Who knew that thread-local caches would be an essential mitigation for timing attacks. But here's how it works: if we have TLCs then we can "context switch" them when we "context switch" origins. This allows us to put some minimal distance between objects from different origins, which gives us the ability to allow small overflows when doing certain bounds checks without creating a useful Spectre information leak.
Created attachment 331061 [details] the patch
Landed in http://trac.webkit.org/changeset/226784/webkit
<rdar://problem/36441606>