.toString(), AUDIO_VOLUME_BT_SCO_ID, &match) ||
+      !match) {
+    return;
+  }
+
+  JS::Rooted<JS::Value> value(cx);
+  if (!JS_GetProperty(cx, obj, "value", &value) ||
+      !value.isNumber()) {
+    return;
+  }
+
+  mCurrentVgs = value.toNumber();
 
   // Adjust volume by headset and we don't have to send volume back to headset
   if (mReceiveVgsFlag) {

dom/bluetooth/bluedroid/hfp/BluetoothHfpManager.h

@@ -149,7 +149,7 @@ private:
   void Cleanup();
 
   void HandleShutdown();
-  void HandleVolumeChanged(nsISupports* aSubject);
+  void HandleVolumeChanged(const nsAString& aData);
   void Notify(const hal::BatteryInformation& aBatteryInfo);
 
   void NotifyConnectionStateChanged(const nsAString& aType);

dom/bluetooth/bluez/BluetoothHfpManager.cpp

@@ -23,8 +23,6 @@
 #include "nsIObserverService.h"
 #include "nsISettingsService.h"
 #include "nsServiceManagerUtils.h"
-#include "mozilla/dom/BindingUtils.h"
-#include "mozilla/dom/SettingChangeNotificationBinding.h"
 
 #ifdef MOZ_B2G_RIL
 #include "nsIDOMIccInfo.h"
@@ -207,7 +205,7 @@ BluetoothHfpManager::Observe(nsISupports* aSubject,
                              const char16_t* aData)
 {
   if (!strcmp(aTopic, MOZSETTINGS_CHANGED_ID)) {
-    HandleVolumeChanged(aSubject);
+    HandleVolumeChanged(nsDependentString(aData));
   } else if (!strcmp(aTopic, NS_XPCOM_SHUTDOWN_OBSERVER_ID)) {
     HandleShutdown();
   } else {
@@ -557,7 +555,7 @@ BluetoothHfpManager::NotifyDialer(const nsAString& aCommand)
 #endif // MOZ_B2G_RIL
 
 void
-BluetoothHfpManager::HandleVolumeChanged(nsISupports* aSubject)
+BluetoothHfpManager::HandleVolumeChanged(const nsAString& aData)
 {
   MOZ_ASSERT(NS_IsMainThread());
 
@@ -565,21 +563,32 @@ BluetoothHfpManager::HandleVolumeChanged(nsISupports* aSubject)
   //  {"key":"volumeup", "value":10}
   //  {"key":"volumedown", "value":2}
 
-  AutoJSAPI jsapi;
-  jsapi.Init();
-  JSContext* cx = jsapi.cx();
-  RootedDictionary<SettingChangeNotification> setting(cx);
-  if (!WrappedJSToDictionary(cx, aSubject, setting)) {
-    return;
-  }
-  if (!setting.mKey.EqualsASCII(AUDIO_VOLUME_BT_SCO_ID)) {
-    return;
-  }
-  if (!setting.mValue.isNumber()) {
+  JSContext* cx = nsContentUtils::GetSafeJSContext();
+  NS_ENSURE_TRUE_VOID(cx);
+
+  JS::Rooted<JS::Value> val(cx);
+  NS_ENSURE_TRUE_VOID(JS_ParseJSON(cx, aData.BeginReading(), aData.Length(), &val));
+  NS_ENSURE_TRUE_VOID(val.isObject());
+
+  JS::Rooted<JSObject*> obj(cx, &val.toObject());
+  JS::Rooted<JS::Value> key(cx);
+  if (!JS_GetProperty(cx, obj, "key", &key) || !key.isString()) {
     return;
   }
 
-  mCurrentVgs = setting.mValue.toNumber();
+  bool match;
+  if (!JS_StringEqualsAscii(cx, key.toString(), AUDIO_VOLUME_BT_SCO_ID, &match) ||
+      !match) {
+    return;
+  }
+
+  JS::Rooted<JS::Value> value(cx);
+  if (!JS_GetProperty(cx, obj, "value", &value)||
+      !value.isNumber()) {
+    return;
+  }
+
+  mCurrentVgs = value.toNumber();
 
   // Adjust volume by headset and we don't have to send volume back to headset
   if (mReceiveVgsFlag) {

dom/bluetooth/bluez/BluetoothHfpManager.h

@@ -149,7 +149,7 @@ private:
 
   BluetoothHfpManager();
   void HandleShutdown();
-  void HandleVolumeChanged(nsISupports* aSubject);
+  void HandleVolumeChanged(const nsAString& aData);
 
   bool Init();
   void Notify(const hal::BatteryInformation& aBatteryInfo);

dom/bluetooth2/BluetoothService.cpp

@@ -35,7 +35,6 @@
 #include "nsITimer.h"
 #include "nsServiceManagerUtils.h"
 #include "nsXPCOM.h"
-#include "mozilla/dom/SettingChangeNotificationBinding.h"
 
