Fix 97def807

On MIPS64, the address of BoundTargetFunction was calculated badly
because instruction ADD was used for this instead of instruction DADD.
This caused flaky crashes of several tests.

TEST=mjsunit/es6/debug-step-into-constructor,mjsunit/es6/array-of,
mjsunit/function-bind,...

BUG=

Review URL: https://codereview.chromium.org/1549383002

Cr-Commit-Position: refs/heads/master@{#33048}