diff --git a/JSTests/modules/module-function-declaration-executable-reuse-jettison.js b/JSTests/modules/module-function-declaration-executable-reuse-jettison.js
new file mode 100644
index 000000000000..fed70cebbbd5
--- /dev/null
+++ b/JSTests/modules/module-function-declaration-executable-reuse-jettison.js
@@ -0,0 +1,8 @@
+//@ requireOptions("--forceCodeBlockToJettisonDueToOldAge=1", "--useEagerCodeBlockJettisonTiming=1")
+import { shouldBe } from "./resources/assert.js";
+import * as A from "./module-function-declaration-executable-reuse-jettison/a.js";
+
+shouldBe(A.before, "f g h s");
+shouldBe(A.after, "f 42 h2 s");
+shouldBe(A.blockResult, "block");
+shouldBe(A.fAfterBlock, "f");
diff --git a/JSTests/modules/module-function-declaration-executable-reuse-jettison/a.js b/JSTests/modules/module-function-declaration-executable-reuse-jettison/a.js
new file mode 100644
index 000000000000..c05efea47ca6
--- /dev/null
+++ b/JSTests/modules/module-function-declaration-executable-reuse-jettison/a.js
@@ -0,0 +1,16 @@
+export function f() { return "f"; }
+export function g() { return "g"; }
+export function h() { return "h"; }
+function s() { return "s"; }
+export const before = [f(), g(), h(), s()].join(" ");
+g = 42;
+h = function () { return "h2"; };
+Promise.resolve().then(() => { fullGC(); });
+await 0;
+export const after = [f(), g, h(), s()].join(" ");
+export let blockResult;
+{
+    function f() { return "block"; }
+    blockResult = f();
+}
+export const fAfterBlock = f();
diff --git a/JSTests/modules/module-function-declaration-executable-reuse.js b/JSTests/modules/module-function-declaration-executable-reuse.js
new file mode 100644
index 000000000000..051885eee79c
--- /dev/null
+++ b/JSTests/modules/module-function-declaration-executable-reuse.js
@@ -0,0 +1,23 @@
+import { shouldBe } from "./resources/assert.js";
+import * as A from "./module-function-declaration-executable-reuse/a.js";
+import * as Same1 from "./module-function-declaration-executable-reuse/same-1.js";
+import * as Same2 from "./module-function-declaration-executable-reuse/same-2.js";
+
+shouldBe(A.f(), "f");
+shouldBe(A.blockResult, "block");
+shouldBe(A.gSeenInB, "g");
+shouldBe(A.hSeenInB, "h");
+shouldBe(A.kSeenInB, "k");
+shouldBe(A.gInBody(), "replaced");
+shouldBe(A.hInBody, 42);
+shouldBe(A.kInBody, Math.max);
+shouldBe(A.callCaptured(), "captured");
+shouldBe(A.localResult, "local");
+shouldBe(A.gen().next().value, "gen");
+shouldBe(typeof A.asyncFn, "function");
+shouldBe(typeof A.asyncGen, "function");
+
+shouldBe(Same1.fInBody, Same2.f);
+shouldBe(Same2.fInBody, Same1.f);
+shouldBe(Same1.f(), "f");
+shouldBe(Same2.f(), "f");
diff --git a/JSTests/modules/module-function-declaration-executable-reuse/a.js b/JSTests/modules/module-function-declaration-executable-reuse/a.js
new file mode 100644
index 000000000000..942ea174defb
--- /dev/null
+++ b/JSTests/modules/module-function-declaration-executable-reuse/a.js
@@ -0,0 +1,29 @@
+import { gSeenInB, hSeenInB, kSeenInB } from "./b.js";
+
+export function f() { return "f"; }
+export function g() { return "g"; }
+export function h() { return "h"; }
+export function k() { return "k"; }
+export function setG(value) { g = value; }
+export function setH(value) { h = value; }
+export function setK(value) { k = value; }
+export function* gen() { yield "gen"; }
+export async function asyncFn() { return "async"; }
+export async function* asyncGen() { yield "asyncGen"; }
+
+function captured() { return "captured"; }
+export function callCaptured() { return captured(); }
+
+function local() { return "local"; }
+export const localResult = local();
+
+export let blockResult;
+{
+    function f() { return "block"; }
+    blockResult = f();
+}
+
+export const gInBody = g;
+export const hInBody = h;
+export const kInBody = k;
+export { gSeenInB, hSeenInB, kSeenInB };
diff --git a/JSTests/modules/module-function-declaration-executable-reuse/b.js b/JSTests/modules/module-function-declaration-executable-reuse/b.js
new file mode 100644
index 000000000000..27ef24c9eb97
--- /dev/null
+++ b/JSTests/modules/module-function-declaration-executable-reuse/b.js
@@ -0,0 +1,8 @@
+import { g, h, k, setG, setH, setK } from "./a.js";
+
+export const gSeenInB = g();
+export const hSeenInB = h();
+export const kSeenInB = k();
+setG(function () { return "replaced"; });
+setH(42);
+setK(Math.max);
diff --git a/JSTests/modules/module-function-declaration-executable-reuse/same-1.js b/JSTests/modules/module-function-declaration-executable-reuse/same-1.js
new file mode 100644
index 000000000000..3c5106893999
--- /dev/null
+++ b/JSTests/modules/module-function-declaration-executable-reuse/same-1.js
@@ -0,0 +1,4 @@
+import "./same-setter.js";
+export function f() { return "f"; }
+export function setF(value) { f = value; }
+export const fInBody = f;
diff --git a/JSTests/modules/module-function-declaration-executable-reuse/same-2.js b/JSTests/modules/module-function-declaration-executable-reuse/same-2.js
new file mode 100644
index 000000000000..3c5106893999
--- /dev/null
+++ b/JSTests/modules/module-function-declaration-executable-reuse/same-2.js
@@ -0,0 +1,4 @@
+import "./same-setter.js";
+export function f() { return "f"; }
+export function setF(value) { f = value; }
+export const fInBody = f;
diff --git a/JSTests/modules/module-function-declaration-executable-reuse/same-setter.js b/JSTests/modules/module-function-declaration-executable-reuse/same-setter.js
new file mode 100644
index 000000000000..6ec2b611f0c2
--- /dev/null
+++ b/JSTests/modules/module-function-declaration-executable-reuse/same-setter.js
@@ -0,0 +1,5 @@
+import { f, setF } from "./same-1.js";
+import { f as f2, setF as setF2 } from "./same-2.js";
+
+setF(f2);
+setF2(f);
diff --git a/JSTests/stress/arguments-elimination-inlined-load-varargs-preserves-recoveries.js b/JSTests/stress/arguments-elimination-inlined-load-varargs-preserves-recoveries.js
new file mode 100644
index 000000000000..6a9e21ffb290
--- /dev/null
+++ b/JSTests/stress/arguments-elimination-inlined-load-varargs-preserves-recoveries.js
@@ -0,0 +1,84 @@
+//@ runDefault("--thresholdForJITAfterWarmUp=10", "--thresholdForFTLOptimizeAfterWarmUp=1000", "--useConcurrentJIT=false", "--validateFTLOSRExitLiveness=true")
+
+"use strict";
+
+function shouldBe(actual, expected)
+{
+    if (actual !== expected)
+        throw new Error("bad value: " + actual + ", expected: " + expected);
+}
+
+function five(values1, values2)
+{
+    let result = null;
+    for (let i = 0; i < 5; ++i) {
+        function arg() { "use strict"; return arguments; }
+        const a = arg.apply(undefined, values1);
+        const b = arg.apply(undefined, values2);
+        try {
+            (3881)(b);
+        } catch (error) {
+            a.toString();
+            result = a;
+        }
+    }
+    return result;
+}
+
+function eight(values1, values2)
+{
+    let result = null;
+    for (let i = 0; i < 5; ++i) {
+        function arg() { "use strict"; return arguments; }
+        const a = arg.apply(undefined, values1);
+        const b = arg.apply(undefined, values2);
+        try {
+            (3881)(b);
+        } catch (error) {
+            a.toString();
+            result = a;
+        }
+    }
+    return result;
+}
+
+function filled(length, value)
+{
+    const result = [];
+    for (let i = 0; i < length; ++i)
+        result.push(value);
+    return result;
+}
+
+const fiveMarker = { marker: "five" };
+const eightMarker = { marker: "eight" };
+const seedArray = [{ marker: "seed" }, 1, 2, 3, 4, 5];
+
+const firstFive = filled(5, fiveMarker);
+const overwriteFive = filled(30, fiveMarker);
+overwriteFive[22] = 9;
+
+const firstEight = filled(8, eightMarker);
+const overwriteEight = filled(30, eightMarker);
+overwriteEight[20] = 9;
+
+for (let i = 0; i < testLoopCount; ++i) {
+    five(firstFive, overwriteFive);
+    eight(firstEight, overwriteEight);
+}
+
+const seedValues = filled(30, seedArray);
+seedValues[20] = 9;
+for (let i = 0; i < testLoopCount; ++i)
+    eight(firstEight, seedValues);
+
+const recoveredEight = eight(firstEight, seedValues);
+shouldBe(recoveredEight.length, firstEight.length);
+for (let i = 0; i < firstEight.length; ++i)
+    shouldBe(recoveredEight[i], eightMarker);
+
+const recoveredFive = five(firstFive, overwriteFive);
+shouldBe(recoveredFive.length, firstFive.length);
+for (let i = 0; i < firstFive.length; ++i)
+    shouldBe(recoveredFive[i], fiveMarker);
+shouldBe(recoveredFive[5], undefined);
diff --git a/JSTests/stress/arguments-elimination-load-varargs-kills-promoted-recoveries.js b/JSTests/stress/arguments-elimination-load-varargs-kills-promoted-recoveries.js
new file mode 100644
index 000000000000..aa818cb6d313
--- /dev/null
+++ b/JSTests/stress/arguments-elimination-load-varargs-kills-promoted-recoveries.js
@@ -0,0 +1,88 @@
+//@ runDefault("--thresholdForJITAfterWarmUp=10", "--thresholdForFTLOptimizeAfterWarmUp=1000", "--useConcurrentJIT=false")
+
+"use strict";
+
+function shouldBe(actual, expected)
+{
+    if (actual !== expected)
+        throw new Error("bad value: " + actual + ", expected: " + expected);
+}
+noInline(shouldBe);
+
+function five(values1, values2)
+{
+    let result = null;
+    for (let i = 0; i < 5; ++i) {
+        function arg() { "use strict"; return arguments; }
+        const a = arg.apply(undefined, values1);
+        const b = arg.apply(undefined, values2);
+        try {
+            (3881)(b);
+        } catch (error) {
+            a.toString();
+            result = a;
+        }
+    }
+    return result;
+}
+noInline(five);
+
+function eight(values1, values2)
+{
+    let result = null;
+    for (let i = 0; i < 5; ++i) {
+        function arg() { "use strict"; return arguments; }
+        const a = arg.apply(undefined, values1);
+        const b = arg.apply(undefined, values2);
+        try {
+            (3881)(b);
+        } catch (error) {
+            a.toString();
+            result = a;
+        }
+    }
+    return result;
+}
+noInline(eight);
+
+function filled(length, value)
+{
+    const result = [];
+    for (let i = 0; i < length; ++i)
+        result.push(value);
+    return result;
+}
+noInline(filled);
+
+const fiveMarker = { marker: "five" };
+const eightMarker = { marker: "eight" };
+const seedArray = [{ marker: "seed" }, 1, 2, 3, 4, 5];
+
+const firstFive = filled(5, fiveMarker);
+const overwriteFive = filled(30, fiveMarker);
+overwriteFive[22] = 9;
+
+const firstEight = filled(8, eightMarker);
+const overwriteEight = filled(30, eightMarker);
+overwriteEight[20] = 9;
+
+for (let i = 0; i < testLoopCount; ++i) {
+    five(firstFive, overwriteFive);
+    eight(firstEight, overwriteEight);
+}
+
+const seedValues = filled(30, seedArray);
+seedValues[20] = 9;
+for (let i = 0; i < testLoopCount; ++i)
+    eight(firstEight, seedValues);
+
+const recoveredEight = eight(firstEight, seedValues);
+shouldBe(recoveredEight.length, firstEight.length);
+for (let i = 0; i < firstEight.length; ++i)
+    shouldBe(recoveredEight[i], eightMarker);
+
+const recoveredFive = five(firstFive, overwriteFive);
+shouldBe(recoveredFive.length, firstFive.length);
+for (let i = 0; i < firstFive.length; ++i)
+    shouldBe(recoveredFive[i], fiveMarker);
+shouldBe(recoveredFive[5], undefined);
diff --git a/JSTests/stress/dfg-string-replace-regexp-unicode-empty-match-surrogate-pair.js b/JSTests/stress/dfg-string-replace-regexp-unicode-empty-match-surrogate-pair.js
new file mode 100644
index 000000000000..2358412ed00a
--- /dev/null
+++ b/JSTests/stress/dfg-string-replace-regexp-unicode-empty-match-surrogate-pair.js
@@ -0,0 +1,37 @@
+function shouldBe(actual, expected) {
+    if (actual !== expected)
+        throw new Error(`bad value: ${JSON.stringify(actual)}, expected ${JSON.stringify(expected)}`);
+}
+
+function replaceUnicode() {
+    return "a\u{1F600}b".replace(/(?:)/gu, "-");
+}
+noInline(replaceUnicode);
+
+function replaceUnicodeSets() {
+    return "a\u{1F600}b".replace(/(?:)/gv, "-");
+}
+noInline(replaceUnicodeSets);
+
+function replaceAllUnicode() {
+    return "\u{1F600}\u{1F601}".replaceAll(/(?:)/gu, "|");
+}
+noInline(replaceAllUnicode);
+
+function replaceLoneLead() {
+    return "a\uD83D".replace(/(?:)/gu, "-");
+}
+noInline(replaceLoneLead);
+
+function replaceNonUnicode() {
+    return "a\u{1F600}b".replace(/(?:)/g, "-");
+}
+noInline(replaceNonUnicode);
+
+for (var i = 0; i < testLoopCount; ++i) {
+    shouldBe(replaceUnicode(), "-a-\u{1F600}-b-");
+    shouldBe(replaceUnicodeSets(), "-a-\u{1F600}-b-");
+    shouldBe(replaceAllUnicode(), "|\u{1F600}|\u{1F601}|");
+    shouldBe(replaceLoneLead(), "-a-\uD83D-");
+    shouldBe(replaceNonUnicode(), "-a-\uD83D-\uDE00-b-");
+}
diff --git a/JSTests/stress/for-of-mixed-element-types-value-profile.js b/JSTests/stress/for-of-mixed-element-types-value-profile.js
new file mode 100644
index 000000000000..ef79286c34f1
--- /dev/null
+++ b/JSTests/stress/for-of-mixed-element-types-value-profile.js
@@ -0,0 +1,40 @@
+//@ skip if not $jitTests
+//@ $skipModes << :lockdown
+//@ requireOptions("--forceUnlinkedDFG=0")
+
+// The baseline JIT's fast-array op_iterator_next path must profile the iterated element into the
+// getValue checkpoint's value profile. When it wrote to the computeNext slot instead, the DFG kept
+// predicting the loop variable from whatever the LLInt had sampled, so it re-speculated the same
+// wrong type on every recompilation until the reoptimization retry counter ran out.
+
+function events(i)
+{
+    // Only the baseline JIT ever sees the number: by iteration 20000 this function is long past the
+    // LLInt.
+    return i < 20000 ? ["a", "bb", "ccc"] : ["a", "bb", 0];
+}
+noInline(events);
+
+function walk(i)
+{
+    let count = 0;
+    for (let event of events(i)) {
+        if (typeof event === "number")
+            count += event;
+        else
+            count += event.length;
+    }
+    return count;
+}
+noInline(walk);
+
+let total = 0;
+for (let i = 0; i < 300000; ++i)
+    total += walk(i);
+
+if (total !== 960000)
+    throw new Error(`bad result: ${total}`);
+
+const compiles = numberOfDFGCompiles(walk);
+if (compiles > 4)
+    throw new Error(`walk was DFG-compiled ${compiles} times; the loop variable's value profile is not being updated`);
diff --git a/JSTests/stress/ftl-osr-exit-materialize-phantom-array-with-live-butterfly.js b/JSTests/stress/ftl-osr-exit-materialize-phantom-array-with-live-butterfly.js
index ed77f790fcee..aceb48a33f53 100644
--- a/JSTests/stress/ftl-osr-exit-materialize-phantom-array-with-live-butterfly.js
+++ b/JSTests/stress/ftl-osr-exit-materialize-phantom-array-with-live-butterfly.js
@@ -1,3 +1,4 @@
+//@ slow!
 //@ runDefault("--forceEagerCompilation=1")
 
 let total = 0;
diff --git a/JSTests/stress/regexp-dot-star-enclosure-dot-all-last-index.js b/JSTests/stress/regexp-dot-star-enclosure-dot-all-last-index.js
new file mode 100644
index 000000000000..109882bf626f
--- /dev/null
+++ b/JSTests/stress/regexp-dot-star-enclosure-dot-all-last-index.js
@@ -0,0 +1,94 @@
+function shouldBe(actual, expected) {
+    if (actual !== expected)
+        throw new Error("bad value: " + actual + " expected: " + expected);
+}
+
+// Checks exec(), the lastIndex it leaves behind, and test(), which share the compiled path.
+function check(re, lastIndex, string, expectedIndex, expectedMatch) {
+    re.lastIndex = lastIndex;
+    const result = re.exec(string);
+    if (expectedMatch === null) {
+        shouldBe(result, null);
+        shouldBe(re.lastIndex, 0);
+    } else {
+        shouldBe(result[0], expectedMatch);
+        shouldBe(result.index, expectedIndex);
+        shouldBe(re.lastIndex, expectedIndex + expectedMatch.length);
+    }
+
+    re.lastIndex = lastIndex;
+    shouldBe(re.test(string), expectedMatch !== null);
+}
+
+const dotAll = /.*X.*/gs;
+const dotAllEOL = /.*X.*$/gs;
+const dotAllMultiline = /.*X.*/gms;
+// `s` is a no-op by construction here, since [\s\S] already matches every code point, so this must
+// agree with the plain `g` spelling below.
+const explicitAnyDotAll = new RegExp("[\\s\\S]*X[\\s\\S]*", "gs");
+const plain = /.*X.*/g;
+
+const bolDotAll = /^.*X.*/gs;
+const bolEOLDotAll = /^.*X.*$/gs;
+const bolDotAllMultiline = /^.*X.*/gms;
+const bolEOLDotAllMultiline = /^.*X.*$/gms;
+const bolPlain = /^.*X.*/g;
+const bolPlainMultiline = /^.*X.*/gm;
+
+function step() {
+    // 1. A global match must begin at or after lastIndex.
+    check(dotAll, 0, "aaXb", 0, "aaXb");
+    check(dotAll, 1, "aaXb", 1, "aXb");
+    check(dotAll, 2, "aaXb", 2, "Xb");
+    check(dotAll, 3, "aaXb", 0, null);
+    check(dotAll, 4, "aaXb", 0, null);
+
+    check(dotAllEOL, 1, "aaXb", 1, "aXb");
+    check(dotAll, 1, "aaXbXc", 1, "aXbXc");
+
+    // The enclosure still reaches across line terminators; it just cannot reach past lastIndex.
+    check(dotAll, 1, "aa\nXb", 1, "a\nXb");
+    check(dotAllMultiline, 1, "aa\nXb", 1, "a\nXb");
+
+    check(explicitAnyDotAll, 1, "aaXb", 1, "aXb");
+    check(plain, 1, "aaXb", 1, "aXb");
+
+    // matchAll() starts from lastIndex too, and its first yield was wrong for the same reason.
+    dotAll.lastIndex = 0;
+    const all = [...("aaXb".matchAll(dotAll))];
+    shouldBe(all.length, 1);
+    shouldBe(all[0].index, 0);
+    shouldBe(all[0][0], "aaXb");
+
+    // 2. `^` still has to hold where the match is reported to begin.
+    check(bolDotAll, 0, "aaXb", 0, "aaXb");
+    check(bolDotAll, 1, "aaXb", 0, null);
+    check(bolDotAll, 2, "aaXb", 0, null);
+    check(bolEOLDotAll, 0, "aaXb", 0, "aaXb");
+    check(bolEOLDotAll, 1, "aaXb", 0, null);
+
+    // Non-zero lastIndex is fine when `^` genuinely holds: under `m` it holds after a newline.
+    check(bolDotAllMultiline, 0, "aa\nXb", 0, "aa\nXb");
+    check(bolDotAllMultiline, 1, "aa\nXb", 3, "Xb");
+    check(bolDotAllMultiline, 3, "aa\nXb", 3, "Xb");
+    check(bolDotAllMultiline, 1, "aaXb", 0, null);
+    check(bolEOLDotAllMultiline, 1, "aa\nXb", 3, "Xb");
+
+    // Under `m` the match can even have to begin at a line start *after* the X the enclosure would
+    // have matched: the leftmost X is at 1, but `^` does not hold there, so the match is "cXd" at 4.
+    // Widening backwards cannot reach that, which is why these patterns skip the enclosure.
+    check(bolDotAllMultiline, 1, "aXb\ncXd", 4, "cXd");
+    check(bolDotAllMultiline, 2, "aXb\ncXd", 4, "cXd");
+    check(bolDotAllMultiline, 4, "aXb\ncXd", 4, "cXd");
+    check(bolDotAllMultiline, 5, "aXb\ncXd", 0, null);
+    check(bolEOLDotAllMultiline, 1, "aXb\ncXd", 4, "cXd");
+
+    // Non-dotAll spellings keep using the enclosure and must be unaffected.
+    check(bolPlain, 0, "aaXb", 0, "aaXb");
+    check(bolPlain, 1, "aaXb", 0, null);
+    check(bolPlainMultiline, 0, "aa\nXb", 3, "Xb");
+    check(bolPlainMultiline, 1, "aa\nXb", 3, "Xb");
+}
+
+for (var i = 0; i < testLoopCount; ++i)
+    step();
diff --git a/JSTests/wasm.yaml b/JSTests/wasm.yaml
index ae481b41bdbb..80d6f5fa6df7 100644
--- a/JSTests/wasm.yaml
+++ b/JSTests/wasm.yaml
@@ -53,6 +53,8 @@
   cmd: runV8WebAssemblySuite(:no_module, "mjsunit.js") unless parseRunCommands
 - path: wasm/branch-hints
   cmd: runWebAssemblySuite unless parseRunCommands
+- path: wasm/extended-const
+  cmd: runWebAssemblySuite unless parseRunCommands
 - path: wasm/threads-spec-tests
   cmd: runWebAssemblyThreadsSpecTest :normal
 
diff --git a/JSTests/wasm/extended-const/extended-const.js b/JSTests/wasm/extended-const/extended-const.js
index b273086a583d..76fbb68b516d 100644
--- a/JSTests/wasm/extended-const/extended-const.js
+++ b/JSTests/wasm/extended-const/extended-const.js
@@ -309,8 +309,7 @@ async function testExtendedConstElement() {
     assert.eq(m.exports.t.get(43), null);
   }
 
-  // FIXME: this requires changing how element segment initialization vectors are parsed.
-  // Test element segment kind 6.with element init expression.
+  // Test element segment kind 6 with element init expression.
   /*
    * (module
    *   (global (import "m" "gi1") externref)
@@ -318,17 +317,17 @@ async function testExtendedConstElement() {
    *   (elem (table 0) (offset (i32.add (i32.const 1) (i32.const 42))) externref (global.get 0))
    *   )
    */
-  //{
-  //  let obj = "hello";
-  //  let m = new WebAssembly.Instance(
-  //    module("\x00\x61\x73\x6d\x01\x00\x00\x00\x02\x8a\x80\x80\x80\x00\x01\x01\x6d\x03\x67\x69\x31\x03\x6f\x00\x04\x84\x80\x80\x80\x00\x01\x6f\x00\x40\x07\x85\x80\x80\x80\x00\x01\x01\x74\x01\x00\x09\x8e\x80\x80\x80\x00\x01\x06\x00\x41\x01\x41\x2a\x6a\x0b\x6f\x01\x23\x00\x0b"),
-  //    { m: { gi1: obj } }
-  //  );
-  //  assert.eq(m.exports.t.get(0), null);
-  //  assert.eq(m.exports.t.get(42), null);
-  //  assert.eq(m.exports.t.get(43), obj);
-  //  assert.eq(m.exports.t.get(44), null);
-  //}
+  {
+    let obj = "hello";
+    let m = new WebAssembly.Instance(
+      module("\x00\x61\x73\x6d\x01\x00\x00\x00\x02\x8a\x80\x80\x80\x00\x01\x01\x6d\x03\x67\x69\x31\x03\x6f\x00\x04\x84\x80\x80\x80\x00\x01\x6f\x00\x40\x07\x85\x80\x80\x80\x00\x01\x01\x74\x01\x00\x09\x8e\x80\x80\x80\x00\x01\x06\x00\x41\x01\x41\x2a\x6a\x0b\x6f\x01\x23\x00\x0b"),
+      { m: { gi1: obj } }
+    );
+    assert.eq(m.exports.t.get(0), null);
+    assert.eq(m.exports.t.get(42), null);
+    assert.eq(m.exports.t.get(43), obj);
+    assert.eq(m.exports.t.get(44), null);
+  }
 }
 
 async function testExtendedConstData() {
diff --git a/JSTests/wasm/js-api/js-module-mutable-global-export.js b/JSTests/wasm/js-api/js-module-mutable-global-export.js
new file mode 100644
index 000000000000..f7930af3a1f6
--- /dev/null
+++ b/JSTests/wasm/js-api/js-module-mutable-global-export.js
@@ -0,0 +1 @@
+export const g = new WebAssembly.Global({ value: "i32", mutable: true }, 1);
diff --git a/JSTests/wasm/js-api/js-module-mutable-global-namespace.js b/JSTests/wasm/js-api/js-module-mutable-global-namespace.js
new file mode 100644
index 000000000000..c1c3fb61368f
--- /dev/null
+++ b/JSTests/wasm/js-api/js-module-mutable-global-namespace.js
@@ -0,0 +1,8 @@
+import * as ns from "./js-module-mutable-global-export.js"
+import * as assert from "../assert.js";
+
+assert.instanceof(ns.g, WebAssembly.Global);
+assert.eq(ns.g.value, 1);
+ns.g.value = 7;
+assert.eq(ns.g.value, 7);
+assert.instanceof(ns.g, WebAssembly.Global);
diff --git a/JSTests/wasm/js-api/js-reexport-wasm-mut-global-namespace.js b/JSTests/wasm/js-api/js-reexport-wasm-mut-global-namespace.js
new file mode 100644
index 000000000000..536b75e55b23
--- /dev/null
+++ b/JSTests/wasm/js-api/js-reexport-wasm-mut-global-namespace.js
@@ -0,0 +1,7 @@
+import * as ns from "./js-reexport-wasm-mut-global.js"
+import * as assert from "../assert.js";
+
+assert.eq(ns.g, 100);
+ns.set(3);
+assert.eq(ns.get(), 3);
+assert.eq(ns.g, 3);
diff --git a/JSTests/wasm/js-api/js-reexport-wasm-mut-global.js b/JSTests/wasm/js-api/js-reexport-wasm-mut-global.js
new file mode 100644
index 000000000000..359daa4f59d2
--- /dev/null
+++ b/JSTests/wasm/js-api/js-reexport-wasm-mut-global.js
@@ -0,0 +1 @@
+export { g, get, set } from "../modules/mut-global.wasm";
diff --git a/JSTests/wasm/js-api/js-wasm-imported-mut-global-namespace.js b/JSTests/wasm/js-api/js-wasm-imported-mut-global-namespace.js
new file mode 100644
index 000000000000..4ef6065f266f
--- /dev/null
+++ b/JSTests/wasm/js-api/js-wasm-imported-mut-global-namespace.js
@@ -0,0 +1,11 @@
+import * as ns from "./reexport-js-mut-global.wasm"
+import { g } from "./js-module-mutable-global-export.js"
+import * as assert from "../assert.js";
+
+assert.eq(ns.g, 1);
+assert.instanceof(g, WebAssembly.Global);
+assert.eq(g.value, 1);
+
+g.value = 9;
+assert.eq(ns.g, 9);
+assert.eq(g.value, 9);
diff --git a/JSTests/wasm/js-api/reexport-js-mut-global.wasm b/JSTests/wasm/js-api/reexport-js-mut-global.wasm
new file mode 100644
index 000000000000..cbfac2fd3b1a
Binary files /dev/null and b/JSTests/wasm/js-api/reexport-js-mut-global.wasm differ
diff --git a/JSTests/wasm/js-api/reexport-js-mut-global.wat b/JSTests/wasm/js-api/reexport-js-mut-global.wat
new file mode 100644
index 000000000000..0e8b69023c51
--- /dev/null
+++ b/JSTests/wasm/js-api/reexport-js-mut-global.wat
@@ -0,0 +1,3 @@
+(module
+  (import "./js-module-mutable-global-export.js" "g" (global $g (mut i32)))
+  (export "g" (global $g)))
diff --git a/JSTests/wasm/js-api/test_basic_api.js b/JSTests/wasm/js-api/test_basic_api.js
index 1231915b9554..fa4f19788da6 100644
--- a/JSTests/wasm/js-api/test_basic_api.js
+++ b/JSTests/wasm/js-api/test_basic_api.js
@@ -66,8 +66,7 @@ for (const c in constructorProperties) {
         for (const invalid of invalidConstructorInputs)
             assert.throws(() => new WebAssembly[c](invalid), TypeError, `first argument must be an ArrayBufferView or an ArrayBuffer (evaluating 'new WebAssembly[c](invalid)')`);
         for (const buffer of [new ArrayBuffer(), new DataView(new ArrayBuffer()), new Int8Array(), new Uint8Array(), new Uint8ClampedArray(), new Int16Array(), new Uint16Array(), new Int32Array(), new Uint32Array(), new Float32Array(), new Float64Array()])
-            // FIXME the following should be WebAssembly.CompileError. https://bugs.webkit.org/show_bug.cgi?id=163768
-            assert.throws(() => new WebAssembly[c](buffer), Error, `WebAssembly.Module doesn't parse at byte 0: expected a module of at least 8 bytes (evaluating 'new WebAssembly[c](buffer)')`);
+            assert.throws(() => new WebAssembly[c](buffer), WebAssembly.CompileError, `WebAssembly.Module doesn't parse at byte 0: expected a module of at least 8 bytes (evaluating 'new WebAssembly[c](buffer)')`);
         assert.instanceof(new WebAssembly[c](emptyModuleArray), WebAssembly.Module);
         break;
     case "Instance":
diff --git a/JSTests/wasm/modules/js-wasm-mutable-global-namespace.js b/JSTests/wasm/modules/js-wasm-mutable-global-namespace.js
new file mode 100644
index 000000000000..8b2ce01950c6
--- /dev/null
+++ b/JSTests/wasm/modules/js-wasm-mutable-global-namespace.js
@@ -0,0 +1,13 @@
+import * as ns from "./mut-global.wasm"
+import * as assert from '../assert.js';
+
+assert.eq(ns.g, 100);
+assert.eq(ns.get(), 100);
+
+ns.set(555);
+assert.eq(ns.get(), 555);
+assert.eq(ns.g, 555);
+
+assert.throws(() => {
+    ns.g = 1;
+}, TypeError, `Attempted to assign to readonly property.`);
diff --git a/JSTests/wasm/modules/js-wasm-reserved-names.js b/JSTests/wasm/modules/js-wasm-reserved-names.js
new file mode 100644
index 000000000000..283c865026c4
--- /dev/null
+++ b/JSTests/wasm/modules/js-wasm-reserved-names.js
@@ -0,0 +1,21 @@
+import * as assert from '../assert.js';
+
+function assertLinkError(promise) {
+    return promise.then($vm.abort, function (error) {
+        assert.eq(error instanceof WebAssembly.LinkError, true);
+    });
+}
+
+assertLinkError(import("./reserved-import-name.wasm"))
+    .then(() => assertLinkError(import("./reserved-import-name-wasm-js.wasm")))
+    .then(() => assertLinkError(import("./reserved-export-name.wasm")))
+    .then(() => assertLinkError(import("./reserved-export-name-wasm-js.wasm")))
+    .then(() => assertLinkError(import("./reserved-import-module.wasm")))
+    .then(() => import("./wasm-colon-module.wasm").then($vm.abort, function (error) {
+        assert.eq(error instanceof WebAssembly.LinkError && String(error).includes("is reserved"), false);
+    }))
+    .then(function () { }, $vm.abort);
+
+const { "wasm:invalid": fn } = new WebAssembly.Instance(new WebAssembly.Module(read("./reserved-export-name.wasm", "binary"))).exports;
+assert.isFunction(fn);
+assert.eq(fn(), 42);
diff --git a/JSTests/wasm/modules/mut-global.wasm b/JSTests/wasm/modules/mut-global.wasm
new file mode 100644
index 000000000000..09baba67d34d
Binary files /dev/null and b/JSTests/wasm/modules/mut-global.wasm differ
diff --git a/JSTests/wasm/modules/mut-global.wat b/JSTests/wasm/modules/mut-global.wat
new file mode 100644
index 000000000000..b7e8b6d0f624
--- /dev/null
+++ b/JSTests/wasm/modules/mut-global.wat
@@ -0,0 +1,7 @@
+(module
+  (global $g (mut i32) (i32.const 100))
+  (func (export "set") (param i32)
+    (global.set $g (local.get 0)))
+  (func (export "get") (result i32)
+    (global.get $g))
+  (export "g" (global $g)))
diff --git a/JSTests/wasm/modules/reserved-export-name-wasm-js.wasm b/JSTests/wasm/modules/reserved-export-name-wasm-js.wasm
new file mode 100644
index 000000000000..363562c7f747
Binary files /dev/null and b/JSTests/wasm/modules/reserved-export-name-wasm-js.wasm differ
diff --git a/JSTests/wasm/modules/reserved-export-name-wasm-js.wat b/JSTests/wasm/modules/reserved-export-name-wasm-js.wat
new file mode 100644
index 000000000000..d79575339e22
--- /dev/null
+++ b/JSTests/wasm/modules/reserved-export-name-wasm-js.wat
@@ -0,0 +1,3 @@
+(module
+    (func (export "wasm-js:invalid") (result i32)
+        i32.const 42))
diff --git a/JSTests/wasm/modules/reserved-export-name.wasm b/JSTests/wasm/modules/reserved-export-name.wasm
new file mode 100644
index 000000000000..cd8be87943b5
Binary files /dev/null and b/JSTests/wasm/modules/reserved-export-name.wasm differ
diff --git a/JSTests/wasm/modules/reserved-export-name.wat b/JSTests/wasm/modules/reserved-export-name.wat
new file mode 100644
index 000000000000..a2b6ddda366b
--- /dev/null
+++ b/JSTests/wasm/modules/reserved-export-name.wat
@@ -0,0 +1,3 @@
+(module
+    (func (export "wasm:invalid") (result i32)
+        i32.const 42))
diff --git a/JSTests/wasm/modules/reserved-import-module.wasm b/JSTests/wasm/modules/reserved-import-module.wasm
new file mode 100644
index 000000000000..56d4f3f021ea
Binary files /dev/null and b/JSTests/wasm/modules/reserved-import-module.wasm differ
diff --git a/JSTests/wasm/modules/reserved-import-module.wat b/JSTests/wasm/modules/reserved-import-module.wat
new file mode 100644
index 000000000000..7e0820a7f348
--- /dev/null
+++ b/JSTests/wasm/modules/reserved-import-module.wat
@@ -0,0 +1,4 @@
+(module
+    (import "wasm-js:invalid" "test" (func $invalid (result i32)))
+    (func (export "test") (result i32)
+        call $invalid))
diff --git a/JSTests/wasm/modules/reserved-import-name-wasm-js.wasm b/JSTests/wasm/modules/reserved-import-name-wasm-js.wasm
new file mode 100644
index 000000000000..9297b2833f5a
Binary files /dev/null and b/JSTests/wasm/modules/reserved-import-name-wasm-js.wasm differ
diff --git a/JSTests/wasm/modules/reserved-import-name-wasm-js.wat b/JSTests/wasm/modules/reserved-import-name-wasm-js.wat
new file mode 100644
index 000000000000..3fe4fe4247da
--- /dev/null
+++ b/JSTests/wasm/modules/reserved-import-name-wasm-js.wat
@@ -0,0 +1,4 @@
+(module
+    (import "test" "wasm-js:invalid" (func $invalid (result i32)))
+    (func (export "test") (result i32)
+        call $invalid))
diff --git a/JSTests/wasm/modules/reserved-import-name.wasm b/JSTests/wasm/modules/reserved-import-name.wasm
new file mode 100644
index 000000000000..79020e8d6144
Binary files /dev/null and b/JSTests/wasm/modules/reserved-import-name.wasm differ
diff --git a/JSTests/wasm/modules/reserved-import-name.wat b/JSTests/wasm/modules/reserved-import-name.wat
new file mode 100644
index 000000000000..53a6d4d478f1
--- /dev/null
+++ b/JSTests/wasm/modules/reserved-import-name.wat
@@ -0,0 +1,4 @@
+(module
+    (import "test" "wasm:invalid" (func $invalid (result i32)))
+    (func (export "test") (result i32)
+        call $invalid))
diff --git a/JSTests/wasm/modules/wasm-colon-module.wasm b/JSTests/wasm/modules/wasm-colon-module.wasm
new file mode 100644
index 000000000000..37b63c127793
Binary files /dev/null and b/JSTests/wasm/modules/wasm-colon-module.wasm differ
diff --git a/JSTests/wasm/modules/wasm-colon-module.wat b/JSTests/wasm/modules/wasm-colon-module.wat
new file mode 100644
index 000000000000..e3d346261e4a
--- /dev/null
+++ b/JSTests/wasm/modules/wasm-colon-module.wat
@@ -0,0 +1,2 @@
+(module
+    (import "wasm:not-a-builtin" "x" (func)))
diff --git a/JSTests/wasm/stress/block-param-type-widening.js b/JSTests/wasm/stress/block-param-type-widening.js
new file mode 100644
index 000000000000..a7925c95b52f
--- /dev/null
+++ b/JSTests/wasm/stress/block-param-type-widening.js
@@ -0,0 +1,72 @@
+import * as assert from "../assert.js";
+
+// When a block/if/try/try_table declares a parameter type that is a *supertype*
+// of the value actually on the stack, the block body must be validated against
+// the DECLARED type, not the narrower concrete type that flowed in
+// Each case below is built twice with an identical body:
+//   - declared type = anyref (wide): `struct.get 0 0` is invalid on anyref, so
+//     the module must be REJECTED. Before widening, the body saw the concrete
+//     `(ref null 0)` and this was (incorrectly) accepted.
+//   - declared type = (ref null 0) (concrete): `struct.get 0 0` is valid, so the
+//     module must VALIDATE. This control confirms the scaffolding is otherwise
+//     well-formed, so the rejection above is due to widening alone.
+
+function uleb128(n) { const r = []; do { let b = n & 0x7f; n >>>= 7; if (n) b |= 0x80; r.push(b); } while (n); return r; }
+function encodeString(s) { const b = []; for (let i = 0; i < s.length; i++) b.push(s.charCodeAt(i)); return [...uleb128(b.length), ...b]; }
+function section(id, content) { return [id, ...uleb128(content.length), ...content]; }
+
+// Module layout:
+//   type 0: struct { i64 mut }
+//   type 1: <blockSig>       (the signature of the block under test)
+//   type 2: func () -> i64   (the exported function "test")
+function buildModule(blockSig, body0) {
+    const typeSection = section(1, [
+        0x03,
+        0x5F, 0x01, 0x7E, 0x01,          // type 0: struct { i64 mut }
+        ...blockSig,                     // type 1
+        0x60, 0x00, 0x01, 0x7E,          // type 2: () -> i64
+    ]);
+    const funcSection = section(3, [0x01, 0x02]);                               // func 0 : type 2
+    const exportSection = section(7, [0x01, ...encodeString("test"), 0x00, 0x00]); // export "test" func 0
+    const codeSection = section(10, [0x01, ...uleb128(body0.length), ...body0]);
+    return new Uint8Array([0x00, 0x61, 0x73, 0x6D, 0x01, 0x00, 0x00, 0x00,
+        ...typeSection, ...funcSection, ...exportSection, ...codeSection]);
+}
+
+const sigParam = (t) => [0x60, 0x01, ...t, 0x01, 0x7E]; // (t) -> (i64)
+const ANYREF = [0x6E];
+const REF_NULL_0 = [0x63, 0x00]; // (ref null 0)
+
+const GET = [0xFB, 0x02, 0x00, 0x00]; // struct.get 0 0
+const REF_NULL_TYPE0 = [0xD0, 0x00];  // ref.null 0  -> (ref null 0)
+
+// name -> { sig: (refTypeBytes) -> typeEntry, body }
+const cases = {
+    // (block (param T) (result i64) (struct.get 0 0))
+    "block param": {
+        sig: sigParam,
+        body: [0x00, ...REF_NULL_TYPE0, 0x02, 0x01, ...GET, 0x0B, 0x0B],
+    },
+    // (if (param T) (result i64) (then struct.get 0 0) (else drop i64.const 0))
+    "if param": {
+        sig: sigParam,
+        body: [0x00, ...REF_NULL_TYPE0, 0x41, 0x01, 0x04, 0x01, ...GET, 0x05, 0x1A, 0x42, 0x00, 0x0B, 0x0B],
+    },
+    // (try (param T) (result i64) (do struct.get 0 0) (catch_all i64.const 0))
+    "try param": {
+        sig: sigParam,
+        body: [0x00, ...REF_NULL_TYPE0, 0x06, 0x01, ...GET, 0x19, 0x42, 0x00, 0x0B, 0x0B],
+    },
+    // (try_table (param T) (result i64) (struct.get 0 0))   -- 0 catch clauses
+    "try_table param": {
+        sig: sigParam,
+        body: [0x00, ...REF_NULL_TYPE0, 0x1F, 0x01, 0x00, ...GET, 0x0B, 0x0B],
+    },
+};
+
+for (const [name, { sig, body }] of Object.entries(cases)) {
+    assert.falsy(WebAssembly.validate(buildModule(sig(ANYREF), body)),
+        `${name}: struct.get on a widened anyref must be rejected (declared type not the concrete incoming type)`);
+    assert.truthy(WebAssembly.validate(buildModule(sig(REF_NULL_0), body)),
+        `${name}: struct.get on the concrete (ref null 0) must validate`);
+}
diff --git a/JSTests/wasm/stress/delegate-widens-result-type-to-signature.js b/JSTests/wasm/stress/delegate-widens-result-type-to-signature.js
new file mode 100644
index 000000000000..20b86f82b44a
--- /dev/null
+++ b/JSTests/wasm/stress/delegate-widens-result-type-to-signature.js
@@ -0,0 +1,74 @@
+import * as assert from "../assert.js";
+
+function uleb128(n) { const r = []; do { let b = n & 0x7f; n >>>= 7; if (n) b |= 0x80; r.push(b); } while (n); return r; }
+function encodeString(s) { const b = []; for (let i = 0; i < s.length; i++) b.push(s.charCodeAt(i)); return [...uleb128(b.length), ...b]; }
+function section(id, content) { return [id, ...uleb128(content.length), ...content]; }
+
+function buildModule() {
+    const typeSection = section(1, [
+        3,
+        0x5F, 0x01, 0x7E, 0x01,                         // type 0: struct { i64 mut }
+        0x60, 0x03, 0x7F, 0x6F, 0x64, 0x00, 0x01, 0x7E, // type 1: func (i32, externref, (ref 0)) -> i64
+        0x60, 0x00, 0x01, 0x64, 0x00,                   // type 2: func () -> (ref 0)
+    ]);
+    const funcSection = section(3, [0x02, 0x01, 0x02]);
+    const exportSection = section(7, [0x02,
+        ...encodeString("test"), 0x00, 0x00,
+        ...encodeString("make"), 0x00, 0x01]);
+
+    // (func $test (param $cond i32) (param $ext externref) (param $s (ref 0)) (result i64)
+    //   try (result i64)                 ;; outer: delegate target
+    //     try (result anyref)            ;; inner
+    //       local.get $ext
+    //       any.convert_extern           ;; -> anyref (NaN-boxed JS number)
+    //       local.get $cond
+    //       br_if 0                      ;; carry the anyref to the inner continuation
+    //       drop
+    //       local.get $s                 ;; fallthrough: (ref 0), a subtype of anyref
+    //     delegate 0                     ;; terminates inner try; result MUST widen to anyref
+    //     ref.cast (ref 0)               ;; must NOT elide IsCell / IsWasmGCObject checks
+    //     struct.get 0 0
+    //   catch_all
+    //     i64.const 0
+    //   end)
+    const body0 = [
+        0x00,
+        0x06, 0x7E,             // try (result i64)
+          0x06, 0x6E,           //   try (result anyref)
+            0x20, 0x01,         //     local.get 1
+            0xFB, 0x1A,         //     any.convert_extern
+            0x20, 0x00,         //     local.get 0
+            0x0D, 0x00,         //     br_if 0
+            0x1A,               //     drop
+            0x20, 0x02,         //     local.get 2
+          0x18, 0x00,           //   delegate 0
+          0xFB, 0x16, 0x00,     //   ref.cast (ref 0)
+          0xFB, 0x02, 0x00, 0x00, // struct.get 0 0
+        0x19,                   // catch_all
+          0x42, 0x00,           //   i64.const 0
+        0x0B,                   // end (outer try)
+        0x0B,                   // end (func)
+    ];
+    // (func $make (result (ref 0)) i64.const 0x1234 struct.new 0)
+    const body1 = [0x00, 0x42, 0xB4, 0x24, 0xFB, 0x00, 0x00, 0x0B];
+    const codeSection = section(10, [0x02,
+        ...uleb128(body0.length), ...body0,
+        ...uleb128(body1.length), ...body1]);
+    return new Uint8Array([0x00, 0x61, 0x73, 0x6D, 0x01, 0x00, 0x00, 0x00,
+        ...typeSection, ...funcSection, ...exportSection, ...codeSection]);
+}
+
+const bytes = buildModule();
+assert.truthy(WebAssembly.validate(bytes));
+const instance = new WebAssembly.Instance(new WebAssembly.Module(bytes));
+const struct = instance.exports.make();
+
+for (let i = 0; i < wasmTestLoopCount; ++i) {
+    // cond == 0: br_if not taken; the try body's (ref 0) fallthrough survives the
+    // delegate. Widened to anyref, ref.cast succeeds and struct.get reads the field.
+    assert.eq(instance.exports.test(0, null, struct), 0x1234n);
+    // cond == 1: br_if delivers an anyref-wrapped JS number to the inner continuation.
+    // The post-delegate value is statically anyref, so ref.cast must perform the full
+    // runtime check and trap rather than dereference the non-cell value.
+    assert.throws(() => instance.exports.test(1, 1.5, struct), WebAssembly.RuntimeError, "ref.cast failed to cast reference to target heap type");
+}
diff --git a/JSTests/wasm/stress/js-to-wasm-i31ref.js b/JSTests/wasm/stress/js-to-wasm-i31ref.js
new file mode 100644
index 000000000000..c195d8040c91
--- /dev/null
+++ b/JSTests/wasm/stress/js-to-wasm-i31ref.js
@@ -0,0 +1,36 @@
+import { instantiate } from "../gc/wast-wrapper.js";
+import * as assert from "../assert.js";
+
+let wat = `
+(module
+  (func (export "get") (param (ref i31)) (result i32)
+    (i31.get_s (local.get 0)))
+  (func (export "getNullable") (param i31ref) (result i32)
+    (if (result i32)
+      (ref.is_null (local.get 0))
+      (then (i32.const -1))
+      (else (i31.get_s (local.get 0)))))
+)
+`;
+
+async function test() {
+    const instance = instantiate(wat);
+    const { get, getNullable } = instance.exports;
+
+    for (let i = 0; i < wasmTestLoopCount; i++) {
+        assert.eq(get(0), 0);
+        assert.eq(get(2), 2);
+        assert.eq(get(2 ** 30 - 1), 2 ** 30 - 1);
+        assert.eq(get(-(2 ** 30)), -(2 ** 30));
+        assert.eq(getNullable(null), -1);
+        assert.eq(getNullable(7), 7);
+    }
+
+    assert.throws(() => get(2.3), TypeError, "Argument value did not match the reference type");
+    assert.throws(() => get(2n), TypeError, "Argument value did not match the reference type");
+    assert.throws(() => get(2 ** 30), TypeError, "Argument value did not match the reference type");
+    assert.throws(() => get(-(2 ** 30) - 1), TypeError, "Argument value did not match the reference type");
+    assert.throws(() => get(null), TypeError, "Argument value did not match the reference type");
+}
+
+await assert.asyncTest(test());
diff --git a/JSTests/wasm/stress/loop-param-type-widening.js b/JSTests/wasm/stress/loop-param-type-widening.js
new file mode 100644
index 000000000000..0fcedc39743e
--- /dev/null
+++ b/JSTests/wasm/stress/loop-param-type-widening.js
@@ -0,0 +1,138 @@
+function uleb128(n) {
+    const r = [];
+    do {
+        let b = n & 0x7f;
+        n >>>= 7;
+        if (n) b |= 0x80;
+        r.push(b);
+    } while (n);
+    return r;
+}
+function encodeString(s) {
+    const b = [];
+    for (let i = 0; i < s.length; i++) b.push(s.charCodeAt(i));
+    return [...uleb128(b.length), ...b];
+}
+function section(id, content) { return [id, ...uleb128(content.length), ...content]; }
+
+// --- Part 1 ---------------------------------------------------------------
+// A loop declaring `(param anyref)` entered with a `(ref $0)` on the stack must
+// typecheck its body against `anyref`, so `struct.get 0 0` at the top of the body
+// is a validation error. Previously the body was typechecked against the narrower
+// `(ref $0)` and the module was (unsoundly) accepted.
+{
+    // Type 0: struct { i64 mut }
+    // Type 1: func (anyref) -> (i64)           — loop block signature
+    // Type 2: func (i32, externref, ref 0) -> (i64)
+    // Type 3: func () -> (ref 0)
+    const typeSection = section(1, [
+        0x04,
+        0x5F, 0x01, 0x7E, 0x01,
+        0x60, 0x01, 0x6E, 0x01, 0x7E,
+        0x60, 0x03, 0x7F, 0x6F, 0x64, 0x00, 0x01, 0x7E,
+        0x60, 0x00, 0x01, 0x64, 0x00,
+    ]);
+    const funcSection = section(3, [0x02, 0x02, 0x03]);
+    const exportSection = section(7, [
+        0x02,
+        ...encodeString("f"), 0x00, 0x00,
+        ...encodeString("make"), 0x00, 0x01,
+    ]);
+    const body0 = [
+        0x01, 0x01, 0x7E,       // 1 local: i64
+        0x20, 0x02,             // local.get 2 (ref $0)
+        0x03, 0x01,             // loop (type 1)  — param anyref
+        0xFB, 0x02, 0x00, 0x00, //   struct.get 0 0    <-- must fail: anyref !<: (ref null $0)
+        0x21, 0x03,             //   local.set 3
+        0x20, 0x01,             //   local.get 1 (externref)
+        0xFB, 0x1A,             //   any.convert_extern
+        0x20, 0x00,             //   local.get 0
+        0x0D, 0x00,             //   br_if 0
+        0x1A,                   //   drop
+        0x20, 0x03,             //   local.get 3
+        0x0B,                   // end loop
+        0x0B,                   // end func
+    ];
+    const body1 = [0x00, 0x42, 0x00, 0xFB, 0x00, 0x00, 0x0B]; // i64.const 0; struct.new 0
+    const codeSection = section(10, [
+        0x02,
+        ...uleb128(body0.length), ...body0,
+        ...uleb128(body1.length), ...body1,
+    ]);
+    const bin = new Uint8Array([
+        0x00, 0x61, 0x73, 0x6D, 0x01, 0x00, 0x00, 0x00,
+        ...typeSection, ...funcSection, ...exportSection, ...codeSection,
+    ]);
+
+    if (WebAssembly.validate(bin))
+        throw new Error("Part 1: module with struct.get on anyref loop param must not validate");
+}
+
+// --- Part 2 ---------------------------------------------------------------
+// A loop declaring `(param (ref null $0))` entered with a non-null `(ref $0)` is
+// valid, but the body must be compiled against the nullable type: struct.get must
+// emit its null check so a null delivered on the back-edge traps cleanly.
+{
+    // Type 0: struct { i64 mut }
+    // Type 1: func (ref null 0) -> (i64)       — loop block signature
+    // Type 2: func (i32, ref 0) -> (i64)
+    // Type 3: func () -> (ref 0)
+    const typeSection = section(1, [
+        0x04,
+        0x5F, 0x01, 0x7E, 0x01,
+        0x60, 0x01, 0x63, 0x00, 0x01, 0x7E,
+        0x60, 0x02, 0x7F, 0x64, 0x00, 0x01, 0x7E,
+        0x60, 0x00, 0x01, 0x64, 0x00,
+    ]);
+    const funcSection = section(3, [0x02, 0x02, 0x03]);
+    const exportSection = section(7, [
+        0x02,
+        ...encodeString("f"), 0x00, 0x00,
+        ...encodeString("make"), 0x00, 0x01,
+    ]);
+    const body0 = [
+        0x01, 0x01, 0x7E,       // 1 local: i64
+        0x20, 0x01,             // local.get 1 (ref $0, non-null)
+        0x03, 0x01,             // loop (type 1)  — param (ref null $0)
+        0xFB, 0x02, 0x00, 0x00, //   struct.get 0 0    <-- must keep null check
+        0x21, 0x02,             //   local.set 2
+        0xD0, 0x71,             //   ref.null none
+        0x20, 0x00,             //   local.get 0
+        0x0D, 0x00,             //   br_if 0        <-- back-edge with null
+        0x1A,                   //   drop
+        0x20, 0x02,             //   local.get 2
+        0x0B,                   // end loop
+        0x0B,                   // end func
+    ];
+    const body1 = [0x00, 0x42, 0x2A, 0xFB, 0x00, 0x00, 0x0B]; // i64.const 42; struct.new 0
+    const codeSection = section(10, [
+        0x02,
+        ...uleb128(body0.length), ...body0,
+        ...uleb128(body1.length), ...body1,
+    ]);
+    const bin = new Uint8Array([
+        0x00, 0x61, 0x73, 0x6D, 0x01, 0x00, 0x00, 0x00,
+        ...typeSection, ...funcSection, ...exportSection, ...codeSection,
+    ]);
+
+    if (!WebAssembly.validate(bin))
+        throw new Error("Part 2: module must validate");
+    const inst = new WebAssembly.Instance(new WebAssembly.Module(bin));
+    const s = inst.exports.make();
+
+    for (let i = 0; i < wasmTestLoopCount; i++) {
+        if (inst.exports.f(0, s) !== 42n)
+            throw new Error("Part 2: expected 42");
+    }
+
+    let trapped = false;
+    try {
+        inst.exports.f(1, s);
+    } catch (e) {
+        if (!(e instanceof WebAssembly.RuntimeError))
+            throw new Error("Part 2: expected WebAssembly.RuntimeError, got " + e);
+        trapped = true;
+    }
+    if (!trapped)
+        throw new Error("Part 2: expected null-dereference trap on back-edge");
+}
diff --git a/JSTests/wasm/stress/ref-func-wrapper-identity.js b/JSTests/wasm/stress/ref-func-wrapper-identity.js
new file mode 100644
index 000000000000..59a1eae1bfa7
--- /dev/null
+++ b/JSTests/wasm/stress/ref-func-wrapper-identity.js
@@ -0,0 +1,50 @@
+import { instantiate } from "../wabt-wrapper.js"
+import * as assert from "../assert.js"
+
+let producerWat = `
+(module
+    (func $hidden (export "hidden") (result i32) (i32.const 7))
+)
+`
+
+let wat = `
+(module
+    (import "m" "hidden" (func $imported (result i32)))
+    (func $local (result i32) (i32.const 11))
+    (func $exported (export "exported") (result i32) (i32.const 13))
+    (elem declare funcref (ref.func $imported) (ref.func $local) (ref.func $exported))
+    (func (export "importedRef") (result funcref) (ref.func $imported))
+    (func (export "localRef") (result funcref) (ref.func $local))
+    (func (export "exportedRef") (result funcref) (ref.func $exported))
+)
+`
+
+async function test() {
+    const { hidden } = (await instantiate(producerWat)).exports
+    const { importedRef, localRef, exportedRef, exported } = (await instantiate(wat, { m: { hidden } })).exports
+
+    let imported = importedRef()
+    let local = localRef()
+    let exportedFromRef = exportedRef()
+
+    for (let i = 0; i < wasmTestLoopCount; ++i) {
+        assert.eq(importedRef(), imported)
+        assert.eq(localRef(), local)
+        assert.eq(exportedRef(), exportedFromRef)
+    }
+
+    assert.eq(imported === local, false)
+    assert.eq(local === exportedFromRef, false)
+    assert.eq(imported, hidden)
+    assert.eq(exportedFromRef, exported)
+    assert.eq(imported(), 7)
+    assert.eq(local(), 11)
+    assert.eq(exportedFromRef(), 13)
+
+    fullGC()
+    assert.eq(importedRef(), imported)
+    assert.eq(localRef(), local)
+    assert.eq(exportedRef(), exported)
+}
+
+await assert.asyncTest(test())
diff --git a/JSTests/wasm/stress/tail-call-unused-pins.js b/JSTests/wasm/stress/tail-call-unused-pins.js
new file mode 100644
index 000000000000..fe5393ffe61d
--- /dev/null
+++ b/JSTests/wasm/stress/tail-call-unused-pins.js
@@ -0,0 +1,50 @@
+//@ requireOptions("--useWasmFastMemory=true")
+import { instantiate } from "../wabt-wrapper.js";
+import * as assert from "../assert.js";
+
+const watA = `
+(module
+    (type $sig (func (param i32 i64)))
+    (import "e" "mem" (memory 1 1))
+    (import "e" "nop" (func $nop))
+    (table (export "tbl") 1 1 funcref)
+    (func (export "f") (param $do_call i32) (param $off i32) (param $val i64)
+        (call $nop)
+        (if (local.get $do_call)
+            (then (return_call_indirect (type $sig)
+                    (local.get $off) (local.get $val) (i32.const 0))))))
+`;
+
+const watB = `
+(module
+    (import "e" "mem" (memory 1 1))
+    (func (export "g") (param $off i32) (param $val i64)
+        (i64.store (local.get $off) (local.get $val))))
+`;
+
+async function test() {
+    const memA = createWebAssemblyMemoryWithMode({ initial: 1, maximum: 1 }, "Signaling");
+    const memB = createWebAssemblyMemoryWithMode({ initial: 1, maximum: 1 }, "BoundsChecking");
+    assert.eq(WebAssemblyMemoryMode(memA), "Signaling");
+    assert.eq(WebAssemblyMemoryMode(memB), "BoundsChecking");
+
+    const instA = await instantiate(watA, { e: { mem: memA, nop: () => {} } }, { tail_call: true });
+    const { f, tbl } = instA.exports;
+
+    const instB = await instantiate(watB, { e: { mem: memB } });
+    const { g } = instB.exports;
+
+    assert.throws(() => g(0x20000, 0n), WebAssembly.RuntimeError, "Out of bounds memory access");
+
+    // Tier g into BBQ. IPInt's prologue reloads regCS4 on entry but BBQ does not.
+    for (let i = 0; i < wasmTestLoopCount; ++i) g(0, 0n);
+
+    // Tier f to OMG without ever taking the tail-call branch.
+    for (let i = 0; i < wasmTestLoopCount; ++i) f(0, 0, 0n);
+
+    tbl.set(0, g);
+
+    assert.throws(() => f(1, 0x20000, 0n), WebAssembly.RuntimeError, "Out of bounds memory access");
+}
+
+await assert.asyncTest(test());
diff --git a/JSTests/wasm/stress/unreachable-end-if-no-else-widens-to-signature.js b/JSTests/wasm/stress/unreachable-end-if-no-else-widens-to-signature.js
new file mode 100644
index 000000000000..73af41f67744
--- /dev/null
+++ b/JSTests/wasm/stress/unreachable-end-if-no-else-widens-to-signature.js
@@ -0,0 +1,75 @@
+// rdar://180535979
+// The unreachable End handler synthesizes an else for `if`-without-`else` and
+// installs the saved if-param stack as the (reachable) else-arm result. Those
+// values must be widened to the block's declared result types before they
+// propagate to the parent stack: an unreachable then-arm may have `br 0`'d a
+// value that only inhabits the wider result type. Without widening, BBQ's
+// emitRefTestOrCast trusts the stale narrow type and elides the IsCell /
+// IsWasmGCObject runtime checks.
+
+import * as assert from "../assert.js";
+
+function uleb128(n) { const r = []; do { let b = n & 0x7f; n >>>= 7; if (n) b |= 0x80; r.push(b); } while (n); return r; }
+function encodeString(s) { const b = []; for (let i = 0; i < s.length; i++) b.push(s.charCodeAt(i)); return [...uleb128(b.length), ...b]; }
+function section(id, content) { return [id, ...uleb128(content.length), ...content]; }
+
+function buildModule() {
+    const typeSection = section(1, [
+        4,
+        0x5F, 0x01, 0x7E, 0x01,                         // type 0: struct { i64 mut }
+        0x60, 0x01, 0x64, 0x00, 0x01, 0x6E,             // type 1: func (param (ref 0)) (result anyref)
+        0x60, 0x03, 0x7F, 0x6F, 0x64, 0x00, 0x01, 0x7E, // type 2: func (i32, externref, (ref 0)) -> i64
+        0x60, 0x00, 0x01, 0x64, 0x00,                   // type 3: func () -> (ref 0)
+    ]);
+    const funcSection = section(3, [0x02, 0x02, 0x03]);
+    const exportSection = section(7, [0x02,
+        ...encodeString("test"), 0x00, 0x00,
+        ...encodeString("make"), 0x00, 0x01]);
+
+    // (func $test (param $cond i32) (param $ext externref) (param $s (ref 0)) (result i64)
+    //   local.get $s
+    //   local.get $cond
+    //   if (param (ref 0)) (result anyref)
+    //     drop
+    //     local.get $ext
+    //     any.convert_extern
+    //     br 0                  ;; then-arm goes unreachable
+    //   end                     ;; <- parseUnreachableExpression()::End, synthetic else
+    //   ref.cast (ref 0)        ;; must NOT elide IsCell / IsWasmGCObject checks
+    //   struct.get 0 0)
+    const body0 = [
+        0x00,
+        0x20, 0x02,
+        0x20, 0x00,
+        0x04, 0x01,
+        0x1A,
+        0x20, 0x01,
+        0xFB, 0x1A,
+        0x0C, 0x00,
+        0x0B,
+        0xFB, 0x16, 0x00,
+        0xFB, 0x02, 0x00, 0x00,
+        0x0B,
+    ];
+    // (func $make (result (ref 0)) i64.const 0x1234 struct.new 0)
+    const body1 = [0x00, 0x42, 0xB4, 0x24, 0xFB, 0x00, 0x00, 0x0B];
+    const codeSection = section(10, [0x02,
+        ...uleb128(body0.length), ...body0,
+        ...uleb128(body1.length), ...body1]);
+    return new Uint8Array([0x00, 0x61, 0x73, 0x6D, 0x01, 0x00, 0x00, 0x00,
+        ...typeSection, ...funcSection, ...exportSection, ...codeSection]);
+}
+
+const bytes = buildModule();
+assert.truthy(WebAssembly.validate(bytes));
+const instance = new WebAssembly.Instance(new WebAssembly.Module(bytes));
+const struct = instance.exports.make();
+
+for (let i = 0; i < wasmTestLoopCount; ++i) {
+    // cond == 0: synthetic else delivers the (ref 0) param; ref.cast succeeds.
+    assert.eq(instance.exports.test(0, null, struct), 0x1234n);
+    // cond == 1: then-arm br's an anyref-wrapped JS number to the if's
+    // continuation. The post-end value is statically anyref, so ref.cast must
+    // perform the full runtime check and trap.
+    assert.throws(() => instance.exports.test(1, 1.5, struct), WebAssembly.RuntimeError, "ref.cast failed to cast reference to target heap type");
+}
diff --git a/LayoutTests/TestExpectations b/LayoutTests/TestExpectations
index e649b41a63ee..7fec63724abe 100644
--- a/LayoutTests/TestExpectations
+++ b/LayoutTests/TestExpectations
@@ -1370,7 +1370,6 @@ webkit.org/b/309872 imported/w3c/web-platform-tests/permissions-policy/reporting
 
 webkit.org/b/182292 imported/w3c/web-platform-tests/css/cssom-view/scrollingElement-quirks-dynamic-001.html [ ImageOnlyFailure ]
 webkit.org/b/182292 imported/w3c/web-platform-tests/css/cssom-view/scrollingElement-quirks-dynamic-002.html [ ImageOnlyFailure ]
-imported/w3c/web-platform-tests/css/css-ui/text-overflow-015.html [ ImageOnlyFailure ]
 imported/w3c/web-platform-tests/eventsource/dedicated-worker/eventsource-constructor-non-same-origin.htm [ Skip ]
 imported/w3c/web-platform-tests/mediacapture-fromelement/capture.html [ Failure ]
 imported/w3c/web-platform-tests/mediacapture-fromelement/ended.html [ Failure ]
@@ -4186,10 +4185,6 @@ imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-021.
 imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-022.tentative.html [ ImageOnlyFailure ]
 imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-023.tentative.html [ ImageOnlyFailure ]
 imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-024.tentative.html [ ImageOnlyFailure ]
-imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-005.tentative.html [ ImageOnlyFailure ]
-imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-006.tentative.html [ ImageOnlyFailure ]
-imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-007.tentative.html [ ImageOnlyFailure ]
-imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-010.tentative.html [ ImageOnlyFailure ]
 imported/w3c/web-platform-tests/css/css-overflow/line-clamp/webkit-line-clamp-008.html [ ImageOnlyFailure ]
 imported/w3c/web-platform-tests/css/css-overflow/line-clamp/webkit-line-clamp-011.html [ ImageOnlyFailure ]
 imported/w3c/web-platform-tests/css/css-overflow/line-clamp/webkit-line-clamp-012.html [ ImageOnlyFailure ]
@@ -4205,13 +4200,6 @@ imported/w3c/web-platform-tests/css/css-overflow/overflow-canvas.html [ ImageOnl
 imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-border-radius-002.html [ ImageOnlyFailure ]
 imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-border-radius.html [ ImageOnlyFailure ]
 
-imported/w3c/web-platform-tests/css/css-overflow/flex-column-container-with-scrollable-descendant.html [ ImageOnlyFailure ]
-imported/w3c/web-platform-tests/css/css-overflow/flex-container-multiple-items-with-scrollable-descendant.html [ ImageOnlyFailure ]
-imported/w3c/web-platform-tests/css/css-overflow/flex-container-with-scrollable-descendant.html [ ImageOnlyFailure ]
-imported/w3c/web-platform-tests/css/css-overflow/flex-nested-container-with-scrollable-descendant.html [ ImageOnlyFailure ]
-imported/w3c/web-platform-tests/css/css-overflow/grid-container-with-scrollable-descendant.html [ ImageOnlyFailure ]
-imported/w3c/web-platform-tests/css/css-overflow/grid-nested-container-with-scrollable-descendant.html [ ImageOnlyFailure ]
-
 # Tests that failed on the 2026-02-02 import of css-overflow
 imported/w3c/web-platform-tests/css/css-overflow/clip-008.html [ ImageOnlyFailure ]
 imported/w3c/web-platform-tests/css/css-overflow/column-style-change-triggers-relayout.html [ ImageOnlyFailure ]
@@ -4233,7 +4221,6 @@ imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-027.h
 imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-028.html [ ImageOnlyFailure ]
 imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-029.html [ ImageOnlyFailure ]
 imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-030.html [ ImageOnlyFailure ]
-imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-032.tentative.html [ ImageOnlyFailure ]
 imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-repaint-003.html [ ImageOnlyFailure ]
 imported/w3c/web-platform-tests/css/css-overflow/line-clamp/continue-001.html [ ImageOnlyFailure ]
 imported/w3c/web-platform-tests/css/css-overflow/line-clamp/discard/discard-multicol-001.html [ ImageOnlyFailure ]
@@ -4244,13 +4231,10 @@ imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-003.html
 imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-007.html [ ImageOnlyFailure ]
 imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-008.html [ ImageOnlyFailure ]
 imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-009.html [ ImageOnlyFailure ]
-imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-011.html [ ImageOnlyFailure ]
 imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-019.html [ ImageOnlyFailure ]
 imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-021.html [ ImageOnlyFailure ]
 imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-030.html [ ImageOnlyFailure ]
-imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-033.html [ ImageOnlyFailure ]
 imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-034.html [ ImageOnlyFailure ]
-imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-035.html [ ImageOnlyFailure ]
 imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-036.html [ ImageOnlyFailure ]
 imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-037.html [ ImageOnlyFailure ]
 imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-038.html [ ImageOnlyFailure ]
@@ -4310,21 +4294,69 @@ imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-fixe
 imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-fixed-pos-015.html [ ImageOnlyFailure ]
 imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-fixed-pos-016.html [ ImageOnlyFailure ]
 imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-fixed-pos-017.html [ ImageOnlyFailure ]
-imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-004.tentative.html [ ImageOnlyFailure ]
-imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-008.html [ ImageOnlyFailure ]
-imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-text-overflow-string-003.html [ ImageOnlyFailure ]
 imported/w3c/web-platform-tests/css/css-overflow/line-clamp/webkit-line-clamp-024.html [ ImageOnlyFailure ]
 imported/w3c/web-platform-tests/css/css-overflow/line-clamp/webkit-line-clamp-036.html [ ImageOnlyFailure ]
 imported/w3c/web-platform-tests/css/css-overflow/line-clamp/webkit-line-clamp-040.html [ ImageOnlyFailure ]
-imported/w3c/web-platform-tests/css/css-overflow/line-clamp/webkit-line-clamp-044.html [ ImageOnlyFailure ]
 imported/w3c/web-platform-tests/css/css-overflow/line-clamp/webkit-line-clamp-045.html [ ImageOnlyFailure ]
-imported/w3c/web-platform-tests/css/css-overflow/line-clamp/webkit-line-clamp-047.html [ ImageOnlyFailure ]
 imported/w3c/web-platform-tests/css/css-overflow/line-clamp/webkit-line-clamp-048.html [ ImageOnlyFailure ]
 imported/w3c/web-platform-tests/css/css-overflow/line-clamp/webkit-line-clamp-050.html [ ImageOnlyFailure ]
 imported/w3c/web-platform-tests/css/css-overflow/line-clamp/webkit-line-clamp-051.html [ ImageOnlyFailure ]
 imported/w3c/web-platform-tests/css/css-overflow/line-clamp/webkit-line-clamp-052.html [ ImageOnlyFailure ]
 imported/w3c/web-platform-tests/css/css-overflow/line-clamp/webkit-line-clamp-053.html [ ImageOnlyFailure ]
-imported/w3c/web-platform-tests/css/css-overflow/line-clamp/webkit-line-clamp-with-max-height.html [ ImageOnlyFailure ]
+
+imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-032.html [ ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-033.html [ ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-035.html [ ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-036.html [ ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-037.html [ ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-039.html [ ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-040.html [ ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-041.html [ ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-bidi-002.html [ ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-bidi-003.html [ ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-bidi-004.html [ ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-quirk-001.html [ ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-quirk-002.html [ ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-033.html [ Skip ]
+imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-041.html [ ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-042.html [ ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-043.html [ ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-044.html [ ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-045.html [ ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-046.html [ ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-047.html [ ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-bfc.html [ ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-004.html [ ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-005.html [ ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-006.html [ ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-007.html [ ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-010.html [ ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-011.html [ ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-012.html [ ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-013.html [ ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-014.html [ ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-015.html [ ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-016.html [ ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-017.html [ ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-018.html [ ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-019.html [ ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-020.html [ ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/overflow-clipped-transparent-border-clip.html [ ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/single-axis-overflow-clip-rtl.html [ ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/single-axis-overflow-scroll-to-clip.html [ ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-editable-div-with-caret.html [ ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-016.html [ ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-018.html [ ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-019.html [ ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-020.html [ ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-021.html [ ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-022.html [ ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-024.tentative.html [ ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-025.tentative.html [ ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-026.tentative.html [ ImageOnlyFailure ]
+
+imported/w3c/web-platform-tests/css/css-overflow/overflow-video-hidden.html [ Skip ]
+imported/w3c/web-platform-tests/css/css-overflow/unicode-bidi-plaintext-scroll-direction.html [ Skip ]
 
 # Fail to run due to rdar://169497013
 imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-026.html [ Skip ]
@@ -4875,9 +4907,9 @@ webkit.org/b/244813 imported/w3c/web-platform-tests/css/css-text-decor/text-deco
 imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-thickness-length-rounding-001.html [ ImageOnlyFailure ]
 imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-thickness-length-rounding-002.html [ ImageOnlyFailure ]
 
-# fractional-position endpoint rounds up to a device pixel
-webkit.org/b/244813 imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-009.html [ ImageOnlyFailure ]
-webkit.org/b/244813 imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-014.html [ ImageOnlyFailure ]
+# Not a text-decoration-inset bug: the test sets unprefixed 'box-decoration-break', which WebKit does not support (only -webkit-box-decoration-break), so the box is sliced rather than cloned.
+# The test passes once the declaration is prefixed.
+imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-029.html [ ImageOnlyFailure ]
 
 # Not a text-decoration-inset bug: a pre-existing ~1px vertical decoration-position difference in a
 # columns:2 multicol context with inline vertical borders. Reproduces with the feature disabled.
@@ -5386,18 +5418,14 @@ webkit.org/b/299202 imported/w3c/web-platform-tests/css/css-writing-modes/wm-pro
 webkit.org/b/214299 imported/w3c/web-platform-tests/css/css-ui/appearance-menulist-button-002.tentative.html [ ImageOnlyFailure ]
 webkit.org/b/214299 imported/w3c/web-platform-tests/css/css-ui/outline-025.html [ ImageOnlyFailure ]
 webkit.org/b/214299 imported/w3c/web-platform-tests/css/css-ui/outline-026.html [ ImageOnlyFailure ]
-webkit.org/b/214299 imported/w3c/web-platform-tests/css/css-ui/text-overflow-ruby.html [ ImageOnlyFailure ]
-webkit.org/b/214299 imported/w3c/web-platform-tests/css/css-ui/text-overflow-021.html [ ImageOnlyFailure ]
 webkit.org/b/214299 imported/w3c/web-platform-tests/css/css-ui/webkit-appearance-menulist-button-002.tentative.html [ ImageOnlyFailure ]
 webkit.org/b/214299 imported/w3c/web-platform-tests/css/css-ui/resize-child-will-change-transform.html [ ImageOnlyFailure ]
 
 webkit.org/b/279302 imported/w3c/web-platform-tests/css/css-ui/negative-outline-offset.html [ ImageOnlyFailure ]
-webkit.org/b/279302 imported/w3c/web-platform-tests/css/css-ui/text-overflow-028.html [ ImageOnlyFailure ]
 
 # New failure after import of css/css-ui (2026-07):
 webkit.org/b/320474 imported/w3c/web-platform-tests/css/css-ui/compute-kind-widget-no-fallback-props-001.html [ ImageOnlyFailure ]
 webkit.org/b/320474 imported/w3c/web-platform-tests/css/css-ui/resize-textarea-relative-to-right-001.tentative.html [ Pass Failure ]
-webkit.org/b/320474 imported/w3c/web-platform-tests/css/css-ui/text-overflow-ellipsis-multiline-001.html [ ImageOnlyFailure ]
 
 # Missing CSS-UI-4 caret properties:
 webkit.org/b/319405 imported/w3c/web-platform-tests/css/css-ui/caret-color-bar-shape-text-color.html [ ImageOnlyFailure ]
@@ -5429,15 +5457,23 @@ webkit.org/b/319405 imported/w3c/web-platform-tests/css/css-ui/caret-shape-block
 webkit.org/b/319405 imported/w3c/web-platform-tests/css/css-ui/caret-shape-block-zoom.html [ ImageOnlyFailure ]
 webkit.org/b/319405 imported/w3c/web-platform-tests/css/css-ui/caret-shape-underscore-001.html [ ImageOnlyFailure ]
 
-# Missing text-overflow: <string>
-webkit.org/b/27545 imported/w3c/web-platform-tests/css/css-ui/text-overflow-string-001.html [ ImageOnlyFailure ]
-webkit.org/b/27545 imported/w3c/web-platform-tests/css/css-ui/text-overflow-string-002.html [ ImageOnlyFailure ]
-webkit.org/b/27545 imported/w3c/web-platform-tests/css/css-ui/text-overflow-string-003.html [ ImageOnlyFailure ]
-webkit.org/b/27545 imported/w3c/web-platform-tests/css/css-ui/text-overflow-string-004.html [ ImageOnlyFailure ]
-webkit.org/b/27545 imported/w3c/web-platform-tests/css/css-ui/text-overflow-string-005.html [ ImageOnlyFailure ]
-webkit.org/b/27545 imported/w3c/web-platform-tests/css/css-ui/text-overflow-string-006.html [ ImageOnlyFailure ]
-webkit.org/b/27545 imported/w3c/web-platform-tests/css/css-ui/text-overflow-string-007.html [ ImageOnlyFailure ]
-webkit.org/b/27545 imported/w3c/web-platform-tests/css/css-ui/text-overflow-string-008.html [ ImageOnlyFailure ]
+# text-overflow failures
+imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ruby.html [ ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/text-overflow-021.html [ ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/text-overflow-028.html [ ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-multiline-001.html [ ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-editing-input.html [ ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-vertical-001.html [ ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-vertical-rtl-001.html [ ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/text-overflow-scroll-001.html [ ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/text-overflow-scroll-rtl-001.html [ ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/text-overflow-scroll-vertical-lr-001.html [ ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/text-overflow-scroll-vertical-lr-rtl-001.html [ ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/text-overflow-scroll-vertical-rl-001.html [ ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/text-overflow-scroll-vertical-rl-rtl-001.html [ ImageOnlyFailure ]
+
+# text-overflow should take in account unicode-bidi to determine ellipsis position.
+imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-008.html
 
 webkit.org/b/214387 imported/w3c/web-platform-tests/svg/animations/seeking-events-4.html [ Pass Failure ]
 
@@ -5725,16 +5761,6 @@ webkit.org/b/277262 [ Debug ] imported/w3c/web-platform-tests/css/css-multicol/m
 
 # -- End CSS multicol -- #
 
-webkit.org/b/214459 imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-editing-input.html [ ImageOnlyFailure ]
-webkit.org/b/214459 imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-vertical-001.html [ ImageOnlyFailure ]
-webkit.org/b/214459 imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-vertical-rtl-001.html [ ImageOnlyFailure ]
-webkit.org/b/214459 imported/w3c/web-platform-tests/css/css-overflow/text-overflow-scroll-001.html [ ImageOnlyFailure ]
-webkit.org/b/214459 imported/w3c/web-platform-tests/css/css-overflow/text-overflow-scroll-rtl-001.html [ ImageOnlyFailure ]
-webkit.org/b/214459 imported/w3c/web-platform-tests/css/css-overflow/text-overflow-scroll-vertical-lr-001.html [ ImageOnlyFailure ]
-webkit.org/b/214459 imported/w3c/web-platform-tests/css/css-overflow/text-overflow-scroll-vertical-lr-rtl-001.html [ ImageOnlyFailure ]
-webkit.org/b/214459 imported/w3c/web-platform-tests/css/css-overflow/text-overflow-scroll-vertical-rl-001.html [ ImageOnlyFailure ]
-webkit.org/b/214459 imported/w3c/web-platform-tests/css/css-overflow/text-overflow-scroll-vertical-rl-rtl-001.html [ ImageOnlyFailure ]
-
 webkit.org/b/214461 imported/w3c/web-platform-tests/css/css-pseudo/active-selection-051.html [ ImageOnlyFailure ]
 webkit.org/b/214461 imported/w3c/web-platform-tests/css/css-pseudo/active-selection-052.html [ ImageOnlyFailure ]
 webkit.org/b/214461 imported/w3c/web-platform-tests/css/css-pseudo/active-selection-053.html [ ImageOnlyFailure ]
@@ -5750,13 +5776,8 @@ webkit.org/b/214461 imported/w3c/web-platform-tests/css/css-pseudo/first-line-op
 webkit.org/b/214461 imported/w3c/web-platform-tests/css/css-pseudo/grammar-error-001.html [ ImageOnlyFailure ]
 webkit.org/b/204163 imported/w3c/web-platform-tests/css/css-pseudo/marker-content-010.html [ ImageOnlyFailure ]
 webkit.org/b/204163 imported/w3c/web-platform-tests/css/css-pseudo/marker-content-012.html [ ImageOnlyFailure ]
-webkit.org/b/204163 imported/w3c/web-platform-tests/css/css-pseudo/marker-content-014.html [ ImageOnlyFailure ]
 webkit.org/b/204163 imported/w3c/web-platform-tests/css/css-pseudo/marker-content-017.html [ ImageOnlyFailure ]
 webkit.org/b/204163 imported/w3c/web-platform-tests/css/css-pseudo/marker-content-018.html [ ImageOnlyFailure ]
-# Inside ::marker content is laid out as an inline-block whose block-size drives the line box, so it
-# does not yet match the line metrics of a native inside marker (shared root cause with marker-content-012).
-webkit.org/b/204163 imported/w3c/web-platform-tests/css/css-pseudo/marker-font-variant-numeric-default.html [ ImageOnlyFailure ]
-webkit.org/b/204163 imported/w3c/web-platform-tests/css/css-pseudo/marker-font-variant-numeric-normal.html [ ImageOnlyFailure ]
 webkit.org/b/214461 imported/w3c/web-platform-tests/css/css-pseudo/marker-list-style-position.html [ ImageOnlyFailure ]
 webkit.org/b/214461 imported/w3c/web-platform-tests/css/css-pseudo/marker-unicode-bidi-normal.html [ ImageOnlyFailure ]
 webkit.org/b/214461 imported/w3c/web-platform-tests/css/css-pseudo/spelling-error-001.html [ ImageOnlyFailure ]
@@ -6247,9 +6268,6 @@ imported/w3c/web-platform-tests/trusted-types/should-trusted-type-policy-creatio
 webkit.org/b/281223 imported/w3c/web-platform-tests/dom/nodes/moveBefore/focus-preserve-render.html [ Skip ]
 webkit.org/b/281223 imported/w3c/web-platform-tests/dom/nodes/moveBefore/moveBefore-option-recalc-style.html [ Skip ]
 
-# Flaky crash.
-webkit.org/b/315031 imported/w3c/web-platform-tests/dom/nodes/moveBefore/throws-exception.html [ Skip ]
-
 # Flaky.
 imported/w3c/web-platform-tests/dom/nodes/insertion-removing-steps/Node-appendChild-script-and-default-style-meta-from-fragment.html [ Skip ]
 
@@ -6753,9 +6771,7 @@ webkit.org/b/277912 imported/w3c/web-platform-tests/css/css-borders/border-shape
 webkit.org/b/277912 imported/w3c/web-platform-tests/css/css-borders/border-shape/border-shape-stroke-from-border.html [ ImageOnlyFailure ]
 webkit.org/b/277912 imported/w3c/web-platform-tests/css/css-borders/border-shape/border-shape-two-shapes-shadow.html [ ImageOnlyFailure ]
 webkit.org/b/277912 imported/w3c/web-platform-tests/css/css-borders/border-shape/border-shape-outline-double.html [ ImageOnlyFailure ]
-webkit.org/b/277912 imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-backdrop-filter-overflow.html [ ImageOnlyFailure ]
 webkit.org/b/277912 imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-backdrop-filter-video-overflow.html [ ImageOnlyFailure Pass ]
-webkit.org/b/277912 imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-backdrop-filter.html [ ImageOnlyFailure ]
 webkit.org/b/277912 imported/w3c/web-platform-tests/css/css-borders/border-shape/border-shape-clips-background.html [ ImageOnlyFailure ]
 webkit.org/b/277912 imported/w3c/web-platform-tests/css/css-borders/border-shape/border-shape-collapsed-shape-clips-background.html [ ImageOnlyFailure ]
 webkit.org/b/277912 imported/w3c/web-platform-tests/css/css-borders/border-shape/border-shape-geometry-box.html [ ImageOnlyFailure ]
diff --git a/LayoutTests/accessibility/isolated-tree/empty-final-line-range-expected.txt b/LayoutTests/accessibility/isolated-tree/empty-final-line-range-expected.txt
new file mode 100644
index 000000000000..db2ef58f8e3e
--- /dev/null
+++ b/LayoutTests/accessibility/isolated-tree/empty-final-line-range-expected.txt
@@ -0,0 +1,10 @@
+This test ensures the line at a text control's last text position is its empty final line.
+
+PASS: textarea.stringForTextMarkerRange(lineRange) === ''
+PASS: textarea.textMarkerRangeLength(lineRange) === 0
+PASS: lineStart.isEqual(lastMarker) === true
+
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/accessibility/isolated-tree/empty-final-line-range.html b/LayoutTests/accessibility/isolated-tree/empty-final-line-range.html
new file mode 100644
index 000000000000..1ebc94777c4b
--- /dev/null
+++ b/LayoutTests/accessibility/isolated-tree/empty-final-line-range.html
@@ -0,0 +1,39 @@
+<!DOCTYPE HTML><!-- webkit-test-runner [ IsAccessibilityIsolatedTreeEnabled=true ] -->
+<html>
+<head>
+<script src="../../resources/accessibility-helper.js"></script>
+<script src="../../resources/js-test.js"></script>
+</head>
+<body>
+
+<!--
+A text control whose value ends in a line break renders an empty final line, which is given a line
+box by a placeholder <br> whose newline is no character of the value. Text runs model rendered text,
+so they do include that newline, which puts the control's last text position past it — one offset
+beyond the position the caret reports on that line (covered by
+accessibility/mac/textarea-line-range-with-trailing-newline.html). The line there is the same empty
+final line, so it must not stretch back over the newline.
+-->
+
+<textarea id="textarea" rows="3" cols="10">one
+</textarea>
+
+<script>
+var output = "This test ensures the line at a text control's last text position is its empty final line.\n\n";
+
+if (window.accessibilityController) {
+    var textarea = accessibilityController.accessibleElementById("textarea");
+    var lastMarker = textarea.endTextMarker;
+    var lineRange = textarea.lineTextMarkerRangeForTextMarker(lastMarker);
+    var lineStart = textarea.startTextMarkerForTextMarkerRange(lineRange);
+
+    output += expect("textarea.stringForTextMarkerRange(lineRange)", "''");
+    output += expect("textarea.textMarkerRangeLength(lineRange)", "0");
+    // Holding no text, the line starts where it ends: at the position asked about.
+    output += expect("lineStart.isEqual(lastMarker)", "true");
+
+    debug(output);
+}
+</script>
+</body>
+</html>
diff --git a/LayoutTests/accessibility/isolated-tree/mac/replace-range-at-block-boundary-expected.txt b/LayoutTests/accessibility/isolated-tree/mac/replace-range-at-block-boundary-expected.txt
new file mode 100644
index 000000000000..594a889cb7e9
--- /dev/null
+++ b/LayoutTests/accessibility/isolated-tree/mac/replace-range-at-block-boundary-expected.txt
@@ -0,0 +1,100 @@
+Asserts that AXReplaceRangeWithText writes at the character index it is given, including the
+index that starts a block, and clamps a range running past the end of the value to the end
+rather than writing at the current selection.
+
+block ending in <br>, index starting the next block: value "alpha\nbravo\n\n", replacing {12, 0}
+PASS: axField.replaceTextInRange("Y", 12, 0) === true
+PASS: textOf(field) === "alpha\nbravo\nY\n"
+PASS: textOf(bystander) === "bystander"
+
+block without a trailing <br>: value "alpha\nbravo\n\n", replacing {12, 0}
+PASS: axField.replaceTextInRange("Y", 12, 0) === true
+PASS: textOf(field) === "alpha\nbravo\nY\n"
+PASS: textOf(bystander) === "bystander"
+
+<br>-separated lines: value "alpha\nbravo\n\n", replacing {12, 0}
+PASS: axField.replaceTextInRange("Y", 12, 0) === true
+PASS: textOf(field) === "alpha\nbravo\nY\n"
+PASS: textOf(bystander) === "bystander"
+
+one line, index starting the blank second line: value "alpha\n\n", replacing {6, 0}
+PASS: axField.replaceTextInRange("Y", 6, 0) === true
+PASS: textOf(field) === "alpha\nY\n"
+PASS: textOf(bystander) === "bystander"
+
+two blocks ending in <br>: value "alpha\nbravo\ncharlie\n\n", replacing {20, 0}
+PASS: axField.replaceTextInRange("Y", 20, 0) === true
+PASS: textOf(field) === "alpha\nbravo\ncharlie\nY\n"
+PASS: textOf(bystander) === "bystander"
+
+interior index: value "alpha\nbravo\n\n", replacing {6, 0}
+PASS: axField.replaceTextInRange("Y", 6, 0) === true
+PASS: textOf(field) === "alpha\nYbravo\n\n"
+PASS: textOf(bystander) === "bystander"
+
+replacing a run of characters: value "alpha\nbravo\n\n", replacing {6, 5}
+PASS: axField.replaceTextInRange("Y", 6, 5) === true
+PASS: textOf(field) === "alpha\nY\n\n"
+PASS: textOf(bystander) === "bystander"
+
+field with no text: value "", replacing {0, 0}
+PASS: axField.replaceTextInRange("Y", 0, 0) === true
+PASS: textOf(field) === "Y"
+PASS: textOf(bystander) === "bystander"
+
+textarea, index starting the blank final line: value "alpha\nbravo\n", replacing {12, 0}
+PASS: axField.replaceTextInRange("Y", 12, 0) === true
+PASS: textOf(field) === "alpha\nbravo\nY"
+PASS: textOf(bystander) === "bystander"
+
+location one past the end of the value: value "alpha\nbravo\n\n", replacing {14, 0}
+PASS: axField.replaceTextInRange("Y", 14, 0) === true
+PASS: textOf(field) === "alpha\nbravo\nY\n"
+PASS: textOf(bystander) === "bystander"
+
+location far past the end of the value: value "alpha\nbravo\n\n", replacing {99, 0}
+PASS: axField.replaceTextInRange("Y", 99, 0) === true
+PASS: textOf(field) === "alpha\nbravo\nY\n"
+PASS: textOf(bystander) === "bystander"
+
+length running past the end of the value: value "alpha\nbravo\n\n", replacing {6, 99}
+PASS: axField.replaceTextInRange("Y", 6, 99) === true
+PASS: textOf(field) === "alpha\nY\n"
+PASS: textOf(bystander) === "bystander"
+
+
+PASS successfullyParsed is true
+
+TEST COMPLETE
+alpha
+bravo
+Y
+alpha
+bravo
+Y
+alpha
+bravo
+Y
+alpha
+Y
+alpha
+bravo
+charlie
+Y
+alpha
+bravo
+Y
+alpha
+bravo
+Y
+alpha
+Y
+alpha
+Ybravo
+
+alpha
+Y
+
+Y
+
+bystander
diff --git a/LayoutTests/accessibility/isolated-tree/mac/replace-range-at-block-boundary.html b/LayoutTests/accessibility/isolated-tree/mac/replace-range-at-block-boundary.html
new file mode 100644
index 000000000000..90b842f40a78
--- /dev/null
+++ b/LayoutTests/accessibility/isolated-tree/mac/replace-range-at-block-boundary.html
@@ -0,0 +1,123 @@
+<!DOCTYPE HTML><!-- webkit-test-runner [ IsAccessibilityIsolatedTreeEnabled=true ] -->
+<html>
+<head>
+<script src="../../../resources/accessibility-helper.js"></script>
+<script src="../../../resources/js-test.js"></script>
+</head>
+<body>
+
+<!-- AXReplaceRangeWithText resolved the character range it was handed by walking CharacterOffsets. A
+     CharacterOffset names a node and a side of it, so at a block boundary one character index belongs
+     to two of them: the position after the <br> that ends the preceding block, and the position
+     starting the next block. The walk picked the former, which is not a caret position -- a <br>
+     ending a block is collapsed out by rendering -- so it canonicalized back over the <br> and the
+     text landed one character early, swallowing a line break.
+
+     This is the shape pressing Return in a contenteditable produces, because the default paragraph
+     separator is a <div> and the block holding the typed text also carries a trailing <br>. It takes
+     three lines to see: the first Return leaves no preceding block to land in. -->
+<div id="typed" contenteditable style="width: 200px">alpha<div>bravo<br></div><div><br></div></div>
+<!-- The same rendered text in shapes that already worked, so a fix that only handles one is visible. -->
+<div id="blocks" contenteditable style="width: 200px">alpha<div>bravo</div><div><br></div></div>
+<div id="brs" contenteditable style="width: 200px">alpha<br>bravo<br><br></div>
+<!-- One line shorter. This is the shape a two-line attempt reaches, and it was always correct. -->
+<div id="short" contenteditable style="width: 200px">alpha<div><br></div></div>
+<!-- Longer, to show the answer does not drift with distance into the content. -->
+<div id="longer" contenteditable style="width: 200px">alpha<div>bravo<br></div><div>charlie<br></div><div><br></div></div>
+<!-- Ranges naming characters the value does not have. Each case gets its own element, so no
+     measurement runs against a value an earlier edit has already changed. -->
+<div id="pastEnd" contenteditable style="width: 200px">alpha<div>bravo<br></div><div><br></div></div>
+<div id="farPastEnd" contenteditable style="width: 200px">alpha<div>bravo<br></div><div><br></div></div>
+<div id="pastEndByLength" contenteditable style="width: 200px">alpha<div>bravo<br></div><div><br></div></div>
+<!-- Interior indices, correct throughout. -->
+<div id="interior" contenteditable style="width: 200px">alpha<div>bravo<br></div><div><br></div></div>
+<div id="replacing" contenteditable style="width: 200px">alpha<div>bravo<br></div><div><br></div></div>
+<!-- A field with no text still has the one position an insertion can name. -->
+<div id="empty" contenteditable style="width: 200px"></div>
+<!-- A native text control takes HTMLTextFormControlElement::setRangeText instead. -->
+<textarea id="textarea" style="width: 200px; height: 60px">alpha
+bravo
+</textarea>
+<!-- Left alone. A request that ignored its range would land wherever the caret is, which is here. -->
+<div id="bystander" contenteditable style="width: 200px">bystander</div>
+
+<script>
+var output = "Asserts that AXReplaceRangeWithText writes at the character index it is given, including the\n"
+    + "index that starts a block, and clamps a range running past the end of the value to the end\n"
+    + "rather than writing at the current selection.\n\n";
+
+// `at`/`length` are the requested range, `want` the element's innerText afterwards. `returns` defaults
+// to true.
+var cases = [
+    { id: "typed", label: "block ending in <br>, index starting the next block", at: 12, want: "alpha\nbravo\nY\n" },
+    { id: "blocks", label: "block without a trailing <br>", at: 12, want: "alpha\nbravo\nY\n" },
+    { id: "brs", label: "<br>-separated lines", at: 12, want: "alpha\nbravo\nY\n" },
+    { id: "short", label: "one line, index starting the blank second line", at: 6, want: "alpha\nY\n" },
+    { id: "longer", label: "two blocks ending in <br>", at: 20, want: "alpha\nbravo\ncharlie\nY\n" },
+    { id: "interior", label: "interior index", at: 6, want: "alpha\nYbravo\n\n" },
+    { id: "replacing", label: "replacing a run of characters", at: 6, length: 5, want: "alpha\nY\n\n" },
+    { id: "empty", label: "field with no text", at: 0, want: "Y" },
+    { id: "textarea", label: "textarea, index starting the blank final line", at: 12, want: "alpha\nbravo\nY" },
+    // A range naming characters the value does not have is clamped to the end of the value rather
+    // than refused, the way setRangeText clamps for a native control. The caller gets its text
+    // somewhere sensible in the field it addressed instead of losing it.
+    { id: "pastEnd", label: "location one past the end of the value", at: 14, want: "alpha\nbravo\nY\n" },
+    { id: "farPastEnd", label: "location far past the end of the value", at: 99, want: "alpha\nbravo\nY\n" },
+    // Replacing through the end leaves the block's own trailing line break, the same way the
+    // interior replacement above does.
+    { id: "pastEndByLength", label: "length running past the end of the value", at: 6, length: 99, want: "alpha\nY\n" },
+];
+
+var axField, field, bystander;
+
+// The editor applies an accessibility edit asynchronously, so give it a turn to land before reading
+// the DOM back. A refused request changes nothing, so there is nothing to wait for; wait a turn
+// either way and assert on the resulting text.
+function editSettled() {
+    return new Promise(resolve => setTimeout(resolve, 0));
+}
+
+function textOf(element) {
+    return element.isContentEditable ? element.innerText : element.value;
+}
+
+if (window.accessibilityController) {
+    window.jsTestIsAsync = true;
+
+    setTimeout(async function() {
+        bystander = document.getElementById("bystander");
+
+        // Park the caret outside every measured field, so a request that ignored its range would
+        // corrupt the bystander rather than land plausibly in the field it named.
+        bystander.focus();
+        var selection = window.getSelection();
+        selection.removeAllRanges();
+        var caret = document.createRange();
+        caret.selectNodeContents(bystander);
+        caret.collapse(false);
+        selection.addRange(caret);
+
+        for (var testCase of cases) {
+            field = document.getElementById(testCase.id);
+            axField = await waitForElementById(testCase.id);
+            if (!axField) {
+                output += `FAIL: ${testCase.label}: no accessibility element for #${testCase.id}\n\n`;
+                continue;
+            }
+
+            var length = testCase.length || 0;
+            output += `${testCase.label}: value ${JSON.stringify(axField.stringAttributeValue("AXValue"))}, replacing {${testCase.at}, ${length}}\n`;
+            output += expect(`axField.replaceTextInRange("Y", ${testCase.at}, ${length})`, testCase.returns === false ? "false" : "true");
+            await editSettled();
+            output += expect("textOf(field)", JSON.stringify(testCase.want));
+            output += expect("textOf(bystander)", JSON.stringify("bystander"));
+            output += "\n";
+        }
+
+        debugEscaped(output);
+        finishJSTest();
+    }, 0);
+}
+</script>
+</body>
+</html>
diff --git a/LayoutTests/accessibility/isolated-tree/mac/text-marker-range-for-text-control-expected.txt b/LayoutTests/accessibility/isolated-tree/mac/text-marker-range-for-text-control-expected.txt
new file mode 100644
index 000000000000..8dfd3e1f2130
--- /dev/null
+++ b/LayoutTests/accessibility/isolated-tree/mac/text-marker-range-for-text-control-expected.txt
@@ -0,0 +1,31 @@
+Asserts that AXTextMarkerRangeForUIElement covers a text control's value rather than the
+control as a single replaced object. A genuinely replaced element still answers with itself.
+
+textarea:
+PASS: webArea.stringForTextMarkerRange(range) === "alpha\nbravo\n"
+PASS: webArea.textMarkerRangeLength(range) === 12
+
+text input:
+PASS: webArea.stringForTextMarkerRange(range) === "alpha bravo"
+PASS: webArea.textMarkerRangeLength(range) === 11
+
+search input:
+PASS: webArea.stringForTextMarkerRange(range) === "alpha bravo"
+PASS: webArea.textMarkerRangeLength(range) === 11
+
+contenteditable:
+PASS: webArea.stringForTextMarkerRange(range) === "alpha\nbravo\n"
+PASS: webArea.textMarkerRangeLength(range) === 12
+
+image:
+PASS: webArea.stringForTextMarkerRange(range) === ""
+PASS: webArea.textMarkerRangeLength(range) === 1
+
+
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
+alpha
+bravo
+
diff --git a/LayoutTests/accessibility/isolated-tree/mac/text-marker-range-for-text-control.html b/LayoutTests/accessibility/isolated-tree/mac/text-marker-range-for-text-control.html
new file mode 100644
index 000000000000..afd35d80208e
--- /dev/null
+++ b/LayoutTests/accessibility/isolated-tree/mac/text-marker-range-for-text-control.html
@@ -0,0 +1,71 @@
+<!DOCTYPE HTML><!-- webkit-test-runner [ IsAccessibilityIsolatedTreeEnabled=true ] -->
+<html>
+<head>
+<script src="../../../resources/accessibility-helper.js"></script>
+<script src="../../../resources/js-test.js"></script>
+</head>
+<body>
+
+<!-- A native text control's value lives in its shadow inner text element, so the host has no light
+     DOM children whose contents a range could cover. AXObjectCache::rangeForNodeContents therefore
+     answered with a range over the control as a single replaced object, whose string is one object
+     replacement character (U+FFFC) and whose endpoints carry no useful index. VoiceOver measures a
+     field's line span with this attribute, so the bogus answer dropped it onto a fallback path. The
+     isolated tree builds the same range from its text runs, which descend into the shadow text, and
+     was already correct. -->
+<textarea id="textarea" style="width: 200px; height: 60px">alpha
+bravo
+</textarea>
+<input id="input" type="text" value="alpha bravo">
+<input id="search" type="search" value="alpha bravo">
+<div id="contenteditable" contenteditable style="width: 200px">alpha<br>bravo<br></div>
+<img id="image" src="resources/cake.png" alt="A cake">
+
+<script>
+var output = "Asserts that AXTextMarkerRangeForUIElement covers a text control's value rather than the\n"
+    + "control as a single replaced object. A genuinely replaced element still answers with itself.\n\n";
+
+// `string` is the expected AXStringForTextMarkerRange of the element's text marker range. U+FFFC,
+// the object replacement character, is what a range over a replaced object stringifies to, and is
+// correct only for the image. A text control with no value keeps pointing at itself, so it answers
+// with U+FFFC too; that case is left out here because the two trees disagree about it.
+var cases = [
+    { id: "textarea", label: "textarea", string: "alpha\nbravo\n" },
+    { id: "input", label: "text input", string: "alpha bravo" },
+    { id: "search", label: "search input", string: "alpha bravo" },
+    { id: "contenteditable", label: "contenteditable", string: "alpha\nbravo\n" },
+    { id: "image", label: "image", string: "\uFFFC" },
+];
+
+// expect() evaluates its expressions in its own scope, so the values it reads are globals.
+var webArea, axElement, range;
+
+if (window.accessibilityController) {
+    window.jsTestIsAsync = true;
+
+    setTimeout(async function() {
+        webArea = accessibilityController.rootElement.childAtIndex(0);
+
+        for (var testCase of cases) {
+            axElement = await waitForElementById(testCase.id);
+            if (!axElement) {
+                output += `FAIL: ${testCase.label}: no accessibility element for #${testCase.id}\n\n`;
+                continue;
+            }
+
+            // VoiceOver asks the web area, and the handler answers about the element it is passed,
+            // so the receiver does not matter; matching VoiceOver's usage keeps this faithful.
+            range = webArea.textMarkerRangeForElement(axElement);
+            output += `${testCase.label}:\n`;
+            output += expect("webArea.stringForTextMarkerRange(range)", JSON.stringify(testCase.string));
+            output += expect("webArea.textMarkerRangeLength(range)", `${testCase.string.length}`);
+            output += "\n";
+        }
+
+        debugEscaped(output);
+        finishJSTest();
+    }, 0);
+}
+</script>
+</body>
+</html>
diff --git a/LayoutTests/accessibility/mac/line-range-at-soft-break-excludes-space-expected.txt b/LayoutTests/accessibility/mac/line-range-at-soft-break-excludes-space-expected.txt
new file mode 100644
index 000000000000..66ef3fc2be08
--- /dev/null
+++ b/LayoutTests/accessibility/mac/line-range-at-soft-break-excludes-space-expected.txt
@@ -0,0 +1,14 @@
+This test ensures a line ended by soft wrapping excludes the space at the wrap point.
+
+PASS: lineText(1) === 'aaa'
+PASS: lineText(2) === 'bbb'
+PASS: webArea.textMarkerRangeLength(lineRange(1)) === 3
+PASS: lineText(3) === 'ccc'
+PASS: lineText(4) === 'ddd'
+PASS: lineText(5) === 'eee'
+PASS: lineText(6) === 'fff'
+
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/accessibility/mac/line-range-at-soft-break-excludes-space.html b/LayoutTests/accessibility/mac/line-range-at-soft-break-excludes-space.html
new file mode 100644
index 000000000000..47e6d9557046
--- /dev/null
+++ b/LayoutTests/accessibility/mac/line-range-at-soft-break-excludes-space.html
@@ -0,0 +1,52 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+<script src="../../resources/accessibility-helper.js"></script>
+<script src="../../resources/js-test.js"></script>
+<style>
+p { width: 4ch; font: 16px/1 monospace; }
+</style>
+</head>
+<body>
+
+<p id="collapsedSpace">aaa bbb</p>
+<p id="collapsedSpaces">ccc   ddd</p>
+<p id="preservedSpace" style="white-space: pre-wrap;">eee fff</p>
+
+<script>
+var output = "This test ensures a line ended by soft wrapping excludes the space at the wrap point.\n\n";
+
+if (window.accessibilityController) {
+    var webArea = accessibilityController.rootElement.childAtIndex(0);
+
+    function lineRange(oneBasedLine)
+    {
+        return webArea.textMarkerRangeForLine(oneBasedLine);
+    }
+
+    function lineText(oneBasedLine)
+    {
+        return webArea.stringForTextMarkerRange(lineRange(oneBasedLine));
+    }
+
+    output += expect("lineText(1)", "'aaa'");
+    output += expect("lineText(2)", "'bbb'");
+    // The range ends before the space, so its length matches the text it yields.
+    output += expect("webArea.textMarkerRangeLength(lineRange(1))", "3");
+
+    // Collapsed spaces render as one, and the line ends before that one too.
+    output += expect("lineText(3)", "'ccc'");
+    output += expect("lineText(4)", "'ddd'");
+
+    // This space is preserved rather than collapsed, but still renders on neither line.
+    output += expect("lineText(5)", "'eee'");
+    output += expect("lineText(6)", "'fff'");
+
+    for (var paragraph of document.querySelectorAll("p"))
+        paragraph.style.display = "none";
+
+    debug(output);
+}
+</script>
+</body>
+</html>
diff --git a/LayoutTests/accessibility/mac/replace-range-at-block-boundary-expected.txt b/LayoutTests/accessibility/mac/replace-range-at-block-boundary-expected.txt
new file mode 100644
index 000000000000..594a889cb7e9
--- /dev/null
+++ b/LayoutTests/accessibility/mac/replace-range-at-block-boundary-expected.txt
@@ -0,0 +1,100 @@
+Asserts that AXReplaceRangeWithText writes at the character index it is given, including the
+index that starts a block, and clamps a range running past the end of the value to the end
+rather than writing at the current selection.
+
+block ending in <br>, index starting the next block: value "alpha\nbravo\n\n", replacing {12, 0}
+PASS: axField.replaceTextInRange("Y", 12, 0) === true
+PASS: textOf(field) === "alpha\nbravo\nY\n"
+PASS: textOf(bystander) === "bystander"
+
+block without a trailing <br>: value "alpha\nbravo\n\n", replacing {12, 0}
+PASS: axField.replaceTextInRange("Y", 12, 0) === true
+PASS: textOf(field) === "alpha\nbravo\nY\n"
+PASS: textOf(bystander) === "bystander"
+
+<br>-separated lines: value "alpha\nbravo\n\n", replacing {12, 0}
+PASS: axField.replaceTextInRange("Y", 12, 0) === true
+PASS: textOf(field) === "alpha\nbravo\nY\n"
+PASS: textOf(bystander) === "bystander"
+
+one line, index starting the blank second line: value "alpha\n\n", replacing {6, 0}
+PASS: axField.replaceTextInRange("Y", 6, 0) === true
+PASS: textOf(field) === "alpha\nY\n"
+PASS: textOf(bystander) === "bystander"
+
+two blocks ending in <br>: value "alpha\nbravo\ncharlie\n\n", replacing {20, 0}
+PASS: axField.replaceTextInRange("Y", 20, 0) === true
+PASS: textOf(field) === "alpha\nbravo\ncharlie\nY\n"
+PASS: textOf(bystander) === "bystander"
+
+interior index: value "alpha\nbravo\n\n", replacing {6, 0}
+PASS: axField.replaceTextInRange("Y", 6, 0) === true
+PASS: textOf(field) === "alpha\nYbravo\n\n"
+PASS: textOf(bystander) === "bystander"
+
+replacing a run of characters: value "alpha\nbravo\n\n", replacing {6, 5}
+PASS: axField.replaceTextInRange("Y", 6, 5) === true
+PASS: textOf(field) === "alpha\nY\n\n"
+PASS: textOf(bystander) === "bystander"
+
+field with no text: value "", replacing {0, 0}
+PASS: axField.replaceTextInRange("Y", 0, 0) === true
+PASS: textOf(field) === "Y"
+PASS: textOf(bystander) === "bystander"
+
+textarea, index starting the blank final line: value "alpha\nbravo\n", replacing {12, 0}
+PASS: axField.replaceTextInRange("Y", 12, 0) === true
+PASS: textOf(field) === "alpha\nbravo\nY"
+PASS: textOf(bystander) === "bystander"
+
+location one past the end of the value: value "alpha\nbravo\n\n", replacing {14, 0}
+PASS: axField.replaceTextInRange("Y", 14, 0) === true
+PASS: textOf(field) === "alpha\nbravo\nY\n"
+PASS: textOf(bystander) === "bystander"
+
+location far past the end of the value: value "alpha\nbravo\n\n", replacing {99, 0}
+PASS: axField.replaceTextInRange("Y", 99, 0) === true
+PASS: textOf(field) === "alpha\nbravo\nY\n"
+PASS: textOf(bystander) === "bystander"
+
+length running past the end of the value: value "alpha\nbravo\n\n", replacing {6, 99}
+PASS: axField.replaceTextInRange("Y", 6, 99) === true
+PASS: textOf(field) === "alpha\nY\n"
+PASS: textOf(bystander) === "bystander"
+
+
+PASS successfullyParsed is true
+
+TEST COMPLETE
+alpha
+bravo
+Y
+alpha
+bravo
+Y
+alpha
+bravo
+Y
+alpha
+Y
+alpha
+bravo
+charlie
+Y
+alpha
+bravo
+Y
+alpha
+bravo
+Y
+alpha
+Y
+alpha
+Ybravo
+
+alpha
+Y
+
+Y
+
+bystander
diff --git a/LayoutTests/accessibility/mac/replace-range-at-block-boundary.html b/LayoutTests/accessibility/mac/replace-range-at-block-boundary.html
new file mode 100644
index 000000000000..595a1fa8fae5
--- /dev/null
+++ b/LayoutTests/accessibility/mac/replace-range-at-block-boundary.html
@@ -0,0 +1,123 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+<script src="../../resources/accessibility-helper.js"></script>
+<script src="../../resources/js-test.js"></script>
+</head>
+<body>
+
+<!-- AXReplaceRangeWithText resolved the character range it was handed by walking CharacterOffsets. A
+     CharacterOffset names a node and a side of it, so at a block boundary one character index belongs
+     to two of them: the position after the <br> that ends the preceding block, and the position
+     starting the next block. The walk picked the former, which is not a caret position -- a <br>
+     ending a block is collapsed out by rendering -- so it canonicalized back over the <br> and the
+     text landed one character early, swallowing a line break.
+
+     This is the shape pressing Return in a contenteditable produces, because the default paragraph
+     separator is a <div> and the block holding the typed text also carries a trailing <br>. It takes
+     three lines to see: the first Return leaves no preceding block to land in. -->
+<div id="typed" contenteditable style="width: 200px">alpha<div>bravo<br></div><div><br></div></div>
+<!-- The same rendered text in shapes that already worked, so a fix that only handles one is visible. -->
+<div id="blocks" contenteditable style="width: 200px">alpha<div>bravo</div><div><br></div></div>
+<div id="brs" contenteditable style="width: 200px">alpha<br>bravo<br><br></div>
+<!-- One line shorter. This is the shape a two-line attempt reaches, and it was always correct. -->
+<div id="short" contenteditable style="width: 200px">alpha<div><br></div></div>
+<!-- Longer, to show the answer does not drift with distance into the content. -->
+<div id="longer" contenteditable style="width: 200px">alpha<div>bravo<br></div><div>charlie<br></div><div><br></div></div>
+<!-- Ranges naming characters the value does not have. Each case gets its own element, so no
+     measurement runs against a value an earlier edit has already changed. -->
+<div id="pastEnd" contenteditable style="width: 200px">alpha<div>bravo<br></div><div><br></div></div>
+<div id="farPastEnd" contenteditable style="width: 200px">alpha<div>bravo<br></div><div><br></div></div>
+<div id="pastEndByLength" contenteditable style="width: 200px">alpha<div>bravo<br></div><div><br></div></div>
+<!-- Interior indices, correct throughout. -->
+<div id="interior" contenteditable style="width: 200px">alpha<div>bravo<br></div><div><br></div></div>
+<div id="replacing" contenteditable style="width: 200px">alpha<div>bravo<br></div><div><br></div></div>
+<!-- A field with no text still has the one position an insertion can name. -->
+<div id="empty" contenteditable style="width: 200px"></div>
+<!-- A native text control takes HTMLTextFormControlElement::setRangeText instead. -->
+<textarea id="textarea" style="width: 200px; height: 60px">alpha
+bravo
+</textarea>
+<!-- Left alone. A request that ignored its range would land wherever the caret is, which is here. -->
+<div id="bystander" contenteditable style="width: 200px">bystander</div>
+
+<script>
+var output = "Asserts that AXReplaceRangeWithText writes at the character index it is given, including the\n"
+    + "index that starts a block, and clamps a range running past the end of the value to the end\n"
+    + "rather than writing at the current selection.\n\n";
+
+// `at`/`length` are the requested range, `want` the element's innerText afterwards. `returns` defaults
+// to true.
+var cases = [
+    { id: "typed", label: "block ending in <br>, index starting the next block", at: 12, want: "alpha\nbravo\nY\n" },
+    { id: "blocks", label: "block without a trailing <br>", at: 12, want: "alpha\nbravo\nY\n" },
+    { id: "brs", label: "<br>-separated lines", at: 12, want: "alpha\nbravo\nY\n" },
+    { id: "short", label: "one line, index starting the blank second line", at: 6, want: "alpha\nY\n" },
+    { id: "longer", label: "two blocks ending in <br>", at: 20, want: "alpha\nbravo\ncharlie\nY\n" },
+    { id: "interior", label: "interior index", at: 6, want: "alpha\nYbravo\n\n" },
+    { id: "replacing", label: "replacing a run of characters", at: 6, length: 5, want: "alpha\nY\n\n" },
+    { id: "empty", label: "field with no text", at: 0, want: "Y" },
+    { id: "textarea", label: "textarea, index starting the blank final line", at: 12, want: "alpha\nbravo\nY" },
+    // A range naming characters the value does not have is clamped to the end of the value rather
+    // than refused, the way setRangeText clamps for a native control. The caller gets its text
+    // somewhere sensible in the field it addressed instead of losing it.
+    { id: "pastEnd", label: "location one past the end of the value", at: 14, want: "alpha\nbravo\nY\n" },
+    { id: "farPastEnd", label: "location far past the end of the value", at: 99, want: "alpha\nbravo\nY\n" },
+    // Replacing through the end leaves the block's own trailing line break, the same way the
+    // interior replacement above does.
+    { id: "pastEndByLength", label: "length running past the end of the value", at: 6, length: 99, want: "alpha\nY\n" },
+];
+
+var axField, field, bystander;
+
+// The editor applies an accessibility edit asynchronously, so give it a turn to land before reading
+// the DOM back. A refused request changes nothing, so there is nothing to wait for; wait a turn
+// either way and assert on the resulting text.
+function editSettled() {
+    return new Promise(resolve => setTimeout(resolve, 0));
+}
+
+function textOf(element) {
+    return element.isContentEditable ? element.innerText : element.value;
+}
+
+if (window.accessibilityController) {
+    window.jsTestIsAsync = true;
+
+    setTimeout(async function() {
+        bystander = document.getElementById("bystander");
+
+        // Park the caret outside every measured field, so a request that ignored its range would
+        // corrupt the bystander rather than land plausibly in the field it named.
+        bystander.focus();
+        var selection = window.getSelection();
+        selection.removeAllRanges();
+        var caret = document.createRange();
+        caret.selectNodeContents(bystander);
+        caret.collapse(false);
+        selection.addRange(caret);
+
+        for (var testCase of cases) {
+            field = document.getElementById(testCase.id);
+            axField = await waitForElementById(testCase.id);
+            if (!axField) {
+                output += `FAIL: ${testCase.label}: no accessibility element for #${testCase.id}\n\n`;
+                continue;
+            }
+
+            var length = testCase.length || 0;
+            output += `${testCase.label}: value ${JSON.stringify(axField.stringAttributeValue("AXValue"))}, replacing {${testCase.at}, ${length}}\n`;
+            output += expect(`axField.replaceTextInRange("Y", ${testCase.at}, ${length})`, testCase.returns === false ? "false" : "true");
+            await editSettled();
+            output += expect("textOf(field)", JSON.stringify(testCase.want));
+            output += expect("textOf(bystander)", JSON.stringify("bystander"));
+            output += "\n";
+        }
+
+        debugEscaped(output);
+        finishJSTest();
+    }, 0);
+}
+</script>
+</body>
+</html>
diff --git a/LayoutTests/accessibility/mac/text-marker-range-for-text-control-expected.txt b/LayoutTests/accessibility/mac/text-marker-range-for-text-control-expected.txt
new file mode 100644
index 000000000000..8dfd3e1f2130
--- /dev/null
+++ b/LayoutTests/accessibility/mac/text-marker-range-for-text-control-expected.txt
@@ -0,0 +1,31 @@
+Asserts that AXTextMarkerRangeForUIElement covers a text control's value rather than the
+control as a single replaced object. A genuinely replaced element still answers with itself.
+
+textarea:
+PASS: webArea.stringForTextMarkerRange(range) === "alpha\nbravo\n"
+PASS: webArea.textMarkerRangeLength(range) === 12
+
+text input:
+PASS: webArea.stringForTextMarkerRange(range) === "alpha bravo"
+PASS: webArea.textMarkerRangeLength(range) === 11
+
+search input:
+PASS: webArea.stringForTextMarkerRange(range) === "alpha bravo"
+PASS: webArea.textMarkerRangeLength(range) === 11
+
+contenteditable:
+PASS: webArea.stringForTextMarkerRange(range) === "alpha\nbravo\n"
+PASS: webArea.textMarkerRangeLength(range) === 12
+
+image:
+PASS: webArea.stringForTextMarkerRange(range) === ""
+PASS: webArea.textMarkerRangeLength(range) === 1
+
+
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
+alpha
+bravo
+
diff --git a/LayoutTests/accessibility/mac/text-marker-range-for-text-control.html b/LayoutTests/accessibility/mac/text-marker-range-for-text-control.html
new file mode 100644
index 000000000000..891a8b1b022d
--- /dev/null
+++ b/LayoutTests/accessibility/mac/text-marker-range-for-text-control.html
@@ -0,0 +1,71 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+<script src="../../resources/accessibility-helper.js"></script>
+<script src="../../resources/js-test.js"></script>
+</head>
+<body>
+
+<!-- A native text control's value lives in its shadow inner text element, so the host has no light
+     DOM children whose contents a range could cover. AXObjectCache::rangeForNodeContents therefore
+     answered with a range over the control as a single replaced object, whose string is one object
+     replacement character (U+FFFC) and whose endpoints carry no useful index. VoiceOver measures a
+     field's line span with this attribute, so the bogus answer dropped it onto a fallback path. The
+     isolated tree builds the same range from its text runs, which descend into the shadow text, and
+     was already correct. -->
+<textarea id="textarea" style="width: 200px; height: 60px">alpha
+bravo
+</textarea>
+<input id="input" type="text" value="alpha bravo">
+<input id="search" type="search" value="alpha bravo">
+<div id="contenteditable" contenteditable style="width: 200px">alpha<br>bravo<br></div>
+<img id="image" src="resources/cake.png" alt="A cake">
+
+<script>
+var output = "Asserts that AXTextMarkerRangeForUIElement covers a text control's value rather than the\n"
+    + "control as a single replaced object. A genuinely replaced element still answers with itself.\n\n";
+
+// `string` is the expected AXStringForTextMarkerRange of the element's text marker range. U+FFFC,
+// the object replacement character, is what a range over a replaced object stringifies to, and is
+// correct only for the image. A text control with no value keeps pointing at itself, so it answers
+// with U+FFFC too; that case is left out here because the two trees disagree about it.
+var cases = [
+    { id: "textarea", label: "textarea", string: "alpha\nbravo\n" },
+    { id: "input", label: "text input", string: "alpha bravo" },
+    { id: "search", label: "search input", string: "alpha bravo" },
+    { id: "contenteditable", label: "contenteditable", string: "alpha\nbravo\n" },
+    { id: "image", label: "image", string: "\uFFFC" },
+];
+
+// expect() evaluates its expressions in its own scope, so the values it reads are globals.
+var webArea, axElement, range;
+
+if (window.accessibilityController) {
+    window.jsTestIsAsync = true;
+
+    setTimeout(async function() {
+        webArea = accessibilityController.rootElement.childAtIndex(0);
+
+        for (var testCase of cases) {
+            axElement = await waitForElementById(testCase.id);
+            if (!axElement) {
+                output += `FAIL: ${testCase.label}: no accessibility element for #${testCase.id}\n\n`;
+                continue;
+            }
+
+            // VoiceOver asks the web area, and the handler answers about the element it is passed,
+            // so the receiver does not matter; matching VoiceOver's usage keeps this faithful.
+            range = webArea.textMarkerRangeForElement(axElement);
+            output += `${testCase.label}:\n`;
+            output += expect("webArea.stringForTextMarkerRange(range)", JSON.stringify(testCase.string));
+            output += expect("webArea.textMarkerRangeLength(range)", `${testCase.string.length}`);
+            output += "\n";
+        }
+
+        debugEscaped(output);
+        finishJSTest();
+    }, 0);
+}
+</script>
+</body>
+</html>
diff --git a/LayoutTests/fast/canvas/canvas-filter-fillText-crash-expected.txt b/LayoutTests/fast/canvas/canvas-filter-fillText-crash-expected.txt
new file mode 100644
index 000000000000..49004868ff5d
--- /dev/null
+++ b/LayoutTests/fast/canvas/canvas-filter-fillText-crash-expected.txt
@@ -0,0 +1,3 @@
+This test passes if it does not crash.
+
+
diff --git a/LayoutTests/fast/canvas/canvas-filter-fillText-crash.html b/LayoutTests/fast/canvas/canvas-filter-fillText-crash.html
new file mode 100644
index 000000000000..6cd77d35cdbb
--- /dev/null
+++ b/LayoutTests/fast/canvas/canvas-filter-fillText-crash.html
@@ -0,0 +1,20 @@
+<!-- webkit-test-runner [ CanvasFiltersEnabled=true ] -->
+
+<!DOCTYPE html>
+
+<p>This test passes if it does not crash.</p>
+<canvas id="c" width="200" height="100"></canvas>
+
+<script>
+  if (window.testRunner)
+    testRunner.dumpAsText();
+
+  const ctx = document.getElementById('c').getContext('2d');
+  ctx.font = '20px serif';
+
+  for (let i = 0; i < 15; ++i)
+    ctx.save();
+
+  ctx.filter = 'blur(5px)';
+  ctx.fillText('hello', 10, 50);
+</script>
diff --git a/LayoutTests/fast/images/animated-image-mp4-crash.html b/LayoutTests/fast/images/animated-image-mp4-crash.html
index 4a22c794a2b0..931248a03b97 100644
--- a/LayoutTests/fast/images/animated-image-mp4-crash.html
+++ b/LayoutTests/fast/images/animated-image-mp4-crash.html
@@ -13,7 +13,9 @@
             return new Promise(resolve => {
                 const image = document.querySelector('img');
                 image.src = src;
-                return image.decode().then(() => { resolve(image); });
+                // The file is malformed on purpose, so decode() is allowed to reject. This test
+                // only checks that loading it does not crash, and hangs if the promise never settles.
+                return image.decode().then(() => { resolve(image); }, () => { resolve(image); });
             });
         }
 
diff --git a/LayoutTests/fast/images/apng-acTL-frame-count-overflow-expected.txt b/LayoutTests/fast/images/apng-acTL-frame-count-overflow-expected.txt
new file mode 100644
index 000000000000..6c9c792760f6
--- /dev/null
+++ b/LayoutTests/fast/images/apng-acTL-frame-count-overflow-expected.txt
@@ -0,0 +1,4 @@
+An APNG whose acTL declares more frames than PNGImageDecoder accepts must not report that count to its callers, which size per-frame containers from it.
+
+PASS
+
diff --git a/LayoutTests/fast/images/apng-acTL-frame-count-overflow.html b/LayoutTests/fast/images/apng-acTL-frame-count-overflow.html
new file mode 100644
index 000000000000..ca8d87c092d5
--- /dev/null
+++ b/LayoutTests/fast/images/apng-acTL-frame-count-overflow.html
@@ -0,0 +1,36 @@
+<!DOCTYPE html>
+<p>An APNG whose acTL declares more frames than PNGImageDecoder accepts must not report that count
+to its callers, which size per-frame containers from it.</p>
+<pre id="log">PASS</pre>
+<img id="image" src="resources/apng-acTL-frame-count-overflow.png">
+<script>
+if (window.testRunner) {
+    testRunner.dumpAsText();
+    testRunner.waitUntilDone();
+}
+
+function log(message)
+{
+    document.getElementById("log").textContent += "\n" + message;
+}
+
+function imageSettled()
+{
+    var image = document.getElementById("image");
+    if (window.internals) {
+        var count = internals.imageFrameCount(image);
+        if (count != 1)
+            log("FAIL: expected a rejected acTL to leave 1 frame, got " + count);
+        internals.forceDecodeImageFrameAtIndex(image, 0);
+    }
+
+    if (window.testRunner)
+        testRunner.notifyDone();
+}
+
+var image = document.getElementById("image");
+image.onload = imageSettled;
+image.onerror = imageSettled;
+if (image.complete)
+    imageSettled();
+</script>
diff --git a/LayoutTests/fast/images/apng-acTL-zero-frame-count-expected.txt b/LayoutTests/fast/images/apng-acTL-zero-frame-count-expected.txt
new file mode 100644
index 000000000000..4c4ad20e177b
--- /dev/null
+++ b/LayoutTests/fast/images/apng-acTL-zero-frame-count-expected.txt
@@ -0,0 +1,3 @@
+An APNG whose acTL declares zero frames is not an animation, so the default image must still decode as a static PNG rather than being reported as a zero-frame image and dropped.
+
+PASS
diff --git a/LayoutTests/fast/images/apng-acTL-zero-frame-count.html b/LayoutTests/fast/images/apng-acTL-zero-frame-count.html
new file mode 100644
index 000000000000..28285e3314f3
--- /dev/null
+++ b/LayoutTests/fast/images/apng-acTL-zero-frame-count.html
@@ -0,0 +1,39 @@
+<!DOCTYPE html>
+<p>An APNG whose acTL declares zero frames is not an animation, so the default image must still
+decode as a static PNG rather than being reported as a zero-frame image and dropped.</p>
+<pre id="log">PASS</pre>
+<script>
+if (window.testRunner) {
+    testRunner.dumpAsText();
+    testRunner.waitUntilDone();
+}
+
+function log(message)
+{
+    document.getElementById("log").textContent += "\n" + message;
+}
+
+function imageSettled(image)
+{
+    try {
+        var canvas = document.createElement("canvas");
+        canvas.width = 4;
+        canvas.height = 4;
+        var context = canvas.getContext("2d");
+        context.drawImage(image, 0, 0);
+        var pixel = context.getImageData(0, 0, 1, 1).data;
+        if (pixel[0] != 255 || pixel[1] || pixel[2] || pixel[3] != 255)
+            log("FAIL: expected an opaque red pixel, got " + [pixel[0], pixel[1], pixel[2], pixel[3]]);
+    } catch (exception) {
+        log("FAIL: " + exception.message);
+    }
+
+    if (window.testRunner)
+        testRunner.notifyDone();
+}
+
+var image = new Image();
+image.onload = function () { imageSettled(image); };
+image.onerror = function () { imageSettled(image); };
+image.src = "resources/apng-acTL-zero-frame-count.png";
+</script>
diff --git a/LayoutTests/fast/images/apng-decode-after-frame-cache-eviction-expected.txt b/LayoutTests/fast/images/apng-decode-after-frame-cache-eviction-expected.txt
new file mode 100644
index 000000000000..d279fbdf979d
--- /dev/null
+++ b/LayoutTests/fast/images/apng-decode-after-frame-cache-eviction-expected.txt
@@ -0,0 +1,4 @@
+Dropping decoded frames and then decoding again must not leave a frame reading a cleared frame's backing store. The test passes if the web process survives.
+
+PASS
+
diff --git a/LayoutTests/fast/images/apng-decode-after-frame-cache-eviction.html b/LayoutTests/fast/images/apng-decode-after-frame-cache-eviction.html
new file mode 100644
index 000000000000..6b4f64838736
--- /dev/null
+++ b/LayoutTests/fast/images/apng-decode-after-frame-cache-eviction.html
@@ -0,0 +1,41 @@
+<!DOCTYPE html>
+<p>Dropping decoded frames and then decoding again must not leave a frame reading a cleared frame's
+backing store. The test passes if the web process survives.</p>
+<pre id="log">PASS</pre>
+<img id="image" src="resources/apng-frame-cache-eviction.png">
+<script>
+if (window.testRunner) {
+    testRunner.dumpAsText();
+    testRunner.waitUntilDone();
+}
+
+function log(message)
+{
+    document.getElementById("log").textContent += "\n" + message;
+}
+
+function imageSettled()
+{
+    var image = document.getElementById("image");
+    if (window.internals) {
+        var count = internals.imageFrameCount(image);
+        for (var index = 0; index < count; ++index)
+            internals.forceDecodeImageFrameAtIndex(image, index);
+
+        // Drop every decoded frame, so the frames a later frame composites over are gone.
+        internals.destroyDecodedDataForAllImages();
+
+        for (var index = count; index > 0; --index)
+            internals.forceDecodeImageFrameAtIndex(image, index - 1);
+    }
+
+    if (window.testRunner)
+        testRunner.notifyDone();
+}
+
+var image = document.getElementById("image");
+image.onload = imageSettled;
+image.onerror = imageSettled;
+if (image.complete)
+    imageSettled();
+</script>
diff --git a/LayoutTests/fast/images/apng-icc-frame-right-half-expected.html b/LayoutTests/fast/images/apng-icc-frame-right-half-expected.html
new file mode 100644
index 000000000000..0af273762072
--- /dev/null
+++ b/LayoutTests/fast/images/apng-icc-frame-right-half-expected.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<style>
+body { margin: 0; }
+img { display: block; image-rendering: pixelated; }
+</style>
+<img src="resources/apng-icc-frame-right-half-reference.png">
diff --git a/LayoutTests/fast/images/apng-icc-frame-right-half.html b/LayoutTests/fast/images/apng-icc-frame-right-half.html
new file mode 100644
index 000000000000..fcffb7d65d5e
--- /dev/null
+++ b/LayoutTests/fast/images/apng-icc-frame-right-half.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<!-- An animated PNG carrying an ICC profile must colour-convert only the pixels its animation frame
+     covers. Its frame sits in the right half of row 0, so a conversion counted from the canvas
+     origin overruns into row 1, which the frame does not cover. The animation declares a single
+     play, so it stops on that frame and this renders as the reference still image. -->
+<style>
+body { margin: 0; }
+img { display: block; image-rendering: pixelated; }
+</style>
+<img id="image" src="resources/apng-icc-frame-right-half.png">
+<script>
+if (window.testRunner) {
+    window.testRunner.waitUntilDone();
+    // The frames are 10ms apart, so let the single play finish before the snapshot.
+    window.addEventListener("load", function () {
+        setTimeout(function () { window.testRunner.notifyDone(); }, 300);
+    });
+}
+</script>
diff --git a/LayoutTests/fast/images/resources/apng-acTL-frame-count-overflow.png b/LayoutTests/fast/images/resources/apng-acTL-frame-count-overflow.png
new file mode 100644
index 000000000000..7510af8a337a
Binary files /dev/null and b/LayoutTests/fast/images/resources/apng-acTL-frame-count-overflow.png differ
diff --git a/LayoutTests/fast/images/resources/apng-acTL-zero-frame-count.png b/LayoutTests/fast/images/resources/apng-acTL-zero-frame-count.png
new file mode 100644
index 000000000000..6da166756ef4
Binary files /dev/null and b/LayoutTests/fast/images/resources/apng-acTL-zero-frame-count.png differ
diff --git a/LayoutTests/fast/images/resources/apng-frame-cache-eviction.png b/LayoutTests/fast/images/resources/apng-frame-cache-eviction.png
new file mode 100644
index 000000000000..3e5f7b2446a3
Binary files /dev/null and b/LayoutTests/fast/images/resources/apng-frame-cache-eviction.png differ
diff --git a/LayoutTests/fast/images/resources/apng-icc-frame-right-half-reference.png b/LayoutTests/fast/images/resources/apng-icc-frame-right-half-reference.png
new file mode 100644
index 000000000000..0ec71fb1b99e
Binary files /dev/null and b/LayoutTests/fast/images/resources/apng-icc-frame-right-half-reference.png differ
diff --git a/LayoutTests/fast/images/resources/apng-icc-frame-right-half.png b/LayoutTests/fast/images/resources/apng-icc-frame-right-half.png
new file mode 100644
index 000000000000..0fb539f9d3ad
Binary files /dev/null and b/LayoutTests/fast/images/resources/apng-icc-frame-right-half.png differ
diff --git a/LayoutTests/fast/webgpu/index-buffer-cache-invalidation-expected.txt b/LayoutTests/fast/webgpu/index-buffer-cache-invalidation-expected.txt
new file mode 100644
index 000000000000..9f9c2060a4c2
--- /dev/null
+++ b/LayoutTests/fast/webgpu/index-buffer-cache-invalidation-expected.txt
@@ -0,0 +1,2 @@
+PASS - no GPU OOB read
+
diff --git a/LayoutTests/fast/webgpu/index-buffer-cache-invalidation.html b/LayoutTests/fast/webgpu/index-buffer-cache-invalidation.html
new file mode 100644
index 000000000000..d0793b422caf
--- /dev/null
+++ b/LayoutTests/fast/webgpu/index-buffer-cache-invalidation.html
@@ -0,0 +1,93 @@
+<script>
+if (window.testRunner) { testRunner.waitUntilDone(); testRunner.dumpAsText() }
+onload = async () => {
+    const output = document.getElementById('output');
+    function log(msg) { output.textContent += msg + '\n'; }
+
+    try {
+        const adapter = await navigator.gpu.requestAdapter();
+        if (!adapter) { log('No adapter'); if (window.testRunner) testRunner.notifyDone(); return; }
+        const device = await adapter.requestDevice();
+
+        // Create a vertex buffer with 256 float32x4 vertices (4096 bytes).
+        const vertexBuffer = device.createBuffer({ size: 4096, usage: GPUBufferUsage.VERTEX });
+
+        // Create a uint32 index buffer with 2 indices.
+        const indexBuffer = device.createBuffer({ size: 8, usage: GPUBufferUsage.INDEX | GPUBufferUsage.COPY_DST });
+
+        // Create a 4x4 render target.
+        const renderTarget = device.createTexture({
+            size: [4, 4], format: 'rgba8unorm',
+            usage: GPUTextureUsage.RENDER_ATTACHMENT,
+        });
+
+        const shaderModule = device.createShaderModule({ code: `
+            @vertex fn vs(@location(0) pos: vec4f) -> @builtin(position) vec4f { return pos; }
+            @fragment fn fs() -> @location(0) vec4f { return vec4f(1.0); }
+        `});
+        const pipeline = device.createRenderPipeline({
+            layout: 'auto',
+            vertex: {
+                module: shaderModule,
+                buffers: [{
+                    arrayStride: 16,
+                    attributes: [{ shaderLocation: 0, offset: 0, format: 'float32x4' }],
+                }],
+            },
+            fragment: { module: shaderModule, targets: [{ format: 'rgba8unorm' }] },
+        });
+
+        // Step 1: Prime with a large index to set the high-water mark.
+        device.queue.writeBuffer(indexBuffer, 0, new Uint32Array([0xFFFFFFFE, 0]));
+
+        // Step 2: Overwrite with safe indices.
+        device.queue.writeBuffer(indexBuffer, 0, new Uint32Array([5, 0]));
+
+        // Step 3: Draw to populate the validation cache.
+        {
+            const encoder = device.createCommandEncoder();
+            const pass = encoder.beginRenderPass({
+                colorAttachments: [{
+                    view: renderTarget.createView(),
+                    loadOp: 'clear', storeOp: 'store',
+                }],
+            });
+            pass.setPipeline(pipeline);
+            pass.setVertexBuffer(0, vertexBuffer);
+            pass.setIndexBuffer(indexBuffer, 'uint32');
+            pass.drawIndexed(2, 1, 0, 0, 0);
+            pass.end();
+            device.queue.submit([encoder.finish()]);
+        }
+
+        // Step 4: Write the large index again. Cache MUST be invalidated.
+        device.queue.writeBuffer(indexBuffer, 0, new Uint32Array([0xFFFFFFFE, 0]));
+
+        // Step 5: Draw again. If the cache was not invalidated, this produces
+        // an OOB GPU vertex fetch. With the fix, the clamp shader re-validates
+        // and zeroes the draw.
+        {
+            const encoder = device.createCommandEncoder();
+            const pass = encoder.beginRenderPass({
+                colorAttachments: [{
+                    view: renderTarget.createView(),
+                    loadOp: 'clear', storeOp: 'store',
+                }],
+            });
+            pass.setPipeline(pipeline);
+            pass.setVertexBuffer(0, vertexBuffer);
+            pass.setIndexBuffer(indexBuffer, 'uint32');
+            pass.drawIndexed(2, 1, 0, 0, 0);
+            pass.end();
+            device.queue.submit([encoder.finish()]);
+        }
+
+        await device.queue.onSubmittedWorkDone();
+        log('PASS - no GPU OOB read');
+    } catch (e) {
+        log('FAIL - ' + e);
+    }
+    if (window.testRunner) testRunner.notifyDone();
+};
+</script>
+<pre id="output"></pre>
diff --git a/LayoutTests/http/tests/images/ico-png-subimage-partial-load-crash-expected.txt b/LayoutTests/http/tests/images/ico-png-subimage-partial-load-crash-expected.txt
new file mode 100644
index 000000000000..2085c15f7edf
--- /dev/null
+++ b/LayoutTests/http/tests/images/ico-png-subimage-partial-load-crash-expected.txt
@@ -0,0 +1,3 @@
+An ICO whose PNG sub-image has only partly arrived must not be asked for a frame buffer before the sub-decoder has parsed its own header. The test passes unless a crash happens.
+
+
diff --git a/LayoutTests/http/tests/images/ico-png-subimage-partial-load-crash.html b/LayoutTests/http/tests/images/ico-png-subimage-partial-load-crash.html
new file mode 100644
index 000000000000..8c53d6076491
--- /dev/null
+++ b/LayoutTests/http/tests/images/ico-png-subimage-partial-load-crash.html
@@ -0,0 +1,38 @@
+<!DOCTYPE html>
+<p>An ICO whose PNG sub-image has only partly arrived must not be asked for a frame buffer before
+the sub-decoder has parsed its own header. The test passes unless a crash happens.</p>
+<img id="image" style="background-color: blue">
+<script>
+if (window.testRunner) {
+    testRunner.dumpAsText();
+    testRunner.waitUntilDone();
+}
+
+function decodeRound()
+{
+    // Drawing an incomplete image is a no-op, so ask the decoder for the frame directly.
+    if (window.internals)
+        internals.forceDecodeImageFrameAtIndex(document.getElementById("image"), 0);
+}
+
+function testDone()
+{
+    if (window.testRunner)
+        testRunner.notifyDone();
+}
+
+function runTest()
+{
+    // Stall inside the embedded PNG: past the icon directory and the PNG signature, but before
+    // the sub-decoder has enough of the IHDR to publish a size.
+    document.getElementById("image").src = "http://127.0.0.1:8000/resources/load-and-stall.py"
+        + "?name=../images/resources/ico-png-subimage.ico"
+        + "&mimeType=image%2Fvnd.microsoft.icon&stallAt=30&stallFor=60";
+
+    for (var i = 1; i <= 8; ++i)
+        setTimeout(decodeRound, i * 60);
+    setTimeout(testDone, 600);
+}
+
+setTimeout(runTest, 0);
+</script>
diff --git a/LayoutTests/http/tests/images/resources/ico-png-subimage.ico b/LayoutTests/http/tests/images/resources/ico-png-subimage.ico
new file mode 100644
index 000000000000..ace422424d9b
Binary files /dev/null and b/LayoutTests/http/tests/images/resources/ico-png-subimage.ico differ
diff --git a/LayoutTests/imported/w3c/resources/resource-files.json b/LayoutTests/imported/w3c/resources/resource-files.json
index 92e97d0cd3a5..de0958ad2ab8 100644
--- a/LayoutTests/imported/w3c/resources/resource-files.json
+++ b/LayoutTests/imported/w3c/resources/resource-files.json
@@ -7231,6 +7231,8 @@
         "web-platform-tests/css/css-nesting/nesting-basic-ref.html",
         "web-platform-tests/css/css-nesting/supports-is-consistent-ref.html",
         "web-platform-tests/css/css-nesting/supports-rule-ref.html",
+        "web-platform-tests/css/css-overflow/abspos-shrink-to-fit-with-scrollable-descendant-ref.html",
+        "web-platform-tests/css/css-overflow/button-with-scrollable-descendant-ref.html",
         "web-platform-tests/css/css-overflow/clip-001-ref.html",
         "web-platform-tests/css/css-overflow/clip-002-ref.html",
         "web-platform-tests/css/css-overflow/clip-003-ref.html",
@@ -7239,12 +7241,24 @@
         "web-platform-tests/css/css-overflow/clipped-scroller-add-content-ref.html",
         "web-platform-tests/css/css-overflow/display-flex-svg-overflow-default-ref.html",
         "web-platform-tests/css/css-overflow/document-element-overflow-hidden-scroll-ref.html",
+        "web-platform-tests/css/css-overflow/dynamic-visible-to-clip-002-ref.html",
+        "web-platform-tests/css/css-overflow/fit-content-textarea-with-scrollbar-ref.html",
+        "web-platform-tests/css/css-overflow/flex-column-container-with-scrollable-descendant-ref.html",
+        "web-platform-tests/css/css-overflow/flex-container-multiple-items-with-scrollable-descendant-ref.html",
+        "web-platform-tests/css/css-overflow/flex-container-with-scrollable-descendant-ref.html",
+        "web-platform-tests/css/css-overflow/flex-nested-container-with-scrollable-descendant-ref.html",
+        "web-platform-tests/css/css-overflow/float-with-scrollable-descendant-ref.html",
+        "web-platform-tests/css/css-overflow/grid-container-with-scrollable-descendant-ref.html",
+        "web-platform-tests/css/css-overflow/grid-nested-container-with-scrollable-descendant-ref.html",
         "web-platform-tests/css/css-overflow/incremental-scroll-002-ref.html",
         "web-platform-tests/css/css-overflow/incremental-scroll-ref.html",
+        "web-platform-tests/css/css-overflow/inline-block-with-scrollable-descendant-ref.html",
+        "web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-crash-001.html",
         "web-platform-tests/css/css-overflow/line-clamp/discard/reference/discard-multicol-001-ref.html",
         "web-platform-tests/css/css-overflow/line-clamp/discard/reference/discard-multicol-002-ref.html",
         "web-platform-tests/css/css-overflow/line-clamp/discard/reference/discard-multicol-003-ref.html",
         "web-platform-tests/css/css-overflow/line-clamp/discard/reference/discard-multicol-004-ref.html",
+        "web-platform-tests/css/css-overflow/line-clamp/line-clamp-bfc-ref.html",
         "web-platform-tests/css/css-overflow/line-clamp/line-clamp-content-height-with-dynamic-change-ref.html",
         "web-platform-tests/css/css-overflow/line-clamp/reference/block-ellipsis-001-ref.html",
         "web-platform-tests/css/css-overflow/line-clamp/reference/block-ellipsis-002-ref.html",
@@ -7268,6 +7282,14 @@
         "web-platform-tests/css/css-overflow/line-clamp/reference/block-ellipsis-029-ref.html",
         "web-platform-tests/css/css-overflow/line-clamp/reference/block-ellipsis-031-ref.html",
         "web-platform-tests/css/css-overflow/line-clamp/reference/block-ellipsis-032-ref.html",
+        "web-platform-tests/css/css-overflow/line-clamp/reference/block-ellipsis-034-ref.html",
+        "web-platform-tests/css/css-overflow/line-clamp/reference/block-ellipsis-035-ref.html",
+        "web-platform-tests/css/css-overflow/line-clamp/reference/block-ellipsis-038-ref.html",
+        "web-platform-tests/css/css-overflow/line-clamp/reference/block-ellipsis-039-ref.html",
+        "web-platform-tests/css/css-overflow/line-clamp/reference/block-ellipsis-041-ref.html",
+        "web-platform-tests/css/css-overflow/line-clamp/reference/block-ellipsis-bidi-002-ref.html",
+        "web-platform-tests/css/css-overflow/line-clamp/reference/block-ellipsis-bidi-003-ref.html",
+        "web-platform-tests/css/css-overflow/line-clamp/reference/block-ellipsis-bidi-004-ref.html",
         "web-platform-tests/css/css-overflow/line-clamp/reference/block-ellipsis-repaint-001-ref.html",
         "web-platform-tests/css/css-overflow/line-clamp/reference/block-ellipsis-repaint-002-ref.html",
         "web-platform-tests/css/css-overflow/line-clamp/reference/block-ellipsis-repaint-003-ref.html",
@@ -7285,6 +7307,8 @@
         "web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-027-ref.html",
         "web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-028-ref.html",
         "web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-029-ref.html",
+        "web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-039-ref.html",
+        "web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-041-ref.html",
         "web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-auto-002-ref.html",
         "web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-auto-005-ref.html",
         "web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-auto-011-ref.html",
@@ -7307,6 +7331,11 @@
         "web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-auto-039-ref.html",
         "web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-auto-040-ref.html",
         "web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-auto-041-ref.html",
+        "web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-auto-043-ref.html",
+        "web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-auto-044-ref.html",
+        "web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-auto-045-ref.html",
+        "web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-auto-046-ref.html",
+        "web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-auto-047-ref.html",
         "web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-auto-with-ruby-001-ref.html",
         "web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-auto-with-ruby-003-ref.html",
         "web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-auto-with-ruby-005-ref.html",
@@ -7330,9 +7359,7 @@
         "web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-with-abspos-023-ref.html",
         "web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-with-floats-001-ref.html",
         "web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-with-floats-005-ref.html",
-        "web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-with-floats-006-ref.html",
         "web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-with-floats-007-ref.html",
-        "web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-with-floats-008-ref.html",
         "web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-with-floats-010-ref.html",
         "web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-with-text-overflow-string-003-ref.html",
         "web-platform-tests/css/css-overflow/line-clamp/reference/webkit-line-clamp-001-ref.html",
@@ -7380,6 +7407,14 @@
         "web-platform-tests/css/css-overflow/line-clamp/reference/webkit-line-clamp-block-in-inline-001-ref.html",
         "web-platform-tests/css/css-overflow/line-clamp/reference/webkit-line-clamp-dynamic-001-ref.html",
         "web-platform-tests/css/css-overflow/line-clamp/reference/webkit-line-clamp-with-line-height-ref.html",
+        "web-platform-tests/css/css-overflow/max-content-nested-textarea-with-scrollbar-ref.html",
+        "web-platform-tests/css/css-overflow/max-content-textarea-with-scrollbar-ref.html",
+        "web-platform-tests/css/css-overflow/max-content-with-float-scrollable-descendant-ref.html",
+        "web-platform-tests/css/css-overflow/max-content-with-multiple-scrollable-descendants-ref.html",
+        "web-platform-tests/css/css-overflow/max-width-container-with-scrollable-descendant-ref.html",
+        "web-platform-tests/css/css-overflow/max-width-container-with-scrollable-descendant-vertical-rl-ref.html",
+        "web-platform-tests/css/css-overflow/min-content-textarea-with-scrollbar-ref.html",
+        "web-platform-tests/css/css-overflow/orthogonal-writing-mode-with-scrollable-descendant-ref.html",
         "web-platform-tests/css/css-overflow/overflow-alignment-001-ref.html",
         "web-platform-tests/css/css-overflow/overflow-alignment-002-ref.html",
         "web-platform-tests/css/css-overflow/overflow-alignment-block-001.html",
@@ -7439,6 +7474,7 @@
         "web-platform-tests/css/css-overflow/overflow-clip-transform-001-ref.html",
         "web-platform-tests/css/css-overflow/overflow-clip-x-visible-y-svg-ref.html",
         "web-platform-tests/css/css-overflow/overflow-clip-y-visible-x-svg-ref.html",
+        "web-platform-tests/css/css-overflow/overflow-clipped-transparent-border-clip-ref.html",
         "web-platform-tests/css/css-overflow/overflow-img-display-table-ref.html",
         "web-platform-tests/css/css-overflow/overflow-img-object-position-ref.html",
         "web-platform-tests/css/css-overflow/overflow-img-ref.html",
@@ -7452,6 +7488,7 @@
         "web-platform-tests/css/css-overflow/overflow-scroll-resize-visibility-hidden-ref.html",
         "web-platform-tests/css/css-overflow/overflow-video-ref.html",
         "web-platform-tests/css/css-overflow/paint-containment-svg-ref.html",
+        "web-platform-tests/css/css-overflow/reference/before-after-pseudo-element-scrolling-ref.html",
         "web-platform-tests/css/css-overflow/reference/input-scrollable-region-001-ref.html",
         "web-platform-tests/css/css-overflow/reference/overflow-body-no-propagation-ref.html",
         "web-platform-tests/css/css-overflow/reference/overflow-body-propagation-ref.html",
@@ -7459,15 +7496,53 @@
         "web-platform-tests/css/css-overflow/reference/overflow-inline-block-with-opacity-ref.html",
         "web-platform-tests/css/css-overflow/reference/overflow-recalc-001-ref.html",
         "web-platform-tests/css/css-overflow/reference/ref-if-there-is-no-red.xht",
+        "web-platform-tests/css/css-overflow/reference/text-overflow-001-ref.html",
+        "web-platform-tests/css/css-overflow/reference/text-overflow-002-ref.html",
+        "web-platform-tests/css/css-overflow/reference/text-overflow-005-ref.html",
+        "web-platform-tests/css/css-overflow/reference/text-overflow-006-ref.html",
+        "web-platform-tests/css/css-overflow/reference/text-overflow-008-ref.html",
+        "web-platform-tests/css/css-overflow/reference/text-overflow-012-ref.html",
+        "web-platform-tests/css/css-overflow/reference/text-overflow-013-ref.html",
+        "web-platform-tests/css/css-overflow/reference/text-overflow-016-ref.html",
+        "web-platform-tests/css/css-overflow/reference/text-overflow-021-ref.html",
+        "web-platform-tests/css/css-overflow/reference/text-overflow-022-ref.html",
+        "web-platform-tests/css/css-overflow/reference/text-overflow-027-ref.html",
+        "web-platform-tests/css/css-overflow/reference/text-overflow-028-ref.html",
+        "web-platform-tests/css/css-overflow/reference/text-overflow-029-ref.html",
+        "web-platform-tests/css/css-overflow/reference/text-overflow-030-ref.html",
+        "web-platform-tests/css/css-overflow/reference/text-overflow-change-color-ref.html",
         "web-platform-tests/css/css-overflow/reference/text-overflow-ellipsis-001-ref.html",
         "web-platform-tests/css/css-overflow/reference/text-overflow-ellipsis-002-ref.html",
+        "web-platform-tests/css/css-overflow/reference/text-overflow-ellipsis-editable-div-with-caret-ref.html",
+        "web-platform-tests/css/css-overflow/reference/text-overflow-ellipsis-indent-001-ref.html",
+        "web-platform-tests/css/css-overflow/reference/text-overflow-ellipsis-multiline-001-ref.html",
         "web-platform-tests/css/css-overflow/reference/text-overflow-ellipsis-rtl-001-ref.html",
+        "web-platform-tests/css/css-overflow/reference/text-overflow-ellipsis-textarea-with-caret-ref.html",
         "web-platform-tests/css/css-overflow/reference/text-overflow-ellipsis-vertical-001-ref.html",
         "web-platform-tests/css/css-overflow/reference/text-overflow-ellipsis-vertical-rtl-001-ref.html",
         "web-platform-tests/css/css-overflow/reference/text-overflow-scroll-001-ref.html",
         "web-platform-tests/css/css-overflow/reference/text-overflow-scroll-rtl-001-ref.html",
         "web-platform-tests/css/css-overflow/reference/text-overflow-scroll-vertical-lr-001-ref.html",
         "web-platform-tests/css/css-overflow/reference/text-overflow-scroll-vertical-lr-rtl-001-ref.html",
+        "web-platform-tests/css/css-overflow/reference/text-overflow-string-001-ref.html",
+        "web-platform-tests/css/css-overflow/reference/text-overflow-string-002-ref.html",
+        "web-platform-tests/css/css-overflow/reference/text-overflow-string-003-ref.html",
+        "web-platform-tests/css/css-overflow/reference/text-overflow-string-004-ref.html",
+        "web-platform-tests/css/css-overflow/reference/text-overflow-string-005-ref.html",
+        "web-platform-tests/css/css-overflow/reference/text-overflow-string-006-ref.html",
+        "web-platform-tests/css/css-overflow/reference/text-overflow-string-007-ref.html",
+        "web-platform-tests/css/css-overflow/reference/text-overflow-string-008-ref.html",
+        "web-platform-tests/css/css-overflow/reference/text-overflow-string-009-ref.html",
+        "web-platform-tests/css/css-overflow/reference/text-overflow-string-010-ref.html",
+        "web-platform-tests/css/css-overflow/reference/text-overflow-string-011-ref.html",
+        "web-platform-tests/css/css-overflow/reference/text-overflow-string-012-ref.html",
+        "web-platform-tests/css/css-overflow/reference/text-overflow-string-013-ref.html",
+        "web-platform-tests/css/css-overflow/reference/text-overflow-string-014-ref.html",
+        "web-platform-tests/css/css-overflow/reference/text-overflow-string-015-ref.html",
+        "web-platform-tests/css/css-overflow/reference/text-overflow-string-016-ref.html",
+        "web-platform-tests/css/css-overflow/reference/text-overflow-string-024-ref.tentative.html",
+        "web-platform-tests/css/css-overflow/reference/text-overflow-string-025-ref.tentative.html",
+        "web-platform-tests/css/css-overflow/reference/text-overflow-string-026-ref.tentative.html",
         "web-platform-tests/css/css-overflow/rounded-overflow-clip-visible-ref.html",
         "web-platform-tests/css/css-overflow/rounded-overflow-visible-clip-ref.html",
         "web-platform-tests/css/css-overflow/scroll-markers/column-scroll-marker-001-ref.html",
@@ -7480,6 +7555,7 @@
         "web-platform-tests/css/css-overflow/scroll-markers/root-scroll-button-ref.html",
         "web-platform-tests/css/css-overflow/scroll-markers/root-scroll-marker-ref.html",
         "web-platform-tests/css/css-overflow/scroll-markers/scroll-button-on-object-ref.html",
+        "web-platform-tests/css/css-overflow/scroll-markers/scroll-button-reattachment-position-ref.html",
         "web-platform-tests/css/css-overflow/scroll-markers/scroll-buttons-001-ref.html",
         "web-platform-tests/css/css-overflow/scroll-markers/scroll-buttons-appearance-ref.html",
         "web-platform-tests/css/css-overflow/scroll-markers/scroll-buttons-disabled-ref.html",
@@ -7544,8 +7620,19 @@
         "web-platform-tests/css/css-overflow/scrollbar-large-scale-in-iframe-ref.html",
         "web-platform-tests/css/css-overflow/scrollbars-chrome-bug-001-ref.html",
         "web-platform-tests/css/css-overflow/select-size-overflow-001-ref.html",
+        "web-platform-tests/css/css-overflow/single-axis-overflow-clip-rtl-ref.html",
+        "web-platform-tests/css/css-overflow/single-axis-overflow-scroll-to-clip-ref.html",
+        "web-platform-tests/css/css-overflow/table-max-content-with-scrollable-descendant-ref.html",
+        "web-platform-tests/css/css-overflow/text-overflow-024-ref.html",
+        "web-platform-tests/css/css-overflow/text-overflow-025-ref.html",
+        "web-platform-tests/css/css-overflow/text-overflow-026-ref.html",
         "web-platform-tests/css/css-overflow/text-overflow-ellipsis-003-ref.html",
+        "web-platform-tests/css/css-overflow/text-overflow-ellipsis-changing-scroll-ref.html",
         "web-platform-tests/css/css-overflow/text-overflow-ellipsis-editing-input-ref.html",
+        "web-platform-tests/css/css-overflow/text-overflow-ref.html",
+        "web-platform-tests/css/css-overflow/text-overflow-ruby-ref.html",
+        "web-platform-tests/css/css-overflow/text-overflow-string-in-input-notref.html",
+        "web-platform-tests/css/css-overflow/text-overflow-with-selection-ref.html",
         "web-platform-tests/css/css-position/absolute-pos-box-inside-fixed-pos-box-with-changing-height-ref.html",
         "web-platform-tests/css/css-position/backdrop-inherit-rendered-ref.html",
         "web-platform-tests/css/css-position/block-axis-constraint-changes-for-out-of-flow-box-ref.html",
@@ -8406,7 +8493,13 @@
         "web-platform-tests/css/css-text-decor/reference/text-decoration-inset-023-ref.html",
         "web-platform-tests/css/css-text-decor/reference/text-decoration-inset-024-ref.html",
         "web-platform-tests/css/css-text-decor/reference/text-decoration-inset-025-ref.html",
+        "web-platform-tests/css/css-text-decor/reference/text-decoration-inset-026-ref.html",
+        "web-platform-tests/css/css-text-decor/reference/text-decoration-inset-027-ref.html",
+        "web-platform-tests/css/css-text-decor/reference/text-decoration-inset-028-ref.html",
+        "web-platform-tests/css/css-text-decor/reference/text-decoration-inset-029-ref.html",
         "web-platform-tests/css/css-text-decor/reference/text-decoration-inset-orthogonal-block-001-ref.html",
+        "web-platform-tests/css/css-text-decor/reference/text-decoration-inset-percentage-slice-multiline-ref.html",
+        "web-platform-tests/css/css-text-decor/reference/text-decoration-inset-percentage-slice-ref.html",
         "web-platform-tests/css/css-text-decor/reference/text-decoration-line-010-ref.xht",
         "web-platform-tests/css/css-text-decor/reference/text-decoration-line-011-ref.xht",
         "web-platform-tests/css/css-text-decor/reference/text-decoration-line-012-ref.xht",
@@ -10034,31 +10127,6 @@
         "web-platform-tests/css/css-ui/reference/outline-style-014-ref.html",
         "web-platform-tests/css/css-ui/reference/outline-with-padding-001-ref.html",
         "web-platform-tests/css/css-ui/reference/subpixel-outline-width-ref.tentative.html",
-        "web-platform-tests/css/css-ui/reference/text-overflow-001-ref.html",
-        "web-platform-tests/css/css-ui/reference/text-overflow-002-ref.html",
-        "web-platform-tests/css/css-ui/reference/text-overflow-005-ref.html",
-        "web-platform-tests/css/css-ui/reference/text-overflow-006-ref.html",
-        "web-platform-tests/css/css-ui/reference/text-overflow-008-ref.html",
-        "web-platform-tests/css/css-ui/reference/text-overflow-012-ref.html",
-        "web-platform-tests/css/css-ui/reference/text-overflow-013-ref.html",
-        "web-platform-tests/css/css-ui/reference/text-overflow-016-ref.html",
-        "web-platform-tests/css/css-ui/reference/text-overflow-021-ref.html",
-        "web-platform-tests/css/css-ui/reference/text-overflow-022-ref.html",
-        "web-platform-tests/css/css-ui/reference/text-overflow-027-ref.html",
-        "web-platform-tests/css/css-ui/reference/text-overflow-028-ref.html",
-        "web-platform-tests/css/css-ui/reference/text-overflow-029-ref.html",
-        "web-platform-tests/css/css-ui/reference/text-overflow-030-ref.html",
-        "web-platform-tests/css/css-ui/reference/text-overflow-change-color-ref.html",
-        "web-platform-tests/css/css-ui/reference/text-overflow-ellipsis-indent-001-ref.html",
-        "web-platform-tests/css/css-ui/reference/text-overflow-ellipsis-multiline-001-ref.html",
-        "web-platform-tests/css/css-ui/reference/text-overflow-string-001-ref.html",
-        "web-platform-tests/css/css-ui/reference/text-overflow-string-002-ref.html",
-        "web-platform-tests/css/css-ui/reference/text-overflow-string-003-ref.html",
-        "web-platform-tests/css/css-ui/reference/text-overflow-string-004-ref.html",
-        "web-platform-tests/css/css-ui/reference/text-overflow-string-005-ref.html",
-        "web-platform-tests/css/css-ui/reference/text-overflow-string-006-ref.html",
-        "web-platform-tests/css/css-ui/reference/text-overflow-string-007-ref.html",
-        "web-platform-tests/css/css-ui/reference/text-overflow-string-008-ref.html",
         "web-platform-tests/css/css-ui/reference/transparent-accent-color-001-ref.html",
         "web-platform-tests/css/css-ui/reference/transparent-accent-color-002-ref.html",
         "web-platform-tests/css/css-ui/resize-change-margin-ref.html",
@@ -10098,12 +10166,6 @@
         "web-platform-tests/css/css-ui/support/w100.svg",
         "web-platform-tests/css/css-ui/support/w100_h100.svg",
         "web-platform-tests/css/css-ui/support/w100_r1-1.svg",
-        "web-platform-tests/css/css-ui/text-overflow-024-ref.html",
-        "web-platform-tests/css/css-ui/text-overflow-025-ref.html",
-        "web-platform-tests/css/css-ui/text-overflow-026-ref.html",
-        "web-platform-tests/css/css-ui/text-overflow-ref.html",
-        "web-platform-tests/css/css-ui/text-overflow-ruby-ref.html",
-        "web-platform-tests/css/css-ui/text-overflow-with-selection-ref.html",
         "web-platform-tests/css/css-ui/translucent-outline-ref.html",
         "web-platform-tests/css/css-ui/widget-percentage-height-001-ref.html",
         "web-platform-tests/css/css-values/attr-in-slotted-ref.html",
diff --git a/LayoutTests/imported/w3c/web-platform-tests/cookies/attributes/expires-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/cookies/attributes/expires-expected.txt
index 575b6d486326..66403af11479 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/cookies/attributes/expires-expected.txt
+++ b/LayoutTests/imported/w3c/web-platform-tests/cookies/attributes/expires-expected.txt
@@ -4,9 +4,22 @@ PASS Set cookie with expires value followed by comma via HTTP headers
 PASS Set cookie with future expiration via HTTP headers
 PASS Set expired cookie along with valid cookie via HTTP headers
 PASS Don't set cookie with expires set to the past via HTTP headers
+PASS Set cookie with the month before the day of the month in expires via HTTP headers
+FAIL Don't set cookie with the month before the day of the month in an expires in the past via HTTP headers assert_equals: The cookie was rejected. expected "" but got "test=7"
+FAIL Don't set cookie with no day name and the month before the day of the month in an expires in the past via HTTP headers assert_equals: The cookie was rejected. expected "" but got "test=8"
+FAIL Don't set cookie with an expires in the past in Date.prototype.toString() format via HTTP headers assert_equals: The cookie was rejected. expected "" but got "test=9"
+PASS Set cookie whose Max-Age overrides an expires in the past via HTTP headers
+PASS Set cookie with an asctime format expires, whose time precedes the year via HTTP headers
 PASS Set cookie with expires value containing a comma via document.cookie
 PASS Set cookie with expires value followed by comma via document.cookie
 PASS Set cookie with future expiration via document.cookie
 PASS Set expired cookie along with valid cookie via document.cookie
 PASS Don't set cookie with expires set to the past via document.cookie
+PASS Set cookie with the month before the day of the month in expires via document.cookie
+PASS Don't set cookie with the month before the day of the month in an expires in the past via document.cookie
+PASS Don't set cookie with no day name and the month before the day of the month in an expires in the past via document.cookie
+PASS Don't set cookie with an expires in the past in Date.prototype.toString() format via document.cookie
+PASS Set cookie whose Max-Age overrides an expires in the past via document.cookie
+PASS Set cookie with an asctime format expires, whose time precedes the year via document.cookie
+PASS Don't set cookie with an expires in the past and a non-ASCII timezone comment via document.cookie
 
diff --git a/LayoutTests/imported/w3c/web-platform-tests/cookies/attributes/expires.html b/LayoutTests/imported/w3c/web-platform-tests/cookies/attributes/expires.html
index a6bacfd74e97..28a59482b93c 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/cookies/attributes/expires.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/cookies/attributes/expires.html
@@ -40,6 +40,49 @@
           expected: "",
           name: "Don't set cookie with expires set to the past",
         },
+        // RFC 6265 section 5.1.1 finds the day of the month, the month and the year by matching each
+        // date token independently, so either ordering parses: "10 Apr 1980" and "Apr 10 1980" are
+        // both valid and denote the same date. Month-first is what JavaScript's
+        // Date.prototype.toString() produces, and sites pass that to document.cookie in place of
+        // toUTCString(), so interoperability here is important.
+        //
+        // Note that only the past-expiration cases below actually distinguish a conforming
+        // implementation: if the Expires attribute is ignored, the cookie is stored as a session
+        // cookie and is therefore still present, so a future expiration looks identical either way.
+        {
+          cookie: "test=6; Expires=Fri Jan 01 2038 00:00:00 GMT",
+          expected: "test=6",
+          name: "Set cookie with the month before the day of the month in expires",
+        },
+        {
+          cookie: "test=7; Expires=Thu Apr 10 1980 16:33:12 GMT",
+          expected: "",
+          name: "Don't set cookie with the month before the day of the month in an expires in the past",
+        },
+        {
+          cookie: "test=8; Expires=Apr 10 1980 16:33:12 GMT",
+          expected: "",
+          name: "Don't set cookie with no day name and the month before the day of the month in an expires in the past",
+        },
+        {
+          cookie: "test=9; Expires=Thu Apr 10 1980 16:33:12 GMT-0700 (Pacific Daylight Time)",
+          expected: "",
+          name: "Don't set cookie with an expires in the past in Date.prototype.toString() format",
+        },
+        {
+          cookie: "test=10; Expires=Thu Apr 10 1980 16:33:12 GMT; Max-Age=1000",
+          expected: "test=10",
+          name: "Set cookie whose Max-Age overrides an expires in the past",
+        },
+        // The asctime form is also month-first, but it puts the time where Date.prototype.toString()
+        // puts the year: "Thu Apr 10 16:33:12 1980". It must not be reordered as though the token
+        // after the day of the month were a year, because "Fri 01 Jan 03:14:07 2038" denotes a date in
+        // the past, which would drop the cookie instead of storing it.
+        {
+          cookie: "test=12; Expires=Fri Jan 01 03:14:07 2038",
+          expected: "test=12",
+          name: "Set cookie with an asctime format expires, whose time precedes the year",
+        },
       ];
 
       // These tests evaluate setting cookies with expiration via HTTP headers.
@@ -51,6 +94,15 @@
       for (const test of expiresTests) {
         domCookieTest(test.cookie, test.expected, test.name + " via document.cookie");
       }
+
+      // A timezone name is localized, so it can be non-ASCII. Date.prototype.toString() only reaches
+      // a cookie through script, and sending non-ASCII in a response header would exercise header
+      // encoding at the same time, so this case covers document.cookie only. Same date as test=9,
+      // written with escapes to keep this file ASCII-only.
+      domCookieTest(
+        "test=11; Expires=Thu Apr 10 1980 16:33:12 GMT-0700 (\u0398\u03b5\u03c1\u03b9\u03bd\u03ae \u03ce\u03c1\u03b1 \u0395\u03b9\u03c1\u03b7\u03bd\u03b9\u03ba\u03bf\u03cd)",
+        "",
+        "Don't set cookie with an expires in the past and a non-ASCII timezone comment via document.cookie");
     </script>
   </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-backdrop-filter-overflow.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-backdrop-filter-overflow.html
index 09efdaee8415..837c130a8569 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-backdrop-filter-overflow.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-backdrop-filter-overflow.html
@@ -2,7 +2,7 @@
 <head>
 <link rel="match" href="corner-shape-backdrop-filter-overflow-ref.html">
 <link rel="help" href="https://drafts.csswg.org/css-borders-4/#corner-shaping">
-<meta name="fuzzy" content="maxDifference=0-64;totalPixels=0-360">
+<meta name="fuzzy" content="maxDifference=0-93;totalPixels=0-360">
 <style>
     .target {
         width: 200px;
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-backdrop-filter.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-backdrop-filter.html
index be294645919e..d52369343538 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-backdrop-filter.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-backdrop-filter.html
@@ -2,7 +2,7 @@
 <head>
 <link rel="help" href="https://drafts.csswg.org/css-borders-4/#corner-shaping">
 <link rel="match" href="corner-shape-backdrop-filter-ref.html">
-<meta name="fuzzy" content="maxDifference=0-64;totalPixels=0-360">
+<meta name="fuzzy" content="maxDifference=0-111;totalPixels=0-381">
 <style>
     .target {
         width: 200px;
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-inline/parsing/WEB_FEATURES.yml b/LayoutTests/imported/w3c/web-platform-tests/css/css-inline/parsing/WEB_FEATURES.yml
new file mode 100644
index 000000000000..a6571f3187dd
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-inline/parsing/WEB_FEATURES.yml
@@ -0,0 +1,6 @@
+rules:
+- alignment-baseline-*: [alignment-baseline]
+- baseline-shift-*: [baseline-shift]
+- dominant-baseline-*: [dominant-baseline]
+- line-height-*: [line-height]
+- vertical-align-*: [vertical-align]
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-inline/parsing/baseline-shift-computed-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/css/css-inline/parsing/baseline-shift-computed-expected.txt
index b962f96ec6e9..1c0b2d568385 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-inline/parsing/baseline-shift-computed-expected.txt
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-inline/parsing/baseline-shift-computed-expected.txt
@@ -4,4 +4,7 @@ PASS Property baseline-shift value '20%'
 PASS Property baseline-shift value 'calc(10px - 0.5em)'
 PASS Property baseline-shift value 'sub'
 PASS Property baseline-shift value 'super'
+FAIL Property baseline-shift value 'bottom' assert_true: 'bottom' is a supported value for baseline-shift. expected true got false
+FAIL Property baseline-shift value 'center' assert_true: 'center' is a supported value for baseline-shift. expected true got false
+FAIL Property baseline-shift value 'top' assert_true: 'top' is a supported value for baseline-shift. expected true got false
 
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-inline/parsing/baseline-shift-computed.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-inline/parsing/baseline-shift-computed.html
index 3bef5bae3b95..b15265a757ea 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-inline/parsing/baseline-shift-computed.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-inline/parsing/baseline-shift-computed.html
@@ -23,6 +23,9 @@
 
 test_computed_value("baseline-shift", "sub");
 test_computed_value("baseline-shift", "super");
+test_computed_value("baseline-shift", "bottom");
+test_computed_value("baseline-shift", "center");
+test_computed_value("baseline-shift", "top");
 </script>
 </body>
 </html>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-inline/parsing/baseline-shift-valid-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/css/css-inline/parsing/baseline-shift-valid-expected.txt
index 0ecb0c2d9560..57e7998a62f2 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-inline/parsing/baseline-shift-valid-expected.txt
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-inline/parsing/baseline-shift-valid-expected.txt
@@ -5,4 +5,7 @@ PASS e.style['baseline-shift'] = "calc(2em + 3ex)" should set the property value
 PASS e.style['baseline-shift'] = "0" should set the property value
 PASS e.style['baseline-shift'] = "sub" should set the property value
 PASS e.style['baseline-shift'] = "super" should set the property value
+FAIL e.style['baseline-shift'] = "bottom" should set the property value assert_not_equals: property should be set got disallowed value ""
+FAIL e.style['baseline-shift'] = "center" should set the property value assert_not_equals: property should be set got disallowed value ""
+FAIL e.style['baseline-shift'] = "top" should set the property value assert_not_equals: property should be set got disallowed value ""
 
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-inline/parsing/baseline-shift-valid.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-inline/parsing/baseline-shift-valid.html
index 8054ebbb39cf..da663aa1a40f 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-inline/parsing/baseline-shift-valid.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-inline/parsing/baseline-shift-valid.html
@@ -17,6 +17,9 @@
 test_valid_value("baseline-shift", "0", "0px");
 test_valid_value("baseline-shift", "sub");
 test_valid_value("baseline-shift", "super");
+test_valid_value("baseline-shift", "bottom");
+test_valid_value("baseline-shift", "center");
+test_valid_value("baseline-shift", "top");
 </script>
 </body>
 </html>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-inline/parsing/vertical-align-computed-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/css/css-inline/parsing/vertical-align-computed-expected.txt
index 21a83324d9c2..e1d5272e4bb6 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-inline/parsing/vertical-align-computed-expected.txt
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-inline/parsing/vertical-align-computed-expected.txt
@@ -1,14 +1,25 @@
 
 PASS Property vertical-align value 'baseline'
-PASS Property vertical-align value 'sub'
-PASS Property vertical-align value 'super'
-PASS Property vertical-align value 'top'
-PASS Property vertical-align value 'text-top'
-PASS Property vertical-align value 'middle'
-PASS Property vertical-align value 'bottom'
+FAIL Property vertical-align value '0' assert_equals: expected "baseline" but got "0px"
+FAIL Property vertical-align value '0px' assert_equals: expected "baseline" but got "0px"
+FAIL Property vertical-align value 'baseline 0' assert_true: 'baseline 0' is a supported value for vertical-align. expected true got false
+FAIL Property vertical-align value '0px baseline' assert_true: '0px baseline' is a supported value for vertical-align. expected true got false
+FAIL Property vertical-align value 'first' assert_true: 'first' is a supported value for vertical-align. expected true got false
+FAIL Property vertical-align value 'last' assert_true: 'last' is a supported value for vertical-align. expected true got false
 PASS Property vertical-align value 'text-bottom'
+FAIL Property vertical-align value 'alphabetic' assert_true: 'alphabetic' is a supported value for vertical-align. expected true got false
+FAIL Property vertical-align value 'ideographic' assert_true: 'ideographic' is a supported value for vertical-align. expected true got false
+PASS Property vertical-align value 'middle'
+FAIL Property vertical-align value 'central' assert_true: 'central' is a supported value for vertical-align. expected true got false
+FAIL Property vertical-align value 'mathematical' assert_true: 'mathematical' is a supported value for vertical-align. expected true got false
+PASS Property vertical-align value 'text-top'
 PASS Property vertical-align value '-10px'
 PASS Property vertical-align value '20%'
 PASS Property vertical-align value 'calc(20% + 10px)'
 PASS Property vertical-align value 'calc(10px - 0.5em)'
+PASS Property vertical-align value 'sub'
+PASS Property vertical-align value 'super'
+PASS Property vertical-align value 'top'
+FAIL Property vertical-align value 'center' assert_true: 'center' is a supported value for vertical-align. expected true got false
+PASS Property vertical-align value 'bottom'
 
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-inline/parsing/vertical-align-computed.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-inline/parsing/vertical-align-computed.html
index 24225084721b..61e3288ae237 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-inline/parsing/vertical-align-computed.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-inline/parsing/vertical-align-computed.html
@@ -18,20 +18,36 @@
 <body>
 <div id="target"></div>
 <script>
-test_computed_value("vertical-align", "baseline");
-test_computed_value("vertical-align", "sub");
-test_computed_value("vertical-align", "super");
-test_computed_value("vertical-align", "top");
-test_computed_value("vertical-align", "text-top");
-test_computed_value("vertical-align", "middle");
-test_computed_value("vertical-align", "bottom");
+// Test shorthand values equivalent to the initial `baseline` value
+test_computed_value("vertical-align", "baseline", "baseline");
+test_computed_value("vertical-align", "0", "baseline");
+test_computed_value("vertical-align", "0px", "baseline");
+test_computed_value("vertical-align", "baseline 0", "baseline");
+test_computed_value("vertical-align", "0px baseline", "baseline");
+
+// Test individual non-initial values for `baseline-source`
+test_computed_value("vertical-align", "first");
+test_computed_value("vertical-align", "last");
+
+// Test individual non-initial values for `alignment-baseline`
 test_computed_value("vertical-align", "text-bottom");
+test_computed_value("vertical-align", "alphabetic");
+test_computed_value("vertical-align", "ideographic");
+test_computed_value("vertical-align", "middle");
+test_computed_value("vertical-align", "central");
+test_computed_value("vertical-align", "mathematical");
+test_computed_value("vertical-align", "text-top");
+
+// Test individual non-initial values for `baseline-shift`
 test_computed_value("vertical-align", "-10px");
 test_computed_value("vertical-align", "20%");
 test_computed_value("vertical-align", "calc(20% + 10px)");
 test_computed_value("vertical-align", "calc(10px - 0.5em)", "-10px");
-
-// TODO: Test against the CSS Inline Layout grammar when browsers support it.
+test_computed_value("vertical-align", "sub");
+test_computed_value("vertical-align", "super");
+test_computed_value("vertical-align", "top");
+test_computed_value("vertical-align", "center");
+test_computed_value("vertical-align", "bottom");
 </script>
 </body>
 </html>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-inline/parsing/vertical-align-invalid-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/css/css-inline/parsing/vertical-align-invalid-expected.txt
index ddf4c43a9bed..cef1262d68b7 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-inline/parsing/vertical-align-invalid-expected.txt
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-inline/parsing/vertical-align-invalid-expected.txt
@@ -7,4 +7,5 @@ PASS e.style['vertical-align'] = "super 10px" should not set the property value
 PASS e.style['vertical-align'] = "20% sub" should not set the property value
 PASS e.style['vertical-align'] = "baseline middle" should not set the property value
 PASS e.style['vertical-align'] = "text-top, bottom" should not set the property value
+PASS e.style['vertical-align'] = "auto" should not set the property value
 
