[CSA] Remove overzealous type check

Bug: chromium:840220
Change-Id: I37404902e99a83d029aab36411b199fad60497b0
Reviewed-on: https://chromium-review.googlesource.com/1046066Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53018}

src/builtins/builtins-typed-array-gen.cc

@@ -952,7 +952,7 @@ TNode<JSTypedArray> TypedArrayBuiltinsAssembler::SpeciesCreateByLength(
   CSA_ASSERT(this, TaggedIsPositiveSmi(len));
 
   // Let constructor be ? SpeciesConstructor(exemplar, defaultConstructor).
-  TNode<JSFunction> constructor =
+  TNode<HeapObject> constructor =
       CAST(TypedArraySpeciesConstructor(context, exemplar));
   return CreateByLength(context, constructor, len, method_name);
 }

test/mjsunit/regress/regress-crbug-840220.js

+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var boundFunction = (function(){}).bind();
+
+var instance = new Uint8Array()
+instance.constructor = {
+  [Symbol.species]: boundFunction
+};
+
+assertThrows(() => instance.map(each => each * 2), TypeError);