[turbofan] Fix RegExp.p.exec modification test.

Forgot to negate. Oops.

Bug: chromium:906893
Change-Id: I6e7a5a87e8c513795cc598314c9f0a34e9389e69
Reviewed-on: https://chromium-review.googlesource.com/c/1342919Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57626}

src/compiler/js-call-reducer.cc

@@ -7093,7 +7093,8 @@ Reduction JSCallReducer::ReduceRegExpPrototypeTest(Node* node) {
   }
   // If "exec" has been modified on {regexp}, we can't do anything.
   if (ai_exec.IsDataConstant()) {
-    if (ai_exec.constant().is_identical_to(isolate()->regexp_exec_function())) {
+    if (!ai_exec.constant().is_identical_to(
+            isolate()->regexp_exec_function())) {
       return NoChange();
     }
   } else if (ai_exec.IsDataConstantField()) {

test/mjsunit/regress-906893.js

+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+const r = /x/;
+let counter = 0;
+
+r.exec = () => { counter++; return null; }
+
+function f() {
+  r.test("ABcd");
+}
+
+f();
+assertEquals(1, counter);
+%OptimizeFunctionOnNextCall(f);
+
+f();
+assertEquals(2, counter);