What

MessageEvent.ports is specified as a FrozenArray<MessagePort>, so the
array exposed by the event must be read-only. The constructor assigned a
plain mutable array, so event.ports could be mutated — e.g.
event.ports.push(...) silently succeeded instead of throwing a
TypeError.

This freezes the array in both branches of the MessageEvent
constructor (empty and populated). Message delivery in
ext/web/13_message_port.js constructs the event via the same
constructor (new MessageEvent("message", { ports })), so delivered
events get a frozen ports array too.

Spec

HTML — the MessageEvent interface:
readonly attribute FrozenArray<MessagePort> ports;

WPT subtests now passing

webmessaging/Channel_postMessage_ports_readonly_array.any.html and
.any.worker.html:

• The postMessage() method - Make new ports into a read only array.

tests/wpt/runner/expectations/webmessaging.json flipped from false to
true for both files.

Root cause

MessageEvent in ext/web/02_event.js stored this.ports as a plain
(non-frozen) array.