Fix JSObject::SetElement for fixed typed array elements.

R=ulan@chromium.org
BUG=357108
LOG=N

Review URL: https://codereview.chromium.org/214543003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20300 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/objects.cc

@@ -12410,7 +12410,8 @@ Handle<Object> JSObject::SetElement(Handle<JSObject> object,
                                     SetPropertyMode set_mode) {
   Isolate* isolate = object->GetIsolate();
 
-  if (object->HasExternalArrayElements()) {
+  if (object->HasExternalArrayElements() ||
+      object->HasFixedTypedArrayElements()) {
     if (!value->IsNumber() && !value->IsUndefined()) {
       bool has_exception;
       Handle<Object> number =

test/mjsunit/regress/regress-357108.js

+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --typed-array-max-size-in-heap=64
+
+function TestArray(constructor) {
+  function Check(a) {
+    a[0] = "";
+    assertEquals(0, a[0]);
+    a[0] = {};
+    assertEquals(0, a[0]);
+    a[0] = { valueOf : function() { return 27; } };
+    assertEquals(27, a[0]);
+  }
+  Check(new constructor(1));
+  Check(new constructor(100));
+}
+
+TestArray(Uint8Array);