 #if defined(MOZ_WIDGET_GONK)
 #include "cutils/properties.h"
@@ -525,29 +524,60 @@ BluetoothService::HandleStartupSettingsCheck(bool aEnable)
 }
 
 nsresult
-BluetoothService::HandleSettingsChanged(nsISupports* aSubject)
+BluetoothService::HandleSettingsChanged(const nsAString& aData)
 {
   MOZ_ASSERT(NS_IsMainThread());
 
   // The string that we're interested in will be a JSON string that looks like:
   //  {"key":"bluetooth.enabled","value":true}
 
-  AutoJSAPI jsapi;
-  jsapi.Init();
-  JSContext* cx = jsapi.cx();
-  RootedDictionary<SettingChangeNotification> setting(cx);
-  if (!WrappedJSToDictionary(cx, aSubject, setting)) {
+  AutoSafeJSContext cx;
+  if (!cx) {
     return NS_OK;
   }
-  if (!setting.mKey.EqualsASCII(BLUETOOTH_DEBUGGING_SETTING)) {
-    return NS_OK;
-  }
-  if (!setting.mValue.isBoolean()) {
-    MOZ_ASSERT(false, "Expecting a boolean for 'bluetooth.debugging.enabled'!");
-    return NS_ERROR_UNEXPECTED;
-  }
 
-  SWITCH_BT_DEBUG(setting.mValue.toBoolean());
+  JS::Rooted<JS::Value> val(cx);
+  if (!JS_ParseJSON(cx, aData.BeginReading(), aData.Length(), &val)) {
+    return JS_ReportPendingException(cx) ? NS_OK : NS_ERROR_OUT_OF_MEMORY;
+  }
+
+  if (!val.isObject()) {
+    return NS_OK;
+  }
+
+  JS::Rooted<JSObject*> obj(cx, &val.toObject());
+
+  JS::Rooted<JS::Value> key(cx);
+  if (!JS_GetProperty(cx, obj, "key", &key)) {
+    MOZ_ASSERT(!JS_IsExceptionPending(cx));
+    return NS_ERROR_OUT_OF_MEMORY;
+  }
+
+  if (!key.isString()) {
+    return NS_OK;
+  }
+
+  // Check whether the string is BLUETOOTH_DEBUGGING_SETTING
+  bool match;
+  if (!JS_StringEqualsAscii(cx, key.toString(), BLUETOOTH_DEBUGGING_SETTING, &match)) {
+    MOZ_ASSERT(!JS_IsExceptionPending(cx));
+    return NS_ERROR_OUT_OF_MEMORY;
+  }
+
+  if (match) {
+    JS::Rooted<JS::Value> value(cx);
+    if (!JS_GetProperty(cx, obj, "value", &value)) {
+      MOZ_ASSERT(!JS_IsExceptionPending(cx));
+      return NS_ERROR_OUT_OF_MEMORY;
+    }
+
+    if (!value.isBoolean()) {
+      MOZ_ASSERT(false, "Expecting a boolean for 'bluetooth.debugging.enabled'!");
+      return NS_ERROR_UNEXPECTED;
+    }
+
+    SWITCH_BT_DEBUG(value.toBoolean());
+  }
 
   return NS_OK;
 }
@@ -658,7 +688,7 @@ BluetoothService::Observe(nsISupports* aSubject, const char* aTopic,
   }
 
   if (!strcmp(aTopic, MOZSETTINGS_CHANGED_ID)) {
-    return HandleSettingsChanged(aSubject);
+    return HandleSettingsChanged(nsDependentString(aData));
   }
 
   if (!strcmp(aTopic, NS_XPCOM_SHUTDOWN_OBSERVER_ID)) {

dom/bluetooth2/BluetoothService.h

@@ -376,7 +376,7 @@ protected:
    * Called when "mozsettings-changed" observer topic fires.
    */
   nsresult
-  HandleSettingsChanged(nsISupports* aSubject);
+  HandleSettingsChanged(const nsAString& aData);
 
   /**
    * Called when XPCOM is shutting down.

dom/bluetooth2/bluedroid/hfp/BluetoothHfpManager.cpp

@@ -27,7 +27,6 @@
 #include "nsRadioInterfaceLayer.h"
 #include "nsServiceManagerUtils.h"
 #include "nsThreadUtils.h"
-#include "mozilla/dom/SettingChangeNotificationBinding.h"
 
