I was trying to do type inference by interpreting the JS bytecode and assuming that the type would stay the same. I would do this, but it would still be a linear pass as branches were never taken. This became a problem with multi variable arrays. Since many multi var arrays were initialized in a loop, indexes past 0 were null and void. Then, later in the execution, stuff that would depend on a certain item in the array were not initialized, and I had no idea what type that item was.
Instead, we just made everything a virtual method call. So far it seems to work really well, and the performance isn't nearly as bad as we thought.