This is a regression. The problem is not present in eg. Safari 3.2.2 for Windows. In the latest WebKit nightlies and in the Safari 4 beta for OSX it is present. Here is a snippet to reproduce it: <script> "foo".__proto__.foo = "bar"; if (Object.prototype.foo == "bar") alert("Has Safari __proto__ bug"); else alert("Doesn't have Safari __proto__ bug"); </script> It seems the problem is restricted to string values. new String("foo").__proto__ gets the right object.
<rdar://problem/6861069>
Created attachment 30127 [details] patch -- needs regression test before review
Created attachment 30195 [details] patch
http://trac.webkit.org/changeset/43506