What Spectre and Meltdown Mean for WebKit

Post by kzrdude » Tue, Jan 09, 2018, 4:35 PM UTC

techdragon wrote: post #80

pizlonator wrote: post #67

Earlier quoted context omitted.

It's common for C++ code to do type checking dynamically. In WebKit we do this by rolling the type checks ourselves. With RTTI, you can do dynamic type checks using the build-in dynamic_cast primitive. Our changes, particularly the ones having to do with pointer poisoning, are meant to protect C++ code that does dynamic type checks in addition to JIT'd JS code that does dynamic type checks. Rust's `match` statement i…

Serious question, is it even possible to have something like ‘match’ or ‘dynamic_cast’ in a programming language without using branches under the hood? I’m not talking about research/example microprocessors that don’t have equivalent instructions. I mean isn’t branching a fundamental logical construct and we either do it in hardware with branch assembly operations or emulate functional equivalents of them in the soft…

Post by SquareWheel » Tue, Jan 09, 2018, 4:42 PM UTC

freeone3000 wrote: post #249

SquareWheel wrote: post #240

Earlier quoted context omitted.

>Not really, not if you think about it. Webmail doesn't need anything more than html( Because redownloading the entire page every time you click a button is such a great experience...

The page without the javascript? It likely would be, since that would be much smaller.

Post by abecedarius » Tue, Jan 09, 2018, 5:26 PM UTC

abritinthebay wrote: post #76

estebank wrote: post #69

Earlier quoted context omitted.

That sounds like a more extreme version of what the Cell[1] was supposed to be. Developers seemed to think that developing for that architecture was really painful, specially compared to other contemporary console platforms. I'd love it if the progress being made in the industry got us to actually being able to exploit the full potential of such architectures. [1]: https://en.wikipedia.org/wiki/Cell_(microprocessor)

It was painful - mostly because we don't have good tools for that sort of thing and most of our programming sort of hides the idea of multiple CPUs and pretends it's all working at once (in terms of us writing the code anyhow). It's all abstracted in a very linear way. Changing all that will take a lot of time if we do.

Post by kibwen » Tue, Jan 09, 2018, 5:31 PM UTC

petascale wrote: post #103

kibwen wrote: post #79

Earlier quoted context omitted.

> Rust's `match` statement is a dynamic type check just like C++'s `dynamic_cast`. I wonder if this is a case of a difference in terminology, because enum variants (the branches in `match` expressions) aren't considered types in Rust, and have no interaction with Rust's typechecker (Rust always has to assume that every instance of an enum can be any variant, even in cases where we as the programmer know that only one…

Hypothetical example pseudocode: if is_pointer(pt): // do pointer-based stuff else: raise error If you train the branch predictor to expect a pointer, it will speculatively treat arbitrary values as pointers until it can determine that they are not. So you can pass in any value and get it treated like a pointer for the duration of the window of speculative execution. Any conditional branch is potentially vulnerable,…

Post by zzzcpan » Tue, Jan 09, 2018, 5:35 PM UTC

madez wrote: post #256

SquareWheel wrote: post #242

Earlier quoted context omitted.

Yes, but at the cost of: 1. Increased complexity on the server side to handle both cases. 2. Degraded experience on the client side (page reloading for simple actions like upvoting).

Then let's standardize generic ways that permit things like upvotes without reloading the page and without executing externally supplied code. :-)