Fix #3554. (#6880)

Fix #3554. (#6880)

On x86, `emitter::emitInsBinary` was calling `genProduceReg` on the
`dst` tree if the source was a contained class field load and the
destination was a register. As per the comment on the offending
function, it is the caller's responsibility to call `genProduceReg`
for the destination register, if any. This was causing errors in
GC ref reporting on x86. This issue did not appear on x64 because
AFAICT we very nearly always morph class field loads into loads of
a `CNS_INT` handle (see morph.cpp:6344 in `fgMorphField` for
details).