It's hard to profile this right now since we need to optimize Function.apply first. So bug 735402 is the first order of business here.

Bug 638794 (currently on inbound) will help v8-raytrace a lot and make Ion faster than JM+TI. The main reason is that we have better type information so we can inline more calls. We seem to be inlining most monomorphic property accesses (bug 771130). There are still a number of hot SetPropertyCache instructions for adding (not setting) properties. Inlining this is harder and I don't know how much it will win (adding propertie modifies the shape, so it's harder to optimize the GuardShape).

This still needs investigating. IonMonkey gets about 10,000 points on raytrace compared to Crankshaft which gets around 20,000. An increase of 100% would mean about a 10% increase on the overall v8 score.

ion_cannon,raytrace.js:709: 1938945688 cycles (44%), called: 58794, 32978 cycles/call ion_cannon,raytrace.js:680: 653186727 cycles (15%), called: 140034, 4664 cycles/call jm_safepoint,raytrace.js:642: 366746944 cycles (8%), called: 63, 5821380 cycles/call jm_normal,raytrace.js:642: 356900963 cycles (8%), called: 175, 2039434 cycles/call jm_normal,raytrace.js:478: 180485505 cycles (4%), called: 41030, 4398 cycles/call ion_cannon,raytrace.js:259: 64223987 cycles (1%), called: 359248, 178 cycles/call ion_compile,raytrace.js:709: 58969365 cycles (1%), called: 8, 7371170 cycles/call jm_normal,raytrace.js:426: 58879556 cycles (1%), called: 30200, 1949 cycles/call gc: 57346732 cycles (1%), called: 9, 6371859 cycles/call Note: inlined functions are reported as their caller and only cycles in the call are reported, not calls to other scripted functions. Inlined functions: raytrace.js:709 - raytrace.js:35 - raytrace.js:94 - raytrace.js:104 - raytrace.js:126 - raytrace.js:136 - raytrace.js:156 - raytrace.js:167 - raytrace.js:235 - raytrace.js:240 - raytrace.js:251 - raytrace.js:255 - raytrace.js:268 - raytrace.js:700 raytrace.js:680 - raytrace.js:35 raytrace.js:259 - raytrace.js:35 59% of the time is spend in IM script - raytrace.js:709, inlines 13+ functions, could explain the high share - raytrace.js:680, pretty small loop, strange the share is that high! 20% of the time is spend in JM script - raytrace.js:642, usecount is at max 9000, before gc wipes info. Never get IM compiled - raytrace.js:478, usecount gets high enough and gets IM compiled, BUT only ran once? I assume we invalidate on each run?

Ah, looks like raytrace.js:680 indeed inlines raytrace.js:478. So the list of inlined functions for 680 is: raytrace.js:680 - raytrace.js:478 - raytrace.js:35 - raytrace.js:244 - raytrace.js:251 - raytrace.js:255 - raytrace.js:268 Also explains the 15% running time reported

Improved profile. Also includes Ion to Ion calls (previous report didn't had that). So much more in-depth.

Removing myself as assignee. We hit parity with v8. Most bugs now are not worth the time yet. We have other places where bigger gains can get obtained. The biggest improvement here will now come from GGC.

Raytrace is the best benchmark for Firefox, being 60~70% faster than Chrome.