Fix JSObject::SetElement for fixed typed array elements.

test/mjsunit/regress/regress-357108.js

Index: test/mjsunit/regress/regress-357108.js
diff --git a/test/mjsunit/regress/regress-357108.js b/test/mjsunit/regress/regress-357108.js
new file mode 100644
index 0000000000000000000000000000000000000000..b20975b02b59c9e276bdeebbf63f97e102cf9e99
--- /dev/null
+++ b/test/mjsunit/regress/regress-357108.js
@@ -0,0 +1,20 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --typed-array-max-size-in-heap=64
+
+function TestArray(constructor) {
+  function Check(a) {
+    a[0] = "";
+    assertEquals(0, a[0]);
+    a[0] = {};
+    assertEquals(0, a[0]);
+    a[0] = { valueOf : function() { return 27; } };
+    assertEquals(27, a[0]);
+  }
+  Check(new constructor(1));
+  Check(new constructor(100));
+}
+
+TestArray(Uint8Array);