MIPS32R6: Put subroutine address in the jump register

Fix afd6351d

After `[csa][builtins] Port CompileLazy* to CSA` landed,
there is an implicit expectation that the address of the JS code
is stored in the target register. Due to optimizations on MIPSR6,
this address was not properly loaded.

We fix this by loading target address explicitly before performing
the jump.

TEST=mjsunit/json2,mjsunit/packed-elements

Change-Id: Ida9cb062910415bf15aa40dd20a17fc42fdba719
Reviewed-on: https://chromium-review.googlesource.com/1095155Reviewed-by: Sreten Kovacevic <sreten.kovacevic@mips.com>
Commit-Queue: Sreten Kovacevic <sreten.kovacevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#53642}

src/compiler/mips/code-generator-mips.cc

@@ -641,7 +641,8 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
         DCHECK_IMPLIES(
             HasCallDescriptorFlag(instr, CallDescriptor::kFixedTargetRegister),
             reg == kJavaScriptCallCodeStartRegister);
-        __ Jump(reg, reg, Code::kHeaderSize - kHeapObjectTag);
+        __ Addu(reg, reg, Code::kHeaderSize - kHeapObjectTag);
+        __ Jump(reg);
       }
       frame_access_state()->ClearSPDelta();
       frame_access_state()->SetFrameAccessToDefault();