Throw if first argument to TypedArray.set is a number.

test/mjsunit/harmony/typedarrays.js

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 440 matching lines @@
   a61.set(a62)
   assertArrayPrefix([1, 12], a61)
 
   // Invalid source
   var a = new Uint16Array(50);
   var expected = [];
   for (i = 0; i < 50; i++) {
     a[i] = i;
     expected.push(i);
   }
-  a.set(0);
-  assertArrayPrefix(expected, a);
   a.set({});
   assertArrayPrefix(expected, a);
   assertThrows(function() { a.set.call({}) }, TypeError);
   assertThrows(function() { a.set.call([]) }, TypeError);
+
+  assertThrows(function() { a.set(0); }, TypeError);
+  assertThrows(function() { a.set(0, 1); }, TypeError);
 }
 
 TestTypedArraySet();
 
 // DataView
 function TestDataViewConstructor() {
   var ab = new ArrayBuffer(256);
 
   var d1 = new DataView(ab, 1, 255);
   assertSame(ab, d1.buffer);
@@ skipping 93 matching lines @@
 TestArbitrary(new ArrayBuffer(256));
 for(i = 0; i < typedArrayConstructors.lenght; i++) {
   TestArbitary(new typedArrayConstructors[i](10));
 }
 TestArbitrary(new DataView(new ArrayBuffer(256)));
 
 
 // Test direct constructor call
 assertThrows(function() { ArrayBuffer(); }, TypeError);
 assertThrows(function() { DataView(new ArrayBuffer()); }, TypeError);