dnaInput = dnaInput.replace(k, subs[k], "g") the 3rd arg to String.replace is a js extension in firefox/spidermonkey. it's not supported by safari/webkit, opera, and IE. those browsers ignore the 'g' flag, so they only replace the first match. firefox is doing a lot more work on this test than other browsers.
forgot to mention. an easy way to confirm this is to add to the end of the test alert(dnaInput.length); and load it on different browsers.
Created attachment 24156 [details] Patch to update test
Comment on attachment 24156 [details] Patch to update test r=me Can you add a FIXME above this line indicating that it should really be doing a global substitution, not just a single one? We'll want to do that in a future SunSpider version.
Fixed in r37390.