[turbofan] Fix kArchTailCallCodeObject on ia32/x64.

Previously these instructions tried to jump to the value at the code entry's
location, rather than jumping to this location. Also adds a test.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1265723003

Cr-Commit-Position: refs/heads/master@{#29949}

src/compiler/ia32/code-generator-ia32.cc

@@ -318,7 +318,8 @@ void CodeGenerator::AssembleArchInstruction(Instruction* instr) {
         __ jmp(code, RelocInfo::CODE_TARGET);
       } else {
         Register reg = i.InputRegister(0);
-        __ jmp(Operand(reg, Code::kHeaderSize - kHeapObjectTag));
+        __ add(reg, Immediate(Code::kHeaderSize - kHeapObjectTag));
+        __ jmp(reg);
       }
       break;
     }

src/compiler/x64/code-generator-x64.cc

@@ -567,8 +567,8 @@ void CodeGenerator::AssembleArchInstruction(Instruction* instr) {
         __ jmp(code, RelocInfo::CODE_TARGET);
       } else {
         Register reg = i.InputRegister(0);
-        int entry = Code::kHeaderSize - kHeapObjectTag;
-        __ jmp(Operand(reg, entry));
+        __ addp(reg, Immediate(Code::kHeaderSize - kHeapObjectTag));
+        __ jmp(reg);
       }
       break;
     }