The global object returned from JSContextGetGlobalObject() is actually wrapped by a JSProxy object. The JSObjectGetPrivate() and JSObjectSetPrivate() don't work with the wrapped object. The JSProxy was added in r166415 - <http://trac.webkit.org/changeset/166415>
Created attachment 228219 [details] Patch
Comment on attachment 228219 [details] Patch r=me
Committed r166554: <http://trac.webkit.org/changeset/166554>