[csa] Fix improperly used SmiEqual.

Bug: v8:6949, v8:7754, chromium:844200
Change-Id: I0d0d0d7931ac2d560c219ab22ff3df93007f6dad
Reviewed-on: https://chromium-review.googlesource.com/1065876Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53249}

src/builtins/builtins-array-gen.cc

@@ -2137,7 +2137,9 @@ TF_BUILTIN(ArrayFrom, ArrayPopulatorAssembler) {
 
     TVARIABLE(Number, index, SmiConstant(0));
 
-    GotoIf(SmiEqual(CAST(length.value()), SmiConstant(0)), &finished);
+    // TODO(ishell): remove <Object, Object>
+    GotoIf(WordEqual<Object, Object>(length.value(), SmiConstant(0)),
+           &finished);
 
     // Loop from 0 to length-1.
     {