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-inline/parsing/vertical-align-invalid.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-inline/parsing/vertical-align-invalid.html
index 0565eb4a68d2..05cceb4af7ac 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-inline/parsing/vertical-align-invalid.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-inline/parsing/vertical-align-invalid.html
@@ -26,6 +26,9 @@
 // Two alignment-baseline values
 test_invalid_value("vertical-align", "baseline middle");
 test_invalid_value("vertical-align", "text-top, bottom");
+
+// Cannot specify `baseline-source: auto` value in shorthand
+test_invalid_value("vertical-align", "auto");
 </script>
 </body>
 </html>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-inline/parsing/vertical-align-valid-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/css/css-inline/parsing/vertical-align-valid-expected.txt
index b43a80243834..fa372006f521 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-inline/parsing/vertical-align-valid-expected.txt
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-inline/parsing/vertical-align-valid-expected.txt
@@ -1,14 +1,32 @@
 
 PASS e.style['vertical-align'] = "baseline" should set the property value
-PASS e.style['vertical-align'] = "sub" should set the property value
-PASS e.style['vertical-align'] = "super" should set the property value
-PASS e.style['vertical-align'] = "top" should set the property value
-PASS e.style['vertical-align'] = "text-top" should set the property value
-PASS e.style['vertical-align'] = "middle" should set the property value
-PASS e.style['vertical-align'] = "bottom" should set the property value
+FAIL e.style['vertical-align'] = "0" should set the property value assert_equals: serialization should be canonical expected "baseline" but got "0px"
+FAIL e.style['vertical-align'] = "0px" should set the property value assert_equals: serialization should be canonical expected "baseline" but got "0px"
+FAIL e.style['vertical-align'] = "baseline 0" should set the property value assert_not_equals: property should be set got disallowed value ""
+FAIL e.style['vertical-align'] = "0px baseline" should set the property value assert_not_equals: property should be set got disallowed value ""
+FAIL e.style['vertical-align'] = "first" should set the property value assert_not_equals: property should be set got disallowed value ""
+FAIL e.style['vertical-align'] = "last" should set the property value assert_not_equals: property should be set got disallowed value ""
 PASS e.style['vertical-align'] = "text-bottom" should set the property value
+FAIL e.style['vertical-align'] = "alphabetic" should set the property value assert_not_equals: property should be set got disallowed value ""
+FAIL e.style['vertical-align'] = "ideographic" should set the property value assert_not_equals: property should be set got disallowed value ""
+PASS e.style['vertical-align'] = "middle" should set the property value
+FAIL e.style['vertical-align'] = "central" should set the property value assert_not_equals: property should be set got disallowed value ""
+FAIL e.style['vertical-align'] = "mathematical" should set the property value assert_not_equals: property should be set got disallowed value ""
+PASS e.style['vertical-align'] = "text-top" should set the property value
 PASS e.style['vertical-align'] = "-10px" should set the property value
+PASS e.style['vertical-align'] = "0.5em" should set the property value
 PASS e.style['vertical-align'] = "20%" should set the property value
-PASS e.style['vertical-align'] = "0" should set the property value
 PASS e.style['vertical-align'] = "calc(20% - 10px)" should set the property value
+PASS e.style['vertical-align'] = "sub" should set the property value
+PASS e.style['vertical-align'] = "super" should set the property value
+PASS e.style['vertical-align'] = "top" should set the property value
+FAIL e.style['vertical-align'] = "center" should set the property value assert_not_equals: property should be set got disallowed value ""
+PASS e.style['vertical-align'] = "bottom" should set the property value
+FAIL e.style['vertical-align'] = "first baseline" should set the property value assert_not_equals: property should be set got disallowed value ""
+FAIL e.style['vertical-align'] = "middle 0" should set the property value assert_not_equals: property should be set got disallowed value ""
+FAIL e.style['vertical-align'] = "baseline super" should set the property value assert_not_equals: property should be set got disallowed value ""
+FAIL e.style['vertical-align'] = "last baseline sub" should set the property value assert_not_equals: property should be set got disallowed value ""
+FAIL e.style['vertical-align'] = "super middle first" should set the property value assert_not_equals: property should be set got disallowed value ""
+FAIL e.style['vertical-align'] = "1em last" should set the property value assert_not_equals: property should be set got disallowed value ""
+FAIL e.style['vertical-align'] = "text-top first 10%" should set the property value assert_not_equals: property should be set got disallowed value ""
 
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-inline/parsing/vertical-align-valid.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-inline/parsing/vertical-align-valid.html
index d51c759dcc5d..d214b405cab3 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-inline/parsing/vertical-align-valid.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-inline/parsing/vertical-align-valid.html
@@ -5,27 +5,54 @@
 <title>CSS Inline Layout: parsing vertical-align with valid values</title>
 <link rel="help" href="https://www.w3.org/TR/CSS2/visudet.html#propdef-vertical-align">
 <link rel="help" href="https://drafts.csswg.org/css-inline/#propdef-vertical-align">
-<meta name="assert" content="vertical-align supports the CSS 2 grammar 'baseline | sub | super | top | text-top | middle | bottom | text-bottom | <percentage> | <length>'.">
+<meta name="assert" content="vertical-align supports the CSS Inline Layout Module Level 3 shorthand syntax.">
 <script src="/resources/testharness.js"></script>
 <script src="/resources/testharnessreport.js"></script>
 <script src="/css/support/parsing-testcommon.js"></script>
 </head>
 <body>
 <script>
-test_valid_value("vertical-align", "baseline");
-test_valid_value("vertical-align", "sub");
-test_valid_value("vertical-align", "super");
-test_valid_value("vertical-align", "top");
-test_valid_value("vertical-align", "text-top");
-test_valid_value("vertical-align", "middle");
-test_valid_value("vertical-align", "bottom");
+// Test shorthand values equivalent to the initial `baseline` value
+test_valid_value("vertical-align", "baseline", "baseline");
+test_valid_value("vertical-align", "0", "baseline");
+test_valid_value("vertical-align", "0px", "baseline");
+test_valid_value("vertical-align", "baseline 0", "baseline");
+test_valid_value("vertical-align", "0px baseline", "baseline");
+
+// Test individual non-initial values for `baseline-source`
+test_valid_value("vertical-align", "first");
+test_valid_value("vertical-align", "last");
+
+// Test individual non-initial values for `alignment-baseline`
 test_valid_value("vertical-align", "text-bottom");
+test_valid_value("vertical-align", "alphabetic");
+test_valid_value("vertical-align", "ideographic");
+test_valid_value("vertical-align", "middle");
+test_valid_value("vertical-align", "central");
+test_valid_value("vertical-align", "mathematical");
+test_valid_value("vertical-align", "text-top");
+
+// Test individual non-initial values for `baseline-shift`
 test_valid_value("vertical-align", "-10px");
+test_valid_value("vertical-align", "0.5em");
 test_valid_value("vertical-align", "20%");
-test_valid_value("vertical-align", "0", "0px");
 test_valid_value("vertical-align", "calc(20% - 10px)");
+test_valid_value("vertical-align", "sub");
+test_valid_value("vertical-align", "super");
+test_valid_value("vertical-align", "top");
+test_valid_value("vertical-align", "center");
+test_valid_value("vertical-align", "bottom");
+
+// Test omissions of initial values for subproperties
+test_valid_value("vertical-align", "first baseline", "first");
+test_valid_value("vertical-align", "middle 0", "middle");
+test_valid_value("vertical-align", "baseline super", "super");
+test_valid_value("vertical-align", "last baseline sub", "last sub");
 
-// TODO: Test against the CSS Inline Layout grammar when browsers support it.
+// Test canonical ordering for subproperties
+test_valid_value("vertical-align", "super middle first", "first middle super");
+test_valid_value("vertical-align", "1em last", "last 1em");
+test_valid_value("vertical-align", "text-top first 10%", "first text-top 10%");
 </script>
 </body>
 </html>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-inline/parsing/w3c-import.log b/LayoutTests/imported/w3c/web-platform-tests/css/css-inline/parsing/w3c-import.log
index e257adcd4ef2..52842df4dde0 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-inline/parsing/w3c-import.log
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-inline/parsing/w3c-import.log
@@ -10,10 +10,9 @@ Do NOT modify or remove this file.
 ------------------------------------------------------------------------
 Properties requiring vendor prefixes:
 None
-Property values requiring vendor prefixes:
-None
 ------------------------------------------------------------------------
 List of files:
+/LayoutTests/imported/w3c/web-platform-tests/css/css-inline/parsing/WEB_FEATURES.yml
 /LayoutTests/imported/w3c/web-platform-tests/css/css-inline/parsing/alignment-baseline-computed.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-inline/parsing/alignment-baseline-invalid.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-inline/parsing/alignment-baseline-valid.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/function-definition-scope-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/function-definition-scope-expected.txt
new file mode 100644
index 000000000000..a8215c9167be
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/function-definition-scope-expected.txt
@@ -0,0 +1,5 @@
+
+PASS Parameter default resolves a dashed-function in the definition scope
+PASS result resolves a dashed-function in the definition scope
+PASS A local resolves a dashed-function in the definition scope
+
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/function-definition-scope.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/function-definition-scope.html
new file mode 100644
index 000000000000..fe496499bade
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/function-definition-scope.html
@@ -0,0 +1,71 @@
+<!DOCTYPE html>
+<title>Custom Functions: parameter defaults resolve names in the definition scope</title>
+<link rel="help" href="https://drafts.csswg.org/css-mixins-1/#evaluate-a-custom-function">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/utils.js"></script>
+
+<style>
+  /* Defined in the outer tree. A <dashed-function> inside these resolves where the
+     function was defined, so it must reach this --scoped() and never the shadow
+     tree's, however the function is called. */
+  @function --scoped() {
+    result: OUTER;
+  }
+  @function --default-calls-scoped(--x: --scoped()) {
+    result: var(--x);
+  }
+  @function --result-calls-scoped() {
+    result: --scoped();
+  }
+  @function --local-calls-scoped() {
+    --local: --scoped();
+    result: var(--local);
+  }
+</style>
+
+<!-- To pass, a test must produce matching computed values for --actual and
+     --expected on the #target inside each shadow root. -->
+
+<div data-name="Parameter default resolves a dashed-function in the definition scope">
+  <template shadowrootmode="open">
+    <style>
+      @function --scoped() { result: SHADOW; }
+      #target {
+        --actual: --default-calls-scoped();
+        --expected: OUTER;
+      }
+    </style>
+    <div id=target></div>
+  </template>
+</div>
+
+<div data-name="result resolves a dashed-function in the definition scope">
+  <template shadowrootmode="open">
+    <style>
+      @function --scoped() { result: SHADOW; }
+      #target {
+        --actual: --result-calls-scoped();
+        --expected: OUTER;
+      }
+    </style>
+    <div id=target></div>
+  </template>
+</div>
+
+<div data-name="A local resolves a dashed-function in the definition scope">
+  <template shadowrootmode="open">
+    <style>
+      @function --scoped() { result: SHADOW; }
+      #target {
+        --actual: --local-calls-scoped();
+        --expected: OUTER;
+      }
+    </style>
+    <div id=target></div>
+  </template>
+</div>
+
+<script>
+  test_all_shadows();
+</script>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/function-parameter-scoping-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/function-parameter-scoping-expected.txt
new file mode 100644
index 000000000000..af79aa29711b
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/function-parameter-scoping-expected.txt
@@ -0,0 +1,6 @@
+
+PASS Default referencing an earlier parameter
+PASS Default referencing a later parameter is guaranteed-invalid
+PASS Default referencing a later parameter does not see the calling element
+PASS Default referencing itself does not see the calling element
+
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/function-parameter-scoping.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/function-parameter-scoping.html
new file mode 100644
index 000000000000..048cfdbdc6cd
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/function-parameter-scoping.html
@@ -0,0 +1,78 @@
+<!DOCTYPE html>
+<title>Custom Functions: name scoping in parameter defaults</title>
+<link rel="help" href="https://drafts.csswg.org/css-mixins-1/#evaluate-a-custom-function">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/utils.js"></script>
+
+<style>
+  @property --actual { syntax: "<length>"; inherits: false; initial-value: -1px; }
+  @property --expected { syntax: "<length>"; inherits: false; initial-value: -1px; }
+</style>
+
+<div id=parent>
+  <div id=target></div>
+</div>
+<div id=main></div>
+
+<!-- To pass, a test must produce matching computed values for --actual and
+     --expected on #target.
+
+     A parameter shadows the calling element's custom property of the same name,
+     whether or not it has been resolved yet, so a default can reference an
+     earlier parameter but never sees the calling element's value of a later one.
+     https://drafts.csswg.org/css-mixins-1/#evaluating-custom-functions -->
+
+<template data-name="Default referencing an earlier parameter">
+  <style>
+    @function --f(--a <length>, --b <length>: var(--a)) returns <length> {
+      result: var(--b);
+    }
+    #target {
+      --actual: --f(6px);
+      --expected: 6px;
+    }
+  </style>
+</template>
+
+<template data-name="Default referencing a later parameter is guaranteed-invalid">
+  <style>
+    @function --f(--a <length>: var(--b), --b <length>: 3px) returns <length> {
+      result: var(--a);
+    }
+    #target {
+      --actual: --f();
+      --expected: -1px;
+    }
+  </style>
+</template>
+
+<template data-name="Default referencing a later parameter does not see the calling element">
+  <style>
+    @function --f(--a <length>: var(--b), --b <length>: 3px) returns <length> {
+      result: var(--a);
+    }
+    #target {
+      --b: 99px;
+      --actual: --f();
+      --expected: -1px;
+    }
+  </style>
+</template>
+
+<template data-name="Default referencing itself does not see the calling element">
+  <style>
+    @function --f(--a <length>: var(--a)) returns <length> {
+      result: var(--a);
+    }
+    #target {
+      --a: 99px;
+      --actual: --f();
+      --expected: -1px;
+    }
+  </style>
+</template>
+
+<script>
+  test_all_templates();
+</script>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/function-relative-units-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/function-relative-units-expected.txt
new file mode 100644
index 000000000000..6d7bb5db743d
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/function-relative-units-expected.txt
@@ -0,0 +1,13 @@
+
+PASS em in a typed parameter
+PASS rem in a typed parameter
+PASS em within calc() in a typed parameter
+PASS em in a typed parameter, untyped return
+PASS em in a typed parameter default
+PASS em in a typed parameter of a nested function
+PASS em in a typed result
+PASS em within calc() in a typed result
+PASS em in an untyped local substituted into a typed result
+PASS em in an untyped parameter
+PASS em in an untyped result
+
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/function-relative-units.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/function-relative-units.html
new file mode 100644
index 000000000000..b783527ba19e
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/function-relative-units.html
@@ -0,0 +1,192 @@
+<!DOCTYPE html>
+<title>Custom Functions: font-relative units in parameters, locals and result</title>
+<link rel="help" href="https://drafts.csswg.org/css-mixins-1/#evaluate-a-custom-function">
+<link rel="help" href="https://drafts.csswg.org/css-values-4/#font-relative-lengths">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/utils.js"></script>
+
+<style>
+  /* Registering both sides as <length> makes each comparison exact without
+     depending on what 1em, 1rem or 1ex actually resolve to. The initial value is
+     nonzero so that a guaranteed-invalid result is distinguishable from a length
+     that wrongly resolved against a zero font size. */
+  @property --actual {
+    syntax: "<length>";
+    inherits: false;
+    initial-value: -1px;
+  }
+  @property --expected {
+    syntax: "<length>";
+    inherits: false;
+    initial-value: -1px;
+  }
+  /* #parent and #target have different font sizes, so a font-relative unit that
+     resolves against the wrong element is caught too, not just one that resolves
+     against no element at all. */
+  #parent {
+    font-size: 10px;
+  }
+  #target {
+    font-size: 20px;
+  }
+</style>
+
+<div id=parent>
+  <div id=target></div>
+</div>
+<div id=main></div>
+
+<!-- To pass, a test must produce matching computed values for --actual and
+     --expected on #target.
+
+     Every case below places the <dashed-function> in a custom property rather
+     than in 'font-size', so a font-relative unit resolves against the calling
+     element whichever context it is evaluated in. -->
+
+<!-- Typed parameters -->
+
+<template data-name="em in a typed parameter">
+  <style>
+    @function --f(--x <length>) returns <length> {
+      result: var(--x);
+    }
+    #target {
+      --actual: --f(1em);
+      --expected: 1em;
+    }
+  </style>
+</template>
+
+<template data-name="rem in a typed parameter">
+  <style>
+    @function --f(--x <length>) returns <length> {
+      result: var(--x);
+    }
+    #target {
+      --actual: --f(1rem);
+      --expected: 1rem;
+    }
+  </style>
+</template>
+
+<template data-name="em within calc() in a typed parameter">
+  <style>
+    @function --f(--x <length>) returns <length> {
+      result: var(--x);
+    }
+    #target {
+      --actual: --f(calc(1em + 5px));
+      --expected: calc(1em + 5px);
+    }
+  </style>
+</template>
+
+<template data-name="em in a typed parameter, untyped return">
+  <style>
+    @function --f(--x <length>) {
+      result: var(--x);
+    }
+    #target {
+      --actual: --f(1em);
+      --expected: 1em;
+    }
+  </style>
+</template>
+
+<template data-name="em in a typed parameter default">
+  <style>
+    @function --f(--x <length>: 1em) returns <length> {
+      result: var(--x);
+    }
+    #target {
+      --actual: --f();
+      --expected: 1em;
+    }
+  </style>
+</template>
+
+<template data-name="em in a typed parameter of a nested function">
+  <style>
+    @function --inner(--y <length>) returns <length> {
+      result: var(--y);
+    }
+    @function --outer(--x <length>) returns <length> {
+      result: --inner(var(--x));
+    }
+    #target {
+      --actual: --outer(1em);
+      --expected: 1em;
+    }
+  </style>
+</template>
+
+<!-- Typed result -->
+
+<template data-name="em in a typed result">
+  <style>
+    @function --f() returns <length> {
+      result: 1em;
+    }
+    #target {
+      --actual: --f();
+      --expected: 1em;
+    }
+  </style>
+</template>
+
+<template data-name="em within calc() in a typed result">
+  <style>
+    @function --f() returns <length> {
+      result: calc(1em * 2);
+    }
+    #target {
+      --actual: --f();
+      --expected: calc(1em * 2);
+    }
+  </style>
+</template>
+
+<template data-name="em in an untyped local substituted into a typed result">
+  <style>
+    @function --f() returns <length> {
+      --local: 1em;
+      result: var(--local);
+    }
+    #target {
+      --actual: --f();
+      --expected: 1em;
+    }
+  </style>
+</template>
+
+<!-- Controls: with nothing typed, the unit is resolved as part of the calling
+     declaration, so these pass even where the cases above do not. -->
+
+<template data-name="em in an untyped parameter">
+  <style>
+    @function --f(--x) {
+      result: var(--x);
+    }
+    #target {
+      --actual: --f(1em);
+      --expected: 1em;
+    }
+  </style>
+</template>
+
+<template data-name="em in an untyped result">
+  <style>
+    @function --f() {
+      result: 1em;
+    }
+    #target {
+      --actual: --f();
+      --expected: 1em;
+    }
+  </style>
+</template>
+
+<script>
+  test_all_templates();
+</script>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/WEB_FEATURES.yml b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/WEB_FEATURES.yml
index c68c9faebee6..282654533f72 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/WEB_FEATURES.yml
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/WEB_FEATURES.yml
@@ -1,34 +1,17 @@
-features:
-- name: scrollbar-gutter
-  files:
-  - scrollbar-gutter-*
-- name: overflow-overlay
-  files:
-  - overflow-overlay.html
-- name: overflow-clip-margin
-  files:
-  - overflow-clip-margin-*
-  - overflow-no-interpolation.html
-  - paint-containment-svg.html
-- name: overflow-clip
-  files:
-  - clip-*
-  - overflow-clip-*
-  - "!overflow-clip-margin-*"
-  - dynamic-visible-to-clip-001.html
-  - rounded-overflow-clip-visible.html
-- name: overflow-shorthand
-  files:
-  - overflow-*
-  - "!overflow-auto-scrollbar-gutter-intrinsic-*"
-  - "!overflow-scroll-*"
-  - "!overflow-no-interpolation.html" # depends on transition-behavior
-  - "!overflow-ellipsis-dynamic-001.html"
-  - "!overflow-clip-*"
-- name: column-pseudo
-  files:
-  - column-*
-- name: text-overflow
-  files:
-  - text-overflow-*
-  - overflow-ellipsis-dynamic-001.html
+rules:
+- scrollbar-gutter-*: [scrollbar-gutter]
+- overflow-overlay.html: [overflow-overlay, overflow-shorthand]
+- overflow-clip-margin-*: [overflow-clip-margin]
+- overflow-no-interpolation.html: [overflow-clip-margin] # depends on transition-behavior
+- paint-containment-svg.html: [overflow-clip-margin]
+- clip-*: [overflow-clip]
+- overflow-clip-*: [overflow-clip]
+- dynamic-visible-to-clip-001.html: [overflow-clip]
+- rounded-overflow-clip-visible.html: [overflow-clip]
+- overflow-auto-scrollbar-gutter-intrinsic-*: []
+- overflow-scroll-*: []
+- overflow-ellipsis-dynamic-001.html: [text-overflow]
+- overflow-*: [overflow-shorthand]
+- column-*: [column-pseudo]
+- text-overflow-*: [text-overflow]
+- text-overflow-string-*: [custom-ellipses, text-overflow]
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/abspos-relayout-with-scrollable-descendant-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/abspos-relayout-with-scrollable-descendant-expected.txt
new file mode 100644
index 000000000000..0fe501cd5f8b
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/abspos-relayout-with-scrollable-descendant-expected.txt
@@ -0,0 +1,4 @@
+
+PASS A horizontal scrollbar appears inside the flex container during its layout
+PASS An out-of-flow box under the same positioned inline is relaid out after the scrollbar change
+
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/abspos-relayout-with-scrollable-descendant-vertical-lr-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/abspos-relayout-with-scrollable-descendant-vertical-lr-expected.txt
new file mode 100644
index 000000000000..f1d0a1bc8d9b
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/abspos-relayout-with-scrollable-descendant-vertical-lr-expected.txt
@@ -0,0 +1,4 @@
+
+PASS A vertical scrollbar appears inside the flex container during its layout
+PASS An out-of-flow box under the same positioned inline is relaid out after the scrollbar change
+
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/abspos-relayout-with-scrollable-descendant-vertical-lr.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/abspos-relayout-with-scrollable-descendant-vertical-lr.html
new file mode 100644
index 000000000000..3d6a959ed6bd
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/abspos-relayout-with-scrollable-descendant-vertical-lr.html
@@ -0,0 +1,64 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>An absolutely positioned box is still relaid out after a scrollable descendant gains a scrollbar, in vertical-lr</title>
+<link rel="help" href="https://drafts.csswg.org/css-overflow-3/#scrollbar-sizing">
+<style>
+/* Avoid auto scrollbars on the viewport, because that might trigger re-layout
+   (and thus hide bugs). */
+body { overflow: hidden; }
+
+/* Always-on scrollbars, so that the scrollbar below really does consume space and
+   change #scroller's content box. */
+#scroller::-webkit-scrollbar { width: 15px; height: 15px; }
+
+/* Same structure as abspos-relayout-with-scrollable-descendant.html, but in
+   vertical-lr, so the axes swap: it is a vertical scrollbar that consumes the flex
+   container's block-axis space, and the flex container's block size is its width.
+
+   The wrapper needs a definite block size of its own. It is orthogonal to the body,
+   so with an indefinite one it would be sized from its contents and would absorb the
+   scrollbar change before #flexContainer could. */
+#wrapper { writing-mode: vertical-lr; height: 800px; }
+
+#positionedInline { position: relative; }
+
+#inlineBlock { display: inline-block; height: 600px; vertical-align: top; }
+
+#flexContainer { display: flex; height: 500px; }
+
+#flexItem { flex: 0 0 auto; height: 100px; width: 30px; }
+
+#positionedFlexItem { position: relative; flex: 1 1 auto; }
+
+#scroller { position: absolute; top: 0; left: 0; height: 100%; width: 60px; overflow-y: auto; overflow-x: hidden; }
+#overflowingContent { height: 300px; width: 20px; }
+
+#targetContainingBlock { display: inline-block; position: relative; height: 300px; width: 120px; vertical-align: top; }
+#target { position: absolute; top: 0; left: 0; height: 100px; width: 20px; }
+</style>
+
+<div id="wrapper"><span id="positionedInline"><span id="inlineBlock"><div id="flexContainer"><div id="flexItem"></div><div id="positionedFlexItem"><div id="scroller"><div id="overflowingContent"></div></div></div></div></span><span id="targetContainingBlock"><div id="target"></div></span></span></div>
+
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+// #positionedFlexItem is 400px along the flex axis to begin with, so #scroller is
+// 400px and its 300px of content does not overflow.
+document.body.offsetHeight;
+
+// Growing #flexItem shrinks #positionedFlexItem, and therefore #scroller, to 50px.
+// The 300px of content now overflows, so a vertical scrollbar appears while
+// #flexContainer is being laid out.
+flexItem.style.height = "450px";
+document.body.offsetHeight;
+
+test(() => {
+    assert_greater_than(scroller.offsetWidth - scroller.clientWidth, 0,
+        "a vertical scrollbar should consume block-axis space in vertical-lr");
+}, "A vertical scrollbar appears inside the flex container during its layout");
+
+test(() => {
+    target.style.width = "80px";
+    assert_equals(target.offsetWidth, 80);
+}, "An out-of-flow box under the same positioned inline is relaid out after the scrollbar change");
+</script>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/abspos-relayout-with-scrollable-descendant.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/abspos-relayout-with-scrollable-descendant.html
new file mode 100644
index 000000000000..ce64c13dd32d
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/abspos-relayout-with-scrollable-descendant.html
@@ -0,0 +1,68 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>An absolutely positioned box is still relaid out after a scrollable descendant gains a scrollbar</title>
+<link rel="help" href="https://drafts.csswg.org/css-overflow-3/#scrollbar-sizing">
+<style>
+/* Avoid auto scrollbars on the viewport, because that might trigger re-layout
+   (and thus hide bugs). */
+body { overflow: hidden; }
+
+/* Always-on scrollbars, so that the scrollbar below really does consume space and
+   change #scroller's content box. */
+#scroller::-webkit-scrollbar { width: 15px; height: 15px; }
+
+/* A relatively positioned inline. It is both the parent of #inlineBlock and the
+   containing block of #target, so the two branches below meet at this inline. */
+#positionedInline { position: relative; }
+
+/* Inline-level, so that #positionedInline is its actual parent rather than an
+   anonymous block. Fixed inline size, so its own size does not depend on its
+   contents. */
+#inlineBlock { display: inline-block; width: 600px; vertical-align: top; }
+
+/* Block-level flex container with an auto block size, so its size depends on its
+   contents and a scrollbar appearing inside it can change that size. */
+#flexContainer { display: flex; width: 500px; }
+
+/* Growing this along the main axis shrinks #positionedFlexItem, and with it
+   #scroller. */
+#flexItem { flex: 0 0 auto; width: 100px; height: 30px; }
+
+#positionedFlexItem { position: relative; flex: 1 1 auto; }
+
+/* Out of flow, and its inline size follows #positionedFlexItem. The scrollbar
+   therefore appears as a consequence of the flex layout, rather than as a
+   consequence of a style change on #scroller or its contents. */
+#scroller { position: absolute; top: 0; left: 0; width: 100%; height: 60px; overflow-x: auto; overflow-y: hidden; }
+#overflowingContent { width: 300px; height: 20px; }
+
+/* #target's containing block, also inline-level under #positionedInline. */
+#targetContainingBlock { display: inline-block; position: relative; width: 300px; height: 120px; vertical-align: top; }
+#target { position: absolute; top: 0; left: 0; width: 100px; height: 20px; }
+</style>
+
+<span id="positionedInline"><span id="inlineBlock"><div id="flexContainer"><div id="flexItem"></div><div id="positionedFlexItem"><div id="scroller"><div id="overflowingContent"></div></div></div></div></span><span id="targetContainingBlock"><div id="target"></div></span></span>
+
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+// #positionedFlexItem is 400px wide to begin with, so #scroller is 400px and its
+// 300px of content does not overflow.
+document.body.offsetHeight;
+
+// Growing #flexItem shrinks #positionedFlexItem, and therefore #scroller, to 50px.
+// The 300px of content now overflows, so a horizontal scrollbar appears while
+// #flexContainer is being laid out.
+flexItem.style.width = "450px";
+document.body.offsetHeight;
+
+test(() => {
+    assert_greater_than(scroller.offsetHeight - scroller.clientHeight, 0,
+        "a horizontal scrollbar should consume block-axis space");
+}, "A horizontal scrollbar appears inside the flex container during its layout");
+
+test(() => {
+    target.style.height = "80px";
+    assert_equals(target.offsetHeight, 80);
+}, "An out-of-flow box under the same positioned inline is relaid out after the scrollbar change");
+</script>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/before-after-pseudo-element-scrolling-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/before-after-pseudo-element-scrolling-expected.html
new file mode 100644
index 000000000000..b4c8db95f3e6
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/before-after-pseudo-element-scrolling-expected.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Reftest Reference</title>
+<link rel="author" title="Steven Novaryo" href="mailto:steven.novaryo@gmail.com">
+<p>Test passes if there is a filled green square and <strong>no red</strong>.</p>
+<div style="width: 100px; height: 100px; background-image: url(/images/green.png);"></div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/before-after-pseudo-element-scrolling.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/before-after-pseudo-element-scrolling.html
new file mode 100644
index 000000000000..805c01af85b7
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/before-after-pseudo-element-scrolling.html
@@ -0,0 +1,59 @@
+<!doctype html>
+<html class="reftest-wait">
+  <head>
+    <title>Scrolls of `::before` and `::after` pseudo element should persist after a reflow.</title>
+    <link rel="help" href="https://github.com/servo/servo/pull/42005">
+    <link rel="author" title="Steven Novaryo" href="mailto:steven.novaryo@gmail.com">
+    <link rel="match" href="reference/before-after-pseudo-element-scrolling-ref.html">
+    <script src="/resources/testdriver.js"></script>
+    <script src="/resources/testdriver-vendor.js"></script>
+    <script src="/resources/testdriver-actions.js"></script>
+    <script src="/dom/events/scrolling/scroll_support.js"></script>
+    <style>
+    #target::before, #target::after {
+      display: block;
+      content: url("/images/red.png") url("/images/green.png");
+      height: 50px;
+      width: 100px;
+      overflow: scroll;
+      scrollbar-width: none;
+      background: url("/images/green.png");
+    }
+    </style>
+  </head>
+  <body>
+    <div id="dummy">dummy</div>
+    <p>Test passes if there is a filled green square and <strong>no red</strong>.</p>
+    <div id="target">
+    </div>
+
+    <script>
+      window.onload = async () => {
+        await waitForCompositorCommit();
+        let rect = target.getBoundingClientRect();
+        let middle_point = (rect.top + rect.bottom) / 2;
+
+        // Scrolls the `::before` pseudo element and wait for the event.
+        let promise_scroll_before = waitForScrollEndOrTimeout(target, MAX_FRAME);
+        new test_driver
+          .Actions()
+          .scroll(rect.left + 10, Math.round(middle_point - rect.height / 4), 0, 1000)
+          .send();
+        await promise_scroll_before;
+
+        // Scrolls the `::after` pseudo element and wait for the event.
+        let promise_scroll_after = waitForScrollEndOrTimeout(target, MAX_FRAME);
+        new test_driver
+          .Actions()
+          .scroll(rect.left + 10, Math.round(middle_point + rect.height / 4), 0, 1000)
+          .send();
+        await promise_scroll_after;
+
+        // This should force a relayout.
+        dummy.style.display = "none";
+        await waitForNextFrame();
+        document.documentElement.classList.remove("reftest-wait");
+      }
+    </script>
+  </body>
+</html>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/chrome-480554290-crash.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/chrome-480554290-crash.html
new file mode 100644
index 000000000000..830ebd5209b2
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/chrome-480554290-crash.html
@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Chrome crash 480554290</title>
+<style id="style">
+  #scroller {
+    overflow: auto;
+    scroll-marker-group: after;
+
+    .item {
+      &::scroll-marker {
+        content: "";
+      }
+    }
+  }
+</style>
+<div id="scroller">
+  <div id="e1" class="item">
+  </div>
+</div>
+<script>
+  requestAnimationFrame(() => {
+    requestAnimationFrame(() => {
+      e1.style.contentVisibility = "hidden";
+      requestAnimationFrame(() => {
+        style["innerText"] = null;
+        style["computedRole"];
+      });
+    });
+  });
+</script>
\ No newline at end of file
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/clip-002.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/clip-002.html
index cec5c7b6e647..cd8b9a3cbeb6 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/clip-002.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/clip-002.html
@@ -4,7 +4,6 @@
 <link rel="author" title="Mats Palmgren" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1531609">
 <link rel="help" href="https://drafts.csswg.org/css-overflow/#valdef-overflow-clip">
 <link rel="match" href="clip-002-ref.html">
-<meta name="fuzzy" content="maxDifference=0-1; totalPixels=0-5000" />
 <style>
   .outer {
     width: 50px;
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/clip-004.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/clip-004.html
index 80aecfdf0776..30dde4a5e12a 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/clip-004.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/clip-004.html
@@ -4,7 +4,6 @@
 <link rel="author" title="Mats Palmgren" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1531609">
 <link rel="help" href="https://drafts.csswg.org/css-overflow/#valdef-overflow-clip">
 <link rel="match" href="clip-004-ref.html">
-<meta name="fuzzy" content="maxDifference=0-1; totalPixels=0-5000" />
 <style>
   .outer {
     width: 30px;
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/clip-005.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/clip-005.html
index be8a3a18f1b3..e55f4b22fcb7 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/clip-005.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/clip-005.html
@@ -4,7 +4,6 @@
 <link rel="author" title="Mats Palmgren" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1531609">
 <link rel="help" href="https://drafts.csswg.org/css-overflow/#valdef-overflow-clip">
 <link rel="match" href="clip-005-ref.html">
-<meta name="fuzzy" content="maxDifference=0-1; totalPixels=0-5000" />
 <style>
   .outer {
     width: 30px;
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/crashtests/WEB_FEATURES.yml b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/crashtests/WEB_FEATURES.yml
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/crashtests/WEB_FEATURES.yml
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/crashtests/WEB_FEATURES.yml
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/crashtests/text-overflow-ellipsis-multiline-crash.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/crashtests/text-overflow-ellipsis-multiline-crash.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/crashtests/text-overflow-ellipsis-multiline-crash.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/crashtests/text-overflow-ellipsis-multiline-crash.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/crashtests/w3c-import.log b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/crashtests/w3c-import.log
new file mode 100644
index 000000000000..d2866e1ceb7d
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/crashtests/w3c-import.log
@@ -0,0 +1,16 @@
+The tests in this directory were imported from the W3C repository.
+Do NOT modify these tests directly in WebKit.
+Instead, create a pull request on the WPT github:
+	https://github.com/web-platform-tests/wpt
+
+Then run the Tools/Scripts/import-w3c-tests in WebKit to reimport
+
+Do NOT modify or remove this file.
+
+------------------------------------------------------------------------
+Properties requiring vendor prefixes:
+None
+------------------------------------------------------------------------
+List of files:
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/crashtests/WEB_FEATURES.yml
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/crashtests/text-overflow-ellipsis-multiline-crash.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/dynamic-visible-to-clip-002-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/dynamic-visible-to-clip-002-expected.html
new file mode 100644
index 000000000000..359a6e7dc919
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/dynamic-visible-to-clip-002-expected.html
@@ -0,0 +1,12 @@
+<!doctype html>
+<meta charset="utf-8">
+<title>CSS Test Reference: viewport with overflow: clip on the root element</title>
+<style>
+  html {
+    overflow: clip;
+  }
+  #fill {
+    height: 200vh;
+  }
+</style>
+<div id="fill"></div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/dynamic-visible-to-clip-002-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/dynamic-visible-to-clip-002-ref.html
new file mode 100644
index 000000000000..359a6e7dc919
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/dynamic-visible-to-clip-002-ref.html
@@ -0,0 +1,12 @@
+<!doctype html>
+<meta charset="utf-8">
+<title>CSS Test Reference: viewport with overflow: clip on the root element</title>
+<style>
+  html {
+    overflow: clip;
+  }
+  #fill {
+    height: 200vh;
+  }
+</style>
+<div id="fill"></div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/dynamic-visible-to-clip-002.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/dynamic-visible-to-clip-002.html
new file mode 100644
index 000000000000..18b6205aca29
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/dynamic-visible-to-clip-002.html
@@ -0,0 +1,24 @@
+<!doctype html>
+<html class="reftest-wait">
+<meta charset="utf-8">
+<title>The viewport scrollbar is updated when the root element's overflow is dynamically changed to 'clip'</title>
+<link rel="help" href="https://drafts.csswg.org/css-overflow/#overflow-propagation">
+<link rel="help" href="https://drafts.csswg.org/css-overflow/#valdef-overflow-clip">
+<link rel="help" href="https://bugzilla.mozilla.org/show_bug.cgi?id=2040247">
+<link rel="match" href="dynamic-visible-to-clip-002-ref.html">
+<style>
+  #fill {
+    height: 200vh;
+  }
+</style>
+<div id="fill"></div>
+<script>
+onload = function() {
+  // Force an initial layout so the viewport scrollbar is present.
+  window.unused = document.documentElement.getBoundingClientRect();
+  requestAnimationFrame(() => requestAnimationFrame(() => {
+    document.documentElement.style.overflow = "clip";
+    document.documentElement.removeAttribute("class");
+  }));
+}
+</script>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/hit-test-border-radius-and-perspective-projection-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/hit-test-border-radius-and-perspective-projection-expected.txt
new file mode 100644
index 000000000000..8ee065a02d54
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/hit-test-border-radius-and-perspective-projection-expected.txt
@@ -0,0 +1,4 @@
+
+PASS Near-Z element projected outside border-radius is clipped
+FAIL Corner point outside border-radius hits body after perspective assert_not_equals: got disallowed value Element node <div id="near"></div>
+
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/hit-test-border-radius-and-perspective-projection.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/hit-test-border-radius-and-perspective-projection.html
new file mode 100644
index 000000000000..227288e591f5
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/hit-test-border-radius-and-perspective-projection.html
@@ -0,0 +1,63 @@
+<!DOCTYPE html>
+<title>Hit Test border-radius clipping with perspective</title>
+<link rel="author" title="Peng Zhou" href="mailto:pengzhou@chromium.org">
+<link rel="help" href="https://drafts.csswg.org/css-backgrounds/#border-radius">
+<link rel="help" href="https://drafts.csswg.org/css-transforms-2/#perspective-property">
+<link rel="help" href="https://issues.chromium.org/issues/40811639">
+<link rel="help" href="https://issues.chromium.org/issues/456164629">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<style>
+  body {
+    margin: 0px;
+    padding: 0px;
+  }
+  #wrapper {
+    width: 100px;
+    height: 100px;
+    border: 1px solid #ccc;
+    border-radius: 50px;
+    overflow: hidden;
+    perspective: 200px;
+    transform-style: preserve-3d;
+  }
+  #near, #middle {
+    position: absolute;
+    width: 10px;
+    height: 10px;
+  }
+  #near {
+    transform: translateZ(70px);
+    left: 15px;
+    top: 15px;
+    background: blue;
+  }
+  #middle {
+    transform: translateZ(-70px);
+    left: 3px;
+    top: 3px;
+    background: orange;
+  }
+</style>
+<div id="wrapper">
+  <div id="near"></div>
+  <div id="middle"></div>
+</div>
+<script>
+  const sceneRect = document.getElementById('wrapper').getBoundingClientRect();
+  test(() => {
+    const x = sceneRect.left + 20;
+    const y = sceneRect.top + 20;
+    const hit = document.elementFromPoint(x, y);
+    assert_not_equals(hit, near);
+    assert_equals(hit, middle);
+  }, 'Near-Z element projected outside border-radius is clipped');
+
+  test(() => {
+    const x = sceneRect.left + 8;
+    const y = sceneRect.top + 8;
+    const hit = document.elementFromPoint(x, y);
+    assert_not_equals(hit, near);
+    assert_equals(hit, document.body);
+  }, 'Corner point outside border-radius hits body after perspective');
+</script>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/hit-test-stacking-context-parent-border-radius-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/hit-test-stacking-context-parent-border-radius-expected.txt
index 98840b9cb2b3..338f82e89918 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/hit-test-stacking-context-parent-border-radius-expected.txt
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/hit-test-stacking-context-parent-border-radius-expected.txt
@@ -1,18 +1,33 @@
 
-FAIL Hit testing respects border-radius clipping on elements without creating stacking contexts assert_equals: expected Element node <body><div id="parent">
-  <div id="child"></div>
-</div>
-
-... but got Element node <div id="child"></div>
-FAIL Hit testing respects border-radius clipping on elements with will-change transform assert_equals: expected Element node <body><div id="parent">
-  <div id="child" style="will-cha... but got Element node <div id="child" style="will-change: transform;"></div>
-FAIL Hit testing respects border-radius clipping on elements with opacity < 1 assert_equals: expected Element node <body><div id="parent">
-  <div id="child" style="opacity:... but got Element node <div id="child" style="opacity: 0.2;"></div>
-FAIL Hit testing respects border-radius clipping on elements with a transform property assert_equals: expected Element node <body><div id="parent">
-  <div id="child" style="height: ... but got Element node <div id="child" style="height: 1000px; transform: transla...
-FAIL Hit testing respects border-radius clipping on elements with a PaintOffset from the container assert_equals: expected Element node <body><div id="parent">
-  <div id="child" style="position... but got Element node <div id="child" style="position: relative; top: 30px;"></...
-FAIL Hit testing respects border-radius clipping on elements with a PaintOffsetTranslation from the container assert_equals: expected Element node <body><div id="parent">
-  <div id="child" style="position... but got Element node <div id="child" style="position: relative; top: 30px; ove...
+FAIL Hit testing respects border-radius clipping on elements without creating stacking contexts assert_equals: expected Element node <div id="wrapper" style="">
+  <div id="parent">
+    <div ... but got Element node <div id="child"></div>
+FAIL Hit testing respects border-radius clipping on elements without creating stacking contexts with perspective assert_equals: expected Element node <div id="wrapper" style="perspective: 1px;">
+  <div id="p... but got Element node <div id="child"></div>
+FAIL Hit testing respects border-radius clipping on elements with will-change transform assert_equals: expected Element node <div id="wrapper" style="">
+  <div id="parent">
+    <div ... but got Element node <div id="child" style="will-change: transform;"></div>
+FAIL Hit testing respects border-radius clipping on elements with will-change transform with perspective assert_equals: expected Element node <div id="wrapper" style="perspective: 1px;">
+  <div id="p... but got Element node <div id="child" style="will-change: transform;"></div>
+FAIL Hit testing respects border-radius clipping on elements with opacity < 1 assert_equals: expected Element node <div id="wrapper" style="">
+  <div id="parent">
+    <div ... but got Element node <div id="child" style="opacity: 0.2;"></div>
+FAIL Hit testing respects border-radius clipping on elements with opacity < 1 with perspective assert_equals: expected Element node <div id="wrapper" style="perspective: 1px;">
+  <div id="p... but got Element node <div id="child" style="opacity: 0.2;"></div>
+FAIL Hit testing respects border-radius clipping on elements with a transform property assert_equals: expected Element node <div id="wrapper" style="">
+  <div id="parent">
+    <div ... but got Element node <div id="child" style="height: 1000px; transform: transla...
+FAIL Hit testing respects border-radius clipping on elements with a transform property with perspective assert_equals: expected Element node <div id="wrapper" style="perspective: 1px;">
+  <div id="p... but got Element node <div id="child" style="height: 1000px; transform: transla...
+FAIL Hit testing respects border-radius clipping on elements with a PaintOffset from the container assert_equals: expected Element node <div id="wrapper" style="">
+  <div id="parent">
+    <div ... but got Element node <div id="child" style="position: relative; top: 30px;"></...
+FAIL Hit testing respects border-radius clipping on elements with a PaintOffset from the container with perspective assert_equals: expected Element node <div id="wrapper" style="perspective: 1px;">
+  <div id="p... but got Element node <div id="child" style="position: relative; top: 30px;"></...
+FAIL Hit testing respects border-radius clipping on elements with a PaintOffsetTranslation from the container assert_equals: expected Element node <div id="wrapper" style="">
+  <div id="parent">
+    <div ... but got Element node <div id="child" style="position: relative; top: 30px; ove...
+FAIL Hit testing respects border-radius clipping on elements with a PaintOffsetTranslation from the container with perspective assert_equals: expected Element node <div id="wrapper" style="perspective: 1px;">
+  <div id="p... but got Element node <div id="child" style="position: relative; top: 30px; ove...
 FAIL Hit testing respects border-radius clipping on elements with a different coordinate space assert_equals: expected Element node <div style="width: 50px; height: 50px; overflow: scroll;"... but got Element node <div id="child" style="position: relative; top: 30px; ove...
 
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/hit-test-stacking-context-parent-border-radius.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/hit-test-stacking-context-parent-border-radius.html
index 7e0820f0b573..00176783f212 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/hit-test-stacking-context-parent-border-radius.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/hit-test-stacking-context-parent-border-radius.html
@@ -19,8 +19,10 @@
 }
 </style>
 
-<div id="parent">
-  <div id="child"></div>
+<div id="wrapper">
+  <div id="parent">
+    <div id="child"></div>
+  </div>
 </div>
 
 <script>
@@ -33,42 +35,51 @@
   return document.elementFromPoint(rect.left + 32, rect.bottom - 10);
 }
 
-test(() => {
-  assert_equals(elementFromPointOutsideParentBorderRadius(), document.body);
+function runTest(fn, description) {
+  wrapper.style = '';
+  test(fn, description);
+  // reset style
+  wrapper.style = 'perspective: 1px;';
+  test(fn, `${description} with perspective`);
+  wrapper.style = '';
+}
+
+runTest(() => {
+  assert_equals(elementFromPointOutsideParentBorderRadius(), wrapper);
   assert_equals(elementFromPointInsideParentBorderRadius(), child);
 }, 'Hit testing respects border-radius clipping on elements without creating stacking contexts');
 
-test(() => {
+runTest(() => {
   child.style = 'will-change: transform';
-  assert_equals(elementFromPointOutsideParentBorderRadius(), document.body);
+  assert_equals(elementFromPointOutsideParentBorderRadius(), wrapper);
   assert_equals(elementFromPointInsideParentBorderRadius(), child);
   child.style = '';
 }, 'Hit testing respects border-radius clipping on elements with will-change transform');
 
-test(() => {
+runTest(() => {
   child.style = 'opacity: 0.2';
-  assert_equals(elementFromPointOutsideParentBorderRadius(), document.body);
+  assert_equals(elementFromPointOutsideParentBorderRadius(), wrapper);
   assert_equals(elementFromPointInsideParentBorderRadius(), child);
   child.style = '';
 }, 'Hit testing respects border-radius clipping on elements with opacity < 1');
 
-test(() => {
+runTest(() => {
   child.style = 'height: 1000px; transform: translate(0, -500px);';
-  assert_equals(elementFromPointOutsideParentBorderRadius(), document.body);
+  assert_equals(elementFromPointOutsideParentBorderRadius(), wrapper);
   assert_equals(elementFromPointInsideParentBorderRadius(), child);
   child.style = '';
 }, 'Hit testing respects border-radius clipping on elements with a transform property');
 
-test(() => {
+runTest(() => {
   child.style = 'position: relative; top: 30px;';
-  assert_equals(elementFromPointOutsideParentBorderRadius(), document.body);
+  assert_equals(elementFromPointOutsideParentBorderRadius(), wrapper);
   assert_equals(elementFromPointInsideParentBorderRadius(), child);
   child.style = '';
 }, 'Hit testing respects border-radius clipping on elements with a PaintOffset from the container');
 
-test(() => {
+runTest(() => {
   child.style = 'position: relative; top: 30px; overflow: scroll;';
-  assert_equals(elementFromPointOutsideParentBorderRadius(), document.body);
+  assert_equals(elementFromPointOutsideParentBorderRadius(), wrapper);
   assert_equals(elementFromPointInsideParentBorderRadius(), child);
   child.style = '';
 }, 'Hit testing respects border-radius clipping on elements with a PaintOffsetTranslation from the container');
@@ -81,13 +92,17 @@
   container.style.height = '50px';
   container.style.overflow = 'scroll';
   container.appendChild(document.getElementById('parent'));
-  document.body.appendChild(container);
+  wrapper.appendChild(container);
   container.scrollTop = container.scrollHeight;
   container.scrollLeft = 0;
   const offset = container.getBoundingClientRect().left;
   const curY = offset + 10;
   assert_equals(document.elementFromPoint(offset, curY), container);
   assert_equals(document.elementFromPoint(offset + 10, curY), child);
+  wrapper.style = 'perspective: 1px;';
+  assert_equals(document.elementFromPoint(offset, curY), container);
+  assert_equals(document.elementFromPoint(offset + 10, curY), child);
+  wrapper.style = '';
   child.style = '';
 }, 'Hit testing respects border-radius clipping on elements with a different coordinate space');
 </script>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/inheritance-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/inheritance-expected.txt
index dfda29631576..842aa1fe15d8 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/inheritance-expected.txt
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/inheritance-expected.txt
@@ -1,9 +1,9 @@
 
 PASS Property block-ellipsis has initial value no-ellipsis
-PASS Property block-ellipsis inherits
-PASS Property continue has initial value auto
+FAIL Property block-ellipsis inherits assert_equals: expected "ellipsis" but got "no-ellipsis"
+FAIL Property continue has initial value normal assert_equals: expected "normal" but got "auto"
 FAIL Property continue does not inherit assert_equals: expected "collapse" but got "auto"
-PASS Property max-lines has initial value none
+FAIL Property max-lines has initial value auto assert_equals: expected "auto" but got "none"
 PASS Property max-lines does not inherit
 PASS Property overflow-block has initial value visible
 PASS Property overflow-block does not inherit
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/inheritance.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/inheritance.html
index ced9fa1b6995..e817ffd771eb 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/inheritance.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/inheritance.html
@@ -15,9 +15,9 @@
   <div id="target"></div>
 </div>
 <script>
-assert_inherited('block-ellipsis', 'no-ellipsis', 'auto');
-assert_not_inherited('continue', 'auto', 'collapse');
-assert_not_inherited('max-lines', 'none', '2');
+assert_inherited('block-ellipsis', 'no-ellipsis', 'ellipsis');
+assert_not_inherited('continue', 'normal', 'collapse');
+assert_not_inherited('max-lines', 'auto', '2');
 assert_not_inherited('overflow-block', 'visible', 'scroll');
 assert_not_inherited('overflow-inline', 'visible', 'scroll');
 assert_not_inherited('overflow-x', 'visible', 'scroll');
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/WEB_FEATURES.yml b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/WEB_FEATURES.yml
index fe3e3bc96f8e..4bf99ef659ec 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/WEB_FEATURES.yml
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/WEB_FEATURES.yml
@@ -1,3 +1,2 @@
-features:
-- name: line-clamp
-  files: "**"
+rules:
+- "**": [line-clamp]
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-032.tentative-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-032-expected.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-032.tentative-expected.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-032-expected.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-032.tentative.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-032.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-032.tentative.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-032.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-007-expected.xht b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-033-expected.xht
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-007-expected.xht
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-033-expected.xht
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-033.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-033.html
new file mode 100644
index 000000000000..d0f0d39dd5b0
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-033.html
@@ -0,0 +1,56 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Overflow: block-ellipsis after hanging whitespacce</title>
+<link rel="author" title="Andreu Botella" href="mailto:abotella@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-overflow-4/#block-ellipsis">
+<link rel="stylesheet" href="/fonts/ahem.css">
+<link rel="match" href="/css/reference/ref-filled-green-100px-square.xht">
+<meta name="assert" content="Preserved tabs are properly taken into account when clamping. In particular, if the last line before clamp is also the last line of the line-clamp container, and it ends in a tab that doesn't cause it to overflow, then that shouldn't cause it to have an ellipsis.">
+<style>
+.clamp {
+  line-clamp: 2;
+  font: 25px/25px Ahem;
+  width: 100px;
+  tab-size: 4;
+}
+.test1 {
+  background-color: red;
+  color: red;
+}
+.test2 {
+  color: transparent;
+  background:
+    linear-gradient(green, green) 25px 25px / 75px 25px no-repeat,
+    red;
+}
+.green {
+  color: green;
+  background-color: green;
+}
+.red {
+  color: red;
+  background-color: red;
+}
+.tab {
+  white-space: pre;
+}
+</style>
+
+<p>Test passes if there is a filled green square and <strong>no red</strong>.</p>
+
+<div class="clamp test1">
+  <span class="green">
+    XXXX
+    X X<span class="tab">&Tab;</span>
+  </span>
+</div>
+
+<div class="clamp test2">
+  <span class="green">
+    XXXX
+    X
+  </span>
+  <span class="red">
+    <span class="tab">&Tab;</span> X
+  </span>
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-034-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-034-expected.html
new file mode 100644
index 000000000000..0b7fb78a9535
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-034-expected.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Test reference</title>
+<link rel="author" title="Florian Rivoal" href="https::/florian.rivoal.net">
+<style>
+p {
+  font-family: monospace;
+}
+</style>
+
+<p>Test passes if there is no red)
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-034.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-034.html
new file mode 100644
index 000000000000..db5c7a88a0c1
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-034.html
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Overflow: punctuation before block-ellipsis cannot hang</title>
+<link rel="author" title="Florian Rivoal" href="https::/florian.rivoal.net">
+<link rel="help" href="https://drafts.csswg.org/css-overflow-4/#block-ellipsis">
+<link rel="help" href="https://drafts.csswg.org/css-text-4/#hanging-punctuation-property">
+<link rel="match" href="reference/block-ellipsis-034-ref.html">
+<meta name="assert" content="Punctionat preceding the ellipsis cannot hang, since it isn't last on the line.">
+<style>
+p {
+  font-family: monospace;
+  width: 35ch;
+  line-clamp: 1 ")";
+  hanging-punctuation: last;
+}
+/* 35ch is enough to fit up to the word FAIL if the following "))" will both "))" hang, which should not happen.
+   Otherwise, FAIL) has to be ellided to make room for )
+*/
+.red { color: red; }
+</style>
+
+<p>Test passes if there is no red <span class=red>FAIL)</span>
+<span class=red>
+FAIL FAIL FAIL FAIL
+FAIL FAIL FAIL FAIL
+FAIL FAIL FAIL FAIL
+</span>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-035-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-035-expected.html
new file mode 100644
index 000000000000..f50980a2cce3
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-035-expected.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Test reference</title>
+<link rel="author" title="Florian Rivoal" href="https::/florian.rivoal.net">
+<style>
+p {
+  font-family: monospace;
+  white-space: pre;
+}
+.blue { color: blue; }
+</style>
+
+<p>Test passes if there are <em>two</em> lines of text, and the second
+line ends with a blue word followed by a closing <span class=blue>parenthesis</span>)
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-035.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-035.html
new file mode 100644
index 000000000000..31206c0828fc
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-035.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Overflow: block-ellipsis can hang</title>
+<link rel="author" title="Florian Rivoal" href="https::/florian.rivoal.net">
+<link rel="help" href="https://drafts.csswg.org/css-overflow-4/#block-ellipsis">
+<link rel="help" href="https://drafts.csswg.org/css-text-4/#hanging-punctuation-property">
+<link rel="match" href="reference/block-ellipsis-035-ref.html">
+<meta name="assert" content="The block ellipsis is affected by the hanging punctuation property, and thus can itself hang.">
+<style>
+p {
+  font-family: monospace;
+  width: 60ch; /* Less than 60, and the word "parenthesis" wouldn't fit the second line. More than 60 and the ")" would fit even if it didn't hang. */
+  line-clamp: 2 ")";
+  hanging-punctuation: last;
+}
+.red { color: red; }
+.blue { color: blue; }
+</style>
+
+<p>Test passes if there are <em>two</em> lines of text, and the second line ends with a blue word followed by a closing <span class=blue>parenthesis</span>
+<span class=red>
+FAIL FAIL FAIL FAIL
+FAIL FAIL FAIL FAIL
+FAIL FAIL FAIL FAIL
+</span>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-009-expected.xht b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-036-expected.xht
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-009-expected.xht
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-036-expected.xht
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-036.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-036.html
new file mode 100644
index 000000000000..72ffa192d9e1
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-036.html
@@ -0,0 +1,38 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Overflow: block-ellipsis strut</title>
+<link rel="author" title="Andreu Botella" href="mailto:abotella@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-overflow-4/#block-ellipsis">
+<link rel="stylesheet" href="/fonts/ahem.css">
+<link rel="match" href="/css/reference/ref-filled-green-100px-square.xht">
+<meta name="assert" content="Preserved tabs are properly taken into account when clamping. In particular, if the last line before clamp is also the last line of the line-clamp container, and it ends in a tab that doesn't cause it to overflow, then that shouldn't cause it to have an ellipsis.">
+<style>
+.parent {
+  height: 100px;
+  width: 100px;
+  background: red;
+}
+.clamp {
+  font: 25px/25px Ahem;
+  line-clamp: 3;
+  width: 100px;
+  color: transparent;
+  background: linear-gradient(green, green) 0 0 / 100px 100px no-repeat, red;
+}
+.big {
+  font: 50px/50px Ahem;
+}
+</style>
+
+<p>Test passes if there is a filled green square and <strong>no red</strong>.</p>
+
+<div class="parent">
+  <div class="clamp">
+    XXXX
+    <span class="big">
+      XX
+      XXX
+      X
+    </span>
+  </div>
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-037-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-037-expected.html
new file mode 100644
index 000000000000..1c3400848e88
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-037-expected.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Overflow: test reference</title>
+<link rel="author" title="Florian Rivoal" href="https://florian.rivoal.net">
+<style>
+.clamp {
+  width: 32ch;
+  font-family: monospace;
+}
+</style>
+<div class="clamp">
+Test passes if there are 4 lines
+and the last two are identical
+supercalifragilisticexpialidocious
+supercalifragilisticexpialidocious
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-037.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-037.html
new file mode 100644
index 000000000000..b47034ebb294
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-037.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Overflow: no-ellipsis when there's not enough room</title>
+<link rel="author" title="Florian Rivoal" href="https://florian.rivoal.net">
+<link rel="help" href="https://drafts.csswg.org/css-overflow-4/#block-ellipsis">
+<link rel="match" href="reference/block-ellipsis-023-ref.html">
+<meta name="assert" content="block-ellipsis: no-ellipsis must not displace content to make room for the (non-existant) ellipsis. this should also be the case when max-lines: auto">
+<style>
+.clamp {
+  line-clamp: auto no-ellipsis;
+  max-height: 4lh;
+  width: 32ch;
+  font-family: monospace;
+}
+</style>
+<div class="clamp">
+  Test passes if there are 4 lines
+  and the last two are identical
+  supercalifragilisticexpialidocious
+  supercalifragilisticexpialidocious
+  Test fails: this should not be visible
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-038-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-038-expected.html
new file mode 100644
index 000000000000..5f6dc1ae8990
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-038-expected.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Overflow: non-empty custom block ellipsis reference</title>
+<style>
+.clamp {
+  font: 20px/1 monospace;
+  width: 20ch;
+}
+</style>
+<div class="clamp">First line<br>PASS CUSTOM</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-038.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-038.html
new file mode 100644
index 000000000000..0ae34c17026b
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-038.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Overflow: non-empty custom block ellipsis</title>
+<link rel="help" href="https://drafts.csswg.org/css-overflow-4/#block-ellipsis">
+<link rel="match" href="reference/block-ellipsis-038-ref.html">
+<meta name="assert" content="A non-empty custom block ellipsis is shown at the clamp point.">
+<style>
+.clamp {
+  font: 20px/1 monospace;
+  width: 20ch;
+  line-clamp: 2 " CUSTOM";
+}
+</style>
+<div class="clamp">First line<br>PASS<br>FAIL</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-039-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-039-expected.html
new file mode 100644
index 000000000000..0f44c45f03fe
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-039-expected.html
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Test reference</title>
+<link rel="author" title="Florian Rivoal" href="https://florian.rivoal.net">
+<style>
+.ref {
+    width: min-content;
+    float: left;
+    border: solid 1px;
+    margin: 0 1ch;
+}
+.tall {
+    font-size: 2em;
+    line-height: 2;
+}
+</style>
+
+<p>This test passes if the two boxes below are identical, including having the same height.
+
+<div class=ref>
+    <span class=tall>TEST</span>
+    …
+</div>
+<div class=ref>
+    <span class=tall>TEST</span>
+    …
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-039.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-039.html
new file mode 100644
index 000000000000..d1a81de76d52
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-039.html
@@ -0,0 +1,33 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Overflow: block-ellipsis root-inline strut</title>
+<link rel="author" title="Florian Rivoal" href="https://florian.rivoal.net">
+<link rel="help" href="https://drafts.csswg.org/css-overflow-4/#block-ellipsis">
+<link rel="match" href="reference/block-ellipsis-039-ref.html">
+<meta name="assert" content="The strut inserted by block-ellipsis is online styled after the root inline, not after any other interrupted inline box.">
+<style>
+.test, .ref {
+    width: min-content;
+    float: left;
+    border: solid 1px;
+    margin: 0 1ch;
+}
+.test {
+    line-clamp: 2;
+}
+.tall {
+    font-size: 2em;
+    line-height: 2;
+}
+</style>
+
+<p>This test passes if the two boxes below are identical, including having the same height.
+
+<div class=test>
+    <span class=tall>TEST TEST TEST</span>
+    <span></span>
+</div>
+<div class=ref>
+    <span class=tall>TEST</span>
+    …
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-010-expected.xht b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-040-expected.xht
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-010-expected.xht
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-040-expected.xht
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-040.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-040.html
new file mode 100644
index 000000000000..1c2f3fa3ba5b
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-040.html
@@ -0,0 +1,37 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Overflow: Room for block-ellipsis not by clearance</title>
+<link rel="author" title="Florian Rivoal" href="https://florian.rivoal.net">
+<link rel="help" href="https://drafts.csswg.org/css-overflow-4/#block-ellipsis">
+<link rel="match" href="/css/reference/ref-filled-green-100px-square.xht">
+<link rel="stylesheet" href="/fonts/ahem.css">
+<meta name="assert" content="The ua must not make room for the block ellipsis by means other than displacing content at the end of the line. Moving the line down to clear a float is not OK.">
+<style>
+.test {
+    font-family: Ahem;
+    line-height: 1;
+    font-size: 25px;
+    background: green;
+    color: transparent;
+    width: 4ch;
+    min-height: 4ch;
+    line-clamp: 3;
+}
+aside {
+    float: left;
+    width: 3ch;
+}
+.red { color: red; }
+</style>
+
+<p>Test passes if there is a filled green square and <strong>no red</strong>.
+
+<div class=test>
+    <aside>ABC ABC ABC</aside>
+    1
+    2
+    <span class=red>3</span>
+    <span class=red>4</span>
+    <span class=red>5</span>
+</div>
+
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-041-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-041-expected.html
new file mode 100644
index 000000000000..2dc26d84ba65
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-041-expected.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Test reference</title>
+<link rel="author" title="Florian Rivoal" href="https://florian.rivoal.net">
+<style>
+.test {
+    font-family: monospace;
+}
+aside {
+    float: left;
+    width: 1ch;
+    height: 1lh;
+}
+.red { color: red; }
+</style>
+
+<p>Test passes if there is a “…” below and <strong>no red</strong>.
+
+<div class=test>
+    <aside></aside>…
+</div>
+
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-041.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-041.html
new file mode 100644
index 000000000000..dc8f11d7ac0e
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-041.html
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Overflow: No clearance if block-ellipsis fits</title>
+<link rel="author" title="Florian Rivoal" href="https://florian.rivoal.net">
+<link rel="help" href="https://drafts.csswg.org/css-overflow-4/#block-ellipsis">
+<link rel="match" href="reference/block-ellipsis-041-ref.html">
+<meta name="assert" content="After displacing content to make room for the ellipsis, if the line would fit next to a float, keep and there and do not shift it down.">
+<style>
+.test {
+    font-family: monospace;
+    width: 5.1ch; /* .1 is to make sure rounding errors don't interfere with line breaking */
+    line-clamp: 1;
+}
+aside {
+    float: left;
+    width: 1ch;
+    height: 1lh;
+}
+.red { color: red; }
+</style>
+
+<p>Test passes if there is a “…” below and <strong>no red</strong>.
+
+<div class=test>
+    <aside></aside>
+    <span class=red>FAIL FAIL FAIL FAIL</span>
+</div>
+
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-bidi-001-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-bidi-001-expected.html
new file mode 100644
index 000000000000..c7346ab52793
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-bidi-001-expected.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Reference</title>
+<style>
+.clamp {
+  display: -webkit-box;
+  -webkit-box-orient: vertical;
+  font: 16px / 32px serif;
+  white-space: pre;
+  padding: 0 4px;
+  background-color: yellow;
+  direction: rtl;
+}
+</style>
+<div class="clamp">Line 1
+Line 2…</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-bidi-001.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-bidi-001.html
new file mode 100644
index 000000000000..8b5f36beaf72
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-bidi-001.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Overflow: line-clamp on RTL content</title>
+<link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
+<link rel="author" title="Florian Rivoal" href="https://florian.rivoal.net">
+<link rel="help" href="https://drafts.csswg.org/css-overflow-4/#block-ellipsis">
+<link rel="match" href="reference/webkit-line-clamp-014-ref.html">
+<meta name="assert" content="line-clamp should place the ellipsis appropriately in RTL content.">
+<style>
+.clamp {
+  line-clamp: 2;
+  font: 16px / 32px serif;
+  white-space: pre;
+  padding: 0 4px;
+  background-color: yellow;
+  direction: rtl;
+}
+</style>
+<div class="clamp">Line 1
+Line 2
+Line 3</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-bidi-002-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-bidi-002-expected.html
new file mode 100644
index 000000000000..76231c06e96f
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-bidi-002-expected.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Test reference</title>
+<link rel="author" title="Florian Rivoal" href="https://florian.rivoal.net">
+<style>
+div {
+    font-family: monospace;
+    unicode-bidi: plaintext;
+    width: 14ch;
+}
+</style>
+
+<p>Test passes if there is no red,
+and there is an ellipsis character (“…”) on the <em>left</em> side
+of the of second line of the text below.
+
+<div>
+        Story time:<br>
+        "روزی روزگاری…
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-bidi-002.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-bidi-002.html
new file mode 100644
index 000000000000..8752a6e04f0b
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-bidi-002.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Overflow: bidi handling of ellipsis in plaintext content</title>
+<link rel="author" title="Florian Rivoal" href="https://florian.rivoal.net">
+<link rel="help" href="https://drafts.csswg.org/css-overflow-4/#block-ellipsis">
+<link rel="match" href="reference/block-ellipsis-bidi-002-ref.html">
+<meta name="assert" content="line-clamp should place the ellipsis appropriately in RTL content, getting its direction from the bidi paragraph, which can vary inside of a block when using unicode-bidi:plaintext">
+<style>
+div {
+    font-family: monospace;
+    line-clamp: 2;
+    unicode-bidi: plaintext;
+    width: 14ch;
+}
+.red { color: red; }
+</style>
+
+<p>Test passes if there is no red,
+and there is an ellipsis character (“…”) on the <em>left</em> side
+of the of second line of the text below.
+
+<div>
+        Story time:<br>
+        "روزی روزگاری <span class=red>بد بد بد بد بد بد بد بد</span>
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-bidi-003-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-bidi-003-expected.html
new file mode 100644
index 000000000000..922d2e9dc505
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-bidi-003-expected.html
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Test referenec</title>
+<link rel="author" title="Florian Rivoal" href="https://florian.rivoal.net">
+<style>
+body {
+    max-width: 80ch;
+}
+div {
+    font-family: monospace;
+    unicode-bidi: plaintext;
+    width: 25ch;
+}
+.test { border: solid blue 5px; }
+.ref { border: solid orange 5px; }
+
+</style>
+
+<p>Test passes if the text in the blue box matches the one in the orange box.
+
+<div class=test>
+    Story time:<br>
+    روزی روزگاری… (continued)
+</div>
+<div class=ref>
+    Story time:<br>
+    روزی روزگاری… (continued)
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-bidi-003.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-bidi-003.html
new file mode 100644
index 000000000000..b17f235516da
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-bidi-003.html
@@ -0,0 +1,35 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Overflow: bidi handling of ellipsis in plaintext content</title>
+<link rel="author" title="Florian Rivoal" href="https://florian.rivoal.net">
+<link rel="help" href="https://drafts.csswg.org/css-overflow-4/#block-ellipsis">
+<link rel="match" href="reference/block-ellipsis-bidi-003-ref.html">
+<meta name="assert" content="The (internal) direction of the block ellipsis is based on that of the paragraph rather than the containing block when they differ, which can happen with unicode-bidi: plaintext">
+<style>
+body {
+    max-width: 80ch;
+}
+div {
+    font-family: monospace;
+    unicode-bidi: plaintext;
+    width: 25ch;
+}
+.test {
+    line-clamp: 2 "… (continued)";
+}
+.red { color: red; }
+.test { border: solid blue 5px; }
+.ref { border: solid orange 5px; }
+
+</style>
+
+<p>Test passes if the text in the blue box matches the one in the orange box.
+
+<div class=test>
+    Story time:<br>
+    روزی روزگاری <span class=red>بد بد بد بد بد بد بد بد</span>
+</div>
+<div class=ref>
+    Story time:<br>
+    روزی روزگاری… (continued)
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-bidi-004-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-bidi-004-expected.html
new file mode 100644
index 000000000000..589212417405
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-bidi-004-expected.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Test reference</title>
+<link rel="author" title="Florian Rivoal" href="https://florian.rivoal.net">
+<style>
+div {
+    font-family: monospace;
+    width: 19ch;
+}
+.test { border: solid blue 5px; }
+.ref { border: solid orange 5px; }
+
+</style>
+
+<p>Test passes if the text in the blue box matches the one in the orange box.
+
+<div class=test>
+    He said "سلام" <bdi dir=rtl>…آخرہ</bdi>
+</div>
+<div class=ref>
+    He said "سلام" <bdi dir=rtl>…آخرہ</bdi>
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-bidi-004.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-bidi-004.html
new file mode 100644
index 000000000000..4912cb956d8b
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-bidi-004.html
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Overflow: block-ellipsis as a bidi isolate</title>
+<link rel="author" title="Florian Rivoal" href="https://florian.rivoal.net">
+<link rel="help" href="https://drafts.csswg.org/css-overflow-4/#block-ellipsis">
+<link rel="match" href="reference/block-ellipsis-bidi-004-ref.html">
+<meta name="assert" content="Characters inserted as block ellipsis should be treated as an isolate, with an embeding level matching that of the paragraph. It should neither get itself reordered away from the end of the line, nor have its strongly directional content influence surrounding neutrals.">
+<style>
+div {
+    font-family: monospace;
+    width: 19ch;
+}
+.test {
+    line-clamp: 1 "…آخرہ";
+}
+.test { border: solid blue 5px; }
+.ref { border: solid orange 5px; }
+
+</style>
+
+<p>Test passes if the text in the blue box matches the one in the orange box.
+
+<div class=test>
+    He said "سلام" and smiled.
+</div>
+<div class=ref>
+    He said "سلام" <bdi dir=rtl>…آخرہ</bdi>
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-crash-001.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-crash-001.html
new file mode 100644
index 000000000000..8d78532aa9ed
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-crash-001.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<meta charset="UTF-8">
+<style>
+.clamp {
+  line-clamp: 2;
+  white-space: pre;
+}
+.relpos {
+  position: relative;
+}
+</style>
+
+<div class="clamp">Line 1
+Line 2 <span class="relpos">
+Line 3</span></div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-011-expected.xht b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-quirk-001-expected.xht
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-011-expected.xht
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-quirk-001-expected.xht
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-quirk-001.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-quirk-001.html
new file mode 100644
index 000000000000..f7498941db3e
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-quirk-001.html
@@ -0,0 +1,50 @@
+<!-- doctype intentionally missing -->
+<meta charset="utf-8">
+<title>CSS Overflow: block-ellipsis and the blocks ignore line-height quirk</title>
+<link rel="author" title="Andreu Botella" href="mailto:abotella@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-overflow-4/#block-ellipsis">
+<link rel="stylesheet" href="/fonts/ahem.css">
+<link rel="match" href="/css/reference/ref-filled-green-100px-square.xht">
+<meta name="assert" content="the 'blocks ignore line-height quirk' does not affect block-ellipsis. When the line-clamp ellipsis displaces a line's entire contents, it is considered to have a strut, which is not removed by this quirk.">
+<style>
+p {
+  /* Making sure the margin collapsing quirk doesn't apply:
+   * https://html.spec.whatwg.org/multipage/rendering.html#margin-collapsing-quirks */
+  margin-block: 1em;
+}
+span.red {
+    color: red;
+}
+div.red {
+    position: absolute;
+    width: 25px;
+    height: 100px;
+    z-index: -1;
+    background: red;
+}
+div.green {
+    position: absolute;
+    width: 100px;
+    height: 100px;
+    z-index: -2;
+    background: green;
+}
+.clamp {
+  line-clamp: 4;
+  font: 25px/25px Ahem;
+  width: 100px;
+  color: green;
+}
+</style>
+
+<p>Test passes if there is a filled green square and <strong>no red</strong>.</p>
+
+<div class=green></div>
+<div class=red></div>
+<div class="clamp">
+  XXXX
+  XXXX
+  XXXX
+  <span class=red>XXXXXXX
+  X</span>
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-014-expected.xht b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-quirk-002-expected.xht
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-014-expected.xht
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-quirk-002-expected.xht
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-quirk-002.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-quirk-002.html
new file mode 100644
index 000000000000..7b0401478d5a
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-quirk-002.html
@@ -0,0 +1,44 @@
+<!-- doctype intentionally missing -->
+<meta charset="utf-8">
+<title>CSS Overflow: block-ellipsis and the blocks ignore line-height quirk</title>
+<link rel="author" title="Andreu Botella" href="mailto:abotella@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-overflow-4/#block-ellipsis">
+<link rel="stylesheet" href="/fonts/ahem.css">
+<link rel="match" href="/css/reference/ref-filled-green-100px-square.xht">
+<meta name="assert" content="In quirks mode, the 'blocks ignore line-height quirk' makes inlines not have a strut. When the line-clamp ellipsis displaces a line's entire contents, it is considered to have a strut for the root inline box, which is not removed by this quirk. There are no struts for other open inline boxes.">
+<style>
+p {
+  /* Making sure the margin collapsing quirk doesn't apply:
+   * https://html.spec.whatwg.org/multipage/rendering.html#margin-collapsing-quirks */
+  margin-block: 1em;
+}
+
+#parent {
+  height: 100px;
+  width: 100px;
+  background-color: red;
+}
+#container {
+  width: 100px;
+  background: linear-gradient(green, green) 0 0 / 100px 100px no-repeat, red;
+  font: 25px/25px Ahem;
+  color: transparent;
+  line-clamp: 3;
+}
+.large {
+  font: 50px/50px Ahem;
+}
+</style>
+
+<p>Test passes if there is a filled green square and <strong>no red</strong>.</p>
+
+<div id="parent">
+  <div id="container">
+    XXXX
+    <span class="large">
+      XX
+      XXXX
+      X
+    </span>
+  </div>
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/discard/reference/w3c-import.log b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/discard/reference/w3c-import.log
index 7e8431c0dd68..67d7d2ae9500 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/discard/reference/w3c-import.log
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/discard/reference/w3c-import.log
@@ -10,8 +10,6 @@ Do NOT modify or remove this file.
 ------------------------------------------------------------------------
 Properties requiring vendor prefixes:
 None
-Property values requiring vendor prefixes:
-None
 ------------------------------------------------------------------------
 List of files:
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/discard/reference/discard-multicol-001-ref.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/discard/w3c-import.log b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/discard/w3c-import.log
index 478b060de06c..b27be5b3294d 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/discard/w3c-import.log
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/discard/w3c-import.log
@@ -10,8 +10,6 @@ Do NOT modify or remove this file.
 ------------------------------------------------------------------------
 Properties requiring vendor prefixes:
 None
-Property values requiring vendor prefixes:
-None
 ------------------------------------------------------------------------
 List of files:
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/discard/discard-multicol-001-expected.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-011-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-011-expected.html
index 02ef71d56193..d318a3e662f8 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-011-expected.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-011-expected.html
@@ -2,15 +2,17 @@
 <meta charset="utf-8">
 <title>CSS Reference</title>
 <style>
-.clamp {
+div {
   font: 16px / 32px serif;
   white-space: pre;
-  height: 3lh;
   padding: 0 4px;
+}
+.clamp {
+  height: 3lh;
   background-color: yellow;
 }
 </style>
 <div class="clamp">Line 1
 Line 2
-Line 3…</div>
-<p>Following content.</p>
+Line 3</div>
+<div>Line 4…</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-011.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-011.html
index 69effbcca170..a409ea197017 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-011.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-011.html
@@ -4,7 +4,7 @@
 <link rel="author" title="Andreu Botella" href="mailto:abotella@igalia.com">
 <link rel="help" href="https://drafts.csswg.org/css-overflow-4/#line-clamp">
 <link rel="match" href="reference/line-clamp-011-ref.html">
-<meta name="assert" content="When line-clamp is used with a number of lines while also having a set block size, whichever comes earlier takes precedence.">
+<meta name="assert" content="When line-clamp is used with a number of lines while also having a set block size, only the line number affects the clamping; content beyond the block size, if any, overflows.">
 <style>
 .clamp {
   line-clamp: 4;
@@ -20,4 +20,3 @@
 Line 3
 Line 4
 Line 5</div>
-<p>Following content.</p>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-026-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-026-expected.html
index b6e816f997c2..9c0772c2782b 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-026-expected.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-026-expected.html
@@ -3,6 +3,7 @@
 <title>CSS Reference</title>
 <style>
 .clamp {
+  overflow: hidden;
   font: 16px / 32px serif;
   white-space: pre-wrap;
 }
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-035-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-035-expected.html
index c9a9ae5d7ffe..d318a3e662f8 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-035-expected.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-035-expected.html
@@ -2,16 +2,17 @@
 <meta charset="utf-8">
 <title>CSS Reference</title>
 <style>
-.clamp {
-  display: -webkit-box;
-  -webkit-box-orient: vertical;
+div {
   font: 16px / 32px serif;
   white-space: pre;
   padding: 0 4px;
+}
+.clamp {
+  height: 3lh;
   background-color: yellow;
 }
 </style>
 <div class="clamp">Line 1
 Line 2
-Line 3
-Line 4…</div>
+Line 3</div>
+<div>Line 4…</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-035.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-035.html
index feb4aac618a2..90513d783292 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-035.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-035.html
@@ -1,24 +1,22 @@
 <!DOCTYPE html>
 <meta charset="utf-8">
-<title>CSS Overflow: `line-clamp` with a number and a smaller max-height</title>
+<title>CSS Overflow: when clamping by lines, if the height doesn't fit that number of lines, the clamp point depends on the height instead</title>
 <link rel="author" title="Andreu Botella" href="mailto:abotella@igalia.com">
 <link rel="help" href="https://drafts.csswg.org/css-overflow-4/#line-clamp">
-<link rel="match" href="reference/webkit-line-clamp-005-ref.html">
-<meta name="assert" content="If line-clamp is set to a number, and there is a (max-)height, the line-clamp container will clamp to whichever comes earlier.">
+<link rel="match" href="reference/line-clamp-011-ref.html">
+<meta name="assert" content="When line-clamp is used with a number of lines while also having a max block size, only the line number affects the clamping; content beyond the block size, if any, overflows.">
 <style>
 .clamp {
-  line-clamp: 6;
-  max-height: 4lh;
+  line-clamp: 4;
   font: 16px / 32px serif;
+  max-height: 3lh;
+  padding: 0 4px;
   white-space: pre;
   background-color: yellow;
-  padding: 0 4px;
 }
 </style>
 <div class="clamp">Line 1
 Line 2
 Line 3
 Line 4
-Line 5
-Line 6
-Line 7</div>
+Line 5</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-039-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-039-expected.html
new file mode 100644
index 000000000000..6539eacb51a2
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-039-expected.html
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Reference</title>
+<style>
+#clamp-and-columns {
+  columns: 3;
+  background-color: yellow;
+}
+p {
+  margin: 0;
+}
+</style>
+<div id="clamp-and-columns">
+  <!-- First column -->
+  <p>Line 1</p>
+  <p>Line 2</p>
+  <p>Line 3</p>
+  <!-- Second column -->
+  <p>Line 4</p>
+  <p>Line 5</p>
+  <p>Line 6</p>
+  <!-- Third column -->
+  <p>Line 7</p>
+  <p>Line 8</p>
+  <p>Line 9</p>
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-039.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-039.html
new file mode 100644
index 000000000000..31983e5109c6
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-039.html
@@ -0,0 +1,32 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Overflow: when applied to a multicol container, `line-clamp` does nothing</title>
+<link rel="author" title="Andreu Botella" href="mailto:abotella@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-overflow-4/#line-clamp">
+<link rel="help" href="https://drafts.csswg.org/css-inline-3/#invisible-line-boxes">
+<link rel="match" href="reference/line-clamp-039-ref.html">
+<meta name="assert" content="The `content` property, which is one of the longhands for `line-clamp`, applies to multicol containers. However, the value `collapse`, which is set with all non-`none` `line-clamp` values, acts the same as the initial value `auto` in a multicol container. Therefore, `line-clamp` has no effect in multicol containers.">
+<style>
+#clamp-and-columns {
+  line-clamp: 2;
+  columns: 3;
+  background-color: yellow;
+}
+p {
+  margin: 0;
+}
+</style>
+<div id="clamp-and-columns">
+  <!-- First column -->
+  <p>Line 1</p>
+  <p>Line 2</p>
+  <p>Line 3</p>
+  <!-- Second column -->
+  <p>Line 4</p>
+  <p>Line 5</p>
+  <p>Line 6</p>
+  <!-- Third column -->
+  <p>Line 7</p>
+  <p>Line 8</p>
+  <p>Line 9</p>
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-040-crash.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-040-crash.html
new file mode 100644
index 000000000000..935ee5268ade
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-040-crash.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Overflow: line-clamp ellipsis before block-in-outlined-inline crash</title>
+<link rel="author" title="Andreu Botella" href="mailto:abotella@igalia.com">
+<link rel="help" href="https://crbug.com/499496973">
+<link rel="help" href="https://drafts.csswg.org/css-overflow-4/#line-clamp">
+
+<div style="line-clamp: 1">
+  Line 1
+  <span style="outline: 1px solid black">
+    <div></div>
+  </span>
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-041-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-041-expected.html
new file mode 100644
index 000000000000..1a42019d7869
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-041-expected.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Reference</title>
+<style>
+.clamp {
+  font: 16px / 32px serif;
+  white-space: pre;
+  padding: 0 4px;
+  background-color: yellow;
+}
+</style>
+<div class="clamp">Line 1
+Line 2
+Line 3…</div>
+<p>Following content.</p>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-041.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-041.html
new file mode 100644
index 000000000000..375169f50327
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-041.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Overflow: when clamping by lines and `auto`, if the height doesn't fit that number of lines, the clamp point is set to that height instead</title>
+<link rel="author" title="Andreu Botella" href="mailto:abotella@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-overflow-4/#line-clamp">
+<link rel="match" href="reference/line-clamp-041-ref.html">
+<meta name="assert" content="When line-clamp is used with a number of lines and `auto`, a set block size takes precendence over the number of lines if it comes earlier.">
+<style>
+.clamp {
+  line-clamp: 4 auto;
+  font: 16px / 32px serif;
+  max-height: 3lh;
+  padding: 0 4px;
+  white-space: pre;
+  background-color: yellow;
+}
+</style>
+<div class="clamp">Line 1
+Line 2
+Line 3
+Line 4
+Line 5</div>
+<p>Following content.</p>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-003.tentative-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-042-expected.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-003.tentative-expected.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-042-expected.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-009.tentative.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-042.html
similarity index 53%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-009.tentative.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-042.html
index f25ac381c09d..632578170db8 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-009.tentative.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-042.html
@@ -1,29 +1,23 @@
 <!DOCTYPE html>
 <meta charset="utf-8">
-<title>CSS Overflow: line-clamp IFC with floats after the clamp point</title>
+<title>CSS Overflow: `line-clamp: &lt;number&gt; auto` with a larger max-height</title>
 <link rel="author" title="Andreu Botella" href="mailto:abotella@igalia.com">
 <link rel="help" href="https://drafts.csswg.org/css-overflow-4/#line-clamp">
 <link rel="match" href="reference/webkit-line-clamp-005-ref.html">
-<meta name="assert" content="If the line-clamp container is an independent formatting context, it will not clear any floats after the clamp point.">
+<meta name="assert" content="When line-clamp is used with a number of lines and `auto`, if it has a larger (max-)height than the number of lines, it clamps according to that number of lines.">
 <style>
 .clamp {
-  display: flow-root;
   line-clamp: 4;
   font: 16px / 32px serif;
+  max-height: 5lh;
   padding: 0 4px;
   white-space: pre;
   background-color: yellow;
 }
-.float {
-  float: left;
-  width: 50px;
-  height: 50px;
-  margin: 4px;
-  background-color: skyblue;
-}
 </style>
 <div class="clamp">Line 1
 Line 2
 Line 3
 Line 4
-Line 5<div class="float"></div></div>
+Line 5
+Line 6</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-004.tentative-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-042-expected.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-004.tentative-expected.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-042-expected.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-042.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-042.html
new file mode 100644
index 000000000000..6e01e29a19be
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-042.html
@@ -0,0 +1,34 @@
+<!DOCTYPE html>
+<html>
+<meta charset="utf-8">
+<title>CSS Overflow: height-based clamp point inside min-height block</title>
+<link rel="author" title="Andreu Botella" href="mailto:abotella@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-overflow-4/#line-clamp">
+<link rel="match" href="reference/webkit-line-clamp-005-ref.html">
+<meta name="assert" content="If we're clamping by height, and the clamp point would be inside a nested block, but that block has constraints that increase its height beyond that point, the actual clamp point must be before it.">
+<style>
+.clamp {
+  line-clamp: auto;
+  max-height: 6lh;
+  font: 16px / 32px serif;
+  padding: 0 4px;
+  background-color: yellow;
+}
+.min-height {
+  min-height: 3lh;
+  background-color: red;
+}
+</style>
+<div class="clamp">
+  Line 1<br>
+  Line 2<br>
+  Line 3<br>
+  Line 4
+  <div class="min-height">
+    Line 5 <br>
+    Line 6 <br>
+    Line 7 <br>
+    Line 8
+  </div>
+  Line 9
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-043-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-043-expected.html
new file mode 100644
index 000000000000..885f931e544b
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-043-expected.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<meta charset="utf-8">
+<title>CSS Overflow: test reference</title>
+<style>
+.clamp {
+  background-color: yellow;
+  width: 500px;
+}
+.max-height {
+  max-height: 1lh;
+  text-align: right;
+}
+</style>
+<div class="clamp">
+  <div class="max-height">
+    Line 1 <br>
+    Line 2 <br>
+    Line 3
+  </div>
+  Line B…
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-043.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-043.html
new file mode 100644
index 000000000000..a02463fb2ead
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-043.html
@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<html>
+<meta charset="utf-8">
+<title>CSS Overflow: height-based clamp point inside max-height block</title>
+<link rel="author" title="Andreu Botella" href="mailto:abotella@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-overflow-4/#line-clamp">
+<link rel="match" href="reference/line-clamp-auto-043-ref.html">
+<meta name="assert" content="If we're clamping by height, the clamp point can't be in the overflow of a box inside the line-clamp container, since clamping there would not decrease that box's height.">
+<style>
+.clamp {
+  line-clamp: auto;
+  max-height: 2lh;
+  width: 500px;
+  background-color: yellow;
+}
+.max-height {
+  max-height: 1lh;
+  text-align: right;
+}
+</style>
+
+<div class="clamp">
+  <div class="max-height">
+    Line 1 <br>
+    Line 2 <br>
+    Line 3
+  </div>
+  Line B <br>
+  Line C
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-044-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-044-expected.html
new file mode 100644
index 000000000000..746cf6446785
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-044-expected.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<meta charset="utf-8">
+<title>CSS Overflow: test reference</title>
+<style>
+.clamp {
+  background-color: yellow;
+  height: 3.5lh;
+}
+p {
+  margin: 0;
+}
+</style>
+
+<div class="clamp">
+  <p>Line 1</p>
+  <p>Line 2</p>
+  <div style="min-height: 3lh">Line 3</div>
+  <p>Line 4…</p>
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-044.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-044.html
new file mode 100644
index 000000000000..5e8f7d14ccb2
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-044.html
@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<html>
+<meta charset="utf-8">
+<title>CSS Overflow: interactions between min-height and max-height constraints when line-clamping by height</title>
+<link rel="author" title="Andreu Botella" href="mailto:abotella@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-overflow-4/#line-clamp">
+<link rel="match" href="reference/line-clamp-auto-044-ref.html">
+<meta name="assert" content="Checks that when clamping by height, if there are nested height constraints, the clamp point is correctly chosen to be the last possible clamp point where the height of the line-clamp container wouldn't overflow.">
+<style>
+.clamp {
+  line-clamp: auto;
+  max-height: 4lh;
+  background-color: yellow;
+}
+p {
+  margin: 0;
+}
+</style>
+
+<div class="clamp">
+  <div style="max-height: 3.5lh">
+    <p>Line 1</p>
+    <p>Line 2</p>
+    <!-- If we weren't inside a max-height box, we'd clamp here -->
+    <div style="min-height: 3lh">Line 3</div>
+    <p>Line 4</p>
+  </div>
+  <!-- We actually clamp here, even if the line with the ellipsis has its bottom
+       edge at a height offset of 6lh, clearly overflowing .clamp -->
+  <p>Line 5</p>
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-045-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-045-expected.html
new file mode 100644
index 000000000000..9b4fd5625fa7
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-045-expected.html
@@ -0,0 +1,41 @@
+<!DOCTYPE html>
+<html>
+<meta charset="utf-8">
+<title>CSS Overflow: test reference</title>
+<style>
+  .clamp {
+    display: flow-root;
+    background-color: yellow;
+    width: 300px;
+  }
+  .float {
+    float: right;
+    background-color: pink;
+  }
+  .margin {
+    margin: 0.5lh;
+  }
+  .abspos {
+    position: absolute;
+    background-color: green;
+    left: auto;
+    right: auto;
+  }
+</style>
+<div class="clamp">
+  Line 1<br>
+  Line 2<br>
+  Line 3<br>
+  <div class="float">
+    Line A <br>
+    Line B
+  </div>
+  Line 4<br>
+  <div class="margin">
+    <div class="margin" style="min-height: 0.5lh">
+      <div class="margin" style="clear: right;">
+        <div class="abspos">Abspos</div>
+      </div>
+    </div>
+  </div>
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-045.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-045.html
new file mode 100644
index 000000000000..23c39c181dbf
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-045.html
@@ -0,0 +1,49 @@
+<!DOCTYPE html>
+<html>
+<meta charset="utf-8">
+<title>CSS Overflow: margin collapsing, clearance and min-height when clamping by height</title>
+<link rel="author" title="Andreu Botella" href="mailto:abotella@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-overflow-4/#line-clamp">
+<link rel="match" href="reference/line-clamp-auto-045-ref.html">
+<meta name="assert" content="Checks the interaction of min-height, margin collapsing, and float clearance in boxes inside a by-height line-clamp container.">
+<style>
+  .clamp {
+    line-clamp: auto;
+    max-height: 6lh;
+    background-color: yellow;
+    width: 300px;
+  }
+  .float {
+    float: right;
+    background-color: pink;
+  }
+  .margin {
+    margin: 0.5lh;
+  }
+  .abspos {
+    position: absolute;
+    background-color: green;
+    left: auto;
+    right: auto;
+  }
+</style>
+<div class="clamp">
+  Line 1<br>
+  Line 2<br>
+  Line 3<br>
+  <div class="float">
+    Line A <br>
+    Line B
+  </div>
+  Line 4<br>
+  <div class="margin">
+    <div class="margin" style="min-height: 0.5lh">
+      <div class="margin" style="clear: right;">
+        <div class="abspos">Abspos</div>
+      </div>
+      Line 5
+    </div>
+  </div>
+  Line 6 <br>
+  Line 7
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-046-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-046-expected.html
new file mode 100644
index 000000000000..705f2b0e3e52
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-046-expected.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html>
+<meta charset="utf-8">
+<title>CSS Overflow: test reference</title>
+<style>
+.clamp {
+  line-clamp: auto;
+  width: 500px;
+  background-color: yellow;
+}
+.size-containment {
+  height: 0;
+  text-align: right;
+}
+</style>
+
+<div class="clamp">
+  <div class="size-containment">
+    Line A <br>
+    Line B <br>
+    Line C <br>
+    Line D <br>
+    Line E <br>
+  </div>
+  Line 1 <br>
+  Line 2 <br>
+  Line 3 <br>
+  Line 4…
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-046.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-046.html
new file mode 100644
index 000000000000..56eab2d033e8
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-046.html
@@ -0,0 +1,35 @@
+<!DOCTYPE html>
+<html>
+<meta charset="utf-8">
+<title>CSS Overflow: size containment inside clamping by height</title>
+<link rel="author" title="Andreu Botella" href="mailto:abotella@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-overflow-4/#line-clamp">
+<link rel="match" href="reference/line-clamp-auto-046-ref.html">
+<meta name="assert" content="Checks that when clamping by height, size contained boxes with no height constraints behave as if they had `height: 0`">
+<style>
+.clamp {
+  line-clamp: auto;
+  max-height: 4lh;
+  width: 500px;
+  background-color: yellow;
+}
+.size-containment {
+  contain: size;
+  text-align: right;
+}
+</style>
+
+<div class="clamp">
+  <div class="size-containment">
+    Line A <br>
+    Line B <br>
+    Line C <br>
+    Line D <br>
+    Line E <br>
+  </div>
+  Line 1 <br>
+  Line 2 <br>
+  Line 3 <br>
+  Line 4 <br>
+  Line 5 <br>
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-047-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-047-expected.html
new file mode 100644
index 000000000000..b934b7e6d2d3
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-047-expected.html
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<html>
+<meta charset="utf-8">
+<title>CSS Overflow: test reference</title>
+<style>
+.clamp {
+  line-clamp: auto;
+  width: 500px;
+  background-color: yellow;
+}
+.size-containment {
+  height: 2lh;
+  text-align: right;
+  border: 1px solid black;
+}
+</style>
+
+<div class="clamp">
+  <div class="size-containment">
+    Line A <br>
+    Line B <br>
+    Line C <br>
+    Line D <br>
+    Line E <br>
+  </div>
+  Line 1 <br>
+  Line 2…
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-047.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-047.html
new file mode 100644
index 000000000000..0b2f38e5303f
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-047.html
@@ -0,0 +1,42 @@
+<!DOCTYPE html>
+<html>
+<meta charset="utf-8">
+<title>CSS Overflow: size containment inside clamping by height</title>
+<link rel="author" title="Andreu Botella" href="mailto:abotella@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-overflow-4/#line-clamp">
+<link rel="match" href="reference/line-clamp-auto-047-ref.html">
+<meta name="assert" content="Checks that when clamping by height, size contained boxes with `min-height` set behave as if they had `height` set to that value.">
+<style>
+.clamp {
+  line-clamp: auto;
+  max-height: 4.5lh;
+  width: 500px;
+  background-color: yellow;
+}
+.size-containment {
+  contain: size;
+  min-height: 2lh;
+  text-align: right;
+  border: 1px solid black;
+}
+</style>
+
+<div class="clamp">
+  <div class="size-containment">
+    Line A <br>
+    Line B <br>
+    Line C <br>
+    Line D <br>
+    Line E <br>
+  </div>
+  Line 1 <br>
+  Line 2
+  <div class="size-containment">
+    Line A <br>
+    Line B <br>
+    Line C <br>
+    Line D <br>
+    Line E <br>
+  </div>
+  Line 3
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-bfc-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-bfc-expected.html
new file mode 100644
index 000000000000..5a06131234fc
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-bfc-expected.html
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>A line-clamp container must establish an independent block formatting context</title>
+<link rel="help" href="https://bugzilla.mozilla.org/show_bug.cgi?id=2042999">
+<link rel="help" href="https://drafts.csswg.org/css-overflow-4/#line-clamp-containers">
+<link rel="author" title="Seva Alipov" href="mailto:salipov@mozilla.com">
+<link rel="stylesheet" href="/fonts/ahem.css">
+<style>
+.clamp-box {
+  border: 1px solid;
+  width: 50px;
+  height: fit-content;
+  display: flow-root;
+  font-family: ahem;
+}
+.float {
+  float: left;
+  width: 100px;
+  height: 100px;
+  border: 1px solid black;
+  padding: 10px;
+  font-family: ahem;
+}
+</style>
+<div class="outer">
+<div class="float">F</div>
+<div class="clamp-box">A&hellip;</div>
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-bfc-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-bfc-ref.html
new file mode 100644
index 000000000000..5a06131234fc
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-bfc-ref.html
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>A line-clamp container must establish an independent block formatting context</title>
+<link rel="help" href="https://bugzilla.mozilla.org/show_bug.cgi?id=2042999">
+<link rel="help" href="https://drafts.csswg.org/css-overflow-4/#line-clamp-containers">
+<link rel="author" title="Seva Alipov" href="mailto:salipov@mozilla.com">
+<link rel="stylesheet" href="/fonts/ahem.css">
+<style>
+.clamp-box {
+  border: 1px solid;
+  width: 50px;
+  height: fit-content;
+  display: flow-root;
+  font-family: ahem;
+}
+.float {
+  float: left;
+  width: 100px;
+  height: 100px;
+  border: 1px solid black;
+  padding: 10px;
+  font-family: ahem;
+}
+</style>
+<div class="outer">
+<div class="float">F</div>
+<div class="clamp-box">A&hellip;</div>
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-bfc.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-bfc.html
new file mode 100644
index 000000000000..9fa2ece1abd5
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-bfc.html
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>A line-clamp container must establish an independent block formatting context</title>
+<link rel="help" href="https://bugzilla.mozilla.org/show_bug.cgi?id=2042999">
+<link rel="help" href="https://drafts.csswg.org/css-overflow-4/#line-clamp-containers">
+<link rel="author" title="Seva Alipov" href="mailto:salipov@mozilla.com">
+<link rel="match" href="line-clamp-bfc-ref.html">
+<link rel="stylesheet" href="/fonts/ahem.css">
+<style>
+.clamp-box {
+  border: 1px solid;
+  width: 50px;
+  overflow: clip;
+  line-clamp: 1;
+  font-family: ahem;
+}
+.float {
+  float: left;
+  width: 100px;
+  height: 100px;
+  border: 1px solid black;
+  padding: 10px;
+  font-family: ahem;
+}
+</style>
+<div class="float">F</div>
+<!-- .clamp-box should exclude .float -->
+<div class="clamp-box">A<br>B</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-001.tentative-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-001-expected.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-001.tentative-expected.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-001-expected.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-001.tentative.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-001.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-001.tentative.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-001.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-002.tentative-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-002-expected.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-002.tentative-expected.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-002-expected.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-002.tentative.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-002.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-002.tentative.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-002.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-009.tentative-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-003-expected.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-009.tentative-expected.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-003-expected.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-003.tentative.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-003.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-003.tentative.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-003.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-with-floats-008-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-004-expected.html
similarity index 58%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-with-floats-008-ref.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-004-expected.html
index 50b3d53900e2..c9a9ae5d7ffe 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-with-floats-008-ref.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-004-expected.html
@@ -3,21 +3,15 @@
 <title>CSS Reference</title>
 <style>
 .clamp {
-  display: flow-root;
+  display: -webkit-box;
+  -webkit-box-orient: vertical;
   font: 16px / 32px serif;
-  padding: 0 4px;
   white-space: pre;
+  padding: 0 4px;
   background-color: yellow;
 }
-.float {
-  float: left;
-  width: 50px;
-  height: 50px;
-  margin: 4px;
-  background-color: skyblue;
-}
 </style>
 <div class="clamp">Line 1
 Line 2
 Line 3
-<div class="float"></div>Line 4…</div>
+Line 4…</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-004.tentative.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-004.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-004.tentative.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-004.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-005.tentative-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-005-expected.html
similarity index 78%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-005.tentative-expected.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-005-expected.html
index d20d6c53ddee..e3ebd7baac6d 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-005.tentative-expected.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-005-expected.html
@@ -2,22 +2,27 @@
 <meta charset="utf-8">
 <title>CSS Reference</title>
 <style>
+.parent {
+  padding: 4px;
+  background-color: yellow;
+}
 .clamp {
-  display: flow-root;
   font: 16px / 32px serif;
-  padding: 0 4px;
   white-space: pre;
-  background-color: yellow;
+  overflow: clip;
 }
 .float {
   float: left;
   width: 50px;
   height: 50px;
   margin: 4px;
+  margin-bottom: 0;
   background-color: skyblue;
 }
 </style>
+<div class="parent">
 <div class="clamp">Line 1
 Line 2
 Line 3
 Line 4…<div class="float"></div></div>
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-005.tentative.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-005.html
similarity index 83%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-005.tentative.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-005.html
index 9689a83fa7f9..81831a5e393d 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-005.tentative.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-005.html
@@ -4,12 +4,12 @@
 <link rel="author" title="Andreu Botella" href="mailto:abotella@igalia.com">
 <link rel="help" href="https://drafts.csswg.org/css-overflow-4/#line-clamp">
 <link rel="match" href="reference/line-clamp-with-floats-005-ref.html">
-<meta name="assert" content="Floats in an inline formatting context inside a line-clamp container are not hidden if they come before the clamp point, even if they extend beyond that point">
+<meta name="assert" content="Floats in an inline formatting context before the clamp point are not hidden, but they are clipped to the line-clamp container's content edge">
 <style>
 .clamp {
   line-clamp: 4;
   font: 16px / 32px serif;
-  padding: 0 4px;
+  padding: 4px;
   white-space: pre;
   background-color: yellow;
 }
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-008-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-006-expected.html
similarity index 69%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-008-expected.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-006-expected.html
index 50b3d53900e2..e3ebd7baac6d 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-008-expected.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-006-expected.html
@@ -2,22 +2,27 @@
 <meta charset="utf-8">
 <title>CSS Reference</title>
 <style>
+.parent {
+  padding: 4px;
+  background-color: yellow;
+}
 .clamp {
-  display: flow-root;
   font: 16px / 32px serif;
-  padding: 0 4px;
   white-space: pre;
-  background-color: yellow;
+  overflow: clip;
 }
 .float {
   float: left;
   width: 50px;
   height: 50px;
   margin: 4px;
+  margin-bottom: 0;
   background-color: skyblue;
 }
 </style>
+<div class="parent">
 <div class="clamp">Line 1
 Line 2
 Line 3
-<div class="float"></div>Line 4…</div>
+Line 4…<div class="float"></div></div>
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-006.tentative.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-006.html
similarity index 77%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-006.tentative.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-006.html
index 0a709bff198f..c5608159f6f4 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-006.tentative.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-006.html
@@ -3,13 +3,13 @@
 <title>CSS Overflow: float in line-clamp before clamp point which extends past it</title>
 <link rel="author" title="Andreu Botella" href="mailto:abotella@igalia.com">
 <link rel="help" href="https://drafts.csswg.org/css-overflow-4/#line-clamp">
-<link rel="match" href="reference/line-clamp-with-floats-006-ref.html">
-<meta name="assert" content="Floats in a block formatting context inside a line-clamp container are not hidden if they come before the clamp point, even if they extend beyond that point">
+<link rel="match" href="reference/line-clamp-with-floats-005-ref.html">
+<meta name="assert" content="Floats in a block formatting context before the clamp point are not hidden, but they are clipped to the line-clamp container's content edge">
 <style>
 .clamp {
   line-clamp: 4;
   font: 16px / 32px serif;
-  padding: 0 4px;
+  padding: 4px;
   background-color: yellow;
 }
 .float {
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-006.tentative-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-006.tentative-expected.html
deleted file mode 100644
index 9288c4e36f92..000000000000
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-006.tentative-expected.html
+++ /dev/null
@@ -1,28 +0,0 @@
-<!DOCTYPE html>
-<meta charset="utf-8">
-<title>CSS Reference</title>
-<style>
-.clamp {
-  display: flow-root;
-  font: 16px / 32px serif;
-  padding: 0 4px;
-  background-color: yellow;
-}
-.float {
-  float: left;
-  width: 50px;
-  height: 75px;
-  margin: 4px;
-  background-color: skyblue;
-}
-.pre {
-  white-space: pre;
-}
-</style>
-<div class="clamp">
-<div class="pre">Line 1
-Line 2
-Line 3</div>
-<div class="float"></div>
-<div class="pre">Line 4…</div>
-</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-007.tentative-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-007-expected.html
similarity index 67%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-007.tentative-expected.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-007-expected.html
index 6d5390246b4d..56a74d934927 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-007.tentative-expected.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-007-expected.html
@@ -2,25 +2,30 @@
 <meta charset="utf-8">
 <title>CSS Reference</title>
 <style>
+.parent {
+  padding: 4px;
+  background-color: yellow;
+}
 .clamp {
-  display: flow-root;
   font: 16px / 32px serif;
-  padding: 0 4px;
   white-space: pre;
-  background-color: yellow;
+  overflow: clip;
 }
 .float {
   float: left;
   margin: 4px;
   white-space: pre;
   background-color: skyblue;
+  line-height: 1em;
 }
 </style>
+<div class="parent">
 <div class="clamp">Line 1
 Line 2
-Line 3
-Line 4…<div class="float">Line A
+Line 3<div class="float">Line A
 Line B
 Line C
 Line D
-Line E</div></div>
+Line E</div>
+Line 4…</div>
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-007.tentative.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-007.html
similarity index 90%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-007.tentative.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-007.html
index 7ee286fbf43b..b6b7e1c03a18 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-007.tentative.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-007.html
@@ -9,7 +9,7 @@
 .clamp {
   line-clamp: 4;
   font: 16px / 32px serif;
-  padding: 0 4px;
+  padding: 4px;
   white-space: pre;
   background-color: yellow;
 }
@@ -18,14 +18,15 @@
   margin: 4px;
   white-space: pre;
   background-color: skyblue;
+  line-height: 1em;
 }
 </style>
 <div class="clamp">Line 1
 Line 2
-Line 3
-Line 4<div class="float">Line A
+Line 3<div class="float">Line A
 Line B
 Line C
 Line D
 Line E</div>
+Line 4
 Line 5</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-008.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-008.html
deleted file mode 100644
index 9ee8a05396d7..000000000000
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-008.html
+++ /dev/null
@@ -1,31 +0,0 @@
-<!DOCTYPE html>
-<meta charset="utf-8">
-<title>CSS Overflow: line-clamp IFC with floats extending past the clamp point</title>
-<link rel="author" title="Andreu Botella" href="mailto:abotella@igalia.com">
-<link rel="help" href="https://drafts.csswg.org/css-overflow-4/#line-clamp">
-<link rel="match" href="reference/line-clamp-with-floats-008-ref.html">
-<meta name="assert" content="Line-clamp containers create an independent formatting context, so they will clear contained floats before the clamp point, even if they extend beyond the last line. Lines past the clamp point will remain hidden.">
-<style>
-.clamp {
-  line-clamp: 4;
-  font: 16px / 32px serif;
-  padding: 0 4px;
-  white-space: pre;
-  background-color: yellow;
-}
-.float {
-  /* Floats create a parallel fragmentation context, and the forced break that
-   * line-clamp causes on the main context should not cause the float to
-   * fragment. */
-  float: left;
-  width: 50px;
-  height: 50px;
-  margin: 4px;
-  background-color: skyblue;
-}
-</style>
-<div class="clamp">Line 1
-Line 2
-Line 3
-<div class="float"></div>Line 4
-Line 5</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-010.tentative-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-010-expected.html
similarity index 65%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-010.tentative-expected.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-010-expected.html
index 12b8cdc441a6..d4fbf4b4dbf2 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-010.tentative-expected.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-010-expected.html
@@ -3,13 +3,15 @@
 <title>CSS Reference</title>
 <style>
 #scrollContainer {
-  overflow: scroll;
+  overflow: hidden;
   font: 16px / 32px serif;
-  height: 4lh;
   border: 1px solid black;
 }
+.parent {
+  overflow: hidden;
+  height: 4lh;
+}
 .clamp {
-  display: flow-root;
   padding: 0 4px;
   white-space: pre;
   background-color: yellow;
@@ -24,14 +26,9 @@
 </style>
 
 <div id="scrollContainer">
+<div class="parent">
 <div class="clamp">Line 1
 Line 2
 Line 3
 Line 4…<div class="float"></div></div>
-
-<script>
-  window.addEventListener("load", () => {
-    const scrollContainer = document.getElementById("scrollContainer");
-    scrollContainer.scrollTop = scrollContainer.scrollHeight;
-  });
-</script>
+</div></div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-010.tentative.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-010.html
similarity index 70%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-010.tentative.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-010.html
index a00ff6017125..c74f75d9e66c 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-010.tentative.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-010.html
@@ -1,13 +1,13 @@
 <!DOCTYPE html>
 <meta charset="utf-8">
-<title>CSS Overflow: line-clamp hidden floats should count as ink overflow</title>
+<title>CSS Overflow: line-clamp hidden and clipped floats don't count as scrollable overflow</title>
 <link rel="author" title="Andreu Botella" href="mailto:abotella@igalia.com">
 <link rel="help" href="https://drafts.csswg.org/css-overflow-4/#line-clamp">
 <link rel="match" href="reference/line-clamp-with-floats-010-ref.html">
-<meta name="assert" content="Any overflowing content hidden from paint by line-clamp is treated as ink overflow, including floats, and therefore doesn't cause the scrollable overflow rectangle to grow. Meanwhile, non-hidden floats count as scrollable overflow.">
+<meta name="assert" content="Neither floats entirely hidden from paint by line-clamp, nor pieces of floats that get clipped away from the line-clamp container's padding edge count as scrollable overflow. Therefore, they don't increase the scrollable overflow area.">
 <style>
 #scrollContainer {
-  overflow: scroll;
+  overflow: hidden;
   font: 16px / 32px serif;
   height: 4lh;
   border: 1px solid black;
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-015-expected.xht b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-011-expected.xht
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-015-expected.xht
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-011-expected.xht
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-011.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-011.html
new file mode 100644
index 000000000000..e410eaa4b487
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-011.html
@@ -0,0 +1,38 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Overflow: line-clamp hidden and clipped floats don't count as scrollable overflow</title>
+<link rel="author" title="Florian Rivoal" href="https://florian.rivoal.net">
+<link rel="help" href="https://drafts.csswg.org/css-overflow-4/#line-clamp">
+<link rel="help" href="https://drafts.csswg.org/css-overflow-4/#line-clamp-containers">
+<link rel="match" href="/css/reference/ref-filled-green-100px-square.xht">
+<meta name="assert" content="Floats are clipped to the *unshaped* block-end content edge of the line-clamp container">
+<style>
+.red { /* checks that we don't clip horizontally nor apply any shaping to the clipping */
+    width: 100px;
+    height: 100px;
+    background: red;
+    position: absolute;
+    z-index: -1;
+}
+.container {
+    line-clamp: auto;
+    height: 100px;
+    margin-left: 25px;
+    padding-left: 25px;
+    border-radius: 50px;
+    padding-bottom: 20px;
+}
+aside {
+    float: left;
+    margin-left: -50px;
+    width: 100px;
+    background: linear-gradient(to bottom, green 0, green 100px, red 100px); /* checks that we do clip vertically */
+    height: 200px;
+}
+</style>
+
+<p>Test passes if there is a filled green square and <strong>no red</strong>.
+
+<div class=red></div>
+
+<div class=container><aside></aside></container>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-020-expected.xht b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-012-expected.xht
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-020-expected.xht
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-012-expected.xht
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-012.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-012.html
new file mode 100644
index 000000000000..524eec50d3cf
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-012.html
@@ -0,0 +1,58 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Overflow: line-clamp clips floats at the block-end only</title>
+<link rel="author" title="Florian Rivoal" href="https://florian.rivoal.net">
+<link rel="help" href="https://drafts.csswg.org/css-overflow-4/#line-clamp-containers">
+<link rel="match" href="/css/reference/ref-filled-green-100px-square.xht">
+<link rel="stylesheet" href="/fonts/ahem.css">
+<meta name="assert" content="Within a line-clamp container, floats which have not been made into invisible boxes must be visually clipped to the block-end content edge of the line-clamp container. Overflow in other directions is not clipped.">
+<style>
+div {
+    font: 20px/20px Ahem, monospace;
+}
+.test {
+    margin-left: 1ch;
+    padding-top: 1lh;
+    width: 3ch;
+    line-clamp: 4;
+    color: green;
+}
+aside {
+    width: 2ch;
+}
+.ne, .se {
+    float: right;
+    margin-right: -1ch;
+}
+.ne, .nw {
+    margin-top: -2lh;
+}
+.nw, .sw {
+    float: left;
+    margin-left: -1ch;
+}
+a.se { display: none; }
+span.red {
+    color: red;
+}
+div.backdrop {
+    color: green;
+    background: red;
+    position: absolute;
+    z-index: -1;
+    width: 5ch;
+    height: 5lh;
+}
+</style>
+
+<p>Test passes if there is a filled green square and <strong>no red</strong>.</p>
+
+<div class=backdrop>..X</div>
+<div class=test>
+    AAA
+    <aside class=nw>BB CC DD</aside>X<aside class=ne>EE FF GG</aside>
+    <aside class=sw>HH II <span class=red>JJ</span></aside>K<aside class=se>LL MM <span class=red>NN</span></aside>
+    OOO
+    <span class=red>P</span>
+</div>
+
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/block-ellipsis-034-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/block-ellipsis-034-ref.html
new file mode 100644
index 000000000000..0b7fb78a9535
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/block-ellipsis-034-ref.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Test reference</title>
+<link rel="author" title="Florian Rivoal" href="https::/florian.rivoal.net">
+<style>
+p {
+  font-family: monospace;
+}
+</style>
+
+<p>Test passes if there is no red)
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/block-ellipsis-035-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/block-ellipsis-035-ref.html
new file mode 100644
index 000000000000..f50980a2cce3
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/block-ellipsis-035-ref.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Test reference</title>
+<link rel="author" title="Florian Rivoal" href="https::/florian.rivoal.net">
+<style>
+p {
+  font-family: monospace;
+  white-space: pre;
+}
+.blue { color: blue; }
+</style>
+
+<p>Test passes if there are <em>two</em> lines of text, and the second
+line ends with a blue word followed by a closing <span class=blue>parenthesis</span>)
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/block-ellipsis-038-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/block-ellipsis-038-ref.html
new file mode 100644
index 000000000000..5f6dc1ae8990
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/block-ellipsis-038-ref.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Overflow: non-empty custom block ellipsis reference</title>
+<style>
+.clamp {
+  font: 20px/1 monospace;
+  width: 20ch;
+}
+</style>
+<div class="clamp">First line<br>PASS CUSTOM</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/block-ellipsis-039-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/block-ellipsis-039-ref.html
new file mode 100644
index 000000000000..0f44c45f03fe
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/block-ellipsis-039-ref.html
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Test reference</title>
+<link rel="author" title="Florian Rivoal" href="https://florian.rivoal.net">
+<style>
+.ref {
+    width: min-content;
+    float: left;
+    border: solid 1px;
+    margin: 0 1ch;
+}
+.tall {
+    font-size: 2em;
+    line-height: 2;
+}
+</style>
+
+<p>This test passes if the two boxes below are identical, including having the same height.
+
+<div class=ref>
+    <span class=tall>TEST</span>
+    …
+</div>
+<div class=ref>
+    <span class=tall>TEST</span>
+    …
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/block-ellipsis-041-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/block-ellipsis-041-ref.html
new file mode 100644
index 000000000000..2dc26d84ba65
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/block-ellipsis-041-ref.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Test reference</title>
+<link rel="author" title="Florian Rivoal" href="https://florian.rivoal.net">
+<style>
+.test {
+    font-family: monospace;
+}
+aside {
+    float: left;
+    width: 1ch;
+    height: 1lh;
+}
+.red { color: red; }
+</style>
+
+<p>Test passes if there is a “…” below and <strong>no red</strong>.
+
+<div class=test>
+    <aside></aside>…
+</div>
+
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/block-ellipsis-bidi-002-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/block-ellipsis-bidi-002-ref.html
new file mode 100644
index 000000000000..76231c06e96f
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/block-ellipsis-bidi-002-ref.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Test reference</title>
+<link rel="author" title="Florian Rivoal" href="https://florian.rivoal.net">
+<style>
+div {
+    font-family: monospace;
+    unicode-bidi: plaintext;
+    width: 14ch;
+}
+</style>
+
+<p>Test passes if there is no red,
+and there is an ellipsis character (“…”) on the <em>left</em> side
+of the of second line of the text below.
+
+<div>
+        Story time:<br>
+        "روزی روزگاری…
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/block-ellipsis-bidi-003-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/block-ellipsis-bidi-003-ref.html
new file mode 100644
index 000000000000..922d2e9dc505
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/block-ellipsis-bidi-003-ref.html
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Test referenec</title>
+<link rel="author" title="Florian Rivoal" href="https://florian.rivoal.net">
+<style>
+body {
+    max-width: 80ch;
+}
+div {
+    font-family: monospace;
+    unicode-bidi: plaintext;
+    width: 25ch;
+}
+.test { border: solid blue 5px; }
+.ref { border: solid orange 5px; }
+
+</style>
+
+<p>Test passes if the text in the blue box matches the one in the orange box.
+
+<div class=test>
+    Story time:<br>
+    روزی روزگاری… (continued)
+</div>
+<div class=ref>
+    Story time:<br>
+    روزی روزگاری… (continued)
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/block-ellipsis-bidi-004-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/block-ellipsis-bidi-004-ref.html
new file mode 100644
index 000000000000..589212417405
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/block-ellipsis-bidi-004-ref.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Test reference</title>
+<link rel="author" title="Florian Rivoal" href="https://florian.rivoal.net">
+<style>
+div {
+    font-family: monospace;
+    width: 19ch;
+}
+.test { border: solid blue 5px; }
+.ref { border: solid orange 5px; }
+
+</style>
+
+<p>Test passes if the text in the blue box matches the one in the orange box.
+
+<div class=test>
+    He said "سلام" <bdi dir=rtl>…آخرہ</bdi>
+</div>
+<div class=ref>
+    He said "سلام" <bdi dir=rtl>…آخرہ</bdi>
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-011-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-011-ref.html
index 02ef71d56193..d318a3e662f8 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-011-ref.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-011-ref.html
@@ -2,15 +2,17 @@
 <meta charset="utf-8">
 <title>CSS Reference</title>
 <style>
-.clamp {
+div {
   font: 16px / 32px serif;
   white-space: pre;
-  height: 3lh;
   padding: 0 4px;
+}
+.clamp {
+  height: 3lh;
   background-color: yellow;
 }
 </style>
 <div class="clamp">Line 1
 Line 2
-Line 3…</div>
-<p>Following content.</p>
+Line 3</div>
+<div>Line 4…</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-026-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-026-ref.html
index b6e816f997c2..9c0772c2782b 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-026-ref.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-026-ref.html
@@ -3,6 +3,7 @@
 <title>CSS Reference</title>
 <style>
 .clamp {
+  overflow: hidden;
   font: 16px / 32px serif;
   white-space: pre-wrap;
 }
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-039-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-039-ref.html
new file mode 100644
index 000000000000..6539eacb51a2
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-039-ref.html
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Reference</title>
+<style>
+#clamp-and-columns {
+  columns: 3;
+  background-color: yellow;
+}
+p {
+  margin: 0;
+}
+</style>
+<div id="clamp-and-columns">
+  <!-- First column -->
+  <p>Line 1</p>
+  <p>Line 2</p>
+  <p>Line 3</p>
+  <!-- Second column -->
+  <p>Line 4</p>
+  <p>Line 5</p>
+  <p>Line 6</p>
+  <!-- Third column -->
+  <p>Line 7</p>
+  <p>Line 8</p>
+  <p>Line 9</p>
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-041-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-041-ref.html
new file mode 100644
index 000000000000..1a42019d7869
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-041-ref.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Reference</title>
+<style>
+.clamp {
+  font: 16px / 32px serif;
+  white-space: pre;
+  padding: 0 4px;
+  background-color: yellow;
+}
+</style>
+<div class="clamp">Line 1
+Line 2
+Line 3…</div>
+<p>Following content.</p>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-auto-043-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-auto-043-ref.html
new file mode 100644
index 000000000000..885f931e544b
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-auto-043-ref.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<meta charset="utf-8">
+<title>CSS Overflow: test reference</title>
+<style>
+.clamp {
+  background-color: yellow;
+  width: 500px;
+}
+.max-height {
+  max-height: 1lh;
+  text-align: right;
+}
+</style>
+<div class="clamp">
+  <div class="max-height">
+    Line 1 <br>
+    Line 2 <br>
+    Line 3
+  </div>
+  Line B…
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-auto-044-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-auto-044-ref.html
new file mode 100644
index 000000000000..746cf6446785
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-auto-044-ref.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<meta charset="utf-8">
+<title>CSS Overflow: test reference</title>
+<style>
+.clamp {
+  background-color: yellow;
+  height: 3.5lh;
+}
+p {
+  margin: 0;
+}
+</style>
+
+<div class="clamp">
+  <p>Line 1</p>
+  <p>Line 2</p>
+  <div style="min-height: 3lh">Line 3</div>
+  <p>Line 4…</p>
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-auto-045-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-auto-045-ref.html
new file mode 100644
index 000000000000..9b4fd5625fa7
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-auto-045-ref.html
@@ -0,0 +1,41 @@
+<!DOCTYPE html>
+<html>
+<meta charset="utf-8">
+<title>CSS Overflow: test reference</title>
+<style>
+  .clamp {
+    display: flow-root;
+    background-color: yellow;
+    width: 300px;
+  }
+  .float {
+    float: right;
+    background-color: pink;
+  }
+  .margin {
+    margin: 0.5lh;
+  }
+  .abspos {
+    position: absolute;
+    background-color: green;
+    left: auto;
+    right: auto;
+  }
+</style>
+<div class="clamp">
+  Line 1<br>
+  Line 2<br>
+  Line 3<br>
+  <div class="float">
+    Line A <br>
+    Line B
+  </div>
+  Line 4<br>
+  <div class="margin">
+    <div class="margin" style="min-height: 0.5lh">
+      <div class="margin" style="clear: right;">
+        <div class="abspos">Abspos</div>
+      </div>
+    </div>
+  </div>
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-auto-046-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-auto-046-ref.html
new file mode 100644
index 000000000000..705f2b0e3e52
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-auto-046-ref.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html>
+<meta charset="utf-8">
+<title>CSS Overflow: test reference</title>
+<style>
+.clamp {
+  line-clamp: auto;
+  width: 500px;
+  background-color: yellow;
+}
+.size-containment {
+  height: 0;
+  text-align: right;
+}
+</style>
+
+<div class="clamp">
+  <div class="size-containment">
+    Line A <br>
+    Line B <br>
+    Line C <br>
+    Line D <br>
+    Line E <br>
+  </div>
+  Line 1 <br>
+  Line 2 <br>
+  Line 3 <br>
+  Line 4…
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-auto-047-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-auto-047-ref.html
new file mode 100644
index 000000000000..b934b7e6d2d3
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-auto-047-ref.html
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<html>
+<meta charset="utf-8">
+<title>CSS Overflow: test reference</title>
+<style>
+.clamp {
+  line-clamp: auto;
+  width: 500px;
+  background-color: yellow;
+}
+.size-containment {
+  height: 2lh;
+  text-align: right;
+  border: 1px solid black;
+}
+</style>
+
+<div class="clamp">
+  <div class="size-containment">
+    Line A <br>
+    Line B <br>
+    Line C <br>
+    Line D <br>
+    Line E <br>
+  </div>
+  Line 1 <br>
+  Line 2…
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-with-floats-005-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-with-floats-005-ref.html
index d20d6c53ddee..e3ebd7baac6d 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-with-floats-005-ref.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-with-floats-005-ref.html
@@ -2,22 +2,27 @@
 <meta charset="utf-8">
 <title>CSS Reference</title>
 <style>
+.parent {
+  padding: 4px;
+  background-color: yellow;
+}
 .clamp {
-  display: flow-root;
   font: 16px / 32px serif;
-  padding: 0 4px;
   white-space: pre;
-  background-color: yellow;
+  overflow: clip;
 }
 .float {
   float: left;
   width: 50px;
   height: 50px;
   margin: 4px;
+  margin-bottom: 0;
   background-color: skyblue;
 }
 </style>
+<div class="parent">
 <div class="clamp">Line 1
 Line 2
 Line 3
 Line 4…<div class="float"></div></div>
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-with-floats-006-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-with-floats-006-ref.html
deleted file mode 100644
index 9288c4e36f92..000000000000
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-with-floats-006-ref.html
+++ /dev/null
@@ -1,28 +0,0 @@
-<!DOCTYPE html>
-<meta charset="utf-8">
-<title>CSS Reference</title>
-<style>
-.clamp {
-  display: flow-root;
-  font: 16px / 32px serif;
-  padding: 0 4px;
-  background-color: yellow;
-}
-.float {
-  float: left;
-  width: 50px;
-  height: 75px;
-  margin: 4px;
-  background-color: skyblue;
-}
-.pre {
-  white-space: pre;
-}
-</style>
-<div class="clamp">
-<div class="pre">Line 1
-Line 2
-Line 3</div>
-<div class="float"></div>
-<div class="pre">Line 4…</div>
-</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-with-floats-007-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-with-floats-007-ref.html
index 6d5390246b4d..56a74d934927 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-with-floats-007-ref.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-with-floats-007-ref.html
@@ -2,25 +2,30 @@
 <meta charset="utf-8">
 <title>CSS Reference</title>
 <style>
+.parent {
+  padding: 4px;
+  background-color: yellow;
+}
 .clamp {
-  display: flow-root;
   font: 16px / 32px serif;
-  padding: 0 4px;
   white-space: pre;
-  background-color: yellow;
+  overflow: clip;
 }
 .float {
   float: left;
   margin: 4px;
   white-space: pre;
   background-color: skyblue;
+  line-height: 1em;
 }
 </style>
+<div class="parent">
 <div class="clamp">Line 1
 Line 2
-Line 3
-Line 4…<div class="float">Line A
+Line 3<div class="float">Line A
 Line B
 Line C
 Line D
-Line E</div></div>
+Line E</div>
+Line 4…</div>
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-with-floats-010-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-with-floats-010-ref.html
index 12b8cdc441a6..d4fbf4b4dbf2 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-with-floats-010-ref.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-with-floats-010-ref.html
@@ -3,13 +3,15 @@
 <title>CSS Reference</title>
 <style>
 #scrollContainer {
-  overflow: scroll;
+  overflow: hidden;
   font: 16px / 32px serif;
-  height: 4lh;
   border: 1px solid black;
 }
+.parent {
+  overflow: hidden;
+  height: 4lh;
+}
 .clamp {
-  display: flow-root;
   padding: 0 4px;
   white-space: pre;
   background-color: yellow;
@@ -24,14 +26,9 @@
 </style>
 
 <div id="scrollContainer">
+<div class="parent">
 <div class="clamp">Line 1
 Line 2
 Line 3
 Line 4…<div class="float"></div></div>
-
-<script>
-  window.addEventListener("load", () => {
-    const scrollContainer = document.getElementById("scrollContainer");
-    scrollContainer.scrollTop = scrollContainer.scrollHeight;
-  });
-</script>
+</div></div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/w3c-import.log b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/w3c-import.log
index 32f977e1da10..2e898babb7de 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/w3c-import.log
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/w3c-import.log
@@ -10,8 +10,6 @@ Do NOT modify or remove this file.
 ------------------------------------------------------------------------
 Properties requiring vendor prefixes:
 None
-Property values requiring vendor prefixes:
-None
 ------------------------------------------------------------------------
 List of files:
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/block-ellipsis-001-ref.html
@@ -36,6 +34,14 @@ List of files:
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/block-ellipsis-029-ref.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/block-ellipsis-031-ref.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/block-ellipsis-032-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/block-ellipsis-034-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/block-ellipsis-035-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/block-ellipsis-038-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/block-ellipsis-039-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/block-ellipsis-041-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/block-ellipsis-bidi-002-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/block-ellipsis-bidi-003-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/block-ellipsis-bidi-004-ref.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/block-ellipsis-repaint-001-ref.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/block-ellipsis-repaint-002-ref.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/block-ellipsis-repaint-003-ref.html
@@ -53,6 +59,8 @@ List of files:
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-027-ref.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-028-ref.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-029-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-039-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-041-ref.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-auto-002-ref.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-auto-005-ref.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-auto-011-ref.html
@@ -75,6 +83,11 @@ List of files:
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-auto-039-ref.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-auto-040-ref.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-auto-041-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-auto-043-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-auto-044-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-auto-045-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-auto-046-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-auto-047-ref.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-auto-with-ruby-001-ref.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-auto-with-ruby-003-ref.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-auto-with-ruby-005-ref.html
@@ -98,9 +111,7 @@ List of files:
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-with-abspos-023-ref.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-with-floats-001-ref.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-with-floats-005-ref.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-with-floats-006-ref.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-with-floats-007-ref.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-with-floats-008-ref.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-with-floats-010-ref.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/line-clamp-with-text-overflow-string-003-ref.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/reference/webkit-line-clamp-001-ref.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/w3c-import.log b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/w3c-import.log
index 3494d9b78b7e..f748a716e3b0 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/w3c-import.log
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/w3c-import.log
@@ -10,8 +10,6 @@ Do NOT modify or remove this file.
 ------------------------------------------------------------------------
 Properties requiring vendor prefixes:
 box-decoration-break
-Property values requiring vendor prefixes:
-None
 ------------------------------------------------------------------------
 List of files:
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/WEB_FEATURES.yml
@@ -77,8 +75,39 @@ List of files:
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-030.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-031-expected.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-031.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-032.tentative-expected.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-032.tentative.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-032-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-032.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-033-expected.xht
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-033.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-034-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-034.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-035-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-035.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-036-expected.xht
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-036.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-037-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-037.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-038-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-038.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-039-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-039.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-040-expected.xht
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-040.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-041-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-041.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-bidi-001-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-bidi-001.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-bidi-002-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-bidi-002.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-bidi-003-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-bidi-003.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-bidi-004-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-bidi-004.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-crash-001.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-quirk-001-expected.xht
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-quirk-001.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-quirk-002-expected.xht
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-quirk-002.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-repaint-001-expected.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-repaint-001.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/block-ellipsis-repaint-002-expected.html
@@ -165,6 +194,13 @@ List of files:
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-037.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-038-expected.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-038.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-039-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-039.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-040-crash.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-041-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-041.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-042-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-042.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-001-crash.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-001-expected.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-001.html
@@ -247,6 +283,18 @@ List of files:
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-040.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-041-expected.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-041.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-042-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-042.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-043-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-043.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-044-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-044.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-045-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-045.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-046-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-046.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-047-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-047.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-with-ruby-001-expected.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-with-ruby-001.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-auto-with-ruby-002-expected.html
@@ -281,10 +329,12 @@ List of files:
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-balance-011.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-balance-012-expected.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-balance-012.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-bfc-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-bfc-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-bfc.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-content-height-with-dynamic-change-expected.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-content-height-with-dynamic-change-ref.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-content-height-with-dynamic-change.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-content-height-with-dynamic-change.html.rej
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-abspos-001-expected.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-abspos-001.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-abspos-002-expected.html
@@ -331,6 +381,8 @@ List of files:
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-abspos-022.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-abspos-023-expected.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-abspos-023.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-block-in-inline-001-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-block-in-inline-001.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-fixed-pos-001-expected.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-fixed-pos-001.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-fixed-pos-002-expected.html
@@ -365,26 +417,26 @@ List of files:
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-fixed-pos-016.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-fixed-pos-017-expected.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-fixed-pos-017.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-001.tentative-expected.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-001.tentative.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-002.tentative-expected.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-002.tentative.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-003.tentative-expected.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-003.tentative.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-004.tentative-expected.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-004.tentative.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-005.tentative-expected.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-005.tentative.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-006.tentative-expected.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-006.tentative.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-007.tentative-expected.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-007.tentative.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-008-expected.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-008.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-009.tentative-expected.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-009.tentative.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-010.tentative-expected.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-010.tentative.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-001-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-001.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-002-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-002.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-003-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-003.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-004-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-004.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-005-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-005.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-006-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-006.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-007-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-007.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-010-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-010.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-011-expected.xht
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-011.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-012-expected.xht
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-floats-012.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-text-overflow-string-001-expected.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-text-overflow-string-001.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-with-text-overflow-string-002-expected.html
@@ -473,14 +525,10 @@ List of files:
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/webkit-line-clamp-042-crash.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/webkit-line-clamp-043-expected.xht
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/webkit-line-clamp-043.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/webkit-line-clamp-044-expected.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/webkit-line-clamp-044.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/webkit-line-clamp-045-expected.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/webkit-line-clamp-045.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/webkit-line-clamp-046-expected.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/webkit-line-clamp-046.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/webkit-line-clamp-047-expected.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/webkit-line-clamp-047.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/webkit-line-clamp-048-expected.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/webkit-line-clamp-048.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/webkit-line-clamp-049-expected.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/webkit-line-clamp-044-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/webkit-line-clamp-044-expected.html
deleted file mode 100644
index 25018d4f59e6..000000000000
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/webkit-line-clamp-044-expected.html
+++ /dev/null
@@ -1,25 +0,0 @@
-<!doctype html>
-<meta charset="utf-8">
-<title>CSS Test Reference</title>
-<style>
-  .clamp {
-    display: flow-root;
-    background-color: yellow;
-    padding: 0.5em;
-    font-size: 16px / 32px serif;
-    white-space: pre;
-  }
-  .float {
-    float: left;
-    background-color: orange;
-    padding: 0.5em;
-    height: 100px;
-    width: 100px;
-  }
-</style>
-
-<div class="clamp">Line 1
-Line 2
-Line 3
-Line 4
-<div class="float"></div>Line 5</div>
\ No newline at end of file
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/webkit-line-clamp-044.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/webkit-line-clamp-044.html
deleted file mode 100644
index 981e09b466c7..000000000000
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/webkit-line-clamp-044.html
+++ /dev/null
@@ -1,35 +0,0 @@
-<!DOCTYPE html>
-<meta charset="UTF-8">
-<title>CSS Overflow: -webkit-line-clamp creates an IFC</title>
-<link rel="author" title="Andreu Botella" href="mailto:abotella@igalia.com">
-<link rel="help" href="https://drafts.csswg.org/css-overflow-4/#line-clamp">
-<link rel="match" href="reference/webkit-line-clamp-044-ref.html">
-<meta name="assert" content="-webkit-line-clamp always creates an independent formatting context, even without overflow: hidden, which causes the height to grow to the clearance of floats.">
-<style>
-  .clamp {
-    display: -webkit-box;
-    -webkit-box-orient: vertical;
-    -webkit-line-clamp: 5;
-    /* no overflow: hidden */
-    background-color: yellow;
-    padding: 0.5em;
-    font-size: 16px / 32px serif;
-    white-space: pre;
-  }
-  .float {
-    /* Floats create a parallel fragmentation context, and even if
-     * -webkit-line-clamp caused a forced break in the main context, that should
-     * not cause the float to fragment. */
-    float: left;
-    background-color: orange;
-    padding: 0.5em;
-    height: 100px;
-    width: 100px;
-  }
-</style>
-
-<div class="clamp"><div>Line 1
-Line 2
-Line 3
-Line 4
-<div class="float"></div>Line 5</div></div>
\ No newline at end of file
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/webkit-line-clamp-047-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/webkit-line-clamp-047-expected.html
deleted file mode 100644
index 3f1e31ab2224..000000000000
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/webkit-line-clamp-047-expected.html
+++ /dev/null
@@ -1,25 +0,0 @@
-<!doctype html>
-<meta charset="utf-8">
-<title>CSS Test Reference</title>
-<style>
-  .clamp {
-    display: flow-root;
-    background-color: yellow;
-    padding: 0.5em;
-    font: 16px / 32px serif;
-    white-space: pre;
-  }
-  .float {
-    float: left;
-    background-color: orange;
-    padding: 0.5em;
-    height: 100px;
-    width: 100px;
-  }
-</style>
-
-<div class="clamp">Line 1
-Line 2
-Line 3
-Line 4
-<div class="float"></div>Line 5…</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/webkit-line-clamp-047.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/webkit-line-clamp-047.html
deleted file mode 100644
index cb66eb714c51..000000000000
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/webkit-line-clamp-047.html
+++ /dev/null
@@ -1,38 +0,0 @@
-<!DOCTYPE html>
-<meta charset="UTF-8">
-<title>CSS Overflow: -webkit-line-clamp creates an IFC</title>
-<link rel="author" title="Andreu Botella" href="mailto:abotella@igalia.com">
-<link rel="author" title="Florian Rivoal" href="https://florian.rivoal.net">
-<link rel="help" href="https://drafts.csswg.org/css-overflow-4/#line-clamp">
-<link rel="match" href="reference/webkit-line-clamp-047-ref.html">
-<meta name="assert" content="-webkit-line-clamp always creates an independent formatting context, even without overflow: hidden, which causes the height to grow to the clearance of floats.">
-<style>
-  .clamp {
-    display: -webkit-box;
-    -webkit-box-orient: vertical;
-    -webkit-line-clamp: 5;
-    /* no overflow: hidden */
-    background-color: yellow;
-    padding: 0.5em;
-    font: 16px / 32px serif;
-    white-space: pre;
-  }
-  .float {
-    /* Floats create a parallel fragmentation context, and even if
-     * -webkit-line-clamp caused a forced break in the main context, that should
-     * not cause the float to fragment. */
-    float: left;
-    background-color: orange;
-    padding: 0.5em;
-    height: 100px;
-    width: 100px;
-  }
-</style>
-
-<div class="clamp"><div>Line 1
-Line 2
-Line 3
-Line 4
-<div class="float"></div>Line 5</div>
-Line 6
-Line 7</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/webkit-line-clamp-with-max-height-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/webkit-line-clamp-with-max-height-expected.html
index c9a9ae5d7ffe..d318a3e662f8 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/webkit-line-clamp-with-max-height-expected.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/webkit-line-clamp-with-max-height-expected.html
@@ -2,16 +2,17 @@
 <meta charset="utf-8">
 <title>CSS Reference</title>
 <style>
-.clamp {
-  display: -webkit-box;
-  -webkit-box-orient: vertical;
+div {
   font: 16px / 32px serif;
   white-space: pre;
   padding: 0 4px;
+}
+.clamp {
+  height: 3lh;
   background-color: yellow;
 }
 </style>
 <div class="clamp">Line 1
 Line 2
-Line 3
-Line 4…</div>
+Line 3</div>
+<div>Line 4…</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/webkit-line-clamp-with-max-height.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/webkit-line-clamp-with-max-height.html
index 410fbef9c751..b07d04fbe651 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/webkit-line-clamp-with-max-height.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/line-clamp/webkit-line-clamp-with-max-height.html
@@ -3,19 +3,22 @@
 <title>CSS Overflow: -webkit-line-clamp with max-height</title>
 <link rel="author" title="Andreu Botella" href="mailto:abotella@igalia.com">
 <link rel="help" href="https://drafts.csswg.org/css-overflow-4/#line-clamp">
-<link rel="match" href="reference/webkit-line-clamp-005-ref.html">
-<meta name="assert" content="If the -webkit-line-clamp property is set on an element where max-height is also specified, they will interact the same as for line-clamp: that is, the container will clamp after the line given by -webkit-line-clamp, or the last that fully fits in the height, whichever comes earlier.">
+<link rel="match" href="reference/line-clamp-011-ref.html">
+<meta name="assert" content="If the -webkit-line-clamp property is set on an element where max-height is also specified, they will interact the same as for line-clamp: that is, the container will clamp after the line given by -webkit-line-clamp, and if the block is too small, excess content overflows.">
 <style>
 .clamp {
   display: -webkit-box;
   -webkit-box-orient: vertical;
-  -webkit-line-clamp: 5;
+  -webkit-line-clamp: 4;
   font: 16px / 32px serif;
   white-space: pre;
   padding: 0 4px;
   background-color: yellow;
-  overflow: hidden;
-  max-height: 4.5lh;
+  max-height: 3lh;
+}
+.hidden {
+  /* can be removed once implementations update their old -webkit-line-clamp implementations */
+  visibility: hidden;
 }
 </style>
 
@@ -23,6 +26,6 @@
 Line 2
 Line 3
 Line 4
-Line 5
+<div class="hidden">Line 5
 Line 6
-Line 7</div>
+Line 7</div></div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/max-width-container-with-scrollable-descendant.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/max-width-container-with-scrollable-descendant.html
index da5056fa95f0..14e5232f06a7 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/max-width-container-with-scrollable-descendant.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/max-width-container-with-scrollable-descendant.html
@@ -1,7 +1,7 @@
 <!DOCTYPE html>
 <html>
 <head>
-<link rel="match" href="/299   max-width-container-with-scrollable-descendant-ref.html">
+<link rel="match" href="max-width-container-with-scrollable-descendant-ref.html">
 <link rel="help" href="https://drafts.csswg.org/css-overflow-3/#scrollbar-sizing">
 <style>
 .container {
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-clamps-and-ignores-scroll-offsets-vertical-rl-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-clamps-and-ignores-scroll-offsets-vertical-rl-expected.txt
new file mode 100644
index 000000000000..8688354aa129
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-clamps-and-ignores-scroll-offsets-vertical-rl-expected.txt
@@ -0,0 +1,3 @@
+
+FAIL changing a resizable vertical-rl scroller from overflow:hidden to overflow:clip clamps existing offsets and makes future scroll writes no-ops assert_equals: changing to overflow:clip should clamp an existing scrollLeft back to 0 expected 0 but got -40
+
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-clamps-and-ignores-scroll-offsets-vertical-rl.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-clamps-and-ignores-scroll-offsets-vertical-rl.html
new file mode 100644
index 000000000000..ffd54e578c13
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-clamps-and-ignores-scroll-offsets-vertical-rl.html
@@ -0,0 +1,79 @@
+<!doctype html>
+<meta charset="utf-8">
+<title>overflow: clip clamps existing scroll offsets and future scroll writes in vertical-rl</title>
+<link rel="help" href="https://drafts.csswg.org/cssom-view/#dom-element-scrollto">
+<link rel="help" href="https://drafts.csswg.org/cssom-view/#dom-element-scrollby">
+<link rel="help" href="https://drafts.csswg.org/cssom-view/#dom-element-scrollleft">
+<link rel="help" href="https://drafts.csswg.org/cssom-view/#dom-element-scrolltop">
+<link rel="help" href="https://drafts.csswg.org/css-overflow-3/#overflow-clip">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+
+<body>
+<style>
+  #scroller {
+    width: 100px;
+    height: 100px;
+    overflow: hidden;
+    resize: both;
+    writing-mode: vertical-rl;
+    border: 1px solid black;
+  }
+
+  #contents {
+    width: 300px;
+    height: 300px;
+  }
+</style>
+
+<div id="scroller">
+  <div id="contents"></div>
+</div>
+
+<script>
+test(() => {
+  const scroller = document.getElementById('scroller');
+
+  scroller.scrollTo(-40, 50);
+  assert_equals(
+      scroller.scrollLeft, -40,
+      'overflow:hidden in vertical-rl should allow establishing a negative scrollLeft');
+  assert_equals(
+      scroller.scrollTop, 50,
+      'overflow:hidden should allow establishing a positive scrollTop');
+
+  scroller.style.overflow = 'clip';
+
+  assert_equals(
+      scroller.scrollLeft, 0,
+      'changing to overflow:clip should clamp an existing scrollLeft back to 0');
+  assert_equals(
+      scroller.scrollTop, 0,
+      'changing to overflow:clip should clamp an existing scrollTop back to 0');
+
+  scroller.scrollTo(-60, 70);
+  assert_equals(
+      scroller.scrollLeft, 0,
+      'scrollTo() should not change scrollLeft for overflow:clip');
+  assert_equals(
+      scroller.scrollTop, 0,
+      'scrollTo() should not change scrollTop for overflow:clip');
+
+  scroller.scrollBy(-10, 20);
+  assert_equals(
+      scroller.scrollLeft, 0,
+      'scrollBy() should not change scrollLeft for overflow:clip');
+  assert_equals(
+      scroller.scrollTop, 0,
+      'scrollBy() should not change scrollTop for overflow:clip');
+
+  scroller.scrollLeft = -25;
+  scroller.scrollTop = 35;
+  assert_equals(
+      scroller.scrollLeft, 0,
+      'setting scrollLeft should be a no-op for overflow:clip');
+  assert_equals(
+      scroller.scrollTop, 0,
+      'setting scrollTop should be a no-op for overflow:clip');
+}, 'changing a resizable vertical-rl scroller from overflow:hidden to overflow:clip clamps existing offsets and makes future scroll writes no-ops');
+</script>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-content-visual-overflow-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-content-visual-overflow-expected.html
index 378da736ecfc..f3aa3676f2e8 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-content-visual-overflow-expected.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-content-visual-overflow-expected.html
@@ -13,7 +13,7 @@
     height: 100px;
     will-change: transform;
     background: black;
-    box-shadow: 10px 50px 5px red;
+    box-shadow: 50px 50px 5px green;
   }
 
   .cover {
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-content-visual-overflow-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-content-visual-overflow-ref.html
index 378da736ecfc..f3aa3676f2e8 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-content-visual-overflow-ref.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-content-visual-overflow-ref.html
@@ -13,7 +13,7 @@
     height: 100px;
     will-change: transform;
     background: black;
-    box-shadow: 10px 50px 5px red;
+    box-shadow: 50px 50px 5px green;
   }
 
   .cover {
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-content-visual-overflow.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-content-visual-overflow.html
index 8ea8e2c3334e..3af937a10e00 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-content-visual-overflow.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-content-visual-overflow.html
@@ -19,19 +19,29 @@
     width: 100px;
     height: 100px;
     background: black;
-    box-shadow: 10px 50px 5px red;
+    box-shadow: 50px 50px 5px green;
   }
 
   .spacer {
     width: 100px;
     height: 150px;
   }
+
+  .fail {
+    width: 10px;
+    height: 10px;
+    background: red;
+    position: absolute;
+    z-index: -1;
+  }
 </style>
 <div class="parent" style="overflow-x: clip; overflow-y: visible">
   <div class="child"></div>
 </div>
+<div class="fail" style="left: 70px; top: 120px;"></div>
 <div class="spacer"></div>
 <div class="parent" style="overflow-x: visible; overflow-y: clip">
   <div class="child"></div>
 </div>
+<div class="fail" style="left: 120px; top: 320px;"></div>
 </script>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-hit-testing.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-hit-testing.html
index b22497601c2a..b819e3dc00a4 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-hit-testing.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-hit-testing.html
@@ -23,7 +23,7 @@
   }
 
   .child2 {
-    background-color: red;
+    background-color: blue;
   }
 </style>
 <div class="parent" style="display: flex; overflow-x: visible; overflow-y: clip">
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-003-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-003-expected.html
index cf6b55a2f91d..3c69cc7c061c 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-003-expected.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-003-expected.html
@@ -8,8 +8,8 @@
       width: 100px;
       height: 100px;
       background-color: green;
-      box-shadow: 20px 20px 5px red;
+      box-shadow: 20px 20px 5px blue;
   }
 </style>
-<p>You should see a green box with a red box shadow.
+<p>You should see a green box with a blue box shadow.
 <div class="parent"></div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-003-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-003-ref.html
index cf6b55a2f91d..3c69cc7c061c 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-003-ref.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-003-ref.html
@@ -8,8 +8,8 @@
       width: 100px;
       height: 100px;
       background-color: green;
-      box-shadow: 20px 20px 5px red;
+      box-shadow: 20px 20px 5px blue;
   }
 </style>
-<p>You should see a green box with a red box shadow.
+<p>You should see a green box with a blue box shadow.
 <div class="parent"></div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-003.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-003.html
index 52625e90977f..5b74fefd952e 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-003.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-003.html
@@ -11,8 +11,18 @@
       background-color: green;
       overflow: clip;
       overflow-clip-margin: 1px;
-      box-shadow: 20px 20px 5px red;
+      box-shadow: 20px 20px 5px blue;
+  }
+  .fail {
+      width: 20px;
+      height: 20px;
+      background-color: red;
+      position: relative;
+      top: -15px;
+      left: 85px;
+      z-index: -1;
   }
 </style>
-<p>You should see a green box with a red box shadow.
+<p>You should see a green box with a blue box shadow.
 <div class="parent"></div>
+<div class="fail"></div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-006-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-006-expected.html
index cf6b55a2f91d..3c69cc7c061c 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-006-expected.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-006-expected.html
@@ -8,8 +8,8 @@
       width: 100px;
       height: 100px;
       background-color: green;
-      box-shadow: 20px 20px 5px red;
+      box-shadow: 20px 20px 5px blue;
   }
 </style>
-<p>You should see a green box with a red box shadow.
+<p>You should see a green box with a blue box shadow.
 <div class="parent"></div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-006-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-006-ref.html
index cf6b55a2f91d..3c69cc7c061c 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-006-ref.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-006-ref.html
@@ -8,8 +8,8 @@
       width: 100px;
       height: 100px;
       background-color: green;
-      box-shadow: 20px 20px 5px red;
+      box-shadow: 20px 20px 5px blue;
   }
 </style>
-<p>You should see a green box with a red box shadow.
+<p>You should see a green box with a blue box shadow.
 <div class="parent"></div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-006.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-006.html
index 493bcee29f65..48602c685a6c 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-006.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-006.html
@@ -11,8 +11,18 @@
       background-color: green;
       contain: paint;
       overflow-clip-margin: 1px;
-      box-shadow: 20px 20px 5px red;
+      box-shadow: 20px 20px 5px blue;
+  }
+  .fail {
+      width: 20px;
+      height: 20px;
+      background-color: red;
+      position: relative;
+      top: -15px;
+      left: 85px;
+      z-index: -1;
   }
 </style>
-<p>You should see a green box with a red box shadow.
+<p>You should see a green box with a blue box shadow.
 <div class="parent"></div>
+<div class="fail"></div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-013-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-013-expected.html
new file mode 100644
index 000000000000..82fcaa3b2aa4
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-013-expected.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mstensho@chromium.org">
+<p>Test passes if there is a filled green square.</p>
+<div style="width:100px; height:100px; background:green;"></div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-013.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-013.html
new file mode 100644
index 000000000000..7b9e85e3ca64
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-013.html
@@ -0,0 +1,31 @@
+<!doctype html>
+<html class="reftest">
+<meta charset="utf-8">
+<title>overflow-clip-margin: border-box</title>
+<link rel="help" href="https://www.w3.org/TR/css-overflow-3/#propdef-overflow-clip-margin">
+<link rel="author" title="Tab Atkins-Bittner" href="mailto:jackalmage@gmail.com">
+<link rel="match" href="../reference/ref-filled-green-100px-square-only.html">
+<style>
+  .clip {
+    width: 80px;
+    height: 80px;
+    border: 10px solid transparent;
+    overflow: clip;
+    overflow-clip-margin: border-box;
+    background: red;
+  }
+  .big {
+    width: 100px;
+    height: 100px;
+    border: 50px solid red;
+    position: relative;
+    top: -60px;
+    left: -60px;
+    z-index: 1;
+    background: green;
+  }
+</style>
+<p>Test passes if there is a filled green square.</p>
+<div class=clip>
+  <div class=big></div>
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-014-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-014-expected.html
new file mode 100644
index 000000000000..82fcaa3b2aa4
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-014-expected.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mstensho@chromium.org">
+<p>Test passes if there is a filled green square.</p>
+<div style="width:100px; height:100px; background:green;"></div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-014.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-014.html
new file mode 100644
index 000000000000..fdd5b4f2568a
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-014.html
@@ -0,0 +1,32 @@
+<!doctype html>
+<html class="reftest">
+<meta charset="utf-8">
+<title>overflow-clip-margin: content-box</title>
+<link rel="help" href="https://www.w3.org/TR/css-overflow-3/#propdef-overflow-clip-margin">
+<link rel="author" title="Tab Atkins-Bittner" href="mailto:jackalmage@gmail.com">
+<link rel="match" href="../reference/ref-filled-green-100px-square-only.html">
+<style>
+  .clip {
+    width: 100px;
+    height: 100px;
+    border: 10px solid transparent;
+    padding: 10px;
+    margin: -20px 0 0 -20px;
+    overflow: clip;
+    overflow-clip-margin: content-box;
+  }
+  .big {
+    width: 100px;
+    height: 100px;
+    border: 50px solid red;
+    position: relative;
+    top: -50px;
+    left: -50px;
+    z-index: 1;
+    background: green;
+  }
+</style>
+<p>Test passes if there is a filled green square.</p>
+<div class=clip>
+  <div class=big></div>
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-015-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-015-expected.html
new file mode 100644
index 000000000000..82fcaa3b2aa4
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-015-expected.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mstensho@chromium.org">
+<p>Test passes if there is a filled green square.</p>
+<div style="width:100px; height:100px; background:green;"></div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-015.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-015.html
new file mode 100644
index 000000000000..3c52d3496691
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-015.html
@@ -0,0 +1,31 @@
+<!doctype html>
+<html class="reftest">
+<meta charset="utf-8">
+<title>overflow-clip-margin: keyword + positive length</title>
+<link rel="help" href="https://www.w3.org/TR/css-overflow-3/#propdef-overflow-clip-margin">
+<link rel="author" title="Tab Atkins-Bittner" href="mailto:jackalmage@gmail.com">
+<link rel="match" href="../reference/ref-filled-green-100px-square-only.html">
+<style>
+  .clip {
+    width: 80px;
+    height: 80px;
+    border: 10px solid transparent;
+    overflow: clip;
+    overflow-clip-margin: padding-box 10px;
+    background: red;
+  }
+  .big {
+    width: 100px;
+    height: 100px;
+    border: 50px solid red;
+    position: relative;
+    top: -60px;
+    left: -60px;
+    z-index: 1;
+    background: green;
+  }
+</style>
+<p>Test passes if there is a filled green square.</p>
+<div class=clip>
+  <div class=big></div>
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-016-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-016-expected.html
new file mode 100644
index 000000000000..82fcaa3b2aa4
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-016-expected.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mstensho@chromium.org">
+<p>Test passes if there is a filled green square.</p>
+<div style="width:100px; height:100px; background:green;"></div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-016.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-016.html
new file mode 100644
index 000000000000..2eb0ced43ea2
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-016.html
@@ -0,0 +1,33 @@
+<!doctype html>
+<html class="reftest">
+<meta charset="utf-8">
+<title>overflow-clip-margin: keyword + negative length</title>
+<link rel="help" href="https://www.w3.org/TR/css-overflow-3/#propdef-overflow-clip-margin">
+<link rel="author" title="Tab Atkins-Bittner" href="mailto:jackalmage@gmail.com">
+<link rel="match" href="../reference/ref-filled-green-100px-square-only.html">
+<style>
+  .clip {
+    width: 100px;
+    height: 100px;
+    padding: 10px;
+    margin: -10px 0 0 -10px;
+    overflow: clip;
+    overflow-clip-margin: padding-box -10px;
+    background: red;
+    background-clip: content-box;
+  }
+  .big {
+    width: 100px;
+    height: 100px;
+    border: 50px solid red;
+    position: relative;
+    top: -50px;
+    left: -50px;
+    z-index: 1;
+    background: green;
+  }
+</style>
+<p>Test passes if there is a filled green square.</p>
+<div class=clip>
+  <div class=big></div>
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-017-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-017-expected.html
new file mode 100644
index 000000000000..82fcaa3b2aa4
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-017-expected.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mstensho@chromium.org">
+<p>Test passes if there is a filled green square.</p>
+<div style="width:100px; height:100px; background:green;"></div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-017.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-017.html
new file mode 100644
index 000000000000..da0623a96c05
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-017.html
@@ -0,0 +1,33 @@
+<!doctype html>
+<html class="reftest">
+<meta charset="utf-8">
+<title>overflow-clip-margin: just a negative length</title>
+<link rel="help" href="https://www.w3.org/TR/css-overflow-3/#propdef-overflow-clip-margin">
+<link rel="author" title="Tab Atkins-Bittner" href="mailto:jackalmage@gmail.com">
+<link rel="match" href="../reference/ref-filled-green-100px-square-only.html">
+<style>
+  .clip {
+    width: 100px;
+    height: 100px;
+    padding: 10px;
+    margin: -10px 0 0 -10px;
+    overflow: clip;
+    overflow-clip-margin: -10px;
+    background: red;
+    background-clip: content-box;
+  }
+  .big {
+    width: 100px;
+    height: 100px;
+    border: 50px solid red;
+    position: relative;
+    top: -50px;
+    left: -50px;
+    z-index: 1;
+    background: green;
+  }
+</style>
+<p>Test passes if there is a filled green square.</p>
+<div class=clip>
+  <div class=big></div>
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-018-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-018-expected.html
new file mode 100644
index 000000000000..82fcaa3b2aa4
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-018-expected.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mstensho@chromium.org">
+<p>Test passes if there is a filled green square.</p>
+<div style="width:100px; height:100px; background:green;"></div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-018.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-018.html
new file mode 100644
index 000000000000..fc720d98a058
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-018.html
@@ -0,0 +1,32 @@
+<!doctype html>
+<html class="reftest">
+<meta charset="utf-8">
+<title>overflow-clip-margin: content-box on a scroller</title>
+<link rel="help" href="https://www.w3.org/TR/css-overflow-3/#propdef-overflow-clip-margin">
+<link rel="author" title="Tab Atkins-Bittner" href="mailto:jackalmage@gmail.com">
+<link rel="match" href="../reference/ref-filled-green-100px-square-only.html">
+<style>
+  .clip {
+    width: 100px;
+    height: 100px;
+    border: 10px solid transparent;
+    padding: 10px;
+    margin: -20px 0 0 -20px;
+    overflow: hidden;
+    overflow-clip-margin: content-box;
+  }
+  .big {
+    width: 100px;
+    height: 100px;
+    border: 50px solid red;
+    position: relative;
+    top: -50px;
+    left: -50px;
+    z-index: 1;
+    background: green;
+  }
+</style>
+<p>Test passes if there is a filled green square.</p>
+<div class=clip>
+  <div class=big></div>
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-019-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-019-expected.html
new file mode 100644
index 000000000000..82fcaa3b2aa4
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-019-expected.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mstensho@chromium.org">
+<p>Test passes if there is a filled green square.</p>
+<div style="width:100px; height:100px; background:green;"></div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-019.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-019.html
new file mode 100644
index 000000000000..9219fe38d4a1
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-019.html
@@ -0,0 +1,33 @@
+<!doctype html>
+<html class="reftest">
+<meta charset="utf-8">
+<title>overflow-clip-margin: keyword + negative length on a scroller</title>
+<link rel="help" href="https://www.w3.org/TR/css-overflow-3/#propdef-overflow-clip-margin">
+<link rel="author" title="Tab Atkins-Bittner" href="mailto:jackalmage@gmail.com">
+<link rel="match" href="../reference/ref-filled-green-100px-square-only.html">
+<style>
+  .clip {
+    width: 100px;
+    height: 100px;
+    padding: 10px;
+    margin: -10px 0 0 -10px;
+    overflow: hidden;
+    overflow-clip-margin: padding-box -10px;
+    background: red;
+    background-clip: content-box;
+  }
+  .big {
+    width: 100px;
+    height: 100px;
+    border: 50px solid red;
+    position: relative;
+    top: -50px;
+    left: -50px;
+    z-index: 1;
+    background: green;
+  }
+</style>
+<p>Test passes if there is a filled green square.</p>
+<div class=clip>
+  <div class=big></div>
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-020-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-020-expected.html
new file mode 100644
index 000000000000..82fcaa3b2aa4
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-020-expected.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mstensho@chromium.org">
+<p>Test passes if there is a filled green square.</p>
+<div style="width:100px; height:100px; background:green;"></div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-020.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-020.html
new file mode 100644
index 000000000000..90ce18a5d25d
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-020.html
@@ -0,0 +1,33 @@
+<!doctype html>
+<html class="reftest">
+<meta charset="utf-8">
+<title>overflow-clip-margin: just a negative length on a scroller</title>
+<link rel="help" href="https://www.w3.org/TR/css-overflow-3/#propdef-overflow-clip-margin">
+<link rel="author" title="Tab Atkins-Bittner" href="mailto:jackalmage@gmail.com">
+<link rel="match" href="../reference/ref-filled-green-100px-square-only.html">
+<style>
+  .clip {
+    width: 100px;
+    height: 100px;
+    padding: 10px;
+    margin: -10px 0 0 -10px;
+    overflow: hidden;
+    overflow-clip-margin: -10px;
+    background: red;
+    background-clip: content-box;
+  }
+  .big {
+    width: 100px;
+    height: 100px;
+    border: 50px solid red;
+    position: relative;
+    top: -50px;
+    left: -50px;
+    z-index: 1;
+    background: green;
+  }
+</style>
+<p>Test passes if there is a filled green square.</p>
+<div class=clip>
+  <div class=big></div>
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-021-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-021-expected.html
new file mode 100644
index 000000000000..82fcaa3b2aa4
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-021-expected.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mstensho@chromium.org">
+<p>Test passes if there is a filled green square.</p>
+<div style="width:100px; height:100px; background:green;"></div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-021.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-021.html
new file mode 100644
index 000000000000..5ee29821c6b1
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-021.html
@@ -0,0 +1,34 @@
+<!doctype html>
+<html class="reftest">
+<meta charset="utf-8">
+<title>overflow-clip-margin: border-box is ignored on a scroller</title>
+<link rel="help" href="https://www.w3.org/TR/css-overflow-3/#propdef-overflow-clip-margin">
+<link rel="author" title="Tab Atkins-Bittner" href="mailto:jackalmage@gmail.com">
+<link rel="match" href="../reference/ref-filled-green-100px-square-only.html">
+<style>
+  .clip {
+    width: 80px;
+    height: 80px;
+    padding: 10px;
+    border: 10px solid transparent;
+    margin: -10px 0 0 -10px;
+    overflow: hidden;
+    overflow-clip-margin: border-box;
+    background: red;
+    background-clip: content-box;
+  }
+  .big {
+    width: 100px;
+    height: 100px;
+    border: 50px solid red;
+    position: relative;
+    top: -60px;
+    left: -60px;
+    z-index: 1;
+    background: green;
+  }
+</style>
+<p>Test passes if there is a filled green square.</p>
+<div class=clip>
+  <div class=big></div>
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-022-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-022-expected.html
new file mode 100644
index 000000000000..82fcaa3b2aa4
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-022-expected.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mstensho@chromium.org">
+<p>Test passes if there is a filled green square.</p>
+<div style="width:100px; height:100px; background:green;"></div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-022.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-022.html
new file mode 100644
index 000000000000..f55c80e23b64
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-022.html
@@ -0,0 +1,34 @@
+<!doctype html>
+<html class="reftest">
+<meta charset="utf-8">
+<title>overflow-clip-margin: border-box is ignored on a scroller, including the offset</title>
+<link rel="help" href="https://www.w3.org/TR/css-overflow-3/#propdef-overflow-clip-margin">
+<link rel="author" title="Tab Atkins-Bittner" href="mailto:jackalmage@gmail.com">
+<link rel="match" href="../reference/ref-filled-green-100px-square-only.html">
+<style>
+  .clip {
+    width: 80px;
+    height: 80px;
+    padding: 10px;
+    border: 10px solid transparent;
+    margin: -10px 0 0 -10px;
+    overflow: hidden;
+    overflow-clip-margin: border-box -1000px;
+    background: red;
+    background-clip: content-box;
+  }
+  .big {
+    width: 100px;
+    height: 100px;
+    border: 50px solid red;
+    position: relative;
+    top: -60px;
+    left: -60px;
+    z-index: 1;
+    background: green;
+  }
+</style>
+<p>Test passes if there is a filled green square.</p>
+<div class=clip>
+  <div class=big></div>
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-content-box-dynamic-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-content-box-dynamic-expected.html
new file mode 100644
index 000000000000..82fcaa3b2aa4
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-content-box-dynamic-expected.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mstensho@chromium.org">
+<p>Test passes if there is a filled green square.</p>
+<div style="width:100px; height:100px; background:green;"></div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-content-box-dynamic.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-content-box-dynamic.html
new file mode 100644
index 000000000000..be66d7a80c71
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-content-box-dynamic.html
@@ -0,0 +1,32 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<link rel="match" href="../reference/ref-filled-green-100px-square-only.html">
+<link rel="help" href="https://drafts.csswg.org/css-overflow-3/#overflow-clip-margin">
+<script src="/common/rendering-utils.js"></script>
+<script src="/common/reftest-wait.js"></script>
+<style>
+#target {
+  width: 100px;
+  height: 100px;
+  padding-bottom: 50px;
+  box-sizing: border-box;
+  overflow: clip;
+  overflow-clip-margin: content-box;
+}
+
+#target > div {
+  width: 100px;
+  height: 100px;
+  background: green;
+}
+</style>
+<p>Test passes if there is a filled green square.</p>
+<div id="target">
+  <div></div>
+</div>
+<script>
+waitForAtLeastOneFrame().then(() => {
+  document.getElementById('target').style.paddingBottom = '0px';
+  takeScreenshot();
+});
+</script>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-no-off-axis-scrollbar-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-no-off-axis-scrollbar-expected.txt
new file mode 100644
index 000000000000..cd0b157c9d84
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-no-off-axis-scrollbar-expected.txt
@@ -0,0 +1,3 @@
+
+PASS overflow: clip on the off-axis does not display a scrollbar.
+
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-no-off-axis-scrollbar.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-no-off-axis-scrollbar.html
new file mode 100644
index 000000000000..b01ff3b919d2
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-no-off-axis-scrollbar.html
@@ -0,0 +1,42 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>overflow: clip does not show an off-axis scrollbar</title>
+<link rel="help" href="https://www.w3.org/TR/css-overflow-3/#valdef-overflow-clip">
+<link rel="help" href="https://www.w3.org/TR/css-overflow-3/#scrollable">
+<meta name="assert" content="overflow: clip on one axis does not display a scrollbar on that axis when the other axis scrolls.">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<style>
+  .container {
+    width: 100px;
+    height: 100px;
+    background: #DDD;
+  }
+  .scroller-y {
+    overflow-y: scroll;
+    overflow-x: clip;
+  }
+  .scroller-x {
+    overflow-x: scroll;
+    overflow-y: clip;
+  }
+  .content { width: 200px; height: 200px; }
+</style>
+<div id="scroller-y" class="container scroller-y">
+  <div class="content"></div>
+</div>
+<div id="scroller-x" class="container scroller-x">
+  <div class="content"></div>
+</div>
+<script>
+  test(() => {
+    const scrollerY = document.getElementById("scroller-y");
+    const scrollerX = document.getElementById("scroller-x");
+
+    const horizontalScrollbar = scrollerY.offsetHeight - scrollerY.clientHeight;
+    const verticalScrollbar = scrollerX.offsetWidth - scrollerX.clientWidth;
+
+    assert_equals(horizontalScrollbar, 0, "overflow-x: clip should not show a horizontal scrollbar.");
+    assert_equals(verticalScrollbar, 0, "overflow-y: clip should not show a vertical scrollbar.");
+  }, "overflow: clip on the off-axis does not display a scrollbar.");
+</script>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clipped-transparent-border-clip-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clipped-transparent-border-clip-expected.html
new file mode 100644
index 000000000000..ef8eed504229
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clipped-transparent-border-clip-expected.html
@@ -0,0 +1,35 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Reference: overflow clipping with transparent borders</title>
+<style>
+.ref {
+  width: 100px;
+  height: 100px;
+  border: 10px solid green;
+  background: blue;
+}
+.ref-clip-y {
+  position: relative;
+  display: inline-block;
+  width: 100px;
+  height: 100px;
+  background: green;
+  box-sizing: border-box;
+}
+.ref-clip-y-inner {
+  position: absolute;
+  top: 20px;
+  left: 0;
+  width: 140px;
+  height: 60px;
+  background: blue;
+}
+</style>
+<p>Test passes if you see two blue squares with green borders, followed by
+  a green-blue-green striped rectangle where the blue stripe overflows to the right.</p>
+<div class="ref"></div>
+<div class="ref"></div>
+<br>
+<div class="ref-clip-y">
+  <div class="ref-clip-y-inner"></div>
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clipped-transparent-border-clip-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clipped-transparent-border-clip-ref.html
new file mode 100644
index 000000000000..ef8eed504229
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clipped-transparent-border-clip-ref.html
@@ -0,0 +1,35 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Reference: overflow clipping with transparent borders</title>
+<style>
+.ref {
+  width: 100px;
+  height: 100px;
+  border: 10px solid green;
+  background: blue;
+}
+.ref-clip-y {
+  position: relative;
+  display: inline-block;
+  width: 100px;
+  height: 100px;
+  background: green;
+  box-sizing: border-box;
+}
+.ref-clip-y-inner {
+  position: absolute;
+  top: 20px;
+  left: 0;
+  width: 140px;
+  height: 60px;
+  background: blue;
+}
+</style>
+<p>Test passes if you see two blue squares with green borders, followed by
+  a green-blue-green striped rectangle where the blue stripe overflows to the right.</p>
+<div class="ref"></div>
+<div class="ref"></div>
+<br>
+<div class="ref-clip-y">
+  <div class="ref-clip-y-inner"></div>
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clipped-transparent-border-clip.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clipped-transparent-border-clip.html
new file mode 100644
index 000000000000..fcda5ab7a96e
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clipped-transparent-border-clip.html
@@ -0,0 +1,56 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Test: overflow clipping preserves background visible through transparent borders</title>
+<link rel="author" title="Jason Leo" href="mailto:cgqaq@chromium.org">
+<link rel="author" title="一丝" href="mailto:yiorsi@gmail.com">
+<link rel="help" href="https://drafts.csswg.org/css-overflow-3/#overflow-clip">
+<link rel="match" href="overflow-clipped-transparent-border-clip-ref.html">
+<style>
+.outer-hidden {
+  width: 100px;
+  height: 100px;
+  border: 10px solid transparent;
+  overflow: hidden;
+  background: green;
+}
+.outer-clip {
+  width: 100px;
+  height: 100px;
+  border: 10px solid transparent;
+  overflow: clip;
+  background: green;
+}
+.inner {
+  width: 120px;
+  height: 120px;
+  margin: -10px;
+  background: blue;
+}
+.outer-clip-y {
+  width: 100px;
+  height: 100px;
+  display: inline-block;
+  background: green;
+  border: 20px solid transparent;
+  box-sizing: border-box;
+  overflow-y: clip;
+}
+.inner-clip-y {
+  width: 140px;
+  height: 140px;
+  margin: -20px;
+  background: blue;
+}
+</style>
+<p>Test passes if you see two blue squares with green borders, followed by
+  a green-blue-green striped rectangle where the blue stripe overflows to the right.</p>
+<div class="outer-hidden">
+  <div class="inner"></div>
+</div>
+<div class="outer-clip">
+  <div class="inner"></div>
+</div>
+<br>
+<div class="outer-clip-y">
+  <div class="inner-clip-y"></div>
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-hidden-resize-with-stacking-context-child.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-hidden-resize-with-stacking-context-child.html
index 8569ac153329..c76cce507aa5 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-hidden-resize-with-stacking-context-child.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-hidden-resize-with-stacking-context-child.html
@@ -22,6 +22,14 @@
   height: 20px;
   background: green;
 }
+.fail {
+  width: 20px;
+  height: 20px;
+  background: red;
+  position: relative;
+  top: -60px;
+  left: 40px;
+}
 </style>
 <p>Test passes if there is a filled green square.</p>
 <div id="container">
@@ -33,6 +41,7 @@
     <div class="content"></div>
   </div>
 </div>
+<div class="fail"></div>
 <script>
 waitForAtLeastOneFrame().then(() => {
   container.style.height = '100px';
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-video-hidden-expected-mismatch.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-video-hidden-expected-mismatch.html
new file mode 100644
index 000000000000..4a8a83e04a8c
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-video-hidden-expected-mismatch.html
@@ -0,0 +1,21 @@
+<!doctype html>
+<html class="reftest-wait">
+<meta charset="utf-8">
+<title>Verifies overflow applies to video elements</title>
+<link rel="help" href="https://drafts.csswg.org/css-overflow/#propdef-overflow">
+<link rel="author" title="Khushal Sagar" href="mailto:khushalsagar@chromium.org">
+<script src="/common/reftest-wait.js"></script>
+<style>
+  body {
+    background: grey;
+  }
+</style>
+<video autoplay>
+  <source src="/media/white.webm" type="video/webm">
+  <source src="/media/white.mp4" type="video/mp4">
+</video>
+<script type="text/javascript">
+  document.getElementsByTagName('video')[0].addEventListener('play', (event) => {
+    takeScreenshot();
+  });
+</script>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-video-hidden.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-video-hidden.html
new file mode 100644
index 000000000000..aaa866ca72d9
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-video-hidden.html
@@ -0,0 +1,29 @@
+<!doctype html>
+<html class="reftest-wait">
+<meta charset="utf-8">
+<title>Verifies overflow: hidden applies to video elements</title>
+<link rel="help" href="https://drafts.csswg.org/css-overflow/#propdef-overflow">
+<link rel="help" href="https://bugzilla.mozilla.org/show_bug.cgi?id=2020992">
+<link rel="mismatch" href="overflow-video-ref.html">
+<script src="/common/reftest-wait.js"></script>
+<style>
+  body {
+    background: grey;
+  }
+  .default {
+    width: 100px;
+    height: 100px;
+    object-fit: none;
+    object-position: 0% 0%;
+    overflow: hidden;
+  }
+</style>
+<video autoplay class="default">
+  <source src="/media/white.webm" type="video/webm">
+  <source src="/media/white.mp4" type="video/mp4">
+</video>
+<script type="text/javascript">
+  document.getElementsByTagName('video')[0].addEventListener('play', (event) => {
+    takeScreenshot();
+  });
+</script>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/WEB_FEATURES.yml b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/WEB_FEATURES.yml
index 7db666f28122..773f30e499bf 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/WEB_FEATURES.yml
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/WEB_FEATURES.yml
@@ -1,20 +1,9 @@
-features:
-- name: overflow-clip-margin
-  files:
-  - overflow-clip-margin*
-- name: scroll-markers
-  files:
-  - scroll-markers*
-- name: scroll-buttons
-  files:
-  - scroll-button*
-- name: scrollbar-gutter
-  files:
-  - scrollbar-gutter-*
-- name: line-clamp
-  files:
-  - line-clamp-*
-  - webkit-line-clamp-*
-- name: text-overflow
-  files:
-  - text-overflow-*
+rules:
+- overflow-clip-margin*: [overflow-clip-margin]
+- scroll-markers*: [scroll-markers]
+- scroll-button*: [scroll-buttons]
+- scroll-target-group*: [scroll-target-group]
+- scrollbar-gutter-*: [scrollbar-gutter]
+- line-clamp-*: [line-clamp]
+- webkit-line-clamp-*: [line-clamp]
+- text-overflow-*: [text-overflow]
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/block-ellipsis-invalid-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/block-ellipsis-invalid-expected.txt
index b8b1e2aa7e69..a9047ff04b41 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/block-ellipsis-invalid-expected.txt
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/block-ellipsis-invalid-expected.txt
@@ -1,9 +1,12 @@
 
 PASS e.style['block-ellipsis'] = "hidden" should not set the property value
 PASS e.style['block-ellipsis'] = "none" should not set the property value
+FAIL e.style['block-ellipsis'] = "auto" should not set the property value assert_equals: expected "" but got "auto"
 PASS e.style['block-ellipsis'] = "none auto" should not set the property value
 PASS e.style['block-ellipsis'] = "no-ellipsis auto" should not set the property value
+PASS e.style['block-ellipsis'] = "ellipsis auto" should not set the property value
 PASS e.style['block-ellipsis'] = "auto \"string\"" should not set the property value
+PASS e.style['block-ellipsis'] = "ellipsis \"string\"" should not set the property value
 PASS e.style['block-ellipsis'] = "\"string\" none" should not set the property value
 PASS e.style['block-ellipsis'] = "\"string\" no-ellipsis" should not set the property value
 PASS e.style['block-ellipsis'] = "\"first\" \"second\"" should not set the property value
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/block-ellipsis-invalid.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/block-ellipsis-invalid.html
index e9fcca411d90..486ddae01299 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/block-ellipsis-invalid.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/block-ellipsis-invalid.html
@@ -4,7 +4,7 @@
 <meta charset="utf-8">
 <title>CSS Overflow: parsing block-ellipsis with invalid values</title>
 <link rel="help" href="https://drafts.csswg.org/css-overflow/#propdef-block-ellipsis">
-<meta name="assert" content="block-ellipsis supports only the grammar 'no-ellipsis | auto | <string>'.">
+<meta name="assert" content="block-ellipsis supports only the grammar 'no-ellipsis | ellipsis | <string>'.">
 <script src="/resources/testharness.js"></script>
 <script src="/resources/testharnessreport.js"></script>
 <script src="/css/support/parsing-testcommon.js"></script>
@@ -13,10 +13,13 @@
 <script>
 test_invalid_value("block-ellipsis", 'hidden');
 test_invalid_value("block-ellipsis", 'none');
+test_invalid_value("block-ellipsis", 'auto');
 
 test_invalid_value("block-ellipsis", 'none auto');
 test_invalid_value("block-ellipsis", 'no-ellipsis auto');
+test_invalid_value("block-ellipsis", 'ellipsis auto');
 test_invalid_value("block-ellipsis", 'auto "string"');
+test_invalid_value("block-ellipsis", 'ellipsis "string"');
 test_invalid_value("block-ellipsis", '"string" none');
 test_invalid_value("block-ellipsis", '"string" no-ellipsis');
 test_invalid_value("block-ellipsis", '"first" "second"');
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/block-ellipsis-valid-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/block-ellipsis-valid-expected.txt
index a0aa14889610..0905141a3bb8 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/block-ellipsis-valid-expected.txt
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/block-ellipsis-valid-expected.txt
@@ -1,5 +1,5 @@
 
