314024 2026-05-04 15:28:31 -0700 REGRESSION: WebAssembly SIMD produces incorrect result on x86_64 Linux (argon2id hash mismatch) 2026-05-05 16:02:27 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar, Regression P2 Normal --- 1 yurys ysuzuki jmichaud webkit-bug-importer ysuzuki oldest_to_newest 2207383 0 yurys 2026-05-04 15:28:31 -0700 Reported downstream against Playwright's WebKit build: https://github.com/microsoft/playwright/issues/40268 An argon2id WebAssembly module (which uses v128 SIMD heavily for Blake2 compression) produces a different but deterministic hash on x86_64 Linux starting somewhere in the WebKit window below. There's no crash — output is stable, just wrong. Expected: $argon2id$v=19$m=65536,t=3,p=4$YXNkZmFzZGZhc2RmYXNkZg$Z6jf3u1V2pXhzHdPMexmG6mG+i5486N1/fV/nlvUI60 Got: $argon2id$v=19$m=65536,t=3,p=4$YXNkZmFzZGZhc2RmYXNkZg$gUlORCnWzMxGpicykVAPxO9zQhQDc56uZ+HFlRYl4pA WebKit-base bisection window (Playwright 1.58 vs 1.59): good: bf5c2a8d3ba9 (2026-01-11) bad: c5cdc14ccf8d (2026-03-20, ~310187@main) Top suspect — flips x86_64 onto a new SIMD lowering path the day before the bad cut: 309571@main / 8528edac562f "[JSC] Use wasm SIMD optimizations in x64 too" bug 310072, 2026-03-19 It adds x64 AVX specializations for vectorZipLower/Higher, vectorUnzipEven/Odd, vectorExtractPair, vectorReverse, vectorDupElement and unlocks ARM64-style B3 SIMD reductions on x64 — exactly the ops argon2id's Blake2 mixing exercises, and exactly the place a silently-wrong result would surface. Other commits in the same window in the same area (less likely but related): dbf8cb7e3ecc "[JSC] Add more SIMD lowering" 99bafdf6e24a "[JSC] Optimize B3 SIMD shuffle more" 8eb745ff86d0 "[JSC] Implement SIMD Shuffle reduction" 72cb0c48cb44 "[JSC] Move B3ReduceSIMDShuffle to B3ReduceStrength for now" A later followup in the same area landed post-cut and is not in the bad build: 9355413a9415 "[JSC] Add VectorShr(VectorZipLower(x, x), 8) strength reduction" (bug 312308, 2026-04-14) Repro: see the Playwright issue above for the argon2 wasm test case. 2207384 1 479467 yurys 2026-05-04 15:31:51 -0700 Created attachment 479467 speculative repro 2207391 2 webkit-bug-importer 2026-05-04 15:56:11 -0700 <rdar://problem/176218743> 2207481 3 ysuzuki 2026-05-04 19:17:25 -0700 Pull request: https://github.com/WebKit/WebKit/pull/64235 2207835 4 ews-feeder 2026-05-05 16:02:25 -0700 Committed 312648@main (4db9b8c8a06d): <https://commits.webkit.org/312648@main> Reviewed commits have been landed. Closing PR #64235 and removing active labels. 