  Side-channel attacks pose serious threats to many security models, especially
sandbox-based browsers. While transient-execution side channels in out-of-order
processors have previously been blamed for vulnerabilities such as Spectre and
Meltdown, we show that in fact, the capability of out-of-order execution
\emph{itself} to cause mayhem is far more general.
  We develop Hacky Racers, a new type of timing gadget that uses
instruction-level parallelism, another key feature of out-of-order execution,
to measure arbitrary fine-grained timing differences, even in the presence of
highly restricted JavaScript sandbox environments. While such environments try
to mitigate timing side channels by reducing timer precision and removing
language features such as \textit{SharedArrayBuffer} that can be used to
indirectly generate timers via thread-level parallelism, no such restrictions
can be designed to limit Hacky Racers. We also design versions of Hacky Racers
that require no misspeculation whatsoever, demonstrating that transient
execution is not the only threat to security from modern microarchitectural
performance optimization.
  We use Hacky Racers to construct novel \textit{backwards-in-time} Spectre
gadgets, which break many hardware countermeasures in the literature by leaking
secrets before misspeculation is discovered. We also use them to generate the
first known last-level cache eviction set generator in JavaScript that does not
require \textit{SharedArrayBuffer} support.
