[runtime] Remove the very dangerous %_CallFunction intrinsic.

src/js/date.js

Index: src/js/date.js
diff --git a/src/js/date.js b/src/js/date.js
index 1e8ef166790a3e3b628b308cde45e80c653fd3ff..a99d8e4d51fec8cf3f68f36539ae16ce1133c226 100644
--- a/src/js/date.js
+++ b/src/js/date.js
@@ -134,7 +134,7 @@ var Date_cache = {
 function DateConstructor(year, month, date, hours, minutes, seconds, ms) {
   if (!%_IsConstructCall()) {
     // ECMA 262 - 15.9.2
-    return %_CallFunction(new GlobalDate(), DateToString);
+    return %_Call(DateToString, new GlobalDate());
   }
 
   // ECMA 262 - 15.9.3
@@ -337,7 +337,7 @@ function DateToTimeString() {
 // ECMA 262 - 15.9.5.5
 function DateToLocaleString() {
   CHECK_DATE(this);
-  return %_CallFunction(this, DateToString);
+  return %_Call(DateToString, this);
 }
 
 
@@ -735,7 +735,7 @@ function DateSetYear(year) {
 // do that either.  Instead, we create a new function whose name
 // property will return toGMTString.
 function DateToGMTString() {
-  return %_CallFunction(this, DateToUTCString);
+  return %_Call(DateToUTCString, this);
 }