Bring r4503 to the 2.1 branch....

test/mjsunit/array-push.js

Index: test/mjsunit/array-push.js
===================================================================
--- test/mjsunit/array-push.js	(revision 4551)
+++ test/mjsunit/array-push.js	(working copy)
@@ -103,3 +103,13 @@
     assertEquals(29, a.push(29));
   }
 })();
+
+// Test the case of not JSArray receiver.
+// Regression test for custom call generators, see issue 684.
+(function() {
+  var x = {__proto__: []};
+  for (var i = 0; i < 100; i++) {
+    x.push("a");
+    assertEquals(i + 1, x.length, i + 'th iteration');
+  }
+})();