mbrodesser-Igalia · mbrodesser-Igalia · Jan 10, 2025 · Jan 10, 2025 · Jan 10, 2025 · Jan 10, 2025
diff --git a/.github/META.yml b/.github/META.yml
@@ -1,3 +1,4 @@
 suggested_reviewers:
   - foolip
   - jgraham
+  - past
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
@@ -40,7 +40,7 @@ jobs:
             latest
             type=raw,value=${{ inputs.tag }}
       - name: Build and push the Docker image
-        uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75 # v6.9.0
+        uses: docker/build-push-action@ca877d9245402d1537745e0e356eab47c3520991 # v6.13.0
         with:
           context: ./tools/docker
           push: true

diff --git a/.github/workflows/update-wasm-tests.yml b/.github/workflows/update-wasm-tests.yml
@@ -0,0 +1,64 @@
+name: Update Wasm tests
+
+on:
+  # Trigger at every Sunday UTC noon, or manually.
+  schedule:
+    - cron: 0 12 * * 0
+  workflow_dispatch:
+
+jobs:
+  build-wpt:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout WPT repo
+        uses: actions/checkout@v4
+        with:
+          path: wpt
+      - name: Checkout Wasm repo
+        uses: actions/checkout@v4
+        with:
+          repository: WebAssembly/spec
+          path: wasm-spec
+      - name: Setup OCaml
+        uses: ocaml/setup-ocaml@v3
+        with:
+          ocaml-compiler: 4.14.x
+      - name: Setup OCaml tools
+        run: opam install --yes ocamlfind.1.9.5 js_of_ocaml.4.0.0 js_of_ocaml-ppx.4.0.0
+      - name: Build interpreter
+        run: cd wasm-spec/interpreter && opam exec make
+      - name: Convert WAST tests to WPT
+        run: wasm-spec/test/build.py --dont-recompile --html wasm-spec/out/
+      - name: Copy Wasm tests to WPT
+        # Replace wasm/core entirely.
+        run: |
+          rm -rf wpt/wasm/core
+          cp -r wasm-spec/out/ wpt/wasm/core/
+      - name: Commit changes
+        id: commit
+        continue-on-error: true
+        run: |
+          cd wpt
+          export BRANCH_NAME="$BRANCH_PREFIX-$(date +'%Y%m%d%H%M%S')"
+          echo "BRANCH_NAME=$BRANCH_NAME" >> $GITHUB_ENV
+          git config user.name "$GIT_AUTHOR_NAME"
+          git config user.email "$GIT_AUTHOR_EMAIL"
+          git checkout -b $BRANCH_NAME
+          git add wasm/core/
+          git commit -m "$COMMIT_TITLE"
+        env:
+          GIT_AUTHOR_NAME: "wpt-pr-bot"
+          GIT_AUTHOR_EMAIL: "[email protected]"
+          BRANCH_PREFIX: "wasm-update"
+          COMMIT_TITLE: "Update Wasm tests"
+      - name: Create PR
+        # Check outcome for success as continue-on-error will mask failure.
+        if: ${{ steps.commit.outcome == 'success' }}
+        run: |
+          cd wpt
+          git push --set-upstream origin $BRANCH_NAME
+          gh pr create --title "$COMMIT_TITLE" --body "$PR_BODY" --reviewer past
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          COMMIT_TITLE: "Update Wasm tests"
+          PR_BODY: "Scheduled weekly update auto-generated by the '${{ github.workflow }}' workflow."
