Bug 314024 – REGRESSION: WebAssembly SIMD produces incorrect result on x86_64 Linux (argon2id hash mismatch)

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Yury Semikhatsky]

Reported downstream against Playwright's WebKit build:
https://github.com/microsoft/playwright/issues/40268

An argon2id WebAssembly module (which uses v128 SIMD heavily for Blake2
compression) produces a different but deterministic hash on x86_64 Linux
starting somewhere in the WebKit window below. There's no crash — output
is stable, just wrong.

  Expected:  $argon2id$v=19$m=65536,t=3,p=4$YXNkZmFzZGZhc2RmYXNkZg$Z6jf3u1V2pXhzHdPMexmG6mG+i5486N1/fV/nlvUI60
  Got:       $argon2id$v=19$m=65536,t=3,p=4$YXNkZmFzZGZhc2RmYXNkZg$gUlORCnWzMxGpicykVAPxO9zQhQDc56uZ+HFlRYl4pA

WebKit-base bisection window (Playwright 1.58 vs 1.59):
  good: bf5c2a8d3ba9  (2026-01-11)
  bad:  c5cdc14ccf8d  (2026-03-20, ~310187@main)

Top suspect — flips x86_64 onto a new SIMD lowering path the day before
the bad cut:

  309571@main / 8528edac562f
  "[JSC] Use wasm SIMD optimizations in x64 too"
  bug 310072, 2026-03-19

It adds x64 AVX specializations for vectorZipLower/Higher,
vectorUnzipEven/Odd, vectorExtractPair, vectorReverse, vectorDupElement
and unlocks ARM64-style B3 SIMD reductions on x64 — exactly the ops
argon2id's Blake2 mixing exercises, and exactly the place a silently-wrong
result would surface.

Other commits in the same window in the same area (less likely but
related):
  dbf8cb7e3ecc  "[JSC] Add more SIMD lowering"
  99bafdf6e24a  "[JSC] Optimize B3 SIMD shuffle more"
  8eb745ff86d0  "[JSC] Implement SIMD Shuffle reduction"
  72cb0c48cb44  "[JSC] Move B3ReduceSIMDShuffle to B3ReduceStrength for now"

A later followup in the same area landed post-cut and is not in the bad
build:
  9355413a9415  "[JSC] Add VectorShr(VectorZipLower(x, x), 8) strength
                  reduction" (bug 312308, 2026-04-14)

Repro: see the Playwright issue above for the argon2 wasm test case.

[Yury Semikhatsky]

Created attachment 479467 [details]
speculative repro

[Radar WebKit Bug Importer]

<rdar://problem/176218743>

[Yusuke Suzuki]

Pull request: https://github.com/WebKit/WebKit/pull/64235

[EWS]

Committed 312648@main (4db9b8c8a06d): <https://commits.webkit.org/312648@main>

Reviewed commits have been landed. Closing PR #64235 and removing active labels.