 PASS e.style['block-ellipsis'] = "no-ellipsis" should set the property value
-PASS e.style['block-ellipsis'] = "auto" should set the property value
+FAIL e.style['block-ellipsis'] = "ellipsis" should set the property value assert_not_equals: property should be set got disallowed value ""
 PASS e.style['block-ellipsis'] = "\" etc., etc. \"" should set the property value
 
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/block-ellipsis-valid.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/block-ellipsis-valid.html
index c761e7cf6644..84fb7db53031 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/block-ellipsis-valid.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/block-ellipsis-valid.html
@@ -4,7 +4,7 @@
 <meta charset="utf-8">
 <title>CSS Overflow: parsing block-ellipsis with valid values</title>
 <link rel="help" href="https://drafts.csswg.org/css-overflow/#propdef-block-ellipsis">
-<meta name="assert" content="block-ellipsis supports the full grammar 'no-ellipsis | auto | <string>'.">
+<meta name="assert" content="block-ellipsis supports the full grammar 'no-ellipsis | ellipsis | <string>'.">
 <script src="/resources/testharness.js"></script>
 <script src="/resources/testharnessreport.js"></script>
 <script src="/css/support/parsing-testcommon.js"></script>
@@ -12,7 +12,7 @@
 <body>
 <script>
 test_valid_value("block-ellipsis", 'no-ellipsis');
-test_valid_value("block-ellipsis", 'auto');
+test_valid_value("block-ellipsis", 'ellipsis');
 test_valid_value("block-ellipsis", '" etc., etc. "');
 </script>
 </body>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/continue-invalid-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/continue-invalid-expected.txt
index ebbb5240a0d1..0a4ce5c68f5a 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/continue-invalid-expected.txt
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/continue-invalid-expected.txt
@@ -1,6 +1,11 @@
 
 PASS e.style['continue'] = "none" should not set the property value
+FAIL e.style['continue'] = "auto" should not set the property value assert_equals: expected "" but got "auto"
 PASS e.style['continue'] = "auto discard" should not set the property value
 PASS e.style['continue'] = "auto collapse" should not set the property value
 PASS e.style['continue'] = "auto -webkit-legacy" should not set the property value
+PASS e.style['continue'] = "normal discard" should not set the property value
+PASS e.style['continue'] = "normal collapse" should not set the property value
+PASS e.style['continue'] = "normal -webkit-legacy" should not set the property value
+PASS e.style['continue'] = "collapse -webkit-legacy" should not set the property value
 
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/continue-invalid.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/continue-invalid.html
index df09e0912beb..6c14c7751bb2 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/continue-invalid.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/continue-invalid.html
@@ -4,7 +4,7 @@
 <meta charset="utf-8">
 <title>CSS Overflow: parsing continue with invalid values</title>
 <link rel="help" href="https://drafts.csswg.org/css-overflow-4/#propdef-continue">
-<meta name="assert" content="continue supports only the grammar 'auto | discard | collapse', as well as '-webkit-legacy' for legacy compatibility.">
+<meta name="assert" content="continue supports only the grammar 'normal | discard | collapse', as well as '-webkit-legacy' for legacy compatibility.">
 <script src="/resources/testharness.js"></script>
 <script src="/resources/testharnessreport.js"></script>
 <script src="/css/support/parsing-testcommon.js"></script>
@@ -12,10 +12,15 @@
 <body>
 <script>
 test_invalid_value("continue", 'none');
+test_invalid_value("continue", 'auto');
 
 test_invalid_value("continue", 'auto discard');
 test_invalid_value("continue", 'auto collapse');
 test_invalid_value("continue", 'auto -webkit-legacy');
+test_invalid_value("continue", 'normal discard');
+test_invalid_value("continue", 'normal collapse');
+test_invalid_value("continue", 'normal -webkit-legacy');
+test_invalid_value("continue", 'collapse -webkit-legacy');
 </script>
 </body>
 </html>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/continue-valid-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/continue-valid-expected.txt
index ba991634ee46..c987fbffd116 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/continue-valid-expected.txt
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/continue-valid-expected.txt
@@ -1,5 +1,5 @@
 
-PASS e.style['continue'] = "auto" should set the property value
+FAIL e.style['continue'] = "normal" should set the property value assert_not_equals: property should be set got disallowed value ""
 PASS e.style['continue'] = "discard" should set the property value
 FAIL e.style['continue'] = "collapse" should set the property value assert_not_equals: property should be set got disallowed value ""
 FAIL e.style['continue'] = "-webkit-legacy" should set the property value assert_not_equals: property should be set got disallowed value ""
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/continue-valid.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/continue-valid.html
index 9d9f71e79ccf..571678e81739 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/continue-valid.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/continue-valid.html
@@ -4,14 +4,14 @@
 <meta charset="utf-8">
 <title>CSS Overflow: parsing continue with valid values</title>
 <link rel="help" href="https://drafts.csswg.org/css-overflow-4/#propdef-continue">
-<meta name="assert" content="continue supports the full grammar 'auto | discard | collapse', as well as '-webkit-legacy' for legacy compatibility.">
+<meta name="assert" content="continue supports the full grammar 'normal | discard | collapse', as well as '-webkit-legacy' for legacy compatibility.">
 <script src="/resources/testharness.js"></script>
 <script src="/resources/testharnessreport.js"></script>
 <script src="/css/support/parsing-testcommon.js"></script>
 </head>
 <body>
 <script>
-test_valid_value("continue", 'auto');
+test_valid_value("continue", 'normal');
 test_valid_value("continue", 'discard');
 test_valid_value("continue", 'collapse');
 test_valid_value("continue", '-webkit-legacy');
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/getComputedStyle-scroll-button-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/getComputedStyle-scroll-button-expected.txt
new file mode 100644
index 000000000000..e23a1b1f686b
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/getComputedStyle-scroll-button-expected.txt
@@ -0,0 +1,7 @@
+
+FAIL inline-start and left map to the same pseudo-element in horizontal LTR assert_equals: inline-start should return cascaded 'B' expected "\"B\"" but got ""
+FAIL Writing-mode vertical-rl LTR correctly maps logical directions to physical directions assert_equals: inline-start should map to up and be overwritten expected "\"V-Up\"" but got ""
+FAIL getComputedStyle() resolves properties when pseudo-element is not created due to no content assert_equals: Should return default 'normal' content expected "normal" but got ""
+FAIL getComputedStyle() resolves properties when the originating element is not a scroll container assert_equals: Should correctly resolve styled content expected "\"<\"" but got ""
+PASS getComputedStyle() with invalid argument falls back cleanly and does not crash
+
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/getComputedStyle-scroll-button.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/getComputedStyle-scroll-button.html
new file mode 100644
index 000000000000..2bc156e9b646
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/getComputedStyle-scroll-button.html
@@ -0,0 +1,143 @@
+<!doctype html>
+<meta charset="utf-8">
+<title>CSS Overflow Test: getComputedStyle() resolves different properties for scroll-button pseudo-elements</title>
+<link rel="help" href="https://drafts.csswg.org/css-overflow-5/#scroll-buttons">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<style>
+  .scroller {
+    width: 200px;
+    height: 200px;
+    overflow: auto;
+  }
+  #scroller-vertical {
+    writing-mode: vertical-rl;
+    direction: ltr;
+  }
+
+  /* Test 1: Horizontal LTR synonym matching */
+  #scroller-horizontal::scroll-button(inline-start) {
+    content: "A";
+    width: 30px;
+    height: 20px;
+  }
+  #scroller-horizontal::scroll-button(left) {
+    content: "B"; /* Should cascade and overwrite inline-start */
+    width: 35px;
+    height: 20px;
+  }
+
+  /* Test 2: Vertical-RL writing mode mapping */
+  #scroller-vertical::scroll-button(inline-start) {
+    content: "V-Start";
+    width: 45px;
+    height: 20px;
+  }
+  #scroller-vertical::scroll-button(up) {
+    content: "V-Up"; /* Should cascade and overwrite inline-start (which is up) */
+    width: 50px;
+    height: 20px;
+  }
+  #scroller-vertical::scroll-button(block-start) {
+    content: "V-BStart";
+    width: 55px;
+    height: 20px;
+  }
+  #scroller-vertical::scroll-button(right) {
+    content: "V-Right"; /* Should cascade and overwrite block-start (which is right) */
+    width: 60px;
+    height: 20px;
+  }
+
+  /* Test 3: Scroll button styled without 'content' (not generated) */
+  #scroller-no-content::scroll-button(inline-start) {
+    width: 80px;
+    height: 20px;
+  }
+
+  /* Test 4: Non-scroller originating element */
+  #not-scroller::scroll-button(inline-start) {
+    content: "<";
+    width: 90px;
+    height: 20px;
+  }
+</style>
+<div id="scroller-horizontal" class="scroller">
+  <div style="width: 500px; height: 100px;"></div>
+</div>
+<div id="scroller-vertical" class="scroller">
+  <div style="width: 500px; height: 500px;"></div>
+</div>
+<div id="scroller-no-content" class="scroller">
+  <div style="width: 500px; height: 100px;"></div>
+</div>
+<div id="not-scroller" style="width: 100px; height: 100px;"></div>
+<script>
+  test(() => {
+    const scroller = document.getElementById("scroller-horizontal");
+    const styleStart = getComputedStyle(scroller, "::scroll-button(inline-start)");
+    const styleLeft = getComputedStyle(scroller, "::scroll-button(left)");
+
+    // In horizontal LTR, inline-start and left map to the same pseudo-element.
+    // Therefore, the 'left' rule (defined later) should cascade and overwrite
+    // the 'inline-start' rule, and both queries must return identical values.
+    assert_equals(styleStart.content, '"B"', "inline-start should return cascaded 'B'");
+    assert_equals(styleStart.width, "35px", "inline-start should return cascaded 35px");
+
+    assert_equals(styleLeft.content, '"B"', "left should return cascaded 'B'");
+    assert_equals(styleLeft.width, "35px", "left should return cascaded 35px");
+  }, "inline-start and left map to the same pseudo-element in horizontal LTR");
+
+  test(() => {
+    const scroller = document.getElementById("scroller-vertical");
+
+    // In vertical-rl LTR, inline-start is up (top).
+    // Therefore, 'up' (defined later) should overwrite 'inline-start'.
+    const styleStart = getComputedStyle(scroller, "::scroll-button(inline-start)");
+    const styleUp = getComputedStyle(scroller, "::scroll-button(up)");
+
+    assert_equals(styleStart.content, '"V-Up"', "inline-start should map to up and be overwritten");
+    assert_equals(styleStart.width, "50px", "inline-start width should be overwritten");
+    assert_equals(styleUp.content, '"V-Up"', "up should return 'V-Up'");
+    assert_equals(styleUp.width, "50px", "up width should be 50px");
+
+    // In vertical-rl LTR, block-start is right.
+    // Therefore, 'right' (defined later) should overwrite 'block-start'.
+    const styleBStart = getComputedStyle(scroller, "::scroll-button(block-start)");
+    const styleRight = getComputedStyle(scroller, "::scroll-button(right)");
+
+    assert_equals(styleBStart.content, '"V-Right"', "block-start should map to right and be overwritten");
+    assert_equals(styleBStart.width, "60px", "block-start width should be overwritten");
+    assert_equals(styleRight.content, '"V-Right"', "right should return 'V-Right'");
+    assert_equals(styleRight.width, "60px", "right width should be 60px");
+  }, "Writing-mode vertical-rl LTR correctly maps logical directions to physical directions");
+
+  test(() => {
+    const scroller = document.getElementById("scroller-no-content");
+    const styleStart = getComputedStyle(scroller, "::scroll-button(inline-start)");
+
+    // The pseudo-element is not created because it has no content.
+    // However, getComputedStyle() should still resolve and return the styled width.
+    assert_equals(styleStart.content, "normal", "Should return default 'normal' content");
+    assert_equals(styleStart.width, "80px", "Should correctly resolve styled width");
+  }, "getComputedStyle() resolves properties when pseudo-element is not created due to no content");
+
+  test(() => {
+    const notScroller = document.getElementById("not-scroller");
+    const styleStart = getComputedStyle(notScroller, "::scroll-button(inline-start)");
+
+    // The originating element is not a scroll container, so the pseudo-element
+    // is generated in a disabled state (since it has styled content).
+    // getComputedStyle() should resolve and return its styled properties correctly.
+    assert_equals(styleStart.content, '"<"', "Should correctly resolve styled content");
+    assert_equals(styleStart.width, "90px", "Should correctly resolve styled width");
+  }, "getComputedStyle() resolves properties when the originating element is not a scroll container");
+
+  test(() => {
+    const scroller = document.getElementById("scroller-horizontal");
+    const styleInvalid = getComputedStyle(scroller, "::scroll-button(invalid-argument)");
+
+    // Invalid argument should not crash the browser, and instead fall back cleanly.
+    assert_equals(styleInvalid.width, "", "Should fall back cleanly and return empty width");
+  }, "getComputedStyle() with invalid argument falls back cleanly and does not crash");
+</script>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/line-clamp-invalid-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/line-clamp-invalid-expected.txt
index 39fccc90cde1..969bd90e82e5 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/line-clamp-invalid-expected.txt
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/line-clamp-invalid-expected.txt
@@ -4,6 +4,7 @@ PASS e.style['line-clamp'] = "-5" should not set the property value
 PASS e.style['line-clamp'] = "none 2" should not set the property value
 PASS e.style['line-clamp'] = "none no-ellipsis" should not set the property value
 PASS e.style['line-clamp'] = "3 none" should not set the property value
+PASS e.style['line-clamp'] = "3 ellipsis auto" should not set the property value
 PASS e.style['line-clamp'] = "-webkit-legacy" should not set the property value
 PASS e.style['line-clamp'] = "0 -webkit-legacy" should not set the property value
 
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/line-clamp-invalid.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/line-clamp-invalid.html
index 36665f7d9bb6..6d3155714934 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/line-clamp-invalid.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/line-clamp-invalid.html
@@ -18,6 +18,7 @@
 test_invalid_value("line-clamp", 'none 2');
 test_invalid_value("line-clamp", 'none no-ellipsis');
 test_invalid_value("line-clamp", '3 none');
+test_invalid_value("line-clamp", '3 ellipsis auto');
 
 test_invalid_value("line-clamp", '-webkit-legacy');
 test_invalid_value("line-clamp", '0 -webkit-legacy');
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/line-clamp-valid-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/line-clamp-valid-expected.txt
index 088a30672e3d..3c45aa81db79 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/line-clamp-valid-expected.txt
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/line-clamp-valid-expected.txt
@@ -3,12 +3,15 @@ PASS e.style['line-clamp'] = "none" should set the property value
 PASS e.style['line-clamp'] = "1" should set the property value
 PASS e.style['line-clamp'] = "6" should set the property value
 FAIL e.style['line-clamp'] = "auto" should set the property value assert_not_equals: property should be set got disallowed value ""
+FAIL e.style['line-clamp'] = "ellipsis" should set the property value assert_not_equals: property should be set got disallowed value ""
 FAIL e.style['line-clamp'] = "\" etc., etc. \"" should set the property value assert_not_equals: property should be set got disallowed value ""
 FAIL e.style['line-clamp'] = "7 no-ellipsis" should set the property value assert_not_equals: property should be set got disallowed value ""
-PASS e.style['line-clamp'] = "8 auto" should set the property value
+FAIL e.style['line-clamp'] = "8 auto" should set the property value assert_equals: serialization should be canonical expected "8 auto" but got "8"
+FAIL e.style['line-clamp'] = "8 ellipsis" should set the property value assert_not_equals: property should be set got disallowed value ""
 PASS e.style['line-clamp'] = "9 \" etc., etc. \"" should set the property value
 FAIL e.style['line-clamp'] = "no-ellipsis 10" should set the property value assert_not_equals: property should be set got disallowed value ""
-PASS e.style['line-clamp'] = "auto 11" should set the property value
+FAIL e.style['line-clamp'] = "auto 11" should set the property value assert_equals: serialization should be canonical expected "11 auto" but got "11"
+FAIL e.style['line-clamp'] = "ellipsis 11" should set the property value assert_not_equals: property should be set got disallowed value ""
 PASS e.style['line-clamp'] = "\" etc., etc. \" 12" should set the property value
 FAIL e.style['line-clamp'] = "1 -webkit-legacy" should set the property value assert_not_equals: property should be set got disallowed value ""
 FAIL e.style['line-clamp'] = "auto -webkit-legacy" should set the property value assert_not_equals: property should be set got disallowed value ""
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/line-clamp-valid.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/line-clamp-valid.html
index 870049809b2d..e8d76921e795 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/line-clamp-valid.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/line-clamp-valid.html
@@ -15,22 +15,26 @@
 
 test_valid_value("line-clamp", '1');
 test_valid_value("line-clamp", '6');
-
 test_valid_value("line-clamp", 'auto');
-test_valid_value("line-clamp", '" etc., etc. "');
+
+test_valid_value("line-clamp", 'ellipsis', 'auto');
+test_valid_value("line-clamp", '" etc., etc. "', 'auto " etc., etc. "');
 
 test_valid_value("line-clamp", '7 no-ellipsis');
-test_valid_value("line-clamp", '8 auto', '8');
+test_valid_value("line-clamp", '8 auto');
+test_valid_value("line-clamp", '8 ellipsis', '8');
 test_valid_value("line-clamp", '9 " etc., etc. "');
 
 test_valid_value("line-clamp", 'no-ellipsis 10', '10 no-ellipsis');
-test_valid_value("line-clamp", 'auto 11', '11');
+test_valid_value("line-clamp", 'auto 11', '11 auto');
+test_valid_value("line-clamp", 'ellipsis 11', '11');
 test_valid_value("line-clamp", '" etc., etc. " 12', '12 " etc., etc. "');
 
 test_valid_value("line-clamp", '1 -webkit-legacy');
 test_valid_value("line-clamp", 'auto -webkit-legacy');
-test_valid_value("line-clamp", 'no-ellipsis -webkit-legacy');
-test_valid_value("line-clamp", '3 auto -webkit-legacy', '3 -webkit-legacy');
+test_valid_value("line-clamp", 'no-ellipsis -webkit-legacy',
+                 'auto no-ellipsis -webkit-legacy');
+test_valid_value("line-clamp", '3 auto -webkit-legacy');
 </script>
 </body>
 </html>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/max-lines-invalid-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/max-lines-invalid-expected.txt
index e677f48aa9aa..a0590005992d 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/max-lines-invalid-expected.txt
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/max-lines-invalid-expected.txt
@@ -1,8 +1,9 @@
 
-PASS e.style['max-lines'] = "auto" should not set the property value
+FAIL e.style['max-lines'] = "none" should not set the property value assert_equals: expected "" but got "none"
 PASS e.style['max-lines'] = "0" should not set the property value
 PASS e.style['max-lines'] = "-5" should not set the property value
 PASS e.style['max-lines'] = "none none" should not set the property value
+PASS e.style['max-lines'] = "auto auto" should not set the property value
 PASS e.style['max-lines'] = "1 none" should not set the property value
 PASS e.style['max-lines'] = "none 2" should not set the property value
 PASS e.style['max-lines'] = "3 4" should not set the property value
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/max-lines-invalid.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/max-lines-invalid.html
index 8b6da0dcb896..5fa973650be6 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/max-lines-invalid.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/max-lines-invalid.html
@@ -12,11 +12,12 @@
 </head>
 <body>
 <script>
-test_invalid_value("max-lines", 'auto');
+test_invalid_value("max-lines", 'none');
 test_invalid_value("max-lines", '0');
 test_invalid_value("max-lines", '-5');
 
 test_invalid_value("max-lines", 'none none');
+test_invalid_value("max-lines", 'auto auto');
 test_invalid_value("max-lines", '1 none');
 test_invalid_value("max-lines", 'none 2');
 test_invalid_value("max-lines", '3 4');
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/max-lines-valid-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/max-lines-valid-expected.txt
index d8c16ff70a5f..c4ec53748583 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/max-lines-valid-expected.txt
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/max-lines-valid-expected.txt
@@ -1,5 +1,7 @@
 
-PASS e.style['max-lines'] = "none" should set the property value
+FAIL e.style['max-lines'] = "auto" should set the property value assert_not_equals: property should be set got disallowed value ""
 PASS e.style['max-lines'] = "1" should set the property value
 PASS e.style['max-lines'] = "6" should set the property value
+FAIL e.style['max-lines'] = "7 auto" should set the property value assert_not_equals: property should be set got disallowed value ""
+FAIL e.style['max-lines'] = "auto 8" should set the property value assert_not_equals: property should be set got disallowed value ""
 
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/max-lines-valid.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/max-lines-valid.html
index 431eb5b45736..11cf13d03b02 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/max-lines-valid.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/max-lines-valid.html
@@ -11,9 +11,11 @@
 </head>
 <body>
 <script>
-test_valid_value("max-lines", 'none');
+test_valid_value("max-lines", 'auto');
 test_valid_value("max-lines", '1');
 test_valid_value("max-lines", '6');
+test_valid_value("max-lines", '7 auto');
+test_valid_value("max-lines", 'auto 8', '8 auto');
 </script>
 </body>
 </html>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/overflow-clip-margin-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/overflow-clip-margin-expected.txt
index e94cb0959024..5054b44d3ab3 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/overflow-clip-margin-expected.txt
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/overflow-clip-margin-expected.txt
@@ -23,4 +23,5 @@ PASS e.style['overflow-clip-margin'] = "border-box calc(0.5em - 100px)" should s
 PASS e.style['overflow-clip-margin'] = "border-box calc(0.5em - 100%)" should not set the property value
 PASS e.style['overflow-clip-margin'] = "margin-box" should not set the property value
 PASS e.style['overflow-clip-margin'] = "inset(10px)" should not set the property value
+PASS e.style['overflow-clip-margin'] = "50px 50px" should not set the property value
 
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/overflow-clip-margin.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/overflow-clip-margin.html
index e1efee596ec0..2a1b988c5724 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/overflow-clip-margin.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/overflow-clip-margin.html
@@ -40,6 +40,7 @@
 
 test_invalid_value("overflow-clip-margin", 'margin-box');
 test_invalid_value("overflow-clip-margin", 'inset(10px)');
+test_invalid_value("overflow-clip-margin", '50px 50px');
 </script>
 </body>
 </html>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/overflow-computed-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/overflow-computed-expected.txt
index fa7112933026..1dd040b531b4 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/overflow-computed-expected.txt
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/overflow-computed-expected.txt
@@ -5,17 +5,17 @@ PASS Property overflow value 'clip'
 PASS Property overflow value 'scroll'
 PASS Property overflow value 'auto'
 PASS Property overflow value 'auto auto'
-PASS Property overflow value 'auto clip'
+FAIL Property overflow value 'auto clip' assert_equals: expected "auto clip" but got "auto hidden"
 PASS Property overflow value 'auto visible'
-PASS Property overflow value 'clip auto'
+FAIL Property overflow value 'clip auto' assert_equals: expected "clip auto" but got "hidden auto"
 PASS Property overflow value 'clip clip'
-PASS Property overflow value 'clip hidden'
-PASS Property overflow value 'clip scroll'
+FAIL Property overflow value 'clip hidden' assert_equals: expected "clip hidden" but got "hidden"
+FAIL Property overflow value 'clip scroll' assert_equals: expected "clip scroll" but got "hidden scroll"
 PASS Property overflow value 'clip visible'
-PASS Property overflow value 'hidden clip'
+FAIL Property overflow value 'hidden clip' assert_equals: expected "hidden clip" but got "hidden"
 PASS Property overflow value 'hidden visible'
 PASS Property overflow value 'scroll auto'
-PASS Property overflow value 'scroll clip'
+FAIL Property overflow value 'scroll clip' assert_equals: expected "scroll clip" but got "scroll hidden"
 PASS Property overflow value 'scroll visible'
 PASS Property overflow value 'visible auto'
 PASS Property overflow value 'visible hidden'
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/overflow-computed.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/overflow-computed.html
index 563d1b31d259..a7d6e2fa3133 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/overflow-computed.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/overflow-computed.html
@@ -4,7 +4,7 @@
 <meta charset="utf-8">
 <title>CSS Overflow: getComputedStyle().overflow</title>
 <link rel="help" href="https://drafts.csswg.org/css-overflow/#propdef-overflow">
-<meta name="assert" content="visible/clip compute to auto/hidden (respectively) if one of overflow-x or overflow-y is neither visible nor clip.">
+<meta name="assert" content="visible computes to auto if one of overflow-x or overflow-y is neither visible nor clip.">
 <script src="/resources/testharness.js"></script>
 <script src="/resources/testharnessreport.js"></script>
 <script src="/css/support/computed-testcommon.js"></script>
@@ -19,17 +19,17 @@
 test_computed_value("overflow", 'auto');
 
 test_computed_value("overflow", 'auto auto', 'auto');
-test_computed_value("overflow", 'auto clip', 'auto hidden');
+test_computed_value("overflow", 'auto clip');
 test_computed_value("overflow", 'auto visible', 'auto');
-test_computed_value("overflow", 'clip auto', 'hidden auto');
+test_computed_value("overflow", 'clip auto');
 test_computed_value("overflow", 'clip clip', 'clip');
-test_computed_value("overflow", 'clip hidden', 'hidden');
-test_computed_value("overflow", 'clip scroll', 'hidden scroll')
-test_computed_value("overflow", 'clip visible', 'clip visible')
-test_computed_value("overflow", 'hidden clip', 'hidden');
+test_computed_value("overflow", 'clip hidden');
+test_computed_value("overflow", 'clip scroll');
+test_computed_value("overflow", 'clip visible', 'clip visible');
+test_computed_value("overflow", 'hidden clip');
 test_computed_value("overflow", 'hidden visible', 'hidden auto');
 test_computed_value("overflow", 'scroll auto');
-test_computed_value("overflow", 'scroll clip', 'scroll hidden');
+test_computed_value("overflow", 'scroll clip');
 test_computed_value("overflow", 'scroll visible', 'scroll auto');
 test_computed_value("overflow", 'visible auto', 'auto');
 test_computed_value("overflow", 'visible hidden', 'auto hidden');
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/scroll-axis-lock-computed-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/scroll-axis-lock-computed-expected.txt
new file mode 100644
index 000000000000..dccad9439cd0
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/scroll-axis-lock-computed-expected.txt
@@ -0,0 +1,10 @@
+
+FAIL Property scroll-axis-lock value 'initial' assert_true: scroll-axis-lock doesn't seem to be supported in the computed style expected true got false
+FAIL Property scroll-axis-lock value 'inherit' assert_true: scroll-axis-lock doesn't seem to be supported in the computed style expected true got false
+FAIL Property scroll-axis-lock value 'unset' assert_true: scroll-axis-lock doesn't seem to be supported in the computed style expected true got false
+FAIL Property scroll-axis-lock value 'revert' assert_true: scroll-axis-lock doesn't seem to be supported in the computed style expected true got false
+FAIL Property scroll-axis-lock value 'auto' assert_true: scroll-axis-lock doesn't seem to be supported in the computed style expected true got false
+FAIL Property scroll-axis-lock value 'none' assert_true: scroll-axis-lock doesn't seem to be supported in the computed style expected true got false
+FAIL The scroll-axis-lock property shows up in CSSStyleDeclaration enumeration assert_not_equals: got disallowed value -1
+FAIL The scroll-axis-lock property shows up in CSSStyleDeclaration.cssText assert_not_equals: got disallowed value -1
+
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/scroll-axis-lock-computed.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/scroll-axis-lock-computed.html
new file mode 100644
index 000000000000..6b14cd9165d0
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/scroll-axis-lock-computed.html
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Overflow: parsing scroll-axis-lock property computed values</title>
+<link rel="help" href="https://drafts.csswg.org/css-overflow-5/#scroll-axis-lock">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/css/support/computed-testcommon.js"></script>
+<div id="target"></div>
+<script>
+  test_computed_value('scroll-axis-lock', 'initial', 'auto');
+  test_computed_value('scroll-axis-lock', 'inherit', 'auto');
+  test_computed_value('scroll-axis-lock', 'unset', 'auto');
+  test_computed_value('scroll-axis-lock', 'revert', 'auto');
+
+  test_computed_value('scroll-axis-lock', 'auto');
+  test_computed_value('scroll-axis-lock', 'none');
+
+  test(() => {
+    let style = getComputedStyle(document.getElementById('target'));
+    assert_not_equals(Array.from(style).indexOf('scroll-axis-lock'), -1);
+  }, 'The scroll-axis-lock property shows up in CSSStyleDeclaration enumeration');
+
+  test(() => {
+    let style = document.getElementById('target').style;
+    assert_not_equals(style.cssText.indexOf('scroll-axis-lock'), -1);
+  }, 'The scroll-axis-lock property shows up in CSSStyleDeclaration.cssText');
+</script>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/scroll-axis-lock-invalid-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/scroll-axis-lock-invalid-expected.txt
new file mode 100644
index 000000000000..45a60854380f
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/scroll-axis-lock-invalid-expected.txt
@@ -0,0 +1,9 @@
+
+PASS e.style['scroll-axis-lock'] = "10" should not set the property value
+PASS e.style['scroll-axis-lock'] = "true" should not set the property value
+PASS e.style['scroll-axis-lock'] = "default" should not set the property value
+PASS e.style['scroll-axis-lock'] = "all" should not set the property value
+PASS e.style['scroll-axis-lock'] = "auto, none" should not set the property value
+PASS e.style['scroll-axis-lock'] = "always" should not set the property value
+PASS e.style['scroll-axis-lock'] = "both" should not set the property value
+
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/scroll-axis-lock-invalid.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/scroll-axis-lock-invalid.html
new file mode 100644
index 000000000000..00e5b920a8b4
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/scroll-axis-lock-invalid.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Overflow: parsing scroll-axis-lock property invalid values</title>
+<link rel="help" href="https://drafts.csswg.org/css-overflow-5/#scroll-axis-lock">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/css/support/parsing-testcommon.js"></script>
+<div id="target"></div>
+<script>
+  test_invalid_value('scroll-axis-lock', '10');
+  test_invalid_value('scroll-axis-lock', 'true');
+  test_invalid_value('scroll-axis-lock', 'default');
+  test_invalid_value('scroll-axis-lock', 'all');
+  test_invalid_value('scroll-axis-lock', 'auto, none');
+  test_invalid_value('scroll-axis-lock', 'always');
+  test_invalid_value('scroll-axis-lock', 'both');
+</script>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/scroll-axis-lock-valid-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/scroll-axis-lock-valid-expected.txt
new file mode 100644
index 000000000000..4a367297066c
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/scroll-axis-lock-valid-expected.txt
@@ -0,0 +1,8 @@
+
+FAIL e.style['scroll-axis-lock'] = "initial" should set the property value assert_not_equals: property should be set got disallowed value ""
+FAIL e.style['scroll-axis-lock'] = "inherit" should set the property value assert_not_equals: property should be set got disallowed value ""
+FAIL e.style['scroll-axis-lock'] = "unset" should set the property value assert_not_equals: property should be set got disallowed value ""
+FAIL e.style['scroll-axis-lock'] = "revert" should set the property value assert_not_equals: property should be set got disallowed value ""
+FAIL e.style['scroll-axis-lock'] = "auto" should set the property value assert_not_equals: property should be set got disallowed value ""
+FAIL e.style['scroll-axis-lock'] = "none" should set the property value assert_not_equals: property should be set got disallowed value ""
+
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/scroll-axis-lock-valid.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/scroll-axis-lock-valid.html
new file mode 100644
index 000000000000..0a67bba52b2b
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/scroll-axis-lock-valid.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Overflow: parsing scroll-axis-lock property valid values</title>
+<link rel="help" href="https://drafts.csswg.org/css-overflow-5/#scroll-axis-lock">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/css/support/parsing-testcommon.js"></script>
+<div id="target"></div>
+<script>
+  test_valid_value('scroll-axis-lock', 'initial');
+  test_valid_value('scroll-axis-lock', 'inherit');
+  test_valid_value('scroll-axis-lock', 'unset');
+  test_valid_value('scroll-axis-lock', 'revert');
+
+  test_valid_value("scroll-axis-lock", 'auto');
+  test_valid_value("scroll-axis-lock", 'none');
+</script>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/scroll-markers-computed.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/scroll-markers-computed.html
index 882ed83fe723..b9a68c20f094 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/scroll-markers-computed.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/scroll-markers-computed.html
@@ -18,8 +18,8 @@
   test_computed_value('scroll-marker-group', 'revert', 'none');
 
   test_computed_value('scroll-marker-group', 'none');
-  test_computed_value('scroll-marker-group', 'before');
-  test_computed_value('scroll-marker-group', 'after');
+  test_computed_value('scroll-marker-group', 'before', 'before links');
+  test_computed_value('scroll-marker-group', 'after', 'after links');
 
   test(() => {
     let style = getComputedStyle(document.getElementById('target'));
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/text-overflow-computed-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/text-overflow-computed-expected.txt
index e20a35252395..4194f4bc6160 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/text-overflow-computed-expected.txt
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/text-overflow-computed-expected.txt
@@ -1,7 +1,7 @@
 
 PASS Property text-overflow value 'clip'
 PASS Property text-overflow value 'ellipsis'
-FAIL Property text-overflow value '""' assert_true: '""' is a supported value for text-overflow. expected true got false
-FAIL Property text-overflow value '"-"' assert_true: '"-"' is a supported value for text-overflow. expected true got false
-FAIL Property text-overflow value '"marker string"' assert_true: '"marker string"' is a supported value for text-overflow. expected true got false
+PASS Property text-overflow value '""'
+PASS Property text-overflow value '"-"'
+PASS Property text-overflow value '"marker string"'
 
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/text-overflow-valid-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/text-overflow-valid-expected.txt
index 6da8efaf3cc8..7d238f2b3c1b 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/text-overflow-valid-expected.txt
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/text-overflow-valid-expected.txt
@@ -1,7 +1,7 @@
 
 PASS e.style['text-overflow'] = "clip" should set the property value
 PASS e.style['text-overflow'] = "ellipsis" should set the property value
-FAIL e.style['text-overflow'] = "\"\"" should set the property value assert_not_equals: property should be set got disallowed value ""
-FAIL e.style['text-overflow'] = "\"-\"" should set the property value assert_not_equals: property should be set got disallowed value ""
-FAIL e.style['text-overflow'] = "\"marker string\"" should set the property value assert_not_equals: property should be set got disallowed value ""
+PASS e.style['text-overflow'] = "\"\"" should set the property value
+PASS e.style['text-overflow'] = "\"-\"" should set the property value
+PASS e.style['text-overflow'] = "\"marker string\"" should set the property value
 
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/w3c-import.log b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/w3c-import.log
index 60907de1ad53..1d6008ff03a8 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/w3c-import.log
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/w3c-import.log
@@ -10,8 +10,6 @@ Do NOT modify or remove this file.
 ------------------------------------------------------------------------
 Properties requiring vendor prefixes:
 None
-Property values requiring vendor prefixes:
-None
 ------------------------------------------------------------------------
 List of files:
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/WEB_FEATURES.yml
@@ -19,6 +17,7 @@ List of files:
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/block-ellipsis-valid.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/continue-invalid.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/continue-valid.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/getComputedStyle-scroll-button.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/line-clamp-invalid.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/line-clamp-valid.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/max-lines-invalid.html
@@ -28,6 +27,9 @@ List of files:
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/overflow-computed.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/overflow-invalid.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/overflow-valid.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/scroll-axis-lock-computed.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/scroll-axis-lock-invalid.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/scroll-axis-lock-valid.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/scroll-buttons-invalid.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/scroll-buttons-valid.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/scroll-markers-computed.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/before-after-pseudo-element-scrolling-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/before-after-pseudo-element-scrolling-ref.html
new file mode 100644
index 000000000000..b4c8db95f3e6
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/before-after-pseudo-element-scrolling-ref.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Reftest Reference</title>
+<link rel="author" title="Steven Novaryo" href="mailto:steven.novaryo@gmail.com">
+<p>Test passes if there is a filled green square and <strong>no red</strong>.</p>
+<div style="width: 100px; height: 100px; background-image: url(/images/green.png);"></div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-001-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-001-ref.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-001-ref.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-001-ref.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-002-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-002-ref.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-002-ref.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-002-ref.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-005-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-005-ref.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-005-ref.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-005-ref.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-006-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-006-ref.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-006-ref.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-006-ref.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-008-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-008-ref.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-008-ref.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-008-ref.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-012-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-012-ref.html
similarity index 95%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-012-ref.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-012-ref.html
index 700f9c896fe9..707f93d79c49 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-012-ref.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-012-ref.html
@@ -9,7 +9,7 @@
   color: green;
 }
 span {
-	color: white;
+  color: white;
 }
 </style>
 
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-013-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-013-ref.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-013-ref.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-013-ref.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-016-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-016-ref.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-016-ref.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-016-ref.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-021-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-021-ref.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-021-ref.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-021-ref.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-022-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-022-ref.html
similarity index 93%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-022-ref.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-022-ref.html
index db7d08f45045..31501b868471 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-022-ref.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-022-ref.html
@@ -9,7 +9,7 @@
   color: green;
 }
 span {
-	color: transparent;
+  color: transparent;
 }
 </style>
 
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-027-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-027-ref.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-027-ref.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-027-ref.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-028-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-028-ref.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-028-ref.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-028-ref.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-029-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-029-ref.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-029-ref.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-029-ref.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-030-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-030-ref.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-030-ref.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-030-ref.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-change-color-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-change-color-ref.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-change-color-ref.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-change-color-ref.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-ellipsis-editable-div-with-caret-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-ellipsis-editable-div-with-caret-ref.html
new file mode 100644
index 000000000000..97e1ffdca126
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-ellipsis-editable-div-with-caret-ref.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Reference for text-overflow ellipsis in editable div with caret selection</title>
+<style>
+  #editable {
+    font: 20px/1;
+    width: 100px;
+    white-space: nowrap;
+    overflow: hidden;
+    text-overflow: clip;
+    margin: 10px;
+    outline: none;
+    caret-color: transparent;
+  }
+</style>
+<body contenteditable="true">
+<div contenteditable="true" id="editable">This is a very long text that should be clipped</div>
+</body>
+<script>
+  // Focus the editable div and place caret at the same position as test
+  const editableDiv = document.getElementById('editable');
+  editableDiv.focus();
+  const range = document.createRange();
+  range.setStart(editableDiv.firstChild, 10);
+  range.setEnd(editableDiv.firstChild, 10);
+  const selection = window.getSelection();
+  selection.removeAllRanges();
+  selection.addRange(range);
+</script>
\ No newline at end of file
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-ellipsis-indent-001-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-ellipsis-indent-001-ref.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-ellipsis-indent-001-ref.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-ellipsis-indent-001-ref.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-ellipsis-multiline-001-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-ellipsis-multiline-001-ref.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-ellipsis-multiline-001-ref.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-ellipsis-multiline-001-ref.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-ellipsis-textarea-with-caret-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-ellipsis-textarea-with-caret-ref.html
new file mode 100644
index 000000000000..77bfc030f70f
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-ellipsis-textarea-with-caret-ref.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Reference for text-overflow ellipsis in textarea with caret selection</title>
+<style>
+  #textarea {
+    font: 20px/1;
+    width: 100px;
+    height: 25px;
+    white-space: nowrap;
+    overflow: hidden;
+    text-overflow: clip;
+    margin: 10px;
+    resize: none;
+    outline: none;
+    border: none;
+    caret-color: transparent;
+  }
+</style>
+<textarea id="textarea">This is a very long text that should be clipped</textarea>
+<script>
+  // Focus the textarea and place caret at the same position as test
+  const textarea = document.getElementById('textarea');
+  textarea.focus();
+  textarea.setSelectionRange(10, 10);
+</script>
\ No newline at end of file
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-string-001-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-001-ref.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-string-001-ref.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-001-ref.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-string-002-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-002-ref.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-string-002-ref.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-002-ref.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-string-003-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-003-ref.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-string-003-ref.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-003-ref.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-string-004-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-004-ref.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-string-004-ref.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-004-ref.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-string-005-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-005-ref.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-string-005-ref.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-005-ref.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-string-006-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-006-ref.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-string-006-ref.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-006-ref.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-string-007-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-007-ref.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-string-007-ref.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-007-ref.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-string-008-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-008-ref.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-string-008-ref.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-008-ref.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-009-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-009-ref.html
new file mode 100644
index 000000000000..3a3b90047ef4
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-009-ref.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Basic User Interface Reference File</title>
+<link rel="author" title="Minseong Kim" href="mailto:jja08111@gmail.com">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css" />
+<style>
+  @font-face {
+    font-family: "cjk-kr-test";
+    src: url("/fonts/noto/cjk-kr/NotoSansCJKkr-Regular-subset.otf");
+  }
+  div {
+    font-family: "cjk-kr-test", monospace;
+    font-size: 10px;
+  }
+  span {
+    font-family: Ahem;
+    font-size: 30px;
+  }
+</style>
+<body>
+  <p>Test passes if there is an <strong>안녕 안녕</strong> after a black rectangle below.</p>
+  <div>
+    <span>Test</span>안녕 안녕
+  </div>
+</body>
\ No newline at end of file
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-010-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-010-ref.html
new file mode 100644
index 000000000000..2a76f91ed132
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-010-ref.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Basic User Interface Reference File</title>
+<link rel="author" title="Minseong Kim" href="mailto:jja08111@gmail.com">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css" />
+<style>
+  @font-face {
+    font-family: "cjk-kr-test";
+    src: url("/fonts/noto/cjk-kr/NotoSansCJKkr-Regular-subset.otf");
+  }
+  div {
+    font-family: "cjk-kr-test", monospace;
+    font-size: 10px;
+  }
+  span {
+    font-family: Ahem;
+    font-size: 30px;
+  }
+</style>
+<body>
+  <p>Test passes if there is an <strong>안녕 你好</strong> after a black rectangle below.</p>
+  <div>
+    <span>Test</span>안녕 你好
+  </div>
+</body>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-011-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-011-ref.html
new file mode 100644
index 000000000000..0e89803a16ea
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-011-ref.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Basic User Interface Reference File</title>
+<link rel="author" title="Minseong Kim" href="mailto:jja08111@gmail.com">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css" />
+<style>
+  div {
+    font-family: monospace;
+    font-size: 10px;
+  }
+  span {
+    font-family: Ahem;
+    font-size: 30px;
+  }
+</style>
+<body>
+  <p>Test passes if there is an <strong>Hi ワールド</strong> after a black rectangle below.</p>
+  <div>
+    <span>Test</span>Hi ワールド
+  </div>
+</body>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-012-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-012-ref.html
new file mode 100644
index 000000000000..6134b3efd9f6
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-012-ref.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Basic User Interface Reference File</title>
+<link rel="author" title="Minseong Kim" href="mailto:jja08111@gmail.com">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css" />
+<style>
+  @font-face {
+    font-family: "cjk-kr-test";
+    src: url("/fonts/noto/cjk-kr/NotoSansCJKkr-Regular-subset.otf");
+  }
+  @font-face {
+    font-family: "emoji-test";
+    src: url("/fonts/noto/color-emoji/NotoColorEmoji-subset.ttf");
+  }
+  div {
+    font-family: "cjk-kr-test", "emoji-test", monospace;
+    font-size: 10px;
+  }
+  span {
+    font-family: Ahem;
+    font-size: 30px;
+  }
+</style>
+<body>
+  <p>Test passes if there is an <strong>안녕 🟢</strong> after a black rectangle below.</p>
+  <div>
+    <span>Test</span>안녕 🟢
+  </div>
+</body>
\ No newline at end of file
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-013-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-013-ref.html
new file mode 100644
index 000000000000..cc57fa1e6441
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-013-ref.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Basic User Interface Reference File</title>
+<link rel="author" title="Minseong Kim" href="mailto:jja08111@gmail.com">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css" />
+<style>
+  @font-face {
+    font-family: "emoji-test";
+    src: url("/fonts/noto/color-emoji/NotoColorEmoji-subset.ttf");
+  }
+  div {
+    font-family: "emoji-test", monospace;
+    font-size: 10px;
+  }
+  span {
+    font-family: Ahem;
+    font-size: 30px;
+  }
+</style>
+<body>
+  <p>Test passes if there is an <strong>你好 🟢</strong> after a black rectangle below.</p>
+  <div>
+    <span>Test</span>你好 🟢
+  </div>
+</body>
\ No newline at end of file
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-014-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-014-ref.html
new file mode 100644
index 000000000000..2d24573aaa9e
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-014-ref.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Basic User Interface Reference File</title>
+<link rel="author" title="Minseong Kim" href="mailto:jja08111@gmail.com">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css" />
+<style>
+  @font-face {
+    font-family: "mplus-test";
+    src: url("/fonts/mplus-1p-regular.woff");
+  }
+  div {
+    font-family: "mplus-test", monospace;
+    font-size: 10px;
+  }
+  span {
+    font-family: Ahem;
+    font-size: 30px;
+  }
+</style>
+<body>
+  <p>Test passes if there is an <strong>שלום 你好</strong> after a black rectangle below.</p>
+  <div>
+    <span>Test</span>שלום 你好
+  </div>
+</body>
\ No newline at end of file
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-015-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-015-ref.html
new file mode 100644
index 000000000000..3a70eecf878b
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-015-ref.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Basic User Interface Reference File</title>
+<link rel="author" title="Minseong Kim" href="mailto:jja08111@gmail.com">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css" />
+<style>
+  @font-face {
+    font-family: "mplus-test";
+    src: url("/fonts/mplus-1p-regular.woff");
+  }
+  @font-face {
+    font-family: "cjk-kr-test";
+    src: url("/fonts/noto/cjk-kr/NotoSansCJKkr-Regular-subset.otf");
+  }
+  div {
+    font-family: "mplus-test", "cjk-kr-test";
+    font-size: 10px;
+  }
+  span {
+    font-family: Ahem;
+    font-size: 30px;
+  }
+</style>
+<body>
+  <p>Test passes if there is an <strong>יְוֹם 낮</strong> after a black rectangle below.</p>
+  <div>
+    <span>Test</span>יְוֹם 낮
+  </div>
+</body>
\ No newline at end of file
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-016-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-016-ref.html
new file mode 100644
index 000000000000..1076f4939711
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-016-ref.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Basic User Interface Reference File</title>
+<link rel="author" title="Minseong Kim" href="mailto:jja08111@gmail.com">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css" />
+<style>
+  div {
+    font-family: monospace;
+    font-size: 10px;
+  }
+  span {
+    font-family: Ahem;
+    font-size: 30px;
+  }
+</style>
+<body>
+  <p>Test passes if there is an <strong>Hi Hi</strong> after a black rectangle below.</p>
+  <div>
+    <span>Test</span>Hi Hi
+  </div>
+</body>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-024-ref.tentative.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-024-ref.tentative.html
new file mode 100644
index 000000000000..97a5a87438dd
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-024-ref.tentative.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Basic User Interface Reference File</title>
+<link rel="author" title="Minseong Kim" href="mailto:jja08111@gmail.com">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css" />
+<style>
+  div {
+    font-family: monospace;
+    font-size: 10px;
+  }
+  span {
+    font-family: Ahem;
+    font-size: 30px;
+  }
+</style>
+<body>
+  <p>Test passes if there is an <strong>こんにちは</strong> after a black rectangle below.</p>
+  <div>
+    <span>Test</span>こんにちは
+  </div>
+</body>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-025-ref.tentative.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-025-ref.tentative.html
new file mode 100644
index 000000000000..ae378c472c19
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-025-ref.tentative.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Basic User Interface Reference File</title>
+<link rel="author" title="Minseong Kim" href="mailto:jja08111@gmail.com">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css" />
+<style>
+  div {
+    font-family: monospace;
+    font-size: 10px;
+  }
+  span {
+    font-family: Ahem;
+    font-size: 30px;
+  }
+</style>
+<body>
+  <p>Test passes if there is an <strong>你好你好</strong> after a black rectangle below.</p>
+  <div>
+    <span>Test</span>你好你好
+  </div>
+</body>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-026-ref.tentative.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-026-ref.tentative.html
new file mode 100644
index 000000000000..594a188b001c
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-026-ref.tentative.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Basic User Interface Reference File</title>
+<link rel="author" title="Minseong Kim" href="mailto:jja08111@gmail.com">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css" />
+<style>
+  div {
+    font-family: monospace;
+    font-size: 10px;
+  }
+  span {
+    font-family: Ahem;
+    font-size: 30px;
+  }
+</style>
+<body>
+  <p>Test passes if there is an <strong>ＦＵＬＬ</strong> after a black rectangle below.</p>
+  <div>
+    <span>Test</span>ＦＵＬＬ
+  </div>
+</body>
\ No newline at end of file
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/w3c-import.log b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/w3c-import.log
index f61c0946ce17..8b242c970423 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/w3c-import.log
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/w3c-import.log
@@ -10,10 +10,9 @@ Do NOT modify or remove this file.
 ------------------------------------------------------------------------
 Properties requiring vendor prefixes:
 None
-Property values requiring vendor prefixes:
-None
 ------------------------------------------------------------------------
 List of files:
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/before-after-pseudo-element-scrolling-ref.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/input-scrollable-region-001-ref.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/overflow-body-no-propagation-ref.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/overflow-body-propagation-ref.html
@@ -21,12 +20,50 @@ List of files:
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/overflow-inline-block-with-opacity-ref.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/overflow-recalc-001-ref.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/ref-if-there-is-no-red.xht
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-001-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-002-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-005-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-006-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-008-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-012-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-013-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-016-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-021-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-022-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-027-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-028-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-029-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-030-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-change-color-ref.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-ellipsis-001-ref.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-ellipsis-002-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-ellipsis-editable-div-with-caret-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-ellipsis-indent-001-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-ellipsis-multiline-001-ref.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-ellipsis-rtl-001-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-ellipsis-textarea-with-caret-ref.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-ellipsis-vertical-001-ref.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-ellipsis-vertical-rtl-001-ref.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-scroll-001-ref.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-scroll-rtl-001-ref.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-scroll-vertical-lr-001-ref.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-scroll-vertical-lr-rtl-001-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-001-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-002-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-003-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-004-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-005-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-006-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-007-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-008-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-009-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-010-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-011-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-012-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-013-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-014-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-015-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-016-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-024-ref.tentative.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-025-ref.tentative.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/reference/text-overflow-string-026-ref.tentative.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-axis-lock-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-axis-lock-expected.txt
new file mode 100644
index 000000000000..224d30a3ae00
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-axis-lock-expected.txt
@@ -0,0 +1,6 @@
+
+Harness Error (TIMEOUT), message = null
+
+TIMEOUT scroll-axis-lock: none allows free diagonal touch scroll even with steep angle (no railing) Test timed out
+NOTRUN scroll-axis-lock: none allows free diagonal wheel scroll even with steep angle (no railing)
+
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-axis-lock.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-axis-lock.html
new file mode 100644
index 000000000000..583ed053f332
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-axis-lock.html
@@ -0,0 +1,125 @@
+<!DOCTYPE html>
+<title>CSS Scroll Snap: scroll-axis-lock</title>
+<link rel="help"
+      href="https://drafts.csswg.org/css-scroll-snap-2/#scroll-axis-lock">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/resources/testdriver.js"></script>
+<script src="/resources/testdriver-actions.js"></script>
+<script src="/resources/testdriver-vendor.js"></script>
+<script src="/dom/events/scrolling/scroll_support.js"></script>
+<style>
+#scroller {
+  margin-left: 200px;
+  margin-top: 100px;
+  width: 200px;
+  height: 200px;
+  overflow: scroll;
+  border: 1px solid black;
+  scroll-axis-lock: none;
+}
+#content {
+  width: 1000px;
+  height: 1000px;
+  background: linear-gradient(45deg, white, black);
+}
+</style>
+
+<div id="scroller">
+  <div id="content"></div>
+</div>
+
+<script>
+async function run_test(t, input_source) {
+  await waitForCompositorReady();
+
+  const scroller = document.getElementById('scroller');
+  await waitForScrollReset(t, scroller);
+  assert_equals(scroller.scrollLeft, 0);
+  assert_equals(scroller.scrollTop, 0);
+
+  let received_wheel_event = null;
+
+  // Scroll mostly vertically, with a small horizontal component.
+  // Move left (scroll right) by 2, up (scroll down) by 150.
+  // This steep angle would normally trigger vertical railing
+  // (horizontal scroll = 0).
+  // With scroll-axis-lock: none, it should not rail.
+  const bounds = scroller.getBoundingClientRect();
+  const start_x = bounds.left + bounds.width / 2;
+  const start_y = bounds.top + bounds.height / 2;
+  const delta_x = 2;
+  const delta_y = 150;
+
+  // We use tolerances because the final scroll offsets might not
+  // match the input deltas exactly. For touch, the initial gesture movement is
+  // affected by touch slop (which is platform-dependent), requiring a loose
+  // tolerance of 30 on the dominant Y axis. Wheel scrolls do not have slop,
+  // so we use a small tolerance of 1. For the minor X axis in the touch test,
+  // we also use a small tolerance so that locking (scrollLeft=0) is still
+  // disallowed.
+  const tolerance_x = 1;
+  const tolerance_y = (input_source === 'touch') ? 30 : 1;
+
+  const end_x = start_x - delta_x;
+  const end_y = start_y - delta_y;
+
+  const scrollend_promise =
+      waitForScrollEndFallbackToDelayWithoutScrollEvent(scroller);
+
+  if (input_source === 'touch') {
+    await new test_driver.Actions()
+      .addPointer("finger", "touch")
+      .pointerMove(Math.round(start_x), Math.round(start_y))
+      .pointerDown()
+      .addTick()
+      .pause(100)
+      .pointerMove(Math.round(end_x), Math.round(end_y))
+      .addTick()
+      .pause(100) // Pause to avoid fling
+      .pointerUp()
+      .send();
+  } else if (input_source === 'wheel') {
+    scroller.addEventListener('wheel', (e) => {
+      received_wheel_event = e;
+    }, { once: true });
+
+    await new test_driver.Actions()
+      .addWheel("wheel")
+      .scroll(0, 0, Math.round(delta_x), Math.round(delta_y),
+              {origin: scroller})
+      .send();
+  }
+
+  // Wait for scroll to end.
+  await scrollend_promise;
+
+  assert_approx_equals(scroller.scrollTop, delta_y, tolerance_y,
+    "Should have scrolled vertically");
+  assert_approx_equals(
+      scroller.scrollLeft, delta_x, tolerance_x,
+      "Should have scrolled horizontally (not railed to Y)");
+
+  if (input_source === 'wheel') {
+    // The wheel delta will always be the unlocked value.
+    // With scroll-axis-lock: none, the wheel delta should match the scroll
+    // delta.
+    assert_not_equals(received_wheel_event, null,
+                      "Should have received a wheel event");
+    assert_equals(received_wheel_event.deltaX, delta_x,
+                  "wheel event deltaX should match sent delta");
+    assert_equals(received_wheel_event.deltaY, delta_y,
+                  "wheel event deltaY should match sent delta");
+  }
+}
+
+promise_test(async t => {
+  await run_test(t, 'touch');
+}, "scroll-axis-lock: none allows free diagonal touch scroll " +
+   "even with steep angle (no railing)");
+
+promise_test(async t => {
+  await run_test(t, 'wheel');
+}, "scroll-axis-lock: none allows free diagonal wheel scroll " +
+   "even with steep angle (no railing)");
+</script>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-marker-group-display-none-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-marker-group-display-none-expected.txt
new file mode 100644
index 000000000000..cff8a4a2d85d
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-marker-group-display-none-expected.txt
@@ -0,0 +1,4 @@
+Item
+
+PASS No crash when scroll-marker-group is display: none during focus navigation
+
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-marker-group-display-none.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-marker-group-display-none.html
new file mode 100644
index 000000000000..f59139223faa
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-marker-group-display-none.html
@@ -0,0 +1,47 @@
+<!DOCTYPE html>
+<title>CSS Overflow: scroll markers crash with display:none</title>
+<link rel="help" href="https://crbug.com/476651195">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/resources/testdriver.js"></script>
+<script src="/resources/testdriver-vendor.js"></script>
+<style>
+  #scroller {
+    overflow: scroll;
+    scroll-marker-group: after;
+    width: 200px;
+    height: 100px;
+  }
+
+  .item {
+    height: 100px;
+    width: 100%;
+  }
+
+  .item::scroll-marker {
+    content: " ";
+    display: inline-block;
+    width: 10px;
+    height: 10px;
+  }
+
+  #scroller::scroll-marker-group {
+    display: flex;
+  }
+
+  #scroller.hide-group::scroll-marker-group {
+    display: none;
+  }
+</style>
+<div id="scroller">
+  <div class="item" id="item">Item</div>
+</div>
+<script>
+  promise_test(async () => {
+    const scroller = document.getElementById('scroller');
+    scroller.classList.add('hide-group');
+    scroller.offsetTop;
+    document.getElementById('item').focus();
+    await test_driver.send_keys(document.body, "\uE004");
+  }, "No crash when scroll-marker-group is display: none during focus navigation");
+</script>
\ No newline at end of file
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-marker-group-hover-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-marker-group-hover-expected.txt
new file mode 100644
index 000000000000..8d7713226b0d
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-marker-group-hover-expected.txt
@@ -0,0 +1,3 @@
+
+FAIL CSS Overflow Test: ::scroll-marker-group supports hover assert_equals: ::scroll-marker-group is unhovered expected "rgb(255, 0, 0)" but got ""
+
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-marker-group-hover-from-marker-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-marker-group-hover-from-marker-expected.txt
new file mode 100644
index 000000000000..96e33d3a6cb9
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-marker-group-hover-from-marker-expected.txt
@@ -0,0 +1,3 @@
+
+FAIL CSS Overflow Test: ::scroll-marker-group matches hover when inner ::scroll-marker is hovered assert_equals: ::scroll-marker-group is unhovered initially expected "rgb(255, 0, 0)" but got ""
+
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-marker-group-hover-from-marker.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-marker-group-hover-from-marker.html
new file mode 100644
index 000000000000..7ad3ee10f315
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-marker-group-hover-from-marker.html
@@ -0,0 +1,64 @@
+<!doctype html>
+<meta charset="utf-8">
+<title>CSS Overflow Test: ::scroll-marker-group matches hover when inner ::scroll-marker is hovered</title>
+<link rel="help" href="https://drafts.csswg.org/css-overflow-5/#scroll-marker-group-pseudo">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/resources/testdriver.js"></script>
+<script src="/resources/testdriver-actions.js"></script>
+<script src="/resources/testdriver-vendor.js"></script>
+<style>
+  body {
+    margin: 0;
+  }
+
+  #scroller {
+    overflow: auto;
+    scroll-marker-group: before;
+  }
+
+  #scroller::scroll-marker-group {
+    height: 100px;
+    width: 100px;
+    background: red;
+  }
+
+  #scroller::scroll-marker-group:hover {
+    background: green;
+  }
+
+  #scroller>div {
+    height: 100px;
+  }
+
+  #scroller>div::scroll-marker {
+    content: "A";
+    display: block;
+    width: 50px;
+    height: 50px;
+    color: red;
+  }
+
+  #scroller>div::scroll-marker:hover {
+    color: green;
+  }
+</style>
+<div id="scroller">
+  <div></div>
+</div>
+<script>
+  promise_test(async t => {
+    assert_equals(getComputedStyle(scroller, "::scroll-marker-group").backgroundColor, "rgb(255, 0, 0)", "::scroll-marker-group is unhovered initially");
+    assert_equals(getComputedStyle(scroller.querySelector("div"), "::scroll-marker").color, "rgb(255, 0, 0)", "::scroll-marker is unhovered initially");
+
+    // The ::scroll-marker is within the ::scroll-marker-group, so we hover over its coordinates
+    const watcher = new EventWatcher(t, scroller, "mouseover");
+    const waitMouseover = watcher.wait_for("mouseover");
+    await new test_driver.Actions()
+      .pointerMove(15, 15)
+      .send();
+    await waitMouseover;
+    assert_equals(getComputedStyle(scroller, "::scroll-marker-group").backgroundColor, "rgb(0, 128, 0)", "::scroll-marker-group matches hover when inner ::scroll-marker is hovered");
+    assert_equals(getComputedStyle(scroller.querySelector("div"), "::scroll-marker").color, "rgb(0, 128, 0)", "::scroll-marker is hovered");
+  });
+</script>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-marker-group-hover.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-marker-group-hover.html
new file mode 100644
index 000000000000..9b8097105bbc
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-marker-group-hover.html
@@ -0,0 +1,42 @@
+<!doctype html>
+<meta charset="utf-8">
+<title>CSS Overflow Test: ::scroll-marker-group supports hover</title>
+<link rel="help" href="https://drafts.csswg.org/css-overflow-5/#scroll-marker-group-pseudo">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/resources/testdriver.js"></script>
+<script src="/resources/testdriver-actions.js"></script>
+<script src="/resources/testdriver-vendor.js"></script>
+<style>
+  body {
+    margin: 0;
+  }
+
+  #scroller {
+    overflow: auto;
+    scroll-marker-group: before;
+
+    &::scroll-marker-group {
+      background: red;
+      height: 100px;
+      width: 100px;
+    }
+
+    &::scroll-marker-group:hover {
+      background: green;
+    }
+  }
+</style>
+<div id="scroller"></div>
+<script>
+  promise_test(async t => {
+    assert_equals(getComputedStyle(scroller, "::scroll-marker-group").backgroundColor, "rgb(255, 0, 0)", "::scroll-marker-group is unhovered");
+    const watcher = new EventWatcher(t, scroller, 'mouseover');
+    const waitMouseover = watcher.wait_for('mouseover');
+    await new test_driver.Actions()
+      .pointerMove(15, 15)
+      .send();
+    await waitMouseover;
+    assert_equals(getComputedStyle(scroller, "::scroll-marker-group").backgroundColor, "rgb(0, 128, 0)", "::scroll-marker-group is hovered");
+  });
+</script>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/WEB_FEATURES.yaml b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/WEB_FEATURES.yaml
deleted file mode 100644
index b3862f22ed98..000000000000
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/WEB_FEATURES.yaml
+++ /dev/null
@@ -1,18 +0,0 @@
-features:
-- name: scroll-markers
-  files:
-  - column-scroll-marker*
-  - html-scroll-marker*
-  - inline-with-scroll-marker*
-  - nested-scroll-markers*
-  - root-scroll-marker*
-  - scroll-marker*
-  - target-current-scroll-marker-update.html
-  - targeted-column-scroll-marker*
-  - targeted-scroll-marker*
-  - chrome-421199213-crash.html
-  - targeted-column-scroll-marker-selection-*
-- name: scroll-buttons
-  files:
-  - root-scroll-button*
-  - scroll-button*
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/WEB_FEATURES.yml b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/WEB_FEATURES.yml
new file mode 100644
index 000000000000..70efb93af80b
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/WEB_FEATURES.yml
@@ -0,0 +1,15 @@
+rules:
+- column-scroll-marker*: [scroll-markers]
+- html-scroll-marker*: [scroll-marker-targets]
+- inline-with-scroll-marker*: [scroll-markers]
+- nested-scroll-markers*: [scroll-markers]
+- root-scroll-marker*: [scroll-markers]
+- scroll-marker-target-before-after.html: [scroll-marker-targets]
+- scroll-marker*: [scroll-markers]
+- target-current-scroll-marker-update.html: [scroll-markers]
+- targeted-column-scroll-marker*: [scroll-markers, scroll-markers]
+- targeted-scroll-marker*: [scroll-markers]
+- chrome-421199213-crash.html: [scroll-markers]
+- root-scroll-button*: [scroll-buttons]
+- scroll-button*: [scroll-buttons]
+- scroll-target-group*: [scroll-target-group]
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/resources/w3c-import.log b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/resources/w3c-import.log
index dea262857ba6..3a0bc3ad17e9 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/resources/w3c-import.log
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/resources/w3c-import.log
@@ -10,8 +10,6 @@ Do NOT modify or remove this file.
 ------------------------------------------------------------------------
 Properties requiring vendor prefixes:
 None
-Property values requiring vendor prefixes:
-None
 ------------------------------------------------------------------------
 List of files:
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/resources/root-scroll-marker-activation-iframe.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-button-display-none.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-button-display-none.html
index 8b3068be6dad..35e87c5556c1 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-button-display-none.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-button-display-none.html
@@ -51,4 +51,22 @@
       .send();
     assert_true(true);
   });
+
+  promise_test(async t => {
+    // Restore the scroller visibility hidden by the previous test.
+    scroller.className = "";
+    document.documentElement.offsetTop;
+
+    // Removing the scroller inside a bubble-phase listener. So that by the
+    // time a handler is called the pseudo-element is already disconnected.
+    scroller.addEventListener('click', () => scroller.remove(), { once: true });
+
+    await new test_driver.Actions()
+      .pointerMove(15, 15)
+      .pointerDown()
+      .pointerUp()
+      .send();
+
+    assert_true(true, "no crash when container removed during event bubbling");
+  }, "scroll-button click removing container during bubbling does not crash");
 </script>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-button-reattachment-position-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-button-reattachment-position-expected.html
new file mode 100644
index 000000000000..65707c53527c
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-button-reattachment-position-expected.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<title>CSS Overflow Test: ::scroll-button positioning works after position type transitions</title>
+<style>
+  body {
+    margin: 0;
+  }
+  #green-box {
+    width: 100px;
+    height: 100px;
+    background: green;
+    position: fixed;
+  }
+</style>
+<p>You should see a green square below.</p>
+<div id="green-box"></div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-button-reattachment-position-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-button-reattachment-position-ref.html
new file mode 100644
index 000000000000..65707c53527c
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-button-reattachment-position-ref.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<title>CSS Overflow Test: ::scroll-button positioning works after position type transitions</title>
+<style>
+  body {
+    margin: 0;
+  }
+  #green-box {
+    width: 100px;
+    height: 100px;
+    background: green;
+    position: fixed;
+  }
+</style>
+<p>You should see a green square below.</p>
+<div id="green-box"></div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-button-reattachment-position.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-button-reattachment-position.html
new file mode 100644
index 000000000000..c9ebb585e3fc
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-button-reattachment-position.html
@@ -0,0 +1,34 @@
+<!DOCTYPE html>
+<title>CSS Overflow Test: ::scroll-button positioning works after position type transitions</title>
+<link rel="match" href="scroll-button-reattachment-position-ref.html">
+<link rel="help" href="https://drafts.csswg.org/css-overflow-5/#scroll-buttons">
+<style>
+  body {
+    margin: 0;
+  }
+  #scroller {
+    width: 100px;
+    height: 100px;
+    overflow: hidden;
+    background: red;
+    position: fixed;
+  }
+  #scroller::scroll-button(inline-end) {
+    border: none;
+    content: ' ';
+    width: 100px;
+    height: 100px;
+    background: green;
+  }
+  #scroller.fixed::scroll-button(inline-end) {
+    position: fixed;
+  }
+</style>
+<p>You should see a green square below.</p>
+<div id="scroller">
+  <div style="width: 500px; height: 100px;"></div>
+</div>
+<script>
+  scroller.offsetTop;
+  scroller.classList.add("fixed");
+</script>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-marker-activation-retains-focus.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-marker-activation-retains-focus.html
index cf38ed354c73..054a87011993 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-marker-activation-retains-focus.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-marker-activation-retains-focus.html
@@ -1,6 +1,6 @@
 <!doctype html>
 <meta charset="utf-8">
-<title>CSS Test: ::scroll-marker retains focus on ::scroll-marker</title>
+<title>CSS Test: ::scroll-marker activation focus behavior in links and tabs modes</title>
 <link rel="help" href="https://drafts.csswg.org/css-overflow-5/#scroll-marker-activation">
 <script src="/resources/testharness.js"></script>
 <script src="/resources/testharnessreport.js"></script>
@@ -51,12 +51,25 @@
 </div>
 <script>
   promise_test(async t => {
+    // 1. Links mode (default)
+    let actions_promise = new test_driver.Actions()
+      .pointerMove(15, 15)
+      .pointerDown()
+      .pointerUp()
+      .send();
+    await actions_promise;
+    assert_equals(getComputedStyle(target, "::scroll-marker").backgroundColor, "rgb(0, 128, 0)", "::scroll-marker activation does not retain focus in links mode");
+
+    // 2. Tabs mode
+    document.activeElement.blur();
+    scroller.style.setProperty("scroll-marker-group", "before tabs");
+
     actions_promise = new test_driver.Actions()
       .pointerMove(15, 15)
       .pointerDown()
       .pointerUp()
       .send();
     await actions_promise;
-    assert_equals(getComputedStyle(target, "::scroll-marker").backgroundColor, "rgb(0, 0, 255)", "::scroll-marker activation retains focus");
-  });
-</script>
\ No newline at end of file
+    assert_equals(getComputedStyle(target, "::scroll-marker").backgroundColor, "rgb(0, 0, 255)", "::scroll-marker activation retains focus in tabs mode");
+  }, "::scroll-marker activation focus behavior in links and tabs modes");
+</script>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-marker-double-activation.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-marker-double-activation.html
index ee621980c286..d6d14e4d90f8 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-marker-double-activation.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-marker-double-activation.html
@@ -1,6 +1,6 @@
 <!doctype html>
 <meta charset="utf-8">
-<title>CSS Values Test: ::scroll-marker double activation scrolls into view twice</title>
+<title>CSS Values Test: ::scroll-marker double activation scrolls into view twice in links and tabs modes</title>
 <link rel="help" href="https://drafts.csswg.org/css-overflow-5/#scroll-marker-activation">
 <script src="/resources/testharness.js"></script>
 <script src="/resources/testharnessreport.js"></script>
@@ -51,13 +51,36 @@
 </div>
 <script>
   promise_test(async t => {
+    // 1. Links mode (default)
+    let actions_promise = new test_driver.Actions()
+      .pointerMove(15, 15)
+      .pointerDown()
+      .pointerUp()
+      .send();
+    await actions_promise;
+    assert_equals(getComputedStyle(target, "::scroll-marker").backgroundColor, "rgb(0, 128, 0)", "::scroll-marker activation does not retain focus in links mode");
+    assert_equals(scroller.scrollLeft, 0, "Scroll position after scroll marker activation should be 0");
+    scroller.scrollLeft = 100;
+    actions_promise = new test_driver.Actions()
+      .pointerMove(15, 15)
+      .pointerDown()
+      .pointerUp()
+      .send();
+    await actions_promise;
+    assert_equals(getComputedStyle(target, "::scroll-marker").backgroundColor, "rgb(0, 128, 0)", "::scroll-marker activation does not retain focus after scroll in links mode");
+    assert_equals(scroller.scrollLeft, 0, "Scroll position after second scroll marker activation should still be 0");
+
+    // 2. Tabs mode
+    document.activeElement.blur();
+    scroller.style.setProperty("scroll-marker-group", "before tabs");
+
     actions_promise = new test_driver.Actions()
       .pointerMove(15, 15)
       .pointerDown()
       .pointerUp()
       .send();
     await actions_promise;
-    assert_equals(getComputedStyle(target, "::scroll-marker").backgroundColor, "rgb(0, 0, 255)", "::scroll-marker activation retains focus");
+    assert_equals(getComputedStyle(target, "::scroll-marker").backgroundColor, "rgb(0, 0, 255)", "::scroll-marker activation retains focus in tabs mode");
     assert_equals(scroller.scrollLeft, 0, "Scroll position after scroll marker activation should be 0");
     scroller.scrollLeft = 100;
     actions_promise = new test_driver.Actions()
@@ -66,7 +89,7 @@
       .pointerUp()
       .send();
     await actions_promise;
-    assert_equals(getComputedStyle(target, "::scroll-marker").backgroundColor, "rgb(0, 0, 255)", "::scroll-marker activation retains focus after scroll");
+    assert_equals(getComputedStyle(target, "::scroll-marker").backgroundColor, "rgb(0, 0, 255)", "::scroll-marker activation retains focus after scroll in tabs mode");
     assert_equals(scroller.scrollLeft, 0, "Scroll position after second scroll marker activation should still be 0");
-  });
+  }, "::scroll-marker double activation behavior in links and tabs modes");
 </script>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-marker-focus-within.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-marker-focus-within.html
index 7a094b2bfd45..4cd3945bd21a 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-marker-focus-within.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-marker-focus-within.html
@@ -1,6 +1,6 @@
 <!doctype html>
 <meta charset="utf-8">
-<title>CSS Overflow Test: focused ::scroll-marker sets :focus-within on its ::scroll-marker-group, scroller and all the ancestors</title>
+<title>CSS Overflow Test: focused ::scroll-marker sets :focus-within on its ::scroll-marker-group, scroller and all the ancestors in links and tabs modes</title>
 <link rel="help" href="https://drafts.csswg.org/css-overflow-5/#focus-pseudoclasses">
 <script src="/resources/testharness.js"></script>
 <script src="/resources/testharnessreport.js"></script>
@@ -65,24 +65,31 @@
 </div>
 <script>
   promise_test(async t => {
+    // 1. Links mode (default)
     let actions_promise = new test_driver.Actions()
       .pointerMove(15, 15)
       .pointerDown()
       .pointerUp()
       .send();
     await actions_promise;
-    assert_equals(getComputedStyle(scroller, "::scroll-marker-group").backgroundColor, "rgb(0, 128, 0)", "focused ::scroll-marker sets :focus-within on its ::scroll-marker-group");
-    assert_equals(getComputedStyle(scroller).backgroundColor, "rgb(0, 128, 0)", "focused ::scroll-marker sets :focus-within on its scroller");
-    assert_equals(getComputedStyle(target, "::scroll-marker").backgroundColor, "rgb(0, 128, 0)", "focused ::scroll-marker sets :focus-within on itself");
-    assert_equals(getComputedStyle(target).backgroundColor, "rgb(0, 128, 0)", "focused ::scroll-marker doesn't set :focus-within on its originating element");
+    assert_equals(getComputedStyle(scroller, "::scroll-marker-group").backgroundColor, "rgb(255, 0, 0)", "unfocused ::scroll-marker does not set :focus-within on its ::scroll-marker-group in links mode");
+    assert_equals(getComputedStyle(scroller).backgroundColor, "rgb(255, 0, 0)", "unfocused ::scroll-marker does not set :focus-within on its scroller in links mode");
+    assert_equals(getComputedStyle(target, "::scroll-marker").backgroundColor, "rgb(255, 0, 0)", "unfocused ::scroll-marker does not set :focus-within on itself in links mode");
+    assert_equals(getComputedStyle(target).backgroundColor, "rgb(0, 128, 0)", "unfocused ::scroll-marker doesn't set :focus-within on its originating element in links mode");
+
+    // 2. Tabs mode
+    document.activeElement.blur();
+    scroller.style.setProperty("scroll-marker-group", "before tabs");
+
     actions_promise = new test_driver.Actions()
-      .pointerMove(500, 300)
+      .pointerMove(15, 15)
       .pointerDown()
       .pointerUp()
       .send();
     await actions_promise;
-    assert_equals(getComputedStyle(scroller, "::scroll-marker-group").backgroundColor, "rgb(255, 0, 0)", "focused ::scroll-marker resets :focus-within on its ::scroll-marker-group");
-    assert_equals(getComputedStyle(scroller).backgroundColor, "rgb(255, 0, 0)", "focused ::scroll-marker resets :focus-within on its scroller");
-    assert_equals(getComputedStyle(target, "::scroll-marker").backgroundColor, "rgb(255, 0, 0)", "focused ::scroll-marker resets :focus-within on itself");
-  });
-</script>
\ No newline at end of file
+    assert_equals(getComputedStyle(scroller, "::scroll-marker-group").backgroundColor, "rgb(0, 128, 0)", "focused ::scroll-marker sets :focus-within on its ::scroll-marker-group in tabs mode");
+    assert_equals(getComputedStyle(scroller).backgroundColor, "rgb(0, 128, 0)", "focused ::scroll-marker sets :focus-within on its scroller in tabs mode");
+    assert_equals(getComputedStyle(target, "::scroll-marker").backgroundColor, "rgb(0, 128, 0)", "focused ::scroll-marker sets :focus-within on itself in tabs mode");
+    assert_equals(getComputedStyle(target).backgroundColor, "rgb(0, 128, 0)", "focused ::scroll-marker doesn't set :focus-within on its originating element in tabs mode");
+  }, "::scroll-marker sets :focus-within on its ancestors in tabs mode, but not in links mode");
+</script>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-marker-inert-003.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-marker-inert-003.html
new file mode 100644
index 000000000000..362f715f6a45
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-marker-inert-003.html
@@ -0,0 +1,49 @@
+<!DOCTYPE html>
+<title>CSS Overflow Test: ::scroll-marker-group inertness applied to display:contents ::scroll-marker</title>
+<link rel="help" href="https://drafts.csswg.org/css-overflow-5/#scroll-markers">
+<link rel="help" href="https://drafts.csswg.org/css-ui/#inertness">
+<link rel="help" href="https://github.com/w3c/csswg-drafts/issues/11746">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/resources/testdriver.js"></script>
+<script src="/resources/testdriver-actions.js"></script>
+<script src="/resources/testdriver-vendor.js"></script>
+<style>
+  body { margin: 0; }
+  #scroller {
+    width: 100px;
+    height: 100px;
+    overflow-y: scroll;
+    scroll-marker-group: before;
+  }
+  #scroller::scroll-marker-group {
+    height: 100px;
+  }
+  .item {
+    height: 100px;
+    background-color: lime;
+    interactivity: inert;
+  }
+  .item::scroll-marker {
+    content: "X";
+    display: contents;
+  }
+  #filler {
+    height: 400px;
+  }
+</style>
+<div id="scroller">
+  <div class="item"></div>
+  <div id="filler"></div>
+  <div id="target" class="item"></div>
+</div>
+<script>
+  promise_test(async t => {
+    await new test_driver.Actions()
+      .pointerMove(20, 10)
+      .pointerDown()
+      .pointerUp()
+      .send();
+    assert_equals(scroller.scrollTop, 500);
+  }, "::scroll-marker is not inert because its ::scroll-marker-group isn't");
+</script>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-marker-navigation-cycles.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-marker-navigation-cycles.html
index d41b720ed925..5dfe09053c90 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-marker-navigation-cycles.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-marker-navigation-cycles.html
@@ -14,54 +14,206 @@
   }
 
   #scroller {
+    background: white;
     overflow: auto;
-    width: 100px;
-    height: 100px;
-    scroll-marker-group: before;
+    width: 600px;
+    height: 300px;
+    /* use tabs mode so activated markers receive focus and can handle
+       arrow-key events directly */
+    scroll-marker-group: before tabs;
     white-space: nowrap;
   }
 
   #scroller::scroll-marker-group {
     display: flex;
-    height: 10px;
-    width: 30px;
+    height: 20px;
+    width: 300px;
   }
 
   #scroller div {
     background: blue;
     display: inline-block;
-    height: 100px;
-    width: 100px;
+    height: 280px;
+    width: 600px;
   }
 
   #scroller div::scroll-marker {
     content: "";
     background: blue;
-    width: 10px;
-    height: 10px;
+    display: inline-block;
+    width: 30px;
+    height: 20px;
+    opacity: 1;
   }
 
   #scroller div::scroll-marker:target-current {
     background: green;
   }
+
+  #scroller div::scroll-marker:focus {
+    opacity: 0.5;
+  }
 </style>
 <div id="scroller">
   <div id="first_item"></div>
-  <div></div>
+  <div id="middle_item"></div>
   <div id="last_item"></div>
 </div>
 <script>
-  promise_test(async t => {
+  const kArrowLeft = 'ArrowLeft';
+  const kArrowRight = 'ArrowRight';
+  const kArrowUp = 'ArrowUp';
+  const kArrowDown = 'ArrowDown';
+
+  function getActiveMarker() {
+    if (getComputedStyle(first_item, "::scroll-marker").backgroundColor === "rgb(0, 128, 0)")
+      return 'first';
+    if (getComputedStyle(middle_item, "::scroll-marker").backgroundColor === "rgb(0, 128, 0)")
+      return 'middle';
+    if (getComputedStyle(last_item, "::scroll-marker").backgroundColor === "rgb(0, 128, 0)")
+      return 'last';
+    return null;
+  }
+
+  function markerIsFocused() {
+    return getComputedStyle(first_item, "::scroll-marker").opacity === '0.5';
+  }
+
+  async function waitForFrame() {
+    await new Promise(resolve => requestAnimationFrame(resolve));
+  }
+
+  async function waitForRenderingUpdate() {
+    await waitForFrame();
+    await waitForFrame();
+  }
+
+  async function clickAt(x, y) {
     await new test_driver.Actions()
-      .pointerMove(5, 5)
+      .pointerMove(x, y)
       .pointerDown()
       .pointerUp()
       .send();
-    assert_equals(getComputedStyle(first_item, "::scroll-marker").backgroundColor, "rgb(0, 128, 0)", "first ::scroll-marker gets activated upon clicking");
+    await waitForRenderingUpdate();
+  }
+
+  async function sendKey(key) {
+    const webdriverKey = {
+      ArrowLeft: '\uE012',
+      ArrowUp: '\uE013',
+      ArrowRight: '\uE014',
+      ArrowDown: '\uE015',
+    }[key];
     await new test_driver.Actions()
-      .keyDown('\uE012')
-      .keyUp('\uE012')
+      .keyDown(webdriverKey)
+      .keyUp(webdriverKey)
       .send();
-    assert_equals(getComputedStyle(last_item, "::scroll-marker").backgroundColor, "rgb(0, 128, 0)", "last ::scroll-marker gets activated by going from the first one");
-  });
-</script>
\ No newline at end of file
+    await waitForRenderingUpdate();
+  }
+
+  async function resetScrollerStyles() {
+    scroller.style.direction = 'ltr';
+    scroller.style.writingMode = 'horizontal-tb';
+    scroller.scrollTo({ left: 0, top: 0, behavior: 'instant' });
+    await waitForRenderingUpdate();
+  }
+
+  async function focusAndActivateFirstMarker() {
+    await resetScrollerStyles();
+    await clickAt(15, 15);
+    assert_equals(getActiveMarker(), 'first', 'click activates the first ::scroll-marker');
+    assert_true(markerIsFocused(), 'clicking the first ::scroll-marker focuses it');
+  }
+
+  promise_test(async t => {
+    // Basic LTR navigation sanity check.
+    // In horizontal-tb:
+    // Block axis is Top to Bottom.
+    // Inline axis is Left to Right.
+    await focusAndActivateFirstMarker();
+    await sendKey(kArrowRight);
+    assert_equals(getActiveMarker(), 'middle', 'right arrow moves forward in horizontal-tb ltr');
+
+    await focusAndActivateFirstMarker();
+    await sendKey(kArrowLeft);
+    assert_equals(getActiveMarker(), 'last', 'left arrow wraps backward in horizontal-tb ltr');
+
+    await focusAndActivateFirstMarker();
+    await sendKey(kArrowDown);
+    assert_equals(getActiveMarker(), 'middle', 'down arrow moves forward in horizontal-tb ltr');
+
+    await focusAndActivateFirstMarker();
+    await sendKey(kArrowUp);
+    assert_equals(getActiveMarker(), 'last', 'up arrow wraps backward in horizontal-tb ltr');
+
+    // Check that RTL flips the behavior of the horizontal arrows.
+    await focusAndActivateFirstMarker();
+    scroller.style.direction = 'rtl';
+    await waitForRenderingUpdate();
+    assert_true(markerIsFocused(), 'changing to RTL keeps focus on the first ::scroll-marker');
+    await sendKey(kArrowRight);
+    assert_equals(getActiveMarker(), 'last', 'in RTL, right arrow wraps backward');
+
+    // In RTL, left arrow acts like right arrow in LTR, so it moves forward from first to middle
+    await focusAndActivateFirstMarker();
+    scroller.style.direction = 'rtl';
+    await waitForRenderingUpdate();
+    await sendKey(kArrowLeft);
+    assert_equals(getActiveMarker(), 'middle', 'in RTL, left arrow moves forward');
+  }, 'Arrow keys in horizontal-tb');
+
+  promise_test(async t => {
+    // In vertical-lr:
+    // Block axis is Left to Right.
+    // Inline axis is Top to Bottom.
+    await focusAndActivateFirstMarker();
+    scroller.style.writingMode = 'vertical-lr';
+    await waitForRenderingUpdate();
+
+    await sendKey(kArrowDown);
+    assert_equals(getActiveMarker(), 'middle', 'down arrow moves forward in vertical-lr');
+    await sendKey(kArrowUp);
+    assert_equals(getActiveMarker(), 'first', 'up arrow moves backward in vertical-lr');
+    await sendKey(kArrowRight);
+    assert_equals(getActiveMarker(), 'middle', 'right arrow moves forward in vertical-lr');
+    await sendKey(kArrowLeft);
+    assert_equals(getActiveMarker(), 'first', 'left arrow moves backward in vertical-lr');
+  }, 'Arrow keys in vertical-lr');
+
+  promise_test(async t => {
+    // In vertical-rl:
+    // Block axis is Right to Left.
+    // Inline axis is Top to Bottom.
+    await focusAndActivateFirstMarker();
+    scroller.style.writingMode = 'vertical-rl';
+    await waitForRenderingUpdate();
+
+    await sendKey(kArrowDown);
+    assert_equals(getActiveMarker(), 'middle', 'down arrow moves forward in vertical-rl');
+    await sendKey(kArrowUp);
+    assert_equals(getActiveMarker(), 'first', 'up arrow moves backward in vertical-rl');
+    await sendKey(kArrowRight);
+    assert_equals(getActiveMarker(), 'last', 'right arrow wraps backward in vertical-rl');
+    await sendKey(kArrowLeft);
+    assert_equals(getActiveMarker(), 'first', 'left arrow moves forward in vertical-rl');
+  }, 'Arrow keys in vertical-rl');
+
+  promise_test(async t => {
+    // In vertical-rl with rtl direction:
+    // Block axis is Right to Left.
+    // Inline axis is Bottom to Top.
+    await focusAndActivateFirstMarker();
+    scroller.style.writingMode = 'vertical-rl';
+    scroller.style.direction = 'rtl';
+    await waitForRenderingUpdate();
+
+    await sendKey(kArrowDown);
+    assert_equals(getActiveMarker(), 'last', 'down arrow wraps backward in vertical-rl rtl');
+    await sendKey(kArrowUp);
+    assert_equals(getActiveMarker(), 'first', 'up arrow moves forward in vertical-rl rtl');
+    await sendKey(kArrowLeft);
+    assert_equals(getActiveMarker(), 'middle', 'left arrow moves forward in vertical-rl rtl');
+    await sendKey(kArrowRight);
+    assert_equals(getActiveMarker(), 'first', 'right arrow moves backward in vertical-rl rtl');
+  }, 'Arrow keys in vertical-rl rtl');
+</script>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-marker-selection-picks-closest.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-marker-selection-picks-closest.html
index e0e46ba1d425..3f7ac296e785 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-marker-selection-picks-closest.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-marker-selection-picks-closest.html
@@ -8,7 +8,7 @@
   <script src="/resources/testharness.js"></script>
   <script src="/resources/testharnessreport.js"></script>
   <script src="/dom/events/scrolling/scroll_support.js"></script>
-  <script src="/css/css-overflow/support/scroll-marker-support.js"></script>
+  <script src="support/scroll-marker-support.js"></script>
 </head>
 
 <body>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-markers-focus-active-element.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-markers-focus-active-element.html
index 0b2d68b5773f..89d6f64de23d 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-markers-focus-active-element.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-markers-focus-active-element.html
@@ -1,6 +1,6 @@
 <!doctype html>
 <meta charset="utf-8">
-<title>CSS Test: document.activeElement for ::scroll-marker is scroller</title>
+<title>CSS Test: document.activeElement for ::scroll-marker in links and tabs modes</title>
 <link rel="help"
   href="https://github.com/flackr/carousel/tree/main/scroll-marker#what-is-the-documentactiveelement-of-a-focused-pseudo-element">
 <script src="/resources/testharness.js"></script>
@@ -56,12 +56,25 @@
 </div>
 <script>
   promise_test(async t => {
+    // 1. Links mode (default)
+    let actions_promise = new test_driver.Actions()
+      .pointerMove(15, 15)
+      .pointerDown()
+      .pointerUp()
+      .send();
+    await actions_promise;
+    assert_equals(document.activeElement, document.body, "document.activeElement for ::scroll-marker is document.body in links mode");
+
+    // 2. Tabs mode
+    document.activeElement.blur();
+    scroller.style.setProperty("scroll-marker-group", "before tabs");
+
     actions_promise = new test_driver.Actions()
       .pointerMove(15, 15)
       .pointerDown()
       .pointerUp()
       .send();
     await actions_promise;
-    assert_equals(document.activeElement, scroller, "document.activeElement for ::scroll-marker is scroller");
-  });
-</script>
\ No newline at end of file
+    assert_equals(document.activeElement, scroller, "document.activeElement for ::scroll-marker is scroller in tabs mode");
+  }, "document.activeElement for ::scroll-marker is document.body in links mode, and scroller in tabs mode");
+</script>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-markers-focus-on-scrolling.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-markers-focus-on-scrolling.html
index 8e5851a49735..8278771a237e 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-markers-focus-on-scrolling.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-markers-focus-on-scrolling.html
@@ -1,6 +1,6 @@
 <!doctype html>
 <meta charset="utf-8">
-<title>CSS Test: scroll tracking for ::scroll-marker </title>
+<title>CSS Test: scroll tracking for ::scroll-marker in links and tabs modes</title>
 <link rel="help" href="https://drafts.csswg.org/css-overflow-5/#scroll-container-scroll">
 <script src="/resources/testharness.js"></script>
 <script src="/resources/testharnessreport.js"></script>
@@ -62,10 +62,34 @@
                   " but was " + pseudoOpacity.toString());
   }
   promise_test(async () => {
+    // 1. Links mode (default)
     scroller.scrollTop = 150;
     assertPseudoElementProperty(target, "::scroll-marker", "1");
-  }, "active ::scroll-marker doesn't have focus on scroll if previous ::scroll-marker didn't have it");
+  }, "active ::scroll-marker doesn't have focus on scroll if previous ::scroll-marker didn't have it in links mode");
+
   promise_test(async () => {
+    // 1. Links mode (default)
+    /* Click the first ::scroll-marker to attempt to give it focus. */
+    let actions_promise = new test_driver.Actions()
+      .pointerMove(7, 7)
+      .pointerDown()
+      .pointerUp()
+      .pointerDown()
+      .pointerUp()
+      .send();
+    await actions_promise;
+    await waitForAnimationFrames(2);
+    scroller.scrollTop = 150;
+    await waitForAnimationFrames(2);
+    assertPseudoElementProperty(target, "::scroll-marker", "1");
+  }, "active ::scroll-marker does not save focus on scroll in links mode because click does not focus the marker");
+
+  promise_test(async () => {
+    // 2. Tabs mode
+    document.activeElement.blur();
+    scroller.style.setProperty("scroll-marker-group", "before tabs");
+    await waitForAnimationFrames(2);
+
     /* Click the first ::scroll-marker to give it focus. */
     let actions_promise = new test_driver.Actions()
       .pointerMove(7, 7)
@@ -79,5 +103,5 @@
     scroller.scrollTop = 150;
     await waitForAnimationFrames(2);
     assertPseudoElementProperty(target, "::scroll-marker", "0.5");
-  }, "active ::scroll-marker saves focus on scroll if previous ::scroll-marker had it");
+  }, "active ::scroll-marker saves focus on scroll if previous ::scroll-marker had it in tabs mode");
 </script>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-markers-nested-scrollers.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-markers-nested-scrollers.html
new file mode 100644
index 000000000000..35f00da9bb3a
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-markers-nested-scrollers.html
@@ -0,0 +1,87 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Overflow Test: scroll tracking for ::scroll-marker in nested scrollers</title>
+<link rel="help" href="https://drafts.csswg.org/css-overflow-5/#scroll-container-scroll">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/css/css-transitions/support/helper.js"></script>
+<style>
+  #a,
+  #b,
+  #b0 {
+    overflow: scroll;
+    height: 100px;
+    width: 100px;
+  }
+
+  #a,
+  #b {
+    scroll-marker-group: after;
+  }
+
+  #a::scroll-marker-group,
+  #b::scroll-marker-group {
+    border: 1px solid black;
+    display: flex;
+    height: 20px;
+  }
+
+  .marker-source {
+    height: 100px;
+    width: 100px;
+  }
+
+  #b::scroll-marker,
+  #b0::scroll-marker,
+  #c::scroll-marker,
+  #c0::scroll-marker {
+    content: '';
+    background-color: red;
+    display: inline-flex;
+    width: 10px;
+    height: 10px;
+    border-radius: 50%;
+  }
+
+  #b::scroll-marker:target-current,
+  #b0::scroll-marker:target-current,
+  #c::scroll-marker:target-current,
+  #c0::scroll-marker:target-current {
+    background-color: green;
+  }
+</style>
+<div id="a">
+  <div id="b0" class="marker-source"></div>
+  <div id="b" class="marker-source">
+    <div id="c0" class="marker-source"></div>
+    <div id="c" class="marker-source"></div>
+  </div>
+</div>
+<script>
+  const GREEN = "rgb(0, 128, 0)";
+  const RED = "rgb(255, 0, 0)";
+
+  function assertPseudoElementProperty(originatingElement, pseudoType, backgroundColor) {
+    const pseudoStyle = getComputedStyle(originatingElement, pseudoType);
+    const pseudoBackgroundColor = pseudoStyle.getPropertyValue('background-color');
+    assert_equals(pseudoBackgroundColor, backgroundColor, pseudoType +
+      " background-color for #" + originatingElement.id + " should be " + backgroundColor.toString() +
+      " but was " + pseudoBackgroundColor.toString());
+  }
+
+  promise_test(async (t) => {
+    await waitForAnimationFrames(2);
+    assertPseudoElementProperty(b0, "::scroll-marker", GREEN);
+    assertPseudoElementProperty(b, "::scroll-marker", RED);
+    assertPseudoElementProperty(c0, "::scroll-marker", GREEN);
+    assertPseudoElementProperty(c, "::scroll-marker", RED);
+
+    c.scrollIntoView();
+    await waitForAnimationFrames(2);
+
+    assertPseudoElementProperty(b0, "::scroll-marker", RED);
+    assertPseudoElementProperty(b, "::scroll-marker", GREEN);
+    assertPseudoElementProperty(c0, "::scroll-marker", RED);
+    assertPseudoElementProperty(c, "::scroll-marker", GREEN);
+  }, "scrollIntoView in nested scrollers selects correct ::scroll-marker in both ancestor groups");
+</script>
\ No newline at end of file
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-target-group-014.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-target-group-014.html
new file mode 100644
index 000000000000..45cbd057c2b5
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-target-group-014.html
@@ -0,0 +1,76 @@
+<!DOCTYPE html>
+<title>CSS Overflow: scroll-target-group: auto with container-type: inline-size</title>
+<link rel="help" href="https://drafts.csswg.org/css-overflow-5/#scroll-target-group">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<style>
+  #nav {
+    scroll-target-group: auto;
+    position: fixed;
+    top: 0;
+    left: 0;
+    background: white;
+  }
+
+  #nav a {
+    display: block;
+    padding: 5px;
+  }
+
+  #nav a:target-current {
+    background-color: yellow;
+  }
+
+  #container {
+    container-type: inline-size;
+    margin-top: 50px;
+  }
+
+  #scroller {
+    height: 400px;
+    overflow: scroll;
+    border: 1px solid black;
+  }
+
+  section {
+    height: 600px;
+    border: 1px solid red;
+  }
+</style>
+<div id="nav">
+  <a id="link1" href="#s1">Section 1</a>
+  <a id="link2" href="#s2">Section 2</a>
+  <a id="link3" href="#s3">Section 3</a>
+</div>
+<div id="scroller">
+  <div id="container">
+    <section id="s1">Section 1</section>
+    <section id="s2">Section 2</section>
+    <section id="s3">Section 3</section>
+  </div>
+</div>
+<script>
+  promise_test(async () => {
+    const scroller = document.getElementById('scroller');
+    const link1 = document.getElementById('link1');
+    const link2 = document.getElementById('link2');
+    const link3 = document.getElementById('link3');
+
+    // Wait for initial scroll marker update.
+    await new Promise(resolve => requestAnimationFrame(() => requestAnimationFrame(resolve)));
+
+    assert_true(link1.matches(':target-current'), "Link 1 should be active initially");
+
+    scroller.scrollTop = 700;
+    // Wait for scroll update and snapshot.
+    await new Promise(resolve => requestAnimationFrame(() => requestAnimationFrame(resolve)));
+
+    assert_true(link2.matches(':target-current'), "Link 2 should be active after scroll");
+    assert_false(link1.matches(':target-current'), "Link 1 should not be active after scroll");
+
+    scroller.scrollTop = 1300;
+    await new Promise(resolve => requestAnimationFrame(() => requestAnimationFrame(resolve)));
+
+    assert_true(link3.matches(':target-current'), "Link 3 should be active after further scroll");
+  }, "scroll-target-group: auto updates :target-current with container-type: inline-size");
+</script>
\ No newline at end of file
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-target-group-iframe.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-target-group-iframe.html
new file mode 100644
index 000000000000..049dec61c30a
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-target-group-iframe.html
@@ -0,0 +1,81 @@
+<!DOCTYPE html>
+<title>CSS Overflow: scroll-target-group: auto with iframe sibling</title>
+<link rel="help" href="https://drafts.csswg.org/css-overflow-5/#scroll-target-group">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<style>
+  #nav {
+    scroll-target-group: auto;
+    position: fixed;
+    top: 0;
+    left: 0;
+    background: white;
+  }
+
+  #nav a {
+    display: block;
+    padding: 5px;
+  }
+
+  #nav a:target-current {
+    background-color: yellow;
+  }
+
+  #scroller {
+    height: 400px;
+    overflow: scroll;
+    border: 1px solid black;
+  }
+
+  section {
+    height: 600px;
+    border: 1px solid red;
+  }
+
+  iframe {
+    height: 600px;
+    width: 100%;
+    border: 1px solid blue;
+  }
+</style>
+<div id="nav">
+  <a id="link1" href="#s1">Section 1</a>
+  <a id="link2" href="#s2">Section 2</a>
+  <a id="link3" href="#s3">Section 3</a>
+</div>
+<div id="scroller">
+  <section id="s1">Section 1</section>
+  <iframe id="ifr"></iframe>
+  <section id="s2">Section 2</section>
+  <section id="s3">Section 3</section>
+</div>
+<script>
+  promise_test(async () => {
+    const scroller = document.getElementById('scroller');
+    const link1 = document.getElementById('link1');
+    const link2 = document.getElementById('link2');
+    const link3 = document.getElementById('link3');
+    const ifr = document.getElementById('ifr');
+
+    // Wait for initial scroll marker update.
+    await new Promise(resolve => requestAnimationFrame(() => requestAnimationFrame(resolve)));
+
+    // Now set the iframe source to load it.
+    ifr.src = "/common/blank.html?pipe=delay(1)";
+    await new Promise(resolve => ifr.addEventListener('load', resolve));
+
+    // Scroll to section 2.
+    // Since section 1 is 600px and iframe is 600px, section 2 starts at 1200px.
+    // Let's scroll to 1400px.
+    scroller.scrollTop = 1400;
+    await new Promise(resolve => requestAnimationFrame(() => requestAnimationFrame(resolve)));
+
+    assert_true(link2.matches(':target-current'), "Link 2 should be active after scroll past iframe");
+    assert_false(link1.matches(':target-current'), "Link 1 should not be active");
+
+    scroller.scrollTop = 2000;
+    await new Promise(resolve => requestAnimationFrame(() => requestAnimationFrame(resolve)));
+
+    assert_true(link3.matches(':target-current'), "Link 3 should be active after further scroll");
+  }, "scroll-target-group: auto updates :target-current when there is an iframe sibling in the scroller");
+</script>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/support/w3c-import.log b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/support/w3c-import.log
index 3395d31b8cf9..1dc4bec0bf95 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/support/w3c-import.log
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/support/w3c-import.log
@@ -10,8 +10,6 @@ Do NOT modify or remove this file.
 ------------------------------------------------------------------------
 Properties requiring vendor prefixes:
 None
-Property values requiring vendor prefixes:
-None
 ------------------------------------------------------------------------
 List of files:
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/support/scroll-marker-support.js
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/targeted-column-scroll-marker-selection-001-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/targeted-column-scroll-marker-selection-001-expected.html
index e4dbe28a85a9..033f34d27002 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/targeted-column-scroll-marker-selection-001-expected.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/targeted-column-scroll-marker-selection-001-expected.html
@@ -20,7 +20,6 @@
       overflow-x: scroll;
       scroll-snap-type: x mandatory;
       list-style-type: none;
-      scroll-behavior: smooth;
       border: solid 2px grey;
       padding-top: 10%;
       text-align: center;
@@ -38,13 +37,15 @@
         margin: 3px;
         background-color: red;
       }
-      /* item 2 is child 3 */
+      /* item2 is child 3. item2.scrollIntoView aligns to its center. */
+      & > :nth-child(3) {
+        scroll-snap-align: center;
+      }
       & > :nth-child(3)::scroll-marker {
         background-color: green;
       }
 
       &>.item {
-        scroll-snap-align: center;
         height: 80%;
         width: 158px;
         border: 1px solid;
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/targeted-column-scroll-marker-selection-001-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/targeted-column-scroll-marker-selection-001-ref.html
index e4dbe28a85a9..033f34d27002 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/targeted-column-scroll-marker-selection-001-ref.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/targeted-column-scroll-marker-selection-001-ref.html
@@ -20,7 +20,6 @@
       overflow-x: scroll;
       scroll-snap-type: x mandatory;
       list-style-type: none;
-      scroll-behavior: smooth;
       border: solid 2px grey;
       padding-top: 10%;
       text-align: center;
@@ -38,13 +37,15 @@
         margin: 3px;
         background-color: red;
       }
-      /* item 2 is child 3 */
+      /* item2 is child 3. item2.scrollIntoView aligns to its center. */
+      & > :nth-child(3) {
+        scroll-snap-align: center;
+      }
       & > :nth-child(3)::scroll-marker {
         background-color: green;
       }
 
       &>.item {
-        scroll-snap-align: center;
         height: 80%;
         width: 158px;
         border: 1px solid;
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/targeted-column-scroll-marker-selection-001.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/targeted-column-scroll-marker-selection-001.html
index a9b79ae1d097..46e7f839a8c7 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/targeted-column-scroll-marker-selection-001.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/targeted-column-scroll-marker-selection-001.html
@@ -24,7 +24,6 @@
       overflow-x: scroll;
       scroll-snap-type: x mandatory;
       list-style-type: none;
-      scroll-behavior: smooth;
       border: solid 2px grey;
       padding-top: 10%;
       text-align: center;
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/targeted-column-scroll-marker-selection-002-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/targeted-column-scroll-marker-selection-002-expected.html
index 6f28d562d9c9..b82ec1b35a24 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/targeted-column-scroll-marker-selection-002-expected.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/targeted-column-scroll-marker-selection-002-expected.html
@@ -51,9 +51,8 @@
         display: inline-block;
       }
 
-      /* Item 3 is child 4. Starting from scrollLeft=0, calling
-      box4.scrollIntoView ends up in a position that aligns box 3. */
-      & > :nth-child(4){
+      /* item4 is child 5. item4.scrollIntoView aligns to its center. */
+      & > :nth-child(5){
         scroll-snap-align: center;
       }
 
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/targeted-column-scroll-marker-selection-002-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/targeted-column-scroll-marker-selection-002-ref.html
index 6f28d562d9c9..b82ec1b35a24 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/targeted-column-scroll-marker-selection-002-ref.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/targeted-column-scroll-marker-selection-002-ref.html
@@ -51,9 +51,8 @@
         display: inline-block;
       }
 
-      /* Item 3 is child 4. Starting from scrollLeft=0, calling
-      box4.scrollIntoView ends up in a position that aligns box 3. */
-      & > :nth-child(4){
+      /* item4 is child 5. item4.scrollIntoView aligns to its center. */
+      & > :nth-child(5){
         scroll-snap-align: center;
       }
 
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/targeted-column-scroll-marker-selection-002.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/targeted-column-scroll-marker-selection-002.html
index 08c3a302a549..8acb21284ff5 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/targeted-column-scroll-marker-selection-002.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/targeted-column-scroll-marker-selection-002.html
@@ -24,7 +24,6 @@
       overflow-x: scroll;
       scroll-snap-type: x mandatory;
       list-style-type: none;
-      scroll-behavior: smooth;
       border: solid 2px grey;
       padding-top: 10%;
       text-align: center;
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/targeted-column-scroll-marker-selection-003-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/targeted-column-scroll-marker-selection-003-expected.html
index 4ead4f45813a..1c2310112f5f 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/targeted-column-scroll-marker-selection-003-expected.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/targeted-column-scroll-marker-selection-003-expected.html
@@ -15,7 +15,7 @@
     }
 
     .carousel {
-      width: 800px;
+      width: 500px;
       height: 200px;
       overflow-x: scroll;
       scroll-snap-type: x mandatory;
@@ -68,15 +68,14 @@
       &>.item {
         scroll-snap-align: none;
         height: 80%;
-        width: 158px;
+        width: 80px;
         border: 1px solid;
         place-content: center;
         display: inline-block;
       }
 
-      /* Make only item 16 (index 15) a snap target so we are scrolled all the
-      way to the right edge */
-      & > :nth-child(14){
+      /* item14 is child 15. item14.scrollIntoView() aligns to its center. */
+      & > :nth-child(15){
         scroll-snap-align: center;
       }
 
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/targeted-column-scroll-marker-selection-003-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/targeted-column-scroll-marker-selection-003-ref.html
index 4ead4f45813a..1c2310112f5f 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/targeted-column-scroll-marker-selection-003-ref.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/targeted-column-scroll-marker-selection-003-ref.html
@@ -15,7 +15,7 @@
     }
 
     .carousel {
-      width: 800px;
+      width: 500px;
       height: 200px;
       overflow-x: scroll;
       scroll-snap-type: x mandatory;
@@ -68,15 +68,14 @@
       &>.item {
         scroll-snap-align: none;
         height: 80%;
-        width: 158px;
+        width: 80px;
         border: 1px solid;
         place-content: center;
         display: inline-block;
       }
 
-      /* Make only item 16 (index 15) a snap target so we are scrolled all the
-      way to the right edge */
-      & > :nth-child(14){
+      /* item14 is child 15. item14.scrollIntoView() aligns to its center. */
+      & > :nth-child(15){
         scroll-snap-align: center;
       }
 
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/targeted-column-scroll-marker-selection-003.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/targeted-column-scroll-marker-selection-003.html
index 4f8f68646ded..845c5a8e3431 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/targeted-column-scroll-marker-selection-003.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/targeted-column-scroll-marker-selection-003.html
@@ -19,12 +19,11 @@
     }
 
     .carousel {
-      width: 800px;
+      width: 500px;
       height: 200px;
       overflow-x: scroll;
       scroll-snap-type: x mandatory;
       list-style-type: none;
-      scroll-behavior: smooth;
       border: solid 2px grey;
       padding-top: 10%;
       text-align: center;
@@ -58,7 +57,7 @@
       &>.item {
         scroll-snap-align: center;
         height: 80%;
-        width: 158px;
+        width: 80px;
         border: 1px solid;
         place-content: center;
         display: inline-block;
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/targeted-column-scroll-marker-selection-004-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/targeted-column-scroll-marker-selection-004-expected.html
index 6e42518107cf..69f872308731 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/targeted-column-scroll-marker-selection-004-expected.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/targeted-column-scroll-marker-selection-004-expected.html
@@ -77,10 +77,8 @@
         display: inline-block;
       }
 
-      /* The test calls scrollIntoView on item 13 (child 14). Make only item 11
-         (index 12) a snap target as it is what is aligned when scrollintoView
-         is called on item 13. */
-      & > :nth-child(12){
+      /* item13 is child 14. item13.scrollIntoView aligns to its center. */
+      & > :nth-child(14){
         scroll-snap-align: center;
       }
 
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/targeted-column-scroll-marker-selection-004-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/targeted-column-scroll-marker-selection-004-ref.html
index 6e42518107cf..69f872308731 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/targeted-column-scroll-marker-selection-004-ref.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/targeted-column-scroll-marker-selection-004-ref.html
@@ -77,10 +77,8 @@
         display: inline-block;
       }
 
-      /* The test calls scrollIntoView on item 13 (child 14). Make only item 11
-         (index 12) a snap target as it is what is aligned when scrollintoView
-         is called on item 13. */
-      & > :nth-child(12){
+      /* item13 is child 14. item13.scrollIntoView aligns to its center. */
+      & > :nth-child(14){
         scroll-snap-align: center;
       }
 
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/targeted-column-scroll-marker-selection-004.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/targeted-column-scroll-marker-selection-004.html
index 60ed33c73b67..acc8f2ed011c 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/targeted-column-scroll-marker-selection-004.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/targeted-column-scroll-marker-selection-004.html
@@ -24,7 +24,6 @@
       overflow-x: scroll;
       scroll-snap-type: x mandatory;
       list-style-type: none;
-      scroll-behavior: smooth;
       border: solid 2px grey;
       padding-top: 10%;
       text-align: center;
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/w3c-import.log b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/w3c-import.log
index fbb9ae657c8d..71db5a56ff8f 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/w3c-import.log
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/w3c-import.log
@@ -10,11 +10,9 @@ Do NOT modify or remove this file.
 ------------------------------------------------------------------------
 Properties requiring vendor prefixes:
 None
-Property values requiring vendor prefixes:
-None
 ------------------------------------------------------------------------
 List of files:
-/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/WEB_FEATURES.yaml
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/WEB_FEATURES.yml
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/chrome-421199213-crash.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/column-scroll-marker-001-expected.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/column-scroll-marker-001-ref.html
@@ -88,6 +86,9 @@ List of files:
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-button-on-object-expected.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-button-on-object-ref.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-button-on-object.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-button-reattachment-position-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-button-reattachment-position-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-button-reattachment-position.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-button-universal-before.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-buttons-001-expected.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-buttons-001-ref.html
@@ -261,6 +262,7 @@ List of files:
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-marker-in-display-none-column-crash.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-marker-inert-001.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-marker-inert-002.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-marker-inert-003.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-marker-multiple-activation.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-marker-navigation-cycles.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-marker-next-focus.html
@@ -282,6 +284,7 @@ List of files:
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-markers-focus-on-scrolling.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-markers-inside-canvas-crash.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-markers-inside-select-crash.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-markers-nested-scrollers.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-markers-resize-crash.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-markers-under-content-visibility-auto-expected.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-markers-under-content-visibility-auto-ref.html
@@ -319,6 +322,8 @@ List of files:
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-target-group-012-ref.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-target-group-012.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-target-group-013.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-target-group-014.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-target-group-iframe.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-target-group-inline-crash.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-target-group-inline-targets-expected.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-markers/scroll-target-group-inline-targets-ref.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scrollbar-gutter-zero-width-crash.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scrollbar-gutter-zero-width-crash.html
new file mode 100644
index 000000000000..7f1fce431d9a
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scrollbar-gutter-zero-width-crash.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Overflow: zero-width scroller with scrollbar-gutter should not crash</title>
+<link rel="author" title="Jason Leo" href="mailto:cgqaq@chromium.org">
+<link rel="help" href="https://drafts.csswg.org/css-overflow-4/#scrollbar-gutter-property">
+<style>
+#target {
+  overflow: auto;
+  scrollbar-gutter: stable both-edges;
+  width: 0;
+}
+</style>
+<div id="target"></div>
+<script>
+  target.scrollTop;
+</script>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/single-axis-overflow-clip-rtl-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/single-axis-overflow-clip-rtl-expected.html
new file mode 100644
index 000000000000..14f3b8663a55
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/single-axis-overflow-clip-rtl-expected.html
@@ -0,0 +1,25 @@
+<!doctype html>
+<meta charset="utf-8">
+<title>Single-axis scroll containers: Clipped X Rendering RTL (Reference)</title>
+<link rel="help" href="https://github.com/w3c/csswg-drafts/issues/5572">
+<style>
+  #scroller {
+    width: 100px;
+    height: 100px;
+    direction: rtl;
+    overflow-x: hidden; /* Reference standard */
+    overflow-y: scroll;
+    scrollbar-width: none;
+  }
+  #content {
+    width: 300px;
+    height: 300px;
+    background: linear-gradient(to right, lightcoral, lightblue);
+    color: black;
+    font-family: sans-serif;
+    font-size: 20px;
+  }
+</style>
+<div id="scroller">
+  <div id="content">RTL gradient and text</div>
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/single-axis-overflow-clip-rtl-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/single-axis-overflow-clip-rtl-ref.html
new file mode 100644
index 000000000000..14f3b8663a55
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/single-axis-overflow-clip-rtl-ref.html
@@ -0,0 +1,25 @@
+<!doctype html>
+<meta charset="utf-8">
+<title>Single-axis scroll containers: Clipped X Rendering RTL (Reference)</title>
+<link rel="help" href="https://github.com/w3c/csswg-drafts/issues/5572">
+<style>
+  #scroller {
+    width: 100px;
+    height: 100px;
+    direction: rtl;
+    overflow-x: hidden; /* Reference standard */
+    overflow-y: scroll;
+    scrollbar-width: none;
+  }
+  #content {
+    width: 300px;
+    height: 300px;
+    background: linear-gradient(to right, lightcoral, lightblue);
+    color: black;
+    font-family: sans-serif;
+    font-size: 20px;
+  }
+</style>
+<div id="scroller">
+  <div id="content">RTL gradient and text</div>
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/single-axis-overflow-clip-rtl.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/single-axis-overflow-clip-rtl.html
new file mode 100644
index 000000000000..46786aa24690
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/single-axis-overflow-clip-rtl.html
@@ -0,0 +1,25 @@
+<!doctype html>
+<meta charset="utf-8">
+<title>Single-axis scroll containers: Clipped X Rendering RTL</title>
+<link rel="help" href="https://github.com/w3c/csswg-drafts/issues/5572">
+<link rel="match" href="single-axis-overflow-clip-rtl-ref.html">
+<style>
+  #scroller {
+    width: 100px;
+    height: 100px;
+    direction: rtl;
+    overflow-x: clip; /* Test subject */
+    overflow-y: hidden;
+  }
+  #content {
+    width: 300px;
+    height: 300px;
+    background: linear-gradient(to right, lightcoral, lightblue);
+    color: black;
+    font-family: sans-serif;
+    font-size: 20px;
+  }
+</style>
+<div id="scroller">
+  <div id="content">RTL gradient and text</div>
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/single-axis-overflow-scroll-to-clip-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/single-axis-overflow-scroll-to-clip-expected.html
new file mode 100644
index 000000000000..a87f5c67fac6
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/single-axis-overflow-scroll-to-clip-expected.html
@@ -0,0 +1,43 @@
+<!doctype html>
+<html>
+<head>
+  <meta charset="utf-8">
+  <title>Visual clamp single-axis overflow: scroll to clip on dynamic style changes (Reference)</title>
+  <style>
+    body {
+      margin: 0;
+    }
+
+    #expected {
+      position: relative;
+      width: 100px;
+      height: 100px;
+      background: rgb(0, 0, 255);
+    }
+
+    #top-band {
+      position: absolute;
+      top: 0;
+      left: 0;
+      width: 100px;
+      height: 50px;
+      background: rgb(0, 255, 0);
+    }
+
+    #x-marker {
+      position: absolute;
+      top: 50px;
+      left: 0;
+      width: 20px;
+      height: 50px;
+      background: rgb(255, 255, 0);
+    }
+  </style>
+</head>
+<body>
+  <div id="expected">
+    <div id="top-band"></div>
+    <div id="x-marker"></div>
+  </div>
+</body>
+</html>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/single-axis-overflow-scroll-to-clip-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/single-axis-overflow-scroll-to-clip-ref.html
new file mode 100644
index 000000000000..a87f5c67fac6
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/single-axis-overflow-scroll-to-clip-ref.html
@@ -0,0 +1,43 @@
+<!doctype html>
+<html>
+<head>
+  <meta charset="utf-8">
+  <title>Visual clamp single-axis overflow: scroll to clip on dynamic style changes (Reference)</title>
+  <style>
+    body {
+      margin: 0;
+    }
+
+    #expected {
+      position: relative;
+      width: 100px;
+      height: 100px;
+      background: rgb(0, 0, 255);
+    }
+
+    #top-band {
+      position: absolute;
+      top: 0;
+      left: 0;
+      width: 100px;
+      height: 50px;
+      background: rgb(0, 255, 0);
+    }
+
+    #x-marker {
+      position: absolute;
+      top: 50px;
+      left: 0;
+      width: 20px;
+      height: 50px;
+      background: rgb(255, 255, 0);
+    }
+  </style>
+</head>
+<body>
+  <div id="expected">
+    <div id="top-band"></div>
+    <div id="x-marker"></div>
+  </div>
+</body>
+</html>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/single-axis-overflow-scroll-to-clip.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/single-axis-overflow-scroll-to-clip.html
new file mode 100644
index 000000000000..8d7e84aeba0e
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/single-axis-overflow-scroll-to-clip.html
@@ -0,0 +1,91 @@
+<!doctype html>
+<html class="reftest-wait">
+<head>
+  <meta charset="utf-8">
+  <title>Single-axis scroll containers visually clamp disabled axes on dynamic style changes</title>
+  <link rel="help" href="https://drafts.csswg.org/cssom-view/#dom-element-scrollto">
+  <link rel="help" href="https://github.com/w3c/csswg-drafts/issues/5572">
+  <link rel="match" href="single-axis-overflow-scroll-to-clip-ref.html">
+  <meta name="assert" content="A scroller with overflow: hidden has one of its axes set to overflow: clip. It repaints with the axis set to overflow: clip at a scroll offset of 0.">
+  <style>
+    body {
+      margin: 0;
+    }
+
+    #clipper {
+      width: 100px;
+      height: 100px;
+      overflow: hidden;
+    }
+
+    #scroller {
+      width: 100px;
+      height: 160px;
+      overflow: hidden;
+      scrollbar-width: none;
+    }
+
+    #scroller::-webkit-scrollbar {
+      display: none;
+    }
+
+    #content {
+      position: relative;
+      width: 300px;
+      height: 300px;
+      background: rgb(0, 0, 255);
+    }
+
+    #top-band {
+      position: absolute;
+      top: 0;
+      left: 0;
+      width: 300px;
+      height: 50px;
+      background: rgb(0, 255, 0);
+    }
+
+    #x-marker {
+      position: absolute;
+      top: 50px;
+      left: 40px;
+      width: 20px;
+      height: 50px;
+      background: rgb(255, 255, 0);
+    }
+  </style>
+</head>
+<body>
+  <div id="clipper">
+    <div id="scroller">
+      <div id="content">
+        <div id="top-band"></div>
+        <div id="x-marker"></div>
+      </div>
+    </div>
+  </div>
+
+  <script>
+    document.documentElement.addEventListener('TestRendered', () => {
+      const scroller = document.getElementById('scroller');
+
+      // Paint the scrolled state first, then change overflow so the test
+      // exercises a visual reset, not just the final computed values.
+      scroller.scrollTo(40, 50);
+
+      requestAnimationFrame(() => {
+        requestAnimationFrame(() => {
+          scroller.style.overflowX = 'hidden';
+          scroller.style.overflowY = 'clip';
+
+          requestAnimationFrame(() => {
+            requestAnimationFrame(() => {
+              document.documentElement.classList.remove('reftest-wait');
+            });
+          });
+        });
+      });
+    });
+  </script>
+</body>
+</html>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/single-axis-scroll-apis-dynamic-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/single-axis-scroll-apis-dynamic-expected.txt
new file mode 100644
index 000000000000..e96c7307d018
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/single-axis-scroll-apis-dynamic-expected.txt
@@ -0,0 +1,3 @@
+
+FAIL changing from overflow: hidden to a single-axis scroller clamps the disabled axis and its scroll dimensions assert_equals: expected 0 but got 50
+
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/single-axis-scroll-apis-dynamic.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/single-axis-scroll-apis-dynamic.html
new file mode 100644
index 000000000000..92b890a48951
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/single-axis-scroll-apis-dynamic.html
@@ -0,0 +1,51 @@
+<!doctype html>
+<meta charset="utf-8">
+<title>Single-axis scroll containers clamp disabled axes on dynamic style changes</title>
+<link rel="help" href="https://drafts.csswg.org/cssom-view/#dom-element-scrollto">
+<link rel="help" href="https://drafts.csswg.org/cssom-view/#dom-element-scrollwidth">
+<link rel="help" href="https://drafts.csswg.org/cssom-view/#dom-element-scrollheight">
+<link rel="help" href="https://github.com/w3c/csswg-drafts/issues/5572">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<style>
+  body {
+    margin: 0;
+  }
+
+  #scroller {
+    position: fixed;
+    top: 0;
+    left: 0;
+    width: 100px;
+    height: 100px;
+    overflow: hidden;
+    scrollbar-width: none;
+  }
+
+  #content {
+    width: 300px;
+    height: 300px;
+  }
+</style>
+<div id="log"></div>
+<div id="scroller"><div id="content"></div></div>
+<script>
+test(() => {
+  const scroller = document.getElementById('scroller');
+
+  assert_equals(scroller.scrollWidth, 300);
+  assert_equals(scroller.scrollHeight, 300);
+
+  scroller.scrollTo(40, 50);
+  assert_equals(scroller.scrollLeft, 40);
+  assert_equals(scroller.scrollTop, 50);
+
+  scroller.style.overflowX = 'scroll';
+  scroller.style.overflowY = 'clip';
+
+  assert_equals(scroller.scrollLeft, 40);
+  assert_equals(scroller.scrollTop, 0);
+  assert_equals(scroller.scrollWidth, 300);
+  assert_equals(scroller.scrollHeight, 300);
+}, 'changing from overflow: hidden to a single-axis scroller clamps the disabled axis and its scroll dimensions');
+</script>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/single-axis-scroll-apis-programmatic-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/single-axis-scroll-apis-programmatic-expected.txt
new file mode 100644
index 000000000000..fa562ff7d0b3
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/single-axis-scroll-apis-programmatic-expected.txt
@@ -0,0 +1,6 @@
+
+FAIL LTR clipped X assert_equals: LTR clipped X: scrollTo ignores the clipped X-axis expected 0 but got 40
+FAIL RTL clipped X assert_equals: RTL clipped X: scrollTo ignores the clipped X-axis (negative in RTL) expected 0 but got -40
+FAIL LTR clipped Y assert_equals: LTR clipped Y: scrollTo ignores the clipped Y-axis expected 0 but got 50
+FAIL RTL clipped Y assert_equals: RTL clipped Y: scrollTo ignores the clipped Y-axis expected 0 but got 50
+
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/single-axis-scroll-apis-programmatic.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/single-axis-scroll-apis-programmatic.html
new file mode 100644
index 000000000000..1f8d95b4fa49
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/single-axis-scroll-apis-programmatic.html
@@ -0,0 +1,161 @@
+<!doctype html>
+<meta charset="utf-8">
+<title>Single-axis scroll containers with programmatic scroll APIs</title>
+<link rel="help" href="https://drafts.csswg.org/cssom-view/#dom-element-scrollto">
+<link rel="help" href="https://drafts.csswg.org/cssom-view/#dom-element-scrollby">
+<link rel="help" href="https://drafts.csswg.org/cssom-view/#dom-element-scrollwidth">
+<link rel="help" href="https://drafts.csswg.org/cssom-view/#dom-element-scrollheight">
+<link rel="help" href="https://github.com/w3c/csswg-drafts/issues/5572">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+
+<style>
+  .scroller {
+    width: 100px;
+    height: 100px;
+    scrollbar-width: none;
+  }
+  .clip-x {
+    overflow-x: clip;
+    overflow-y: scroll;
+  }
+  .clip-y {
+    overflow-x: scroll;
+    overflow-y: clip;
+  }
+  .rtl {
+    direction: rtl;
+  }
+  .content {
+    width: 300px;
+    height: 300px;
+  }
+</style>
+
+<!-- LTR scroller with clipped X -->
+<div class="scroller clip-x">
+  <div class="content"></div>
+</div>
+
+<!-- RTL scroller with clipped X -->
+<div class="scroller clip-x rtl">
+  <div class="content"></div>
+</div>
+
+<!-- LTR scroller with clipped Y -->
+<div class="scroller clip-y">
+  <div class="content"></div>
+</div>
+
+<!-- RTL scroller with clipped Y -->
+<div class="scroller clip-y rtl">
+  <div class="content"></div>
+</div>
+
+<script>
+function assertOverflowDimensions(scroller, label) {
+  assert_equals(scroller.scrollWidth, 300,
+      `${label}: scrollWidth retains overflowing content size`);
+  assert_equals(scroller.scrollHeight, 300,
+      `${label}: scrollHeight retains overflowing content size`);
+}
+
+test(() => {
+  const scroller = document.querySelector('.scroller.clip-x');
+
+  assert_equals(scroller.scrollLeft, 0,
+      'LTR clipped X: scrollLeft is set to default value of 0');
+
+  scroller.scrollTo(40, 50);
+  assert_equals(scroller.scrollLeft, 0,
+      'LTR clipped X: scrollTo ignores the clipped X-axis');
+  assert_equals(scroller.scrollTop, 50,
+      'LTR clipped X: scrollTo updates the unclipped Y-axis');
+
+  scroller.scrollBy(20, 20);
+  assert_equals(scroller.scrollLeft, 0,
+      'LTR clipped X: scrollBy ignores the clipped X-axis');
+  assert_equals(scroller.scrollTop, 70,
+      'LTR clipped X: scrollBy incrementally updates the unclipped Y-axis (50 + 20 = 70)');
+
+  scroller.scrollLeft = 70;
+  assert_equals(scroller.scrollLeft, 0,
+      'LTR clipped X: setting scrollLeft ignores the clipped X-axis');
+  assert_equals(scroller.scrollTop, 70,
+      'LTR clipped X: setting scrollLeft leaves the unclipped Y-axis unchanged');
+
+  assertOverflowDimensions(scroller, 'LTR clipped X');
+}, 'LTR clipped X');
+
+test(() => {
+  const scroller = document.querySelector('.scroller.clip-x.rtl');
+
+  scroller.scrollTo(-40, 50);
+  assert_equals(scroller.scrollLeft, 0,
+      'RTL clipped X: scrollTo ignores the clipped X-axis (negative in RTL)');
+  assert_equals(scroller.scrollTop, 50,
+      'RTL clipped X: scrollTo updates the unclipped Y-axis');
+
+  scroller.scrollBy(-20, 20);
+  assert_equals(scroller.scrollLeft, 0,
+      'RTL clipped X: scrollBy ignores the clipped X-axis');
+  assert_equals(scroller.scrollTop, 70,
+      'RTL clipped X: scrollBy incrementally updates the unclipped Y-axis (50 + 20 = 70)');
+
+  scroller.scrollLeft = -70;
+  assert_equals(scroller.scrollLeft, 0,
+      'RTL clipped X: setting scrollLeft ignores the clipped X-axis');
+  assert_equals(scroller.scrollTop, 70,
+      'RTL clipped X: setting scrollLeft leaves the unclipped Y-axis unchanged');
+
+  assertOverflowDimensions(scroller, 'RTL clipped X');
+}, 'RTL clipped X');
+
+test(() => {
+  const scroller = document.querySelector('.scroller.clip-y');
+
+  scroller.scrollTo(40, 50);
+  assert_equals(scroller.scrollLeft, 40,
+      'LTR clipped Y: scrollTo updates the unclipped X-axis');
+  assert_equals(scroller.scrollTop, 0,
+      'LTR clipped Y: scrollTo ignores the clipped Y-axis');
+
+  scroller.scrollBy(20, 20);
+  assert_equals(scroller.scrollLeft, 60,
+      'LTR clipped Y: scrollBy incrementally updates the unclipped X-axis (40 + 20 = 60)');
+  assert_equals(scroller.scrollTop, 0,
+      'LTR clipped Y: scrollBy ignores the clipped Y-axis');
+
+  scroller.scrollTop = 70;
+  assert_equals(scroller.scrollLeft, 60,
+      'LTR clipped Y: setting scrollTop leaves the unclipped X-axis unchanged');
+  assert_equals(scroller.scrollTop, 0,
+      'LTR clipped Y: setting scrollTop ignores the clipped Y-axis');
+
+  assertOverflowDimensions(scroller, 'LTR clipped Y');
+}, 'LTR clipped Y');
+
+test(() => {
+  const scroller = document.querySelector('.scroller.clip-y.rtl');
+
+  scroller.scrollTo(-40, 50);
+  assert_equals(scroller.scrollLeft, -40,
+      'RTL clipped Y: scrollTo updates the unclipped X-axis (negative in RTL)');
+  assert_equals(scroller.scrollTop, 0,
+      'RTL clipped Y: scrollTo ignores the clipped Y-axis');
+
+  scroller.scrollBy(-20, 20);
+  assert_equals(scroller.scrollLeft, -60,
+      'RTL clipped Y: scrollBy incrementally updates the unclipped X-axis (-40 + -20 = -60)');
+  assert_equals(scroller.scrollTop, 0,
+      'RTL clipped Y: scrollBy ignores the clipped Y-axis');
+
+  scroller.scrollTop = 70;
+  assert_equals(scroller.scrollLeft, -60,
+      'RTL clipped Y: setting scrollTop leaves the unclipped X-axis unchanged');
+  assert_equals(scroller.scrollTop, 0,
+      'RTL clipped Y: setting scrollTop ignores the clipped Y-axis');
+
+  assertOverflowDimensions(scroller, 'RTL clipped Y');
+}, 'RTL clipped Y');
+</script>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/single-axis-scroll-into-view-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/single-axis-scroll-into-view-expected.txt
new file mode 100644
index 000000000000..e9a21f7ff911
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/single-axis-scroll-into-view-expected.txt
@@ -0,0 +1,3 @@
+
+FAIL scrollIntoView() respects single-axis limits independently on each ancestor assert_equals: inner ignores the clipped vertical axis expected 0 but got 20
+
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/single-axis-scroll-into-view-rtl-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/single-axis-scroll-into-view-rtl-expected.txt
new file mode 100644
index 000000000000..48d36a180a1c
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/single-axis-scroll-into-view-rtl-expected.txt
@@ -0,0 +1,3 @@
+
+FAIL scrollIntoView() respects single-axis limits independently on each ancestor in RTL assert_equals: inner ignores the clipped vertical axis expected 0 but got 20
+
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/single-axis-scroll-into-view-rtl.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/single-axis-scroll-into-view-rtl.html
new file mode 100644
index 000000000000..56cfe21c3350
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/single-axis-scroll-into-view-rtl.html
@@ -0,0 +1,77 @@
+<!doctype html>
+<meta charset="utf-8">
+<title>Single-axis scroll containers with scrollIntoView (RTL)</title>
+<link rel="help" href="https://drafts.csswg.org/cssom-view/#dom-element-scrollintoview">
+<link rel="help" href="https://github.com/w3c/csswg-drafts/issues/12289">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+
+<style>
+  #outer {
+    width: 100px;
+    height: 100px;
+    overflow-x: clip;
+    overflow-y: scroll;
+    scrollbar-width: none;
+  }
+  #inner {
+    width: 100px;
+    height: 100px;
+    direction: rtl;
+    overflow-x: scroll;
+    overflow-y: clip;
+    scrollbar-width: none;
+  }
+  .inner-spacer {
+    height: 220px;
+  }
+  .spacer {
+    height: 100px;
+  }
+  #target {
+    width: 100px;
+    height: 60px;
+    /* In RTL, margin-right pushes the target to the visual left while keeping
+       it within inner's clipped block axis. The trailing spacer keeps #inner
+       vertically scrollable, so this test fails if the clipped axis is
+       scrolled instead of propagating the block-axis alignment to #outer. */
+    margin-right: 200px;
+    margin-top: 20px;
+  }
+</style>
+
+<div id="outer">
+  <!-- Spacer pushes #inner down, creating 300px of scrollable height inside #outer -->
+  <div class="spacer"></div>
+  <div id="inner">
+    <div id="target"></div>
+    <div class="inner-spacer"></div>
+  </div>
+  <div class="spacer"></div>
+</div>
+
+<script>
+test(() => {
+  const outer = document.querySelector('#outer');
+  const inner = outer.querySelector('#inner');
+  const target = outer.querySelector('#target');
+
+  // Attempt to scroll the target to the top-start (top-right in RTL) of the viewing area
+  target.scrollIntoView({block: 'start', inline: 'start', behavior: 'instant'});
+
+  // Check inner container (RTL, scrolls X, clips Y)
+  // Target is pushed 200px to the left, so inner must scroll -200px horizontally.
+  assert_equals(inner.scrollLeft, -200, 'inner scrolls horizontally to the target (negative in RTL)');
+  assert_equals(inner.scrollTop, 0, 'inner ignores the clipped vertical axis');
+  assert_equals(inner.scrollWidth, 300, 'inner scrollWidth retains overflowing content');
+  assert_equals(inner.scrollHeight, 300, 'inner scrollHeight retains overflowing content');
+
+  // Check outer container (LTR, clips X, scrolls Y)
+  // The target sits 20px below the top of #inner, so #outer must scroll the
+  // remaining 120px vertically when #inner cannot scroll the clipped axis.
+  assert_equals(outer.scrollLeft, 0, 'outer ignores the clipped horizontal axis');
+  assert_equals(outer.scrollTop, 120, 'outer scrolls vertically to the target');
+  assert_equals(outer.scrollWidth, 100, 'outer scrollWidth naturally fits client width');
+  assert_equals(outer.scrollHeight, 300, 'outer scrollHeight retains overflowing content');
+}, 'scrollIntoView() respects single-axis limits independently on each ancestor in RTL');
+</script>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/single-axis-scroll-into-view.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/single-axis-scroll-into-view.html
new file mode 100644
index 000000000000..aba04f8fe9b2
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/single-axis-scroll-into-view.html
@@ -0,0 +1,76 @@
+<!doctype html>
+<meta charset="utf-8">
+<title>Single-axis scroll containers with scrollIntoView</title>
+<link rel="help" href="https://drafts.csswg.org/cssom-view/#dom-element-scrollintoview">
+<link rel="help" href="https://github.com/w3c/csswg-drafts/issues/12289">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+
+<style>
+  #outer {
+    width: 100px;
+    height: 100px;
+    overflow-x: clip;
+    overflow-y: scroll;
+    scrollbar-width: none;
+  }
+  #inner {
+    width: 100px;
+    height: 100px;
+    overflow-x: scroll;
+    overflow-y: clip;
+    scrollbar-width: none;
+  }
+  .inner-spacer {
+    height: 220px;
+  }
+  .spacer {
+    height: 100px;
+  }
+  #target {
+    width: 100px;
+    height: 60px;
+    /* Pushes target to the right while keeping it within inner's clipped block
+       axis. The trailing spacer keeps #inner vertically scrollable, so this
+       test fails if the clipped axis is scrolled instead of propagating the
+       block-axis alignment to #outer. */
+    margin-left: 200px;
+    margin-top: 20px;
+  }
+</style>
+
+<div id="outer">
+  <!-- Spacer pushes #inner down, creating 300px of scrollable height inside #outer -->
+  <div class="spacer"></div>
+  <div id="inner">
+    <div id="target"></div>
+    <div class="inner-spacer"></div>
+  </div>
+  <div class="spacer"></div>
+</div>
+
+<script>
+test(() => {
+  const outer = document.querySelector('#outer');
+  const inner = outer.querySelector('#inner');
+  const target = outer.querySelector('#target');
+
+  // Attempt to scroll the target to the top-left of the viewing area
+  target.scrollIntoView({block: 'start', inline: 'start', behavior: 'instant'});
+
+  // Check inner container (scrolls X, clips Y)
+  // Target is pushed 200px right, so inner should scroll exactly 200px horizontally.
+  assert_equals(inner.scrollLeft, 200, 'inner scrolls horizontally to the target');
+  assert_equals(inner.scrollTop, 0, 'inner ignores the clipped vertical axis');
+  assert_equals(inner.scrollWidth, 300, 'inner scrollWidth retains overflowing content');
+  assert_equals(inner.scrollHeight, 300, 'inner scrollHeight retains overflowing content');
+
+  // Check outer container (clips X, scrolls Y)
+  // The target sits 20px below the top of #inner, so #outer must scroll the
+  // remaining 120px vertically when #inner cannot scroll the clipped axis.
+  assert_equals(outer.scrollLeft, 0, 'outer ignores the clipped horizontal axis');
+  assert_equals(outer.scrollTop, 120, 'outer scrolls vertically to the target');
+  assert_equals(outer.scrollWidth, 100, 'outer scrollWidth naturally fits client width');
+  assert_equals(outer.scrollHeight, 300, 'outer scrollHeight retains overflowing content');
+}, 'scrollIntoView() respects single-axis limits independently on each ancestor');
+</script>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-001-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-001-expected.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-001-expected.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-001-expected.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-001.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-001.html
similarity index 88%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-001.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-001.html
index ae9029933a6a..2fdcf8233e8a 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-001.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-001.html
@@ -3,7 +3,7 @@
 <title>CSS Basic User Interface Test: text-overflow - clip - the text inline content overflows will be broken</title>
 <link rel="author" title="Intel" href="http://www.intel.com/">
 <link rel="author" title="Shiyou Tan" href="mailto:shiyoux.tan@intel.com">
-<link rel="help" title="8.2. Overflow Ellipsis: the 'text-overflow' property" href="http://www.w3.org/TR/css3-ui/#text-overflow">
+<link rel="help" href="https://drafts.csswg.org/css-overflow/#text-overflow">
 <link rel="match" href="reference/text-overflow-001-ref.html">
 <meta name="assert" content="Test checks that the inline content that overflows will be clipped. Characters may be only partially rendered when
 text-overflow set clip">
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-002-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-002-expected.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-002-expected.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-002-expected.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-002.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-002.html
similarity index 88%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-002.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-002.html
index d8a95299d29d..717c508eb019 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-002.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-002.html
@@ -3,7 +3,7 @@
 <title>CSS Basic User Interface Test: text-overflow - ellipsis - the broken textual content instead of ellipsis</title>
 <link rel="author" title="Intel" href="http://www.intel.com/">
 <link rel="author" title="Shiyou Tan" href="mailto:shiyoux.tan@intel.com">
-<link rel="help" title="8.2. Overflow Ellipsis: the 'text-overflow' property" href="http://www.w3.org/TR/css3-ui/#text-overflow">
+<link rel="help" href="https://drafts.csswg.org/css-overflow/#text-overflow">
 <link rel="match" href="reference/text-overflow-002-ref.html">
 <meta name="assert" content="Test checks that an ellipsis (...) is shown instead of overflowing textual content">
 <link rel="stylesheet" type="text/css" href="/fonts/ahem.css" />
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-003-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-003-expected.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-003-expected.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-003-expected.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-003.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-003.html
similarity index 88%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-003.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-003.html
index ea958ef35b15..8c7ea45fad13 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-003.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-003.html
@@ -3,7 +3,7 @@
 <title>CSS Basic User Interface Test: text-overflow - inherit - inherit clip value of parent's text-overflow property</title>
 <link rel="author" title="Intel" href="http://www.intel.com/">
 <link rel="author" title="Shiyou Tan" href="mailto:shiyoux.tan@intel.com">
-<link rel="help" title="8.2. Overflow Ellipsis: the 'text-overflow' property" href="http://www.w3.org/TR/css3-ui/#text-overflow">
+<link rel="help" href="https://drafts.csswg.org/css-overflow/#text-overflow">
 <link rel="match" href="reference/text-overflow-001-ref.html">
 <meta name="assert" content="Test checks that text-overflow inherits the parent' clip value when text-overflow set inherit">
 <link rel="stylesheet" type="text/css" href="/fonts/ahem.css" />
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-004-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-004-expected.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-004-expected.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-004-expected.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-004.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-004.html
similarity index 89%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-004.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-004.html
index 1cc11e82573a..760fd685c20b 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-004.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-004.html
@@ -3,7 +3,7 @@
 <title>CSS Basic User Interface Test: text-overflow - inherit - inherit ellipsis value of parent's text-overflow property</title>
 <link rel="author" title="Intel" href="http://www.intel.com/">
 <link rel="author" title="Shiyou Tan" href="mailto:shiyoux.tan@intel.com">
-<link rel="help" title="8.2. Overflow Ellipsis: the 'text-overflow' property" href="http://www.w3.org/TR/css3-ui/#text-overflow">
+<link rel="help" href="https://drafts.csswg.org/css-overflow/#text-overflow">
 <link rel="match" href="reference/text-overflow-002-ref.html">
 <meta name="assert" content="Test checks that text-overflow inherits the parent' ellipsis value when text-overflow set inherit">
 <link rel="stylesheet" type="text/css" href="/fonts/ahem.css" />
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-005-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-005-expected.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-005-expected.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-005-expected.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-005.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-005.html
similarity index 86%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-005.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-005.html
index b7ced3673dce..72d29577e1da 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-005.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-005.html
@@ -4,7 +4,7 @@
 <title>CSS-UI test: text-overflow reflow</title>
 <meta name="assert" content="Text overflow should disappear when the container becomes large enough. This test is targetted at bug #14952 in Servo's incremental reflow engine.">
 <link rel="author" title="Michael Howell" href="mailto:michael@notriddle.com">
-<link rel="help" title="8.2. Overflow Ellipsis: the 'text-overflow' property" href="http://www.w3.org/TR/css3-ui/#text-overflow">
+<link rel="help" href="https://drafts.csswg.org/css-overflow/#text-overflow">
 <link rel="match" href="reference/text-overflow-005-ref.html">
 <meta name="flags" content="ahem">
 <link rel="stylesheet" type="text/css" href="/fonts/ahem.css" />
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-006-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-006-expected.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-006-expected.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-006-expected.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-006.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-006.html
similarity index 93%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-006.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-006.html
index 8fd149a98db0..238a17be2ae1 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-006.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-006.html
@@ -2,7 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Basic User Interface Test: text-overflow applied at edge of block container</title>
 <link rel="author" title="Florian Rivoal" href="http://florian.rivoal.net/">
-<link rel="help" href="http://www.w3.org/TR/css3-ui/#text-overflow">
+<link rel="help" href="https://drafts.csswg.org/css-overflow/#text-overflow">
 <link rel="match" href="reference/text-overflow-006-ref.html">
 <meta name="assert" content="Checks that the elipsis is applied at the edge of the line box, not the end of the block container, when these are different.">
 <style>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-007-expected.xht b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-007-expected.xht
new file mode 100644
index 000000000000..05a13794482a
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-007-expected.xht
@@ -0,0 +1,19 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+ <head>
+  <title>CSS Reftest Reference</title>
+  <link rel="author" title="Gérard Talbot" href="http://www.gtalbot.org/BrowserBugsSection/css21testsuite/" />
+  <style type="text/css"><![CDATA[
+  div
+  {
+  background-color: green;
+  height: 100px;
+  width: 100px;
+  }
+  ]]></style>
+ </head>
+ <body>
+  <p>Test passes if there is a filled green square and <strong>no red</strong>.</p>
+  <div></div>
+ </body>
+</html>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-007.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-007.html
similarity index 95%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-007.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-007.html
index 795dae40fa4a..5b14dd334b99 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-007.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-007.html
@@ -2,7 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Basic User Interface Test: ellipsis adjacent to remaining content</title>
 <link rel="author" title="Florian Rivoal" href="http://florian.rivoal.net/">
-<link rel="help" href="http://www.w3.org/TR/css3-ui/#text-overflow">
+<link rel="help" href="https://drafts.csswg.org/css-overflow/#text-overflow">
 <link rel="match" href="../reference/ref-filled-green-100px-square.xht">
 <meta name="flags" content="ahem">
 <meta name="assert" content="The ellipsis is placed immediately adjacent to the end edge of the remaining inline content, with no intervening gap.">
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-008-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-008-expected.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-008-expected.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-008-expected.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-008.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-008.html
similarity index 71%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-008.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-008.html
index e4dbd761a05d..2128179174f2 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-008.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-008.html
@@ -2,13 +2,13 @@
 <meta charset="utf-8">
 <title>CSS Basic User Interface Test: ellipsis and first character</title>
 <link rel="author" title="Florian Rivoal" href="http://florian.rivoal.net/">
-<link rel="help" href="http://www.w3.org/TR/css3-ui/#text-overflow">
+<link rel="help" href="https://drafts.csswg.org/css-overflow/#text-overflow">
 <link rel="match" href="reference/text-overflow-008-ref.html">
 <meta name="flags" content="ahem">
 <meta name="assert" content="The first character on a line must be clipped rather than ellipsed.">
 <!--
-	If the ellipsis character appears, it will be red (as it is styled after the block), and the test will fail.
-	If the first character is omitted rather than clipped, there will be no box at all, and the test will fail.
+  If the ellipsis character appears, it will be red (as it is styled after the block), and the test will fail.
+  If the first character is omitted rather than clipped, there will be no box at all, and the test will fail.
 -->
 <link rel="stylesheet" type="text/css" href="/fonts/ahem.css" />
 <style>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-009-expected.xht b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-009-expected.xht
new file mode 100644
index 000000000000..05a13794482a
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-009-expected.xht
@@ -0,0 +1,19 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+ <head>
+  <title>CSS Reftest Reference</title>
+  <link rel="author" title="Gérard Talbot" href="http://www.gtalbot.org/BrowserBugsSection/css21testsuite/" />
+  <style type="text/css"><![CDATA[
+  div
+  {
+  background-color: green;
+  height: 100px;
+  width: 100px;
+  }
+  ]]></style>
+ </head>
+ <body>
+  <p>Test passes if there is a filled green square and <strong>no red</strong>.</p>
+  <div></div>
+ </body>
+</html>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-009.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-009.html
similarity index 90%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-009.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-009.html
index 384f82051199..d8ea68f38368 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-009.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-009.html
@@ -2,7 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Basic User Interface Test: ellipsis and first atomic inline</title>
 <link rel="author" title="Florian Rivoal" href="http://florian.rivoal.net/">
-<link rel="help" href="http://www.w3.org/TR/css3-ui/#text-overflow">
+<link rel="help" href="https://drafts.csswg.org/css-overflow/#text-overflow">
 <link rel="match" href="../reference/ref-filled-green-100px-square.xht">
 <meta name="assert" content="The first atomic inline on a line must be clipped rather than ellipsed.">
 <style>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-010-expected.xht b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-010-expected.xht
new file mode 100644
index 000000000000..05a13794482a
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-010-expected.xht
@@ -0,0 +1,19 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+ <head>
+  <title>CSS Reftest Reference</title>
+  <link rel="author" title="Gérard Talbot" href="http://www.gtalbot.org/BrowserBugsSection/css21testsuite/" />
+  <style type="text/css"><![CDATA[
+  div
+  {
+  background-color: green;
+  height: 100px;
+  width: 100px;
+  }
+  ]]></style>
+ </head>
+ <body>
+  <p>Test passes if there is a filled green square and <strong>no red</strong>.</p>
+  <div></div>
+ </body>
+</html>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-010.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-010.html
similarity index 94%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-010.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-010.html
index aec768cb6979..687d20cef9fc 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-010.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-010.html
@@ -2,7 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Basic User Interface Test: ellipsis hides atomic inlines and chars at end of line</title>
 <link rel="author" title="Florian Rivoal" href="http://florian.rivoal.net/">
-<link rel="help" href="http://www.w3.org/TR/css3-ui/#text-overflow">
+<link rel="help" href="https://drafts.csswg.org/css-overflow/#text-overflow">
 <link rel="match" href="../reference/ref-filled-green-100px-square.xht">
 <meta name="flags" content="ahem">
 <meta name="assert" content="Implementations must hide atomic inlines and characters at the end of the line to make room for the ellipsis">
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-011-expected.xht b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-011-expected.xht
new file mode 100644
index 000000000000..05a13794482a
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-011-expected.xht
@@ -0,0 +1,19 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+ <head>
+  <title>CSS Reftest Reference</title>
+  <link rel="author" title="Gérard Talbot" href="http://www.gtalbot.org/BrowserBugsSection/css21testsuite/" />
+  <style type="text/css"><![CDATA[
+  div
+  {
+  background-color: green;
+  height: 100px;
+  width: 100px;
+  }
+  ]]></style>
+ </head>
+ <body>
+  <p>Test passes if there is a filled green square and <strong>no red</strong>.</p>
+  <div></div>
+ </body>
+</html>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-011.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-011.html
similarity index 93%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-011.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-011.html
index 0fe96e65193b..6392a51a412d 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-011.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-011.html
@@ -2,7 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Basic User Interface Test: ellipsis hides end of line</title>
 <link rel="author" title="Florian Rivoal" href="http://florian.rivoal.net/">
-<link rel="help" href="http://www.w3.org/TR/css3-ui/#text-overflow">
+<link rel="help" href="https://drafts.csswg.org/css-overflow/#text-overflow">
 <link rel="match" href="../reference/ref-filled-green-100px-square.xht">
 <meta name="flags" content="ahem">
 <meta name="assert" content="Implementations must hide at the *end* (not right) of the line to make room for the ellipsis">
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-012-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-012-expected.html
similarity index 95%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-012-expected.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-012-expected.html
index 700f9c896fe9..707f93d79c49 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-012-expected.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-012-expected.html
@@ -9,7 +9,7 @@
   color: green;
 }
 span {
-	color: white;
+  color: white;
 }
 </style>
 
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-012.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-012.html
similarity index 95%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-012.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-012.html
index a75908026aa3..15e31deda7d6 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-012.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-012.html
@@ -3,7 +3,7 @@
 <meta charset="utf-8">
 <title>CSS Basic User Interface Test: ellipsis and extended grapheme cluster</title>
 <link rel="author" title="Florian Rivoal" href="http://florian.rivoal.net/">
-<link rel="help" href="http://www.w3.org/TR/css3-ui/#text-overflow">
+<link rel="help" href="https://drafts.csswg.org/css-overflow/#text-overflow">
 <link rel="match" href="reference/text-overflow-012-ref.html">
 <meta name="flags" content="should">
 <!-- This is SHOULD because although CSS-UI defines "character" as "grapheme cluster" in a non optional manner
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-013-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-013-expected.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-013-expected.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-013-expected.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-013.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-013.html
similarity index 95%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-013.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-013.html
index 20c9a5c5ae10..bf2223e8407b 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-013.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-013.html
@@ -2,7 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Basic User Interface Test: ellipsis and baseline alignement</title>
 <link rel="author" title="Florian Rivoal" href="http://florian.rivoal.net/">
-<link rel="help" href="http://www.w3.org/TR/css3-ui/#ellipsing-details">
+<link rel="help" href="https://drafts.csswg.org/css-overflow/#ellipsing-details">
 <link rel="match" href="reference/text-overflow-013-ref.html">
 <meta name="flags" content="ahem">
 <meta name="assert" content="The ellipsis is be baseline aligned with the block, even if the thing it replaces isn't.">
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-014-expected.xht b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-014-expected.xht
new file mode 100644
index 000000000000..05a13794482a
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-014-expected.xht
@@ -0,0 +1,19 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+ <head>
+  <title>CSS Reftest Reference</title>
+  <link rel="author" title="Gérard Talbot" href="http://www.gtalbot.org/BrowserBugsSection/css21testsuite/" />
+  <style type="text/css"><![CDATA[
+  div
+  {
+  background-color: green;
+  height: 100px;
+  width: 100px;
+  }
+  ]]></style>
+ </head>
+ <body>
+  <p>Test passes if there is a filled green square and <strong>no red</strong>.</p>
+  <div></div>
+ </body>
+</html>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-014.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-014.html
similarity index 93%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-014.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-014.html
index 0fe5063a342f..f5ca35172c97 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-014.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-014.html
@@ -2,7 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Basic User Interface Test: styling the ellipsis</title>
 <link rel="author" title="Florian Rivoal" href="http://florian.rivoal.net/">
-<link rel="help" href="http://www.w3.org/TR/css3-ui/#ellipsing-details">
+<link rel="help" href="https://drafts.csswg.org/css-overflow/#ellipsing-details">
 <link rel="match" href="../reference/ref-filled-green-100px-square.xht">
 <meta name="flags" content="ahem">
 <meta name="assert" content="The ellipsis' font family, font size, and color are styled according to the block.">
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-015-expected.xht b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-015-expected.xht
new file mode 100644
index 000000000000..05a13794482a
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-015-expected.xht
@@ -0,0 +1,19 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+ <head>
+  <title>CSS Reftest Reference</title>
+  <link rel="author" title="Gérard Talbot" href="http://www.gtalbot.org/BrowserBugsSection/css21testsuite/" />
+  <style type="text/css"><![CDATA[
+  div
+  {
+  background-color: green;
+  height: 100px;
+  width: 100px;
+  }
+  ]]></style>
+ </head>
+ <body>
+  <p>Test passes if there is a filled green square and <strong>no red</strong>.</p>
+  <div></div>
+ </body>
+</html>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-015.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-015.html
similarity index 91%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-015.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-015.html
index 3899fc6a1e2a..6c55266ba0bd 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-015.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-015.html
@@ -2,7 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Basic User Interface Test: ellipsis after graphical transformations</title>
 <link rel="author" title="Florian Rivoal" href="http://florian.rivoal.net/">
-<link rel="help" href="http://www.w3.org/TR/css3-ui/#ellipsing-details">
+<link rel="help" href="https://drafts.csswg.org/css-overflow/#ellipsing-details">
 <link rel="match" href="../reference/ref-filled-green-100px-square.xht">
 <meta name="flags" content="ahem">
 <meta name="assert" content="Ellipsing occurs after relative positioning">
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-016-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-016-expected.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-016-expected.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-016-expected.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-016.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-016.html
similarity index 94%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-016.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-016.html
index d66b64d58a81..86798f4822bd 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-016.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-016.html
@@ -2,7 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Basic User Interface Test: clipping the ellipsis</title>
 <link rel="author" title="Florian Rivoal" href="http://florian.rivoal.net/">
-<link rel="help" href="http://www.w3.org/TR/css3-ui/#ellipsing-details">
+<link rel="help" href="https://drafts.csswg.org/css-overflow/#ellipsing-details">
 <link rel="match" href="reference/text-overflow-016-ref.html">
 <meta name="flags" content="ahem">
 <meta name="assert" content="If there is insufficient space for the ellipsis, then clip the rendering of the ellipsis itself">
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-017-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-017-expected.txt
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-017-expected.txt
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-017-expected.txt
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-017.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-017.html
similarity index 93%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-017.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-017.html
index 7f61a57620c1..a605cbc162dd 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-017.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-017.html
@@ -3,7 +3,7 @@
 <meta charset="utf-8">
 <title>CSS Basic User Interface Test: interacting with the ellipsis</title>
 <link rel="author" title="Florian Rivoal" href="http://florian.rivoal.net/">
-<link rel="help" href="http://www.w3.org/TR/css3-ui/#text-overflow">
+<link rel="help" href="https://drafts.csswg.org/css-overflow/#text-overflow">
 <script src="/resources/testharness.js"></script>
 <script src="/resources/testharnessreport.js"></script>
 <script src="/resources/testdriver.js"></script>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-020-expected.xht b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-020-expected.xht
new file mode 100644
index 000000000000..05a13794482a
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-020-expected.xht
@@ -0,0 +1,19 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+ <head>
+  <title>CSS Reftest Reference</title>
+  <link rel="author" title="Gérard Talbot" href="http://www.gtalbot.org/BrowserBugsSection/css21testsuite/" />
+  <style type="text/css"><![CDATA[
+  div
+  {
+  background-color: green;
+  height: 100px;
+  width: 100px;
+  }
+  ]]></style>
+ </head>
+ <body>
+  <p>Test passes if there is a filled green square and <strong>no red</strong>.</p>
+  <div></div>
+ </body>
+</html>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-020.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-020.html
similarity index 90%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-020.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-020.html
index 73f2b88e89d3..734f79083506 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-020.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-020.html
@@ -2,7 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Basic User Interface Test: no ellipsing when nesting</title>
 <link rel="author" title="Florian Rivoal" href="http://florian.rivoal.net/">
-<link rel="help" href="http://www.w3.org/TR/css3-ui/#text-overflow">
+<link rel="help" href="https://drafts.csswg.org/css-overflow/#text-overflow">
 <link rel="match" href="../reference/ref-filled-green-100px-square.xht">
 <meta name="flags" content="ahem">
 <meta name="assert" content="Nested paragraph won’t ellipse.">
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-021-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-021-expected.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-021-expected.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-021-expected.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-021.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-021.html
similarity index 92%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-021.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-021.html
index 8057ffc78762..47cd3f1c6065 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-021.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-021.html
@@ -3,7 +3,7 @@
 <meta charset="utf-8">
 <title>CSS Basic User Interface Test: ellipsis, revealing more text</title>
 <link rel="author" title="Florian Rivoal" href="http://florian.rivoal.net/">
-<link rel="help" href="http://www.w3.org/TR/css3-ui/#ellipsis-scrolling">
+<link rel="help" href="https://drafts.csswg.org/css-overflow/#ellipsis-scrolling">
 <link rel="match" href="reference/text-overflow-021-ref.html">
 <meta name="flags" content="dom should">
 <meta name="assert" content="When an element with ellipsis is scrolled, more content should be revealed, until the element is scrolled far enough to display the edge of the content at which point that content should be displayed rather than an ellipsis.">
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-022-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-022-expected.html
similarity index 93%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-022-expected.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-022-expected.html
index db7d08f45045..31501b868471 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-022-expected.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-022-expected.html
@@ -9,7 +9,7 @@
   color: green;
 }
 span {
-	color: transparent;
+  color: transparent;
 }
 </style>
 
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-022.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-022.html
similarity index 94%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-022.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-022.html
index e1ada9d479da..a5850cb16bee 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-022.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-022.html
@@ -3,7 +3,7 @@
 <meta charset="utf-8">
 <title>CSS Basic User Interface Test: ellipsis and legacy grapheme cluster</title>
 <link rel="author" title="Florian Rivoal" href="http://florian.rivoal.net/">
-<link rel="help" href="http://www.w3.org/TR/css3-ui/#text-overflow">
+<link rel="help" href="https://drafts.csswg.org/css-overflow/#text-overflow">
 <link rel="match" href="reference/text-overflow-022-ref.html">
 <meta name="assert" content="Implementations must hide characters, i.e. entire garpheme clusters, not part of them, to make room for the ellipsis">
 <style>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-023-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-023-expected.txt
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-023-expected.txt
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-023-expected.txt
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-023.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-023.html
similarity index 95%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-023.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-023.html
index b9c21ed8f22e..654ecf3a0e93 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-023.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-023.html
@@ -3,7 +3,7 @@
 <meta charset="utf-8">
 <title>CSS Basic User Interface Test: interacting with the ellipsis</title>
 <link rel="author" title="Florian Rivoal" href="http://florian.rivoal.net/">
-<link rel="help" href="http://www.w3.org/TR/css3-ui/#text-overflow">
+<link rel="help" href="https://drafts.csswg.org/css-overflow/#text-overflow">
 <meta name="flags" content="ahem dom should">
 <meta name="assert" content="Pointer events on the ellipsis should be dispatched to the elided inline element if there's one, rather than directly to the block.">
 <!-- This is tested indirectly, using elementFromPoint instead of actually triggering a pointer event, because:
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-024-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-024-expected.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-024-expected.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-024-expected.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-024-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-024-ref.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-024-ref.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-024-ref.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-024.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-024.html
similarity index 87%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-024.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-024.html
index 0ca5b428cb4d..47171656979b 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-024.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-024.html
@@ -7,7 +7,7 @@
   <meta charset="utf-8">
   <title>Test: text-overflow on tr::before with overflow:hidden</title>
   <link rel="author" title="Boris Zbarsky" href="mailto:bzbarsky@mit.edu">
-  <link rel="help" href="https://www.w3.org/TR/css3-ui/#text-overflow" title="5.2. the 'text-overflow' property">
+  <link rel="help" href="https://drafts.csswg.org/css-overflow/#text-overflow">
   <link rel="match" href="text-overflow-024-ref.html">
   <style type="text/css">
 
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-025-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-025-expected.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-025-expected.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-025-expected.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-025-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-025-ref.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-025-ref.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-025-ref.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-025.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-025.html
similarity index 87%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-025.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-025.html
index 3e0fce0afb0e..932babf0b07d 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-025.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-025.html
@@ -7,7 +7,7 @@
   <meta charset="utf-8">
   <title>Test: text-overflow on tr::before without overflow:hidden</title>
   <link rel="author" title="Boris Zbarsky" href="mailto:bzbarsky@mit.edu">
-  <link rel="help" href="https://www.w3.org/TR/css3-ui/#text-overflow" title="5.2. the 'text-overflow' property">
+  <link rel="help" href="https://drafts.csswg.org/css-overflow/#text-overflow">
   <link rel="match" href="text-overflow-025-ref.html">
   <style type="text/css">
 