diff --git a/CODEOWNERS b/CODEOWNERS
@@ -8,3 +8,6 @@
 # Require a review for Dockerfile
 tools/docker/Dockerfile @web-platform-tests/wpt-core-team @web-platform-tests/admins
 .taskcluster.yml @web-platform-tests/wpt-core-team @web-platform-tests/admins
+
+# Prevent accidentally touching wasm/core which is updated by a workflow
+wasm/core/ @web-platform-tests/wpt-core-team
diff --git a/FileAPI/BlobURL/cross-partition-navigation.https.html b/FileAPI/BlobURL/cross-partition-navigation.https.html
@@ -0,0 +1,285 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="/common/utils.js"></script>
+<script src="/common/dispatcher/dispatcher.js"></script>
+<!-- Pull in executor_path needed by newPopup / newIframe -->
+<script src="/html/cross-origin-embedder-policy/credentialless/resources/common.js"></script>
+<!-- Pull in importScript / newPopup / newIframe -->
+<script src="/html/anonymous-iframe/resources/common.js"></script>
+<body>
+<script>
+
+const navigation_handle_null = "Navigation handle returns null";
+const navigation_handle_not_null = "Navigation handle returns not null";
+const opener_null_response = "Window.opener is null";
+const opener_not_null_response = "Window.opener isn't null";
+
+const does_blob_url_open_return_handle = (blob_url, response_queue_name) => `
+  async function test() {
+    const handle = window.open("${blob_url}")
+    if (!handle) {
+      return send("${response_queue_name}", "${navigation_handle_null}");
+    }
+
+    return send("${response_queue_name}", "${navigation_handle_not_null}");
+  }
+  await test();
+`;
+
+const add_iframe_js = (iframe_origin, response_queue_uuid) => `
+  const importScript = ${importScript};
+  await importScript("/html/cross-origin-embedder-policy/credentialless" +
+                   "/resources/common.js");
+  await importScript("/html/anonymous-iframe/resources/common.js");
+  await importScript("/common/utils.js");
+
+  // dispatcher.js has already been loaded by the popup this is running in.
+  await send("${response_queue_uuid}", newIframe("${iframe_origin}"));
+`;
+
+const same_site_origin = get_host_info().HTTPS_ORIGIN;
+const cross_site_origin = get_host_info().HTTPS_NOTSAMESITE_ORIGIN;
+
+async function create_test_iframes(t, response_queue_uuid) {
+  assert_equals("https://" + window.location.host, same_site_origin,
+  "this test assumes that the page's window.location.host corresponds to " +
+  "get_host_info().HTTPS_ORIGIN");
+
+  // Create a same-origin iframe in a cross-site popup.
+  const not_same_site_popup_uuid = newPopup(t, cross_site_origin);
+  await send(not_same_site_popup_uuid,
+       add_iframe_js(same_site_origin, response_queue_uuid));
+  const cross_site_iframe_uuid = await receive(response_queue_uuid);
+
+  // Create a same-origin iframe in a same-site popup.
+  const same_origin_popup_uuid = newPopup(t, same_site_origin);
+  await send(same_origin_popup_uuid,
+       add_iframe_js(same_site_origin, response_queue_uuid));
+  const same_site_iframe_uuid = await receive(response_queue_uuid);
+
+  return [cross_site_iframe_uuid, same_site_iframe_uuid];
+}
+
+const opener_check_frame_html = (noopener_response_queue) => `
+  <!doctype html>
+  <!-- dispatcher.js requires the baseURI to be set in order to compute
+    the server path correctly in the blob URL page. -->
+  <base href="${window.location.href}">
+  <script src="/html/cross-origin-embedder-policy/credentialless/resources/common.js"><\/script>
+  <script src="/html/anonymous-iframe/resources/common.js"><\/script>
+  <script src="/common/utils.js"><\/script>
+  <script src="/common/dispatcher/dispatcher.js"><\/script>
+  <script>
+    if (window.opener === null) {
+      send("${noopener_response_queue}", "${opener_null_response}")
+    } else {
+      send("${noopener_response_queue}", "${opener_not_null_response}")
+    }
+  <\/script>
+`;
+
+// Tests blob URL window.open for same and cross partition iframes.
+promise_test(t => {
+  return new Promise(async (resolve, reject) => {
+    try {
+      // Creates same and cross partition iframes.
+      const response_queue_uuid = token();
+      const noopener_response_queue = token();
+
+      const [cross_site_iframe_uuid, same_site_iframe_uuid] =
+        await create_test_iframes(t, response_queue_uuid);
+
+      const blob = new Blob([opener_check_frame_html(noopener_response_queue)], {type : "text/html"});
+      const blob_url = URL.createObjectURL(blob);
+
+      // Attempt to open blob URL in cross partition iframe.
