MIPS: Fix in-object memory slack tracking bug.

TEST=
BUG=

Review URL: https://codereview.chromium.org/1067393003

Cr-Commit-Position: refs/heads/master@{#27678}

src/mips/builtins-mips.cc

@@ -433,9 +433,7 @@ static void Generate_JSConstructStubHelper(MacroAssembler* masm,
         __ CallRuntime(Runtime::kFinalizeInstanceSize, 1);
 
         __ Pop(a1, a2);
-        // Slack tracking counter is Map::kSlackTrackingCounterEnd after runtime
-        // call.
-        __ li(t2, Map::kSlackTrackingCounterEnd);
+        __ li(t2, Operand(Map::kSlackTrackingCounterEnd - 1));
 
         __ bind(&allocate);
       }

src/mips64/builtins-mips64.cc

@@ -434,9 +434,7 @@ static void Generate_JSConstructStubHelper(MacroAssembler* masm,
         __ CallRuntime(Runtime::kFinalizeInstanceSize, 1);
 
         __ Pop(a1, a2);
-        // Slack tracking counter is Map::kSlackTrackingCounterEnd after runtime
-        // call.
-        __ li(a6, Map::kSlackTrackingCounterEnd);
+        __ li(a6, Operand(Map::kSlackTrackingCounterEnd - 1));
 
         __ bind(&allocate);
       }