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-026-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-026-expected.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-026-expected.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-026-expected.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-026-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-026-ref.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-026-ref.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-026-ref.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-026.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-026.html
similarity index 93%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-026.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-026.html
index 2d1aa57cc892..2d1ac3157c52 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-026.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-026.html
@@ -7,7 +7,7 @@
   <meta charset="utf-8">
   <title>Test: text-overflow with leading white-space</title>
   <link rel="author" title="Mats Palmgren" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1403986">
-  <link rel="help" href="https://www.w3.org/TR/css3-ui/#text-overflow" title="5.2. the 'text-overflow' property">
+  <link rel="help" href="https://drafts.csswg.org/css-overflow/#text-overflow">
   <link rel="match" href="text-overflow-026-ref.html">
   <style type="text/css">
 html,body {
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-027-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-027-expected.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-027-expected.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-027-expected.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-027.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-027.html
similarity index 83%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-027.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-027.html
index 6e7686c6c905..7664cf3dfdac 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-027.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-027.html
@@ -2,8 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Basic User Interface Test: text-overflow applies visually to bidi</title>
 <link rel="author" title="Florian Rivoal" href="http://florian.rivoal.net/">
-<link rel="help" href="http://www.w3.org/TR/css-ui-3/#text-overflow">
-<link rel="help" href="http://www.w3.org/TR/css-ui-4/#text-overflow">
+<link rel="help" href="https://drafts.csswg.org/css-overflow/#text-overflow">
 <link rel="match" href="reference/text-overflow-027-ref.html">
 <meta name="assert" content="text-overflow is a visual operation that occurs after layout, and therfore ellides text from the visual end of the line, even in bidi situations">
 <style>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-028-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-028-expected.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-028-expected.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-028-expected.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-028.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-028.html
similarity index 83%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-028.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-028.html
index 68b47cc18887..c444816063a7 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-028.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-028.html
@@ -2,8 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Basic User Interface Test: text-overflow applies visually to bidi</title>
 <link rel="author" title="Florian Rivoal" href="http://florian.rivoal.net/">
-<link rel="help" href="http://www.w3.org/TR/css-ui-3/#text-overflow">
-<link rel="help" href="http://www.w3.org/TR/css-ui-4/#text-overflow">
+<link rel="help" href="https://drafts.csswg.org/css-overflow/#text-overflow">
 <link rel="match" href="reference/text-overflow-028-ref.html">
 <meta name="assert" content="text-overflow is a visual operation that occurs after layout, and therfore ellides text from the visual end of the line, even in bidi situations">
 <style>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-029-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-029-expected.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-029-expected.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-029-expected.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-029.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-029.html
similarity index 84%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-029.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-029.html
index 07ba44712228..b84b01788fa7 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-029.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-029.html
@@ -3,8 +3,7 @@
 <meta charset="utf-8">
 <title>CSS Basic User Interface Test: text-overflow and bidi interaction</title>
 <link rel="author" title="Florian Rivoal" href="https://florian.rivoal.net/">
-<link rel="help" href="http://www.w3.org/TR/css-ui-3/#text-overflow">
-<link rel="help" href="http://www.w3.org/TR/css-ui-4/#text-overflow">
+<link rel="help" href="https://drafts.csswg.org/css-overflow/#text-overflow">
 <link rel="match" href="reference/text-overflow-029-ref.html">
 <meta name="assert" content="When there's content of mixed directionality, text-overflow ellides the characters at the physical end of the line.">
 <style>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-030-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-030-expected.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-030-expected.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-030-expected.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-030.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-030.html
similarity index 89%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-030.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-030.html
index 0ccd59c12a20..e5cb2252b40c 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-030.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-030.html
@@ -2,7 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Basic User Interface Test: ellipsis should render under other positioned content</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://www.w3.org/TR/css3-ui/#text-overflow">
+<link rel="help" href="https://drafts.csswg.org/css-overflow/#text-overflow">
 <link rel="match" href="reference/text-overflow-030-ref.html">
 <style>
 .positioned {
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-change-color-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-change-color-expected.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-change-color-expected.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-change-color-expected.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-change-color.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-change-color.html
similarity index 86%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-change-color.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-change-color.html
index 8982da5eb998..db9ddb9c5dc5 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-change-color.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-change-color.html
@@ -1,7 +1,7 @@
 <!DOCTYPE html>
 <title>Test ellipsis style</title>
 <link rel="match" href="reference/text-overflow-change-color-ref.html">
-<link rel="help" href="https://drafts.csswg.org/css-ui-3/#ellipsing-details">
+<link rel="help" href="https://drafts.csswg.org/css-overflow/#ellipsing-details">
 <link rel="author" href="kojii@chromium.org">
 <meta name="assert" content="Changing the color of the container should also change the color of ellipsis">
 <style>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-ellipsis-abspos-in-inline-block-crash-001-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-abspos-in-inline-block-crash-001-expected.txt
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-ellipsis-abspos-in-inline-block-crash-001-expected.txt
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-abspos-in-inline-block-crash-001-expected.txt
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-ellipsis-abspos-in-inline-block-crash-001.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-abspos-in-inline-block-crash-001.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-ellipsis-abspos-in-inline-block-crash-001.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-abspos-in-inline-block-crash-001.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-changing-scroll-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-changing-scroll-expected.html
new file mode 100644
index 000000000000..ef96c9eda8d6
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-changing-scroll-expected.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<title>CSS Test Reference</title>
+<style>
+  #overflow {
+    overflow: hidden;
+    text-overflow: ellipsis;
+    width: 100px;
+    border: 1px solid black;
+  }
+</style>
+<div id="overflow">ELLIPSISELLIPSIS</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-changing-scroll-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-changing-scroll-ref.html
new file mode 100644
index 000000000000..ef96c9eda8d6
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-changing-scroll-ref.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<title>CSS Test Reference</title>
+<style>
+  #overflow {
+    overflow: hidden;
+    text-overflow: ellipsis;
+    width: 100px;
+    border: 1px solid black;
+  }
+</style>
+<div id="overflow">ELLIPSISELLIPSIS</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-changing-scroll.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-changing-scroll.html
new file mode 100644
index 000000000000..e8da7f6065e7
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-changing-scroll.html
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<title>CSS Overflow: text-overflow: ellipsis after scroll changes</title>
+<link rel="help" href="https://drafts.csswg.org/css-overflow-4/#ellipsis-interaction">
+<link rel="match" href="text-overflow-ellipsis-changing-scroll-ref.html">
+<meta name="assert" content="Ellipsis rendering should not change after scroll offset is changed back to the original offset">
+<script src="/common/reftest-wait.js"></script>
+<style>
+  #overflow {
+    overflow: hidden;
+    text-overflow: ellipsis;
+    width: 100px;
+    border: 1px solid black;
+  }
+</style>
+<div id="overflow">ELLIPSISELLIPSIS</div>
+<script>
+  requestAnimationFrame(() => {
+    requestAnimationFrame(() => {
+      overflow.scrollLeft = 100;
+      overflow.style.fontSize = "17px";
+      overflow.offsetTop;
+      overflow.style.fontSize = "";
+      overflow.scrollLeft = 0;
+      takeScreenshot();
+    });
+  });
+</script>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-editable-div-with-caret-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-editable-div-with-caret-expected.html
new file mode 100644
index 000000000000..97e1ffdca126
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-editable-div-with-caret-expected.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Reference for text-overflow ellipsis in editable div with caret selection</title>
+<style>
+  #editable {
+    font: 20px/1;
+    width: 100px;
+    white-space: nowrap;
+    overflow: hidden;
+    text-overflow: clip;
+    margin: 10px;
+    outline: none;
+    caret-color: transparent;
+  }
+</style>
+<body contenteditable="true">
+<div contenteditable="true" id="editable">This is a very long text that should be clipped</div>
+</body>
+<script>
+  // Focus the editable div and place caret at the same position as test
+  const editableDiv = document.getElementById('editable');
+  editableDiv.focus();
+  const range = document.createRange();
+  range.setStart(editableDiv.firstChild, 10);
+  range.setEnd(editableDiv.firstChild, 10);
+  const selection = window.getSelection();
+  selection.removeAllRanges();
+  selection.addRange(range);
+</script>
\ No newline at end of file
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-editable-div-with-caret.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-editable-div-with-caret.html
new file mode 100644
index 000000000000..6740a6113a46
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-editable-div-with-caret.html
@@ -0,0 +1,32 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Overflow: text-overflow ellipsis in editable div with caret selection</title>
+<link rel="help" href="https://drafts.csswg.org/css-overflow/#ellipsis-interaction">
+<link rel="match" href="reference/text-overflow-ellipsis-editable-div-with-caret-ref.html">
+<meta name="assert" content="Check that text-overflow ellipsis behavior changes when caret selection is present in editable div.">
+<style>
+  #editable {
+    font: 20px/1;
+    width: 100px;
+    white-space: nowrap;
+    overflow: hidden;
+    text-overflow: ellipsis;
+    margin: 10px;
+    outline: none;
+    caret-color: transparent;
+  }
+</style>
+<body contenteditable="true">
+<div contenteditable="true" id="editable">This is a very long text that should be clipped</div>
+</body>
+<script>
+  // Focus the editable div and place caret.
+  const editableDiv = document.getElementById('editable');
+  editableDiv.focus();
+  const range = document.createRange();
+  range.setStart(editableDiv.firstChild, 10);
+  range.setEnd(editableDiv.firstChild, 10);
+  const selection = window.getSelection();
+  selection.removeAllRanges();
+  selection.addRange(range);
+</script>
\ No newline at end of file
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-ellipsis-hyphen-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-hyphen-expected.txt
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-ellipsis-hyphen-expected.txt
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-hyphen-expected.txt
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-ellipsis-hyphen.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-hyphen.html
similarity index 83%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-ellipsis-hyphen.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-hyphen.html
index eb6f5d443e71..3b66d716a819 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-ellipsis-hyphen.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-hyphen.html
@@ -1,7 +1,7 @@
 <!DOCTYPE html>
 <title>Ellipsizing hyphens should not crash</title>
 <link rel="author" href="kojii@chromium.org">
-<link rel="help" href="https://drafts.csswg.org/css-ui-3/#ellipsing-details">
+<link rel="help" href="https://drafts.csswg.org/css-overflow/#ellipsing-details">
 <script src="/resources/testharness.js"></script>
 <script src="/resources/testharnessreport.js"></script>
 <style>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-ellipsis-indent-001-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-indent-001-expected.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-ellipsis-indent-001-expected.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-indent-001-expected.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-ellipsis-indent-001.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-indent-001.html
similarity index 87%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-ellipsis-indent-001.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-indent-001.html
index 6f5c81bc1e09..c090732091f1 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-ellipsis-indent-001.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-indent-001.html
@@ -1,7 +1,7 @@
 <!DOCTYPE html>
 <title>Test ellipsis with `text-indent`</title>
 <link rel="match" href="reference/text-overflow-ellipsis-indent-001-ref.html">
-<link rel="help" href="https://drafts.csswg.org/css-ui-3/#ellipsing-details">
+<link rel="help" href="https://drafts.csswg.org/css-overflow/#ellipsing-details">
 <link rel="author" href="mailto:kojii@chromium.org">
 <style>
 div {
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-ellipsis-multiline-001-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-multiline-001-expected.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-ellipsis-multiline-001-expected.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-multiline-001-expected.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-ellipsis-multiline-001.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-multiline-001.html
similarity index 79%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-ellipsis-multiline-001.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-multiline-001.html
index 5987817a5c98..aee61bfbb40a 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-ellipsis-multiline-001.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-multiline-001.html
@@ -1,7 +1,7 @@
 <!DOCTYPE html>
 <title>Test multiline ellipsis with `::first-line`</title>
 <link rel="match" href="reference/text-overflow-ellipsis-multiline-001-ref.html">
-<link rel="help" href="https://drafts.csswg.org/css-ui-3/#ellipsing-details">
+<link rel="help" href="https://drafts.csswg.org/css-overflow/#ellipsing-details">
 <style>
 div {
   width: 6ch;
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-ellipsis-self-painting-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-self-painting-expected.txt
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-ellipsis-self-painting-expected.txt
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-self-painting-expected.txt
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-ellipsis-self-painting.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-self-painting.html
similarity index 92%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-ellipsis-self-painting.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-self-painting.html
index 2810f8dae181..5d722269bcce 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-ellipsis-self-painting.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-self-painting.html
@@ -1,6 +1,6 @@
 <!DOCTYPE html>
 <title>CSS Basic User Interface Test: ellipsis when there are self-painting objects</title>
-<link rel="help" href="http://www.w3.org/TR/css3-ui/#text-overflow">
+<link rel="help" href="https://drafts.csswg.org/css-overflow/#text-overflow">
 <link rel="help" href="https://crbug.com/1005645">
 <link rel="author" href="mailto:kojii@chromium.org">
 <script src="/resources/testharness.js"></script>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-textarea-with-caret-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-textarea-with-caret-expected.html
new file mode 100644
index 000000000000..77bfc030f70f
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-textarea-with-caret-expected.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Reference for text-overflow ellipsis in textarea with caret selection</title>
+<style>
+  #textarea {
+    font: 20px/1;
+    width: 100px;
+    height: 25px;
+    white-space: nowrap;
+    overflow: hidden;
+    text-overflow: clip;
+    margin: 10px;
+    resize: none;
+    outline: none;
+    border: none;
+    caret-color: transparent;
+  }
+</style>
+<textarea id="textarea">This is a very long text that should be clipped</textarea>
+<script>
+  // Focus the textarea and place caret at the same position as test
+  const textarea = document.getElementById('textarea');
+  textarea.focus();
+  textarea.setSelectionRange(10, 10);
+</script>
\ No newline at end of file
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-textarea-with-caret.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-textarea-with-caret.html
new file mode 100644
index 000000000000..c3a6cbffc728
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-textarea-with-caret.html
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Overflow: text-overflow ellipsis in textarea with caret selection</title>
+<link rel="help" href="https://drafts.csswg.org/css-overflow/#ellipsis-interaction">
+<link rel="match" href="reference/text-overflow-ellipsis-textarea-with-caret-ref.html">
+<meta name="assert" content="Check that text-overflow ellipsis behavior changes when caret selection is present in textarea element.">
+<style>
+  #textarea {
+    font: 20px/1;
+    width: 100px;
+    height: 25px;
+    white-space: nowrap;
+    overflow: hidden;
+    text-overflow: ellipsis;
+    margin: 10px;
+    resize: none;
+    outline: none;
+    border: none;
+    caret-color: transparent;
+  }
+</style>
+<textarea id="textarea">This is a very long text that should be clipped</textarea>
+<script>
+  // Focus the textarea and place caret
+  const textarea = document.getElementById('textarea');
+  textarea.focus();
+  textarea.setSelectionRange(10, 10);
+</script>
\ No newline at end of file
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-ellipsis-width-001-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-width-001-expected.txt
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-ellipsis-width-001-expected.txt
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-width-001-expected.txt
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-ellipsis-width-001.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-width-001.html
similarity index 90%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-ellipsis-width-001.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-width-001.html
index 204211158825..9a6ccdee04e1 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-ellipsis-width-001.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-width-001.html
@@ -2,7 +2,7 @@
 <title>Ellipsizing should not affect `offsetWidth` of inline boxes.</title>
 <link rel="author" href="kojii@chromium.org">
 <link rel="help" href="https://crbug.com/978392">
-<link rel="help" href="https://drafts.csswg.org/css-ui-3/#ellipsing-details">
+<link rel="help" href="https://drafts.csswg.org/css-overflow/#ellipsing-details">
 <script src="/resources/testharness.js"></script>
 <script src="/resources/testharnessreport.js"></script>
 <style>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-expected.html
new file mode 100644
index 000000000000..9a7ec4105c56
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-expected.html
@@ -0,0 +1,17 @@
+<!doctype html>
+<head>
+    <title>CSS Reftest Ellipsis Reference</title>
+    <link rel="stylesheet" href="/fonts/ahem.css">
+    <style>
+        div { font-size:10px; }
+        span { font-family:Ahem; font-size:30px; }
+    </style>
+</head>
+<body>
+    <p>PREREQUISITE: The font used must have a glyph for the U+2026 character.</p>
+    <p>Test passes if there is <strong>ellipsis</strong> after a black square.</p>
+    <div>
+        <span>A</span>&#x2026;
+    </div>
+</body>
+</html>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ref.html
new file mode 100644
index 000000000000..9a7ec4105c56
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ref.html
@@ -0,0 +1,17 @@
+<!doctype html>
+<head>
+    <title>CSS Reftest Ellipsis Reference</title>
+    <link rel="stylesheet" href="/fonts/ahem.css">
+    <style>
+        div { font-size:10px; }
+        span { font-family:Ahem; font-size:30px; }
+    </style>
+</head>
+<body>
+    <p>PREREQUISITE: The font used must have a glyph for the U+2026 character.</p>
+    <p>Test passes if there is <strong>ellipsis</strong> after a black square.</p>
+    <div>
+        <span>A</span>&#x2026;
+    </div>
+</body>
+</html>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-ruby-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ruby-expected.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-ruby-expected.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ruby-expected.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-ruby-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ruby-ref.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-ruby-ref.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ruby-ref.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-ruby.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ruby.html
similarity index 96%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-ruby.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ruby.html
index c8abebb7206b..8f863624f75a 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-ruby.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ruby.html
@@ -6,7 +6,7 @@
 <html><head>
   <meta charset="utf-8">
   <title>CSS Basic User Interface Test: text-overflow:ellipsis and ruby</title>
-  <link rel="help" href="http://www.w3.org/TR/css3-ui/#text-overflow">
+  <link rel="help" href="https://drafts.csswg.org/css-overflow/#text-overflow">
   <link rel="author" title="Mats Palmgren" href="mailto:mats@mozilla.com">
   <link rel="match" href="text-overflow-ruby-ref.html">
   <style>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-string-001-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-001-expected.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-string-001-expected.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-001-expected.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-string-001.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-001.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-string-001.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-001.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-string-002-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-002-expected.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-string-002-expected.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-002-expected.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-string-002.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-002.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-string-002.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-002.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-string-003-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-003-expected.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-string-003-expected.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-003-expected.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-string-003.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-003.html
similarity index 89%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-string-003.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-003.html
index 7ab1ba6efb1c..8a03dd83d216 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-string-003.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-003.html
@@ -10,8 +10,8 @@
   @font-face {
     /* A subset of Noto Color Emoji (only the code points used below) so the
        emoji ellipsis has known advance widths regardless of the platform's
-       emoji font. Every emoji glyph advances 12.45px and "🤷‍♂️" is a single
-       ZWJ cluster, so "🟢😀🤷‍♂️" is 3 glyphs wide. */
+       emoji font. Every emoji glyph advances 12px and "🤷‍♂️" is a single ZWJ
+       cluster, so "🟢😀🤷‍♂️" is 3 glyphs wide. */
     font-family: "emoji-test";
     src: url("/fonts/noto/color-emoji/NotoColorEmoji-subset.ttf");
   }
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-string-004-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-004-expected.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-string-004-expected.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-004-expected.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-string-004.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-004.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-string-004.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-004.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-string-005-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-005-expected.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-string-005-expected.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-005-expected.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-string-005.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-005.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-string-005.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-005.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-string-006-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-006-expected.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-string-006-expected.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-006-expected.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-string-006.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-006.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-string-006.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-006.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-string-007-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-007-expected.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-string-007-expected.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-007-expected.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-string-007.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-007.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-string-007.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-007.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-string-008-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-008-expected.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-string-008-expected.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-008-expected.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-string-008.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-008.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-string-008.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-008.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-009-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-009-expected.html
new file mode 100644
index 000000000000..3a3b90047ef4
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-009-expected.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Basic User Interface Reference File</title>
+<link rel="author" title="Minseong Kim" href="mailto:jja08111@gmail.com">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css" />
+<style>
+  @font-face {
+    font-family: "cjk-kr-test";
+    src: url("/fonts/noto/cjk-kr/NotoSansCJKkr-Regular-subset.otf");
+  }
+  div {
+    font-family: "cjk-kr-test", monospace;
+    font-size: 10px;
+  }
+  span {
+    font-family: Ahem;
+    font-size: 30px;
+  }
+</style>
+<body>
+  <p>Test passes if there is an <strong>안녕 안녕</strong> after a black rectangle below.</p>
+  <div>
+    <span>Test</span>안녕 안녕
+  </div>
+</body>
\ No newline at end of file
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-009.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-009.html
new file mode 100644
index 000000000000..6a6ad944976a
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-009.html
@@ -0,0 +1,34 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Basic User Interface Test: text-overflow - string</title>
+<link rel="author" title="Minseong Kim" href="mailto:jja08111@gmail.com">
+<link rel="help" href="https://drafts.csswg.org/css-overflow-4">
+<link rel="match" href="reference/text-overflow-string-009-ref.html">
+<meta name="assert" content="Test checks that a line feed in text-overflow string
+is converted to a space when adjacent to Hangul.">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css" />
+<style>
+  @font-face {
+    font-family: "cjk-kr-test";
+    src: url("/fonts/noto/cjk-kr/NotoSansCJKkr-Regular-subset.otf");
+  }
+  div {
+    font-family: "cjk-kr-test", monospace;
+    font-size: 10px;
+    overflow: hidden;
+    text-overflow: "안녕\0A안녕";
+    /* 120px for four Ahem glyphs + (38px + 1ch) for the ellipsis string "안녕 안녕"
+       + 1px margin. */
+    width: calc(120px + 38px + 1ch + 1px);
+  }
+  span {
+    font-family: Ahem;
+    font-size: 30px;
+  }
+</style>
+<body>
+  <p>Test passes if there is an <strong>안녕 안녕</strong> after a black rectangle below.</p>
+  <div>
+    <span>TestChecksThatTheBrokenContentRepalcedByTextOverflow</span>
+  </div>
+</body>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-010-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-010-expected.html
new file mode 100644
index 000000000000..2a76f91ed132
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-010-expected.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Basic User Interface Reference File</title>
+<link rel="author" title="Minseong Kim" href="mailto:jja08111@gmail.com">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css" />
+<style>
+  @font-face {
+    font-family: "cjk-kr-test";
+    src: url("/fonts/noto/cjk-kr/NotoSansCJKkr-Regular-subset.otf");
+  }
+  div {
+    font-family: "cjk-kr-test", monospace;
+    font-size: 10px;
+  }
+  span {
+    font-family: Ahem;
+    font-size: 30px;
+  }
+</style>
+<body>
+  <p>Test passes if there is an <strong>안녕 你好</strong> after a black rectangle below.</p>
+  <div>
+    <span>Test</span>안녕 你好
+  </div>
+</body>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-010.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-010.html
new file mode 100644
index 000000000000..c780c29a235a
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-010.html
@@ -0,0 +1,34 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Basic User Interface Test: text-overflow - string</title>
+<link rel="author" title="Minseong Kim" href="mailto:jja08111@gmail.com">
+<link rel="help" href="https://drafts.csswg.org/css-overflow-4">
+<link rel="match" href="reference/text-overflow-string-010-ref.html">
+<meta name="assert" content="Test checks that a line feed in text-overflow string
+is converted to a space when one side is Hangul.">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css" />
+<style>
+  @font-face {
+    font-family: "cjk-kr-test";
+    src: url("/fonts/noto/cjk-kr/NotoSansCJKkr-Regular-subset.otf");
+  }
+  div {
+    font-family: "cjk-kr-test", monospace;
+    font-size: 10px;
+    overflow: hidden;
+    text-overflow: "안녕\0A你好";
+    /* 120px for four Ahem glyphs + (19px + 1ch + 2ic) for the ellipsis string
+       "안녕 你好" + 1px margin. */
+    width: calc(120px + 19px + 1ch + 2ic + 1px);
+  }
+  span {
+    font-family: Ahem;
+    font-size: 30px;
+  }
+</style>
+<body>
+  <p>Test passes if there is an <strong>안녕 你好</strong> after a black rectangle below.</p>
+  <div>
+    <span>TestChecksThatTheBrokenContentRepalcedByTextOverflow</span>
+  </div>
+</body>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-011-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-011-expected.html
new file mode 100644
index 000000000000..0e89803a16ea
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-011-expected.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Basic User Interface Reference File</title>
+<link rel="author" title="Minseong Kim" href="mailto:jja08111@gmail.com">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css" />
+<style>
+  div {
+    font-family: monospace;
+    font-size: 10px;
+  }
+  span {
+    font-family: Ahem;
+    font-size: 30px;
+  }
+</style>
+<body>
+  <p>Test passes if there is an <strong>Hi ワールド</strong> after a black rectangle below.</p>
+  <div>
+    <span>Test</span>Hi ワールド
+  </div>
+</body>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-011.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-011.html
new file mode 100644
index 000000000000..e879d020ad20
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-011.html
@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Basic User Interface Test: text-overflow - string</title>
+<link rel="author" title="Minseong Kim" href="mailto:jja08111@gmail.com">
+<link rel="help" href="https://drafts.csswg.org/css-overflow-4">
+<link rel="match" href="reference/text-overflow-string-011-ref.html">
+<meta name="assert" content="Test checks that a line feed in text-overflow string
+is converted to a space when one side is English.">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css" />
+<style>
+  div {
+    font-family: monospace;
+    font-size: 10px;
+    overflow: hidden;
+    text-overflow: "Hi\0Aワールド";
+    /* 120px for four Ahem glyphs + (3ch + 4ic) for the ellipsis string
+       "Hi ワールド". */
+    width: calc(120px + 3ch + 4.1ic);
+  }
+  span {
+    font-family: Ahem;
+    font-size: 30px;
+  }
+</style>
+<body>
+  <p>Test passes if there is an <strong>Hi ワールド</strong> after a black rectangle below.</p>
+  <div>
+    <span>TestChecksThatTheBrokenContentRepalcedByTextOverflow</span>
+  </div>
+</body>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-012-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-012-expected.html
new file mode 100644
index 000000000000..6134b3efd9f6
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-012-expected.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Basic User Interface Reference File</title>
+<link rel="author" title="Minseong Kim" href="mailto:jja08111@gmail.com">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css" />
+<style>
+  @font-face {
+    font-family: "cjk-kr-test";
+    src: url("/fonts/noto/cjk-kr/NotoSansCJKkr-Regular-subset.otf");
+  }
+  @font-face {
+    font-family: "emoji-test";
+    src: url("/fonts/noto/color-emoji/NotoColorEmoji-subset.ttf");
+  }
+  div {
+    font-family: "cjk-kr-test", "emoji-test", monospace;
+    font-size: 10px;
+  }
+  span {
+    font-family: Ahem;
+    font-size: 30px;
+  }
+</style>
+<body>
+  <p>Test passes if there is an <strong>안녕 🟢</strong> after a black rectangle below.</p>
+  <div>
+    <span>Test</span>안녕 🟢
+  </div>
+</body>
\ No newline at end of file
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-012.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-012.html
new file mode 100644
index 000000000000..db8303eeb033
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-012.html
@@ -0,0 +1,38 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Basic User Interface Test: text-overflow - string</title>
+<link rel="author" title="Minseong Kim" href="mailto:jja08111@gmail.com">
+<link rel="help" href="https://drafts.csswg.org/css-overflow-4">
+<link rel="match" href="reference/text-overflow-string-012-ref.html">
+<meta name="assert" content="Test checks that a line feed in text-overflow string
+is converted to a space when one side is Hangul.">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css" />
+<style>
+  @font-face {
+    font-family: "cjk-kr-test";
+    src: url("/fonts/noto/cjk-kr/NotoSansCJKkr-Regular-subset.otf");
+  }
+  @font-face {
+    font-family: "emoji-test";
+    src: url("/fonts/noto/color-emoji/NotoColorEmoji-subset.ttf");
+  }
+  div {
+    font-family: "cjk-kr-test", "emoji-test", monospace;
+    font-size: 10px;
+    overflow: hidden;
+    text-overflow: "안녕\0A🟢";
+    /* 120px for four Ahem glyphs + (32px + 1ch) for the ellipsis string "안녕 🟢"
+       + 1px margin. */
+    width: calc(120px + 32px + 1ch + 1px);
+  }
+  span {
+    font-family: Ahem;
+    font-size: 30px;
+  }
+</style>
+<body>
+  <p>Test passes if there is an <strong>안녕 🟢</strong> after a black rectangle below.</p>
+  <div>
+    <span>TestChecksThatTheBrokenContentRepalcedByTextOverflow</span>
+  </div>
+</body>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-013-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-013-expected.html
new file mode 100644
index 000000000000..cc57fa1e6441
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-013-expected.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Basic User Interface Reference File</title>
+<link rel="author" title="Minseong Kim" href="mailto:jja08111@gmail.com">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css" />
+<style>
+  @font-face {
+    font-family: "emoji-test";
+    src: url("/fonts/noto/color-emoji/NotoColorEmoji-subset.ttf");
+  }
+  div {
+    font-family: "emoji-test", monospace;
+    font-size: 10px;
+  }
+  span {
+    font-family: Ahem;
+    font-size: 30px;
+  }
+</style>
+<body>
+  <p>Test passes if there is an <strong>你好 🟢</strong> after a black rectangle below.</p>
+  <div>
+    <span>Test</span>你好 🟢
+  </div>
+</body>
\ No newline at end of file
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-013.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-013.html
new file mode 100644
index 000000000000..bcea5a714cff
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-013.html
@@ -0,0 +1,34 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Basic User Interface Test: text-overflow - string</title>
+<link rel="author" title="Minseong Kim" href="mailto:jja08111@gmail.com">
+<link rel="help" href="https://drafts.csswg.org/css-overflow-4">
+<link rel="match" href="reference/text-overflow-string-013-ref.html">
+<meta name="assert" content="Test checks that a line feed in text-overflow string
+is converted to a space when between a Wide character and an Emoji">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css" />
+<style>
+  @font-face {
+    font-family: "emoji-test";
+    src: url("/fonts/noto/color-emoji/NotoColorEmoji-subset.ttf");
+  }
+  div {
+    font-family: "emoji-test", monospace;
+    font-size: 10px;
+    overflow: hidden;
+    text-overflow: "你好\0A🟢";
+    /* 120px for four Ahem glyphs + (2ic + 1ch + 13px) for the ellipsis string
+       "你好 🟢" + 1px margin. */
+    width: calc(120px + 2ic + 1ch + 13px + 1px);
+  }
+  span {
+    font-family: Ahem;
+    font-size: 30px;
+  }
+</style>
+<body>
+  <p>Test passes if there is an <strong>你好 🟢</strong> after a black rectangle below.</p>
+  <div>
+    <span>TestChecksThatTheBrokenContentRepalcedByTextOverflow</span>
+  </div>
+</body>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-014-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-014-expected.html
new file mode 100644
index 000000000000..2d24573aaa9e
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-014-expected.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Basic User Interface Reference File</title>
+<link rel="author" title="Minseong Kim" href="mailto:jja08111@gmail.com">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css" />
+<style>
+  @font-face {
+    font-family: "mplus-test";
+    src: url("/fonts/mplus-1p-regular.woff");
+  }
+  div {
+    font-family: "mplus-test", monospace;
+    font-size: 10px;
+  }
+  span {
+    font-family: Ahem;
+    font-size: 30px;
+  }
+</style>
+<body>
+  <p>Test passes if there is an <strong>שלום 你好</strong> after a black rectangle below.</p>
+  <div>
+    <span>Test</span>שלום 你好
+  </div>
+</body>
\ No newline at end of file
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-014.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-014.html
new file mode 100644
index 000000000000..16b4b80209ff
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-014.html
@@ -0,0 +1,34 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Basic User Interface Test: text-overflow - string</title>
+<link rel="author" title="Minseong Kim" href="mailto:jja08111@gmail.com">
+<link rel="help" href="https://drafts.csswg.org/css-overflow-4">
+<link rel="match" href="reference/text-overflow-string-014-ref.html">
+<meta name="assert" content="Test checks that a line feed in text-overflow string
+is converted to a space when one side is an RTL character">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css" />
+<style>
+  @font-face {
+    font-family: "mplus-test";
+    src: url("/fonts/mplus-1p-regular.woff");
+  }
+  div {
+    font-family: "mplus-test", monospace;
+    font-size: 10px;
+    overflow: hidden;
+    text-overflow: "שלום\0A你好";
+    /* 120px for four Ahem glyphs + (24px + 2ic) for the ellipsis string "שלום 你好"
+       + 1px margin. */
+    width: calc(120px + 24px + 2ic + 1px);
+  }
+  span {
+    font-family: Ahem;
+    font-size: 30px;
+  }
+</style>
+<body>
+  <p>Test passes if there is an <strong>שלום 你好</strong> after a black rectangle below.</p>
+  <div>
+    <span>TestChecksThatTheBrokenContentRepalcedByTextOverflow</span>
+  </div>
+</body>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-015-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-015-expected.html
new file mode 100644
index 000000000000..3a70eecf878b
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-015-expected.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Basic User Interface Reference File</title>
+<link rel="author" title="Minseong Kim" href="mailto:jja08111@gmail.com">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css" />
+<style>
+  @font-face {
+    font-family: "mplus-test";
+    src: url("/fonts/mplus-1p-regular.woff");
+  }
+  @font-face {
+    font-family: "cjk-kr-test";
+    src: url("/fonts/noto/cjk-kr/NotoSansCJKkr-Regular-subset.otf");
+  }
+  div {
+    font-family: "mplus-test", "cjk-kr-test";
+    font-size: 10px;
+  }
+  span {
+    font-family: Ahem;
+    font-size: 30px;
+  }
+</style>
+<body>
+  <p>Test passes if there is an <strong>יְוֹם 낮</strong> after a black rectangle below.</p>
+  <div>
+    <span>Test</span>יְוֹם 낮
+  </div>
+</body>
\ No newline at end of file
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-015.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-015.html
new file mode 100644
index 000000000000..7091bafdf179
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-015.html
@@ -0,0 +1,38 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Basic User Interface Test: text-overflow - string</title>
+<link rel="author" title="Minseong Kim" href="mailto:jja08111@gmail.com">
+<link rel="help" href="https://drafts.csswg.org/css-overflow-4">
+<link rel="match" href="reference/text-overflow-string-015-ref.html">
+<meta name="assert" content="Test checks that a line feed in text-overflow string
+is converted to a space when one side is Hangul.">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css" />
+<style>
+  @font-face {
+    font-family: "mplus-test";
+    src: url("/fonts/mplus-1p-regular.woff");
+  }
+  @font-face {
+    font-family: "cjk-kr-test";
+    src: url("/fonts/noto/cjk-kr/NotoSansCJKkr-Regular-subset.otf");
+  }
+  div {
+    font-family: "mplus-test", "cjk-kr-test";
+    font-size: 10px;
+    overflow: hidden;
+    text-overflow: "יְוֹם\0A낮";
+    /* 120px for four Ahem glyphs + 27px for the ellipsis string "יְוֹם 낮"
+       + 1px margin. */
+    width: calc(120px + 27px + 1px);
+  }
+  span {
+    font-family: Ahem;
+    font-size: 30px;
+  }
+</style>
+<body>
+  <p>Test passes if there is an <strong>יְוֹם 낮</strong> after a black rectangle below.</p>
+  <div>
+    <span>TestChecksThatTheBrokenContentRepalcedByTextOverflow</span>
+  </div>
+</body>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-016-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-016-expected.html
new file mode 100644
index 000000000000..1076f4939711
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-016-expected.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Basic User Interface Reference File</title>
+<link rel="author" title="Minseong Kim" href="mailto:jja08111@gmail.com">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css" />
+<style>
+  div {
+    font-family: monospace;
+    font-size: 10px;
+  }
+  span {
+    font-family: Ahem;
+    font-size: 30px;
+  }
+</style>
+<body>
+  <p>Test passes if there is an <strong>Hi Hi</strong> after a black rectangle below.</p>
+  <div>
+    <span>Test</span>Hi Hi
+  </div>
+</body>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-016.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-016.html
new file mode 100644
index 000000000000..98d2b0b91ad6
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-016.html
@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Basic User Interface Test: text-overflow - string</title>
+<link rel="author" title="Minseong Kim" href="mailto:jja08111@gmail.com">
+<link rel="help" href="https://drafts.csswg.org/css-overflow-4">
+<link rel="match" href="reference/text-overflow-string-016-ref.html">
+<meta name="assert" content="Test checks that multiple consecutive line feeds in
+text-overflow string are collapsed into a single space">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css" />
+<style>
+  div {
+    font-family: monospace;
+    font-size: 10px;
+    overflow: hidden;
+    text-overflow: "Hi\0A\0A\0A\0A\0AHi";
+    /* 120px for four Ahem glyphs + 5ch for the ellipsis string "Hi Hi" which
+       is monospace. */
+    width: calc(120px + 5.1ch);
+  }
+  span {
+    font-family: Ahem;
+    font-size: 30px;
+  }
+</style>
+<body>
+  <p>Test passes if there is an <strong>Hi Hi</strong> after a black rectangle below.</p>
+  <div>
+    <span>TestChecksThatTheBrokenContentRepalcedByTextOverflow</span>
+  </div>
+</body>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-017-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-017-expected.html
new file mode 100644
index 000000000000..1076f4939711
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-017-expected.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Basic User Interface Reference File</title>
+<link rel="author" title="Minseong Kim" href="mailto:jja08111@gmail.com">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css" />
+<style>
+  div {
+    font-family: monospace;
+    font-size: 10px;
+  }
+  span {
+    font-family: Ahem;
+    font-size: 30px;
+  }
+</style>
+<body>
+  <p>Test passes if there is an <strong>Hi Hi</strong> after a black rectangle below.</p>
+  <div>
+    <span>Test</span>Hi Hi
+  </div>
+</body>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-017.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-017.html
new file mode 100644
index 000000000000..f41781aa5e43
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-017.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Basic User Interface Test: text-overflow - string</title>
+<link rel="author" title="Minseong Kim" href="mailto:jja08111@gmail.com">
+<link rel="help" href="https://drafts.csswg.org/css-overflow-4">
+<link rel="match" href="reference/text-overflow-string-016-ref.html">
+<meta name="assert" content="Test checks that a line feed in text-overflow string is converted to a space">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css" />
+<style>
+  div {
+    font-family: monospace;
+    font-size: 10px;
+    overflow: hidden;
+    text-overflow: "Hi\0AHi";
+    /* 120px for four Ahem glyphs + 5ch for the ellipsis string "Hi Hi" which
+       is monospace. */
+    width: calc(120px + 5.1ch);
+  }
+  span {
+    font-family: Ahem;
+    font-size: 30px;
+  }
+</style>
+<body>
+  <p>Test passes if there is an <strong>Hi Hi</strong> after a black rectangle below.</p>
+  <div>
+    <span>TestChecksThatTheBrokenContentRepalcedByTextOverflow</span>
+  </div>
+</body>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-018-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-018-expected.html
new file mode 100644
index 000000000000..1076f4939711
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-018-expected.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Basic User Interface Reference File</title>
+<link rel="author" title="Minseong Kim" href="mailto:jja08111@gmail.com">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css" />
+<style>
+  div {
+    font-family: monospace;
+    font-size: 10px;
+  }
+  span {
+    font-family: Ahem;
+    font-size: 30px;
+  }
+</style>
+<body>
+  <p>Test passes if there is an <strong>Hi Hi</strong> after a black rectangle below.</p>
+  <div>
+    <span>Test</span>Hi Hi
+  </div>
+</body>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-018.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-018.html
new file mode 100644
index 000000000000..7298bc53c957
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-018.html
@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Basic User Interface Test: text-overflow - string</title>
+<link rel="author" title="Minseong Kim" href="mailto:jja08111@gmail.com">
+<link rel="help" href="https://drafts.csswg.org/css-overflow-4">
+<link rel="match" href="reference/text-overflow-string-016-ref.html">
+<meta name="assert" content="Test checks that a line separator (U+2028) in
+text-overflow string is collapsed like a forced line break and converted to a
+space.">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css" />
+<style>
+  div {
+    font-family: monospace;
+    font-size: 10px;
+    overflow: hidden;
+    text-overflow: "Hi\2028Hi";
+    /* 120px for four Ahem glyphs + 5ch for the ellipsis string "Hi Hi" which
+       is monospace. */
+    width: calc(120px + 5.1ch);
+  }
+  span {
+    font-family: Ahem;
+    font-size: 30px;
+  }
+</style>
+<body>
+  <p>Test passes if there is an <strong>Hi Hi</strong> after a black rectangle below.</p>
+  <div>
+    <span>TestChecksThatTheBrokenContentRepalcedByTextOverflow</span>
+  </div>
+</body>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-019-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-019-expected.html
new file mode 100644
index 000000000000..1076f4939711
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-019-expected.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Basic User Interface Reference File</title>
+<link rel="author" title="Minseong Kim" href="mailto:jja08111@gmail.com">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css" />
+<style>
+  div {
+    font-family: monospace;
+    font-size: 10px;
+  }
+  span {
+    font-family: Ahem;
+    font-size: 30px;
+  }
+</style>
+<body>
+  <p>Test passes if there is an <strong>Hi Hi</strong> after a black rectangle below.</p>
+  <div>
+    <span>Test</span>Hi Hi
+  </div>
+</body>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-019.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-019.html
new file mode 100644
index 000000000000..6aa0d94619e5
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-019.html
@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Basic User Interface Test: text-overflow - string</title>
+<link rel="author" title="Minseong Kim" href="mailto:jja08111@gmail.com">
+<link rel="help" href="https://drafts.csswg.org/css-overflow-4">
+<link rel="match" href="reference/text-overflow-string-016-ref.html">
+<meta name="assert" content="Test checks that a paragraph separator (U+2029) in
+text-overflow string is collapsed like a forced line break and converted to a
+space.">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css" />
+<style>
+  div {
+    font-family: monospace;
+    font-size: 10px;
+    overflow: hidden;
+    text-overflow: "Hi\2029Hi";
+    /* 120px for four Ahem glyphs + 5ch for the ellipsis string "Hi Hi" which
+       is monospace. */
+    width: calc(120px + 5.1ch);
+  }
+  span {
+    font-family: Ahem;
+    font-size: 30px;
+  }
+</style>
+<body>
+  <p>Test passes if there is an <strong>Hi Hi</strong> after a black rectangle below.</p>
+  <div>
+    <span>TestChecksThatTheBrokenContentRepalcedByTextOverflow</span>
+  </div>
+</body>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-020-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-020-expected.html
new file mode 100644
index 000000000000..1076f4939711
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-020-expected.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Basic User Interface Reference File</title>
+<link rel="author" title="Minseong Kim" href="mailto:jja08111@gmail.com">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css" />
+<style>
+  div {
+    font-family: monospace;
+    font-size: 10px;
+  }
+  span {
+    font-family: Ahem;
+    font-size: 30px;
+  }
+</style>
+<body>
+  <p>Test passes if there is an <strong>Hi Hi</strong> after a black rectangle below.</p>
+  <div>
+    <span>Test</span>Hi Hi
+  </div>
+</body>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-020.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-020.html
new file mode 100644
index 000000000000..655d121635ca
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-020.html
@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Basic User Interface Test: text-overflow - string</title>
+<link rel="author" title="Minseong Kim" href="mailto:jja08111@gmail.com">
+<link rel="help" href="https://drafts.csswg.org/css-overflow-4">
+<link rel="match" href="reference/text-overflow-string-016-ref.html">
+<meta name="assert" content="Test checks that a form feed (U+000C) in text-overflow
+string is collapsed like a forced line break and converted to a space.">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css" />
+<style>
+  div {
+    font-family: monospace;
+    font-size: 10px;
+    overflow: hidden;
+    text-overflow: "Hi\0CHi";
+    /* 120px for four Ahem glyphs + 5ch for the ellipsis string "Hi Hi" which
+       is monospace. */
+    width: calc(120px + 5.1ch);
+  }
+  span {
+    font-family: Ahem;
+    font-size: 30px;
+  }
+</style>
+<body>
+  <p>Test passes if there is an <strong>Hi Hi</strong> after a black rectangle below.</p>
+  <div>
+    <span>TestChecksThatTheBrokenContentRepalcedByTextOverflow</span>
+  </div>
+</body>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-021-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-021-expected.html
new file mode 100644
index 000000000000..1076f4939711
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-021-expected.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Basic User Interface Reference File</title>
+<link rel="author" title="Minseong Kim" href="mailto:jja08111@gmail.com">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css" />
+<style>
+  div {
+    font-family: monospace;
+    font-size: 10px;
+  }
+  span {
+    font-family: Ahem;
+    font-size: 30px;
+  }
+</style>
+<body>
+  <p>Test passes if there is an <strong>Hi Hi</strong> after a black rectangle below.</p>
+  <div>
+    <span>Test</span>Hi Hi
+  </div>
+</body>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-021.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-021.html
new file mode 100644
index 000000000000..3677412be7a5
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-021.html
@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Basic User Interface Test: text-overflow - string</title>
+<link rel="author" title="Minseong Kim" href="mailto:jja08111@gmail.com">
+<link rel="help" href="https://drafts.csswg.org/css-overflow-4">
+<link rel="match" href="reference/text-overflow-string-016-ref.html">
+<meta name="assert" content="Test checks that a line tabulation (U+000B) in
+text-overflow string is collapsed like a forced line break and converted to a
+space.">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css" />
+<style>
+  div {
+    font-family: monospace;
+    font-size: 10px;
+    overflow: hidden;
+    text-overflow: "Hi\0BHi";
+    /* 120px for four Ahem glyphs + 5ch for the ellipsis string "Hi Hi" which
+       is monospace. */
+    width: calc(120px + 5.1ch);
+  }
+  span {
+    font-family: Ahem;
+    font-size: 30px;
+  }
+</style>
+<body>
+  <p>Test passes if there is an <strong>Hi Hi</strong> after a black rectangle below.</p>
+  <div>
+    <span>TestChecksThatTheBrokenContentRepalcedByTextOverflow</span>
+  </div>
+</body>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-022-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-022-expected.html
new file mode 100644
index 000000000000..1076f4939711
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-022-expected.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Basic User Interface Reference File</title>
+<link rel="author" title="Minseong Kim" href="mailto:jja08111@gmail.com">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css" />
+<style>
+  div {
+    font-family: monospace;
+    font-size: 10px;
+  }
+  span {
+    font-family: Ahem;
+    font-size: 30px;
+  }
+</style>
+<body>
+  <p>Test passes if there is an <strong>Hi Hi</strong> after a black rectangle below.</p>
+  <div>
+    <span>Test</span>Hi Hi
+  </div>
+</body>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-022.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-022.html
new file mode 100644
index 000000000000..98406cf567b6
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-022.html
@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Basic User Interface Test: text-overflow - string</title>
+<link rel="author" title="Minseong Kim" href="mailto:jja08111@gmail.com">
+<link rel="help" href="https://drafts.csswg.org/css-overflow-4">
+<link rel="match" href="reference/text-overflow-string-016-ref.html">
+<meta name="assert" content="Test checks that a next line (U+0085) in text-overflow
+string is collapsed like a forced line break and converted to a space.">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css" />
+<style>
+  div {
+    font-family: monospace;
+    font-size: 10px;
+    overflow: hidden;
+    text-overflow: "Hi\85Hi";
+    /* 120px for four Ahem glyphs + 5ch for the ellipsis string "Hi Hi" which
+       is monospace. */
+    width: calc(120px + 5.1ch);
+  }
+  span {
+    font-family: Ahem;
+    font-size: 30px;
+  }
+</style>
+<body>
+  <p>Test passes if there is an <strong>Hi Hi</strong> after a black rectangle below.</p>
+  <div>
+    <span>TestChecksThatTheBrokenContentRepalcedByTextOverflow</span>
+  </div>
+</body>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-023-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-023-expected.html
new file mode 100644
index 000000000000..1076f4939711
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-023-expected.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Basic User Interface Reference File</title>
+<link rel="author" title="Minseong Kim" href="mailto:jja08111@gmail.com">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css" />
+<style>
+  div {
+    font-family: monospace;
+    font-size: 10px;
+  }
+  span {
+    font-family: Ahem;
+    font-size: 30px;
+  }
+</style>
+<body>
+  <p>Test passes if there is an <strong>Hi Hi</strong> after a black rectangle below.</p>
+  <div>
+    <span>Test</span>Hi Hi
+  </div>
+</body>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-023.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-023.html
new file mode 100644
index 000000000000..33832f01c0f0
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-023.html
@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Basic User Interface Test: text-overflow - string</title>
+<link rel="author" title="Minseong Kim" href="mailto:jja08111@gmail.com">
+<link rel="help" href="https://drafts.csswg.org/css-overflow-4">
+<link rel="match" href="reference/text-overflow-string-016-ref.html">
+<meta name="assert" content="Test checks that multiple consecutive forced line
+breaks of different kinds in text-overflow string are collapsed into a single
+space.">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css" />
+<style>
+  div {
+    font-family: monospace;
+    font-size: 10px;
+    overflow: hidden;
+    text-overflow: "Hi\0A\2028\2029Hi";
+    /* 120px for four Ahem glyphs + 5ch for the ellipsis string "Hi Hi" which
+       is monospace. */
+    width: calc(120px + 5.1ch);
+  }
+  span {
+    font-family: Ahem;
+    font-size: 30px;
+  }
+</style>
+<body>
+  <p>Test passes if there is an <strong>Hi Hi</strong> after a black rectangle below.</p>
+  <div>
+    <span>TestChecksThatTheBrokenContentRepalcedByTextOverflow</span>
+  </div>
+</body>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-024.tentative-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-024.tentative-expected.html
new file mode 100644
index 000000000000..97a5a87438dd
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-024.tentative-expected.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Basic User Interface Reference File</title>
+<link rel="author" title="Minseong Kim" href="mailto:jja08111@gmail.com">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css" />
+<style>
+  div {
+    font-family: monospace;
+    font-size: 10px;
+  }
+  span {
+    font-family: Ahem;
+    font-size: 30px;
+  }
+</style>
+<body>
+  <p>Test passes if there is an <strong>こんにちは</strong> after a black rectangle below.</p>
+  <div>
+    <span>Test</span>こんにちは
+  </div>
+</body>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-024.tentative.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-024.tentative.html
new file mode 100644
index 000000000000..e9ef29e7dd6d
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-024.tentative.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Basic User Interface Test: text-overflow - string</title>
+<link rel="author" title="Minseong Kim" href="mailto:jja08111@gmail.com">
+<link rel="help" href="https://drafts.csswg.org/css-overflow-4">
+<link rel="match" href="reference/text-overflow-string-024-ref.tentative.html">
+<meta name="assert" content="Test checks that a line feed in text-overflow string
+is stripped when between Japanese characters.">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css" />
+<style>
+  div {
+    font-family: monospace;
+    font-size: 10px;
+    overflow: hidden;
+    text-overflow: "こん\0Aにちは";
+    /* 120px for four Ahem glyphs + 5ic for the ellipsis string "こんにちは". */
+    width: calc(120px + 5.1ic);
+  }
+  span {
+    font-family: Ahem;
+    font-size: 30px;
+  }
+</style>
+<body>
+  <p>Test passes if there is an <strong>こんにちは</strong> after a black rectangle below.</p>
+  <div>
+    <span>TestChecksThatTheBrokenContentRepalcedByTextOverflow</span>
+  </div>
+</body>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-025.tentative-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-025.tentative-expected.html
new file mode 100644
index 000000000000..ae378c472c19
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-025.tentative-expected.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Basic User Interface Reference File</title>
+<link rel="author" title="Minseong Kim" href="mailto:jja08111@gmail.com">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css" />
+<style>
+  div {
+    font-family: monospace;
+    font-size: 10px;
+  }
+  span {
+    font-family: Ahem;
+    font-size: 30px;
+  }
+</style>
+<body>
+  <p>Test passes if there is an <strong>你好你好</strong> after a black rectangle below.</p>
+  <div>
+    <span>Test</span>你好你好
+  </div>
+</body>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-025.tentative.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-025.tentative.html
new file mode 100644
index 000000000000..a1409fe27fde
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-025.tentative.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Basic User Interface Test: text-overflow - string</title>
+<link rel="author" title="Minseong Kim" href="mailto:jja08111@gmail.com">
+<link rel="help" href="https://drafts.csswg.org/css-overflow-4">
+<link rel="match" href="reference/text-overflow-string-025-ref.tentative.html">
+<meta name="assert" content="Test checks that a line feed in text-overflow string
+is stripped when between Chinese characters.">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css" />
+<style>
+  div {
+    font-family: monospace;
+    font-size: 10px;
+    overflow: hidden;
+    text-overflow: "你好\0A你好";
+    /* 120px for four Ahem glyphs + 4ic for the ellipsis string "你好你好". */
+    width: calc(120px + 4.1ic);
+  }
+  span {
+    font-family: Ahem;
+    font-size: 30px;
+  }
+</style>
+<body>
+  <p>Test passes if there is an <strong>你好你好</strong> after a black rectangle below.</p>
+  <div>
+    <span>TestChecksThatTheBrokenContentRepalcedByTextOverflow</span>
+  </div>
+</body>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-026.tentative-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-026.tentative-expected.html
new file mode 100644
index 000000000000..594a188b001c
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-026.tentative-expected.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Basic User Interface Reference File</title>
+<link rel="author" title="Minseong Kim" href="mailto:jja08111@gmail.com">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css" />
+<style>
+  div {
+    font-family: monospace;
+    font-size: 10px;
+  }
+  span {
+    font-family: Ahem;
+    font-size: 30px;
+  }
+</style>
+<body>
+  <p>Test passes if there is an <strong>ＦＵＬＬ</strong> after a black rectangle below.</p>
+  <div>
+    <span>Test</span>ＦＵＬＬ
+  </div>
+</body>
\ No newline at end of file
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-026.tentative.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-026.tentative.html
new file mode 100644
index 000000000000..9c223b623246
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-026.tentative.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Basic User Interface Test: text-overflow - string</title>
+<link rel="author" title="Minseong Kim" href="mailto:jja08111@gmail.com">
+<link rel="help" href="https://drafts.csswg.org/css-overflow-4">
+<link rel="match" href="reference/text-overflow-string-026-ref.tentative.html">
+<meta name="assert" content="Test checks that a line feed in text-overflow string
+is stripped when between Full-width Latin characters">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css" />
+<style>
+  div {
+    font-family: monospace;
+    font-size: 10px;
+    overflow: hidden;
+    text-overflow: "ＦＵ\0AＬＬ";
+    /* 120px for four Ahem glyphs + 4ic for the ellipsis string "ＦＵＬＬ". */
+    width: calc(120px + 4.1ic);
+  }
+  span {
+    font-family: Ahem;
+    font-size: 30px;
+  }
+</style>
+<body>
+  <p>Test passes if there is an <strong>ＦＵＬＬ</strong> after a black rectangle below.</p>
+  <div>
+    <span>TestChecksThatTheBrokenContentRepalcedByTextOverflow</span>
+  </div>
+</body>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-in-input-expected-mismatch.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-in-input-expected-mismatch.html
new file mode 100644
index 000000000000..be13855d5345
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-in-input-expected-mismatch.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>text-overflow: &lt;string&gt; in text inputs - not reference</title>
+<input value="aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa">
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-in-input-notref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-in-input-notref.html
new file mode 100644
index 000000000000..be13855d5345
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-in-input-notref.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>text-overflow: &lt;string&gt; in text inputs - not reference</title>
+<input value="aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa">
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-in-input.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-in-input.html
new file mode 100644
index 000000000000..c37ce537af5e
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-in-input.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>text-overflow: &lt;string&gt; in text inputs</title>
+<link rel="author" title="Tim Nguyen" href="https://github.com/nt1m">
+<link rel="help" href="https://drafts.csswg.org/css-overflow-4/#text-overflow">
+<link rel="mismatch" href="text-overflow-string-in-input-notref.html">
+<input value="aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" style="text-overflow: '[...]'">
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-with-selection-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-with-selection-expected.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-with-selection-expected.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-with-selection-expected.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-with-selection-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-with-selection-ref.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-with-selection-ref.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-with-selection-ref.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-with-selection.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-with-selection.html
similarity index 100%
rename from LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-with-selection.html
rename to LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-with-selection.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow.html
new file mode 100644
index 000000000000..12cecef6f79e
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow.html
@@ -0,0 +1,29 @@
+<!doctype html>
+<html>
+    <title>CSS Basic User Interface Test: text-overflow - ellipsis</title>
+    <link rel="author" title="YreenChan" href="mailto:yreenchan@gmail.com">
+    <link rel="reviewer" title="Simon Pieters" href="mailto:simonp@opera.com">
+    <link rel="reviewer" title="Leif Arne Storset" href="mailto:lstorset@opera.com">
+    <link rel="help" href="https://drafts.csswg.org/css-overflow/#text-overflow">
+    <link rel="match" href="text-overflow-ref.html">
+    <meta name="flags" content="ahem">
+    <meta name="assert" content="'text-overflow:ellipsis' renders U+2026 when text is overflowing.">
+    <link rel="stylesheet" type="text/css" href="/fonts/ahem.css" />
+    <style>
+    div {
+        font-size:10px;
+        overflow: hidden;
+        text-overflow: ellipsis;
+        white-space: nowrap;
+        width: 50px;
+    }
+    span { font-family: Ahem; font-size:30px; }
+    </style>
+<body>
+    <p>PREREQUISITE: The font used must have a glyph for the U+2026 character.</p>
+    <p>Test passes if there is <strong>ellipsis</strong> after a black square.</p>
+    <div>
+        <span>AAAA</span>
+    </div>
+</body>
+</html>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/unicode-bidi-plaintext-scroll-direction-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/unicode-bidi-plaintext-scroll-direction-expected.txt
new file mode 100644
index 000000000000..2df3521afb67
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/unicode-bidi-plaintext-scroll-direction-expected.txt
@@ -0,0 +1,16 @@
+اسماء.شبكة/%20/test/
+اسماء.شبكة/%20/test/
+
+اسماء.شبكة/%20/test/
+اسماء.شبكة/%20/test/
+
+
+FAIL unicode-bidi: plaintext content opposite to the container's direction isn't scrollable (#plaintext-div-text) assert_equals: should not be scrollable expected 200 but got 258
+FAIL unicode-bidi: plaintext content opposite to the container's direction isn't scrollable (#plaintext-div-span) assert_equals: should not be scrollable expected 200 but got 258
+FAIL unicode-bidi: plaintext content opposite to the container's direction isn't scrollable (#plaintext-textarea) assert_equals: should not be scrollable expected 215 but got 273
+FAIL unicode-bidi: plaintext content opposite to the container's direction isn't scrollable (#plaintext-input) assert_equals: should not be scrollable expected 230 but got 290
+PASS dir=auto makes rtl-dominant content scrollable (#auto-div-text)
+PASS dir=auto makes rtl-dominant content scrollable (#auto-div-span)
+PASS dir=auto makes rtl-dominant content scrollable (#auto-textarea)
+PASS dir=auto makes rtl-dominant content scrollable (#auto-input)
+
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/unicode-bidi-plaintext-scroll-direction.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/unicode-bidi-plaintext-scroll-direction.html
new file mode 100644
index 000000000000..aded81128813
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/unicode-bidi-plaintext-scroll-direction.html
@@ -0,0 +1,56 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Overflow Test: unicode-bidi: plaintext doesn't affect the scroll direction of a scroll container, dir=auto does</title>
+<link rel="author" title="Mozilla" href="https://mozilla.com/">
+<link rel="author" title="Emilio Cobos Álvarez" href="mailto:emilio@crisal.io">
+<link rel="help" href="https://drafts.csswg.org/css-overflow-3/#scrollable">
+<link rel="help" href="https://drafts.csswg.org/css-writing-modes-4/#unicode-bidi">
+<link rel="help" href="https://github.com/w3c/csswg-drafts/issues/13816">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<style>
+  .scroller {
+    width: 200px;
+    font: 30px sans-serif;
+    overflow-x: auto;
+    white-space: nowrap;
+  }
+</style>
+
+<div class="scroller" id="plaintext-div-text" style="unicode-bidi: plaintext">اسماء.شبكة/%20/test/</div>
+<div class="scroller" id="plaintext-div-span" style="unicode-bidi: plaintext"><span>اسماء.شبكة/%20/test/</span></div>
+<textarea class="scroller" id="plaintext-textarea" style="unicode-bidi: plaintext" rows="1">اسماء.شبكة/%20/test/</textarea>
+<input class="scroller" id="plaintext-input" style="unicode-bidi: plaintext" value="اسماء.شبكة/%20/test/">
+
+<div class="scroller" id="auto-div-text" dir="auto">اسماء.شبكة/%20/test/</div>
+<div class="scroller" id="auto-div-span" dir="auto"><span>اسماء.شبكة/%20/test/</span></div>
+<textarea class="scroller" id="auto-textarea" dir="auto" rows="1">اسماء.شبكة/%20/test/</textarea>
+<input class="scroller" id="auto-input" dir="auto" value="اسماء.شبكة/%20/test/">
+
+<script>
+  // unicode-bidi: plaintext doesn't change the scroll container's scroll
+  // direction.
+  for (const id of ["plaintext-div-text", "plaintext-div-span", "plaintext-textarea", "plaintext-input"]) {
+    test(() => {
+      const el = document.getElementById(id);
+      assert_equals(getComputedStyle(el).direction, "ltr");
+      assert_equals(el.scrollWidth, el.clientWidth, "should not be scrollable");
+    }, `unicode-bidi: plaintext content opposite to the container's direction isn't scrollable (#${id})`);
+  }
+
+  // dir=auto affects direction, which affects the scroll direction.
+  for (const id of ["auto-div-text", "auto-div-span", "auto-textarea", "auto-input"]) {
+    test(() => {
+      const el = document.getElementById(id);
+      assert_equals(getComputedStyle(el).direction, "rtl");
+      assert_greater_than(el.scrollWidth, el.clientWidth, "element should overflow");
+
+      el.scrollLeft = 100000;
+      assert_equals(el.scrollLeft, 0, "Should scroll to the left");
+
+      el.scrollLeft = -100000;
+      assert_approx_equals(el.scrollLeft, -(el.scrollWidth - el.clientWidth), 1,
+        "min scroll offset should match a plain rtl scroller");
+    }, `dir=auto makes rtl-dominant content scrollable (#${id})`);
+  }
+</script>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/w3c-import.log b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/w3c-import.log
index 649e5484c47e..7da07122b565 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/w3c-import.log
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/w3c-import.log
@@ -10,15 +10,24 @@ Do NOT modify or remove this file.
 ------------------------------------------------------------------------
 Properties requiring vendor prefixes:
 None
-Property values requiring vendor prefixes:
-None
 ------------------------------------------------------------------------
 List of files:
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/META.yml
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/WEB_FEATURES.yml
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/abspos-relayout-with-scrollable-descendant-vertical-lr.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/abspos-relayout-with-scrollable-descendant.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/abspos-shrink-to-fit-with-scrollable-descendant-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/abspos-shrink-to-fit-with-scrollable-descendant-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/abspos-shrink-to-fit-with-scrollable-descendant.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/add-scroller-then-scroll-content-into-view-expected.xht
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/add-scroller-then-scroll-content-into-view.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/auto-scrollbar-inline-children.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/before-after-pseudo-element-scrolling-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/before-after-pseudo-element-scrolling.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/button-with-scrollable-descendant-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/button-with-scrollable-descendant-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/button-with-scrollable-descendant.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/chrome-480554290-crash.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/chrome-body-overflow-propagation-crash.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/clip-001-expected.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/clip-001-ref.html
@@ -58,9 +67,41 @@ List of files:
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/document-element-overflow-hidden-scroll.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/dynamic-visible-to-clip-001-expected.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/dynamic-visible-to-clip-001.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/dynamic-visible-to-clip-002-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/dynamic-visible-to-clip-002-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/dynamic-visible-to-clip-002.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/ellipsis-with-image-crash.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/fit-content-textarea-with-scrollbar-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/fit-content-textarea-with-scrollbar-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/fit-content-textarea-with-scrollbar.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/flex-column-container-with-scrollable-descendant-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/flex-column-container-with-scrollable-descendant-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/flex-column-container-with-scrollable-descendant.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/flex-container-multiple-items-with-scrollable-descendant-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/flex-container-multiple-items-with-scrollable-descendant-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/flex-container-multiple-items-with-scrollable-descendant.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/flex-container-with-scrollable-descendant-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/flex-container-with-scrollable-descendant-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/flex-container-with-scrollable-descendant.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/flex-nested-container-with-scrollable-descendant-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/flex-nested-container-with-scrollable-descendant-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/flex-nested-container-with-scrollable-descendant.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/flex-orthogonal-writing-mode-with-scrollable-descendant-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/flex-orthogonal-writing-mode-with-scrollable-descendant.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/float-with-relpos-and-transform-expected.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/float-with-relpos-and-transform.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/float-with-scrollable-descendant-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/float-with-scrollable-descendant-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/float-with-scrollable-descendant.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/grid-container-with-scrollable-descendant-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/grid-container-with-scrollable-descendant-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/grid-container-with-scrollable-descendant.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/grid-nested-container-with-scrollable-descendant-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/grid-nested-container-with-scrollable-descendant-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/grid-nested-container-with-scrollable-descendant.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/grid-orthogonal-writing-mode-with-scrollable-descendant-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/grid-orthogonal-writing-mode-with-scrollable-descendant.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/hit-test-border-radius-and-perspective-projection.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/hit-test-border-radius-and-perspective.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/hit-test-stacking-context-parent-border-radius.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/incremental-scroll-002-expected.html
@@ -70,18 +111,45 @@ List of files:
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/incremental-scroll-ref.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/incremental-scroll.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/inheritance.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/inline-block-with-scrollable-descendant-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/inline-block-with-scrollable-descendant-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/inline-block-with-scrollable-descendant.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/input-scrollable-region-001-expected.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/input-scrollable-region-001.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/keyboard-scroll.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/logical-overflow-001.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/margin-block-end-scroll-area-001-expected.xht
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/margin-block-end-scroll-area-001.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/max-content-nested-textarea-with-scrollbar-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/max-content-nested-textarea-with-scrollbar-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/max-content-nested-textarea-with-scrollbar.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/max-content-textarea-with-scrollbar-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/max-content-textarea-with-scrollbar-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/max-content-textarea-with-scrollbar.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/max-content-with-float-scrollable-descendant-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/max-content-with-float-scrollable-descendant-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/max-content-with-float-scrollable-descendant.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/max-content-with-multiple-scrollable-descendants-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/max-content-with-multiple-scrollable-descendants-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/max-content-with-multiple-scrollable-descendants.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/max-width-container-with-scrollable-descendant-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/max-width-container-with-scrollable-descendant-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/max-width-container-with-scrollable-descendant-vertical-rl-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/max-width-container-with-scrollable-descendant-vertical-rl-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/max-width-container-with-scrollable-descendant-vertical-rl.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/max-width-container-with-scrollable-descendant.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/min-content-textarea-with-scrollbar-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/min-content-textarea-with-scrollbar-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/min-content-textarea-with-scrollbar.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/multicol-in-orthogonal-writing-mode-crash.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/no-scrollable-overflow-vertical-rl-2-expected.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/no-scrollable-overflow-vertical-rl-2.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/no-scrollable-overflow-vertical-rl-expected.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/no-scrollable-overflow-vertical-rl.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/orthogonal-flow-with-inline-end-margin.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/orthogonal-writing-mode-with-scrollable-descendant-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/orthogonal-writing-mode-with-scrollable-descendant-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/orthogonal-writing-mode-with-scrollable-descendant.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/outline-with-opacity-crash.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-abpos-transform.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-alignment-001-ref.html
@@ -115,7 +183,6 @@ List of files:
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-auto-scrollbar-gutter-intrinsic-003-expected.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-auto-scrollbar-gutter-intrinsic-003-ref.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-auto-scrollbar-gutter-intrinsic-003.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-auto-scrollbar-gutter-intrinsic-003.html.rej
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-auto-scrolling-with-margin-and-transform.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-body-propagation-001-expected.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-body-propagation-001.html
@@ -162,6 +229,7 @@ List of files:
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-cant-scroll-expected.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-cant-scroll-ref.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-cant-scroll.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-clamps-and-ignores-scroll-offsets-vertical-rl.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-content-visual-overflow-expected.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-content-visual-overflow-ref.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-content-visual-overflow.html
@@ -201,12 +269,34 @@ List of files:
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-011.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-012-expected.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-012.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-013-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-013.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-014-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-014.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-015-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-015.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-016-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-016.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-017-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-017.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-018-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-018.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-019-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-019.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-020-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-020.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-021-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-021.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-022-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-022.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-border-radius-002-expected.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-border-radius-002-ref.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-border-radius-002.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-border-radius-expected.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-border-radius-ref.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-border-radius.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-content-box-dynamic-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-content-box-dynamic.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-hit-testing.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-intersection-observer.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-invalidation-expected.html
@@ -233,6 +323,7 @@ List of files:
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-visual-box-expected.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-visual-box-ref.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-margin-visual-box.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-no-off-axis-scrollbar.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-rounded-table-expected.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-rounded-table-ref.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-rounded-table.html
@@ -246,6 +337,9 @@ List of files:
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-y-visible-x-svg-expected.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-y-visible-x-svg-ref.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clip-y-visible-x-svg.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clipped-transparent-border-clip-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clipped-transparent-border-clip-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-clipped-transparent-border-clip.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-codependent-scrollbars.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-does-not-apply-to-inline-box-expected.xht
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-does-not-apply-to-inline-box.html
@@ -307,8 +401,9 @@ List of files:
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-scroll-resize-visibility-hidden.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-shorthand-001.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-shorthand-002.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-shorthand-002.html.rej
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-video-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-video-hidden-expected-mismatch.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-video-hidden.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-video-ref.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-video.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/paint-containment-svg-expected.html
@@ -322,6 +417,10 @@ List of files:
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/rounded-overflow-visible-clip-expected.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/rounded-overflow-visible-clip-ref.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/rounded-overflow-visible-clip.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-axis-lock.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-marker-group-display-none.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-marker-group-hover-from-marker.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-marker-group-hover.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-overflow-padding-block-001.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-with-ancestor-border-radius.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scroll-with-border-radius.html
@@ -329,8 +428,8 @@ List of files:
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scrollable-overflow-empty-newline-span.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scrollable-overflow-fixed-positioned-initial-containing-block.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scrollable-overflow-float.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scrollable-overflow-from-grid-container-contents.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scrollable-overflow-height-with-flex-item-margin-inline-end-rtl.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scrollable-overflow-height-with-flex-item-margin-inline-end-rtl.html.rej
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scrollable-overflow-height-with-flex-item-margin-inline-end.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scrollable-overflow-input-001-expected.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scrollable-overflow-input-001-ref.html
@@ -341,6 +440,8 @@ List of files:
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scrollable-overflow-padding-inline.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scrollable-overflow-padding-input.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scrollable-overflow-padding.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scrollable-overflow-relative-positioned-block-in-inline-002.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scrollable-overflow-relative-positioned-block-in-inline.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scrollable-overflow-self-collapsing.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scrollable-overflow-textarea.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scrollable-overflow-transform-001.html
@@ -417,14 +518,10 @@ List of files:
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scrollbar-gutter-propagation-007.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scrollbar-gutter-root-both-edges-expected.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scrollbar-gutter-root-both-edges-ref.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scrollbar-gutter-root-both-edges-ref.html.rej
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scrollbar-gutter-root-both-edges.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scrollbar-gutter-root-both-edges.html.rej
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scrollbar-gutter-root-expected.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scrollbar-gutter-root-ref.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scrollbar-gutter-root-ref.html.rej
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scrollbar-gutter-root.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scrollbar-gutter-root.html.rej
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scrollbar-gutter-rtl-001.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scrollbar-gutter-rtl-002-expected.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scrollbar-gutter-rtl-002-ref.html
@@ -443,6 +540,7 @@ List of files:
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scrollbar-gutter-with-background-gradient-expected.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scrollbar-gutter-with-background-gradient-ref.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scrollbar-gutter-with-background-gradient.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scrollbar-gutter-zero-width-crash.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scrollbar-large-scale-in-iframe-expected.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scrollbar-large-scale-in-iframe-ref.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scrollbar-large-scale-in-iframe.html
@@ -454,7 +552,80 @@ List of files:
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/select-size-overflow-001-ref.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/select-size-overflow-001.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/shrink-to-fit-auto-overflow-relayout-crash.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/shrink-to-fit-overflow-auto-scrollbar-width.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/single-axis-overflow-clip-rtl-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/single-axis-overflow-clip-rtl-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/single-axis-overflow-clip-rtl.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/single-axis-overflow-scroll-to-clip-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/single-axis-overflow-scroll-to-clip-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/single-axis-overflow-scroll-to-clip.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/single-axis-scroll-apis-dynamic.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/single-axis-scroll-apis-programmatic.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/single-axis-scroll-into-view-rtl.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/single-axis-scroll-into-view.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/table-header-group-overflow-crash.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/table-max-content-with-scrollable-descendant-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/table-max-content-with-scrollable-descendant-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/table-max-content-with-scrollable-descendant.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-001-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-001.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-002-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-002.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-003-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-003.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-004-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-004.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-005-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-005.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-006-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-006.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-007-expected.xht
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-007.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-008-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-008.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-009-expected.xht
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-009.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-010-expected.xht
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-010.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-011-expected.xht
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-011.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-012-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-012.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-013-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-013.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-014-expected.xht
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-014.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-015-expected.xht
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-015.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-016-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-016.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-017.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-020-expected.xht
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-020.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-021-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-021.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-022-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-022.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-023.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-024-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-024-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-024.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-025-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-025-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-025.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-026-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-026-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-026.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-027-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-027.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-028-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-028.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-029-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-029.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-030-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-030.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-change-color-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-change-color.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-001-expected.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-001.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-002-expected.html
@@ -462,15 +633,35 @@ List of files:
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-003-expected.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-003-ref.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-003.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-abspos-in-inline-block-crash-001.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-changing-scroll-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-changing-scroll-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-changing-scroll.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-editable-div-with-caret-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-editable-div-with-caret.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-editing-input-expected.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-editing-input-ref.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-editing-input.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-hyphen.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-indent-001-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-indent-001.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-multiline-001-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-multiline-001.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-rtl-001-expected.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-rtl-001.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-self-painting.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-textarea-with-caret-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-textarea-with-caret.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-vertical-001-expected.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-vertical-001.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-vertical-rtl-001-expected.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-vertical-rtl-001.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ellipsis-width-001.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ruby-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ruby-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-ruby.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-scroll-001-expected.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-scroll-001.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-scroll-rtl-001-expected.html
@@ -483,3 +674,63 @@ List of files:
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-scroll-vertical-rl-001.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-scroll-vertical-rl-rtl-001-expected.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-scroll-vertical-rl-rtl-001.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-001-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-001.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-002-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-002.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-003-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-003.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-004-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-004.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-005-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-005.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-006-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-006.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-007-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-007.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-008-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-008.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-009-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-009.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-010-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-010.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-011-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-011.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-012-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-012.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-013-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-013.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-014-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-014.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-015-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-015.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-016-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-016.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-017-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-017.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-018-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-018.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-019-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-019.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-020-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-020.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-021-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-021.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-022-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-022.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-023-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-023.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-024.tentative-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-024.tentative.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-025.tentative-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-025.tentative.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-026.tentative-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-026.tentative.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-in-input-expected-mismatch.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-in-input-notref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-in-input.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-with-selection-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-with-selection-ref.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-with-selection.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/unicode-bidi-plaintext-scroll-direction.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/parsing/text-decoration-inset-computed-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/parsing/text-decoration-inset-computed-expected.txt
index 49ace8ee9180..04fdd737fcc9 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/parsing/text-decoration-inset-computed-expected.txt
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/parsing/text-decoration-inset-computed-expected.txt
@@ -9,4 +9,10 @@ PASS Property text-decoration-inset value '1px 2px'
 PASS Property text-decoration-inset value '1ch -1ch'
 PASS Property text-decoration-inset value 'calc(1em / 4) calc(-1ch)'
 PASS Property text-decoration-inset value 'auto'
+PASS Property text-decoration-inset value '10%'
+PASS Property text-decoration-inset value '0 20%'
+PASS Property text-decoration-inset value '10% 20%'
+PASS Property text-decoration-inset value '10px -20%'
+PASS Property text-decoration-inset value 'calc(10% - 1em) 0'
+PASS Property text-decoration-inset value 'calc(10% + 1ch) calc(-20%)'
 
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/parsing/text-decoration-inset-computed.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/parsing/text-decoration-inset-computed.html
index 692d6b95e246..7d7ac4d39f6e 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/parsing/text-decoration-inset-computed.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/parsing/text-decoration-inset-computed.html
@@ -28,5 +28,13 @@
   test_computed_value("text-decoration-inset", "1ch -1ch", "20px -20px");
   test_computed_value("text-decoration-inset", "calc(1em / 4) calc(-1ch)", "5px -20px");
   test_computed_value("text-decoration-inset", "auto");
+
+  // https://github.com/w3c/csswg-drafts/issues/8403
+  test_computed_value("text-decoration-inset", "10%");
+  test_computed_value("text-decoration-inset", "0 20%", "0px 20%");
+  test_computed_value("text-decoration-inset", "10% 20%");
+  test_computed_value("text-decoration-inset", "10px -20%");
+  test_computed_value("text-decoration-inset", "calc(10% - 1em) 0", "calc(10% - 20px) 0px");
+  test_computed_value("text-decoration-inset", "calc(10% + 1ch) calc(-20%)", "calc(10% + 20px) -20%");
 });
 </script>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/parsing/text-decoration-inset-invalid-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/parsing/text-decoration-inset-invalid-expected.txt
index 5fbfbfdfb75d..187446944e08 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/parsing/text-decoration-inset-invalid-expected.txt
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/parsing/text-decoration-inset-invalid-expected.txt
@@ -6,6 +6,6 @@ PASS e.style['text-decoration-inset'] = "0 auto" should not set the property val
 PASS e.style['text-decoration-inset'] = "auto none" should not set the property value
 PASS e.style['text-decoration-inset'] = "1px auto" should not set the property value
 PASS e.style['text-decoration-inset'] = "auto -1px" should not set the property value
-PASS e.style['text-decoration-inset'] = "10%" should not set the property value
+PASS e.style['text-decoration-inset'] = "10% auto" should not set the property value
 PASS e.style['text-decoration-inset'] = "45deg" should not set the property value
 
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/parsing/text-decoration-inset-invalid.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/parsing/text-decoration-inset-invalid.html
index aecc8e35767b..e903ed10792a 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/parsing/text-decoration-inset-invalid.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/parsing/text-decoration-inset-invalid.html
@@ -3,7 +3,7 @@
 <title>CSS Text Decoration Test: Parsing text-decoration-inset with invalid values</title>
 <link rel="author" title="Jonathan Kew" href="mailto:jkew@mozilla.com">
 <link rel="help" href="https://drafts.csswg.org/css-text-decor-4/#text-decoration-skip-inset-property">
-<meta name="assert" content="text-decoration-inset supports the full grammar '<length>{1,2} | auto'.">
+<meta name="assert" content="text-decoration-inset supports the full grammar '<length-percentage>{1,2} | auto'.">
 <script src="/resources/testharness.js"></script>
 <script src="/resources/testharnessreport.js"></script>
 <script src="/css/support/parsing-testcommon.js"></script>
@@ -15,6 +15,6 @@
 test_invalid_value("text-decoration-inset", "auto none");
 test_invalid_value("text-decoration-inset", "1px auto");
 test_invalid_value("text-decoration-inset", "auto -1px");
-test_invalid_value("text-decoration-inset", "10%");
+test_invalid_value("text-decoration-inset", "10% auto");
 test_invalid_value("text-decoration-inset", "45deg");
 </script>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/parsing/text-decoration-inset-valid-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/parsing/text-decoration-inset-valid-expected.txt
index 115049c2bf6a..3e58f6959504 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/parsing/text-decoration-inset-valid-expected.txt
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/parsing/text-decoration-inset-valid-expected.txt
@@ -9,4 +9,10 @@ PASS e.style['text-decoration-inset'] = "1px 2px" should set the property value
 PASS e.style['text-decoration-inset'] = "1ch -1ch" should set the property value
 PASS e.style['text-decoration-inset'] = "calc(1em / 4) calc(-1ch)" should set the property value
 PASS e.style['text-decoration-inset'] = "auto" should set the property value
+PASS e.style['text-decoration-inset'] = "10%" should set the property value
+PASS e.style['text-decoration-inset'] = "0 20%" should set the property value
+PASS e.style['text-decoration-inset'] = "10% 20%" should set the property value
+PASS e.style['text-decoration-inset'] = "10px -20%" should set the property value
+PASS e.style['text-decoration-inset'] = "calc(10% - 1em) 0" should set the property value
+PASS e.style['text-decoration-inset'] = "calc(10% + 1ch) calc(-20%)" should set the property value
 
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/parsing/text-decoration-inset-valid.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/parsing/text-decoration-inset-valid.html
index 59ea5632865c..f402ca8183ef 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/parsing/text-decoration-inset-valid.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/parsing/text-decoration-inset-valid.html
@@ -18,4 +18,12 @@
 test_valid_value("text-decoration-inset", "1ch -1ch");
 test_valid_value("text-decoration-inset", "calc(1em / 4) calc(-1ch)", "calc(0.25em) calc(-1ch)");
 test_valid_value("text-decoration-inset", "auto");
+
+// https://github.com/w3c/csswg-drafts/issues/8403
+test_valid_value("text-decoration-inset", "10%");
+test_valid_value("text-decoration-inset", "0 20%", "0px 20%");
+test_valid_value("text-decoration-inset", "10% 20%");
+test_valid_value("text-decoration-inset", "10px -20%");
+test_valid_value("text-decoration-inset", "calc(10% - 1em) 0", "calc(10% - 1em) 0px");
+test_valid_value("text-decoration-inset", "calc(10% + 1ch) calc(-20%)");
 </script>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/reference/text-decoration-inset-026-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/reference/text-decoration-inset-026-ref.html
new file mode 100644
index 000000000000..edc00dea6e0b
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/reference/text-decoration-inset-026-ref.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Text Decoration 4 reference: text-decoration-inset percentage</title>
+<link rel="help" href="https://drafts.csswg.org/css-text-decor-4/#text-decoration-inset-property">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css">
+<style>
+  body { background: white; color: black; font: 20px/2 Ahem; }
+  u {
+    text-decoration-line: underline;
+    text-decoration-color: blue;
+    text-decoration-thickness: 2px;
+    text-underline-offset: 5px;
+  }
+</style>
+
+<p>a<u>bcdefgh</u>ij</p>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/reference/text-decoration-inset-027-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/reference/text-decoration-inset-027-ref.html
new file mode 100644
index 000000000000..4ef861117d64
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/reference/text-decoration-inset-027-ref.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Text Decoration 4 reference: text-decoration-inset calc</title>
+<link rel="help" href="https://drafts.csswg.org/css-text-decor-4/#text-decoration-inset-property">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css">
+<style>
+  body { background: white; color: black; font: 20px/2 Ahem; }
+  u {
+    text-decoration-line: underline;
+    text-decoration-color: blue;
+    text-decoration-thickness: 2px;
+    text-underline-offset: 5px;
+  }
+</style>
+
+<p>a<u>bcdefghij&nbsp&nbsp</u></p>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/reference/text-decoration-inset-028-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/reference/text-decoration-inset-028-ref.html
new file mode 100644
index 000000000000..ab565c274e7b
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/reference/text-decoration-inset-028-ref.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Text Decoration 4 reference: text-decoration-inset percentage with b-d-b slice</title>
+<link rel="help" href="https://drafts.csswg.org/css-text-decor-4/#text-decoration-inset-property">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css">
+<style>
+  body { background: white; color: black; font: 20px/2 Ahem; }
+  u {
+    text-decoration-line: underline;
+    text-decoration-color: blue;
+    text-decoration-thickness: 2px;
+    text-underline-offset: 5px;
+  }
+</style>
+
+<div style="width: 100px;">
+  <p>a<u>bcde fgh</u>ij</p>
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/reference/text-decoration-inset-029-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/reference/text-decoration-inset-029-ref.html
new file mode 100644
index 000000000000..2411a16c7519
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/reference/text-decoration-inset-029-ref.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Text Decoration 4 reference: text-decoration-inset percentage with b-d-b clone</title>
+<link rel="help" href="https://drafts.csswg.org/css-text-decor-4/#text-decoration-inset-property">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css">
+<style>
+  body { background: white; color: black; font: 20px/2 Ahem; }
+  u {
+    text-decoration-line: underline;
+    text-decoration-color: blue;
+    text-decoration-thickness: 2px;
+    text-underline-offset: 5px;
+  }
+</style>
+
+<div style="width: 100px;">
+  <p>a<u>bc</u>de f<u>gh</u>ij</p>
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/reference/text-decoration-inset-percentage-slice-multiline-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/reference/text-decoration-inset-percentage-slice-multiline-ref.html
new file mode 100644
index 000000000000..3ac42704c055
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/reference/text-decoration-inset-percentage-slice-multiline-ref.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Reference: percentage text-decoration-inset over three line fragments</title>
+<link rel="stylesheet" href="/fonts/ahem.css">
+<style>
+  div {
+    width: 100px;
+    font: 20px/2 Ahem;
+  }
+  u {
+    text-decoration-line: underline;
+    text-decoration-color: blue;
+    text-decoration-thickness: 2px;
+  }
+</style>
+<div><p>abcde f<u>ghi</u>j klmno</p></div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/reference/text-decoration-inset-percentage-slice-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/reference/text-decoration-inset-percentage-slice-ref.html
new file mode 100644
index 000000000000..04c43d55866a
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/reference/text-decoration-inset-percentage-slice-ref.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Reference: percentage text-decoration-inset resolves against the whole decorated run with box-decoration-break: slice</title>
+<style>
+  div {
+    font: 48px/2 monospace;
+  }
+  u {
+    text-decoration-line: underline;
+    text-decoration-color: black;
+    text-decoration-thickness: 4px;
+  }
+</style>
+<div>A<u>BC</u>D</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-009.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-009.html
index 3f4c229e67d9..a519a5ab02e5 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-009.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-009.html
@@ -1,5 +1,6 @@
 <!DOCTYPE html>
 <meta charset="utf-8">
+<meta name="fuzzy" content="maxDifference=0-175; totalPixels=0-4">
 
 <title>CSS Text Decoration 4: text-decoration-inset</title>
 
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-014.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-014.html
index ea33cea453e5..7b390a9d6030 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-014.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-014.html
@@ -1,5 +1,6 @@
 <!DOCTYPE html>
 <meta charset="utf-8">
+<meta name="fuzzy" content="maxDifference=0-255; totalPixels=0-6">
 
 <title>CSS Text Decoration 4: text-decoration-inset</title>
 
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-026-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-026-expected.html
new file mode 100644
index 000000000000..edc00dea6e0b
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-026-expected.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Text Decoration 4 reference: text-decoration-inset percentage</title>
+<link rel="help" href="https://drafts.csswg.org/css-text-decor-4/#text-decoration-inset-property">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css">
+<style>
+  body { background: white; color: black; font: 20px/2 Ahem; }
+  u {
+    text-decoration-line: underline;
+    text-decoration-color: blue;
+    text-decoration-thickness: 2px;
+    text-underline-offset: 5px;
+  }
+</style>
+
+<p>a<u>bcdefgh</u>ij</p>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-026.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-026.html
new file mode 100644
index 000000000000..b8499b43e0a3
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-026.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Text Decoration 4: text-decoration-inset percentage</title>
+<link rel="help" href="https://drafts.csswg.org/css-text-decor-4/#text-decoration-inset-property">
+<link rel="help" href="https://github.com/w3c/csswg-drafts/issues/8403">
+<link rel="match" href="reference/text-decoration-inset-026-ref.html">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css">
+<style>
+  body { background: white; color: black; font: 20px/2 Ahem; }
+  p {
+    text-decoration-line: underline;
+    text-decoration-color: blue;
+    text-decoration-thickness: 2px;
+    text-underline-offset: 5px;
+    text-decoration-inset: 10% 20%;
+  }
+</style>
+
+<!-- Underline should be inset 10% (20px) from start and 20% (40px) from end -->
+
+<p>abcdefghij</p>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-027-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-027-expected.html
new file mode 100644
index 000000000000..4ef861117d64
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-027-expected.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Text Decoration 4 reference: text-decoration-inset calc</title>
+<link rel="help" href="https://drafts.csswg.org/css-text-decor-4/#text-decoration-inset-property">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css">
+<style>
+  body { background: white; color: black; font: 20px/2 Ahem; }
+  u {
+    text-decoration-line: underline;
+    text-decoration-color: blue;
+    text-decoration-thickness: 2px;
+    text-underline-offset: 5px;
+  }
+</style>
+
+<p>a<u>bcdefghij&nbsp&nbsp</u></p>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-027.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-027.html
new file mode 100644
index 000000000000..8bb94fe9fe49
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-027.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Text Decoration 4: text-decoration-inset calc</title>
+<link rel="help" href="https://drafts.csswg.org/css-text-decor-4/#text-decoration-inset-property">
+<link rel="help" href="https://github.com/w3c/csswg-drafts/issues/8403">
+<link rel="match" href="reference/text-decoration-inset-027-ref.html">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css">
+<style>
+  body { background: white; color: black; font: 20px/2 Ahem; }
+  p {
+    text-decoration-line: underline;
+    text-decoration-color: blue;
+    text-decoration-thickness: 2px;
+    text-underline-offset: 5px;
+    text-decoration-inset: calc(5% + 10px) calc(-10% - 20px);
+  }
+</style>
+
+<!-- Underline should be inset 20px from start and 40px from end. -->
+
+<p>abcdefghij</p>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-028-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-028-expected.html
new file mode 100644
index 000000000000..ab565c274e7b
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-028-expected.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Text Decoration 4 reference: text-decoration-inset percentage with b-d-b slice</title>
+<link rel="help" href="https://drafts.csswg.org/css-text-decor-4/#text-decoration-inset-property">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css">
+<style>
+  body { background: white; color: black; font: 20px/2 Ahem; }
+  u {
+    text-decoration-line: underline;
+    text-decoration-color: blue;
+    text-decoration-thickness: 2px;
+    text-underline-offset: 5px;
+  }
+</style>
+
+<div style="width: 100px;">
+  <p>a<u>bcde fgh</u>ij</p>
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-028.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-028.html
new file mode 100644
index 000000000000..5360d0e986f2
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-028.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Text Decoration 4: text-decoration-inset percentage with b-d-b slice</title>
+<link rel="help" href="https://drafts.csswg.org/css-text-decor-4/#text-decoration-inset-property">
+<link rel="help" href="https://github.com/w3c/csswg-drafts/issues/8403">
+<link rel="match" href="reference/text-decoration-inset-028-ref.html">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css">
+<style>
+  body { background: white; color: black; font: 20px/2 Ahem; }
+  p {
+    text-decoration-line: underline;
+    text-decoration-color: blue;
+    text-decoration-thickness: 2px;
+    text-underline-offset: 5px;
+    text-decoration-inset: 10% 20%;
+    box-decoration-break: slice;
+  }
+</style>
+
+<div style="width: 100px;">
+  <p>abcde fghij</p>
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-029-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-029-expected.html
new file mode 100644
index 000000000000..2411a16c7519
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-029-expected.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Text Decoration 4 reference: text-decoration-inset percentage with b-d-b clone</title>
+<link rel="help" href="https://drafts.csswg.org/css-text-decor-4/#text-decoration-inset-property">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css">
+<style>
+  body { background: white; color: black; font: 20px/2 Ahem; }
+  u {
+    text-decoration-line: underline;
+    text-decoration-color: blue;
+    text-decoration-thickness: 2px;
+    text-underline-offset: 5px;
+  }
+</style>
+
+<div style="width: 100px;">
+  <p>a<u>bc</u>de f<u>gh</u>ij</p>
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-029.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-029.html
new file mode 100644
index 000000000000..d8e512dfafd3
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-029.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Text Decoration 4: text-decoration-inset percentage with b-d-b clone</title>
+<link rel="help" href="https://drafts.csswg.org/css-text-decor-4/#text-decoration-inset-property">
+<link rel="help" href="https://github.com/w3c/csswg-drafts/issues/8403">
+<link rel="match" href="reference/text-decoration-inset-029-ref.html">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css">
+<style>
+  body { background: white; color: black; font: 20px/2 Ahem; }
+  p {
+    text-decoration-line: underline;
+    text-decoration-color: blue;
+    text-decoration-thickness: 2px;
+    text-underline-offset: 5px;
+    text-decoration-inset: 20% 40%;
+    box-decoration-break: clone;
+  }
+</style>
+
+<div style="width: 100px;">
+  <p>abcde fghij</p>
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-030-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-030-expected.html
new file mode 100644
index 000000000000..ab565c274e7b
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-030-expected.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Text Decoration 4 reference: text-decoration-inset percentage with b-d-b slice</title>
+<link rel="help" href="https://drafts.csswg.org/css-text-decor-4/#text-decoration-inset-property">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css">
+<style>
+  body { background: white; color: black; font: 20px/2 Ahem; }
+  u {
+    text-decoration-line: underline;
+    text-decoration-color: blue;
+    text-decoration-thickness: 2px;
+    text-underline-offset: 5px;
+  }
+</style>
+
+<div style="width: 100px;">
+  <p>a<u>bcde fgh</u>ij</p>
+</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-030.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-030.html
new file mode 100644
index 000000000000..7ffe4c77752b
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-030.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Text Decoration 4: text-decoration-inset percentage with b-d-b slice and br</title>
+<link rel="help" href="https://drafts.csswg.org/css-text-decor-4/#text-decoration-inset-property">
+<link rel="help" href="https://github.com/w3c/csswg-drafts/issues/8403">
+<link rel="match" href="reference/text-decoration-inset-028-ref.html">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css">
+<style>
+  body { background: white; color: black; font: 20px/2 Ahem; }
+  p {
+    text-decoration-line: underline;
+    text-decoration-color: blue;
+    text-decoration-thickness: 2px;
+    text-underline-offset: 5px;
+    text-decoration-inset: 10% 20%;
+    box-decoration-break: slice;
+  }
+</style>
+
+<p>abcde<br>fghij</p>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-clone-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-clone-expected.html
new file mode 100644
index 000000000000..1fb80ae660c9
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-clone-expected.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html> <!-- webkit-test-runner [ CSSTextDecorationInsetEnabled=true ] -->
+<meta charset="utf-8">
+<title>CSS Text Decoration: with box-decoration-break: clone a percentage inset resolves per fragment (reference)</title>
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css">
+<style>
+body { margin: 20px; }
+div { width: 100px; font: 20px/2 Ahem; }
+u {
+  text-decoration-line: underline;
+  text-decoration-color: blue;
+  text-decoration-thickness: 2px;
+  text-underline-offset: 5px;
+}
+</style>
+
+<div>a<u>bcd</u>e f<u>ghi</u>j</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-clone.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-clone.html
new file mode 100644
index 000000000000..fe1541738e31
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-clone.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html> <!-- webkit-test-runner [ CSSTextDecorationInsetEnabled=true ] -->
+<meta charset="utf-8">
+<title>CSS Text Decoration: with box-decoration-break: clone a percentage inset resolves per fragment</title>
+<link rel="help" href="https://drafts.csswg.org/css-text-decor-4/#text-decoration-inset-property">
+<link rel="help" href="https://drafts.csswg.org/css-break-4/#propdef-box-decoration-break">
+<link rel="match" href="text-decoration-inset-percentage-clone-expected.html">
+<meta name="assert" content="For box-decoration-break: clone each fragment is a complete box, so a percentage inset resolves against that fragment's own inline size and both endpoints are inset on every line. Uses -webkit-box-decoration-break because WebKit does not support the unprefixed property.">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css">
+<style>
+body { margin: 20px; }
+div { width: 100px; font: 20px/2 Ahem; }
+u {
+  text-decoration-line: underline;
+  text-decoration-color: blue;
+  text-decoration-thickness: 2px;
+  text-underline-offset: 5px;
+}
+</style>
+
+<!-- Each of the two lines is a 100px fragment, so 20% trims 20px from both ends of each line
+     independently: "abcde" keeps only "bcd", and "fghij" keeps only "ghi". -->
+
+<div><u style="text-decoration-inset: 20%; -webkit-box-decoration-break: clone">abcde fghij</u></div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-equivalence-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-equivalence-expected.html
new file mode 100644
index 000000000000..f4fe7cda170c
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-equivalence-expected.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html> <!-- webkit-test-runner [ CSSTextDecorationInsetEnabled=true ] -->
+<meta charset="utf-8">
+<title>CSS Text Decoration: a percentage text-decoration-inset matches the equivalent length (reference)</title>
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css">
+<style>
+body { margin: 20px; }
+u {
+  font: 20px/2 Ahem;
+  text-decoration-line: underline;
+  text-decoration-color: blue;
+  text-decoration-thickness: 2px;
+  text-underline-offset: 5px;
+}
+</style>
+
+<p><u style="text-decoration-inset: 50px">abcdefghij</u></p>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-equivalence.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-equivalence.html
new file mode 100644
index 000000000000..45a0c7fce0fa
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-equivalence.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html> <!-- webkit-test-runner [ CSSTextDecorationInsetEnabled=true ] -->
+<meta charset="utf-8">
+<title>CSS Text Decoration: a percentage text-decoration-inset matches the equivalent length</title>
+<link rel="help" href="https://drafts.csswg.org/css-text-decor-4/#text-decoration-inset-property">
+<link rel="match" href="text-decoration-inset-percentage-equivalence-expected.html">
+<meta name="assert" content="On a single-fragment decorating box of known inline size, a percentage inset resolves against that inline size, so '25%' of a 200px box paints identically to '50px'.">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css">
+<style>
+body { margin: 20px; }
+u {
+  font: 20px/2 Ahem;
+  text-decoration-line: underline;
+  text-decoration-color: blue;
+  text-decoration-thickness: 2px;
+  text-underline-offset: 5px;
+}
+</style>
+
+<!-- The <u> is exactly 10ch = 200px wide, so 25% resolves to 50px at each endpoint. -->
+
+<p><u style="text-decoration-inset: 25%">abcdefghij</u></p>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-negative-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-negative-expected.html
new file mode 100644
index 000000000000..af15780a9f19
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-negative-expected.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html> <!-- webkit-test-runner [ CSSTextDecorationInsetEnabled=true ] -->
+<meta charset="utf-8">
+<title>CSS Text Decoration: a negative percentage text-decoration-inset extends the decoration (reference)</title>
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css">
+<style>
+body { margin: 80px; }
+u {
+  font: 20px/2 Ahem;
+  text-decoration-line: underline;
+  text-decoration-color: blue;
+  text-decoration-thickness: 2px;
+  text-underline-offset: 5px;
+}
+</style>
+
+<p><u style="text-decoration-inset: -50px">abcdefghij</u></p>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-negative-grow-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-negative-grow-expected.html
new file mode 100644
index 000000000000..ec38f4be666d
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-negative-grow-expected.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html> <!-- webkit-test-runner [ CSSTextDecorationInsetEnabled=true ] -->
+<meta charset="utf-8">
+<title>CSS Text Decoration: growing a negative percentage inset re-expands the ink overflow (reference)</title>
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css">
+<style>
+body { margin: 80px; }
+div { will-change: transform; width: max-content; }
+u {
+  font: 20px/2 Ahem;
+  text-decoration-line: underline;
+  text-decoration-color: blue;
+  text-decoration-thickness: 2px;
+  text-underline-offset: 5px;
+}
+</style>
+
+<div><u style="text-decoration-inset: -50px">abcdefghij</u></div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-negative-grow.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-negative-grow.html
new file mode 100644
index 000000000000..a6c539b51a4b
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-negative-grow.html
@@ -0,0 +1,35 @@
+<!DOCTYPE html> <!-- webkit-test-runner [ CSSTextDecorationInsetEnabled=true ] -->
+<html class="reftest-wait">
+<meta charset="utf-8">
+<title>CSS Text Decoration: growing a negative percentage inset re-expands the ink overflow</title>
+<link rel="help" href="https://drafts.csswg.org/css-text-decor-4/#text-decoration-inset-property">
+<link rel="match" href="text-decoration-inset-percentage-negative-grow-expected.html">
+<meta name="assert" content="Changing a negative percentage text-decoration-inset to a larger one must recompute the ink overflow, so the newly extended part of the underline is painted rather than clipped to the previous overhang.">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css">
+<style>
+body { margin: 80px; }
+div { will-change: transform; width: max-content; }
+u {
+  font: 20px/2 Ahem;
+  text-decoration-line: underline;
+  text-decoration-color: blue;
+  text-decoration-thickness: 2px;
+  text-underline-offset: 5px;
+  text-decoration-inset: -5%;
+}
+</style>
+
+<!-- The <u> is 10ch = 200px wide. It is laid out with a -5% (10px) overhang and then changed to
+     -25% (50px), which must grow the ink overflow of the composited layer accordingly. -->
+
+<div><u id="target">abcdefghij</u></div>
+
+<script>
+requestAnimationFrame(() => requestAnimationFrame(() => {
+  document.getElementById("target").style.textDecorationInset = "-25%";
+  requestAnimationFrame(() => requestAnimationFrame(() => {
+    document.documentElement.classList.remove("reftest-wait");
+  }));
+}));
+</script>
+</html>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-negative-incremental-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-negative-incremental-expected.html
new file mode 100644
index 000000000000..b1b69b7bc02b
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-negative-incremental-expected.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html> <!-- webkit-test-runner [ CSSTextDecorationInsetEnabled=true ] -->
+<meta charset="utf-8">
+<title>CSS Text Decoration: a negative percentage inset survives an incremental relayout of a later line (reference)</title>
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css">
+<style>
+body { margin: 100px; }
+div { width: 100px; will-change: transform; }
+p { font: 20px/2 Ahem; }
+u {
+  text-decoration-line: underline;
+  text-decoration-color: blue;
+  text-decoration-thickness: 2px;
+  text-underline-offset: 5px;
+  text-decoration-inset: -120px;
+}
+</style>
+
+<div><p><u>abcde fghij klmno</u></p></div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-negative-incremental.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-negative-incremental.html
new file mode 100644
index 000000000000..f951ae477231
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-negative-incremental.html
@@ -0,0 +1,35 @@
+<!DOCTYPE html> <!-- webkit-test-runner [ CSSTextDecorationInsetEnabled=true ] -->
+<html class="reftest-wait">
+<meta charset="utf-8">
+<title>CSS Text Decoration: a negative percentage inset survives an incremental relayout of a later line</title>
+<link rel="help" href="https://drafts.csswg.org/css-text-decor-4/#text-decoration-inset-property">
+<link rel="match" href="text-decoration-inset-percentage-negative-incremental-expected.html">
+<meta name="assert" content="Editing the text of a later line triggers a partial line-layout update. The overhang of a negative percentage inset must be applied exactly once to the relaid-out lines and must not be re-applied to the untouched ones.">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css">
+<style>
+body { margin: 100px; }
+div { width: 100px; will-change: transform; }
+p { font: 20px/2 Ahem; }
+u {
+  text-decoration-line: underline;
+  text-decoration-color: blue;
+  text-decoration-thickness: 2px;
+  text-underline-offset: 5px;
+  text-decoration-inset: -40%;
+}
+</style>
+
+<!-- Starts as "abcde fghij klmnX", then the trailing X is corrected to o. That damages only the last
+     line, so the earlier lines keep their previously computed ink overflow. -->
+
+<div><p><u id="target">abcde fghij klmnX</u></p></div>
+
+<script>
+requestAnimationFrame(() => requestAnimationFrame(() => {
+  document.getElementById("target").firstChild.data = "abcde fghij klmno";
+  requestAnimationFrame(() => requestAnimationFrame(() => {
+    document.documentElement.classList.remove("reftest-wait");
+  }));
+}));
+</script>
+</html>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-negative-layer-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-negative-layer-expected.html
new file mode 100644
index 000000000000..c75c2ac70165
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-negative-layer-expected.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html> <!-- webkit-test-runner [ CSSTextDecorationInsetEnabled=true ] -->
+<meta charset="utf-8">
+<title>CSS Text Decoration: a negative percentage inset is not clipped by a composited layer (reference)</title>
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css">
+<style>
+body { margin: 80px; }
+div { will-change: transform; width: max-content; }
+u {
+  font: 20px/2 Ahem;
+  text-decoration-line: underline;
+  text-decoration-color: blue;
+  text-decoration-thickness: 2px;
+  text-underline-offset: 5px;
+}
+</style>
+
+<div><u style="text-decoration-inset: -50px">abcdefghij</u></div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-negative-layer.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-negative-layer.html
new file mode 100644
index 000000000000..99184f5a323d
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-negative-layer.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html> <!-- webkit-test-runner [ CSSTextDecorationInsetEnabled=true ] -->
+<meta charset="utf-8">
+<title>CSS Text Decoration: a negative percentage inset is not clipped by a composited layer</title>
+<link rel="help" href="https://drafts.csswg.org/css-text-decor-4/#text-decoration-inset-property">
+<link rel="match" href="text-decoration-inset-percentage-negative-layer-expected.html">
+<meta name="assert" content="A composited layer is sized from the content's ink overflow, so the overhang of a negative percentage inset must be included in that overflow and painted, exactly as an equivalent negative length is.">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css">
+<style>
+body { margin: 80px; }
+div { will-change: transform; width: max-content; }
+u {
+  font: 20px/2 Ahem;
+  text-decoration-line: underline;
+  text-decoration-color: blue;
+  text-decoration-thickness: 2px;
+  text-underline-offset: 5px;
+}
+</style>
+
+<!-- The <u> is 10ch = 200px wide, so -25% extends each endpoint outward by 50px. -->
+
+<div><u style="text-decoration-inset: -25%">abcdefghij</u></div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-negative-multiline-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-negative-multiline-expected.html
new file mode 100644
index 000000000000..d51cd255ec85
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-negative-multiline-expected.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html> <!-- webkit-test-runner [ CSSTextDecorationInsetEnabled=true ] -->
+<meta charset="utf-8">
+<title>CSS Text Decoration: a negative percentage inset on a multi-line box extends by a percentage of the whole box (reference)</title>
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css">
+<style>
+body { margin: 100px; }
+div { width: 100px; will-change: transform; }
+p { font: 20px/2 Ahem; }
+u {
+  text-decoration-line: underline;
+  text-decoration-color: blue;
+  text-decoration-thickness: 2px;
+  text-underline-offset: 5px;
+  text-decoration-inset: -120px;
+}
+</style>
+
+<div><p><u>abcde fghij klmno</u></p></div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-negative-multiline.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-negative-multiline.html
new file mode 100644
index 000000000000..9aa846ed3aa4
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-negative-multiline.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html> <!-- webkit-test-runner [ CSSTextDecorationInsetEnabled=true ] -->
+<meta charset="utf-8">
+<title>CSS Text Decoration: a negative percentage inset on a multi-line box extends by a percentage of the whole box</title>
+<link rel="help" href="https://drafts.csswg.org/css-text-decor-4/#text-decoration-inset-property">
+<link rel="match" href="text-decoration-inset-percentage-negative-multiline-expected.html">
+<meta name="assert" content="With box-decoration-break: slice the percentage resolves against the inline size of the whole decorating box, not of one line fragment, and the resulting outward overhang must be painted rather than clipped to the individual line's ink overflow.">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css">
+<style>
+body { margin: 100px; }
+div { width: 100px; will-change: transform; }
+p { font: 20px/2 Ahem; }
+u {
+  text-decoration-line: underline;
+  text-decoration-color: blue;
+  text-decoration-thickness: 2px;
+  text-underline-offset: 5px;
+  text-decoration-inset: -40%;
+}
+</style>
+
+<!-- The text wraps into three 100px fragments, so the decorating box is 300px and -40% extends each
+     endpoint outward by 120px - far more than any single line is wide. The composited layer means a
+     line whose ink overflow is too small would clip the overhang instead of painting it. -->
+
+<div><p><u>abcde fghij klmno</u></p></div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-negative-propagated-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-negative-propagated-expected.html
new file mode 100644
index 000000000000..eebe60bde18e
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-negative-propagated-expected.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html> <!-- webkit-test-runner [ CSSTextDecorationInsetEnabled=true ] -->
+<meta charset="utf-8">
+<title>CSS Text Decoration: a negative percentage inset extends a decoration that propagates to a descendant (reference)</title>
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css">
+<style>
+body { margin: 120px 200px; }
+div {
+  font: 20px/2 Ahem;
+  width: max-content;
+  will-change: transform;
+  text-decoration-line: underline;
+  text-decoration-color: blue;
+  text-decoration-thickness: 2px;
+  text-underline-offset: 5px;
+  text-decoration-inset: -100px;
+}
+</style>
+
+<!-- Bare text, so the reference does not depend on the propagated-decoration path being correct. -->
+<div>abcdefghij</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-negative-propagated.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-negative-propagated.html
new file mode 100644
index 000000000000..cb71af656148
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-negative-propagated.html
@@ -0,0 +1,26 @@
+<!DOCTYPE html> <!-- webkit-test-runner [ CSSTextDecorationInsetEnabled=true ] -->
+<meta charset="utf-8">
+<title>CSS Text Decoration: a negative percentage inset extends a decoration that propagates to a descendant</title>
+<link rel="help" href="https://drafts.csswg.org/css-text-decor-4/#text-decoration-inset-property">
+<link rel="match" href="text-decoration-inset-percentage-negative-propagated-expected.html">
+<meta name="assert" content="text-decoration-inset is not inherited, so an inset on the box that originates the decoration applies even when the text is inside a descendant inline box. The outward overhang of a negative percentage must be painted rather than clipped, which requires reading the inset off the originating box rather than off the text's immediate parent.">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css">
+<style>
+body { margin: 120px 200px; }
+div {
+  font: 20px/2 Ahem;
+  width: max-content;
+  will-change: transform;
+  text-decoration-line: underline;
+  text-decoration-color: blue;
+  text-decoration-thickness: 2px;
+  text-underline-offset: 5px;
+  text-decoration-inset: -50%;
+}
+</style>
+
+<!-- The decoration originates on the div; the text sits inside a span, so the text box's immediate
+     parent is not the box carrying the inset. The div is 10ch = 200px, so -50% extends each endpoint
+     outward by 100px. The composited layer means an ink overflow that missed the inset would clip it. -->
+
+<div><span>abcdefghij</span></div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-negative-repaint-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-negative-repaint-expected.html
new file mode 100644
index 000000000000..ac4e5739619f
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-negative-repaint-expected.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html> <!-- webkit-test-runner [ CSSTextDecorationInsetEnabled=true ] -->
+<meta charset="utf-8">
+<title>CSS Text Decoration: a negative percentage inset repaints its overhang on a dynamic change (reference)</title>
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css">
+<style>
+body { margin: 80px; }
+u {
+  font: 20px/2 Ahem;
+  text-decoration-line: underline;
+  text-decoration-color: blue;
+  text-decoration-thickness: 2px;
+  text-underline-offset: 5px;
+}
+</style>
+
+<p><u style="text-decoration-inset: -50px">abcdefghij</u></p>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-negative-repaint.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-negative-repaint.html
new file mode 100644
index 000000000000..23534aa241bf
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-negative-repaint.html
@@ -0,0 +1,33 @@
+<!DOCTYPE html> <!-- webkit-test-runner [ CSSTextDecorationInsetEnabled=true ] -->
+<html class="reftest-wait">
+<meta charset="utf-8">
+<title>CSS Text Decoration: a negative percentage inset repaints its overhang on a dynamic change</title>
+<link rel="help" href="https://drafts.csswg.org/css-text-decor-4/#text-decoration-inset-property">
+<link rel="match" href="text-decoration-inset-percentage-negative-repaint-expected.html">
+<meta name="assert" content="Turning on a negative percentage text-decoration-inset after the first paint repaints the newly extended part of the underline; the overhang must not be left clipped to the un-inset ink overflow.">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css">
+<style>
+body { margin: 80px; }
+u {
+  font: 20px/2 Ahem;
+  text-decoration-line: underline;
+  text-decoration-color: blue;
+  text-decoration-thickness: 2px;
+  text-underline-offset: 5px;
+}
+</style>
+
+<!-- The <u> is 10ch = 200px wide, so -25% extends each endpoint outward by 50px. Applying it after
+     the initial layout/paint exercises the repaint path rather than the first-paint path. -->
+
+<p><u id="target">abcdefghij</u></p>
+
+<script>
+requestAnimationFrame(() => requestAnimationFrame(() => {
+  document.getElementById("target").style.textDecorationInset = "-25%";
+  requestAnimationFrame(() => requestAnimationFrame(() => {
+    document.documentElement.classList.remove("reftest-wait");
+  }));
+}));
+</script>
+</html>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-negative.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-negative.html
new file mode 100644
index 000000000000..15b8ca64d260
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-negative.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html> <!-- webkit-test-runner [ CSSTextDecorationInsetEnabled=true ] -->
+<meta charset="utf-8">
+<title>CSS Text Decoration: a negative percentage text-decoration-inset extends the decoration</title>
+<link rel="help" href="https://drafts.csswg.org/css-text-decor-4/#text-decoration-inset-property">
+<link rel="match" href="text-decoration-inset-percentage-negative-expected.html">
+<meta name="assert" content="A negative percentage moves the endpoints outward by that percentage of the decorating box's inline size, and the resulting overhang is painted rather than clipped: '-25%' of a 200px box paints identically to '-50px'.">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css">
+<style>
+body { margin: 80px; }
+u {
+  font: 20px/2 Ahem;
+  text-decoration-line: underline;
+  text-decoration-color: blue;
+  text-decoration-thickness: 2px;
+  text-underline-offset: 5px;
+}
+</style>
+
+<!-- The <u> is exactly 10ch = 200px wide, so -25% extends each endpoint outward by 50px. -->
+
+<p><u style="text-decoration-inset: -25%">abcdefghij</u></p>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-padding-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-padding-expected.html
new file mode 100644
index 000000000000..38a7b74b95a9
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-padding-expected.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html> <!-- webkit-test-runner [ CSSTextDecorationInsetEnabled=true ] -->
+<meta charset="utf-8">
+<title>CSS Text Decoration: a percentage inset resolves against the decorating box including its padding (reference)</title>
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css">
+<style>
+body { margin: 20px; }
+u {
+  font: 20px/2 Ahem;
+  padding: 0 40px;
+  text-decoration-line: underline;
+  text-decoration-color: blue;
+  text-decoration-thickness: 2px;
+  text-underline-offset: 5px;
+  text-decoration-inset: 60px;
+}
+b { font-weight: normal; }
+</style>
+
+<!-- 25% of the 240px decorating box is 60px. -->
+
+<div><u>aaaa<b>bbbb</b></u></div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-padding.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-padding.html
new file mode 100644
index 000000000000..8d693e1a6160
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-padding.html
@@ -0,0 +1,27 @@
+<!DOCTYPE html> <!-- webkit-test-runner [ CSSTextDecorationInsetEnabled=true ] -->
+<meta charset="utf-8">
+<title>CSS Text Decoration: a percentage inset resolves against the decorating box including its padding</title>
+<link rel="help" href="https://drafts.csswg.org/css-text-decor-4/#text-decoration-inset-property">
+<link rel="match" href="text-decoration-inset-percentage-padding-expected.html">
+<meta name="assert" content="The percentage resolves against the inline size of the decorating box, which includes the box's own padding and every text run inside it - not against the individual text run being painted.">
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css">
+<style>
+body { margin: 20px; }
+u {
+  font: 20px/2 Ahem;
+  padding: 0 40px;
+  text-decoration-line: underline;
+  text-decoration-color: blue;
+  text-decoration-thickness: 2px;
+  text-underline-offset: 5px;
+  text-decoration-inset: 25%;
+}
+b { font-weight: normal; }
+</style>
+
+<!-- The <u> is 40px padding + 4ch + 4ch + 40px = 240px, and its content is split into three text runs
+     by the <b>. 25% of the decorating box is 60px, trimming 60px from each end. Resolving against the
+     painted text run (80px, giving 20px) or against the runs without the padding (160px, giving 40px)
+     would both leave a longer underline. -->
+
+<div><u>aaaa<b>bbbb</b></u></div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-slice-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-slice-expected.html
new file mode 100644
index 000000000000..04c43d55866a
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-slice-expected.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Reference: percentage text-decoration-inset resolves against the whole decorated run with box-decoration-break: slice</title>
+<style>
+  div {
+    font: 48px/2 monospace;
+  }
+  u {
+    text-decoration-line: underline;
+    text-decoration-color: black;
+    text-decoration-thickness: 4px;
+  }
+</style>
+<div>A<u>BC</u>D</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-slice-multiline-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-slice-multiline-expected.html
new file mode 100644
index 000000000000..3ac42704c055
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-slice-multiline-expected.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Reference: percentage text-decoration-inset over three line fragments</title>
+<link rel="stylesheet" href="/fonts/ahem.css">
+<style>
+  div {
+    width: 100px;
+    font: 20px/2 Ahem;
+  }
+  u {
+    text-decoration-line: underline;
+    text-decoration-color: blue;
+    text-decoration-thickness: 2px;
+  }
+</style>
+<div><p>abcde f<u>ghi</u>j klmno</p></div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-slice-multiline.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-slice-multiline.html
new file mode 100644
index 000000000000..63d1166959c3
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-slice-multiline.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Text Decoration 4: percentage text-decoration-inset over three line fragments</title>
+<link rel="help" href="https://drafts.csswg.org/css-text-decor-4/#text-decoration-inset-property">
+<link rel="author" title="Helmut Januschka" href="mailto:helmut@januschka.com">
+<link rel="match" href="reference/text-decoration-inset-percentage-slice-multiline-ref.html">
+<link rel="stylesheet" href="/fonts/ahem.css">
+<style>
+  div {
+    width: 100px;
+    font: 20px/2 Ahem;
+  }
+  u {
+    text-decoration-line: underline;
+    text-decoration-color: blue;
+    text-decoration-thickness: 2px;
+    text-decoration-inset: 40%;
+    box-decoration-break: slice;
+  }
+</style>
+<!-- The single text node wraps into three fragments. The middle fragment is
+     neither first nor last. The 40% inset resolves to 120px against the 300px
+     decorated run, consuming the first and last lines and carrying 20px into
+     each edge of the middle line. -->
+<div><p><u>abcde fghij klmno</u></p></div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-slice.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-slice.html
new file mode 100644
index 000000000000..6587a92fbf03
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-slice.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<meta name="fuzzy" content="maxDifference=0-50; totalPixels=0-8">
+<title>CSS Text Decoration 4: percentage text-decoration-inset resolves against the whole decorated run with box-decoration-break: slice</title>
+<link rel="help" href="https://drafts.csswg.org/css-text-decor-4/#text-decoration-skip-inset-property">
+<link rel="author" title="Helmut Januschka" href="mailto:helmut@januschka.com">
+<link rel="match" href="reference/text-decoration-inset-percentage-slice-ref.html">
+<style>
+  u {
+    font: 48px/2 monospace;
+    text-decoration-line: underline;
+    text-decoration-color: black;
+    text-decoration-thickness: 4px;
+    text-decoration-inset: 25%;
+    box-decoration-break: slice;
+  }
+</style>
+<!-- The decorated run is split into four text fragments. With
+     box-decoration-break: slice, the 25% inset must resolve against the
+     size of the whole run and only trim its outer edges, rendering
+     identically to the unfragmented reference. -->
+<div><u>A<span>B</span><span>C</span>D</u></div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-propagated-ink-overflow-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-propagated-ink-overflow-expected.html
new file mode 100644
index 000000000000..6fbe17892ee5
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-propagated-ink-overflow-expected.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html> <!-- webkit-test-runner [ CSSTextDecorationInsetEnabled=true ] -->
+<meta charset="utf-8">
+<title>CSS Text Decoration: a decoration propagated to a descendant inline box is measured with the originating box's style (reference)</title>
+<style>
+body { margin: 30px; }
+div { font: 24px/2 monospace; width: max-content; will-change: transform; }
+.thick { text-decoration: underline; text-decoration-thickness: 24px; }
+.wavy { text-decoration: underline wavy; text-decoration-thickness: 8px; }
+.inset { text-decoration: underline 3px blue; text-underline-offset: 6px; text-decoration-inset: -40px; }
+</style>
+
+<!-- Bare text, so the text box's parent is the box that originates the decoration. -->
+
+<div class="thick">thickness</div>
+<div class="wavy">wavyline</div>
+<div class="inset">negative inset</div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-propagated-ink-overflow.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-propagated-ink-overflow.html
new file mode 100644
index 000000000000..e13bd3f57265
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-propagated-ink-overflow.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html> <!-- webkit-test-runner [ CSSTextDecorationInsetEnabled=true ] -->
+<meta charset="utf-8">
+<title>CSS Text Decoration: a decoration propagated to a descendant inline box is measured with the originating box's style</title>
+<link rel="help" href="https://drafts.csswg.org/css-text-decor-4/#line-decoration">
+<link rel="match" href="text-decoration-propagated-ink-overflow-expected.html">
+<meta name="assert" content="The text decoration properties are not inherited, so a decoration that propagates to a descendant is drawn with the originating box's style. Its ink overflow must be measured from that same style, or the parts of the decoration that fall outside the text box are clipped.">
+<style>
+body { margin: 30px; }
+div { font: 24px/2 monospace; width: max-content; will-change: transform; }
+.thick { text-decoration: underline; text-decoration-thickness: 24px; }
+.wavy { text-decoration: underline wavy; text-decoration-thickness: 8px; }
+.inset { text-decoration: underline 3px blue; text-underline-offset: 6px; text-decoration-inset: -40px; }
+</style>
+
+<!-- Each decoration originates on the div and propagates to the text inside the span, so the text
+     box's immediate parent is not the box carrying the decoration properties. The composited layer
+     is sized from the ink overflow, so any part measured against the span's initial values - a
+     24px-thick underline, a wavy underline's control points, a negative inset's overhang - is
+     clipped instead of painted. The reference has the same declarations on bare text. -->
+
+<div class="thick"><span>thickness</span></div>
+<div class="wavy"><span>wavyline</span></div>
+<div class="inset"><span>negative inset</span></div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/w3c-import.log b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/w3c-import.log
index 06cd8872a6ba..cb15c4f39bdb 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/w3c-import.log
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/w3c-import.log
@@ -89,8 +89,22 @@ List of files:
 /LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-024.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-025-expected.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-025.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-026-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-026.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-027-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-027.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-028-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-028.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-029-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-029.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-030-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-030.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-orthogonal-block-001-expected.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-orthogonal-block-001.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-slice-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-slice-multiline-expected.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-slice-multiline.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-slice.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-line-010-expected.xht
 /LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-line-010.xht
 /LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-line-011-expected.xht
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-transitions/transition-duration-infinite-cancelation-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/css/css-transitions/transition-duration-infinite-cancelation-expected.txt
new file mode 100644
index 000000000000..8df21383d165
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-transitions/transition-duration-infinite-cancelation-expected.txt
@@ -0,0 +1,3 @@
+
+PASS Canceling a transition with transition-duration set to infinite value
+
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-transitions/transition-duration-infinite-cancelation.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-transitions/transition-duration-infinite-cancelation.html
new file mode 100644
index 000000000000..0db5049ff0b9
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-transitions/transition-duration-infinite-cancelation.html
@@ -0,0 +1,46 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>Canceling a transition with transition-duration set to infinite value</title>
+<link rel="author" title="Antoine Quint" href="mailto:graouts@webkit.org">
+<link rel="help" href="https://bugs.webkit.org/show_bug.cgi?id=321274">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="support/helper.js"></script>
+<style>
+
+#target {
+  width: 100px;
+  height: 100px;
+  background-color: black;
+
+  transition: background-color calc(infinity * 1s) ease;
+}
+
+#target.transition {
+  background-color: blue;
+  transition-duration: .2s;
+}
+
+</style>
+</head>
+<body>
+<div id="target"></div>
+<script>
+promise_test(async t => {
+  const div = document.querySelector("div");
+
+  // Start the transition.
+  await new Promise(requestAnimationFrame);
+  div.classList.toggle("transition");
+
+  // End the transition.
+  await new Promise(requestAnimationFrame);
+  div.classList.toggle("transition");
+
+  // Ensure we wait a frame to make sure the page is responsive.
+  await new Promise(requestAnimationFrame);
+}, 'Canceling a transition with transition-duration set to infinite value');
+</script>
+</body>
+</html>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-typed-om/the-stylepropertymap/properties/text-overflow-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/css/css-typed-om/the-stylepropertymap/properties/text-overflow-expected.txt
index e18deeb40d5e..e69633d96be6 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-typed-om/the-stylepropertymap/properties/text-overflow-expected.txt
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-typed-om/the-stylepropertymap/properties/text-overflow-expected.txt
@@ -34,6 +34,6 @@ PASS Setting 'text-overflow' to a transform: translate(50%, 50%) throws TypeErro
 PASS Setting 'text-overflow' to a transform: perspective(10em) throws TypeError
 PASS Setting 'text-overflow' to a transform: translate3d(0px, 1px, 2px) translate(0px, 1px) rotate3d(1, 2, 3, 45deg) rotate(45deg) scale3d(1, 2, 3) scale(1, 2) skew(1deg, 1deg) skewX(1deg) skewY(45deg) perspective(1px) matrix3d(1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16) matrix(1, 2, 3, 4, 5, 6) throws TypeError
 FAIL 'text-overflow' does not support 'clip ellipsis' assert_class_string: Unsupported value must be a CSSStyleValue and not one of its subclasses expected "[object CSSStyleValue]" but got "[object Undefined]"
-FAIL 'text-overflow' does not support '"..."' assert_class_string: Unsupported value must be a CSSStyleValue and not one of its subclasses expected "[object CSSStyleValue]" but got "[object Undefined]"
+PASS 'text-overflow' does not support '"..."'
 FAIL 'text-overflow' does not support 'fade(1px, 50%)' assert_class_string: Unsupported value must be a CSSStyleValue and not one of its subclasses expected "[object CSSStyleValue]" but got "[object Undefined]"
 
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/WEB_FEATURES.yml b/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/WEB_FEATURES.yml
index 431c3dd86a52..b2f128bd0193 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/WEB_FEATURES.yml
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/WEB_FEATURES.yml
@@ -17,9 +17,7 @@ rules:
 - caret-shape-*: [caret-shape]
 - caret-eol-*: [caret-shape]
 - cursor-image-016-manual.html: [cross-fade, cursor]
-- text-overflow-string-*: [custom-ellipses, text-overflow]
 - native-appearance-disabled-for-value-unset.html: [unset-value]
-- text-overflow-*: [text-overflow]
 - canvas-cursor-*: [cursor]
 - cursor-*: [cursor]
 - select-cursor-*: [cursor]
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/animation/w3c-import.log b/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/animation/w3c-import.log
index 8dbd4183ad7c..a38cabc747ff 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/animation/w3c-import.log
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/animation/w3c-import.log
@@ -21,6 +21,7 @@ List of files:
 /LayoutTests/imported/w3c/web-platform-tests/css/css-ui/animation/cursor-no-interpolation.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-ui/animation/outline-color-interpolation.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-ui/animation/outline-offset-composition.html
+/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/animation/outline-offset-interpolation-rounding.tentative.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-ui/animation/outline-offset-interpolation.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-ui/animation/outline-width-composition.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-ui/animation/outline-width-interpolation.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/crashtests/w3c-import.log b/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/crashtests/w3c-import.log
index 46851bbb1626..9595ce42b6d2 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/crashtests/w3c-import.log
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/crashtests/w3c-import.log
@@ -12,9 +12,7 @@ Properties requiring vendor prefixes:
 None
 ------------------------------------------------------------------------
 List of files:
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/crashtests/WEB_FEATURES.yml
 /LayoutTests/imported/w3c/web-platform-tests/css/css-ui/crashtests/chrome-bug-467732064.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-ui/crashtests/cursor-light-dark-generated-image-crash.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-ui/crashtests/input-range-content-url.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-ui/crashtests/outline-scrollIntoView-crash.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/crashtests/text-overflow-ellipsis-multiline-crash.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/parsing/WEB_FEATURES.yml b/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/parsing/WEB_FEATURES.yml
index dd510909558e..a45148595cc1 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/parsing/WEB_FEATURES.yml
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/parsing/WEB_FEATURES.yml
@@ -7,5 +7,4 @@ rules:
 - outline-color-*: [outlines]
 - outline-offset-*: [outlines]
 - cursor-*: [cursor]
-- text-overflow-*: [text-overflow]
 - box-sizing-*: [box-sizing]
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/parsing/text-overflow-computed-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/parsing/text-overflow-computed-expected.txt
deleted file mode 100644
index b255e566ee7f..000000000000
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/parsing/text-overflow-computed-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-
-PASS Property text-overflow value 'clip'
-PASS Property text-overflow value 'ellipsis'
-
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/parsing/text-overflow-computed.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/parsing/text-overflow-computed.html
deleted file mode 100644
index 701506e617b1..000000000000
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/parsing/text-overflow-computed.html
+++ /dev/null
@@ -1,19 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-<meta charset="utf-8">
-<title>CSS UI Level 3: getComputedStyle().textOverflow</title>
-<link rel="help" href="https://drafts.csswg.org/css-ui-3/#text-overflow">
-<meta name="assert" content="text-overflow computed value is as specified.">
-<script src="/resources/testharness.js"></script>
-<script src="/resources/testharnessreport.js"></script>
-<script src="/css/support/computed-testcommon.js"></script>
-</head>
-<body>
-<div id="target"></div>
-<script>
-test_computed_value("text-overflow", "clip");
-test_computed_value("text-overflow", "ellipsis");
-</script>
-</body>
-</html>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/parsing/text-overflow-invalid-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/parsing/text-overflow-invalid-expected.txt
deleted file mode 100644
index 41d88dcf1198..000000000000
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/parsing/text-overflow-invalid-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-
-PASS e.style['text-overflow'] = "auto" should not set the property value
-PASS e.style['text-overflow'] = "clip ellipsis clip" should not set the property value
-
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/parsing/text-overflow-invalid.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/parsing/text-overflow-invalid.html
deleted file mode 100644
index aa4169c1462b..000000000000
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/parsing/text-overflow-invalid.html
+++ /dev/null
@@ -1,19 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-<meta charset="utf-8">
-<title>CSS UI Level 3: parsing text-overflow with invalid values</title>
-<link rel="author" title="Eric Willigers" href="mailto:ericwilligers@chromium.org">
-<link rel="help" href="https://drafts.csswg.org/css-ui-3/#text-overflow">
-<meta name="assert" content="text-overflow supports only the grammar 'clip | ellipsis'.">
-<script src="/resources/testharness.js"></script>
-<script src="/resources/testharnessreport.js"></script>
-<script src="/css/support/parsing-testcommon.js"></script>
-</head>
-<body>
-<script>
-test_invalid_value("text-overflow", "auto");
-test_invalid_value("text-overflow", "clip ellipsis clip");
-</script>
-</body>
-</html>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/parsing/text-overflow-valid-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/parsing/text-overflow-valid-expected.txt
deleted file mode 100644
index db0f4d89fa56..000000000000
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/parsing/text-overflow-valid-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-
-PASS e.style['text-overflow'] = "clip" should set the property value
-PASS e.style['text-overflow'] = "ellipsis" should set the property value
-
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/parsing/text-overflow-valid.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/parsing/text-overflow-valid.html
deleted file mode 100644
index 5d40b6839def..000000000000
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/parsing/text-overflow-valid.html
+++ /dev/null
@@ -1,19 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-<meta charset="utf-8">
-<title>CSS UI Level 3: parsing text-overflow with valid values</title>
-<link rel="author" title="Eric Willigers" href="mailto:ericwilligers@chromium.org">
-<link rel="help" href="https://drafts.csswg.org/css-ui-3/#text-overflow">
-<meta name="assert" content="text-overflow supports the full grammar 'clip | ellipsis'.">
-<script src="/resources/testharness.js"></script>
-<script src="/resources/testharnessreport.js"></script>
-<script src="/css/support/parsing-testcommon.js"></script>
-</head>
-<body>
-<script>
-test_valid_value("text-overflow", "clip");
-test_valid_value("text-overflow", "ellipsis");
-</script>
-</body>
-</html>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/parsing/w3c-import.log b/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/parsing/w3c-import.log
index 97a6e8eead56..8d48600cbd25 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/parsing/w3c-import.log
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/parsing/w3c-import.log
@@ -46,9 +46,6 @@ List of files:
 /LayoutTests/imported/w3c/web-platform-tests/css/css-ui/parsing/resize-computed.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-ui/parsing/resize-invalid.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-ui/parsing/resize-valid.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/parsing/text-overflow-computed.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/parsing/text-overflow-invalid.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/parsing/text-overflow-valid.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-ui/parsing/user-select-computed-contain.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-ui/parsing/user-select-computed.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-ui/parsing/user-select-invalid.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/w3c-import.log b/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/w3c-import.log
index 0ab18153c5de..651cb3e84efc 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/w3c-import.log
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/w3c-import.log
@@ -40,30 +40,5 @@ List of files:
 /LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/outline-style-014-ref.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/outline-with-padding-001-ref.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/subpixel-outline-width-ref.tentative.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-001-ref.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-002-ref.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-005-ref.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-006-ref.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-008-ref.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-012-ref.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-013-ref.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-016-ref.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-021-ref.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-022-ref.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-027-ref.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-028-ref.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-029-ref.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-030-ref.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-change-color-ref.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-ellipsis-indent-001-ref.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-ellipsis-multiline-001-ref.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-string-001-ref.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-string-002-ref.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-string-003-ref.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-string-004-ref.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-string-005-ref.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-string-006-ref.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-string-007-ref.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/text-overflow-string-008-ref.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/transparent-accent-color-001-ref.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-ui/reference/transparent-accent-color-002-ref.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/tentative/button-user-select-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/tentative/button-user-select-expected.txt
new file mode 100644
index 000000000000..b6e131bac86f
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/tentative/button-user-select-expected.txt
@@ -0,0 +1,4 @@
+Button under test
+
+PASS CSS user-select default value for button element
+
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/tentative/button-user-select.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/tentative/button-user-select.html
new file mode 100644
index 000000000000..f1288c1895c4
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/tentative/button-user-select.html
@@ -0,0 +1,17 @@
+<!doctype html>
+<meta charset=utf-8>
+<title>CSS user-select default value for button element</title>
+<link rel="author" title="Seva Alipov" href="mailto:salipov@mozilla.com">
+<link rel="help" href="https://github.com/w3c/csswg-drafts/issues/9709">
+<link rel="help" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1998331">
+<script src=/resources/testharness.js></script>
+<script src=/resources/testharnessreport.js></script>
+
+<button id="test_btn">Button under test</button>
+<script>
+  test(function() {
+    assert_equals(getComputedStyle(test_btn).userSelect, "auto",
+                  "Button should default to 'user-select: auto'");
+    }
+  )
+</script>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/tentative/w3c-import.log b/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/tentative/w3c-import.log
index 3cf9e3deffbd..75b912f63602 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/tentative/w3c-import.log
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/tentative/w3c-import.log
@@ -12,6 +12,7 @@ Properties requiring vendor prefixes:
 user-modify
 ------------------------------------------------------------------------
 List of files:
+/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/tentative/button-user-select.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-ui/tentative/moz-user-modify-01.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-ui/tentative/moz-user-modify-02.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-ui/tentative/moz-user-modify-03.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-expected.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-expected.html
deleted file mode 100644
index b471cf1c3163..000000000000
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-expected.html
+++ /dev/null
@@ -1,17 +0,0 @@
-<!doctype html>
-<head>
-	<title>CSS Reftest Ellipsis Reference</title>
-	<link rel="stylesheet" type="text/css" href="/fonts/ahem.css" />
-	<style>
-		div { font-size:10px; }
-		span { font-family:Ahem; font-size:30px; }
-	</style>
-</head>
-<body>
-	<p>PREREQUISITE: The font used must have a glyph for the U+2026 character.</p>
-	<p>Test passes if there is <strong>ellipsis</strong> after a black square.</p>
-	<div>
-		<span>A</span>&#x2026;
-	</div>
-</body>
-</html>
\ No newline at end of file
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-ref.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-ref.html
deleted file mode 100644
index b471cf1c3163..000000000000
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-ref.html
+++ /dev/null
@@ -1,17 +0,0 @@
-<!doctype html>
-<head>
-	<title>CSS Reftest Ellipsis Reference</title>
-	<link rel="stylesheet" type="text/css" href="/fonts/ahem.css" />
-	<style>
-		div { font-size:10px; }
-		span { font-family:Ahem; font-size:30px; }
-	</style>
-</head>
-<body>
-	<p>PREREQUISITE: The font used must have a glyph for the U+2026 character.</p>
-	<p>Test passes if there is <strong>ellipsis</strong> after a black square.</p>
-	<div>
-		<span>A</span>&#x2026;
-	</div>
-</body>
-</html>
\ No newline at end of file
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow.html
deleted file mode 100644
index 88bc91157b40..000000000000
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow.html
+++ /dev/null
@@ -1,29 +0,0 @@
-<!doctype html>
-<html>
-	<title>CSS Basic User Interface Test: text-overflow - ellipsis</title>
-    <link rel="author" title="YreenChan" href="mailto:yreenchan@gmail.com">
-    <link rel="reviewer" title="Simon Pieters" href="mailto:simonp@opera.com">
-    <link rel="reviewer" title="Leif Arne Storset" href="mailto:lstorset@opera.com">
-    <link rel="help" href="http://www.w3.org/TR/css3-ui/#text-overflow" title="8.2. the 'text-overflow' property">
-    <link rel="match" href="text-overflow-ref.html">
-    <meta name="flags" content="ahem">
-    <meta name="assert" content="'text-overflow:ellipsis' renders U+2026 when text is overflowing.">
-	<link rel="stylesheet" type="text/css" href="/fonts/ahem.css" />
-	<style>
-	div {
-		font-size:10px;
-		overflow: hidden;
-		text-overflow: ellipsis;
-		white-space: nowrap;
-		width: 50px;
-	}
-	span { font-family: Ahem; font-size:30px; }
-	</style>
-<body>
-	<p>PREREQUISITE: The font used must have a glyph for the U+2026 character.</p>
-	<p>Test passes if there is <strong>ellipsis</strong> after a black square.</p>
-	<div>
-		<span>AAAA</span>
-	</div>
-</body>
-</html>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/user-select-001.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/user-select-001.html
index 03796aa8677b..35febc38bb0b 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/user-select-001.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/user-select-001.html
@@ -15,11 +15,11 @@
 
   <style>
   :root {
-    -webkit-user-select: none;
+    user-select: none;
   }
   </style>
 
-  <span style="-webkit-user-select: text">
+  <span style="user-select: text">
     <div>Let's select this <b id="target">word</b></div>
   </span>
 
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/user-select-button-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/user-select-button-expected.txt
index ba57a87d1562..eb637e6b1357 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/user-select-button-expected.txt
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/user-select-button-expected.txt
@@ -7,5 +7,5 @@ PASS the button text should be selectable from outside.
 PASS the button text should not be selectable from inside when the parent is user-select: text.
 PASS the button text should be selectable from outside when the parent is user-select: text.
 PASS the button text should not be selectable from inside when the parent is user-select: none.
-FAIL the button text should not be selectable from outside when the parent is user-select: none. assert_equals: expected "" but got "button"
+PASS the button text should not be selectable from outside when the parent is user-select: none.
 
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/user-select-button.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/user-select-button.html
index 2445537ff252..07c8e1cc3f2a 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/user-select-button.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/user-select-button.html
@@ -14,15 +14,15 @@
 
 <style>
 .usa {
-  -webkit-user-select: auto;
+  user-select: auto;
 }
 
 .ust {
-  -webkit-user-select: text;
+  user-select: text;
 }
 
 .usn {
-  -webkit-user-select: none;
+  user-select: none;
 }
 
 #empty {
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/user-select-none-in-editable.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/user-select-none-in-editable.html
index 9d72bc8a301b..bce54f1ddc32 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/user-select-none-in-editable.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/user-select-none-in-editable.html
@@ -7,7 +7,7 @@
 <link rel="help" href="https://drafts.csswg.org/css-ui/#valdef-user-select-none">
 <style>
 .user-select-none {
-    -webkit-user-select: none;
+    user-select: none;
 }
 </style>
 </head>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/user-select-none-on-input.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/user-select-none-on-input.html
index 7eb82e112d48..f48d9e8a8aa0 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/user-select-none-on-input.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/user-select-none-on-input.html
@@ -7,7 +7,7 @@
     <link rel="help" href="https://drafts.csswg.org/css-ui/#valdef-user-select-none">
     <style>
     input, textarea {
-        -webkit-user-select: none;
+        user-select: none;
     }
     </style>
 </head>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/w3c-import.log b/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/w3c-import.log
index c19cc9eba21e..ab6674325eac 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/w3c-import.log
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/w3c-import.log
@@ -9,7 +9,7 @@ Do NOT modify or remove this file.
 
 ------------------------------------------------------------------------
 Properties requiring vendor prefixes:
-user-select
+None
 ------------------------------------------------------------------------
 List of files:
 /LayoutTests/imported/w3c/web-platform-tests/css/css-ui/META.yml
@@ -413,98 +413,6 @@ List of files:
 /LayoutTests/imported/w3c/web-platform-tests/css/css-ui/select-author-level-padding-applies.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-ui/subpixel-outline-width.tentative-expected.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-ui/subpixel-outline-width.tentative.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-001-expected.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-001.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-002-expected.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-002.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-003-expected.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-003.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-004-expected.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-004.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-005-expected.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-005.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-006-expected.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-006.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-007-expected.xht
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-007.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-008-expected.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-008.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-009-expected.xht
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-009.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-010-expected.xht
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-010.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-011-expected.xht
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-011.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-012-expected.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-012.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-013-expected.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-013.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-014-expected.xht
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-014.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-015-expected.xht
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-015.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-016-expected.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-016.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-017.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-020-expected.xht
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-020.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-021-expected.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-021.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-022-expected.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-022.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-023.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-024-expected.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-024-ref.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-024.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-025-expected.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-025-ref.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-025.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-026-expected.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-026-ref.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-026.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-027-expected.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-027.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-028-expected.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-028.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-029-expected.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-029.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-030-expected.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-030.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-change-color-expected.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-change-color.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-ellipsis-abspos-in-inline-block-crash-001.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-ellipsis-hyphen.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-ellipsis-indent-001-expected.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-ellipsis-indent-001.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-ellipsis-multiline-001-expected.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-ellipsis-multiline-001.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-ellipsis-self-painting.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-ellipsis-width-001.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-expected.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-ref.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-ruby-expected.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-ruby-ref.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-ruby.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-string-001-expected.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-string-001.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-string-002-expected.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-string-002.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-string-003-expected.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-string-003.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-string-004-expected.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-string-004.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-string-005-expected.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-string-005.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-string-006-expected.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-string-006.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-string-007-expected.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-string-007.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-string-008-expected.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-string-008.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-with-selection-expected.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-with-selection-ref.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow-with-selection.html
-/LayoutTests/imported/w3c/web-platform-tests/css/css-ui/text-overflow.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-ui/translucent-outline-expected.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-ui/translucent-outline-ref.html
 /LayoutTests/imported/w3c/web-platform-tests/css/css-ui/translucent-outline.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-values/random-in-custom-function.tentative-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/css/css-values/random-in-custom-function.tentative-expected.txt
index b341c138fc4d..f8f2486a6595 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-values/random-in-custom-function.tentative-expected.txt
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-values/random-in-custom-function.tentative-expected.txt
@@ -7,4 +7,11 @@ PASS random() in same registered function same locals different positions
 FAIL random() in different function same default locals assert_true: expected true got false
 FAIL random() in function in local overrides argument assert_false: Random values should not be equal expected false got true
 PASS random() in function argument
+PASS random(fixed) outside a function
+PASS random(fixed) through an untyped argument
+PASS random(fixed) through a typed argument
+FAIL random(fixed) through an untyped argument into a typed result assert_equals: expected "50" but got "0"
+FAIL random(fixed) in an untyped local substituted into a typed result assert_equals: expected "50" but got "0"
+FAIL random(fixed) in a typed parameter default assert_equals: expected "50" but got "0"
+PASS random(fixed) written in a typed result
 
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/css-values/random-in-custom-function.tentative.html b/LayoutTests/imported/w3c/web-platform-tests/css/css-values/random-in-custom-function.tentative.html
index 818f48c33165..bd68306c0386 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/css-values/random-in-custom-function.tentative.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/css-values/random-in-custom-function.tentative.html
@@ -67,6 +67,29 @@
     @function --g-number() returns <number> {
         result: random(--foo property-index-scoped, 1, 1e6);
     }
+
+    /* random(fixed <number>) bypasses the random cache name entirely, so the
+       cases below test only whether a value is produced at all, independent of
+       how cache names are scoped inside custom functions. Each resolves to 50. */
+    @function --fixed-untyped(--x) {
+        result: var(--x);
+    }
+    @function --fixed-typed-argument(--x <number>) returns <number> {
+        result: var(--x);
+    }
+    @function --fixed-untyped-argument-typed-result(--x) returns <number> {
+        result: var(--x);
+    }
+    @function --fixed-untyped-local-typed-result() returns <number> {
+        --x: random(fixed 0.5, 0, 100);
+        result: var(--x);
+    }
+    @function --fixed-typed-default(--x <number>: random(fixed 0.5, 0, 100)) returns <number> {
+        result: var(--x);
+    }
+    @function --fixed-typed-result() returns <number> {
+        result: random(fixed 0.5, 0, 100);
+    }
 </style>
 <script>
 // Since actual and expected values are generated randomly, `assert_equals()`
@@ -266,4 +289,37 @@
     document.body.removeChild(holder);
   }
 }, `random() in function argument`);
+
+// random(fixed <number>) has a fixed random base value and ignores the random
+// cache name, so these cases are deterministic and independent of how cache
+// names are scoped inside a custom function.
+function test_fixed_random(value, description) {
+  test(() => {
+    const holder = document.createElement('div');
+    document.body.appendChild(holder);
+    try {
+      const el = document.createElement('div');
+      el.style.setProperty('--number', value);
+      holder.appendChild(el);
+      assert_equals(getComputedStyle(el).getPropertyValue('--number'), '50');
+    } finally {
+      document.body.removeChild(holder);
+    }
+  }, description);
+}
+
+test_fixed_random('random(fixed 0.5, 0, 100)',
+  'random(fixed) outside a function');
+test_fixed_random('--fixed-untyped(random(fixed 0.5, 0, 100))',
+  'random(fixed) through an untyped argument');
+test_fixed_random('--fixed-typed-argument(random(fixed 0.5, 0, 100))',
+  'random(fixed) through a typed argument');
+test_fixed_random('--fixed-untyped-argument-typed-result(random(fixed 0.5, 0, 100))',
+  'random(fixed) through an untyped argument into a typed result');
+test_fixed_random('--fixed-untyped-local-typed-result()',
+  'random(fixed) in an untyped local substituted into a typed result');
+test_fixed_random('--fixed-typed-default()',
+  'random(fixed) in a typed parameter default');
+test_fixed_random('--fixed-typed-result()',
+  'random(fixed) written in a typed result');
 </script>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/selectors/invalidation/WEB_FEATURES.yml b/LayoutTests/imported/w3c/web-platform-tests/css/selectors/invalidation/WEB_FEATURES.yml
index e4c0f6ec3087..e8b9513e7cce 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/selectors/invalidation/WEB_FEATURES.yml
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/selectors/invalidation/WEB_FEATURES.yml
@@ -1,73 +1,42 @@
-features:
-- name: selectors
-  files:
-  - attribute.html
-  - class-id-attr.html
-  - sibling.html
-  - insert-sibling-*
-  - selectorText-dynamic-001.html
-  - sheet-going-away-*
-- name: has
-  files:
-  - has-*
-  - "*-in-has.*"
-  - "*-in-has-*"
-- name: link-selectors
-  files:
-  - "any-link-*"
-- name: media-pseudos
-  files:
-  - media-loading-pseudo-classes-in-has.sub.html
-  - media-pseudo-classes-in-has.html
-- name: modal
-  files:
-  - modal-pseudo-class-in-has.html
-- name: not
-  files:
-  - not-*
-- name: nth-child
-  files:
-  - first-child-last-child.html
-  - nth-child-in-shadow-root.html
-- name: nth-child-of
-  files:
-  - nth-child-of-*
-  - nth-child-when-*
-  - nth-child-whole-subtree.html
-  - nth-child-containing-ancestor.html
-  - negated-nth-child-when-*
-  - nth-last-child-of-*
-  - nth-last-child-when-*
-  - nth-last-child-containing-ancestor.html
-  - negated-nth-last-child-when-*
-- name: nth-of-type
-  files:
-  - 'negated-*-of-type*'
-- name: user-pseudos
-  files:
-  - user-valid-user-invalid.html
-- name: state
-  files:
-  - state-in-has.html
-- name: placeholder-shown
-  files:
-  - placeholder-shown.html
-- name: shadow-parts
-  files:
-  - part-dir.html
-  - part-lang.html
-  - part-pseudo.html
-- name: host
-  files:
-  - host-*
-  - "!host-context-*"
-- name: is
-  files:
-  - is.html
-  - negated-is-*
-- name: where
-  files:
-  - where.html
-- name: input-selectors
-  files:
-  - enabled-disabled.html
+rules:
+- attribute.html: [selectors]
+- class-id-attr.html: [selectors]
+- sibling.html: [selectors]
+- insert-sibling-*: [selectors]
+- selectorText-dynamic-001.html: [selectors]
+- sheet-going-away-*: [selectors]
+- has-*: [has]
+- "*-in-has-*": [has, has]
+- media-loading-pseudo-classes-in-has.sub.html: [media-pseudos, has]
+- media-pseudo-classes-in-has.html: [media-pseudos, has]
+- modal-pseudo-class-in-has.html: [modal, has]
+- not-pseudo-containing-sibling-relationship-in-has.html: [has, not]
+- not-pseudo-containing-complex-in-has.html: [has, not]
+- state-in-has.html: [state, has]
+- host-pseudo-class-in-has.html: [has, host]
+- host-context-pseudo-class-in-has.html: [has]
+- "*-in-has.*": [has]
+- any-link-*: [link-selectors]
+- not-*: [not]
+- first-child-last-child.html: [nth-child]
+- nth-child-in-shadow-root.html: [nth-child]
+- nth-child-of-*: [nth-child-of]
+- nth-child-when-*: [nth-child-of]
+- nth-child-whole-subtree.html: [nth-child-of]
+- nth-child-containing-ancestor.html: [nth-child-of]
+- negated-nth-child-when-*: [nth-child-of]
+- nth-last-child-of-*: [nth-child-of]
+- nth-last-child-when-*: [nth-child-of]
+- nth-last-child-containing-ancestor.html: [nth-child-of]
+- negated-nth-last-child-when-*: [nth-child-of]
+- negated-is-*: [is, nth-of-type]
+- negated-*-of-type*: [nth-of-type]
+- user-valid-user-invalid.html: [user-pseudos]
+- placeholder-shown.html: [placeholder-shown]
+- part-dir.html: [shadow-parts]
+- part-lang.html: [shadow-parts]
+- part-pseudo.html: [shadow-parts]
+- host-*: [host]
+- is.html: [is]
+- where.html: [where]
+- enabled-disabled.html: [input-selectors]
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/selectors/invalidation/crashtests/w3c-import.log b/LayoutTests/imported/w3c/web-platform-tests/css/selectors/invalidation/crashtests/w3c-import.log
index 0df60f2c8284..91ee0a84048d 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/selectors/invalidation/crashtests/w3c-import.log
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/selectors/invalidation/crashtests/w3c-import.log
@@ -10,8 +10,6 @@ Do NOT modify or remove this file.
 ------------------------------------------------------------------------
 Properties requiring vendor prefixes:
 None
-Property values requiring vendor prefixes:
-None
 ------------------------------------------------------------------------
 List of files:
 /LayoutTests/imported/w3c/web-platform-tests/css/selectors/invalidation/crashtests/has-pseudoclass-only-crash.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/css/selectors/invalidation/w3c-import.log b/LayoutTests/imported/w3c/web-platform-tests/css/selectors/invalidation/w3c-import.log
index a2cacf45b1bb..c906563903b9 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/css/selectors/invalidation/w3c-import.log
+++ b/LayoutTests/imported/w3c/web-platform-tests/css/selectors/invalidation/w3c-import.log
@@ -10,8 +10,6 @@ Do NOT modify or remove this file.
 ------------------------------------------------------------------------
 Properties requiring vendor prefixes:
 None
-Property values requiring vendor prefixes:
-None
 ------------------------------------------------------------------------
 List of files:
 /LayoutTests/imported/w3c/web-platform-tests/css/selectors/invalidation/WEB_FEATURES.yml
@@ -50,6 +48,7 @@ List of files:
 /LayoutTests/imported/w3c/web-platform-tests/css/selectors/invalidation/has-nested-pseudo-002-crash.html
 /LayoutTests/imported/w3c/web-platform-tests/css/selectors/invalidation/has-nested-pseudo-003-crash.html
 /LayoutTests/imported/w3c/web-platform-tests/css/selectors/invalidation/has-pseudo-element-expected.xht
+/LayoutTests/imported/w3c/web-platform-tests/css/selectors/invalidation/has-pseudo-element-subject-child-mutation.html
 /LayoutTests/imported/w3c/web-platform-tests/css/selectors/invalidation/has-pseudo-element.html
 /LayoutTests/imported/w3c/web-platform-tests/css/selectors/invalidation/has-pseudoclass-only.html
 /LayoutTests/imported/w3c/web-platform-tests/css/selectors/invalidation/has-sibling-insertion-removal.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/script-move-before-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/script-move-before-expected.txt
index 6a269137f591..b167f7286f86 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/script-move-before-expected.txt
+++ b/LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/script-move-before-expected.txt
@@ -1,4 +1,4 @@
 
-FAIL Synchronous script execution in HTMLScriptElement during moveBefore should be blocked assert_false: <html:script> does not define moving steps which allow script execution. expected false got true
-FAIL Synchronous script execution in SVGScriptElement during moveBefore should be blocked assert_false: <svg:script> does not define moving steps which allow script execution. expected false got true
+PASS Synchronous script execution in HTMLScriptElement during moveBefore should be blocked
+PASS Synchronous script execution in SVGScriptElement during moveBefore should be blocked
 
diff --git a/LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/scroll-to-fragid/WEB_FEATURES.yml b/LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/scroll-to-fragid/WEB_FEATURES.yml
index 416ef6049d11..01c1930231a7 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/scroll-to-fragid/WEB_FEATURES.yml
+++ b/LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/scroll-to-fragid/WEB_FEATURES.yml
@@ -1,4 +1,3 @@
-features:
-- name: target
-  files:
-  - target-pseudo-after-reinsertion.html
+rules:
+- target-pseudo-after-adoption.html: [target]
+- target-pseudo-after-reinsertion.html: [target]
diff --git a/LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/scroll-to-fragid/target-pseudo-after-adoption-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/scroll-to-fragid/target-pseudo-after-adoption-expected.txt
new file mode 100644
index 000000000000..fe6572753e47
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/scroll-to-fragid/target-pseudo-after-adoption-expected.txt
@@ -0,0 +1,4 @@
+target
+
+PASS :target should follow the target element back after a round trip through another document.
+
diff --git a/LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/scroll-to-fragid/target-pseudo-after-adoption.html b/LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/scroll-to-fragid/target-pseudo-after-adoption.html
new file mode 100644
index 000000000000..47f36fb2c515
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/scroll-to-fragid/target-pseudo-after-adoption.html
@@ -0,0 +1,32 @@
+<!DOCTYPE html>
+<link rel=author href="mailto:annevk@annevk.nl">
+<link rel=help href="https://html.spec.whatwg.org/multipage/browsing-the-web.html#target-element">
+<link rel=help href="https://github.com/whatwg/html/issues/10029">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+
+<div id=target>target</div>
+
+<script>
+test(() => {
+  const target = document.getElementById('target');
+  window.location.href = '#target';
+  assert_equals(document.querySelector(':target'), target,
+    ':target should match before adoption.');
+
+  const other = document.implementation.createHTMLDocument();
+  other.body.appendChild(other.adoptNode(target));
+  assert_equals(target.ownerDocument, other,
+    'target should have been adopted into the other document.');
+  assert_false(target.matches(':target'),
+    ':target should not match in a document whose target element is null.');
+  assert_equals(other.querySelector(':target'), null,
+    'the other document should have no target element.');
+
+  document.body.appendChild(document.adoptNode(target));
+  assert_equals(target.ownerDocument, document,
+    'target should have been adopted back.');
+  assert_equals(document.querySelector(':target'), target,
+    ':target should match again after being adopted back.');
+}, ':target should follow the target element back after a round trip through another document.');
+</script>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/scroll-to-fragid/target-pseudo-after-reinsertion-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/scroll-to-fragid/target-pseudo-after-reinsertion-expected.txt
index a20570c30f17..8fff1f013c79 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/scroll-to-fragid/target-pseudo-after-reinsertion-expected.txt
+++ b/LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/scroll-to-fragid/target-pseudo-after-reinsertion-expected.txt
@@ -1,4 +1,4 @@
 target
 
-FAIL :target should match the target element even after it is removed and reinserted. assert_equals: :target should match after reinsertion. expected Element node <div id="target">target</div> but got null
+PASS :target should match the target element even after it is removed and reinserted.
 
diff --git a/LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/scroll-to-fragid/w3c-import.log b/LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/scroll-to-fragid/w3c-import.log
index db65fbb587e7..249a4f149930 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/scroll-to-fragid/w3c-import.log
+++ b/LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/scroll-to-fragid/w3c-import.log
@@ -38,4 +38,5 @@ List of files:
 /LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/scroll-to-fragid/scroll-to-anchor-name.html
 /LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/scroll-to-fragid/scroll-to-id-top.html
 /LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/scroll-to-fragid/scroll-to-top.html
+/LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/scroll-to-fragid/target-pseudo-after-adoption.html
 /LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/scroll-to-fragid/target-pseudo-after-reinsertion.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/html/interaction/focus/the-autofocus-attribute/document-with-fragment-removed-target-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/html/interaction/focus/the-autofocus-attribute/document-with-fragment-removed-target-expected.txt
new file mode 100644
index 000000000000..4c9fbed9a341
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/html/interaction/focus/the-autofocus-attribute/document-with-fragment-removed-target-expected.txt
@@ -0,0 +1,3 @@
+
+PASS Autofocus should be skipped when the target element has been removed from the document.
+
diff --git a/LayoutTests/imported/w3c/web-platform-tests/html/interaction/focus/the-autofocus-attribute/document-with-fragment-removed-target.html b/LayoutTests/imported/w3c/web-platform-tests/html/interaction/focus/the-autofocus-attribute/document-with-fragment-removed-target.html
new file mode 100644
index 000000000000..5433fdf51ec6
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/html/interaction/focus/the-autofocus-attribute/document-with-fragment-removed-target.html
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/utils.js"></script>
+
+<script>
+'use strict';
+
+promise_test(async () => {
+  const w = window.open('resources/frame-with-anchor.html#anchor1');
+  await waitForLoad(w);
+  const doc = w.document;
+  const anchor = doc.querySelector('#anchor1');
+  assert_equals(doc.querySelector(':target'), anchor);
+
+  // Removing the target element does not set the target element to null.
+  anchor.remove();
+  assert_equals(doc.querySelector(':target'), null);
+
+  const input = doc.createElement('input');
+  input.autofocus = true;
+  doc.body.appendChild(input);
+  await waitUntilStableAutofocusState(w);
+  assert_not_equals(doc.activeElement, input);
+  w.close();
+}, 'Autofocus should be skipped when the target element has been removed from the document.');
+</script>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/html/interaction/focus/the-autofocus-attribute/w3c-import.log b/LayoutTests/imported/w3c/web-platform-tests/html/interaction/focus/the-autofocus-attribute/w3c-import.log
index 8f389afad2c9..65243ba9ca00 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/html/interaction/focus/the-autofocus-attribute/w3c-import.log
+++ b/LayoutTests/imported/w3c/web-platform-tests/html/interaction/focus/the-autofocus-attribute/w3c-import.log
@@ -21,6 +21,7 @@ List of files:
 /LayoutTests/imported/w3c/web-platform-tests/html/interaction/focus/the-autofocus-attribute/autofocus-on-stable-document.html
 /LayoutTests/imported/w3c/web-platform-tests/html/interaction/focus/the-autofocus-attribute/document-with-fragment-empty.html
 /LayoutTests/imported/w3c/web-platform-tests/html/interaction/focus/the-autofocus-attribute/document-with-fragment-nonexistent.html
+/LayoutTests/imported/w3c/web-platform-tests/html/interaction/focus/the-autofocus-attribute/document-with-fragment-removed-target.html
 /LayoutTests/imported/w3c/web-platform-tests/html/interaction/focus/the-autofocus-attribute/document-with-fragment-top.html
 /LayoutTests/imported/w3c/web-platform-tests/html/interaction/focus/the-autofocus-attribute/document-with-fragment-valid.html
 /LayoutTests/imported/w3c/web-platform-tests/html/interaction/focus/the-autofocus-attribute/first-reconnected.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/inert-node-is-not-highlighted-expected.html b/LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/inert-node-is-not-highlighted-expected.html
index 15d632578fcb..1b757ecf62db 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/inert-node-is-not-highlighted-expected.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/inert-node-is-not-highlighted-expected.html
@@ -4,7 +4,7 @@
 <style>
 body p, span {
     -webkit-user-select: none;
-    -webkit-user-select: none;
+    user-select: none;
 }
 
 ::backdrop {
diff --git a/LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/top-layer-removal-invalidates-ua-styles-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/top-layer-removal-invalidates-ua-styles-expected.txt
new file mode 100644
index 000000000000..7e7d5601c050
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/top-layer-removal-invalidates-ua-styles-expected.txt
@@ -0,0 +1,3 @@
+
+PASS Top layer UA styles stop applying once a dialog leaves the top layer
+
diff --git a/LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/top-layer-removal-invalidates-ua-styles.html b/LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/top-layer-removal-invalidates-ua-styles.html
new file mode 100644
index 000000000000..42eec703594f
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/top-layer-removal-invalidates-ua-styles.html
@@ -0,0 +1,34 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Removing a dialog from the top layer invalidates the top layer UA styles</title>
+<link rel="help" href="https://html.spec.whatwg.org/multipage/rendering.html#flow-content-3">
+<link rel="help" href="https://www.w3.org/TR/css-position-4/#top-styling">
+<link rel="author" href="mailto:mhochk@microsoft.com">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+
+<dialog style="display:block"></dialog>
+<script>
+test(() => {
+  const dialog = document.querySelector('dialog');
+  const computedStyle = getComputedStyle(dialog);
+
+  assert_equals(computedStyle.position, 'absolute',
+                'position before entering the top layer');
+  assert_equals(computedStyle.overflow, 'visible',
+                'overflow before entering the top layer');
+
+  dialog.showModal();
+
+  assert_equals(computedStyle.position, 'fixed',
+                'position while in the top layer');
+  assert_equals(computedStyle.overflow, 'auto',
+                'overflow while in the top layer');
+
+  dialog.close();
+  assert_equals(computedStyle.position, 'absolute',
+                'position after leaving the top layer');
+  assert_equals(computedStyle.overflow, 'visible',
+                'overflow after leaving the top layer');
+}, 'Top layer UA styles stop applying once a dialog leaves the top layer');
+</script>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/w3c-import.log b/LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/w3c-import.log
index 379019f83e9f..c0d20f38b4f9 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/w3c-import.log
+++ b/LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/w3c-import.log
@@ -9,7 +9,7 @@ Do NOT modify or remove this file.
 
 ------------------------------------------------------------------------
 Properties requiring vendor prefixes:
-user-select
+None
 ------------------------------------------------------------------------
 List of files:
 /LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/WEB_FEATURES.yml
@@ -228,6 +228,7 @@ List of files:
 /LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/top-layer-position-static-expected.html
 /LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/top-layer-position-static.html
 /LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/top-layer-position.html
+/LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/top-layer-removal-invalidates-ua-styles.html
 /LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/top-layer-remove-popover-attribute-expected.html
 /LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/top-layer-remove-popover-attribute-ref.html
 /LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/top-layer-remove-popover-attribute.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/popover-beforetoggle-change-type-crash.html b/LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/popover-beforetoggle-change-type-crash.html
new file mode 100644
index 000000000000..780a67034955
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/popover-beforetoggle-change-type-crash.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<link rel="author" href="mailto:masonf@chromium.org">
+<link rel="help" href="https://html.spec.whatwg.org/#the-popover-attribute">
+
+<div id="p1" popover="auto">Popover 1</div>
+<div id="p2" popover="auto">Popover 2</div>
+
+<script>
+  p1.addEventListener('beforetoggle', (e) => {
+    if (e.newState === 'closed') {
+      p1.setAttribute('popover', 'manual');
+      p2.showPopover();
+    }
+  });
+
+  p1.showPopover();
+  p1.hidePopover();
+</script>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/popover-focus-invoker-inside-popover-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/popover-focus-invoker-inside-popover-expected.txt
new file mode 100644
index 000000000000..f6c5fe01870f
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/popover-focus-invoker-inside-popover-expected.txt
@@ -0,0 +1,4 @@
+Click me first Close  Click me second, THEN press tab After
+
+FAIL Popover with an internal tabindex=-1 invoker does not cause infinite recursion assert_equals: focus should remain on before button expected Element node <button id="before" popovertarget="p" popovertargetaction... but got Element node <body><button id="before" popovertarget="p" popovertarget...
+
diff --git a/LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/popover-focus-invoker-inside-popover.html b/LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/popover-focus-invoker-inside-popover.html
new file mode 100644
index 000000000000..40e901c3ff42
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/popover-focus-invoker-inside-popover.html
@@ -0,0 +1,39 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<link rel="author" href="mailto:masonf@chromium.org">
+<link rel="help" href="https://crbug.com/542274292">
+<link rel="help" href="https://html.spec.whatwg.org/multipage/popover.html">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/resources/testdriver.js"></script>
+<script src="/resources/testdriver-actions.js"></script>
+<script src="/resources/testdriver-vendor.js"></script>
+<script src="resources/popover-utils.js"></script>
+
+<button id="before" popovertarget="p" popovertargetaction="show">Click me first</button>
+<div id="p" popover>
+  <button id="b" popovertarget="p" tabindex="-1">Close</button>
+  <button id="inside">Click me second, THEN press tab</button>
+</div>
+<button id="after">After</button>
+
+<script>
+promise_test(async () => {
+  p.showPopover({source: b});
+  assert_true(p.matches(':popover-open'), 'popover should be open');
+  before.focus();
+  assert_equals(document.activeElement, before, 'focus starts on before button');
+
+  await clickOn(before);
+  assert_true(p.matches(':popover-open'), 'popover should stay open');
+  assert_equals(document.activeElement, before, 'focus should remain on before button');
+
+  await clickOn(inside);
+  assert_true(p.matches(':popover-open'), 'popover should stay open');
+  assert_equals(document.activeElement, inside, 'focus should move to inside button');
+
+  await sendTab();
+  assert_true(p.matches(':popover-open'), 'popover should stay open');
+  assert_equals(document.activeElement, after, 'focus should move to after button');
+}, "Popover with an internal tabindex=-1 invoker does not cause infinite recursion");
+</script>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/popover-hint-loseinterest-show-child-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/popover-hint-loseinterest-show-child-expected.txt
new file mode 100644
index 000000000000..5019c8aa22e4
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/popover-hint-loseinterest-show-child-expected.txt
@@ -0,0 +1,4 @@
+Hover me
+
+FAIL Showing a child hint popover in loseinterest should function promise_test: Unhandled rejection with value: object "ReferenceError: Can't find variable: waitForRender"
+
diff --git a/LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/popover-hint-loseinterest-show-child.html b/LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/popover-hint-loseinterest-show-child.html
new file mode 100644
index 000000000000..c411235dd137
--- /dev/null
+++ b/LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/popover-hint-loseinterest-show-child.html
@@ -0,0 +1,36 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<link rel="author" href="mailto:masonf@chromium.org">
+<link rel="help" href="https://open-ui.org/components/interest-invokers.explainer/">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/html/semantics/interestfor/resources/invoker-utils.js"></script>
+
+<button id="invoker" interestfor="hint1">Hover me</button>
+<div id="hint1" popover="hint">
+  Parent hint
+  <div id="hint2" popover="hint">Child hint</div>
+</div>
+
+<style>
+  #invoker {
+    interest-delay: 0s 1000s;
+  }
+</style>
+
+<script>
+  promise_test(async (t) => {
+    hint1.addEventListener('loseinterest', () => {
+      try {
+        hint2.showPopover();
+      } catch (e) {}
+    });
+    invoker.focus();
+    await waitForRender();
+    assert_true(hint1.matches(':popover-open'), 'hint1 should be open via interest');
+    hint1.hidePopover();
+    assert_false(hint1.matches(':popover-open'), 'hint1 should be closed');
+    // Should not crash here.
+  }, 'Showing a child hint popover in loseinterest should function');
+</script>
+
diff --git a/LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/w3c-import.log b/LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/w3c-import.log
index b748b09f5e71..fe8f5c8524bf 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/w3c-import.log
+++ b/LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/w3c-import.log
@@ -50,6 +50,7 @@ List of files:
 /LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/popover-backdrop-appearance-expected.html
 /LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/popover-backdrop-appearance-ref.html
 /LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/popover-backdrop-appearance.html
+/LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/popover-beforetoggle-change-type-crash.html
 /LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/popover-beforetoggle-opening-event.html
 /LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/popover-change-type.html
 /LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/popover-checkbox-backdrop-expected.html
@@ -71,6 +72,7 @@ List of files:
 /LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/popover-focus-inert-invoker.html
 /LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/popover-focus-inside-shadow-dom.html
 /LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/popover-focus-inside-slot.html
+/LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/popover-focus-invoker-inside-popover.html
 /LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/popover-focus-overflow-visible.html
 /LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/popover-focus-previous-crash.html
 /LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/popover-focus-slotted.html
@@ -83,6 +85,7 @@ List of files:
 /LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/popover-hidden-display.html
 /LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/popover-hint-crash.html
 /LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/popover-hint-hierarchy.html
+/LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/popover-hint-loseinterest-show-child.html
 /LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/popover-hint-reentrant-crash.html
 /LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/popover-iframe-backdrop-expected.html
 /LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/popover-iframe-backdrop.html
diff --git a/LayoutTests/imported/w3c/web-platform-tests/scroll-animations/css/scroll-timeline-name-shadow-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/scroll-animations/css/scroll-timeline-name-shadow-expected.txt
index e886fe3918ca..8a64dfdd16f9 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/scroll-animations/css/scroll-timeline-name-shadow-expected.txt
+++ b/LayoutTests/imported/w3c/web-platform-tests/scroll-animations/css/scroll-timeline-name-shadow-expected.txt
@@ -1,6 +1,6 @@
 
-FAIL Outer animation can not see scroll timeline defined by :host assert_equals: expected "x" but got "y"
-FAIL Outer animation can not see scroll timeline defined by ::slotted assert_equals: expected "x" but got "y"
+PASS Outer animation can not see scroll timeline defined by :host
+PASS Outer animation can not see scroll timeline defined by ::slotted
 PASS Inner animation can see scroll timeline defined by ::part
 PASS Animation inside shadow DOM can see the scroll timeline defined by the ancestor DOM
 
diff --git a/LayoutTests/imported/w3c/web-platform-tests/scroll-animations/css/view-timeline-name-shadow-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/scroll-animations/css/view-timeline-name-shadow-expected.txt
index 99f3418cc8f8..b7de7d0d38a0 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/scroll-animations/css/view-timeline-name-shadow-expected.txt
+++ b/LayoutTests/imported/w3c/web-platform-tests/scroll-animations/css/view-timeline-name-shadow-expected.txt
@@ -1,6 +1,6 @@
 
-FAIL Outer animation can not see view timeline defined by :host assert_equals: expected "x" but got "y"
-FAIL Outer animation can not see view timeline defined by ::slotted assert_equals: expected "x" but got "y"
+PASS Outer animation can not see view timeline defined by :host
+PASS Outer animation can not see view timeline defined by ::slotted
 PASS Inner animation can see view timeline defined by ::part
 PASS Animation inside shadow DOM can see the view timeline defined by the ancestor DOM
 
diff --git a/LayoutTests/imported/w3c/web-platform-tests/wasm/jsapi/esm-integration/global-exports-live-bindings.tentative.any-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/wasm/jsapi/esm-integration/global-exports-live-bindings.tentative.any-expected.txt
index c4629b03f7e1..52cd8eda41f9 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/wasm/jsapi/esm-integration/global-exports-live-bindings.tentative.any-expected.txt
+++ b/LayoutTests/imported/w3c/web-platform-tests/wasm/jsapi/esm-integration/global-exports-live-bindings.tentative.any-expected.txt
@@ -1,4 +1,4 @@
 
-FAIL Local mutable global exports should be live bindings assert_equals: expected (number) 555 but got (object) object "[object WebAssembly.Global]"
-FAIL Dep module mutable global exports should be live bindings assert_equals: expected (number) 3001 but got (object) object "[object WebAssembly.Global]"
+PASS Local mutable global exports should be live bindings
+PASS Dep module mutable global exports should be live bindings
 
diff --git a/LayoutTests/imported/w3c/web-platform-tests/wasm/jsapi/esm-integration/global-exports-live-bindings.tentative.any.worker-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/wasm/jsapi/esm-integration/global-exports-live-bindings.tentative.any.worker-expected.txt
index c4629b03f7e1..52cd8eda41f9 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/wasm/jsapi/esm-integration/global-exports-live-bindings.tentative.any.worker-expected.txt
+++ b/LayoutTests/imported/w3c/web-platform-tests/wasm/jsapi/esm-integration/global-exports-live-bindings.tentative.any.worker-expected.txt
@@ -1,4 +1,4 @@
 
-FAIL Local mutable global exports should be live bindings assert_equals: expected (number) 555 but got (object) object "[object WebAssembly.Global]"
-FAIL Dep module mutable global exports should be live bindings assert_equals: expected (number) 3001 but got (object) object "[object WebAssembly.Global]"
+PASS Local mutable global exports should be live bindings
+PASS Dep module mutable global exports should be live bindings
 
diff --git a/LayoutTests/imported/w3c/web-platform-tests/wasm/jsapi/esm-integration/global-exports.tentative.any-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/wasm/jsapi/esm-integration/global-exports.tentative.any-expected.txt
index 1913b69f275f..f50fb8118401 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/wasm/jsapi/esm-integration/global-exports.tentative.any-expected.txt
+++ b/LayoutTests/imported/w3c/web-platform-tests/wasm/jsapi/esm-integration/global-exports.tentative.any-expected.txt
@@ -1,7 +1,7 @@
 
 PASS WebAssembly module global values should be unwrapped when importing in ESM integration
-FAIL WebAssembly mutable global values should be unwrapped when importing in ESM integration assert_equals: expected (number) 100 but got (object) object "[object WebAssembly.Global]"
-FAIL WebAssembly local global values should be unwrapped when exporting in ESM integration assert_equals: expected (number) 100 but got (object) object "[object WebAssembly.Global]"
-FAIL WebAssembly module globals from imported WebAssembly modules should be unwrapped assert_equals: expected (number) 2001 but got (object) object "[object WebAssembly.Global]"
-FAIL WebAssembly should properly handle all global types assert_equals: expected (number) 100 but got (object) object "[object WebAssembly.Global]"
+PASS WebAssembly mutable global values should be unwrapped when importing in ESM integration
+PASS WebAssembly local global values should be unwrapped when exporting in ESM integration
+PASS WebAssembly module globals from imported WebAssembly modules should be unwrapped
+PASS WebAssembly should properly handle all global types
 
diff --git a/LayoutTests/imported/w3c/web-platform-tests/wasm/jsapi/esm-integration/global-exports.tentative.any.worker-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/wasm/jsapi/esm-integration/global-exports.tentative.any.worker-expected.txt
index 1913b69f275f..f50fb8118401 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/wasm/jsapi/esm-integration/global-exports.tentative.any.worker-expected.txt
+++ b/LayoutTests/imported/w3c/web-platform-tests/wasm/jsapi/esm-integration/global-exports.tentative.any.worker-expected.txt
@@ -1,7 +1,7 @@
 
 PASS WebAssembly module global values should be unwrapped when importing in ESM integration
-FAIL WebAssembly mutable global values should be unwrapped when importing in ESM integration assert_equals: expected (number) 100 but got (object) object "[object WebAssembly.Global]"
-FAIL WebAssembly local global values should be unwrapped when exporting in ESM integration assert_equals: expected (number) 100 but got (object) object "[object WebAssembly.Global]"
-FAIL WebAssembly module globals from imported WebAssembly modules should be unwrapped assert_equals: expected (number) 2001 but got (object) object "[object WebAssembly.Global]"
-FAIL WebAssembly should properly handle all global types assert_equals: expected (number) 100 but got (object) object "[object WebAssembly.Global]"
+PASS WebAssembly mutable global values should be unwrapped when importing in ESM integration
+PASS WebAssembly local global values should be unwrapped when exporting in ESM integration
+PASS WebAssembly module globals from imported WebAssembly modules should be unwrapped
+PASS WebAssembly should properly handle all global types
 
diff --git a/LayoutTests/imported/w3c/web-platform-tests/wasm/jsapi/esm-integration/mutable-global-sharing.tentative.any-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/wasm/jsapi/esm-integration/mutable-global-sharing.tentative.any-expected.txt
index d665f3fea2ae..fe4e3433a5c7 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/wasm/jsapi/esm-integration/mutable-global-sharing.tentative.any-expected.txt
+++ b/LayoutTests/imported/w3c/web-platform-tests/wasm/jsapi/esm-integration/mutable-global-sharing.tentative.any-expected.txt
@@ -1,5 +1,5 @@
 
-FAIL WebAssembly modules should export shared mutable globals with correct initial values assert_equals: expected (number) 100 but got (object) object "[object WebAssembly.Global]"
+PASS WebAssembly modules should export shared mutable globals with correct initial values
 PASS Wasm-to-Wasm mutable global sharing is live
 PASS Multiple JavaScript imports return the same WebAssembly module instance
 PASS v128 globals should work correctly in WebAssembly-to-WebAssembly imports
diff --git a/LayoutTests/imported/w3c/web-platform-tests/wasm/jsapi/esm-integration/mutable-global-sharing.tentative.any.worker-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/wasm/jsapi/esm-integration/mutable-global-sharing.tentative.any.worker-expected.txt
index d665f3fea2ae..fe4e3433a5c7 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/wasm/jsapi/esm-integration/mutable-global-sharing.tentative.any.worker-expected.txt
+++ b/LayoutTests/imported/w3c/web-platform-tests/wasm/jsapi/esm-integration/mutable-global-sharing.tentative.any.worker-expected.txt
@@ -1,5 +1,5 @@
 
-FAIL WebAssembly modules should export shared mutable globals with correct initial values assert_equals: expected (number) 100 but got (object) object "[object WebAssembly.Global]"
+PASS WebAssembly modules should export shared mutable globals with correct initial values
 PASS Wasm-to-Wasm mutable global sharing is live
 PASS Multiple JavaScript imports return the same WebAssembly module instance
 PASS v128 globals should work correctly in WebAssembly-to-WebAssembly imports
diff --git a/LayoutTests/imported/w3c/web-platform-tests/wasm/jsapi/esm-integration/reserved-import-names.tentative.any-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/wasm/jsapi/esm-integration/reserved-import-names.tentative.any-expected.txt
index 0a6c819a77af..9aa83d229ab8 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/wasm/jsapi/esm-integration/reserved-import-names.tentative.any-expected.txt
+++ b/LayoutTests/imported/w3c/web-platform-tests/wasm/jsapi/esm-integration/reserved-import-names.tentative.any-expected.txt
@@ -1,13 +1,7 @@
 
-FAIL wasm: reserved import names should cause WebAssembly.LinkError promise_rejects_js: function "function() { throw e; }" threw object "TypeError: Module name, 'test' does not resolve to a valid URL." ("TypeError") expected instance of function "function LinkError() {
-    [native code]
-}" ("LinkError")
-FAIL wasm-js: reserved import names should cause WebAssembly.LinkError promise_rejects_js: function "function() { throw e; }" threw object "TypeError: Module name, 'test' does not resolve to a valid URL." ("TypeError") expected instance of function "function LinkError() {
-    [native code]
-}" ("LinkError")
-FAIL wasm: reserved export names should cause WebAssembly.LinkError assert_unreached: Should have rejected: undefined Reached unreachable code
-FAIL wasm-js: reserved export names should cause WebAssembly.LinkError assert_unreached: Should have rejected: undefined Reached unreachable code
-FAIL wasm-js: reserved module names should cause WebAssembly.LinkError promise_rejects_js: function "function() { throw e; }" threw object "TypeError: Importing a module script failed." ("TypeError") expected instance of function "function LinkError() {
-    [native code]
-}" ("LinkError")
+PASS wasm: reserved import names should cause WebAssembly.LinkError
+PASS wasm-js: reserved import names should cause WebAssembly.LinkError
+PASS wasm: reserved export names should cause WebAssembly.LinkError
+PASS wasm-js: reserved export names should cause WebAssembly.LinkError
+PASS wasm-js: reserved module names should cause WebAssembly.LinkError
 
diff --git a/LayoutTests/imported/w3c/web-platform-tests/wasm/jsapi/esm-integration/reserved-import-names.tentative.any.worker-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/wasm/jsapi/esm-integration/reserved-import-names.tentative.any.worker-expected.txt
index 4a870bad85cb..9aa83d229ab8 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/wasm/jsapi/esm-integration/reserved-import-names.tentative.any.worker-expected.txt
+++ b/LayoutTests/imported/w3c/web-platform-tests/wasm/jsapi/esm-integration/reserved-import-names.tentative.any.worker-expected.txt
@@ -1,13 +1,7 @@
 
-FAIL wasm: reserved import names should cause WebAssembly.LinkError promise_rejects_js: function "function() { throw e; }" threw object "TypeError: Module name, 'test' does not resolve to a valid URL." ("TypeError") expected instance of function "function LinkError() {
-    [native code]
-}" ("LinkError")
-FAIL wasm-js: reserved import names should cause WebAssembly.LinkError promise_rejects_js: function "function() { throw e; }" threw object "TypeError: Module name, 'test' does not resolve to a valid URL." ("TypeError") expected instance of function "function LinkError() {
-    [native code]
-}" ("LinkError")
-FAIL wasm: reserved export names should cause WebAssembly.LinkError assert_unreached: Should have rejected: undefined Reached unreachable code
-FAIL wasm-js: reserved export names should cause WebAssembly.LinkError assert_unreached: Should have rejected: undefined Reached unreachable code
-FAIL wasm-js: reserved module names should cause WebAssembly.LinkError promise_rejects_js: function "function() { throw e; }" threw object "TypeError: Cross-origin script load denied by Cross-Origin Resource Sharing policy." ("TypeError") expected instance of function "function LinkError() {
-    [native code]
-}" ("LinkError")
+PASS wasm: reserved import names should cause WebAssembly.LinkError
+PASS wasm-js: reserved import names should cause WebAssembly.LinkError
+PASS wasm: reserved export names should cause WebAssembly.LinkError
+PASS wasm-js: reserved export names should cause WebAssembly.LinkError
+PASS wasm-js: reserved module names should cause WebAssembly.LinkError
 
diff --git a/LayoutTests/ipc/cocoa/videoEncode.html b/LayoutTests/ipc/cocoa/videoEncode.html
index c0e81eaba911..2e44a2b1e730 100644
--- a/LayoutTests/ipc/cocoa/videoEncode.html
+++ b/LayoutTests/ipc/cocoa/videoEncode.html
@@ -22,7 +22,7 @@
             id, width, height, startBitrate:62, maxBitrate:91, minBitrate:5, maxFramerate:720916
         });
         CoreIPC.GPU.LibWebRTCCodecsProxy.EncodeFrame(0, {
-            id, buffer:{ time: { timeValue:43, timeScale:79, timeFlags:145 }, mirrored:false, rotation:0, colorSpace: {primaries: {optionalValue: 0}, transfer: {optionalValue: 0}, matrix:{optionalValue: 1}, fullRange: {optionalValue: false}}, buffer:{ alias: { variantType:'WebCore::IntSize', variant : { width, height } } }}, timeStamp:61, duration:{}, shouldEncodeAsKeyFrame:true
+            id, buffer:{ time: { timeValue:43, timeScale:79, timeFlags:145 }, mirrored:false, rotation:0, colorSpace: {primaries: {optionalValue: 0}, transfer: {optionalValue: 0}, matrix:{optionalValue: 1}, fullRange: {optionalValue: false}, chromaLocation: {}}, buffer:{ alias: { variantType:'WebCore::IntSize', variant : { width, height } } }}, timeStamp:61, duration:{}, shouldEncodeAsKeyFrame:true
         });
         CoreIPC.GPU.LibWebRTCCodecsProxy.ReleaseEncoder(0, {
             id
diff --git a/LayoutTests/ipc/coreipc.js b/LayoutTests/ipc/coreipc.js
index a15c63ed87c4..e8ca90faac1f 100644
--- a/LayoutTests/ipc/coreipc.js
+++ b/LayoutTests/ipc/coreipc.js
@@ -245,6 +245,19 @@ const aliases = {
     'CGColorSpaceRef': 'WebKit::CoreIPCCGColorSpace'
 }
 
+// A DestinationColorSpace holding sRGB. Under USE(CG) it is a structured variant; under
+// USE(SKIA) sk_sp<SkColorSpace> crosses IPC as the bytes SkColorSpace::serialize() produces,
+// which IPC.serializedSRGBColorSpace() obtains from the real serializer.
+export function sRGBColorSpace() {
+    if ('WebKit::CoreIPCCGColorSpace' in CoreIPC.typeInfo)
+        return { serializableColorSpace: { alias: { optionalValue: { m_cgColorSpace: { alias: { variantType: 'WebCore::ColorSpace', variant: 19 } } } } } }; // WebCore::ColorSpace::SRGB
+
+    if ('sk_sp<SkColorSpace>' in CoreIPC.typeInfo)
+        return { serializableColorSpace: { alias: { dataReference: IPC.serializedSRGBColorSpace() } } };
+
+    throw new SerializationError('sRGBColorSpace() supports only the CG and Skia serialization formats');
+}
+
 export function resolveAlias(argumentType) {
     if (argumentType in aliases) {
         return resolveAlias(aliases[argumentType]);
@@ -584,6 +597,10 @@ export class ArgumentSerializer {
                 case 'UniqueRef':
                     return ArgumentSerializer.serializeArgument({type: innerType, name: argumentDefinition.name}, argument);
                 default:
+                    // A wrapper class such as sk_sp<SkColorSpace> is a template, but the
+                    // generator describes it like any other struct.
+                    if (argumentDefinition.type in CoreIPC.typeInfo)
+                        break;
                     throw new SerializationError(`Don't know how to serialize template '${ templateType }'`);
             }
         }
diff --git a/LayoutTests/ipc/decode-feConvolveMatrix-kernelSize-overflow.html b/LayoutTests/ipc/decode-feConvolveMatrix-kernelSize-overflow.html
index 32e0afc450e8..9805bb7d9a36 100644
--- a/LayoutTests/ipc/decode-feConvolveMatrix-kernelSize-overflow.html
+++ b/LayoutTests/ipc/decode-feConvolveMatrix-kernelSize-overflow.html
@@ -9,7 +9,7 @@
     if (!window.IPC)
         return testRunner?.notifyDone();
 
-    const { CoreIPC } = await import('./coreipc.js');
+    const { CoreIPC, sRGBColorSpace } = await import('./coreipc.js');
     const renderingBackendIdentifier = randomIPCID();
     o58 = CoreIPC.newStreamConnection();
     CoreIPC.GPU.GPUConnectionToWebProcess.CreateRenderingBackend(
@@ -33,23 +33,7 @@
                         k2 : -0.0000015329670121806829,
                         k3 : 8.407790785948902e-44,
                         k4 : -8.633401098587574e-14,
-                        operatingColorSpace : {
-                            serializableColorSpace: {
-                                alias: {
-                                    optionalValue: {
-                                        m_cgColorSpace: {
-                                            alias: {
-                                                variantType: "WebKit::ICCData",
-                                                variant: {
-                                                    data: [],
-                                                    derivative: 0
-                                                },
-                                            },
-                                        },
-                                    },
-                                },
-                            },
-                        }
+                        operatingColorSpace : sRGBColorSpace()
                         }
                     }
                     },
@@ -57,23 +41,7 @@
                     subclasses : {
                         variantType : 'WebCore::SourceAlpha',
                         variant : {
-                        operatingColorSpace : {
-                            serializableColorSpace: {
-                                alias: {
-                                    optionalValue: {
-                                        m_cgColorSpace: {
-                                            alias: {
-                                                variantType: "WebKit::ICCData",
-                                                variant: {
-                                                    data: [],
-                                                    derivative: 0
-                                                },
-                                            },
-                                        },
-                                    },
-                                },
-                            },
-                        }
+                        operatingColorSpace : sRGBColorSpace()
                         }
                     }
                     },
@@ -83,23 +51,7 @@
                         variant : {
                         floodColor : { data : {} },
                         floodOpacity : -2.4559581509165345e-24,
-                        operatingColorSpace : {
-                            serializableColorSpace: {
-                                alias: {
-                                    optionalValue: {
-                                        m_cgColorSpace: {
-                                            alias: {
-                                                variantType: "WebKit::ICCData",
-                                                variant: {
-                                                    data: [],
-                                                    derivative: 0
-                                                },
-                                            },
-                                        },
-                                    },
-                                },
-                            },
-                        }
+                        operatingColorSpace : sRGBColorSpace()
                         }
                     }
                     },
@@ -112,23 +64,7 @@
                         k2 : -1.175494351e-38,
                         k3 : 1.0369608636003646e-43,
                         k4 : 4.344025239406933e-44,
-                        operatingColorSpace : {
-                            serializableColorSpace: {
-                                alias: {
-                                    optionalValue: {
-                                        m_cgColorSpace: {
-                                            alias: {
-                                                variantType: "WebKit::ICCData",
-                                                variant: {
-                                                    data: [],
-                                                    derivative: 0
-                                                },
-                                            },
-                                        },
-                                    },
-                                },
-                            },
-                        }
+                        operatingColorSpace : sRGBColorSpace()
                         }
                     }
                     },
@@ -137,23 +73,7 @@
                         variantType : 'WebCore::FEMerge',
                         variant : {
                         numberOfEffectInputs : 93,
-                        operatingColorSpace : {
-                            serializableColorSpace: {
-                                alias: {
-                                    optionalValue: {
-                                        m_cgColorSpace: {
-                                            alias: {
-                                                variantType: "WebKit::ICCData",
-                                                variant: {
-                                                    data: [],
-                                                    derivative: 0
-                                                },
-                                            },
-                                        },
-                                    },
-                                },
-                            },
-                        }
+                        operatingColorSpace : sRGBColorSpace()
                         }
                     }
                     },
@@ -161,23 +81,7 @@
                     subclasses : {
                         variantType : 'WebCore::SourceGraphic',
                         variant : {
-                        operatingColorSpace : {
-                            serializableColorSpace: {
-                                alias: {
-                                    optionalValue: {
-                                        m_cgColorSpace: {
-                                            alias: {
-                                                variantType: "WebKit::ICCData",
-                                                variant: {
-                                                    data: [],
-                                                    derivative: 0
-                                                },
-                                            },
-                                        },
-                                    },
-                                },
-                            },
-                        }
+                        operatingColorSpace : sRGBColorSpace()
                         }
                     }
                     },
@@ -196,23 +100,7 @@
                         },
                         preserveAlpha : false,
                         kernel : [],
-                        operatingColorSpace : {
-                            serializableColorSpace: {
-                                alias: {
-                                    optionalValue: {
-                                        m_cgColorSpace: {
-                                            alias: {
-                                                variantType: "WebKit::ICCData",
-                                                variant: {
-                                                    data: [],
-                                                    derivative: 0
-                                                },
-                                            },
-                                        },
-                                    },
-                                },
-                            },
-                        }
+                        operatingColorSpace : sRGBColorSpace()
                         }
                     }
                     }
diff --git a/LayoutTests/ipc/empty-svgfilterrenderer-expression-crash.html b/LayoutTests/ipc/empty-svgfilterrenderer-expression-crash.html
index 3d43984283f8..a6a2d39101e9 100644
--- a/LayoutTests/ipc/empty-svgfilterrenderer-expression-crash.html
+++ b/LayoutTests/ipc/empty-svgfilterrenderer-expression-crash.html
@@ -7,7 +7,7 @@
     window.setTimeout(async () => {
         if (!window.IPC) return window.testRunner?.notifyDone();
 
-        const { CoreIPC } = await import("./coreipc.js");
+        const { CoreIPC, sRGBColorSpace } = await import("./coreipc.js");
 
         const streamConnection = CoreIPC.newStreamConnection();
 
@@ -27,23 +27,7 @@
             renderingMode: 1,
             renderingPurpose: 0,
             resolutionScale: 1,
-            colorSpace: {
-                serializableColorSpace: {
-                    alias: {
-                        optionalValue: {
-                            m_cgColorSpace: {
-                                alias: {
-                                    variantType: "WebKit::ICCData",
-                                    variant: {
-                                        data: [],
-                                        derivative: 0
-                                    },
-                                },
-                            },
-                        },
-                    },
-                },
-            },
+            colorSpace: sRGBColorSpace(),
             bufferFormat: { pixelFormat: 2, useLosslessCompression: 1 },
             identifier: 393236,
             contextIdentifier: 393237,
@@ -79,21 +63,7 @@
                                             xChannelSelector: 0,
                                             yChannelSelector: 4,
                                             scale: 1,
-                                            operatingColorSpace: {
-                                                serializableColorSpace: {
-                                                    alias: {
-                                                        optionalValue: {
-                                                            m_cgColorSpace: {
-                                                                alias: {
-                                                                    variantType:
-                                                                        "WebCore::ColorSpace",
-                                                                    variant: 17,
-                                                                },
-                                                            },
-                                                        },
-                                                    },
-                                                },
-                                            },
+                                            operatingColorSpace: sRGBColorSpace(),
                                             in2IsTainted: false,
                                         },
                                     },
diff --git a/LayoutTests/ipc/fecolormatrix-type-values-mismatch-crash.html b/LayoutTests/ipc/fecolormatrix-type-values-mismatch-crash.html
index 350734b4228e..cb8c7b96f5b4 100644
--- a/LayoutTests/ipc/fecolormatrix-type-values-mismatch-crash.html
+++ b/LayoutTests/ipc/fecolormatrix-type-values-mismatch-crash.html
@@ -8,7 +8,7 @@
             if (!window.IPC)
                 return window.testRunner?.notifyDone();
 
