Bug 1524943 - IsPackedArray must only be called with objects. r=jandem

js/src/builtin/TypedArray.js

@@ -1508,7 +1508,7 @@ function TypedArrayStaticFrom(source, mapfn = undefined, thisArg = undefined) {
 
         // Try to take a fast path when there's no mapper function and the
         // constructor is a built-in TypedArray constructor.
-        if (!mapping && IsTypedArrayConstructor(C)) {
+        if (!mapping && IsTypedArrayConstructor(C) && IsObject(source)) {
             // TODO: Add fast path for TypedArray inputs (bug 1491813).
 
             // The source is a packed array using the default iterator.

js/src/jit-test/tests/auto-regress/bug1524943.js

@@ -0,0 +1,4 @@
+Object.prototype[Symbol.iterator] = Array.prototype[Symbol.iterator];
+
+// Just ensure it doesn't crash.
+Uint8Array.from(0);