Decreased DOMHighResTimeStamp resolution

[plehegar]

Aligning with implementation expectation.

---

Preview | Diff

[igrigorik]

@plehegar thanks for drafting this. Based on the discussion on the WG call today, the consensus was that we do not yet know what the exact recommendation here should be; each browser is doing something different: it looks like the current floor is 20us (Mozilla), but Edge is also adding jitter, Chrome is raising this to 100us for M64 and there are active investigations for M65+, and it's unclear what Webkit policy will be (they're already using clamping to 100us).

As a result, I don't think we know what the normative text should be here yet. Instead, perhaps we can add a warning in place pointing to this WIP discussion?

/cc @toddreifsteck

[plehegar]

It might be better to open an issue in that case for the discussion, since this PR might become stale overtime. If you agree, I'll open one.

[igrigorik]

Sounds good. Are you suggesting we also close this PR without further action? Or, are you suggesting adding a note and linking to an issue?

[igrigorik]

From: https://webkit.org/blog/8048/what-spectre-and-meltdown-mean-for-webkit/

Timer precision from performance.now and other sources is reduced to 1ms (r226495).
We have disabled SharedArrayBuffer, since it can be used to create a high-resolution timer (r226386).

[plehegar]

I opened #56 with all of the relevant links. Closing this PR since we need to get a better understanding first. I think a note in the meantime with a link to the issue is the best approach for now.

[blurbusters]

Crossposting here because someone at W3C gave me this link.

I have serious grave concerns about permanent precision reductions.

FireFox's 2ms precision now makes WebVR useless.

And a lot of 3D game programming techniques becomes impractical.

For a very good legitimate reason, I may have to begin automatically prompting users step by step instructions on overriding the precision reductions via advanced browser flags/config. This reduces security, since I essentially have to tell users to reduce the security globally just for one site - I do not like this approach.

Better remedy is a prompt/permissions based API like fullscreen, camera, VR, etc.

Please urgently read:
https://bugzilla.mozilla.org/show_bug.cgi?id=1427918#c9