Skip to content

Update WPT - #8126

Merged
npaun merged 8 commits into
mainfrom
automatic-update-wpt
Nov 2, 2026
Merged

npaun merged 8 commits into
mainfrom
automatic-update-wpt

Conversation

@workers-devprod

Copy link
Copy Markdown
Contributor

This is an automated pull request for updating WPT in workerd.
The WPT update was triaged by an agent using the wpt-update skill (run).

WPT update: wpt-2f17dec1f → wpt-2e4dc257c

This is a triage-only update: the dependency bump was already committed. The upstream changes are at
https://github.com/web-platform-tests/wpt/compare/2f17dec1f36194d1c236120fd38b3556be466072...2e4dc257cfbe254ff8449e291cc231f0989b2d38.diff

Verification

  • bazel test //src/wpt/... --test_size_filters= --nocache_test_results reports Build completed successfully and Executed 65 out of 65 tests: 65 tests pass. This covers the default and all-autogates variants, plus the ESLint and TypeScript checks.
  • python3 tools/cross/format.py --check git and git diff --check are clean.

WPT patches

None needed. 0001-disable-virtualenv-for-serve-command.patch still applies, and the new archive adds no requirements keys to the serve command.

Suite changes

Renamed (WebCryptoAPI, 71 suites). Upstream b638c093cd ("[WebCryptoAPI] Group tests by spec and remove tentative labels", #62873) moved the tests into modern-algos/ and secure-curves/ and dropped .tentative from the file names. For example, digest/sha3.tentative.https.any.js is now modern-algos/digest/sha3.https.any.js, and generateKey/failures_Ed448.tentative.https.any.js is now secure-curves/generateKey/failures_Ed448.https.any.js. The existing config moved with each file.

  • The old idlharness.tentative.https.any.js was split into modern-algos/idlharness.https.any.js and secure-curves/idlharness.https.any.js. Its config moved to the modern-algos file.
  • The 17 base WebCrypto IDL expectations were dropped from the modern-algos entry: the harness reported them as unexpected successes there. They remain on idlharness.https.any.js. The 5 expectations for modern-algos operations stay (encapsulateKey, encapsulateBits, decapsulateKey, decapsulateBits, getPublicKey).

Added:

Suite Upstream commit Classification
WebCryptoAPI/import_export/okp_fixed_length.https.any.js 245f4eb92d {} (passes)
WebCryptoAPI/import_export/okp_malformed_asn1.https.any.js 245f4eb92d {} (passes)
WebCryptoAPI/wrapKey_unwrapKey/aes_kw_unwrapKey_failures.https.any.js e15690d276 {} (passes)
WebCryptoAPI/secure-curves/idlharness.https.any.js b638c093cd {} (passes)
eventsource/format-bom-split.any.js b0912c9100 expectedFailures: true: workerd's EventSource does not support relative URLs (same as the other format-* suites)
eventsource/format-bom-utf-16.any.js e88a6af55a same
eventsource/format-field-id-redirect.any.js e58225abb9 same
eventsource/format-field-retry-bogus-2.any.js 4f77d3a5b3 same
fetch/api/headers/header-values-last-event-id.any.js (fetch/api and fetch/api-ts) e58225abb9 expected failure, see below
webidl/ecmascript-binding/es-exceptions/DOMException-audioworklet-processor.js ddb25fdfff omittedTests: true: an AudioWorklet processor module loaded by an HTML test, not a test; AudioWorkletProcessor does not exist in workerd

Removed: performance-timeline/not-restored-reasons/test-helper.js. Upstream a8f306ee43 moved it into resources/, which discovery skips.

Expectations added

  • encoding and encoding-ts, textdecoder-mistakes.any.js: EUC-JP JIS0212 state after a fatal streaming error is an expected failure.
    • Upstream 51a3177fe0 added the test. Per the spec, after the fatal error on 8F A2 20 the ASCII byte 0x20 must go back into the input, so the next decode returns "  ". workerd returns " ".
    • Cause: src/rust/encoding/lib.rs (decode, DecoderResult::Malformed branch) replaces the decoder with a fresh one and truncates the output, so the byte is lost.
    • The decoder is Rust (encoding_rs), so this should not differ between platforms.
  • fetch/api and fetch/api-ts, headers/header-values-last-event-id.any.js: fetch() sends the bytes of a non-ASCII Last-Event-ID header value unchanged is an expected failure.
    • Header values with code points U+0080–U+00FF go on the wire UTF-8 encoded: 636166c383c2a9 instead of 636166c3a9.
    • This is workerd's documented UTF-8 header quirk (see the runtime warning "As a quirk to support Unicode…").
  • performance-timeline, po-disconnect.any.js: Entries queued before disconnect() are not delivered after re-observing is disabled.
    • Upstream 77c05300a4 added it as an async_test that waits for an observer callback.
    • PerformanceObserver::observe and disconnect are no-ops in src/workerd/api/performance.c++:288-298, so the callback never fires and the test hangs; workerd cancels the request as hung. The other subtests in this file were already disabled.
    • The other new subtest, takeRecords() returns no entries after disconnect(), passes.

