[ic] Use the CallFunction builtin to invoke accessors.

test/mjsunit/regress/regress-crbug-599073-4.js

Index: test/mjsunit/regress/regress-crbug-599073-4.js
diff --git a/test/mjsunit/regress/regress-crbug-595657.js b/test/mjsunit/regress/regress-crbug-599073-4.js
similarity index 59%
copy from test/mjsunit/regress/regress-crbug-595657.js
copy to test/mjsunit/regress/regress-crbug-599073-4.js
index 653259781be24ec1acf1d5e2aa4f4de2f361d3ec..0d6854cbb32bd262f499a5783154d19858f0818e 100644
--- a/test/mjsunit/regress/regress-crbug-595657.js
+++ b/test/mjsunit/regress/regress-crbug-599073-4.js
@@ -2,14 +2,10 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --stack-size=100
+Object.defineProperty(Number.prototype, "v", {set:constructor});
 
-function test() {
-  try {
-    test();
-  } catch(e) {
-    /(\2)(a)/.test("");
-  }
-}
+function foo(b) { b.v = 1; }
 
-test();
+foo(2);
+foo(3);
+foo(4);