Reapply http://code.google.com/p/v8/source/detail?r=6555

src/api.cc

Index: src/api.cc
diff --git a/src/api.cc b/src/api.cc
index 80a53bf158a4c521fe1020456d1765ebb528c7bd..188047bcc2a81939c2b1af32b0d0634cf2ff7879 100644
--- a/src/api.cc
+++ b/src/api.cc
@@ -2206,6 +2206,12 @@ bool Value::Equals(Handle<Value> that) const {
   ENTER_V8;
   i::Handle<i::Object> obj = Utils::OpenHandle(this);
   i::Handle<i::Object> other = Utils::OpenHandle(*that);
+  // If both obj and other are JSObjects, we'd better compare by identity
+  // immediately when going into JS builtin.  The reason is Invoke
+  // would overwrite global object receiver with global proxy.
+  if (obj->IsJSObject() && other->IsJSObject()) {
+    return *obj == *other;
+  }
   i::Object** args[1] = { other.location() };
   EXCEPTION_PREAMBLE();
   i::Handle<i::Object> result =