Windows Guide

[3QVvxrhnYZ]

As I said here:

@3QVvxrhnYZ

disabling JIT, which heavily slows down browser’s performance (especially on Android, as per my tests)? The most annoying aspect of disabling JIT for most people would be the page loading delay. Or, simply put: with JIT disabled, users will have to wait much more until their page gets rendered.

Disabling JIT slows down browsing, especially on lower-end devices. Benchmark it for yourself.
If you don’t trust me, you can listen to a reputable source — @SkewedZeppelin:

Vanadium (GrapheneOS Web Browser)

Why are you implying I am insulting you? The only thing disabled JIT will do is cause JavaScript to run slower and WASM to be disabled, it will not block ads. (Microsoft is supposedly trying to upstream a patchset that lets WASM run when JIT is off.)

Also:

Page Load times show the most severe decrease with tests that show regressions averaging around 17%

Disabling JIT does result in significantly lower scores in JavaScript benchmarks. Our tests showed a decline as high as 58%.

Source: Super Duper Secure Mode | Microsoft Browser Vulnerability Research

Since JIT-less mode disables the optimizing compiler, it comes with a performance penalty. We looked at a variety of benchmarks to better understand how V8’s performance characteristics change. Speedometer 2.0 is intended to represent a typical web application; the Web Tooling Benchmark includes a set of common JS developer tools; and we also include a benchmark that simulates a browsing workflow on the Living Room YouTube app. All measurements were made locally on an x64 Linux desktop over 5 runs.

Speedometer 2.0 is around 40% slower in JIT-less mode. Roughly half of the regression can be attributed to the disabled optimizing compiler. The other half is caused by the regular expression interpreter, which was originally intended as a debugging aid, and will see performance improvements in the future.

The Web Tooling Benchmark tends to spend more time in TurboFan-optimized code and thus shows a larger regression of 80% when JIT-less mode is enabled.

Finally, we measured a simulated browsing session on the Living Room YouTube app which includes both video playback and menu navigation. Here, JIT-less mode is roughly on-par and only shows a 6% slowdown in JS execution compared to a standard V8 configuration. This benchmark demonstrates how peak optimized code performance is not always correlated to real-world performance, and in many situations embedders can maintain reasonable performance even in JIT-less mode.

Memory consumption only changed slightly, with a median of 1.7% decrease of V8’s heap size for loading a representative set of websites.

Source: JIT-less V8 · V8

@sha123

It’s very reasonable to disable it and you get a massive security boost with little downsides.

Whether you need to disable JIT completely depends on your use-case/threat model. There are downsides. Browsing with JIT disabled is really not ready for general usage by everyone, yet, and it shouldn’t be recommended to everyone.

@sha123

It’s a common misconception to think that you need to be a high value target

I didn’t imply that. I implied that regular people getting pwned by JIT exploits is a rare case.