[runtime] Replace many buggy uses of %_CallFunction with %_Call.

src/promise.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 (function(global, utils) {
 
 "use strict";
 
 %CheckIsBootstrapping();
 
@@ skipping 70 matching lines @@
   if (!IsPromise(x) && IS_SPEC_OBJECT(x)) {
     var then;
     try {
       then = x.then;
     } catch(r) {
       return %_CallFunction(constructor, r, PromiseRejected);
     }
     if (IS_CALLABLE(then)) {
       var deferred = %_CallFunction(constructor, PromiseDeferred);
       try {
-        %_CallFunction(x, deferred.resolve, deferred.reject, then);
+        %_Call(then, x, deferred.resolve, deferred.reject);
       } catch(r) {
         deferred.reject(r);
       }
       return deferred.promise;
     }
   }
   return x;
 }
 
 function PromiseHandle(value, handler, deferred) {
@@ skipping 280 matching lines @@
   "promise_catch", PromiseCatch,
   "promise_chain", PromiseChain,
   "promise_create", PromiseCreate,
   "promise_has_user_defined_reject_handler", PromiseHasUserDefinedRejectHandler,
   "promise_reject", PromiseReject,
   "promise_resolve", PromiseResolve,
   "promise_then", PromiseThen,
 ]);
 
 })