The attached patch greatly improves the compiler's behavior on the box2d asm.js/emscripten benchmark. In combination with the patches for bug 864220 and bug 864218, running with --no-asmjs --ion-limit-script-size=off --ion-regalloc=backtracking I get frame averages of about 13 (ms?) vs. 10 with asm. Trunk is about 45. This is a mix of porting some existing tweaks from analyzeTypes, adding a few new ones and removing some unnecessary code.

Comment on attachment 747069 [details] [diff] [review] patch Review of attachment 747069 [details] [diff] [review]: ----------------------------------------------------------------- ::: js/src/ion/IonBuilder.cpp @@ +4621,5 @@ > + types::StackTypeSet *observed = script()->analysis()->bytecodeTypes(pc); > + if (observed->empty() && observed->noConstraints()) { > + if (BytecodeFlowsToBitop(pc)) { > + observed->addType(cx, types::Type::Int32Type()); > + } else if (*(pc + GetBytecodeLength(pc)) == JSOP_POS) { Nit: (*GetNextPc(pc) == JSOP_POS) @@ +4624,5 @@ > + observed->addType(cx, types::Type::Int32Type()); > + } else if (*(pc + GetBytecodeLength(pc)) == JSOP_POS) { > + // Note: this is lame, overspecialized on the code patterns used > + // by asm.js and should be replaced by a more general mechanism. > + observed->addType(cx, types::Type::DoubleType()); Worth filing a follow-up bug for this. ::: js/src/ion/VMFunctions.cpp @@ +73,2 @@ > if (thisv.isMagic(JS_IS_CONSTRUCTING)) > + return InvokeConstructor(cx, ObjectValue(*fun), argc, argvWithoutThis, rval); This works because all calls are monitored now right? Good find.