 #define MOZSETTINGS_CHANGED_ID               "mozsettings-changed"
 #define AUDIO_VOLUME_BT_SCO_ID               "audio.volume.bt_sco"
@@ -466,7 +465,7 @@ BluetoothHfpManager::Observe(nsISupports* aSubject,
                              const char16_t* aData)
 {
   if (!strcmp(aTopic, MOZSETTINGS_CHANGED_ID)) {
-    HandleVolumeChanged(aSubject);
+    HandleVolumeChanged(nsDependentString(aData));
   } else if (!strcmp(aTopic, NS_XPCOM_SHUTDOWN_OBSERVER_ID)) {
     HandleShutdown();
   } else {
@@ -565,29 +564,39 @@ public:
 };
 
 void
-BluetoothHfpManager::HandleVolumeChanged(nsISupports* aSubject)
+BluetoothHfpManager::HandleVolumeChanged(const nsAString& aData)
 {
   MOZ_ASSERT(NS_IsMainThread());
 
   // The string that we're interested in will be a JSON string that looks like:
   //  {"key":"volumeup", "value":10}
   //  {"key":"volumedown", "value":2}
+  JSContext* cx = nsContentUtils::GetSafeJSContext();
+  NS_ENSURE_TRUE_VOID(cx);
 
-  AutoJSAPI jsapi;
-  jsapi.Init();
-  JSContext* cx = jsapi.cx();
-  RootedDictionary<dom::SettingChangeNotification> setting(cx);
-  if (!WrappedJSToDictionary(cx, aSubject, setting)) {
-    return;
-  }
-  if (!setting.mKey.EqualsASCII(AUDIO_VOLUME_BT_SCO_ID)) {
-    return;
-  }
-  if (!setting.mValue.isNumber()) {
+  JS::Rooted<JS::Value> val(cx);
+  NS_ENSURE_TRUE_VOID(JS_ParseJSON(cx, aData.BeginReading(), aData.Length(), &val));
+  NS_ENSURE_TRUE_VOID(val.isObject());
+
+  JS::Rooted<JSObject*> obj(cx, &val.toObject());
+  JS::Rooted<JS::Value> key(cx);
+  if (!JS_GetProperty(cx, obj, "key", &key) || !key.isString()) {
     return;
   }
 
-  mCurrentVgs = setting.mValue.toNumber();
+  bool match;
+  if (!JS_StringEqualsAscii(cx, key.toString(), AUDIO_VOLUME_BT_SCO_ID, &match) ||
+      !match) {
+    return;
+  }
+
+  JS::Rooted<JS::Value> value(cx);
+  if (!JS_GetProperty(cx, obj, "value", &value) ||
+      !value.isNumber()) {
+    return;
+  }
+
+  mCurrentVgs = value.toNumber();
 
   // Adjust volume by headset and we don't have to send volume back to headset
   if (mReceiveVgsFlag) {

dom/bluetooth2/bluedroid/hfp/BluetoothHfpManager.h

@@ -147,7 +147,7 @@ private:
   bool Init();
 
   void HandleShutdown();
-  void HandleVolumeChanged(nsISupports* aSubject);
+  void HandleVolumeChanged(const nsAString& aData);
   void Notify(const hal::BatteryInformation& aBatteryInfo);
 
   void NotifyConnectionStateChanged(const nsAString& aType);

dom/bluetooth2/bluez/BluetoothHfpManager.cpp

@@ -23,7 +23,6 @@
 #include "nsIObserverService.h"
 #include "nsISettingsService.h"
 #include "nsServiceManagerUtils.h"
-#include "mozilla/dom/SettingChangeNotificationBinding.h"
 
 #ifdef MOZ_B2G_RIL
 #include "nsIDOMIccInfo.h"
@@ -206,7 +205,7 @@ BluetoothHfpManager::Observe(nsISupports* aSubject,
                              const char16_t* aData)
 {
   if (!strcmp(aTopic, MOZSETTINGS_CHANGED_ID)) {
-    HandleVolumeChanged(aSubject);
+    HandleVolumeChanged(nsDependentString(aData));
   } else if (!strcmp(aTopic, NS_XPCOM_SHUTDOWN_OBSERVER_ID)) {
     HandleShutdown();
   } else {
@@ -556,7 +555,7 @@ BluetoothHfpManager::NotifyDialer(const nsAString& aCommand)
 #endif // MOZ_B2G_RIL
 
 void
-BluetoothHfpManager::HandleVolumeChanged(nsISupports* aSubject)
+BluetoothHfpManager::HandleVolumeChanged(const nsAString& aData)
 {
   MOZ_ASSERT(NS_IsMainThread());
 
@@ -564,21 +563,32 @@ BluetoothHfpManager::HandleVolumeChanged(nsISupports* aSubject)
   //  {"key":"volumeup", "value":10}
   //  {"key":"volumedown", "value":2}
 
