Support typed arrays in IsMoreGeneralElementsKindTransition.

test/mjsunit/regress/regress-357054.js

Index: test/mjsunit/regress/regress-357054.js
diff --git a/test/mjsunit/neuter-twice.js b/test/mjsunit/regress/regress-357054.js
similarity index 56%
copy from test/mjsunit/neuter-twice.js
copy to test/mjsunit/regress/regress-357054.js
index 3501cee4330f966c1eeaf6f5b7ebdc6418f2bcec..92a066edc114d0869371b80f728f70731dc9ffeb 100644
--- a/test/mjsunit/neuter-twice.js
+++ b/test/mjsunit/regress/regress-357054.js
@@ -1,9 +1,10 @@
 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
-//
-// Flags: --allow-natives-syntax
 
-var ab = new ArrayBuffer(100);
-%ArrayBufferNeuter(ab);
-%ArrayBufferNeuter(ab);
+[].__defineSetter__(0, function() { });
+function f(a,i,v) { a[i] = v; }
+a = [0,0,0];
+f(a,0,5);
+a = new Float32Array(5);
+f(a,2,5.5);