Baby Bear loves a compromise, they want their computer to be safe from Goldilocks' hacking attempts but also love performance improvements.
One compromise may be to probabilistic poison memory some of the time, e.g. a roughly 5% chance of poisoning. That’s more complex and involves a memory write anyway to keep the "time until poison" counter updated. We didn’t investigate it. But it’s worth noting that it would be similar in spirit to the Probabilistic Heap Checker (PHC) that’s rolling out in Firefox or the similar GWP-ASan capability in Chrome.
Instead we tested "what if we poison only the first cache line of a memory cell". Andrew McCreight and Olli Pettay pointed out that Element, a common DOM structure, is 128 bytes long and poisoning it is useful to detect memory errors in DOM code, as a lot of DOM code will involve Element.
We tested poisoning the first 64, 128 and 256 bytes of each structure. We assume that management of cache and writing cache lines back to RAM is going to be the dominant cost. Therefore we round-up our writes to the next cache line boundary..
For example, on a computer with 64-byte cache lines, if a 96-byte object is allocated so that the first 32-bytes is in one cache-line, while the next 64-bytes is in another. Our 64-byte write would cover two halves of different cache lines. In this case we will poison all 96-bytes because doing so writes to the same number of cache lines as the original 64-byte write.
Let’s add these options to our table of results.
| sp2 (score) | sp3 (score) | amazon (sec) | instagram (sec) | |
|---|---|---|---|---|
Poison |
178.84 ± 0.84 |
13.32 ± 1.03 |
243.20 ± 1.96 |
419.43 ± 1.04 |
Poison 256 |
179.50 ± 0.55 |
13.35 ± 0.33 |
240.47 ± 2.82 |
415.28 ± 1.30 |
Poison 128 |
179.19 ± 0.43 |
13.35 ± 0.59 |
241.62 ± 3.05 |
414.95 ± 1.15 |
Poison 64 |
179.09 ± 0.87 |
13.33 ± 0.83 |
242.13 ± 2.56 |
414.11 ± 0.91 |
No poisoning |
179.42 ± 0.48 |
13.39 ± 0.31 |
237.55 ± 2.60 |
414.5 ± 0.8 |
As above, sp2 and sp3 are scores - bigger numbers are better. While amazon and instagram are page load tests where smaller numbers are better.
As expected the partial poisoning results fall between full and no
poisoning. But what’s a little bit surprising is that in some tests (sp2 and
amazon) poisoning a larger amount of memory made things faster.
This could be because the memset() routine or the hardware itself is able
to optimise larger writes more effectively.
That said it’s important to acknowledge that the standard deviation is
fairly high and doing the right statistical analysis is beyond this blog post.