479467 2026-05-04 15:31:51 -0700 2026-05-04 15:31:51 -0700 speculative repro argon2-simd-repro.html text/html 2428 yurys PCFkb2N0eXBlIGh0bWw+CjwhLS0KICBTdGFuZGFsb25lIHJlcHJvZHVjZXIgZm9yIGFuIGFyZ29u MmlkIFdBU00gU0lNRCBtaXNjb21wdXRhdGlvbiBpbiBKU0Mgb24geDg2XzY0LgogIE9wZW4gaW4g TWluaUJyb3dzZXIgKG9yIGFueSBXZWJLaXQgYnVpbGQpIG92ZXIgaHR0cChzKTsgbmVlZHMgbmV0 d29yayBmb3IgdW5wa2cuCgogIE9yaWdpbiByZXBvcnRzOiBodHRwczovL2dpdGh1Yi5jb20vbWlj cm9zb2Z0L3BsYXl3cmlnaHQvaXNzdWVzLzQwMjY4CiAgV0FTTSBzb3VyY2U6ICAgIGh0dHBzOi8v Z2l0aHViLmNvbS9waGktYWcvYXJnb24yICAodW5tb2RpZmllZCwgLW1zaW1kMTI4IC1tYXZ4MikK CiAgSW5wdXRzOgogICAgcGFzc3dvcmQgPSAibXkgc2VjcmV0IHBhc3N3b3JkIgogICAgc2FsdCAg ICAgPSAiYXNkZmFzZGZhc2RmYXNkZiIgICgxNiBBU0NJSSBieXRlcykKICAgIHBhcmFtcyAgID0g bT02NTUzNiwgdD0zLCBwPTQgICAoZGVmYXVsdHMpCgogIEV4cGVjdGVkIChhbmQgcmVwcm9kdWNl ZCBvbiBTYWZhcmkvbWFjT1MsIExpbnV4IENocm9tZS9GaXJlZm94LCBhbmQgV2ViS2l0IDwgMzA5 NTcxQG1haW4pOgogICAgJGFyZ29uMmlkJHY9MTkkbT02NTUzNix0PTMscD00JFlYTmtabUZ6Wkda aGMyUm1ZWE5rWmckWjZqZjN1MVYycFhoekhkUE1leG1HNm1HK2k1NDg2TjEvZlYvbmx2VUk2MAoK ICBPYnNlcnZlZCBvbiBXZWJLaXQgTGludXggeDg2XzY0ID49IDMwOTU3MUBtYWluIChkaWZmZXJl bnQgYnV0IGRldGVybWluaXN0aWMpOgogICAgJGFyZ29uMmlkJHY9MTkkbT02NTUzNix0PTMscD00 JFlYTmtabUZ6WkdaaGMyUm1ZWE5rWmckZ1VsT1JDbld6TXhHcGljeWtWQVB4Tzl6UWhRRGM1NnVa K0hGbFJZbDRwQQoKICBPbmx5IHRoZSB0cmFpbGluZyAzMiByYXcgb3V0cHV0IGJ5dGVzIChhZnRl ciB0aGUgbGFzdCBgJGApIGRpZmZlcjsgdGhlIHByZWZpeAogIGlzIGp1c3QgYXJnb24yJ3MgUEhD LWZvcm1hdCBoZWFkZXIgKGFsZ29yaXRobSwgdmVyc2lvbiwgbS90L3AsIGJhc2U2NCBzYWx0KS4K ICBObyBjcmFzaDsgb3V0cHV0IGlzIHN0YWJsZSBhY3Jvc3MgcnVucy4KCiAgY29vcGVyNjY3IGNv bmZpcm1lZCBkb3duc3RyZWFtIHRoYXQgcmVidWlsZGluZyBhcmdvbjIncyBDIHNvdXJjZSB3aXRo b3V0CiAgLW1zaW1kMTI4IC1tYXZ4MiBtYWtlcyB0aGUgZmFpbHVyZSBnbyBhd2F5LCBwb2ludGlu ZyBhdCB0aGUgU0lNRCBjb2RlIHBhdGguCi0tPgo8aHRtbCBsYW5nPSJlbiI+CiAgPGhlYWQ+CiAg ICA8bWV0YSBjaGFyc2V0PSJVVEYtOCIgLz4KICAgIDx0aXRsZT5hcmdvbjIgU0lNRCByZXBybzwv dGl0bGU+CiAgPC9oZWFkPgogIDxib2R5PgogICAgPHByZSBpZD0ib3V0Ij5ydW5uaW5nLi4uPC9w cmU+CiAgICA8c2NyaXB0IHR5cGU9Im1vZHVsZSI+CiAgICAgIGNvbnN0IG91dCA9IGRvY3VtZW50 LmdldEVsZW1lbnRCeUlkKCJvdXQiKTsKICAgICAgY29uc3QgbG9nID0gKGxpbmUpID0+IHsgb3V0 LnRleHRDb250ZW50ICs9ICJcbiIgKyBsaW5lOyB9OwoKICAgICAgY29uc3QgRVhQRUNURUQgPQog ICAgICAgICIkYXJnb24yaWQkdj0xOSRtPTY1NTM2LHQ9MyxwPTQkWVhOa1ptRnpaR1poYzJSbVlY TmtaZyRaNmpmM3UxVjJwWGh6SGRQTWV4bUc2bUcraTU0ODZOMS9mVi9ubHZVSTYwIjsKCiAgICAg IHRyeSB7CiAgICAgICAgY29uc3QgVkVSU0lPTiA9ICIwLjUuMjEiOwogICAgICAgIGNvbnN0IGlu aXRpYWxpemUgPSAoCiAgICAgICAgICBhd2FpdCBpbXBvcnQoYGh0dHBzOi8vdW5wa2cuY29tL0Bw aGktYWcvYXJnb24yQCR7VkVSU0lPTn0vZGlzdC9mZXRjaC5qc2ApCiAgICAgICAgKS5kZWZhdWx0 OwogICAgICAgIGNvbnN0IGFyZ29uMiA9IGF3YWl0IGluaXRpYWxpemUoCiAgICAgICAgICBgaHR0 cHM6Ly91bnBrZy5jb20vQHBoaS1hZy9hcmdvbjJAJHtWRVJTSU9OfS9kaXN0L2FyZ29uMi53YXNt YAogICAgICAgICk7CgogICAgICAgIGNvbnN0IHNhbHQgPSBuZXcgVGV4dEVuY29kZXIoKS5lbmNv ZGUoImFzZGZhc2RmYXNkZmFzZGYiKTsKICAgICAgICBvdXQudGV4dENvbnRlbnQgPSAiIjsKICAg ICAgICBsb2coImV4cGVjdGVkOiAiICsgRVhQRUNURUQpOwoKICAgICAgICBmb3IgKGxldCBpID0g MDsgaSA8IDM7IGkrKykgewogICAgICAgICAgY29uc3QgeyBlbmNvZGVkIH0gPSBhcmdvbjIuaGFz aCgibXkgc2VjcmV0IHBhc3N3b3JkIiwgeyBzYWx0IH0pOwogICAgICAgICAgY29uc3Qgb2sgPSBl bmNvZGVkID09PSBFWFBFQ1RFRDsKICAgICAgICAgIGxvZyhgcnVuICR7aX06ICAgJHtlbmNvZGVk fSAgWyR7b2sgPyAiUEFTUyIgOiAiRkFJTCJ9XWApOwogICAgICAgIH0KICAgICAgfSBjYXRjaCAo ZSkgewogICAgICAgIGxvZygiZXJyb3I6ICIgKyAoZSAmJiBlLnN0YWNrIHx8IGUpKTsKICAgICAg fQogICAgPC9zY3JpcHQ+CiAgPC9ib2R5Pgo8L2h0bWw+Cg==