Remove SMI length check from Builtins::Generate_ArrayIndexOf

Currently, Generate_ArrayIndexOf handles the hypothetical case of an array with
a fast ElementsKind and non-SMI length. This should not happen (and is checked
against in JSArray::JSArrayVerify of objects_debug.cc).

Therefore this CL replaces that handling with a CSA_ASSERT that the length is
indeed SMI.

The CL also simplifies loading of the (SMI) length on 64 bit architectures by
using LoadAndUntagObjectField instead of LoadObjectField+SmiToWord.

The CL does not add new tests, because test/mjsunit/array-length.js should
cover this already.

BUG=v8:5985

Review-Url: https://codereview.chromium.org/2714173002
Cr-Commit-Position: refs/heads/master@{#43431}

src/builtins/builtins-array.cc

@@ -2021,11 +2021,13 @@ void Builtins::Generate_ArrayIndexOf(compiler::CodeAssemblerState* state) {
 
   assembler.Bind(&init_len);
   {
-    // Handle case where JSArray length is not an Smi in the runtime
-    Node* len = assembler.LoadObjectField(array, JSArray::kLengthOffset);
-    assembler.GotoIfNot(assembler.TaggedIsSmi(len), &call_runtime);
+    // JSArray length is always an Smi for fast arrays.
+    CSA_ASSERT(&assembler, assembler.TaggedIsSmi(assembler.LoadObjectField(
+                               array, JSArray::kLengthOffset)));
+    Node* len =
+        assembler.LoadAndUntagObjectField(array, JSArray::kLengthOffset);
 
-    len_var.Bind(assembler.SmiToWord(len));
+    len_var.Bind(len);
     assembler.Branch(assembler.WordEqual(len_var.value(), intptr_zero),
                      &return_not_found, &init_k);
   }