[runtime] Remove the very dangerous %_CallFunction intrinsic.

src/js/string.js

Index: src/js/string.js
diff --git a/src/js/string.js b/src/js/string.js
index 0fdd7ae342f88225165304c25920a4ba574445f2..1a31fd1df31e11edddf015e7ee5af1ae31906b3f 100644
--- a/src/js/string.js
+++ b/src/js/string.js
@@ -179,11 +179,10 @@ function StringNormalizeJS() {
   var form = IS_UNDEFINED(formArg) ? 'NFC' : TO_STRING(formArg);
 
   var NORMALIZATION_FORMS = ['NFC', 'NFD', 'NFKC', 'NFKD'];
-  var normalizationForm =
-      %_CallFunction(NORMALIZATION_FORMS, form, ArrayIndexOf);
+  var normalizationForm = %_Call(ArrayIndexOf, NORMALIZATION_FORMS, form);
   if (normalizationForm === -1) {
     throw MakeRangeError(kNormalizationForm,
-                         %_CallFunction(NORMALIZATION_FORMS, ', ', ArrayJoin));
+                         %_Call(ArrayJoin, NORMALIZATION_FORMS, ', '));
   }
 
   return s;
@@ -803,7 +802,7 @@ function StringFromCharCode(code) {
 
 // ES6 draft, revision 26 (2014-07-18), section B.2.3.2.1
 function HtmlEscape(str) {
-  return %_CallFunction(TO_STRING(str), /"/g, """, StringReplace);
+  return %_Call(StringReplace, TO_STRING(str), /"/g, """);
 }