[JSC] Speculate children first in DFG NewArray