Fix Trac #3831: blowup in SpecConstr