[runtime] Remove the very dangerous %_CallFunction intrinsic.

src/js/generator.js

Index: src/js/generator.js
diff --git a/src/js/generator.js b/src/js/generator.js
index 4d3f3191254df7b01d5a8c5bcdc06a72d9d0c161..2f61b3f22cd1e232bc90ec5b0a36f750c574366d 100644
--- a/src/js/generator.js
+++ b/src/js/generator.js
@@ -84,7 +84,7 @@ function GeneratorFunctionConstructor(arg1) {  // length == 1
   var global_proxy = %GlobalProxy(GeneratorFunctionConstructor);
   // Compile the string in the constructor and not a helper so that errors
   // appear to come from here.
-  var func = %_CallFunction(global_proxy, %CompileString(source, true));
+  var func = %_Call(%CompileString(source, true), global_proxy);
   // Set name-should-print-as-anonymous flag on the ShareFunctionInfo and
   // ensure that |func| uses correct initial map from |new.target| if
   // it's available.