+      await send(cross_site_iframe_uuid, does_blob_url_open_return_handle(blob_url, response_queue_uuid));
+      const response_1 = await receive(response_queue_uuid);
+      if (response_1 !== navigation_handle_null) {
+        reject(`Blob URL handle wasn't null in not-same-top-level-site iframe: ${response_1}`);
+      }
+      const noopener_response_1 = await receive(noopener_response_queue);
+      if (noopener_response_1 !== opener_null_response) {
+        reject(`Blob URL page opener wasn't null in not-same-top-level-site iframe.`);
+      }
+
+      // Attempt to open blob URL in same partition iframe.
+      await send(same_site_iframe_uuid, does_blob_url_open_return_handle(blob_url, response_queue_uuid));
+      const response_2 = await receive(response_queue_uuid);
+      if (response_2 !== navigation_handle_not_null) {
+        reject(`Blob URL wasn't opened in same-top-level-site iframe: ${response_2}`);
+      }
+      const noopener_response_2 = await receive(noopener_response_queue);
+      if (noopener_response_2 !== opener_not_null_response) {
+        reject(`Blob URL page opener was null in same-top-level-site iframe`);
+      }
+      resolve();
+    } catch (e) {
+      reject(e);
+    }
+  });
+}, "Blob URL window.open should enforce noopener for a cross-top-level-site navigation");
+
+const blob_url_iframe_html = (response_queue_uuid, message) => `
+  <!doctype html>
+  <!-- dispatcher.js requires the baseURI to be set in order to compute
+    the server path correctly in the blob URL page. -->
+  <base href="${window.location.href}">
+  <script src="/html/cross-origin-embedder-policy/credentialless/resources/common.js"><\/script>
+  <script src="/html/anonymous-iframe/resources/common.js"><\/script>
+  <script src="/common/utils.js"><\/script>
+  <script src="/common/dispatcher/dispatcher.js"><\/script>
+  <script>
+      window.onload = () => {
+        send("${response_queue_uuid}", "${message}");
+        window.close();
+      };
+  <\/script>
+`;
+
+const create_iframe_with_blob_url = (blob_url) => `
+  const iframe = document.createElement('iframe');
+  iframe.src = "${blob_url}";
+  document.body.appendChild(iframe);
+`;
+
+// Tests blob URL subframe navigations for same and cross partition iframes.
+promise_test(t => {
+  return new Promise(async (resolve, reject) => {
+    try {
+      // Creates same and cross partition iframes.
+      const response_queue_uuid = token();
+      const cross_site_message = "cross_partition_loaded";
+      const same_site_message = "same_partition_loaded";
+
+      const [cross_site_iframe_uuid, same_site_iframe_uuid] =
+        await create_test_iframes(t, response_queue_uuid);
+
+      // Create blob URL for the cross-site test.
+      const cross_site_blob = new Blob([blob_url_iframe_html(response_queue_uuid, cross_site_message)], {type: "text/html"});
+      const cross_site_blob_url = URL.createObjectURL(cross_site_blob);
+
+      // Attempt to open blob URL in cross partition iframe.
+      await send(cross_site_iframe_uuid, create_iframe_with_blob_url(cross_site_blob_url));
+
+      // Create blob URL for the same-site test.
+      const same_site_blob = new Blob([blob_url_iframe_html(response_queue_uuid, same_site_message)], {type: "text/html"});
+      const same_site_blob_url = URL.createObjectURL(same_site_blob);
+
+      // Attempt to open blob URL in same partition iframe.
