diff --git a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
index 28bf040..344827e 100644
--- a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
@@ -713,7 +713,8 @@
                                 globalObject->arrayPrototype()->structure()->transitionWatchpointSet());
                             m_graph.watchpoints().addLazily(
                                 globalObject->objectPrototype()->structure()->transitionWatchpointSet());
-                            node->setArrayMode(arrayMode.withSpeculation(Array::SaneChain));
+                            if (globalObject->arrayPrototypeChainIsSane())
+                                node->setArrayMode(arrayMode.withSpeculation(Array::SaneChain));
                         }
                     }
                 }
@@ -1323,6 +1324,7 @@
         case PhantomClonedArguments:
         case ForwardVarargs:
         case GetMyArgumentByVal:
+        case GetMyArgumentByValOutOfBounds:
         case PutHint:
         case CheckStructureImmediate:
         case MaterializeNewObject: