[turbofan] Weaken map stability assumption for JSGetSuperConstructor.

There's no need to assume anything when we don't reduce the node.

R=bmeurer@chromium.org

Change-Id: Ic39b6e634c662824a72affd91318ca024f3e1055
Reviewed-on: https://chromium-review.googlesource.com/1105832Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53870}

src/compiler/js-native-context-specialization.cc

@@ -153,13 +153,11 @@ Reduction JSNativeContextSpecialization::ReduceJSGetSuperConstructor(
   // We can constant-fold the super constructor access if the
   // {function}s map is stable, i.e. we can use a code dependency
   // to guard against [[Prototype]] changes of {function}.
-  if (function_map->is_stable()) {
-    Node* value = jsgraph()->Constant(function_prototype);
+  if (function_map->is_stable() && function_prototype->IsConstructor()) {
     dependencies()->AssumeMapStable(function_map);
-    if (function_prototype->IsConstructor()) {
-      ReplaceWithValue(node, value);
-      return Replace(value);
-    }
+    Node* value = jsgraph()->Constant(function_prototype);
+    ReplaceWithValue(node, value);
+    return Replace(value);
   }
 
   return NoChange();