-  AutoJSAPI jsapi;
-  jsapi.Init();
-  JSContext* cx = jsapi.cx();
-  RootedDictionary<dom::SettingChangeNotification> setting(cx);
-  if (!WrappedJSToDictionary(cx, aSubject, setting)) {
-    return;
-  }
-  if (!setting.mKey.EqualsASCII(AUDIO_VOLUME_BT_SCO_ID)) {
-    return;
-  }
-  if (!setting.mValue.isNumber()) {
+  JSContext* cx = nsContentUtils::GetSafeJSContext();
+  NS_ENSURE_TRUE_VOID(cx);
+
+  JS::Rooted<JS::Value> val(cx);
+  NS_ENSURE_TRUE_VOID(JS_ParseJSON(cx, aData.BeginReading(), aData.Length(), &val));
+  NS_ENSURE_TRUE_VOID(val.isObject());
+
+  JS::Rooted<JSObject*> obj(cx, &val.toObject());
+  JS::Rooted<JS::Value> key(cx);
+  if (!JS_GetProperty(cx, obj, "key", &key) || !key.isString()) {
     return;
   }
 
-  mCurrentVgs = setting.mValue.toNumber();
+  bool match;
+  if (!JS_StringEqualsAscii(cx, key.toString(), AUDIO_VOLUME_BT_SCO_ID, &match) ||
+      !match) {
+    return;
+  }
+
+  JS::Rooted<JS::Value> value(cx);
+  if (!JS_GetProperty(cx, obj, "value", &value)||
+      !value.isNumber()) {
+    return;
+  }
+
+  mCurrentVgs = value.toNumber();
 
   // Adjust volume by headset and we don't have to send volume back to headset
   if (mReceiveVgsFlag) {

dom/bluetooth2/bluez/BluetoothHfpManager.h

@@ -149,7 +149,7 @@ private:
 
   BluetoothHfpManager();
   void HandleShutdown();
-  void HandleVolumeChanged(nsISupports* aSubject);
+  void HandleVolumeChanged(const nsAString& aData);
 
   bool Init();
   void Notify(const hal::BatteryInformation& aBatteryInfo);

dom/fmradio/FMRadioService.cpp

@@ -16,8 +16,6 @@
 #include "nsIObserverService.h"
 #include "nsISettingsService.h"
 #include "nsJSUtils.h"
-#include "mozilla/dom/BindingUtils.h"
-#include "mozilla/dom/SettingChangeNotificationBinding.h"
 
 #define BAND_87500_108000_kHz 1
 #define BAND_76000_108000_kHz 2
@@ -680,9 +678,9 @@ FMRadioService::CancelSeek(FMRadioReplyRunnable* aReplyRunnable)
 }
 
 NS_IMETHODIMP
-FMRadioService::Observe(nsISupports* aSubject,
-                        const char* aTopic,
-                        const char16_t* aData)
+FMRadioService::Observe(nsISupports * aSubject,
+                        const char * aTopic,
+                        const char16_t * aData)
 {
   MOZ_ASSERT(NS_IsMainThread());
   MOZ_ASSERT(sFMRadioService);
@@ -693,26 +691,47 @@ FMRadioService::Observe(nsISupports* aSubject,
 
   // The string that we're interested in will be a JSON string looks like:
   //  {"key":"airplaneMode.enabled","value":true}
-  AutoJSAPI jsapi;
-  jsapi.Init();
-  JSContext* cx = jsapi.cx();
-  RootedDictionary<dom::SettingChangeNotification> setting(cx);
-  if (!WrappedJSToDictionary(cx, aSubject, setting)) {
-    return NS_OK;
-  }
-  if (!setting.mKey.EqualsASCII(SETTING_KEY_AIRPLANEMODE_ENABLED)) {
-    return NS_OK;
-  }
-  if (!setting.mValue.isBoolean()) {
+  AutoSafeJSContext cx;
+  const nsDependentString dataStr(aData);
+  JS::Rooted<JS::Value> val(cx);
+  if (!JS_ParseJSON(cx, dataStr.get(), dataStr.Length(), &val) ||
+      !val.isObject()) {
+    NS_WARNING("Bad JSON string format.");
     return NS_OK;
   }
 
-  mAirplaneModeEnabled = setting.mValue.toBoolean();
-  mHasReadAirplaneModeSetting = true;
+  JS::Rooted<JSObject*> obj(cx, &val.toObject());
+  JS::Rooted<JS::Value> key(cx);
+  if (!JS_GetProperty(cx, obj, "key", &key) ||
+      !key.isString()) {
+    NS_WARNING("Failed to get string property `key`.");
+    return NS_OK;
+  }
 
