Current custom call generators cannot cope with the case when receiver is not a JSArray.

test/mjsunit/array-pop.js

Index: test/mjsunit/array-pop.js
diff --git a/test/mjsunit/array-pop.js b/test/mjsunit/array-pop.js
index 4edd02614b3ac262f1193dc3ea91d3f8cd2b1813..9608cd4ce5acbbc51bb22d46f8930c85bdd5b359 100644
--- a/test/mjsunit/array-pop.js
+++ b/test/mjsunit/array-pop.js
@@ -59,3 +59,14 @@
     assertEquals(0, a.length, "length 9th pop");
   }
 })();
+
+// Test the case of not JSArray receiver.
+// Regression test for custom call generators, see issue 684.
+(function() {
+  var a = [];
+  for (var i = 0; i < 100; i++) a.push(i);
+  var x = {__proto__: a};
+  for (var i = 0; i < 100; i++) {
+    assertEquals(99 - i, x.pop(), i + 'th iteration');
+  }
+})();