Why is Poly1305, which is based on AES, faster than AES? The web pages of BearSSL have the following performance numbers:


Poly1305 1730.92 MB/s, amd64, ctmulq
AES-128 CTR 92.38 MB/s, amd64, ct64


It seems that constant-time Poly1305 is over an order of magnitude faster than AES-128 in the counter mode, without any special CPU instruction support in either.

My understanding is that Poly1305, however, is based on AES (source). Why can something based on AES be faster than AES by a so wide margin?
Poly1305 is not based on AES, it was used together with AES in Bernstein's first description http://cr.yp.to/mac/poly1305-20050329.pdf. For pseudocode of the Poly1305 algorithm see e.g. https://tools.ietf.org/html/rfc7539#section-2.5.1.

GHASH is the 'hash function' in AES/GCM. 

So if Poly1305 is faster than GHASH on some hardware this is no contradiction. And note that the peek values on your linked site are comparable: Poly1305 1730.92MB/s, GHASH 1740.96 MB/s.