[crankshaft] do not sign-extend int32 immediate in DoMathMinMax.

R=bmeurer@chromium.org
BUG=chromium:495493

Review-Url: https://codereview.chromium.org/2044353002
Cr-Commit-Position: refs/heads/master@{#36818}

src/crankshaft/x64/lithium-codegen-x64.cc

@@ -1779,7 +1779,7 @@ void LCodeGen::DoMathMinMax(LMathMinMax* instr) {
           : SmiValuesAre31Bits());
       __ cmpl(left_reg, right_imm);
       __ j(condition, &return_left, Label::kNear);
-      __ movp(left_reg, right_imm);
+      __ movl(left_reg, right_imm);
     } else if (right->IsRegister()) {
       Register right_reg = ToRegister(right);
       if (instr->hydrogen_value()->representation().IsSmi()) {

test/mjsunit/regress/regress-crbug-495493.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --nofold-constants --enable-slow-asserts --debug-code
+
+function foo(p) {
+  for (var i = 0; i < 100000; ++i) {
+    p = Math.min(-1, 0);
+  }
+}
+foo(0);