A technical nitpick: speculation doesn't check both forks of a branch, it has to pick a side!
The CPU tries very hard to guess which way branches go and that allows it to speculate much further than if it tried every possible combinations.
What happens in this post is that the author writes a CALL instruction, but then manipulates the stack so that it doesn't actually return where the CPU expects it to.
So the CPU will speculatively execute the instructions that follow the CALL linearly, even though they are never actually reached!
The CPU tries very hard to guess which way branches go and that allows it to speculate much further than if it tried every possible combinations.
What happens in this post is that the author writes a CALL instruction, but then manipulates the stack so that it doesn't actually return where the CPU expects it to. So the CPU will speculatively execute the instructions that follow the CALL linearly, even though they are never actually reached!