[ic] Use the CallFunction builtin to invoke accessors.

test/mjsunit/regress/regress-crbug-599073-1.js

Index: test/mjsunit/regress/regress-crbug-599073-1.js
diff --git a/test/mjsunit/regress/regress-crbug-595657.js b/test/mjsunit/regress/regress-crbug-599073-1.js
similarity index 56%
copy from test/mjsunit/regress/regress-crbug-595657.js
copy to test/mjsunit/regress/regress-crbug-599073-1.js
index 653259781be24ec1acf1d5e2aa4f4de2f361d3ec..fc89fe4c66a6d4e944b292268f0087e6bf98aa86 100644
--- a/test/mjsunit/regress/regress-crbug-595657.js
+++ b/test/mjsunit/regress/regress-crbug-599073-1.js
@@ -2,14 +2,10 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --stack-size=100
+Object.defineProperty(Boolean.prototype, "v", {get:constructor});
 
-function test() {
-  try {
-    test();
-  } catch(e) {
-    /(\2)(a)/.test("");
-  }
-}
+function foo(b) { return b.v; }
 
-test();
+foo(true);
+foo(true);
+foo(true);