[runtime] Remove the very dangerous %_CallFunction intrinsic.

test/mjsunit/strong/function-arity.js

Index: test/mjsunit/strong/function-arity.js
diff --git a/test/mjsunit/strong/function-arity.js b/test/mjsunit/strong/function-arity.js
index 55e0600b53f080bde86ef0a05767d61a9c4f8a23..5ead236171b75bf381b8e7f8ac8ccb2e852d778a 100644
--- a/test/mjsunit/strong/function-arity.js
+++ b/test/mjsunit/strong/function-arity.js
@@ -70,8 +70,7 @@ function generateSpread(n) {
           `f.call(undefined, ${generateSpread(argumentCount)})`,
           `f.apply(undefined, [${generateArguments(argumentCount)}])`,
           `f.bind(undefined)(${generateArguments(argumentCount)})`,
-          `%_CallFunction(${generateArguments(argumentCount, 'undefined')},
-                          f)`,
+          `%_Call(f, ${generateArguments(argumentCount, 'undefined')})`,
           `%Call(f, ${generateArguments(argumentCount, 'undefined')})`,
           `%Apply(f, undefined, [${generateArguments(argumentCount)}], 0,
                   ${argumentCount})`,
@@ -134,7 +133,7 @@ function generateSpread(n) {
             `o.m.call(o, ${generateSpread(argumentCount)})`,
             `o.m.apply(o, [${generateArguments(argumentCount)}])`,
             `o.m.bind(o)(${generateArguments(argumentCount)})`,
-            `%_CallFunction(${generateArguments(argumentCount, 'o')}, o.m)`,
+            `%_Call(o.m, ${generateArguments(argumentCount, 'o')})`,
             `%Call(o.m, ${generateArguments(argumentCount, 'o')})`,
             `%Apply(o.m, o, [${generateArguments(argumentCount)}], 0,
                     ${argumentCount})`,