High Resolution Timing Mitigation: Decreases high timer resolution in Blink (#1966)

Currently disabled by default.

build/cromite_patches_list.txt

@@ -303,6 +303,7 @@ Disable-prefers-reduced-motion.patch
 Disable-css-preferred-text-scale.patch
 Disable-Viewport-Segments.patch
 Keep-disabled-cache-sharing-for-pervasive-scripts.patch
+High-Resolution-Timing-Mitigation.patch
 
 # temporary or wip patches
 Temp-PerformanceNavigationTiming-privacy-fix.patch

build/patches/High-Resolution-Timing-Mitigation.patch

@@ -0,0 +1,146 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Tue, 1 Jul 2025 14:49:55 +0000
+Subject: High Resolution Timing Mitigation
+
+Decreases high timer resolution in Blink.
+
+License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
+---
+ .../High-resolution-timing-mitigation.inc     |  8 ++++++++
+ .../High-resolution-timing-mitigation.inc     |  3 +++
+ .../High-resolution-timing-mitigation.inc     |  1 +
+ .../renderer/core/timing/time_clamper.cc      | 19 +++++++++++++++----
+ .../blink/renderer/core/timing/time_clamper.h |  5 +++--
+ .../video_frame_callback_requester_impl.cc    | 17 +++++++----------
+ 6 files changed, 37 insertions(+), 16 deletions(-)
+ create mode 100644 cromite_flags/chrome/browser/about_flags_cc/High-resolution-timing-mitigation.inc
+ create mode 100644 cromite_flags/third_party/blink/common/features_cc/High-resolution-timing-mitigation.inc
+ create mode 100644 cromite_flags/third_party/blink/common/features_h/High-resolution-timing-mitigation.inc
+
+diff --git a/cromite_flags/chrome/browser/about_flags_cc/High-resolution-timing-mitigation.inc b/cromite_flags/chrome/browser/about_flags_cc/High-resolution-timing-mitigation.inc
+new file mode 100644
+--- /dev/null
++++ b/cromite_flags/chrome/browser/about_flags_cc/High-resolution-timing-mitigation.inc
+@@ -0,0 +1,8 @@
++#ifdef FLAG_SECTION
++
++    {"high-resolution-timing-mitigation",
++     "High Resolution Timing Mitigation",
++     "Decreases timer resolution in Blink.", kOsAll,
++     FEATURE_VALUE_TYPE(blink::features::kHighResolutionTimingMitigation)},
++
++#endif
+diff --git a/cromite_flags/third_party/blink/common/features_cc/High-resolution-timing-mitigation.inc b/cromite_flags/third_party/blink/common/features_cc/High-resolution-timing-mitigation.inc
+new file mode 100644
+--- /dev/null
++++ b/cromite_flags/third_party/blink/common/features_cc/High-resolution-timing-mitigation.inc
+@@ -0,0 +1,3 @@
++CROMITE_FEATURE(kHighResolutionTimingMitigation,
++                "HighResolutionTimingMitigation",
++                base::FEATURE_DISABLED_BY_DEFAULT);
+diff --git a/cromite_flags/third_party/blink/common/features_h/High-resolution-timing-mitigation.inc b/cromite_flags/third_party/blink/common/features_h/High-resolution-timing-mitigation.inc
+new file mode 100644
+--- /dev/null
++++ b/cromite_flags/third_party/blink/common/features_h/High-resolution-timing-mitigation.inc
+@@ -0,0 +1 @@
++BLINK_COMMON_EXPORT BASE_DECLARE_FEATURE(kHighResolutionTimingMitigation);
+diff --git a/third_party/blink/renderer/core/timing/time_clamper.cc b/third_party/blink/renderer/core/timing/time_clamper.cc
+--- a/third_party/blink/renderer/core/timing/time_clamper.cc
++++ b/third_party/blink/renderer/core/timing/time_clamper.cc
+@@ -7,6 +7,9 @@
+ #include "base/bit_cast.h"
+ #include "base/rand_util.h"
+ 
++#include "third_party/blink/public/common/features.h"
++#include "third_party/blink/renderer/platform/runtime_enabled_features.h"
++
+ #include <cmath>
+ 
+ namespace blink {
+@@ -15,7 +18,10 @@ namespace {
+ const int64_t kTenLowerDigitsMod = 10000000000;
+ }  // namespace
+ 