Expectations removed

  • fetch/api and fetch/api-ts, request/request-disturbed.any.js: removed Input request used for creating new request became disturbed even if body is not used.
    • Upstream 18904ce927 renamed this subtest to …with a new body is not disturbed and inverted the assertion.
    • workerd passes the new version.
    • The stale "(1) To be investigated" part of the comment was dropped.

Audit

  • I diffed every WPT directory mapped in src/wpt/BUILD.bazel between the two archives.
  • The other changed files only touch subtests that already pass or are covered by whole-file classifications:
    • WebCrypto helpers now guard buffer.transfer() with !detached (3726093110).
    • cors-preflight-cache adds a test, but the suite is omitted.
    • request-bad-port (d64eb89a3b) and websockets/Create-blocked-port (cfddf189bb) are entirely omitted or disabled.
    • http-cache/vary adds a not_cached case, which passes.
  • No disabled or omitted arrays referenced renamed or removed subtests. All moved WebCrypto entries use whole-file values or expectedFailures, which the harness validates.

Skill update

.opencode/skills/wpt-update/SKILL.md now documents two things:

  • Suites with include_tentative = True have config keys for tentative files, so upstream dropping the label renames them.
  • A stale config key aborts the whole suite before any test runs.

Out-of-scope follow-ups

  1. EUC-JP fatal streaming: in src/rust/encoding/lib.rs, on Malformed in fatal mode, keep the bytes encoding_rs consumed after the malformed sequence (or avoid resetting state those bytes depend on), so a reused streaming decoder decodes them. The same area may explain the long-disabled iso-2022-jp fatal stream case.
  2. Header encoding: sending U+0080–U+00FF header values as one byte each (ByteString semantics) would need a compat flag.
  3. PerformanceObserver: it is still a stub. Implementing delivery would unblock many disabled performance-timeline tests.
  4. Unverified comment: the remaining request-disturbed expectation (Request construction failure should not set "bodyUsed") keeps its old comment, whose reason I did not re-verify. It likely relates to workerd not treating CONNECT as a forbidden method.

@workers-devprod
workers-devprod requested review from a team as code owners November 1, 2026 19:12

@clanky-the-clanker clanky-the-clanker Bot left a comment •

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Superseded by the review of f804ff17.

This review, of 4aa9b0a5

✅ Approved — This is a WPT archive bump plus matching config: the WebCrypto suites move to their new keys, new suites are classified, and the expectations are updated. No issues were found.

The decision is advisory: this review is a comment and never approves, blocks or requests changes on the pull request.


✅ All checks passed

🚀 Release: ✅ LGTM

Risk: Low. Only the dependency pin for the test-only WPT archive changes.


🔒 Security: ✅ LGTM

The archive URL, strip_prefix and version agree across shared_deps.jsonc and the generated MODULE file. Everything else is test configuration and has no security impact.


📖 AGENTS.md: ✅ LGTM

No issues found.


📋 Code Quality: ✅ LGTM

The WPT config changes match the upstream renames and the new suites. The new expected failures and disabled tests each have an explanatory comment.


⚡ Performance: ✅ LGTM

Only test configuration changes, so there is no performance impact.


📝 Documentation: ✅ LGTM

The new notes in the wpt-update skill are accurate.


Reviewed commit: 4aa9b0a5

@clanky-the-clanker clanky-the-clanker Bot left a comment •

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Superseded by the review of 3f9d2b62.

This review, of f804ff17

✅ Approved — This updates the test-only WPT dependency and its config and adds two new WPT suites. No issues were found.

The decision is advisory: this review is a comment and never approves, blocks or requests changes on the pull request.


✅ All checks passed

🚀 Release: ✅ LGTM

Risk: Low. Only the pin for the test-only WPT archive changes.


🔒 Security: ✅ LGTM

Only test configuration and the WPT archive pin change, so there is no security impact.


📖 AGENTS.md: ✅ LGTM

No issues found.


📋 Code Quality: ✅ LGTM

The config changes match the upstream renames and the new suites. Each new disabled or omitted test has a comment explaining why.


⚡ Performance: ✅ LGTM

Only test configuration changes, so there is no performance impact.


