DFG speculative JIT does not initialize integer tags for PredictInt32 temporaries