-  // Disable the FM radio HW if Airplane mode is enabled.
-  if (mAirplaneModeEnabled) {
-    Disable(nullptr);
+  JS::Rooted<JSString*> jsKey(cx, key.toString());
+  nsAutoJSString keyStr;
+  if (!keyStr.init(cx, jsKey)) {
+    return NS_OK;
+  }
+
+  if (keyStr.EqualsLiteral(SETTING_KEY_AIRPLANEMODE_ENABLED)) {
+    JS::Rooted<JS::Value> value(cx);
+    if (!JS_GetProperty(cx, obj, "value", &value)) {
+      NS_WARNING("Failed to get property `value`.");
+      return NS_OK;
+    }
+
+    if (!value.isBoolean()) {
+      return NS_OK;
+    }
+
+    mAirplaneModeEnabled = value.toBoolean();
+    mHasReadAirplaneModeSetting = true;
+
+    // Disable the FM radio HW if Airplane mode is enabled.
+    if (mAirplaneModeEnabled) {
+      Disable(nullptr);
+    }
   }
 
   return NS_OK;

dom/geolocation/nsGeolocation.cpp

@@ -24,7 +24,6 @@
 #include "mozilla/Preferences.h"
 #include "mozilla/ClearOnShutdown.h"
 #include "mozilla/dom/PermissionMessageUtils.h"
-#include "mozilla/dom/SettingChangeNotificationBinding.h"
 
 class nsIPrincipal;
 
@@ -713,26 +712,36 @@ nsGeolocationService::~nsGeolocationService()
 }
 
 void
-nsGeolocationService::HandleMozsettingChanged(nsISupports* aSubject)
+nsGeolocationService::HandleMozsettingChanged(const char16_t* aData)
 {
     // The string that we're interested in will be a JSON string that looks like:
     //  {"key":"gelocation.enabled","value":true}
 
-    AutoJSAPI jsapi;
-    jsapi.Init();
-    JSContext* cx = jsapi.cx();
-    RootedDictionary<SettingChangeNotification> setting(cx);
-    if (!WrappedJSToDictionary(cx, aSubject, setting)) {
-      return;
-    }
-    if (!setting.mKey.EqualsASCII(GEO_SETINGS_ENABLED)) {
-      return;
-    }
-    if (!setting.mValue.isBoolean()) {
+    AutoSafeJSContext cx;
+
+    nsDependentString dataStr(aData);
+    JS::Rooted<JS::Value> val(cx);
+    if (!JS_ParseJSON(cx, dataStr.get(), dataStr.Length(), &val) || !val.isObject()) {
       return;
     }
 
-    HandleMozsettingValue(setting.mValue.toBoolean());
+    JS::Rooted<JSObject*> obj(cx, &val.toObject());
+    JS::Rooted<JS::Value> key(cx);
+    if (!JS_GetProperty(cx, obj, "key", &key) || !key.isString()) {
+      return;
+    }
+
+    bool match;
+    if (!JS_StringEqualsAscii(cx, key.toString(), GEO_SETINGS_ENABLED, &match) || !match) {
+      return;
+    }
+
+    JS::Rooted<JS::Value> value(cx);
+    if (!JS_GetProperty(cx, obj, "value", &value) || !value.isBoolean()) {
+      return;
+    }
+
+    HandleMozsettingValue(value.toBoolean());
 }
 
 void
@@ -777,7 +786,7 @@ nsGeolocationService::Observe(nsISupports* aSubject,
   }
 
   if (!strcmp("mozsettings-changed", aTopic)) {
-    HandleMozsettingChanged(aSubject);
+    HandleMozsettingChanged(aData);
     return NS_OK;
   }
 

dom/geolocation/nsGeolocation.h

@@ -70,7 +70,7 @@ public:
 
   nsresult Init();
 
-  void HandleMozsettingChanged(nsISupports* aSubject);
+  void HandleMozsettingChanged(const char16_t* aData);
   void HandleMozsettingValue(const bool aValue);
 