📝 Documentation: ✅ LGTM

The new notes in the wpt-update skill are accurate.


Reviewed commit: f804ff17

@clanky-the-clanker clanky-the-clanker Bot left a comment •

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Superseded by the review of f82d7afc.

This review, of 3f9d2b62

✅ Approved — This updates the test-only WPT archive pin and its config and adds three new WPT suites. No issues were found.

The decision is advisory: this review is a comment and never approves, blocks or requests changes on the pull request.


✅ All checks passed

🚀 Release: ✅ LGTM

Risk: Low. Only the pin for the test-only WPT archive changes.


🔒 Security: ✅ LGTM

Only test configuration and the sha256-pinned WPT archive pin change, so there is no security impact.


📖 AGENTS.md: ✅ LGTM

No issues found.


📋 Code Quality: ✅ LGTM

The config changes match the upstream renames and the new suites. The new timers suite config explains each disabled or omitted test, and its BUILD.bazel target follows the existing pattern.


⚡ Performance: ✅ LGTM

Only test configuration changes, so there is no performance impact.


📝 Documentation: ✅ LGTM

The new notes in the wpt-update skill are accurate.


Reviewed commit: 3f9d2b62

workers-devprod and others added 7 commits November 2, 2026 02:17
Reconcile the WPT configuration with upstream changes between
2f17dec1f and 2e4dc257c.

WebCryptoAPI: upstream b638c093cd moved the modern-algos and
secure-curves tests into their own directories and removed the
tentative labels. Move the existing config to the new keys. The
modern-algos idlharness now covers only the modern-algos operations,
so drop the base WebCrypto IDL expectations, which remain on
idlharness.https.any.js. Add the new okp_fixed_length,
okp_malformed_asn1, aes_kw_unwrapKey_failures and secure-curves
idlharness suites, which pass.

encoding: 51a3177fe0 added an EUC-JP JIS0212 fatal streaming test.
The encoding_rs-backed decoder resets on a fatal error and drops the
ASCII byte that should be restored to the input, so mark it as an
expected failure.

eventsource: four new format-* suites use relative EventSource URLs,
matching the existing expected failures.

fetch/api: e58225abb9 added a Last-Event-ID byte test; workerd sends
U+0080-U+00FF header values UTF-8 encoded. 18904ce927 renamed and
inverted a request-disturbed assertion that workerd now passes.

performance-timeline: a8f306ee43 moved test-helper.js into resources/.
77c05300a4 added a re-observe test to po-disconnect that hangs because
PerformanceObserver never delivers callbacks; disable it.

webidl: ddb25fdfff added an AudioWorklet processor module used by an
HTML test; omit it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Explain that include_tentative suites carry config keys for tentative
files, so upstream dropping the label renames suites, and that a
stale config key aborts the whole suite before any test runs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
base64.any.js checks btoa() against a reference implementation for
286 inputs (WebIDL conversions, every code point up to U+0101, and
characters above U+00FF that must throw InvalidCharacterError), and
atob() against the shared data-URL base64 vectors from
fetch/data-urls/resources/base64.json plus WebIDL conversion cases.

All 380 subtests pass, so the config has no expected failures,
disabled or omitted tests. The JSON vectors are bound through
extra_wpt_directories.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The suite covers queueMicrotask(): that it exists, that it throws a
TypeError for non-callable arguments, that it calls the callback
asynchronously with no arguments, and that its callbacks interleave
with promise reactions in FIFO order. All 5 subtests of
queue-microtask.any.js pass.

"It rethrows exceptions" (queue-microtask-exceptions.any.js) is
disabled: it listens for the global error event, but the harness
stubs globalThis.addEventListener with a no-op, so the test hangs.
It passes with the stub removed. The two subtests in
queue-microtask.window.js need MutationObserver and a DOM, so they
are omitted.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Run the .any.js tests from html/webappapis/timers, which cover
setTimeout and setInterval: clearing timers from callbacks, using
clearTimeout and clearInterval interchangeably, missing, undefined
and negative delays, and ordering of zero-delay timers.

All 10 subtests in the 7 enabled files pass, including the two
setup({single_test: true}) files that check negative delays.

- evil-spec-example.any.js is omitted: it relies on string handlers,
  which workerd does not support because it disallows eval.
- type-long-settimeout.any.js and type-long-setinterval.any.js are
  disabled because they hang. workerd clamps the delay as a double
  rather than converting it to a WebIDL long, so 2 ** 32 ms does not
  wrap to 0 and done() is never called.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Runs the structuredClone() battery of tests
(structured-clone.any.js), which clones and transfers primitives,
wrappers, dates, regexps, errors, buffers, views, Blobs, Files,
MessagePorts and more. The three battery helper files that discovery
picks up are omitted.