-            const { CoreIPC } = await import('./coreipc.js');
+            const { CoreIPC, sRGBColorSpace } = await import('./coreipc.js');
 
             const streamConnection = CoreIPC.newStreamConnection();
 
@@ -29,20 +29,7 @@
                 renderingMode: 1,
                 renderingPurpose: 0,
                 resolutionScale: 10,
-                colorSpace: {
-                    serializableColorSpace: {
-                        alias: {
-                            optionalValue: {
-                                m_cgColorSpace: {
-                                    alias: {
-                                        variantType: 'WebCore::ColorSpace',
-                                        variant: 1
-                                    }
-                                }
-                            }
-                        }
-                    }
-                },
+                colorSpace: sRGBColorSpace(),
                 pixelFormat: 1,
                 bufferFormat: { pixelFormat: 1, useLosslessCompression: 0 },
                 identifier: imageBufferIdentifier,
@@ -50,7 +37,7 @@
             });
             const remoteImageBuffer = streamConnection.newInterface("RemoteImageBuffer", imageBufferIdentifier);
 
-            const srgbColorSpace = {serializableColorSpace: {alias: {optionalValue: {m_cgColorSpace: {alias: {variantType: 'WebCore::ColorSpace', variant: 1}}}}}};
+            const srgbColorSpace = sRGBColorSpace();
 
             try {
                 remoteImageBuffer.FilteredNativeImage({
diff --git a/LayoutTests/ipc/insufficient-svgfilter-inputs-crash.html b/LayoutTests/ipc/insufficient-svgfilter-inputs-crash.html
index 4ca218eb6981..7e3b725d1438 100644
--- a/LayoutTests/ipc/insufficient-svgfilter-inputs-crash.html
+++ b/LayoutTests/ipc/insufficient-svgfilter-inputs-crash.html
@@ -9,7 +9,7 @@
         if (!window.IPC)
             return window.testRunner?.notifyDone();
     
-        const { CoreIPC } = await import('./coreipc.js');
+        const { CoreIPC, sRGBColorSpace } = await import('./coreipc.js');
     
         const streamConnection = CoreIPC.newStreamConnection();
 
@@ -27,7 +27,7 @@
             renderingMode: 0,
             renderingPurpose: 0,
             resolutionScale: 1.0,
-            colorSpace: {serializableColorSpace: {alias: {optionalValue: {m_cgColorSpace: {alias: {variantType: 'WebCore::ColorSpace', variant: 1}}}}}},
+            colorSpace: sRGBColorSpace(),
             bufferFormat: { pixelFormat: 1, useLosslessCompression: 0 },
             identifier: imageBufferIdentifier,
             contextIdentifier: contextIdentifier,
@@ -57,7 +57,7 @@
                                     variantType: 'WebCore::FEBlend',
                                     variant: {
                                         blendMode: 8,
-                                        operatingColorSpace: {serializableColorSpace: {alias: {optionalValue: {m_cgColorSpace: {alias: {variantType: 'WebCore::ColorSpace', variant: 1}}}}}}
+                                        operatingColorSpace: sRGBColorSpace()
                                     }
                                 }
                             }
diff --git a/LayoutTests/ipc/invalid-feConvolveMatrix-crash.html b/LayoutTests/ipc/invalid-feConvolveMatrix-crash.html
index 15c247cb8385..fea956a81976 100644
--- a/LayoutTests/ipc/invalid-feConvolveMatrix-crash.html
+++ b/LayoutTests/ipc/invalid-feConvolveMatrix-crash.html
@@ -8,7 +8,7 @@
             if (!window.IPC)
                 return window.testRunner?.notifyDone();
 
-            const { CoreIPC } = await import('./coreipc.js');
+            const { CoreIPC, sRGBColorSpace } = await import('./coreipc.js');
 
             const streamConnection = CoreIPC.newStreamConnection();
 
@@ -29,20 +29,7 @@
                 renderingMode: 1,
                 renderingPurpose: 0,
                 resolutionScale: 10,
-                colorSpace: {
-                    serializableColorSpace: {
-                        alias: {
-                            optionalValue: {
-                                m_cgColorSpace: {
-                                    alias: {
-                                        variantType: 'WebCore::ColorSpace',
-                                        variant: 1
-                                    }
-                                }
-                            }
-                        }
-                    }
-                },
+                colorSpace: sRGBColorSpace(),
                 pixelFormat: 1,
                 bufferFormat: { pixelFormat: 1, useLosslessCompression: 0 },
                 identifier: imageBufferIdentifier,
@@ -77,20 +64,7 @@
                                             },
                                             preserveAlpha: true,
                                             kernel: [],
-                                            operatingColorSpace: {
-                                                serializableColorSpace: {
-                                                    alias: {
-                                                        optionalValue: {
-                                                            m_cgColorSpace: {
-                                                                alias: {
-                                                                    variantType: 'WebCore::ColorSpace',
-                                                                    variant: 1
-                                                                }
-                                                            }
-                                                        }
-                                                    }
-                                                }
-                                            }
+                                            operatingColorSpace: sRGBColorSpace()
                                         }
                                     }
                                 }],
diff --git a/LayoutTests/ipc/invalid-svgfilter-expression-crash.html b/LayoutTests/ipc/invalid-svgfilter-expression-crash.html
index 0e0b0747845d..6893db4bc788 100644
--- a/LayoutTests/ipc/invalid-svgfilter-expression-crash.html
+++ b/LayoutTests/ipc/invalid-svgfilter-expression-crash.html
@@ -9,7 +9,7 @@
     if (!window.IPC)
         return window.testRunner?.notifyDone();
 
-    const { CoreIPC } = await import('./coreipc.js');
+    const { CoreIPC, sRGBColorSpace } = await import('./coreipc.js');
 
     const streamConnection = CoreIPC.newStreamConnection();
 
@@ -27,7 +27,7 @@
         renderingMode: 0,
         renderingPurpose: 0,
         resolutionScale: 1.0,
-        colorSpace: {serializableColorSpace: {alias: {optionalValue: {m_cgColorSpace: {alias: {variantType: 'WebCore::ColorSpace', variant: 1}}}}}},
+        colorSpace: sRGBColorSpace(),
         bufferFormat: { pixelFormat: 1, useLosslessCompression: 0 },
         identifier: imageBufferIdentifier,
         contextIdentifier: contextIdentifier
@@ -54,7 +54,7 @@
                                     variantType: 'WebCore::FEBlend',
                                     variant: {
                                         blendMode: 8,
-                                        operatingColorSpace: {serializableColorSpace: {alias: {optionalValue: {m_cgColorSpace: {alias: {variantType: 'WebCore::ColorSpace', variant: 1}}}}}}
+                                        operatingColorSpace: sRGBColorSpace()
                                     }
                                 }
                             }
diff --git a/LayoutTests/ipc/nested-display-list-draw-control-part-crash.html b/LayoutTests/ipc/nested-display-list-draw-control-part-crash.html
index 6c96df22c24d..218c1ebad8a4 100644
--- a/LayoutTests/ipc/nested-display-list-draw-control-part-crash.html
+++ b/LayoutTests/ipc/nested-display-list-draw-control-part-crash.html
@@ -14,7 +14,7 @@
     if (!window.IPC)
         return;
 
-    const { CoreIPC, ArgumentSerializer, StreamConnection } = await import('./coreipc.js');
+    const { CoreIPC, ArgumentSerializer, StreamConnection, sRGBColorSpace } = await import('./coreipc.js');
 
     // CoreIPC.js aliases RetainPtr<CGColorSpaceRef> -> CoreIPCCGColorSpace, but the
     // generated coder wraps it in a leading `bool isEngaged`. Override the field type
@@ -73,7 +73,7 @@
             renderingMode: 0,
             renderingPurpose: 0,
             resolutionScale: 1.0,
-            colorSpace: { serializableColorSpace: { alias: { optionalValue: { m_cgColorSpace: { alias: { variantType: 'WebCore::ColorSpace', variant: 19 } } } } } },
+            colorSpace: sRGBColorSpace(),
             bufferFormat: { pixelFormat: 2, useLosslessCompression: 1 },
             identifier: imageBufferIdentifier,
             contextIdentifier: graphicsContextIdentifier
diff --git a/LayoutTests/ipc/restore-empty-stack-crash.html b/LayoutTests/ipc/restore-empty-stack-crash.html
index fb45edf7dd37..14402eb7d45c 100644
--- a/LayoutTests/ipc/restore-empty-stack-crash.html
+++ b/LayoutTests/ipc/restore-empty-stack-crash.html
@@ -4,12 +4,12 @@
     window.testRunner?.waitUntilDone();
     if (window.IPC) {
         import('./coreipc.js').then(({
-            CoreIPC
+            CoreIPC, sRGBColorSpace
         }) => {
             o10=CoreIPC.newStreamConnection();
             CoreIPC.GPU.GPUConnectionToWebProcess.CreateRenderingBackend(0,{renderingBackendIdentifier:393219,connectionHandle:o10});
             o12=o10.newInterface("RemoteRenderingBackend", 393219);
-            o12.CreateImageBuffer({logicalSize:{width:32,height:18},renderingMode:3,renderingPurpose:1,resolutionScale:489626271805,colorSpace:{serializableColorSpace:{alias:{optionalValue:{m_cgColorSpace:{alias:{variantType:'WebCore::ColorSpace',variant:5}}}}}},pixelFormat:1,bufferFormat:{pixelFormat:1,useLosslessCompression:0},identifier:393225,contextIdentifier:393226});
+            o12.CreateImageBuffer({logicalSize:{width:32,height:18},renderingMode:3,renderingPurpose:1,resolutionScale:489626271805,colorSpace:sRGBColorSpace(),pixelFormat:1,bufferFormat:{pixelFormat:1,useLosslessCompression:0},identifier:393225,contextIdentifier:393226});
             o10.connection.waitForMessage(393225, IPC.messages.RemoteImageBufferProxy_DidCreateBackend.name, 1);
             o31=o10.newInterface("RemoteGraphicsContext", 393226);
             o31.Restore({});
diff --git a/LayoutTests/ipc/serialized-type-info.html b/LayoutTests/ipc/serialized-type-info.html
index 5aa1204e40c7..17800540109f 100644
--- a/LayoutTests/ipc/serialized-type-info.html
+++ b/LayoutTests/ipc/serialized-type-info.html
@@ -188,6 +188,9 @@
                         result.push("WKDDActionContext");
                     }
                 }
+            } else {
+                result.push("UnixFileDescriptor");
+                result.push("GTlsCertificateFlags");
             }
         }
         return result.sort();
diff --git a/LayoutTests/platform/glib/TestExpectations b/LayoutTests/platform/glib/TestExpectations
index c8cde2869f6f..5804233c239b 100644
--- a/LayoutTests/platform/glib/TestExpectations
+++ b/LayoutTests/platform/glib/TestExpectations
@@ -428,7 +428,7 @@ imported/w3c/web-platform-tests/css/css-transforms/transform3d-preserve3d-013.ht
 imported/w3c/web-platform-tests/css/css-transforms/transforms-skewY.html [ Pass ]
 imported/w3c/web-platform-tests/css/css-view-transitions/massive-element-right-of-viewport-partially-onscreen-new.html [ Pass ]
 imported/w3c/web-platform-tests/css/selectors/selectors-4/lang-020.html [ Pass ]
-imported/w3c/web-platform-tests/css/css-ui/text-overflow-028.html [ Pass ]
+imported/w3c/web-platform-tests/css/css-overflow/text-overflow-028.html [ Pass ]
 
 # css-values passing for us.
 imported/w3c/web-platform-tests/css/css-values/ch-unit-003.html [ Pass ]
@@ -1250,9 +1250,6 @@ accessibility/statictext-path.html [ Failure ]
 # aria-braille* attributes are not implemented:
 webkit.org/b/220719 accessibility/braille-label-role.html [ Failure ]
 
-# Key events for AX actions seems to not be not being emitted
-webkit.org/b/221022 accessibility/keyevents-for-actions-mimic-real-key-events.html [ Timeout ]
-
 # Test requires WebKitTestRunner property 'standaloneWebApplicationURL', which is only implemented for Cocoa platforms.
 http/tests/resourceLoadStatistics/standalone-web-application-exempt-from-website-data-deletion.html [ Skip ]
 
@@ -1898,7 +1895,7 @@ webkit.org/b/224767 imported/w3c/web-platform-tests/media-source/mediasource-cha
 # See also bug #175578.
 webkit.org/b/167108 imported/w3c/web-platform-tests/media-source/mediasource-avtracks.html [ Failure ]
 
-webkit.org/b/167108 imported/w3c/web-platform-tests/media-source/mediasource-duration.html [ Failure ]
+webkit.org/b/167108 imported/w3c/web-platform-tests/media-source/mediasource-duration.html [ Failure Pass ]
 
 webkit.org/b/210486 imported/w3c/web-platform-tests/media-source/mediasource-correct-frames-after-reappend.html [ Failure ]
 
@@ -2115,11 +2112,6 @@ http/tests/push-api [ Skip ]
 
 webkit.org/b/202750 http/tests/download/anchor-download-attribute-content-disposition-no-extension-text-plain.html [ Failure ]
 
-# libsoup 3.6.6 mangles interior spaces in Content-Disposition filenames to '_'
-# (regressed by libsoup 9e1570c9, fixed upstream by db09564e). Remove once the
-# SDK ships a libsoup with that fix.
-http/tests/download/basic-ascii.html [ Failure ]
-
 # There is no network load scheduling or prioritization with NetworkProcess.
 webkit.org/b/123431 http/tests/local/link-stylesheet-load-order-preload.html [ Failure ]
 webkit.org/b/123431 http/tests/local/link-stylesheet-load-order.html [ Failure ]
@@ -2848,7 +2840,7 @@ imported/w3c/web-platform-tests/webrtc-extensions/transfer-datachannel-service-w
 imported/w3c/web-platform-tests/webrtc/simulcast/setParameters-maxFramerate.https.html [ Skip ] # Timeout
 imported/w3c/web-platform-tests/webrtc/simulcast/vp9-scalability-mode.https.html [ Skip ] # Timeout
 webrtc/getDisplayMedia-odd-size.html [ Skip ] # Timeout
-webrtc/video-rotation.html [ Failure ]
+webkit.org/b/322821 webrtc/video-rotation.html [ Failure Pass Timeout ]
 webrtc/video-maxBitrate-vp8.html [ Skip ] # Timeout
 webrtc/video-maxBitrate.html [ Skip ] # Timeout
 
@@ -2961,7 +2953,7 @@ imported/w3c/web-platform-tests/webrtc-encoded-transform/tentative/RTCEncodedFra
 http/wpt/webrtc/video-script-transform-simulcast.html [ Skip ]
 
 # This test is a constant failure (assert_true: front stream should be small expected true got false).
-webkit.org/b/313153 webrtc/video-replace-track.html [ Failure ]
+webkit.org/b/313153 webrtc/video-replace-track.html [ Failure Timeout ]
 
 # GStreamerRtpSenderBackend::setMediaStreamIds() unimplemented.
 webkit.org/b/235885 webrtc/video.html [ Skip ]
@@ -2999,7 +2991,6 @@ webkit.org/b/235885 webrtc/canvas-to-peer-connection-vp8.html [ Failure ]
 imported/w3c/web-platform-tests/webrtc/RTCDataChannel-worker-GC.html [ Skip ] # Timeout
 imported/w3c/web-platform-tests/webrtc/RTCPeerConnection-remote-track-currentTime.https.html [ Failure ]
 imported/w3c/web-platform-tests/webrtc/RTCRtpReceiver-track-settings.tentative.html [ Failure ]
-imported/w3c/web-platform-tests/webrtc/rtp-stats-lifetime.https.html?interop-2026 [ Failure ]
 
 # The last promise test here fails because webrtcbin doesn't rely on a singleton signaling thread.
 # See also comments in:
@@ -3161,10 +3152,12 @@ imported/w3c/web-platform-tests/html/semantics/forms/the-meter-element/meter-app
 imported/w3c/web-platform-tests/html/semantics/forms/the-meter-element/meter-appearance-none-suboptimum-value-rendering.html [ ImageOnlyFailure ]
 
 # Passes for GTK/WPE (but not for Mac/iOS) after WPT update of css-writing-modes tests
+webkit.org/b/214291 imported/w3c/web-platform-tests/css/css-writing-modes/available-size-001.html [ Pass ]
 webkit.org/b/214291 imported/w3c/web-platform-tests/css/css-writing-modes/available-size-004.html [ Pass ]
 webkit.org/b/214291 imported/w3c/web-platform-tests/css/css-writing-modes/available-size-006.html [ Pass ]
 webkit.org/b/214291 imported/w3c/web-platform-tests/css/css-writing-modes/available-size-008.html [ Pass ]
 webkit.org/b/214291 imported/w3c/web-platform-tests/css/css-writing-modes/available-size-009.html [ Pass ]
+webkit.org/b/214291 imported/w3c/web-platform-tests/css/css-writing-modes/available-size-012.html [ Pass ]
 webkit.org/b/214291 imported/w3c/web-platform-tests/css/css-writing-modes/available-size-015.html [ Pass ]
 webkit.org/b/214291 imported/w3c/web-platform-tests/css/css-writing-modes/available-size-016.html [ Pass ]
 webkit.org/b/214291 imported/w3c/web-platform-tests/css/css-writing-modes/available-size-018.html [ Pass ]
@@ -3219,9 +3212,6 @@ imported/w3c/web-platform-tests/css/css-images/infinite-radial-gradient-refcrash
 
 webkit.org/b/203448 imported/w3c/web-platform-tests/css/css-position/position-absolute-dynamic-static-position-table-cell.html [ Pass ]
 
-webkit.org/b/209080 imported/w3c/web-platform-tests/css/css-writing-modes/available-size-001.html [ Pass ]
-webkit.org/b/209080 imported/w3c/web-platform-tests/css/css-writing-modes/available-size-012.html [ Pass ]
-
 webkit.org/b/215799 imported/w3c/web-platform-tests/css/css-content/quotes-005.html [ ImageOnlyFailure ]
 
 # WIRELESS_PLAYBACK_TARGET not enabled.
@@ -3406,19 +3396,16 @@ http/tests/ipc/webpageproxy-didfailload-failingurl-message-check.html [ Skip ]
 # CertificateInfo serializes a GRefPtr<GTlsCertificate> that coreipc.js cannot construct.
 http/tests/ipc/createnewpage-file-body-sandbox-extension.html [ Skip ]
 
-# Generic regressions whose IPC payload needs porting to Skia's colorspace format.
-ipc/nested-display-list-draw-control-part-crash.html [ Skip ]
-ipc/move-to-image-buffer-cross-thread-font-crash.html [ Skip ]
+# RemoteRenderingBackend::PrepareImageBufferSetsForDisplay is PLATFORM(COCOA).
 ipc/remotedisplaylistrecorder-drawcontrolpart-slidertrackpart-crash.html [ Skip ]
-ipc/decode-feConvolveMatrix-kernelSize-overflow.html [ Skip ]
-ipc/fecolormatrix-type-values-mismatch-crash.html [ Skip ]
-ipc/insufficient-svgfilter-inputs-crash.html [ Skip ]
-ipc/invalid-feConvolveMatrix-crash.html [ Skip ]
-ipc/invalid-svgfilter-expression-crash.html [ Skip ]
 ipc/mark-surfaces-volatile-during-prepare-for-display.html [ Skip ]
-ipc/restore-empty-stack-crash.html [ Skip ]
+
+# Hardcodes Cocoa's WebCore::FontPlatformDataAttributes in the IPC payload.
+ipc/move-to-image-buffer-cross-thread-font-crash.html [ Skip ]
+
+# Sends WebCore::PixelFormat index 3; the glib ports enable none of RGB10, RGB10A8
+# and RGBA16F, so the enum stops at BGRA8.
 ipc/convert-to-luminance-mask-float16.html [ Skip ]
-ipc/empty-svgfilterrenderer-expression-crash.html [ Skip ]
 
 # ATTACHMENT_ELEMENT is disabled in glib ports.
 ipc/restrictedendpoints/allow-access-attachmentElement.html [ Skip ]
@@ -4006,8 +3993,6 @@ webkit.org/b/297178 media/media-source/media-source-paint-stereo-to-canvas.html
 
 # Flaky failure
 webkit.org/b/175419 imported/w3c/web-platform-tests/fetch/api/abort/serviceworker-intercepted.https.html [ Pass Failure ]
-# This test fails both invalid-chunked-encoding cases
-webkit.org/b/175419 imported/w3c/web-platform-tests/service-workers/service-worker/registration-script.https.html [ Failure ]
 # This test requires the ServiceWorkerRegistration.showNotification
 webkit.org/b/175419 http/tests/workers/service/openwindow-from-notification-click.html [ Skip ]
 
@@ -4047,8 +4032,6 @@ webkit.org/b/199001 accessibility/set-selected-text-range-after-newline.html [ F
 imported/w3c/web-platform-tests/websockets/keeping-connection-open/001.html?wss [ Slow ]
 
 # Issues with WebSockets, many due to macOS/iOS and "glib" dealing with console messages differently
-webkit.org/b/206652 imported/w3c/web-platform-tests/websockets/constructor/011.html?default [ Failure ]
-webkit.org/b/206652 imported/w3c/web-platform-tests/websockets/constructor/011.html?wss [ Failure ]
 webkit.org/b/252878 imported/w3c/web-platform-tests/websockets/multi-globals/message-received.html?wss [ Failure Pass ]
 webkit.org/b/252878 imported/w3c/web-platform-tests/websockets/unload-a-document/003.html?wss [ Failure Pass ]
 webkit.org/b/252878 imported/w3c/web-platform-tests/websockets/unload-a-document/004.html?wss [ Failure Pass ]
@@ -4065,9 +4048,6 @@ webkit.org/b/201981 http/wpt/resource-timing/rt-resources-per-worker.html [ Fail
 
 webkit.org/b/306019 imported/w3c/web-platform-tests/resource-timing/resource_timing.worker.html [ Failure Pass ]
 
-# ch units should be ignored in these tests.
-webkit.org/b/206001 imported/w3c/web-platform-tests/css/css-values/ch-unit-017.html [ ImageOnlyFailure ]
-
 # WPT fetch tests.
 webkit.org/b/206416 imported/w3c/web-platform-tests/fetch/range/sw.https.window.html [ Failure ]
 
@@ -4076,19 +4056,6 @@ imported/w3c/web-platform-tests/fetch/content-encoding/gzip/bad-gzip-body.any.ht
 imported/w3c/web-platform-tests/fetch/content-encoding/gzip/bad-gzip-body.any.serviceworker.html [ Failure ]
 imported/w3c/web-platform-tests/fetch/content-encoding/gzip/bad-gzip-body.any.sharedworker.html [ Failure ]
 imported/w3c/web-platform-tests/fetch/content-encoding/gzip/bad-gzip-body.any.worker.html [ Failure ]
-imported/w3c/web-platform-tests/fetch/content-encoding/zstd/bad-zstd-body.https.any.html [ Failure ]
-imported/w3c/web-platform-tests/fetch/content-encoding/zstd/bad-zstd-body.https.any.serviceworker.html [ Failure ]
-imported/w3c/web-platform-tests/fetch/content-encoding/zstd/bad-zstd-body.https.any.sharedworker.html [ Failure ]
-imported/w3c/web-platform-tests/fetch/content-encoding/zstd/bad-zstd-body.https.any.worker.html [ Failure ]
-imported/w3c/web-platform-tests/fetch/content-encoding/zstd/big-zstd-body.https.any.html [ Failure ]
-imported/w3c/web-platform-tests/fetch/content-encoding/zstd/big-zstd-body.https.any.serviceworker.html [ Failure ]
-imported/w3c/web-platform-tests/fetch/content-encoding/zstd/big-zstd-body.https.any.sharedworker.html [ Failure ]
-imported/w3c/web-platform-tests/fetch/content-encoding/zstd/big-zstd-body.https.any.worker.html [ Failure ]
-imported/w3c/web-platform-tests/fetch/content-encoding/zstd/zstd-body.https.any.html [ Failure ]
-imported/w3c/web-platform-tests/fetch/content-encoding/zstd/zstd-body.https.any.serviceworker.html [ Failure ]
-imported/w3c/web-platform-tests/fetch/content-encoding/zstd/zstd-body.https.any.sharedworker.html [ Failure ]
-imported/w3c/web-platform-tests/fetch/content-encoding/zstd/zstd-body.https.any.worker.html [ Failure ]
-imported/w3c/web-platform-tests/fetch/content-encoding/zstd/zstd-navigation.https.window.html [ Failure ]
 imported/w3c/web-platform-tests/fetch/content-length/too-long.window.html [ Failure ]
 imported/w3c/web-platform-tests/fetch/content-type/response.window.html [ Failure ]
 imported/w3c/web-platform-tests/fetch/http-cache/partial.any.html [ Failure ]
@@ -4358,6 +4325,7 @@ imported/w3c/web-platform-tests/css/css-scroll-snap/input/mouse-wheel.html [ Ski
 imported/w3c/web-platform-tests/css/css-scroll-snap/snap-at-user-scroll-end.html [ Skip ]
 imported/w3c/web-platform-tests/css/css-transforms/scroll-preserve-3d.html [ Skip ]
 imported/w3c/web-platform-tests/dom/events/non-cancelable-when-passive [ Skip ]
+imported/w3c/web-platform-tests/html/semantics/popovers/popover-focus-invoker-inside-popover.html [ Skip ]
 imported/w3c/web-platform-tests/html/semantics/popovers/popover-light-dismiss-scroll-within.html [ Skip ]
 imported/w3c/web-platform-tests/html/semantics/popovers/popover-self-invoke.html [ Skip ]
 imported/w3c/web-platform-tests/uievents/order-of-events/mouse-events/wheel-scrolling.html [ Skip ]
@@ -5224,7 +5192,6 @@ imported/w3c/web-platform-tests/webcodecs/videoFrame-copyTo.crossOriginIsolated.
 imported/w3c/web-platform-tests/workers/Worker-creation-happens-in-parallel.https.html [ Skip ]
 imported/w3c/web-platform-tests/workers/postMessage_block.https.html [ Skip ]
 imported/w3c/web-platform-tests/workers/Worker-postMessage-happens-in-parallel.https.html [ Skip ]
-ipc/serialized-type-info.html [ Skip ]
 ipc/stream-sync-reply-shared-memory.html [ Skip ]
 webkit.org/b/297737 ipc/send-gradient.html [ Skip ]
 webkit.org/b/297737 ipc/send-filter.html [ Skip ]
@@ -5305,13 +5272,15 @@ webkit.org/b/319045 [ Debug ] accessibility/button-in-deep-dom.html [ Timeout ]
 webkit.org/b/319047 [ Debug ] imported/w3c/web-platform-tests/css/css-overflow/line-clamp/line-clamp-033.html [ Crash ]
 webkit.org/b/319049 [ Debug ] http/tests/cache/cancel-multiple-post-xhrs.html [ Pass Failure ]
 webkit.org/b/319050 [ Debug ] imported/w3c/web-platform-tests/fetch/local-network-access/iframe.tentative.https.window.html [ Failure ]
-webkit.org/b/319051 [ Debug ] imported/w3c/web-platform-tests/uievents/mouse/mouse_boundary_events_after_removing_last_over_element.html [ Failure ]
+webkit.org/b/319051 [ Debug ] imported/w3c/web-platform-tests/uievents/mouse/mouse_boundary_events_after_removing_last_over_element.html [ Failure Pass ]
 webkit.org/b/319052 [ Debug ] http/tests/websocket/tests/hybi/inspector/handshake-error.html [ Pass Failure ]
 webkit.org/b/319053 [ Debug ] media/video-playback-restriction-play-before-load.html [ Failure ]
 webkit.org/b/319310 [ Debug ] fast/repaint/iframe-avoid-redundant-repaint.html [ Failure Pass ]
 webkit.org/b/319311 [ Debug ] fast/repaint/missing-out-of-flow-repaint-on-destroy.html [ Pass ImageOnlyFailure ]
 webkit.org/b/319312 [ Debug ] workers/bomb.html [ Skip ]
 
+imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-023.html [ ImageOnlyFailure ]
+
 webkit.org/b/319950 imported/w3c/web-platform-tests/css/css-pseudo/marker-hit-testing.html [ Failure ]
 
 # WebTransport is Cocoa-only (non-Cocoa ports are a stub). https://bugs.webkit.org/show_bug.cgi?id=319008
@@ -5400,6 +5369,10 @@ webkit.org/b/322641 [ Debug ] imported/w3c/web-platform-tests/web-animations/tim
 webkit.org/b/322642 [ Debug ] imported/w3c/web-platform-tests/webaudio/the-audio-api/the-audioworklet-interface/audioworkletprocessor-unconnected-outputs.https.window.html [ Pass Failure ]
 webkit.org/b/322646 [ Debug ] media/track/track-readiness-state.html [ Pass Failure ]
 
+webkit.org/b/322814 imported/w3c/web-platform-tests/mediacapture-record/MediaRecorder-error.html [ Crash Failure Pass ]
+webkit.org/b/322815 imported/w3c/web-platform-tests/mediacapture-record/MediaRecorder-pause-resume.html [ Pass Timeout ]
+webkit.org/b/322816 imported/w3c/web-platform-tests/resource-timing/initiator-type/style.html [ Failure Pass ]
+
 # End: Common failures between GTK and WPE.
 
 #////////////////////////////////////////////////////////////////////////////////////////
diff --git a/LayoutTests/platform/gtk/TestExpectations b/LayoutTests/platform/gtk/TestExpectations
index 257a1131d315..b44ff7efa928 100644
--- a/LayoutTests/platform/gtk/TestExpectations
+++ b/LayoutTests/platform/gtk/TestExpectations
@@ -24,7 +24,6 @@ fast/scrolling/gtk [ Pass ]
 swipe [ Pass ]
 
 webkit.org/b/254521 [ Release ] imported/w3c/web-platform-tests/media-source/mediasource-getvideoplaybackquality.html [ Pass Failure ]
-webkit.org/b/277912 imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-backdrop-filter-overflow.html [ ImageOnlyFailure ]
 imported/w3c/web-platform-tests/css/CSS2/linebox/vertical-align-baseline-009.xht [ Pass ]
 imported/w3c/web-platform-tests/css/css-anchor-position/anchor-scroll-to-sticky-003.html [ Pass ]
 imported/w3c/web-platform-tests/css/css-anchor-position/anchor-scroll-to-sticky-004.html [ Pass ]
@@ -1262,9 +1261,9 @@ webkit.org/b/319058 [ Debug ] media/media-h264-webm-error.html [ Failure ]
 webkit.org/b/319059 [ Debug ] media/vp9.html [ Failure ]
 webkit.org/b/319060 [ Debug ] media/auto-play-video-in-about-blank-iframe.html [ Failure ]
 webkit.org/b/319061 [ Debug ] media/muted-video-is-playing-audio.html [ Timeout ]
-webkit.org/b/319062 [ Debug ] inspector/dom/getMediaStats.html [ Failure ]
+webkit.org/b/319062 [ Debug ] inspector/dom/getMediaStats.html [ Failure Pass ]
 webkit.org/b/319063 [ Debug ] fullscreen/full-screen-enter-while-exiting.html [ Timeout ]
-webkit.org/b/319064 [ Debug ] fullscreen/video-inside-flex-item.html [ Failure ]
+webkit.org/b/319064 [ Debug ] fullscreen/video-inside-flex-item.html [ Failure Pass ]
 webkit.org/b/319066 [ Debug ] imported/w3c/web-platform-tests/css/css-view-transitions/view-transition-waituntil-finished-promise.html [ Failure ]
 
 webkit.org/b/319072 imported/w3c/web-platform-tests/html/semantics/embedded-content/the-audio-element/audio-loading-lazy-window-onload.html [ Failure Pass ]
@@ -1323,3 +1322,8 @@ webkit.org/b/322648 [ Debug ] navigation-api/navigation-api-rate-limit-history-a
 webkit.org/b/322650 [ Debug ] webrtc/video-h264.html [ Pass Failure ]
 webkit.org/b/322651 [ Debug ] webrtc/video-remote-mute.html [ Pass Failure ]
 webkit.org/b/322652 [ Debug ] workers/btoa-oom.html [ Pass Timeout ]
+webkit.org/b/322811 [ Debug ] fast/mediastream/applyConstraints-with-takePhoto.html [ Pass Timeout ]
+webkit.org/b/322818 [ Debug ] imported/w3c/web-platform-tests/wasm/core/simd/simd_f32x4_cmp.wast.js.html [ Pass Timeout ]
+webkit.org/b/322819 [ Debug ] imported/w3c/web-platform-tests/wasm/core/simd/simd_f64x2_cmp.wast.js.html [ Pass Timeout ]
+webkit.org/b/319070 [ Debug ] imported/w3c/web-platform-tests/wasm/core/simd/simd_f32x4_rounding.wast.js.html [ Pass Timeout ]
+webkit.org/b/322820 [ Release ] media/video-seek-past-end-paused.html [ Failure Pass ]
diff --git a/LayoutTests/platform/ios/TestExpectations b/LayoutTests/platform/ios/TestExpectations
index 66b591edb373..f2a46d8ff060 100644
--- a/LayoutTests/platform/ios/TestExpectations
+++ b/LayoutTests/platform/ios/TestExpectations
@@ -207,7 +207,9 @@ imported/w3c/web-platform-tests/payment-request/payment-request-disallowed-when-
 imported/w3c/web-platform-tests/html/rendering/non-replaced-elements/form-controls/text-transform.html [ ImageOnlyFailure ]
 imported/w3c/web-platform-tests/html/rendering/non-replaced-elements/phrasing-content-0/br-wbr-content/content-property.tentative.html [ ImageOnlyFailure ]
 
-webkit.org/b/259089 imported/w3c/web-platform-tests/css/css-ui/text-overflow-028.html [ ImageOnlyFailure ]
+webkit.org/b/259089 imported/w3c/web-platform-tests/css/css-overflow/text-overflow-028.html [ ImageOnlyFailure ]
+
+imported/w3c/web-platform-tests/css/css-overflow/before-after-pseudo-element-scrolling.html [ ImageOnlyFailure ]
 
 webkit.org/b/279302 imported/w3c/web-platform-tests/css/css-ui/outline-width-rounding.tentative.html [ Failure ]
 webkit.org/b/279302 imported/w3c/web-platform-tests/css/css-ui/parsing/outline-width-computed.html [ Failure ]
@@ -280,6 +282,9 @@ fast/images/jpegxl-with-color-profile.html [ Pass ]
 # Video as an image source is only supported on macOS and iOS.
 fast/images/video-as-image.html [ Pass ]
 
+# ImageIO rejects an acTL declaring zero frames, so the default image never decodes.
+fast/images/apng-acTL-zero-frame-count.html [ Skip ]
+
 # No fullscreen API on iOS
 fullscreen
 http/tests/fullscreen
@@ -7356,10 +7361,10 @@ imported/w3c/web-platform-tests/css/css-text/white-space/pre-wrap-leading-spaces
 imported/w3c/web-platform-tests/css/css-text/white-space/pre-wrap-leading-spaces-013.html [ Pass ImageOnlyFailure ]
 imported/w3c/web-platform-tests/css/css-transitions/render-blocking/no-transition-from-ua-to-blocking-stylesheet.html [ Pass ImageOnlyFailure ]
 imported/w3c/web-platform-tests/css/css-ui/outline-028.html [ Pass ImageOnlyFailure ]
-imported/w3c/web-platform-tests/css/css-ui/text-overflow-010.html [ Pass ImageOnlyFailure ]
-imported/w3c/web-platform-tests/css/css-ui/text-overflow-011.html [ Pass ImageOnlyFailure ]
-imported/w3c/web-platform-tests/css/css-ui/text-overflow-013.html [ Pass ImageOnlyFailure ]
-imported/w3c/web-platform-tests/css/css-ui/text-overflow-014.html [ Pass ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/text-overflow-010.html [ Pass ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/text-overflow-011.html [ Pass ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/text-overflow-013.html [ Pass ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/text-overflow-014.html [ Pass ImageOnlyFailure ]
 fast/forms/textfield-outline.html [ Pass Failure ]
 http/tests/security/clipboard/copy-paste-html-across-origin-sanitizes-html.html [ Pass Failure ]
 http/tests/security/clipboard/copy-paste-html-across-origin-strips-mso-list.html [ Pass Failure ]
@@ -10139,10 +10144,10 @@ imported/w3c/web-platform-tests/svg/animations/reinserting-svg-into-document.htm
 
 imported/w3c/web-platform-tests/pointerevents/pointerevent_releasepointercapture_onpointercancel_touch.html [ Pass Failure ] # rdar://178676720
 
-imported/w3c/web-platform-tests/css/css-ui/text-overflow-001.html [ Pass ImageOnlyFailure ] # rdar://178676888
-imported/w3c/web-platform-tests/css/css-ui/text-overflow-002.html [ Pass ImageOnlyFailure ] # rdar://178676888
-imported/w3c/web-platform-tests/css/css-ui/text-overflow-004.html [ Pass ImageOnlyFailure ] # rdar://178676888
-imported/w3c/web-platform-tests/css/css-ui/text-overflow-003.html [ Pass ImageOnlyFailure ] # rdar://178676888
+imported/w3c/web-platform-tests/css/css-overflow/text-overflow-001.html [ Pass ImageOnlyFailure ] # rdar://178676888
+imported/w3c/web-platform-tests/css/css-overflow/text-overflow-002.html [ Pass ImageOnlyFailure ] # rdar://178676888
+imported/w3c/web-platform-tests/css/css-overflow/text-overflow-004.html [ Pass ImageOnlyFailure ] # rdar://178676888
+imported/w3c/web-platform-tests/css/css-overflow/text-overflow-003.html [ Pass ImageOnlyFailure ] # rdar://178676888
 
 imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/modal-dialog-in-iframe.html [ Pass ImageOnlyFailure ] # rdar://178676913
 imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/modal-dialog-generated-content.html [ Pass ImageOnlyFailure ] # rdar://178676913
diff --git a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/W3C-SVG-1.1/coords-viewattr-01-b-expected.txt b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/W3C-SVG-1.1/coords-viewattr-01-b-expected.txt
index d0c3cf2cd29f..e93786598c2b 100644
--- a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/W3C-SVG-1.1/coords-viewattr-01-b-expected.txt
+++ b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/W3C-SVG-1.1/coords-viewattr-01-b-expected.txt
@@ -48,7 +48,7 @@ layer at (0,-27.75) size 112x58 backgroundClip at (0,0) size 480x360 clip at (0,
 layer at (0,0) size 50x31 backgroundClip at (0,0) size 30x40
   RenderSVGViewportContainer {svg} at (0,12.75) size 50x30
     RenderSVGRect {rect} at (0.50,0.50) size 29x39 [stroke={[type=SOLID] [color=#FF0000]}] [fill={[type=SOLID] [color=#000000]}] [x=0.50] [y=0.50] [width=29.00] [height=39.00]
-layer at (5,5) size 20x20 backgroundClip at (120,80) size 50x30 clip at (120,80) size 50x30
+layer at (5,5) size 20x20
   RenderSVGTransformableContainer {g} at (5,5) size 20x20
     RenderSVGEllipse {circle} at (0,0) size 20x20 [fill={[type=SOLID] [color=#FFFF00]}] [cx=15.00] [cy=15.00] [r=10.00]
     RenderSVGEllipse {circle} at (5.50,5.50) size 3x3 [fill={[type=SOLID] [color=#000000]}] [cx=12.00] [cy=12.00] [r=1.50]
@@ -60,10 +60,10 @@ layer at (0,-12.75) size 50x43 backgroundClip at (0,0) size 480x360 clip at (0,0
       RenderSVGInlineText {#text} at (0,0) size 25x10
         chunk 1 text run 1 at (0.00,-5.00) startOffset 0 endOffset 5 width 24.00: "xMid*"
     RenderSVGRect {rect} at (0.50,13.25) size 49x29 [stroke={[type=SOLID] [color=#0000FF]}] [x=0.50] [y=0.50] [width=49.00] [height=29.00]
-layer at (0,0) size 50x31 backgroundClip at (0,0) size 30x40 clip at (0,0) size 48.34x40
+layer at (0,0) size 50x31 backgroundClip at (0,0) size 30x40
   RenderSVGViewportContainer {svg} at (0,12.75) size 50x30
     RenderSVGRect {rect} at (0.50,0.50) size 29x39 [stroke={[type=SOLID] [color=#FF0000]}] [fill={[type=SOLID] [color=#000000]}] [x=0.50] [y=0.50] [width=29.00] [height=39.00]
-layer at (5,5) size 20x20 backgroundClip at (189.98,80) size 50.02x30 clip at (189.98,80) size 50.02x30
+layer at (5,5) size 20x20
   RenderSVGTransformableContainer {g} at (5,5) size 20x20
     RenderSVGEllipse {circle} at (0,0) size 20x20 [fill={[type=SOLID] [color=#FFFF00]}] [cx=15.00] [cy=15.00] [r=10.00]
     RenderSVGEllipse {circle} at (5.50,5.50) size 3x3 [fill={[type=SOLID] [color=#000000]}] [cx=12.00] [cy=12.00] [r=1.50]
@@ -75,10 +75,10 @@ layer at (0,-12.75) size 50x43 backgroundClip at (0,0) size 480x360 clip at (0,0
       RenderSVGInlineText {#text} at (0,0) size 26x10
         chunk 1 text run 1 at (0.00,-5.00) startOffset 0 endOffset 5 width 25.50: "xMax*"
     RenderSVGRect {rect} at (0.50,13.25) size 49x29 [stroke={[type=SOLID] [color=#0000FF]}] [x=0.50] [y=0.50] [width=49.00] [height=29.00]
-layer at (0,0) size 50x31 backgroundClip at (0,0) size 30x40 clip at (0,0) size 30.02x40
+layer at (0,0) size 50x31 backgroundClip at (0,0) size 30x40
   RenderSVGViewportContainer {svg} at (0,12.75) size 50x30
     RenderSVGRect {rect} at (0.50,0.50) size 29x39 [stroke={[type=SOLID] [color=#FF0000]}] [fill={[type=SOLID] [color=#000000]}] [x=0.50] [y=0.50] [width=29.00] [height=39.00]
-layer at (5,5) size 20x20 backgroundClip at (119.98,130) size 50.02x30 clip at (119.98,130) size 50.02x30
+layer at (5,5) size 20x20
   RenderSVGTransformableContainer {g} at (5,5) size 20x20
     RenderSVGEllipse {circle} at (0,0) size 20x20 [fill={[type=SOLID] [color=#FFFF00]}] [cx=15.00] [cy=15.00] [r=10.00]
     RenderSVGEllipse {circle} at (5.50,5.50) size 3x3 [fill={[type=SOLID] [color=#000000]}] [cx=12.00] [cy=12.00] [r=1.50]
@@ -94,10 +94,10 @@ layer at (0,-27.75) size 124x88 backgroundClip at (0,0) size 480x360 clip at (0,
         RenderSVGInlineText {#text} at (0,0) size 27x10
           chunk 1 text run 1 at (0.00,-5.00) startOffset 0 endOffset 5 width 26.00: "*YMin"
       RenderSVGRect {rect} at (0.50,13.25) size 29x59 [stroke={[type=SOLID] [color=#0000FF]}] [x=0.50] [y=0.50] [width=29.00] [height=59.00]
-layer at (0,0) size 30x61 backgroundClip at (0,0) size 30x60 clip at (0,0) size 30x60
+layer at (0,0) size 30x61 backgroundClip at (0,0) size 30x60
   RenderSVGViewportContainer {svg} at (0,12.75) size 30x60
     RenderSVGRect {rect} at (0.50,0.50) size 29x39 [stroke={[type=SOLID] [color=#FF0000]}] [fill={[type=SOLID] [color=#000000]}] [x=0.50] [y=0.50] [width=29.00] [height=39.00]
-layer at (5,5) size 20x20 backgroundClip at (300,80) size 30x60 clip at (300,80) size 30x60
+layer at (5,5) size 20x20
   RenderSVGTransformableContainer {g} at (5,5) size 20x20
     RenderSVGEllipse {circle} at (0,0) size 20x20 [fill={[type=SOLID] [color=#FFFF00]}] [cx=15.00] [cy=15.00] [r=10.00]
     RenderSVGEllipse {circle} at (5.50,5.50) size 3x3 [fill={[type=SOLID] [color=#000000]}] [cx=12.00] [cy=12.00] [r=1.50]
@@ -109,10 +109,10 @@ layer at (0,-12.75) size 30x73 backgroundClip at (0,0) size 480x360 clip at (0,0
       RenderSVGInlineText {#text} at (0,0) size 27x10
         chunk 1 text run 1 at (0.00,-5.00) startOffset 0 endOffset 5 width 26.00: "*YMid"
     RenderSVGRect {rect} at (0.50,13.25) size 29x59 [stroke={[type=SOLID] [color=#0000FF]}] [x=0.50] [y=0.50] [width=29.00] [height=59.00]
-layer at (0,0) size 30x61 backgroundClip at (0,0) size 30x60 clip at (0,0) size 30x50
+layer at (0,0) size 30x61 backgroundClip at (0,0) size 30x60
   RenderSVGViewportContainer {svg} at (0,12.75) size 30x60
     RenderSVGRect {rect} at (0.50,0.50) size 29x39 [stroke={[type=SOLID] [color=#FF0000]}] [fill={[type=SOLID] [color=#000000]}] [x=0.50] [y=0.50] [width=29.00] [height=39.00]
-layer at (5,5) size 20x20 backgroundClip at (350,80) size 30x60 clip at (350,80) size 30x60
+layer at (5,5) size 20x20
   RenderSVGTransformableContainer {g} at (5,5) size 20x20
     RenderSVGEllipse {circle} at (0,0) size 20x20 [fill={[type=SOLID] [color=#FFFF00]}] [cx=15.00] [cy=15.00] [r=10.00]
     RenderSVGEllipse {circle} at (5.50,5.50) size 3x3 [fill={[type=SOLID] [color=#000000]}] [cx=12.00] [cy=12.00] [r=1.50]
@@ -124,10 +124,10 @@ layer at (0,-12.75) size 30x73 backgroundClip at (0,0) size 480x360 clip at (0,0
       RenderSVGInlineText {#text} at (0,0) size 28x10
         chunk 1 text run 1 at (0.00,-5.00) startOffset 0 endOffset 5 width 27.50: "*YMax"
     RenderSVGRect {rect} at (0.50,13.25) size 29x59 [stroke={[type=SOLID] [color=#0000FF]}] [x=0.50] [y=0.50] [width=29.00] [height=59.00]
-layer at (0,0) size 30x61 backgroundClip at (0,0) size 30x60 clip at (0,0) size 30x40
+layer at (0,0) size 30x61 backgroundClip at (0,0) size 30x60
   RenderSVGViewportContainer {svg} at (0,12.75) size 30x60
     RenderSVGRect {rect} at (0.50,0.50) size 29x39 [stroke={[type=SOLID] [color=#FF0000]}] [fill={[type=SOLID] [color=#000000]}] [x=0.50] [y=0.50] [width=29.00] [height=39.00]
-layer at (5,5) size 20x20 backgroundClip at (400,80) size 30x60 clip at (400,80) size 30x60
+layer at (5,5) size 20x20
   RenderSVGTransformableContainer {g} at (5,5) size 20x20
     RenderSVGEllipse {circle} at (0,0) size 20x20 [fill={[type=SOLID] [color=#FFFF00]}] [cx=15.00] [cy=15.00] [r=10.00]
     RenderSVGEllipse {circle} at (5.50,5.50) size 3x3 [fill={[type=SOLID] [color=#000000]}] [cx=12.00] [cy=12.00] [r=1.50]
diff --git a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/W3C-SVG-1.1/filters-comptran-01-b-expected.txt b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/W3C-SVG-1.1/filters-comptran-01-b-expected.txt
index 2da0055fa2f5..0c07f7048da8 100644
--- a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/W3C-SVG-1.1/filters-comptran-01-b-expected.txt
+++ b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/W3C-SVG-1.1/filters-comptran-01-b-expected.txt
@@ -40,11 +40,11 @@ layer at (0,0) size 450x300 backgroundClip at (0.50,0.50) size 479.50x359.50
       RenderSVGText {text} at (9,348) size 586x38 contains 1 chunk(s)
         RenderSVGInlineText {#text} at (0,0) size 586x37
           chunk 1 text run 1 at (10.00,380.00) startOffset 0 endOffset 34 width 585.21: "type: gamma ampl:2 exponents:5/3/1"
-layer at (10,10) size 580x40 backgroundClip at (15,5) size 450x300 clip at (15,5) size 450x300
+layer at (10,10) size 580x40 backgroundClip at (0,0) size 480x360 clip at (0,0) size 480x360
   RenderSVGRect {rect} at (9,9) size 580x40 [fill={[type=SOLID] [color=#00000000]}] [x=10.00] [y=10.00] [width=580.00] [height=40.00]
-layer at (10,110) size 580x40 backgroundClip at (15,5) size 450x300 clip at (15,5) size 450x300
+layer at (10,110) size 580x40 backgroundClip at (0,0) size 480x360 clip at (0,0) size 480x360
   RenderSVGRect {rect} at (9,109) size 580x40 [fill={[type=SOLID] [color=#00000000]}] [x=10.00] [y=110.00] [width=580.00] [height=40.00]
-layer at (10,210) size 580x40 backgroundClip at (15,5) size 450x300 clip at (15,5) size 450x300
+layer at (10,210) size 580x40 backgroundClip at (0,0) size 480x360 clip at (0,0) size 480x360
   RenderSVGRect {rect} at (9,209) size 580x40 [fill={[type=SOLID] [color=#00000000]}] [x=10.00] [y=210.00] [width=580.00] [height=40.00]
-layer at (10,310) size 580x40 backgroundClip at (15,5) size 450x300 clip at (15,5) size 450x300
+layer at (10,310) size 580x40 backgroundClip at (0,0) size 480x360 clip at (0,0) size 480x360
   RenderSVGRect {rect} at (9,309) size 580x40 [fill={[type=SOLID] [color=#00000000]}] [x=10.00] [y=310.00] [width=580.00] [height=40.00]
diff --git a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/W3C-SVG-1.1/filters-example-01-b-expected.txt b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/W3C-SVG-1.1/filters-example-01-b-expected.txt
index cb96b43067bc..1fa986e85da7 100644
--- a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/W3C-SVG-1.1/filters-example-01-b-expected.txt
+++ b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/W3C-SVG-1.1/filters-example-01-b-expected.txt
@@ -9,7 +9,7 @@ layer at (0,0) size 480x360
       RenderSVGInlineText {#text} at (0,0) size 264x46
         chunk 1 text run 1 at (10.00,340.00) startOffset 0 endOffset 16 width 263.34: "$Revision: 1.7 $"
     RenderSVGRect {rect} at (1,1) size 478x358 [stroke={[type=SOLID] [color=#000000]}] [x=1.00] [y=1.00] [width=478.00] [height=358.00]
-layer at (0,0) size 300x180 clip at (0,0) size 200x120
+layer at (0,0) size 300x180
   RenderSVGViewportContainer {svg} at (0,0) size 300x180
     RenderSVGHiddenContainer {defs} at (0,0) size 0x0
       RenderSVGHiddenContainer {filter} at (0,0) size 0x0
@@ -17,7 +17,7 @@ layer at (0,0) size 300x180 clip at (0,0) size 200x120
         RenderSVGHiddenContainer {feOffset} at (0,0) size 0x0
         RenderSVGHiddenContainer {feComposite} at (0,0) size 0x0
     RenderSVGRect {rect} at (1,1) size 198x118 [stroke={[type=SOLID] [color=#0000FF]}] [fill={[type=SOLID] [color=#888888]}] [x=1.00] [y=1.00] [width=198.00] [height=118.00]
-layer at (12.50,30) size 176x60 backgroundClip at (80,110) size 300x180 clip at (80,110) size 300x180
+layer at (12.50,30) size 176x60
   RenderSVGTransformableContainer {g} at (12.50,30) size 175x60
     RenderSVGTransformableContainer {g} at (0,0) size 175x60
       RenderSVGPath {path} at (0,0) size 175x60 [stroke={[type=SOLID] [color=#D90000] [stroke width=10.00]}] [data="M 50 90 C 0 90 0 30 50 30 L 150 30 C 200 30 200 90 150 90 Z"]
diff --git a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/W3C-SVG-1.1/painting-marker-03-f-expected.png b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/W3C-SVG-1.1/painting-marker-03-f-expected.png
new file mode 100644
index 000000000000..37d532da1de4
Binary files /dev/null and b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/W3C-SVG-1.1/painting-marker-03-f-expected.png differ
diff --git a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/W3C-SVG-1.1/types-basicDOM-01-b-expected.txt b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/W3C-SVG-1.1/types-basicDOM-01-b-expected.txt
index 824b18fdc2a0..93b658505912 100644
--- a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/W3C-SVG-1.1/types-basicDOM-01-b-expected.txt
+++ b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/W3C-SVG-1.1/types-basicDOM-01-b-expected.txt
@@ -27,6 +27,6 @@ layer at (0,0) size 402x155
     RenderSVGText {text} at (100,111) size 302x24 contains 1 chunk(s)
       RenderSVGInlineText {#text} at (0,0) size 302x23
         chunk 1 text run 1 at (100.00,130.00) startOffset 0 endOffset 35 width 301.10: "Some other text with id 'otherText'"
-layer at (0,0) size 110x110 backgroundClip at (0,0) size 50x50 clip at (0,0) size 55x55
+layer at (0,0) size 110x110 backgroundClip at (0,0) size 50x50
   RenderSVGViewportContainer {svg} at (0,0) size 110x110
     RenderSVGEllipse {circle} at (-50,-50) size 100x100 [fill={[type=SOLID] [color=#FF0000]}] [cx=0.00] [cy=0.00] [r=50.00]
diff --git a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/container-opacity-clip-viewBox-expected.png b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/container-opacity-clip-viewBox-expected.png
new file mode 100644
index 000000000000..fe5bc5bdd9d5
Binary files /dev/null and b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/container-opacity-clip-viewBox-expected.png differ
diff --git a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/container-opacity-clip-viewBox-expected.txt b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/container-opacity-clip-viewBox-expected.txt
index 7a4581c5a0cb..568b36a07943 100644
--- a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/container-opacity-clip-viewBox-expected.txt
+++ b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/container-opacity-clip-viewBox-expected.txt
@@ -7,7 +7,7 @@ layer at (0,0) size 800x600
   RenderSVGViewportContainer {svg} at (0,0) size 800x600 [opacity=0.90]
 layer at (0,0) size 200x200
   RenderSVGTransformableContainer {g} at (0,0) size 200x200
-layer at (0,0) size 200x200 backgroundClip at (0,0) size 83x64 clip at (0,0) size 117x116
+layer at (0,0) size 200x200 backgroundClip at (0,0) size 83x64
   RenderSVGViewportContainer {svg} at (0,0) size 200x200
     RenderSVGRect {rect} at (-83,-84) size 166x148 [fill={[type=SOLID] [color=#008000]}] [x=-83.00] [y=-84.00] [width=166.00] [height=148.00]
 layer at (0,-14) size 368x48 backgroundClip at (0,0) size 800x600 clip at (0,0) size 800x600
diff --git a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/feComponentTransfer-Discrete-expected.txt b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/feComponentTransfer-Discrete-expected.txt
index b3fa4551bb70..1aabad4db15a 100644
--- a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/feComponentTransfer-Discrete-expected.txt
+++ b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/feComponentTransfer-Discrete-expected.txt
@@ -34,11 +34,11 @@ layer at (0,0) size 450x300 backgroundClip at (0.50,0.50) size 649x419
       RenderSVGText {text} at (19,353) size 567x20 contains 1 chunk(s)
         RenderSVGInlineText {#text} at (0,0) size 567x19
           chunk 1 text run 1 at (20.00,370.00) startOffset 0 endOffset 75 width 566.84: "type: discrete [0.0 0.25 0.5 0.75 1] -- Result should be quantized gradient"
-layer at (20,10) size 580x40 backgroundClip at (25,8.31) size 750x500 clip at (25,8.31) size 750x500
+layer at (20,10) size 580x40
   RenderSVGRect {rect} at (19,9) size 580x40 [fill={[type=SOLID] [color=#00000000]}] [x=20.00] [y=10.00] [width=580.00] [height=40.00]
-layer at (20,110) size 580x40 backgroundClip at (25,8.31) size 750x500 clip at (25,8.31) size 750x500
+layer at (20,110) size 580x40
   RenderSVGRect {rect} at (19,109) size 580x40 [fill={[type=SOLID] [color=#00000000]}] [x=20.00] [y=110.00] [width=580.00] [height=40.00]
-layer at (20,210) size 580x40 backgroundClip at (25,8.31) size 750x500 clip at (25,8.31) size 750x500
+layer at (20,210) size 580x40
   RenderSVGRect {rect} at (19,209) size 580x40 [fill={[type=SOLID] [color=#00000000]}] [x=20.00] [y=210.00] [width=580.00] [height=40.00]
-layer at (20,310) size 580x40 backgroundClip at (25,8.31) size 750x500 clip at (25,8.31) size 750x500
+layer at (20,310) size 580x40
   RenderSVGRect {rect} at (19,309) size 580x40 [fill={[type=SOLID] [color=#00000000]}] [x=20.00] [y=310.00] [width=580.00] [height=40.00]
diff --git a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/feComponentTransfer-Gamma-expected.txt b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/feComponentTransfer-Gamma-expected.txt
index fdb5e3bd549c..d303dafa7249 100644
--- a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/feComponentTransfer-Gamma-expected.txt
+++ b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/feComponentTransfer-Gamma-expected.txt
@@ -40,11 +40,11 @@ layer at (0,0) size 450x300 backgroundClip at (0.50,0.50) size 649x419
       RenderSVGText {text} at (19,373) size 93x20 contains 1 chunk(s)
         RenderSVGInlineText {#text} at (0,0) size 93x19
           chunk 1 text run 1 at (20.00,390.00) startOffset 0 endOffset 12 width 92.17: "the gradient"
-layer at (20,10) size 580x40 backgroundClip at (25,8.31) size 750x500 clip at (25,8.31) size 750x500
+layer at (20,10) size 580x40
   RenderSVGRect {rect} at (19,9) size 580x40 [fill={[type=SOLID] [color=#00000000]}] [x=20.00] [y=10.00] [width=580.00] [height=40.00]
-layer at (20,110) size 580x40 backgroundClip at (25,8.31) size 750x500 clip at (25,8.31) size 750x500
+layer at (20,110) size 580x40
   RenderSVGRect {rect} at (19,109) size 580x40 [fill={[type=SOLID] [color=#00000000]}] [x=20.00] [y=110.00] [width=580.00] [height=40.00]
-layer at (20,210) size 580x40 backgroundClip at (25,8.31) size 750x500 clip at (25,8.31) size 750x500
+layer at (20,210) size 580x40
   RenderSVGRect {rect} at (19,209) size 580x40 [fill={[type=SOLID] [color=#00000000]}] [x=20.00] [y=210.00] [width=580.00] [height=40.00]
-layer at (20,310) size 580x40 backgroundClip at (25,8.31) size 750x500 clip at (25,8.31) size 750x500
+layer at (20,310) size 580x40
   RenderSVGRect {rect} at (19,309) size 580x40 [fill={[type=SOLID] [color=#00000000]}] [x=20.00] [y=310.00] [width=580.00] [height=40.00]
diff --git a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/feComponentTransfer-Linear-expected.txt b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/feComponentTransfer-Linear-expected.txt
index 5b4f552f71a8..57545bb6de24 100644
--- a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/feComponentTransfer-Linear-expected.txt
+++ b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/feComponentTransfer-Linear-expected.txt
@@ -34,11 +34,11 @@ layer at (0,0) size 450x300 backgroundClip at (0.50,0.50) size 649x419
       RenderSVGText {text} at (19,353) size 606x20 contains 1 chunk(s)
         RenderSVGInlineText {#text} at (0,0) size 606x19
           chunk 1 text run 1 at (20.00,370.00) startOffset 0 endOffset 79 width 605.80: "type: linear slope=0.5 intercept=0.25 -- Result should be less extreme gradient"
-layer at (20,10) size 580x40 backgroundClip at (25,8.31) size 750x500 clip at (25,8.31) size 750x500
+layer at (20,10) size 580x40
   RenderSVGRect {rect} at (19,9) size 580x40 [fill={[type=SOLID] [color=#00000000]}] [x=20.00] [y=10.00] [width=580.00] [height=40.00]
-layer at (20,110) size 580x40 backgroundClip at (25,8.31) size 750x500 clip at (25,8.31) size 750x500
+layer at (20,110) size 580x40
   RenderSVGRect {rect} at (19,109) size 580x40 [fill={[type=SOLID] [color=#00000000]}] [x=20.00] [y=110.00] [width=580.00] [height=40.00]
-layer at (20,210) size 580x40 backgroundClip at (25,8.31) size 750x500 clip at (25,8.31) size 750x500
+layer at (20,210) size 580x40
   RenderSVGRect {rect} at (19,209) size 580x40 [fill={[type=SOLID] [color=#00000000]}] [x=20.00] [y=210.00] [width=580.00] [height=40.00]
-layer at (20,310) size 580x40 backgroundClip at (25,8.31) size 750x500 clip at (25,8.31) size 750x500
+layer at (20,310) size 580x40
   RenderSVGRect {rect} at (19,309) size 580x40 [fill={[type=SOLID] [color=#00000000]}] [x=20.00] [y=310.00] [width=580.00] [height=40.00]
diff --git a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/feComponentTransfer-Table-expected.txt b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/feComponentTransfer-Table-expected.txt
index b2f83ff6cbb2..d1af3d75eb43 100644
--- a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/feComponentTransfer-Table-expected.txt
+++ b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/feComponentTransfer-Table-expected.txt
@@ -34,11 +34,11 @@ layer at (0,0) size 450x300 backgroundClip at (0.50,0.50) size 649x419
       RenderSVGText {text} at (19,353) size 468x20 contains 1 chunk(s)
         RenderSVGInlineText {#text} at (0,0) size 468x19
           chunk 1 text run 1 at (20.00,370.00) startOffset 0 endOffset 61 width 467.60: "type: table [0 0 1 1] -- Result should be compressed gradient"
-layer at (20,10) size 580x40 backgroundClip at (25,8.31) size 750x500 clip at (25,8.31) size 750x500
+layer at (20,10) size 580x40
   RenderSVGRect {rect} at (19,9) size 580x40 [fill={[type=SOLID] [color=#00000000]}] [x=20.00] [y=10.00] [width=580.00] [height=40.00]
-layer at (20,110) size 580x40 backgroundClip at (25,8.31) size 750x500 clip at (25,8.31) size 750x500
+layer at (20,110) size 580x40
   RenderSVGRect {rect} at (19,109) size 580x40 [fill={[type=SOLID] [color=#00000000]}] [x=20.00] [y=110.00] [width=580.00] [height=40.00]
-layer at (20,210) size 580x40 backgroundClip at (25,8.31) size 750x500 clip at (25,8.31) size 750x500
+layer at (20,210) size 580x40
   RenderSVGRect {rect} at (19,209) size 580x40 [fill={[type=SOLID] [color=#00000000]}] [x=20.00] [y=210.00] [width=580.00] [height=40.00]
-layer at (20,310) size 580x40 backgroundClip at (25,8.31) size 750x500 clip at (25,8.31) size 750x500
+layer at (20,310) size 580x40
   RenderSVGRect {rect} at (19,309) size 580x40 [fill={[type=SOLID] [color=#00000000]}] [x=20.00] [y=310.00] [width=580.00] [height=40.00]
diff --git a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/js-late-marker-and-object-creation-expected.png b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/js-late-marker-and-object-creation-expected.png
new file mode 100644
index 000000000000..fd8f12fe416f
Binary files /dev/null and b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/js-late-marker-and-object-creation-expected.png differ
diff --git a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/js-late-marker-creation-expected.png b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/js-late-marker-creation-expected.png
new file mode 100644
index 000000000000..fd8f12fe416f
Binary files /dev/null and b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/js-late-marker-creation-expected.png differ
diff --git a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/marker-default-width-height-expected.png b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/marker-default-width-height-expected.png
new file mode 100644
index 000000000000..f33b1a752c57
Binary files /dev/null and b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/marker-default-width-height-expected.png differ
diff --git a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/preserve-aspect-ratio-syntax-expected.png b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/preserve-aspect-ratio-syntax-expected.png
index f212019ac81d..eb391f1b9145 100644
Binary files a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/preserve-aspect-ratio-syntax-expected.png and b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/preserve-aspect-ratio-syntax-expected.png differ
diff --git a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/preserve-aspect-ratio-syntax-expected.txt b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/preserve-aspect-ratio-syntax-expected.txt
index eaa01be0a030..d8a7e62cb506 100644
--- a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/preserve-aspect-ratio-syntax-expected.txt
+++ b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/preserve-aspect-ratio-syntax-expected.txt
@@ -14,10 +14,10 @@ layer at (0,0) size 800x600
             chunk 1 text run 1 at (0.00,190.00) startOffset 0 endOffset 72 width 264.94: "All svgs below should look the same, all have valid preserveAspectRatio."
 layer at (0,0) size 30x60
   RenderSVGTransformableContainer {g} at (0,0) size 30x60
-layer at (0,0) size 30x60 clip at (0,0) size 30x50
+layer at (0,0) size 30x60
   RenderSVGViewportContainer {svg} at (0,0) size 30x60
     RenderSVGRect {rect} at (0.50,0.50) size 29x39 [stroke={[type=SOLID] [color=#FF0000]}] [fill={[type=SOLID] [color=#000000]}] [x=0.50] [y=0.50] [width=29.00] [height=39.00]
-layer at (5,5) size 20x20 backgroundClip at (0,83.33) size 50x99.98 clip at (0,83.33) size 50x99.98
+layer at (5,5) size 20x20
   RenderSVGTransformableContainer {g} at (5,5) size 20x20
     RenderSVGEllipse {circle} at (0,0) size 20x20 [fill={[type=SOLID] [color=#FFFF00]}] [cx=15.00] [cy=15.00] [r=10.00]
     RenderSVGEllipse {circle} at (5.50,5.50) size 3x3 [fill={[type=SOLID] [color=#000000]}] [cx=12.00] [cy=12.00] [r=1.50]
@@ -25,10 +25,10 @@ layer at (5,5) size 20x20 backgroundClip at (0,83.33) size 50x99.98 clip at (0,8
     RenderSVGPath {path} at (5,14) size 10x4 [stroke={[type=SOLID] [color=#000000] [stroke width=2.00]}] [fill={[type=SOLID] [color=#000000]}] [data="M 10 19 L 15 23 L 20 19"]
 layer at (0,0) size 30x60
   RenderSVGTransformableContainer {g} at (0,0) size 30x60
-layer at (0,0) size 30x60 clip at (0,0) size 30x50
+layer at (0,0) size 30x60
   RenderSVGViewportContainer {svg} at (0,0) size 30x60
     RenderSVGRect {rect} at (0.50,0.50) size 29x39 [stroke={[type=SOLID] [color=#FF0000]}] [fill={[type=SOLID] [color=#000000]}] [x=0.50] [y=0.50] [width=29.00] [height=39.00]
-layer at (5,5) size 20x20 backgroundClip at (83.33,83.33) size 49.98x99.98 clip at (83.33,83.33) size 49.98x99.98
+layer at (5,5) size 20x20
   RenderSVGTransformableContainer {g} at (5,5) size 20x20
     RenderSVGEllipse {circle} at (0,0) size 20x20 [fill={[type=SOLID] [color=#FFFF00]}] [cx=15.00] [cy=15.00] [r=10.00]
     RenderSVGEllipse {circle} at (5.50,5.50) size 3x3 [fill={[type=SOLID] [color=#000000]}] [cx=12.00] [cy=12.00] [r=1.50]
@@ -36,10 +36,10 @@ layer at (5,5) size 20x20 backgroundClip at (83.33,83.33) size 49.98x99.98 clip
     RenderSVGPath {path} at (5,14) size 10x4 [stroke={[type=SOLID] [color=#000000] [stroke width=2.00]}] [fill={[type=SOLID] [color=#000000]}] [data="M 10 19 L 15 23 L 20 19"]
 layer at (0,0) size 30x60
   RenderSVGTransformableContainer {g} at (0,0) size 30x60
-layer at (0,0) size 30x60 clip at (0,0) size 30x50
+layer at (0,0) size 30x60
   RenderSVGViewportContainer {svg} at (0,0) size 30x60
     RenderSVGRect {rect} at (0.50,0.50) size 29x39 [stroke={[type=SOLID] [color=#FF0000]}] [fill={[type=SOLID] [color=#000000]}] [x=0.50] [y=0.50] [width=29.00] [height=39.00]
-layer at (5,5) size 20x20 backgroundClip at (166.66,83.33) size 50x99.98 clip at (166.66,83.33) size 50x99.98
+layer at (5,5) size 20x20
   RenderSVGTransformableContainer {g} at (5,5) size 20x20
     RenderSVGEllipse {circle} at (0,0) size 20x20 [fill={[type=SOLID] [color=#FFFF00]}] [cx=15.00] [cy=15.00] [r=10.00]
     RenderSVGEllipse {circle} at (5.50,5.50) size 3x3 [fill={[type=SOLID] [color=#000000]}] [cx=12.00] [cy=12.00] [r=1.50]
@@ -47,10 +47,10 @@ layer at (5,5) size 20x20 backgroundClip at (166.66,83.33) size 50x99.98 clip at
     RenderSVGPath {path} at (5,14) size 10x4 [stroke={[type=SOLID] [color=#000000] [stroke width=2.00]}] [fill={[type=SOLID] [color=#000000]}] [data="M 10 19 L 15 23 L 20 19"]
 layer at (0,0) size 30x60
   RenderSVGTransformableContainer {g} at (0,0) size 30x60
-layer at (0,0) size 30x60 clip at (0,0) size 30x50
+layer at (0,0) size 30x60
   RenderSVGViewportContainer {svg} at (0,0) size 30x60
     RenderSVGRect {rect} at (0.50,0.50) size 29x39 [stroke={[type=SOLID] [color=#FF0000]}] [fill={[type=SOLID] [color=#000000]}] [x=0.50] [y=0.50] [width=29.00] [height=39.00]
-layer at (5,5) size 20x20 backgroundClip at (250,83.33) size 50x99.98 clip at (250,83.33) size 50x99.98
+layer at (5,5) size 20x20
   RenderSVGTransformableContainer {g} at (5,5) size 20x20
     RenderSVGEllipse {circle} at (0,0) size 20x20 [fill={[type=SOLID] [color=#FFFF00]}] [cx=15.00] [cy=15.00] [r=10.00]
     RenderSVGEllipse {circle} at (5.50,5.50) size 3x3 [fill={[type=SOLID] [color=#000000]}] [cx=12.00] [cy=12.00] [r=1.50]
@@ -58,10 +58,10 @@ layer at (5,5) size 20x20 backgroundClip at (250,83.33) size 50x99.98 clip at (2
     RenderSVGPath {path} at (5,14) size 10x4 [stroke={[type=SOLID] [color=#000000] [stroke width=2.00]}] [fill={[type=SOLID] [color=#000000]}] [data="M 10 19 L 15 23 L 20 19"]
 layer at (0,0) size 30x60
   RenderSVGTransformableContainer {g} at (0,0) size 30x60
-layer at (0,0) size 30x60 clip at (0,0) size 30x50
+layer at (0,0) size 30x60
   RenderSVGViewportContainer {svg} at (0,0) size 30x60
     RenderSVGRect {rect} at (0.50,0.50) size 29x39 [stroke={[type=SOLID] [color=#FF0000]}] [fill={[type=SOLID] [color=#000000]}] [x=0.50] [y=0.50] [width=29.00] [height=39.00]
-layer at (5,5) size 20x20 backgroundClip at (333.33,83.33) size 50x99.98 clip at (333.33,83.33) size 50x99.98
+layer at (5,5) size 20x20
   RenderSVGTransformableContainer {g} at (5,5) size 20x20
     RenderSVGEllipse {circle} at (0,0) size 20x20 [fill={[type=SOLID] [color=#FFFF00]}] [cx=15.00] [cy=15.00] [r=10.00]
     RenderSVGEllipse {circle} at (5.50,5.50) size 3x3 [fill={[type=SOLID] [color=#000000]}] [cx=12.00] [cy=12.00] [r=1.50]
@@ -69,10 +69,10 @@ layer at (5,5) size 20x20 backgroundClip at (333.33,83.33) size 50x99.98 clip at
     RenderSVGPath {path} at (5,14) size 10x4 [stroke={[type=SOLID] [color=#000000] [stroke width=2.00]}] [fill={[type=SOLID] [color=#000000]}] [data="M 10 19 L 15 23 L 20 19"]
 layer at (0,0) size 30x60
   RenderSVGTransformableContainer {g} at (0,0) size 30x60
-layer at (0,0) size 30x60 clip at (0,0) size 30x50
+layer at (0,0) size 30x60
   RenderSVGViewportContainer {svg} at (0,0) size 30x60
     RenderSVGRect {rect} at (0.50,0.50) size 29x39 [stroke={[type=SOLID] [color=#FF0000]}] [fill={[type=SOLID] [color=#000000]}] [x=0.50] [y=0.50] [width=29.00] [height=39.00]
-layer at (5,5) size 20x20 backgroundClip at (416.66,83.33) size 50x99.98 clip at (416.66,83.33) size 50x99.98
+layer at (5,5) size 20x20
   RenderSVGTransformableContainer {g} at (5,5) size 20x20
     RenderSVGEllipse {circle} at (0,0) size 20x20 [fill={[type=SOLID] [color=#FFFF00]}] [cx=15.00] [cy=15.00] [r=10.00]
     RenderSVGEllipse {circle} at (5.50,5.50) size 3x3 [fill={[type=SOLID] [color=#000000]}] [cx=12.00] [cy=12.00] [r=1.50]
@@ -80,10 +80,10 @@ layer at (5,5) size 20x20 backgroundClip at (416.66,83.33) size 50x99.98 clip at
     RenderSVGPath {path} at (5,14) size 10x4 [stroke={[type=SOLID] [color=#000000] [stroke width=2.00]}] [fill={[type=SOLID] [color=#000000]}] [data="M 10 19 L 15 23 L 20 19"]
 layer at (0,0) size 30x60
   RenderSVGTransformableContainer {g} at (0,0) size 30x60
-layer at (0,0) size 30x60 clip at (0,0) size 30x50
+layer at (0,0) size 30x60
   RenderSVGViewportContainer {svg} at (0,0) size 30x60
     RenderSVGRect {rect} at (0.50,0.50) size 29x39 [stroke={[type=SOLID] [color=#FF0000]}] [fill={[type=SOLID] [color=#000000]}] [x=0.50] [y=0.50] [width=29.00] [height=39.00]
-layer at (5,5) size 20x20 backgroundClip at (0,333.33) size 50x100 clip at (0,333.33) size 50x100
+layer at (5,5) size 20x20
   RenderSVGTransformableContainer {g} at (5,5) size 20x20
     RenderSVGEllipse {circle} at (0,0) size 20x20 [fill={[type=SOLID] [color=#FFFF00]}] [cx=15.00] [cy=15.00] [r=10.00]
     RenderSVGEllipse {circle} at (5.50,5.50) size 3x3 [fill={[type=SOLID] [color=#000000]}] [cx=12.00] [cy=12.00] [r=1.50]
@@ -91,10 +91,10 @@ layer at (5,5) size 20x20 backgroundClip at (0,333.33) size 50x100 clip at (0,33
     RenderSVGPath {path} at (5,14) size 10x4 [stroke={[type=SOLID] [color=#000000] [stroke width=2.00]}] [fill={[type=SOLID] [color=#000000]}] [data="M 10 19 L 15 23 L 20 19"]
 layer at (0,0) size 30x60
   RenderSVGTransformableContainer {g} at (0,0) size 30x60
-layer at (0,0) size 30x60 clip at (0,0) size 30x50
+layer at (0,0) size 30x60
   RenderSVGViewportContainer {svg} at (0,0) size 30x60
     RenderSVGRect {rect} at (0.50,0.50) size 29x39 [stroke={[type=SOLID] [color=#FF0000]}] [fill={[type=SOLID] [color=#000000]}] [x=0.50] [y=0.50] [width=29.00] [height=39.00]
-layer at (5,5) size 20x20 backgroundClip at (83.33,333.33) size 49.98x100 clip at (83.33,333.33) size 49.98x100
+layer at (5,5) size 20x20
   RenderSVGTransformableContainer {g} at (5,5) size 20x20
     RenderSVGEllipse {circle} at (0,0) size 20x20 [fill={[type=SOLID] [color=#FFFF00]}] [cx=15.00] [cy=15.00] [r=10.00]
     RenderSVGEllipse {circle} at (5.50,5.50) size 3x3 [fill={[type=SOLID] [color=#000000]}] [cx=12.00] [cy=12.00] [r=1.50]
@@ -102,10 +102,10 @@ layer at (5,5) size 20x20 backgroundClip at (83.33,333.33) size 49.98x100 clip a
     RenderSVGPath {path} at (5,14) size 10x4 [stroke={[type=SOLID] [color=#000000] [stroke width=2.00]}] [fill={[type=SOLID] [color=#000000]}] [data="M 10 19 L 15 23 L 20 19"]
 layer at (0,0) size 30x60
   RenderSVGTransformableContainer {g} at (0,0) size 30x60
-layer at (0,0) size 30x60 clip at (0,0) size 30x50
+layer at (0,0) size 30x60
   RenderSVGViewportContainer {svg} at (0,0) size 30x60
     RenderSVGRect {rect} at (0.50,0.50) size 29x39 [stroke={[type=SOLID] [color=#FF0000]}] [fill={[type=SOLID] [color=#000000]}] [x=0.50] [y=0.50] [width=29.00] [height=39.00]
-layer at (5,5) size 20x20 backgroundClip at (166.66,333.33) size 50x100 clip at (166.66,333.33) size 50x100
+layer at (5,5) size 20x20
   RenderSVGTransformableContainer {g} at (5,5) size 20x20
     RenderSVGEllipse {circle} at (0,0) size 20x20 [fill={[type=SOLID] [color=#FFFF00]}] [cx=15.00] [cy=15.00] [r=10.00]
     RenderSVGEllipse {circle} at (5.50,5.50) size 3x3 [fill={[type=SOLID] [color=#000000]}] [cx=12.00] [cy=12.00] [r=1.50]
@@ -113,10 +113,10 @@ layer at (5,5) size 20x20 backgroundClip at (166.66,333.33) size 50x100 clip at
     RenderSVGPath {path} at (5,14) size 10x4 [stroke={[type=SOLID] [color=#000000] [stroke width=2.00]}] [fill={[type=SOLID] [color=#000000]}] [data="M 10 19 L 15 23 L 20 19"]
 layer at (0,0) size 30x60
   RenderSVGTransformableContainer {g} at (0,0) size 30x60
-layer at (0,0) size 30x60 clip at (0,0) size 30x50
+layer at (0,0) size 30x60
   RenderSVGViewportContainer {svg} at (0,0) size 30x60
     RenderSVGRect {rect} at (0.50,0.50) size 29x39 [stroke={[type=SOLID] [color=#FF0000]}] [fill={[type=SOLID] [color=#000000]}] [x=0.50] [y=0.50] [width=29.00] [height=39.00]
-layer at (5,5) size 20x20 backgroundClip at (250,333.33) size 50x100 clip at (250,333.33) size 50x100
+layer at (5,5) size 20x20
   RenderSVGTransformableContainer {g} at (5,5) size 20x20
     RenderSVGEllipse {circle} at (0,0) size 20x20 [fill={[type=SOLID] [color=#FFFF00]}] [cx=15.00] [cy=15.00] [r=10.00]
     RenderSVGEllipse {circle} at (5.50,5.50) size 3x3 [fill={[type=SOLID] [color=#000000]}] [cx=12.00] [cy=12.00] [r=1.50]
diff --git a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/relative-sized-inner-svg-expected.txt b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/relative-sized-inner-svg-expected.txt
index f6d863681b36..bac786cc8bbd 100644
--- a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/relative-sized-inner-svg-expected.txt
+++ b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/relative-sized-inner-svg-expected.txt
@@ -11,6 +11,6 @@ layer at (0,0) size 800x460
 layer at (9,51) size 400x400
   RenderSVGRoot {svg} at (1,1) size 400x400
     RenderSVGViewportContainer at (0,0) size 400x400
-layer at (9,51) size 400x400 clip at (9,51) size 150x150
+layer at (9,51) size 400x400
   RenderSVGViewportContainer {svg} at (0,0) size 400x400
     RenderSVGPath {path} at (7,6.09) size 136x136.09 [fill={[type=SOLID] [color=#008000]}] [data="M 143 103 L 143 117 C 143 130.909 112.555 142.185 75 142.185 C 37.4446 142.185 7.00001 130.909 7.00001 117 L 7 117 L 7 103 C 7 89.0906 37.4446 77.8148 75 77.8148 C 112.555 77.8148 143 89.0906 143 103 L 52 72 C 34.3123 70.6562 20.8513 55.5699 21.5237 37.8439 C 22.1961 20.118 36.7613 6.09483 54.5 6.09483 C 72.2387 6.09483 86.8039 20.118 87.4763 37.8439 C 88.1487 55.5699 74.6877 70.6562 57 72"]
diff --git a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/relative-sized-use-on-symbol-expected.txt b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/relative-sized-use-on-symbol-expected.txt
index 4b45e92337c7..6343b90ab328 100644
--- a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/relative-sized-use-on-symbol-expected.txt
+++ b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/relative-sized-use-on-symbol-expected.txt
@@ -16,6 +16,6 @@ layer at (9,51) size 400x400
           RenderSVGPath {path} at (0,0) size 136x136.09 [fill={[type=SOLID] [color=#008000]}] [data="M 143 103 L 143 117 C 143 130.909 112.555 142.185 75 142.185 C 37.4446 142.185 7.00001 130.909 7.00001 117 L 7 117 L 7 103 C 7 89.0906 37.4446 77.8148 75 77.8148 C 112.555 77.8148 143 89.0906 143 103 L 52 72 C 34.3123 70.6562 20.8513 55.5699 21.5237 37.8439 C 22.1961 20.118 36.7613 6.09483 54.5 6.09483 C 72.2387 6.09483 86.8039 20.118 87.4763 37.8439 C 88.1487 55.5699 74.6877 70.6562 57 72"]
 layer at (9,51) size 360x360
   RenderSVGTransformableContainer {use} at (0,0) size 360x360
-layer at (9,51) size 360x360 clip at (9,51) size 150x150
+layer at (9,51) size 360x360
   RenderSVGViewportContainer {svg} at (0,0) size 360x360
     RenderSVGPath {path} at (7,6.09) size 136x136.09 [fill={[type=SOLID] [color=#008000]}] [data="M 143 103 L 143 117 C 143 130.909 112.555 142.185 75 142.185 C 37.4446 142.185 7.00001 130.909 7.00001 117 L 7 117 L 7 103 C 7 89.0906 37.4446 77.8148 75 77.8148 C 112.555 77.8148 143 89.0906 143 103 L 52 72 C 34.3123 70.6562 20.8513 55.5699 21.5237 37.8439 C 22.1961 20.118 36.7613 6.09483 54.5 6.09483 C 72.2387 6.09483 86.8039 20.118 87.4763 37.8439 C 88.1487 55.5699 74.6877 70.6562 57 72"]
diff --git a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/relative-sized-use-without-attributes-on-symbol-expected.txt b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/relative-sized-use-without-attributes-on-symbol-expected.txt
index e308c180ff75..4b2ec7667a54 100644
--- a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/relative-sized-use-without-attributes-on-symbol-expected.txt
+++ b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/relative-sized-use-without-attributes-on-symbol-expected.txt
@@ -16,6 +16,6 @@ layer at (9,51) size 400x400
           RenderSVGPath {path} at (0,0) size 136x136.09 [fill={[type=SOLID] [color=#008000]}] [data="M 143 103 L 143 117 C 143 130.909 112.555 142.185 75 142.185 C 37.4446 142.185 7.00001 130.909 7.00001 117 L 7 117 L 7 103 C 7 89.0906 37.4446 77.8148 75 77.8148 C 112.555 77.8148 143 89.0906 143 103 L 52 72 C 34.3123 70.6562 20.8513 55.5699 21.5237 37.8439 C 22.1961 20.118 36.7613 6.09483 54.5 6.09483 C 72.2387 6.09483 86.8039 20.118 87.4763 37.8439 C 88.1487 55.5699 74.6877 70.6562 57 72"]
 layer at (9,51) size 400x400
   RenderSVGTransformableContainer {use} at (0,0) size 400x400
-layer at (9,51) size 400x400 clip at (9,51) size 150x150
+layer at (9,51) size 400x400
   RenderSVGViewportContainer {svg} at (0,0) size 400x400
     RenderSVGPath {path} at (7,6.09) size 136x136.09 [fill={[type=SOLID] [color=#008000]}] [data="M 143 103 L 143 117 C 143 130.909 112.555 142.185 75 142.185 C 37.4446 142.185 7.00001 130.909 7.00001 117 L 7 117 L 7 103 C 7 89.0906 37.4446 77.8148 75 77.8148 C 112.555 77.8148 143 89.0906 143 103 L 52 72 C 34.3123 70.6562 20.8513 55.5699 21.5237 37.8439 C 22.1961 20.118 36.7613 6.09483 54.5 6.09483 C 72.2387 6.09483 86.8039 20.118 87.4763 37.8439 C 88.1487 55.5699 74.6877 70.6562 57 72"]
diff --git a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/root-container-opacity-clip-viewBox-expected.txt b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/root-container-opacity-clip-viewBox-expected.txt
index 8c9369200973..eec376cbe5dd 100644
--- a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/root-container-opacity-clip-viewBox-expected.txt
+++ b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/root-container-opacity-clip-viewBox-expected.txt
@@ -3,6 +3,6 @@ layer at (0,0) size 800x600
 layer at (0,0) size 800x600
   RenderSVGRoot {svg} at (0,0) size 800x600
     RenderSVGViewportContainer at (0,0) size 800x600
-layer at (0,0) size 200x200 backgroundClip at (0,0) size 83x64 clip at (0,0) size 117x116
+layer at (0,0) size 200x200 backgroundClip at (0,0) size 83x64
   RenderSVGViewportContainer {svg} at (0,0) size 200x200
     RenderSVGRect {rect} at (-83,-84) size 166x148 [fill={[type=SOLID] [color=#008000]}] [x=-83.00] [y=-84.00] [width=166.00] [height=148.00]
diff --git a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/shapes-supporting-markers-expected.png b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/shapes-supporting-markers-expected.png
new file mode 100644
index 000000000000..5be91a0e0772
Binary files /dev/null and b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/shapes-supporting-markers-expected.png differ
diff --git a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/text-rotated-gradient-expected.txt b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/text-rotated-gradient-expected.txt
index 86a02d19e779..80aa841ef7e7 100644
--- a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/text-rotated-gradient-expected.txt
+++ b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/text-rotated-gradient-expected.txt
@@ -35,7 +35,7 @@ layer at (50,21) size 77x37
     RenderSVGText {text} at (0,0) size 77x37 contains 1 chunk(s)
       RenderSVGInlineText {#text} at (0,0) size 77x37
         chunk 1 text run 1 at (50.00,50.00) startOffset 0 endOffset 4 width 76.44: "TEST"
-layer at (0,0) size 800x600 backgroundClip at (0,121.14) size 374.33x80 clip at (0,0) size 466.67x400
+layer at (0,0) size 800x600 backgroundClip at (0,121.14) size 374.33x80
   RenderSVGViewportContainer {svg} at (0,0) size 800x600
 layer at (100,71.33) size 77x37
   RenderSVGTransformableContainer {g} at (100,71.33) size 76.44x36.67
diff --git a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/use-in-symbol-with-offset-expected.txt b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/use-in-symbol-with-offset-expected.txt
index 8a3e9c8090b2..e4c8592323dc 100644
--- a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/use-in-symbol-with-offset-expected.txt
+++ b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/use-in-symbol-with-offset-expected.txt
@@ -19,7 +19,7 @@ layer at (0,0) size 1x2
     RenderSVGRect {rect} at (0,0) size 1x2 [fill={[type=SOLID] [color=#008000]}] [x=0.00] [y=0.00] [width=1.00] [height=2.00]
 layer at (0,0) size 100x100
   RenderSVGTransformableContainer {use} at (0,0) size 100x100
-layer at (0,0) size 100x100 clip at (0,0) size 2x2
+layer at (0,0) size 100x100
   RenderSVGViewportContainer {svg} at (0,0) size 100x100
 layer at (0,0) size 1x2
   RenderSVGTransformableContainer {g} at (0,0) size 1x2
diff --git a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/use-transfer-width-height-properties-to-svg-expected.txt b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/use-transfer-width-height-properties-to-svg-expected.txt
index 9e76ee3dad43..950bc10ec7c6 100644
--- a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/use-transfer-width-height-properties-to-svg-expected.txt
+++ b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/use-transfer-width-height-properties-to-svg-expected.txt
@@ -4,10 +4,10 @@ layer at (0,0) size 400x400
   RenderSVGRoot {svg} at (0,0) size 400x400
     RenderSVGViewportContainer at (0,0) size 400x400
       RenderSVGHiddenContainer {defs} at (0,0) size 400x400
-layer at (0,0) size 400x400 clip at (0,0) size 2x2
+layer at (0,0) size 400x400
   RenderSVGViewportContainer {svg} at (0,0) size 400x400
     RenderSVGRect {rect} at (0,0) size 1x1 [fill={[type=SOLID] [color=#008000]}] [x=0.00] [y=0.00] [width=1.00] [height=1.00]
-layer at (0,0) size 400x400 clip at (0,0) size 2x2
+layer at (0,0) size 400x400
   RenderSVGViewportContainer {svg} at (0,0) size 400x400
 layer at (0,0) size 1x1
   RenderSVGTransformableContainer {use} at (0,0) size 1x1
@@ -16,7 +16,7 @@ layer at (0,0) size 1x1
     RenderSVGRect {rect} at (0,0) size 1x1 [fill={[type=SOLID] [color=#008000]}] [x=0.00] [y=0.00] [width=1.00] [height=1.00]
 layer at (0,0) size 400x400
   RenderSVGTransformableContainer {use} at (0,0) size 400x400
-layer at (0,0) size 400x400 clip at (0,0) size 2x2
+layer at (0,0) size 400x400
   RenderSVGViewportContainer {svg} at (0,0) size 400x400
 layer at (0,0) size 1x1
   RenderSVGTransformableContainer {g} at (0,0) size 1x1
diff --git a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/use-transfer-width-height-properties-to-svg1-expected.txt b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/use-transfer-width-height-properties-to-svg1-expected.txt
index 5c3a46f895f0..8d0e29e3658c 100644
--- a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/use-transfer-width-height-properties-to-svg1-expected.txt
+++ b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/use-transfer-width-height-properties-to-svg1-expected.txt
@@ -4,11 +4,11 @@ layer at (0,0) size 200x200
   RenderSVGRoot {svg} at (0,0) size 200x200
     RenderSVGViewportContainer at (0,0) size 200x200
       RenderSVGHiddenContainer {defs} at (0,0) size 200x200
-layer at (0,0) size 200x200 clip at (0,0) size 2x2
+layer at (0,0) size 200x200
   RenderSVGViewportContainer {svg} at (0,0) size 200x200
     RenderSVGRect {rect} at (0,0) size 1x1 [fill={[type=SOLID] [color=#008000]}] [x=0.00] [y=0.00] [width=1.00] [height=1.00]
 layer at (0,0) size 200x200
   RenderSVGTransformableContainer {use} at (0,0) size 200x200
-layer at (0,0) size 200x200 clip at (0,0) size 2x2
+layer at (0,0) size 200x200
   RenderSVGViewportContainer {svg} at (0,0) size 200x200
     RenderSVGRect {rect} at (0,0) size 1x1 [fill={[type=SOLID] [color=#008000]}] [x=0.00] [y=0.00] [width=1.00] [height=1.00]
diff --git a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/use-transfer-width-height-properties-to-svg2-expected.txt b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/use-transfer-width-height-properties-to-svg2-expected.txt
index f358622c93d0..1da76fc58468 100644
--- a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/use-transfer-width-height-properties-to-svg2-expected.txt
+++ b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/use-transfer-width-height-properties-to-svg2-expected.txt
@@ -5,7 +5,7 @@ layer at (0,0) size 400x400
     RenderSVGViewportContainer at (0,0) size 400x400
       RenderSVGHiddenContainer {defs} at (0,0) size 400x400
         RenderSVGHiddenContainer {symbol} at (0,0) size 1x1
-layer at (0,0) size 400x400 clip at (0,0) size 2x2
+layer at (0,0) size 400x400
   RenderSVGViewportContainer {svg} at (0,0) size 400x400
     RenderSVGRect {rect} at (0,0) size 1x1 [fill={[type=SOLID] [color=#008000]}] [x=0.00] [y=0.00] [width=1.00] [height=1.00]
 layer at (0,0) size 1x1
@@ -15,7 +15,7 @@ layer at (0,0) size 1x1
     RenderSVGRect {rect} at (0,0) size 1x1 [fill={[type=SOLID] [color=#008000]}] [x=0.00] [y=0.00] [width=1.00] [height=1.00]
 layer at (0,0) size 400x400
   RenderSVGTransformableContainer {use} at (0,0) size 400x400
-layer at (0,0) size 400x400 clip at (0,0) size 2x2
+layer at (0,0) size 400x400
   RenderSVGViewportContainer {svg} at (0,0) size 400x400
 layer at (0,0) size 1x1
   RenderSVGTransformableContainer {g} at (0,0) size 1x1
diff --git a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/use-transfer-width-height-properties-to-symbol-expected.txt b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/use-transfer-width-height-properties-to-symbol-expected.txt
index aca688826ea7..8b727bfce408 100644
--- a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/use-transfer-width-height-properties-to-symbol-expected.txt
+++ b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/use-transfer-width-height-properties-to-symbol-expected.txt
@@ -14,7 +14,7 @@ layer at (0,0) size 1x1
     RenderSVGRect {rect} at (0,0) size 1x1 [fill={[type=SOLID] [color=#008000]}] [x=0.00] [y=0.00] [width=1.00] [height=1.00]
 layer at (0,0) size 400x400
   RenderSVGTransformableContainer {use} at (0,0) size 400x400
-layer at (0,0) size 400x400 clip at (0,0) size 2x2
+layer at (0,0) size 400x400
   RenderSVGViewportContainer {svg} at (0,0) size 400x400
 layer at (0,0) size 1x1
   RenderSVGTransformableContainer {g} at (0,0) size 1x1
diff --git a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/use-transfer-width-height-properties-to-symbol1-expected.txt b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/use-transfer-width-height-properties-to-symbol1-expected.txt
index 6303b50a7562..a1716da977b5 100644
--- a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/use-transfer-width-height-properties-to-symbol1-expected.txt
+++ b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/use-transfer-width-height-properties-to-symbol1-expected.txt
@@ -8,6 +8,6 @@ layer at (0,0) size 200x200
           RenderSVGRect {rect} at (0,0) size 1x1 [fill={[type=SOLID] [color=#008000]}] [x=0.00] [y=0.00] [width=1.00] [height=1.00]
 layer at (0,0) size 200x200
   RenderSVGTransformableContainer {use} at (0,0) size 200x200
-layer at (0,0) size 200x200 clip at (0,0) size 2x2
+layer at (0,0) size 200x200
   RenderSVGViewportContainer {svg} at (0,0) size 200x200
     RenderSVGRect {rect} at (0,0) size 1x1 [fill={[type=SOLID] [color=#008000]}] [x=0.00] [y=0.00] [width=1.00] [height=1.00]
diff --git a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/use-transfer-width-height-properties-to-symbol2-expected.txt b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/use-transfer-width-height-properties-to-symbol2-expected.txt
index c2546a1549f9..f8d197b4d402 100644
--- a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/use-transfer-width-height-properties-to-symbol2-expected.txt
+++ b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/use-transfer-width-height-properties-to-symbol2-expected.txt
@@ -6,7 +6,7 @@ layer at (0,0) size 400x400
       RenderSVGHiddenContainer {defs} at (0,0) size 400x400
         RenderSVGHiddenContainer {symbol} at (0,0) size 1x1
           RenderSVGRect {rect} at (0,0) size 1x1 [fill={[type=SOLID] [color=#008000]}] [x=0.00] [y=0.00] [width=1.00] [height=1.00]
-layer at (0,0) size 400x400 clip at (0,0) size 2x2
+layer at (0,0) size 400x400
   RenderSVGViewportContainer {svg} at (0,0) size 400x400
 layer at (0,0) size 1x1
   RenderSVGTransformableContainer {use} at (0,0) size 1x1
@@ -15,7 +15,7 @@ layer at (0,0) size 1x1
     RenderSVGRect {rect} at (0,0) size 1x1 [fill={[type=SOLID] [color=#008000]}] [x=0.00] [y=0.00] [width=1.00] [height=1.00]
 layer at (0,0) size 400x400
   RenderSVGTransformableContainer {use} at (0,0) size 400x400
-layer at (0,0) size 400x400 clip at (0,0) size 2x2
+layer at (0,0) size 400x400
   RenderSVGViewportContainer {svg} at (0,0) size 400x400
 layer at (0,0) size 1x1
   RenderSVGTransformableContainer {g} at (0,0) size 1x1
diff --git a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/viewbox-syntax-expected.png b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/viewbox-syntax-expected.png
new file mode 100644
index 000000000000..99854a5a02ab
Binary files /dev/null and b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/viewbox-syntax-expected.png differ
diff --git a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/viewbox-syntax-expected.txt b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/viewbox-syntax-expected.txt
index 98aa3edc9b6e..4b4a0fcfc5d2 100644
--- a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/viewbox-syntax-expected.txt
+++ b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/viewbox-syntax-expected.txt
@@ -27,7 +27,7 @@ layer at (0,0) size 30x60
 layer at (0,0) size 30x60
   RenderSVGViewportContainer {svg} at (0,0) size 30x60
     RenderSVGRect {rect} at (0.50,0.50) size 29x39 [stroke={[type=SOLID] [color=#FF0000]}] [fill={[type=SOLID] [color=#000000]}] [x=0.50] [y=0.50] [width=29.00] [height=39.00]
-layer at (5,5) size 20x20 backgroundClip at (0,83.33) size 50x99.98 clip at (0,83.33) size 50x99.98
+layer at (5,5) size 20x20
   RenderSVGTransformableContainer {g} at (5,5) size 20x20
     RenderSVGEllipse {circle} at (0,0) size 20x20 [fill={[type=SOLID] [color=#FFFF00]}] [cx=15.00] [cy=15.00] [r=10.00]
     RenderSVGEllipse {circle} at (5.50,5.50) size 3x3 [fill={[type=SOLID] [color=#000000]}] [cx=12.00] [cy=12.00] [r=1.50]
@@ -38,7 +38,7 @@ layer at (0,0) size 30x60
 layer at (0,0) size 30x60
   RenderSVGViewportContainer {svg} at (0,0) size 30x60
     RenderSVGRect {rect} at (0.50,0.50) size 29x39 [stroke={[type=SOLID] [color=#FF0000]}] [fill={[type=SOLID] [color=#000000]}] [x=0.50] [y=0.50] [width=29.00] [height=39.00]
-layer at (5,5) size 20x20 backgroundClip at (83.33,83.33) size 49.98x99.98 clip at (83.33,83.33) size 49.98x99.98
+layer at (5,5) size 20x20
   RenderSVGTransformableContainer {g} at (5,5) size 20x20
     RenderSVGEllipse {circle} at (0,0) size 20x20 [fill={[type=SOLID] [color=#FFFF00]}] [cx=15.00] [cy=15.00] [r=10.00]
     RenderSVGEllipse {circle} at (5.50,5.50) size 3x3 [fill={[type=SOLID] [color=#000000]}] [cx=12.00] [cy=12.00] [r=1.50]
@@ -49,7 +49,7 @@ layer at (0,0) size 30x60
 layer at (0,0) size 30x60
   RenderSVGViewportContainer {svg} at (0,0) size 30x60
     RenderSVGRect {rect} at (0.50,0.50) size 29x39 [stroke={[type=SOLID] [color=#FF0000]}] [fill={[type=SOLID] [color=#000000]}] [x=0.50] [y=0.50] [width=29.00] [height=39.00]
-layer at (5,5) size 20x20 backgroundClip at (166.66,83.33) size 50x99.98 clip at (166.66,83.33) size 50x99.98
+layer at (5,5) size 20x20
   RenderSVGTransformableContainer {g} at (5,5) size 20x20
     RenderSVGEllipse {circle} at (0,0) size 20x20 [fill={[type=SOLID] [color=#FFFF00]}] [cx=15.00] [cy=15.00] [r=10.00]
     RenderSVGEllipse {circle} at (5.50,5.50) size 3x3 [fill={[type=SOLID] [color=#000000]}] [cx=12.00] [cy=12.00] [r=1.50]
@@ -60,7 +60,7 @@ layer at (0,0) size 30x60
 layer at (0,0) size 30x60
   RenderSVGViewportContainer {svg} at (0,0) size 30x60
     RenderSVGRect {rect} at (0.50,0.50) size 29x39 [stroke={[type=SOLID] [color=#FF0000]}] [fill={[type=SOLID] [color=#000000]}] [x=0.50] [y=0.50] [width=29.00] [height=39.00]
-layer at (5,5) size 20x20 backgroundClip at (250,83.33) size 50x99.98 clip at (250,83.33) size 50x99.98
+layer at (5,5) size 20x20
   RenderSVGTransformableContainer {g} at (5,5) size 20x20
     RenderSVGEllipse {circle} at (0,0) size 20x20 [fill={[type=SOLID] [color=#FFFF00]}] [cx=15.00] [cy=15.00] [r=10.00]
     RenderSVGEllipse {circle} at (5.50,5.50) size 3x3 [fill={[type=SOLID] [color=#000000]}] [cx=12.00] [cy=12.00] [r=1.50]
@@ -71,7 +71,7 @@ layer at (0,0) size 30x60
 layer at (0,0) size 30x60
   RenderSVGViewportContainer {svg} at (0,0) size 30x60
     RenderSVGRect {rect} at (0.50,0.50) size 29x39 [stroke={[type=SOLID] [color=#FF0000]}] [fill={[type=SOLID] [color=#000000]}] [x=0.50] [y=0.50] [width=29.00] [height=39.00]
-layer at (5,5) size 20x20 backgroundClip at (333.33,83.33) size 50x99.98 clip at (333.33,83.33) size 50x99.98
+layer at (5,5) size 20x20
   RenderSVGTransformableContainer {g} at (5,5) size 20x20
     RenderSVGEllipse {circle} at (0,0) size 20x20 [fill={[type=SOLID] [color=#FFFF00]}] [cx=15.00] [cy=15.00] [r=10.00]
     RenderSVGEllipse {circle} at (5.50,5.50) size 3x3 [fill={[type=SOLID] [color=#000000]}] [cx=12.00] [cy=12.00] [r=1.50]
@@ -82,7 +82,7 @@ layer at (0,0) size 30x60
 layer at (0,0) size 30x60
   RenderSVGViewportContainer {svg} at (0,0) size 30x60
     RenderSVGRect {rect} at (0.50,0.50) size 29x39 [stroke={[type=SOLID] [color=#FF0000]}] [fill={[type=SOLID] [color=#000000]}] [x=0.50] [y=0.50] [width=29.00] [height=39.00]
-layer at (5,5) size 20x20 backgroundClip at (416.66,83.33) size 50x99.98 clip at (416.66,83.33) size 50x99.98
+layer at (5,5) size 20x20
   RenderSVGTransformableContainer {g} at (5,5) size 20x20
     RenderSVGEllipse {circle} at (0,0) size 20x20 [fill={[type=SOLID] [color=#FFFF00]}] [cx=15.00] [cy=15.00] [r=10.00]
     RenderSVGEllipse {circle} at (5.50,5.50) size 3x3 [fill={[type=SOLID] [color=#000000]}] [cx=12.00] [cy=12.00] [r=1.50]
@@ -93,7 +93,7 @@ layer at (0,0) size 30x60
 layer at (0,0) size 30x60
   RenderSVGViewportContainer {svg} at (0,0) size 30x60
     RenderSVGRect {rect} at (0.50,0.50) size 29x39 [stroke={[type=SOLID] [color=#FF0000]}] [fill={[type=SOLID] [color=#000000]}] [x=0.50] [y=0.50] [width=29.00] [height=39.00]
-layer at (5,5) size 20x20 backgroundClip at (500,83.33) size 50x99.98 clip at (500,83.33) size 50x99.98
+layer at (5,5) size 20x20
   RenderSVGTransformableContainer {g} at (5,5) size 20x20
     RenderSVGEllipse {circle} at (0,0) size 20x20 [fill={[type=SOLID] [color=#FFFF00]}] [cx=15.00] [cy=15.00] [r=10.00]
     RenderSVGEllipse {circle} at (5.50,5.50) size 3x3 [fill={[type=SOLID] [color=#000000]}] [cx=12.00] [cy=12.00] [r=1.50]
@@ -104,7 +104,7 @@ layer at (0,0) size 30x60
 layer at (0,0) size 30x60
   RenderSVGViewportContainer {svg} at (0,0) size 30x60
     RenderSVGRect {rect} at (0.50,0.50) size 29x39 [stroke={[type=SOLID] [color=#FF0000]}] [fill={[type=SOLID] [color=#000000]}] [x=0.50] [y=0.50] [width=29.00] [height=39.00]
-layer at (5,5) size 20x20 backgroundClip at (583.33,83.33) size 50x99.98 clip at (583.33,83.33) size 50x99.98
+layer at (5,5) size 20x20
   RenderSVGTransformableContainer {g} at (5,5) size 20x20
     RenderSVGEllipse {circle} at (0,0) size 20x20 [fill={[type=SOLID] [color=#FFFF00]}] [cx=15.00] [cy=15.00] [r=10.00]
     RenderSVGEllipse {circle} at (5.50,5.50) size 3x3 [fill={[type=SOLID] [color=#000000]}] [cx=12.00] [cy=12.00] [r=1.50]
@@ -115,7 +115,7 @@ layer at (0,0) size 30x60
 layer at (0,0) size 30x60
   RenderSVGViewportContainer {svg} at (0,0) size 30x60
     RenderSVGRect {rect} at (0.50,0.50) size 29x39 [stroke={[type=SOLID] [color=#FF0000]}] [fill={[type=SOLID] [color=#000000]}] [x=0.50] [y=0.50] [width=29.00] [height=39.00]
-layer at (5,5) size 20x20 backgroundClip at (666.66,83.33) size 50x99.98 clip at (666.66,83.33) size 50x99.98
+layer at (5,5) size 20x20
   RenderSVGTransformableContainer {g} at (5,5) size 20x20
     RenderSVGEllipse {circle} at (0,0) size 20x20 [fill={[type=SOLID] [color=#FFFF00]}] [cx=15.00] [cy=15.00] [r=10.00]
     RenderSVGEllipse {circle} at (5.50,5.50) size 3x3 [fill={[type=SOLID] [color=#000000]}] [cx=12.00] [cy=12.00] [r=1.50]
@@ -126,7 +126,7 @@ layer at (0,0) size 30x60
 layer at (0,0) size 30x60
   RenderSVGViewportContainer {svg} at (0,0) size 30x60
     RenderSVGRect {rect} at (0.50,0.50) size 29x39 [stroke={[type=SOLID] [color=#FF0000]}] [fill={[type=SOLID] [color=#000000]}] [x=0.50] [y=0.50] [width=29.00] [height=39.00]
-layer at (5,5) size 20x20 backgroundClip at (750,83.33) size 50x99.98 clip at (750,83.33) size 50x99.98
+layer at (5,5) size 20x20
   RenderSVGTransformableContainer {g} at (5,5) size 20x20
     RenderSVGEllipse {circle} at (0,0) size 20x20 [fill={[type=SOLID] [color=#FFFF00]}] [cx=15.00] [cy=15.00] [r=10.00]
     RenderSVGEllipse {circle} at (5.50,5.50) size 3x3 [fill={[type=SOLID] [color=#000000]}] [cx=12.00] [cy=12.00] [r=1.50]
@@ -134,10 +134,10 @@ layer at (5,5) size 20x20 backgroundClip at (750,83.33) size 50x99.98 clip at (7
     RenderSVGPath {path} at (5,14) size 10x4 [stroke={[type=SOLID] [color=#000000] [stroke width=2.00]}] [fill={[type=SOLID] [color=#000000]}] [data="M 10 19 L 15 23 L 20 19"]
 layer at (0,0) size 30x60
   RenderSVGTransformableContainer {g} at (0,0) size 30x60
-layer at (0,0) size 30x60 clip at (0,0) size 30x40
+layer at (0,0) size 30x60
   RenderSVGViewportContainer {svg} at (0,0) size 30x60
     RenderSVGRect {rect} at (0.50,0.50) size 29x39 [stroke={[type=SOLID] [color=#FF0000]}] [fill={[type=SOLID] [color=#000000]}] [x=0.50] [y=0.50] [width=29.00] [height=39.00]
-layer at (5,5) size 20x20 backgroundClip at (0,333.33) size 50x100 clip at (0,333.33) size 50x100
+layer at (5,5) size 20x20
   RenderSVGTransformableContainer {g} at (5,5) size 20x20
     RenderSVGEllipse {circle} at (0,0) size 20x20 [fill={[type=SOLID] [color=#FFFF00]}] [cx=15.00] [cy=15.00] [r=10.00]
     RenderSVGEllipse {circle} at (5.50,5.50) size 3x3 [fill={[type=SOLID] [color=#000000]}] [cx=12.00] [cy=12.00] [r=1.50]
@@ -145,10 +145,10 @@ layer at (5,5) size 20x20 backgroundClip at (0,333.33) size 50x100 clip at (0,33
     RenderSVGPath {path} at (5,14) size 10x4 [stroke={[type=SOLID] [color=#000000] [stroke width=2.00]}] [fill={[type=SOLID] [color=#000000]}] [data="M 10 19 L 15 23 L 20 19"]
 layer at (0,0) size 30x60
   RenderSVGTransformableContainer {g} at (0,0) size 30x60
-layer at (0,0) size 30x60 clip at (0,0) size 30x40
+layer at (0,0) size 30x60
   RenderSVGViewportContainer {svg} at (0,0) size 30x60
     RenderSVGRect {rect} at (0.50,0.50) size 29x39 [stroke={[type=SOLID] [color=#FF0000]}] [fill={[type=SOLID] [color=#000000]}] [x=0.50] [y=0.50] [width=29.00] [height=39.00]
-layer at (5,5) size 20x20 backgroundClip at (83.33,333.33) size 49.98x100 clip at (83.33,333.33) size 49.98x100
+layer at (5,5) size 20x20
   RenderSVGTransformableContainer {g} at (5,5) size 20x20
     RenderSVGEllipse {circle} at (0,0) size 20x20 [fill={[type=SOLID] [color=#FFFF00]}] [cx=15.00] [cy=15.00] [r=10.00]
     RenderSVGEllipse {circle} at (5.50,5.50) size 3x3 [fill={[type=SOLID] [color=#000000]}] [cx=12.00] [cy=12.00] [r=1.50]
@@ -156,10 +156,10 @@ layer at (5,5) size 20x20 backgroundClip at (83.33,333.33) size 49.98x100 clip a
     RenderSVGPath {path} at (5,14) size 10x4 [stroke={[type=SOLID] [color=#000000] [stroke width=2.00]}] [fill={[type=SOLID] [color=#000000]}] [data="M 10 19 L 15 23 L 20 19"]
 layer at (0,0) size 30x60
   RenderSVGTransformableContainer {g} at (0,0) size 30x60
-layer at (0,0) size 30x60 clip at (0,0) size 30x40
+layer at (0,0) size 30x60
   RenderSVGViewportContainer {svg} at (0,0) size 30x60
     RenderSVGRect {rect} at (0.50,0.50) size 29x39 [stroke={[type=SOLID] [color=#FF0000]}] [fill={[type=SOLID] [color=#000000]}] [x=0.50] [y=0.50] [width=29.00] [height=39.00]
-layer at (5,5) size 20x20 backgroundClip at (166.66,333.33) size 50x100 clip at (166.66,333.33) size 50x100
+layer at (5,5) size 20x20
   RenderSVGTransformableContainer {g} at (5,5) size 20x20
     RenderSVGEllipse {circle} at (0,0) size 20x20 [fill={[type=SOLID] [color=#FFFF00]}] [cx=15.00] [cy=15.00] [r=10.00]
     RenderSVGEllipse {circle} at (5.50,5.50) size 3x3 [fill={[type=SOLID] [color=#000000]}] [cx=12.00] [cy=12.00] [r=1.50]
@@ -167,10 +167,10 @@ layer at (5,5) size 20x20 backgroundClip at (166.66,333.33) size 50x100 clip at
     RenderSVGPath {path} at (5,14) size 10x4 [stroke={[type=SOLID] [color=#000000] [stroke width=2.00]}] [fill={[type=SOLID] [color=#000000]}] [data="M 10 19 L 15 23 L 20 19"]
 layer at (0,0) size 30x60
   RenderSVGTransformableContainer {g} at (0,0) size 30x60
-layer at (0,0) size 30x60 clip at (0,0) size 30x40
+layer at (0,0) size 30x60
   RenderSVGViewportContainer {svg} at (0,0) size 30x60
     RenderSVGRect {rect} at (0.50,0.50) size 29x39 [stroke={[type=SOLID] [color=#FF0000]}] [fill={[type=SOLID] [color=#000000]}] [x=0.50] [y=0.50] [width=29.00] [height=39.00]
-layer at (5,5) size 20x20 backgroundClip at (250,333.33) size 50x100 clip at (250,333.33) size 50x100
+layer at (5,5) size 20x20
   RenderSVGTransformableContainer {g} at (5,5) size 20x20
     RenderSVGEllipse {circle} at (0,0) size 20x20 [fill={[type=SOLID] [color=#FFFF00]}] [cx=15.00] [cy=15.00] [r=10.00]
     RenderSVGEllipse {circle} at (5.50,5.50) size 3x3 [fill={[type=SOLID] [color=#000000]}] [cx=12.00] [cy=12.00] [r=1.50]
@@ -189,10 +189,10 @@ layer at (5,5) size 20x20 backgroundClip at (333.33,333.33) size 50x100 clip at
     RenderSVGPath {path} at (5,14) size 10x4 [stroke={[type=SOLID] [color=#000000] [stroke width=2.00]}] [fill={[type=SOLID] [color=#000000]}] [data="M 10 19 L 15 23 L 20 19"]
 layer at (0,0) size 30x60
   RenderSVGTransformableContainer {g} at (0,0) size 30x60
-layer at (0,0) size 30x60 clip at (0,0) size 30x40
+layer at (0,0) size 30x60
   RenderSVGViewportContainer {svg} at (0,0) size 30x60
     RenderSVGRect {rect} at (0.50,0.50) size 29x39 [stroke={[type=SOLID] [color=#FF0000]}] [fill={[type=SOLID] [color=#000000]}] [x=0.50] [y=0.50] [width=29.00] [height=39.00]
-layer at (5,5) size 20x20 backgroundClip at (416.66,333.33) size 50x100 clip at (416.66,333.33) size 50x100
+layer at (5,5) size 20x20
   RenderSVGTransformableContainer {g} at (5,5) size 20x20
     RenderSVGEllipse {circle} at (0,0) size 20x20 [fill={[type=SOLID] [color=#FFFF00]}] [cx=15.00] [cy=15.00] [r=10.00]
     RenderSVGEllipse {circle} at (5.50,5.50) size 3x3 [fill={[type=SOLID] [color=#000000]}] [cx=12.00] [cy=12.00] [r=1.50]
@@ -200,10 +200,10 @@ layer at (5,5) size 20x20 backgroundClip at (416.66,333.33) size 50x100 clip at
     RenderSVGPath {path} at (5,14) size 10x4 [stroke={[type=SOLID] [color=#000000] [stroke width=2.00]}] [fill={[type=SOLID] [color=#000000]}] [data="M 10 19 L 15 23 L 20 19"]
 layer at (0,0) size 30x60
   RenderSVGTransformableContainer {g} at (0,0) size 30x60
-layer at (0,0) size 30x60 clip at (0,0) size 30x40
+layer at (0,0) size 30x60
   RenderSVGViewportContainer {svg} at (0,0) size 30x60
     RenderSVGRect {rect} at (0.50,0.50) size 29x39 [stroke={[type=SOLID] [color=#FF0000]}] [fill={[type=SOLID] [color=#000000]}] [x=0.50] [y=0.50] [width=29.00] [height=39.00]
-layer at (5,5) size 20x20 backgroundClip at (500,333.33) size 50x100 clip at (500,333.33) size 50x100
+layer at (5,5) size 20x20
   RenderSVGTransformableContainer {g} at (5,5) size 20x20
     RenderSVGEllipse {circle} at (0,0) size 20x20 [fill={[type=SOLID] [color=#FFFF00]}] [cx=15.00] [cy=15.00] [r=10.00]
     RenderSVGEllipse {circle} at (5.50,5.50) size 3x3 [fill={[type=SOLID] [color=#000000]}] [cx=12.00] [cy=12.00] [r=1.50]
@@ -211,10 +211,10 @@ layer at (5,5) size 20x20 backgroundClip at (500,333.33) size 50x100 clip at (50
     RenderSVGPath {path} at (5,14) size 10x4 [stroke={[type=SOLID] [color=#000000] [stroke width=2.00]}] [fill={[type=SOLID] [color=#000000]}] [data="M 10 19 L 15 23 L 20 19"]
 layer at (0,0) size 30x60
   RenderSVGTransformableContainer {g} at (0,0) size 30x60
-layer at (0,0) size 30x60 clip at (0,0) size 30x40
+layer at (0,0) size 30x60
   RenderSVGViewportContainer {svg} at (0,0) size 30x60
     RenderSVGRect {rect} at (0.50,0.50) size 29x39 [stroke={[type=SOLID] [color=#FF0000]}] [fill={[type=SOLID] [color=#000000]}] [x=0.50] [y=0.50] [width=29.00] [height=39.00]
-layer at (5,5) size 20x20 backgroundClip at (583.33,333.33) size 50x100 clip at (583.33,333.33) size 50x100
+layer at (5,5) size 20x20
   RenderSVGTransformableContainer {g} at (5,5) size 20x20
     RenderSVGEllipse {circle} at (0,0) size 20x20 [fill={[type=SOLID] [color=#FFFF00]}] [cx=15.00] [cy=15.00] [r=10.00]
     RenderSVGEllipse {circle} at (5.50,5.50) size 3x3 [fill={[type=SOLID] [color=#000000]}] [cx=12.00] [cy=12.00] [r=1.50]
diff --git a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/text/text-viewbox-rescale-expected.txt b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/text/text-viewbox-rescale-expected.txt
index dc47ed468f1c..c040df5fa750 100644
--- a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/text/text-viewbox-rescale-expected.txt
+++ b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/text/text-viewbox-rescale-expected.txt
@@ -6,7 +6,7 @@ layer at (0,0) size 800x600
 layer at (0,0) size 200x200
   RenderSVGRoot {svg} at (0,0) size 200x200
     RenderSVGViewportContainer at (0,0) size 200x200
-layer at (0,0) size 200x200 clip at (0,0) size 1x1
+layer at (0,0) size 200x200
   RenderSVGViewportContainer {svg} at (0,0) size 200x200
     RenderSVGText {text} at (0,0) size 1x1 contains 1 chunk(s)
       RenderSVGInlineText {#text} at (0,0) size 1x1
@@ -15,7 +15,7 @@ layer at (0,0) size 200x200 clip at (0,0) size 1x1
         RenderSVGInlineText {#text} at (0,0) size 1x1
           chunk 1 text run 1 at (0.56,0.30) startOffset 0 endOffset 4 width 0.24: "PASS"
       RenderSVGInlineText {#text} at (0,0) size 0x0
-layer at (0,0) size 200x200 clip at (0,0) size 1x1
+layer at (0,0) size 200x200
   RenderSVGViewportContainer {svg} at (0,0) size 200x200
     RenderSVGText {text} at (0,0) size 1x1 contains 1 chunk(s)
       RenderSVGInlineText {#text} at (0,0) size 1x1
diff --git a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/zoom/page/zoom-coords-viewattr-01-b-expected.png b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/zoom/page/zoom-coords-viewattr-01-b-expected.png
index 7c5d248bbaf2..b77bd28ed052 100644
Binary files a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/zoom/page/zoom-coords-viewattr-01-b-expected.png and b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/zoom/page/zoom-coords-viewattr-01-b-expected.png differ
diff --git a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/zoom/page/zoom-coords-viewattr-01-b-expected.txt b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/zoom/page/zoom-coords-viewattr-01-b-expected.txt
index c530700eb90c..d1fbfa4c2ea0 100644
--- a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/zoom/page/zoom-coords-viewattr-01-b-expected.txt
+++ b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/zoom/page/zoom-coords-viewattr-01-b-expected.txt
@@ -49,7 +49,7 @@ layer at (0,-28.05) size 112x59 backgroundClip at (0,0) size 1130.39x842.39 clip
 layer at (0,0) size 50x31 backgroundClip at (0,0) size 30x40
   RenderSVGViewportContainer {svg} at (0,13.05) size 50x30
     RenderSVGRect {rect} at (0.50,0.50) size 29x39 [stroke={[type=SOLID] [color=#FF0000]}] [fill={[type=SOLID] [color=#000000]}] [x=0.50] [y=0.50] [width=29.00] [height=39.00]
-layer at (5,5) size 20x20 backgroundClip at (284.39,187.19) size 117x70.19 clip at (284.39,187.19) size 117x70.19
+layer at (5,5) size 20x20
   RenderSVGTransformableContainer {g} at (5,5) size 20x20
     RenderSVGEllipse {circle} at (0,0) size 20x20 [fill={[type=SOLID] [color=#FFFF00]}] [cx=15.00] [cy=15.00] [r=10.00]
     RenderSVGEllipse {circle} at (5.50,5.50) size 3x3 [fill={[type=SOLID] [color=#000000]}] [cx=12.00] [cy=12.00] [r=1.50]
@@ -61,10 +61,10 @@ layer at (0,-13.05) size 50x44 backgroundClip at (0,0) size 1130.39x842.39 clip
       RenderSVGInlineText {#text} at (0,0) size 25x11
         chunk 1 text run 1 at (0.00,-5.00) startOffset 0 endOffset 5 width 24.00: "xMid*"
     RenderSVGRect {rect} at (0.50,13.55) size 49x29 [stroke={[type=SOLID] [color=#0000FF]}] [x=0.50] [y=0.50] [width=49.00] [height=29.00]
-layer at (0,0) size 50x31 backgroundClip at (0,0) size 30x40 clip at (0,0) size 48.34x40
+layer at (0,0) size 50x31 backgroundClip at (0,0) size 30x40
   RenderSVGViewportContainer {svg} at (0,13.05) size 50x30
     RenderSVGRect {rect} at (0.50,0.50) size 29x39 [stroke={[type=SOLID] [color=#FF0000]}] [fill={[type=SOLID] [color=#000000]}] [x=0.50] [y=0.50] [width=29.00] [height=39.00]
-layer at (5,5) size 20x20 backgroundClip at (448.17,187.19) size 117.03x70.19 clip at (448.17,187.19) size 117.03x70.19
+layer at (5,5) size 20x20
   RenderSVGTransformableContainer {g} at (5,5) size 20x20
     RenderSVGEllipse {circle} at (0,0) size 20x20 [fill={[type=SOLID] [color=#FFFF00]}] [cx=15.00] [cy=15.00] [r=10.00]
     RenderSVGEllipse {circle} at (5.50,5.50) size 3x3 [fill={[type=SOLID] [color=#000000]}] [cx=12.00] [cy=12.00] [r=1.50]
@@ -76,10 +76,10 @@ layer at (0,-13.05) size 50x44 backgroundClip at (0,0) size 1130.39x842.39 clip
       RenderSVGInlineText {#text} at (0,0) size 26x11
         chunk 1 text run 1 at (0.00,-5.00) startOffset 0 endOffset 5 width 25.50: "xMax*"
     RenderSVGRect {rect} at (0.50,13.55) size 49x29 [stroke={[type=SOLID] [color=#0000FF]}] [x=0.50] [y=0.50] [width=49.00] [height=29.00]
-layer at (0,0) size 50x31 backgroundClip at (0,0) size 30x40 clip at (0,0) size 30.02x40
+layer at (0,0) size 50x31 backgroundClip at (0,0) size 30x40
   RenderSVGViewportContainer {svg} at (0,13.05) size 50x30
     RenderSVGRect {rect} at (0.50,0.50) size 29x39 [stroke={[type=SOLID] [color=#FF0000]}] [fill={[type=SOLID] [color=#000000]}] [x=0.50] [y=0.50] [width=29.00] [height=39.00]
-layer at (5,5) size 20x20 backgroundClip at (284.38,304.19) size 117.03x70.19 clip at (284.38,304.19) size 117.03x70.19
+layer at (5,5) size 20x20
   RenderSVGTransformableContainer {g} at (5,5) size 20x20
     RenderSVGEllipse {circle} at (0,0) size 20x20 [fill={[type=SOLID] [color=#FFFF00]}] [cx=15.00] [cy=15.00] [r=10.00]
     RenderSVGEllipse {circle} at (5.50,5.50) size 3x3 [fill={[type=SOLID] [color=#000000]}] [cx=12.00] [cy=12.00] [r=1.50]
@@ -95,10 +95,10 @@ layer at (0,-28.05) size 124x89 backgroundClip at (0,0) size 1130.39x842.39 clip
         RenderSVGInlineText {#text} at (0,0) size 27x11
           chunk 1 text run 1 at (0.00,-5.00) startOffset 0 endOffset 5 width 26.00: "*YMin"
       RenderSVGRect {rect} at (0.50,13.55) size 29x59 [stroke={[type=SOLID] [color=#0000FF]}] [x=0.50] [y=0.50] [width=29.00] [height=59.00]
-layer at (0,0) size 30x61 backgroundClip at (0,0) size 30x60 clip at (0,0) size 30x60
+layer at (0,0) size 30x61 backgroundClip at (0,0) size 30x60
   RenderSVGViewportContainer {svg} at (0,13.05) size 30x60
     RenderSVGRect {rect} at (0.50,0.50) size 29x39 [stroke={[type=SOLID] [color=#FF0000]}] [fill={[type=SOLID] [color=#000000]}] [x=0.50] [y=0.50] [width=29.00] [height=39.00]
-layer at (5,5) size 20x20 backgroundClip at (705.59,187.19) size 70.19x140.39 clip at (705.59,187.19) size 70.19x140.39
+layer at (5,5) size 20x20
   RenderSVGTransformableContainer {g} at (5,5) size 20x20
     RenderSVGEllipse {circle} at (0,0) size 20x20 [fill={[type=SOLID] [color=#FFFF00]}] [cx=15.00] [cy=15.00] [r=10.00]
     RenderSVGEllipse {circle} at (5.50,5.50) size 3x3 [fill={[type=SOLID] [color=#000000]}] [cx=12.00] [cy=12.00] [r=1.50]
@@ -110,10 +110,10 @@ layer at (0,-13.05) size 30x74 backgroundClip at (0,0) size 1130.39x842.39 clip
       RenderSVGInlineText {#text} at (0,0) size 27x11
         chunk 1 text run 1 at (0.00,-5.00) startOffset 0 endOffset 5 width 26.00: "*YMid"
     RenderSVGRect {rect} at (0.50,13.55) size 29x59 [stroke={[type=SOLID] [color=#0000FF]}] [x=0.50] [y=0.50] [width=29.00] [height=59.00]
-layer at (0,0) size 30x61 backgroundClip at (0,0) size 30x60 clip at (0,0) size 30x50
+layer at (0,0) size 30x61 backgroundClip at (0,0) size 30x60
   RenderSVGViewportContainer {svg} at (0,13.05) size 30x60
     RenderSVGRect {rect} at (0.50,0.50) size 29x39 [stroke={[type=SOLID] [color=#FF0000]}] [fill={[type=SOLID] [color=#000000]}] [x=0.50] [y=0.50] [width=29.00] [height=39.00]
-layer at (5,5) size 20x20 backgroundClip at (822.58,187.19) size 70.19x140.39 clip at (822.58,187.19) size 70.19x140.39
+layer at (5,5) size 20x20
   RenderSVGTransformableContainer {g} at (5,5) size 20x20
     RenderSVGEllipse {circle} at (0,0) size 20x20 [fill={[type=SOLID] [color=#FFFF00]}] [cx=15.00] [cy=15.00] [r=10.00]
     RenderSVGEllipse {circle} at (5.50,5.50) size 3x3 [fill={[type=SOLID] [color=#000000]}] [cx=12.00] [cy=12.00] [r=1.50]
@@ -125,10 +125,10 @@ layer at (0,-13.05) size 30x74 backgroundClip at (0,0) size 1130.39x842.39 clip
       RenderSVGInlineText {#text} at (0,0) size 28x11
         chunk 1 text run 1 at (0.00,-5.00) startOffset 0 endOffset 5 width 27.50: "*YMax"
     RenderSVGRect {rect} at (0.50,13.55) size 29x59 [stroke={[type=SOLID] [color=#0000FF]}] [x=0.50] [y=0.50] [width=29.00] [height=59.00]
-layer at (0,0) size 30x61 backgroundClip at (0,0) size 30x60 clip at (0,0) size 30x40
+layer at (0,0) size 30x61 backgroundClip at (0,0) size 30x60
   RenderSVGViewportContainer {svg} at (0,13.05) size 30x60
     RenderSVGRect {rect} at (0.50,0.50) size 29x39 [stroke={[type=SOLID] [color=#FF0000]}] [fill={[type=SOLID] [color=#000000]}] [x=0.50] [y=0.50] [width=29.00] [height=39.00]
-layer at (5,5) size 20x20 backgroundClip at (939.58,187.19) size 70.19x140.39 clip at (939.58,187.19) size 70.19x140.39
+layer at (5,5) size 20x20
   RenderSVGTransformableContainer {g} at (5,5) size 20x20
     RenderSVGEllipse {circle} at (0,0) size 20x20 [fill={[type=SOLID] [color=#FFFF00]}] [cx=15.00] [cy=15.00] [r=10.00]
     RenderSVGEllipse {circle} at (5.50,5.50) size 3x3 [fill={[type=SOLID] [color=#000000]}] [cx=12.00] [cy=12.00] [r=1.50]
diff --git a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/zoom/text/zoom-coords-viewattr-01-b-expected.png b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/zoom/text/zoom-coords-viewattr-01-b-expected.png
index e159733c8ea2..c83ba0fee370 100644
Binary files a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/zoom/text/zoom-coords-viewattr-01-b-expected.png and b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/zoom/text/zoom-coords-viewattr-01-b-expected.png differ
diff --git a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/zoom/text/zoom-coords-viewattr-01-b-expected.txt b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/zoom/text/zoom-coords-viewattr-01-b-expected.txt
index 935117c0eb3f..ed0e2e14f33e 100644
--- a/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/zoom/text/zoom-coords-viewattr-01-b-expected.txt
+++ b/LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/zoom/text/zoom-coords-viewattr-01-b-expected.txt
@@ -49,7 +49,7 @@ layer at (0,-27.95) size 112x58 backgroundClip at (0,0) size 800x600 clip at (0,
 layer at (0,0) size 50x31 backgroundClip at (0,0) size 30x40
   RenderSVGViewportContainer {svg} at (0,12.95) size 50x30
     RenderSVGRect {rect} at (0.50,0.50) size 29x39 [stroke={[type=SOLID] [color=#FF0000]}] [fill={[type=SOLID] [color=#000000]}] [x=0.50] [y=0.50] [width=29.00] [height=39.00]
-layer at (5,5) size 20x20 backgroundClip at (200,133.33) size 83.33x50 clip at (200,133.33) size 83.33x50
+layer at (5,5) size 20x20
   RenderSVGTransformableContainer {g} at (5,5) size 20x20
     RenderSVGEllipse {circle} at (0,0) size 20x20 [fill={[type=SOLID] [color=#FFFF00]}] [cx=15.00] [cy=15.00] [r=10.00]
     RenderSVGEllipse {circle} at (5.50,5.50) size 3x3 [fill={[type=SOLID] [color=#000000]}] [cx=12.00] [cy=12.00] [r=1.50]
@@ -61,10 +61,10 @@ layer at (0,-12.95) size 50x43 backgroundClip at (0,0) size 800x600 clip at (0,0
       RenderSVGInlineText {#text} at (0,0) size 25x11
         chunk 1 text run 1 at (0.00,-5.00) startOffset 0 endOffset 5 width 24.00: "xMid*"
     RenderSVGRect {rect} at (0.50,13.45) size 49x29 [stroke={[type=SOLID] [color=#0000FF]}] [x=0.50] [y=0.50] [width=49.00] [height=29.00]
-layer at (0,0) size 50x31 backgroundClip at (0,0) size 30x40 clip at (0,0) size 48.34x40
+layer at (0,0) size 50x31 backgroundClip at (0,0) size 30x40
   RenderSVGViewportContainer {svg} at (0,12.95) size 50x30
     RenderSVGRect {rect} at (0.50,0.50) size 29x39 [stroke={[type=SOLID] [color=#FF0000]}] [fill={[type=SOLID] [color=#000000]}] [x=0.50] [y=0.50] [width=29.00] [height=39.00]
-layer at (5,5) size 20x20 backgroundClip at (316.64,133.33) size 83.36x50 clip at (316.64,133.33) size 83.36x50
+layer at (5,5) size 20x20
   RenderSVGTransformableContainer {g} at (5,5) size 20x20
     RenderSVGEllipse {circle} at (0,0) size 20x20 [fill={[type=SOLID] [color=#FFFF00]}] [cx=15.00] [cy=15.00] [r=10.00]
     RenderSVGEllipse {circle} at (5.50,5.50) size 3x3 [fill={[type=SOLID] [color=#000000]}] [cx=12.00] [cy=12.00] [r=1.50]
@@ -76,10 +76,10 @@ layer at (0,-12.95) size 50x43 backgroundClip at (0,0) size 800x600 clip at (0,0
       RenderSVGInlineText {#text} at (0,0) size 26x11
         chunk 1 text run 1 at (0.00,-5.00) startOffset 0 endOffset 5 width 25.50: "xMax*"
     RenderSVGRect {rect} at (0.50,13.45) size 49x29 [stroke={[type=SOLID] [color=#0000FF]}] [x=0.50] [y=0.50] [width=49.00] [height=29.00]
-layer at (0,0) size 50x31 backgroundClip at (0,0) size 30x40 clip at (0,0) size 30.02x40
+layer at (0,0) size 50x31 backgroundClip at (0,0) size 30x40
   RenderSVGViewportContainer {svg} at (0,12.95) size 50x30
     RenderSVGRect {rect} at (0.50,0.50) size 29x39 [stroke={[type=SOLID] [color=#FF0000]}] [fill={[type=SOLID] [color=#000000]}] [x=0.50] [y=0.50] [width=29.00] [height=39.00]
-layer at (5,5) size 20x20 backgroundClip at (199.98,216.66) size 83.36x49.98 clip at (199.98,216.66) size 83.36x49.98
+layer at (5,5) size 20x20
   RenderSVGTransformableContainer {g} at (5,5) size 20x20
     RenderSVGEllipse {circle} at (0,0) size 20x20 [fill={[type=SOLID] [color=#FFFF00]}] [cx=15.00] [cy=15.00] [r=10.00]
     RenderSVGEllipse {circle} at (5.50,5.50) size 3x3 [fill={[type=SOLID] [color=#000000]}] [cx=12.00] [cy=12.00] [r=1.50]
@@ -95,10 +95,10 @@ layer at (0,-27.95) size 124x88 backgroundClip at (0,0) size 800x600 clip at (0,
         RenderSVGInlineText {#text} at (0,0) size 27x11
           chunk 1 text run 1 at (0.00,-5.00) startOffset 0 endOffset 5 width 26.00: "*YMin"
       RenderSVGRect {rect} at (0.50,13.45) size 29x59 [stroke={[type=SOLID] [color=#0000FF]}] [x=0.50] [y=0.50] [width=29.00] [height=59.00]
-layer at (0,0) size 30x61 backgroundClip at (0,0) size 30x60 clip at (0,0) size 30x60
+layer at (0,0) size 30x61 backgroundClip at (0,0) size 30x60
   RenderSVGViewportContainer {svg} at (0,12.95) size 30x60
     RenderSVGRect {rect} at (0.50,0.50) size 29x39 [stroke={[type=SOLID] [color=#FF0000]}] [fill={[type=SOLID] [color=#000000]}] [x=0.50] [y=0.50] [width=29.00] [height=39.00]
-layer at (5,5) size 20x20 backgroundClip at (500,133.33) size 50x100 clip at (500,133.33) size 50x100
+layer at (5,5) size 20x20
   RenderSVGTransformableContainer {g} at (5,5) size 20x20
     RenderSVGEllipse {circle} at (0,0) size 20x20 [fill={[type=SOLID] [color=#FFFF00]}] [cx=15.00] [cy=15.00] [r=10.00]
     RenderSVGEllipse {circle} at (5.50,5.50) size 3x3 [fill={[type=SOLID] [color=#000000]}] [cx=12.00] [cy=12.00] [r=1.50]
@@ -110,10 +110,10 @@ layer at (0,-12.95) size 30x73 backgroundClip at (0,0) size 800x600 clip at (0,0
       RenderSVGInlineText {#text} at (0,0) size 27x11
         chunk 1 text run 1 at (0.00,-5.00) startOffset 0 endOffset 5 width 26.00: "*YMid"
     RenderSVGRect {rect} at (0.50,13.45) size 29x59 [stroke={[type=SOLID] [color=#0000FF]}] [x=0.50] [y=0.50] [width=29.00] [height=59.00]
-layer at (0,0) size 30x61 backgroundClip at (0,0) size 30x60 clip at (0,0) size 30x50
+layer at (0,0) size 30x61 backgroundClip at (0,0) size 30x60
   RenderSVGViewportContainer {svg} at (0,12.95) size 30x60
     RenderSVGRect {rect} at (0.50,0.50) size 29x39 [stroke={[type=SOLID] [color=#FF0000]}] [fill={[type=SOLID] [color=#000000]}] [x=0.50] [y=0.50] [width=29.00] [height=39.00]
-layer at (5,5) size 20x20 backgroundClip at (583.33,133.33) size 50x100 clip at (583.33,133.33) size 50x100
+layer at (5,5) size 20x20
   RenderSVGTransformableContainer {g} at (5,5) size 20x20
     RenderSVGEllipse {circle} at (0,0) size 20x20 [fill={[type=SOLID] [color=#FFFF00]}] [cx=15.00] [cy=15.00] [r=10.00]
     RenderSVGEllipse {circle} at (5.50,5.50) size 3x3 [fill={[type=SOLID] [color=#000000]}] [cx=12.00] [cy=12.00] [r=1.50]
@@ -125,10 +125,10 @@ layer at (0,-12.95) size 30x73 backgroundClip at (0,0) size 800x600 clip at (0,0
       RenderSVGInlineText {#text} at (0,0) size 28x11
         chunk 1 text run 1 at (0.00,-5.00) startOffset 0 endOffset 5 width 27.50: "*YMax"
     RenderSVGRect {rect} at (0.50,13.45) size 29x59 [stroke={[type=SOLID] [color=#0000FF]}] [x=0.50] [y=0.50] [width=29.00] [height=59.00]
-layer at (0,0) size 30x61 backgroundClip at (0,0) size 30x60 clip at (0,0) size 30x40
+layer at (0,0) size 30x61 backgroundClip at (0,0) size 30x60
   RenderSVGViewportContainer {svg} at (0,12.95) size 30x60
     RenderSVGRect {rect} at (0.50,0.50) size 29x39 [stroke={[type=SOLID] [color=#FF0000]}] [fill={[type=SOLID] [color=#000000]}] [x=0.50] [y=0.50] [width=29.00] [height=39.00]
-layer at (5,5) size 20x20 backgroundClip at (666.66,133.33) size 50x100 clip at (666.66,133.33) size 50x100
+layer at (5,5) size 20x20
   RenderSVGTransformableContainer {g} at (5,5) size 20x20
     RenderSVGEllipse {circle} at (0,0) size 20x20 [fill={[type=SOLID] [color=#FFFF00]}] [cx=15.00] [cy=15.00] [r=10.00]
     RenderSVGEllipse {circle} at (5.50,5.50) size 3x3 [fill={[type=SOLID] [color=#000000]}] [cx=12.00] [cy=12.00] [r=1.50]
diff --git a/LayoutTests/platform/mac-wk2/TestExpectations b/LayoutTests/platform/mac-wk2/TestExpectations
index 486a1a6d5e0c..76313f082be4 100644
--- a/LayoutTests/platform/mac-wk2/TestExpectations
+++ b/LayoutTests/platform/mac-wk2/TestExpectations
@@ -2471,4 +2471,21 @@ webkit.org/b/322051 [ Release ] media/picture-in-picture/picture-in-picture-inte
 [ Tahoe+ ] http/tests/storageAccess/request-and-grant-access-cross-origin-sandboxed-iframe-from-prevalent-domain-with-user-interaction-and-access-from-right-frame.https.html [ Failure ]
 [ Tahoe+ ] http/tests/storageAccess/request-and-grant-access-cross-origin-sandboxed-iframe-from-prevalent-domain-with-user-interaction-but-access-from-wrong-frame.https.html [ Failure ]
 
-webkit.org/b/321323 [ Tahoe+ ] http/tests/websocket/tests/hybi/inspector/before-load.html [ Failure ]
\ No newline at end of file
+webkit.org/b/321323 [ Tahoe+ ] http/tests/websocket/tests/hybi/inspector/before-load.html [ Failure ]
+
+# webkit.org/b/322840 REGRESSION(318498@main): [Tahoe] 11 imported/w3c/web-platform-tests/encrypted-media/drm-mp4 tests are a constant CRASH
+[ Tahoe Debug ] imported/w3c/web-platform-tests/encrypted-media/drm-mp4-playback-temporary-encrypted-clear-sources.https.html [ Failure Crash ]
+[ Tahoe Debug ] imported/w3c/web-platform-tests/encrypted-media/drm-mp4-playback-temporary-playduration.html [ Failure Crash ]
+[ Tahoe Debug ] imported/w3c/web-platform-tests/encrypted-media/drm-mp4-playback-temporary-setMediaKeys-after-update.https.html [ Failure Crash ]
+[ Tahoe Debug ] imported/w3c/web-platform-tests/encrypted-media/drm-mp4-playback-temporary-setMediaKeys-immediately.https.html [ Failure Crash ]
+[ Tahoe Debug ] imported/w3c/web-platform-tests/encrypted-media/drm-mp4-playback-temporary-setMediaKeys-onencrypted.https.html [ Failure Crash ]
+[ Tahoe Debug ] imported/w3c/web-platform-tests/encrypted-media/drm-mp4-playback-temporary-two-videos.https.html [ Failure Crash ]
+[ Tahoe Debug ] imported/w3c/web-platform-tests/encrypted-media/drm-mp4-playback-temporary-waitingforkey.https.html [ Failure Crash ]
+[ Tahoe Debug ] imported/w3c/web-platform-tests/encrypted-media/drm-mp4-playback-temporary.https.html [ Failure Crash ]
+[ Tahoe Debug ] imported/w3c/web-platform-tests/encrypted-media/drm-mp4-setmediakeys-again-after-playback.https.html [ Failure Crash ]
+[ Tahoe Debug ] imported/w3c/web-platform-tests/encrypted-media/drm-mp4-setmediakeys-again-after-resetting-src.https.html [ Failure Crash ]
+[ Tahoe Debug ] imported/w3c/web-platform-tests/encrypted-media/drm-mp4-waiting-for-a-key.https.html [ Failure Crash ]
+
+webkit.org/b/322847 [ Debug ] imported/w3c/web-platform-tests/css/css-grid/grid-lanes/subgrid/grid-subgridded-to-grid-lanes/baseline/row-grid-lanes-item-baseline-subgrid-001.html [ Crash ]
+webkit.org/b/322847 [ Debug ] imported/w3c/web-platform-tests/css/css-grid/grid-lanes/subgrid/grid-subgridded-to-grid-lanes/baseline/row-grid-lanes-item-baseline-subgrid-004.html [ Crash ]
+webkit.org/b/322847 [ Debug ] imported/w3c/web-platform-tests/css/css-grid/grid-lanes/subgrid/grid-subgridded-to-grid-lanes/baseline/row-grid-lanes-item-baseline-subgrid-005.html [ Crash ]
\ No newline at end of file
diff --git a/LayoutTests/platform/mac/TestExpectations b/LayoutTests/platform/mac/TestExpectations
index e1b4ac5905db..d149ca079c36 100644
--- a/LayoutTests/platform/mac/TestExpectations
+++ b/LayoutTests/platform/mac/TestExpectations
@@ -102,6 +102,9 @@ fast/images/heic-as-background-image.html [ Pass ]
 # Video as an image source is only supported on macOS and iOS.
 fast/images/video-as-image.html [ Pass ]
 
+# ImageIO rejects an acTL declaring zero frames, so the default image never decodes.
+fast/images/apng-acTL-zero-frame-count.html [ Skip ]
+
 # Enabled in rdar://102830993
 fast/images/mac/play-all-pause-all-animations-context-menu-items.html [ Skip ]
 
@@ -1935,8 +1938,6 @@ webkit.org/b/258181 [ Debug ] inspector/debugger/async-stack-trace-truncate.html
 
 webkit.org/b/236128 imported/w3c/web-platform-tests/html/user-activation/activation-trigger-mouse-right.html [ Skip ]
 
-webkit.org/b/252322 [ X86_64 ] media/media-source/media-source-video-renders.html [ ImageOnlyFailure ] # rdar://180537206
-
 webkit.org/b/259712 media/media-source/media-source-paint-after-display-none.html [ Skip ]
 
 # rdar://110876540 ASSERTION FAILED: firstChild(): [ macOS ] (258183)
@@ -2468,8 +2469,8 @@ imported/w3c/web-platform-tests/storage-access-api/requestStorageAccess-web-sock
 # rdar://172914523 [macOS 27] imported/w3c/web-platform-tests/svg/shapes/reftests/pathlength-002.svg is a constant IMAGE failure
 [ GoldenGate ] imported/w3c/web-platform-tests/svg/shapes/reftests/pathlength-002.svg [ ImageOnlyFailure ]
 
-# rdar://173032378 REGRESSION(304821@main): [macOS 27] imported/w3c/web-platform-tests/css/css-ui/text-overflow-with-selection.html is a constant IMAGE failure
-[ GoldenGate ] imported/w3c/web-platform-tests/css/css-ui/text-overflow-with-selection.html [ ImageOnlyFailure ]
+# rdar://173032378 REGRESSION(304821@main): [macOS 27] imported/w3c/web-platform-tests/css/css-overflow/text-overflow-with-selection.html is a constant IMAGE failure
+[ GoldenGate ] imported/w3c/web-platform-tests/css/css-overflow/text-overflow-with-selection.html [ ImageOnlyFailure ]
 
 # rdar://173034292 REGRESSION(macOS 27?): [macOS 27] media/modern-media-controls/tracks-support/sorted-by-user-preferred-languages.html is a constant TEXT failure
 [ GoldenGate ] media/modern-media-controls/tracks-support/sorted-by-user-preferred-languages.html [ Failure ]
diff --git a/LayoutTests/platform/wpe/TestExpectations b/LayoutTests/platform/wpe/TestExpectations
index 8bea42cc0bee..0f1324dd7b06 100644
--- a/LayoutTests/platform/wpe/TestExpectations
+++ b/LayoutTests/platform/wpe/TestExpectations
@@ -25,7 +25,7 @@ imported/w3c/web-platform-tests/css/compositing/mix-blend-mode/mix-blend-mode-in
 
 webkit.org/b/307586 [ Release ] imported/w3c/web-platform-tests/css/css-view-transitions/no-raf-while-render-blocked.html [ Failure Pass ]
 
-imported/w3c/web-platform-tests/css/css-ui/text-overflow-005.html [ Pass ]
+imported/w3c/web-platform-tests/css/css-overflow/text-overflow-005.html [ Pass ]
 imported/w3c/web-platform-tests/css/css-display/run-in/quotes-applies-to-011.xht [ ImageOnlyFailure ]
 imported/w3c/web-platform-tests/css/css-text/boundary-shaping/boundary-shaping-004.html [ ImageOnlyFailure ]
 imported/w3c/web-platform-tests/css/css-text/boundary-shaping/boundary-shaping-005.html [ ImageOnlyFailure ]
@@ -869,6 +869,10 @@ media/media-source/media-detachablemse-append.html [ Timeout Pass ]
 
 imported/w3c/web-platform-tests/css/css-overflow/overflow-auto-scrolling-with-margin-and-transform.html [ Skip ]
 
+imported/w3c/web-platform-tests/css/css-overflow/clip-002.html [ ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/clip-004.html [ ImageOnlyFailure ]
+imported/w3c/web-platform-tests/css/css-overflow/clip-005.html [ ImageOnlyFailure ]
+
 webkit.org/b/228311 imported/w3c/web-platform-tests/css/css-scoping/css-scoping-shadow-dynamic-remove-style-detached.html [ Pass Failure ]
 
 fast/events/mouse-cursor-pseudo-elements.html [ Failure Pass ]
@@ -1326,3 +1330,4 @@ webkit.org/b/322026 [ arm64 ] imported/w3c/web-platform-tests/wasm/core/f64_cmp.
 webkit.org/b/321789 animations/no-style-recalc-during-accelerated-animation.html [ Failure Pass ]
 webkit.org/b/322637 [ Debug ] imported/w3c/web-platform-tests/fullscreen/model/remove-last.html [ Pass Failure ]
 webkit.org/b/322639 [ Debug ] imported/w3c/web-platform-tests/html/semantics/popovers/popover-remove-attribute-during-focusing-steps.html [ Pass Failure ]
+webkit.org/b/322813 [ arm64 ] imported/w3c/web-platform-tests/css/css-grid/subgrid/subgrid-baseline-018.html [ Crash Pass Timeout ]
diff --git a/Source/JavaScriptCore/API/tests/Regress141275.mm b/Source/JavaScriptCore/API/tests/Regress141275.mm
index fd13edca35d9..ece269daa477 100644
--- a/Source/JavaScriptCore/API/tests/Regress141275.mm
+++ b/Source/JavaScriptCore/API/tests/Regress141275.mm
@@ -107,7 +107,7 @@ - (instancetype)init
 {
     self = [super init];
     if (self) {
-        _jsSourcePerformQueue = dispatch_queue_create("JSTEval", DISPATCH_QUEUE_CONCURRENT);
+        _jsSourcePerformQueue = dispatch_queue_create("JSTEval", concurrentQueueWithAutoreleasePoolAttrSingleton());
 
         _allScriptsDone = dispatch_semaphore_create(0);
 
diff --git a/Source/JavaScriptCore/CMakeLists.txt b/Source/JavaScriptCore/CMakeLists.txt
index fa79d0d4aade..b0f7305a55b4 100644
--- a/Source/JavaScriptCore/CMakeLists.txt
+++ b/Source/JavaScriptCore/CMakeLists.txt
@@ -2076,6 +2076,26 @@ if(USE_INSPECTOR_SOCKET_SERVER)
     )
 endif()
 
+# The corpse memory-analysis support is built on Mach task and corpse APIs, so
+# its headers have no content off Darwin and there is nothing to build or export.
+if (APPLE)
+    list(APPEND JavaScriptCore_PRIVATE_INCLUDE_DIRECTORIES
+        "${JAVASCRIPTCORE_DIR}/corpse"
+    )
+    list(APPEND JavaScriptCore_PRIVATE_FRAMEWORK_HEADERS
+        corpse/CorpseAddress.h
+        corpse/CorpseByteParser.h
+        corpse/CorpseClient.h
+        corpse/CorpseError.h
+        corpse/CorpseExportsTrie.h
+        corpse/CorpseProcess.h
+        corpse/CorpseRegion.h
+        corpse/CorpseSnapshot.h
+        corpse/CorpseSymbol.h
+        corpse/CorpseThread.h
+    )
+endif ()
+
 # GENERATOR 1-B: particular LUT creator (for 1 file only)
 GENERATE_HASH_LUT(${CMAKE_CURRENT_SOURCE_DIR}/parser/Keywords.table ${JavaScriptCore_DERIVED_SOURCES_DIR}/Lexer.lut.h)
 
@@ -2385,6 +2405,14 @@ add_custom_target(JavaScriptCoreSharedScripts DEPENDS ${JavaScriptCore_SCRIPTS})
 add_dependencies(JavaScriptCore JavaScriptCoreSharedScripts ${JavaScriptCore_EXTRA_DEPENDENCIES})
 add_dependencies(JavaScriptCoreSharedScripts JSCBuiltins)
 
+# The corpse code is part of JavaScriptCoreTools, which ships as a static library used
+# only by tools for assisting in the development of JavaScriptCore and WebKit. This code
+# is not needed for JavaScriptCore and WebKit functionality as a browser engine. The
+# corpse code rely on Mach APIs which are only available on Apple platforms.
+if (APPLE)
+  add_subdirectory(corpse)
+endif ()
+
 if (ENABLE_JAVASCRIPT_SHELL)
   add_subdirectory(shell)
 endif ()
diff --git a/Source/JavaScriptCore/Configurations/Mya.xcconfig b/Source/JavaScriptCore/Configurations/Mya.xcconfig
new file mode 100644
index 000000000000..32bdfefbe5a7
--- /dev/null
+++ b/Source/JavaScriptCore/Configurations/Mya.xcconfig
@@ -0,0 +1,43 @@
+// Copyright (C) 2026 Apple Inc. All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions
+// are met:
+// 1. Redistributions of source code must retain the above copyright
+//    notice, this list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright
+//    notice, this list of conditions and the following disclaimer in the
+//    documentation and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+// PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+// EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+// PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+// OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+#include "JSC.xcconfig"
+
+PRODUCT_NAME = mya;
+
+INSTALL_PATH = /usr/local/bin;
+
+// Not installed for simulator or Catalyst builds.
+WK_LIB_JSC_TOOLS_SIMULATOR = NO;
+WK_LIB_JSC_TOOLS_SIMULATOR[sdk=*simulator*] = YES;
+WK_LIB_JSC_TOOLS_SUPPORTED = $(WK_NOT_$(WK_LIB_JSC_TOOLS_UNSUPPORTED));
+WK_LIB_JSC_TOOLS_UNSUPPORTED = $(WK_OR_$(WK_LIB_JSC_TOOLS_SIMULATOR)_$(WK_CHECK_CATALYST));
+
+SKIP_INSTALL = $(WK_LIB_JSC_TOOLS_SKIP_INSTALL_$(WK_LIB_JSC_TOOLS_UNSUPPORTED));
+WK_LIB_JSC_TOOLS_SKIP_INSTALL_YES = YES;
+WK_LIB_JSC_TOOLS_SKIP_INSTALL_NO = NO;
+
+OTHER_LDFLAGS = $(inherited) $(WK_LIB_JSC_TOOLS_LDFLAGS_$(WK_LIB_JSC_TOOLS_SUPPORTED));
+WK_LIB_JSC_TOOLS_LDFLAGS_YES = -lJavaScriptCoreTools;
+
+OTHER_CODE_SIGN_FLAGS[sdk=iphone*] = -i com.apple.jsc.mya --entitlements ${WK_PROCESSED_XCENT_FILE};
diff --git a/Source/JavaScriptCore/Configurations/TestLibJSCTools.xcconfig b/Source/JavaScriptCore/Configurations/TestLibJSCTools.xcconfig
new file mode 100644
index 000000000000..6f33bf0408e5
--- /dev/null
+++ b/Source/JavaScriptCore/Configurations/TestLibJSCTools.xcconfig
@@ -0,0 +1,35 @@
+// Copyright (C) 2026 Apple Inc. All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions
+// are met:
+// 1. Redistributions of source code must retain the above copyright
+//    notice, this list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright
+//    notice, this list of conditions and the following disclaimer in the
+//    documentation and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+// PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+// EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+// PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+// OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+#include "TestExecutable.xcconfig"
+
+// We build and install testLibJSCTools for the simulator and MacCatalyst but it does nothing
+// on these platforms. We do this so that run-javascriptcore-tests do not error out for a missing
+// testLibJSCTools executable.
+WK_LIB_JSC_TOOLS_SIMULATOR = NO;
+WK_LIB_JSC_TOOLS_SIMULATOR[sdk=*simulator*] = YES;
+WK_LIB_JSC_TOOLS_SUPPORTED = $(WK_NOT_$(WK_LIB_JSC_TOOLS_UNSUPPORTED));
+WK_LIB_JSC_TOOLS_UNSUPPORTED = $(WK_OR_$(WK_LIB_JSC_TOOLS_SIMULATOR)_$(WK_CHECK_CATALYST));
+
+OTHER_LDFLAGS = $(inherited) $(WK_LIB_JSC_TOOLS_LDFLAGS_$(WK_LIB_JSC_TOOLS_SUPPORTED));
+WK_LIB_JSC_TOOLS_LDFLAGS_YES = -lJavaScriptCoreTools;
diff --git a/Source/JavaScriptCore/Configurations/libJavaScriptCoreTools.xcconfig b/Source/JavaScriptCore/Configurations/libJavaScriptCoreTools.xcconfig
new file mode 100644
index 000000000000..412a878ef1fe
--- /dev/null
+++ b/Source/JavaScriptCore/Configurations/libJavaScriptCoreTools.xcconfig
@@ -0,0 +1,57 @@
+// Copyright (C) 2026 Apple Inc. All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions
+// are met:
+// 1. Redistributions of source code must retain the above copyright
+//    notice, this list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright
+//    notice, this list of conditions and the following disclaimer in the
+//    documentation and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+// PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+// EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+// PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+// OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// JavaScriptCoreTools is a tools library that is for implementing tools to assist
+// in JavaScriptCore and WebKit development. It builds on JavaScriptCore, but does
+// not contain any functionality that is part of core JSC, and it is not needed for
+// implementing browser engines.
+//
+// JavaScriptCoreTools is packaged as a static library, and meant only to be linked
+// by tools that need it. Its headers are included as private headers of JavaScriptCore.
+// This allows JavaScriptCore and JavaScriptCoreTools to be revision locked, and
+// built in tandem to prevent bit rot from creeping in.
+#include "BaseTarget.xcconfig"
+
+PRODUCT_NAME = JavaScriptCoreTools;
+
+// Disable IR PGO profile generation for JavaScriptCoreTools.
+WK_PGO_GEN_FLAGS = ;
+
+// Not built for simulator or Catalyst builds.
+WK_LIB_JSC_TOOLS_SIMULATOR = NO;
+WK_LIB_JSC_TOOLS_SIMULATOR[sdk=*simulator*] = YES;
+WK_LIB_JSC_TOOLS_UNSUPPORTED = $(WK_OR_$(WK_LIB_JSC_TOOLS_SIMULATOR)_$(WK_CHECK_CATALYST));
+
+EXCLUDED_SOURCE_FILE_NAMES = $(WK_LIB_JSC_TOOLS_EXCLUDED_$(WK_LIB_JSC_TOOLS_UNSUPPORTED));
+WK_LIB_JSC_TOOLS_EXCLUDED_YES = *;
+
+// Installed to /usr/local/lib, alongside libWTF.a and libbmalloc.a.
+INSTALL_PATH = $(WK_LIBRARY_INSTALL_PATH);
+SKIP_INSTALL = $(WK_LIB_JSC_TOOLS_SKIP_INSTALL_$(WK_LIB_JSC_TOOLS_UNSUPPORTED));
+WK_LIB_JSC_TOOLS_SKIP_INSTALL_YES = YES;
+WK_LIB_JSC_TOOLS_SKIP_INSTALL_NO = NO;
+STRIP_INSTALLED_PRODUCT = NO;
+
+// The sources include "config.h" and their own headers from the source tree,
+// plus JavaScriptCore's generated and private headers.
+HEADER_SEARCH_PATHS = $(SRCROOT) $(SRCROOT)/corpse "$(JAVASCRIPTCORE_FRAMEWORKS_DIR)/JavaScriptCore.framework/PrivateHeaders" $(inherited);
diff --git a/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj b/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
index 62dc0c1cb3bd..eb7e1593d232 100644
--- a/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
+++ b/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
@@ -76,6 +76,8 @@
 			dependencies = (
 				932F5BE70822A1C700736975 /* PBXTargetDependency */,
 				5D69E912152BE5470028D720 /* PBXTargetDependency */,
+				D3934A4385F631C04057F7E7 /* PBXTargetDependency */,
+				5F40739EF054554602787C41 /* PBXTargetDependency */,
 				5D6B2A57152B9E2E005231DE /* PBXTargetDependency */,
 			);
 			name = All;
@@ -1527,6 +1529,9 @@
 		92B4EF902D71C3650068CB55 /* LLVMProfiling.h in Headers */ = {isa = PBXBuildFile; fileRef = 92B4EF8F2D71C3650068CB55 /* LLVMProfiling.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		93052C350FB792190048FDC3 /* ParserArena.h in Headers */ = {isa = PBXBuildFile; fileRef = 93052C330FB792190048FDC3 /* ParserArena.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		932F5BDD0822A1C700736975 /* jsc.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 45E12D8806A49B0F00E9DF84 /* jsc.cpp */; };
+		6DCC8B386903B87B8A4E5A26 /* mya.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 806620AA0612E27A5093C379 /* mya.cpp */; };
+		ACB50B356C9AA8E90AA3DF50 /* JavaScriptCore.framework in Product Dependencies */ = {isa = PBXBuildFile; fileRef = 932F5BD90822A1C700736975 /* JavaScriptCore.framework */; };
+		D9BBE216687E30084BD44207 /* libedit.dylib in Frameworks */ = {isa = PBXBuildFile; fileRef = 5D5D8AD00E0D0EBE00F9C692 /* libedit.dylib */; };
 		933040040E6A749400786E6A /* SmallStrings.h in Headers */ = {isa = PBXBuildFile; fileRef = 93303FEA0E6A72C000786E6A /* SmallStrings.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		93BFC6D929B344C90030D7BE /* GlobalObjectMethodTable.h in Headers */ = {isa = PBXBuildFile; fileRef = 93BFC6D829B344C80030D7BE /* GlobalObjectMethodTable.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		95CA6AD328809E010062D5EC /* ImplementationVisibility.h in Headers */ = {isa = PBXBuildFile; fileRef = 95CA6AD228809E010062D5EC /* ImplementationVisibility.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -1828,6 +1833,34 @@
 		BC11667B0E199C05008066DD /* InternalFunction.h in Headers */ = {isa = PBXBuildFile; fileRef = BC11667A0E199C05008066DD /* InternalFunction.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC1167DA0E19BCC9008066DD /* JSCell.h in Headers */ = {isa = PBXBuildFile; fileRef = BC1167D80E19BCC9008066DD /* JSCell.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C3E50E16F5CD00B34460 /* APICast.h in Headers */ = {isa = PBXBuildFile; fileRef = 1482B78A0A4305AB00517CFC /* APICast.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0D9C2E68ACFF010D91916993 /* CorpseProcess.h in Headers */ = {isa = PBXBuildFile; fileRef = 55D0F2DD9CA70132D5104B34 /* CorpseProcess.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		3A7C1E5D9B0F4A2681C34D07 /* CorpseRegion.h in Headers */ = {isa = PBXBuildFile; fileRef = 9F41D6082A3E4B57C0768DB1 /* CorpseRegion.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		725D045D67B3017EAC56561C /* CorpseAddress.h in Headers */ = {isa = PBXBuildFile; fileRef = 2C6EB9C72F84ED87DF23277A /* CorpseAddress.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		80B96670131FB9EBB9AD49CC /* CorpseClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 9CBE14E70FB474FCFCD6A8B9 /* CorpseClient.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		C2EB941F3198AE0BD86A2324 /* CorpseClient.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 422D2FE4AA2401EA8C3F2D8F /* CorpseClient.cpp */; };
+		85428E7BE0B3557DD2988043 /* CorpseError.h in Headers */ = {isa = PBXBuildFile; fileRef = 8DDA7A78AD90B64B97AE329C /* CorpseError.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		121D90BB8171A66F1922D548 /* CorpseError.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 2AC15166B6F71CD338DD8D6F /* CorpseError.cpp */; };
+		7E83C43817D785F3003DC41B /* CorpseExportsTrie.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7E83C43617D785F3003DC41B /* CorpseExportsTrie.cpp */; };
+		7E83C42417D785F3003DC41B /* CorpseByteParser.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7E83C42317D785F3003DC41B /* CorpseByteParser.cpp */; };
+		7E83C42817D785F3003DC41B /* CorpseByteParser.h in Headers */ = {isa = PBXBuildFile; fileRef = 7E83C42217D785F3003DC41B /* CorpseByteParser.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		7E83C42717D785F3003DC41B /* CorpseByteParserTest.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7E83C42617D785F3003DC41B /* CorpseByteParserTest.cpp */; };
+		7E83C42B17D785F3003DC41B /* CorpseAddressTest.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7E83C42917D785F3003DC41B /* CorpseAddressTest.cpp */; };
+		7E83C42E17D785F3003DC41B /* CorpseProcessTest.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7E83C42C17D785F3003DC41B /* CorpseProcessTest.cpp */; };
+		7E83C43117D785F3003DC41B /* CorpseRegionTest.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7E83C42F17D785F3003DC41B /* CorpseRegionTest.cpp */; };
+		7E83C43417D785F3003DC41B /* CorpseThreadTest.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7E83C43217D785F3003DC41B /* CorpseThreadTest.cpp */; };
+		7E83C40B17D785F3003DC41B /* CorpseExportsTrieTest.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7E83C40217D785F3003DC41B /* CorpseExportsTrieTest.cpp */; };
+		7E83C41017D785F3003DC41B /* Foundation.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = FF0F569B2E334C90002A232A /* Foundation.framework */; };
+		7E83C40F17D785F3003DC41B /* JavaScriptCore.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 932F5BD90822A1C700736975 /* JavaScriptCore.framework */; };
+		7E83C40C17D785F3003DC41B /* LibJSCToolsTestUtilities.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7E83C40417D785F3003DC41B /* LibJSCToolsTestUtilities.cpp */; };
+		7E83C40D17D785F3003DC41B /* CorpseSnapshotTest.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7E83C40617D785F3003DC41B /* CorpseSnapshotTest.cpp */; };
+		7E83C40E17D785F3003DC41B /* CorpseSymbolTest.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7E83C40817D785F3003DC41B /* CorpseSymbolTest.cpp */; };
+		7E83C40A17D785F3003DC41B /* testLibJSCTools.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7E83C40017D785F3003DC41B /* testLibJSCTools.cpp */; };
+		7E83C43717D785F3003DC41B /* CorpseExportsTrie.h in Headers */ = {isa = PBXBuildFile; fileRef = 7E83C43517D785F3003DC41B /* CorpseExportsTrie.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		56C6C2B7EBDCC63B6ECEA9AD /* CorpseThread.h in Headers */ = {isa = PBXBuildFile; fileRef = 211E3D6CA97F31CEB385A75A /* CorpseThread.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		EF648B9EEAF54C44048B416A /* CorpseThread.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 960BD2B783EAEBE3233F91BF /* CorpseThread.cpp */; };
+		CA47D093D003440A28D15924 /* CorpseSnapshot.h in Headers */ = {isa = PBXBuildFile; fileRef = 94711688984F16F71D615DE5 /* CorpseSnapshot.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		5601486802533982ACC870BE /* CorpseSymbol.h in Headers */ = {isa = PBXBuildFile; fileRef = 8F1FA0900D09DF06EE63F7D2 /* CorpseSymbol.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		377C8C2416AE3DF90650C0E9 /* CorpseSymbol.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E8D1735B28066A3B1D756ECC /* CorpseSymbol.cpp */; };
 		BC18C3E60E16F5CD00B34460 /* ArrayConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = BC7952070E15E8A800A898AB /* ArrayConstructor.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C3E70E16F5CD00B34460 /* ArrayPrototype.h in Headers */ = {isa = PBXBuildFile; fileRef = F692A84E0255597D01FF60F7 /* ArrayPrototype.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C3EC0E16F5CD00B34460 /* BooleanObject.h in Headers */ = {isa = PBXBuildFile; fileRef = 704FD35305697E6D003DBED9 /* BooleanObject.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -2131,6 +2164,9 @@
 		E392E6F924D25FA900B20767 /* B3BottomTupleValue.h in Headers */ = {isa = PBXBuildFile; fileRef = E392E6F724D25FA600B20767 /* B3BottomTupleValue.h */; };
 		E393ADD81FE702D00022D681 /* WeakMapImplInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = E393ADD71FE702CC0022D681 /* WeakMapImplInlines.h */; };
 		E39440542F276A4A0055F0DB /* Binja.c in Sources */ = {isa = PBXBuildFile; fileRef = E3380F572F271A400097D76C /* Binja.c */; };
+		C366EA5039A3B51405995EA6 /* CorpseProcess.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 68BBF9CBD85C8635B2B8385F /* CorpseProcess.cpp */; };
+		5E2B94A17C6D40F3B85219CE /* CorpseRegion.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C8503B7E641A29DF5B0E3742 /* CorpseRegion.cpp */; };
+		0946712DEC51E0E86C4A49E3 /* CorpseSnapshot.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5E906BE4CC29012A83A8F299 /* CorpseSnapshot.cpp */; };
 		E3952C182F1DDF5700F5BEE8 /* B3WasmStructGetValue.h in Headers */ = {isa = PBXBuildFile; fileRef = E3952C122F1DDF5700F5BEE8 /* B3WasmStructGetValue.h */; };
 		E3952C192F1DDF5700F5BEE8 /* B3WasmStructNewValue.h in Headers */ = {isa = PBXBuildFile; fileRef = E3952C142F1DDF5700F5BEE8 /* B3WasmStructNewValue.h */; };
 		E3952C1A2F1DDF5700F5BEE8 /* B3WasmStructFieldValue.h in Headers */ = {isa = PBXBuildFile; fileRef = E3952C102F1DDF5700F5BEE8 /* B3WasmStructFieldValue.h */; };
@@ -2527,6 +2563,48 @@
 /* End PBXBuildRule section */
 
