To exploit meltdown you need to peek at specific places of memory (and flush the probe array from cache which might not be possible in JS easily).
Can you be a little more specific about this JavaScript meltdown implementation in the Spectre paper?