+-TimeClamper::TimeClamper() : secret_(base::RandUint64()) {}
++TimeClamper::TimeClamper() : secret_(base::RandUint64()) {
++  timing_mitigation_ =
++    base::FeatureList::IsEnabled(features::kHighResolutionTimingMitigation);
++}
+ 
+ // This is using int64 for timestamps, because https://bit.ly/doubles-are-bad
+ base::TimeDelta TimeClamper::ClampTimeResolution(
+@@ -40,9 +46,14 @@ base::TimeDelta TimeClamper::ClampTimeResolution(
+ 
+   // Determine resolution based on the context's cross-origin isolation
+   // capability. https://w3c.github.io/hr-time/#dfn-coarsen-time
+-  int resolution = cross_origin_isolated_capability
+-                       ? kFineResolutionMicroseconds
+-                       : kCoarseResolutionMicroseconds;
++  int resolution;
++  if (timing_mitigation_) {
++    resolution = 1000;
++  } else {
++    resolution = cross_origin_isolated_capability
++                       ? 5 /*kFineResolutionMicroseconds*/
++                       : 100 /*kCoarseResolutionMicroseconds*/;
++  }
+ 
+   // Clamped the time based on the resolution.
+   int64_t clamped_time = time_lower_digits - time_lower_digits % resolution;
+diff --git a/third_party/blink/renderer/core/timing/time_clamper.h b/third_party/blink/renderer/core/timing/time_clamper.h
+--- a/third_party/blink/renderer/core/timing/time_clamper.h
++++ b/third_party/blink/renderer/core/timing/time_clamper.h
+@@ -18,8 +18,8 @@ class CORE_EXPORT TimeClamper {
+   USING_FAST_MALLOC(TimeClamper);
+ 
+  public:
+-  static constexpr int kCoarseResolutionMicroseconds = 100;
+-  static constexpr int kFineResolutionMicroseconds = 5;
++  // static constexpr int kCoarseResolutionMicroseconds = 100;
++  // static constexpr int kFineResolutionMicroseconds = 5;
+ 
+   TimeClamper();
+   TimeClamper(const TimeClamper&) = delete;
+@@ -43,6 +43,7 @@ class CORE_EXPORT TimeClamper {
+   static inline uint64_t MurmurHash3(uint64_t value);
+ 
+   uint64_t secret_;
++  bool timing_mitigation_;
+ };
+ 
+ }  // namespace blink
+diff --git a/third_party/blink/renderer/modules/video_rvfc/video_frame_callback_requester_impl.cc b/third_party/blink/renderer/modules/video_rvfc/video_frame_callback_requester_impl.cc
+--- a/third_party/blink/renderer/modules/video_rvfc/video_frame_callback_requester_impl.cc
++++ b/third_party/blink/renderer/modules/video_rvfc/video_frame_callback_requester_impl.cc
+@@ -22,6 +22,9 @@
+ #include "third_party/blink/renderer/platform/heap/persistent.h"
+ #include "third_party/blink/renderer/platform/wtf/functional.h"
+ 
++#include "third_party/blink/public/common/features.h"
++#include "third_party/blink/renderer/platform/runtime_enabled_features.h"
++
+ namespace blink {
+ 
+ namespace {
+@@ -316,16 +319,10 @@ double VideoFrameCallbackRequesterImpl::GetClampedTimeInMillis(
+ // static
+ double VideoFrameCallbackRequesterImpl::GetCoarseClampedTimeInSeconds(
+     base::TimeDelta time) {
+-  constexpr auto kCoarseResolution = base::Microseconds(100);
+-  // Add this assert, in case TimeClamper's resolution were to change to be
+-  // stricter.
+-  static_assert(
+-      kCoarseResolution >=
+-          base::Microseconds(TimeClamper::kCoarseResolutionMicroseconds),
+-      "kCoarseResolution should be at least as coarse as other clock "
+-      "resolutions");
+-
+-  return time.FloorToMultiple(kCoarseResolution).InSecondsF();
++  if (base::FeatureList::IsEnabled(features::kHighResolutionTimingMitigation))
++    return time.FloorToMultiple(base::Microseconds(1000)).InSecondsF();
++  else
++    return time.FloorToMultiple(base::Microseconds(100)).InSecondsF();
+ }
+ 
+ int VideoFrameCallbackRequesterImpl::requestVideoFrameCallback(
+--