1 files changed, 7 insertions, 10 deletions

diff --git a/Source/JavaScriptCore/dfg/DFGGraph.h b/Source/JavaScriptCore/dfg/DFGGraph.h
index 9fbb2df07..0c77b2959 100644
--- a/Source/JavaScriptCore/dfg/DFGGraph.h
+++ b/Source/JavaScriptCore/dfg/DFGGraph.h
@@ -220,7 +220,7 @@ public:
         if (right.hasConstant())
             return addImmediateShouldSpeculateInteger(add, left, right);
         
-        return Node::shouldSpeculateInteger(left, right) && add.canSpeculateInteger();
+        return Node::shouldSpeculateIntegerExpectingDefined(left, right) && add.canSpeculateInteger();
     }
     
     bool mulShouldSpeculateInteger(Node& mul)
@@ -230,18 +230,13 @@ public:
         Node& left = at(mul.child1());
         Node& right = at(mul.child2());
         
-        if (left.hasConstant())
-            return mulImmediateShouldSpeculateInteger(mul, right, left);
-        if (right.hasConstant())
-            return mulImmediateShouldSpeculateInteger(mul, left, right);
-        
-        return Node::shouldSpeculateInteger(left, right) && mul.canSpeculateInteger() && !nodeMayOverflow(mul.arithNodeFlags());
+        return Node::shouldSpeculateIntegerForArithmetic(left, right) && mul.canSpeculateInteger();
     }
     
     bool negateShouldSpeculateInteger(Node& negate)
     {
         ASSERT(negate.op() == ArithNegate);
-        return at(negate.child1()).shouldSpeculateInteger() && negate.canSpeculateInteger();
+        return at(negate.child1()).shouldSpeculateIntegerForArithmetic() && negate.canSpeculateInteger();
     }
     
     bool addShouldSpeculateInteger(NodeIndex nodeIndex)
@@ -493,6 +488,8 @@ public:
         switch (node.arrayMode().type()) {
         case Array::Generic:
             return false;
+        case Array::Int32:
+        case Array::Double:
         case Array::Contiguous:
         case Array::ArrayStorage:
             return !node.arrayMode().isOutOfBounds();
@@ -712,7 +709,7 @@ private:
         if (!immediateValue.isNumber())
             return false;
         
-        if (!variable.shouldSpeculateInteger())
+        if (!variable.shouldSpeculateIntegerExpectingDefined())
             return false;
         
         if (immediateValue.isInt32())
@@ -734,7 +731,7 @@ private:
         if (!immediateValue.isInt32())
             return false;
         
-        if (!variable.shouldSpeculateInteger())
+        if (!variable.shouldSpeculateIntegerForArithmetic())
             return false;
         
         int32_t intImmediate = immediateValue.asInt32();