[runtime] Remove the very dangerous %_CallFunction intrinsic.

src/js/generator.js

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 (function(global, utils) {
 
 "use strict";
 
 %CheckIsBootstrapping();
 
@@ skipping 66 matching lines @@
     throw MakeTypeError(kGeneratorRunning);
   }
 }
 
 
 function GeneratorFunctionConstructor(arg1) {  // length == 1
   var source = NewFunctionString(arguments, 'function*');
   var global_proxy = %GlobalProxy(GeneratorFunctionConstructor);
   // Compile the string in the constructor and not a helper so that errors
   // appear to come from here.
-  var func = %_CallFunction(global_proxy, %CompileString(source, true));
+  var func = %_Call(%CompileString(source, true), global_proxy);
   // Set name-should-print-as-anonymous flag on the ShareFunctionInfo and
   // ensure that |func| uses correct initial map from |new.target| if
   // it's available.
   return %CompleteFunctionConstruction(func, GeneratorFunction, new.target);
 }
 
 // ----------------------------------------------------------------------------
 
 // Both Runtime_GeneratorNext and Runtime_GeneratorThrow are supported by
 // neither Crankshaft nor TurboFan, disable optimization of wrappers here.
@@ skipping 13 matching lines @@
     toStringTagSymbol, "Generator", DONT_ENUM | READ_ONLY);
 %InternalSetPrototype(GeneratorFunctionPrototype, GlobalFunction.prototype);
 %AddNamedProperty(GeneratorFunctionPrototype,
     toStringTagSymbol, "GeneratorFunction", DONT_ENUM | READ_ONLY);
 %AddNamedProperty(GeneratorFunctionPrototype, "constructor",
     GeneratorFunction, DONT_ENUM | READ_ONLY);
 %InternalSetPrototype(GeneratorFunction, GlobalFunction);
 %SetCode(GeneratorFunction, GeneratorFunctionConstructor);
 
 })