 /* Begin PBXContainerItemProxy section */
+		6044D4B120B01FBCA9BCFBE5 /* PBXContainerItemProxy */ = {
+			isa = PBXContainerItemProxy;
+			containerPortal = 0867D690FE84028FC02AAC07 /* Project object */;
+			proxyType = 1;
+			remoteGlobalIDString = 49D9C56EC7911960C24239F3;
+			remoteInfo = JavaScriptCoreTools;
+		};
+		A1B2C3000AE5B4A700C0FFEE /* PBXContainerItemProxy */ = {
+			isa = PBXContainerItemProxy;
+			containerPortal = 0867D690FE84028FC02AAC07 /* Project object */;
+			proxyType = 1;
+			remoteGlobalIDString = 65FB3F6609D11E9100F49DEB;
+			remoteInfo = "Derived Sources";
+		};
+		A1B2C30004E5B4A700C0FFEE /* PBXContainerItemProxy */ = {
+			isa = PBXContainerItemProxy;
+			containerPortal = 0867D690FE84028FC02AAC07 /* Project object */;
+			proxyType = 1;
+			remoteGlobalIDString = 49D9C56EC7911960C24239F3;
+			remoteInfo = JavaScriptCoreTools;
+		};
+		A1B2C30006E5B4A700C0FFEE /* PBXContainerItemProxy */ = {
+			isa = PBXContainerItemProxy;
+			containerPortal = 0867D690FE84028FC02AAC07 /* Project object */;
+			proxyType = 1;
+			remoteGlobalIDString = 6B03652E1F50D87F0DEC6B42;
+			remoteInfo = mya;
+		};
+		A1B2C30008E5B4A700C0FFEE /* PBXContainerItemProxy */ = {
+			isa = PBXContainerItemProxy;
+			containerPortal = 0867D690FE84028FC02AAC07 /* Project object */;
+			proxyType = 1;
+			remoteGlobalIDString = 7E83C41317D785F3003DC41B;
+			remoteInfo = testLibJSCTools;
+		};
+		291A8D565940996D3CA021C1 /* PBXContainerItemProxy */ = {
+			isa = PBXContainerItemProxy;
+			containerPortal = 0867D690FE84028FC02AAC07 /* Project object */;
+			proxyType = 1;
+			remoteGlobalIDString = 49D9C56EC7911960C24239F3;
+			remoteInfo = JavaScriptCoreTools;
+		};
 		074D7E092E3D3B6800CD38C6 /* PBXContainerItemProxy */ = {
 			isa = PBXContainerItemProxy;
 			containerPortal = 0867D690FE84028FC02AAC07 /* Project object */;
@@ -2646,6 +2724,20 @@
 			remoteGlobalIDString = 65FB3F6609D11E9100F49DEB;
 			remoteInfo = "Derived Sources";
 		};
+		B70B8C003BC4F51DF41C2D65 /* PBXContainerItemProxy */ = {
+			isa = PBXContainerItemProxy;
+			containerPortal = 0867D690FE84028FC02AAC07 /* Project object */;
+			proxyType = 1;
+			remoteGlobalIDString = 65FB3F6609D11E9100F49DEB;
+			remoteInfo = "Derived Sources";
+		};
+		A269FDF04AF38423A3A5DE9A /* PBXContainerItemProxy */ = {
+			isa = PBXContainerItemProxy;
+			containerPortal = 0867D690FE84028FC02AAC07 /* Project object */;
+			proxyType = 1;
+			remoteGlobalIDString = 6B03652E1F50D87F0DEC6B42;
+			remoteInfo = mya;
+		};
 		44F93E102AE7200100FFA37C /* PBXContainerItemProxy */ = {
 			isa = PBXContainerItemProxy;
 			containerPortal = 0867D690FE84028FC02AAC07 /* Project object */;
@@ -2758,6 +2850,27 @@
 			remoteGlobalIDString = FE533CA11F217DB30016A1FE;
 			remoteInfo = testmasm;
 		};
+		7E83C41C17D785F3003DC41B /* PBXContainerItemProxy */ = {
+			isa = PBXContainerItemProxy;
+			containerPortal = 0867D690FE84028FC02AAC07 /* Project object */;
+			proxyType = 1;
+			remoteGlobalIDString = 65FB3F6609D11E9100F49DEB;
+			remoteInfo = "Derived Sources";
+		};
+		7E83C41E17D785F3003DC41B /* PBXContainerItemProxy */ = {
+			isa = PBXContainerItemProxy;
+			containerPortal = 0867D690FE84028FC02AAC07 /* Project object */;
+			proxyType = 1;
+			remoteGlobalIDString = E1AC2E2720F7B94C00B0897D;
+			remoteInfo = "Unlock Keychain";
+		};
+		7E83C42017D785F3003DC41B /* PBXContainerItemProxy */ = {
+			isa = PBXContainerItemProxy;
+			containerPortal = 0867D690FE84028FC02AAC07 /* Project object */;
+			proxyType = 1;
+			remoteGlobalIDString = 7E83C41317D785F3003DC41B;
+			remoteInfo = testLibJSCTools;
+		};
 		FF0F56882E33437C002A232A /* PBXContainerItemProxy */ = {
 			isa = PBXContainerItemProxy;
 			containerPortal = 0867D690FE84028FC02AAC07 /* Project object */;
@@ -2815,6 +2928,17 @@
 			name = "Product Dependencies";
 			runOnlyForDeploymentPostprocessing = 0;
 		};
+		184CD487A9C6C6DCE0BA2ADA /* Product Dependencies */ = {
+			isa = PBXCopyFilesBuildPhase;
+			buildActionMask = 2147483647;
+			dstPath = "";
+			dstSubfolderSpec = 16;
+			files = (
+				ACB50B356C9AA8E90AA3DF50 /* JavaScriptCore.framework in Product Dependencies */,
+			);
+			name = "Product Dependencies";
+			runOnlyForDeploymentPostprocessing = 0;
+		};
 		5DBB1524131D0BA10056AD36 /* Copy Support Script */ = {
 			isa = PBXCopyFilesBuildPhase;
 			buildActionMask = 2147483647;
@@ -3951,6 +4075,23 @@
 		1482B74B0A43032800517CFC /* JSStringRef.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSStringRef.h; sourceTree = "<group>"; };
 		1482B74C0A43032800517CFC /* JSStringRef.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSStringRef.cpp; sourceTree = "<group>"; };
 		1482B78A0A4305AB00517CFC /* APICast.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = APICast.h; sourceTree = "<group>"; };
+		55D0F2DD9CA70132D5104B34 /* CorpseProcess.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CorpseProcess.h; sourceTree = "<group>"; };
+		9F41D6082A3E4B57C0768DB1 /* CorpseRegion.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CorpseRegion.h; sourceTree = "<group>"; };
+		94711688984F16F71D615DE5 /* CorpseSnapshot.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CorpseSnapshot.h; sourceTree = "<group>"; };
+		8F1FA0900D09DF06EE63F7D2 /* CorpseSymbol.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CorpseSymbol.h; sourceTree = "<group>"; };
+		E8D1735B28066A3B1D756ECC /* CorpseSymbol.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CorpseSymbol.cpp; sourceTree = "<group>"; };
+		68BBF9CBD85C8635B2B8385F /* CorpseProcess.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CorpseProcess.cpp; sourceTree = "<group>"; };
+		C8503B7E641A29DF5B0E3742 /* CorpseRegion.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CorpseRegion.cpp; sourceTree = "<group>"; };
+		5E906BE4CC29012A83A8F299 /* CorpseSnapshot.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CorpseSnapshot.cpp; sourceTree = "<group>"; };
+		2C6EB9C72F84ED87DF23277A /* CorpseAddress.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CorpseAddress.h; sourceTree = "<group>"; };
+		9CBE14E70FB474FCFCD6A8B9 /* CorpseClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CorpseClient.h; sourceTree = "<group>"; };
+		422D2FE4AA2401EA8C3F2D8F /* CorpseClient.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CorpseClient.cpp; sourceTree = "<group>"; };
+		8DDA7A78AD90B64B97AE329C /* CorpseError.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CorpseError.h; sourceTree = "<group>"; };
+		2AC15166B6F71CD338DD8D6F /* CorpseError.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CorpseError.cpp; sourceTree = "<group>"; };
+		7E83C43617D785F3003DC41B /* CorpseExportsTrie.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CorpseExportsTrie.cpp; sourceTree = "<group>"; };
+		7E83C43517D785F3003DC41B /* CorpseExportsTrie.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CorpseExportsTrie.h; sourceTree = "<group>"; };
+		211E3D6CA97F31CEB385A75A /* CorpseThread.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CorpseThread.h; sourceTree = "<group>"; };
+		960BD2B783EAEBE3233F91BF /* CorpseThread.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CorpseThread.cpp; sourceTree = "<group>"; };
 		1482B7E10A43076000517CFC /* JSObjectRef.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSObjectRef.h; sourceTree = "<group>"; };
 		1482B7E20A43076000517CFC /* JSObjectRef.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSObjectRef.cpp; sourceTree = "<group>"; };
 		148521D526EAEBDF00CC1D1A /* WasmHandlerInfo.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = WasmHandlerInfo.cpp; sourceTree = "<group>"; };
@@ -4347,9 +4488,35 @@
 		4487DB822AF825C800AFECAE /* Fuzzilli.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Fuzzilli.h; sourceTree = "<group>"; };
 		44F93DFD2AE71EBD00FFA37C /* libJavaScriptCore.xcconfig */ = {isa = PBXFileReference; lastKnownFileType = text.xcconfig; path = libJavaScriptCore.xcconfig; sourceTree = "<group>"; };
 		44F93E022AE71F5400FFA37C /* libJavaScriptCore.a */ = {isa = PBXFileReference; explicitFileType = archive.ar; includeInIndex = 0; path = libJavaScriptCore.a; sourceTree = BUILT_PRODUCTS_DIR; };
+		33CCFE0660BE540320EF4777 /* libJavaScriptCoreTools.xcconfig */ = {isa = PBXFileReference; lastKnownFileType = text.xcconfig; path = libJavaScriptCoreTools.xcconfig; sourceTree = "<group>"; };
+		A1B2C30001E5B4A700C0FFEE /* TestLibJSCTools.xcconfig */ = {isa = PBXFileReference; lastKnownFileType = text.xcconfig; path = TestLibJSCTools.xcconfig; sourceTree = "<group>"; };
+		76A3C1425B4D63FC23BD2344 /* libJavaScriptCoreTools.a */ = {isa = PBXFileReference; explicitFileType = archive.ar; includeInIndex = 0; path = libJavaScriptCoreTools.a; sourceTree = BUILT_PRODUCTS_DIR; };
+		7E83C42317D785F3003DC41B /* CorpseByteParser.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CorpseByteParser.cpp; sourceTree = "<group>"; };
+		7E83C42217D785F3003DC41B /* CorpseByteParser.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CorpseByteParser.h; sourceTree = "<group>"; };
+		7E83C42617D785F3003DC41B /* CorpseByteParserTest.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CorpseByteParserTest.cpp; sourceTree = "<group>"; };
+		7E83C42917D785F3003DC41B /* CorpseAddressTest.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CorpseAddressTest.cpp; sourceTree = "<group>"; };
+		7E83C42A17D785F3003DC41B /* CorpseAddressTest.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CorpseAddressTest.h; sourceTree = "<group>"; };
+		7E83C42C17D785F3003DC41B /* CorpseProcessTest.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CorpseProcessTest.cpp; sourceTree = "<group>"; };
+		7E83C42D17D785F3003DC41B /* CorpseProcessTest.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CorpseProcessTest.h; sourceTree = "<group>"; };
+		7E83C42F17D785F3003DC41B /* CorpseRegionTest.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CorpseRegionTest.cpp; sourceTree = "<group>"; };
+		7E83C43017D785F3003DC41B /* CorpseRegionTest.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CorpseRegionTest.h; sourceTree = "<group>"; };
+		7E83C43217D785F3003DC41B /* CorpseThreadTest.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CorpseThreadTest.cpp; sourceTree = "<group>"; };
+		7E83C43317D785F3003DC41B /* CorpseThreadTest.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CorpseThreadTest.h; sourceTree = "<group>"; };
+		7E83C42517D785F3003DC41B /* CorpseByteParserTest.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CorpseByteParserTest.h; sourceTree = "<group>"; };
+		7E83C40217D785F3003DC41B /* CorpseExportsTrieTest.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CorpseExportsTrieTest.cpp; sourceTree = "<group>"; };
+		7E83C40117D785F3003DC41B /* CorpseExportsTrieTest.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CorpseExportsTrieTest.h; sourceTree = "<group>"; };
+		7E83C40417D785F3003DC41B /* LibJSCToolsTestUtilities.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = LibJSCToolsTestUtilities.cpp; sourceTree = "<group>"; };
+		7E83C40317D785F3003DC41B /* LibJSCToolsTestUtilities.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LibJSCToolsTestUtilities.h; sourceTree = "<group>"; };
+		7E83C40617D785F3003DC41B /* CorpseSnapshotTest.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CorpseSnapshotTest.cpp; sourceTree = "<group>"; };
+		7E83C40517D785F3003DC41B /* CorpseSnapshotTest.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CorpseSnapshotTest.h; sourceTree = "<group>"; };
+		7E83C40817D785F3003DC41B /* CorpseSymbolTest.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CorpseSymbolTest.cpp; sourceTree = "<group>"; };
+		7E83C40717D785F3003DC41B /* CorpseSymbolTest.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CorpseSymbolTest.h; sourceTree = "<group>"; };
+		7E83C40017D785F3003DC41B /* testLibJSCTools.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = testLibJSCTools.cpp; sourceTree = "<group>"; };
+		7E83C40917D785F3003DC41B /* testLibJSCTools */ = {isa = PBXFileReference; explicitFileType = "compiled.mach-o.executable"; includeInIndex = 0; path = testLibJSCTools; sourceTree = BUILT_PRODUCTS_DIR; };
 		44F93E0D2AE71F9F00FFA37C /* JavaScriptCoreFramework.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = JavaScriptCoreFramework.cpp; sourceTree = "<group>"; };
 		451539B812DC994500EF7AC4 /* Yarr.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = Yarr.h; path = yarr/Yarr.h; sourceTree = "<group>"; };
 		45E12D8806A49B0F00E9DF84 /* jsc.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = jsc.cpp; sourceTree = "<group>"; tabWidth = 4; };
+		806620AA0612E27A5093C379 /* mya.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; name = mya.cpp; path = mya/mya.cpp; sourceTree = "<group>"; tabWidth = 4; };
 		4615E4662B5833FB001D4D53 /* WasmBBQJIT64.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WasmBBQJIT64.h; sourceTree = "<group>"; };
 		4615E4682B5833FB001D4D53 /* WasmBBQJIT64.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WasmBBQJIT64.cpp; sourceTree = "<group>"; };
 		4B78E098294427D2003C6682 /* B3SIMDValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3SIMDValue.cpp; path = b3/B3SIMDValue.cpp; sourceTree = "<group>"; };
@@ -4752,6 +4919,7 @@
 		5C7E1A152DA1B0E100A4C005 /* JSTypedArrayViewPrototypeInternal.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSTypedArrayViewPrototypeInternal.h; sourceTree = "<group>"; };
 		5D5D8AD00E0D0EBE00F9C692 /* libedit.dylib */ = {isa = PBXFileReference; lastKnownFileType = "compiled.mach-o.dylib"; name = libedit.dylib; path = /usr/lib/libedit.dylib; sourceTree = "<absolute>"; };
 		5DAFD6CB146B686300FBEFB4 /* JSC.xcconfig */ = {isa = PBXFileReference; lastKnownFileType = text.xcconfig; path = JSC.xcconfig; sourceTree = "<group>"; };
+		3E812A1EEBE0D5AEA7D3C74B /* Mya.xcconfig */ = {isa = PBXFileReference; lastKnownFileType = text.xcconfig; path = Mya.xcconfig; sourceTree = "<group>"; };
 		5DE3D0F40DD8DDFB00468714 /* WebKitAvailability.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebKitAvailability.h; sourceTree = "<group>"; };
 		623A37EB1B87A7BD00754209 /* RegisterMap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RegisterMap.h; sourceTree = "<group>"; };
 		627673211B680C1E00FD9F2E /* CallMode.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CallMode.cpp; sourceTree = "<group>"; };
@@ -5183,6 +5351,7 @@
 		932F5BD80822A1C700736975 /* Info.plist */ = {isa = PBXFileReference; indentWidth = 4; lastKnownFileType = text.plist.xml; path = Info.plist; sourceTree = "<group>"; tabWidth = 8; usesTabs = 1; };
 		932F5BD90822A1C700736975 /* JavaScriptCore.framework */ = {isa = PBXFileReference; explicitFileType = wrapper.framework; includeInIndex = 0; path = JavaScriptCore.framework; sourceTree = BUILT_PRODUCTS_DIR; };
 		932F5BE10822A1C700736975 /* jsc */ = {isa = PBXFileReference; explicitFileType = "compiled.mach-o.executable"; includeInIndex = 0; path = jsc; sourceTree = BUILT_PRODUCTS_DIR; };
+		B2D6E3DABD6662589CD25896 /* mya */ = {isa = PBXFileReference; explicitFileType = "compiled.mach-o.executable"; includeInIndex = 0; path = mya; sourceTree = BUILT_PRODUCTS_DIR; };
 		93303FE80E6A72B500786E6A /* SmallStrings.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SmallStrings.cpp; sourceTree = "<group>"; };
 		93303FEA0E6A72C000786E6A /* SmallStrings.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SmallStrings.h; sourceTree = "<group>"; };
 		933A349A038AE7C6008635CE /* Identifier.h */ = {isa = PBXFileReference; fileEncoding = 4; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = Identifier.h; sourceTree = "<group>"; tabWidth = 8; };
@@ -6726,6 +6895,14 @@
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
+		97663BCF9AB10EBDF8B13940 /* Frameworks */ = {
+			isa = PBXFrameworksBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				D9BBE216687E30084BD44207 /* libedit.dylib in Frameworks */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
 		FE533CA41F217DB30016A1FE /* Frameworks */ = {
 			isa = PBXFrameworksBuildPhase;
 			buildActionMask = 2147483647;
@@ -6735,6 +6912,15 @@
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
+		7E83C41A17D785F3003DC41B /* Frameworks */ = {
+			isa = PBXFrameworksBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				7E83C41017D785F3003DC41B /* Foundation.framework in Frameworks */,
+				7E83C40F17D785F3003DC41B /* JavaScriptCore.framework in Frameworks */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
 		FF0F568C2E33437C002A232A /* Frameworks */ = {
 			isa = PBXFrameworksBuildPhase;
 			buildActionMask = 2147483647;
@@ -6747,11 +6933,65 @@
 /* End PBXFrameworksBuildPhase section */
 
 /* Begin PBXGroup section */
+		7E83C41217D785F3003DC41B /* tests */ = {
+			isa = PBXGroup;
+			children = (
+				7E83C42917D785F3003DC41B /* CorpseAddressTest.cpp */,
+				7E83C42A17D785F3003DC41B /* CorpseAddressTest.h */,
+				7E83C42617D785F3003DC41B /* CorpseByteParserTest.cpp */,
+				7E83C42517D785F3003DC41B /* CorpseByteParserTest.h */,
+				7E83C40217D785F3003DC41B /* CorpseExportsTrieTest.cpp */,
+				7E83C40117D785F3003DC41B /* CorpseExportsTrieTest.h */,
+				7E83C42C17D785F3003DC41B /* CorpseProcessTest.cpp */,
+				7E83C42D17D785F3003DC41B /* CorpseProcessTest.h */,
+				7E83C42F17D785F3003DC41B /* CorpseRegionTest.cpp */,
+				7E83C43017D785F3003DC41B /* CorpseRegionTest.h */,
+				7E83C40617D785F3003DC41B /* CorpseSnapshotTest.cpp */,
+				7E83C40517D785F3003DC41B /* CorpseSnapshotTest.h */,
+				7E83C40817D785F3003DC41B /* CorpseSymbolTest.cpp */,
+				7E83C40717D785F3003DC41B /* CorpseSymbolTest.h */,
+				7E83C43217D785F3003DC41B /* CorpseThreadTest.cpp */,
+				7E83C43317D785F3003DC41B /* CorpseThreadTest.h */,
+				7E83C40417D785F3003DC41B /* LibJSCToolsTestUtilities.cpp */,
+				7E83C40317D785F3003DC41B /* LibJSCToolsTestUtilities.h */,
+				7E83C40017D785F3003DC41B /* testLibJSCTools.cpp */,
+			);
+			path = tests;
+			sourceTree = "<group>";
+		};
+		65036098A29083DFB9FCF27C /* corpse */ = {
+			isa = PBXGroup;
+			children = (
+				7E83C41217D785F3003DC41B /* tests */,
+				2C6EB9C72F84ED87DF23277A /* CorpseAddress.h */,
+				7E83C42317D785F3003DC41B /* CorpseByteParser.cpp */,
+				7E83C42217D785F3003DC41B /* CorpseByteParser.h */,
+				422D2FE4AA2401EA8C3F2D8F /* CorpseClient.cpp */,
+				9CBE14E70FB474FCFCD6A8B9 /* CorpseClient.h */,
+				2AC15166B6F71CD338DD8D6F /* CorpseError.cpp */,
+				8DDA7A78AD90B64B97AE329C /* CorpseError.h */,
+				7E83C43617D785F3003DC41B /* CorpseExportsTrie.cpp */,
+				7E83C43517D785F3003DC41B /* CorpseExportsTrie.h */,
+				68BBF9CBD85C8635B2B8385F /* CorpseProcess.cpp */,
+				55D0F2DD9CA70132D5104B34 /* CorpseProcess.h */,
+				C8503B7E641A29DF5B0E3742 /* CorpseRegion.cpp */,
+				9F41D6082A3E4B57C0768DB1 /* CorpseRegion.h */,
+				5E906BE4CC29012A83A8F299 /* CorpseSnapshot.cpp */,
+				94711688984F16F71D615DE5 /* CorpseSnapshot.h */,
+				E8D1735B28066A3B1D756ECC /* CorpseSymbol.cpp */,
+				8F1FA0900D09DF06EE63F7D2 /* CorpseSymbol.h */,
+				960BD2B783EAEBE3233F91BF /* CorpseThread.cpp */,
+				211E3D6CA97F31CEB385A75A /* CorpseThread.h */,
+			);
+			path = corpse;
+			sourceTree = "<group>";
+		};
 		034768DFFF38A50411DB9C8B /* Products */ = {
 			isa = PBXGroup;
 			children = (
 				0F9327591C20BCBA00CF6564 /* dynbench */,
 				932F5BE10822A1C700736975 /* jsc */,
+				B2D6E3DABD6662589CD25896 /* mya */,
 				0FF922CF14F46B130041A24E /* JSCLLIntOffsetsExtractor */,
 				14BD688E215191310050DAFF /* JSCLLIntSettingsExtractor */,
 				141211200A48793C00480255 /* minidom */,
@@ -6761,9 +7001,11 @@
 				52CD0F642242F569004A18A5 /* testdfg */,
 				FE533CAC1F217DB40016A1FE /* testmasm */,
 				79281BDC20B62B3E002E2A60 /* testmem */,
+				7E83C40917D785F3003DC41B /* testLibJSCTools */,
 				6511230514046A4C002B101D /* testRegExp */,
 				932F5BD90822A1C700736975 /* JavaScriptCore.framework */,
 				44F93E022AE71F5400FFA37C /* libJavaScriptCore.a */,
+				76A3C1425B4D63FC23BD2344 /* libJavaScriptCoreTools.a */,
 				FF0F56942E33437C002A232A /* testwasmdebugger */,
 			);
 			name = Products;
@@ -6795,6 +7037,7 @@
 				44F93E0D2AE71F9F00FFA37C /* JavaScriptCoreFramework.cpp */,
 				F5C290E60284F98E018635CA /* JavaScriptCorePrefix.h */,
 				45E12D8806A49B0F00E9DF84 /* jsc.cpp */,
+				806620AA0612E27A5093C379 /* mya.cpp */,
 				A7C225CC139981F100FF1662 /* KeywordLookupGenerator.py */,
 				79D7B0E121152FD200FE7C64 /* entitlements.plist */,
 				53ADF4742F0D7A2000A05CDD /* lol */,
@@ -6804,6 +7047,7 @@
 				A7D8019F1880D66E0026C39B /* builtins */,
 				969A078F0ED1D3AE00F1F681 /* bytecode */,
 				7E39D81D0EC38EFA003AF11A /* bytecompiler */,
+				65036098A29083DFB9FCF27C /* corpse */,
 				1C90513E0BA9E8830081E9D0 /* Configurations */,
 				1480DB9A0DDC2231003CFDF2 /* debugger */,
 				650FDF8D09D0FCA700769E54 /* Derived Sources */,
@@ -7952,8 +8196,11 @@
 				1C9051430BA9E8A70081E9D0 /* JavaScriptCore.xcconfig */,
 				5DAFD6CB146B686300FBEFB4 /* JSC.xcconfig */,
 				44F93DFD2AE71EBD00FFA37C /* libJavaScriptCore.xcconfig */,
+				33CCFE0660BE540320EF4777 /* libJavaScriptCoreTools.xcconfig */,
 				DD8A31502F17A00000000001 /* LLIntExtractor.xcconfig */,
+				3E812A1EEBE0D5AEA7D3C74B /* Mya.xcconfig */,
 				FEE0A12229FE250400CED5E4 /* TestExecutable.xcconfig */,
+				A1B2C30001E5B4A700C0FFEE /* TestLibJSCTools.xcconfig */,
 				BC021BF2136900C300FC5467 /* ToolExecutable.xcconfig */,
 			);
 			path = Configurations;
@@ -11438,6 +11685,16 @@
 				E3FCCB642310A90D00238E72 /* ConstructorKind.h in Headers */,
 				A57D23F21891B5B40031C7FA /* ContentSearchUtilities.h in Headers */,
 				52678F911A04177C006A306D /* ControlFlowProfiler.h in Headers */,
+				725D045D67B3017EAC56561C /* CorpseAddress.h in Headers */,
+				7E83C42817D785F3003DC41B /* CorpseByteParser.h in Headers */,
+				80B96670131FB9EBB9AD49CC /* CorpseClient.h in Headers */,
+				85428E7BE0B3557DD2988043 /* CorpseError.h in Headers */,
+				7E83C43717D785F3003DC41B /* CorpseExportsTrie.h in Headers */,
+				0D9C2E68ACFF010D91916993 /* CorpseProcess.h in Headers */,
+				3A7C1E5D9B0F4A2681C34D07 /* CorpseRegion.h in Headers */,
+				CA47D093D003440A28D15924 /* CorpseSnapshot.h in Headers */,
+				5601486802533982ACC870BE /* CorpseSymbol.h in Headers */,
+				56C6C2B7EBDCC63B6ECEA9AD /* CorpseThread.h in Headers */,
 				C4F4B6F41A05C944005CAB76 /* cpp_generator.py in Headers */,
 				C4F4B6F31A05C944005CAB76 /* cpp_generator_templates.py in Headers */,
 				0F30D7C01D95D6320053089D /* CPU.h in Headers */,
@@ -13005,6 +13262,22 @@
 /* End PBXHeadersBuildPhase section */
 
 /* Begin PBXNativeTarget section */
+		49D9C56EC7911960C24239F3 /* JavaScriptCoreTools */ = {
+			isa = PBXNativeTarget;
+			buildConfigurationList = CDAB8A13AA6F0C8A7D95A0DD /* Build configuration list for PBXNativeTarget "JavaScriptCoreTools" */;
+			buildPhases = (
+				0F73B81D27D8B848DDFD4BA2 /* Sources */,
+			);
+			buildRules = (
+			);
+			dependencies = (
+				A1B2C3000BE5B4A700C0FFEE /* PBXTargetDependency */,
+			);
+			name = JavaScriptCoreTools;
+			productName = JavaScriptCoreTools;
+			productReference = 76A3C1425B4D63FC23BD2344 /* libJavaScriptCoreTools.a */;
+			productType = "com.apple.product-type.library.static";
+		};
 		0F6183381C45F62A0072450B /* testair */ = {
 			isa = PBXNativeTarget;
 			buildConfigurationList = 0F61833E1C45F62A0072450B /* Build configuration list for PBXNativeTarget "testair" */;
@@ -13261,6 +13534,9 @@
 			buildRules = (
 			);
 			dependencies = (
+				A1B2C30005E5B4A700C0FFEE /* PBXTargetDependency */,
+				A1B2C30007E5B4A700C0FFEE /* PBXTargetDependency */,
+				A1B2C30009E5B4A700C0FFEE /* PBXTargetDependency */,
 				14D9D9DA218462B5009126C2 /* PBXTargetDependency */,
 			);
 			name = jsc;
@@ -13269,6 +13545,27 @@
 			productReference = 932F5BE10822A1C700736975 /* jsc */;
 			productType = "com.apple.product-type.tool";
 		};
+		6B03652E1F50D87F0DEC6B42 /* mya */ = {
+			isa = PBXNativeTarget;
+			buildConfigurationList = 1564F766F55B0B045D183322 /* Build configuration list for PBXNativeTarget "mya" */;
+			buildPhases = (
+				184CD487A9C6C6DCE0BA2ADA /* Product Dependencies */,
+				FE35E0580C774FF6AC63188E /* Generate Entitlements */,
+				4ECC923BDB875C54F15ECFB7 /* Sources */,
+				97663BCF9AB10EBDF8B13940 /* Frameworks */,
+			);
+			buildRules = (
+			);
+			dependencies = (
+				D3934A4385F631C04057F7E7 /* PBXTargetDependency */,
+				87B6EB7D11A4B965B9269538 /* PBXTargetDependency */,
+			);
+			name = mya;
+			productInstallPath = /usr/local/bin;
+			productName = mya;
+			productReference = B2D6E3DABD6662589CD25896 /* mya */;
+			productType = "com.apple.product-type.tool";
+		};
 		FE533CA11F217DB30016A1FE /* testmasm */ = {
 			isa = PBXNativeTarget;
 			buildConfigurationList = FE533CA71F217DB30016A1FE /* Build configuration list for PBXNativeTarget "testmasm" */;
@@ -13287,6 +13584,27 @@
 			productReference = FE533CAC1F217DB40016A1FE /* testmasm */;
 			productType = "com.apple.product-type.tool";
 		};
+		7E83C41317D785F3003DC41B /* testLibJSCTools */ = {
+			isa = PBXNativeTarget;
+			buildConfigurationList = 7E83C41417D785F3003DC41B /* Build configuration list for PBXNativeTarget "testLibJSCTools" */;
+			buildPhases = (
+				7E83C42117D785F3003DC41B /* Generate Entitlements */,
+				7E83C41917D785F3003DC41B /* Sources */,
+				7E83C41A17D785F3003DC41B /* Frameworks */,
+			);
+			buildRules = (
+			);
+			dependencies = (
+				F7DDEC2D6CAFD2ACDD19D991 /* PBXTargetDependency */,
+				7E83C41B17D785F3003DC41B /* PBXTargetDependency */,
+				7E83C41D17D785F3003DC41B /* PBXTargetDependency */,
+			);
+			name = testLibJSCTools;
+			productInstallPath = /usr/local/bin;
+			productName = testLibJSCTools;
+			productReference = 7E83C40917D785F3003DC41B /* testLibJSCTools */;
+			productType = "com.apple.product-type.tool";
+		};
 		FF0F56862E33437C002A232A /* testwasmdebugger */ = {
 			isa = PBXNativeTarget;
 			buildConfigurationList = FF0F568F2E33437C002A232A /* Build configuration list for PBXNativeTarget "testwasmdebugger" */;
@@ -13354,6 +13672,8 @@
 				1412111F0A48793C00480255 /* minidom */,
 				14BD59BE0A3E8F9000BAF59C /* testapi */,
 				932F5BDA0822A1C700736975 /* jsc */,
+				49D9C56EC7911960C24239F3 /* JavaScriptCoreTools */,
+				6B03652E1F50D87F0DEC6B42 /* mya */,
 				651122F714046A4C002B101D /* testRegExp */,
 				0FEC85941BDB5CF10080FF74 /* testb3 */,
 				5D6B2A47152B9E17005231DE /* Test Tools */,
@@ -13364,6 +13684,7 @@
 				5325BDBF21DFF2B100A0DEE1 /* Apply Configuration to XCFileLists */,
 				52CD0F592242F569004A18A5 /* testdfg */,
 				FF0F56862E33437C002A232A /* testwasmdebugger */,
+				7E83C41317D785F3003DC41B /* testLibJSCTools */,
 			);
 		};
 /* End PBXProject section */
@@ -13772,6 +14093,26 @@
 			shellPath = /bin/sh;
 			shellScript = "Scripts/process-entitlements.sh\n";
 		};
+		FE35E0580C774FF6AC63188E /* Generate Entitlements */ = {
+			isa = PBXShellScriptBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			inputFileListPaths = (
+			);
+			inputPaths = (
+				"$(SRCROOT)/Scripts/process-entitlements.sh",
+			);
+			name = "Generate Entitlements";
+			outputFileListPaths = (
+			);
+			outputPaths = (
+				"$(WK_PROCESSED_XCENT_FILE)",
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+			shellPath = /bin/sh;
+			shellScript = "Scripts/process-entitlements.sh\n";
+		};
 		E3D6F6EE25D78CF600C20EB4 /* Generate Entitlements */ = {
 			isa = PBXShellScriptBuildPhase;
 			buildActionMask = 2147483647;
@@ -13976,6 +14317,26 @@
 			shellPath = /bin/sh;
 			shellScript = "Scripts/process-entitlements.sh\n";
 		};
+		7E83C42117D785F3003DC41B /* Generate Entitlements */ = {
+			isa = PBXShellScriptBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			inputFileListPaths = (
+			);
+			inputPaths = (
+				"$(SRCROOT)/Scripts/process-entitlements.sh",
+			);
+			name = "Generate Entitlements";
+			outputFileListPaths = (
+			);
+			outputPaths = (
+				"$(WK_PROCESSED_XCENT_FILE)",
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+			shellPath = /bin/sh;
+			shellScript = "Scripts/process-entitlements.sh\n";
+		};
 		FF0F56892E33437C002A232A /* Generate Entitlements */ = {
 			isa = PBXShellScriptBuildPhase;
 			buildActionMask = 2147483647;
@@ -13999,6 +14360,22 @@
 /* End PBXShellScriptBuildPhase section */
 
 /* Begin PBXSourcesBuildPhase section */
+		0F73B81D27D8B848DDFD4BA2 /* Sources */ = {
+			isa = PBXSourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				7E83C42417D785F3003DC41B /* CorpseByteParser.cpp in Sources */,
+				C2EB941F3198AE0BD86A2324 /* CorpseClient.cpp in Sources */,
+				121D90BB8171A66F1922D548 /* CorpseError.cpp in Sources */,
+				7E83C43817D785F3003DC41B /* CorpseExportsTrie.cpp in Sources */,
+				C366EA5039A3B51405995EA6 /* CorpseProcess.cpp in Sources */,
+				5E2B94A17C6D40F3B85219CE /* CorpseRegion.cpp in Sources */,
+				0946712DEC51E0E86C4A49E3 /* CorpseSnapshot.cpp in Sources */,
+				377C8C2416AE3DF90650C0E9 /* CorpseSymbol.cpp in Sources */,
+				EF648B9EEAF54C44048B416A /* CorpseThread.cpp in Sources */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
 		0F6183391C45F62A0072450B /* Sources */ = {
 			isa = PBXSourcesBuildPhase;
 			buildActionMask = 2147483647;
@@ -14345,6 +14722,14 @@
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
+		4ECC923BDB875C54F15ECFB7 /* Sources */ = {
+			isa = PBXSourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				6DCC8B386903B87B8A4E5A26 /* mya.cpp in Sources */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
 		FE533CA21F217DB30016A1FE /* Sources */ = {
 			isa = PBXSourcesBuildPhase;
 			buildActionMask = 2147483647;
@@ -14353,6 +14738,23 @@
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
+		7E83C41917D785F3003DC41B /* Sources */ = {
+			isa = PBXSourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				7E83C42B17D785F3003DC41B /* CorpseAddressTest.cpp in Sources */,
+				7E83C42717D785F3003DC41B /* CorpseByteParserTest.cpp in Sources */,
+				7E83C40B17D785F3003DC41B /* CorpseExportsTrieTest.cpp in Sources */,
+				7E83C42E17D785F3003DC41B /* CorpseProcessTest.cpp in Sources */,
+				7E83C43117D785F3003DC41B /* CorpseRegionTest.cpp in Sources */,
+				7E83C40D17D785F3003DC41B /* CorpseSnapshotTest.cpp in Sources */,
+				7E83C40E17D785F3003DC41B /* CorpseSymbolTest.cpp in Sources */,
+				7E83C43417D785F3003DC41B /* CorpseThreadTest.cpp in Sources */,
+				7E83C40C17D785F3003DC41B /* LibJSCToolsTestUtilities.cpp in Sources */,
+				7E83C40A17D785F3003DC41B /* testLibJSCTools.cpp in Sources */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
 		FF0F568A2E33437C002A232A /* Sources */ = {
 			isa = PBXSourcesBuildPhase;
 			buildActionMask = 2147483647;
@@ -14377,6 +14779,31 @@
 /* End PBXSourcesBuildPhase section */
 
 /* Begin PBXTargetDependency section */
+		D3934A4385F631C04057F7E7 /* PBXTargetDependency */ = {
+			isa = PBXTargetDependency;
+			target = 49D9C56EC7911960C24239F3 /* JavaScriptCoreTools */;
+			targetProxy = 6044D4B120B01FBCA9BCFBE5 /* PBXContainerItemProxy */;
+		};
+		A1B2C30005E5B4A700C0FFEE /* PBXTargetDependency */ = {
+			isa = PBXTargetDependency;
+			target = 49D9C56EC7911960C24239F3 /* JavaScriptCoreTools */;
+			targetProxy = A1B2C30004E5B4A700C0FFEE /* PBXContainerItemProxy */;
+		};
+		A1B2C30007E5B4A700C0FFEE /* PBXTargetDependency */ = {
+			isa = PBXTargetDependency;
+			target = 6B03652E1F50D87F0DEC6B42 /* mya */;
+			targetProxy = A1B2C30006E5B4A700C0FFEE /* PBXContainerItemProxy */;
+		};
+		A1B2C30009E5B4A700C0FFEE /* PBXTargetDependency */ = {
+			isa = PBXTargetDependency;
+			target = 7E83C41317D785F3003DC41B /* testLibJSCTools */;
+			targetProxy = A1B2C30008E5B4A700C0FFEE /* PBXContainerItemProxy */;
+		};
+		F7DDEC2D6CAFD2ACDD19D991 /* PBXTargetDependency */ = {
+			isa = PBXTargetDependency;
+			target = 49D9C56EC7911960C24239F3 /* JavaScriptCoreTools */;
+			targetProxy = 291A8D565940996D3CA021C1 /* PBXContainerItemProxy */;
+		};
 		074D7E0A2E3D3B6800CD38C6 /* PBXTargetDependency */ = {
 			isa = PBXTargetDependency;
 			target = 65FB3F6609D11E9100F49DEB /* Derived Sources */;
@@ -14462,6 +14889,21 @@
 			target = 65FB3F6609D11E9100F49DEB /* Derived Sources */;
 			targetProxy = 14D9D9D9218462B5009126C2 /* PBXContainerItemProxy */;
 		};
+		87B6EB7D11A4B965B9269538 /* PBXTargetDependency */ = {
+			isa = PBXTargetDependency;
+			target = 65FB3F6609D11E9100F49DEB /* Derived Sources */;
+			targetProxy = B70B8C003BC4F51DF41C2D65 /* PBXContainerItemProxy */;
+		};
+		A1B2C3000BE5B4A700C0FFEE /* PBXTargetDependency */ = {
+			isa = PBXTargetDependency;
+			target = 65FB3F6609D11E9100F49DEB /* Derived Sources */;
+			targetProxy = A1B2C3000AE5B4A700C0FFEE /* PBXContainerItemProxy */;
+		};
+		5F40739EF054554602787C41 /* PBXTargetDependency */ = {
+			isa = PBXTargetDependency;
+			target = 6B03652E1F50D87F0DEC6B42 /* mya */;
+			targetProxy = A269FDF04AF38423A3A5DE9A /* PBXContainerItemProxy */;
+		};
 		44F93E112AE7200100FFA37C /* PBXTargetDependency */ = {
 			isa = PBXTargetDependency;
 			target = 44F93E012AE71F5300FFA37C /* libJavaScriptCore */;
@@ -14542,6 +14984,21 @@
 			target = FE533CA11F217DB30016A1FE /* testmasm */;
 			targetProxy = FE533CAE1F217EC60016A1FE /* PBXContainerItemProxy */;
 		};
+		7E83C41B17D785F3003DC41B /* PBXTargetDependency */ = {
+			isa = PBXTargetDependency;
+			target = 65FB3F6609D11E9100F49DEB /* Derived Sources */;
+			targetProxy = 7E83C41C17D785F3003DC41B /* PBXContainerItemProxy */;
+		};
+		7E83C41D17D785F3003DC41B /* PBXTargetDependency */ = {
+			isa = PBXTargetDependency;
+			target = E1AC2E2720F7B94C00B0897D /* Unlock Keychain */;
+			targetProxy = 7E83C41E17D785F3003DC41B /* PBXContainerItemProxy */;
+		};
+		7E83C41F17D785F3003DC41B /* PBXTargetDependency */ = {
+			isa = PBXTargetDependency;
+			target = 7E83C41317D785F3003DC41B /* testLibJSCTools */;
+			targetProxy = 7E83C42017D785F3003DC41B /* PBXContainerItemProxy */;
+		};
 		FF0F56872E33437C002A232A /* PBXTargetDependency */ = {
 			isa = PBXTargetDependency;
 			target = E1AC2E2720F7B94C00B0897D /* Unlock Keychain */;
@@ -14555,6 +15012,34 @@
 /* End PBXTargetDependency section */
 
 /* Begin XCBuildConfiguration section */
+		0496C9FAB31F908B0425279C /* Debug */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = 33CCFE0660BE540320EF4777 /* libJavaScriptCoreTools.xcconfig */;
+			buildSettings = {
+			};
+			name = Debug;
+		};
+		CF17CD764111B2A78C3D8F10 /* Release */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = 33CCFE0660BE540320EF4777 /* libJavaScriptCoreTools.xcconfig */;
+			buildSettings = {
+			};
+			name = Release;
+		};
+		1738026904B5B9E1BA357B8F /* Profiling */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = 33CCFE0660BE540320EF4777 /* libJavaScriptCoreTools.xcconfig */;
+			buildSettings = {
+			};
+			name = Profiling;
+		};
+		1A9B847BE318F847F08771D9 /* Production */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = 33CCFE0660BE540320EF4777 /* libJavaScriptCoreTools.xcconfig */;
+			buildSettings = {
+			};
+			name = Production;
+		};
 		0F61833F1C45F62A0072450B /* Debug */ = {
 			isa = XCBuildConfiguration;
 			baseConfigurationReference = FEE0A12229FE250400CED5E4 /* TestExecutable.xcconfig */;
@@ -14731,6 +15216,34 @@
 			};
 			name = Production;
 		};
+		0D9FBE8C4B6D65ED3E83AB12 /* Debug */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = 3E812A1EEBE0D5AEA7D3C74B /* Mya.xcconfig */;
+			buildSettings = {
+			};
+			name = Debug;
+		};
+		39672BABA758BF6EC3C9BDE6 /* Release */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = 3E812A1EEBE0D5AEA7D3C74B /* Mya.xcconfig */;
+			buildSettings = {
+			};
+			name = Release;
+		};
+		D433E29BE1849C8E3DEEF0BB /* Profiling */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = 3E812A1EEBE0D5AEA7D3C74B /* Mya.xcconfig */;
+			buildSettings = {
+			};
+			name = Profiling;
+		};
+		9FAFBEC1CDCCB2F48A335C3E /* Production */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = 3E812A1EEBE0D5AEA7D3C74B /* Mya.xcconfig */;
+			buildSettings = {
+			};
+			name = Production;
+		};
 		149C276D08902AFE008A9EFC /* Debug */ = {
 			isa = XCBuildConfiguration;
 			baseConfigurationReference = 1C9051430BA9E8A70081E9D0 /* JavaScriptCore.xcconfig */;
@@ -15183,6 +15696,38 @@
 			};
 			name = Production;
 		};
+		7E83C41517D785F3003DC41B /* Debug */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = A1B2C30001E5B4A700C0FFEE /* TestLibJSCTools.xcconfig */;
+			buildSettings = {
+				PRODUCT_NAME = "$(TARGET_NAME)";
+			};
+			name = Debug;
+		};
+		7E83C41617D785F3003DC41B /* Release */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = A1B2C30001E5B4A700C0FFEE /* TestLibJSCTools.xcconfig */;
+			buildSettings = {
+				PRODUCT_NAME = "$(TARGET_NAME)";
+			};
+			name = Release;
+		};
+		7E83C41717D785F3003DC41B /* Profiling */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = A1B2C30001E5B4A700C0FFEE /* TestLibJSCTools.xcconfig */;
+			buildSettings = {
+				PRODUCT_NAME = "$(TARGET_NAME)";
+			};
+			name = Profiling;
+		};
+		7E83C41817D785F3003DC41B /* Production */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = A1B2C30001E5B4A700C0FFEE /* TestLibJSCTools.xcconfig */;
+			buildSettings = {
+				PRODUCT_NAME = "$(TARGET_NAME)";
+			};
+			name = Production;
+		};
 		FF0F56902E33437C002A232A /* Debug */ = {
 			isa = XCBuildConfiguration;
 			baseConfigurationReference = FEE0A12229FE250400CED5E4 /* TestExecutable.xcconfig */;
@@ -15218,6 +15763,17 @@
 /* End XCBuildConfiguration section */
 
 /* Begin XCConfigurationList section */
+		CDAB8A13AA6F0C8A7D95A0DD /* Build configuration list for PBXNativeTarget "JavaScriptCoreTools" */ = {
+			isa = XCConfigurationList;
+			buildConfigurations = (
+				0496C9FAB31F908B0425279C /* Debug */,
+				CF17CD764111B2A78C3D8F10 /* Release */,
+				1738026904B5B9E1BA357B8F /* Profiling */,
+				1A9B847BE318F847F08771D9 /* Production */,
+			);
+			defaultConfigurationIsVisible = 0;
+			defaultConfigurationName = Production;
+		};
 		0F61833E1C45F62A0072450B /* Build configuration list for PBXNativeTarget "testair" */ = {
 			isa = XCConfigurationList;
 			buildConfigurations = (
@@ -15295,6 +15851,17 @@
 			defaultConfigurationIsVisible = 0;
 			defaultConfigurationName = Production;
 		};
+		1564F766F55B0B045D183322 /* Build configuration list for PBXNativeTarget "mya" */ = {
+			isa = XCConfigurationList;
+			buildConfigurations = (
+				0D9FBE8C4B6D65ED3E83AB12 /* Debug */,
+				39672BABA758BF6EC3C9BDE6 /* Release */,
+				D433E29BE1849C8E3DEEF0BB /* Profiling */,
+				9FAFBEC1CDCCB2F48A335C3E /* Production */,
+			);
+			defaultConfigurationIsVisible = 0;
+			defaultConfigurationName = Production;
+		};
 		149C276C08902AFE008A9EFC /* Build configuration list for PBXAggregateTarget "All" */ = {
 			isa = XCConfigurationList;
 			buildConfigurations = (
@@ -15449,6 +16016,17 @@
 			defaultConfigurationIsVisible = 0;
 			defaultConfigurationName = Production;
 		};
+		7E83C41417D785F3003DC41B /* Build configuration list for PBXNativeTarget "testLibJSCTools" */ = {
+			isa = XCConfigurationList;
+			buildConfigurations = (
+				7E83C41517D785F3003DC41B /* Debug */,
+				7E83C41617D785F3003DC41B /* Release */,
+				7E83C41717D785F3003DC41B /* Profiling */,
+				7E83C41817D785F3003DC41B /* Production */,
+			);
+			defaultConfigurationIsVisible = 0;
+			defaultConfigurationName = Production;
+		};
 		FF0F568F2E33437C002A232A /* Build configuration list for PBXNativeTarget "testwasmdebugger" */ = {
 			isa = XCConfigurationList;
 			buildConfigurations = (
diff --git a/Source/JavaScriptCore/SaferCPPExpectations/UncountedCallArgsCheckerExpectations b/Source/JavaScriptCore/SaferCPPExpectations/UncountedCallArgsCheckerExpectations
index 18aeede54748..4d1e59f20fbf 100644
--- a/Source/JavaScriptCore/SaferCPPExpectations/UncountedCallArgsCheckerExpectations
+++ b/Source/JavaScriptCore/SaferCPPExpectations/UncountedCallArgsCheckerExpectations
@@ -71,14 +71,10 @@ inspector/ConsoleMessage.cpp
 inspector/JSGlobalObjectInspectorController.cpp
 inspector/JSJavaScriptCallFrame.cpp
 inspector/ScriptCallStack.cpp
-inspector/agents/InspectorAgent.cpp
-inspector/agents/InspectorAuditAgent.cpp
-inspector/agents/InspectorConsoleAgent.cpp
 inspector/agents/InspectorDebuggerAgent.cpp
 inspector/agents/InspectorHeapAgent.cpp
 inspector/agents/InspectorRuntimeAgent.cpp
 inspector/agents/InspectorScriptProfilerAgent.cpp
-inspector/agents/JSGlobalObjectRuntimeAgent.cpp
 jit/BaselineJITPlan.cpp
 jit/ExecutableAllocator.cpp
 jit/GCAwareJITStubRoutine.cpp
diff --git a/Source/JavaScriptCore/SaferCPPExpectations/UncountedLambdaCapturesCheckerExpectations b/Source/JavaScriptCore/SaferCPPExpectations/UncountedLambdaCapturesCheckerExpectations
index 3a64d3fc500c..2d708615bb1b 100644
--- a/Source/JavaScriptCore/SaferCPPExpectations/UncountedLambdaCapturesCheckerExpectations
+++ b/Source/JavaScriptCore/SaferCPPExpectations/UncountedLambdaCapturesCheckerExpectations
@@ -3,7 +3,6 @@ bytecode/InlineCacheCompiler.cpp
 bytecode/ObjectPropertyConditionSet.cpp
 bytecompiler/NodesCodegen.cpp
 debugger/Debugger.cpp
-dfg/DFGDesiredWatchpoints.h
 dfg/DFGLazyJSValue.cpp
 dfg/DFGObjectAllocationSinkingPhase.cpp
 ftl/FTLCompile.cpp
diff --git a/Source/JavaScriptCore/Scripts/process-entitlements.sh b/Source/JavaScriptCore/Scripts/process-entitlements.sh
index ff396dcd52c6..8e8c00f5d4ff 100755
--- a/Source/JavaScriptCore/Scripts/process-entitlements.sh
+++ b/Source/JavaScriptCore/Scripts/process-entitlements.sh
@@ -69,6 +69,23 @@ function mac_process_testapi_entitlements()
     fi
 }
 
+function mac_process_mya_entitlements()
+{
+    if [[ "${WK_USE_RESTRICTED_ENTITLEMENTS}" == YES ]]
+    then
+        plistbuddy Add :com.apple.private.cs.debugger bool YES
+
+        if [[ "${WK_USE_FATAL_EXCEPTIONS}" == YES ]]
+        then
+            plistbuddy Add :com.apple.private.pac.exception bool YES
+        fi
+
+        plistbuddy Add :com.apple.developer.kernel.extended-virtual-addressing bool YES
+
+        plistbuddy Add :com.apple.developer.hardened-process bool YES
+    fi
+}
+
 # ========================================
 # macCatalyst entitlements
 # ========================================
@@ -133,6 +150,23 @@ function maccatalyst_process_testapi_entitlements()
     fi
 }
 
+function maccatalyst_process_mya_entitlements()
+{
+    if [[ "${WK_USE_RESTRICTED_ENTITLEMENTS}" == YES ]]
+    then
+        plistbuddy Add :com.apple.private.cs.debugger bool YES
+
+        if [[ "${WK_USE_FATAL_EXCEPTIONS}" == YES ]]
+        then
+            plistbuddy Add :com.apple.private.pac.exception bool YES
+        fi
+
+        plistbuddy Add :com.apple.developer.kernel.extended-virtual-addressing bool YES
+
+        plistbuddy Add :com.apple.developer.hardened-process bool YES
+    fi
+}
+
 # ========================================
 # iOS Family entitlements
 # ========================================
@@ -165,6 +199,22 @@ function ios_family_process_jsc_entitlements()
     plistbuddy Add :com.apple.developer.hardened-process bool YES
 }
 
+function ios_family_process_mya_entitlements()
+{
+    if [[ "${WK_USE_RESTRICTED_ENTITLEMENTS}" == YES ]]
+    then
+        plistbuddy Add :com.apple.private.cs.debugger bool YES
+    fi
+
+    if [[ "${WK_USE_FATAL_EXCEPTIONS}" == YES ]]
+    then
+        plistbuddy Add :com.apple.private.pac.exception bool YES
+    fi
+
+    plistbuddy Add :com.apple.developer.kernel.extended-virtual-addressing bool YES
+    plistbuddy Add :com.apple.developer.hardened-process bool YES
+}
+
 rm -f "${WK_PROCESSED_XCENT_FILE}"
 plistbuddy Clear dict
 
@@ -185,6 +235,9 @@ then
           "${PRODUCT_NAME}" == testmem ||
           "${PRODUCT_NAME}" == testRegExp ]]; then mac_process_jsc_entitlements
     elif [[ "${PRODUCT_NAME}" == testapi ]]; then mac_process_testapi_entitlements
+    elif [[ "${PRODUCT_NAME}" == mya ]]; then mac_process_mya_entitlements
+    # testLibJSCTools only ever snapshots its own process, which needs no entitlement.
+    elif [[ "${PRODUCT_NAME}" == testLibJSCTools ]]; then true
     else echo "Unsupported/unknown product: ${PRODUCT_NAME}"
     fi
 elif [[ "${WK_PLATFORM_NAME}" == maccatalyst || "${WK_PLATFORM_NAME}" == iosmac ]]
@@ -201,6 +254,9 @@ then
           "${PRODUCT_NAME}" == testmem ||
           "${PRODUCT_NAME}" == testRegExp ]]; then maccatalyst_process_jsc_entitlements
     elif [[ "${PRODUCT_NAME}" == testapi ]]; then maccatalyst_process_testapi_entitlements
+    elif [[ "${PRODUCT_NAME}" == mya ]]; then maccatalyst_process_mya_entitlements
+    # testLibJSCTools only ever snapshots its own process, which needs no entitlement.
+    elif [[ "${PRODUCT_NAME}" == testLibJSCTools ]]; then true
     else echo "Unsupported/unknown product: ${PRODUCT_NAME}"
     fi
 elif [[ "${WK_PLATFORM_NAME}" == iphoneos ||
@@ -218,6 +274,9 @@ then
           "${PRODUCT_NAME}" == testmasm ||
           "${PRODUCT_NAME}" == testmem ||
           "${PRODUCT_NAME}" == testRegExp ]]; then ios_family_process_jsc_entitlements
+    elif [[ "${PRODUCT_NAME}" == mya ]]; then ios_family_process_mya_entitlements
+    # testLibJSCTools only ever snapshots its own process, which needs no entitlement.
+    elif [[ "${PRODUCT_NAME}" == testLibJSCTools ]]; then true
     else echo "Unsupported/unknown product: ${PRODUCT_NAME}"
     fi
 else
diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerARM64.h b/Source/JavaScriptCore/assembler/MacroAssemblerARM64.h
index 17088a7e5f51..debe749bfa00 100644
--- a/Source/JavaScriptCore/assembler/MacroAssemblerARM64.h
+++ b/Source/JavaScriptCore/assembler/MacroAssemblerARM64.h
@@ -191,10 +191,6 @@ class MacroAssemblerARM64 : public AbstractMacroAssembler<Assembler> {
     void add32(TrustedImm32 imm, RegisterID src, RegisterID dest)
     {
         auto immediate = imm.m_value;
-        if (!immediate) {
-            zeroExtend32ToWord(src, dest);
-            return;
-        }
         if (auto tuple = tryExtractShiftedImm(immediate)) {
             auto [u12, shift, inverted] = tuple.value();
             if (!inverted)
@@ -326,10 +322,6 @@ class MacroAssemblerARM64 : public AbstractMacroAssembler<Assembler> {
     void add64(TrustedImm32 imm, RegisterID src, RegisterID dest)
     {
         auto immediate = imm.m_value;
-        if (!immediate) {
-            move(src, dest);
-            return;
-        }
         if (auto tuple = tryExtractShiftedImm(immediate)) {
             auto [u12, shift, inverted] = tuple.value();
             if (!inverted)
@@ -360,10 +352,6 @@ class MacroAssemblerARM64 : public AbstractMacroAssembler<Assembler> {
     void add64(TrustedImm64 imm, RegisterID src, RegisterID dest)
     {
         auto immediate = imm.m_value;
-        if (!immediate) {
-            move(src, dest);
-            return;
-        }
         if (auto tuple = tryExtractShiftedImm(immediate)) {
             auto [u12, shift, inverted] = tuple.value();
             if (!inverted)
@@ -1515,10 +1503,6 @@ class MacroAssemblerARM64 : public AbstractMacroAssembler<Assembler> {
     void sub32(RegisterID left, TrustedImm32 imm, RegisterID dest)
     {
         auto immediate = imm.m_value;
-        if (!immediate) {
-            zeroExtend32ToWord(left, dest);
-            return;
-        }
         if (auto tuple = tryExtractShiftedImm(immediate)) {
             auto [u12, shift, inverted] = tuple.value();
             if (!inverted)
@@ -1591,10 +1575,6 @@ class MacroAssemblerARM64 : public AbstractMacroAssembler<Assembler> {
     void sub64(RegisterID left, TrustedImm32 imm, RegisterID dest)
     {
         auto immediate = imm.m_value;
-        if (!immediate) {
-            move(left, dest);
-            return;
-        }
         if (auto tuple = tryExtractShiftedImm(immediate)) {
             auto [u12, shift, inverted] = tuple.value();
             if (!inverted)
@@ -1615,10 +1595,6 @@ class MacroAssemblerARM64 : public AbstractMacroAssembler<Assembler> {
     void sub64(RegisterID left, TrustedImm64 imm, RegisterID dest)
     {
         auto immediate = imm.m_value;
-        if (!immediate) {
-            move(left, dest);
-            return;
-        }
         if (auto tuple = tryExtractShiftedImm(immediate)) {
             auto [u12, shift, inverted] = tuple.value();
             if (!inverted)
diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerX86_64.h b/Source/JavaScriptCore/assembler/MacroAssemblerX86_64.h
index f3523d36cd71..67975043b8cb 100644
--- a/Source/JavaScriptCore/assembler/MacroAssemblerX86_64.h
+++ b/Source/JavaScriptCore/assembler/MacroAssemblerX86_64.h
@@ -5122,9 +5122,6 @@ class MacroAssemblerX86_64 : public AbstractMacroAssembler<Assembler> {
 
     void add64(TrustedImm32 imm, RegisterID srcDest)
     {
-        if (!imm.m_value)
-            return;
-
         if (imm.m_value == 1)
             m_assembler.incq_r(srcDest);
         else
@@ -5133,9 +5130,6 @@ class MacroAssemblerX86_64 : public AbstractMacroAssembler<Assembler> {
 
     void add64(TrustedImm64 imm, RegisterID dest)
     {
-        if (!imm.m_value)
-            return;
-
         if (imm.m_value == 1)
             m_assembler.incq_r(dest);
         else {
@@ -5146,21 +5140,11 @@ class MacroAssemblerX86_64 : public AbstractMacroAssembler<Assembler> {
 
     void add64(TrustedImm32 imm, RegisterID src, RegisterID dest)
     {
-        if (!imm.m_value) {
-            move(src, dest);
-            return;
-        }
-
         m_assembler.leaq_mr(imm.m_value, src, dest);
     }
 
     void add64(TrustedImm64 imm, RegisterID src, RegisterID dest)
     {
-        if (!imm.m_value) {
-            move(src, dest);
-            return;
-        }
-
         if (WTF::isRepresentableAs<int32_t>(imm.m_value))
             m_assembler.leaq_mr(imm.m_value, src, dest);
         else {
@@ -5801,9 +5785,6 @@ class MacroAssemblerX86_64 : public AbstractMacroAssembler<Assembler> {
 
     void sub64(TrustedImm32 imm, RegisterID dest)
     {
-        if (!imm.m_value)
-            return;
-
         if (imm.m_value == 1)
             m_assembler.decq_r(dest);
         else
@@ -5812,11 +5793,6 @@ class MacroAssemblerX86_64 : public AbstractMacroAssembler<Assembler> {
 
     void sub64(RegisterID a, TrustedImm32 imm, RegisterID dest)
     {
-        if (!imm.m_value) {
-            move(a, dest);
-            return;
-        }
-
         if (a == dest) {
             sub64(imm, dest);
             return;
@@ -5831,9 +5807,6 @@ class MacroAssemblerX86_64 : public AbstractMacroAssembler<Assembler> {
 
     void sub64(TrustedImm64 imm, RegisterID dest)
     {
-        if (!imm.m_value)
-            return;
-
         if (imm.m_value == 1)
             m_assembler.decq_r(dest);
         else {
@@ -5844,11 +5817,6 @@ class MacroAssemblerX86_64 : public AbstractMacroAssembler<Assembler> {
 
     void sub64(RegisterID src, TrustedImm64 imm, RegisterID dest)
     {
-        if (!imm.m_value) {
-            move(src, dest);
-            return;
-        }
-
         if (src == dest) {
             sub64(imm, dest);
             return;
diff --git a/Source/JavaScriptCore/assembler/testmasm.cpp b/Source/JavaScriptCore/assembler/testmasm.cpp
index 3f495628f492..4c586c98d871 100644
--- a/Source/JavaScriptCore/assembler/testmasm.cpp
+++ b/Source/JavaScriptCore/assembler/testmasm.cpp
@@ -975,216 +975,6 @@ void testStore64Imm64AddressPointer()
     doTest(0xAAAA432198765555);
 }
 
-void testAdd32Imm()
-{
-    for (auto immediate : int32Operands()) {
-        for (auto immediate2 : int32Operands()) {
-            auto add = compile([=] (CCallHelpers& jit) {
-                emitFunctionPrologue(jit);
-
-                jit.move(CCallHelpers::TrustedImm32(immediate), GPRInfo::returnValueGPR);
-                jit.add32(CCallHelpers::TrustedImm32(immediate2), GPRInfo::returnValueGPR);
-
-                emitFunctionEpilogue(jit);
-                jit.ret();
-            });
-            CHECK_EQ(invoke<uint32_t>(add), static_cast<uint32_t>(immediate) + static_cast<uint32_t>(immediate2));
-        }
-    }
-}
-
-void testAdd32ArgImm()
-{
-    for (auto immediate : int32Operands()) {
-        auto add = compile([=] (CCallHelpers& jit) {
-            emitFunctionPrologue(jit);
-
-            jit.add32(CCallHelpers::TrustedImm32(immediate), GPRInfo::argumentGPR0, GPRInfo::returnValueGPR);
-
-            emitFunctionEpilogue(jit);
-            jit.ret();
-        });
-
-        for (auto value : int32Operands())
-            CHECK_EQ(invoke<uint32_t>(add, value), static_cast<uint32_t>(value) + static_cast<uint32_t>(immediate));
-    }
-}
-
-void testAdd64Imm32()
-{
-    for (auto immediate : int64Operands()) {
-        for (auto immediate2 : int32Operands()) {
-            auto add = compile([=] (CCallHelpers& jit) {
-                emitFunctionPrologue(jit);
-
-                jit.move(CCallHelpers::TrustedImm64(immediate), GPRInfo::returnValueGPR);
-                jit.add64(CCallHelpers::TrustedImm32(immediate2), GPRInfo::returnValueGPR);
-
-                emitFunctionEpilogue(jit);
-                jit.ret();
-            });
-            CHECK_EQ(invoke<uint64_t>(add), static_cast<uint64_t>(immediate) + static_cast<uint64_t>(immediate2));
-        }
-    }
-}
-
-void testAdd64ArgImm32()
-{
-    for (auto immediate : int32Operands()) {
-        auto add = compile([=] (CCallHelpers& jit) {
-            emitFunctionPrologue(jit);
-
-            jit.add64(CCallHelpers::TrustedImm32(immediate), GPRInfo::argumentGPR0, GPRInfo::returnValueGPR);
-
-            emitFunctionEpilogue(jit);
-            jit.ret();
-        });
-
-        for (auto value : int64Operands())
-            CHECK_EQ(invoke<uint64_t>(add, value), static_cast<uint64_t>(value) + static_cast<uint64_t>(immediate));
-    }
-}
-
-void testAdd64Imm64()
-{
-    for (auto immediate : int64Operands()) {
-        for (auto immediate2 : int64Operands()) {
-            auto add = compile([=] (CCallHelpers& jit) {
-                emitFunctionPrologue(jit);
-
-                jit.move(CCallHelpers::TrustedImm64(immediate), GPRInfo::returnValueGPR);
-                jit.add64(CCallHelpers::TrustedImm64(immediate2), GPRInfo::returnValueGPR);
-
-                emitFunctionEpilogue(jit);
-                jit.ret();
-            });
-            CHECK_EQ(invoke<uint64_t>(add), static_cast<uint64_t>(immediate) + static_cast<uint64_t>(immediate2));
-        }
-    }
-}
-
-void testAdd64ArgImm64()
-{
-    for (auto immediate : int64Operands()) {
-        auto add = compile([=] (CCallHelpers& jit) {
-            emitFunctionPrologue(jit);
-
-            jit.add64(CCallHelpers::TrustedImm64(immediate), GPRInfo::argumentGPR0, GPRInfo::returnValueGPR);
-
-            emitFunctionEpilogue(jit);
-            jit.ret();
-        });
-
-        for (auto value : int64Operands())
-            CHECK_EQ(invoke<uint64_t>(add, value), static_cast<uint64_t>(value) + static_cast<uint64_t>(immediate));
-    }
-}
-
-void testSub32Args()
-{
-    for (auto value : int32Operands()) {
-        auto sub = compile([=] (CCallHelpers& jit) {
-            emitFunctionPrologue(jit);
-
-            jit.sub32(GPRInfo::argumentGPR0, GPRInfo::argumentGPR1, GPRInfo::returnValueGPR);
-
-            emitFunctionEpilogue(jit);
-            jit.ret();
-        });
-
-        for (auto value2 : int32Operands())
-            CHECK_EQ(invoke<uint32_t>(sub, value, value2), static_cast<uint32_t>(value - value2));
-    }
-}
-
-void testSub32Imm()
-{
-    for (auto immediate : int32Operands()) {
-        for (auto immediate2 : int32Operands()) {
-            auto sub = compile([=] (CCallHelpers& jit) {
-                emitFunctionPrologue(jit);
-
-                jit.move(CCallHelpers::TrustedImm32(immediate), GPRInfo::returnValueGPR);
-                jit.sub32(CCallHelpers::TrustedImm32(immediate2), GPRInfo::returnValueGPR);
-
-                emitFunctionEpilogue(jit);
-                jit.ret();
-            });
-            CHECK_EQ(invoke<uint32_t>(sub), static_cast<uint32_t>(immediate - immediate2));
-        }
-    }
-}
-
-void testSub64Imm32()
-{
-    for (auto immediate : int64Operands()) {
-        for (auto immediate2 : int32Operands()) {
-            auto sub = compile([=] (CCallHelpers& jit) {
-                emitFunctionPrologue(jit);
-
-                jit.move(CCallHelpers::TrustedImm64(immediate), GPRInfo::returnValueGPR);
-                jit.sub64(CCallHelpers::TrustedImm32(immediate2), GPRInfo::returnValueGPR);
-
-                emitFunctionEpilogue(jit);
-                jit.ret();
-            });
-            CHECK_EQ(invoke<uint64_t>(sub), static_cast<uint64_t>(immediate - immediate2));
-        }
-    }
-}
-
-void testSub64ArgImm32()
-{
-    for (auto immediate : int32Operands()) {
-        auto sub = compile([=] (CCallHelpers& jit) {
-            emitFunctionPrologue(jit);
-
-            jit.sub64(GPRInfo::argumentGPR0, CCallHelpers::TrustedImm32(immediate), GPRInfo::returnValueGPR);
-
-            emitFunctionEpilogue(jit);
-            jit.ret();
-        });
-
-        for (auto value : int64Operands())
-            CHECK_EQ(invoke<int64_t>(sub, value), static_cast<int64_t>(value - immediate));
-    }
-}
-
-void testSub64Imm64()
-{
-    for (auto immediate : int64Operands()) {
-        for (auto immediate2 : int64Operands()) {
-            auto sub = compile([=] (CCallHelpers& jit) {
-                emitFunctionPrologue(jit);
-
-                jit.move(CCallHelpers::TrustedImm64(immediate), GPRInfo::returnValueGPR);
-                jit.sub64(CCallHelpers::TrustedImm64(immediate2), GPRInfo::returnValueGPR);
-
-                emitFunctionEpilogue(jit);
-                jit.ret();
-            });
-            CHECK_EQ(invoke<uint64_t>(sub), static_cast<uint64_t>(immediate - immediate2));
-        }
-    }
-}
-
-void testSub64ArgImm64()
-{
-    for (auto immediate : int64Operands()) {
-        auto sub = compile([=] (CCallHelpers& jit) {
-            emitFunctionPrologue(jit);
-
-            jit.sub64(GPRInfo::argumentGPR0, CCallHelpers::TrustedImm64(immediate), GPRInfo::returnValueGPR);
-
-            emitFunctionEpilogue(jit);
-            jit.ret();
-        });
-
-        for (auto value : int64Operands())
-            CHECK_EQ(invoke<int64_t>(sub, value), static_cast<int64_t>(value - immediate));
-    }
-}
-
 #endif // CPU(X86_64) || CPU(ARM64)
 
 void testCompareDouble(MacroAssembler::DoubleCondition condition)
@@ -1435,6 +1225,111 @@ void testMultiplyAddZeroExtend32()
     }
 }
 
+void testSub32Args()
+{
+    for (auto value : int32Operands()) {
+        auto sub = compile([=] (CCallHelpers& jit) {
+            emitFunctionPrologue(jit);
+
+            jit.sub32(GPRInfo::argumentGPR0, GPRInfo::argumentGPR1, GPRInfo::returnValueGPR);
+
+            emitFunctionEpilogue(jit);
+            jit.ret();
+        });
+
+        for (auto value2 : int32Operands())
+            CHECK_EQ(invoke<uint32_t>(sub, value, value2), static_cast<uint32_t>(value - value2));
+    }
+}
+
+void testSub32Imm()
+{
+    for (auto immediate : int32Operands()) {
+        for (auto immediate2 : int32Operands()) {
+            auto sub = compile([=] (CCallHelpers& jit) {
+                emitFunctionPrologue(jit);
+
+                jit.move(CCallHelpers::TrustedImm32(immediate), GPRInfo::returnValueGPR);
+                jit.sub32(CCallHelpers::TrustedImm32(immediate2), GPRInfo::returnValueGPR);
+
+                emitFunctionEpilogue(jit);
+                jit.ret();
+            });
+            CHECK_EQ(invoke<uint32_t>(sub), static_cast<uint32_t>(immediate - immediate2));
+        }
+    }
+}
+
+void testSub64Imm32()
+{
+    for (auto immediate : int64Operands()) {
+        for (auto immediate2 : int32Operands()) {
+            auto sub = compile([=] (CCallHelpers& jit) {
+                emitFunctionPrologue(jit);
+
+                jit.move(CCallHelpers::TrustedImm64(immediate), GPRInfo::returnValueGPR);
+                jit.sub64(CCallHelpers::TrustedImm32(immediate2), GPRInfo::returnValueGPR);
+
+                emitFunctionEpilogue(jit);
+                jit.ret();
+            });
+            CHECK_EQ(invoke<uint64_t>(sub), static_cast<uint64_t>(immediate - immediate2));
+        }
+    }
+}
+
+void testSub64ArgImm32()
+{
+    for (auto immediate : int32Operands()) {
+        auto sub = compile([=] (CCallHelpers& jit) {
+            emitFunctionPrologue(jit);
+
+            jit.sub64(GPRInfo::argumentGPR0, CCallHelpers::TrustedImm32(immediate), GPRInfo::returnValueGPR);
+
+            emitFunctionEpilogue(jit);
+            jit.ret();
+        });
+
+        for (auto value : int64Operands())
+            CHECK_EQ(invoke<int64_t>(sub, value), static_cast<int64_t>(value - immediate));
+    }
+}
+
+void testSub64Imm64()
+{
+    for (auto immediate : int64Operands()) {
+        for (auto immediate2 : int64Operands()) {
+            auto sub = compile([=] (CCallHelpers& jit) {
+                emitFunctionPrologue(jit);
+
+                jit.move(CCallHelpers::TrustedImm64(immediate), GPRInfo::returnValueGPR);
+                jit.sub64(CCallHelpers::TrustedImm64(immediate2), GPRInfo::returnValueGPR);
+
+                emitFunctionEpilogue(jit);
+                jit.ret();
+            });
+            CHECK_EQ(invoke<uint64_t>(sub), static_cast<uint64_t>(immediate - immediate2));
+        }
+    }
+}
+
+void testSub64ArgImm64()
+{
+    for (auto immediate : int64Operands()) {
+        auto sub = compile([=] (CCallHelpers& jit) {
+            emitFunctionPrologue(jit);
+
+            jit.sub64(GPRInfo::argumentGPR0, CCallHelpers::TrustedImm64(immediate), GPRInfo::returnValueGPR);
+
+            emitFunctionEpilogue(jit);
+            jit.ret();
+        });
+
+        for (auto value : int64Operands())
+            CHECK_EQ(invoke<int64_t>(sub, value), static_cast<int64_t>(value - immediate));
+    }
+}
+
 void testMultiplySubSignExtend32()
 {
     // d = a - SExt32(n) * SExt32(m)
@@ -8530,21 +8425,6 @@ void run(const char* filter) WTF_IGNORES_THREAD_SAFETY_ANALYSIS
     RUN(testCountTrailingZeros64WithoutNullCheck());
     RUN(testShiftAndAdd());
     RUN(testStore64Imm64AddressPointer());
-
-    RUN(testAdd32Imm());
-    RUN(testAdd32ArgImm());
-    RUN(testAdd64Imm32());
-    RUN(testAdd64ArgImm32());
-    RUN(testAdd64Imm64());
-    RUN(testAdd64ArgImm64());
-
-    RUN(testSub32Args());
-    RUN(testSub32Imm());
-    RUN(testSub64Imm32());
-    RUN(testSub64ArgImm32());
-    RUN(testSub64Imm64());
-    RUN(testSub64ArgImm64());
-
 #endif
 
     RUN(testLoadAcq8SignedExtendTo32_Address_RegisterID());
@@ -8580,6 +8460,13 @@ void run(const char* filter) WTF_IGNORES_THREAD_SAFETY_ANALYSIS
     RUN(testMultiplySignExtend32());
     RUN(testMultiplyZeroExtend32());
 
+    RUN(testSub32Args());
+    RUN(testSub32Imm());
+    RUN(testSub64Imm32());
+    RUN(testSub64ArgImm32());
+    RUN(testSub64Imm64());
+    RUN(testSub64ArgImm64());
+
     RUN(testMultiplyAddSignExtend32());
     RUN(testMultiplyAddZeroExtend32());
     RUN(testMultiplySubSignExtend32());
diff --git a/Source/JavaScriptCore/b3/B3AbstractHeapRepository.h b/Source/JavaScriptCore/b3/B3AbstractHeapRepository.h
index c38f2302d2b7..79b06bedc113 100644
--- a/Source/JavaScriptCore/b3/B3AbstractHeapRepository.h
+++ b/Source/JavaScriptCore/b3/B3AbstractHeapRepository.h
@@ -270,6 +270,7 @@ namespace JSC::B3 {
     macro(JSWebAssemblyInstance_gcObjectStructureIDs) \
     macro(JSWebAssemblyInstance_importFunctionStubs) \
     macro(JSWebAssemblyInstance_tables) \
+    macro(JSWebAssemblyInstance_functionWrappers) \
 
 // This class is meant to be cacheable between compilations, but it doesn't have to be.
 // Doing so saves on creation of nodes. But clearing it will save memory.
diff --git a/Source/JavaScriptCore/bytecode/ArrayProfile.h b/Source/JavaScriptCore/bytecode/ArrayProfile.h
index 807c8e39a576..6b57f404a6e3 100644
--- a/Source/JavaScriptCore/bytecode/ArrayProfile.h
+++ b/Source/JavaScriptCore/bytecode/ArrayProfile.h
@@ -25,7 +25,6 @@
 
 #pragma once
 
-#include "ConcurrentJSLock.h"
 #include "Structure.h"
 #include <wtf/OptionSet.h>
 
@@ -228,9 +227,9 @@ class ArrayProfile {
 
     static constexpr uint64_t s_smallTypedArrayMaxLength = std::numeric_limits<int32_t>::max();
     void setMayBeLargeTypedArray() { m_arrayProfileFlags.add(ArrayProfileFlag::MayBeLargeTypedArray); }
-    bool mayBeLargeTypedArray(const ConcurrentJSLocker&) const { return m_arrayProfileFlags.contains(ArrayProfileFlag::MayBeLargeTypedArray); }
+    bool mayBeLargeTypedArray() const { return m_arrayProfileFlags.contains(ArrayProfileFlag::MayBeLargeTypedArray); }
 
-    bool mayBeResizableOrGrowableSharedTypedArray(const ConcurrentJSLocker&) const { return m_arrayProfileFlags.contains(ArrayProfileFlag::MayBeResizableOrGrowableSharedTypedArray); }
+    bool mayBeResizableOrGrowableSharedTypedArray() const { return m_arrayProfileFlags.contains(ArrayProfileFlag::MayBeResizableOrGrowableSharedTypedArray); }
 
     StructureID* addressOfSpeculationFailureStructureID() LIFETIME_BOUND { return &m_speculationFailureStructureID; }
     ArrayModes* addressOfArrayModes() LIFETIME_BOUND { return &m_observedArrayModes; }
@@ -252,15 +251,15 @@ class ArrayProfile {
     void observeArrayMode(ArrayModes mode) { m_observedArrayModes |= mode; }
     void NODELETE observeIndexedRead(JSCell*, unsigned index);
 
-    ArrayModes observedArrayModes(const ConcurrentJSLocker&) const { return m_observedArrayModes; }
-    bool mayInterceptIndexedAccesses(const ConcurrentJSLocker&) const { return m_arrayProfileFlags.contains(ArrayProfileFlag::MayInterceptIndexedAccesses);; }
-    
-    bool mayStoreToHole(const ConcurrentJSLocker&) const { return m_arrayProfileFlags.contains(ArrayProfileFlag::MayStoreHole); }
-    bool outOfBounds(const ConcurrentJSLocker&) const { return m_arrayProfileFlags.contains(ArrayProfileFlag::OutOfBounds); }
-    
-    bool usesOriginalArrayStructures(const ConcurrentJSLocker&) const { return !m_arrayProfileFlags.contains(ArrayProfileFlag::UsesNonOriginalArrayStructures); }
+    ArrayModes observedArrayModes() const { return m_observedArrayModes; }
+    bool mayInterceptIndexedAccesses() const { return m_arrayProfileFlags.contains(ArrayProfileFlag::MayInterceptIndexedAccesses); }
+
+    bool mayStoreToHole() const { return m_arrayProfileFlags.contains(ArrayProfileFlag::MayStoreHole); }
+    bool outOfBounds() const { return m_arrayProfileFlags.contains(ArrayProfileFlag::OutOfBounds); }
+
+    bool usesOriginalArrayStructures() const { return !m_arrayProfileFlags.contains(ArrayProfileFlag::UsesNonOriginalArrayStructures); }
 
-    bool mayBeRegExpMatchesArray(const ConcurrentJSLocker&) const { return m_arrayProfileFlags.contains(ArrayProfileFlag::MayBeRegExpMatchesArray); }
+    bool mayBeRegExpMatchesArray() const { return m_arrayProfileFlags.contains(ArrayProfileFlag::MayBeRegExpMatchesArray); }
 
     CString briefDescription(CodeBlock*);
     CString briefDescriptionWithoutUpdating();
diff --git a/Source/JavaScriptCore/bytecode/CodeBlock.cpp b/Source/JavaScriptCore/bytecode/CodeBlock.cpp
index 0f0e2c18637b..09d4dd4403e8 100644
--- a/Source/JavaScriptCore/bytecode/CodeBlock.cpp
+++ b/Source/JavaScriptCore/bytecode/CodeBlock.cpp
@@ -401,6 +401,20 @@ CodeBlock::CodeBlock(VM& vm, Structure* structure, ScriptExecutable* ownerExecut
     checker().set(CrashChecker::Metadata, checker().hash(this, m_metadata.get()));
 }
 
+static FunctionExecutable* instantiatedModuleFunctionExecutable(JSModuleEnvironment* moduleEnvironment, ScriptExecutable* topLevelExecutable, UnlinkedFunctionExecutable* unlinkedExecutable)
+{
+    SymbolTableEntry::Fast entry = moduleEnvironment->symbolTable()->get(unlinkedExecutable->name().impl());
+    if (entry.isNull())
+        return nullptr;
+    auto* function = dynamicDowncast<JSFunction>(moduleEnvironment->variableAt(entry.scopeOffset()).get());
+    if (!function)
+        return nullptr;
+    auto* executable = dynamicDowncast<FunctionExecutable>(function->executable());
+    if (!executable || executable->unlinkedExecutable() != unlinkedExecutable || executable->topLevelExecutable() != topLevelExecutable)
+        return nullptr;
+    return executable;
+}
+
 // The main purpose of this function is to generate linked bytecode from unlinked bytecode. The process
 // of linking is taking an abstract representation of bytecode and tying it to a GlobalObject and scope
 // chain. For example, this process allows us to cache the depth of lexical environment reads that reach
@@ -430,7 +444,9 @@ bool CodeBlock::finishCreation(VM& vm, ScriptExecutable* ownerExecutable, Unlink
 
     // We already have the cloned symbol table for the module environment since we need to instantiate
     // the module environments before linking the code block. We replace the stored symbol table with the already cloned one.
+    JSModuleEnvironment* moduleEnvironment = nullptr;
     if (UnlinkedModuleProgramCodeBlock* unlinkedModuleProgramCodeBlock = dynamicDowncast<UnlinkedModuleProgramCodeBlock>(unlinkedCodeBlock)) {
+        moduleEnvironment = uncheckedDowncast<JSModuleEnvironment>(scope);
         SymbolTable* clonedSymbolTable = uncheckedDowncast<ModuleProgramExecutable>(ownerExecutable)->moduleEnvironmentSymbolTable();
         if (m_unlinkedCode->wasCompiledWithTypeProfilerOpcodes()) {
             ConcurrentJSLocker locker(clonedSymbolTable->m_lock);
@@ -445,7 +461,10 @@ bool CodeBlock::finishCreation(VM& vm, ScriptExecutable* ownerExecutable, Unlink
         UnlinkedFunctionExecutable* unlinkedExecutable = unlinkedCodeBlock->functionDecl(i);
         if (shouldUpdateFunctionHasExecutedCache)
             vm.functionHasExecutedCache()->insertUnexecutedRange(ownerExecutable->sourceID(), unlinkedExecutable->unlinkedFunctionStart(), unlinkedExecutable->unlinkedFunctionEnd());
-        m_functionDecls[i].set(vm, this, unlinkedExecutable->link(vm, topLevelExecutable, ownerExecutable->source(), std::nullopt, NoIntrinsic, ownerExecutable->isInsideOrdinaryFunction()));
+        FunctionExecutable* executable = moduleEnvironment ? instantiatedModuleFunctionExecutable(moduleEnvironment, topLevelExecutable, unlinkedExecutable) : nullptr;
+        if (!executable)
+            executable = unlinkedExecutable->link(vm, topLevelExecutable, ownerExecutable->source(), std::nullopt, NoIntrinsic, ownerExecutable->isInsideOrdinaryFunction());
+        m_functionDecls[i].set(vm, this, executable);
     }
 
     m_functionExprs = FixedVector<WriteBarrier<FunctionExecutable>>(unlinkedCodeBlock->numberOfFunctionExprs());
@@ -1237,6 +1256,14 @@ void CodeBlock::visitChildren(Visitor& visitor)
 
     stronglyVisitStrongReferences(locker, visitor);
     stronglyVisitWeakReferences(locker, visitor);
+
+    // Update profiles from concurrent markers to reduce the cost of update at the GC end phase as its execution is serialized.
+    if constexpr (std::is_same_v<Visitor, SlotVisitor>) {
+        if (visitor.isFirstVisit() && JITCode::isBaselineCode(jitType())) {
+            updateAllNonLazyValueProfilePredictions();
+            updateAllLazyValueProfilePredictions();
+        }
+    }
     
     Heap::CodeBlockSpaceAndSet::setFor(*subspace()).add(this);
 }
@@ -2979,7 +3006,7 @@ void CodeBlock::didFailFTLCompilation()
 
 #endif
 
-ArrayProfile* CodeBlock::getArrayProfile(const ConcurrentJSLocker&, BytecodeIndex bytecodeIndex)
+ArrayProfile* CodeBlock::getArrayProfile(BytecodeIndex bytecodeIndex)
 {
     auto instruction = instructions().at(bytecodeIndex);
 
@@ -3167,7 +3194,7 @@ void CodeBlock::updateAllArrayAllocationProfilePredictions()
 
 // Folds each profile's sampled value into a pointer-free SpeculatedType and clears the sample.
 // The samples are untraced JSValues and StructureIDs, so this only runs while they are still
-// readable: after marking, before sweep.
+// readable, which means any time from marking up to the sweep that would free them.
 void CodeBlock::updateAllPredictions()
 {
     updateAllNonLazyValueProfilePredictions();
diff --git a/Source/JavaScriptCore/bytecode/CodeBlock.h b/Source/JavaScriptCore/bytecode/CodeBlock.h
index 64ac1db6e6a5..747bc94452d8 100644
--- a/Source/JavaScriptCore/bytecode/CodeBlock.h
+++ b/Source/JavaScriptCore/bytecode/CodeBlock.h
@@ -451,7 +451,7 @@ class CodeBlock : public JSCell {
 
     bool NODELETE couldTakeSpecialArithFastCase(BytecodeIndex bytecodeOffset);
 
-    ArrayProfile* NODELETE getArrayProfile(const ConcurrentJSLocker&, BytecodeIndex);
+    ArrayProfile* NODELETE getArrayProfile(BytecodeIndex);
 
     // Exception handling support
 
diff --git a/Source/JavaScriptCore/corpse/CMakeLists.txt b/Source/JavaScriptCore/corpse/CMakeLists.txt
new file mode 100644
index 000000000000..f36085a527cd
--- /dev/null
+++ b/Source/JavaScriptCore/corpse/CMakeLists.txt
@@ -0,0 +1,32 @@
+set(JavaScriptCoreTools_LIBRARY_TYPE STATIC)
+
+set(JavaScriptCoreTools_SOURCES
+    CorpseByteParser.cpp
+    CorpseClient.cpp
+    CorpseError.cpp
+    CorpseExportsTrie.cpp
+    CorpseProcess.cpp
+    CorpseRegion.cpp
+    CorpseSnapshot.cpp
+    CorpseSymbol.cpp
+    CorpseThread.cpp
+)
+
+set(JavaScriptCoreTools_PRIVATE_INCLUDE_DIRECTORIES
+    $<TARGET_PROPERTY:JavaScriptCore,INCLUDE_DIRECTORIES>
+)
+
+set(JavaScriptCoreTools_FRAMEWORKS
+    JavaScriptCore
+    WTF
+    bmalloc
+)
+
+WEBKIT_LIBRARY_DECLARE(JavaScriptCoreTools)
+
+WEBKIT_INCLUDE_CONFIG_FILES_IF_EXISTS()
+
+WEBKIT_LIBRARY(JavaScriptCoreTools)
+
+# The corpse sources use JavaScriptCore's generated headers.
+add_dependencies(JavaScriptCoreTools JavaScriptCore)
diff --git a/Source/JavaScriptCore/corpse/CorpseAddress.h b/Source/JavaScriptCore/corpse/CorpseAddress.h
new file mode 100644
index 000000000000..ac83749e83d2
--- /dev/null
+++ b/Source/JavaScriptCore/corpse/CorpseAddress.h
@@ -0,0 +1,100 @@
+/*
+ * Copyright (C) 2026 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
+
+#include <bit>
+#include <compare>
+#include <cstddef>
+#include <mach/mach.h>
+#include <stdint.h>
+
+#if CPU(ARM64E)
+#include <ptrauth.h>
+#endif
+
+namespace JSC {
+namespace Corpse {
+
+// An address in the target corpse process. A corpse address can never be dereferenced
+// by accident.
+class Address {
+public:
+    Address() = default;
+    explicit Address(mach_vm_address_t value)
+        : m_value(value)
+    {
+    }
+    explicit Address(const void* pointer)
+        : m_value(reinterpret_cast<mach_vm_address_t>(pointer))
+    {
+    }
+
+    mach_vm_address_t toMachVMAddress() const { return m_value; }
+    explicit operator bool() const { return m_value; }
+    template<typename T> explicit operator T() const = delete;
+
+    Address stripped() const
+    {
+#if CPU(ARM64E)
+        // We don't know if this is a code or data pointer. The 2 have different number of
+        // bits. But we know that code pointers have more PAC bits. So, we'll conservatively
+        // use XPACI to strip the max number of PAC bits.
+        auto stripped = ptrauth_strip(reinterpret_cast<void*>(m_value), ptrauth_key_process_dependent_code);
+
+        // While XPACI may have already stripped the MTE tag in data pointers as well,
+        // we don't want to assume that code pointer PAC bits will always cover the MTE
+        // nibble or non-zero data pointer top-bytes due to TBI (Top Byte Ignore). So,
+        // let's explicitly clear the top byte to be sure.
+        constexpr uintptr_t topByte = 0xffull << 56;
+        uintptr_t strippedInt = std::bit_cast<uintptr_t>(stripped);
+        strippedInt &= ~topByte;
+
+        return Address(std::bit_cast<void*>(strippedInt));
+#else
+        return *this;
+#endif
+    }
+
+    friend bool operator==(Address, Address) = default;
+    friend auto operator<=>(Address, Address) = default;
+
+    friend bool operator==(Address address, std::nullptr_t) { return !address.m_value; }
+
+    Address operator+(uint64_t offset) const { return Address(m_value + offset); }
+    Address operator-(uint64_t offset) const { return Address(m_value - offset); }
+
+    uint64_t operator-(Address other) const { return m_value - other.m_value; }
+
+private:
+    mach_vm_address_t m_value { 0 };
+};
+
+} // namespace Corpse
+} // namespace JSC
+
+#endif // (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
diff --git a/Source/JavaScriptCore/corpse/CorpseByteParser.cpp b/Source/JavaScriptCore/corpse/CorpseByteParser.cpp
new file mode 100644
index 000000000000..ea65768b3344
--- /dev/null
+++ b/Source/JavaScriptCore/corpse/CorpseByteParser.cpp
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2026 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "CorpseByteParser.h"
+
+#if (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
+
+#include <wtf/LEBDecoder.h>
+#include <wtf/StdLibExtras.h>
+
+namespace JSC {
+namespace Corpse {
+
+std::optional<uint8_t> ByteParser::consumeByte()
+{
+    if (m_position >= m_data.size())
+        return std::nullopt;
+    return m_data[m_position++];
+}
+
+std::optional<uint64_t> ByteParser::consumeULEB128()
+{
+    size_t start = m_position;
+    uint64_t result = 0;
+    if (WTF::LEBDecoder::decodeUInt64(m_data, m_position, result))
+        return result;
+    m_position = start;
+    return std::nullopt;
+}
+
+std::optional<std::string_view> ByteParser::consumeCString()
+{
+    size_t start = m_position;
+    while (m_position < m_data.size() && m_data[m_position])
+        ++m_position;
+    if (m_position >= m_data.size()) {
+        m_position = start;
+        return std::nullopt;
+    }
+    std::string_view result(spanReinterpretCast<const char>(m_data.subspan(start, m_position - start)));
+    ++m_position; // Consume the null terminator.
+    return result;
+}
+
+} // namespace Corpse
+} // namespace JSC
+
+#endif // (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
diff --git a/Source/JavaScriptCore/corpse/CorpseByteParser.h b/Source/JavaScriptCore/corpse/CorpseByteParser.h
new file mode 100644
index 000000000000..f5c404e03c1b
--- /dev/null
+++ b/Source/JavaScriptCore/corpse/CorpseByteParser.h
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2026 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
+
+#include <optional>
+#include <span>
+#include <stdint.h>
+#include <string_view>
+
+namespace JSC {
+namespace Corpse {
+
+// A forward byte parser over a local buffer. Every read reports whether it got
+// what it asked for, and a read that fails consumes nothing.
+class ByteParser {
+public:
+    ByteParser(std::span<const uint8_t> data, size_t position = 0)
+        : m_data(data)
+        , m_position(position)
+    {
+    }
+
+    size_t position() const { return m_position; }
+
+    std::optional<uint8_t> consumeByte();
+
+    // Decodes the ULEB128 at the cursor. Returns nullopt if the buffer ends
+    // before the encoding does, or if the value will not fit in 64 bits.
+    // Untrusted data can hold either, and silently truncating one would yield a
+    // plausible wrong value instead of a detected failure.
+    std::optional<uint64_t> consumeULEB128();
+
+    // Returns the null-terminated string at the cursor. Returns nullopt if the
+    // buffer ends before the terminator does: without that the trailing bytes of
+    // a truncated buffer read back as a complete string.
+    std::optional<std::string_view> consumeCString();
+
+private:
+    std::span<const uint8_t> m_data;
+    size_t m_position;
+};
+
+} // namespace Corpse
+} // namespace JSC
+
+#endif // (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
diff --git a/Source/JavaScriptCore/corpse/CorpseClient.cpp b/Source/JavaScriptCore/corpse/CorpseClient.cpp
new file mode 100644
index 000000000000..800479f273de
--- /dev/null
+++ b/Source/JavaScriptCore/corpse/CorpseClient.cpp
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2026 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "CorpseClient.h"
+
+#if (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
+
+namespace JSC {
+namespace Corpse {
+
+ASCIILiteral Client::s_clientName = "JSC::Corpse"_s; // Default if not set.
+
+void Client::setName(ASCIILiteral name)
+{
+    if (!name.isEmpty())
+        s_clientName = name;
+}
+
+} // namespace Corpse
+} // namespace JSC
+
+#endif // (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
diff --git a/Source/WebKit/NetworkProcess/EarlyHintsResourceLoader.h b/Source/JavaScriptCore/corpse/CorpseClient.h
similarity index 54%
rename from Source/WebKit/NetworkProcess/EarlyHintsResourceLoader.h
rename to Source/JavaScriptCore/corpse/CorpseClient.h
index 14aa69a3ca2e..b5ab8c1c380a 100644
--- a/Source/WebKit/NetworkProcess/EarlyHintsResourceLoader.h
+++ b/Source/JavaScriptCore/corpse/CorpseClient.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Apple Inc. All rights reserved.
+ * Copyright (C) 2026 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -25,35 +25,27 @@
 
 #pragma once
 
-#include "NetworkResourceLoader.h"
-#include <wtf/TZoneMalloc.h>
+#if (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
 
-namespace WebCore {
-class LinkHeader;
-}
+#include <wtf/text/ASCIILiteral.h>
 
-namespace WebKit {
+namespace JSC {
+namespace Corpse {
 
-class EarlyHintsResourceLoader
-    : public WebCore::ContentSecurityPolicyClient {
-    WTF_MAKE_TZONE_ALLOCATED(EarlyHintsResourceLoader);
-    WTF_MAKE_NONCOPYABLE(EarlyHintsResourceLoader);
-public:
-    explicit EarlyHintsResourceLoader(NetworkResourceLoader&);
-    virtual ~EarlyHintsResourceLoader();
+// Currently, this is only to allow the client application to set the client name
+// during initialization so that error messages identify with the client instead
+// of the corpse library.
 
-    void handleEarlyHintsResponse(WebCore::ResourceResponse&&);
+class Client {
+public:
+    static void setName(ASCIILiteral);
+    static ASCIILiteral name() { return s_clientName; }
 
 private:
-    // ContentSecurityPolicyClient
-    void addConsoleMessage(MessageSource, MessageLevel, const String&, unsigned long requestIdentifier = 0) final;
-    void enqueueSecurityPolicyViolationEvent(WebCore::SecurityPolicyViolationEventInit&&) final;
-
-    WebCore::ResourceRequest constructPreconnectRequest(const WebCore::ResourceRequest&, const URL&);
-    void startPreconnectTask(const URL& baseURL, const WebCore::LinkHeader&, const WebCore::ContentSecurityPolicy&);
-
-    WeakPtr<NetworkResourceLoader> m_loader;
-    bool m_hasReceivedEarlyHints { false };
+    static ASCIILiteral s_clientName;
 };
 
-} // namespace WebKit
+} // namespace Corpse
+} // namespace JSC
+
+#endif // (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
diff --git a/Source/JavaScriptCore/corpse/CorpseError.cpp b/Source/JavaScriptCore/corpse/CorpseError.cpp
new file mode 100644
index 000000000000..0f7ea774d502
--- /dev/null
+++ b/Source/JavaScriptCore/corpse/CorpseError.cpp
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2026 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "CorpseError.h"
+
+#if (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
+
+#include "CorpseClient.h"
+
+#include <stdarg.h>
+#include <stdio.h>
+
+WTF_ALLOW_UNSAFE_BUFFER_USAGE_BEGIN
+
+namespace JSC {
+namespace Corpse {
+
+void Error::report(const char* format, ...)
+{
+    fprintf(stderr, "%s: ", Client::name().characters());
+
+    va_list args;
+    va_start(args, format);
+    vfprintf(stderr, format, args);
+    va_end(args);
+
+    fputc('\n', stderr);
+}
+
+} // namespace Corpse
+} // namespace JSC
+
+WTF_ALLOW_UNSAFE_BUFFER_USAGE_END
+
+#endif // (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
diff --git a/Source/JavaScriptCore/corpse/CorpseError.h b/Source/JavaScriptCore/corpse/CorpseError.h
new file mode 100644
index 000000000000..6a4ab690dd75
--- /dev/null
+++ b/Source/JavaScriptCore/corpse/CorpseError.h
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2026 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
+
+#include <wtf/Assertions.h>
+
+namespace JSC {
+namespace Corpse {
+
+// Reports the library's diagnostics. Messages are prefixed with the name the
+// client set via Corpse::Client, so they read as the client's own output.
+class Error {
+public:
+    static void report(const char* format, ...) WTF_ATTRIBUTE_PRINTF(1, 2);
+};
+
+} // namespace Corpse
+} // namespace JSC
+
+#endif // (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
diff --git a/Source/JavaScriptCore/corpse/CorpseExportsTrie.cpp b/Source/JavaScriptCore/corpse/CorpseExportsTrie.cpp
new file mode 100644
index 000000000000..da6fa47ec71a
--- /dev/null
+++ b/Source/JavaScriptCore/corpse/CorpseExportsTrie.cpp
@@ -0,0 +1,144 @@
+/*
+ * Copyright (C) 2026 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "CorpseExportsTrie.h"
+
+#if (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
+
+#include <mach-o/loader.h>
+#include <optional>
+
+namespace JSC {
+namespace Corpse {
+
+// The bits that Mach-O defines in an exports trie terminal's flags.
+constexpr uint64_t knownExportFlagBits = EXPORT_SYMBOL_FLAGS_KIND_MASK
+    | EXPORT_SYMBOL_FLAGS_WEAK_DEFINITION
+    | EXPORT_SYMBOL_FLAGS_REEXPORT
+    | EXPORT_SYMBOL_FLAGS_STUB_AND_RESOLVER
+    | EXPORT_SYMBOL_FLAGS_STATIC_RESOLVER;
+
+Expected<ExportsTrie::Export, ExportsTrie::Failure> ExportsTrie::lookUp(std::span<const uint8_t> trie, std::string_view name)
+{
+    size_t nodeOffset = 0;
+    std::string_view remaining = name;
+
+    // The only way around this loop is by matching an edge, which consumes at least
+    // one character of the `remaining` name we're searching for. Because empty edges
+    // are rejected below, the walk is bounded by the length of the name no matter
+    // what the trie's child offsets say, and cannot be made to revisit a node forever.
+    while (nodeOffset < trie.size()) {
+        ByteParser node(trie, nodeOffset);
+
+        // A terminal node in a dyld exports trie is: a length, then flags, then some
+        // ULEB128s whose meaning depends on the flags. See mach-o/loader.h around lines
+        // 1488–1499 for details.
+        auto terminalLength = node.consumeULEB128();
+        if (!terminalLength)
+            return makeUnexpected(Failure::Malformed);
+
+        // terminalLength is a full 64-bit value out of the trie, so it is compared
+        // against what is left of the trie rather than by forming position + terminalLength,
+        // which could wrap and pass a direct comparison. The subtraction is safe because
+        // consumeULEB128 stops at the end of the trie, so the position cannot have passed it.
+        if (*terminalLength > trie.size() - node.position())
+            return makeUnexpected(Failure::Malformed);
+        size_t childrenPosition = node.position() + *terminalLength;
+
+        if (remaining.empty() && *terminalLength) {
+            // The payload is read through a parser bounded to the terminal, so that a
+            // terminal declaring less than the flags and offset it needs cannot be made
+            // to take the bytes that follow it as its own.
+            ByteParser terminal(trie.subspan(node.position(), *terminalLength));
+            auto flags = terminal.consumeULEB128();
+            if (!flags)
+                return makeUnexpected(Failure::Malformed);
+            if (*flags & ~knownExportFlagBits)
+                return makeUnexpected(Failure::Malformed);
+            if (*flags & EXPORT_SYMBOL_FLAGS_REEXPORT)
+                return makeUnexpected(Failure::ReExport);
+
+            Export::Kind kind;
+            switch (*flags & EXPORT_SYMBOL_FLAGS_KIND_MASK) {
+            case EXPORT_SYMBOL_FLAGS_KIND_REGULAR:
+                kind = Export::Kind::Regular;
+                break;
+            case EXPORT_SYMBOL_FLAGS_KIND_ABSOLUTE:
+                kind = Export::Kind::Absolute; // the value is the address itself.
+                break;
+            default:
+                // Thread-local, or a kind postdating this code. A thread-local's value
+                // is the offset of its TLV descriptor, not of the variable, and the
+                // variable's address differs per thread, so there is no one answer to
+                // report. Saying nothing beats reporting the descriptor as if it were
+                // the variable.
+                return makeUnexpected(Failure::UnsupportedKind);
+            }
+
+            auto value = terminal.consumeULEB128();
+            if (!value)
+                return makeUnexpected(Failure::Malformed);
+            return Export { kind, *value };
+        }
+
+        ByteParser children(trie, childrenPosition);
+        auto childCount = children.consumeByte();
+        if (!childCount)
+            return makeUnexpected(Failure::Malformed);
+
+        std::optional<uint64_t> nextNodeOffset;
+        for (uint8_t i = 0; i < *childCount; ++i) {
+            auto edge = children.consumeCString();
+            if (!edge)
+                return makeUnexpected(Failure::Malformed);
+            // An edge carries the characters that tell a node's children apart,
+            // so an empty one is malformed. It would also match anything, and
+            // descending on it would consume none of the name.
+            if (edge->empty())
+                return makeUnexpected(Failure::Malformed);
+            auto childOffset = children.consumeULEB128();
+            if (!childOffset)
+                return makeUnexpected(Failure::Malformed);
+            if (remaining.starts_with(*edge)) {
+                remaining.remove_prefix(edge->size());
+                nextNodeOffset = childOffset;
+                break;
+            }
+        }
+        // No edge matched what is left of the name, so nothing below this node
+        // can hold it. A node with no children ends the walk the same way.
+        if (!nextNodeOffset)
+            return makeUnexpected(Failure::Absent);
+        nodeOffset = *nextNodeOffset;
+    }
+    // A child offset led to or past the end of the trie.
+    return makeUnexpected(Failure::Malformed);
+}
+
+} // namespace Corpse
+} // namespace JSC
+
+#endif // (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
diff --git a/Source/JavaScriptCore/corpse/CorpseExportsTrie.h b/Source/JavaScriptCore/corpse/CorpseExportsTrie.h
new file mode 100644
index 000000000000..f86d4bec637f
--- /dev/null
+++ b/Source/JavaScriptCore/corpse/CorpseExportsTrie.h
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2026 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
+
+#include <JavaScriptCore/CorpseByteParser.h>
+#include <span>
+#include <stdint.h>
+#include <string_view>
+#include <wtf/Expected.h>
+
+namespace JSC {
+namespace Corpse {
+
+// The dyld exports trie of one Mach-O image: a prefix tree over exported symbol
+// names, whose terminals say how to compute each symbol's address.
+//
+// A trie read out of a corpse is untrusted input, so the walk is bounded and a
+// malformed encoding is reported rather than guessed at.
+class ExportsTrie {
+public:
+    // A matched terminal, and how to turn it into an address.
+    struct Export {
+        enum class Kind : uint8_t {
+            Regular, // An offset from the image's base address.
+            Absolute, // Already an address, not relative to the image.
+        };
+        Kind kind { Kind::Regular };
+        uint64_t value { 0 };
+    };
+
+    enum class Failure : uint8_t {
+        Absent,
+        Malformed, // An encoding did not decode, or an offset led outside the trie.
+        ReExport, // Matched, but the symbol is defined in another image.
+        UnsupportedKind, // Matched, but the kind has no one address, such as a thread-local.
+    };
+
+    static Expected<Export, Failure> lookUp(std::span<const uint8_t> trie, std::string_view name);
+};
+
+} // namespace Corpse
+} // namespace JSC
+
+#endif // (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
diff --git a/Source/JavaScriptCore/corpse/CorpseProcess.cpp b/Source/JavaScriptCore/corpse/CorpseProcess.cpp
new file mode 100644
index 000000000000..d980d94701c0
--- /dev/null
+++ b/Source/JavaScriptCore/corpse/CorpseProcess.cpp
@@ -0,0 +1,110 @@
+/*
+ * Copyright (C) 2026 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "CorpseProcess.h"
+
+#if (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
+
+#include "CorpseError.h"
+
+#include <errno.h>
+#include <mach/mach.h>
+#include <mach/mach_error.h>
+#include <mach/mach_traps.h>
+#include <signal.h>
+#include <sys/proc.h>
+#include <sys/sysctl.h>
+
+WTF_ALLOW_UNSAFE_BUFFER_USAGE_BEGIN
+
+namespace JSC {
+namespace Corpse {
+
+// A task port name outlives the task it named: when the target exits, the right we
+// hold becomes a dead name while the name itself is unchanged. MACH_PORT_VALID only
+// looks at the name, so it keeps reporting the port as good. Asking the kernel which
+// pid the port names is what tells a still-attached process apart from one that has
+// since exited -- and, because the answer is compared against m_pid, from a later
+// process that inherited the same pid.
+bool Process::holdsLiveTask() const
+{
+    if (!MACH_PORT_VALID(m_taskPort))
+        return false;
+    int pid = -1;
+    return pid_for_task(m_taskPort, &pid) == KERN_SUCCESS && pid == m_pid;
+}
+
+bool Process::isTranslated() const
+{
+    struct kinfo_proc info;
+    size_t length = sizeof info;
+    int selector[4] = { CTL_KERN, KERN_PROC, KERN_PROC_PID, m_pid };
+    // A pid that no longer exists is not an error here: sysctl succeeds and reports
+    // that it wrote nothing, so the size has to be checked rather than the result.
+    if (sysctl(selector, 4, &info, &length, nullptr, 0) || length < sizeof info)
+        return false;
+    return info.kp_proc.p_flag & P_TRANSLATED;
+}
+
+bool Process::attach()
+{
+    if (isAttached()) {
+        if (holdsLiveTask())
+            return true;
+        // The target exited while we held its port.
+        detach();
+    }
+
+    mach_port_t taskPort = MACH_PORT_NULL;
+    kern_return_t kr = task_for_pid(mach_task_self(), m_pid, &taskPort);
+    if (kr == KERN_SUCCESS) {
+        m_taskPort = taskPort;
+        return true;
+    }
+
+    if (kill(m_pid, 0) && errno == ESRCH)
+        Error::report("No process with PID %d", static_cast<int>(m_pid));
+    else {
+        Error::report("Could not attach to PID %u: %s (0x%x) -- may need to run as root "
+            "or add the appropriate debugger entitlement",
+            static_cast<unsigned>(m_pid), mach_error_string(kr), kr);
+    }
+    return false;
+}
+
+void Process::detach()
+{
+    if (MACH_PORT_VALID(m_taskPort))
+        mach_port_deallocate(mach_task_self(), m_taskPort);
+    m_taskPort = MACH_PORT_NULL;
+}
+
+} // namespace Corpse
+} // namespace JSC
+
+WTF_ALLOW_UNSAFE_BUFFER_USAGE_END
+
+#endif // (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
diff --git a/Source/JavaScriptCore/corpse/CorpseProcess.h b/Source/JavaScriptCore/corpse/CorpseProcess.h
new file mode 100644
index 000000000000..83df1bda88e1
--- /dev/null
+++ b/Source/JavaScriptCore/corpse/CorpseProcess.h
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2026 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
+
+#include <mach/mach.h>
+#include <sys/types.h>
+#include <wtf/Assertions.h>
+#include <wtf/Ref.h>
+#include <wtf/RefCounted.h>
+
+namespace JSC {
+namespace Corpse {
+
+// Represents a target corpse process identified by PID. It manages the Mach task
+// port for that process: attach() acquires it, detach() releases it (but keeps the
+// PID so the same Process can be reattached later).
+class Process final : public RefCounted<Process> {
+public:
+    static Ref<Process> create(pid_t pid) { return adoptRef(*new Process(pid)); }
+
+    ~Process() { detach(); }
+
+    bool attach();
+    void detach();
+
+    pid_t pid() const { return m_pid; }
+    mach_port_t taskPort() const { return m_taskPort; }
+
+    bool isAttached() const { return MACH_PORT_VALID(m_taskPort); }
+
+    // The target process may have terminated while we still hold the port.
+    bool holdsLiveTask() const;
+
+    // True if the target runs under Rosetta translation. Such a process executes as
+    // arm64 whatever its own architecture is, so its thread state describes the
+    // translator rather than the program, and cannot be read as the program's.
+    bool isTranslated() const;
+
+private:
+    explicit Process(pid_t pid)
+        : m_pid(pid)
+    {
+        RELEASE_ASSERT(pid > 0);
+    }
+
+    pid_t m_pid;
+    mach_port_t m_taskPort { MACH_PORT_NULL };
+};
+
+} // namespace Corpse
+} // namespace JSC
+
+#endif // (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
diff --git a/Source/JavaScriptCore/corpse/CorpseRegion.cpp b/Source/JavaScriptCore/corpse/CorpseRegion.cpp
new file mode 100644
index 000000000000..7d912d228ca3
--- /dev/null
+++ b/Source/JavaScriptCore/corpse/CorpseRegion.cpp
@@ -0,0 +1,75 @@
+/*
+ * Copyright (C) 2026 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "CorpseRegion.h"
+
+#if (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
+
+#include <mach/mach_vm.h>
+
+namespace JSC {
+namespace Corpse {
+
+uint64_t Region::pageCount() const
+{
+    return vm_kernel_page_size ? m_size / vm_kernel_page_size : 0;
+}
+
+std::optional<Region> Region::findContaining(mach_port_t task, Address address)
+{
+    // mach_vm_region_recurse reports the region at or above the address it is given,
+    // so the result only describes `address` if it turns out to contain it.
+    mach_vm_address_t regionAddress = 0;
+    mach_vm_size_t regionSize = 0;
+    vm_region_submap_info_data_64_t info;
+    for (natural_t depth = 0; ; ++depth) {
+        regionAddress = address.toMachVMAddress();
+        regionSize = 0;
+        natural_t depthLimit = depth; // We tell the kernel how deep we want to go. Kernel tells us how deep it can go.
+        mach_msg_type_number_t infoCount = VM_REGION_SUBMAP_INFO_COUNT_64;
+        kern_return_t kr = mach_vm_region_recurse(task, &regionAddress, &regionSize,
+            &depthLimit, reinterpret_cast<vm_region_recurse_info_t>(&info), &infoCount);
+        if (kr != KERN_SUCCESS)
+            return std::nullopt;
+        if (!info.is_submap)
+            break;
+    }
+
+    Region region;
+    region.m_base = Address(regionAddress);
+    region.m_size = static_cast<size_t>(regionSize);
+    if (!region.contains(address))
+        return std::nullopt;
+
+    region.m_residentPageCount = info.pages_resident;
+    region.m_dirtyPageCount = info.pages_dirtied;
+    return region;
+}
+
+} // namespace Corpse
+} // namespace JSC
+
+#endif // (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
diff --git a/Source/JavaScriptCore/corpse/CorpseRegion.h b/Source/JavaScriptCore/corpse/CorpseRegion.h
new file mode 100644
index 000000000000..d2bfcaa0adb6
--- /dev/null
+++ b/Source/JavaScriptCore/corpse/CorpseRegion.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2026 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
+
+#include <JavaScriptCore/CorpseAddress.h>
+#include <mach/mach.h>
+#include <optional>
+#include <stdint.h>
+
+namespace JSC {
+namespace Corpse {
+
+// One mapped region of a task's address space, as the kernel describes it.
+class Region {
+public:
+    // The region containing `address`, or nullopt if not found in any region.
+    static std::optional<Region> findContaining(mach_port_t task, Address);
+
+    Address base() const { return m_base; }
+    size_t size() const { return m_size; }
+    Address end() const { return m_base + m_size; }
+    bool contains(Address address) const { return address >= m_base && address < end(); }
+
+    uint64_t pageCount() const;
+    uint64_t residentPageCount() const { return m_residentPageCount; }
+    uint64_t dirtyPageCount() const { return m_dirtyPageCount; }
+
+private:
+    Address m_base;
+    size_t m_size { 0 };
+    uint64_t m_residentPageCount { 0 };
+    uint64_t m_dirtyPageCount { 0 };
+};
+
+} // namespace Corpse
+} // namespace JSC
+
+#endif // (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
diff --git a/Source/JavaScriptCore/corpse/CorpseSnapshot.cpp b/Source/JavaScriptCore/corpse/CorpseSnapshot.cpp
new file mode 100644
index 000000000000..14107ca4c9c5
--- /dev/null
+++ b/Source/JavaScriptCore/corpse/CorpseSnapshot.cpp
@@ -0,0 +1,98 @@
+/*
+ * Copyright (C) 2026 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "CorpseSnapshot.h"
+
+#if (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
+
+#include "CorpseError.h"
+
+#include <mach/mach.h>
+#include <mach/mach_error.h>
+#include <wtf/TZoneMallocInlines.h>
+
+WTF_ALLOW_UNSAFE_BUFFER_USAGE_BEGIN
+
+namespace JSC {
+namespace Corpse {
+
+WTF_MAKE_TZONE_ALLOCATED_IMPL(Snapshot);
+
+unsigned Snapshot::s_nextId = 1;
+
+Snapshot::Snapshot(RefPtr<Process> process)
+    : m_process(WTF::move(process))
+    , m_id(s_nextId++)
+{
+    if (!m_process || !m_process->isAttached())
+        return;
+
+    // Snapshot the target into a corpse; only a read port is required from here
+    // on, and the corpse is independent of the live target.
+    kern_return_t kr = task_generate_corpse(m_process->taskPort(), &m_corpsePort);
+    if (kr != KERN_SUCCESS) {
+        m_corpsePort = MACH_PORT_NULL;
+        if (!m_process->holdsLiveTask()) {
+            Error::report("Could not snapshot PID %d: the process has terminated",
+                static_cast<int>(m_process->pid()));
+        } else {
+            Error::report("Could not snapshot PID %d: %s (0x%x)",
+                static_cast<int>(m_process->pid()), mach_error_string(kr), kr);
+        }
+    }
+}
+
+Snapshot::~Snapshot()
+{
+    if (isValid())
+        mach_port_deallocate(mach_task_self(), m_corpsePort);
+}
+
+const Vector<Thread>& Snapshot::threads()
+{
+    if (!m_threads)
+        m_threads = Thread::collect(*this);
+    return *m_threads;
+}
+
+Address Snapshot::symbol(const char* name)
+{
+    if (!name || !*name)
+        return { };
+
+    auto entry = m_symbols.ensure<StringViewHashTranslator>(StringView::fromLatin1(name), [&] {
+        return WTF::makeUnique<Symbol>(*this, name);
+    });
+
+    return entry.iterator->value->address();
+}
+
+} // namespace Corpse
+} // namespace JSC
+
+WTF_ALLOW_UNSAFE_BUFFER_USAGE_END
+
+#endif // (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
diff --git a/Source/JavaScriptCore/corpse/CorpseSnapshot.h b/Source/JavaScriptCore/corpse/CorpseSnapshot.h
new file mode 100644
index 000000000000..3013bf605022
--- /dev/null
+++ b/Source/JavaScriptCore/corpse/CorpseSnapshot.h
@@ -0,0 +1,101 @@
+/*
+ * Copyright (C) 2026 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
+
+#include <JavaScriptCore/CorpseAddress.h>
+#include <JavaScriptCore/CorpseProcess.h>
+#include <JavaScriptCore/CorpseSymbol.h>
+#include <JavaScriptCore/CorpseThread.h>
+#include <mach/mach.h>
+#include <memory>
+#include <optional>
+#include <utility>
+#include <wtf/DoublyLinkedList.h>
+#include <wtf/HashMap.h>
+#include <wtf/RefPtr.h>
+#include <wtf/StdLibExtras.h>
+#include <wtf/TZoneMalloc.h>
+#include <wtf/Vector.h>
+#include <wtf/text/StringHash.h>
+#include <wtf/text/StringView.h>
+#include <wtf/text/WTFString.h>
+
+namespace JSC {
+namespace Corpse {
+
+// Owns a corpse (a read-only Mach snapshot of a process)
+// Check isValid() to see whether acquisition succeeded.
+//
+// Snapshots are linked into a DoublyLinkedList by their owner. The list is
+// intrusive and does not own its nodes: whoever appends a Snapshot must remove
+// it from the list before destroying it.
+class Snapshot : public DoublyLinkedListNode<Snapshot> {
+    WTF_MAKE_TZONE_ALLOCATED(Snapshot);
+public:
+    explicit Snapshot(RefPtr<Process>);
+    ~Snapshot();
+
+    Snapshot(const Snapshot&) = delete;
+    Snapshot& operator=(const Snapshot&) = delete;
+    Snapshot(Snapshot&& other) = delete;
+
+    bool isValid() const { return MACH_PORT_VALID(m_corpsePort); }
+
+    // A monotonically increasing identifier assigned at construction. IDs are
+    // never reused, so they stay stable as snapshots are added and removed.
+    unsigned id() const { return m_id; }
+
+    Process* process() const { return m_process.get(); }
+    mach_port_t corpsePort() const { return m_corpsePort; }
+
+    // The threads captured in this corpse, read and cached on the first call.
+    const Vector<Thread>& threads();
+
+    // The address of `name` in this corpse, null if it is not there.
+    Address symbol(const char* name);
+
+private:
+    static unsigned s_nextId;
+
+    RefPtr<Process> m_process;
+    mach_port_t m_corpsePort { MACH_PORT_NULL };
+    unsigned m_id;
+
+    std::optional<Vector<Thread>> m_threads;
+    HashMap<String, std::unique_ptr<Symbol>> m_symbols;
+
+    Snapshot* m_prev { nullptr }; // Required by DoublyLinkedListNode.
+    Snapshot* m_next { nullptr }; // Required by DoublyLinkedListNode.
+
+    friend class WTF::DoublyLinkedListNode<Snapshot>;
+};
+
+} // namespace Corpse
+} // namespace JSC
+
+#endif // (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
diff --git a/Source/JavaScriptCore/corpse/CorpseSymbol.cpp b/Source/JavaScriptCore/corpse/CorpseSymbol.cpp
new file mode 100644
index 000000000000..a968dfa30a1b
--- /dev/null
+++ b/Source/JavaScriptCore/corpse/CorpseSymbol.cpp
@@ -0,0 +1,481 @@
+/*
+ * Copyright (C) 2026 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "CorpseSymbol.h"
+
+#if (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
+
+#include "CorpseError.h"
+#include "CorpseExportsTrie.h"
+#include "CorpseSnapshot.h"
+
+#include <mach-o/dyld_images.h>
+#include <mach-o/loader.h>
+#include <mach/mach.h>
+#include <mach/mach_vm.h>
+#include <mach/task_info.h>
+#include <optional>
+#include <span>
+#include <string.h>
+#include <string_view>
+#include <type_traits>
+#include <wtf/StdLibExtras.h>
+#include <wtf/TZoneMallocInlines.h>
+#include <wtf/Vector.h>
+#include <wtf/text/StringCommon.h>
+
+#if CORPSE_SYMBOL_LOOKUP_DIAGNOSTICS
+#define CORPSE_DIAGNOSTIC_DO(statement) statement
+#else
+#define CORPSE_DIAGNOSTIC_DO(statement) ((void)0)
+#endif
+
+namespace JSC {
+namespace Corpse {
+
+WTF_MAKE_TZONE_ALLOCATED_IMPL(Symbol);
+
+// It is assumed that this corpse analysis library is built with the same SDK targeting
+// the same OS that the corpse binary is built for. While the corpse gives us the data
+// to inspect, it does not provide the format. Hence, we need to rely on the invariant
+// that this analysis library is built with the same understanding of the same data
+// format used in the corpse. This is how we can walk and interpret the corpse's
+// dyld exports trie and get addresses of symbols.
+
+namespace {
+
+// Sizes and counts read out of a corpse are used to bound loops and to size
+// allocations, so they are checked against these limits first. Each one is a
+// sanity check on a single value: it says the struct we read was not what we
+// thought it was, in which case the addresses in it are not worth chasing. They
+// are not a bound on the work a lookup can do, because the per-image limits
+// multiply by the image count. maxTotalBytesRead below is that bound.
+//
+// The values sit above what was empirically measured: across every Mach-O image
+// installed on a sample system the largest load commands were 7.4 KB and the
+// largest exports trie 2.1 MB, and a process that dlopens every framework on the
+// system reaches about 2,800 images.
+constexpr size_t maxLoadCommandsSize = 128 * KB; // About 17× the measured maximum.
+constexpr size_t maxExportsTrieSize = 16 * MB; // About 8× the measured maximum.
+constexpr uint32_t maxImageCount = 16 * 1024; // About 6× the measured maximum.
+
+// A lookup that finds nothing will read every image's load commands and exports
+// trie, which measured 101 MB for the ~2,800 image process above and 0.4 MB for
+// a small one. This caps the total for one lookup, so a corpse claiming many
+// large images cannot turn a single symbol lookup into unbounded copying.
+constexpr size_t maxTotalBytesRead = 256 * MB; // About 2.5× the measured maximum.
+
+// Copies data from a corpse task's virtual address space.
+// FIXME: This is a temporary "get things to work solution", and will be replaced with
+// a more efficient memory access from a page manager later that eliminates copying.
+class TaskMemory {
+public:
+    explicit TaskMemory(mach_port_t task)
+        : m_task(task)
+    {
+    }
+
+    template<typename T>
+    std::optional<T> read(Address address) const
+    {
+        static_assert(std::is_trivially_copyable_v<T>);
+        T out;
+        if (!readRaw(address, &out, sizeof out))
+            return std::nullopt;
+        return out;
+    }
+
+    std::optional<Vector<uint8_t>> readBytes(Address address, size_t length) const
+    {
+        Vector<uint8_t> buffer;
+        // Callers derive `length` from the corpse, so failing to allocate is a
+        // potential outcome here due to potential corruption.
+        if (!buffer.tryGrow(length))
+            return std::nullopt;
+        if (!readRaw(address, buffer.mutableSpan().data(), length))
+            return std::nullopt;
+        return buffer;
+    }
+
+private:
+    bool readRaw(Address address, void* destination, size_t length) const
+    {
+        mach_vm_size_t got = 0;
+        kern_return_t kr = mach_vm_read_overwrite(m_task, address.toMachVMAddress(), length,
+            reinterpret_cast<mach_vm_address_t>(destination), &got);
+        return kr == KERN_SUCCESS && got == length;
+    }
+
+    mach_port_t m_task;
+};
+
+template<typename T>
+std::optional<T> readCommand(std::span<const uint8_t> commands, size_t offset)
+{
+    static_assert(std::is_trivially_copyable_v<T>);
+    // Compared against what is left of the buffer rather than by forming
+    // offset + sizeof(T), which could wrap and pass a direct comparison. The
+    // first clause is what makes the subtraction safe.
+    if (offset > commands.size() || commands.size() - offset < sizeof(T))
+        return std::nullopt;
+
+    T value;
+    memcpySpan(asMutableByteSpan(value), commands.subspan(offset, sizeof(T)));
+    return value;
+}
+
+bool segmentNameIs(const char (&name)[16], std::string_view expected)
+{
+    // A segment name fills the whole array when it is exactly 16 characters, in
+    // which case it has no terminator.
+    std::span<const char> span { name };
+    return std::string_view(span.first(strlenSpan(span))) == expected;
+}
+
+} // anonymous namespace
+
+bool Symbol::hasReadBudget(size_t length)
+{
+    if (length > m_readBudget) {
+        CORPSE_DIAGNOSTIC_DO(++m_diagnostics.readBudgetExhausted);
+        return false;
+    }
+    m_readBudget -= length;
+    return true;
+}
+
+// Resolves `name` in the one image loaded at `imageAddress`, via its exports
+// trie. Returns a null address if this image does not export it.
+Address Symbol::resolveInImage(mach_port_t task, Address imageAddress, std::string_view name)
+{
+    TaskMemory memory(task);
+
+    auto header = memory.read<mach_header_64>(imageAddress);
+    if (!header || header->magic != MH_MAGIC_64) {
+        CORPSE_DIAGNOSTIC_DO(++m_diagnostics.unreadableHeader);
+        return { };
+    }
+    CORPSE_DIAGNOSTIC_DO(++m_diagnostics.examined);
+    if (header->flags & MH_DYLIB_IN_CACHE)
+        CORPSE_DIAGNOSTIC_DO(++m_diagnostics.inSharedCache);
+
+    if (header->sizeofcmds > maxLoadCommandsSize) {
+        CORPSE_DIAGNOSTIC_DO(++m_diagnostics.implausibleCommandsSize);
+        return { };
+    }
+    if (!hasReadBudget(header->sizeofcmds))
+        return { };
+    auto commandsBuffer = memory.readBytes(imageAddress + sizeof(mach_header_64), header->sizeofcmds);
+    if (!commandsBuffer) {
+        CORPSE_DIAGNOSTIC_DO(++m_diagnostics.unreadableCommands);
+        return { };
+    }
+    std::span<const uint8_t> commands = commandsBuffer->span();
+
+    std::optional<uint64_t> textVMAddress;
+    std::optional<uint64_t> linkeditVMAddress;
+    std::optional<uint64_t> linkeditFileOffset;
+    std::optional<uint64_t> linkeditFileSize;
+    uint32_t exportOffset = 0;
+    uint32_t exportSize = 0;
+
+    size_t offset = 0;
+    for (uint32_t i = 0; i < header->ncmds; ++i) {
+        auto command = readCommand<load_command>(commands, offset);
+        // cmdsize is compared against what is left of the blob rather than by
+        // forming offset + cmdsize, which could wrap and pass a direct
+        // comparison. The subtraction is safe only because a successful
+        // readCommand has already established that offset is within the blob,
+        // so the clauses have to stay in this order.
+        if (!command || command->cmdsize < sizeof(load_command) || command->cmdsize > commands.size() - offset)
+            break;
+
+        // Each case below re-reads `offset` as the larger struct the command
+        // claims to be. cmdsize has to cover that struct too: a command that
+        // declares itself smaller is malformed, and reading it anyway would take
+        // the fields that follow it as its own.
+        switch (command->cmd) {
+        case LC_SEGMENT_64: {
+            if (command->cmdsize < sizeof(segment_command_64))
+                break;
+            auto segment = readCommand<segment_command_64>(commands, offset);
+            if (!segment)
+                break;
+            if (segmentNameIs(segment->segname, SEG_TEXT))
+                textVMAddress = segment->vmaddr;
+            else if (segmentNameIs(segment->segname, SEG_LINKEDIT)) {
+                linkeditVMAddress = segment->vmaddr;
+                linkeditFileOffset = segment->fileoff;
+                linkeditFileSize = segment->filesize;
+            }
+            break;
+        }
+        case LC_DYLD_INFO:
+        case LC_DYLD_INFO_ONLY: {
+            if (command->cmdsize < sizeof(dyld_info_command))
+                break;
+            auto info = readCommand<dyld_info_command>(commands, offset);
+            if (!info)
+                break;
+            exportOffset = info->export_off;
+            exportSize = info->export_size;
+            break;
+        }
+        case LC_DYLD_EXPORTS_TRIE: {
+            if (command->cmdsize < sizeof(linkedit_data_command))
+                break;
+            auto data = readCommand<linkedit_data_command>(commands, offset);
+            if (!data)
+                break;
+            exportOffset = data->dataoff;
+            exportSize = data->datasize;
+            break;
+        }
+        default:
+            break;
+        }
+        offset += command->cmdsize;
+    }
+
+    if (!textVMAddress || !linkeditVMAddress || !linkeditFileOffset || !linkeditFileSize || !exportSize) {
+        CORPSE_DIAGNOSTIC_DO(++m_diagnostics.withoutTrie);
+        return { };
+    }
+    if (exportSize > maxExportsTrieSize) {
+        CORPSE_DIAGNOSTIC_DO(++m_diagnostics.implausibleTrieSize);
+        return { };
+    }
+
+    // The trie is file-backed data living inside __LINKEDIT. So, exportOffset cannot
+    // be less than the start of __LINKEDIT, cannot exceed the end of __LINKEDIT, and
+    // the whole trie must fit inside it.
+    if (exportOffset < *linkeditFileOffset) {
+        CORPSE_DIAGNOSTIC_DO(++m_diagnostics.trieOutsideLinkedit);
+        return { };
+    }
+    uint64_t trieSegmentOffset = exportOffset - *linkeditFileOffset;
+    if (trieSegmentOffset > *linkeditFileSize || exportSize > *linkeditFileSize - trieSegmentOffset) {
+        CORPSE_DIAGNOSTIC_DO(++m_diagnostics.trieOutsideLinkedit);
+        return { };
+    }
+
+    // __TEXT's link-time address against where the image actually landed. The
+    // load commands give link-time addresses, so everything read out of them
+    // needs this added to reach the corpse.
+    uint64_t slide = imageAddress - Address(*textVMAddress);
+    Address trieAddress = Address(*linkeditVMAddress) + slide + trieSegmentOffset;
+
+    if (!hasReadBudget(exportSize))
+        return { };
+    auto trieBuffer = memory.readBytes(trieAddress, exportSize);
+    if (!trieBuffer) {
+        CORPSE_DIAGNOSTIC_DO(++m_diagnostics.unreadableTrie);
+        return { };
+    }
+    CORPSE_DIAGNOSTIC_DO(++m_diagnostics.searched);
+
+    auto found = ExportsTrie::lookUp(trieBuffer->span(), name);
+    if (!found) {
+#if CORPSE_SYMBOL_LOOKUP_DIAGNOSTICS
+        if (found.error() == ExportsTrie::Failure::ReExport)
+            ++m_diagnostics.reExports;
+        else if (found.error() == ExportsTrie::Failure::UnsupportedKind)
+            ++m_diagnostics.unsupportedKind;
+#endif
+        return { };
+    }
+    if (found->kind == ExportsTrie::Export::Kind::Absolute)
+        return Address(found->value);
+    return imageAddress + found->value;
+}
+
+Address Symbol::lookUpName(const Snapshot& snapshot)
+{
+    if (!snapshot.isValid() || m_name.empty())
+        return { };
+
+    m_readBudget = maxTotalBytesRead;
+
+    auto doLookUp = [&] () -> Address {
+        std::string name = "_" + m_name; // Use Mach-O symbol name for look up.
+
+        mach_port_t task = snapshot.corpsePort();
+        TaskMemory memory(task);
+
+        // dyld publishes the list of loaded images; search each one in turn.
+        task_dyld_info_data_t dyldInfo;
+        mach_msg_type_number_t count = TASK_DYLD_INFO_COUNT;
+        if (task_info(task, TASK_DYLD_INFO, reinterpret_cast<task_info_t>(&dyldInfo), &count) != KERN_SUCCESS)
+            return { };
+        CORPSE_DIAGNOSTIC_DO(m_diagnostics.readDyldInfo = true);
+
+        Address allImageInfosAddress { dyldInfo.all_image_info_addr };
+        CORPSE_DIAGNOSTIC_DO(m_diagnostics.allImageInfosAddress = allImageInfosAddress);
+        if (!allImageInfosAddress)
+            return { };
+
+        auto allImages = memory.read<dyld_all_image_infos>(allImageInfosAddress);
+        if (!allImages)
+            return { };
+        CORPSE_DIAGNOSTIC_DO(m_diagnostics.readAllImageInfos = true);
+        CORPSE_DIAGNOSTIC_DO(m_diagnostics.version = allImages->version);
+
+        Address rawArrayAddress { allImages->infoArray };
+        Address arrayAddress = rawArrayAddress.stripped();
+        uint32_t imageCount = allImages->infoArrayCount;
+        CORPSE_DIAGNOSTIC_DO(m_diagnostics.rawImageArrayAddress = rawArrayAddress);
+        CORPSE_DIAGNOSTIC_DO(m_diagnostics.imageArrayAddress = arrayAddress);
+        CORPSE_DIAGNOSTIC_DO(m_diagnostics.images = imageCount);
+        if (!arrayAddress || !imageCount)
+            return { };
+        // Each image below costs a Mach round-trip and two buffer reads, so an
+        // implausible count is a lot of work to be talked into doing.
+        if (imageCount > maxImageCount) {
+            CORPSE_DIAGNOSTIC_DO(m_diagnostics.implausibleImageCount = true);
+            return { };
+        }
+
+        for (uint32_t i = 0; i < imageCount; ++i) {
+            auto info = memory.read<dyld_image_info>(arrayAddress + static_cast<uint64_t>(i) * sizeof(dyld_image_info));
+            if (!info) {
+                CORPSE_DIAGNOSTIC_DO(++m_diagnostics.unreadableInfo);
+                continue;
+            }
+            auto imageAddress = Address(info->imageLoadAddress).stripped();
+            auto symbolAddress = resolveInImage(task, imageAddress, name);
+            if (symbolAddress)
+                return symbolAddress;
+        }
+
+        return { };
+    };
+
+    Address address = doLookUp();
+#if CORPSE_SYMBOL_LOOKUP_DIAGNOSTICS
+    if (!address)
+        reportFailure(snapshot);
+#endif
+    return address;
+}
+
+#if CORPSE_SYMBOL_LOOKUP_DIAGNOSTICS
+
+// Says how a failed search went, so a caller can tell "the symbol is not
+// exported" from "the corpse could not be read".
+void Symbol::reportFailure(const Snapshot& snapshot) const
+{
+    const Diagnostics& d = m_diagnostics;
+
+    Error::report("No symbol '_%s' in pid %d", m_name.c_str(),
+        static_cast<int>(snapshot.process()->pid()));
+
+    if (!d.readDyldInfo) {
+        Error::report("  could not read dyld information (task_info TASK_DYLD_INFO failed)");
+        return;
+    }
+    if (!d.allImageInfosAddress) {
+        Error::report("  dyld reports no image list (all_image_info_addr is 0)");
+        return;
+    }
+    if (!d.readAllImageInfos) {
+        Error::report("  could not read dyld_all_image_infos at 0x%llx",
+            d.allImageInfosAddress.toMachVMAddress());
+        return;
+    }
+
+    // A sane version says the struct read probably landed on real data, which is what
+    // makes the image count and array address below worth printing.
+    Error::report("  dyld_all_image_infos v%u at 0x%llx lists %u images at 0x%llx",
+        d.version, d.allImageInfosAddress.toMachVMAddress(),
+        d.images, d.imageArrayAddress.toMachVMAddress());
+    if (d.rawImageArrayAddress != d.imageArrayAddress) {
+        Error::report("  that address was ptrauth-signed as 0x%llx; the signature was stripped",
+            d.rawImageArrayAddress.toMachVMAddress());
+    }
+    if (!d.imageArrayAddress || !d.images) {
+        Error::report("  that list is empty, so there was nothing to search");
+        return;
+    }
+    if (d.implausibleImageCount) {
+        Error::report("  that count is too large to be a real image list, so the struct read"
+            " was not dyld_all_image_infos and was not searched");
+        return;
+    }
+
+    Error::report("  read %u of %u image headers (%u in the shared cache), walked %u exports tries",
+        d.examined, d.images, d.inSharedCache, d.searched);
+    if (d.unreadableInfo)
+        Error::report("  %u image list entries were unreadable", d.unreadableInfo);
+    if (d.unreadableHeader)
+        Error::report("  %u image headers were unreadable or not 64-bit Mach-O", d.unreadableHeader);
+    if (d.implausibleCommandsSize)
+        Error::report("  %u images had implausible load command sizes", d.implausibleCommandsSize);
+    if (d.unreadableCommands)
+        Error::report("  %u images had unreadable load commands", d.unreadableCommands);
+    if (d.withoutTrie)
+        Error::report("  %u images had no exports trie", d.withoutTrie);
+    if (d.implausibleTrieSize)
+        Error::report("  %u images had implausible exports trie sizes", d.implausibleTrieSize);
+    if (d.trieOutsideLinkedit)
+        Error::report("  %u images placed their exports trie outside __LINKEDIT", d.trieOutsideLinkedit);
+    if (d.unreadableTrie)
+        Error::report("  %u exports tries were not readable", d.unreadableTrie);
+    if (d.readBudgetExhausted) {
+        Error::report("  gave up after reading %u MB from the corpse; %u images were skipped",
+            static_cast<unsigned>(maxTotalBytesRead / MB), d.readBudgetExhausted);
+    }
+    if (d.reExports)
+        Error::report("  %u images re-export the name from elsewhere, which is not followed", d.reExports);
+    if (d.unsupportedKind)
+        Error::report("  %u images export the name in a form that has no single address, such as a thread-local", d.unsupportedKind);
+
+    if (d.searched) {
+        Error::report(
+            "  only exported symbols appear in an exports trie: a symbol hidden"
+            " by the linker is invisible here even though lldb can still find"
+            " it in the symbol table");
+    } else {
+        Error::report(
+            "  no trie was searched, so this is a memory-access problem rather"
+            " than the symbol being absent");
+    }
+}
+
+#endif // CORPSE_SYMBOL_LOOKUP_DIAGNOSTICS
+
+Symbol::Symbol(const Snapshot& snapshot, const char* name)
+    : m_name(name ? name : "")
+{
+    if (!m_name.empty())
+        m_address = lookUpName(snapshot);
+}
+
+} // namespace Corpse
+} // namespace JSC
+
+#undef CORPSE_DIAGNOSTIC_DO
+
+#endif // (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
diff --git a/Source/JavaScriptCore/corpse/CorpseSymbol.h b/Source/JavaScriptCore/corpse/CorpseSymbol.h
new file mode 100644
index 000000000000..e32f53d98e09
--- /dev/null
+++ b/Source/JavaScriptCore/corpse/CorpseSymbol.h
@@ -0,0 +1,113 @@
+/*
+ * Copyright (C) 2026 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
+
+#include <JavaScriptCore/CorpseAddress.h>
+#include <mach/mach.h>
+#include <stdint.h>
+#include <string>
+#include <string_view>
+#include <wtf/TZoneMalloc.h>
+
+// Enable for more detailed error messages on what may have caused a symbol lookup failure.
+#define CORPSE_SYMBOL_LOOKUP_DIAGNOSTICS 0
+
+namespace JSC {
+namespace Corpse {
+
+class Snapshot;
+
+// A symbol looked up in a corpse by name. The lookup happens on construction.
+//
+// Only regular and absolute exports are read out of an image's trie. A re-export is
+// skipped rather than followed, so a name that one image re-exports resolves in the
+// image that defines it, as long as that image is loaded in the corpse. A
+// thread-local is not found at all.
+//
+// A re-export may also rename, and then no image exports the name at all: memcpy
+// exists only as libsystem_c's re-export of __platform_memmove from
+// libsystem_platform, so a lookup of memcpy finds nothing while a lookup of
+// __platform_memmove succeeds.
+class Symbol {
+    WTF_MAKE_TZONE_ALLOCATED(Symbol);
+public:
+    Symbol(const Snapshot&, const char* name);
+
+    const std::string& name() const { return m_name; }
+
+    Address address() const { return m_address; } // Null means not found.
+    bool isValid() const { return static_cast<bool>(m_address); }
+
+private:
+    Address lookUpName(const Snapshot&);
+    Address resolveInImage(mach_port_t, Address loadAddress, std::string_view name);
+    bool hasReadBudget(size_t length);
+
+#if CORPSE_SYMBOL_LOOKUP_DIAGNOSTICS
+    // How far a search got, so a failure can name the stage that fell short.
+    struct Diagnostics {
+        bool readDyldInfo { false };
+        Address allImageInfosAddress;
+        bool readAllImageInfos { false };
+        uint32_t version { 0 };                 // dyld_all_image_infos::version.
+        Address rawImageArrayAddress;           // As stored, possibly signed.
+        Address imageArrayAddress;              // ...with any signature stripped.
+        unsigned images { 0 };                  // Images dyld reported.
+        bool implausibleImageCount { false };   // ...but too many to be believed.
+        unsigned examined { 0 };                // ...whose Mach header we read.
+        unsigned inSharedCache { 0 };           // ...of those, in the shared cache.
+        unsigned unreadableInfo { 0 };          // dyld_image_info unreadable.
+        unsigned unreadableHeader { 0 };        // Header missing or not 64-bit.
+        unsigned implausibleCommandsSize { 0 }; // sizeofcmds too large to believe.
+        unsigned unreadableCommands { 0 };      // Load commands unreadable.
+        unsigned withoutTrie { 0 };             // No trie, or no __TEXT/__LINKEDIT.
+        unsigned implausibleTrieSize { 0 };     // Trie size too large to believe.
+        unsigned trieOutsideLinkedit { 0 };     // Trie not within __LINKEDIT.
+        unsigned unreadableTrie { 0 };          // Trie located but not readable.
+        unsigned readBudgetExhausted { 0 };     // Gave up: the lookup hit its read budget.
+        unsigned searched { 0 };                // Tries actually walked.
+        unsigned reExports { 0 };               // Matched, but re-exported.
+        unsigned unsupportedKind { 0 };         // Matched, but not an export kind with one address.
+    };
+
+    void reportFailure(const Snapshot&) const;
+
+    Diagnostics m_diagnostics;
+#endif
+
+    std::string m_name;
+    Address m_address;
+
+    // What this lookup may still copy out of the corpse. Set when the search starts.
+    size_t m_readBudget { 0 };
+};
+
+} // namespace Corpse
+} // namespace JSC
+
+#endif // (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
diff --git a/Source/JavaScriptCore/corpse/CorpseThread.cpp b/Source/JavaScriptCore/corpse/CorpseThread.cpp
new file mode 100644
index 000000000000..f70ee5151c61
--- /dev/null
+++ b/Source/JavaScriptCore/corpse/CorpseThread.cpp
@@ -0,0 +1,189 @@
+/*
+ * Copyright (C) 2026 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "CorpseThread.h"
+
+#if (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
+
+#include "CorpseError.h"
+#include "CorpseProcess.h"
+#include "CorpseRegion.h"
+#include "CorpseSnapshot.h"
+
+#include <mach/mach.h>
+#include <mach/mach_error.h>
+#include <mach/mach_vm.h>
+#include <mach/thread_act.h>
+#include <mach/thread_info.h>
+#include <mach/thread_status.h>
+#include <optional>
+
+WTF_ALLOW_UNSAFE_BUFFER_USAGE_BEGIN
+
+namespace JSC {
+namespace Corpse {
+
+static std::optional<Address> readStackPointer(thread_act_t thread)
+{
+#if CPU(ARM64)
+    arm_thread_state64_t state = { };
+    mach_msg_type_number_t count = ARM_THREAD_STATE64_COUNT;
+    if (thread_get_state(thread, ARM_THREAD_STATE64, reinterpret_cast<thread_state_t>(&state), &count) != KERN_SUCCESS)
+        return std::nullopt; // May fail e.g. for Rosetta.
+    // The target's pc/lr/sp/fp arrive signed for its own ptrauth context. On an
+    // arm64e build the accessors would try to authenticate them against ours and
+    // trap (EXC_BAD_ACCESS / EXC_ARM_PAC_FAIL), so strip the signatures first.
+    // Stripping also marks the state as unsigned, so the accessor reads it raw.
+    arm_thread_state64_ptrauth_strip(state);
+    return Address(arm_thread_state64_get_sp(state));
+#elif CPU(X86_64)
+    x86_thread_state64_t state = { };
+    mach_msg_type_number_t count = x86_THREAD_STATE64_COUNT;
+    if (thread_get_state(thread, x86_THREAD_STATE64, reinterpret_cast<thread_state_t>(&state), &count) != KERN_SUCCESS)
+        return std::nullopt;
+    return Address(state.__rsp);
+#else
+    UNUSED_PARAM(thread);
+    return std::nullopt;
+#endif
+}
+
+const char* Thread::runStateDescription() const
+{
+    switch (m_runState) {
+    case TH_STATE_RUNNING:
+        return "running";
+    case TH_STATE_STOPPED:
+        return "stopped";
+    case TH_STATE_WAITING:
+        return "waiting";
+    case TH_STATE_UNINTERRUPTIBLE:
+        return "uninterruptible";
+    case TH_STATE_HALTED:
+        return "halted";
+    default:
+        return "unknown";
+    }
+}
+
+Vector<Thread> Thread::collect(const Snapshot& snapshot)
+{
+    Vector<Thread> result;
+
+    if (!snapshot.isValid()) {
+        Error::report("Cannot read threads from an invalid snapshot");
+        return result;
+    }
+    mach_port_t task = snapshot.corpsePort();
+
+    thread_act_array_t threads = nullptr;
+    mach_msg_type_number_t threadCount = 0;
+    kern_return_t kr = task_threads(task, &threads, &threadCount);
+    if (kr != KERN_SUCCESS) {
+        pid_t pid = snapshot.process()->pid();
+        Error::report("Could not read the thread list for pid %d: %s (0x%x)",
+            static_cast<int>(pid), mach_error_string(kr), kr);
+        return result;
+    }
+
+    result.reserveCapacity(threadCount);
+
+    // A translated target executes as arm64 whatever its own architecture is, so its
+    // threads' stack pointers belong to Rosetta's runtime rather than to the program.
+    // Those addresses do land in real mappings, so reporting the region around one
+    // would name a plausible but wrong stack; report no stack instead.
+    Process* process = snapshot.process();
+    bool isTranslated = process->isTranslated();
+    if (isTranslated) {
+        Error::report("Thread stacks for pid %d are not available: the process runs"
+            " under Rosetta translation, whose thread state does not describe the program",
+            static_cast<int>(process->pid()));
+    }
+
+    unsigned unreadableStates = 0;
+    for (mach_msg_type_number_t i = 0; i < threadCount; ++i) {
+        Thread thread;
+
+        thread_identifier_info_data_t identifierInfo;
+        mach_msg_type_number_t count = THREAD_IDENTIFIER_INFO_COUNT;
+        if (thread_info(threads[i], THREAD_IDENTIFIER_INFO, reinterpret_cast<thread_info_t>(&identifierInfo), &count) == KERN_SUCCESS)
+            thread.m_id = identifierInfo.thread_id;
+
+        thread_basic_info_data_t basicInfo;
+        count = THREAD_BASIC_INFO_COUNT;
+        if (thread_info(threads[i], THREAD_BASIC_INFO, reinterpret_cast<thread_info_t>(&basicInfo), &count) == KERN_SUCCESS) {
+            thread.m_runState = basicInfo.run_state;
+            thread.m_suspendCount = basicInfo.suspend_count;
+            thread.m_userTimeUsec = static_cast<uint64_t>(basicInfo.user_time.seconds) * 1000000
+                + basicInfo.user_time.microseconds;
+            thread.m_systemTimeUsec = static_cast<uint64_t>(basicInfo.system_time.seconds) * 1000000
+                + basicInfo.system_time.microseconds;
+        }
+
+        // Extended info is the only flavor that reports the pthread name.
+        thread_extended_info_data_t extendedInfo;
+        count = THREAD_EXTENDED_INFO_COUNT;
+        if (thread_info(threads[i], THREAD_EXTENDED_INFO, reinterpret_cast<thread_info_t>(&extendedInfo), &count) == KERN_SUCCESS) {
+            extendedInfo.pth_name[sizeof(extendedInfo.pth_name) - 1] = '\0';
+            thread.m_name = extendedInfo.pth_name;
+        }
+
+        // The stack is the region the stack pointer points into.
+        if (!isTranslated) {
+            if (auto stackPointer = readStackPointer(threads[i])) {
+                thread.m_stackPointer = *stackPointer;
+                if (auto region = Region::findContaining(task, thread.m_stackPointer))
+                    thread.m_stackRegion = *region;
+            } else
+                ++unreadableStates;
+        }
+
+        result.append(thread);
+    }
+
+    // Failing to read the thread state leaves a thread with no stack, which on its
+    // own looks the same as a thread that has none. Say which it was.
+    if (unreadableStates) {
+        Error::report("Could not read the thread state of %u of %u threads in pid %d:"
+            " this build cannot read the target's architecture",
+            unreadableStates, static_cast<unsigned>(threadCount),
+            static_cast<int>(process->pid()));
+    }
+
+    // task_threads hands us a right to each thread plus the array itself.
+    for (mach_msg_type_number_t i = 0; i < threadCount; ++i)
+        mach_port_deallocate(mach_task_self(), threads[i]);
+    mach_vm_size_t threadsSize = threadCount * sizeof(thread_act_t);
+    mach_vm_deallocate(mach_task_self(), reinterpret_cast<mach_vm_address_t>(threads), threadsSize);
+
+    return result;
+}
+} // namespace Corpse
+} // namespace JSC
+
+WTF_ALLOW_UNSAFE_BUFFER_USAGE_END
+
+#endif // (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
diff --git a/Source/JavaScriptCore/corpse/CorpseThread.h b/Source/JavaScriptCore/corpse/CorpseThread.h
new file mode 100644
index 000000000000..64b2ae2d433f
--- /dev/null
+++ b/Source/JavaScriptCore/corpse/CorpseThread.h
@@ -0,0 +1,82 @@
+/*
+ * Copyright (C) 2026 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
+
+#include <JavaScriptCore/CorpseAddress.h>
+#include <JavaScriptCore/CorpseRegion.h>
+#include <mach/mach.h>
+#include <stdint.h>
+#include <string>
+#include <wtf/Vector.h>
+
+namespace JSC {
+namespace Corpse {
+
+class Snapshot;
+
+// A snapshot of thread values read out of a corpse.
+class Thread {
+public:
+    // The kernel's system-wide unique 64-bit thread id, as reported by lldb and
+    // spindump. This is an identifier, not an address.
+    uint64_t id() const { return m_id; }
+
+    // The pthread name, empty if the thread was never named.
+    const std::string& name() const { return m_name; }
+
+    int runState() const { return m_runState; }
+    int suspendCount() const { return m_suspendCount; }
+    uint64_t userTimeUsec() const { return m_userTimeUsec; }
+    uint64_t systemTimeUsec() const { return m_systemTimeUsec; }
+
+    Address stackPointer() const { return m_stackPointer; }
+
+    const Region& stackRegion() const { return m_stackRegion; }
+    bool hasStack() const { return m_stackRegion.size(); }
+
+    const char* runStateDescription() const;
+
+private:
+    static Vector<Thread> collect(const Snapshot&);
+
+    uint64_t m_id { 0 };
+    std::string m_name;
+    int m_runState { 0 };
+    int m_suspendCount { 0 };
+    uint64_t m_userTimeUsec { 0 };
+    uint64_t m_systemTimeUsec { 0 };
+    Address m_stackPointer;
+    Region m_stackRegion;
+
+    friend class Snapshot;
+};
+
+} // namespace Corpse
+} // namespace JSC
+
+#endif // (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
diff --git a/Source/JavaScriptCore/corpse/tests/CorpseAddressTest.cpp b/Source/JavaScriptCore/corpse/tests/CorpseAddressTest.cpp
new file mode 100644
index 000000000000..4f3e685bba92
--- /dev/null
+++ b/Source/JavaScriptCore/corpse/tests/CorpseAddressTest.cpp
@@ -0,0 +1,125 @@
+/*
+ * Copyright (C) 2026 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "CorpseAddressTest.h"
+
+#if (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
+
+#include "LibJSCToolsTestUtilities.h"
+
+#include <JavaScriptCore/CorpseAddress.h>
+#include <mach/mach.h>
+#include <type_traits>
+
+#if CPU(ARM64E)
+#include <ptrauth.h>
+#endif
+
+namespace JSCToolsTest {
+
+using JSC::Corpse::Address;
+
+void testAddress()
+{
+    if (!beginSuite("Address"))
+        return;
+
+    {
+        Address none;
+        TEST_ASSERT(!none, "a default Address is null");
+        TEST_ASSERT(none == nullptr, "a default Address compares equal to nullptr");
+        TEST_ASSERT_HEX_EQ(none.toMachVMAddress(), 0, "a default Address holds zero");
+    }
+    {
+        Address address(static_cast<mach_vm_address_t>(0x1000));
+        TEST_ASSERT(static_cast<bool>(address), "a non-zero Address is not null");
+        TEST_ASSERT(!(address == nullptr), "a non-zero Address does not compare equal to nullptr");
+        TEST_ASSERT_HEX_EQ(address.toMachVMAddress(), 0x1000, "an Address holds what it was given");
+    }
+    {
+        int local = 0;
+        Address address(&local);
+        TEST_ASSERT_HEX_EQ(address.toMachVMAddress(), reinterpret_cast<uintptr_t>(&local),
+            "an Address built from a pointer holds that pointer");
+    }
+    {
+        // The whole point of the type: a corpse address must not be usable as a
+        // local one by accident, so there is no conversion out of it.
+        TEST_ASSERT(!(std::is_convertible_v<Address, uint64_t>),
+            "an Address does not convert to an integer");
+        TEST_ASSERT(!(std::is_convertible_v<Address, void*>),
+            "an Address does not convert to a pointer");
+    }
+    {
+        Address low(static_cast<mach_vm_address_t>(0x1000));
+        Address high(static_cast<mach_vm_address_t>(0x2000));
+        TEST_ASSERT(low < high, "Addresses order by value");
+        TEST_ASSERT(high > low, "Addresses order by value the other way");
+        TEST_ASSERT(low <= low && low >= low, "an Address is not less or greater than itself");
+        TEST_ASSERT(low == Address(static_cast<mach_vm_address_t>(0x1000)), "equal values compare equal");
+        TEST_ASSERT(low != high, "different values do not compare equal");
+    }
+    {
+        Address base(static_cast<mach_vm_address_t>(0x1000));
+        TEST_ASSERT_HEX_EQ((base + 0x20).toMachVMAddress(), 0x1020, "adding an offset moves forward");
+        TEST_ASSERT_HEX_EQ((base - 0x20).toMachVMAddress(), 0x0fe0, "subtracting an offset moves back");
+        TEST_ASSERT_HEX_EQ(Address(static_cast<mach_vm_address_t>(0x1030)) - base, 0x30,
+            "subtracting two Addresses gives the distance between them");
+    }
+    {
+        // A plain address has nothing to strip, whatever the platform.
+        Address plain(static_cast<mach_vm_address_t>(0x0000000100002000));
+        TEST_ASSERT_HEX_EQ(plain.stripped().toMachVMAddress(), 0x0000000100002000,
+            "stripping an unsigned address changes nothing");
+    }
+#if CPU(ARM64E)
+    {
+        // A pointer read out of a corpse arrives signed for the target's context,
+        // and must be reduced to the address it names before it is used as one.
+        void* raw = reinterpret_cast<void*>(static_cast<uintptr_t>(0x0000000100002000));
+        void* signedPointer;
+        unsigned count = 0;
+        constexpr unsigned maxRetryCount = 10;
+        do {
+            signedPointer = ptrauth_sign_unauthenticated(raw, ptrauth_key_process_dependent_code, 0);
+        } while (signedPointer == raw && ++count <= maxRetryCount);
+        TEST_ASSERT(count <= maxRetryCount, "unable to generate PAC signed pointer for test");
+        TEST_ASSERT_HEX_EQ(Address(signedPointer).stripped().toMachVMAddress(),
+            reinterpret_cast<uintptr_t>(raw), "stripping recovers the address a signed pointer names");
+    }
+    {
+        // Top-byte-ignore and memory tagging both leave data in the top byte, which
+        // is not part of the address either.
+        Address tagged(static_cast<mach_vm_address_t>(0x4200000100002000));
+        TEST_ASSERT_HEX_EQ(tagged.stripped().toMachVMAddress(), 0x0000000100002000,
+            "stripping clears a tagged top byte");
+    }
+#endif
+}
+
+} // namespace JSCToolsTest
+
+#endif // (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
diff --git a/Source/JavaScriptCore/corpse/tests/CorpseAddressTest.h b/Source/JavaScriptCore/corpse/tests/CorpseAddressTest.h
new file mode 100644
index 000000000000..2af264d1993e
--- /dev/null
+++ b/Source/JavaScriptCore/corpse/tests/CorpseAddressTest.h
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2026 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
+
+namespace JSCToolsTest {
+
+void testAddress();
+
+} // namespace JSCToolsTest
+
+#endif // (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
diff --git a/Source/JavaScriptCore/corpse/tests/CorpseByteParserTest.cpp b/Source/JavaScriptCore/corpse/tests/CorpseByteParserTest.cpp
new file mode 100644
index 000000000000..cbc380b92fda
--- /dev/null
+++ b/Source/JavaScriptCore/corpse/tests/CorpseByteParserTest.cpp
@@ -0,0 +1,186 @@
+/*
+ * Copyright (C) 2026 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "CorpseByteParserTest.h"
+
+#if (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
+
+#include "LibJSCToolsTestUtilities.h"
+
+#include <JavaScriptCore/CorpseByteParser.h>
+#include <limits>
+
+namespace JSCToolsTest {
+
+using JSC::Corpse::ByteParser;
+
+void testByteParser()
+{
+    if (!beginSuite("ByteParser"))
+        return;
+
+    {
+        Vector<uint8_t> empty;
+        ByteParser parser(empty.span());
+        TEST_ASSERT(!parser.consumeByte(), "consumeByte on an empty buffer yields nothing");
+        TEST_ASSERT(!parser.consumeULEB128(), "consumeULEB128 on an empty buffer yields nothing");
+        TEST_ASSERT(!parser.consumeCString(), "consumeCString on an empty buffer yields nothing");
+        TEST_ASSERT_EQ(parser.position(), static_cast<size_t>(0), "a failed read does not advance");
+    }
+    {
+        Vector<uint8_t> data { 0x11, 0x22 };
+        ByteParser parser(data.span());
+        auto first = parser.consumeByte();
+        TEST_ASSERT(first && *first == 0x11, "consumeByte yields the first byte");
+        TEST_ASSERT_EQ(parser.position(), static_cast<size_t>(1), "consumeByte advances by one");
+        auto second = parser.consumeByte();
+        TEST_ASSERT(second && *second == 0x22, "consumeByte yields the next byte");
+        TEST_ASSERT_EQ(parser.position(), static_cast<size_t>(2), "consumeByte advances past the last byte");
+        TEST_ASSERT(!parser.consumeByte(), "consumeByte stops at the end");
+    }
+    {
+        // A parser may start part way in, which is how a node is read out of a trie.
+        Vector<uint8_t> data { 0x11, 0x22, 0x33 };
+        ByteParser parser(data.span(), 2);
+        auto value = parser.consumeByte();
+        TEST_ASSERT(value && *value == 0x33, "a parser starts at the position it is given");
+        TEST_ASSERT_EQ(parser.position(), static_cast<size_t>(3), "a read advances from the given position");
+    }
+    {
+        // A trie node's fields are ULEB128s read through a parser bounded to the whole
+        // trie but starting at the node, so decoding has to begin at that position and
+        // leave the cursor on the field that follows.
+        Vector<uint8_t> data { 0x11, 0x22, 0xe5, 0x8e, 0x26, 0x33 };
+        ByteParser parser(data.span(), 2);
+        auto value = parser.consumeULEB128();
+        TEST_ASSERT(value && *value == 624485, "consumeULEB128 decodes from the position it is given");
+        TEST_ASSERT_EQ(parser.position(), static_cast<size_t>(5), "consumeULEB128 stops after the value it decoded");
+        auto next = parser.consumeByte();
+        TEST_ASSERT(next && *next == 0x33, "the byte after a decoded value is left for the next read");
+    }
+    {
+        // A failed read rewinds to where the cursor was, which is not necessarily the
+        // start of the buffer.
+        Vector<uint8_t> data { 0x11, 0x22, 0x80 };
+        ByteParser parser(data.span(), 2);
+        TEST_ASSERT(!parser.consumeULEB128(), "a truncated ULEB128 is rejected wherever it starts");
+        TEST_ASSERT_EQ(parser.position(), static_cast<size_t>(2), "a failed read rewinds to the given position");
+    }
+
+    struct ULEBCase {
+        Vector<uint8_t> bytes;
+        bool decodes;
+        uint64_t value;
+        const char* description;
+    };
+    Vector<ULEBCase> ulebCases;
+    ulebCases.append({ { 0x00 }, true, 0, "zero" });
+    ulebCases.append({ { 0x01 }, true, 1, "one" });
+    ulebCases.append({ { 0x7f }, true, 127, "the largest one-byte value" });
+    ulebCases.append({ { 0x80, 0x01 }, true, 128, "the smallest two-byte value" });
+    ulebCases.append({ { 0xe5, 0x8e, 0x26 }, true, 624485, "a three-byte value" });
+    ulebCases.append({ { 0x80, 0x80, 0x80, 0x00 }, true, 0, "zero padded with continuations" });
+    ulebCases.append({ { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x01 }, true,
+        std::numeric_limits<uint64_t>::max(), "the largest 64-bit value" });
+    // Rejected: the top group carries bits that do not fit in 64.
+    ulebCases.append({ { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x02 }, false, 0,
+        "a value one bit too wide for 64 bits" });
+    // Rejected: the shift would reach 64, which is undefined rather than merely large.
+    ulebCases.append({ { 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x01 }, false, 0,
+        "an encoding longer than 64 bits can hold" });
+    ulebCases.append({ { 0x80 }, false, 0, "a value whose continuation runs off the end" });
+    ulebCases.append({ { 0xff, 0xff }, false, 0, "a truncated multi-byte value" });
+
+    for (const ULEBCase& testCase : ulebCases) {
+        ByteParser parser(testCase.bytes.span());
+        auto decoded = parser.consumeULEB128();
+        if (!testCase.decodes) {
+            TEST_ASSERT(!decoded, testCase.description);
+            TEST_ASSERT_EQ(parser.position(), static_cast<size_t>(0), testCase.description);
+            continue;
+        }
+        if (!decoded) {
+            TEST_ASSERT(decoded, testCase.description);
+            continue;
+        }
+        TEST_ASSERT_HEX_EQ(*decoded, testCase.value, testCase.description);
+        TEST_ASSERT_EQ(parser.position(), testCase.bytes.size(), testCase.description);
+    }
+
+    {
+        Vector<uint8_t> data { 'a', 'b', 0, 'c', 0 };
+        ByteParser parser(data.span());
+        auto first = parser.consumeCString();
+        TEST_ASSERT(first && *first == "ab", "consumeCString yields the string");
+        TEST_ASSERT_EQ(parser.position(), static_cast<size_t>(3), "consumeCString consumes the terminator");
+        auto second = parser.consumeCString();
+        TEST_ASSERT(second && *second == "c", "consumeCString yields the following string");
+        TEST_ASSERT_EQ(parser.position(), static_cast<size_t>(5), "consumeCString consumes the second terminator");
+        TEST_ASSERT(!parser.consumeCString(), "consumeCString stops at the end");
+    }
+    {
+        Vector<uint8_t> data { 0 };
+        ByteParser parser(data.span());
+        auto empty = parser.consumeCString();
+        TEST_ASSERT(empty && empty->empty(), "an empty string is a string");
+        TEST_ASSERT_EQ(parser.position(), static_cast<size_t>(1), "an empty string still consumes its terminator");
+    }
+    {
+        // A read that fails consumes nothing.
+        Vector<uint8_t> unterminated { 'a', 'b' };
+        ByteParser cstring(unterminated.span());
+        TEST_ASSERT(!cstring.consumeCString(), "an unterminated string is rejected");
+        TEST_ASSERT_EQ(cstring.position(), static_cast<size_t>(0),
+            "a failed string read leaves the cursor where it was");
+
+        Vector<uint8_t> truncated { 0x80, 0x80 };
+        ByteParser uleb(truncated.span());
+        TEST_ASSERT(!uleb.consumeULEB128(), "a truncated ULEB128 is rejected");
+        TEST_ASSERT_EQ(uleb.position(), static_cast<size_t>(0),
+            "a failed ULEB128 read leaves the cursor where it was");
+
+        // The failed read should not advance the cursor. Therefore, the 2nd read should succeed.
+        Vector<uint8_t> lone { 0x80 };
+        ByteParser retry(lone.span());
+        TEST_ASSERT(!retry.consumeULEB128(), "a lone continuation byte is not a value");
+        auto byte = retry.consumeByte();
+        TEST_ASSERT(byte && *byte == 0x80, "a failed read leaves its bytes for another reader");
+    }
+    {
+        Vector<uint8_t> data { 0x11, 'a', 0 };
+        for (size_t position : { data.size(), data.size() + 1, std::numeric_limits<size_t>::max() }) {
+            ByteParser parser(data.span(), position);
+            TEST_ASSERT(!parser.consumeByte(), "consumeByte from beyond the end yields nothing");
+            TEST_ASSERT(!parser.consumeULEB128(), "consumeULEB128 from beyond the end yields nothing");
+            TEST_ASSERT(!parser.consumeCString(), "consumeCString from beyond the end yields nothing");
+            TEST_ASSERT_EQ(parser.position(), position, "a failed read beyond the end does not move the cursor");
+        }
+    }
+}
+
+} // namespace JSCToolsTest
+
+#endif // (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
diff --git a/Source/JavaScriptCore/corpse/tests/CorpseByteParserTest.h b/Source/JavaScriptCore/corpse/tests/CorpseByteParserTest.h
new file mode 100644
index 000000000000..02c3681aee74
--- /dev/null
+++ b/Source/JavaScriptCore/corpse/tests/CorpseByteParserTest.h
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2026 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
+
+namespace JSCToolsTest {
+
+void testByteParser();
+
+} // namespace JSCToolsTest
+
+#endif // (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
diff --git a/Source/JavaScriptCore/corpse/tests/CorpseExportsTrieTest.cpp b/Source/JavaScriptCore/corpse/tests/CorpseExportsTrieTest.cpp
new file mode 100644
index 000000000000..c13efc1b801d
--- /dev/null
+++ b/Source/JavaScriptCore/corpse/tests/CorpseExportsTrieTest.cpp
@@ -0,0 +1,811 @@
+/*
+ * Copyright (C) 2026 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "CorpseExportsTrieTest.h"
+
+#if (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
+
+#include "LibJSCToolsTestUtilities.h"
+
+#include <JavaScriptCore/CorpseExportsTrie.h>
+#include <array>
+#include <limits>
+#include <mach-o/loader.h>
+#include <pthread.h>
+#include <string>
+#include <unistd.h>
+#include <wtf/Atomics.h>
+
+namespace JSCToolsTest {
+
+using JSC::Corpse::ExportsTrie;
+
+namespace {
+
+// Builds the bytes of a dyld exports trie, or of something that is not quite one.
+// Emitting bytes rather than describing exports is deliberate: most of what is
+// worth testing here is malformed, and could not be described any other way.
+class TrieBytes {
+public:
+    void byte(uint8_t value) { m_bytes.append(value); }
+    void bytes(std::span<const uint8_t>);
+    void uleb128(uint64_t);
+
+    // A ULEB128 padded to a fixed width so that a forward reference can be
+    // patched once its target is known. Non-canonical but well formed: the
+    // padding bytes carry a continuation bit and no payload.
+    static constexpr unsigned fixedWidth = 3;
+    size_t uleb128Fixed(uint64_t);
+    void patchUleb128Fixed(size_t position, uint64_t);
+
+    void cString(std::string_view); // With its terminator.
+    void string(std::string_view); // Without.
+
+    size_t position() const { return m_bytes.size(); }
+    std::span<const uint8_t> span() const { return m_bytes.span(); }
+    Vector<uint8_t> take() { return WTF::move(m_bytes); }
+
+private:
+    Vector<uint8_t> m_bytes;
+};
+
+// The flags and payload of one terminal, as a trie encodes them.
+struct TerminalSpec {
+    uint64_t flags { 0 };
+    // The ULEB128s that follow the flags. What they mean depends on the flags:
+    // one offset for an ordinary export, a stub offset then a resolver offset
+    // for a stub-and-resolver, an ordinal for a re-export.
+    Vector<uint64_t> values;
+    // Appended after the values, for a re-export's imported name.
+    std::string_view trailingString;
+    bool hasTrailingString { false };
+};
+
+// A trie holding one export named "", so that a look up of "" reaches the
+// terminal without walking any edge. Isolates terminal decoding from the walk.
+Vector<uint8_t> terminalOnlyTrie(const TerminalSpec&);
+
+// A trie whose root has one edge, `name`, leading to a terminal.
+Vector<uint8_t> singleExportTrie(std::string_view name, const TerminalSpec&);
+
+// A trie spelling one export across several edges, so a look up has to walk.
+Vector<uint8_t> chainedExportTrie(std::span<const std::string_view> edges, const TerminalSpec&);
+
+// An ordinary export at `offset` from the image's base.
+TerminalSpec regularExport(uint64_t offset);
+
+void TrieBytes::bytes(std::span<const uint8_t> data)
+{
+    m_bytes.append(data);
+}
+
+void TrieBytes::uleb128(uint64_t value)
+{
+    do {
+        uint8_t group = value & 0x7f;
+        value >>= 7;
+        if (value)
+            group |= 0x80;
+        m_bytes.append(group);
+    } while (value);
+}
+
+size_t TrieBytes::uleb128Fixed(uint64_t value)
+{
+    size_t start = m_bytes.size();
+    for (unsigned i = 0; i < fixedWidth; ++i) {
+        uint8_t group = (value >> (7 * i)) & 0x7f;
+        if (i + 1 < fixedWidth)
+            group |= 0x80;
+        m_bytes.append(group);
+    }
+    return start;
+}
+
+void TrieBytes::patchUleb128Fixed(size_t position, uint64_t value)
+{
+    for (unsigned i = 0; i < fixedWidth; ++i) {
+        uint8_t group = (value >> (7 * i)) & 0x7f;
+        if (i + 1 < fixedWidth)
+            group |= 0x80;
+        m_bytes[position + i] = group;
+    }
+}
+
+void TrieBytes::cString(std::string_view text)
+{
+    string(text);
+    m_bytes.append(0);
+}
+
+void TrieBytes::string(std::string_view text)
+{
+    for (char character : text)
+        m_bytes.append(static_cast<uint8_t>(character));
+}
+
+TerminalSpec regularExport(uint64_t offset)
+{
+    TerminalSpec spec;
+    spec.values.append(offset);
+    return spec;
+}
+
+// The bytes a terminal node holds after its length: the flags, then whatever
+// ULEB128s and string the flags call for.
+static Vector<uint8_t> terminalPayload(const TerminalSpec& spec)
+{
+    TrieBytes payload;
+    payload.uleb128(spec.flags);
+    for (uint64_t value : spec.values)
+        payload.uleb128(value);
+    if (spec.hasTrailingString)
+        payload.cString(spec.trailingString);
+    return payload.take();
+}
+
+// A node with a terminal and no children.
+static void appendTerminalNode(TrieBytes& trie, const TerminalSpec& spec)
+{
+    Vector<uint8_t> payload = terminalPayload(spec);
+    trie.uleb128(payload.size());
+    trie.bytes(payload.span());
+    trie.byte(0); // No children.
+}
+
+Vector<uint8_t> terminalOnlyTrie(const TerminalSpec& spec)
+{
+    TrieBytes trie;
+    appendTerminalNode(trie, spec);
+    return trie.take();
+}
+
+Vector<uint8_t> chainedExportTrie(std::span<const std::string_view> edges, const TerminalSpec& spec)
+{
+    TrieBytes trie;
+
+    // Every node but the last points at the one after it, whose position is not
+    // known until it has been emitted, so each reference is patched from behind.
+    Vector<size_t> patchPositions;
+    for (std::string_view edge : edges) {
+        if (!patchPositions.isEmpty()) {
+            trie.patchUleb128Fixed(patchPositions.last(), trie.position());
+            patchPositions.removeLast();
+        }
+        trie.uleb128(0); // No terminal on the way down.
+        trie.byte(1); // One edge.
+        trie.cString(edge);
+        patchPositions.append(trie.uleb128Fixed(0));
+    }
+    if (!patchPositions.isEmpty())
+        trie.patchUleb128Fixed(patchPositions.last(), trie.position());
+    appendTerminalNode(trie, spec);
+    return trie.take();
+}
+
+Vector<uint8_t> singleExportTrie(std::string_view name, const TerminalSpec& spec)
+{
+    std::array<std::string_view, 1> edges { name };
+    return chainedExportTrie(std::span<const std::string_view>(edges), spec);
+}
+
+// A node's children count is one byte, so 255 edges is as wide as a node can be.
+static constexpr unsigned maximumEdgeCount = 255;
+
+// The name of the `index`th edge of a fan-out trie. Two characters wide so that no
+// edge is a prefix of another, which leaves exactly one of them matching a name.
+static std::string fanOutEdgeName(unsigned index)
+{
+    return { static_cast<char>('a' + index / 16), static_cast<char>('a' + index % 16) };
+}
+
+// Distinct per edge, so that a walk landing on the wrong child is caught.
+static constexpr uint64_t fanOutExportOffset(unsigned index)
+{
+    return 0x1000 + index;
+}
+
+// A root with `edgeCount` edges, each leading to a terminal of its own.
+static Vector<uint8_t> fanOutTrie(unsigned edgeCount)
+{
+    TrieBytes trie;
+    trie.uleb128(0); // The root itself exports nothing.
+    trie.byte(static_cast<uint8_t>(edgeCount));
+
+    // Each edge points at a node that has not been emitted yet, so the references
+    // are patched once their targets are laid down below.
+    Vector<size_t> patchPositions;
+    for (unsigned index = 0; index < edgeCount; ++index) {
+        trie.cString(fanOutEdgeName(index));
+        patchPositions.append(trie.uleb128Fixed(0));
+    }
+    for (unsigned index = 0; index < edgeCount; ++index) {
+        trie.patchUleb128Fixed(patchPositions[index], trie.position());
+        appendTerminalNode(trie, regularExport(fanOutExportOffset(index)));
+    }
+    return trie.take();
+}
+
+using Failure = ExportsTrie::Failure;
+using Kind = ExportsTrie::Export::Kind;
+
+} // anonymous namespace
+
+// A node carrying both a terminal and one edge, which is how a trie holds an
+// export whose name is a prefix of another export's name.
+static Vector<uint8_t> prefixAndChildTrie(std::string_view rootEdge, const TerminalSpec& atRootEdge,
+    std::string_view childEdge, const TerminalSpec& atChild)
+{
+    TrieBytes trie;
+    trie.uleb128(0); // The root itself exports nothing.
+    trie.byte(1);
+    trie.cString(rootEdge);
+    size_t rootEdgePatch = trie.uleb128Fixed(0);
+
+    trie.patchUleb128Fixed(rootEdgePatch, trie.position());
+    TrieBytes payload;
+    payload.uleb128(atRootEdge.flags);
+    for (uint64_t value : atRootEdge.values)
+        payload.uleb128(value);
+    Vector<uint8_t> payloadBytes = payload.take();
+    trie.uleb128(payloadBytes.size());
+    trie.bytes(payloadBytes.span());
+    trie.byte(1);
+    trie.cString(childEdge);
+    size_t childPatch = trie.uleb128Fixed(0);
+
+    trie.patchUleb128Fixed(childPatch, trie.position());
+    TrieBytes childPayload;
+    childPayload.uleb128(atChild.flags);
+    for (uint64_t value : atChild.values)
+        childPayload.uleb128(value);
+    Vector<uint8_t> childPayloadBytes = childPayload.take();
+    trie.uleb128(childPayloadBytes.size());
+    trie.bytes(childPayloadBytes.span());
+    trie.byte(0);
+
+    return trie.take();
+}
+
+static void testFoundExports()
+{
+    {
+        Vector<uint8_t> trie = singleExportTrie("_foo", regularExport(0x1234));
+        auto found = ExportsTrie::lookUp(trie.span(), "_foo");
+        TEST_ASSERT(found, "an exported name is found");
+        if (found) {
+            TEST_ASSERT(found->kind == Kind::Regular, "an ordinary export is Regular");
+            TEST_ASSERT_HEX_EQ(found->value, 0x1234, "an ordinary export yields its offset");
+        }
+    }
+    {
+        TerminalSpec spec;
+        spec.flags = EXPORT_SYMBOL_FLAGS_KIND_ABSOLUTE;
+        spec.values.append(0xdeadbeef);
+        Vector<uint8_t> trie = singleExportTrie("_absolute", spec);
+        auto found = ExportsTrie::lookUp(trie.span(), "_absolute");
+        TEST_ASSERT(found, "an absolute export is found");
+        if (found) {
+            TEST_ASSERT(found->kind == Kind::Absolute, "an absolute export is Absolute");
+            TEST_ASSERT_HEX_EQ(found->value, 0xdeadbeef, "an absolute export yields the address itself");
+        }
+    }
+    {
+        // A weak definition is still an ordinary export; the flag sits outside the
+        // kind mask and must not disturb it.
+        TerminalSpec spec;
+        spec.flags = EXPORT_SYMBOL_FLAGS_WEAK_DEFINITION | EXPORT_SYMBOL_FLAGS_KIND_REGULAR;
+        spec.values.append(0x40);
+        Vector<uint8_t> trie = singleExportTrie("_weak", spec);
+        auto found = ExportsTrie::lookUp(trie.span(), "_weak");
+        TEST_ASSERT(found, "a weak definition is found");
+        if (found) {
+            TEST_ASSERT(found->kind == Kind::Regular, "a weak definition is Regular");
+            TEST_ASSERT_HEX_EQ(found->value, 0x40, "a weak definition yields its offset");
+        }
+    }
+    {
+        // Per <mach-o/loader.h>, a stub-and-resolver terminal holds two ULEB128s:
+        // the stub offset and then the resolver offset. The stub is the address
+        // the symbol resolves to; the resolver is only how a lazy binding finds it.
+        TerminalSpec spec;
+        spec.flags = EXPORT_SYMBOL_FLAGS_STUB_AND_RESOLVER | EXPORT_SYMBOL_FLAGS_KIND_REGULAR;
+        spec.values.append(0x1000); // Stub offset.
+        spec.values.append(0x2000); // Resolver offset.
+        Vector<uint8_t> trie = singleExportTrie("_resolved", spec);
+        auto found = ExportsTrie::lookUp(trie.span(), "_resolved");
+        TEST_ASSERT(found, "a stub-and-resolver export is found");
+        if (found) {
+            TEST_ASSERT(found->kind == Kind::Regular, "a stub-and-resolver export is Regular");
+            TEST_ASSERT_HEX_EQ(found->value, 0x1000, "a stub-and-resolver export yields the stub offset");
+        }
+    }
+    {
+        // The highest defined flag bit. It carries no payload of its own, so a
+        // terminal that sets it still decodes; nothing in dyld, ld or cctools reads
+        // it, which is why it must not be mistaken for an unknown bit.
+        TerminalSpec spec;
+        spec.flags = EXPORT_SYMBOL_FLAGS_STATIC_RESOLVER | EXPORT_SYMBOL_FLAGS_KIND_REGULAR;
+        spec.values.append(0x50);
+        Vector<uint8_t> trie = singleExportTrie("_staticResolver", spec);
+        auto found = ExportsTrie::lookUp(trie.span(), "_staticResolver");
+        TEST_ASSERT(found, "an export with the highest defined flag bit is found");
+        if (found) {
+            TEST_ASSERT(found->kind == Kind::Regular, "a static-resolver export is Regular");
+            TEST_ASSERT_HEX_EQ(found->value, 0x50, "a static-resolver export yields its offset");
+        }
+    }
+    {
+        // A terminal may declare more room than its flags and offset need. The spare
+        // room is not part of the offset, and the export still resolves.
+        TrieBytes builder;
+        builder.uleb128(4); // Two bytes more than the payload below uses.
+        builder.uleb128(0); // Flags: an ordinary export.
+        builder.uleb128(0x7f); // Offset.
+        builder.byte(0); // Spare terminal byte.
+        builder.byte(0); // Spare terminal byte.
+        builder.byte(0); // No children.
+        Vector<uint8_t> trie = builder.take();
+        auto found = ExportsTrie::lookUp(trie.span(), "");
+        TEST_ASSERT(found, "a terminal with room to spare still resolves");
+        if (found)
+            TEST_ASSERT_HEX_EQ(found->value, 0x7f, "spare terminal room is not read as the offset");
+    }
+    {
+        // A look up of "" reaches the root's own terminal without walking an edge.
+        Vector<uint8_t> trie = terminalOnlyTrie(regularExport(0x99));
+        auto found = ExportsTrie::lookUp(trie.span(), "");
+        TEST_ASSERT(found, "a terminal at the root is found");
+        if (found)
+            TEST_ASSERT_HEX_EQ(found->value, 0x99, "a terminal at the root yields its offset");
+    }
+    {
+        // Real tries spread a name over several edges, so the walk has to cross
+        // more than one node to reach the terminal.
+        std::array<std::string_view, 3> edges { "_f", "oo", "bar" };
+        Vector<uint8_t> trie = chainedExportTrie(std::span<const std::string_view>(edges), regularExport(0x77));
+        auto found = ExportsTrie::lookUp(trie.span(), "_foobar");
+        TEST_ASSERT(found, "a name spread over several edges is found");
+        if (found)
+            TEST_ASSERT_HEX_EQ(found->value, 0x77, "a multi-edge name yields its offset");
+
+        auto prefix = ExportsTrie::lookUp(trie.span(), "_foo");
+        TEST_ASSERT(!prefix && prefix.error() == Failure::Absent,
+            "a prefix of a multi-edge name is absent");
+        auto extension = ExportsTrie::lookUp(trie.span(), "_foobarbaz");
+        TEST_ASSERT(!extension && extension.error() == Failure::Absent,
+            "an extension of a multi-edge name is absent");
+    }
+    {
+        // "_foo" and "_foobar" both exported: the shorter one lives on a node that
+        // also has children, so a terminal must not end the walk when name is left.
+        Vector<uint8_t> trie = prefixAndChildTrie("_foo", regularExport(0x10), "bar", regularExport(0x20));
+        auto shorter = ExportsTrie::lookUp(trie.span(), "_foo");
+        TEST_ASSERT(shorter, "the shorter of two nested names is found");
+        if (shorter)
+            TEST_ASSERT_HEX_EQ(shorter->value, 0x10, "the shorter name yields its own offset");
+        auto longer = ExportsTrie::lookUp(trie.span(), "_foobar");
+        TEST_ASSERT(longer, "the longer of two nested names is found");
+        if (longer)
+            TEST_ASSERT_HEX_EQ(longer->value, 0x20, "the longer name yields its own offset");
+        TEST_ASSERT(!ExportsTrie::lookUp(trie.span(), "_foobaz"), "a name that diverges is not found");
+    }
+    {
+        // A node's children count is a byte rather than a ULEB128. Decoded as one, a
+        // count of 255 carries a continuation bit, so it would swallow the first
+        // character of the edge behind it: the count comes out far too large and that
+        // edge is read from the wrong byte. 255 edges is the widest a node can be, and
+        // reaching the last of them needs the walk to scan past every edge ahead of it.
+        Vector<uint8_t> trie = fanOutTrie(maximumEdgeCount);
+        for (unsigned index : { 0u, maximumEdgeCount / 2, maximumEdgeCount - 1 }) {
+            auto found = ExportsTrie::lookUp(trie.span(), fanOutEdgeName(index));
+            TEST_ASSERT(found, "an export is found among 255 edges");
+            if (found) {
+                TEST_ASSERT_HEX_EQ(found->value, fanOutExportOffset(index),
+                    "each of 255 edges leads to its own export");
+            }
+        }
+
+        // Nothing matches, so the walk has to scan all 255 edges and end.
+        auto absent = ExportsTrie::lookUp(trie.span(), "zz");
+        TEST_ASSERT(!absent && absent.error() == Failure::Absent,
+            "a name matching none of 255 edges is Absent");
+    }
+}
+
+static void testClassifiedFailures()
+{
+    {
+        TerminalSpec spec;
+        spec.flags = EXPORT_SYMBOL_FLAGS_REEXPORT | EXPORT_SYMBOL_FLAGS_KIND_REGULAR;
+        spec.values.append(1); // Library ordinal.
+        spec.trailingString = "_other";
+        spec.hasTrailingString = true;
+        Vector<uint8_t> trie = singleExportTrie("_reexported", spec);
+        auto result = ExportsTrie::lookUp(trie.span(), "_reexported");
+        TEST_ASSERT(!result && result.error() == Failure::ReExport,
+            "a re-exported name reports ReExport rather than being absent");
+    }
+    {
+        TerminalSpec spec;
+        spec.flags = EXPORT_SYMBOL_FLAGS_KIND_THREAD_LOCAL;
+        spec.values.append(0x30);
+        Vector<uint8_t> trie = singleExportTrie("_threadLocal", spec);
+        auto result = ExportsTrie::lookUp(trie.span(), "_threadLocal");
+        TEST_ASSERT(!result && result.error() == Failure::UnsupportedKind,
+            "a thread-local reports UnsupportedKind: its address differs per thread");
+    }
+    {
+        // The one value the kind mask can hold that Mach-O does not define. A kind
+        // this code does not know cannot be read as an address.
+        TerminalSpec spec;
+        spec.flags = 0x03;
+        spec.values.append(0x30);
+        Vector<uint8_t> trie = singleExportTrie("_unknownKind", spec);
+        auto result = ExportsTrie::lookUp(trie.span(), "_unknownKind");
+        TEST_ASSERT(!result && result.error() == Failure::UnsupportedKind,
+            "an unrecognized kind reports UnsupportedKind");
+    }
+    {
+        Vector<uint8_t> trie = singleExportTrie("_foo", regularExport(0x1234));
+        auto missing = ExportsTrie::lookUp(trie.span(), "_bar");
+        TEST_ASSERT(!missing && missing.error() == Failure::Absent,
+            "a name with no matching edge is Absent");
+        auto shortName = ExportsTrie::lookUp(trie.span(), "_fo");
+        TEST_ASSERT(!shortName && shortName.error() == Failure::Absent,
+            "a name shorter than the edge is Absent");
+        auto emptyName = ExportsTrie::lookUp(trie.span(), "");
+        TEST_ASSERT(!emptyName && emptyName.error() == Failure::Absent,
+            "the empty name is Absent when the root exports nothing");
+    }
+    {
+        // A node with neither a terminal nor children ends the walk without an answer.
+        TrieBytes builder;
+        builder.uleb128(0);
+        builder.byte(0);
+        Vector<uint8_t> trie = builder.take();
+        auto result = ExportsTrie::lookUp(trie.span(), "_foo");
+        TEST_ASSERT(!result && result.error() == Failure::Absent, "a childless root is Absent");
+    }
+}
+
+static void testMalformedTries()
+{
+    {
+        Vector<uint8_t> empty;
+        auto result = ExportsTrie::lookUp(empty.span(), "_foo");
+        TEST_ASSERT(!result && result.error() == Failure::Malformed, "an empty trie is malformed");
+    }
+    {
+        Vector<uint8_t> trie { 0x80 }; // A terminal length that never ends.
+        auto result = ExportsTrie::lookUp(trie.span(), "_foo");
+        TEST_ASSERT(!result && result.error() == Failure::Malformed,
+            "a truncated terminal length is malformed");
+    }
+    {
+        // A terminal claiming more bytes than the trie has left. Rejecting this is
+        // what keeps the children position inside the buffer.
+        Vector<uint8_t> trie { 0x7f };
+        auto result = ExportsTrie::lookUp(trie.span(), "");
+        TEST_ASSERT(!result && result.error() == Failure::Malformed,
+            "a terminal longer than the trie is malformed");
+    }
+    {
+        // A terminal length so large that adding it to the position would wrap.
+        TrieBytes builder;
+        builder.uleb128(std::numeric_limits<uint64_t>::max());
+        builder.byte(0);
+        Vector<uint8_t> trie = builder.take();
+        auto result = ExportsTrie::lookUp(trie.span(), "");
+        TEST_ASSERT(!result && result.error() == Failure::Malformed,
+            "a terminal length that would wrap the position is malformed");
+    }
+    {
+        Vector<uint8_t> trie { 0x01, 0x80 }; // Terminal of one byte, holding half a ULEB128.
+        auto result = ExportsTrie::lookUp(trie.span(), "");
+        TEST_ASSERT(!result && result.error() == Failure::Malformed, "truncated flags are malformed");
+    }
+    {
+        Vector<uint8_t> trie { 0x01, 0x00 }; // Flags say an ordinary export, but no offset follows.
+        auto result = ExportsTrie::lookUp(trie.span(), "");
+        TEST_ASSERT(!result && result.error() == Failure::Malformed,
+            "an export with no offset is malformed");
+    }
+    {
+        // Flags promise a stub offset that the trie does not hold.
+        TrieBytes builder;
+        TrieBytes payload;
+        payload.uleb128(EXPORT_SYMBOL_FLAGS_STUB_AND_RESOLVER | EXPORT_SYMBOL_FLAGS_KIND_REGULAR);
+        Vector<uint8_t> payloadBytes = payload.take();
+        builder.uleb128(payloadBytes.size());
+        builder.bytes(payloadBytes.span());
+        Vector<uint8_t> trie = builder.take();
+        auto result = ExportsTrie::lookUp(trie.span(), "");
+        TEST_ASSERT(!result && result.error() == Failure::Malformed,
+            "a stub-and-resolver export with no offsets is malformed");
+    }
+    {
+        // Only six flag bits are defined. An unknown one may carry a ULEB128 ahead of
+        // the address, so the offset that follows it cannot be trusted to be one.
+        TerminalSpec spec;
+        spec.flags = 0x40;
+        spec.values.append(0x42);
+        Vector<uint8_t> trie = singleExportTrie("_unknownFlag", spec);
+        auto result = ExportsTrie::lookUp(trie.span(), "_unknownFlag");
+        TEST_ASSERT(!result && result.error() == Failure::Malformed,
+            "a terminal with an unknown flag bit is malformed");
+    }
+    {
+        // A terminal that declares only its flags holds no offset. Reading one anyway
+        // would take the children count that follows it as the symbol's address.
+        TrieBytes builder;
+        builder.uleb128(1); // Terminal length: room for the flags alone.
+        builder.uleb128(0); // Flags: an ordinary export, which needs an offset...
+        builder.byte(2); // ...but this is the children count, not one.
+        builder.cString("a");
+        builder.uleb128(0);
+        Vector<uint8_t> trie = builder.take();
+        auto result = ExportsTrie::lookUp(trie.span(), "");
+        TEST_ASSERT(!result && result.error() == Failure::Malformed,
+            "a terminal that ends before its offset is malformed");
+    }
+    {
+        // The offset's encoding runs off the end of the terminal, so completing it
+        // would take a byte belonging to the children.
+        TrieBytes builder;
+        builder.uleb128(2); // Terminal length: the flags and one offset byte.
+        builder.uleb128(0); // Flags.
+        builder.byte(0x80); // First byte of a two-byte offset...
+        builder.byte(0x01); // ...whose second byte lies outside the terminal.
+        builder.byte(0); // No children.
+        Vector<uint8_t> trie = builder.take();
+        auto result = ExportsTrie::lookUp(trie.span(), "");
+        TEST_ASSERT(!result && result.error() == Failure::Malformed,
+            "an offset whose encoding leaves the terminal is malformed");
+    }
+    {
+        // The children count sits past the end of the trie.
+        Vector<uint8_t> trie { 0x00 };
+        auto result = ExportsTrie::lookUp(trie.span(), "_foo");
+        TEST_ASSERT(!result && result.error() == Failure::Malformed,
+            "a missing children count is malformed");
+    }
+    {
+        TrieBytes builder;
+        builder.uleb128(0);
+        builder.byte(1);
+        builder.string("_foo"); // No terminator.
+        Vector<uint8_t> trie = builder.take();
+        auto result = ExportsTrie::lookUp(trie.span(), "_foo");
+        TEST_ASSERT(!result && result.error() == Failure::Malformed,
+            "an unterminated edge is malformed");
+    }
+    {
+        // An empty edge would match anything and consume none of the name, which is
+        // what would let a walk run forever.
+        TrieBytes builder;
+        builder.uleb128(0);
+        builder.byte(1);
+        builder.cString("");
+        builder.uleb128(0);
+        Vector<uint8_t> trie = builder.take();
+        auto result = ExportsTrie::lookUp(trie.span(), "_foo");
+        TEST_ASSERT(!result && result.error() == Failure::Malformed, "an empty edge is malformed");
+    }
+    {
+        TrieBytes builder;
+        builder.uleb128(0);
+        builder.byte(1);
+        builder.cString("_foo");
+        builder.byte(0x80); // A child offset that never ends.
+        Vector<uint8_t> trie = builder.take();
+        auto result = ExportsTrie::lookUp(trie.span(), "_foo");
+        TEST_ASSERT(!result && result.error() == Failure::Malformed,
+            "a truncated child offset is malformed");
+    }
+    {
+        // An edge leading outside the trie.
+        TrieBytes builder;
+        builder.uleb128(0);
+        builder.byte(1);
+        builder.cString("_foo");
+        builder.uleb128(1000);
+        Vector<uint8_t> trie = builder.take();
+        auto result = ExportsTrie::lookUp(trie.span(), "_foo");
+        TEST_ASSERT(!result && result.error() == Failure::Malformed,
+            "a child offset past the end of the trie is malformed");
+    }
+    {
+        // An edge leading into the middle of the node it came from. Whatever that
+        // decodes to, it must be an answer rather than a crash or a hang.
+        TrieBytes builder;
+        builder.uleb128(0);
+        builder.byte(1);
+        builder.cString("_foo");
+        builder.uleb128(2);
+        Vector<uint8_t> trie = builder.take();
+        auto result = ExportsTrie::lookUp(trie.span(), "_foo");
+        TEST_ASSERT(!result, "a child offset into the middle of a node yields no export");
+    }
+    {
+        // A trie truncated part way through a node it claims to hold. The last byte
+        // is the terminal node's children count, which a look up that ends at that
+        // terminal never reads, so removing only that byte still resolves; every
+        // shorter prefix cuts into the terminal itself and must not.
+        Vector<uint8_t> trie = singleExportTrie("_foo", regularExport(0x1234));
+        for (size_t length = 1; length + 1 < trie.size(); ++length) {
+            auto result = ExportsTrie::lookUp(trie.span().first(length), "_foo");
+            TEST_ASSERT(!result, "a truncated trie yields no export");
+        }
+    }
+}
+
+static void testWalkIsBounded()
+{
+    // A node whose only edge leads back to itself. The walk may only follow an edge
+    // by consuming at least one character of the name, so it has to end even though
+    // the trie describes a cycle. Without that property this test would not return.
+    TrieBytes builder;
+    builder.uleb128(0);
+    builder.byte(1);
+    builder.cString("a");
+    builder.uleb128(0); // Back to the root.
+    Vector<uint8_t> trie = builder.take();
+
+    std::string name(20000, 'a');
+    auto result = ExportsTrie::lookUp(trie.span(), name);
+    TEST_ASSERT(!result, "a cyclic trie yields no export");
+
+    // The same cycle reached with a name it cannot consume.
+    auto other = ExportsTrie::lookUp(trie.span(), "b");
+    TEST_ASSERT(!other && other.error() == Failure::Absent, "a cycle whose edge does not match is Absent");
+}
+
+void testExportsTrie()
+{
+    if (!beginSuite("ExportsTrie"))
+        return;
+
+    testFoundExports();
+    testClassifiedFailures();
+    testMalformedTries();
+    testWalkIsBounded();
+}
+
+// A small deterministic generator, so that a failure can be reproduced from the
+// seed the run reports.
+class Random {
+public:
+    explicit Random(uint64_t seed)
+        : m_state(seed ? seed : 0x9e3779b97f4a7c15ull)
+    {
+    }
+
+    uint64_t next()
+    {
+        m_state ^= m_state >> 12;
+        m_state ^= m_state << 25;
+        m_state ^= m_state >> 27;
+        return m_state * 0x2545f4914f6cdd1dull;
+    }
+
+    uint32_t below(uint32_t bound) { return bound ? static_cast<uint32_t>(next() % bound) : 0; }
+
+private:
+    uint64_t m_state;
+};
+
+static Atomic<uint64_t> fuzzIteration;
+static Atomic<bool> fuzzFinished;
+
+static void* fuzzWatchdog(void*)
+{
+    uint64_t lastSeen = 0;
+    unsigned stalledPolls = 0;
+    static constexpr unsigned pollIntervalUsec = 250 * 1000;
+    static constexpr unsigned stallLimitPolls = 40; // Ten seconds.
+
+    while (!fuzzFinished.load()) {
+        usleep(pollIntervalUsec);
+        uint64_t current = fuzzIteration.load();
+        if (current != lastSeen) {
+            lastSeen = current;
+            stalledPolls = 0;
+            continue;
+        }
+        if (++stalledPolls < stallLimitPolls)
+            continue;
+        // The decoder promises to bound its work on any input. A stall means it
+        // does not, so crash here rather than let the run hang: a report with a
+        // stack in the decoder says far more than a timeout does.
+        dataLogLn("FAIL: exports trie look up did not finish on fuzz iteration ", lastSeen);
+        CRASH();
+    }
+    return nullptr;
+}
+
+void fuzzExportsTrie(uint64_t seed, unsigned iterations)
+{
+    if (!beginSuite("ExportsTrie fuzz"))
+        return;
+    dataLogLn("    seed ", RawHex(seed), ", ", iterations, " iterations");
+
+    Random random(seed);
+    fuzzIteration.store(0);
+    fuzzFinished.store(false);
+
+    pthread_t watchdog { };
+    bool watching = !pthread_create(&watchdog, nullptr, fuzzWatchdog, nullptr);
+    TEST_ASSERT(watching, "the fuzz watchdog started");
+
+    Vector<uint8_t> valid = singleExportTrie("_foo", regularExport(0x1234));
+    std::array<std::string_view, 6> names { "_foo", "_foobar", "_f", "", "_bar", "_fop" };
+
+    for (unsigned iteration = 0; iteration < iterations; ++iteration) {
+        fuzzIteration.store(iteration + 1);
+
+        Vector<uint8_t> trie;
+        if (random.below(4)) {
+            // Mostly near-valid tries: those reach further into the decoder than
+            // noise does, because their early fields still make sense.
+            trie = valid;
+            unsigned mutations = 1 + random.below(6);
+            for (unsigned mutation = 0; mutation < mutations; ++mutation)
+                trie[random.below(static_cast<uint32_t>(trie.size()))] = static_cast<uint8_t>(random.next());
+        } else {
+            unsigned length = random.below(64);
+            for (unsigned index = 0; index < length; ++index)
+                trie.append(static_cast<uint8_t>(random.next()));
+        }
+
+        std::string generatedName;
+        std::string_view name;
+        if (random.below(4))
+            name = names[random.below(names.size())];
+        else {
+            unsigned length = random.below(12);
+            for (unsigned index = 0; index < length; ++index)
+                generatedName += static_cast<char>('_' + random.below(48));
+            name = generatedName;
+        }
+
+        auto result = ExportsTrie::lookUp(trie.span(), name);
+        // Noise is allowed to decode as an export. What is not allowed is an
+        // export of a kind the caller cannot act on.
+        if (result) {
+            TEST_ASSERT(result->kind == Kind::Regular || result->kind == Kind::Absolute,
+                "a decoded export has a kind the caller understands");
+        }
+    }
+
+    fuzzFinished.store(true);
+    if (watching)
+        pthread_join(watchdog, nullptr);
+}
+
+} // namespace JSCToolsTest
+
+#endif // (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
diff --git a/Source/JavaScriptCore/corpse/tests/CorpseExportsTrieTest.h b/Source/JavaScriptCore/corpse/tests/CorpseExportsTrieTest.h
new file mode 100644
index 000000000000..29e8bc6b4f8f
--- /dev/null
+++ b/Source/JavaScriptCore/corpse/tests/CorpseExportsTrieTest.h
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2026 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
+
+#include <stdint.h>
+
+namespace JSCToolsTest {
+
+void testExportsTrie();
+
+// Feeds mutated and random tries to the decoder. A trie out of a corpse is
+// untrusted, and the decoder promises to bound its work on any input, which only
+// a run over inputs nobody wrote can really check.
+void fuzzExportsTrie(uint64_t seed, unsigned iterations);
+
+} // namespace JSCToolsTest
+
+#endif // (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
diff --git a/Source/JavaScriptCore/corpse/tests/CorpseProcessTest.cpp b/Source/JavaScriptCore/corpse/tests/CorpseProcessTest.cpp
new file mode 100644
index 000000000000..445ceb9d5b20
--- /dev/null
+++ b/Source/JavaScriptCore/corpse/tests/CorpseProcessTest.cpp
@@ -0,0 +1,197 @@
+/*
+ * Copyright (C) 2026 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "CorpseProcessTest.h"
+
+#if (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
+
+#include "LibJSCToolsTestUtilities.h"
+
+#include <JavaScriptCore/CorpseProcess.h>
+#include <signal.h>
+#include <spawn.h>
+#include <sys/wait.h>
+#include <unistd.h>
+
+namespace JSCToolsTest {
+
+using JSC::Corpse::Process;
+
+// A pid that is certainly not in use: a child that has been reaped. Returns 0 if
+// no child could be made.
+static pid_t reapedChildPid()
+{
+    pid_t child = fork();
+    if (!child)
+        _exit(0);
+    if (child < 0)
+        return 0;
+    int status = 0;
+    if (waitpid(child, &status, 0) != child)
+        return 0;
+    return child;
+}
+
+#if CPU(ARM64)
+// Launches /bin/sh as x86_64, which on Apple silicon means under translation.
+// Returns 0 if this machine cannot run x86_64 code.
+static pid_t spawnTranslatedChild()
+{
+    posix_spawnattr_t attributes;
+    if (posix_spawnattr_init(&attributes))
+        return 0;
+
+    cpu_type_t preference = CPU_TYPE_X86_64;
+    size_t counted = 0;
+    posix_spawnattr_setbinpref_np(&attributes, 1, &preference, &counted);
+
+    char* const arguments[] = {
+        const_cast<char*>("/bin/sh"),
+        const_cast<char*>("-c"),
+        const_cast<char*>("sleep 30"),
+        nullptr
+    };
+    pid_t child = 0;
+    int error = posix_spawn(&child, "/bin/sh", nullptr, &attributes, arguments, nullptr);
+    posix_spawnattr_destroy(&attributes);
+
+    if (error || counted != 1)
+        return 0;
+    return child;
+}
+#endif // CPU(ARM64)
+
+void testProcess()
+{
+    if (!beginSuite("Process"))
+        return;
+
+    {
+        RefPtr<Process> process = Process::create(getpid());
+        TEST_ASSERT(!process->isAttached(), "a new Process is not attached");
+        TEST_ASSERT_EQ(process->pid(), getpid(), "a Process keeps the pid it was given");
+
+        TEST_ASSERT(process->attach(), "attaching to this process succeeds");
+        TEST_ASSERT(process->isAttached(), "attaching leaves the Process attached");
+        TEST_ASSERT(process->holdsLiveTask(), "the task port names this very process");
+        TEST_ASSERT(process->attach(), "attaching an already attached Process succeeds");
+
+        process->detach();
+        TEST_ASSERT(!process->isAttached(), "detaching releases the task port");
+        TEST_ASSERT(!process->holdsLiveTask(), "a detached Process holds no task");
+
+        TEST_ASSERT(process->attach(), "a detached Process can attach again");
+        process->detach();
+        process->detach();
+        TEST_ASSERT(!process->isAttached(), "detaching twice is harmless");
+    }
+    {
+        // Attaching takes a send right to the target's task port, and every path out of
+        // an attach has to give it back. Attaching to this very process yields the name
+        // this task already holds for itself, so the kernel adds a reference to that
+        // name rather than handing out a new one: a right that is never given back
+        // shows up in the reference count and not in the size of the name space.
+        unsigned namesBefore = machPortNameCount();
+        mach_port_t port = MACH_PORT_NULL;
+        unsigned refsAttached = 0;
+        {
+            RefPtr<Process> process = Process::create(getpid());
+            TEST_ASSERT(process->attach(), "attaching to this process succeeds");
+            if (process->isAttached()) {
+                port = process->taskPort();
+                refsAttached = machPortSendRightCount(port);
+                TEST_ASSERT(refsAttached, "an attached Process holds a send right to the task port");
+
+                process->attach();
+                TEST_ASSERT_EQ(machPortSendRightCount(port), refsAttached,
+                    "attaching an attached Process takes no further send right");
+
+                process->detach();
+                TEST_ASSERT_EQ(machPortSendRightCount(port), refsAttached - 1,
+                    "detaching gives the send right back");
+                process->detach();
+                TEST_ASSERT_EQ(machPortSendRightCount(port), refsAttached - 1,
+                    "detaching twice gives back only what one attach took");
+
+                process->attach(); // Left attached, so the destructor has to release it.
+            }
+        }
+        if (refsAttached) {
+            TEST_ASSERT_EQ(machPortSendRightCount(port), refsAttached - 1,
+                "destroying an attached Process gives its send right back");
+            TEST_ASSERT_EQ(machPortNameCount(), namesBefore,
+                "attaching and detaching leaves no port name behind");
+        }
+    }
+    {
+        pid_t gone = reapedChildPid();
+        if (!gone)
+            TEST_ASSERT(gone, "a child could be forked and reaped");
+        else {
+            dataLogLn("    (the next line is the failure this test asks for)");
+            unsigned namesBefore = machPortNameCount();
+            RefPtr<Process> process = Process::create(gone);
+            TEST_ASSERT(!process->attach(), "attaching to a process that has exited fails");
+            TEST_ASSERT(!process->isAttached(), "a failed attach leaves the Process unattached");
+            TEST_ASSERT_EQ(machPortNameCount(), namesBefore, "a failed attach leaves no port name behind");
+        }
+    }
+    {
+        RefPtr<Process> process = Process::create(getpid());
+        TEST_ASSERT(!process->isTranslated(), "this process does not run under translation");
+        // Answering this needs no task port, only the pid.
+        TEST_ASSERT(!process->isAttached(), "asking about translation does not attach");
+    }
+    {
+        RefPtr<Process> initProcess = Process::create(1);
+        TEST_ASSERT(!initProcess->isTranslated(), "launchd does not run under translation");
+    }
+    {
+        pid_t gone = reapedChildPid();
+        if (gone) {
+            RefPtr<Process> process = Process::create(gone);
+            TEST_ASSERT(!process->isTranslated(), "a process that has exited is not translated");
+        }
+    }
+#if CPU(ARM64)
+    {
+        pid_t translated = spawnTranslatedChild();
+        if (!translated)
+            skipSuite("Process translation", "this machine cannot run x86_64 code");
+        else {
+            RefPtr<Process> process = Process::create(translated);
+            TEST_ASSERT(process->isTranslated(), "a process running x86_64 code is translated");
+            kill(translated, SIGKILL);
+            int status = 0;
+            waitpid(translated, &status, 0);
+        }
+    }
+#endif // CPU(ARM64)
+}
+
+} // namespace JSCToolsTest
+
+#endif // (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
diff --git a/Source/JavaScriptCore/corpse/tests/CorpseProcessTest.h b/Source/JavaScriptCore/corpse/tests/CorpseProcessTest.h
new file mode 100644
index 000000000000..1245c56e1e07
--- /dev/null
+++ b/Source/JavaScriptCore/corpse/tests/CorpseProcessTest.h
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2026 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
+
+namespace JSCToolsTest {
+
+void testProcess();
+
+} // namespace JSCToolsTest
+
+#endif // (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
diff --git a/Source/JavaScriptCore/corpse/tests/CorpseRegionTest.cpp b/Source/JavaScriptCore/corpse/tests/CorpseRegionTest.cpp
new file mode 100644
index 000000000000..813b24717cd7
--- /dev/null
+++ b/Source/JavaScriptCore/corpse/tests/CorpseRegionTest.cpp
@@ -0,0 +1,180 @@
+/*
+ * Copyright (C) 2026 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "CorpseRegionTest.h"
+
+#if (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
+
+#include "LibJSCToolsTestUtilities.h"
+
+#include <JavaScriptCore/CorpseAddress.h>
+#include <JavaScriptCore/CorpseRegion.h>
+#include <JavaScriptCore/CorpseSnapshot.h>
+#include <mach/mach.h>
+#include <mach/mach_vm.h>
+#include <string.h>
+#include <sys/mman.h>
+#include <unistd.h>
+
+namespace JSCToolsTest {
+
+using JSC::Corpse::Address;
+using JSC::Corpse::Region;
+
+void testRegion()
+{
+    if (!beginSuite("Region"))
+        return;
+
+    size_t pageSize = static_cast<size_t>(getpagesize());
+    static constexpr size_t mappedPages = 5;
+    static constexpr size_t writtenPages = 2;
+    static constexpr size_t readPages = 1; // Exclusive of writtenPages.
+
+    // The test scratch area is seven pages, with the first and last given back (holes), so
+    // that the five in the middle are a region of known size with a hole on either side.
+    // In this test, we'll check on those hole pages being holes. Hence, we need for them to
+    // stay unmapped.
+    //
+    // Unfortunately, bmalloc or other heaps, when expanding, may consume the lower unmapped
+    // page, and put it to use. This breaks our reliance on it being unmapped. So, we'll
+    // precede the test scratch area with a runway of 10 unmapped pages. This gives any heap
+    // some room to grow into without picking off our hole pages.
+    static constexpr size_t runwayPaddingPages = 10;
+    static constexpr size_t lowerSentinelPage = runwayPaddingPages;
+    static constexpr size_t holeBelowRegion = lowerSentinelPage + 1;
+    static constexpr size_t holeAboveRegion = holeBelowRegion + mappedPages + 1;
+    static constexpr size_t upperSentinelPage = holeAboveRegion + 1;
+    static constexpr size_t reservationPages = upperSentinelPage + 1;
+
+    size_t reservationSize = reservationPages * pageSize;
+    void* reservation = mmap(nullptr, reservationSize, PROT_READ | PROT_WRITE,
+        MAP_PRIVATE | MAP_ANON, -1, 0);
+    if (reservation == MAP_FAILED) {
+        TEST_ASSERT(false, "the required test VA should be mappable");
+        return;
+    }
+    auto addressAt = [&](size_t pageIndex) {
+        return reinterpret_cast<uintptr_t>(reservation) + pageIndex * pageSize;
+    };
+    auto unmapPages = [&](size_t pageIndex, size_t pageCount) {
+        munmap(reinterpret_cast<void*>(addressAt(pageIndex)), pageCount * pageSize);
+    };
+    unmapPages(0, runwayPaddingPages);
+    unmapPages(holeBelowRegion, 1);
+    unmapPages(holeAboveRegion, 1);
+
+    uintptr_t base = addressAt(holeBelowRegion + 1);
+    for (size_t page = 0; page < writtenPages; ++page)
+        *reinterpret_cast<volatile uint8_t*>(base + page * pageSize) = 1; // Touch with write.
+    for (size_t page = writtenPages; page < writtenPages + readPages; ++page)
+        (void)*reinterpret_cast<volatile uint8_t*>(base + page * pageSize); // Touch with read.
+
+    // Gives back everything this test still holds: the region and the two sentinels.
+    // The runwayPaddingPages are already unmapped.
+    auto unmapPagesStillHeld = [&]() {
+        unmapPages(lowerSentinelPage, 1);
+        unmapPages(holeBelowRegion + 1, mappedPages);
+        unmapPages(upperSentinelPage, 1);
+    };
+
+    SelfSnapshot self;
+    if (!self.isValid()) {
+        unmapPagesStillHeld();
+        return;
+    }
+    mach_port_t corpsePort = self.snapshot().corpsePort();
+
+    {
+        auto region = Region::findContaining(corpsePort, Address(static_cast<mach_vm_address_t>(base)));
+        TEST_ASSERT(region, "the region holding a known mapping is found");
+        if (region) {
+            TEST_ASSERT_HEX_EQ(region->base().toMachVMAddress(), base, "the region starts where the mapping does");
+            TEST_ASSERT_EQ(region->size(), mappedPages * pageSize, "the region is as large as the mapping");
+            TEST_ASSERT_HEX_EQ(region->end().toMachVMAddress(), base + mappedPages * pageSize,
+                "the region ends where the mapping does");
+            TEST_ASSERT_EQ(region->pageCount(),
+                static_cast<uint64_t>(mappedPages * pageSize / vm_kernel_page_size),
+                "the region holds as many pages as were mapped");
+            TEST_ASSERT(region->contains(region->base()), "a region contains its first byte");
+            TEST_ASSERT(region->contains(region->end() - 1), "a region contains its last byte");
+            TEST_ASSERT(!region->contains(region->end()), "a region does not contain the byte past its end");
+            TEST_ASSERT(!region->contains(region->base() - 1), "a region does not contain the byte before it");
+
+            uint64_t accessedKernelPages =
+                static_cast<uint64_t>((writtenPages + readPages) * pageSize / vm_kernel_page_size);
+            TEST_ASSERT_EQ(region->residentPageCount(), accessedKernelPages,
+                "the pages that were accessed are the resident ones");
+
+            // Dirty does not mean written: an anonymous page has no pager to be re-read
+            // from, so it counts as dirty from the moment a fault creates it, whether
+            // that fault was a write or a read. The page that was only read is dirty in
+            // most runs but not all, so the written pages are what can be counted on.
+            uint64_t writtenKernelPages = static_cast<uint64_t>(writtenPages * pageSize / vm_kernel_page_size);
+            TEST_ASSERT(region->dirtyPageCount() >= writtenKernelPages
+                && region->dirtyPageCount() <= accessedKernelPages,
+                "every page that was written is dirty and no page that was never accessed is");
+        }
+    }
+    {
+        // An address in the middle of the mapping still finds the whole region.
+        auto region = Region::findContaining(corpsePort,
+            Address(static_cast<mach_vm_address_t>(base + pageSize + 16)));
+        TEST_ASSERT(region, "an address inside the mapping finds the region");
+        if (region)
+            TEST_ASSERT_HEX_EQ(region->base().toMachVMAddress(), base, "any address in a region finds its base");
+    }
+    {
+        // The kernel reports the region at or above the address it is asked about,
+        // so a hole must be reported as a hole rather than as the region above it.
+        auto region = Region::findContaining(corpsePort,
+            Address(static_cast<mach_vm_address_t>(addressAt(holeBelowRegion))));
+        TEST_ASSERT(!region, "an address in an unmapped hole finds no region");
+    }
+    {
+        // The same question asked from the other side. An address in this hole sits past
+        // the end of the region below it, which must not be reported as containing it.
+        auto region = Region::findContaining(corpsePort,
+            Address(static_cast<mach_vm_address_t>(addressAt(holeAboveRegion))));
+        TEST_ASSERT(!region, "an address in the hole above a region finds no region");
+    }
+    {
+        // The shared cache is mapped as a submap, which the search has to descend
+        // into before it can describe what is actually there. A function's address
+        // arrives signed on arm64e, and is an address only once stripped.
+        Address inSharedCache = Address(reinterpret_cast<void*>(&memcpy)).stripped();
+        auto region = Region::findContaining(corpsePort, inSharedCache);
+        TEST_ASSERT(region, "an address in the shared cache finds a region");
+        if (region)
+            TEST_ASSERT(region->size(), "a shared cache region has a size");
+    }
+
+    unmapPagesStillHeld();
+}
+
+} // namespace JSCToolsTest
+
+#endif // (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
diff --git a/Source/JavaScriptCore/corpse/tests/CorpseRegionTest.h b/Source/JavaScriptCore/corpse/tests/CorpseRegionTest.h
new file mode 100644
index 000000000000..b2c14df1c4db
--- /dev/null
+++ b/Source/JavaScriptCore/corpse/tests/CorpseRegionTest.h
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2026 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
+
+namespace JSCToolsTest {
+
+// Takes a corpse of the running test itself, so that everything the corpse
+// reports can be checked against what this process already knows.
+
+void testRegion();
+
+} // namespace JSCToolsTest
+
+#endif // (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
diff --git a/Source/JavaScriptCore/corpse/tests/CorpseSnapshotTest.cpp b/Source/JavaScriptCore/corpse/tests/CorpseSnapshotTest.cpp
new file mode 100644
index 000000000000..92a922f913b3
--- /dev/null
+++ b/Source/JavaScriptCore/corpse/tests/CorpseSnapshotTest.cpp
@@ -0,0 +1,115 @@
+/*
+ * Copyright (C) 2026 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "CorpseSnapshotTest.h"
+
+#if (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
+
+#include "LibJSCToolsTestUtilities.h"
+
+#include <JavaScriptCore/CorpseProcess.h>
+#include <JavaScriptCore/CorpseSnapshot.h>
+#include <mach/mach.h>
+#include <unistd.h>
+
+namespace JSCToolsTest {
+
+using JSC::Corpse::Process;
+using JSC::Corpse::Snapshot;
+
+void testSnapshot()
+{
+    if (!beginSuite("Snapshot"))
+        return;
+
+    RefPtr<Process> process = Process::create(getpid());
+    if (!process->attach()) {
+        TEST_ASSERT(false, "attaching to this process succeeds");
+        return;
+    }
+
+    unsigned firstId = 0;
+    {
+        Snapshot snapshot(process);
+        TEST_ASSERT(snapshot.isValid(), "a snapshot of this process is valid");
+        TEST_ASSERT(MACH_PORT_VALID(snapshot.corpsePort()), "a valid snapshot holds a corpse port");
+        TEST_ASSERT(snapshot.process() == process.get(), "a snapshot keeps the process it came from");
+        firstId = snapshot.id();
+        TEST_ASSERT(firstId, "a snapshot has an identifier");
+
+        Snapshot second(process);
+        TEST_ASSERT(second.isValid(), "a second snapshot of the same process is valid");
+        TEST_ASSERT(second.id() > firstId, "identifiers increase");
+        TEST_ASSERT(second.corpsePort() != snapshot.corpsePort(),
+            "two snapshots hold two different corpses");
+    }
+    {
+        // The two above are gone; their identifiers must not come back.
+        Snapshot later(process);
+        TEST_ASSERT(later.id() > firstId + 1, "identifiers are not reused after a snapshot is destroyed");
+    }
+    {
+        RefPtr<Process> unattached = Process::create(getpid());
+        Snapshot snapshot(unattached);
+        TEST_ASSERT(!snapshot.isValid(), "a snapshot of an unattached process is invalid");
+        TEST_ASSERT(snapshot.threads().isEmpty(), "an invalid snapshot reports no threads");
+        TEST_ASSERT(!snapshot.symbol("g_config"), "an invalid snapshot resolves no symbol");
+    }
+    {
+        RefPtr<Process> none;
+        Snapshot snapshot(none);
+        TEST_ASSERT(!snapshot.isValid(), "a snapshot with no process is invalid");
+    }
+    {
+        Snapshot snapshot(process);
+        TEST_ASSERT(!snapshot.symbol(nullptr), "an unnamed symbol resolves to nothing");
+        TEST_ASSERT(!snapshot.symbol(""), "an empty symbol name resolves to nothing");
+    }
+
+    {
+        // A corpse and the threads read out of it are Mach ports. Taking many
+        // snapshots must not leave any of them behind.
+        static constexpr unsigned rounds = 100;
+        unsigned before = machPortNameCount();
+        for (unsigned round = 0; round < rounds; ++round) {
+            Snapshot snapshot(process);
+            if (!snapshot.isValid())
+                continue;
+            snapshot.threads();
+        }
+        unsigned after = machPortNameCount();
+        // A handful of names may come and go for reasons of their own; a leak of
+        // one port per round would be a hundred.
+        static constexpr unsigned allowedDrift = 8;
+        TEST_ASSERT(after <= before + allowedDrift, "taking and dropping snapshots leaks no Mach port");
+        if (after > before + allowedDrift)
+            dataLogLn("    port names before ", before, ", after ", after, ", over ", rounds, " snapshots");
+    }
+}
+
+} // namespace JSCToolsTest
+
+#endif // (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
diff --git a/Source/JavaScriptCore/corpse/tests/CorpseSnapshotTest.h b/Source/JavaScriptCore/corpse/tests/CorpseSnapshotTest.h
new file mode 100644
index 000000000000..4a0b7759f219
--- /dev/null
+++ b/Source/JavaScriptCore/corpse/tests/CorpseSnapshotTest.h
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2026 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
+
+namespace JSCToolsTest {
+
+// Takes a corpse of the running test itself, so that everything the corpse
+// reports can be checked against what this process already knows.
+
+void testSnapshot();
+
+} // namespace JSCToolsTest
+
+#endif // (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
diff --git a/Source/JavaScriptCore/corpse/tests/CorpseSymbolTest.cpp b/Source/JavaScriptCore/corpse/tests/CorpseSymbolTest.cpp
new file mode 100644
index 000000000000..8bb461be59e2
--- /dev/null
+++ b/Source/JavaScriptCore/corpse/tests/CorpseSymbolTest.cpp
@@ -0,0 +1,161 @@
+/*
+ * Copyright (C) 2026 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "CorpseSymbolTest.h"
+
+#if (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
+
+#include "LibJSCToolsTestUtilities.h"
+
+#include <JavaScriptCore/CorpseAddress.h>
+#include <JavaScriptCore/CorpseSnapshot.h>
+#include <JavaScriptCore/CorpseSymbol.h>
+#include <dlfcn.h>
+#include <mach/mach.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <wtf/MonotonicTime.h>
+#include <wtf/WTFConfig.h>
+
+// Exists in this binary but is not exported, so an exports trie cannot see it.
+// A look up must report that rather than find it some other way.
+extern "C" __attribute__((visibility("hidden"))) int jscToolsTestHiddenGlobal;
+int jscToolsTestHiddenGlobal = 42;
+
+namespace JSCToolsTest {
+
+using JSC::Corpse::Address;
+using JSC::Corpse::Snapshot;
+using JSC::Corpse::Symbol;
+
+// A symbol resolved out of a corpse of this very process must land on the same
+// address this process would use, because the corpse is a copy of this address
+// space. That makes every look up below checkable against ground truth.
+void testSymbol()
+{
+    if (!beginSuite("Symbol"))
+        return;
+
+    SelfSnapshot self;
+    if (!self.isValid())
+        return;
+    Snapshot& snapshot = self.snapshot();
+
+    {
+        // A data symbol exported by the JavaScriptCore framework: an image that is
+        // not in the shared cache, so this checks the slide from __TEXT's link-time
+        // address to where the image actually landed.
+        auto expected = reinterpret_cast<uintptr_t>(WebConfig::g_config);
+        Address found = snapshot.symbol("g_config");
+        TEST_ASSERT(found, "a symbol exported by JavaScriptCore is found");
+        TEST_ASSERT_HEX_EQ(found.toMachVMAddress(), expected,
+            "g_config resolves to the address this process uses for it");
+    }
+    {
+        // A function in the shared cache, where __LINKEDIT is shared between images
+        // and the trie is reached by a different route.
+        void* expected = dlsym(RTLD_DEFAULT, "malloc");
+        TEST_ASSERT(expected, "malloc can be looked up locally");
+        Address found = snapshot.symbol("malloc");
+        TEST_ASSERT(found, "a symbol exported by a shared cache image is found");
+        // A function pointer arrives signed on arm64e; only the address it names is
+        // being compared here.
+        TEST_ASSERT_HEX_EQ(found.stripped().toMachVMAddress(),
+            Address(expected).stripped().toMachVMAddress(),
+            "malloc resolves to the address this process uses for it");
+    }
+    {
+        // A data symbol in the shared cache.
+        void* expected = dlsym(RTLD_DEFAULT, "environ");
+        if (!expected)
+            skipSuite("Symbol environ", "this system does not export environ");
+        else {
+            Address found = snapshot.symbol("environ");
+            TEST_ASSERT(found, "a data symbol in the shared cache is found");
+            TEST_ASSERT_HEX_EQ(found.stripped().toMachVMAddress(),
+                Address(expected).stripped().toMachVMAddress(),
+                "environ resolves to the address this process uses for it");
+        }
+    }
+    {
+        TEST_ASSERT(!snapshot.symbol("jscToolsTestNoSuchSymbolAnywhere"),
+            "a name that is not exported anywhere is not found");
+        TEST_ASSERT(!snapshot.symbol(nullptr), "no name resolves to nothing");
+        TEST_ASSERT(!snapshot.symbol(""), "an empty name resolves to nothing");
+    }
+    {
+        // Only exported symbols appear in a trie. This one is in the binary, and
+        // still must not be found: saying so is the honest answer.
+        TEST_ASSERT(jscToolsTestHiddenGlobal == 42, "the hidden global is in this binary");
+        TEST_ASSERT(!snapshot.symbol("jscToolsTestHiddenGlobal"),
+            "a symbol hidden from the linker is not found");
+    }
+    {
+        // A look up prepends the underscore that a Mach-O symbol name carries, so a
+        // name that already has one is asking for a different symbol.
+        TEST_ASSERT(!snapshot.symbol("_malloc"),
+            "a name given with its underscore already attached is not found");
+    }
+    {
+        // Resolving is expensive, so a snapshot keeps what it has resolved.
+        Address first = snapshot.symbol("g_config");
+        Address second = snapshot.symbol("g_config");
+        TEST_ASSERT(first == second, "resolving the same name twice gives the same address");
+    }
+    {
+        Symbol symbol(snapshot, "g_config");
+        TEST_ASSERT(symbol.name() == "g_config", "a Symbol keeps the name it was asked for");
+        TEST_ASSERT(symbol.isValid(), "a Symbol that resolved is valid");
+        TEST_ASSERT(symbol.address() == snapshot.symbol("g_config"),
+            "a Symbol resolves to what the snapshot reports");
+
+        Symbol missing(snapshot, "jscToolsTestNoSuchSymbolAnywhere");
+        TEST_ASSERT(!missing.isValid(), "a Symbol that did not resolve is not valid");
+        TEST_ASSERT(!missing.address(), "a Symbol that did not resolve has no address");
+        TEST_ASSERT(missing.name() == "jscToolsTestNoSuchSymbolAnywhere",
+            "a Symbol that did not resolve still knows its name");
+
+        Symbol unnamed(snapshot, nullptr);
+        TEST_ASSERT(unnamed.name().empty(), "a Symbol with no name has an empty name");
+        TEST_ASSERT(!unnamed.isValid(), "a Symbol with no name is not valid");
+    }
+    {
+        // A name that is nowhere walks every image in the corpse, which is the most
+        // work a look up can be asked to do. It has to stay bounded.
+        static constexpr double budgetSeconds = 60;
+        MonotonicTime start = MonotonicTime::now();
+        TEST_ASSERT(!snapshot.symbol("jscToolsTestAnotherNameThatIsNowhere"),
+            "an absent name is reported absent");
+        double elapsed = (MonotonicTime::now() - start).seconds();
+        TEST_ASSERT(elapsed < budgetSeconds, "a look up that finds nothing still finishes");
+        if (elapsed >= budgetSeconds)
+            dataLogLn("    the search took ", elapsed, " seconds");
+    }
+}
+
+} // namespace JSCToolsTest
+
+#endif // (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
diff --git a/Source/JavaScriptCore/corpse/tests/CorpseSymbolTest.h b/Source/JavaScriptCore/corpse/tests/CorpseSymbolTest.h
new file mode 100644
index 000000000000..e66d0a11c6a6
--- /dev/null
+++ b/Source/JavaScriptCore/corpse/tests/CorpseSymbolTest.h
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2026 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
+
+namespace JSCToolsTest {
+
+void testSymbol();
+
+} // namespace JSCToolsTest
+
+#endif // (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
diff --git a/Source/JavaScriptCore/corpse/tests/CorpseThreadTest.cpp b/Source/JavaScriptCore/corpse/tests/CorpseThreadTest.cpp
new file mode 100644
index 000000000000..5766b8a4a58f
--- /dev/null
+++ b/Source/JavaScriptCore/corpse/tests/CorpseThreadTest.cpp
@@ -0,0 +1,117 @@
+/*
+ * Copyright (C) 2026 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "CorpseThreadTest.h"
+
+#if (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
+
+#include "LibJSCToolsTestUtilities.h"
+
+#include <JavaScriptCore/CorpseRegion.h>
+#include <JavaScriptCore/CorpseSnapshot.h>
+#include <JavaScriptCore/CorpseThread.h>
+#include <string>
+#include <string_view>
+
+namespace JSCToolsTest {
+
+using JSC::Corpse::Thread;
+
+void testThreads()
+{
+    if (!beginSuite("Thread"))
+        return;
+
+    static constexpr const char* alphaName = "jsctools alpha";
+    static constexpr const char* betaName = "jsctools beta";
+    // Longer than a pthread name can hold, so that truncation is exercised.
+    static constexpr const char* longName =
+        "jsctools a thread whose name is far too long to fit in the space a pthread name has";
+
+    ParkedThreads parked;
+    TEST_ASSERT(parked.spawn(alphaName), "a named thread starts");
+    TEST_ASSERT(parked.spawn(betaName), "a second named thread starts");
+    TEST_ASSERT(parked.spawn(longName), "a thread with an overlong name starts");
+    if (!parked.waitUntilAllParked()) {
+        TEST_ASSERT(false, "the spawned threads parked themselves");
+        return;
+    }
+
+    SelfSnapshot self;
+    if (!self.isValid())
+        return;
+
+    const Vector<Thread>& threads = self.snapshot().threads();
+    TEST_ASSERT(threads.size() >= 1 + parked.count(),
+        "the corpse holds at least this process's own threads");
+
+    bool foundAlpha = false;
+    bool foundBeta = false;
+    bool foundTruncated = false;
+    std::string expectedTruncated(std::string_view(longName).substr(0, ParkedThreads::maximumNameLength));
+
+    for (const Thread& thread : threads) {
+        if (thread.name() == alphaName)
+            foundAlpha = true;
+        else if (thread.name() == betaName)
+            foundBeta = true;
+        else if (thread.name() == expectedTruncated)
+            foundTruncated = true;
+
+        TEST_ASSERT(thread.id(), "every thread has an identifier");
+        TEST_ASSERT(thread.name().length() <= ParkedThreads::maximumNameLength,
+            "no thread name is longer than a pthread name can be");
+
+        // The stack is defined as the region the stack pointer points into, so if
+        // both were read they have to agree.
+        if (thread.stackPointer()) {
+            TEST_ASSERT(thread.hasStack(), "a thread with a stack pointer has a stack region");
+            if (thread.hasStack()) {
+                TEST_ASSERT(thread.stackRegion().contains(thread.stackPointer()),
+                    "a thread's stack pointer lies inside its stack region");
+                TEST_ASSERT(thread.stackRegion().pageCount() >= thread.stackRegion().residentPageCount(),
+                    "a stack has at least as many pages as it has resident");
+            }
+        }
+
+        TEST_ASSERT(!std::string_view(thread.runStateDescription()).empty(),
+            "a thread's run state has a name");
+    }
+
+    TEST_ASSERT(foundAlpha, "a named thread appears in the corpse under its name");
+    TEST_ASSERT(foundBeta, "a second named thread appears under its name");
+    TEST_ASSERT(foundTruncated, "an overlong thread name appears cut to what a pthread name holds");
+
+    // Reading the threads is the expensive part, so it happens once.
+    const Vector<Thread>& again = self.snapshot().threads();
+    TEST_ASSERT(&again == &threads, "the threads of a snapshot are read once and kept");
+
+    parked.stopAndJoin();
+}
+
+} // namespace JSCToolsTest
+
+#endif // (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
diff --git a/Source/JavaScriptCore/corpse/tests/CorpseThreadTest.h b/Source/JavaScriptCore/corpse/tests/CorpseThreadTest.h
new file mode 100644
index 000000000000..8a897ad7551c
--- /dev/null
+++ b/Source/JavaScriptCore/corpse/tests/CorpseThreadTest.h
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2026 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
+
+namespace JSCToolsTest {
+
+// Takes a corpse of the running test itself, so that everything the corpse
+// reports can be checked against what this process already knows.
+
+void testThreads();
+
+} // namespace JSCToolsTest
+
+#endif // (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
diff --git a/Source/JavaScriptCore/corpse/tests/LibJSCToolsTestUtilities.cpp b/Source/JavaScriptCore/corpse/tests/LibJSCToolsTestUtilities.cpp
new file mode 100644
index 000000000000..ad71dbe0365f
--- /dev/null
+++ b/Source/JavaScriptCore/corpse/tests/LibJSCToolsTestUtilities.cpp
@@ -0,0 +1,205 @@
+/*
+ * Copyright (C) 2026 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "LibJSCToolsTestUtilities.h"
+
+#if (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
+
+#include <JavaScriptCore/CorpseProcess.h>
+#include <JavaScriptCore/CorpseSnapshot.h>
+#include <mach/mach.h>
+#include <mach/mach_vm.h>
+#include <pthread.h>
+#include <string>
+#include <unistd.h>
+#include <wtf/StdLibExtras.h>
+
+namespace JSCToolsTest {
+
+unsigned assertionsRun = 0;
+unsigned assertionsFailed = 0;
+unsigned suitesSkipped = 0;
+const char* suiteFilter = nullptr;
+
+bool beginSuite(const char* name)
+{
+    if (suiteFilter && !std::string_view(name).contains(std::string_view(suiteFilter)))
+        return false;
+    dataLogLn("--- ", name);
+    return true;
+}
+
+void skipSuite(const char* name, const char* why)
+{
+    ++suitesSkipped;
+    dataLogLn("SKIP: ", name, ": ", why);
+}
+
+unsigned machPortNameCount()
+{
+    mach_port_name_array_t names = nullptr;
+    mach_msg_type_number_t nameCount = 0;
+    mach_port_type_array_t types = nullptr;
+    mach_msg_type_number_t typeCount = 0;
+    auto result = mach_port_names(mach_task_self(), &names, &nameCount, &types, &typeCount);
+    RELEASE_ASSERT(result == KERN_SUCCESS);
+
+    mach_vm_deallocate(mach_task_self(), reinterpret_cast<mach_vm_address_t>(names), nameCount * sizeof(mach_port_name_t));
+    mach_vm_deallocate(mach_task_self(), reinterpret_cast<mach_vm_address_t>(types), typeCount * sizeof(mach_port_type_t));
+    return nameCount;
+}
+
+unsigned machPortSendRightCount(mach_port_t port)
+{
+    mach_port_urefs_t refs = 0;
+    auto result = mach_port_get_refs(mach_task_self(), port, MACH_PORT_RIGHT_SEND, &refs);
+    if (result == KERN_INVALID_NAME) {
+        // A name this task does not hold is an answer -- it holds no rights under it --
+        // rather than a failure. Hence, has no send right.
+        return 0;
+    }
+    RELEASE_ASSERT(result == KERN_SUCCESS);
+    return refs; // Can still be 0 (which still means no send right).
+}
+
+SelfSnapshot::SelfSnapshot()
+{
+    m_process = JSC::Corpse::Process::create(getpid());
+    if (!m_process->attach()) {
+        TEST_ASSERT(false, "attaching to this process succeeds");
+        return;
+    }
+    m_snapshot = WTF::makeUnique<JSC::Corpse::Snapshot>(m_process);
+    if (!m_snapshot->isValid())
+        TEST_ASSERT(false, "a snapshot of this process is valid");
+}
+
+SelfSnapshot::~SelfSnapshot() = default;
+
+bool SelfSnapshot::isValid() const
+{
+    return m_snapshot && m_snapshot->isValid();
+}
+
+JSC::Corpse::Snapshot& SelfSnapshot::snapshot() const
+{
+    return *m_snapshot;
+}
+
+RefPtr<JSC::Corpse::Process> SelfSnapshot::process() const
+{
+    return m_process;
+}
+
+// One control block for all parked threads, so that they can be told to stop
+// together. Only one ParkedThreads is expected to be alive at a time.
+static pthread_mutex_t parkMutex = PTHREAD_MUTEX_INITIALIZER;
+static unsigned parkedCount = 0;
+static bool parkStopping = false;
+
+struct ParkedThreads::Thread {
+    pthread_t handle { };
+    std::string name;
+};
+
+static void* parkThread(void* argument)
+{
+    auto* thread = static_cast<ParkedThreads::Thread*>(argument);
+    pthread_setname_np(thread->name.c_str());
+
+    pthread_mutex_lock(&parkMutex);
+    ++parkedCount;
+    while (!parkStopping) {
+        pthread_mutex_unlock(&parkMutex);
+        usleep(1000);
+        pthread_mutex_lock(&parkMutex);
+    }
+    pthread_mutex_unlock(&parkMutex);
+    return nullptr;
+}
+
+ParkedThreads::~ParkedThreads()
+{
+    stopAndJoin();
+}
+
+bool ParkedThreads::spawn(const char* name)
+{
+    auto* thread = new Thread;
+    // pthread cuts a name that does not fit, and so must this copy, so that the
+    // name asked for here is the name a corpse will report.
+    thread->name = std::string_view(name).substr(0, maximumNameLength);
+    if (pthread_create(&thread->handle, nullptr, parkThread, thread)) {
+        delete thread;
+        return false;
+    }
+    m_threads.append(thread);
+    return true;
+}
+
+bool ParkedThreads::waitUntilAllParked()
+{
+    // Bounded so that a thread that never starts fails the test rather than
+    // hanging it.
+    for (unsigned attempt = 0; attempt < 5000; ++attempt) {
+        pthread_mutex_lock(&parkMutex);
+        bool ready = parkedCount >= m_threads.size();
+        pthread_mutex_unlock(&parkMutex);
+        if (ready) {
+            // A thread counts itself as parked just before it settles into its
+            // wait, so give it that moment before anything reads its state.
+            usleep(50 * 1000);
+            return true;
+        }
+        usleep(1000);
+    }
+    return false;
+}
+
+void ParkedThreads::stopAndJoin()
+{
+    if (m_threads.isEmpty())
+        return;
+
+    pthread_mutex_lock(&parkMutex);
+    parkStopping = true;
+    pthread_mutex_unlock(&parkMutex);
+
+    for (Thread* thread : m_threads) {
+        pthread_join(thread->handle, nullptr);
+        delete thread;
+    }
+    m_threads.clear();
+
+    pthread_mutex_lock(&parkMutex);
+    parkStopping = false;
+    parkedCount = 0;
+    pthread_mutex_unlock(&parkMutex);
+}
+
+} // namespace JSCToolsTest
+
+#endif // (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
diff --git a/Source/JavaScriptCore/corpse/tests/LibJSCToolsTestUtilities.h b/Source/JavaScriptCore/corpse/tests/LibJSCToolsTestUtilities.h
new file mode 100644
index 000000000000..e34a9abc3c32
--- /dev/null
+++ b/Source/JavaScriptCore/corpse/tests/LibJSCToolsTestUtilities.h
@@ -0,0 +1,159 @@
+/*
+ * Copyright (C) 2026 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
+
+#include <mach/mach.h>
+#include <memory>
+#include <span>
+#include <stdint.h>
+#include <string_view>
+#include <wtf/DataLog.h>
+#include <wtf/HexNumber.h>
+#include <wtf/RefPtr.h>
+#include <wtf/Vector.h>
+
+namespace JSC {
+namespace Corpse {
+class Process;
+class Snapshot;
+}
+}
+
+namespace JSCToolsTest {
+
+// Assertions report against these, and main reports the totals.
+extern unsigned assertionsRun;
+extern unsigned assertionsFailed;
+extern unsigned suitesSkipped;
+
+// Only suites whose name contains this substring run. Null runs all of them.
+extern const char* suiteFilter;
+
+bool beginSuite(const char* name);
+void skipSuite(const char* name, const char* why);
+
+// Nothing is printed for a passing assertion: a passing run should be quiet, and
+// a failing one should say only what failed.
+#define TEST_ASSERT(condition, message) \
+    do { \
+        ++JSCToolsTest::assertionsRun; \
+        if (!(condition)) { \
+            ++JSCToolsTest::assertionsFailed; \
+            dataLogLn("FAIL: ", message, " (", #condition, ") at ", __FILE__, ":", __LINE__); \
+        } \
+    } while (0)
+
+// For values dataLog can print. Reports both sides, which is what makes a
+// failure diagnosable without a debugger.
+#define TEST_ASSERT_EQ(actual, expected, message) \
+    do { \
+        ++JSCToolsTest::assertionsRun; \
+        auto testActual = (actual); \
+        auto testExpected = (expected); \
+        if (!(testActual == testExpected)) { \
+            ++JSCToolsTest::assertionsFailed; \
+            dataLogLn("FAIL: ", message, ": got ", testActual, ", expected ", testExpected, \
+                " at ", __FILE__, ":", __LINE__); \
+        } \
+    } while (0)
+
+#define TEST_ASSERT_HEX_EQ(actual, expected, message) \
+    do { \
+        ++JSCToolsTest::assertionsRun; \
+        uint64_t testActual = (actual); \
+        uint64_t testExpected = (expected); \
+        if (testActual != testExpected) { \
+            ++JSCToolsTest::assertionsFailed; \
+            dataLogLn("FAIL: ", message, ": got 0x", hex(testActual), ", expected 0x", hex(testExpected), \
+                " at ", __FILE__, ":", __LINE__); \
+        } \
+    } while (0)
+
+// The number of names in this task's Mach port name space. Used to show that a
+// sequence of operations leaves no port behind.
+unsigned machPortNameCount();
+
+// The number of send rights this task holds for `port`, or 0 if it holds no name for
+// it. A task that acquires a port it already has a name for gets another reference
+// under that same name rather than a new name, so a right that is taken and never
+// given back shows up here and not in machPortNameCount().
+unsigned machPortSendRightCount(mach_port_t);
+
+// Attaches to this process and takes a corpse of it. That is what lets a test
+// check what a corpse reports against what this process already knows about
+// itself, and it needs no privilege: a task may always snapshot itself.
+//
+// Reports the failure if either step does not work, so a caller only has to
+// check isValid() and return.
+class SelfSnapshot {
+public:
+    SelfSnapshot();
+    ~SelfSnapshot();
+
+    SelfSnapshot(const SelfSnapshot&) = delete;
+    SelfSnapshot& operator=(const SelfSnapshot&) = delete;
+
+    bool isValid() const;
+    JSC::Corpse::Snapshot& snapshot() const;
+    RefPtr<JSC::Corpse::Process> process() const;
+
+private:
+    RefPtr<JSC::Corpse::Process> m_process;
+    std::unique_ptr<JSC::Corpse::Snapshot> m_snapshot;
+};
+
+// Threads that park themselves until stopped, each under a name of our choosing,
+// so that a corpse of this process contains threads whose properties are known.
+class ParkedThreads {
+public:
+    struct Thread;
+
+    // pthread keeps a thread name in a fixed buffer, so a longer name arrives cut
+    // to this length.
+    static constexpr size_t maximumNameLength = 63;
+
+    ~ParkedThreads();
+
+    // Returns false if the thread could not be created.
+    bool spawn(const char* name);
+
+    // Blocks until every spawned thread is parked, so that a snapshot taken
+    // afterwards sees them with their names set and their stacks in use.
+    bool waitUntilAllParked();
+
+    void stopAndJoin();
+
+    size_t count() const { return m_threads.size(); }
+
+private:
+    Vector<Thread*> m_threads;
+};
+
+} // namespace JSCToolsTest
+
+#endif // (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
diff --git a/Source/JavaScriptCore/corpse/tests/testLibJSCTools.cpp b/Source/JavaScriptCore/corpse/tests/testLibJSCTools.cpp
new file mode 100644
index 000000000000..d6da8fecd368
--- /dev/null
+++ b/Source/JavaScriptCore/corpse/tests/testLibJSCTools.cpp
@@ -0,0 +1,155 @@
+/*
+ * Copyright (C) 2026 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include <wtf/DataLog.h>
+
+#if (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
+
+#include "CorpseAddressTest.h"
+#include "CorpseByteParserTest.h"
+#include "CorpseExportsTrieTest.h"
+#include "CorpseProcessTest.h"
+#include "CorpseRegionTest.h"
+#include "CorpseSnapshotTest.h"
+#include "CorpseSymbolTest.h"
+#include "CorpseThreadTest.h"
+#include "LibJSCToolsTestUtilities.h"
+
+#include <stdlib.h>
+#include <string.h>
+#include <string_view>
+#include <wtf/StdLibExtras.h>
+#include <wtf/text/StringToIntegerConversion.h>
+#include <wtf/text/StringView.h>
+
+namespace {
+
+// A default that runs in well under a second, so that every run exercises the
+// decoder on inputs nobody wrote. A longer hunt is a matter of passing a bigger
+// count and a different seed.
+constexpr uint64_t defaultFuzzSeed = 0x5eed1234;
+constexpr unsigned defaultFuzzIterations = 20000;
+
+void printUsage()
+{
+    dataLogLn("Usage: testLibJSCTools [<suite filter>]");
+    dataLogLn("       testLibJSCTools --fuzz-trie [<seed> [<iterations>]]");
+    dataLogLn("");
+    dataLogLn("  Runs the tests for libJavaScriptCoreTools. With a filter, only the");
+    dataLogLn("  suites whose name contains it run.");
+}
+
+bool parseUint64(std::string_view text, uint64_t& out)
+{
+    uint8_t base = text.starts_with("0x") || text.starts_with("0X") ? 16 : 10;
+    if (base == 16)
+        text = text.substr(2);
+    auto parsed = WTF::parseInteger<uint64_t>(StringView::fromLatin1(std::string(text).c_str()), base);
+    if (!parsed)
+        return false;
+    out = *parsed;
+    return true;
+}
+
+} // anonymous namespace
+
+int main(int argc, char** argv)
+{
+    uint64_t fuzzSeed = defaultFuzzSeed;
+    uint64_t fuzzIterations = defaultFuzzIterations;
+    bool fuzzOnly = false;
+
+    // argv is wrapped in a span so that nothing here walks off the end of it.
+    auto arguments = unsafeMakeSpan(argv, static_cast<size_t>(argc));
+    for (size_t index = 1; index < arguments.size(); ++index) {
+        std::string_view argument = arguments[index];
+        if (argument == "--help" || argument == "-h") {
+            printUsage();
+            return 0;
+        }
+        if (argument == "--fuzz-trie") {
+            fuzzOnly = true;
+            if (index + 1 < arguments.size() && parseUint64(arguments[index + 1], fuzzSeed)) {
+                ++index;
+                if (index + 1 < arguments.size() && parseUint64(arguments[index + 1], fuzzIterations))
+                    ++index;
+            }
+            continue;
+        }
+        if (argument.starts_with("-")) {
+            dataLogLn("Unknown option '", arguments[index], "'");
+            printUsage();
+            return 1;
+        }
+        JSCToolsTest::suiteFilter = arguments[index];
+    }
+
+    dataLogLn("Starting libJavaScriptCoreTools tests");
+
+    if (fuzzOnly)
+        JSCToolsTest::fuzzExportsTrie(fuzzSeed, static_cast<unsigned>(fuzzIterations));
+    else {
+        JSCToolsTest::testByteParser();
+        JSCToolsTest::testExportsTrie();
+        JSCToolsTest::fuzzExportsTrie(fuzzSeed, static_cast<unsigned>(fuzzIterations));
+        JSCToolsTest::testAddress();
+        JSCToolsTest::testProcess();
+        JSCToolsTest::testSnapshot();
+        JSCToolsTest::testRegion();
+        JSCToolsTest::testThreads();
+        JSCToolsTest::testSymbol();
+    }
+
+    dataLogLn("Ran ", JSCToolsTest::assertionsRun, " assertions, ",
+        JSCToolsTest::assertionsFailed, " failed, ",
+        JSCToolsTest::suitesSkipped, " suites skipped");
+
+    if (JSCToolsTest::assertionsFailed) {
+        dataLogLn("Some libJavaScriptCoreTools tests FAILED!");
+        return 1;
+    }
+    if (!JSCToolsTest::assertionsRun) {
+        dataLogLn("No tests ran!");
+        return 1;
+    }
+
+    dataLogLn("All libJavaScriptCoreTools tests PASSED!");
+    return 0;
+}
+
+#else // libJavaScriptCoreTools support unavailable
+
+int main(int, char**)
+{
+    // The corpse support is built on Mach task APIs, so there is nothing to test
+    // on other platforms. Simulators and MacCatalyst are also not supported.
+    // Report success so that a run here is not a failure.
+    printf("Not supported platform for testLibJSCTools\n");
+    return 0;
+}
+
+#endif // (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
diff --git a/Source/JavaScriptCore/dfg/DFGArgumentsEliminationPhase.cpp b/Source/JavaScriptCore/dfg/DFGArgumentsEliminationPhase.cpp
index b90a0b9649cf..52567cea948e 100644
--- a/Source/JavaScriptCore/dfg/DFGArgumentsEliminationPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGArgumentsEliminationPhase.cpp
@@ -33,6 +33,7 @@
 #include "DFGArgumentsUtilities.h"
 #include <wtf/IndexMap.h>
 #include "DFGClobberize.h"
+#include "DFGCombinedLiveness.h"
 #include "DFGForAllKills.h"
 #include "DFGGraph.h"
 #include "DFGInsertionSet.h"
@@ -722,7 +723,16 @@ class ArgumentsEliminationPhase : public Phase {
             }
 
