[turbofan] Fix ReduceObjectGetPrototype.

A missing negation (typo in previous refactoring) had effectively
disabled this optimization.

Bug: chromium:904104
Change-Id: I3f8d26c7594fcaa762e0a9c992b4cb0bf1bc53f6
Reviewed-on: https://chromium-review.googlesource.com/c/1329690Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57422}

src/compiler/js-call-reducer.cc

@@ -585,7 +585,7 @@ Reduction JSCallReducer::ReduceObjectGetPrototype(Node* node, Node* object) {
       MapRef object_map(broker(), object_maps[i]);
       if (IsSpecialReceiverInstanceType(object_map.instance_type()) ||
           object_map.has_hidden_prototype() ||
-          object_map.prototype().equals(candidate_prototype)) {
+          !object_map.prototype().equals(candidate_prototype)) {
         // We exclude special receivers, like JSProxy or API objects that
         // might require access checks here; we also don't want to deal
         // with hidden prototypes at this point.