[runtime] Remove the very dangerous %_CallFunction intrinsic.

test/mjsunit/compiler/regress-lazy-deopt.js

Index: test/mjsunit/compiler/regress-lazy-deopt.js
diff --git a/test/mjsunit/compiler/regress-lazy-deopt.js b/test/mjsunit/compiler/regress-lazy-deopt.js
index d1c3d01dc6f832275581435d1c5280640b03629a..766220763bdd5c3c88a0e9c2fd93a26ff5f0f230 100644
--- a/test/mjsunit/compiler/regress-lazy-deopt.js
+++ b/test/mjsunit/compiler/regress-lazy-deopt.js
@@ -27,7 +27,7 @@
 
 // Flags: --allow-natives-syntax
 
-// Test lazy deoptimization after CallFunctionStub.
+// Test lazy deoptimization after Call builtin.
 
 function foo() { return 1; }
 
@@ -37,7 +37,7 @@ function f(x, y) {
     %DeoptimizeFunction(f);
     return 1;
   }
-  a[0] = %_CallFunction(null, x - 1, f);
+  a[0] = %_Call(f, null, x - 1);
   return x >> a[0];
 }