new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/basic/typeof-array.js
@@ -0,0 +1,9 @@
+
+function typeOf(o) {
+    assertEq(typeof o, "object");
+}
+
+typeOf([]);
+typeOf(new Float32Array());
+typeOf(new Int32Array());
+typeOf(new ArrayBuffer());

--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -856,22 +856,16 @@ slowarray_addProperty(JSContext *cx, Han
     if (!js_IdIsIndex(id, &index))
         return JS_TRUE;
     length = obj->getArrayLength();
     if (index >= length)
         obj->setArrayLength(cx, index + 1);
     return JS_TRUE;
 }
 
-static JSType
-array_typeOf(JSContext *cx, HandleObject obj)
-{
-    return JSTYPE_OBJECT;
-}
-
 static JSBool
 array_setGeneric(JSContext *cx, HandleObject obj, HandleId id, Value *vp, JSBool strict)
 {
     if (JSID_IS_ATOM(id, cx->runtime->atomState.lengthAtom))
         return array_length_setter(cx, obj, id, strict, vp);
 
     if (!obj->isDenseArray())
         return baseops::SetPropertyHelper(cx, obj, obj, id, 0, vp, strict);
@@ -1237,17 +1231,17 @@ Class js::ArrayClass = {
         array_setGenericAttributes,
         array_setPropertyAttributes,
         array_setElementAttributes,
         array_setSpecialAttributes,
         array_deleteProperty,
         array_deleteElement,
         array_deleteSpecial,
         NULL,       /* enumerate      */
-        array_typeOf,
+        NULL,       /* typeOf         */
         NULL,       /* thisObject     */
         NULL,       /* clear          */
     }
 };
 
 Class js::SlowArrayClass = {
     "Array",
     JSCLASS_HAS_CACHED_PROTO(JSProto_Array) | JSCLASS_FOR_OF_ITERATION,

--- a/js/src/jstypedarray.cpp
+++ b/js/src/jstypedarray.cpp
@@ -705,22 +705,16 @@ ArrayBufferObject::obj_deleteSpecial(JSC
 JSBool
 ArrayBufferObject::obj_enumerate(JSContext *cx, HandleObject obj,
                                  JSIterateOp enum_op, Value *statep, jsid *idp)
 {
     statep->setNull();
     return true;
 }
 
-JSType
-ArrayBufferObject::obj_typeOf(JSContext *cx, HandleObject obj)
-{
-    return JSTYPE_OBJECT;
-}
-
 /*
  * ArrayBufferViews of various sorts
  */
 
 static JSObject *
 GetProtoForClass(JSContext *cx, Class *clasp)
 {
     // Pass in the proto from this compartment
@@ -1320,22 +1314,16 @@ class TypedArrayTemplate
           case JSENUMERATE_DESTROY:
             statep->setNull();
             break;
         }
 
         return true;
     }
 
-    static JSType
-    obj_typeOf(JSContext *cx, HandleObject obj)
-    {
-        return JSTYPE_OBJECT;
-    }
-
     static JSObject *
     makeInstance(JSContext *cx, HandleObject bufobj, uint32_t byteOffset, uint32_t len,
                  HandleObject proto)
     {
         RootedObject obj(cx, NewBuiltinClassInstance(cx, protoClass()));
         if (!obj)
             return NULL;
         JS_ASSERT(obj->getAllocKind() == gc::FINALIZE_OBJECT8_BACKGROUND);
@@ -2891,17 +2879,17 @@ Class js::ArrayBufferClass = {
         ArrayBufferObject::obj_setGenericAttributes,
         ArrayBufferObject::obj_setPropertyAttributes,
         ArrayBufferObject::obj_setElementAttributes,
         ArrayBufferObject::obj_setSpecialAttributes,
         ArrayBufferObject::obj_deleteProperty,
         ArrayBufferObject::obj_deleteElement,
         ArrayBufferObject::obj_deleteSpecial,
         ArrayBufferObject::obj_enumerate,
-        ArrayBufferObject::obj_typeOf,
+        NULL,       /* typeOf          */
         NULL,       /* thisObject      */
         NULL,       /* clear           */
     }
 };
 
 JSFunctionSpec ArrayBufferObject::jsfuncs[] = {
     JS_FN("slice", ArrayBufferObject::fun_slice, 2, JSFUN_GENERIC_NATIVE),
     JS_FS_END
@@ -3026,17 +3014,17 @@ IMPL_TYPED_ARRAY_JSAPI_CONSTRUCTORS(Floa
         _typedArray::obj_setGenericAttributes,                                 \
         _typedArray::obj_setPropertyAttributes,                                \
         _typedArray::obj_setElementAttributes,                                 \
         _typedArray::obj_setSpecialAttributes,                                 \
         _typedArray::obj_deleteProperty,                                       \
         _typedArray::obj_deleteElement,                                        \
         _typedArray::obj_deleteSpecial,                                        \
         _typedArray::obj_enumerate,                                            \
-        _typedArray::obj_typeOf,                                               \
+        NULL,                /* typeOf      */                                 \
         NULL,                /* thisObject  */                                 \
         NULL,                /* clear       */                                 \
     }                                                                          \
 }
 
 template<class ArrayType>
 static inline JSObject *
 InitTypedArrayClass(JSContext *cx)

--- a/js/src/jstypedarray.h
+++ b/js/src/jstypedarray.h
@@ -120,19 +120,16 @@ class ArrayBufferObject : public JSObjec
     obj_deleteElement(JSContext *cx, HandleObject obj, uint32_t index, Value *rval, JSBool strict);
     static JSBool
     obj_deleteSpecial(JSContext *cx, HandleObject obj, HandleSpecialId sid, Value *rval, JSBool strict);
 
     static JSBool
     obj_enumerate(JSContext *cx, HandleObject obj, JSIterateOp enum_op,
                   Value *statep, jsid *idp);
 
-    static JSType
-    obj_typeOf(JSContext *cx, HandleObject obj);
-
     bool
     allocateSlots(JSContext *cx, uint32_t size, uint8_t *contents = NULL);
 
     inline uint32_t byteLength() const;
 
     inline uint8_t * dataPointer() const;
 
    /*