Return of the JIT

Privacy
1

This blog post describes a workaround for an issue arising from recent changes around the V8 optimizer toggle in some Chromium-based web browsers on desktop platforms.

Some time back, Chromium introduced a new toggle named V8 optimizer that allowed users to disable JavaScript just-in-time (JIT) compilation. This feature dramatically enhanced security by reducing the attack surface at the cost of slightly degraded performance. For reference, V8 JIT compiler bugs have accounted for roughly 45% of all the CVEs issued for V8 at some point in time.

1 Like
2

Regardless of the security benefits “slightly” might be a bit of an understatement.
It’s a very significant performance penalty.

3

I honestly disagree. Only place I’ve noticed any decrease in performance is sometimes loading advanced web apps like Proton Mail, but besides that I don’t notice a difference at all.

I guess it just depends on what sites you visit and how you use your browser, as well as your hardware.

1 Like
4

Only on the very small number of websites which make heavy use of it, for example virustotal’s hash calculation. For all others it’s not really noticable. Edge’s SDSM whitepaper has statistics for it, which also show this. Been using JITless for years on multiple devices and browsers.

2 Likes
5

I hate this, especially since it’ll throw a captcha sometimes and start again.