[runtime] Remove the very dangerous %_CallFunction intrinsic.

src/js/templates.js

Index: src/js/templates.js
diff --git a/src/js/templates.js b/src/js/templates.js
index b273bc39e816e1a828e891506564113b3ae526c3..eee6b7d7e71fc9663c95e5337e8fac9545e56937 100644
--- a/src/js/templates.js
+++ b/src/js/templates.js
@@ -38,7 +38,7 @@ function SameCallSiteElements(rawStrings, other) {
 
 
 function GetCachedCallSite(siteObj, hash) {
-  var obj = %_CallFunction(callSiteCache, hash, mapGetFn);
+  var obj = %_Call(mapGetFn, callSiteCache, hash);
 
   if (IS_UNDEFINED(obj)) return;
 
@@ -50,13 +50,13 @@ function GetCachedCallSite(siteObj, hash) {
 
 
 function SetCachedCallSite(siteObj, hash) {
-  var obj = %_CallFunction(callSiteCache, hash, mapGetFn);
+  var obj = %_Call(mapGetFn, callSiteCache, hash);
   var array;
 
   if (IS_UNDEFINED(obj)) {
     array = new InternalArray(1);
     array[0] = siteObj;
-    %_CallFunction(callSiteCache, hash, array, mapSetFn);
+    %_Call(mapSetFn, callSiteCache, hash, array);
   } else {
     obj.push(siteObj);
   }