117 of 135 subtests pass; 18 are expected failures and 2 (ImageBitmap,
OffscreenCanvas) are omitted because workerd has no canvas APIs.

The expected failures fall into these groups:
- enhanced_error_serialization deliberately clones custom error
  properties (8 subtests).
- File is not serializable, although Blob is.
- structuredClone(new Response()) succeeds instead of throwing a
  DataCloneError.
- Only ArrayBuffers can be transferred: MessagePort and ReadableStream
  transfers throw TypeError, and transferring a Blob throws TypeError
  instead of a DataCloneError.
- Transferring a detached ArrayBuffer succeeds.
- "Growable SharedArrayBuffer" compares a SharedArrayBuffer with
  `instanceof ArrayBuffer`, which only passes in browsers because they
  refuse to clone SABs without cross-origin isolation.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

@clanky-the-clanker clanky-the-clanker Bot left a comment •

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Superseded by the review of d4c78989.

This review, of f82d7afc

✅ Approved — Only test configuration and the test-only WPT archive pin change, and the new structured-clone suite follows the existing patterns. No issues were found.

The decision is advisory: this review is a comment and never approves, blocks or requests changes on the pull request.


✅ All checks passed

🚀 Release: ✅ LGTM

Risk: Low. Only the pin for the test-only WPT archive changes.


🔒 Security: ✅ LGTM

The sha256 pin and the URL of the WPT archive change together. The rest of the change only edits test configuration, so there is no security impact.


📖 AGENTS.md: ✅ LGTM

No issues found.


📋 Code Quality: ✅ LGTM

  • structured-clone target (src/wpt/BUILD.bazel): html/webappapis/structured-clone@module is listed in both wpt_directory and extra_wpt_directories. This is intentional: wpt_test skips the duplicate when it builds runfiles. The extra entry binds the files under their absolute path, which the META scripts need. wasm/jsapi is set up the same way.
  • structured-clone-test.ts: the config keys match the helper files and the test file. Each expected failure has a justification comment, and the omitted tests are explained.
  • The atob, timers and microtask-queuing targets follow the existing wpt_test pattern.

⚡ Performance: ✅ LGTM

Only test configuration changes, so there is no performance impact.


📝 Documentation: ✅ LGTM

The new notes in the wpt-update skill are accurate.


Reviewed commit: f82d7afc

WPT 2e4dc257c adds Blob.text() subtests for byte order marks.
Blob::text() passes the blob's bytes straight to js.str() rather
than running UTF-8 decode, so it keeps a leading BOM. The three
subtests that expect it to be stripped are recorded as expected
failures; the other five new subtests pass.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@npaun
npaun force-pushed the automatic-update-wpt branch from f82d7af to d4c7898 Compare November 2, 2026 02:19

@clanky-the-clanker clanky-the-clanker Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Approved — The change touches only WPT test configuration, the pin for the test-only WPT archive, and skill documentation. The new FileAPI BOM expectations and the new html/webappapis targets match the runtime code and follow the existing patterns. No issues found.

The decision is advisory: this review is a comment and never approves, blocks or requests changes on the pull request.


✅ All checks passed

🚀 Release: ✅ LGTM

Risk: Low. Only the pin for the test-only WPT archive changes.


🔒 Security: ✅ LGTM

The URL and sha256 pin of the WPT archive change together. Everything else is test configuration, so there is no security impact.


📖 AGENTS.md: ✅ LGTM

No issues found.


📋 Code Quality: ✅ LGTM

  • src/wpt/BUILD.bazel:
    • The microtask-queuing, atob, timers and structured-clone targets follow the existing wpt_test pattern.
    • atob pulls in fetch/data-urls@module through extra_wpt_directories, which its base64.any.js needs for fetch/data-urls/resources/base64.json.
    • structured-clone lists its own module in both places on purpose, with a comment explaining why.
  • src/wpt/FileAPI-test.ts: the three BOM expected failures match the code. Blob::text() (src/workerd/api/blob.c++:271-276) passes the bytes to js.str() without UTF-8 decoding, so it keeps a leading BOM. The failures are listed by subtest name, each with an accurate justification.

⚡ Performance: ✅ LGTM

Only test configuration changes, so there is no performance impact.


📝 Documentation: ✅ LGTM

The new notes in the wpt-update skill are accurate.


Reviewed commit: d4c78989

@npaun
npaun enabled auto-merge (rebase) November 2, 2026 02:26
@npaun
npaun merged commit d45d1a8 into main Nov 2, 2026
24 checks passed
@npaun
npaun deleted the automatic-update-wpt branch November 2, 2026 02:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants