Right now all calls into asm.js go through the C++ trampoline CallAsmJS. We should be able to add an Ion call IC that is much much faster. The only tricky thing CallAsmJS does is push an AsmJSActivation. To avoid having to duplicate that in assembly, we can: 1. remove AsmJSActivation::cx_ and use the 'cx' from IonContext (which is already pushed if we are in Ion code) 2. remove AsmJSActivation::module_ and maintain a linked list of AsmJSModules in the Runtime which is used instead by the cold paths that currently use the stack 3. remove AsmJSActivation::errorRejoinSP_ and use the stack-walking introduced by bug 895015 instead. 4. move resumePC_ from AsmJSActivation to AsmJSModule With these changes, AsmJSActivation is completely removed from the Ion->asm.js call path. Once the IC knows the identity of the callee and the types of the arguments, the call can simply use MAsmJSPassStackArg and MAsmJSCall to make the actual call. Because these pass args in registers or unboxed on the stack, this will make an Ion->asm.js call much faster than a normal Ion->Ion call (unless the Ion->Ion call is inlined, of course).
After a bit more thought, I think it'd be simpler initially to just push an AsmJSModule from jit code. It'd still be nice to remove cx_, errorRejoinSP_ and resumePC_ as described above. However having an AsmJSActivation stack with module_ (and later, an exitSP_ and exitPC_) will really be useful for asm.js stack-walking as needed for Error.stack and SPS profiling.