On TodoMVC-Angular, the function tick is slower at executing the for of loop in SM than in V8. Matching V8's speed of this function would gain us 0.5% on TodoMVC-Angular.
A similar problem appears on TodoMVC-Vue, in the function triggerEffects; matching V8's speed of that function would gain us 1.5% on TodoMVC-Vue, and is the top-ranked improvement after the Proxy stuff. However, this function calls values() and next() both from for of and from the spread operator ([...set]), so fixing for of would not be enough on its own to gain those 1.5%.

I am going to attach three microbenchmarks which match the number of calls and sizes of arrays from the Speedometer benchmarks.

SM: 0.65ms
V8: 0.17ms

SM: 1.3ms
V8: 0.30ms

% js --only-inline-selfhosted for-of-vue-triggerEffects.js
% d8 --no-turbo-inlining for-of-vue-triggerEffects.js

SM: 0.80ms
V8: 0.25ms

Taking a preliminary peek at this, it looks like none of these testcases run long enough to get into Ion or Turbofan, so the gap here is baseline performance. It's not immediately obvious to me what V8 is doing that's so much faster. Eyeballing the bytecode, it looks like they're doing roughly the same sorts of things we are. My best guess without data would be that our self-hosted implementations of values and next are slower than V8's builtins. Maybe Bryan's work on eager baseline compilation for self-hosted code will help a bit here.