[ic] Use the CallFunction builtin to invoke accessors.

test/mjsunit/regress/regress-crbug-599073-3.js

Index: test/mjsunit/regress/regress-crbug-599073-3.js
diff --git a/test/mjsunit/regress/regress-crbug-595657.js b/test/mjsunit/regress/regress-crbug-599073-3.js
similarity index 58%
copy from test/mjsunit/regress/regress-crbug-595657.js
copy to test/mjsunit/regress/regress-crbug-599073-3.js
index 653259781be24ec1acf1d5e2aa4f4de2f361d3ec..2892f562aa0245aba7ed15fe6b607aa57b24f553 100644
--- a/test/mjsunit/regress/regress-crbug-595657.js
+++ b/test/mjsunit/regress/regress-crbug-599073-3.js
@@ -2,14 +2,10 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --stack-size=100
+Object.defineProperty(Number.prototype, "v", {get:constructor});
 
-function test() {
-  try {
-    test();
-  } catch(e) {
-    /(\2)(a)/.test("");
-  }
-}
+function foo(b) { return b.v; }
 
-test();
+foo(2);
+foo(3);
+foo(4);