Current custom call generators cannot cope with the case when receiver is not a JSArray.

test/mjsunit/array-push.js

Index: test/mjsunit/array-push.js
diff --git a/test/mjsunit/array-push.js b/test/mjsunit/array-push.js
index baccf000c4708cb2c69eaac50ef0f966f5a8cbe3..2a25a9cc9e31eaeab85273ce0a5f95f35533565f 100644
--- a/test/mjsunit/array-push.js
+++ b/test/mjsunit/array-push.js
@@ -103,3 +103,13 @@
     assertEquals(29, a.push(29));
   }
 })();
+
+// Test the case of not JSArray receiver.
+// Regression test for custom call generators, see issue 684.
+(function() {
+  var x = {__proto__: []};
+  for (var i = 0; i < 100; i++) {
+    x.push("a");
+    assertEquals(i + 1, x.length, i + 'th iteration');
+  }
+})();