[builtins] Fix clobbered reg in Math.{Max,Min}

edi is expected to contain the JS function. Ensure that it is not
overwritten.

BUG=chromium:621431,chromium:621550,chromium:621217
R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2085043004
Cr-Commit-Position: refs/heads/master@{#37173}

src/ia32/builtins-ia32.cc

@@ -1668,8 +1668,10 @@ void Builtins::Generate_MathMaxMin(MacroAssembler* masm, MathMaxMinKind kind) {
 
     // Left and right hand side are equal, check for -0 vs. +0.
     __ bind(&compare_equal);
+    __ Push(edi);  // Preserve function in edi.
     __ movmskpd(edi, reg);
     __ test(edi, Immediate(1));
+    __ Pop(edi);
     __ j(not_zero, &compare_swap);
 
     __ bind(&done_compare);