[salamander014]

Sorry if I'm being thick, but why not just cache the response?

If you are guessing at the data anyway, what's the difference?

Why set up an entire speculative execution engine / runtime snapshot rollback framework when it sounds like adding heuristic decision caching would solve this problem?

[InvisGhost]

Sounds like they were caching it since they could execute it before getting the response. The difference is that they wanted to avoid the situation where they execute stale code that the server never would've served. So they can execute the stale code while waiting for the response then either toss the result or continue on with it once they determine if the server response changed.

[mostthingsweb]

How else will you discover new and exciting speculative execution vulnerabilities? /s