[runtime] Remove the very dangerous %_CallFunction intrinsic.

src/js/v8natives.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 (function(global, utils) {
 
 %CheckIsBootstrapping();
 
 // ----------------------------------------------------------------------------
 // Imports
@@ skipping 99 matching lines @@
 
 
 function GlobalEval(x) {
   if (!IS_STRING(x)) return x;
 
   var global_proxy = %GlobalProxy(GlobalEval);
 
   var f = %CompileString(x, false);
   if (!IS_FUNCTION(f)) return f;
 
-  return %_CallFunction(global_proxy, f);
+  return %_Call(f, global_proxy);
 }
 
 
 // ----------------------------------------------------------------------------
 
 // Set up global object.
 var attributes = DONT_ENUM | DONT_DELETE | READ_ONLY;
 
 utils.InstallConstants(global, [
   // ECMA 262 - 15.1.1.1.
@@ skipping 416 matching lines @@
     }
     trap = defaultTrap;
   } else if (!IS_CALLABLE(trap)) {
     throw MakeTypeError(kProxyHandlerTrapMustBeCallable, handler, name);
   }
   return trap;
 }
 
 
 function CallTrap0(handler, name, defaultTrap) {
-  return %_CallFunction(handler, GetTrap(handler, name, defaultTrap));
+  return %_Call(GetTrap(handler, name, defaultTrap), handler);
 }
 
 
 function CallTrap1(handler, name, defaultTrap, x) {
-  return %_CallFunction(handler, x, GetTrap(handler, name, defaultTrap));
+  return %_Call(GetTrap(handler, name, defaultTrap), handler, x);
 }
 
 
 function CallTrap2(handler, name, defaultTrap, x, y) {
-  return %_CallFunction(handler, x, y, GetTrap(handler, name, defaultTrap));
+  return %_Call(GetTrap(handler, name, defaultTrap), handler, x, y);
 }
 
 
 // ES5 section 8.12.1.
 function GetOwnPropertyJS(obj, v) {
   var p = TO_NAME(v);
   if (%_IsJSProxy(obj)) {
     // TODO(rossberg): adjust once there is a story for symbols vs proxies.
     if (IS_SYMBOL(v)) return UNDEFINED;
 
@@ skipping 878 matching lines @@
   // Convert the radix to an integer and check the range.
   radix = TO_INTEGER(radix);
   if (radix < 2 || radix > 36) throw MakeRangeError(kToRadixFormatRange);
   // Convert the number to a string in the given radix.
   return %NumberToRadixString(number, radix);
 }
 
 
 // ECMA-262 section 15.7.4.3
 function NumberToLocaleString() {
-  return %_CallFunction(this, NumberToStringJS);
+  return %_Call(NumberToStringJS, this);
 }
 
 
 // ECMA-262 section 15.7.4.4
 function NumberValueOf() {
   // NOTE: Both Number objects and values can enter here as
   // 'this'. This is not as dictated by ECMA-262.
   if (!IS_NUMBER(this) && !IS_NUMBER_WRAPPER(this)) {
     throw MakeTypeError(kNotGeneric, 'Number.prototype.valueOf');
   }
@@ skipping 283 matching lines @@
   var n = args.length;
   var p = '';
   if (n > 1) {
     p = TO_STRING(args[0]);
     for (var i = 1; i < n - 1; i++) {
       p += ',' + TO_STRING(args[i]);
     }
     // If the formal parameters string include ) - an illegal
     // character - it may make the combined function expression
     // compile. We avoid this problem by checking for this early on.
-    if (%_CallFunction(p, ')', StringIndexOf) != -1) {
+    if (%_Call(StringIndexOf, p, ')') != -1) {
       throw MakeSyntaxError(kParenthesisInArgString);
     }
     // If the formal parameters include an unbalanced block comment, the
     // function must be rejected. Since JavaScript does not allow nested
     // comments we can include a trailing block comment to catch this.
     p += '\n/' + '**/';
   }
   var body = (n > 0) ? TO_STRING(args[n - 1]) : '';
   return '(' + function_token + '(' + p + ') {\n' + body + '\n})';
 }
 
 
 function FunctionConstructor(arg1) {  // length == 1
   var source = NewFunctionString(arguments, 'function');
   var global_proxy = %GlobalProxy(FunctionConstructor);
   // Compile the string in the constructor and not a helper so that errors
   // appear to come from here.
-  var func = %_CallFunction(global_proxy, %CompileString(source, true));
+  var func = %_Call(%CompileString(source, true), global_proxy);
   // Set name-should-print-as-anonymous flag on the ShareFunctionInfo and
   // ensure that |func| uses correct initial map from |new.target| if
   // it's available.
   return %CompleteFunctionConstruction(func, GlobalFunction, new.target);
 }
 
 
 // ----------------------------------------------------------------------------
 
 %SetCode(GlobalFunction, FunctionConstructor);
@@ skipping 10 matching lines @@
 
 // ES6 rev 33, 2015-02-12
 // 7.4.1 GetIterator ( obj, method )
 function GetIterator(obj, method) {
   if (IS_UNDEFINED(method)) {
     method = obj[iteratorSymbol];
   }
   if (!IS_CALLABLE(method)) {
     throw MakeTypeError(kNotIterable, obj);
   }
-  var iterator = %_CallFunction(obj, method);
+  var iterator = %_Call(method, obj);
   if (!IS_SPEC_OBJECT(iterator)) {
     throw MakeTypeError(kNotAnIterator, iterator);
   }
   return iterator;
 }
 
 // ----------------------------------------------------------------------------
 // Exports
 
 utils.Export(function(to) {
@@ skipping 18 matching lines @@
 
 %InstallToContext([
   "global_eval_fun", GlobalEval,
   "object_value_of", ObjectValueOf,
   "object_to_string", ObjectToString,
   "object_get_own_property_descriptor", ObjectGetOwnPropertyDescriptor,
   "to_complete_property_descriptor", ToCompletePropertyDescriptor,
 ]);
 
 })