[runtime] Remove the very dangerous %_CallFunction intrinsic.

src/js/array.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 (function(global, utils, extrasUtils) {
 
 "use strict";
 
 %CheckIsBootstrapping();
 
@@ skipping 387 matching lines @@
     func = this.join;
     if (func === ArrayJoin) {
       return Join(this, this.length, ',', ConvertToString);
     }
     array = this;
   } else {
     array = TO_OBJECT(this);
     func = array.join;
   }
   if (!IS_CALLABLE(func)) {
-    return %_CallFunction(array, ObjectToString);
+    return %_Call(ObjectToString, array);
   }
   return %_Call(func, array);
 }
 
 
 function InnerArrayToLocaleString(array, length) {
   var len = TO_LENGTH_OR_UINT32(length);
   if (len === 0) return "";
   return Join(array, len, ',', ConvertToLocaleString);
 }
@@ skipping 1531 matching lines @@
 %InstallToContext([
   "array_pop", ArrayPop,
   "array_push", ArrayPush,
   "array_shift", ArrayShift,
   "array_splice", ArraySplice,
   "array_slice", ArraySlice,
   "array_unshift", ArrayUnshift,
 ]);
 
 });