MIPS[64]: Fix `[builtins] Port WeakMap/WeakSet constructor to CSA`

Fix c5c50e18

After the change from the title landed, around 700 tests started
failing on MIPS and MIPS64. The reason for the failure was a typo
in Generate_JSBuiltinsConstructStubHelper in builtin-mips.cc
and builtin-mips64.cc.

Bug: 
Change-Id: Id95a87773d6ab1d4a65c3c7a306629046a44fa7d
Reviewed-on: https://chromium-review.googlesource.com/771652Reviewed-by: Miran Karić <Miran.Karic@imgtec.com>
Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#49382}

src/builtins/mips/builtins-mips.cc

@@ -242,7 +242,7 @@ void Generate_JSBuiltinsConstructStubHelper(MacroAssembler* masm) {
     // Restore context from the frame.
     __ lw(cp, MemOperand(fp, ConstructFrameConstants::kContextOffset));
     // Restore smi-tagged arguments count from the frame.
-    __ lw(a1, MemOperand(sp));
+    __ lw(a1, MemOperand(fp, ConstructFrameConstants::kLengthOffset));
     // Leave construct frame.
   }
 

src/builtins/mips64/builtins-mips64.cc

@@ -243,7 +243,7 @@ void Generate_JSBuiltinsConstructStubHelper(MacroAssembler* masm) {
     // Restore context from the frame.
     __ Ld(cp, MemOperand(fp, ConstructFrameConstants::kContextOffset));
     // Restore smi-tagged arguments count from the frame.
-    __ Ld(a1, MemOperand(sp));
+    __ Ld(a1, MemOperand(fp, ConstructFrameConstants::kLengthOffset));
     // Leave construct frame.
   }