--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -3649,18 +3649,17 @@ MIRType IonBuilder::binaryArithNumberSpe
   }
   return MIRType::Double;
 }
 
 AbortReasonOr<MBinaryArithInstruction*> IonBuilder::binaryArithEmitSpecialized(
     MDefinition::Opcode op, MIRType specialization, MDefinition* left,
     MDefinition* right) {
   MBinaryArithInstruction* ins =
-      MBinaryArithInstruction::New(alloc(), op, left, right);
-  ins->setSpecialization(specialization);
+      MBinaryArithInstruction::New(alloc(), op, left, right, specialization);
 
   if (op == MDefinition::Opcode::Add || op == MDefinition::Opcode::Mul) {
     ins->setCommutative();
   }
 
   current->add(ins);
   current->push(ins);
 

--- a/js/src/jit/MIR.cpp
+++ b/js/src/jit/MIR.cpp
@@ -2782,28 +2782,30 @@ void MBinaryArithInstruction::printOpcod
       break;
   }
 }
 #endif
 
 MBinaryArithInstruction* MBinaryArithInstruction::New(TempAllocator& alloc,
                                                       Opcode op,
                                                       MDefinition* left,
-                                                      MDefinition* right) {
+                                                      MDefinition* right,
+                                                      MIRType specialization) {
+  MOZ_ASSERT(IsNumberType(specialization));
   switch (op) {
     case Opcode::Add:
-      return MAdd::New(alloc, left, right);
+      return MAdd::New(alloc, left, right, specialization);
     case Opcode::Sub:
-      return MSub::New(alloc, left, right);
+      return MSub::New(alloc, left, right, specialization);
     case Opcode::Mul:
-      return MMul::New(alloc, left, right);
+      return MMul::New(alloc, left, right, specialization);
     case Opcode::Div:
-      return MDiv::New(alloc, left, right);
+      return MDiv::New(alloc, left, right, specialization);
     case Opcode::Mod:
-      return MMod::New(alloc, left, right);
+      return MMod::New(alloc, left, right, specialization);
     default:
       MOZ_CRASH("unexpected binary opcode");
   }
 }
 
 bool MBinaryArithInstruction::constantDoubleResult(TempAllocator& alloc) {
   bool typeChange = false;
   EvaluateConstantOperands(alloc, this, &typeChange);

--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -4783,17 +4783,18 @@ class MBinaryArithInstruction : public M
       : MBinaryInstruction(op, left, right),
         implicitTruncate_(NoTruncate),
         mustPreserveNaN_(false) {
     specialization_ = MIRType::None;
     setMovable();
   }
 
   static MBinaryArithInstruction* New(TempAllocator& alloc, Opcode op,
-                                      MDefinition* left, MDefinition* right);
+                                      MDefinition* left, MDefinition* right,
+                                      MIRType specialization);
 
   bool constantDoubleResult(TempAllocator& alloc);
 
   void setMustPreserveNaN(bool b) { mustPreserveNaN_ = b; }
   bool mustPreserveNaN() const { return mustPreserveNaN_; }
 
   MDefinition* foldsTo(TempAllocator& alloc) override;
 #ifdef JS_JITSPEW
@@ -5704,16 +5705,20 @@ class MMod : public MBinaryArithInstruct
   }
 
  public:
   INSTRUCTION_HEADER(Mod)
   static MMod* New(TempAllocator& alloc, MDefinition* left,
                    MDefinition* right) {
     return new (alloc) MMod(left, right, MIRType::Value);
   }
+  static MMod* New(TempAllocator& alloc, MDefinition* left, MDefinition* right,
+                   MIRType type) {
+    return new (alloc) MMod(left, right, type);
+  }
   static MMod* New(
       TempAllocator& alloc, MDefinition* left, MDefinition* right, MIRType type,
       bool unsignd, bool trapOnError = false,
       wasm::BytecodeOffset bytecodeOffset = wasm::BytecodeOffset()) {
     auto* mod = new (alloc) MMod(left, right, type);
     mod->unsigned_ = unsignd;
     mod->trapOnError_ = trapOnError;
     mod->bytecodeOffset_ = bytecodeOffset;

--- a/js/src/jsapi-tests/testJitGVN.cpp
+++ b/js/src/jsapi-tests/testJitGVN.cpp
@@ -262,19 +262,19 @@ BEGIN_TEST(testJitGVN_PinnedPhis) {
   outerBlock->end(MGoto::New(func.alloc, innerHeader));
 
   MConstant* true_ = MConstant::New(func.alloc, BooleanValue(true));
   innerHeader->add(true_);
   innerHeader->end(MTest::New(func.alloc, true_, innerBackedge, exit));
 
   innerBackedge->end(MGoto::New(func.alloc, innerHeader));
 
-  MInstruction* z4 = MAdd::New(func.alloc, phi0, phi1);
+  MInstruction* z4 = MAdd::New(func.alloc, phi0, phi1, MIRType::Int32);
   MConstant* z5 = MConstant::New(func.alloc, Int32Value(4));
-  MInstruction* z6 = MAdd::New(func.alloc, phi2, phi3);
+  MInstruction* z6 = MAdd::New(func.alloc, phi2, phi3, MIRType::Int32);
   MConstant* z7 = MConstant::New(func.alloc, Int32Value(6));
   MOZ_RELEASE_ASSERT(phi0->addInputSlow(z4));
   MOZ_RELEASE_ASSERT(phi1->addInputSlow(z5));
   MOZ_RELEASE_ASSERT(phi2->addInputSlow(z6));
   MOZ_RELEASE_ASSERT(phi3->addInputSlow(z7));
   exit->add(z4);
   exit->add(z5);
   exit->add(z6);