Current custom call generators cannot cope with the case when receiver is not a JSArray.

test/mjsunit/array-pop.js

 // Copyright 2010 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 41 matching lines @@
     assertEquals(7, a.pop(), "7th pop");
     assertEquals(0, a.length, "length 7th pop");
 
     assertEquals(undefined, a.pop(), "8th pop");
     assertEquals(0, a.length, "length 8th pop");
 
     assertEquals(undefined, a.pop(1, 2, 3), "9th pop");
     assertEquals(0, a.length, "length 9th pop");
   }
 })();
+
+// Test the case of not JSArray receiver.
+// Regression test for custom call generators, see issue 684.
+(function() {
+  var a = [];
+  for (var i = 0; i < 100; i++) a.push(i);
+  var x = {__proto__: a};
+  for (var i = 0; i < 100; i++) {
+    assertEquals(99 - i, x.pop(), i + 'th iteration');
+  }
+})();