More cases of CallFunction that doesn't work correctly.

src/array.js

Index: src/array.js
diff --git a/src/array.js b/src/array.js
index 97ce10dd85e0870e0f644cb7fef4dc475ceb5732..6ed1476080d49c5d1e552d63011c34964e798ea8 100644
--- a/src/array.js
+++ b/src/array.js
@@ -1138,7 +1138,7 @@ function ArrayReduce(callback, current) {
   for (; i < length; i++) {
     var element = this[i];
     if (!IS_UNDEFINED(element) || i in this) {
-      current = %_CallFunction(null, current, element, i, this, callback);
+      current = callback.call(null, current, element, i, this);
     }
   }
   return current;
@@ -1164,7 +1164,7 @@ function ArrayReduceRight(callback, current) {
   for (; i >= 0; i--) {
     var element = this[i];
     if (!IS_UNDEFINED(element) || i in this) {
-      current = %_CallFunction(null, current, element, i, this, callback);
+      current = callback.call(null, current, element, i, this);
     }
   }
   return current;