[turbofan] Fix lowering of Math.max for integral inputs.

R=jarin@chromium.org
BUG=chromium:468162
LOG=y

Review URL: https://codereview.chromium.org/1027753002

Cr-Commit-Position: refs/heads/master@{#27341}

src/compiler/js-builtin-reducer.cc

@@ -118,8 +118,8 @@ Reduction JSBuiltinReducer::ReduceMathMax(Node* node) {
       Node* const input = r.GetJSCallInput(i);
       value = graph()->NewNode(
           common()->Select(kMachNone),
-          graph()->NewNode(simplified()->NumberLessThan(), input, value), input,
-          value);
+          graph()->NewNode(simplified()->NumberLessThan(), input, value), value,
+          input);
     }
     return Replace(value);
   }

test/mjsunit/compiler/regress-468162.js

+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var asm = (function() {
+  "use asm";
+  var max = Math.max;
+  return function f() { return max(0, -17); };
+})();
+
+assertEquals(0, asm());

test/unittests/compiler/js-builtin-reducer-unittest.cc

@@ -112,7 +112,7 @@ TEST_F(JSBuiltinReducerTest, MathMax2) {
       if (t0->Is(Type::Integral32()) && t1->Is(Type::Integral32())) {
         ASSERT_TRUE(r.Changed());
         EXPECT_THAT(r.replacement(),
-                    IsSelect(kMachNone, IsNumberLessThan(p1, p0), p1, p0));
+                    IsSelect(kMachNone, IsNumberLessThan(p1, p0), p0, p1));
       } else {
         ASSERT_FALSE(r.Changed());
         EXPECT_EQ(IrOpcode::kJSCallFunction, call->opcode());