             if (clobberStack) {
-                for (Node* node : combinedLiveness.liveAtTail[block])
+                // liveAtTail is the union of the CFG successors' liveAtHead, but a candidate can be kept
+                // alive solely by an exceptional exit to a catch entrypoint, which the DFG models as a
+                // non-CFG successor. Such a candidate is OSR-live at the terminal yet absent from
+                // liveAtTail, so a clobber of its source slots in this block would otherwise go
+                // unnoticed. Cover that gap with the nodes live at the terminal but dead on the tail.
+                // FIXME: If this is ever too conservative we can just calculate the locals used by
+                // the catch block for the terminal.
+                NodeSet possiblyLiveOut = bytecodeLivenessAtTerminal(m_graph, block);
+                possiblyLiveOut.addAll(combinedLiveness.liveAtTail[block]);
+                for (Node* node : possiblyLiveOut)
                     removeViaKill(block, block->size(), node);
 
                 for (unsigned nodeIndex = 0; nodeIndex < block->size(); ++nodeIndex) {
diff --git a/Source/JavaScriptCore/dfg/DFGArrayMode.cpp b/Source/JavaScriptCore/dfg/DFGArrayMode.cpp
index 3d34454eac5b..0601017db462 100644
--- a/Source/JavaScriptCore/dfg/DFGArrayMode.cpp
+++ b/Source/JavaScriptCore/dfg/DFGArrayMode.cpp
@@ -36,10 +36,10 @@
 
 namespace JSC { namespace DFG {
 
-ArrayMode ArrayMode::fromObserved(const ConcurrentJSLocker& locker, ArrayProfile* profile, Array::Action action, bool makeSafe)
+ArrayMode ArrayMode::fromObserved(ArrayProfile profile, Array::Action action, bool makeSafe)
 {
     Array::Class nonArray;
-    if (profile->usesOriginalArrayStructures(locker))
+    if (profile.usesOriginalArrayStructures())
         nonArray = Array::OriginalNonArray;
     else
         nonArray = Array::NonArray;
@@ -63,27 +63,27 @@ ArrayMode ArrayMode::fromObserved(const ConcurrentJSLocker& locker, ArrayProfile
         else
             converts = Array::AsIs;
 
-        return ArrayMode(type, isArray, converts, action).withProfile(locker, profile, makeSafe);
+        return ArrayMode(type, isArray, converts, action).withProfile(profile, makeSafe);
     };
 
-    ArrayModes observed = profile->observedArrayModes(locker);
+    ArrayModes observed = profile.observedArrayModes();
     switch (observed) {
     case 0:
         return ArrayMode(Array::Unprofiled);
     case asArrayModesIgnoringTypedArrays(NonArray):
-        if (action == Array::Write && !profile->mayInterceptIndexedAccesses(locker))
+        if (action == Array::Write && !profile.mayInterceptIndexedAccesses())
             return ArrayMode(Array::SelectUsingArguments, nonArray, Array::OutOfBounds, Array::Convert, action);
-        return ArrayMode(Array::SelectUsingPredictions, nonArray, action).withSpeculationFromProfile(locker, profile, makeSafe);
+        return ArrayMode(Array::SelectUsingPredictions, nonArray, action).withSpeculationFromProfile(profile, makeSafe);
 
     case asArrayModesIgnoringTypedArrays(ArrayWithUndecided):
         if (action == Array::Write)
             return ArrayMode(Array::SelectUsingArguments, Array::Array, Array::OutOfBounds, Array::Convert, action);
-        return ArrayMode(Array::Undecided, Array::Array, Array::OutOfBounds, Array::AsIs, action).withProfile(locker, profile, makeSafe);
+        return ArrayMode(Array::Undecided, Array::Array, Array::OutOfBounds, Array::AsIs, action).withProfile(profile, makeSafe);
         
     case asArrayModesIgnoringTypedArrays(NonArray) | asArrayModesIgnoringTypedArrays(ArrayWithUndecided):
-        if (action == Array::Write && !profile->mayInterceptIndexedAccesses(locker))
+        if (action == Array::Write && !profile.mayInterceptIndexedAccesses())
             return ArrayMode(Array::SelectUsingArguments, Array::PossiblyArray, Array::OutOfBounds, Array::Convert, action);
-        return ArrayMode(Array::SelectUsingPredictions, action).withSpeculationFromProfile(locker, profile, makeSafe);
+        return ArrayMode(Array::SelectUsingPredictions, action).withSpeculationFromProfile(profile, makeSafe);
 
     case asArrayModesIgnoringTypedArrays(NonArrayWithInt32):
     case asArrayModesIgnoringTypedArrays(ArrayWithInt32):
@@ -113,52 +113,52 @@ ArrayMode ArrayMode::fromObserved(const ConcurrentJSLocker& locker, ArrayProfile
         return handleContiguousModes(Array::Contiguous, observed);
 
     case asArrayModesIgnoringTypedArrays(NonArrayWithArrayStorage):
-        return ArrayMode(Array::ArrayStorage, nonArray, Array::AsIs, action).withProfile(locker, profile, makeSafe);
+        return ArrayMode(Array::ArrayStorage, nonArray, Array::AsIs, action).withProfile(profile, makeSafe);
     case asArrayModesIgnoringTypedArrays(NonArrayWithSlowPutArrayStorage):
     case asArrayModesIgnoringTypedArrays(NonArrayWithArrayStorage) | asArrayModesIgnoringTypedArrays(NonArrayWithSlowPutArrayStorage):
-        return ArrayMode(Array::SlowPutArrayStorage, nonArray, Array::AsIs, action).withProfile(locker, profile, makeSafe);
+        return ArrayMode(Array::SlowPutArrayStorage, nonArray, Array::AsIs, action).withProfile(profile, makeSafe);
     case asArrayModesIgnoringTypedArrays(ArrayWithArrayStorage):
-        return ArrayMode(Array::ArrayStorage, Array::Array, Array::AsIs, action).withProfile(locker, profile, makeSafe);
+        return ArrayMode(Array::ArrayStorage, Array::Array, Array::AsIs, action).withProfile(profile, makeSafe);
     case asArrayModesIgnoringTypedArrays(ArrayWithSlowPutArrayStorage):
     case asArrayModesIgnoringTypedArrays(ArrayWithArrayStorage) | asArrayModesIgnoringTypedArrays(ArrayWithSlowPutArrayStorage):
-        return ArrayMode(Array::SlowPutArrayStorage, Array::Array, Array::AsIs, action).withProfile(locker, profile, makeSafe);
+        return ArrayMode(Array::SlowPutArrayStorage, Array::Array, Array::AsIs, action).withProfile(profile, makeSafe);
     case asArrayModesIgnoringTypedArrays(NonArrayWithArrayStorage) | asArrayModesIgnoringTypedArrays(ArrayWithArrayStorage):
-        return ArrayMode(Array::ArrayStorage, Array::PossiblyArray, Array::AsIs, action).withProfile(locker, profile, makeSafe);
+        return ArrayMode(Array::ArrayStorage, Array::PossiblyArray, Array::AsIs, action).withProfile(profile, makeSafe);
     case asArrayModesIgnoringTypedArrays(NonArrayWithSlowPutArrayStorage) | asArrayModesIgnoringTypedArrays(ArrayWithSlowPutArrayStorage):
     case asArrayModesIgnoringTypedArrays(NonArrayWithArrayStorage) | asArrayModesIgnoringTypedArrays(ArrayWithArrayStorage) | asArrayModesIgnoringTypedArrays(NonArrayWithSlowPutArrayStorage) | asArrayModesIgnoringTypedArrays(ArrayWithSlowPutArrayStorage):
-        return ArrayMode(Array::SlowPutArrayStorage, Array::PossiblyArray, Array::AsIs, action).withProfile(locker, profile, makeSafe);
+        return ArrayMode(Array::SlowPutArrayStorage, Array::PossiblyArray, Array::AsIs, action).withProfile(profile, makeSafe);
     case Int8ArrayMode:
-        return ArrayMode(Array::Int8Array, nonArray, Array::AsIs, action).withProfile(locker, profile, makeSafe);
+        return ArrayMode(Array::Int8Array, nonArray, Array::AsIs, action).withProfile(profile, makeSafe);
     case Int16ArrayMode:
-        return ArrayMode(Array::Int16Array, nonArray, Array::AsIs, action).withProfile(locker, profile, makeSafe);
+        return ArrayMode(Array::Int16Array, nonArray, Array::AsIs, action).withProfile(profile, makeSafe);
     case Int32ArrayMode:
-        return ArrayMode(Array::Int32Array, nonArray, Array::AsIs, action).withProfile(locker, profile, makeSafe);
+        return ArrayMode(Array::Int32Array, nonArray, Array::AsIs, action).withProfile(profile, makeSafe);
     case Uint8ArrayMode:
-        return ArrayMode(Array::Uint8Array, nonArray, Array::AsIs, action).withProfile(locker, profile, makeSafe);
+        return ArrayMode(Array::Uint8Array, nonArray, Array::AsIs, action).withProfile(profile, makeSafe);
     case Uint8ClampedArrayMode:
-        return ArrayMode(Array::Uint8ClampedArray, nonArray, Array::AsIs, action).withProfile(locker, profile, makeSafe);
+        return ArrayMode(Array::Uint8ClampedArray, nonArray, Array::AsIs, action).withProfile(profile, makeSafe);
     case Uint16ArrayMode:
-        return ArrayMode(Array::Uint16Array, nonArray, Array::AsIs, action).withProfile(locker, profile, makeSafe);
+        return ArrayMode(Array::Uint16Array, nonArray, Array::AsIs, action).withProfile(profile, makeSafe);
     case Uint32ArrayMode:
-        return ArrayMode(Array::Uint32Array, nonArray, Array::AsIs, action).withProfile(locker, profile, makeSafe);
+        return ArrayMode(Array::Uint32Array, nonArray, Array::AsIs, action).withProfile(profile, makeSafe);
     case Float16ArrayMode:
-        return ArrayMode(Array::Float16Array, nonArray, Array::AsIs, action).withProfile(locker, profile, makeSafe);
+        return ArrayMode(Array::Float16Array, nonArray, Array::AsIs, action).withProfile(profile, makeSafe);
     case Float32ArrayMode:
-        return ArrayMode(Array::Float32Array, nonArray, Array::AsIs, action).withProfile(locker, profile, makeSafe);
+        return ArrayMode(Array::Float32Array, nonArray, Array::AsIs, action).withProfile(profile, makeSafe);
     case Float64ArrayMode:
-        return ArrayMode(Array::Float64Array, nonArray, Array::AsIs, action).withProfile(locker, profile, makeSafe);
+        return ArrayMode(Array::Float64Array, nonArray, Array::AsIs, action).withProfile(profile, makeSafe);
     case BigInt64ArrayMode:
-        return ArrayMode(Array::BigInt64Array, nonArray, Array::AsIs, action).withProfile(locker, profile, makeSafe);
+        return ArrayMode(Array::BigInt64Array, nonArray, Array::AsIs, action).withProfile(profile, makeSafe);
     case BigUint64ArrayMode:
-        return ArrayMode(Array::BigUint64Array, nonArray, Array::AsIs, action).withProfile(locker, profile, makeSafe);
+        return ArrayMode(Array::BigUint64Array, nonArray, Array::AsIs, action).withProfile(profile, makeSafe);
 
     default:
         // If we have seen multiple TypedArray types, or a TypedArray and non-typed array, it doesn't make sense to try to convert the object since you can't convert typed arrays.
         if (observed & ALL_TYPED_ARRAY_MODES)
-            return ArrayMode(Array::Generic, nonArray, Array::AsIs, action).withProfile(locker, profile, makeSafe);
+            return ArrayMode(Array::Generic, nonArray, Array::AsIs, action).withProfile(profile, makeSafe);
 
-        if ((observed & asArrayModesIgnoringTypedArrays(NonArray)) && profile->mayInterceptIndexedAccesses(locker))
-            return ArrayMode(Array::SelectUsingPredictions).withSpeculationFromProfile(locker, profile, makeSafe);
+        if ((observed & asArrayModesIgnoringTypedArrays(NonArray)) && profile.mayInterceptIndexedAccesses())
+            return ArrayMode(Array::SelectUsingPredictions).withSpeculationFromProfile(profile, makeSafe);
         
         Array::Type type;
         Array::Class arrayClass;
@@ -185,7 +185,7 @@ ArrayMode ArrayMode::fromObserved(const ConcurrentJSLocker& locker, ArrayProfile
         else
             arrayClass = Array::PossiblyArray;
         
-        return ArrayMode(type, arrayClass, Array::Convert, action).withProfile(locker, profile, makeSafe);
+        return ArrayMode(type, arrayClass, Array::Convert, action).withProfile(profile, makeSafe);
     }
 }
 
diff --git a/Source/JavaScriptCore/dfg/DFGArrayMode.h b/Source/JavaScriptCore/dfg/DFGArrayMode.h
index 45f4d92ce9f5..051e6ad0f2a3 100644
--- a/Source/JavaScriptCore/dfg/DFGArrayMode.h
+++ b/Source/JavaScriptCore/dfg/DFGArrayMode.h
@@ -209,7 +209,7 @@ class ArrayMode {
         return ArrayMode(word);
     }
     
-    static ArrayMode fromObserved(const ConcurrentJSLocker&, ArrayProfile*, Array::Action, bool makeSafe);
+    static ArrayMode fromObserved(ArrayProfile, Array::Action, bool makeSafe);
 
     ArrayMode withType(Array::Type type) const
     {
@@ -246,31 +246,31 @@ class ArrayMode {
         return ArrayMode(type(), arrayClass, speculation(), conversion(), action(), mayBeLargeTypedArray(), mayBeResizableOrGrowableSharedTypedArray());
     }
 
-    static Array::Speculation speculationFromProfile(const ConcurrentJSLocker& locker, ArrayProfile* profile, bool makeSafe)
+    static Array::Speculation speculationFromProfile(ArrayProfile profile, bool makeSafe)
     {
         if (makeSafe)
             return Array::OutOfBounds;
-        else if (profile->mayStoreToHole(locker))
+        else if (profile.mayStoreToHole())
             return Array::ToHole;
         else
             return Array::InBounds;
     }
 
-    ArrayMode withSpeculationFromProfile(const ConcurrentJSLocker& locker, ArrayProfile* profile, bool makeSafe) const
+    ArrayMode withSpeculationFromProfile(ArrayProfile profile, bool makeSafe) const
     {
-        return withSpeculation(speculationFromProfile(locker, profile, makeSafe));
+        return withSpeculation(speculationFromProfile(profile, makeSafe));
     }
 
-    ArrayMode withProfile(const ConcurrentJSLocker& locker, ArrayProfile* profile, bool makeSafe) const
+    ArrayMode withProfile(ArrayProfile profile, bool makeSafe) const
     {
         Array::Class myArrayClass;
         if (isJSArray()) {
-            if (profile->usesOriginalArrayStructures(locker) && benefitsFromOriginalArray()) {
+            if (profile.usesOriginalArrayStructures() && benefitsFromOriginalArray()) {
                 switch (type()) {
                 case Array::Int32:
                 case Array::Double:
                 case Array::Contiguous: {
-                    ArrayModes arrayModes = profile->observedArrayModes(locker);
+                    ArrayModes arrayModes = profile.observedArrayModes();
                     if (hasSeenCopyOnWriteArray(arrayModes) && !hasSeenWritableArray(arrayModes))
                         myArrayClass = Array::OriginalCopyOnWriteArray;
                     else if (!hasSeenCopyOnWriteArray(arrayModes) && hasSeenWritableArray(arrayModes))
@@ -293,11 +293,9 @@ class ArrayMode {
         } else
             myArrayClass = arrayClass();
 
-        Array::Speculation speculation = speculationFromProfile(locker, profile, makeSafe);
+        Array::Speculation speculation = speculationFromProfile(profile, makeSafe);
 
-        bool mayBeLargeTypedArray = profile->mayBeLargeTypedArray(locker);
-        bool mayBeResizableOrGrowableSharedTypedArray = profile->mayBeResizableOrGrowableSharedTypedArray(locker);
-        return withArrayClassAndSpeculation(myArrayClass, speculation, mayBeLargeTypedArray, mayBeResizableOrGrowableSharedTypedArray);
+        return withArrayClassAndSpeculation(myArrayClass, speculation, profile.mayBeLargeTypedArray(), profile.mayBeResizableOrGrowableSharedTypedArray());
     }
     
     static constexpr SpeculatedType unusedIndexSpeculatedType = SpecInt32Only;
diff --git a/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp b/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
index 983da967562c..7d149beffad8 100644
--- a/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
+++ b/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
@@ -1346,34 +1346,26 @@ class ByteCodeParser {
     ArrayMode getArrayMode(Array::Action action)
     {
         CodeBlock* codeBlock = m_inlineStackTop->m_profiledBlock;
-        ConcurrentJSLocker locker(codeBlock->m_lock);
-        ArrayProfile* profile = codeBlock->getArrayProfile(locker, codeBlock->bytecodeIndex(m_currentInstruction));
+        ArrayProfile* profile = codeBlock->getArrayProfile(codeBlock->bytecodeIndex(m_currentInstruction));
         if (!profile)
             return { };
-        return getArrayMode(locker, *profile, action);
+        return getArrayMode(*profile, action);
     }
 
-    ArrayMode getArrayMode(ArrayProfile& profile, Array::Action action)
+    ArrayMode getArrayMode(ArrayProfile& liveProfile, Array::Action action)
     {
-        ConcurrentJSLocker locker(m_inlineStackTop->m_profiledBlock->m_lock);
-        return getArrayMode(locker, profile, action);
-    }
-
-    ArrayMode getArrayMode(const ConcurrentJSLocker& locker, ArrayProfile& profile, Array::Action action)
-    {
-        profile.computeUpdatedPrediction(m_inlineStackTop->m_profiledBlock);
-        bool makeSafe = profile.outOfBounds(locker);
-        return ArrayMode::fromObserved(locker, &profile, action, makeSafe);
+        liveProfile.computeUpdatedPrediction(m_inlineStackTop->m_profiledBlock);
+        ArrayProfile profile = liveProfile;
+        return ArrayMode::fromObserved(profile, action, profile.outOfBounds());
     }
 
     bool profiledArrayMayBeRegExpMatchesArray()
     {
         CodeBlock* codeBlock = m_inlineStackTop->m_profiledBlock;
-        ConcurrentJSLocker locker(codeBlock->m_lock);
-        ArrayProfile* profile = codeBlock->getArrayProfile(locker, codeBlock->bytecodeIndex(m_currentInstruction));
+        ArrayProfile* profile = codeBlock->getArrayProfile(codeBlock->bytecodeIndex(m_currentInstruction));
         if (!profile)
             return false;
-        return profile->mayBeRegExpMatchesArray(locker);
+        return profile->mayBeRegExpMatchesArray();
     }
 
     Node* makeSafe(Node* node)
diff --git a/Source/JavaScriptCore/dfg/DFGCombinedLiveness.cpp b/Source/JavaScriptCore/dfg/DFGCombinedLiveness.cpp
index b8cd7406d5aa..116bd7e9004f 100644
--- a/Source/JavaScriptCore/dfg/DFGCombinedLiveness.cpp
+++ b/Source/JavaScriptCore/dfg/DFGCombinedLiveness.cpp
@@ -61,6 +61,13 @@ NodeSet liveNodesAtHead(Graph& graph, BasicBlock* block)
     return seen;
 }
 
+NodeSet bytecodeLivenessAtTerminal(Graph& graph, BasicBlock* block)
+{
+    NodeSet seen;
+    addBytecodeLiveness(graph, block->ssa->availabilityAtTail, seen, block->last());
+    return seen;
+}
+
 CombinedLiveness::CombinedLiveness(Graph& graph)
     : liveAtHead(graph.numBlocks())
     , liveAtTail(graph.numBlocks())
@@ -80,11 +87,8 @@ CombinedLiveness::CombinedLiveness(Graph& graph)
         // Unreachable
         //
         // And things may definitely be live in bytecode at that point in the program.
-        if (!block->numSuccessors()) {
-            NodeSet seen;
-            addBytecodeLiveness(graph, block->ssa->availabilityAtTail, seen, block->last());
-            liveAtTail[block] = seen;
-        }
+        if (!block->numSuccessors())
+            liveAtTail[block] = bytecodeLivenessAtTerminal(graph, block);
     }
     
     // Now compute the liveAtTail by unifying the liveAtHead of the successors.
diff --git a/Source/JavaScriptCore/dfg/DFGCombinedLiveness.h b/Source/JavaScriptCore/dfg/DFGCombinedLiveness.h
index a31846febbb4..4d16de38db1f 100644
--- a/Source/JavaScriptCore/dfg/DFGCombinedLiveness.h
+++ b/Source/JavaScriptCore/dfg/DFGCombinedLiveness.h
@@ -35,6 +35,8 @@ namespace JSC { namespace DFG {
 // Returns the set of nodes live at head, both due to DFG and due to bytecode (i.e. OSR exit).
 NodeSet liveNodesAtHead(Graph&, BasicBlock*);
 
+NodeSet bytecodeLivenessAtTerminal(Graph&, BasicBlock*);
+
 // WARNING: This currently does not reason about the liveness of shadow values. The execution
 // semantics of DFG SSA are that an Upsilon stores to the shadow value of a Phi, and the Phi loads
 // from that shadow value. Hence, the shadow values are like variables, and have liveness. The normal
diff --git a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
index 9f2e887d0cd9..c71dd9571197 100644
--- a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
@@ -1373,9 +1373,8 @@ class FixupPhase : public Phase {
                         ArrayModes arrayModes = 0;
                         {
                             CodeBlock* profiledBlock = m_graph.baselineCodeBlockFor(node->origin.semantic);
-                            ConcurrentJSLocker locker(profiledBlock->m_lock);
-                            if (ArrayProfile* arrayProfile = profiledBlock->getArrayProfile(locker, node->origin.semantic.bytecodeIndex()))
-                                arrayModes = arrayProfile->observedArrayModes(locker);
+                            if (ArrayProfile* arrayProfile = profiledBlock->getArrayProfile(node->origin.semantic.bytecodeIndex()))
+                                arrayModes = arrayProfile->observedArrayModes();
                         }
                         auto info = refineArrayModesForMultiGetByVal(node, arrayModes);
                         if (!info)
@@ -1564,9 +1563,8 @@ class FixupPhase : public Phase {
                         ArrayModes arrayModes = 0;
                         {
                             CodeBlock* profiledBlock = m_graph.baselineCodeBlockFor(node->origin.semantic);
-                            ConcurrentJSLocker locker(profiledBlock->m_lock);
-                            if (ArrayProfile* arrayProfile = profiledBlock->getArrayProfile(locker, node->origin.semantic.bytecodeIndex()))
-                                arrayModes = arrayProfile->observedArrayModes(locker);
+                            if (ArrayProfile* arrayProfile = profiledBlock->getArrayProfile(node->origin.semantic.bytecodeIndex()))
+                                arrayModes = arrayProfile->observedArrayModes();
                         }
                         if (auto result = refineArrayModesForMultiPutByVal(node, arrayModes)) {
                             if (m_graph.hasExitSite(node->origin.semantic, OutOfBounds)) {
@@ -5261,11 +5259,10 @@ class FixupPhase : public Phase {
         ArrayMode arrayMode = ArrayMode(Array::SelectUsingPredictions, Array::Read);
         {
             CodeBlock* profiledBlock = m_graph.baselineCodeBlockFor(node->origin.semantic);
-            ConcurrentJSLocker locker(profiledBlock->m_lock);
-            ArrayProfile* arrayProfile = profiledBlock->getArrayProfile(locker, node->origin.semantic.bytecodeIndex());
-            if (arrayProfile) {
-                arrayProfile->computeUpdatedPrediction(profiledBlock);
-                arrayMode = ArrayMode::fromObserved(locker, arrayProfile, Array::Read, false);
+            ArrayProfile* liveProfile = profiledBlock->getArrayProfile(node->origin.semantic.bytecodeIndex());
+            if (liveProfile) {
+                liveProfile->computeUpdatedPrediction(profiledBlock);
+                arrayMode = ArrayMode::fromObserved(*liveProfile, Array::Read, false);
                 if (arrayMode.type() == Array::Unprofiled) {
                     // For normal array operations, it makes sense to treat Unprofiled
                     // accesses as ForceExit and get more data rather than using
diff --git a/Source/JavaScriptCore/dfg/DFGForAllKills.h b/Source/JavaScriptCore/dfg/DFGForAllKills.h
index 6cc22cb83256..8b1a134070b6 100644
--- a/Source/JavaScriptCore/dfg/DFGForAllKills.h
+++ b/Source/JavaScriptCore/dfg/DFGForAllKills.h
@@ -34,10 +34,6 @@
 
 namespace JSC { namespace DFG {
 
-namespace ForAllKillsInternal {
-constexpr bool verbose = false;
-}
-
 // Utilities for finding the last points where a node is live in DFG SSA. This accounts for liveness due
 // to OSR exit. This is usually used for enumerating over all of the program points where a node is live,
 // by exploring all blocks where the node is live at tail and then exploring all program points where the
@@ -170,34 +166,6 @@ void forAllKilledNodesAtNodeIndex(
         });
 }
 
-// Tells you all of the places to start searching from in a basic block. Gives you the node index at which
-// the value is either no longer live. This pretends that nodes are dead at the end of the block, so that
-// you can use this to do per-basic-block analyses.
-template<ConstInvocable<void(unsigned, Node*)> Functor>
-void forAllKillsInBlock(
-    Graph& graph, const CombinedLiveness& combinedLiveness, BasicBlock* block,
-    const Functor& functor)
-{
-    for (Node* node : combinedLiveness.liveAtTail[block])
-        functor(block->size(), node);
-    
-    LocalOSRAvailabilityCalculator localAvailability(graph);
-    localAvailability.beginBlock(block);
-    // Start running functor at the second node, because the functor is expected to only inspect nodes from the start of
-    // the block up to nodeIndex (exclusive), so if nodeIndex is zero then the functor has nothing to do.
-    for (unsigned nodeIndex = 0; nodeIndex < block->size(); ++nodeIndex) {
-        dataLogLnIf(ForAllKillsInternal::verbose, "local availability at index: ", nodeIndex, " ", localAvailability.m_availability);
-        if (nodeIndex) {
-            forAllKilledNodesAtNodeIndex(
-                graph, localAvailability.m_availability, block, nodeIndex,
-                [&] (Node* node) {
-                    functor(nodeIndex, node);
-                });
-        }
-        localAvailability.executeNode(block->at(nodeIndex));
-    }
-}
-
 } } // namespace JSC::DFG
 
 #endif // ENABLE(DFG_JIT)
diff --git a/Source/JavaScriptCore/dfg/DFGOSRAvailabilityAnalysisPhase.cpp b/Source/JavaScriptCore/dfg/DFGOSRAvailabilityAnalysisPhase.cpp
index 690d784b2fac..8f25e4e705c8 100644
--- a/Source/JavaScriptCore/dfg/DFGOSRAvailabilityAnalysisPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGOSRAvailabilityAnalysisPhase.cpp
@@ -359,8 +359,10 @@ void LocalOSRAvailabilityCalculator::executeNode(Node* node)
     case LoadVarargs:
     case ForwardVarargs: {
         LoadVarargsData* data = node->loadVarargsData();
+        killHeaps(data->count);
         m_availability.m_locals.operand(data->count) = Availability(node->child1().node(), FlushedAt(FlushedInt32, data->machineCount));
         for (unsigned i = data->limit; i--;) {
+            killHeaps(data->start + i);
             m_availability.m_locals.operand(data->start + i) =
                 Availability(FlushedAt(FlushedJSValue, data->machineStart.isValid() ? (data->machineStart + i) : VirtualRegister()));
         }
diff --git a/Source/JavaScriptCore/dfg/DFGOSRExit.cpp b/Source/JavaScriptCore/dfg/DFGOSRExit.cpp
index 67c56dae3717..a637b93e2114 100644
--- a/Source/JavaScriptCore/dfg/DFGOSRExit.cpp
+++ b/Source/JavaScriptCore/dfg/DFGOSRExit.cpp
@@ -325,7 +325,7 @@ void OSRExit::compileExit(CCallHelpers& jit, VM& vm, const OSRExit& exit, const
 
             CodeOrigin codeOrigin = exit.m_codeOriginForExitProfile;
             CodeBlock* codeBlock = jit.baselineCodeBlockFor(codeOrigin);
-            if (ArrayProfile* arrayProfile = codeBlock->getArrayProfile(ConcurrentJSLocker(codeBlock->m_lock), codeOrigin.bytecodeIndex())) {
+            if (ArrayProfile* arrayProfile = codeBlock->getArrayProfile(codeOrigin.bytecodeIndex())) {
                 GPRReg usedRegister;
                 if (exit.m_jsValueSource.isAddress())
                     usedRegister = exit.m_jsValueSource.base();
diff --git a/Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp b/Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp
index 78a6333a0270..0324ff8c29d1 100644
--- a/Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp
+++ b/Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp
@@ -264,7 +264,7 @@ static void compileStub(VM& vm, unsigned exitID, JITCode* jitCode, OSRExit& exit
         if (exit.m_kind == BadCache || exit.m_kind == BadIndexingType) {
             CodeOrigin codeOrigin = exit.m_codeOriginForExitProfile;
             CodeBlock* codeBlock = jit.baselineCodeBlockFor(codeOrigin);
-            if (ArrayProfile* arrayProfile = codeBlock->getArrayProfile(ConcurrentJSLocker(codeBlock->m_lock), codeOrigin.bytecodeIndex())) {
+            if (ArrayProfile* arrayProfile = codeBlock->getArrayProfile(codeOrigin.bytecodeIndex())) {
                 jit.move(CCallHelpers::TrustedImmPtr(arrayProfile), GPRInfo::regT3);
                 jit.load32(MacroAssembler::Address(GPRInfo::regT0, JSCell::structureIDOffset()), GPRInfo::regT1);
                 jit.store32(GPRInfo::regT1, CCallHelpers::Address(GPRInfo::regT3, ArrayProfile::offsetOfSpeculationFailureStructureID()));
diff --git a/Source/JavaScriptCore/inspector/agents/InspectorAgent.cpp b/Source/JavaScriptCore/inspector/agents/InspectorAgent.cpp
index 1343b440d37c..d4ba877730f3 100644
--- a/Source/JavaScriptCore/inspector/agents/InspectorAgent.cpp
+++ b/Source/JavaScriptCore/inspector/agents/InspectorAgent.cpp
@@ -43,7 +43,7 @@ InspectorAgent::InspectorAgent(AgentContext& context)
     : InspectorAgentBase("Inspector"_s)
     , m_environment(context.environment)
     , m_frontendDispatcher(makeUniqueRef<InspectorFrontendDispatcher>(context.frontendRouter))
-    , m_backendDispatcher(InspectorBackendDispatcher::create(context.backendDispatcher, this))
+    , m_backendDispatcher(InspectorBackendDispatcher::create(protect(context.backendDispatcher), this))
 {
 }
 
diff --git a/Source/JavaScriptCore/inspector/agents/InspectorAuditAgent.cpp b/Source/JavaScriptCore/inspector/agents/InspectorAuditAgent.cpp
index 9c0943e7c1b0..693d154dab51 100644
--- a/Source/JavaScriptCore/inspector/agents/InspectorAuditAgent.cpp
+++ b/Source/JavaScriptCore/inspector/agents/InspectorAuditAgent.cpp
@@ -44,7 +44,7 @@ WTF_MAKE_TZONE_ALLOCATED_IMPL(InspectorAuditAgent);
 
 InspectorAuditAgent::InspectorAuditAgent(AgentContext& context)
     : InspectorAgentBase("Audit"_s)
-    , m_backendDispatcher(AuditBackendDispatcher::create(context.backendDispatcher, this))
+    , m_backendDispatcher(AuditBackendDispatcher::create(protect(context.backendDispatcher), this))
     , m_injectedScriptManager(context.injectedScriptManager)
     , m_debugger(CheckedRef { context.environment }->debugger())
 {
diff --git a/Source/JavaScriptCore/inspector/agents/InspectorConsoleAgent.cpp b/Source/JavaScriptCore/inspector/agents/InspectorConsoleAgent.cpp
index 074cd02f2eb6..2398ddf05320 100644
--- a/Source/JavaScriptCore/inspector/agents/InspectorConsoleAgent.cpp
+++ b/Source/JavaScriptCore/inspector/agents/InspectorConsoleAgent.cpp
@@ -46,7 +46,7 @@ InspectorConsoleAgent::InspectorConsoleAgent(AgentContext& context)
     : InspectorAgentBase("Console"_s)
     , m_injectedScriptManager(context.injectedScriptManager)
     , m_frontendDispatcher(makeUniqueRef<ConsoleFrontendDispatcher>(context.frontendRouter))
-    , m_backendDispatcher(ConsoleBackendDispatcher::create(context.backendDispatcher, this))
+    , m_backendDispatcher(ConsoleBackendDispatcher::create(protect(context.backendDispatcher), this))
 {
 }
 
diff --git a/Source/JavaScriptCore/inspector/agents/InspectorDebuggerAgent.cpp b/Source/JavaScriptCore/inspector/agents/InspectorDebuggerAgent.cpp
index 532b83432c39..3b82f9acd297 100644
--- a/Source/JavaScriptCore/inspector/agents/InspectorDebuggerAgent.cpp
+++ b/Source/JavaScriptCore/inspector/agents/InspectorDebuggerAgent.cpp
@@ -269,7 +269,7 @@ RefPtr<JSC::Breakpoint> InspectorDebuggerAgent::debuggerBreakpointFromPayload(Pr
 InspectorDebuggerAgent::InspectorDebuggerAgent(AgentContext& context)
     : InspectorAgentBase("Debugger"_s)
     , m_frontendDispatcher(makeUniqueRef<DebuggerFrontendDispatcher>(context.frontendRouter))
-    , m_backendDispatcher(DebuggerBackendDispatcher::create(context.backendDispatcher, this))
+    , m_backendDispatcher(DebuggerBackendDispatcher::create(protect(context.backendDispatcher), this))
     , m_debugger(*CheckedRef { context.environment }->debugger())
     , m_injectedScriptManager(context.injectedScriptManager)
 {
diff --git a/Source/JavaScriptCore/inspector/agents/InspectorHeapAgent.cpp b/Source/JavaScriptCore/inspector/agents/InspectorHeapAgent.cpp
index 90d674e4dbad..92363e58b04c 100644
--- a/Source/JavaScriptCore/inspector/agents/InspectorHeapAgent.cpp
+++ b/Source/JavaScriptCore/inspector/agents/InspectorHeapAgent.cpp
@@ -48,7 +48,7 @@ InspectorHeapAgent::InspectorHeapAgent(AgentContext& context)
     : InspectorAgentBase("Heap"_s)
     , m_injectedScriptManager(context.injectedScriptManager)
     , m_frontendDispatcher(makeUniqueRef<HeapFrontendDispatcher>(context.frontendRouter))
-    , m_backendDispatcher(HeapBackendDispatcher::create(context.backendDispatcher, this))
+    , m_backendDispatcher(HeapBackendDispatcher::create(protect(context.backendDispatcher), this))
     , m_environment(context.environment)
 {
 }
diff --git a/Source/JavaScriptCore/inspector/agents/InspectorScriptProfilerAgent.cpp b/Source/JavaScriptCore/inspector/agents/InspectorScriptProfilerAgent.cpp
index 430a0f5ed8f1..2b4df03ddc43 100644
--- a/Source/JavaScriptCore/inspector/agents/InspectorScriptProfilerAgent.cpp
+++ b/Source/JavaScriptCore/inspector/agents/InspectorScriptProfilerAgent.cpp
@@ -43,7 +43,7 @@ WTF_MAKE_TZONE_ALLOCATED_IMPL(InspectorScriptProfilerAgent);
 InspectorScriptProfilerAgent::InspectorScriptProfilerAgent(AgentContext& context)
     : InspectorAgentBase("ScriptProfiler"_s)
     , m_frontendDispatcher(makeUniqueRef<ScriptProfilerFrontendDispatcher>(context.frontendRouter))
-    , m_backendDispatcher(ScriptProfilerBackendDispatcher::create(context.backendDispatcher, this))
+    , m_backendDispatcher(ScriptProfilerBackendDispatcher::create(protect(context.backendDispatcher), this))
     , m_environment(context.environment)
 {
 }
diff --git a/Source/JavaScriptCore/inspector/agents/JSGlobalObjectRuntimeAgent.cpp b/Source/JavaScriptCore/inspector/agents/JSGlobalObjectRuntimeAgent.cpp
index b43bf2c0a905..801bfccddc56 100644
--- a/Source/JavaScriptCore/inspector/agents/JSGlobalObjectRuntimeAgent.cpp
+++ b/Source/JavaScriptCore/inspector/agents/JSGlobalObjectRuntimeAgent.cpp
@@ -40,7 +40,7 @@ WTF_MAKE_TZONE_ALLOCATED_IMPL(JSGlobalObjectRuntimeAgent);
 JSGlobalObjectRuntimeAgent::JSGlobalObjectRuntimeAgent(JSAgentContext& context)
     : InspectorRuntimeAgent(context)
     , m_frontendDispatcher(makeUniqueRef<RuntimeFrontendDispatcher>(context.frontendRouter))
-    , m_backendDispatcher(RuntimeBackendDispatcher::create(context.backendDispatcher, this))
+    , m_backendDispatcher(RuntimeBackendDispatcher::create(protect(context.backendDispatcher), this))
     , m_globalObject(context.inspectedGlobalObject)
 {
 }
diff --git a/Source/JavaScriptCore/inspector/remote/cocoa/RemoteInspectorCocoa.mm b/Source/JavaScriptCore/inspector/remote/cocoa/RemoteInspectorCocoa.mm
index 404bc4fad14d..469033e6b96b 100644
--- a/Source/JavaScriptCore/inspector/remote/cocoa/RemoteInspectorCocoa.mm
+++ b/Source/JavaScriptCore/inspector/remote/cocoa/RemoteInspectorCocoa.mm
@@ -127,7 +127,7 @@ static bool canAccessWebInspectorMachPort()
 }
 
 RemoteInspector::RemoteInspector()
-    : m_xpcQueue(adoptOSObject(dispatch_queue_create("com.apple.JavaScriptCore.remote-inspector-xpc", DISPATCH_QUEUE_SERIAL)))
+    : m_xpcQueue(adoptOSObject(dispatch_queue_create("com.apple.JavaScriptCore.remote-inspector-xpc", serialQueueWithAutoreleasePoolAttrSingleton())))
 {
 }
 
diff --git a/Source/JavaScriptCore/jit/JITCall.cpp b/Source/JavaScriptCore/jit/JITCall.cpp
index ecaae8c39f92..19bd4bce03e5 100644
--- a/Source/JavaScriptCore/jit/JITCall.cpp
+++ b/Source/JavaScriptCore/jit/JITCall.cpp
@@ -465,7 +465,6 @@ void JIT::emit_op_iterator_next(const JSInstruction* instruction)
     genericCases.append(branchIfNotType(nextJSR.payloadGPR(), SentinelType));
 
     JumpList doneCases;
-#if CPU(ARM64) || CPU(X86_64)
     loadGlobalObject(argumentGPR0);
     emitGetVirtualRegister(bytecode.m_iterator, argumentGPR1);
     emitGetVirtualRegister(bytecode.m_iterable, argumentGPR2);
@@ -474,19 +473,7 @@ void JIT::emit_op_iterator_next(const JSInstruction* instruction)
     emitPutVirtualRegister(bytecode.m_done, returnValueGPR);
     emitPutVirtualRegister(bytecode.m_value, returnValueGPR2);
     doneCases.append(branchIfEmpty(JSValueRegs { returnValueGPR2 }));
-    emitValueProfilingSite(bytecode, JSValueRegs { returnValueGPR2 });
-#else
-    auto* tryFastFunction = ([&] () {
-        switch (instruction->width()) {
-        case Narrow: return iterator_next_try_fast_narrow;
-        case Wide16: return iterator_next_try_fast_wide16;
-        case Wide32: return iterator_next_try_fast_wide32;
-        default: RELEASE_ASSERT_NOT_REACHED();
-        }
-    })();
-    JITSlowPathCall slowPathCall(this, tryFastFunction);
-    slowPathCall.call();
-#endif
+    emitValueProfilingSite(bytecode, m_bytecodeIndex.withCheckpoint(OpIteratorNext::getValue), JSValueRegs { returnValueGPR2 });
     doneCases.append(jump());
 
     genericCases.link(this);
diff --git a/Source/JavaScriptCore/jsc.cpp b/Source/JavaScriptCore/jsc.cpp
index cdb26ba465bc..92c287e33ab4 100644
--- a/Source/JavaScriptCore/jsc.cpp
+++ b/Source/JavaScriptCore/jsc.cpp
@@ -129,6 +129,7 @@
 #include <wtf/OSObjectPtr.h>
 #include <wtf/cocoa/CrashReporter.h>
 #include <wtf/cocoa/RuntimeApplicationChecksCocoa.h>
+#include <wtf/darwin/DispatchExtras.h>
 #endif
 
 #if PLATFORM(GTK)
@@ -4941,7 +4942,7 @@ int jscmain(int argc, char** argv)
     auto& memoryPressureHandler = MemoryPressureHandler::singleton();
     {
         // FIXME: This is a false positive. rdar://160931336
-        SUPPRESS_RETAINPTR_CTOR_ADOPT auto queue = adoptOSObject(dispatch_queue_create("jsc shell memory pressure handler", DISPATCH_QUEUE_SERIAL));
+        SUPPRESS_RETAINPTR_CTOR_ADOPT OSObjectPtr queue = adoptOSObject(dispatch_queue_create("jsc shell memory pressure handler", serialQueueWithAutoreleasePoolAttrSingleton()));
         memoryPressureHandler.setDispatchQueue(WTF::move(queue));
     }
     Box<Critical> memoryPressureCriticalState = Box<Critical>::create(Critical::No);
diff --git a/Source/JavaScriptCore/mya/mya.cpp b/Source/JavaScriptCore/mya/mya.cpp
new file mode 100644
index 000000000000..1ee8ccd46547
--- /dev/null
+++ b/Source/JavaScriptCore/mya/mya.cpp
@@ -0,0 +1,1407 @@
+/*
+ * Copyright (C) 2026 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
+
+#include <JavaScriptCore/CorpseAddress.h>
+#include <JavaScriptCore/CorpseClient.h>
+#include <JavaScriptCore/CorpseProcess.h>
+#include <JavaScriptCore/CorpseRegion.h>
+#include <JavaScriptCore/CorpseSnapshot.h>
+#include <JavaScriptCore/CorpseThread.h>
+#include <algorithm>
+#include <ctype.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <limits.h>
+#include <memory>
+#include <pwd.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <string>
+#include <string_view>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <unistd.h>
+#include <vector>
+#include <wtf/ASCIICType.h>
+#include <wtf/Assertions.h>
+#include <wtf/CheckedArithmetic.h>
+#include <wtf/DoublyLinkedList.h>
+#include <wtf/HashMap.h>
+#include <wtf/Ref.h>
+#include <wtf/RefPtr.h>
+#include <wtf/Vector.h>
+
+#if HAVE(READLINE)
+// readline/history.h has a Function typedef that conflicts with WTF::Function;
+// rename it across these includes to avoid the clash.
+#define Function ReadlineFunction
+#include <readline/history.h>
+#include <readline/readline.h>
+#undef Function
+#endif
+
+WTF_ALLOW_UNSAFE_BUFFER_USAGE_BEGIN
+
+using JSC::Corpse::Address;
+using JSC::Corpse::Process;
+using JSC::Corpse::Snapshot;
+using JSC::Corpse::Thread;
+
+namespace Mya {
+
+// A lexer over a null-terminated string. Parsing methods skip leading
+// whitespace and advance past whatever they consume; a failed parse leaves the
+// position where it was. A Lexer is essentially made up of a position in the
+// string. So copying one is how you look ahead without committing.
+class Lexer {
+public:
+    explicit Lexer(const char* text)
+        : m_at(text)
+    {
+    }
+
+    void skipWhitespace()
+    {
+        while (isTabOrSpace(*m_at))
+            ++m_at;
+    }
+
+    // True if only whitespace remains.
+    bool atEnd()
+    {
+        skipWhitespace();
+        return !*m_at;
+    }
+
+    // The next non-whitespace character, or '\0' at end of input.
+    char peek()
+    {
+        skipWhitespace();
+        return *m_at;
+    }
+
+    // Consumes and returns the next whitespace-delimited token, which is empty
+    // at end of input.
+    std::string_view nextToken()
+    {
+        skipWhitespace();
+        const char* start = m_at;
+        while (*m_at && !isTabOrSpace(*m_at))
+            ++m_at;
+        return std::string_view(start, static_cast<size_t>(m_at - start));
+    }
+
+    // Consumes the next token only if it matches word.
+    bool consumeToken(const char* word)
+    {
+        Lexer probe = *this;
+        if (probe.nextToken() != word)
+            return false;
+        *this = probe;
+        return true;
+    }
+
+    // Consumes the next non-whitespace character only if it matches c.
+    bool consumeChar(char c)
+    {
+        skipWhitespace();
+        if (*m_at != c)
+            return false;
+        ++m_at;
+        return true;
+    }
+
+    // Consumes a positive number from the specified `minimum` upwards, but capped at INT_MAX.
+    template<long minimum = 0, typename T>
+    bool consumeUint32(T& out)
+    {
+        skipWhitespace();
+        if (!isASCIIDigit(*m_at))
+            return false; // Rejects cases like -0, -1, +3, which strtol allows.
+        errno = 0;
+        char* end = nullptr;
+        long value = strtol(m_at, &end, 10);
+        if (end == m_at || errno || value < minimum || value > INT_MAX)
+            return false;
+        m_at = end;
+        out = static_cast<T>(value);
+        return true;
+    }
+
+    bool consumePID(pid_t& pid) { return consumeUint32<1>(pid); }
+
+private:
+    const char* m_at;
+};
+
+class Shell {
+public:
+    ~Shell()
+    {
+        cleanup();
+    }
+
+    int run(int argc, char** argv)
+    {
+        JSC::Corpse::Client::setName("mya"_s);
+        auto action = parseArguments(argc, argv);
+        switch (action) {
+        case ContinuationAction::Continue:
+            openHistory();
+            runInteractive();
+            return 0;
+        case ContinuationAction::Exit:
+            return 0;
+        case ContinuationAction::Error:
+            return 1;
+        }
+        RELEASE_ASSERT_NOT_REACHED();
+        return 1;
+    }
+
+private:
+    static constexpr const char* prompt = ">>> ";
+    static constexpr const char* historyDirName = ".mya";
+    static constexpr const char* historyFileName = "history";
+    static constexpr unsigned defaultMaxHistoryEntries = 50;
+    static constexpr unsigned minHistorySize = 5;
+
+    // The history file records the target max history entries in its first line, followed by
+    // historical commands. To avoid re-writing the file on every new command, we allow the file
+    // to exceed the max entries by maxOverflowEntries, before we do a re-write to purge
+    // the extra entries. We will keep appending to the same file until the re-write is needed.
+    static constexpr const char* maxEntriesHeaderPrefix = "max entries ";
+    static constexpr unsigned maxOverflowEntries = 100;
+
+    static void printUsage(FILE* out)
+    {
+        fputs("Mya (MY-uh /ˈmaɪə/) - MemorY Analyzer\n", out);
+        fputs("Usage:\n", out);
+        fputs("  mya [--pid|-p <pid>]\n", out);
+        fputs("  mya [--help|-h [<command>]]\n", out);
+        fputs("Commands:\n", out);
+        fputs("  attach [--pid|-p] <pid>   Set the target PID and attach\n", out);
+        fputs("  detach                    Detach from the current PID\n", out);
+        fputs("  status (st)               Show whether mya is attached\n", out);
+        fputs("  snapshot (sn, snap) ...   Capture and manage snapshots\n", out);
+        fputs("  thread (th) ...           Inspect the threads in a snapshot\n", out);
+        fputs("  p[/x] &<symbol>           Print a symbol's address, /x for hex\n", out);
+        fputs("  history (hi, hist) ...    Show and manage the command history\n", out);
+        fputs("  help [<command>]          Show this help, or help for <command>\n", out);
+        fputs("  quit (q, exit)            Exit mya\n", out);
+        fputs("\n", out);
+        fputs("  Use `help snapshot`, `help thread` or `help history` for their subcommands.\n", out);
+        fputs("\n", out);
+    }
+
+    static void printThreadUsage(FILE* out)
+    {
+        fputs("thread - inspect the threads captured in a snapshot\n", out);
+        fputs("  thread list (li)          List the threads in the snapshot in use\n", out);
+        fputs("\n", out);
+        fputs("  `thread` may be abbreviated as `th`, and lists by default.\n", out);
+        fputs("  Threads are read from the snapshot in use; see `help snapshot`.\n", out);
+        fputs("\n", out);
+    }
+
+    static void printSnapshotUsage(FILE* out)
+    {
+        fputs("snapshot - capture and manage snapshots of a process\n", out);
+        fputs("  snapshot                  Capture a snapshot of the current process\n", out);
+        fputs("  snapshot --pid|-p <pid>   Attach to <pid> and capture a snapshot of it\n", out);
+        fputs("  snapshot <n>              Switch to using snapshot <n>\n", out);
+        fputs("  snapshot list (li)        List captured snapshots (* marks the one in use)\n", out);
+        fputs("  snapshot info (inf) <n>   Show details of snapshot <n>\n", out);
+        fputs("  snapshot delete (del) <n> Delete snapshot <n>\n", out);
+        fputs("  snapshot diff <a> <b>     Diff snapshot <a> against snapshot <b>\n", out);
+        fputs("\n", out);
+        fputs("  `snapshot` may be abbreviated as `sn` or `snap`.\n", out);
+        fputs("  Capturing a snapshot switches to using it.\n", out);
+        fputs("\n", out);
+    }
+
+    static void printHistoryUsage(FILE* out)
+    {
+        fputs("history - show and manage the command history\n", out);
+        fputs("  history                   List the command history\n", out);
+        fputs("  history clear [<n>]       Clear the history, or its <n> oldest entries\n", out);
+        fputs("  history size [<n>]        Show or set the max entries kept\n", out);
+        fputs("  !<n>                      Replay history entry <n>\n", out);
+        fputs("  !!                        Replay the previous command\n", out);
+        fputs("\n", out);
+        fputs("  `history` may be abbreviated as `hi` or `hist`.\n", out);
+        fprintf(out, "  Command history is kept (defaults up to %u entries) in ~/%s/%s.\n",
+            defaultMaxHistoryEntries, historyDirName, historyFileName);
+#if HAVE(READLINE)
+        fputs("  It is navigable with the Up/Down arrows and Ctrl-R reverse search.\n", out);
+#endif
+        fputs("\n", out);
+    }
+
+    // Dispatches `help [<command>]`. `lex` is positioned after the "help" word.
+    static bool handleHelp(Lexer lex)
+    {
+        if (lex.atEnd()) {
+            printUsage(stdout);
+            return true;
+        }
+        std::string_view topic = lex.nextToken();
+        if (topic == "sn" || topic == "snap" || topic == "snapshot") {
+            printSnapshotUsage(stdout);
+            return true;
+        }
+        if (topic == "hi" || topic == "hist" || topic == "history") {
+            printHistoryUsage(stdout);
+            return true;
+        }
+        if (topic == "th" || topic == "thread") {
+            printThreadUsage(stdout);
+            return true;
+        }
+        fprintf(stderr, "mya: No help for '%.*s'\n", static_cast<int>(topic.length()), topic.data());
+        return false;
+    }
+
+    // Writes a byte count in the largest unit that keeps it readable, e.g. "512 KB" or "1.50 MB".
+    static void formatByteSize(size_t bytes, char* out, size_t outSize)
+    {
+        if (bytes >= 1024 * 1024)
+            snprintf(out, outSize, "%.2f MB", bytes / (1024.0 * 1024.0));
+        else if (bytes >= 1024)
+            snprintf(out, outSize, "%zu KB", bytes / 1024);
+        else
+            snprintf(out, outSize, "%zu B", bytes);
+    }
+
+    enum class ContinuationAction { Continue, Exit, Error };
+    ContinuationAction parseArguments(int argc, char** argv)
+    {
+        // Help is answered before anything else is acted on, so that asking for it
+        // never attaches to a process or takes a snapshot along the way.
+        for (int i = 1; i < argc; ++i) {
+            std::string_view arg = argv[i];
+            if (arg != "--help" && arg != "-h")
+                continue;
+            if (i + 1 >= argc) {
+                printUsage(stdout);
+                return ContinuationAction::Exit;
+            }
+            Lexer lex(argv[i + 1]);
+            return handleHelp(lex) ? ContinuationAction::Exit : ContinuationAction::Error;
+        }
+
+        for (int i = 1; i < argc; ++i) {
+            const char* argText = argv[i];
+            std::string_view arg = argText;
+            const char* pidText = nullptr;
+            if (arg == "--pid" || arg == "-p") {
+                if (i + 1 >= argc) {
+                    fprintf(stderr, "mya: %s requires an argument\n", argText);
+                    return ContinuationAction::Error;
+                }
+                pidText = argv[++i];
+            } else if (arg.starts_with("--pid="))
+                pidText = argText + 6;
+            else if (arg.starts_with("-p") && arg.size() > 2)
+                pidText = argText + 2; // "-p12345"
+            else {
+                fprintf(stderr, "mya: Unknown option '%s'\n", argText);
+                return ContinuationAction::Error;
+            }
+
+            pid_t pid = -1;
+            Lexer lex(pidText);
+            if (!lex.consumePID(pid) || !lex.atEnd()) {
+                fprintf(stderr, "mya: Invalid PID '%s'\n", pidText);
+                return ContinuationAction::Error;
+            }
+
+            attachAndSnapshot(pid);
+        }
+        return ContinuationAction::Continue;
+    }
+
+    void attach(pid_t pid)
+    {
+        RefPtr<Process> process;
+        auto existing = m_processes.find(pid);
+        if (existing != m_processes.end())
+            process = existing->value;
+        else {
+            process = Process::create(pid);
+            m_processes.add(pid, process);
+        }
+
+        if (!process->attach())
+            return;
+
+        if (m_currentProcess && m_currentProcess != process)
+            m_currentProcess->detach();
+
+        m_currentProcess = WTF::move(process);
+        printf("Attached to %d\n", static_cast<int>(m_currentProcess->pid()));
+    }
+
+    void detach()
+    {
+        if (!m_currentProcess) {
+            fputs("Not attached to any process.\n", stdout);
+            return;
+        }
+        pid_t pid = m_currentProcess->pid();
+        m_currentProcess->detach();
+        m_currentProcess = nullptr;
+        printf("Detached from %d\n", static_cast<int>(pid));
+    }
+
+    // `mya --pid <pid>` and `snapshot --pid <pid>` both attach then snapshot.
+    void attachAndSnapshot(pid_t pid)
+    {
+        attach(pid);
+        if (m_currentProcess && m_currentProcess->pid() == pid)
+            captureSnapshot();
+    }
+
+    void captureSnapshot()
+    {
+        if (!m_currentProcess) {
+            fputs("Unable to capture snapshot. Not attached to any process. Use `attach` command or specify `--pid` argument for the snapshot command.\n", stderr);
+            return;
+        }
+        auto snapshot = WTF::makeUnique<Snapshot>(m_currentProcess);
+        if (!snapshot->isValid())
+            return; // The Snapshot constructor already logged the failure.
+        unsigned id = snapshot->id();
+        // The map owns the Snapshot and the list only records capture order.
+        Snapshot* node = snapshot.get();
+        m_snapshotsById.add(id, WTF::move(snapshot));
+        m_snapshots.append(node);
+        printf("Captured Snapshot #%u of %d\n", id, static_cast<int>(m_currentProcess->pid()));
+        useSnapshot(id); // Capturing switches to the new snapshot.
+    }
+
+    // Sets the current snapshot used by subsequent commands.
+    void useSnapshot(unsigned id)
+    {
+        if (!snapshotById(id)) {
+            fprintf(stderr, "mya: No snapshot #%u\n", id);
+            return;
+        }
+        if (m_currentSnapshot) {
+            if (m_currentSnapshot == id)
+                printf("Already using snapshot %u\n", id);
+            else
+                printf("Switching to using snapshot %u\n", id);
+        }
+        m_currentSnapshot = id;
+    }
+
+    // Returns the snapshot with the given id, or nullptr if there is none.
+    Snapshot* snapshotById(unsigned id) const
+    {
+        auto entry = m_snapshotsById.find(id);
+        return entry != m_snapshotsById.end() ? entry->value.get() : nullptr;
+    }
+
+    void listSnapshots()
+    {
+        if (m_snapshots.isEmpty()) {
+            fputs("No snapshots.\n", stdout);
+            return;
+        }
+        for (Snapshot* snapshot = m_snapshots.head(); snapshot; snapshot = snapshot->next()) {
+            // Mark the snapshot currently in use.
+            const char* marker = snapshot->id() == m_currentSnapshot ? "*" : " ";
+            printf("%s #%u: pid %d\n", marker, snapshot->id(), static_cast<int>(snapshot->process()->pid()));
+        }
+    }
+
+    void snapshotInfo(unsigned id)
+    {
+        Snapshot* snapshot = snapshotById(id);
+        if (!snapshot) {
+            fprintf(stderr, "mya: No snapshot #%u\n", id);
+            return;
+        }
+        printf("Snapshot #%u: pid %d, corpse %s\n", id,
+            static_cast<int>(snapshot->process()->pid()), snapshot->isValid() ? "valid" : "invalid");
+    }
+
+    void snapshotDelete(unsigned id)
+    {
+        Snapshot* snapshot = snapshotById(id);
+        if (!snapshot) {
+            fprintf(stderr, "mya: No snapshot #%u\n", id);
+            return;
+        }
+        // Unlink before dropping the owning entry: the list does not own its
+        // nodes, so it must not be left pointing at a destroyed Snapshot.
+        m_snapshots.remove(snapshot);
+        m_snapshotsById.remove(id);
+        if (id == m_currentSnapshot)
+            m_currentSnapshot = 0;
+        printf("Deleted Snapshot #%u.\n", id);
+    }
+
+    void snapshotDiff(unsigned a, unsigned b)
+    {
+        if (!snapshotById(a)) {
+            fprintf(stderr, "mya: No snapshot #%u\n", a);
+            return;
+        }
+        if (!snapshotById(b)) {
+            fprintf(stderr, "mya: No snapshot #%u\n", b);
+            return;
+        }
+        printf("Snapshot diff #%u vs #%u is not implemented yet.\n", a, b);
+    }
+
+    // `lex` is positioned after the "snapshot" command word.
+    void handleSnapshot(Lexer lex)
+    {
+        if (lex.atEnd()) {
+            captureSnapshot();
+            return;
+        }
+        // A bare number switches to that snapshot e.g. "snapshot 3".
+        if (isASCIIDigit(static_cast<unsigned char>(lex.peek()))) {
+            unsigned number = 0;
+            if (!lex.consumeUint32(number) || !lex.atEnd()) {
+                fputs("Usage: snapshot <n>\n", stderr);
+                return;
+            }
+            useSnapshot(number);
+            return;
+        }
+        if (lex.consumeToken("--pid") || lex.consumeToken("-p")) {
+            pid_t pid = -1;
+            if (!lex.consumePID(pid) || !lex.atEnd()) {
+                fputs("Usage: snapshot [--pid|-p] <pid>\n", stderr);
+                return;
+            }
+            attachAndSnapshot(pid);
+            return;
+        }
+        if (lex.consumeToken("li") || lex.consumeToken("list")) {
+            listSnapshots();
+            return;
+        }
+        if (lex.consumeToken("inf") || lex.consumeToken("info")) {
+            unsigned number = 0;
+            if (!lex.consumeUint32(number) || !lex.atEnd()) {
+                fputs("Usage: snapshot info <n>\n", stderr);
+                return;
+            }
+            snapshotInfo(number);
+            return;
+        }
+        if (lex.consumeToken("del") || lex.consumeToken("delete")) {
+            unsigned number = 0;
+            if (!lex.consumeUint32(number) || !lex.atEnd()) {
+                fputs("Usage: snapshot delete <n>\n", stderr);
+                return;
+            }
+            snapshotDelete(number);
+            return;
+        }
+        if (lex.consumeToken("diff")) {
+            unsigned a = 0;
+            unsigned b = 0;
+            if (!lex.consumeUint32(a) || !lex.consumeUint32(b) || !lex.atEnd()) {
+                fputs("Usage: snapshot diff <a> <b>\n", stderr);
+                return;
+            }
+            snapshotDiff(a, b);
+            return;
+        }
+        std::string_view token = lex.nextToken();
+        fprintf(stderr, "mya: Unknown snapshot subcommand '%.*s'\n",
+            static_cast<int>(token.length()), token.data());
+    }
+
+    // Lists the threads captured in the snapshot currently in use.
+    void listThreads()
+    {
+        Snapshot* snapshot = snapshotById(m_currentSnapshot);
+        if (!snapshot) {
+            fputs("No snapshot in use. Capture one with `snapshot`, or select one with `snapshot <n>`.\n", stderr);
+            return;
+        }
+
+        const Vector<Thread>& threads = snapshot->threads();
+        if (threads.isEmpty()) {
+            fputs("No threads.\n", stdout);
+            return;
+        }
+
+        printf("Threads in snapshot #%u (pid %d):\n", snapshot->id(), static_cast<int>(snapshot->process()->pid()));
+
+        // Build the rows as text first so each column can be sized to its widest entry.
+        static constexpr size_t columnCount = 12;
+        static const char* const headings[columnCount] = {
+            "INDEX", "TID", "STATE", "USER(ms)", "SYS(ms)", "SP", "STACK", "SIZE",
+            "PAGES", "RESIDENT", "DIRTY", "NAME"
+        };
+        static const bool rightAligned[columnCount] = {
+            true, false, false, true, true, false, false, true, true, true, true, false
+        };
+
+        struct Row {
+            std::string cells[columnCount];
+        };
+        Vector<Row> rows;
+        rows.reserveCapacity(threads.size());
+
+        char buffer[64];
+        for (size_t i = 0; i < threads.size(); ++i) {
+            const Thread& thread = threads[i];
+            Row row;
+
+            snprintf(buffer, sizeof(buffer), "%zu", i + 1);
+            row.cells[0] = buffer;
+            snprintf(buffer, sizeof(buffer), "0x%llx", static_cast<unsigned long long>(thread.id()));
+            row.cells[1] = buffer;
+            row.cells[2] = thread.runStateDescription();
+            snprintf(buffer, sizeof(buffer), "%.3f", thread.userTimeUsec() / 1000.0);
+            row.cells[3] = buffer;
+            snprintf(buffer, sizeof(buffer), "%.3f", thread.systemTimeUsec() / 1000.0);
+            row.cells[4] = buffer;
+            if (thread.stackPointer()) {
+                snprintf(buffer, sizeof(buffer), "0x%llx",
+                    thread.stackPointer().toMachVMAddress());
+                row.cells[5] = buffer;
+            } else
+                row.cells[5] = "-";
+            if (thread.hasStack()) {
+                const auto& stack = thread.stackRegion();
+                snprintf(buffer, sizeof(buffer), "0x%llx-0x%llx",
+                    stack.base().toMachVMAddress(),
+                    stack.end().toMachVMAddress());
+                row.cells[6] = buffer;
+                formatByteSize(stack.size(), buffer, sizeof(buffer));
+                row.cells[7] = buffer;
+                snprintf(buffer, sizeof(buffer), "%llu",
+                    static_cast<unsigned long long>(stack.pageCount()));
+                row.cells[8] = buffer;
+                snprintf(buffer, sizeof(buffer), "%llu",
+                    static_cast<unsigned long long>(stack.residentPageCount()));
+                row.cells[9] = buffer;
+                snprintf(buffer, sizeof(buffer), "%llu",
+                    static_cast<unsigned long long>(stack.dirtyPageCount()));
+                row.cells[10] = buffer;
+            } else {
+                row.cells[6] = "-";
+                row.cells[7] = "-";
+                row.cells[8] = "-";
+                row.cells[9] = "-";
+                row.cells[10] = "-";
+            }
+            row.cells[11] = thread.name().empty() ? "-" : thread.name();
+
+            rows.append(WTF::move(row));
+        }
+
+        size_t widths[columnCount];
+        for (size_t column = 0; column < columnCount; ++column) {
+            widths[column] = strlen(headings[column]);
+            for (const Row& row : rows)
+                widths[column] = std::max(widths[column], row.cells[column].length());
+        }
+
+        auto printRow = [&](auto&& cellAt) {
+            fputs("  ", stdout);
+            for (size_t column = 0; column < columnCount; ++column) {
+                if (column)
+                    fputs("  ", stdout);
+                const char* text = cellAt(column);
+                // The last column needs no padding, which also avoids trailing
+                // whitespace on every line.
+                if (column == columnCount - 1)
+                    fputs(text, stdout);
+                else if (rightAligned[column])
+                    printf("%*s", static_cast<int>(widths[column]), text);
+                else
+                    printf("%-*s", static_cast<int>(widths[column]), text);
+            }
+            putchar('\n');
+        };
+
+        printRow([&](size_t column) { return headings[column]; });
+        for (const Row& row : rows)
+            printRow([&](size_t column) { return row.cells[column].c_str(); });
+    }
+
+    // Dispatches the `thread ...` subcommands. `lex` is positioned after the
+    // "thread" command word.
+    void handleThread(Lexer lex)
+    {
+        // Listing is the default, so a bare `thread` lists too.
+        if (lex.atEnd() || lex.consumeToken("li") || lex.consumeToken("list")) {
+            if (!lex.atEnd()) {
+                fputs("Usage: thread list\n", stderr);
+                return;
+            }
+            listThreads();
+            return;
+        }
+        std::string_view token = lex.nextToken();
+        fprintf(stderr, "mya: Unknown thread subcommand '%.*s'\n",
+            static_cast<int>(token.length()), token.data());
+    }
+
+    // Dispatches `p[/<format>] <expression>`. The only expression understood so
+    // far is `&<symbol>`, which resolves the symbol in the snapshot in use.
+    // `format` is the text after the '/', empty when none was given.
+    void handlePrint(std::string_view format, Lexer lex)
+    {
+        bool hex = false;
+        if (!format.empty()) {
+            if (format == "x")
+                hex = true;
+            else if (format != "d") {
+                fprintf(stderr, "mya: Unknown print format '%.*s'; use x or d\n",
+                    static_cast<int>(format.length()), format.data());
+                return;
+            }
+        }
+
+        Snapshot* snapshot = snapshotById(m_currentSnapshot);
+        if (!snapshot) {
+            fputs("No snapshot in use. Capture one with `snapshot`, or select one with `snapshot <n>`.\n", stderr);
+            return;
+        }
+
+        // Taking a symbol's address is all we can do without type information.
+        if (!lex.consumeChar('&')) {
+            fputs("Usage: p[/x] &<symbol>\n", stderr);
+            return;
+        }
+        std::string_view token = lex.nextToken();
+        if (token.empty() || !lex.atEnd()) {
+            fputs("Usage: p[/x] &<symbol>\n", stderr);
+            return;
+        }
+
+        std::string name(token);
+        Address address = snapshot->symbol(name.c_str());
+        if (!address) {
+            fprintf(stderr, "mya: No symbol '%s' in snapshot #%u\n", name.c_str(), snapshot->id());
+            return;
+        }
+        if (hex)
+            printf("&%s = 0x%llx\n", name.c_str(), address.toMachVMAddress());
+        else
+            printf("&%s = %llu\n", name.c_str(), address.toMachVMAddress());
+    }
+
+    // Releases resources without extra output. Dropping the current selection
+    // and clearing the containers runs ~Process / ~Snapshot, which release the
+    // task and corpse ports. Idempotent: safe from the quit path and destructor.
+    void cleanup()
+    {
+        m_currentProcess = nullptr;
+        m_processes.clear();
+        // Unlink the non-owning list before destroying the Snapshots it points at.
+        m_snapshots.clear();
+        m_snapshotsById.clear();
+        if (m_historyFile) {
+            fclose(m_historyFile);
+            m_historyFile = nullptr;
+        }
+        if (m_historyDirDescriptor >= 0) {
+            close(m_historyDirDescriptor);
+            m_historyDirDescriptor = -1;
+        }
+    }
+
+    // Prompts for confirmation before quitting. Enter (empty) defaults to yes.
+    bool confirmQuit()
+    {
+        for (;;) {
+            std::string response;
+#if HAVE(READLINE)
+            char* input = readline("Really quit? [Y/n] ");
+            if (!input) {
+                putchar('\n');
+                return true; // EOF: treat as yes.
+            }
+            response = input;
+            free(input);
+#else
+            fputs("Really quit? [Y/n] ", stdout);
+            fflush(stdout);
+            char buffer[64];
+            if (!fgets(buffer, sizeof(buffer), stdin)) {
+                putchar('\n');
+                return true; // EOF: treat as yes.
+            }
+            // Without a newline the answer was longer than the buffer, and the rest
+            // would be read as the answer to the next prompt. Discard it.
+            if (!std::string_view(buffer).contains('\n')) {
+                int discarded = 0;
+                while ((discarded = getchar()) != '\n' && discarded != EOF) { }
+            }
+            response = buffer;
+#endif
+            size_t start = 0;
+            while (start < response.size() && isASCIIWhitespace(static_cast<unsigned char>(response[start])))
+                ++start;
+            size_t stop = response.size();
+            while (stop > start && isASCIIWhitespace(static_cast<unsigned char>(response[stop - 1])))
+                --stop;
+            response = response.substr(start, stop - start);
+
+            if (response.empty() || response[0] == 'y' || response[0] == 'Y')
+                return true;
+            if (response[0] == 'n' || response[0] == 'N')
+                return false;
+            fputs("Please answer 'y' or 'n'.\n", stdout);
+        }
+    }
+
+    void printStatus()
+    {
+        if (m_currentProcess)
+            printf("Attached to pid %d\n", static_cast<int>(m_currentProcess->pid()));
+        else
+            fputs("Not attached to any process.\n", stdout);
+
+        if (Snapshot* snapshot = snapshotById(m_currentSnapshot))
+            printf("Using snapshot %u of pid %d\n", snapshot->id(), static_cast<int>(snapshot->process()->pid()));
+        else
+            fputs("No snapshot in use.\n", stdout);
+    }
+
+    void printHistory()
+    {
+        if (!m_history.size()) {
+            printf("History is empty.\n");
+            return;
+        }
+        for (size_t i = 0; i < m_history.size(); ++i)
+            printf("%5zu  %s\n", i + 1, m_history[i].c_str());
+    }
+
+    // Drops the `count` oldest entries.
+    void clearHistory(unsigned count)
+    {
+        if (!count) {
+            fputs("Nothing to do for clearing 0 history entries.\n", stdout);
+            return;
+        }
+        if (m_history.empty()) {
+            fputs("History is already empty.\n", stdout);
+            return;
+        }
+        unsigned removeCount = count >= m_history.size() ? safeCast<unsigned>(m_history.size()) : count;
+        m_history.erase(m_history.begin(), m_history.begin() + removeCount);
+#if HAVE(READLINE)
+        // readline has no way to drop individual entries, so rebuild its history
+        // from the cache to keep the arrow keys in sync.
+        clear_history();
+        for (const std::string& command : m_history)
+            add_history(command.c_str());
+#endif
+        if (m_historyFile && !rewriteHistoryFile()) {
+            fputs("mya: Failed to clear history file.\n", stderr);
+            return;
+        }
+        if (m_history.empty()) {
+            if (removeCount == 1)
+                printf("Cleared 1 history entry.\n");
+            else
+                printf("Cleared %u history entries.\n", removeCount);
+        } else if (removeCount == 1)
+            printf("Cleared the oldest history entry.\n");
+        else
+            printf("Cleared the %u oldest history entries.\n", removeCount);
+    }
+
+    void printHistorySize()
+    {
+        printf("History holds %zu of %u entries.\n", m_history.size(), m_maxHistoryEntries);
+    }
+
+    // Sets how many entries the history keeps, purging the oldest if the new
+    // capacity is smaller than what is currently stored.
+    void setMaxHistorySize(unsigned capacity)
+    {
+        if (capacity < minHistorySize) {
+            capacity = minHistorySize;
+            printf("Minimum history size is %u.\n", minHistorySize);
+        }
+        if (m_maxHistoryEntries == capacity) {
+            printf("Maximum history size is already %u.\n", m_maxHistoryEntries);
+            return;
+        }
+        m_maxHistoryEntries = capacity;
+        boundReadlineHistory();
+        if (m_history.size() > m_maxHistoryEntries) {
+            m_history.erase(m_history.begin(), m_history.end() - m_maxHistoryEntries);
+#if HAVE(READLINE)
+            clear_history();
+            for (const std::string& command : m_history)
+                add_history(command.c_str());
+#endif
+        }
+        if (!rewriteHistoryFile())
+            fputs("mya: The new size applies to this session only.\n", stderr);
+        printHistorySize();
+    }
+
+    // Dispatches the `history ...` subcommands. `lex` is positioned after the
+    // "history" command word.
+    void handleHistory(Lexer lex)
+    {
+        if (lex.atEnd()) {
+            printHistory();
+            return;
+        }
+        if (lex.consumeToken("clear")) {
+            unsigned count = UINT_MAX; // Default to  "all".
+            if (!lex.atEnd()) {
+                unsigned parsed = 0;
+                if (!lex.consumeUint32(parsed) || !lex.atEnd()) {
+                    fputs("Usage: history clear [<n>]\n", stderr);
+                    return;
+                }
+                count = parsed;
+            }
+            clearHistory(count);
+            return;
+        }
+        if (lex.consumeToken("size")) {
+            if (lex.atEnd()) {
+                printHistorySize();
+                return;
+            }
+            unsigned capacity = 0;
+            if (!lex.consumeUint32(capacity) || !lex.atEnd()) {
+                fputs("Usage: history size [<n>]\n", stderr);
+                return;
+            }
+            setMaxHistorySize(capacity);
+            return;
+        }
+        std::string_view token = lex.nextToken();
+        fprintf(stderr, "mya: Unknown history subcommand '%.*s'\n",
+            static_cast<int>(token.length()), token.data());
+    }
+
+    // Resolves a history reference ("!!" or "!<n>") to a stored command and
+    // replays it. `lex` is positioned after the leading '!'; `line` is the whole
+    // input, used for error reporting.
+    void replayHistory(const char* line, Lexer lex)
+    {
+        std::string command;
+        if (lex.consumeChar('!') && lex.atEnd()) {
+            if (m_history.empty()) {
+                fputs("mya: No commands in history\n", stderr);
+                return;
+            }
+            command = m_history.back();
+        } else {
+            unsigned index = 0;
+            if (!lex.consumeUint32(index) || !lex.atEnd() || index > m_history.size()) {
+                fprintf(stderr, "mya: %s: event not found\n", line);
+                return;
+            }
+            if (!index) {
+                fprintf(stderr, "mya: %s: invalid history entry\n", line);
+                return;
+            }
+            command = m_history[index - 1];
+        }
+        // Echo the resolved command, then run it as if it had been typed. The
+        // replayed command records itself; the "!" reference is not recorded.
+        printf("%s\n", command.c_str());
+        handleLine(command.c_str());
+    }
+
+    static bool isRunningAsRoot() { return !geteuid(); }
+
+    // The directory that holds the history file, empty if the user has no home
+    // directory to put it in.
+    //
+    // We deliberately keep root (when run with sudo)'s history file distinct from
+    // the non-root user's. This is better for security (root is not dependent on
+    // non-root user data), and does not block the non-root user from accessing
+    // their history if the last mya run was via sudo and the history file was
+    // updated by root (and ownership changed).
+    static std::string historyDirectory()
+    {
+        const char* home = nullptr;
+        if (isRunningAsRoot()) {
+            if (const struct passwd* entry = getpwuid(0))
+                home = entry->pw_dir;
+        } else {
+            home = getenv("HOME");
+            if (!home || !*home) {
+                if (const struct passwd* entry = getpwuid(getuid()))
+                    home = entry->pw_dir;
+            }
+        }
+        if (!home || !*home)
+            return { };
+
+        std::string directory = home;
+        if (directory.back() != '/')
+            directory += '/';
+        directory += historyDirName;
+        return directory;
+    }
+
+    void boundReadlineHistory()
+    {
+#if HAVE(READLINE)
+        // libedit only applies the bound when an entry is added, so lowering it does
+        // not shorten the existing list: callers that shrink the cache must rebuild
+        // readline's list as well for the change to take effect immediately.
+        stifle_history(safeCast<int>(m_maxHistoryEntries));
+#endif
+    }
+
+    // Opens the history file for read+write, creating it if absent, and loads any
+    // stored commands into the cache. If it cannot be opened, the cache stays in
+    // memory only for the session.
+    //
+    // The file lives under the user's home directory, not the working directory:
+    // mya carries a debugger entitlement and its own usage suggests running it as
+    // root, so it must not be steered into writing through a path controlled by
+    // whoever owns the directory it happens to be started in. Both path
+    // components are opened O_NOFOLLOW, so a symlink planted at either one is
+    // refused rather than followed, and the file is never opened with O_TRUNC.
+    void openHistory()
+    {
+        boundReadlineHistory();
+
+        std::string directory = historyDirectory();
+        if (directory.empty()) {
+            fputs("mya: No home directory, so command history will not be saved.\n", stderr);
+            return;
+        }
+
+        if (isRunningAsRoot()) {
+            fprintf(stderr, "mya: Running as root: using history file %s/%s.\n",
+                directory.c_str(), historyFileName);
+        }
+
+        if (mkdir(directory.c_str(), 0700) && errno != EEXIST) {
+            fprintf(stderr, "mya: Could not create %s: %s\n", directory.c_str(), strerror(errno));
+            return;
+        }
+
+        int directoryDescriptor = open(directory.c_str(), O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC);
+        if (directoryDescriptor < 0) {
+            fprintf(stderr, "mya: Could not open %s: %s\n", directory.c_str(), strerror(errno));
+            return;
+        }
+
+        int fileDescriptor = openat(directoryDescriptor, historyFileName, O_RDWR | O_CREAT | O_NOFOLLOW | O_CLOEXEC, 0600);
+        if (fileDescriptor < 0) {
+            fprintf(stderr, "mya: Could not open %s/%s: %s\n", directory.c_str(), historyFileName, strerror(errno));
+            close(directoryDescriptor);
+            return;
+        }
+
+        // Anything other than a regular file is not something mya wrote: reading a
+        // FIFO here would block the shell before it ever prompted. So, we decline to open
+        // any non-regular files.
+        struct stat status;
+        if (fstat(fileDescriptor, &status) || !S_ISREG(status.st_mode)) {
+            fprintf(stderr, "mya: %s/%s is not a regular file, so command history will not be saved.\n",
+                directory.c_str(), historyFileName);
+            close(fileDescriptor);
+            close(directoryDescriptor);
+            return;
+        }
+
+        m_historyFile = fdopen(fileDescriptor, "r+");
+        if (!m_historyFile) {
+            close(fileDescriptor);
+            close(directoryDescriptor);
+            return;
+        }
+
+        // Held for the session: rewriting the file creates and renames through this
+        // descriptor, so the replacement lands in the directory that was checked
+        // here rather than wherever the path may point by then.
+        m_historyDirDescriptor = directoryDescriptor;
+
+        loadHistory();
+    }
+
+    // Reads the cap out of a "max entries <n>" header line. Returns 0 if `line` does not
+    // contain the header, which means the file is corrupted.
+    static unsigned parseMaxEntriesHeader(const char* line)
+    {
+        size_t prefixLength = strlen(maxEntriesHeaderPrefix);
+        if (!std::string_view(line).starts_with(maxEntriesHeaderPrefix))
+            return 0;
+        Lexer lex(line + prefixLength);
+        unsigned entries = 0;
+        if (!lex.consumeUint32<1>(entries) || !lex.atEnd())
+            return 0;
+        // We deliberately allow reading a capacity value below minHistorySize so that we can
+        // print a meaningful error message about it in the caller.
+        return entries;
+    }
+
+    void loadHistory()
+    {
+        if (!m_historyFile)
+            return;
+        rewind(m_historyFile);
+
+        char buffer[4096];
+        unsigned capacity = 0;
+        if (fgets(buffer, sizeof(buffer), m_historyFile)) {
+            buffer[strcspn(buffer, "\n")] = '\0';
+            capacity = parseMaxEntriesHeader(buffer);
+            if (!capacity) {
+                fprintf(stderr, "mya: Corrupted file: ~/%s/%s does not start with a valid header (\"%s<n>\"); starting a new one.\n",
+                    historyDirName, historyFileName, maxEntriesHeaderPrefix);
+            } else if (capacity < minHistorySize) {
+                fprintf(stderr, "mya: Corrupted file: ~/%s/%s header asks for fewer than the minimum %u entries;"
+                    " starting a new one.\n", historyDirName, historyFileName, minHistorySize);
+                capacity = 0; // Treat as error.
+            }
+        }
+        if (!capacity) {
+            rewriteHistoryFile(); // Invalid header. Reset the history file.
+            return;
+        }
+        m_maxHistoryEntries = capacity;
+        boundReadlineHistory();
+
+        Vector<std::string> entries;
+        while (fgets(buffer, sizeof(buffer), m_historyFile)) {
+            buffer[strcspn(buffer, "\n")] = '\0';
+            if (!buffer[0])
+                continue;
+            if (isReplayCommand(buffer))
+                continue; // A ! replay command in history is invalid and not allowed. Skip.
+            entries.append(buffer);
+        }
+        m_entriesInHistoryFile = safeCast<unsigned>(entries.size());
+
+        // The cache never holds more than the capacity, however much the file holds.
+        unsigned keep = std::min(m_entriesInHistoryFile, m_maxHistoryEntries);
+        for (size_t i = entries.size() - keep; i < entries.size(); ++i) {
+            m_history.push_back(entries[i]);
+#if HAVE(READLINE)
+            add_history(entries[i].c_str());
+#endif
+        }
+
+        // Seek to the end so later commands append, and to satisfy the C rule
+        // that a positioning call separates a read from a following write.
+        if (fseek(m_historyFile, 0, SEEK_END))
+            fallBackToMemoryOnly("Could not read the history file", errno);
+    }
+
+    // Report the failure condition and switch to in-memory cache only history.
+    // The history file itself is left exactly as it was, and whatever was already
+    // read from it stays in the cache.
+    void fallBackToMemoryOnly(const char* what, int error)
+    {
+        fprintf(stderr, "mya: %s: %s\n", what, strerror(error));
+        fputs("mya: Command history is kept in memory only from here, and the saved"
+            " history is left as it is.\n", stderr);
+        if (m_historyFile) {
+            fclose(m_historyFile);
+            m_historyFile = nullptr;
+        }
+        if (m_historyDirDescriptor >= 0) {
+            close(m_historyDirDescriptor);
+            m_historyDirDescriptor = -1;
+        }
+    }
+
+    // Replaces the history file as a transaction i.e. the file either has the new
+    // history or remains the old one if something went wrong. It is never left half
+    // modified. This is done by writing the new file completely before replacing the
+    // old history file with it.
+    //
+    // In the event something went wrong, the in-memory cache retains its state, and
+    // may become out of sync with the history file.
+    bool rewriteHistoryFile()
+    {
+        if (!m_historyFile || m_historyDirDescriptor < 0)
+            return false;
+
+        // Qualified by pid so two mya instances cannot land on the same temporary.
+        char temporaryName[64];
+        snprintf(temporaryName, sizeof(temporaryName), "%s.%d.tmp", historyFileName,
+            static_cast<int>(getpid()));
+
+        int descriptor = openat(m_historyDirDescriptor, temporaryName,
+            O_RDWR | O_CREAT | O_EXCL | O_NOFOLLOW | O_CLOEXEC, 0600);
+        if (descriptor < 0 && errno == EEXIST) {
+            // Left behind by a run that died between creating and renaming.
+            unlinkat(m_historyDirDescriptor, temporaryName, 0);
+            descriptor = openat(m_historyDirDescriptor, temporaryName,
+                O_RDWR | O_CREAT | O_EXCL | O_NOFOLLOW | O_CLOEXEC, 0600);
+        }
+        if (descriptor < 0) {
+            fallBackToMemoryOnly("Could not create a temporary history file", errno);
+            return false;
+        }
+
+        FILE* replacement = fdopen(descriptor, "w+");
+        if (!replacement) {
+            int error = errno;
+            close(descriptor);
+            unlinkat(m_historyDirDescriptor, temporaryName, 0);
+            fallBackToMemoryOnly("Could not rewrite the history file", error);
+            return false;
+        }
+
+        fprintf(replacement, "%s%u\n", maxEntriesHeaderPrefix, m_maxHistoryEntries);
+        for (const std::string& command : m_history)
+            fprintf(replacement, "%s\n", command.c_str());
+
+        // Commit the contents before publishing them, so a crash cannot leave the
+        // rename pointing at a file that was never written.
+        int error = 0;
+        if (fflush(replacement) || fsync(fileno(replacement)))
+            error = errno;
+        else if (ferror(replacement))
+            error = EIO;
+        if (!error && renameat(m_historyDirDescriptor, temporaryName, m_historyDirDescriptor, historyFileName))
+            error = errno;
+        if (error) {
+            fclose(replacement);
+            unlinkat(m_historyDirDescriptor, temporaryName, 0);
+            fallBackToMemoryOnly("Could not rewrite the history file", error);
+            return false;
+        }
+
+        // The rename published the temporary file, so it is the history file now.
+        fclose(m_historyFile);
+        m_historyFile = replacement;
+        m_entriesInHistoryFile = safeCast<unsigned>(m_history.size());
+        if (fseek(m_historyFile, 0, SEEK_END)) {
+            fallBackToMemoryOnly("Could not rewrite the history file", errno);
+            return false;
+        }
+        return true;
+    }
+
+    static bool isReplayCommand(const char* line)
+    {
+        Lexer lex(line);
+        return lex.peek() == '!';
+    }
+
+    void recordCommand(const char* line)
+    {
+        // Do not allow replay commands in the history. They just pollute the history, and
+        // add recursion complexities in the replay execution code, which we want to prevent.
+        if (isReplayCommand(line))
+            return;
+
+        // Only filter an immediate repeat of the previous command.
+        if (!m_history.empty() && m_history.back() == line)
+            return;
+
+        m_history.push_back(line);
+#if HAVE(READLINE)
+        add_history(line);
+#endif
+        if (m_history.size() > m_maxHistoryEntries)
+            m_history.erase(m_history.begin());
+
+        if (!m_historyFile)
+            return;
+
+        fprintf(m_historyFile, "%s\n", line);
+        int error = 0;
+        if (fflush(m_historyFile))
+            error = errno;
+        else if (ferror(m_historyFile))
+            error = EIO;
+        if (error) {
+            fallBackToMemoryOnly("Could not append to the history file", error);
+            return;
+        }
+        ++m_entriesInHistoryFile;
+        // The sum cannot overflow: the capacity only ever comes from Lexer::consumeUint32,
+        // which rejects anything above INT_MAX, leaving room for the overflow
+        // allowance on top.
+        if (m_entriesInHistoryFile >= m_maxHistoryEntries + maxOverflowEntries)
+            rewriteHistoryFile();
+    }
+
+    void handleLine(const char* line)
+    {
+        Lexer lex(line);
+        if (lex.atEnd())
+            return; // Blank line: not a command, not an error.
+
+        // History replay ("!!" / "!<n>") is expanded before command dispatch.
+        if (lex.consumeChar('!'))
+            return replayHistory(line, lex);
+
+        std::string_view word = lex.nextToken();
+        // `p` takes an lldb-style format suffix, as in "p/x", so the command and
+        // its format arrive as one token.
+        std::string_view command = word;
+        std::string_view format;
+        if (size_t slash = word.find('/'); slash != std::string_view::npos) {
+            command = word.substr(0, slash);
+            format = word.substr(slash + 1);
+        }
+
+        auto is = [&](const char* name) {
+            return word == name;
+        };
+
+        if (is("help")) {
+            handleHelp(lex);
+            return;
+        }
+        if (is("q") || is("quit") || is("exit")) {
+            m_isQuitting = confirmQuit();
+            return;
+        }
+        if (is("st") || is("status")) {
+            recordCommand(line);
+            printStatus();
+            return;
+        }
+        if (is("hi") || is("hist") || is("history")) {
+            // A bare `history` only lists the history. Recording it would make
+            // the last entry of every listing be the command that asked for it.
+            if (!lex.atEnd())
+                recordCommand(line);
+            handleHistory(lex);
+            return;
+        }
+        if (is("detach")) {
+            recordCommand(line);
+            detach();
+            return;
+        }
+        if (is("attach")) {
+            recordCommand(line);
+            // Optional "--pid"/"-p" before the number: "attach --pid 42" == "attach 42".
+            if (!lex.consumeToken("--pid"))
+                lex.consumeToken("-p");
+            pid_t pid = -1;
+            if (!lex.consumePID(pid) || !lex.atEnd()) {
+                fputs("Usage: attach [--pid|-p] <pid>\n", stderr);
+                return;
+            }
+            attach(pid);
+            return;
+        }
+        if (is("sn") || is("snap") || is("snapshot")) {
+            recordCommand(line);
+            handleSnapshot(lex);
+            return;
+        }
+        if (is("th") || is("thread")) {
+            recordCommand(line);
+            handleThread(lex);
+            return;
+        }
+        if (command == "p" || command == "print") {
+            recordCommand(line);
+            handlePrint(format, lex);
+            return;
+        }
+
+        recordCommand(line);
+        fprintf(stderr, "mya: Unknown command '%.*s'\n", static_cast<int>(word.length()), word.data());
+    }
+
+    void runInteractive()
+    {
+#if HAVE(READLINE)
+        for (;;) {
+            char* line = readline(prompt);
+            if (!line) {
+                putchar('\n');
+                break;
+            }
+            handleLine(line);
+            free(line);
+            if (m_isQuitting)
+                break;
+        }
+#else
+        char line[4096];
+        fputs(prompt, stdout);
+        fflush(stdout);
+        while (fgets(line, sizeof(line), stdin)) {
+            line[strcspn(line, "\n")] = '\0';
+            handleLine(line);
+            if (m_isQuitting)
+                break;
+            fputs(prompt, stdout);
+            fflush(stdout);
+        }
+        putchar('\n');
+#endif
+        cleanup(); // About to quit.
+    }
+
+    std::vector<std::string> m_history;
+    unsigned m_maxHistoryEntries { defaultMaxHistoryEntries };
+    unsigned m_entriesInHistoryFile { 0 }; // Actual number of commands in the file (may exceed target capacity).
+    FILE* m_historyFile { nullptr };
+    int m_historyDirDescriptor { -1 };
+    HashMap<pid_t, RefPtr<Process>> m_processes;
+    // m_snapshotsById owns the Snapshots; m_snapshots only records capture order.
+    HashMap<unsigned, std::unique_ptr<Snapshot>> m_snapshotsById;
+    DoublyLinkedList<Snapshot> m_snapshots;
+    RefPtr<Process> m_currentProcess;
+    unsigned m_currentSnapshot { 0 }; // Snapshot id in use; 0 means none.
+    bool m_isQuitting { false };
+};
+
+} // namespace Mya
+
+WTF_ALLOW_UNSAFE_BUFFER_USAGE_END
+
+#endif // (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
+
+int main(int argc, char** argv)
+{
+#if (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
+    return Mya::Shell().run(argc, argv);
+#else
+    UNUSED_PARAM(argc);
+    UNUSED_PARAM(argv);
+    printf("Not supported platform for mya\n");
+    return 1;
+#endif // (OS(MACOS) || USE(APPLE_INTERNAL_SDK)) && !PLATFORM(MACCATALYST) && !PLATFORM(IOS_FAMILY_SIMULATOR)
+}
diff --git a/Source/JavaScriptCore/runtime/JSModuleNamespaceObject.cpp b/Source/JavaScriptCore/runtime/JSModuleNamespaceObject.cpp
index 6b2c96688dd9..03d40b0d33e4 100644
--- a/Source/JavaScriptCore/runtime/JSModuleNamespaceObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSModuleNamespaceObject.cpp
@@ -34,6 +34,10 @@
 #if USE(BUN_JSC_ADDITIONS)
 #include "SyntheticModuleRecord.h"
 #endif
+#if ENABLE(WEBASSEMBLY)
+#include "JSWebAssemblyGlobal.h"
+#include "WebAssemblyModuleRecord.h"
+#endif
 
 namespace JSC {
 
@@ -207,6 +211,17 @@ bool JSModuleNamespaceObject::getOwnPropertySlotCommon(JSGlobalObject* globalObj
             return false;
         }
 
+#if ENABLE(WEBASSEMBLY)
+        if (is<WebAssemblyModuleRecord>(exportEntry.moduleRecord.get())) {
+            if (auto* wasmGlobal = dynamicDowncast<JSWebAssemblyGlobal>(value); wasmGlobal && wasmGlobal->global()->mutability() == Wasm::Mutability::Mutable) {
+                value = wasmGlobal->global()->get(globalObject);
+                RETURN_IF_EXCEPTION(scope, false);
+                slot.setValue(this, static_cast<unsigned>(PropertyAttribute::DontDelete), value);
+                return true;
+            }
+        }
+#endif
+
         slot.setValueModuleNamespace(this, static_cast<unsigned>(PropertyAttribute::DontDelete), value, environment, scopeOffset);
         return true;
     }
diff --git a/Source/JavaScriptCore/shell/CMakeLists.txt b/Source/JavaScriptCore/shell/CMakeLists.txt
index 01a69510b43b..83d560adb6e0 100644
--- a/Source/JavaScriptCore/shell/CMakeLists.txt
+++ b/Source/JavaScriptCore/shell/CMakeLists.txt
@@ -29,6 +29,24 @@ if (ENABLE_FUZZILLI)
   list(APPEND jsc_SOURCES ../fuzzilli/Fuzzilli.cpp)
 endif ()
 
+# mya analyzes process corpses through Mach task APIs, so it only builds on
+# Apple platforms. Its sources do not compile elsewhere.
+if (APPLE)
+    set(mya_SOURCES ../mya/mya.cpp)
+    set(mya_FRAMEWORKS
+        JavaScriptCore
+        WTF
+        bmalloc
+    )
+
+    set(mya_PRIVATE_INCLUDE_DIRECTORIES
+        $<TARGET_PROPERTY:JavaScriptCore,INCLUDE_DIRECTORIES>
+    )
+
+    # The corpse support mya uses lives in the tools static library.
+    set(mya_LIBRARIES JavaScriptCoreTools edit)
+endif ()
+
 WEBKIT_EXECUTABLE_DECLARE(jsc)
 
 if (USE_BUN_JSC_ADDITIONS)
@@ -63,6 +81,10 @@ if (USE_BUN_JSC_ADDITIONS)
     WEBKIT_EXECUTABLE_DECLARE(testFFI)
 endif ()
 
+if (APPLE)
+    WEBKIT_EXECUTABLE_DECLARE(mya)
+endif ()
+
 if (DEVELOPER_MODE)
     set(testapi_SOURCES
         ../API/tests/CompareAndSwapTest.cpp
@@ -123,6 +145,29 @@ if (DEVELOPER_MODE)
     set(testdfg_PRIVATE_INCLUDE_DIRECTORIES ${jsc_PRIVATE_INCLUDE_DIRECTORIES})
     set(testdfg_FRAMEWORKS ${jsc_FRAMEWORKS})
 
+    # The tools library and its tests are only relevant for Apple platforms.
+    if (APPLE)
+        set(testLibJSCTools_SOURCES
+            ../corpse/tests/CorpseAddressTest.cpp
+            ../corpse/tests/CorpseByteParserTest.cpp
+            ../corpse/tests/CorpseExportsTrieTest.cpp
+            ../corpse/tests/CorpseProcessTest.cpp
+            ../corpse/tests/CorpseRegionTest.cpp
+            ../corpse/tests/CorpseSnapshotTest.cpp
+            ../corpse/tests/CorpseSymbolTest.cpp
+            ../corpse/tests/CorpseThreadTest.cpp
+            ../corpse/tests/LibJSCToolsTestUtilities.cpp
+            ../corpse/tests/testLibJSCTools.cpp
+        )
+        set(testLibJSCTools_DEFINITIONS ${jsc_PRIVATE_DEFINITIONS})
+        set(testLibJSCTools_PRIVATE_INCLUDE_DIRECTORIES
+            ${jsc_PRIVATE_INCLUDE_DIRECTORIES}
+            ${JAVASCRIPTCORE_DIR}/corpse
+        )
+        set(testLibJSCTools_FRAMEWORKS ${jsc_FRAMEWORKS})
+        set(testLibJSCTools_LIBRARIES JavaScriptCoreTools)
+    endif ()
+
     set(testwasmdebugger_SOURCES
         ../wasm/debugger/testwasmdebugger.cpp
 
@@ -155,6 +200,10 @@ if (DEVELOPER_MODE)
     WEBKIT_EXECUTABLE_DECLARE(testdfg)
     WEBKIT_EXECUTABLE_DECLARE(testwasmdebugger)
 
+    if (APPLE)
+        WEBKIT_EXECUTABLE_DECLARE(testLibJSCTools)
+    endif ()
+
     if (COMPILER_IS_GCC_OR_CLANG)
         WEBKIT_ADD_TARGET_CXX_FLAGS(testb3 -Wno-array-bounds)
         WEBKIT_ADD_TARGET_CXX_FLAGS(testair -Wno-array-bounds)
@@ -175,6 +224,14 @@ if (SHOULD_INSTALL_JS_SHELL)
     install(TARGETS jsc DESTINATION "${LIBEXEC_INSTALL_DIR}")
 endif ()
 
+if (APPLE)
+    WEBKIT_EXECUTABLE(mya)
+
+    if (SHOULD_INSTALL_JS_SHELL)
+        install(TARGETS mya DESTINATION "${LIBEXEC_INSTALL_DIR}")
+    endif ()
+endif ()
+
 if (DEVELOPER_MODE)
     WEBKIT_EXECUTABLE(testapi)
     WEBKIT_EXECUTABLE(testRegExp)
@@ -184,6 +241,10 @@ if (DEVELOPER_MODE)
     WEBKIT_EXECUTABLE(testdfg)
     WEBKIT_EXECUTABLE(testwasmdebugger)
 
+    if (APPLE)
+        WEBKIT_EXECUTABLE(testLibJSCTools)
+    endif ()
+
     WEBKIT_ADD_PREFIX_HEADER(testapi ../JavaScriptCorePrefix.h PREFIX_NO_CODEGEN PREFIX_LANGUAGES CXX)
     WEBKIT_REUSE_PREFIX_HEADER(testb3 testapi ../JavaScriptCorePrefix.h PREFIX_LANGUAGES CXX)
     WEBKIT_REUSE_PREFIX_HEADER(testwasmdebugger testapi ../JavaScriptCorePrefix.h PREFIX_LANGUAGES CXX)
diff --git a/Source/JavaScriptCore/shell/PlatformCocoa.cmake b/Source/JavaScriptCore/shell/PlatformCocoa.cmake
index 06765386e803..3ebba0330703 100644
--- a/Source/JavaScriptCore/shell/PlatformCocoa.cmake
+++ b/Source/JavaScriptCore/shell/PlatformCocoa.cmake
@@ -14,6 +14,7 @@ set_source_files_properties(${testapi_OBJC_SOURCES} PROPERTIES
 )
 
 WEBKIT_GENERATE_ENTITLEMENTS(jsc USING ../Scripts/process-entitlements.sh)
+WEBKIT_GENERATE_ENTITLEMENTS(mya USING ../Scripts/process-entitlements.sh)
 if (DEVELOPER_MODE)
     WEBKIT_GENERATE_ENTITLEMENTS(testapi USING ../Scripts/process-entitlements.sh)
     WEBKIT_GENERATE_ENTITLEMENTS(testRegExp USING ../Scripts/process-entitlements.sh)
@@ -21,5 +22,6 @@ if (DEVELOPER_MODE)
     WEBKIT_GENERATE_ENTITLEMENTS(testb3 USING ../Scripts/process-entitlements.sh)
     WEBKIT_GENERATE_ENTITLEMENTS(testair USING ../Scripts/process-entitlements.sh)
     WEBKIT_GENERATE_ENTITLEMENTS(testdfg USING ../Scripts/process-entitlements.sh)
+    WEBKIT_GENERATE_ENTITLEMENTS(testLibJSCTools USING ../Scripts/process-entitlements.sh)
 endif ()
 
diff --git a/Source/JavaScriptCore/wasm/WasmBBQJIT.cpp b/Source/JavaScriptCore/wasm/WasmBBQJIT.cpp
index 77a7e16d2cc3..c5ab146354b4 100644
--- a/Source/JavaScriptCore/wasm/WasmBBQJIT.cpp
+++ b/Source/JavaScriptCore/wasm/WasmBBQJIT.cpp
@@ -3215,16 +3215,27 @@ PartialResult BBQJIT::addI32Extend8S(Value operand, Value& result)
 
 [[nodiscard]] PartialResult BBQJIT::addRefFunc(FunctionSpaceIndex index, Value& result)
 {
-    // FIXME: Emit this inline <https://bugs.webkit.org/show_bug.cgi?id=198506>.
-    TypeKind returnType = TypeKind::Ref;
+    GPRReg resultGPR;
+    {
+        ScratchScope<1, 0> scratches(*this);
+        resultGPR = scratches.gpr(0);
+
+        m_jit.load64(Address(GPRInfo::wasmContextInstancePointer, safeCast<int32_t>(JSWebAssemblyInstance::offsetOfFunctionWrapper(m_info, index))), resultGPR);
+
+        JumpList slowPath = m_jit.branchTest64(ResultCondition::Zero, resultGPR);
+        MacroAssembler::Label done(m_jit);
+        m_slowPaths.append({ origin(), WTF::move(slowPath), WTF::move(done), copyBindings(), [index, resultGPR](BBQJIT&, CCallHelpers& jit) {
+            jit.prepareWasmCallOperation(GPRInfo::wasmContextInstancePointer);
+            jit.setupArguments<decltype(operationWasmRefFunc)>(GPRInfo::wasmContextInstancePointer, TrustedImm32(static_cast<uint32_t>(index)));
+            jit.callOperation<OperationPtrTag>(operationWasmRefFunc);
+            jit.move(GPRInfo::returnValueGPR, resultGPR);
+        } });
+    }
 
-    Vector<Value, 8> arguments = {
-        instanceValue(),
-        Value::fromI32(index)
-    };
-    result = topValue(returnType);
-    emitCCall(&operationWasmRefFunc, arguments, result);
+    result = topValue(TypeKind::Ref);
+    bind(result, Location::fromGPR(resultGPR));
 
+    LOG_INSTRUCTION("RefFunc", index, RESULT(result));
     return { };
 }
 
diff --git a/Source/JavaScriptCore/wasm/WasmBBQJIT64.cpp b/Source/JavaScriptCore/wasm/WasmBBQJIT64.cpp
index 9fa3ffba4628..75c02372110f 100644
--- a/Source/JavaScriptCore/wasm/WasmBBQJIT64.cpp
+++ b/Source/JavaScriptCore/wasm/WasmBBQJIT64.cpp
@@ -1611,22 +1611,6 @@ void BBQJIT::emitAllocateGCArrayUninitialized(GPRReg resultGPR, TypeSignatureInd
 [[nodiscard]] PartialResult BBQJIT::addArrayNewDefault(TypeSignatureIndex typeIndex, ExpressionType size, ExpressionType& result)
 {
     StorageType elementType = getArrayElementType(typeIndex);
-    // FIXME: We don't have a good way to fill V128s yet so just make a call.
-    if (elementType.unpacked().isV128()) {
-        Vector<Value, 8> arguments = {
-            instanceValue(),
-            Value::fromI32(typeIndex.rawIndex()),
-            size,
-        };
-        result = topValue(TypeKind::Arrayref);
-        emitCCall(operationWasmArrayNewEmpty, arguments, result);
-
-        Location resultLocation = loadIfNecessary(result);
-        emitThrowOnNullReference(ExceptionType::BadArrayNew, resultLocation);
-
-        LOG_INSTRUCTION("ArrayNewDefault", typeIndex, size, RESULT(result));
-        return { };
-    }
 
     GPRReg resultGPR;
     {
@@ -1639,7 +1623,13 @@ void BBQJIT::emitAllocateGCArrayUninitialized(GPRReg resultGPR, TypeSignatureInd
         JIT_COMMENT(m_jit, "Array allocation done do initialization");
         std::optional<ScratchScope<1, 0>> sizeScratch;
         Location sizeLocation = materializeToGPR(size, sizeScratch);
-        Value initValue = Value::fromI64(Wasm::isRefType(elementType.unpacked()) ? JSValue::encode(jsNull()) : 0);
+        Value initValue;
+        if (elementType.unpacked().isV128()) {
+            // FIXME: We should have V128 Constant.
+            materializeVectorConstant(v128_t { }, Location::fromFPR(wasmScratchFPR));
+            initValue = Value::pinned(TypeKind::V128, Location::fromFPR(wasmScratchFPR));
+        } else
+            initValue = Value::fromI64(Wasm::isRefType(elementType.unpacked()) ? JSValue::encode(jsNull()) : 0);
 
         emitArrayGetPayload(elementType, resultGPR, scratchGPR);
 
diff --git a/Source/JavaScriptCore/wasm/WasmFunctionParser.h b/Source/JavaScriptCore/wasm/WasmFunctionParser.h
index 4f4cf92ad41f..bb18a422a6e7 100644
--- a/Source/JavaScriptCore/wasm/WasmFunctionParser.h
+++ b/Source/JavaScriptCore/wasm/WasmFunctionParser.h
@@ -247,7 +247,9 @@ class FunctionParser : public Parser<void>, public FunctionParserTypes<typename
     [[nodiscard]] PartialResult parseUnreachableExpression();
     [[nodiscard]] PartialResult unifyControl(ArgumentList&, unsigned level);
     [[nodiscard]] PartialResult checkLocalInitialized(uint32_t);
-    [[nodiscard]] PartialResult checkExpressionStack(const ControlType&, bool forceSignature = false);
+    [[nodiscard]] PartialResult checkArgumentsAndWiden(const BlockSignature&);
+    [[nodiscard]] PartialResult checkResultsAndWiden(const BlockSignature&);
+    [[nodiscard]] PartialResult endBlockAndCheckResultTypes(ControlEntry&);
 
     enum BranchConditionalityTag {
         Unconditional,
@@ -652,12 +654,9 @@ auto FunctionParser<Context>::binaryCompareCase(OpType op, BinaryOperationHandle
             BlockSignature inlineSignature;
             WASM_PARSER_FAIL_IF(!parseBlockSignatureAndNotifySIMDUseIfNeeded(inlineSignature), "can't get if's signature"_s);
 
-            const uint32_t sliceSize = m_expressionStack.size() - m_currentStackBegin;
             const uint32_t argumentCount = inlineSignature.argumentCount();
-            WASM_VALIDATOR_FAIL_IF(sliceSize < argumentCount, "Too few arguments on stack for if block. If expects ", argumentCount, ", but only ", sliceSize, " were present. If block has signature: ", inlineSignature);
+            WASM_FAIL_IF_HELPER_FAILS(checkArgumentsAndWiden(inlineSignature));
             const uint32_t parentStackHeight = m_expressionStack.size() - argumentCount;
-            for (unsigned i = 0; i < argumentCount; ++i)
-                WASM_VALIDATOR_FAIL_IF(!isSubtype(m_expressionStack[parentStackHeight + i].type(), inlineSignature.argumentType(i)), "Loop expects the argument at index", i, " to be ", inlineSignature.argumentType(i), " but argument has type ", m_expressionStack[parentStackHeight + i].type());
 
             auto args = m_expressionStack.mutableSpan().last(argumentCount);
             ControlType control;
@@ -722,12 +721,9 @@ auto FunctionParser<Context>::unaryCompareCase(OpType op, UnaryOperationHandler
             BlockSignature inlineSignature;
             WASM_PARSER_FAIL_IF(!parseBlockSignatureAndNotifySIMDUseIfNeeded(inlineSignature), "can't get if's signature"_s);
 
-            const uint32_t sliceSize = m_expressionStack.size() - m_currentStackBegin;
             const uint32_t argumentCount = inlineSignature.argumentCount();
-            WASM_VALIDATOR_FAIL_IF(sliceSize < argumentCount, "Too few arguments on stack for if block. If expects ", argumentCount, ", but only ", sliceSize, " were present. If block has signature: ", inlineSignature);
+            WASM_FAIL_IF_HELPER_FAILS(checkArgumentsAndWiden(inlineSignature));
             const uint32_t parentStackHeight = m_expressionStack.size() - argumentCount;
-            for (unsigned i = 0; i < argumentCount; ++i)
-                WASM_VALIDATOR_FAIL_IF(!isSubtype(m_expressionStack[parentStackHeight + i].type(), inlineSignature.argumentType(i)), "Loop expects the argument at index", i, " to be ", inlineSignature.argumentType(i), " but argument has type ", m_expressionStack[parentStackHeight + i].type());
 
             auto args = m_expressionStack.mutableSpan().last(argumentCount);
             ControlType control;
@@ -1900,22 +1896,61 @@ auto FunctionParser<Context>::checkLocalInitialized(uint32_t index) -> PartialRe
 }
 
 template<typename Context>
-auto FunctionParser<Context>::checkExpressionStack(const ControlType& controlData, bool forceSignature) -> PartialResult
+auto FunctionParser<Context>::checkArgumentsAndWiden(const BlockSignature& blockSignature) -> PartialResult
+{
+    const uint32_t argumentCount = blockSignature.argumentCount();
+    const uint32_t sliceSize = m_expressionStack.size() - m_currentStackBegin;
+    WASM_VALIDATOR_FAIL_IF(sliceSize < argumentCount, "Too few values on stack for block. Block expects "_s, argumentCount, ", but only "_s, sliceSize, " were present. Block has signature: "_s, blockSignature);
+    const uint32_t offset = m_expressionStack.size() - argumentCount;
+    for (unsigned i = 0; i < argumentCount; ++i) {
+        auto& slot = m_expressionStack[offset + i];
+        const auto expectedType = blockSignature.argumentType(i);
+        WASM_VALIDATOR_FAIL_IF(!isSubtype(slot.type(), expectedType), "Block expects the argument at index "_s, i, " to be "_s, expectedType, " but argument has type "_s, slot.type());
+        // Widen the operand to the block's declared parameter type, per the spec's
+        // push_ctrl(op, in, out) doing push_vals(in): the block body must be validated
+        // against its declared parameter types, not the narrower subtype that flowed in.
+        // https://webassembly.github.io/spec/core/bikeshed/#validation-of-opcode-sequences
+        slot.setType(expectedType);
+    }
+
+    return { };
+}
+
+template<typename Context>
+auto FunctionParser<Context>::checkResultsAndWiden(const BlockSignature& blockSignature) -> PartialResult
 {
-    const auto& blockSignature = controlData.signature();
     const uint32_t sliceSize = m_expressionStack.size() - m_currentStackBegin;
     WASM_VALIDATOR_FAIL_IF(blockSignature.returnCount() != sliceSize, " block with type: "_s, blockSignature, " returns: "_s, blockSignature.returnCount(), " but stack has: "_s, sliceSize, " values"_s);
     for (unsigned i = 0; i < blockSignature.returnCount(); ++i) {
-        const auto actualType = m_expressionStack[m_currentStackBegin + i].type();
+        auto& slot = m_expressionStack[m_currentStackBegin + i];
         const auto expectedType = blockSignature.returnType(i);
-        WASM_VALIDATOR_FAIL_IF(!isSubtype(actualType, expectedType), "control flow returns with unexpected type. "_s, actualType, " is not a "_s, expectedType);
-        if (forceSignature)
-            m_expressionStack[m_currentStackBegin + i].setType(expectedType);
+        WASM_VALIDATOR_FAIL_IF(!isSubtype(slot.type(), expectedType), "control flow returns with unexpected type. "_s, slot.type(), " is not a "_s, expectedType);
+        // Widen the operand to the block's declared result type, per the spec's
+        // end doing push_vals(frame.end_types): results leave the block as the
+        // declared type, not the narrower subtype that reached the end.
+        // https://webassembly.github.io/spec/core/bikeshed/#validation-of-opcode-sequences
+        slot.setType(expectedType);
     }
 
     return { };
 }
 
+template<typename Context>
+auto FunctionParser<Context>::endBlockAndCheckResultTypes(ControlEntry& entry) -> PartialResult
+{
+    // Widen each result to the block signature type before ending the block.
+    // FIXME: mutating the expression stack for the block result is effectful, but there's no
+    // better API yet. See https://bugs.webkit.org/show_bug.cgi?id=164353
+    WASM_FAIL_IF_HELPER_FAILS(checkResultsAndWiden(entry.controlData.signature()));
+    const uint32_t parentBegin = parentEntryBegin();
+    auto enclosedStack = m_expressionStack.mutableSpan().subspan(parentBegin);
+    // We should avoid adding other callsites of endBlock. Since a new block is a sign of a
+    // merge point and it would be a security bug to fail to widen the types.
+    WASM_TRY_ADD_TO_CONTEXT(endBlock(entry, enclosedStack));
+    m_currentStackBegin = parentBegin;
+    return { };
+}
+
 template<typename Context>
 auto FunctionParser<Context>::parseArrayTypeDefinition(ASCIILiteral operation, bool isNullable, TypeSignatureIndex& typeIndex, FieldType& elementType, Type& arrayRefType) -> PartialResult
 {
@@ -3464,15 +3499,8 @@ FOR_EACH_WASM_MEMORY_STORE_OP(CREATE_CASE)
         BlockSignature inlineSignature;
         WASM_PARSER_FAIL_IF(!parseBlockSignatureAndNotifySIMDUseIfNeeded(inlineSignature), "can't get block's signature"_s);
 
