[mips] Fix code generation bug in handling of immediates

When testing turning --verify-csa off to generate better code for builtins, mips
started failing mksnapshot due to an assert in instruction-selection-mips.cc's
VisitBinop routine, which creates a buffer to hold InstructionOperand of size 4
that would be overflowed. This fix is somewhat speculative, assuming that either
the LHS or the RHS operand of a mips binary op can be an immediate (as opposed
to the current code which seems to have a code path where both the left and
right operands are added, leading to the buffer overflow). With this fix, the
assert doesn't fire and all of the mips tests run through successfully in debug
mode.

R=ishell@chromium.org
TBR=dusan.m.milosavljevic@gmail.com

Review-Url: https://codereview.chromium.org/2647283009
Cr-Commit-Position: refs/heads/master@{#42701}

src/compiler/mips/instruction-selector-mips.cc

@@ -173,10 +173,9 @@ static void VisitBinop(InstructionSelector* selector, Node* node,
                         &inputs[1])) {
     inputs[0] = g.UseRegister(m.left().node());
     input_count++;
-  }
-  if (has_reverse_opcode &&
-      TryMatchImmediate(selector, &reverse_opcode, m.left().node(),
-                        &input_count, &inputs[1])) {
+  } else if (has_reverse_opcode &&
+             TryMatchImmediate(selector, &reverse_opcode, m.left().node(),
+                               &input_count, &inputs[1])) {
     inputs[0] = g.UseRegister(m.right().node());
     opcode = reverse_opcode;
     input_count++;

src/compiler/mips64/instruction-selector-mips64.cc

@@ -269,10 +269,9 @@ static void VisitBinop(InstructionSelector* selector, Node* node,
                         &inputs[1])) {
     inputs[0] = g.UseRegister(m.left().node());
     input_count++;
-  }
-  if (has_reverse_opcode &&
-      TryMatchImmediate(selector, &reverse_opcode, m.left().node(),
-                        &input_count, &inputs[1])) {
+  } else if (has_reverse_opcode &&
+             TryMatchImmediate(selector, &reverse_opcode, m.left().node(),
+                               &input_count, &inputs[1])) {
     inputs[0] = g.UseRegister(m.right().node());
     opcode = reverse_opcode;
     input_count++;