   // Management of the Geolocation objects

dom/settings/SettingsRequestManager.jsm

@@ -663,12 +663,12 @@ let SettingsRequestManager = {
   sendSettingsChange: function(aKey, aValue, aIsServiceLock) {
     this.broadcastMessage("Settings:Change:Return:OK",
       { key: aKey, value: aValue });
-    var setting = {
-      key: aKey,
-      value: aValue,
-      isInternalChange: aIsServiceLock
-    };
-    Services.obs.notifyObservers(setting, kMozSettingsChangedObserverTopic, "");
+    Services.obs.notifyObservers(this, kMozSettingsChangedObserverTopic,
+      JSON.stringify({
+        key: aKey,
+        value: aValue,
+        isInternalChange: aIsServiceLock
+      }));
   },
 
   broadcastMessage: function broadcastMessage(aMsgName, aContent) {

dom/system/NetworkGeolocationProvider.js

@@ -264,10 +264,11 @@ WifiGeoPositionProvider.prototype = {
     }
 
     try {
-      if (aSubject.key == SETTINGS_DEBUG_ENABLED) {
-        gLoggingEnabled = aSubject.value;
-      } else if (aSubject.key == SETTINGS_WIFI_ENABLED) {
-        gWifiScanningEnabled = aSubject.value;
+      let setting = JSON.parse(aData);
+      if (setting.key == SETTINGS_DEBUG_ENABLED) {
+        gLoggingEnabled = setting.value;
+      } else if (setting.key == SETTINGS_WIFI_ENABLED) {
+        gWifiScanningEnabled = setting.value;
       }
     } catch (e) {
     }

dom/system/gonk/AudioManager.cpp

@@ -41,8 +41,6 @@
 #include "nsServiceManagerUtils.h"
 #include "nsComponentManagerUtils.h"
 #include "nsXULAppAPI.h"
-#include "mozilla/dom/BindingUtils.h"
-#include "mozilla/dom/SettingChangeNotificationBinding.h"
 
 using namespace mozilla::dom::gonk;
 using namespace android;
@@ -352,21 +350,36 @@ AudioManager::Observe(nsISupports* aSubject,
   // To process the volume control on each audio channel according to
   // change of settings
   else if (!strcmp(aTopic, MOZ_SETTINGS_CHANGE_ID)) {
-    AutoJSAPI jsapi;
-    jsapi.Init();
-    JSContext* cx = jsapi.cx();
-    RootedDictionary<dom::SettingChangeNotification> setting(cx);
-    if (!WrappedJSToDictionary(cx, aSubject, setting)) {
-      return NS_OK;
-    }
-    if (!setting.mKey.EqualsASCII("audio.volume.bt_sco")) {
-      return NS_OK;
-    }
-    if (!setting.mValue.isNumber()) {
+    AutoSafeJSContext cx;
+    nsDependentString dataStr(aData);
+    JS::Rooted<JS::Value> val(cx);
+    if (!JS_ParseJSON(cx, dataStr.get(), dataStr.Length(), &val) ||
+        !val.isObject()) {
       return NS_OK;
     }
 
-    int32_t index = setting.mValue.toNumber();
+    JS::Rooted<JSObject*> obj(cx, &val.toObject());
+    JS::Rooted<JS::Value> key(cx);
+    if (!JS_GetProperty(cx, obj, "key", &key) ||
+        !key.isString()) {
+      return NS_OK;
+    }
+
+    JS::Rooted<JSString*> jsKey(cx, JS::ToString(cx, key));
+    if (!jsKey) {
+      return NS_OK;
+    }
+    nsAutoJSString keyStr;
+    if (!keyStr.init(cx, jsKey) || !keyStr.EqualsLiteral("audio.volume.bt_sco")) {
+      return NS_OK;
+    }
+
+    JS::Rooted<JS::Value> value(cx);
+    if (!JS_GetProperty(cx, obj, "value", &value) || !value.isInt32()) {
+      return NS_OK;
+    }
+
+    int32_t index = value.toInt32();
     SetStreamVolumeIndex(AUDIO_STREAM_BLUETOOTH_SCO, index);
 
     return NS_OK;

dom/system/gonk/AutoMounterSetting.cpp

@@ -20,8 +20,6 @@
 #include "xpcpublic.h"
 #include "mozilla/dom/ScriptSettings.h"
 #include "mozilla/Attributes.h"
-#include "mozilla/dom/BindingUtils.h"
-#include "mozilla/dom/SettingChangeNotificationBinding.h"
 
 #undef LOG
 #define LOG(args...)  __android_log_print(ANDROID_LOG_INFO, "AutoMounterSetting" , ## args)
@@ -33,8 +31,6 @@
 #define UMS_VOLUME_ENABLED_SUFFIX ".enabled"
 #define MOZSETTINGS_CHANGED       "mozsettings-changed"
 
-using namespace mozilla::dom;
-
 namespace mozilla {
 namespace system {
 
@@ -239,35 +235,52 @@ AutoMounterSetting::Observe(nsISupports* aSubject,
   // The string that we're interested in will be a JSON string that looks like:
   //  {"key":"ums.autoMount","value":true}
 
