I took a look at the mlprof-colored control flow graph and we're hurting because of bounds checks, overflow checks, and loop-invariant references to Array_length, all of which should be removable.