[runtime] Remove the very dangerous %_CallFunction intrinsic.

src/js/proxy.js

Index: src/js/proxy.js
diff --git a/src/js/proxy.js b/src/js/proxy.js
index 56373861eec5676dcc817a57ac0586587ee6a917..fc38680a13a8daae96d7df99e3acf839ecb35232 100644
--- a/src/js/proxy.js
+++ b/src/js/proxy.js
@@ -81,7 +81,7 @@ function DerivedGetTrap(receiver, name) {
   } else {
     if (IS_UNDEFINED(desc.get)) { return desc.get }
     // The proposal says: desc.get.call(receiver)
-    return %_CallFunction(receiver, desc.get)
+    return %_Call(desc.get, receiver)
   }
 }
 
@@ -99,7 +99,7 @@ function DerivedSetTrap(receiver, name, val) {
     } else { // accessor
       if (desc.set) {
         // The proposal says: desc.set.call(receiver, val)
-        %_CallFunction(receiver, val, desc.set)
+        %_Call(desc.set, receiver, val)
         return true
       } else {
         return false
@@ -117,7 +117,7 @@ function DerivedSetTrap(receiver, name, val) {
     } else { // accessor
       if (desc.set) {
         // The proposal says: desc.set.call(receiver, val)
-        %_CallFunction(receiver, val, desc.set)
+        %_Call(desc.set, receiver, val)
         return true
       } else {
         return false