-  AutoJSAPI jsapi;
-  jsapi.Init();
-  JSContext* cx = jsapi.cx();
-  RootedDictionary<SettingChangeNotification> setting(cx);
-  if (!WrappedJSToDictionary(cx, aSubject, setting)) {
+  mozilla::AutoSafeJSContext cx;
+  nsDependentString dataStr(aData);
+  JS::Rooted<JS::Value> val(cx);
+  if (!JS_ParseJSON(cx, dataStr.get(), dataStr.Length(), &val) ||
+      !val.isObject()) {
+    return NS_OK;
+  }
+  JS::Rooted<JSObject*> obj(cx, &val.toObject());
+  JS::Rooted<JS::Value> key(cx);
+  if (!JS_GetProperty(cx, obj, "key", &key) ||
+      !key.isString()) {
+    return NS_OK;
+  }
+
+  JSString *jsKey = JS::ToString(cx, key);
+  nsAutoJSString keyStr;
+  if (!keyStr.init(cx, jsKey)) {
+    return NS_OK;
+  }
+
+  JS::Rooted<JS::Value> value(cx);
+  if (!JS_GetProperty(cx, obj, "value", &value)) {
     return NS_OK;
   }
 
   // Check for ums.mode changes
-  if (setting.mKey.EqualsASCII(UMS_MODE)) {
-    if (!setting.mValue.isInt32()) {
+  if (keyStr.EqualsLiteral(UMS_MODE)) {
+    if (!value.isInt32()) {
       return NS_OK;
     }
-    int32_t mode = setting.mValue.toInt32();
+    int32_t mode = value.toInt32();
     SetAutoMounterMode(mode);
     return NS_OK;
   }
 
   // Check for ums.volume.NAME.enabled
-  if (StringBeginsWith(setting.mKey, NS_LITERAL_STRING(UMS_VOLUME_ENABLED_PREFIX)) &&
-      StringEndsWith(setting.mKey, NS_LITERAL_STRING(UMS_VOLUME_ENABLED_SUFFIX))) {
-    if (!setting.mValue.isBoolean()) {
+  if (StringBeginsWith(keyStr, NS_LITERAL_STRING(UMS_VOLUME_ENABLED_PREFIX)) &&
+      StringEndsWith(keyStr, NS_LITERAL_STRING(UMS_VOLUME_ENABLED_SUFFIX))) {
+    if (!value.isBoolean()) {
       return NS_OK;
     }
     const size_t prefixLen = sizeof(UMS_VOLUME_ENABLED_PREFIX) - 1;
     const size_t suffixLen = sizeof(UMS_VOLUME_ENABLED_SUFFIX) - 1;
     nsDependentSubstring volumeName =
-      Substring(setting.mKey, prefixLen, setting.mKey.Length() - prefixLen - suffixLen);
-    bool isSharingEnabled = setting.mValue.toBoolean();
+      Substring(keyStr, prefixLen, keyStr.Length() - prefixLen - suffixLen);
+    bool isSharingEnabled = value.toBoolean();
     SetAutoMounterSharingMode(NS_LossyConvertUTF16toASCII(volumeName), isSharingEnabled);
     return NS_OK;
   }

dom/system/gonk/NetworkManager.js

@@ -220,7 +220,8 @@ NetworkManager.prototype = {
   observe: function(subject, topic, data) {
     switch (topic) {
       case TOPIC_MOZSETTINGS_CHANGED:
-        this.handle(subject.key, subject.value);
+        let setting = JSON.parse(data);
+        this.handle(setting.key, setting.value);
         break;
       case TOPIC_PREF_CHANGED:
         this._manageOfflineStatus =

dom/system/gonk/RadioInterfaceLayer.js

@@ -960,7 +960,8 @@ XPCOMUtils.defineLazyGetter(this, "gDataConnectionManager", function () {
     observe: function(subject, topic, data) {
       switch (topic) {
         case kMozSettingsChangedObserverTopic:
-          this.handle(subject.key, subject.value);
+          let setting = JSON.parse(data);
+          this.handle(setting.key, setting.value);
           break;
         case NS_XPCOM_SHUTDOWN_OBSERVER_ID:
           this._shutdown();
@@ -3051,7 +3052,8 @@ RadioInterface.prototype = {
   observe: function(subject, topic, data) {
     switch (topic) {
       case kMozSettingsChangedObserverTopic:
-        this.handleSettingsChange(subject.key, subject.value, subject.isInternalChange);
+        let setting = JSON.parse(data);
+        this.handleSettingsChange(setting.key, setting.value, setting.isInternalChange);
         break;
       case kSysClockChangeObserverTopic:
         let offset = parseInt(data, 10);

dom/system/gonk/TimeZoneSettingObserver.cpp

@@ -22,8 +22,6 @@
 #include "xpcpublic.h"
 #include "nsContentUtils.h"
 #include "nsPrintfCString.h"
-#include "mozilla/dom/BindingUtils.h"
-#include "mozilla/dom/SettingChangeNotificationBinding.h"
 