+      await send(same_site_iframe_uuid, create_iframe_with_blob_url(same_site_blob_url));
+      const response = await receive(response_queue_uuid);
+      if (response === cross_site_message) {
+        reject(`Blob URL subframe navigation succeeded in not-same-top-level-site iframe.`);
+      }
+      resolve();
+    } catch (e) {
+      reject(e);
+    }
+  });
+}, "Blob URL should partition subframe navigation.");
+
+const open_blob_url_window_via_a_click = (blob_url) => `
+  const link = document.createElement("a");
+  link.href = "${blob_url}";
+  link.target = "_blank";
+  link.rel = "opener";
+  document.body.appendChild(link);
+  link.click();
+`;
+
+// Tests blob URL `<a target="_blank" rel="opener">` click for same and cross partition iframes.
+promise_test(t => {
+  return new Promise(async (resolve, reject) => {
+    try {
+      // Creates same and cross partition iframes.
+      const noopener_response_queue = token();
+
+      const [cross_site_iframe_uuid, same_site_iframe_uuid] = await create_test_iframes(t, token());
+
+      const blob = new Blob([opener_check_frame_html(noopener_response_queue)], {type : "text/html"});
+      const blob_url = URL.createObjectURL(blob);
+
+      // Attempt to click blob URL in cross partition iframe.
+      await send(cross_site_iframe_uuid, open_blob_url_window_via_a_click(blob_url));
+      const noopener_response_1 = await receive(noopener_response_queue);
+      if (noopener_response_1 !== opener_null_response) {
+        reject(`Blob URL page opener wasn't null in not-same-top-level-site iframe.`);
+      }
+
+      // Attempt to click blob URL in same partition iframe.
+      await send(same_site_iframe_uuid, open_blob_url_window_via_a_click(blob_url));
+      const noopener_response_2 = await receive(noopener_response_queue);
+      if (noopener_response_2 !== opener_not_null_response) {
+        reject(`Blob URL page opener was null in same-top-level-site iframe`);
+      }
+      resolve();
+    } catch (e) {
+      reject(e);
+    }
+  });
+}, "Blob URL link click should enforce noopener for a cross-top-level-site navigation");
+
+const open_blob_url_window_via_area_click = (blob_url) => `
+  const canvas = document.createElement("canvas");
+  canvas.height = 1;
+  canvas.width = 1;
+  const dataURL = canvas.toDataURL();
+
+  const image = document.createElement("img");
+  image.src = dataURL;
+  document.body.appendChild(image);
+
+  const map = document.createElement("map");
+  map.name = "map";
+  image.useMap = "#map";
+  document.body.appendChild(map);
+
+  const area = document.createElement("area");
+  area.shape = "rect";
+  area.coords = "0,0,1,1";
+  area.href = "${blob_url}";
+  area.target = "_blank";
+  area.rel = "opener";
+  map.appendChild(area);
+  area.click();
+`;
+
+// Tests blob URL `<area target="_blank" rel="opener">` click for same and cross partition iframes.
+promise_test(t => {
+  return new Promise(async (resolve, reject) => {
+    try {
+      // Creates same and cross partition iframes.
+      const noopener_response_queue = token();
+
+      const [cross_site_iframe_uuid, same_site_iframe_uuid] = await create_test_iframes(t, token());
+
+      const blob = new Blob([opener_check_frame_html(noopener_response_queue)], {type : "text/html"});
+      const blob_url = URL.createObjectURL(blob);
+
+      // Attempt to click blob URL in cross partition iframe.
+      await send(cross_site_iframe_uuid, open_blob_url_window_via_area_click(blob_url));
+      const noopener_response_1 = await receive(noopener_response_queue);
+      if (noopener_response_1 !== opener_null_response) {
+        reject(`Blob URL page opener wasn't null in not-same-top-level-site iframe.`);
+      }
+
+      // Attempt to click blob URL in same partition iframe.
+      await send(same_site_iframe_uuid, open_blob_url_window_via_area_click(blob_url));
+      const noopener_response_2 = await receive(noopener_response_queue);
+      if (noopener_response_2 !== opener_not_null_response) {
+        reject(`Blob URL page opener was null in same-top-level-site iframe`);
+      }
+      resolve();
+    } catch (e) {
+      reject(e);
+    }
+  });
+}, "Blob URL area element click should enforce noopener for a cross-top-level-site navigation");
+
+</script>
+</body>