[ia32] Bugfix for jump optimization

The jump optimization maybe run Turbofan pipeline twice for each TF/CS builtins,
and relies on the fact that the number of j/jmp instruction generated is always
the same.
The behavior of {AddMatcher::SwapInputs} should be aware the two times code
generation, and prevents the flipping of child nodes.

For example:

1: Int32Add(2, 3)   --- We shouldn't swap the input #2 and #3 in this situation
2: Int32Sub(4, 5)
3: Int32Add(6, 7)
4: ...
5: ...
6: ...
7: ...

R=danno@chromium.org

Bug: v8:7839
Change-Id: Ia97de3ab28294e595ac27b5898c099c0d782e9f9
Reviewed-on: https://chromium-review.googlesource.com/1098678Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Kanghua Yu <kanghua.yu@intel.com>
Cr-Commit-Position: refs/heads/master@{#53705}

src/compiler/node-matchers.h

@@ -391,11 +391,10 @@ struct AddMatcher : public BinopMatcher {
       return;
     }
 
-    if (this->right().opcode() == kAddOpcode &&
-        this->left().opcode() != kAddOpcode) {
-      this->SwapInputs();
-    } else if (this->right().opcode() == kSubOpcode &&
-               this->left().opcode() != kSubOpcode) {
+    if ((this->left().opcode() != kSubOpcode &&
+         this->left().opcode() != kAddOpcode) &&
+        (this->right().opcode() == kAddOpcode ||
+         this->right().opcode() == kSubOpcode)) {
       this->SwapInputs();
     }
   }

src/ia32/assembler-ia32.cc

@@ -364,10 +364,7 @@ void Assembler::GetCode(Isolate* isolate, CodeDesc* desc) {
         }
       }
       if (can_opt) {
-        // Disable for now due to bug flushed out by unrelated CSA/Torque
-        // changes
-        // TODO(7839): reenable when fixed
-        // jump_opt->set_optimizable();
+        jump_opt->set_optimizable();
       }
     }
   }