 #undef LOG
 #define LOG(args...)  __android_log_print(ANDROID_LOG_INFO, "Time Zone Setting" , ## args)
@@ -33,7 +31,6 @@
 #define MOZSETTINGS_CHANGED "mozsettings-changed"
 
 using namespace mozilla;
-using namespace mozilla::dom;
 
 namespace {
 
@@ -187,8 +184,8 @@ NS_IMPL_ISUPPORTS(TimeZoneSettingObserver, nsIObserver)
 
 NS_IMETHODIMP
 TimeZoneSettingObserver::Observe(nsISupports *aSubject,
-                                 const char *aTopic,
-                                 const char16_t *aData)
+                     const char *aTopic,
+                     const char16_t *aData)
 {
   if (strcmp(aTopic, MOZSETTINGS_CHANGED) != 0) {
     return NS_OK;
@@ -202,19 +199,37 @@ TimeZoneSettingObserver::Observe(nsISupports *aSubject,
   // {"key":"time.timezone","value":"UTC-05:00"}
 
   AutoSafeJSContext cx;
-  RootedDictionary<SettingChangeNotification> setting(cx);
-  if (!WrappedJSToDictionary(cx, aSubject, setting)) {
+
+  // Parse the JSON value.
+  nsDependentString dataStr(aData);
+  JS::Rooted<JS::Value> val(cx);
+  if (!JS_ParseJSON(cx, dataStr.get(), dataStr.Length(), &val) ||
+      !val.isObject()) {
     return NS_OK;
   }
-  if (!setting.mKey.EqualsASCII(TIME_TIMEZONE)) {
+
+  // Get the key, which should be the JS string "time.timezone".
+  JS::Rooted<JSObject*> obj(cx, &val.toObject());
+  JS::Rooted<JS::Value> key(cx);
+  if (!JS_GetProperty(cx, obj, "key", &key) ||
+      !key.isString()) {
     return NS_OK;
   }
-  if (!setting.mValue.isString()) {
+  bool match;
+  if (!JS_StringEqualsAscii(cx, key.toString(), TIME_TIMEZONE, &match) ||
+      !match) {
+    return NS_OK;
+  }
+
+  // Get the value, which should be a JS string like "America/Chicago".
+  JS::Rooted<JS::Value> value(cx);
+  if (!JS_GetProperty(cx, obj, "value", &value) ||
+      !value.isString()) {
     return NS_OK;
   }
 
   // Set the system timezone.
-  return SetTimeZone(setting.mValue, cx);
+  return SetTimeZone(value, cx);
 }
 
 } // anonymous namespace

dom/webidl/SettingChangeNotification.webidl

@@ -1,12 +0,0 @@
-/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this file,
- * You can obtain one at http://mozilla.org/MPL/2.0/.
- */
-
-// Used internally by Gecko
-dictionary SettingChangeNotification {
-  DOMString key   = "";
-  any       value;
-  boolean   isInternalChange = false;
-};

dom/webidl/moz.build

@@ -337,7 +337,6 @@ WEBIDL_FILES = [
     'ServiceWorkerContainer.webidl',
     'ServiceWorkerGlobalScope.webidl',
     'ServiceWorkerRegistration.webidl',
-    'SettingChangeNotification.webidl',
     'SettingsManager.webidl',
     'ShadowRoot.webidl',
     'SharedWorker.webidl',

dom/wifi/WifiWorker.js

@@ -3631,13 +3631,17 @@ WifiWorker.prototype = {
   observe: function observe(subject, topic, data) {
     switch (topic) {
     case kMozSettingsChangedObserverTopic:
+      // The string we're interested in will be a JSON string that looks like:
+      // {"key":"wifi.enabled","value":"true"}.
+
+      let setting = JSON.parse(data);
       // To avoid WifiWorker setting the wifi again, don't need to deal with
       // the "mozsettings-changed" event fired from internal setting.
-      if (subject.isInternalChange) {
+      if (setting.isInternalChange) {
         return;
       }
 
-      this.handle(subject.key, subject.value);
+      this.handle(setting.key, setting.value);
       break;
 
     case "xpcom-shutdown":

toolkit/devtools/discovery/discovery.js

@@ -205,10 +205,11 @@ LocalDevice.prototype = {
     if (topic !== "mozsettings-changed") {
       return;
     }
-    if (subject.key !== LocalDevice.SETTING) {
+    let setting = JSON.parse(data);
+    if (setting.key !== LocalDevice.SETTING) {
       return;
     }
-    this._name = subject.value;
+    this._name = setting.value;
     log("Device: " + this._name);
   },