Merged r20300 into 3.25 branch.

Fix JSObject::SetElement for fixed typed array elements.

BUG=357108
LOG=N
R=jochen@chromium.org

Review URL: https://codereview.chromium.org/221233002

git-svn-id: https://v8.googlecode.com/svn/branches/3.25@20413 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Merge remote-tracking branch 'upstream/3.25' into 3.25