-        const uint32_t sliceSize = m_expressionStack.size() - m_currentStackBegin;
         const uint32_t argumentCount = inlineSignature.argumentCount();
-
-        WASM_VALIDATOR_FAIL_IF(sliceSize < argumentCount, "Too few values on stack for block. Block expects ", argumentCount, ", but only ", sliceSize, " were present. Block has inlineSignature: ", inlineSignature);
-        const uint32_t parentStackHeight = m_expressionStack.size() - argumentCount;
-        for (unsigned i = 0; i < argumentCount; ++i) {
-            Type type = m_expressionStack[parentStackHeight + i].type();
-            WASM_VALIDATOR_FAIL_IF(!isSubtype(type, inlineSignature.argumentType(i)), "Block expects the argument at index", i, " to be ", inlineSignature.argumentType(i), " but argument has type ", type);
-        }
+        WASM_FAIL_IF_HELPER_FAILS(checkArgumentsAndWiden(inlineSignature));
 
         auto args = m_expressionStack.mutableSpan().last(argumentCount);
         ControlType block;
@@ -3485,15 +3513,9 @@ FOR_EACH_WASM_MEMORY_STORE_OP(CREATE_CASE)
         BlockSignature inlineSignature;
         WASM_PARSER_FAIL_IF(!parseBlockSignatureAndNotifySIMDUseIfNeeded(inlineSignature), "can't get loop's signature"_s);
 
-        const uint32_t sliceSize = m_expressionStack.size() - m_currentStackBegin;
         const uint32_t argumentCount = inlineSignature.argumentCount();
-
-        WASM_VALIDATOR_FAIL_IF(sliceSize < argumentCount, "Too few values on stack for loop block. Loop expects ", argumentCount, ", but only ", sliceSize, " were present. Loop has inlineSignature: ", inlineSignature);
+        WASM_FAIL_IF_HELPER_FAILS(checkArgumentsAndWiden(inlineSignature));
         const uint32_t parentStackHeight = m_expressionStack.size() - argumentCount;
-        for (unsigned i = 0; i < argumentCount; ++i) {
-            Type type = m_expressionStack[parentStackHeight + i].type();
-            WASM_VALIDATOR_FAIL_IF(!isSubtype(type, inlineSignature.argumentType(i)), "Loop expects the argument at index", i, " to be ", inlineSignature.argumentType(i), " but argument has type ", type);
-        }
 
         auto args = m_expressionStack.mutableSpan().last(argumentCount);
         ControlType loop;
@@ -3512,13 +3534,9 @@ FOR_EACH_WASM_MEMORY_STORE_OP(CREATE_CASE)
         WASM_TRY_POP_EXPRESSION_STACK_INTO(condition, "if condition"_s);
 
         WASM_VALIDATOR_FAIL_IF(!condition.type().isI32(), "if condition must be i32, got ", condition.type());
-        const uint32_t sliceSize = m_expressionStack.size() - m_currentStackBegin;
         const uint32_t argumentCount = inlineSignature.argumentCount();
-
-        WASM_VALIDATOR_FAIL_IF(sliceSize < argumentCount, "Too few arguments on stack for if block. If expects ", argumentCount, ", but only ", sliceSize, " were present. If block has signature: ", inlineSignature);
+        WASM_FAIL_IF_HELPER_FAILS(checkArgumentsAndWiden(inlineSignature));
         const uint32_t parentStackHeight = m_expressionStack.size() - argumentCount;
-        for (unsigned i = 0; i < argumentCount; ++i)
-            WASM_VALIDATOR_FAIL_IF(!isSubtype(m_expressionStack[parentStackHeight + i].type(), inlineSignature.argumentType(i)), "Loop expects the argument at index", i, " to be ", inlineSignature.argumentType(i), " but argument has type ", m_expressionStack[parentStackHeight + i].type());
 
         auto args = m_expressionStack.mutableSpan().last(argumentCount);
         ControlType control;
@@ -3539,7 +3557,7 @@ FOR_EACH_WASM_MEMORY_STORE_OP(CREATE_CASE)
         ControlEntry& controlEntry = m_controlStack.last();
 
         WASM_VALIDATOR_FAIL_IF(!ControlType::isIf(controlEntry.controlData), "else block isn't associated to an if");
-        WASM_FAIL_IF_HELPER_FAILS(checkExpressionStack(controlEntry.controlData));
+        WASM_FAIL_IF_HELPER_FAILS(checkResultsAndWiden(controlEntry.controlData.signature()));
         auto ifBranchResults = m_expressionStack.mutableSpan().subspan(m_currentStackBegin);
         WASM_TRY_ADD_TO_CONTEXT(addElse(controlEntry.controlData, ifBranchResults));
         m_expressionStack.shrink(m_currentStackBegin);
@@ -3553,13 +3571,9 @@ FOR_EACH_WASM_MEMORY_STORE_OP(CREATE_CASE)
         BlockSignature inlineSignature;
         WASM_PARSER_FAIL_IF(!parseBlockSignatureAndNotifySIMDUseIfNeeded(inlineSignature), "can't get try's signature"_s);
 
-        const uint32_t sliceSize = m_expressionStack.size() - m_currentStackBegin;
         const uint32_t argumentCount = inlineSignature.argumentCount();
-
-        WASM_VALIDATOR_FAIL_IF(sliceSize < argumentCount, "Too few arguments on stack for try block. Try expects ", argumentCount, ", but only ", sliceSize, " were present. Try block has signature: ", inlineSignature);
+        WASM_FAIL_IF_HELPER_FAILS(checkArgumentsAndWiden(inlineSignature));
         const uint32_t parentStackHeight = m_expressionStack.size() - argumentCount;
-        for (unsigned i = 0; i < argumentCount; ++i)
-            WASM_VALIDATOR_FAIL_IF(!isSubtype(m_expressionStack[parentStackHeight + i].type(), inlineSignature.argumentType(i)), "Try expects the argument at index", i, " to be ", inlineSignature.argumentType(i), " but argument has type ", m_expressionStack[parentStackHeight + i].type());
 
         auto args = m_expressionStack.mutableSpan().last(argumentCount);
         ControlType control;
@@ -3580,7 +3594,7 @@ FOR_EACH_WASM_MEMORY_STORE_OP(CREATE_CASE)
 
         ControlEntry& controlEntry = m_controlStack.last();
         WASM_VALIDATOR_FAIL_IF(!isTryOrCatch(controlEntry.controlData), "catch block isn't associated to a try");
-        WASM_FAIL_IF_HELPER_FAILS(checkExpressionStack(controlEntry.controlData));
+        WASM_FAIL_IF_HELPER_FAILS(checkResultsAndWiden(controlEntry.controlData.signature()));
 
         ResultList results;
         auto preCatchStack = m_expressionStack.mutableSpan().subspan(m_currentStackBegin);
@@ -3606,7 +3620,7 @@ FOR_EACH_WASM_MEMORY_STORE_OP(CREATE_CASE)
         ControlEntry& controlEntry = m_controlStack.last();
 
         WASM_VALIDATOR_FAIL_IF(!isTryOrCatch(controlEntry.controlData), "catch block isn't associated to a try");
-        WASM_FAIL_IF_HELPER_FAILS(checkExpressionStack(controlEntry.controlData));
+        WASM_FAIL_IF_HELPER_FAILS(checkResultsAndWiden(controlEntry.controlData.signature()));
 
         auto preCatchStack = m_expressionStack.mutableSpan().subspan(m_currentStackBegin);
         WASM_TRY_ADD_TO_CONTEXT(addCatchAll(preCatchStack, controlEntry.controlData));
@@ -3622,14 +3636,8 @@ FOR_EACH_WASM_MEMORY_STORE_OP(CREATE_CASE)
         BlockSignature inlineSignature;
         WASM_PARSER_FAIL_IF(!parseBlockSignatureAndNotifySIMDUseIfNeeded(inlineSignature), "can't get try_table's signature"_s);
 
-        const uint32_t sliceSize = m_expressionStack.size() - m_currentStackBegin;
         const uint32_t argumentCount = inlineSignature.argumentCount();
-        WASM_VALIDATOR_FAIL_IF(sliceSize < argumentCount, "Too few values on stack for block. Block expects ", argumentCount, ", but only ", sliceSize, " were present. Block has inlineSignature: ", inlineSignature);
-        const uint32_t parentStackHeight = m_expressionStack.size() - argumentCount;
-        for (unsigned i = 0; i < argumentCount; ++i) {
-            Type type = m_expressionStack[parentStackHeight + i].type();
-            WASM_VALIDATOR_FAIL_IF(!isSubtype(type, inlineSignature.argumentType(i)), "Block expects the argument at index", i, " to be ", inlineSignature.argumentType(i), " but argument has type ", type);
-        }
+        WASM_FAIL_IF_HELPER_FAILS(checkArgumentsAndWiden(inlineSignature));
 
         uint32_t numberOfCatches;
         Vector<CatchHandler> targets;
@@ -3714,13 +3722,8 @@ FOR_EACH_WASM_MEMORY_STORE_OP(CREATE_CASE)
         WASM_VALIDATOR_FAIL_IF(!ControlType::isTry(targetData) && !ControlType::isTopLevel(targetData), "delegate target isn't a try or the top level block");
 
         WASM_TRY_ADD_TO_CONTEXT(addDelegate(targetData, controlEntry.controlData));
-        WASM_FAIL_IF_HELPER_FAILS(checkExpressionStack(controlEntry.controlData));
-
-        const uint32_t parentBegin = parentEntryBegin();
-        auto enclosedStack = m_expressionStack.mutableSpan().subspan(parentBegin);
-        WASM_TRY_ADD_TO_CONTEXT(endBlock(controlEntry, enclosedStack));
-
-        m_currentStackBegin = parentBegin;
+        // Unlike the sibling catch/catch_all arms, delegate ends the try block, so it widens results.
+        WASM_FAIL_IF_HELPER_FAILS(endBlockAndCheckResultTypes(controlEntry));
         resetLocalInitStackToHeight(controlEntry.localInitStackHeight);
         return { };
     }
@@ -3849,26 +3852,13 @@ FOR_EACH_WASM_MEMORY_STORE_OP(CREATE_CASE)
     case End: {
         ControlEntry data = m_controlStack.takeLast();
         if (ControlType::isIf(data.controlData)) {
-            WASM_FAIL_IF_HELPER_FAILS(checkExpressionStack(data.controlData));
+            WASM_FAIL_IF_HELPER_FAILS(checkResultsAndWiden(data.controlData.signature()));
             auto ifBranchResults = m_expressionStack.mutableSpan().subspan(m_currentStackBegin);
             WASM_TRY_ADD_TO_CONTEXT(addElse(data.controlData, ifBranchResults));
             m_expressionStack.shrink(m_currentStackBegin);
             m_expressionStack.append(data.elseBlockStack.span());
         }
-
-        // FIXME: endBlock may modify the expressionStack slice for the result of the block.
-        // That's a little too effectful but we don't have a better API right now.
-        // see: https://bugs.webkit.org/show_bug.cgi?id=164353
-
-        // The spec requires the output type of a structured control instruction to be
-        // the result type from its signature, even when the fallthrough value is a subtype.
-        WASM_FAIL_IF_HELPER_FAILS(checkExpressionStack(data.controlData, true));
-
-        const uint32_t parentBegin = parentEntryBegin();
-        auto enclosedStack = m_expressionStack.mutableSpan().subspan(parentBegin);
-        WASM_TRY_ADD_TO_CONTEXT(endBlock(data, enclosedStack));
-
-        m_currentStackBegin = parentBegin;
+        WASM_FAIL_IF_HELPER_FAILS(endBlockAndCheckResultTypes(data));
         if (!ControlType::isTopLevel(data.controlData))
             resetLocalInitStackToHeight(data.localInitStackHeight);
         return { };
@@ -4064,12 +4054,7 @@ auto FunctionParser<Context>::parseUnreachableExpression() -> PartialResult
                 WASM_TRY_ADD_TO_CONTEXT(addElseToUnreachable(data.controlData));
                 m_expressionStack.shrink(m_currentStackBegin);
                 m_expressionStack.append(data.elseBlockStack.span());
-                WASM_FAIL_IF_HELPER_FAILS(checkExpressionStack(data.controlData));
-
-                // Reachable End handling: the combined enclosedStack now lives in
-                // m_expressionStack[parentBegin..end].
-                auto enclosedStack = m_expressionStack.mutableSpan().subspan(parentBegin);
-                WASM_TRY_ADD_TO_CONTEXT(endBlock(data, enclosedStack));
+                WASM_FAIL_IF_HELPER_FAILS(endBlockAndCheckResultTypes(data));
             } else {
                 m_expressionStack.shrink(m_currentStackBegin);
                 const auto& sig = data.controlData.signature();
diff --git a/Source/JavaScriptCore/wasm/WasmOMGIRGenerator.cpp b/Source/JavaScriptCore/wasm/WasmOMGIRGenerator.cpp
index d487c5640138..c9f887518938 100644
--- a/Source/JavaScriptCore/wasm/WasmOMGIRGenerator.cpp
+++ b/Source/JavaScriptCore/wasm/WasmOMGIRGenerator.cpp
@@ -1328,6 +1328,9 @@ OMGIRGenerator::OMGIRGenerator(AbstractHeapRepository& heaps, CompilationContext
 
     m_proc.pinRegister(GPRInfo::wasmContextInstancePointer);
     m_proc.pinRegister(GPRInfo::wasmBaseMemoryPointer);
+    // FIXME: The wasm ABI effectively has to assume this is a caller save when getting
+    // called by wasm, so there's no point in saving and restoring it if B3 chooses to
+    // use it. We actively don't restore this register in many cases anyway e.g. tail calls.
     if (mode == MemoryMode::BoundsChecking)
         m_proc.pinRegister(GPRInfo::wasmBoundsCheckingSizeRegister);
 
@@ -1786,9 +1789,28 @@ auto OMGIRGenerator::addTableSet(unsigned tableIndex, ExpressionType index, Expr
 
 auto OMGIRGenerator::addRefFunc(FunctionSpaceIndex index, ExpressionType& result) -> PartialResult
 {
-    // FIXME: Emit this inline <https://bugs.webkit.org/show_bug.cgi?id=198506>.
-    result = push(callWasmOperation(m_currentBlock, wasmRefType(), operationWasmRefFunc,
-        instanceValue(), constant(toB3Type(Types::I32), index)));
+    auto* loaded = m_currentBlock->appendNew<MemoryValue>(m_proc, Load, wasmRefType(), origin(), instanceValue(), safeCast<int32_t>(JSWebAssemblyInstance::offsetOfFunctionWrapper(m_info, index)));
+    m_heaps.decorateMemory(&m_heaps.JSWebAssemblyInstance_functionWrappers[index], loaded);
+
+    auto* slowPath = m_proc.addBlock();
+    auto* continuation = m_proc.addBlock();
+    auto* phi = continuation->appendNew<Value>(m_proc, Phi, wasmRefType(), origin());
+
+    m_currentBlock->appendNew<UpsilonValue>(m_proc, origin(), loaded, phi);
+    m_currentBlock->appendNewControlValue(m_proc, B3::Branch, origin(), loaded,
+        FrequentedBlock(continuation), FrequentedBlock(slowPath, FrequencyClass::Rare));
+    slowPath->addPredecessor(m_currentBlock);
+    continuation->addPredecessor(m_currentBlock);
+
+    m_currentBlock = slowPath;
+    auto* called = callWasmOperation(m_currentBlock, wasmRefType(), operationWasmRefFunc,
+        instanceValue(), constant(Int32, index));
+    m_currentBlock->appendNew<UpsilonValue>(m_proc, origin(), called, phi);
+    m_currentBlock->appendNewControlValue(m_proc, Jump, origin(), continuation);
+    continuation->addPredecessor(m_currentBlock);
+
+    m_currentBlock = continuation;
+    result = push(phi);
     TRACE_VALUE(Wasm::Types::Funcref, get(result), "ref_func ", index);
     return { };
 }
@@ -5822,6 +5844,11 @@ static inline void prepareForTailCallImpl(unsigned functionIndex, CCallHelpers&
     entries.reserveInitialCapacity(calleeSaves.registerCount() + functionSignature.argumentCount() + 1);
 
     for (const auto& regAtOffset : calleeSaves) {
+        // Don't restore wasmBoundsCheckingSizeRegister since we may have set it when checking for
+        // a cross-instance call. It's not a normal callee save independent of whether we used
+        // it or not.
+        if (regAtOffset.reg() == GPRInfo::wasmBoundsCheckingSizeRegister)
+            continue;
         ShuffleEntry entry;
         entry.src = ShuffleLocation::fromStack(fpOffsetToSPOffset(regAtOffset.offset()));
         if (regAtOffset.reg().isGPR()) {
diff --git a/Source/JavaScriptCore/wasm/js/JSToWasm.cpp b/Source/JavaScriptCore/wasm/js/JSToWasm.cpp
index f1e7f0b10c65..8a020292f7e4 100644
--- a/Source/JavaScriptCore/wasm/js/JSToWasm.cpp
+++ b/Source/JavaScriptCore/wasm/js/JSToWasm.cpp
@@ -600,11 +600,19 @@ CodePtr<JSEntryPtrTag> RTT::jsToWasmICEntrypoint() const
                     slowPath.append(jit.branchPtr(CCallHelpers::NotEqual, scratchJSR.payloadGPR(), CCallHelpers::TrustedImmPtr(targetRTT.ptr())));
                 }
 
+                if (type.isNullable())
+                    isNull.link(&jit);
+            } else if (Wasm::isI31ref(type)) {
+                jit.loadValue(jsParam, scratchJSR);
+                auto isNull = jit.branchIfNull(scratchJSR);
+                if (!type.isNullable())
+                    slowPath.append(isNull);
+                slowPath.append(jit.branchIfNotInt32(scratchJSR, DoNotHaveTagRegisters));
+                slowPath.append(jit.branch32(CCallHelpers::GreaterThan, scratchJSR.payloadGPR(), CCallHelpers::TrustedImm32(Wasm::maxI31ref)));
+                slowPath.append(jit.branch32(CCallHelpers::LessThan, scratchJSR.payloadGPR(), CCallHelpers::TrustedImm32(Wasm::minI31ref)));
                 if (type.isNullable())
                     isNull.link(&jit);
             } else if (!Wasm::isExternref(type)) {
-                // FIXME: this should implement some fast paths for, e.g., i31refs and other
-                // types that can be easily handled.
                 slowPath.append(jit.jump());
             }
 
diff --git a/Source/JavaScriptCore/wasm/js/JSWebAssemblyArray.cpp b/Source/JavaScriptCore/wasm/js/JSWebAssemblyArray.cpp
index 47478b1a743e..f15b4205dade 100644
--- a/Source/JavaScriptCore/wasm/js/JSWebAssemblyArray.cpp
+++ b/Source/JavaScriptCore/wasm/js/JSWebAssemblyArray.cpp
@@ -69,9 +69,9 @@ void JSWebAssemblyArray::fill(VM& vm, uint32_t offset, uint64_t value, uint32_t
 {
     // Handle ref types separately to ensure write barriers are in effect.
     if (elementsAreRefTypes()) {
-        // FIXME: We should have a GCSafeMemfill.
-        for (size_t i = 0; i < size; i++)
-            set(vm, offset + i, value);
+        for (size_t i = 0; i < size; ++i)
+            setWithoutWriteBarrier(offset + i, value);
+        vm.writeBarrier(this);
         return;
     }
 
diff --git a/Source/JavaScriptCore/wasm/js/JSWebAssemblyArray.h b/Source/JavaScriptCore/wasm/js/JSWebAssemblyArray.h
index 172f8056b516..0e20af09f7ae 100644
--- a/Source/JavaScriptCore/wasm/js/JSWebAssemblyArray.h
+++ b/Source/JavaScriptCore/wasm/js/JSWebAssemblyArray.h
@@ -132,6 +132,7 @@ class JSWebAssemblyArray final : public WebAssemblyGCObjectBase {
 
 private:
     friend class LLIntOffsetsExtractor;
+    inline void setWithoutWriteBarrier(uint32_t index, uint64_t value);
     inline std::span<uint8_t> bytes();
 
     // NB: It's *HIGHLY* recommended that you don't use these directly since you'll have to remember to clean up the alignment for v128.
diff --git a/Source/JavaScriptCore/wasm/js/JSWebAssemblyArrayInlines.h b/Source/JavaScriptCore/wasm/js/JSWebAssemblyArrayInlines.h
index bc50a2469ba8..27e06128f567 100644
--- a/Source/JavaScriptCore/wasm/js/JSWebAssemblyArrayInlines.h
+++ b/Source/JavaScriptCore/wasm/js/JSWebAssemblyArrayInlines.h
@@ -142,15 +142,20 @@ v128_t JSWebAssemblyArray::getVector(uint32_t index)
     return span<v128_t>()[index];
 }
 
-void JSWebAssemblyArray::set(VM& vm, uint32_t index, uint64_t value)
+void JSWebAssemblyArray::setWithoutWriteBarrier(uint32_t index, uint64_t value)
 {
     visitSpanNonVector([&]<typename T>(std::span<T> span) ALWAYS_INLINE_LAMBDA {
         span[index] = static_cast<T>(value);
-        if (elementsAreRefTypes())
-            vm.writeBarrier(this);
     });
 }
 
+void JSWebAssemblyArray::set(VM& vm, uint32_t index, uint64_t value)
+{
+    setWithoutWriteBarrier(index, value);
+    if (elementsAreRefTypes())
+        vm.writeBarrier(this);
+}
+
 void JSWebAssemblyArray::set(VM&, uint32_t index, v128_t value)
 {
     ASSERT(elementType().type.as<Wasm::Type>().kind() == Wasm::TypeKind::V128);
diff --git a/Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.cpp b/Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.cpp
index a4591d7f54c9..2f3cf559ce37 100644
--- a/Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.cpp
+++ b/Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.cpp
@@ -136,6 +136,7 @@ JSWebAssemblyInstance::JSWebAssemblyInstance(VM& vm, Structure* structure, JSWeb
     }
 
     memset(reinterpret_cast<uint8_t*>(baselineDatas().data()), 0, baselineDatas().size_bytes());
+    zeroSpan(asMutableByteSpan(functionWrappers()));
     if (m_moduleInformation->hasGCObjectTypes()) {
         memset(reinterpret_cast<uint8_t*>(gcObjectStructureIDs().data()), 0, gcObjectStructureIDs().size_bytes());
         CompleteSubspace* subspace = JSWebAssemblyArray::subspaceFor<JSWebAssemblyArray, SubspaceAccess::OnMainThread>(vm);
@@ -222,9 +223,9 @@ void JSWebAssemblyInstance::visitChildrenImpl(JSCell* cell, Visitor& visitor)
             visitor.append(thisObject->gcObjectStructureID(i));
     }
 
-    Locker locker { cell->cellLock() };
     for (auto& wrapper : thisObject->functionWrappers())
-        visitor.appendUnbarriered(wrapper.get());
+        visitor.append(wrapper);
+    Locker locker { cell->cellLock() };
     for (auto& entry : thisObject->m_constantExpressionValues)
         visitor.append(entry.value);
     for (auto& entry : thisObject->m_tagWrappers)
@@ -308,9 +309,7 @@ Identifier JSWebAssemblyInstance::createPrivateModuleKey()
 
 size_t JSWebAssemblyInstance::allocationSize(const Wasm::ModuleInformation& info)
 {
-    if (info.hasGCObjectTypes())
-        return offsetOfAllocatorForGCObject(info, MarkedSpace::numSizeClasses);
-    return offsetOfBaselineData(info, info.internalFunctionCount());
+    return offsetOfFunctionWrapper(info, info.functionIndexSpaceSize());
 }
 
 
@@ -349,14 +348,33 @@ JSWebAssemblyInstance* JSWebAssemblyInstance::tryCreate(VM& vm, Structure* insta
             return exception(createTypeError(globalObject, "can't make WebAssembly.Instance because there is no imports Object and the WebAssembly.Module requires imports"_s));
     }
 
+    auto isReservedESMName = [](const Wasm::Name& name) {
+        return startsWith(name.span(), "wasm:"_s) || startsWith(name.span(), "wasm-js:"_s);
+    };
+
+    if (creationMode == CreationMode::FromModuleLoader) {
+        for (auto& exp : moduleInformation.exports) {
+            if (isReservedESMName(exp.field))
+                return exception(createJSWebAssemblyLinkError(globalObject, vm, makeString("Export name '"_s, makeString(exp.field), "' is reserved"_s)));
+        }
+    }
+
     // For each import i in module.imports:
     {
         IdentifierSet specifiers;
         for (auto& import : moduleInformation.imports) {
             auto moduleName = Identifier::fromString(vm, makeAtomString(import.module));
             auto fieldName = Identifier::fromString(vm, makeAtomString(import.field));
+            if (creationMode == CreationMode::FromModuleLoader) {
+                if (isReservedESMName(import.field))
+                    return exception(createJSWebAssemblyLinkError(globalObject, vm, makeString("Import name '"_s, StringView(fieldName.impl()), "' is reserved"_s)));
+                if (startsWith(import.module.span(), "wasm-js:"_s))
+                    return exception(createJSWebAssemblyLinkError(globalObject, vm, makeString("Import module '"_s, StringView(moduleName.impl()), "' is reserved"_s)));
+            }
+            bool skipRequestedModule = creationMode == CreationMode::FromModuleLoader
+                && (moduleInformation.importedStringConstantsEquals(import.module) || moduleInformation.builtinSetsInclude(import.module));
             auto result = specifiers.add(moduleName.impl());
-            if (result.isNewEntry)
+            if (result.isNewEntry && !skipRequestedModule)
                 moduleRecord->appendRequestedModule(moduleName, nullptr);
             moduleRecord->addImportEntry(WebAssemblyModuleRecord::ImportEntry {
                 WebAssemblyModuleRecord::ImportEntryType::Single,
@@ -445,18 +463,17 @@ void JSWebAssemblyInstance::setGlobal(unsigned i, JSValue value)
 
 JSValue JSWebAssemblyInstance::getFunctionWrapper(unsigned i) const
 {
-    JSValue value = m_functionWrappers.get(i).get();
-    if (value.isEmpty())
-        return jsNull();
-    return value;
+    ASSERT(i < functionWrappers().size());
+    JSValue value = functionWrappers()[i].get();
+    return value ? value : jsNull();
 }
 
 void JSWebAssemblyInstance::setFunctionWrapper(unsigned i, JSValue value)
 {
+    ASSERT(i < functionWrappers().size());
     ASSERT(value.isCallable());
-    ASSERT(!m_functionWrappers.contains(i));
-    Locker locker { cellLock() };
-    m_functionWrappers.set(i, WriteBarrier<Unknown>(vm(), this, value));
+    ASSERT(!functionWrappers()[i].get());
+    functionWrappers()[i].set(vm(), this, value);
     ASSERT(getFunctionWrapper(i) == value);
 }
 
diff --git a/Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.h b/Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.h
index 604bad2ebc1a..dcb05769d5e1 100644
--- a/Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.h
+++ b/Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.h
@@ -73,7 +73,7 @@ class BaselineData;
 }
 
 // The layout of a JSWebAssemblyInstance is
-//     { struct JSWebAssemblyInstance }[ WasmMemoryBaseAndSize ][ WasmOrJSImportableFunctionCallLinkInfo ][ Wasm::Table* ][ Global::Value ][ Wasm::BaselineData* ][ WebAssemblyGCStructure* ][ Allocator* ]
+//     { struct JSWebAssemblyInstance }[ WasmMemoryBaseAndSize ][ WasmOrJSImportableFunctionCallLinkInfo ][ Wasm::Table* ][ Global::Value ][ Wasm::BaselineData* ][ WebAssemblyGCStructure* ][ Allocator* ][ WriteBarrier<Unknown> function wrappers ]
 // in a compound TrailingArray-like format.
 class JSWebAssemblyInstance final : public JSNonFinalObject {
     friend class LLIntOffsetsExtractor;
@@ -182,8 +182,6 @@ class JSWebAssemblyInstance final : public JSNonFinalObject {
     static constexpr ptrdiff_t offsetOfVM() { return OBJECT_OFFSETOF(JSWebAssemblyInstance, m_vm); }
     static constexpr ptrdiff_t offsetOfModuleRecord() { return OBJECT_OFFSETOF(JSWebAssemblyInstance, m_moduleRecord); }
 
-    using FunctionWrapperMap = UncheckedKeyHashMap<uint32_t, WriteBarrier<Unknown>, IntHash<uint32_t>, WTF::UnsignedWithZeroKeyHashTraits<uint32_t>>;
-
     static constexpr ptrdiff_t offsetOfSoftStackLimit() { return OBJECT_OFFSETOF(JSWebAssemblyInstance, m_stackMirror) + StackManager::Mirror::offsetOfSoftStackLimit(); }
 
     Wasm::Module& module() const { return m_module.get(); }
@@ -308,7 +306,6 @@ class JSWebAssemblyInstance final : public JSNonFinalObject {
     const BitVector& globalsToMark() LIFETIME_BOUND { return m_globalsToMark; }
     const BitVector& globalsToBinding() LIFETIME_BOUND { return m_globalsToBinding; }
     JSValue getFunctionWrapper(unsigned) const;
-    typename FunctionWrapperMap::ValuesConstIteratorRange functionWrappers() const { return m_functionWrappers.values(); }
     void setFunctionWrapper(unsigned, JSValue);
     JSValue ensureFunctionWrapper(Wasm::FunctionSpaceIndex);
     void setBuiltinCalleeBits(uint32_t builtinID, CalleeBits calleeBits) { m_builtinCalleeBits[builtinID] = calleeBits; }
@@ -378,6 +375,14 @@ class JSWebAssemblyInstance final : public JSNonFinalObject {
         return roundUpToMultipleOf<alignof(Allocator)>(offsetOfGCObjectStructureID(info, info.typeCount())) + sizeof(Allocator) * index;
     }
 
+    static ptrdiff_t offsetOfFunctionWrapper(const Wasm::ModuleInformation& info, unsigned index)
+    {
+        ptrdiff_t base = info.hasGCObjectTypes()
+            ? offsetOfAllocatorForGCObject(info, MarkedSpace::numSizeClasses)
+            : offsetOfBaselineData(info, info.internalFunctionCount());
+        return roundUpToMultipleOf<alignof(WriteBarrier<Unknown>)>(base) + sizeof(WriteBarrier<Unknown>) * index;
+    }
+
     static size_t offsetOfTargetInstance(const Wasm::ModuleInformation& info, size_t importFunctionNum) { return offsetOfImportFunctionInfo(info, importFunctionNum) + OBJECT_OFFSETOF(Wasm::WasmOrJSImportableFunctionCallLinkInfo, targetInstance); }
     static size_t offsetOfEntrypointLoadLocation(const Wasm::ModuleInformation& info, size_t importFunctionNum) { return offsetOfImportFunctionInfo(info, importFunctionNum) + OBJECT_OFFSETOF(Wasm::WasmOrJSImportableFunctionCallLinkInfo, entrypointLoadLocation); }
     static size_t offsetOfBoxedCallee(const Wasm::ModuleInformation& info, size_t importFunctionNum) { return offsetOfImportFunctionInfo(info, importFunctionNum) + OBJECT_OFFSETOF(Wasm::WasmOrJSImportableFunctionCallLinkInfo, boxedCallee); }
@@ -420,6 +425,16 @@ class JSWebAssemblyInstance final : public JSNonFinalObject {
         return unsafeMakeSpan<Allocator, MarkedSpace::numSizeClasses>(std::bit_cast<Allocator*>(std::bit_cast<uint8_t*>(this) + offsetOfAllocatorForGCObject(m_moduleInformation, 0)), MarkedSpace::numSizeClasses);
     }
 
+    std::span<WriteBarrier<Unknown>> functionWrappers()
+    {
+        return std::span { std::bit_cast<WriteBarrier<Unknown>*>(std::bit_cast<uint8_t*>(this) + offsetOfFunctionWrapper(m_moduleInformation, 0)), m_moduleInformation->functionIndexSpaceSize() };
+    }
+
+    std::span<const WriteBarrier<Unknown>> functionWrappers() const
+    {
+        return std::span { std::bit_cast<const WriteBarrier<Unknown>*>(std::bit_cast<const uint8_t*>(this) + offsetOfFunctionWrapper(m_moduleInformation, 0)), m_moduleInformation->functionIndexSpaceSize() };
+    }
+
     unsigned numImportFunctions() const { return m_numImportFunctions; }
     WasmOrJSImportableFunctionCallLinkInfo* importFunctionInfo(size_t importFunctionNum)
     {
@@ -485,7 +500,6 @@ class JSWebAssemblyInstance final : public JSNonFinalObject {
 
     RefPtr<Wasm::Memory> m_wasmMemory;
     Wasm::Global::Value* m_globals { nullptr };
-    FunctionWrapperMap m_functionWrappers;
 
     using ConstantExpressionValueMap = UncheckedKeyHashMap<uint64_t, WriteBarrier<Unknown>, IntHash<uint64_t>, WTF::UnsignedWithZeroKeyHashTraits<uint64_t>>;
     ConstantExpressionValueMap m_constantExpressionValues;
diff --git a/Source/JavaScriptCore/wasm/js/WebAssemblyModuleConstructor.cpp b/Source/JavaScriptCore/wasm/js/WebAssemblyModuleConstructor.cpp
index 72f16569fe84..28f11fb4c159 100644
--- a/Source/JavaScriptCore/wasm/js/WebAssemblyModuleConstructor.cpp
+++ b/Source/JavaScriptCore/wasm/js/WebAssemblyModuleConstructor.cpp
@@ -46,6 +46,7 @@
 #include "WebAssemblyModulePrototype.h"
 #include <wtf/StdLibExtras.h>
 #include <wtf/text/MakeString.h>
+#include <wtf/text/StringCommon.h>
 
 namespace JSC {
 static JSC_DECLARE_HOST_FUNCTION(webAssemblyModuleCustomSections);
@@ -89,8 +90,7 @@ JSC_DEFINE_HOST_FUNCTION(webAssemblyModuleCustomSections, (JSGlobalObject* globa
 
     const auto& customSections = module->moduleInformation().customSections;
     for (const Wasm::CustomSection& section : customSections) {
-        // FIXME: Add a function that compares a String with a span<char8_t> so we don't need to make a string.
-        if (WTF::makeString(section.name) == sectionNameString) {
+        if (equal(sectionNameString, section.name.span())) {
             auto buffer = ArrayBuffer::tryCreate(section.payload.span());
             if (!buffer)
                 return JSValue::encode(throwException(globalObject, throwScope, createOutOfMemoryError(globalObject)));
diff --git a/Source/ThirdParty/libwebrtc/Configurations/libwebrtc.exp b/Source/ThirdParty/libwebrtc/Configurations/libwebrtc.exp
index 8b1c8e0f22e8..1abac82e44bb 100644
--- a/Source/ThirdParty/libwebrtc/Configurations/libwebrtc.exp
+++ b/Source/ThirdParty/libwebrtc/Configurations/libwebrtc.exp
@@ -1,6 +1,8 @@
+__ZN6webrtc10I010Buffer6CreateEii
 __ZN6webrtc10I420Buffer12MutableDataUEv
 __ZN6webrtc10I420Buffer12MutableDataVEv
 __ZN6webrtc10I420Buffer12MutableDataYEv
+__ZN6webrtc10I420Buffer6CreateEii
 __ZN6webrtc10I420Buffer6RotateERKNS_19I420BufferInterfaceENS_13VideoRotationE
 __ZN6webrtc10I420Buffer8SetBlackEPS0_
 __ZN6webrtc10VideoFrameD1Ev
@@ -426,3 +428,6 @@ __ZNK6webrtc18VideoFrameMetadata15GetDependenciesEv
 __ZNK6webrtc8RtpCodec9mime_typeEv
 __ZN6webrtc14SdpVideoFormatC1ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEERKNS_17CodecParameterMapE
 __ZN4absl19ThrowStdLengthErrorEPKc
+__ZN6webrtc10I010Buffer12MutableDataUEv
+__ZN6webrtc10I010Buffer12MutableDataVEv
+__ZN6webrtc10I010Buffer12MutableDataYEv
diff --git a/Source/ThirdParty/libwebrtc/Configurations/libwebrtc.xcconfig b/Source/ThirdParty/libwebrtc/Configurations/libwebrtc.xcconfig
index 364eae747465..417e25c009a7 100644
--- a/Source/ThirdParty/libwebrtc/Configurations/libwebrtc.xcconfig
+++ b/Source/ThirdParty/libwebrtc/Configurations/libwebrtc.xcconfig
@@ -90,6 +90,6 @@ OTHER_LDFLAGS = $(inherited) $(SOURCE_VERSION_LDFLAGS) $(WEBRTC_LDFLAGS_ENABLE_L
 
 // Allow fuzzers to link to libwebrtc.dylib.
 WEBRTC_ALLOWABLE_CLIENTS = $(WEBRTC_ALLOWABLE_CLIENTS_$(WK_NOT_$(ENABLE_LIBFUZZER)));
-WEBRTC_ALLOWABLE_CLIENTS_YES = -allowable_client WebCore -allowable_client WebCoreTestSupport -allowable_client WebKit;
+WEBRTC_ALLOWABLE_CLIENTS_YES = -allowable_client WebCore -allowable_client WebCoreTestSupport -allowable_client WebKit -allowable_client TestWebKitAPI;
 
 WARNING_CFLAGS = $(inherited) -Wno-nullability-completeness;
diff --git a/Source/ThirdParty/libwebrtc/Source/webrtc/webkit_sdk/WebKit/WebKitUtilities.mm b/Source/ThirdParty/libwebrtc/Source/webrtc/webkit_sdk/WebKit/WebKitUtilities.mm
index f5631db00b03..d5342a5ad11b 100644
--- a/Source/ThirdParty/libwebrtc/Source/webrtc/webkit_sdk/WebKit/WebKitUtilities.mm
+++ b/Source/ThirdParty/libwebrtc/Source/webrtc/webkit_sdk/WebKit/WebKitUtilities.mm
@@ -436,7 +436,7 @@ bool copyVideoFrameBuffer(VideoFrameBuffer& buffer, uint8_t* data)
         auto* i420Frame = buffer.GetI420();
         auto* dataY = data;
         auto strideY = i420Frame->width();
-        auto strideUV = i420Frame->width();
+        auto strideUV = i420Frame->width() & 1 ? i420Frame->width() + 1 : i420Frame->width();
         auto* dataUV = data + (i420Frame->width() * i420Frame->height());
         return !libyuv::I420ToNV12(i420Frame->DataY(), i420Frame->StrideY(),
                                    i420Frame->DataU(), i420Frame->StrideU(),
@@ -448,7 +448,7 @@ bool copyVideoFrameBuffer(VideoFrameBuffer& buffer, uint8_t* data)
         auto* i010Frame = buffer.GetI010();
         auto* dataY = reinterpret_cast<uint16_t*>(data);
         auto strideY = i010Frame->width();
-        auto strideUV = i010Frame->width();
+        auto strideUV = i010Frame->width() & 1 ? i010Frame->width() + 1 : i010Frame->width();
         auto* dataUV = dataY + (i010Frame->width() * i010Frame->height());
         return !libyuv::I010ToP010(i010Frame->DataY(), i010Frame->StrideY(),
                                    i010Frame->DataU(), i010Frame->StrideU(),
diff --git a/Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml b/Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml
index 679c0a30ed5c..fbe0592acd6d 100644
--- a/Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml
+++ b/Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml
@@ -10364,18 +10364,18 @@ WebExtensionBookmarksEnabled:
 
 WebExtensionOffscreenEnabled:
   type: bool
-  status: testable
+  status: stable
   category: extensions
   humanReadableName: "WebExtension Offscreen API"
   humanReadableDescription: "Enable support for WebExtensions using the Offscreen API"
   condition: ENABLE(WK_WEB_EXTENSIONS_OFFSCREEN)
   defaultValue:
     WebKitLegacy:
-      default: false
+      default: true
     WebKit:
-      default: false
+      default: true
     WebCore:
-      default: false
+      default: true
 
 WebExtensionSidebarEnabled:
   type: bool
diff --git a/Source/WTF/wtf/CMakeLists.txt b/Source/WTF/wtf/CMakeLists.txt
index 239a26355298..d21bf31baf81 100644
--- a/Source/WTF/wtf/CMakeLists.txt
+++ b/Source/WTF/wtf/CMakeLists.txt
@@ -803,6 +803,7 @@ elseif (APPLE)
 elseif (CMAKE_SYSTEM_NAME MATCHES "Linux")
     list(APPEND WTF_PUBLIC_HEADERS
         linux/CurrentProcessMemoryStatus.h
+        linux/HighPriorityThreads.h
         linux/ProcessMemoryFootprint.h
     )
 endif ()
diff --git a/Source/WTF/wtf/NeverDestroyed.h b/Source/WTF/wtf/NeverDestroyed.h
index 974eee494e3c..f6cbe8eb9fb2 100644
--- a/Source/WTF/wtf/NeverDestroyed.h
+++ b/Source/WTF/wtf/NeverDestroyed.h
@@ -72,13 +72,13 @@ template<typename T, typename AccessTraits> class NeverDestroyed {
     template<typename... Args> NeverDestroyed(Args&&... args)
     {
         AccessTraits::assertAccess();
-        MaybeRelax<T>(new (storagePointer()) T(std::forward<Args>(args)...));
+        new (storagePointer()) T(std::forward<Args>(args)...);
     }
 
     NeverDestroyed(NeverDestroyed&& other)
     {
         AccessTraits::assertAccess();
-        MaybeRelax<T>(new (storagePointer()) T(WTF::move(*other.storagePointer())));
+        new (storagePointer()) T(WTF::move(*other.storagePointer()));
     }
 
     operator T&() { return *storagePointer(); }
@@ -100,13 +100,6 @@ template<typename T, typename AccessTraits> class NeverDestroyed {
         return const_cast<PointerType>(m_storage.get());
     }
 
-    template<typename PtrType, bool ShouldRelax = std::is_base_of<RefCountedBase, PtrType>::value> struct MaybeRelax {
-        explicit MaybeRelax(PtrType*) { }
-    };
-    template<typename PtrType> struct MaybeRelax<PtrType, true> {
-        explicit MaybeRelax(PtrType* ptr) { ptr->relaxAdoptionRequirement(); }
-    };
-
     // FIXME: Investigate whether we should allocate a hunk of virtual memory
     // and hand out chunks of it to NeverDestroyed instead, to reduce fragmentation.
     AlignedStorage<T> m_storage;
@@ -135,7 +128,7 @@ template<typename T, typename AccessTraits> class LazyNeverDestroyed {
 #if ASSERT_ENABLED
         m_isConstructed = true;
 #endif
-        MaybeRelax<T>(new (storagePointerWithoutAccessCheck()) T(std::forward<Args>(args)...));
+        new (storagePointerWithoutAccessCheck()) T(std::forward<Args>(args)...);
     }
 
     operator T&() { return *storagePointer(); }
@@ -167,13 +160,6 @@ template<typename T, typename AccessTraits> class LazyNeverDestroyed {
         return storagePointerWithoutAccessCheck();
     }
 
-    template<typename PtrType, bool ShouldRelax = std::is_base_of<RefCountedBase, PtrType>::value> struct MaybeRelax {
-        explicit MaybeRelax(PtrType*) { }
-    };
-    template<typename PtrType> struct MaybeRelax<PtrType, true> {
-        explicit MaybeRelax(PtrType* ptr) { ptr->relaxAdoptionRequirement(); }
-    };
-
 #if ASSERT_ENABLED
     // LazyNeverDestroyed objects are always static, so this variable is initialized to false.
     // It must not be initialized dynamically; that would not be thread safe.
diff --git a/Source/WTF/wtf/PlatformEnableCocoa.h b/Source/WTF/wtf/PlatformEnableCocoa.h
index 4d71a85c4cff..972895c156e8 100644
--- a/Source/WTF/wtf/PlatformEnableCocoa.h
+++ b/Source/WTF/wtf/PlatformEnableCocoa.h
@@ -1087,7 +1087,7 @@
 #endif
 
 #if !defined(ENABLE_WK_WEB_EXTENSIONS_OFFSCREEN)
-#define ENABLE_WK_WEB_EXTENSIONS_OFFSCREEN 0 && ENABLE_WK_WEB_EXTENSIONS
+#define ENABLE_WK_WEB_EXTENSIONS_OFFSCREEN ENABLE_WK_WEB_EXTENSIONS
 #endif
 
 #if !defined(ENABLE_WK_WEB_EXTENSIONS_BOOKMARKS)
diff --git a/Source/WTF/wtf/Ref.h b/Source/WTF/wtf/Ref.h
index 4af39c1cd381..3d2555e1e5c2 100644
--- a/Source/WTF/wtf/Ref.h
+++ b/Source/WTF/wtf/Ref.h
@@ -43,8 +43,6 @@ extern "C" int __asan_address_is_poisoned(void const volatile *addr);
 
 namespace WTF {
 
-inline void adopted(const void*) { }
-
 template<typename T> struct DefaultRefDerefTraits {
     static constexpr bool isDefaultImplementation = true;
 
@@ -353,7 +351,6 @@ struct IsSmartPtr<Ref<T, _PtrTraits, RefDerefTraits>> {
 template<typename T, typename _PtrTraits, typename RefDerefTraits>
 inline Ref<T, _PtrTraits, RefDerefTraits> adoptRef(T& reference)
 {
-    adopted(&reference);
     return Ref<T, _PtrTraits, RefDerefTraits>(reference, Ref<T, _PtrTraits, RefDerefTraits>::Adopt);
 }
 
diff --git a/Source/WTF/wtf/RefCountDebugger.h b/Source/WTF/wtf/RefCountDebugger.h
index 5361ef3086a3..7462deffbd8f 100644
--- a/Source/WTF/wtf/RefCountDebugger.h
+++ b/Source/WTF/wtf/RefCountDebugger.h
@@ -63,7 +63,6 @@ class RefCountDebuggerImpl : public RefCountDebuggerBase {
     ~RefCountDebuggerImpl()
     {
         ASSERT(m_deletionHasBegun);
-        ASSERT(!m_adoptionIsRequired);
     }
 #else
     ~RefCountDebuggerImpl() = default;
@@ -73,25 +72,6 @@ class RefCountDebuggerImpl : public RefCountDebuggerBase {
     {
         applyRefDerefThreadingCheck(refCount);
         applyRefDuringDestructionCheck();
-
-#if CHECK_REF_COUNTED_LIFECYCLE
-        ASSERT(!m_adoptionIsRequired);
-#endif
-    }
-
-    void adopted()
-    {
-#if CHECK_REF_COUNTED_LIFECYCLE
-        m_adoptionIsRequired = false;
-#endif
-    }
-
-    void relaxAdoptionRequirement()
-    {
-#if CHECK_REF_COUNTED_LIFECYCLE
-        ASSERT(m_adoptionIsRequired);
-        m_adoptionIsRequired = false;
-#endif
     }
 
     // Unsafe precondition: The caller must ensure thread-safe access to this object,
@@ -155,10 +135,6 @@ class RefCountDebuggerImpl : public RefCountDebuggerBase {
     {
         applyRefDerefThreadingCheck(refCount);
 
-#if CHECK_REF_COUNTED_LIFECYCLE
-        ASSERT(!m_adoptionIsRequired);
-#endif
-
         ASSERT(refCount);
     }
 
@@ -185,7 +161,6 @@ class RefCountDebuggerImpl : public RefCountDebuggerBase {
 #endif
 #if CHECK_REF_COUNTED_LIFECYCLE
     mutable std::atomic<bool> m_deletionHasBegun { false };
-    mutable bool m_adoptionIsRequired { true };
 #endif
 };
 
diff --git a/Source/WTF/wtf/RefCounted.h b/Source/WTF/wtf/RefCounted.h
index 1633fa28e661..d5463a57c549 100644
--- a/Source/WTF/wtf/RefCounted.h
+++ b/Source/WTF/wtf/RefCounted.h
@@ -39,8 +39,6 @@ class RefCountedBase {
     uint32_t refCount() const { return m_refCount; }
 
     // Debug APIs
-    void adopted() { m_refCountDebugger.adopted(); }
-    void relaxAdoptionRequirement() { m_refCountDebugger.relaxAdoptionRequirement(); }
     void disableThreadingChecks() { m_refCountDebugger.disableThreadingChecks(); }
     RefCountDebugger& refCountDebugger() LIFETIME_BOUND { return m_refCountDebugger; }
 
@@ -88,13 +86,6 @@ template<typename T> class RefCounted : public RefCountedBase {
     ~RefCounted() = default;
 } SWIFT_RETURNED_AS_UNRETAINED_BY_DEFAULT;
 
-inline void adopted(RefCountedBase* object)
-{
-    if (!object)
-        return;
-    object->adopted();
-}
-
 } // namespace WTF
 
 using WTF::RefCounted;
diff --git a/Source/WTF/wtf/RefCountedWithInlineWeakPtr.h b/Source/WTF/wtf/RefCountedWithInlineWeakPtr.h
index 8d14e42792d1..e35ff79d8886 100644
--- a/Source/WTF/wtf/RefCountedWithInlineWeakPtr.h
+++ b/Source/WTF/wtf/RefCountedWithInlineWeakPtr.h
@@ -193,16 +193,6 @@ template<typename T> class RefCountedWithInlineWeakPtr {
     RefCountHeader& header() const { return refCountHeader(object()); }
 } SWIFT_RETURNED_AS_UNRETAINED_BY_DEFAULT;
 
-template<typename U>
-    requires requires { typename U::RefCountedType; }
-inline void adopted(U* object)
-{
-    if (!object)
-        return;
-    using T = typename U::RefCountedType;
-    refCountHeader(static_cast<const T*>(object)).refCountDebugger().adopted();
-}
-
 template<typename U, typename... Args>
 Ref<U> createRefCountedWithInlineWeakPtr(Args&&... args)
 {
diff --git a/Source/WTF/wtf/RefPtr.h b/Source/WTF/wtf/RefPtr.h
index 8523fbeab63c..33316d112f6d 100644
--- a/Source/WTF/wtf/RefPtr.h
+++ b/Source/WTF/wtf/RefPtr.h
@@ -265,7 +265,6 @@ inline bool operator==(const RefPtr<T, U, V>& a, X* b)
 template<typename T, typename U, typename V>
 inline RefPtr<T, U, V> adoptRef(T* p)
 {
-    adopted(p);
     return RefPtr<T, U, V>(p, RefPtr<T, U, V>::Adopt);
 }
 
diff --git a/Source/WTF/wtf/ThreadSafeRefCounted.h b/Source/WTF/wtf/ThreadSafeRefCounted.h
index 71e7c4573e07..9426a1b4ea1a 100644
--- a/Source/WTF/wtf/ThreadSafeRefCounted.h
+++ b/Source/WTF/wtf/ThreadSafeRefCounted.h
@@ -48,18 +48,11 @@ class WTF_EMPTY_BASE_CLASS ThreadSafeRefCountedBase {
     uint32_t refCount() const { return m_refCount.load(std::memory_order_relaxed); }
 
     // Debug APIs
-    void adopted() { m_refCountDebugger.adopted(); }
-    void relaxAdoptionRequirement() { m_refCountDebugger.relaxAdoptionRequirement(); }
     void disableThreadingChecks() { m_refCountDebugger.disableThreadingChecks(); }
     ThreadSafeRefCountDebugger& refCountDebugger() LIFETIME_BOUND { return m_refCountDebugger; }
 
 protected:
-    ThreadSafeRefCountedBase()
-    {
-        // FIXME: Lots of subclasses violate our adoption requirements. Migrate
-        // this call into only those subclasses that need it.
-        m_refCountDebugger.relaxAdoptionRequirement();
-    }
+    ThreadSafeRefCountedBase() = default;
 
     ~ThreadSafeRefCountedBase()
     {
@@ -114,13 +107,6 @@ template<class T, DestructionThread destructionThread = DestructionThread::Any>
     ~ThreadSafeRefCounted() = default;
 } SWIFT_RETURNED_AS_UNRETAINED_BY_DEFAULT;
 
-inline void adopted(ThreadSafeRefCountedBase* object)
-{
-    if (!object)
-        return;
-    object->adopted();
-}
-
 } // namespace WTF
 
 using WTF::ThreadSafeRefCounted;
diff --git a/Source/WTF/wtf/ThreadSafeRefCountedWithSuppressingSaferCPPChecking.h b/Source/WTF/wtf/ThreadSafeRefCountedWithSuppressingSaferCPPChecking.h
index e8a34cc5381f..95fd440d778f 100644
--- a/Source/WTF/wtf/ThreadSafeRefCountedWithSuppressingSaferCPPChecking.h
+++ b/Source/WTF/wtf/ThreadSafeRefCountedWithSuppressingSaferCPPChecking.h
@@ -50,18 +50,11 @@ class WTF_EMPTY_BASE_CLASS ThreadSafeRefCountedWithSuppressingSaferCPPCheckingBa
     uint32_t refCount() const { return m_refCount.load(std::memory_order_relaxed); }
 
     // Debug APIs
-    void adopted() { m_refCountDebugger.adopted(); }
-    void relaxAdoptionRequirement() { m_refCountDebugger.relaxAdoptionRequirement(); }
     void disableThreadingChecks() { m_refCountDebugger.disableThreadingChecks(); }
     ThreadSafeRefCountDebugger& refCountDebugger() LIFETIME_BOUND { return m_refCountDebugger; }
 
 protected:
-    ThreadSafeRefCountedWithSuppressingSaferCPPCheckingBase()
-    {
-        // FIXME: Lots of subclasses violate our adoption requirements. Migrate
-        // this call into only those subclasses that need it.
-        m_refCountDebugger.relaxAdoptionRequirement();
-    }
+    ThreadSafeRefCountedWithSuppressingSaferCPPCheckingBase() = default;
 
     ~ThreadSafeRefCountedWithSuppressingSaferCPPCheckingBase()
     {
@@ -114,13 +107,6 @@ template<class T, DestructionThread destructionThread = DestructionThread::Any>
     }
 } SWIFT_RETURNED_AS_UNRETAINED_BY_DEFAULT;
 
-inline void adopted(ThreadSafeRefCountedWithSuppressingSaferCPPCheckingBase* object)
-{
-    if (!object)
-        return;
-    object->adopted();
-}
-
 } // namespace WTF
 
 using WTF::ThreadSafeRefCountedWithSuppressingSaferCPPChecking;
diff --git a/Source/WTF/wtf/ThreadSafeWeakPtr.h b/Source/WTF/wtf/ThreadSafeWeakPtr.h
index a97c97c2fdb3..b31935fd0348 100644
--- a/Source/WTF/wtf/ThreadSafeWeakPtr.h
+++ b/Source/WTF/wtf/ThreadSafeWeakPtr.h
@@ -52,7 +52,8 @@ class ThreadSafeWeakPtrControlBlock {
         return this;
     }
 
-    void weakDeref()
+    // Deleting ThreadSafeWeakPtrControlBlock does not delete a user object.
+    SUPPRESS_NODELETE void NODELETE weakDeref()
     {
         bool shouldDeleteControlBlock { false };
         {
@@ -394,7 +395,8 @@ class ThreadSafeRefCountedAndCanMakeThreadSafeWeakPtr {
 
 protected:
     ThreadSafeRefCountedAndCanMakeThreadSafeWeakPtr() = default;
-    ThreadSafeWeakPtrControlBlock& controlBlock() const
+    // Creating & destroying ThreadSafeWeakPtrControlBlock does not delete an user object.
+    SUPPRESS_NODELETE ThreadSafeWeakPtrControlBlock& NODELETE controlBlock() const
     {
         // If we ever decided there was a lot of contention here we could have some lock bits in m_bits but
         // that seems unlikely since this is a one-way street. Once we add a controlBlock we don't go back
diff --git a/Source/WTF/wtf/UniquelyOwnedPtr.h b/Source/WTF/wtf/UniquelyOwnedPtr.h
index b4fcf6f82300..d224ffecd12f 100644
--- a/Source/WTF/wtf/UniquelyOwnedPtr.h
+++ b/Source/WTF/wtf/UniquelyOwnedPtr.h
@@ -43,7 +43,6 @@ UniquelyOwnedPtr<U> makeUniquelyOwned(Args&&... args)
 {
     using T = typename U::RefCountedType;
     auto* object = RefCountedWithInlineWeakPtr<T>::template create<U>(std::forward<Args>(args)...);
-    adopted(object);
     return UniquelyOwnedPtr<U>(object);
 }
 
diff --git a/Source/WTF/wtf/cocoa/WorkQueueCocoa.cpp b/Source/WTF/wtf/cocoa/WorkQueueCocoa.cpp
index 2c08b5a44558..486e46022034 100644
--- a/Source/WTF/wtf/cocoa/WorkQueueCocoa.cpp
+++ b/Source/WTF/wtf/cocoa/WorkQueueCocoa.cpp
@@ -82,7 +82,7 @@ WorkQueueBase::WorkQueueBase(OSObjectPtr<dispatch_queue_t>&& dispatchQueue)
 
 void WorkQueueBase::platformInitialize(ASCIILiteral name, Type type, QOS qos)
 {
-    dispatch_queue_attr_t attr = type == Type::Concurrent ? DISPATCH_QUEUE_CONCURRENT : DISPATCH_QUEUE_SERIAL;
+    dispatch_queue_attr_t attr = type == Type::Concurrent ? concurrentQueueWithAutoreleasePoolAttrSingleton() : serialQueueWithAutoreleasePoolAttrSingleton();
     attr = dispatch_queue_attr_make_with_qos_class(attr, Thread::dispatchQOSClass(qos), 0);
     // FIXME: This is a false positive. rdar://160931336
     SUPPRESS_RETAINPTR_CTOR_ADOPT lazyInitialize(m_dispatchQueue, adoptOSObject(dispatch_queue_create(name, attr)));
diff --git a/Source/WTF/wtf/darwin/DispatchExtras.h b/Source/WTF/wtf/darwin/DispatchExtras.h
index dfac7c6d6671..07f4e7e2aa29 100644
--- a/Source/WTF/wtf/darwin/DispatchExtras.h
+++ b/Source/WTF/wtf/darwin/DispatchExtras.h
@@ -39,7 +39,19 @@ inline dispatch_queue_main_t mainDispatchQueueSingleton()
     return dispatch_get_main_queue(); // NOLINT
 }
 
+inline dispatch_queue_attr_t serialQueueWithAutoreleasePoolAttrSingleton()
+{
+    return DISPATCH_QUEUE_SERIAL_WITH_AUTORELEASE_POOL; // NOLINT
+}
+
+inline dispatch_queue_attr_t concurrentQueueWithAutoreleasePoolAttrSingleton()
+{
+    return DISPATCH_QUEUE_CONCURRENT_WITH_AUTORELEASE_POOL; // NOLINT
+}
+
 } // namespace WTF
 
+using WTF::concurrentQueueWithAutoreleasePoolAttrSingleton;
 using WTF::globalDispatchQueueSingleton;
 using WTF::mainDispatchQueueSingleton;
+using WTF::serialQueueWithAutoreleasePoolAttrSingleton;
diff --git a/Source/WTF/wtf/glib/SocketConnection.cpp b/Source/WTF/wtf/glib/SocketConnection.cpp
index dc3e7091b8d2..345b6668096c 100644
--- a/Source/WTF/wtf/glib/SocketConnection.cpp
+++ b/Source/WTF/wtf/glib/SocketConnection.cpp
@@ -39,8 +39,6 @@ SocketConnection::SocketConnection(GRefPtr<GSocketConnection>&& connection, cons
     , m_messageHandlers(messageHandlers)
     , m_userData(userData)
 {
-    relaxAdoptionRequirement();
-
     m_readBuffer.reserveInitialCapacity(defaultBufferSize);
     m_writeBuffer.reserveInitialCapacity(defaultBufferSize);
 
diff --git a/Source/WTF/wtf/linux/HighPriorityThreads.cpp b/Source/WTF/wtf/linux/HighPriorityThreads.cpp
index fecd6728781a..d529d2f0d2c2 100644
--- a/Source/WTF/wtf/linux/HighPriorityThreads.cpp
+++ b/Source/WTF/wtf/linux/HighPriorityThreads.cpp
@@ -42,7 +42,7 @@
 namespace WTF {
 
 // Requested nice value. rtkit clamps this to its own MinNiceLevel.
-static constexpr int s_highPriorityNiceLevel = -20;
+[[maybe_unused]] static constexpr int s_highPriorityNiceLevel = -20;
 
 HighPriorityThreads& HighPriorityThreads::singleton()
 {
diff --git a/Source/WebCore/Headers.cmake b/Source/WebCore/Headers.cmake
index c698f21f331c..98b48cc1450d 100644
--- a/Source/WebCore/Headers.cmake
+++ b/Source/WebCore/Headers.cmake
@@ -2026,6 +2026,7 @@ set(WebCore_PRIVATE_FRAMEWORK_HEADERS
     page/FrameConsoleClient.h
     page/FrameDestructionObserver.h
     page/FrameDestructionObserverInlines.h
+    page/FrameGeometrySyncData.h
     page/FrameIdentifier.h
     page/FrameInlines.h
     page/FrameSnapshotting.h
@@ -2081,7 +2082,6 @@ set(WebCore_PRIVATE_FRAMEWORK_HEADERS
     page/PrewarmInformation.h
     page/PrintContext.h
     page/ProcessWarming.h
-    page/QuirkMatch.h
     page/QuirkNames.h
     page/QuirkTable.h
     page/Quirks.h
@@ -2117,6 +2117,7 @@ set(WebCore_PRIVATE_FRAMEWORK_HEADERS
     page/TextAnimationTypes.h
     page/TextDirectionSubmenuInclusionBehavior.h
     page/TextIndicator.h
+    page/URLMatch.h
     page/TranslationContextMenuInfo.h
     page/UADataValues.h
     page/UALowEntropyJSON.h
@@ -2684,6 +2685,7 @@ set(WebCore_PRIVATE_FRAMEWORK_HEADERS
     platform/graphics/PlatformTextTrack.h
     platform/graphics/PlatformTimeRanges.h
     platform/graphics/PlatformTrackConfiguration.h
+    platform/graphics/PlatformVideoChromaLocation.h
     platform/graphics/PlatformVideoColorPrimaries.h
     platform/graphics/PlatformVideoColorSpace.h
     platform/graphics/PlatformVideoMatrixCoefficients.h
@@ -3438,6 +3440,7 @@ set(WebCore_PRIVATE_FRAMEWORK_HEADERS
     style/values/overflow/StyleOverflowClipMargin.h
     style/values/overflow/StyleScrollBehavior.h
     style/values/overflow/StyleScrollbarGutter.h
+    style/values/overflow/StyleTextOverflow.h
 
     style/values/page/StylePageSize.h
 
diff --git a/Source/WebCore/Modules/mediastream/MediaStreamTrack.cpp b/Source/WebCore/Modules/mediastream/MediaStreamTrack.cpp
index f91bb78204d5..cd9a3d954e42 100644
--- a/Source/WebCore/Modules/mediastream/MediaStreamTrack.cpp
+++ b/Source/WebCore/Modules/mediastream/MediaStreamTrack.cpp
@@ -93,7 +93,6 @@ MediaStreamTrack::MediaStreamTrack(ScriptExecutionContext& context, Ref<MediaStr
     , m_muted(m_private->muted())
     , m_isCaptureTrack(is<Document>(context) && m_private->isCaptureTrack())
 {
-    relaxAdoptionRequirement();
     ALWAYS_LOG(LOGIDENTIFIER);
 
     m_private->addObserver(*this);
diff --git a/Source/WebCore/Modules/mediastream/RTCPeerConnection.cpp b/Source/WebCore/Modules/mediastream/RTCPeerConnection.cpp
index 0d1b18518e85..aba3bb1ea99f 100644
--- a/Source/WebCore/Modules/mediastream/RTCPeerConnection.cpp
+++ b/Source/WebCore/Modules/mediastream/RTCPeerConnection.cpp
@@ -130,7 +130,6 @@ RTCPeerConnection::RTCPeerConnection(Document& document)
 #endif
 {
     ALWAYS_LOG(LOGIDENTIFIER);
-    relaxAdoptionRequirement();
 }
 
 RTCPeerConnection::~RTCPeerConnection()
diff --git a/Source/WebCore/Modules/notifications/NotificationResourcesLoader.cpp b/Source/WebCore/Modules/notifications/NotificationResourcesLoader.cpp
index c56a75a99c5d..1d02de7ffe61 100644
--- a/Source/WebCore/Modules/notifications/NotificationResourcesLoader.cpp
+++ b/Source/WebCore/Modules/notifications/NotificationResourcesLoader.cpp
@@ -139,8 +139,6 @@ auto NotificationResourcesLoader::ResourceLoader::create(ScriptExecutionContext&
 NotificationResourcesLoader::ResourceLoader::ResourceLoader(ScriptExecutionContext& context, const URL& url, CompletionHandler<void(ResourceLoader*, RefPtr<BitmapImage>&&)>&& completionHandler)
     : m_completionHandler(WTF::move(completionHandler))
 {
-    relaxAdoptionRequirement();
-
     ThreadableLoaderOptions options;
     options.mode = FetchOptions::Mode::Cors;
     options.sendLoadCallbacks = SendCallbackPolicy::SendCallbacks;
diff --git a/Source/WebCore/Modules/webcodecs/WebCodecsVideoFrame.cpp b/Source/WebCore/Modules/webcodecs/WebCodecsVideoFrame.cpp
index a635371e5dc0..eaec35155b48 100644
--- a/Source/WebCore/Modules/webcodecs/WebCodecsVideoFrame.cpp
+++ b/Source/WebCore/Modules/webcodecs/WebCodecsVideoFrame.cpp
@@ -263,7 +263,7 @@ ExceptionOr<Ref<WebCodecsVideoFrame>> WebCodecsVideoFrame::create(ScriptExecutio
     if (!pixelBuffer)
         return Exception { ExceptionCode::InvalidStateError,  "Buffer has no frame"_s };
 
-    auto videoFrame = VideoFrame::createFromPixelBuffer(pixelBuffer.releaseNonNull(), { PlatformVideoColorPrimaries::Bt709, PlatformVideoTransferCharacteristics::Iec6196621, PlatformVideoMatrixCoefficients::Rgb, true });
+    auto videoFrame = VideoFrame::createFromPixelBuffer(pixelBuffer.releaseNonNull(), { .primaries = PlatformVideoColorPrimaries::Bt709, .transfer = PlatformVideoTransferCharacteristics::Iec6196621, .matrix = PlatformVideoMatrixCoefficients::Rgb, .fullRange = true });
 
     if (!videoFrame)
         return Exception { ExceptionCode::InvalidStateError,  "Unable to create frame from buffer"_s };
diff --git a/Source/WebCore/Modules/webcodecs/WebCodecsVideoFrameAlgorithms.cpp b/Source/WebCore/Modules/webcodecs/WebCodecsVideoFrameAlgorithms.cpp
index 0b5ec95978d9..9fe8c2da7324 100644
--- a/Source/WebCore/Modules/webcodecs/WebCodecsVideoFrameAlgorithms.cpp
+++ b/Source/WebCore/Modules/webcodecs/WebCodecsVideoFrameAlgorithms.cpp
@@ -268,9 +268,9 @@ VideoColorSpaceInit videoFramePickColorSpace(const std::optional<VideoColorSpace
         return *overrideColorSpace;
 
     if (isRGBVideoPixelFormat(format))
-        return { PlatformVideoColorPrimaries::Bt709, PlatformVideoTransferCharacteristics::Iec6196621, PlatformVideoMatrixCoefficients::Rgb, true };
+        return { .primaries = PlatformVideoColorPrimaries::Bt709, .transfer = PlatformVideoTransferCharacteristics::Iec6196621, .matrix = PlatformVideoMatrixCoefficients::Rgb, .fullRange = true };
 
-    return { PlatformVideoColorPrimaries::Bt709, PlatformVideoTransferCharacteristics::Bt709, PlatformVideoMatrixCoefficients::Bt709, false };
+    return { .primaries = PlatformVideoColorPrimaries::Bt709, .transfer = PlatformVideoTransferCharacteristics::Bt709, .matrix = PlatformVideoMatrixCoefficients::Bt709, .fullRange = false };
 }
 
 // https://w3c.github.io/webcodecs/#validate-videoframeinit
diff --git a/Source/WebCore/SaferCPPExpectations/UncheckedLocalVarsCheckerExpectations b/Source/WebCore/SaferCPPExpectations/UncheckedLocalVarsCheckerExpectations
index 624acb4d0c82..55899d6a4328 100644
--- a/Source/WebCore/SaferCPPExpectations/UncheckedLocalVarsCheckerExpectations
+++ b/Source/WebCore/SaferCPPExpectations/UncheckedLocalVarsCheckerExpectations
@@ -10,7 +10,6 @@ dom/Position.cpp
 editing/Editing.cpp
 [ iOS ] editing/cocoa/EditorCocoa.mm
 [ macOS ] html/HTMLMediaElement.cpp
-html/canvas/CanvasRenderingContext2DBase.cpp
 inspector/InspectorOverlay.cpp
 inspector/agents/InspectorDOMAgent.cpp
 layout/formattingContexts/FormattingGeometry.cpp
diff --git a/Source/WebCore/SaferCPPExpectations/UncountedCallArgsCheckerExpectations b/Source/WebCore/SaferCPPExpectations/UncountedCallArgsCheckerExpectations
index 70f94954e0b9..35075eb1103f 100644
--- a/Source/WebCore/SaferCPPExpectations/UncountedCallArgsCheckerExpectations
+++ b/Source/WebCore/SaferCPPExpectations/UncountedCallArgsCheckerExpectations
@@ -201,19 +201,14 @@ inspector/agents/InspectorCPUProfilerAgent.cpp
 inspector/agents/InspectorCSSAgent.cpp
 inspector/agents/InspectorCanvasAgent.cpp
 inspector/agents/InspectorDOMAgent.cpp
-inspector/agents/InspectorDOMDebuggerAgent.cpp
 inspector/agents/InspectorDOMStorageAgent.cpp
-inspector/agents/InspectorLayerTreeAgent.cpp
 inspector/agents/InspectorMemoryAgent.cpp
 inspector/agents/InspectorNetworkAgent.cpp
 inspector/agents/InspectorPageAgent.cpp
-inspector/agents/InspectorTimelineAgent.cpp
-inspector/agents/InspectorWorkerAgent.cpp
 inspector/agents/page/PageConsoleAgent.cpp
 inspector/agents/page/PageNetworkAgent.cpp
 inspector/agents/page/PageRuntimeAgent.cpp
 inspector/agents/worker/ServiceWorkerAgent.cpp
-inspector/agents/worker/WorkerRuntimeAgent.cpp
 loader/ApplicationManifestLoader.cpp
 loader/DocumentLoader.cpp
 loader/FrameLoader.cpp
diff --git a/Source/WebCore/Sources.txt b/Source/WebCore/Sources.txt
index 1638a7ceee11..696a7bde7b54 100644
--- a/Source/WebCore/Sources.txt
+++ b/Source/WebCore/Sources.txt
@@ -2290,6 +2290,7 @@ page/FocusController.cpp
 page/Frame.cpp
 page/FrameConsoleClient.cpp
 page/FrameDestructionObserver.cpp
+page/FrameGeometrySyncData.cpp
 page/FrameIdentifier.cpp
 page/FrameSnapshotting.cpp @header:RenderStyleGetters @cost:6
 page/FrameTree.cpp
@@ -2356,7 +2357,6 @@ page/PointerCaptureController.cpp
 page/PointerLockController.cpp
 page/PrintContext.cpp @header:RenderStyleGetters @cost:7
 page/ProcessWarming.cpp
-page/QuirkMatch.cpp
 page/QuirkTable.cpp
 page/Quirks.cpp @header:RenderStyleGetters @cost:11
 page/RemoteDOMWindow.cpp
@@ -2381,6 +2381,7 @@ page/ShadowRealmGlobalScope.cpp
 page/ShareDataReader.cpp
 page/SpatialNavigation.cpp @header:RenderStyleGetters @cost:6
 page/TextIndicator.cpp @header:RenderStyleGetters @cost:6
+page/URLMatch.cpp
 page/UndoItem.cpp
 page/UndoManager.cpp
 page/UserContentController.cpp
@@ -3529,6 +3530,7 @@ style/values/non-standard/StyleWebKitTouchCallout.cpp
 style/values/outline/StyleOutlineOffset.cpp @header:RenderStyleGetters
 style/values/overflow/StyleBlockEllipsis.cpp
 style/values/overflow/StyleScrollbarGutter.cpp
+style/values/overflow/StyleTextOverflow.cpp
 style/values/overflow/StyleOverflowClipMargin.cpp
 style/values/page/StylePageSize.cpp
 style/values/pointerevents/StyleTouchAction.cpp
diff --git a/Source/WebCore/WebCore.xcodeproj/project.pbxproj b/Source/WebCore/WebCore.xcodeproj/project.pbxproj
index 7887cffc508b..f4dc68aff4dd 100644
--- a/Source/WebCore/WebCore.xcodeproj/project.pbxproj
+++ b/Source/WebCore/WebCore.xcodeproj/project.pbxproj
@@ -411,6 +411,7 @@
 		0F099D0917B968A100FF84B9 /* WebCoreTypedArrayController.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F099D0717B968A100FF84B9 /* WebCoreTypedArrayController.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F0E009C26F92D8400ACE9C6 /* ScrollAnimationMomentum.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F0E009A26F92D7B00ACE9C6 /* ScrollAnimationMomentum.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F11781822E3C47F008BD570 /* FrameIdentifier.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F11781622E3C47E008BD570 /* FrameIdentifier.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		81ED7B1F003A5A7768139C21 /* FrameGeometrySyncData.h in Headers */ = {isa = PBXBuildFile; fileRef = 26B3A704C67CF84C8688D269 /* FrameGeometrySyncData.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F11A54F0F39233100C37884 /* RenderSelectionGeometry.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F11A54E0F39233100C37884 /* RenderSelectionGeometry.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F13163E16ED0CC80035CC04 /* PlatformCAFilters.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F13163D16ED0CC80035CC04 /* PlatformCAFilters.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F1774801378B772009DA76A /* ScrollAnimatorIOS.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F17747E1378B771009DA76A /* ScrollAnimatorIOS.h */; };
@@ -3163,7 +3164,7 @@
 		05D4770CFFB4C18C6BA6928C /* QuirkTable.h in Headers */ = {isa = PBXBuildFile; fileRef = 05D4770BFFB4C18C6BA6928C /* QuirkTable.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		7ABB0F622CE7C170009A837F /* QuirkNames.h in Headers */ = {isa = PBXBuildFile; fileRef = 7ABB0F5D2CE7C170009A837F /* QuirkNames.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		7ABB0F602CE7C170009A837D /* QuirksData.h in Headers */ = {isa = PBXBuildFile; fileRef = 7ABB0F5F2CE7C170009A837D /* QuirksData.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		05D47708FFB4C18C6BA6928A /* QuirkMatch.h in Headers */ = {isa = PBXBuildFile; fileRef = 05D47707FFB4C18C6BA6928A /* QuirkMatch.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		05D47708FFB4C18C6BA6928A /* URLMatch.h in Headers */ = {isa = PBXBuildFile; fileRef = 05D47707FFB4C18C6BA6928A /* URLMatch.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		7AC09F4728C0122C004568FC /* TestReportBody.h in Headers */ = {isa = PBXBuildFile; fileRef = 7AC09F4528C00E5D004568FC /* TestReportBody.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		7AD41E7E2C7607AF00ED9467 /* ScrollingPlatformLayer.h in Headers */ = {isa = PBXBuildFile; fileRef = 7AD41E7D2C7607AA00ED9467 /* ScrollingPlatformLayer.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		7ADE722610CBBB9B006B3B3A /* ContextMenuProvider.h in Headers */ = {isa = PBXBuildFile; fileRef = 7ADE722510CBBB9B006B3B3A /* ContextMenuProvider.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -5937,6 +5938,7 @@
 		CD1A22672B080A5C0038923E /* AV1UtilitiesCocoa.mm in Sources */ = {isa = PBXBuildFile; fileRef = CD1A225C2B075A6D0038923E /* AV1UtilitiesCocoa.mm */; };
 		CD1A9315297EFFF40080AF3B /* JSDOMPromiseDeferredForward.h in Headers */ = {isa = PBXBuildFile; fileRef = CD1A9314297EFFF40080AF3B /* JSDOMPromiseDeferredForward.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		CD1DE17C2E69036D0097B710 /* IDBActiveDOMObjectInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = CD1DE17B2E6903600097B710 /* IDBActiveDOMObjectInlines.h */; };
+		4A7C1E0B2D0000010012AB02 /* PlatformVideoChromaLocation.h in Headers */ = {isa = PBXBuildFile; fileRef = 4A7C1E0A2D0000010012AB01 /* PlatformVideoChromaLocation.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		CD1F9B01270020B700617EB6 /* PlatformVideoColorSpace.h in Headers */ = {isa = PBXBuildFile; fileRef = CD1F9AFA26FD385900617EB6 /* PlatformVideoColorSpace.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		CD1F9B022700323D00617EB6 /* PlatformVideoColorPrimaries.h in Headers */ = {isa = PBXBuildFile; fileRef = CD1F9AFB26FD38C900617EB6 /* PlatformVideoColorPrimaries.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		CD1F9B032700323D00617EB6 /* PlatformVideoMatrixCoefficients.h in Headers */ = {isa = PBXBuildFile; fileRef = CD1F9AFD26FD38CB00617EB6 /* PlatformVideoMatrixCoefficients.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -6322,6 +6324,7 @@
 		DDB04F3A278E5539008D3678 /* libWTF.a in Product Dependencies */ = {isa = PBXBuildFile; fileRef = DDB04F39278E5531008D3678 /* libWTF.a */; };
 		DDBF8DAF2AB51FC100B3318A /* RubyFormattingContext.h in Headers */ = {isa = PBXBuildFile; fileRef = DDBF8DAE2AB51FC100B3318A /* RubyFormattingContext.h */; };
 		DDCF765D2C7F85E2005DDAFF /* StyleBlockEllipsis.h in Headers */ = {isa = PBXBuildFile; fileRef = DDCF765C2C7F85E2005DDAFF /* StyleBlockEllipsis.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		17B4998B9CB9379F392A38E0 /* StyleTextOverflow.h in Headers */ = {isa = PBXBuildFile; fileRef = AA570E42DB220D6821FE7A82 /* StyleTextOverflow.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		DDD517EC2A9FC5440069AF81 /* LineLayoutResult.h in Headers */ = {isa = PBXBuildFile; fileRef = DDD517EB2A9FC5440069AF81 /* LineLayoutResult.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		DDD5F55C2C703DFC00E1C692 /* TextBoxTrimmer.h in Headers */ = {isa = PBXBuildFile; fileRef = DDD5F55B2C703DFC00E1C692 /* TextBoxTrimmer.h */; };
 		DDDFE83E2846ECE2006F1EE5 /* cocoa in Copy PDF.js Extras */ = {isa = PBXBuildFile; fileRef = DDDFE83B2846ECD3006F1EE5 /* cocoa */; };
@@ -8384,6 +8387,8 @@
 		0F0E009A26F92D7B00ACE9C6 /* ScrollAnimationMomentum.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = ScrollAnimationMomentum.h; sourceTree = "<group>"; };
 		0F0E009B26F92D7B00ACE9C6 /* ScrollAnimationMomentum.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = ScrollAnimationMomentum.cpp; sourceTree = "<group>"; };
 		0F11781622E3C47E008BD570 /* FrameIdentifier.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FrameIdentifier.h; sourceTree = "<group>"; };
+		26B3A704C67CF84C8688D269 /* FrameGeometrySyncData.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = FrameGeometrySyncData.h; sourceTree = "<group>"; };
+		3D9194F39EFB04C0917E9354 /* FrameGeometrySyncData.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = FrameGeometrySyncData.cpp; sourceTree = "<group>"; };
 		0F11A54E0F39233100C37884 /* RenderSelectionGeometry.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderSelectionGeometry.h; sourceTree = "<group>"; };
 		0F13163D16ED0CC80035CC04 /* PlatformCAFilters.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PlatformCAFilters.h; sourceTree = "<group>"; };
 		0F13163F16ED0CDE0035CC04 /* PlatformCAFiltersCocoa.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = PlatformCAFiltersCocoa.mm; sourceTree = "<group>"; };
@@ -14992,10 +14997,10 @@
 		7ABA250E28B40370005D4F6D /* ReportingClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ReportingClient.h; sourceTree = "<group>"; };
 		7ABB0F5D2CE7C170009A837F /* QuirkNames.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = QuirkNames.h; sourceTree = "<group>"; };
 		7ABB0F5F2CE7C170009A837D /* QuirksData.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = QuirksData.h; sourceTree = "<group>"; };
-		05D47709FFB4C18C6BA6928A /* QuirkMatch.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = QuirkMatch.cpp; sourceTree = "<group>"; };
+		05D47709FFB4C18C6BA6928A /* URLMatch.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = URLMatch.cpp; sourceTree = "<group>"; };
 		05D4770AFFB4C18C6BA6928B /* QuirkTable.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = QuirkTable.cpp; sourceTree = "<group>"; };
 		05D4770BFFB4C18C6BA6928C /* QuirkTable.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = QuirkTable.h; sourceTree = "<group>"; };
-		05D47707FFB4C18C6BA6928A /* QuirkMatch.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = QuirkMatch.h; sourceTree = "<group>"; };
+		05D47707FFB4C18C6BA6928A /* URLMatch.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = URLMatch.h; sourceTree = "<group>"; };
 		7ABF02D621D7EBA2AFFD021A /* UnifiedSource35-header-RenderStyleGetters.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = "UnifiedSource35-header-RenderStyleGetters.cpp"; sourceTree = "<group>"; };
 		7AC09F3628BFD45B004568FC /* JSReportBody.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSReportBody.h; sourceTree = "<group>"; };
 		7AC09F3728BFD45B004568FC /* JSReportBody.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSReportBody.cpp; sourceTree = "<group>"; };
@@ -15020,6 +15025,7 @@
 		7AEAD8AD290289C9008B5675 /* ScrollingTreeOverflowScrollProxyNode.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScrollingTreeOverflowScrollProxyNode.cpp; sourceTree = "<group>"; };
 		7AEAD8AE290289E1008B5675 /* ScrollingTreeOverflowScrollProxyNode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScrollingTreeOverflowScrollProxyNode.h; sourceTree = "<group>"; };
 		7AEFEA122D52A89D007B21AC /* DocumentEnums.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = DocumentEnums.h; sourceTree = "<group>"; };
+		7AF0423D303F4F8F006FB27D /* Cookie.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = Cookie.cpp; sourceTree = "<group>"; };
 		7AF9B1FC18CFB2DF00C64BEF /* VTTRegion.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = VTTRegion.cpp; sourceTree = "<group>"; };
 		7AF9B1FD18CFB2DF00C64BEF /* VTTRegion.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = VTTRegion.h; sourceTree = "<group>"; };
 		7AF9B1FE18CFB2DF00C64BEF /* VTTRegion.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = VTTRegion.idl; sourceTree = "<group>"; };
@@ -20226,6 +20232,7 @@
 		BC95FC0C2C838E9C00051FAE /* CSSPropertyParserConsumer+Filter.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = "CSSPropertyParserConsumer+Filter.h"; sourceTree = "<group>"; };
 		BC95FC0D2C838E9C00051FAE /* CSSPropertyParserConsumer+Filter.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = "CSSPropertyParserConsumer+Filter.cpp"; sourceTree = "<group>"; };
 		BC966B372E274F790028A7AF /* StyleBlockEllipsis.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = StyleBlockEllipsis.cpp; sourceTree = "<group>"; };
+		2481C500948CA9B768D48AC0 /* StyleTextOverflow.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = StyleTextOverflow.cpp; sourceTree = "<group>"; };
 		BC966B402E280AA30028A7AF /* StyleCounterStyle.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = StyleCounterStyle.h; sourceTree = "<group>"; };
 		BC96DB420F3A880E00573CB3 /* RenderBoxModelObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderBoxModelObject.h; sourceTree = "<group>"; };
 		BC96DB450F3A882200573CB3 /* RenderBoxModelObject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderBoxModelObject.cpp; sourceTree = "<group>"; };
@@ -21198,6 +21205,7 @@
 		CD1F9AF526FD215600617EB6 /* VideoColorSpace.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = VideoColorSpace.h; sourceTree = "<group>"; };
 		CD1F9AF726FD2CAD00617EB6 /* VideoTransferCharacteristics.idl */ = {isa = PBXFileReference; lastKnownFileType = text; path = VideoTransferCharacteristics.idl; sourceTree = "<group>"; };
 		CD1F9AF826FD2CAD00617EB6 /* VideoTransferCharacteristics.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = VideoTransferCharacteristics.h; sourceTree = "<group>"; };
+		4A7C1E0A2D0000010012AB01 /* PlatformVideoChromaLocation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PlatformVideoChromaLocation.h; sourceTree = "<group>"; };
 		CD1F9AFA26FD385900617EB6 /* PlatformVideoColorSpace.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = PlatformVideoColorSpace.h; sourceTree = "<group>"; };
 		CD1F9AFB26FD38C900617EB6 /* PlatformVideoColorPrimaries.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PlatformVideoColorPrimaries.h; sourceTree = "<group>"; };
 		CD1F9AFC26FD38CA00617EB6 /* PlatformVideoTransferCharacteristics.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PlatformVideoTransferCharacteristics.h; sourceTree = "<group>"; };
@@ -21973,6 +21981,7 @@
 		DDBF8DAE2AB51FC100B3318A /* RubyFormattingContext.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RubyFormattingContext.h; sourceTree = "<group>"; };
 		DDBF8DB02AB51FD100B3318A /* RubyFormattingContext.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = RubyFormattingContext.cpp; sourceTree = "<group>"; };
 		DDCF765C2C7F85E2005DDAFF /* StyleBlockEllipsis.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = StyleBlockEllipsis.h; sourceTree = "<group>"; };
+		AA570E42DB220D6821FE7A82 /* StyleTextOverflow.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = StyleTextOverflow.h; sourceTree = "<group>"; };
 		DDD517EB2A9FC5440069AF81 /* LineLayoutResult.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LineLayoutResult.h; sourceTree = "<group>"; };
 		DDD5F55A2C703DF200E1C692 /* TextBoxTrimmer.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = TextBoxTrimmer.cpp; sourceTree = "<group>"; };
 		DDD5F55B2C703DFC00E1C692 /* TextBoxTrimmer.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = TextBoxTrimmer.h; sourceTree = "<group>"; };
@@ -31006,6 +31015,7 @@
 				E43AF8E41AC5B7DD00CA717E /* CacheValidation.cpp */,
 				E43AF8E51AC5B7DD00CA717E /* CacheValidation.h */,
 				91B8F0B321953D65000C2B00 /* CertificateSummary.h */,
+				7AF0423D303F4F8F006FB27D /* Cookie.cpp */,
 				7A56996E2086C618000E0433 /* CookieRequestHeaderFieldProxy.h */,
 				E13F01EA1270E10D00DFBA71 /* CookieStorage.h */,
 				514C76590CE923A1007EF3CD /* Credential.h */,
@@ -31294,6 +31304,8 @@
 				974A862014B7ADBB003FDC76 /* FrameDestructionObserver.cpp */,
 				974A862114B7ADBB003FDC76 /* FrameDestructionObserver.h */,
 				46014ACB28333F52004C0B84 /* FrameDestructionObserverInlines.h */,
+				3D9194F39EFB04C0917E9354 /* FrameGeometrySyncData.cpp */,
+				26B3A704C67CF84C8688D269 /* FrameGeometrySyncData.h */,
 				FA63420E2D9CB95B00A6BECE /* FrameIdentifier.cpp */,
 				0F11781622E3C47E008BD570 /* FrameIdentifier.h */,
 				9B46C04A2DC4A867002E22C4 /* FrameInlines.h */,
@@ -31525,8 +31537,6 @@
 				B776D43A1104525D00BEB0EC /* PrintContext.h */,
 				E42050162141901B0066EF3B /* ProcessWarming.cpp */,
 				E42050142141901A0066EF3B /* ProcessWarming.h */,
-				05D47709FFB4C18C6BA6928A /* QuirkMatch.cpp */,
-				05D47707FFB4C18C6BA6928A /* QuirkMatch.h */,
 				7ABB0F5D2CE7C170009A837F /* QuirkNames.h */,
 				CD9A87F9215D6CF3006F17B5 /* Quirks.cpp */,
 				CD9A87FB215D6CF3006F17B5 /* Quirks.h */,
@@ -31630,6 +31640,8 @@
 				2ECDBACF21D8903400F00ECD /* UndoManager.cpp */,
 				2ECDBACE21D8903400F00ECD /* UndoManager.h */,
 				2ECDBAD021D8903400F00ECD /* UndoManager.idl */,
+				05D47709FFB4C18C6BA6928A /* URLMatch.cpp */,
+				05D47707FFB4C18C6BA6928A /* URLMatch.h */,
 				D6F1F4B32E42AAA200FAB161 /* UserAgentStringData.h */,
 				D61496E22E428EEE00BAF335 /* UserAgentStringParser.cpp */,
 				D61496E12E428EDB00BAF335 /* UserAgentStringParser.h */,
@@ -37138,6 +37150,7 @@
 				074E82B818A69F0E007EF54C /* PlatformTimeRanges.cpp */,
 				074E82B918A69F0E007EF54C /* PlatformTimeRanges.h */,
 				CDD08ABC277E542600EA3755 /* PlatformTrackConfiguration.h */,
+				4A7C1E0A2D0000010012AB01 /* PlatformVideoChromaLocation.h */,
 				CD1F9AFB26FD38C900617EB6 /* PlatformVideoColorPrimaries.h */,
 				7BCBCD982EF559D0005B0ACE /* PlatformVideoColorSpace.cpp */,
 				CD1F9AFA26FD385900617EB6 /* PlatformVideoColorSpace.h */,
@@ -38607,6 +38620,8 @@
 				A39F8E222A1ECC1E00967C09 /* StyleScrollbarGutter.cpp */,
 				A39F8E212A1ECBFC00967C09 /* StyleScrollbarGutter.h */,
 				BC0929A82E2AA1D6002ACB2C /* StyleScrollBehavior.h */,
+				2481C500948CA9B768D48AC0 /* StyleTextOverflow.cpp */,
+				AA570E42DB220D6821FE7A82 /* StyleTextOverflow.h */,
 			);
 			path = overflow;
 			sourceTree = "<group>";
@@ -45836,6 +45851,7 @@
 				46014ACC28333F65004C0B84 /* FrameDestructionObserverInlines.h in Headers */,
 				5E3DD8092F903C9A00250DF5 /* FrameDOMAgent.h in Headers */,
 				5E3DD80C2F903C9A00250DF5 /* FrameDOMStorageAgent.h in Headers */,
+				81ED7B1F003A5A7768139C21 /* FrameGeometrySyncData.h in Headers */,
 				0F11781822E3C47F008BD570 /* FrameIdentifier.h in Headers */,
 				9B46C04B2DC4A867002E22C4 /* FrameInlines.h in Headers */,
 				F30EE46B2E721BA800935B60 /* FrameInspectorController.h in Headers */,
@@ -48146,6 +48162,7 @@
 				0F7D07331884C56C00B4AF86 /* PlatformTextTrack.h in Headers */,
 				074E82BB18A69F0E007EF54C /* PlatformTimeRanges.h in Headers */,
 				CDD08ABD277E542600EA3755 /* PlatformTrackConfiguration.h in Headers */,
+				4A7C1E0B2D0000010012AB02 /* PlatformVideoChromaLocation.h in Headers */,
 				CD1F9B022700323D00617EB6 /* PlatformVideoColorPrimaries.h in Headers */,
 				CD1F9B01270020B700617EB6 /* PlatformVideoColorSpace.h in Headers */,
 				CD1F9B032700323D00617EB6 /* PlatformVideoMatrixCoefficients.h in Headers */,
@@ -48279,7 +48296,6 @@
 				A70B77D62A9EE40B003D8566 /* Quaternion.h in Headers */,
 				CD20ED3C27878FFB0038BE44 /* QueuedVideoOutput.h in Headers */,
 				A15E31F41E0CB0B5004B371C /* QuickLook.h in Headers */,
-				05D47708FFB4C18C6BA6928A /* QuirkMatch.h in Headers */,
 				7ABB0F622CE7C170009A837F /* QuirkNames.h in Headers */,
 				9BAEE92C22388A7D004157A9 /* Quirks.h in Headers */,
 				7ABB0F602CE7C170009A837D /* QuirksData.h in Headers */,
@@ -49425,6 +49441,7 @@
 				BC6120262ECA437D00904592 /* StyleTextEmphasisPosition.h in Headers */,
 				BCD9EFED2E18E5A000D1C3DF /* StyleTextEmphasisStyle.h in Headers */,
 				BCD9EFEB2E18E58600D1C3DF /* StyleTextIndent.h in Headers */,
+				17B4998B9CB9379F392A38E0 /* StyleTextOverflow.h in Headers */,
 				BC3CC22E2DE8D2D50032971C /* StyleTextShadow.h in Headers */,
 				BC09298A2E29F25B002ACB2C /* StyleTextSizeAdjust.h in Headers */,
 				BC4631102EA310B600EA911F /* StyleTextSpacingTrim.h in Headers */,
@@ -49906,6 +49923,7 @@
 				267726051A5DF6F2003C24DD /* URLFilterParser.h in Headers */,
 				F55B3DDE1251F12D003EF269 /* URLInputType.h in Headers */,
 				4674BE5128C9A5B800A6C831 /* URLKeepingBlobAlive.h in Headers */,
+				05D47708FFB4C18C6BA6928A /* URLMatch.h in Headers */,
 				900C20842CAF8232002C79C5 /* URLPattern.h in Headers */,
 				90E1B6D22CB9A7E300CADF80 /* URLPatternCanonical.h in Headers */,
 				90E0A16F2CDEE2CF0074377B /* URLPatternComponent.h in Headers */,
diff --git a/Source/WebCore/accessibility/AXTextMarker.cpp b/Source/WebCore/accessibility/AXTextMarker.cpp
index 77f1c59e1133..c428099e016a 100644
--- a/Source/WebCore/accessibility/AXTextMarker.cpp
+++ b/Source/WebCore/accessibility/AXTextMarker.cpp
@@ -829,21 +829,53 @@ static bool hasEmptyFinalLine(AXIsolatedObject& object, const AXTextRuns& textRu
     return previousRuns->toStringView().endsWith('\n');
 }
 
-// |lineRange| ending where the text control's value ends, rather than where its rendered text does.
-// A line that ends with the collapsed trailing newline is one character longer than the line of the
-// value it stands for, and for the empty final line that newline is the whole range. Marker walks are
-// left the unclamped range, so that empty final line remains enumerable as a line of its own.
-static AXTextMarkerRange lineRangeWithoutCollapsedTrailingNewline(const AXTextMarkerRange& lineRange)
+enum class LineRangeTrim : uint8_t {
+    // A text control's value ends before the newline its rendered text ends with.
+    // This option allows explicit trimming of this collapsed newline.
+    CollapsedTrailingNewline = 1 << 0,
+    // The text runs keep the space a line soft-wrapped at, appended to the wrapping line's run, so a
+    // range spanning the wrap reads "foo bar" rather than "foobar". This space renders on no line, so
+    // no line ends with it. This option denotes it should be trimmed.
+    SoftWrapSpace = 1 << 1,
+};
+
+static AXTextMarkerRange lineRangeWithout(const AXTextMarkerRange& lineRange, OptionSet<LineRangeTrim> trims)
 {
     auto endMarker = lineRange.end().toTextRunMarker();
     RefPtr endObject = endMarker.isolatedObject();
-    if (!endObject)
+    const auto* runs = endObject ? endObject->textRuns() : nullptr;
+    if (!runs)
         return lineRange;
 
-    auto indexOfCollapsedNewline = offsetOfCollapsedTrailingNewline(*endObject, endObject->textRuns());
-    if (!indexOfCollapsedNewline || endMarker.offset() <= *indexOfCollapsedNewline)
+    unsigned endOffset = endMarker.offset();
+    if (trims.contains(LineRangeTrim::CollapsedTrailingNewline)) {
+        std::optional offsetOfNewline = offsetOfCollapsedTrailingNewline(*endObject, runs);
+        if (offsetOfNewline && endOffset > *offsetOfNewline)
+            endOffset = *offsetOfNewline;
+    }
+
+    if (trims.contains(LineRangeTrim::SoftWrapSpace)) {
+        // Only a line that ended where this object wrapped has a wrap space, as its end
+        // sits at the end of a run that another follows.
+        //
+        // For example, in this text where _ is a wrap-space and | is the text position:
+        // aaa_|
+        // bbb
+        // We want to trim the space after "aaa" if this option is set.
+        size_t runIndex = runs->indexForOffset(endOffset, Affinity::Upstream);
+        bool endsWhereObjectWrapped = runIndex != notFound && runIndex != runs->lastRunIndex() && runs->runLengthSumTo(runIndex) == endOffset;
+        if (endsWhereObjectWrapped && endOffset && runs->toStringView()[endOffset - 1] == space)
+            --endOffset;
+    }
+
+    if (endOffset == endMarker.offset())
+        return lineRange;
+
+    if (lineRange.start().objectID() == endMarker.objectID() && lineRange.start().offset() > endOffset) {
+        // Trimming the range would move the end before the start, so early-exit.
         return lineRange;
-    return { lineRange.start(), AXTextMarker { *endObject, *indexOfCollapsedNewline } };
+    }
+    return { lineRange.start(), AXTextMarker { *endObject, endOffset } };
 }
 
 // Advances |lineRange| to the following line: the range from the start of the next line through
@@ -898,7 +930,7 @@ CharacterRange AXTextMarker::characterRangeForLine(unsigned lineIndex) const
     // the preceding line's range), which is why only block-separated lines were affected.
     unsigned precedingLength = AXTextMarkerRange { textRunMarker, currentLineRange.start() }.length();
 
-    return CharacterRange(precedingLength, lineRangeWithoutCollapsedTrailingNewline(currentLineRange).length());
+    return CharacterRange(precedingLength, lineRangeWithout(currentLineRange, LineRangeTrim::CollapsedTrailingNewline).length());
 }
 
 AXTextMarkerRange AXTextMarker::markerRangeForLineIndex(unsigned lineIndex) const
@@ -916,7 +948,7 @@ AXTextMarkerRange AXTextMarker::markerRangeForLineIndex(unsigned lineIndex) cons
         currentLineRange = nextLineRange(currentLineRange, IncludeTrailingLineBreak::No, std::nullopt);
         --lineIndex;
     }
-    return lineRangeWithoutCollapsedTrailingNewline(currentLineRange);
+    return lineRangeWithout(currentLineRange, { LineRangeTrim::CollapsedTrailingNewline, LineRangeTrim::SoftWrapSpace });
 }
 
 int AXTextMarker::lineNumberForIndex(unsigned index) const
@@ -938,7 +970,7 @@ int AXTextMarker::lineNumberForIndex(unsigned index) const
     unsigned lineNumber = 0;
     auto currentLineRange = textRunMarker.lineRange(LineRangeType::Current, IncludeTrailingLineBreak::Yes);
     while (currentLineRange) {
-        unsigned lineLength = lineRangeWithoutCollapsedTrailingNewline(currentLineRange).length();
+        unsigned lineLength = lineRangeWithout(currentLineRange, LineRangeTrim::CollapsedTrailingNewline).length();
         auto nextRange = nextLineRange(currentLineRange, IncludeTrailingLineBreak::Yes, stopAtID);
         // A line occupies the index space up to the start of the next line, which is not the same as
         // the length of its own range: the newline synthesized at a block boundary belongs to no
@@ -1788,7 +1820,7 @@ AXTextMarkerRange AXTextMarker::lineRange(LineRangeType type, IncludeTrailingLin
     if (type == LineRangeType::Current) {
         auto startMarker = atLineStart() ? *this : previousLineStart();
         auto endMarker = atLineEnd() ? *this : nextLineEnd(includeTrailingLineBreak);
-        return lineRangeWithoutCollapsedTrailingNewline({ startMarker, endMarker });
+        return lineRangeWithout({ startMarker, endMarker }, LineRangeTrim::CollapsedTrailingNewline);
     }
 
     if (type == LineRangeType::Left) {
@@ -1798,7 +1830,7 @@ AXTextMarkerRange AXTextMarker::lineRange(LineRangeType type, IncludeTrailingLin
             startMarker = startMarker.previousLineStart();
 
         auto endMarker = startMarker.nextLineEnd(includeTrailingLineBreak);
-        return lineRangeWithoutCollapsedTrailingNewline({ WTF::move(startMarker), WTF::move(endMarker) });
+        return lineRangeWithout({ WTF::move(startMarker), WTF::move(endMarker) }, LineRangeTrim::CollapsedTrailingNewline);
     }
 
     AX_ASSERT(type == LineRangeType::Right);
@@ -1809,7 +1841,7 @@ AXTextMarkerRange AXTextMarker::lineRange(LineRangeType type, IncludeTrailingLin
         startMarker = startMarker.previousLineStart();
 
     auto endMarker = startMarker.nextLineEnd(includeTrailingLineBreak);
-    return lineRangeWithoutCollapsedTrailingNewline({ WTF::move(startMarker), WTF::move(endMarker) });
+    return lineRangeWithout({ WTF::move(startMarker), WTF::move(endMarker) }, LineRangeTrim::CollapsedTrailingNewline);
 }
 
 AXTextMarkerRange AXTextMarker::wordRange(WordRangeType type) const
diff --git a/Source/WebCore/accessibility/AccessibilityMenuList.cpp b/Source/WebCore/accessibility/AccessibilityMenuList.cpp
index 82058fa189df..7de9e2acacab 100644
--- a/Source/WebCore/accessibility/AccessibilityMenuList.cpp
+++ b/Source/WebCore/accessibility/AccessibilityMenuList.cpp
@@ -48,8 +48,6 @@ AccessibilityMenuList::AccessibilityMenuList(AXID axID, RenderObject& renderer,
 Ref<AccessibilityMenuList> AccessibilityMenuList::create(AXID axID, RenderObject& renderer, AXObjectCache& cache)
 {
     Ref menuList = adoptRef(*new AccessibilityMenuList(axID, renderer, cache));
-    // We have to do this setup here and not in the constructor to avoid an
-    // adoptionIsRequired ASSERT in RefCounted.h.
     menuList->m_popup->setParent(menuList.ptr());
     menuList->addChild(menuList->m_popup.get());
     menuList->m_childrenInitialized = true;
diff --git a/Source/WebCore/accessibility/AccessibilityNodeObject.cpp b/Source/WebCore/accessibility/AccessibilityNodeObject.cpp
index 2993967e00fb..9c32c1a1ab28 100644
--- a/Source/WebCore/accessibility/AccessibilityNodeObject.cpp
+++ b/Source/WebCore/accessibility/AccessibilityNodeObject.cpp
@@ -1107,15 +1107,6 @@ static bool NODELETE isFlowContent(Node& node)
     return text && !text->data().containsOnly<isASCIIWhitespace>();
 }
 
-bool AccessibilityNodeObject::isNativeTextControl() const
-{
-    if (is<HTMLTextAreaElement>(node()))
-        return true;
-
-    auto* input = dynamicDowncast<HTMLInputElement>(node());
-    return input && (input->isText() || input->isNumberField());
-}
-
 bool AccessibilityNodeObject::isSearchField() const
 {
     RefPtr node = this->node();
@@ -4135,9 +4126,9 @@ String AccessibilityNodeObject::text() const
     if (!isTextControl())
         return { };
 
+    if (RefPtr textControl = nativeTextControl())
+        return textControl->value();
     RefPtr element = dynamicDowncast<Element>(node());
-    if (RefPtr formControl = dynamicDowncast<HTMLTextFormControlElement>(element); formControl && isNativeTextControl())
-        return formControl->value();
     return element ? element->innerText() : String();
 }
 
diff --git a/Source/WebCore/accessibility/AccessibilityNodeObject.h b/Source/WebCore/accessibility/AccessibilityNodeObject.h
index d43f643c8b3e..1319864b2d88 100644
--- a/Source/WebCore/accessibility/AccessibilityNodeObject.h
+++ b/Source/WebCore/accessibility/AccessibilityNodeObject.h
@@ -65,7 +65,6 @@ class AccessibilityNodeObject : public AccessibilityObject {
     bool isDescriptionList() const final;
     bool isMultiSelectable() const override;
     bool NODELETE isNativeImage() const;
-    bool isNativeTextControl() const final;
     bool isSecureField() const final;
     bool isSearchField() const final;
 
diff --git a/Source/WebCore/accessibility/AccessibilityObject.cpp b/Source/WebCore/accessibility/AccessibilityObject.cpp
index 628258691d90..6d31596a9f8d 100644
--- a/Source/WebCore/accessibility/AccessibilityObject.cpp
+++ b/Source/WebCore/accessibility/AccessibilityObject.cpp
@@ -68,6 +68,7 @@
 #include "FrameSelection.h"
 #include "GeometryUtilities.h"
 #include "HTMLAreaElement.h"
+#include "HTMLBRElement.h"
 #include "HTMLBodyElement.h"
 #include "HTMLDataListElement.h"
 #include "HTMLDetailsElement.h"
@@ -945,6 +946,38 @@ std::optional<SimpleRange> AccessibilityObject::simpleRange() const
     return AXObjectCache::rangeForNodeContents(*node);
 }
 
+HTMLTextFormControlElement* AccessibilityObject::nativeTextControl() const
+{
+    if (auto* textArea = dynamicDowncast<HTMLTextAreaElement>(node()))
+        return textArea;
+
+    auto* input = dynamicDowncast<HTMLInputElement>(node());
+    return input && (input->isText() || input->isNumberField()) ? input : nullptr;
+}
+
+AXTextMarkerRange AccessibilityObject::textMarkerRange() const
+{
+    // A native text control's value lives in its shadow inner text element, so the host has no
+    // children whose contents to take: simpleRange covers the control as a single replaced object,
+    // which stringifies to an object replacement character rather than the value.
+    if (RefPtr textControl = nativeTextControl()) {
+        if (RefPtr innerText = textControl->innerTextElement()) {
+            auto range = AXObjectCache::rangeForNodeContents(*innerText);
+            // A value ending in a line break renders an empty final line, which
+            // HTMLTextFormControlElement::setInnerTextValue gives a line box by appending a
+            // placeholder <br>. That <br>'s newline is collapsed out by rendering and is not a
+            // character of the value, so leave it out.
+            if (is<HTMLBRElement>(innerText->lastChild()) && range.end.offset)
+                --range.end.offset;
+            // A control with no value has no text to point at, so leave it pointing at itself,
+            // which is the only marker its callers can place in the document.
+            if (range.start != range.end)
+                return AXTextMarkerRange { std::optional { range } };
+        }
+    }
+    return simpleRange();
+}
+
 Vector<BoundaryPoint> AccessibilityObject::previousLineStartBoundaryPoints(const VisiblePosition& startingPosition, const SimpleRange& targetRange, unsigned positionsToRetrieve) const
 {
     Vector<BoundaryPoint> boundaryPoints;
@@ -2928,7 +2961,19 @@ bool AccessibilityObject::replaceTextInRange(const String& replacementString, co
     // Also only do this when the field is in editing mode.
     Ref frame = renderer()->frame();
     if (element->shouldUseInputMethod()) {
-        frame->selection().setSelectedRange(rangeForCharacterRange(range), Affinity::Downstream, FrameSelection::ShouldCloseTyping::Yes);
+        uint64_t textLength = getLengthForTextRange();
+        uint64_t startIndex = std::min(range.location, textLength);
+        uint64_t endIndex = startIndex + std::min(range.length, textLength - startIndex);
+
+        auto start = visiblePositionForIndex(static_cast<int>(startIndex));
+        std::optional insertionRange = makeSimpleRange(start, endIndex == startIndex ? start : visiblePositionForIndex(static_cast<int>(endIndex)));
+        if (!insertionRange)
+            return false;
+
+        // Fail if the selection can't be set, otherwise the wrong text would be replaced.
+        if (!frame->selection().setSelectedRange(*insertionRange, Affinity::Downstream, FrameSelection::ShouldCloseTyping::Yes))
+            return false;
+
         protect(frame->editor())->replaceSelectionWithText(replacementString, Editor::SelectReplacement::No, Editor::SmartReplace::No);
         return true;
     }
diff --git a/Source/WebCore/accessibility/AccessibilityObject.h b/Source/WebCore/accessibility/AccessibilityObject.h
index f8b1c21446b6..b74bf682977f 100644
--- a/Source/WebCore/accessibility/AccessibilityObject.h
+++ b/Source/WebCore/accessibility/AccessibilityObject.h
@@ -64,6 +64,7 @@ WTF_ALLOW_COMPACT_POINTERS_TO_INCOMPLETE_TYPE(WebCore::AXObjectRareData);
 
 namespace WebCore {
 
+class HTMLTextFormControlElement;
 class IntPoint;
 class IntSize;
 class ScrollableArea;
@@ -140,7 +141,9 @@ class AccessibilityObject : public AXCoreObject {
 
     bool isSecureField() const override { return false; }
     bool isContainedBySecureField() const;
-    bool isNativeTextControl() const override { return false; }
+    bool isNativeTextControl() const final { return nativeTextControl(); }
+    // The <textarea> or text <input> whose value this object exposes, or null.
+    HTMLTextFormControlElement* nativeTextControl() const;
     virtual bool isSearchField() const { return false; }
     bool isAttachment() const override { return false; }
 #if ENABLE(ATTACHMENT_ELEMENT)
diff --git a/Source/WebCore/accessibility/AccessibilityObjectInlines.h b/Source/WebCore/accessibility/AccessibilityObjectInlines.h
index eacd2488d462..9c5edfc92119 100644
--- a/Source/WebCore/accessibility/AccessibilityObjectInlines.h
+++ b/Source/WebCore/accessibility/AccessibilityObjectInlines.h
@@ -85,11 +85,6 @@ inline bool AccessibilityObject::hasTreeRole() const
     return element && hasRole(*element, "tree"_s);
 }
 
-inline AXTextMarkerRange AccessibilityObject::textMarkerRange() const
-{
-    return simpleRange();
-}
-
 inline LocalFrame* AccessibilityObject::frame() const
 {
     Node* node = this->node();
diff --git a/Source/WebCore/accessibility/AccessibilityRenderObject.cpp b/Source/WebCore/accessibility/AccessibilityRenderObject.cpp
index 66a7a7841225..c03c02fede55 100644
--- a/Source/WebCore/accessibility/AccessibilityRenderObject.cpp
+++ b/Source/WebCore/accessibility/AccessibilityRenderObject.cpp
@@ -2053,13 +2053,8 @@ void AccessibilityRenderObject::setSelectedVisiblePositionRange(const VisiblePos
     // else branch below would fail because contains<ComposedTree> returns
     // false for cross-document positions, clamping the selection to the web
     // area start.
-    RefPtr<HTMLTextFormControlElement> textControl;
-    if (isNativeTextControl()) {
-        // isNativeTextControl returns true only for HTMLTextAreaElement or HTMLInputElement,
-        // both of which derive from HTMLTextFormControlElement.
-        ASSERT(is<HTMLTextFormControlElement>(node()));
-        textControl = downcast<HTMLTextFormControlElement>(node());
-    } else
+    RefPtr textControl = nativeTextControl();
+    if (!textControl)
         textControl = enclosingTextFormControl(range.start.deepEquivalent());
 
     if (textControl) {
diff --git a/Source/WebCore/accessibility/AccessibilitySpinButton.cpp b/Source/WebCore/accessibility/AccessibilitySpinButton.cpp
index 7caa76f9891e..7890b61246ff 100644
--- a/Source/WebCore/accessibility/AccessibilitySpinButton.cpp
+++ b/Source/WebCore/accessibility/AccessibilitySpinButton.cpp
@@ -53,8 +53,6 @@ AccessibilitySpinButton::AccessibilitySpinButton(AXID axID, SpinButtonElement& s
 Ref<AccessibilitySpinButton> AccessibilitySpinButton::create(AXID axID, SpinButtonElement& spinButtonElement, AXObjectCache& cache)
 {
     Ref spinButton = adoptRef(*new AccessibilitySpinButton(axID, spinButtonElement, cache));
-    // We have to do this setup here and not in the constructor to avoid an
-    // adoptionIsRequired ASSERT in RefCounted.h.
     spinButton->m_incrementor->setParent(spinButton.ptr());
     spinButton->m_decrementor->setParent(spinButton.ptr());
     spinButton->addChild(spinButton->m_incrementor.get());
diff --git a/Source/WebCore/animation/CSSAnimation.cpp b/Source/WebCore/animation/CSSAnimation.cpp
index d7d3bf1bc97c..6b51c4b75a8f 100644
--- a/Source/WebCore/animation/CSSAnimation.cpp
+++ b/Source/WebCore/animation/CSSAnimation.cpp
@@ -217,7 +217,7 @@ void CSSAnimation::syncStyleOriginatedTimeline()
         [&](const CSS::Keyword::None&) {
             setTimeline(nullptr);
         },
-        [&](const Style::CustomIdent&) {
+        [&](const Style::ScopedName&) {
             CheckedRef styleOriginatedTimelinesController = document->ensureStyleOriginatedTimelinesController();
             styleOriginatedTimelinesController->attachAnimation(*this);
         },
@@ -235,7 +235,7 @@ void CSSAnimation::syncStyleOriginatedTimeline()
                 if (existingViewTimeline->matchesAnonymousViewFunctionForSubject(viewFunction, m_backingStyleZoomForLength, *owningElement()))
                     return;
             }
-            auto viewTimeline = ViewTimeline::create(nullAtom(), viewFunction->axis, viewFunction->insets, m_backingStyleZoomForLength);
+            auto viewTimeline = ViewTimeline::create({ nullAtom() }, viewFunction->axis, viewFunction->insets, m_backingStyleZoomForLength);
             viewTimeline->setSubject(*owningElement());
             setTimeline(WTF::move(viewTimeline));
         }
@@ -243,7 +243,7 @@ void CSSAnimation::syncStyleOriginatedTimeline()
 
     // If we're not dealing with a named timeline, we should make sure we have no
     // pending attachment operation for this timeline name.
-    if (!m_backingStyleAnimation.timeline().isCustomIdent()) {
+    if (!m_backingStyleAnimation.timeline().isScopedName()) {
         CheckedRef styleOriginatedTimelinesController = document->ensureStyleOriginatedTimelinesController();
         styleOriginatedTimelinesController->removePendingOperationsForCSSAnimation(*this);
     }
diff --git a/Source/WebCore/animation/ScrollTimeline.cpp b/Source/WebCore/animation/ScrollTimeline.cpp
index 2b4d8c4acf68..8d7585301a30 100644
--- a/Source/WebCore/animation/ScrollTimeline.cpp
+++ b/Source/WebCore/animation/ScrollTimeline.cpp
@@ -83,7 +83,7 @@ Ref<ScrollTimeline> ScrollTimeline::create(Document& document, ScrollTimelineOpt
     return timeline;
 }
 
-Ref<ScrollTimeline> ScrollTimeline::create(const AtomString& name, ScrollAxis axis)
+Ref<ScrollTimeline> ScrollTimeline::create(const Style::ScopedName& name, ScrollAxis axis)
 {
     return adoptRef(*new ScrollTimeline(name, axis));
 }
@@ -95,7 +95,7 @@ Ref<ScrollTimeline> ScrollTimeline::create(Scroller scroller, ScrollAxis axis)
 
 Ref<ScrollTimeline> ScrollTimeline::createInactiveStyleOriginatedTimeline(const AtomString& name)
 {
-    auto timeline = adoptRef(*new ScrollTimeline(name, ScrollAxis::Block));
+    Ref timeline = adoptRef(*new ScrollTimeline({ name }, ScrollAxis::Block));
     timeline->m_isInactiveStyleOriginatedTimeline = true;
     return timeline;
 }
@@ -110,7 +110,7 @@ ScrollTimeline::ScrollTimeline()
 {
 }
 
-ScrollTimeline::ScrollTimeline(const AtomString& name, ScrollAxis axis)
+ScrollTimeline::ScrollTimeline(const Style::ScopedName& name, ScrollAxis axis)
     : ScrollTimeline()
 {
     m_axis = axis;
@@ -416,7 +416,7 @@ void ScrollTimeline::animationTimingDidChange(WebAnimation& animation)
 
 bool ScrollTimeline::matchesAnonymousScrollFunctionForSource(const Style::ScrollFunction& scrollFunction, const Styleable& source) const
 {
-    return m_isStyleOriginated && m_name.isEmpty() && m_scroller == scrollFunction->scroller && m_axis == scrollFunction->axis && m_source.styleable() == source;
+    return m_isStyleOriginated && m_name.name.isEmpty() && m_scroller == scrollFunction->scroller && m_axis == scrollFunction->axis && m_source.styleable() == source;
 }
 
 #if ENABLE(THREADED_ANIMATIONS)
diff --git a/Source/WebCore/animation/ScrollTimeline.h b/Source/WebCore/animation/ScrollTimeline.h
index 0d8121f782dd..3066644e2fe1 100644
--- a/Source/WebCore/animation/ScrollTimeline.h
+++ b/Source/WebCore/animation/ScrollTimeline.h
@@ -28,6 +28,7 @@
 #include <WebCore/AnimationTimeline.h>
 #include <WebCore/Element.h>
 #include <WebCore/RenderStyleConstants.h>
+#include <WebCore/ScopedName.h>
 #include <WebCore/ScrollAxis.h>
 #include <WebCore/ScrollTimelineOptions.h>
 #include <WebCore/StyleScrollFunction.h>
@@ -51,7 +52,7 @@ class ComputedStyle;
 class ScrollTimeline : public AnimationTimeline {
 public:
     static Ref<ScrollTimeline> create(Document&, ScrollTimelineOptions&& = { });
-    static Ref<ScrollTimeline> create(const AtomString&, ScrollAxis);
+    static Ref<ScrollTimeline> create(const Style::ScopedName&, ScrollAxis);
     static Ref<ScrollTimeline> create(Scroller, ScrollAxis);
     static Ref<ScrollTimeline> createInactiveStyleOriginatedTimeline(const AtomString& name);
 
@@ -64,8 +65,8 @@ class ScrollTimeline : public AnimationTimeline {
     ScrollAxis axis() const { return m_axis; }
     void setAxis(ScrollAxis axis) { m_axis = axis; }
 
-    const AtomString& name() const LIFETIME_BOUND { return m_name; }
-    void setName(const AtomString& name) { m_name = name; }
+    const Style::ScopedName& name() const LIFETIME_BOUND { return m_name; }
+    void setName(const Style::ScopedName& name) { m_name = name; }
 
     bool isInactiveStyleOriginatedTimeline() const { return m_isInactiveStyleOriginatedTimeline; }
 
@@ -98,7 +99,7 @@ class ScrollTimeline : public AnimationTimeline {
 #endif
 
 protected:
-    explicit ScrollTimeline(const AtomString&, ScrollAxis);
+    explicit ScrollTimeline(const Style::ScopedName&, ScrollAxis);
 
     struct Data {
         float scrollOffset { 0 };
@@ -140,7 +141,7 @@ class ScrollTimeline : public AnimationTimeline {
 
     WeakStyleable m_source;
     ScrollAxis m_axis { ScrollAxis::Block };
-    AtomString m_name;
+    Style::ScopedName m_name;
     Scroller m_scroller { Scroller::Self };
     WeakPtr<Element, WeakPtrImplWithEventTargetData> m_timelineScopeElement;
     CurrentTimeData m_cachedCurrentTimeData { };
diff --git a/Source/WebCore/animation/StyleOriginatedTimelinesController.cpp b/Source/WebCore/animation/StyleOriginatedTimelinesController.cpp
index 7a1f8d93e69d..374d866961db 100644
--- a/Source/WebCore/animation/StyleOriginatedTimelinesController.cpp
+++ b/Source/WebCore/animation/StyleOriginatedTimelinesController.cpp
@@ -40,6 +40,7 @@
 #include "ScrollTimeline.h"
 #include "Settings.h"
 #include "StyleableInlines.h"
+#include "StyleScope.h"
 #include "ViewTimeline.h"
 #include "WebAnimation.h"
 #include "WebAnimationTypes.h"
@@ -125,7 +126,20 @@ ScrollTimeline* StyleOriginatedTimelinesController::determineTreeOrder(const Vec
     return nullptr;
 }
 
-ScrollTimeline* StyleOriginatedTimelinesController::determineTimelineForElement(const Vector<Ref<ScrollTimeline>>& timelines, const Styleable& styleable, const Element* timelineScopeElement)
+static bool timelineIsInScopeForTarget(const Ref<ScrollTimeline>& timeline, Element& targetElement, Style::ScopeOrdinal animationTimelineNameScopeOrdinal)
+{
+    if (!targetElement.isConnected())
+        return false;
+    RefPtr timelineOriginatingElement { originatingElement(timeline).element() };
+    ASSERT(timelineOriginatingElement);
+    CheckedPtr scrollTimelineNameStyleScope = Style::Scope::forOrdinal(*timelineOriginatingElement, timeline->name().scopeOrdinal);
+    ASSERT(scrollTimelineNameStyleScope);
+    return Style::resolveTreeScopedReference(targetElement, { timeline->name().name, animationTimelineNameScopeOrdinal }, [&](const Style::Scope& scope, const Style::ScopedName&) {
+        return scrollTimelineNameStyleScope == &scope;
+    });
+}
+
+ScrollTimeline* StyleOriginatedTimelinesController::determineTimelineForElement(const Vector<Ref<ScrollTimeline>>& timelines, const Styleable& styleable, Style::ScopeOrdinal targetTimelineScopeOrdinal, const Element* timelineScopeElement)
 {
     // https://drafts.csswg.org/scroll-animations-1/#timeline-scoping
     // A named scroll progress timeline or view progress timeline is referenceable by:
@@ -139,6 +153,9 @@ ScrollTimeline* StyleOriginatedTimelinesController::determineTimelineForElement(
         auto styleableForTimeline = originatingStyleableIncludingTimelineScope(timeline).styleable();
         if (!styleableForTimeline)
             continue;
+        Ref targetElement { styleable.element };
+        if (!timelineIsInScopeForTarget(timeline, targetElement.get(), targetTimelineScopeOrdinal))
+            continue;
         Ref protectedElementForTimeline { styleableForTimeline->element };
         if (&styleableForTimeline->element == &styleable.element || styleable.element.isComposedTreeDescendantOf(protectedElementForTimeline.get()))
             matchedTimelines.append(timeline);
@@ -183,11 +200,11 @@ void StyleOriginatedTimelinesController::updateTimelineForTimelineScope(const Re
     }
 }
 
-void StyleOriginatedTimelinesController::registerNamedScrollTimeline(const AtomString& name, const Styleable& source, ScrollAxis axis)
+void StyleOriginatedTimelinesController::registerNamedScrollTimeline(const Style::ScopedName& scopedName, const Styleable& source, ScrollAxis axis)
 {
-    LOG_WITH_STREAM(Animations, stream << "StyleOriginatedTimelinesController::registerNamedScrollTimeline: " << name << " source: " << source);
+    LOG_WITH_STREAM(Animations, stream << "StyleOriginatedTimelinesController::registerNamedScrollTimeline: " << scopedName.name << " source: " << source);
 
-    auto& timelines = timelinesForName(name);
+    auto& timelines = timelinesForName(scopedName.name);
 
     auto existingTimelineIndex = timelines.findIf([&](auto& timeline) {
         return !is<ViewTimeline>(timeline) && timeline->sourceStyleable() == source;
@@ -197,11 +214,11 @@ void StyleOriginatedTimelinesController::registerNamedScrollTimeline(const AtomS
         auto& existingScrollTimeline = timelines[existingTimelineIndex].get();
         existingScrollTimeline.setAxis(axis);
     } else {
-        auto newScrollTimeline = ScrollTimeline::create(name, axis);
+        auto newScrollTimeline = ScrollTimeline::create(scopedName, axis);
         newScrollTimeline->setSource(source);
-        updateTimelineForTimelineScope(newScrollTimeline, name);
+        updateTimelineForTimelineScope(newScrollTimeline, scopedName.name);
         timelines.append(WTF::move(newScrollTimeline));
-        updateCSSAnimationsAssociatedWithNamedTimeline(name);
+        updateCSSAnimationsAssociatedWithNamedTimeline(scopedName.name);
     }
 }
 
@@ -216,8 +233,8 @@ void StyleOriginatedTimelinesController::updateCSSAnimationsAssociatedWithNamedT
             if (RefPtr cssAnimation = dynamicDowncast<CSSAnimation>(animation.get())) {
                 if (!cssAnimation->owningElement())
                     continue;
-                if (auto timelineName = cssAnimation->backingStyleAnimation().timeline().tryCustomIdent()) {
-                    if (timelineName->value == name)
+                if (auto timelineName = cssAnimation->backingStyleAnimation().timeline().tryScopedName()) {
+                    if (timelineName->name == name)
                         cssAnimationsWithMatchingTimelineName.add(*cssAnimation);
                 }
             }
@@ -255,11 +272,11 @@ void StyleOriginatedTimelinesController::documentDidResolveStyle()
     m_removedTimelines.clear();
 }
 
-void StyleOriginatedTimelinesController::registerNamedViewTimeline(const AtomString& name, const Styleable& subject, ScrollAxis axis, const Style::ViewTimelineInsetItem& insets, const Style::ZoomFactor& usedZoomForLength)
+void StyleOriginatedTimelinesController::registerNamedViewTimeline(const Style::ScopedName& scopedName, const Styleable& subject, ScrollAxis axis, const Style::ViewTimelineInsetItem& insets, const Style::ZoomFactor& usedZoomForLength)
 {
-    LOG_WITH_STREAM(Animations, stream << "StyleOriginatedTimelinesController::registerNamedViewTimeline: " << name << " subject: " << subject);
+    LOG_WITH_STREAM(Animations, stream << "StyleOriginatedTimelinesController::registerNamedViewTimeline: " << scopedName.name << " subject: " << subject);
 
-    auto& timelines = timelinesForName(name);
+    auto& timelines = timelinesForName(scopedName.name);
 
     auto existingTimelineIndex = timelines.findIf([&](auto& timeline) {
         if (RefPtr viewTimeline = dynamicDowncast<ViewTimeline>(timeline))
@@ -274,14 +291,14 @@ void StyleOriginatedTimelinesController::registerNamedViewTimeline(const AtomStr
         existingViewTimeline->setAxis(axis);
         existingViewTimeline->setInsets(ResolvableViewTimelineInsets { insets, usedZoomForLength });
     } else {
-        auto newViewTimeline = ViewTimeline::create(name, axis, insets, usedZoomForLength);
+        auto newViewTimeline = ViewTimeline::create(scopedName, axis, insets, usedZoomForLength);
         newViewTimeline->setSubject(subject);
-        updateTimelineForTimelineScope(newViewTimeline, name);
+        updateTimelineForTimelineScope(newViewTimeline, scopedName.name);
         timelines.append(WTF::move(newViewTimeline));
     }
 
     if (!hasExistingTimeline)
-        updateCSSAnimationsAssociatedWithNamedTimeline(name);
+        updateCSSAnimationsAssociatedWithNamedTimeline(scopedName.name);
 }
 
 void StyleOriginatedTimelinesController::unregisterNamedTimeline(const AtomString& name, const Styleable& styleable)
@@ -336,14 +353,14 @@ void StyleOriginatedTimelinesController::attachAnimation(CSSAnimation& animation
     if (!target)
         return;
 
-    auto timelineName = protectedAnimation->backingStyleAnimation().timeline().tryCustomIdent();
+    auto timelineName = protectedAnimation->backingStyleAnimation().timeline().tryScopedName();
     if (!timelineName)
         return;
 
-    LOG_WITH_STREAM(Animations, stream << "StyleOriginatedTimelinesController::attachAnimation: " << timelineName->value << " target: " << *target);
+    LOG_WITH_STREAM(Animations, stream << "StyleOriginatedTimelinesController::attachAnimation: " << timelineName->name << " target: " << *target);
 
     auto relevantTimelineScopeElement = [&] -> RefPtr<Element> {
-        auto timelineScopeElements = relatedTimelineScopeElements(*timelineName);
+        auto timelineScopeElements = relatedTimelineScopeElements(Style::CustomIdent { timelineName->name });
         if (timelineScopeElements.isEmpty())
             return nullptr;
         // Find the nearest parent within timelineScopeElements.
@@ -356,7 +373,7 @@ void StyleOriginatedTimelinesController::attachAnimation(CSSAnimation& animation
         return nullptr;
     }();
 
-    auto it = m_nameToTimelineMap.find(timelineName->value);
+    auto it = m_nameToTimelineMap.find(timelineName->name);
     auto hasNamedTimeline = it != m_nameToTimelineMap.end() && it->value.containsIf([&](auto& timeline) {
         auto timelineScope = timeline->timelineScopeDeclaredElement();
         if (timelineScope && timelineScope.get() != relevantTimelineScopeElement.get())
@@ -380,13 +397,13 @@ void StyleOriginatedTimelinesController::attachAnimation(CSSAnimation& animation
         //        scroll timeline, or,
         //     2. the name is not within scope and the timeline is null.
         if (relevantTimelineScopeElement)
-            protectedAnimation->setTimeline(&inactiveNamedTimeline(timelineName->value));
+            protectedAnimation->setTimeline(&inactiveNamedTimeline(timelineName->name));
         else
             protectedAnimation->setTimeline(nullptr);
     } else {
         auto& timelines = it->value;
-        RefPtr timeline = determineTimelineForElement(timelines, *target, relevantTimelineScopeElement.get());
-        LOG_WITH_STREAM(Animations, stream << "StyleOriginatedTimelinesController::attachAnimation: " << timelineName->value << " styleable: " << *target << " attaching to timeline of element: " << originatingElement(*timeline));
+        RefPtr timeline = determineTimelineForElement(timelines, *target, timelineName->scopeOrdinal, relevantTimelineScopeElement.get());
+        LOG_WITH_STREAM(Animations, stream << "StyleOriginatedTimelinesController::attachAnimation: " << timelineName->name << " styleable: " << *target << " attaching to timeline of element: " << originatingElement(*timeline));
         // A deferred inactive timeline means there was a conflict with multiple timelines existing within
         // a parent element with a "timeline-scope" property. In that case, we must reconsider timeline attachment
         // once style resolution completes as further updates may occur that would yield a different timeline
@@ -441,7 +458,7 @@ void StyleOriginatedTimelinesController::updateNamedTimelineMapForTimelineScope(
         // We need to unregister all timelines that are no longer within this scope.
         for (auto& timeline : namedTimelinesToUnregister) {
             if (auto associatedElement = originatingElement(timeline).styleable())
-                unregisterNamedTimeline(timeline->name(), *associatedElement);
+                unregisterNamedTimeline(timeline->name().name, *associatedElement);
         }
         break;
     }
diff --git a/Source/WebCore/animation/StyleOriginatedTimelinesController.h b/Source/WebCore/animation/StyleOriginatedTimelinesController.h
index 15d347e02d64..1e3d26a153c5 100644
--- a/Source/WebCore/animation/StyleOriginatedTimelinesController.h
+++ b/Source/WebCore/animation/StyleOriginatedTimelinesController.h
@@ -26,6 +26,7 @@
 #pragma once
 
 #include "CSSAnimation.h"
+#include "ScopedName.h"
 #include "ScrollAxis.h"
 #include "StyleNameScope.h"
 #include "Styleable.h"
@@ -64,8 +65,8 @@ class StyleOriginatedTimelinesController final : public CanMakeCheckedPtr<StyleO
     explicit StyleOriginatedTimelinesController() = default;
     ~StyleOriginatedTimelinesController() = default;
 
-    void registerNamedScrollTimeline(const AtomString&, const Styleable&, ScrollAxis);
-    void registerNamedViewTimeline(const AtomString&, const Styleable&, ScrollAxis, const Style::ViewTimelineInsetItem&, const Style::ZoomFactor&);
+    void registerNamedScrollTimeline(const Style::ScopedName&, const Styleable&, ScrollAxis);
+    void registerNamedViewTimeline(const Style::ScopedName&, const Styleable&, ScrollAxis, const Style::ViewTimelineInsetItem&, const Style::ZoomFactor&);
     void unregisterNamedTimeline(const AtomString&, const Styleable&);
     void attachAnimation(CSSAnimation&);
     void updateNamedTimelineMapForTimelineScope(const Style::NameScope&, const Styleable&);
@@ -83,7 +84,7 @@ class StyleOriginatedTimelinesController final : public CanMakeCheckedPtr<StyleO
 
     enum class AllowsDeferral : bool { No, Yes };
     void attachAnimation(CSSAnimation&, AllowsDeferral);
-    ScrollTimeline* determineTimelineForElement(const Vector<Ref<ScrollTimeline>>&, const Styleable&, const Element*);
+    ScrollTimeline* determineTimelineForElement(const Vector<Ref<ScrollTimeline>>&, const Styleable&, Style::ScopeOrdinal targetTimelineScopeOrdinal, const Element*);
     ScrollTimeline* determineTreeOrder(const Vector<Ref<ScrollTimeline>>&, const Styleable&, const Element*);
     ScrollTimeline& inactiveNamedTimeline(const AtomString&);
 
diff --git a/Source/WebCore/animation/ViewTimeline.cpp b/Source/WebCore/animation/ViewTimeline.cpp
index 29c6f4af7164..9ef23de29ee3 100644
--- a/Source/WebCore/animation/ViewTimeline.cpp
+++ b/Source/WebCore/animation/ViewTimeline.cpp
@@ -58,7 +58,7 @@ ExceptionOr<Ref<ViewTimeline>> ViewTimeline::create(Document& document, ViewTime
     if (!insets)
         return Exception { ExceptionCode::TypeError };
 
-    auto viewTimeline = ViewTimeline::create(nullAtom(), options.axis, WTF::move(*insets), Style::ZoomFactor::none());
+    auto viewTimeline = ViewTimeline::create({ nullAtom() }, options.axis, WTF::move(*insets), Style::ZoomFactor::none());
 
     viewTimeline->setSubject(options.subject.get());
     if (auto subject = options.subject)
@@ -68,13 +68,13 @@ ExceptionOr<Ref<ViewTimeline>> ViewTimeline::create(Document& document, ViewTime
     return viewTimeline;
 }
 
-Ref<ViewTimeline> ViewTimeline::create(const AtomString& name, ScrollAxis axis, const Style::ViewTimelineInsetItem& insets, const Style::ZoomFactor& usedZoomForLength)
+Ref<ViewTimeline> ViewTimeline::create(const Style::ScopedName& scopedName, ScrollAxis axis, const Style::ViewTimelineInsetItem& insets, const Style::ZoomFactor& usedZoomForLength)
 {
-    return adoptRef(*new ViewTimeline(name, axis, insets, usedZoomForLength));
+    return adoptRef(*new ViewTimeline(scopedName, axis, insets, usedZoomForLength));
 }
 
-ViewTimeline::ViewTimeline(const AtomString& name, ScrollAxis axis, const Style::ViewTimelineInsetItem& insets, const Style::ZoomFactor& usedZoomForLength)
-    : ScrollTimeline(name, axis)
+ViewTimeline::ViewTimeline(const Style::ScopedName& scopedName, ScrollAxis axis, const Style::ViewTimelineInsetItem& insets, const Style::ZoomFactor& usedZoomForLength)
+    : ScrollTimeline(scopedName, axis)
     , m_insets({ .insets = insets, .zoom = usedZoomForLength })
 {
 }
@@ -552,7 +552,7 @@ Ref<CSSNumericValue> ViewTimeline::endOffset() const
 bool ViewTimeline::matchesAnonymousViewFunctionForSubject(const Style::ViewFunction& viewFunction, const Style::ZoomFactor& usedZoomForLength, const Styleable& subject) const
 {
     return isStyleOriginated()
-        && name().isEmpty()
+        && name().name.isEmpty()
         && m_insets.insets == viewFunction->insets
         && m_insets.zoom == usedZoomForLength
         && axis() == viewFunction->axis
diff --git a/Source/WebCore/animation/ViewTimeline.h b/Source/WebCore/animation/ViewTimeline.h
index d250e6dbe5e8..ea1b2c8f8c54 100644
--- a/Source/WebCore/animation/ViewTimeline.h
+++ b/Source/WebCore/animation/ViewTimeline.h
@@ -28,6 +28,7 @@
 #include <WebCore/CSSNumericValue.h>
 #include <WebCore/CSSPrimitiveValue.h>
 #include <WebCore/ResolvableViewTimelineInsets.h>
+#include <WebCore/ScopedName.h>
 #include <WebCore/ScrollTimeline.h>
 #include <WebCore/StyleViewFunction.h>
 #include <WebCore/Styleable.h>
@@ -72,7 +73,7 @@ struct StickinessAdjustmentData {
 class ViewTimeline final : public ScrollTimeline {
 public:
     static ExceptionOr<Ref<ViewTimeline>> create(Document&, ViewTimelineOptions&&);
-    static Ref<ViewTimeline> create(const AtomString&, ScrollAxis, const Style::ViewTimelineInsetItem&, const Style::ZoomFactor&);
+    static Ref<ViewTimeline> create(const Style::ScopedName&, ScrollAxis, const Style::ViewTimelineInsetItem&, const Style::ZoomFactor&);
 
     const Element* NODELETE subject() const;
     const WeakStyleable subjectStyleable() const { return m_subject; }
@@ -102,7 +103,7 @@ class ViewTimeline final : public ScrollTimeline {
     WebAnimationTime NODELETE epsilon() const;
 
 private:
-    ViewTimeline(const AtomString&, ScrollAxis, const Style::ViewTimelineInsetItem&, const Style::ZoomFactor&);
+    ViewTimeline(const Style::ScopedName&, ScrollAxis, const Style::ViewTimelineInsetItem&, const Style::ZoomFactor&);
 
     ScrollTimeline::Data computeTimelineData(UseCachedCurrentTime = UseCachedCurrentTime::Yes) const final;
     std::pair<double, double> intervalForTimelineRangeName(const ScrollTimeline::Data&, Style::SingleAnimationRangeName) const;
diff --git a/Source/WebCore/css/CSSProperties.json b/Source/WebCore/css/CSSProperties.json
index e9f212cb81ef..33a397c4e812 100644
--- a/Source/WebCore/css/CSSProperties.json
+++ b/Source/WebCore/css/CSSProperties.json
@@ -8696,9 +8696,9 @@
             ],
             "codegen-properties": {
                 "computed-style-storage-path": ["m_nonInheritedData", "miscData"],
-                "computed-style-storage-kind": "enum",
-                "computed-style-type": "TextOverflow",
-                "parser-grammar": "<<values>>"
+                "computed-style-storage-kind": "reference",
+                "computed-style-type": "Style::TextOverflow",
+                "parser-grammar": "clip | ellipsis | <string>"
             },
             "specification": {
                 "category": "css-overflow",
@@ -12098,7 +12098,7 @@
                 "computed-style-storage-path": ["m_nonInheritedData", "rareData"],
                 "computed-style-storage-kind": "reference",
                 "computed-style-type": "Style::TextDecorationInset",
-                "parser-grammar": "auto | <length>{1,2}@(type=CSSValuePair default=previous)",
+                "parser-grammar": "auto | <length-percentage>{1,2}@(type=CSSValuePair default=previous)",
                 "applies-to-highlight-pseudo-elements": "yes"
             },
             "specification": {
diff --git a/Source/WebCore/css/parser/CSSCustomPropertySyntax.cpp b/Source/WebCore/css/parser/CSSCustomPropertySyntax.cpp
index f8088f756f1e..fb6022e7b139 100644
--- a/Source/WebCore/css/parser/CSSCustomPropertySyntax.cpp
+++ b/Source/WebCore/css/parser/CSSCustomPropertySyntax.cpp
@@ -80,7 +80,7 @@ auto CSSCustomPropertySyntax::parseComponent(std::span<const CharacterType> span
         ++buffer;
 
     auto ident = [&] {
-        auto tokenizer = CSSTokenizer::tryCreate(StringView(begin.first(buffer.position() - begin.data())).toStringWithoutCopying());
+        auto tokenizer = CSSTokenizer::tryCreate(StringView(begin.first(buffer.position() - begin.data())));
         if (!tokenizer)
             return nullAtom();
 
diff --git a/Source/WebCore/css/parser/CSSParser.h b/Source/WebCore/css/parser/CSSParser.h
index 6709a044774d..2bb6f95e4d53 100644
--- a/Source/WebCore/css/parser/CSSParser.h
+++ b/Source/WebCore/css/parser/CSSParser.h
@@ -128,7 +128,7 @@ class CSSParser {
 
     static RefPtr<StyleRuleNestedDeclarations> parseNestedDeclarations(const CSSParserContext&, const String&);
 
-    CSSTokenizer* tokenizer() const LIFETIME_BOUND { return m_tokenizer.get(); }
+    const CSSTokenizer* tokenizer() const LIFETIME_BOUND { return m_tokenizer.get(); }
 
 private:
     struct NestingContext {
diff --git a/Source/WebCore/css/parser/CSSTokenizer.cpp b/Source/WebCore/css/parser/CSSTokenizer.cpp
index 491c66cf38e7..1085b125177c 100644
--- a/Source/WebCore/css/parser/CSSTokenizer.cpp
+++ b/Source/WebCore/css/parser/CSSTokenizer.cpp
@@ -35,6 +35,7 @@
 #include "CSSParserTokenRange.h"
 #include "CSSTokenizerInputStream.h"
 #include <wtf/NeverDestroyed.h>
+#include <wtf/text/CodePointIterator.h>
 #include <wtf/text/StringBuilder.h>
 #include <wtf/unicode/CharacterNames.h>
 
@@ -42,19 +43,60 @@ namespace WebCore {
 DEFINE_ALLOCATOR_WITH_HEAP_IDENTIFIER(CSSTokenizer);
 
 // https://drafts.csswg.org/css-syntax/#input-preprocessing
-String CSSTokenizer::preprocessString(const String& string)
+StringView CSSTokenizer::preprocessString(StringView string)
 {
     // We don't replace '\r' and '\f' with '\n' as the specification suggests, instead
     // we treat them all the same in the isCSSNewline() function from CSSParserIdioms.h.
-    StringImpl* oldImpl = string.impl();
-    String replaced = makeStringByReplacingAll(string, '\0', replacementCharacter);
-    replaced = replaceUnpairedSurrogatesWithReplacementCharacter(WTF::move(replaced));
-    if (replaced.impl() != oldImpl)
-        registerString(replaced);
-    return replaced;
+
+    auto preprocessSpan8 = [&](auto characters) -> StringView {
+        // Latin-1 strings only need to replace any null characters.
+
+        size_t indexOfNullCharacter = WTF::find(characters, '\0');
+        if (indexOfNullCharacter == notFound)
+            return string;
+
+        return registerString(String { StringImpl::createByReplacingInCharacters(characters, '\0', replacementCharacter, indexOfNullCharacter) });
+    };
+
+    auto preprocessSpan16 = [&](auto characters) -> StringView {
+        // UTF-16 string need to replace any null characters and any unpaired surrogates.
+
+        bool hasUnpairedSurrogate = [&] {
+            for (WTF::CodePointIterator<char16_t> iterator(characters); !iterator.atEnd(); ++iterator) {
+                if (U_IS_SURROGATE(*iterator))
+                    return true;
+            }
+            return false;
+        }();
+
+        if (!hasUnpairedSurrogate) {
+            // When there are no unpaired surrogates, we can treat this just like the Latin-1 case.
+
+            size_t indexOfNullCharacter = WTF::find(characters, '\0');
+            if (indexOfNullCharacter == notFound)
+                return string;
+
+            return registerString(String { StringImpl::createByReplacingInCharacters(characters, '\0', replacementCharacter, indexOfNullCharacter) });
+        } else {
+            StringBuilder result;
+            result.reserveCapacity(string.length());
+            for (WTF::CodePointIterator<char16_t> iterator(characters); !iterator.atEnd(); ++iterator) {
+                auto codePoint = *iterator;
+                if (!codePoint || U_IS_SURROGATE(codePoint))
+                    result.append(replacementCharacter);
+                else
+                    result.append(codePoint);
+            }
+            return registerString(result.toString());
+        }
+    };
+
+    if (string.is8Bit())
+        return preprocessSpan8(string.span8());
+    return preprocessSpan16(string.span16());
 }
 
-std::unique_ptr<CSSTokenizer> CSSTokenizer::tryCreate(const String& string)
+std::unique_ptr<CSSTokenizer> CSSTokenizer::tryCreate(StringView string)
 {
     bool success = true;
     // We can't use makeUnique here because it does not have access to this private constructor.
@@ -64,7 +106,7 @@ std::unique_ptr<CSSTokenizer> CSSTokenizer::tryCreate(const String& string)
     return tokenizer;
 }
 
-std::unique_ptr<CSSTokenizer> CSSTokenizer::tryCreate(const String& string, CSSParserObserverWrapper& wrapper)
+std::unique_ptr<CSSTokenizer> CSSTokenizer::tryCreate(StringView string, CSSParserObserverWrapper& wrapper)
 {
     bool success = true;
     // We can't use makeUnique here because it does not have access to this private constructor.
@@ -74,17 +116,17 @@ std::unique_ptr<CSSTokenizer> CSSTokenizer::tryCreate(const String& string, CSSP
     return tokenizer;
 }
 
-CSSTokenizer::CSSTokenizer(const String& string)
+CSSTokenizer::CSSTokenizer(StringView string)
     : CSSTokenizer(string, nullptr, nullptr)
 {
 }
 
-CSSTokenizer::CSSTokenizer(const String& string, CSSParserObserverWrapper& wrapper)
+CSSTokenizer::CSSTokenizer(StringView string, CSSParserObserverWrapper& wrapper)
     : CSSTokenizer(string, &wrapper, nullptr)
 {
 }
 
-CSSTokenizer::CSSTokenizer(const String& string, CSSParserObserverWrapper* wrapper, bool* constructionSuccessPtr)
+CSSTokenizer::CSSTokenizer(StringView string, CSSParserObserverWrapper* wrapper, bool* constructionSuccessPtr)
     : m_input(preprocessString(string))
 {
     if (constructionSuccessPtr)
@@ -134,7 +176,7 @@ CSSParserTokenRange CSSTokenizer::tokenRange() const LIFETIME_BOUND
     return m_tokens;
 }
 
-unsigned CSSTokenizer::tokenCount()
+unsigned CSSTokenizer::tokenCount() const
 {
     return m_tokens.size();
 }
@@ -865,6 +907,12 @@ bool CSSTokenizer::nextCharsAreIdentifier()
     return areIdentifier;
 }
 
+StringView CSSTokenizer::registerString(String&& string)
+{
+    m_stringPool.append(WTF::move(string));
+    return m_stringPool.last();
+}
+
 StringView CSSTokenizer::registerString(const String& string)
 {
     m_stringPool.append(string);
diff --git a/Source/WebCore/css/parser/CSSTokenizer.h b/Source/WebCore/css/parser/CSSTokenizer.h
index 98cde39ba5e9..2ee127bf2780 100644
--- a/Source/WebCore/css/parser/CSSTokenizer.h
+++ b/Source/WebCore/css/parser/CSSTokenizer.h
@@ -33,7 +33,6 @@
 #include <WebCore/CSSTokenizerInputStream.h>
 #include <climits>
 #include <wtf/text/StringView.h>
-#include <wtf/text/WTFString.h>
 
 namespace WebCore {
 
@@ -46,28 +45,28 @@ class CSSTokenizer {
     WTF_MAKE_NONCOPYABLE(CSSTokenizer);
     WTF_DEPRECATED_MAKE_FAST_ALLOCATED_WITH_HEAP_IDENTIFIER(CSSTokenizer, CSSTokenizer);
 public:
-    static std::unique_ptr<CSSTokenizer> tryCreate(const String&);
-    static std::unique_ptr<CSSTokenizer> tryCreate(const String&, CSSParserObserverWrapper&); // For the inspector
+    static std::unique_ptr<CSSTokenizer> tryCreate(StringView string LIFETIME_BOUND);
+    static std::unique_ptr<CSSTokenizer> tryCreate(StringView string LIFETIME_BOUND, CSSParserObserverWrapper&); // For the inspector
 
-    WEBCORE_EXPORT explicit CSSTokenizer(const String&);
-    CSSTokenizer(const String&, CSSParserObserverWrapper&); // For the inspector
+    WEBCORE_EXPORT explicit CSSTokenizer(StringView string LIFETIME_BOUND);
+    CSSTokenizer(StringView string LIFETIME_BOUND, CSSParserObserverWrapper&); // For the inspector
 
     WEBCORE_EXPORT CSSParserTokenRange NODELETE tokenRange() const LIFETIME_BOUND;
-    unsigned NODELETE tokenCount();
+    unsigned NODELETE tokenCount() const;
 
     static bool NODELETE isWhitespace(CSSParserTokenType);
 
     Vector<String>&& escapedStringsForAdoption() { return WTF::move(m_stringPool); }
 
 private:
-    CSSTokenizer(const String&, CSSParserObserverWrapper*, bool* constructionSuccess);
+    CSSTokenizer(StringView string LIFETIME_BOUND, CSSParserObserverWrapper*, bool* constructionSuccess);
 
     CSSParserToken nextToken();
 
     char16_t NODELETE consume();
     void NODELETE reconsume(char16_t);
 
-    String preprocessString(const String&);
+    StringView preprocessString(StringView);
 
     CSSParserToken consumeNumericToken();
     CSSParserToken consumeIdentLikeToken();
@@ -122,6 +121,7 @@ class CSSTokenizer {
     CSSParserToken stringStart(char16_t);
     CSSParserToken endOfFile(char16_t);
 
+    StringView registerString(String&&);
     StringView registerString(const String&);
 
     using CodePoint = CSSParserToken (CSSTokenizer::*)(char16_t);
diff --git a/Source/WebCore/css/parser/CSSTokenizerInputStream.cpp b/Source/WebCore/css/parser/CSSTokenizerInputStream.cpp
index 354458e03e6f..2b760b446a6c 100644
--- a/Source/WebCore/css/parser/CSSTokenizerInputStream.cpp
+++ b/Source/WebCore/css/parser/CSSTokenizerInputStream.cpp
@@ -37,10 +37,10 @@
 namespace WebCore {
 DEFINE_ALLOCATOR_WITH_HEAP_IDENTIFIER(CSSTokenizerInputStream);
 
-CSSTokenizerInputStream::CSSTokenizerInputStream(const String& input)
+CSSTokenizerInputStream::CSSTokenizerInputStream(StringView string)
     : m_offset(0)
-    , m_stringLength(input.length())
-    , m_string(input.impl())
+    , m_stringLength(string.length())
+    , m_string(string)
 {
 }
 
@@ -52,10 +52,10 @@ void CSSTokenizerInputStream::advanceUntilNonWhitespace()
             ++m_offset;
     };
 
-    if (m_string->is8Bit())
-        advance(m_string->span8());
+    if (m_string.is8Bit())
+        advance(m_string.span8());
     else
-        advance(m_string->span16());
+        advance(m_string.span16());
 }
 
 void CSSTokenizerInputStream::advanceUntilNewlineOrNonWhitespace()
@@ -68,10 +68,10 @@ void CSSTokenizerInputStream::advanceUntilNewlineOrNonWhitespace()
         }
     };
 
-    if (m_string->is8Bit())
-        advance(m_string->span8());
+    if (m_string.is8Bit())
+        advance(m_string.span8());
     else
-        advance(m_string->span16());
+        advance(m_string.span16());
 }
 
 double CSSTokenizerInputStream::getDouble(unsigned start, unsigned end) const
@@ -80,10 +80,10 @@ double CSSTokenizerInputStream::getDouble(unsigned start, unsigned end) const
     bool isResultOK = false;
     double result = 0.0;
     if (start < end) {
-        if (m_string->is8Bit())
-            result = charactersToDouble(m_string->span8().subspan(m_offset + start, end - start), &isResultOK);
+        if (m_string.is8Bit())
+            result = charactersToDouble(m_string.span8().subspan(m_offset + start, end - start), &isResultOK);
         else
-            result = charactersToDouble(m_string->span16().subspan(m_offset + start, end - start), &isResultOK);
+            result = charactersToDouble(m_string.span16().subspan(m_offset + start, end - start), &isResultOK);
     }
     // FIXME: It looks like callers ensure we have a valid number
     return isResultOK ? result : 0.0;
diff --git a/Source/WebCore/css/parser/CSSTokenizerInputStream.h b/Source/WebCore/css/parser/CSSTokenizerInputStream.h
index b0742b2e2189..42f5d6b604a2 100644
--- a/Source/WebCore/css/parser/CSSTokenizerInputStream.h
+++ b/Source/WebCore/css/parser/CSSTokenizerInputStream.h
@@ -40,7 +40,7 @@ class CSSTokenizerInputStream {
     WTF_MAKE_NONCOPYABLE(CSSTokenizerInputStream);
     WTF_DEPRECATED_MAKE_FAST_ALLOCATED_WITH_HEAP_IDENTIFIER(CSSTokenizerInputStream, CSSTokenizerInputStream);
 public:
-    explicit CSSTokenizerInputStream(const String& input);
+    explicit CSSTokenizerInputStream(StringView string LIFETIME_BOUND);
 
     // Gets the char in the stream. Will return (NUL) kEndOfFileMarker when at the
     // end of the stream.
@@ -48,7 +48,7 @@ class CSSTokenizerInputStream {
     {
         if (m_offset >= m_stringLength)
             return kEndOfFileMarker;
-        return (*m_string)[m_offset];
+        return m_string[m_offset];
     }
 
     // Gets the char at lookaheadOffset from the current stream position. Will
@@ -57,7 +57,7 @@ class CSSTokenizerInputStream {
     {
         if ((m_offset + lookaheadOffset) >= m_stringLength)
             return kEndOfFileMarker;
-        return (*m_string)[m_offset + lookaheadOffset];
+        return m_string[m_offset + lookaheadOffset];
     }
 
     void advance(unsigned offset = 1) { m_offset += offset; }
@@ -72,12 +72,12 @@ class CSSTokenizerInputStream {
     template<bool characterPredicate(char16_t)>
     unsigned skipWhilePredicate(unsigned offset)
     {
-        if (m_string->is8Bit()) {
-            auto characters8 = m_string->span8();
+        if (m_string.is8Bit()) {
+            auto characters8 = m_string.span8();
             while ((m_offset + offset) < m_stringLength && characterPredicate(characters8[m_offset + offset]))
                 ++offset;
         } else {
-            auto characters16 = m_string->span16();
+            auto characters16 = m_string.span16();
             while ((m_offset + offset) < m_stringLength && characterPredicate(characters16[m_offset + offset]))
                 ++offset;
         }
@@ -93,13 +93,13 @@ class CSSTokenizerInputStream {
     StringView rangeAt(unsigned start, unsigned length) const
     {
         ASSERT(start + length <= m_stringLength);
-        return StringView(m_string.get()).substring(start, length); // FIXME: Should make a constructor on StringView for this.
+        return m_string.substring(start, length);
     }
 
 private:
     size_t m_offset;
     const size_t m_stringLength;
-    RefPtr<StringImpl> m_string;
+    StringView m_string;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/css/query/ContainerQueryFeatures.cpp b/Source/WebCore/css/query/ContainerQueryFeatures.cpp
index 7130f7ea5677..b776cd134e00 100644
--- a/Source/WebCore/css/query/ContainerQueryFeatures.cpp
+++ b/Source/WebCore/css/query/ContainerQueryFeatures.cpp
@@ -96,7 +96,7 @@ struct WidthFeatureSchema : public SizeFeatureSchema {
 
     EvaluationResult evaluate(const MQ::Feature& feature, const RenderBox& renderer, const CSSToLengthConversionData& conversionData) const override
     {
-        auto width = Style::adjustForAbsoluteZoom(renderer.contentBoxWidth(), renderer);
+        auto width = Style::unapplyingZoom<int>(renderer.contentBoxWidth(), renderer);
         return evaluateLengthFeature(feature, width, conversionData);
     }
 };
@@ -111,7 +111,7 @@ struct HeightFeatureSchema : public SizeFeatureSchema {
 
     EvaluationResult evaluate(const MQ::Feature& feature, const RenderBox& renderer, const CSSToLengthConversionData& conversionData) const override
     {
-        auto height = Style::adjustForAbsoluteZoom(renderer.contentBoxHeight(), renderer);
+        auto height = Style::unapplyingZoom<int>(renderer.contentBoxHeight(), renderer);
         return evaluateLengthFeature(feature, height, conversionData);
     }
 };
@@ -126,7 +126,7 @@ struct InlineSizeFeatureSchema : public SizeFeatureSchema {
 
     EvaluationResult evaluate(const MQ::Feature& feature, const RenderBox& renderer, const CSSToLengthConversionData& conversionData) const override
     {
-        auto logicalWidth = Style::adjustForAbsoluteZoom(renderer.contentBoxLogicalWidth(), renderer);
+        auto logicalWidth = Style::unapplyingZoom<int>(renderer.contentBoxLogicalWidth(), renderer);
         return evaluateLengthFeature(feature, logicalWidth, conversionData);
     }
 };
@@ -141,7 +141,7 @@ struct BlockSizeFeatureSchema : public SizeFeatureSchema {
 
     EvaluationResult evaluate(const MQ::Feature& feature, const RenderBox& renderer, const CSSToLengthConversionData& conversionData) const override
     {
-        auto logicalHeight = Style::adjustForAbsoluteZoom(renderer.contentBoxLogicalHeight(), renderer);
+        auto logicalHeight = Style::unapplyingZoom<int>(renderer.contentBoxLogicalHeight(), renderer);
         return evaluateLengthFeature(feature, logicalHeight, conversionData);
     }
 };
diff --git a/Source/WebCore/css/query/MediaQueryFeatures.cpp b/Source/WebCore/css/query/MediaQueryFeatures.cpp
index dd3d322ac58e..c2014ca6eb8e 100644
--- a/Source/WebCore/css/query/MediaQueryFeatures.cpp
+++ b/Source/WebCore/css/query/MediaQueryFeatures.cpp
@@ -429,7 +429,7 @@ static const LengthSchema& heightFeatureSchema()
         [](auto& context) {
             auto height = protect(context.document->view())->layoutHeight();
             if (CheckedPtr renderView = context.document->renderView())
-                height = Style::adjustForAbsoluteZoom(height, *renderView);
+                height = Style::unapplyingZoom<int>(height, *renderView);
             return height;
         }
     };
@@ -729,7 +729,7 @@ static const LengthSchema& widthFeatureSchema()
         [](auto& context) {
             auto width = protect(context.document->view())->layoutWidth();
             if (CheckedPtr renderView = context.document->renderView())
-                width = Style::adjustForAbsoluteZoom(width, *renderView);
+                width = Style::unapplyingZoom<int>(width, *renderView);
             return width;
         }
     };
diff --git a/Source/WebCore/css/typedom/CSSUnparsedValue.cpp b/Source/WebCore/css/typedom/CSSUnparsedValue.cpp
index 13c04fe4ecf6..32b98d097fc7 100644
--- a/Source/WebCore/css/typedom/CSSUnparsedValue.cpp
+++ b/Source/WebCore/css/typedom/CSSUnparsedValue.cpp
@@ -168,7 +168,8 @@ ExceptionOr<CSSUnparsedSegment> CSSUnparsedValue::setItem(size_t index, CSSUnpar
 
 RefPtr<CSSValue> CSSUnparsedValue::toCSSValue() const
 {
-    CSSTokenizer tokenizer(toString());
+    auto serialization = toString();
+    CSSTokenizer tokenizer(serialization);
     return CSSSubstitutionValue::create(tokenizer.tokenRange(), { }, strictCSSParserContext());
 }
 
diff --git a/Source/WebCore/css/values/primitives/CSSCustomIdent.h b/Source/WebCore/css/values/primitives/CSSCustomIdent.h
index f81ef3949394..31abd552b311 100644
--- a/Source/WebCore/css/values/primitives/CSSCustomIdent.h
+++ b/Source/WebCore/css/values/primitives/CSSCustomIdent.h
@@ -36,12 +36,6 @@ namespace CSS {
 struct CustomIdent {
     AtomString value;
 
-    std::optional<AtomString> tryResolved() const
-    {
-        // FIXME: When ident() function is added, only successfully resolve when there are no <integer> components.
-        return value;
-    }
-
     bool operator==(const CustomIdent&) const = default;
 };
 
diff --git a/Source/WebCore/dom/ContainerNode.cpp b/Source/WebCore/dom/ContainerNode.cpp
index b929ed75363b..059fd4f0f380 100644
--- a/Source/WebCore/dom/ContainerNode.cpp
+++ b/Source/WebCore/dom/ContainerNode.cpp
@@ -312,6 +312,49 @@ static ContainerNode::ChildChange makeChildChangeForInsertion(ContainerNode& con
     };
 }
 
+static ContainerNode::ChildChange makeChildChangeForMoveRemoval(Node& child)
+{
+    auto changeType = [&] {
+        if (is<Element>(child))
+            return ContainerNode::ChildChange::Type::ElementMovedFrom;
+        if (is<Text>(child))
+            return ContainerNode::ChildChange::Type::TextMovedFrom;
+        return ContainerNode::ChildChange::Type::NonContentsChildMovedFrom;
+    }();
+
+    return {
+        changeType,
+        nullptr,
+        dynamicDowncast<Element>(child),
+        ElementTraversal::previousSibling(child),
+        ElementTraversal::nextSibling(child),
+        ContainerNode::ChildChange::Source::API,
+        changeType == ContainerNode::ChildChange::Type::ElementMovedFrom ? ContainerNode::ChildChange::AffectsElements::Yes : ContainerNode::ChildChange::AffectsElements::No
+    };
+}
+
+static ContainerNode::ChildChange makeChildChangeForMoveInsertion(ContainerNode& containerNode, Node& child, Node* beforeChild)
+{
+    auto changeType = [&] {
+        if (is<Element>(child))
+            return ContainerNode::ChildChange::Type::ElementMovedInto;
+        if (is<Text>(child))
+            return ContainerNode::ChildChange::Type::TextMovedInto;
+        return ContainerNode::ChildChange::Type::NonContentsChildMovedInto;
+    }();
+
+    auto* beforeChildElement = dynamicDowncast<Element>(beforeChild);
+    return {
+        changeType,
+        nullptr,
+        dynamicDowncast<Element>(child),
+        beforeChild ? ElementTraversal::previousSibling(*beforeChild) : ElementTraversal::lastChild(containerNode),
+        !beforeChild || beforeChildElement ? beforeChildElement : ElementTraversal::nextSibling(*beforeChild),
+        ContainerNode::ChildChange::Source::API,
+        changeType == ContainerNode::ChildChange::Type::ElementMovedInto ? ContainerNode::ChildChange::AffectsElements::Yes : ContainerNode::ChildChange::AffectsElements::No
+    };
+}
+
 static ContainerNode::ChildChange NODELETE makeChildChangeForInsertion(ContainerNode& containerNode, NodeVector& children, Node* beforeChild, ContainerNode::ChildChange::Source source, ReplacedAllChildren replacedAllChildren)
 {
     using Type = ContainerNode::ChildChange::Type;
@@ -1449,7 +1492,7 @@ static void runMovingStepsForShadowIncludingInclusiveDescendants(Node& root, Nod
     for (RefPtr inclusiveDescendant = &root; inclusiveDescendant; inclusiveDescendant = NodeTraversal::next(*inclusiveDescendant, &root)) {
         bool isSubtreeRoot = inclusiveDescendant.get() == &movedNode;
 
-        inclusiveDescendant->movingSteps(isSubtreeRoot, oldParent);
+        inclusiveDescendant->movingSteps(isSubtreeRoot ? Node::IsSubtreeRoot::Yes : Node::IsSubtreeRoot::No, oldParent);
 
         if (newParentIsConnected) {
             if (RefPtr element = dynamicDowncast<Element>(*inclusiveDescendant); element && element->isDefinedCustomElement())
@@ -1504,7 +1547,7 @@ ExceptionOr<void> ContainerNode::moveBefore(Node& node, RefPtr<Node>&& refChild)
     RefPtr oldPreviousSibling = node.previousSibling();
     RefPtr oldNextSibling = node.nextSibling();
 
-    auto removalChildChange = makeChildChangeForRemoval(node, ChildChange::Source::API);
+    auto removalChildChange = makeChildChangeForMoveRemoval(node);
 
     {
         Ref nodeDocument = node.document();
@@ -1552,10 +1595,8 @@ ExceptionOr<void> ContainerNode::moveBefore(Node& node, RefPtr<Node>&& refChild)
 
     runMovingStepsForShadowIncludingInclusiveDescendants(node, node, *oldParent, newParentIsConnected);
 
-    // FIXME: Add a new type for ChildChange.
-
     oldParent->childrenChanged(removalChildChange);
-    childrenChanged(makeChildChangeForInsertion(*this, node, refChild, ChildChange::Source::API, ReplacedAllChildren::No));
+    childrenChanged(makeChildChangeForMoveInsertion(*this, node, refChild));
 
     return { };
 }
diff --git a/Source/WebCore/dom/ContainerNode.h b/Source/WebCore/dom/ContainerNode.h
index bfee836263da..5b223f691d4a 100644
--- a/Source/WebCore/dom/ContainerNode.h
+++ b/Source/WebCore/dom/ContainerNode.h
@@ -83,7 +83,7 @@ class ContainerNode : public Node {
 
     enum class CanDelayNodeDeletion : uint8_t { No, Yes, Unknown };
     struct ChildChange {
-        enum class Type : uint8_t { ElementInserted, ElementRemoved, ElementAndTextInserted, TextInserted, TextRemoved, TextChanged, AllChildrenRemoved, NonContentsChildRemoved, NonContentsChildInserted, AllChildrenReplaced };
+        enum class Type : uint8_t { ElementInserted, ElementRemoved, ElementMovedInto, ElementMovedFrom, ElementAndTextInserted, TextInserted, TextRemoved, TextChanged, TextMovedFrom, TextMovedInto, AllChildrenRemoved, NonContentsChildRemoved, NonContentsChildInserted, NonContentsChildMovedInto, NonContentsChildMovedFrom, AllChildrenReplaced };
         enum class Source : uint8_t { Parser, API, Clone };
         enum class AffectsElements : uint8_t { Unknown, No, Yes };
 
@@ -107,10 +107,16 @@ class ContainerNode : public Node {
             case ChildChange::Type::AllChildrenReplaced:
                 return true;
             case ChildChange::Type::ElementRemoved:
+            case ChildChange::Type::ElementMovedFrom:
+            case ChildChange::Type::ElementMovedInto:
             case ChildChange::Type::TextRemoved:
+            case ChildChange::Type::TextMovedFrom:
+            case ChildChange::Type::TextMovedInto:
             case ChildChange::Type::TextChanged:
             case ChildChange::Type::AllChildrenRemoved:
             case ChildChange::Type::NonContentsChildRemoved:
+            case ChildChange::Type::NonContentsChildMovedFrom:
+            case ChildChange::Type::NonContentsChildMovedInto:
                 return false;
             }
             ASSERT_NOT_REACHED();
diff --git a/Source/WebCore/dom/Document.cpp b/Source/WebCore/dom/Document.cpp
index c65ca919bb8e..4099202f72ed 100644
--- a/Source/WebCore/dom/Document.cpp
+++ b/Source/WebCore/dom/Document.cpp
@@ -535,12 +535,12 @@ static void CallbackForContainIntrinsicSize(const Vector<Ref<ResizeObserverEntry
 
             auto contentBoxSize = entry->contentBoxSize().at(0);
             if (box->style().logicalContainIntrinsicWidth().hasAuto()) {
-                auto adjustedWidth = LayoutUnit { Style::applyZoom(contentBoxSize->inlineSize(), box->style()) };
+                auto adjustedWidth = LayoutUnit { Style::applyingZoom<float>(contentBoxSize->inlineSize(), box->style()) };
                 target->setLastRememberedLogicalWidth(adjustedWidth);
             }
 
             if (box->style().logicalContainIntrinsicHeight().hasAuto()) {
-                auto adjustedHeight = LayoutUnit { Style::applyZoom(contentBoxSize->blockSize(), box->style()) };
+                auto adjustedHeight = LayoutUnit { Style::applyingZoom<float>(contentBoxSize->blockSize(), box->style()) };
                 target->setLastRememberedLogicalHeight(adjustedHeight);
             }
         }
diff --git a/Source/WebCore/dom/Element.cpp b/Source/WebCore/dom/Element.cpp
index 7155ab9d506a..06c9322cff96 100644
--- a/Source/WebCore/dom/Element.cpp
+++ b/Source/WebCore/dom/Element.cpp
@@ -1447,8 +1447,8 @@ void Element::scrollTo(const ScrollToOptions& options, ScrollClamping clamping,
         return;
 
     auto scrollToOptions = normalizeNonFiniteCoordinatesOrFallBackTo(options,
-        Style::adjustForAbsoluteZoom(renderer->scrollLeft(), *renderer),
-        Style::adjustForAbsoluteZoom(renderer->scrollTop(), *renderer)
+        Style::unapplyingZoom<int>(renderer->scrollLeft(), *renderer),
+        Style::unapplyingZoom<int>(renderer->scrollTop(), *renderer)
     );
     IntPoint scrollPosition(
         clampTo<int>(scrollToOptions.left.value() * renderer->style().usedZoom()),
@@ -1590,7 +1590,7 @@ int Element::offsetWidth()
     protect(document())->updateLayoutIfDimensionsOutOfDate(*this, DimensionsCheck::Width, { LayoutOptions::TreatContentVisibilityHiddenAsVisible, LayoutOptions::TreatContentVisibilityAutoAsVisible, LayoutOptions::IgnorePendingStylesheets });
     if (CheckedPtr renderer = renderBoxModelObject()) {
         auto offsetWidth = LayoutUnit { roundToInt(renderer->offsetWidth()) };
-        return convertToNonSubpixelValue(Style::adjustLayoutUnitForAbsoluteZoom(offsetWidth, *renderer).toDouble());
+        return convertToNonSubpixelValue(Style::unapplyingZoom<LayoutUnit>(offsetWidth, *renderer).toDouble());
     }
     return 0;
 }
@@ -1600,7 +1600,7 @@ int Element::offsetHeight()
     protect(document())->updateLayoutIfDimensionsOutOfDate(*this, DimensionsCheck::Height, { LayoutOptions::TreatContentVisibilityHiddenAsVisible, LayoutOptions::TreatContentVisibilityAutoAsVisible, LayoutOptions::IgnorePendingStylesheets });
     if (CheckedPtr renderer = renderBoxModelObject()) {
         auto offsetHeight = LayoutUnit { roundToInt(renderer->offsetHeight()) };
-        return convertToNonSubpixelValue(Style::adjustLayoutUnitForAbsoluteZoom(offsetHeight, *renderer).toDouble());
+        return convertToNonSubpixelValue(Style::unapplyingZoom<LayoutUnit>(offsetHeight, *renderer).toDouble());
     }
     return 0;
 }
@@ -1631,7 +1631,7 @@ int Element::clientLeft()
 
     if (CheckedPtr renderer = renderBox()) {
         auto clientLeft = LayoutUnit { roundToInt(renderer->borderLeft()) };
-        return convertToNonSubpixelValue(Style::adjustLayoutUnitForAbsoluteZoom(clientLeft, *renderer).toDouble());
+        return convertToNonSubpixelValue(Style::unapplyingZoom<LayoutUnit>(clientLeft, *renderer).toDouble());
     }
     return 0;
 }
@@ -1642,7 +1642,7 @@ int Element::clientTop()
 
     if (CheckedPtr renderer = renderBox()) {
         auto clientTop = LayoutUnit { roundToInt(renderer->borderTop()) };
-        return convertToNonSubpixelValue(Style::adjustLayoutUnitForAbsoluteZoom(clientTop, *renderer).toDouble());
+        return convertToNonSubpixelValue(Style::unapplyingZoom<LayoutUnit>(clientTop, *renderer).toDouble());
     }
     return 0;
 }
@@ -1661,7 +1661,7 @@ int Element::clientWidth()
     // When in quirks mode, clientWidth for the body element should return the width of the containing frame.
     bool inQuirksMode = document->inQuirksMode();
     if ((!inQuirksMode && document->documentElement() == this) || (inQuirksMode && isHTMLElement() && document->bodyOrFrameset() == this))
-        return Style::adjustForAbsoluteZoom(protect(renderView->frameView())->layoutWidth(), renderView);
+        return Style::unapplyingZoom<int>(protect(renderView->frameView())->layoutWidth(), renderView);
     
     if (CheckedPtr renderer = renderBox()) {
         auto clientWidth = LayoutUnit { roundToInt(renderer->paddingBoxWidth()) };
@@ -1680,7 +1680,7 @@ int Element::clientWidth()
                 clientWidth += renderer->paddingLeft() + renderer->paddingRight();
             clientWidth += renderer->borderLeft() + renderer->borderRight();
         }
-        return convertToNonSubpixelValue(Style::adjustLayoutUnitForAbsoluteZoom(clientWidth, *renderer).toDouble());
+        return convertToNonSubpixelValue(Style::unapplyingZoom<LayoutUnit>(clientWidth, *renderer).toDouble());
     }
     return 0;
 }
@@ -1698,7 +1698,7 @@ int Element::clientHeight()
     // When in quirks mode, clientHeight for the body element should return the height of the containing frame.
     bool inQuirksMode = document->inQuirksMode();
     if ((!inQuirksMode && document->documentElement() == this) || (inQuirksMode && isHTMLElement() && document->bodyOrFrameset() == this))
-        return Style::adjustForAbsoluteZoom(protect(renderView->frameView())->layoutHeight(), renderView);
+        return Style::unapplyingZoom<int>(protect(renderView->frameView())->layoutHeight(), renderView);
 
     if (CheckedPtr renderer = renderBox()) {
         auto clientHeight = LayoutUnit { roundToInt(renderer->paddingBoxHeight()) };
@@ -1717,7 +1717,7 @@ int Element::clientHeight()
                 clientHeight += renderer->paddingTop() + renderer->paddingBottom();
             clientHeight += renderer->borderTop() + renderer->borderBottom();
         }
-        return convertToNonSubpixelValue(Style::adjustLayoutUnitForAbsoluteZoom(clientHeight, *renderer).toDouble());
+        return convertToNonSubpixelValue(Style::unapplyingZoom<LayoutUnit>(clientHeight, *renderer).toDouble());
     }
     return 0;
 }
@@ -1757,7 +1757,7 @@ int Element::scrollLeft()
     }
 
     if (CheckedPtr renderer = renderBox())
-        return Style::adjustForAbsoluteZoom(renderer->scrollLeft(), *renderer);
+        return Style::unapplyingZoom<int>(renderer->scrollLeft(), *renderer);
     return 0;
 }
 
@@ -1773,7 +1773,7 @@ int Element::scrollTop()
     }
 
     if (CheckedPtr renderer = renderBox())
-        return Style::adjustForAbsoluteZoom(renderer->scrollTop(), *renderer);
+        return Style::unapplyingZoom<int>(renderer->scrollTop(), *renderer);
     return 0;
 }
 
@@ -1847,7 +1847,7 @@ int Element::scrollWidth()
     }
 
     if (CheckedPtr renderer = renderBox())
-        return Style::adjustForAbsoluteZoom(renderer->scrollWidth(), *renderer);
+        return Style::unapplyingZoom<int>(renderer->scrollWidth(), *renderer);
     return 0;
 }
 
@@ -1865,7 +1865,7 @@ int Element::scrollHeight()
     }
 
     if (CheckedPtr renderer = renderBox())
-        return Style::adjustForAbsoluteZoom(renderer->scrollHeight(), *renderer);
+        return Style::unapplyingZoom<int>(renderer->scrollHeight(), *renderer);
     return 0;
 }
 
@@ -3293,9 +3293,6 @@ void Element::removingSteps(RemovalType removalType, ContainerNode& oldParentOfR
         if (isInTopLayer()) [[unlikely]]
             removeFromTopLayer();
 
-        if (oldDocument->cssTarget() == this)
-            oldDocument->setCSSTarget(nullptr);
-
         if (isDefinedCustomElement()) [[unlikely]]
             CustomElementReactionQueue::enqueueDisconnectedCallbackIfNeeded(*this);
     }
@@ -3328,7 +3325,7 @@ void Element::removingSteps(RemovalType removalType, ContainerNode& oldParentOfR
     }
 }
 
-void Element::movingSteps(bool isSubtreeRoot, ContainerNode& oldParent)
+void Element::movingSteps(IsSubtreeRoot isSubtreeRoot, ContainerNode& oldParent)
 {
     ContainerNode::movingSteps(isSubtreeRoot, oldParent);
 
@@ -3362,7 +3359,7 @@ void Element::movingSteps(bool isSubtreeRoot, ContainerNode& oldParent)
 
     updateEffectiveLangState();
 
-    if (!isSubtreeRoot || !hasFocusWithin())
+    if (isSubtreeRoot == IsSubtreeRoot::No || !hasFocusWithin())
         return;
 
     if (RefPtr oldParentElement = dynamicDowncast<Element>(oldParent))
@@ -3770,7 +3767,10 @@ void Element::childrenChanged(const ChildChange& change)
         switch (change.type) {
         case ChildChange::Type::ElementInserted:
         case ChildChange::Type::ElementRemoved:
+        case ChildChange::Type::ElementMovedFrom:
+        case ChildChange::Type::ElementMovedInto:
             // For elements, we notify shadowRoot in Element::insertionSteps and Element::removingSteps.
+            // FIXME(321178): Need to notify shadowRoot when elements are moved.
             break;
         case ChildChange::Type::AllChildrenRemoved:
         case ChildChange::Type::AllChildrenReplaced:
@@ -3780,10 +3780,14 @@ void Element::childrenChanged(const ChildChange& change)
         case ChildChange::Type::TextInserted:
         case ChildChange::Type::TextRemoved:
         case ChildChange::Type::TextChanged:
+        case ChildChange::Type::TextMovedFrom:
+        case ChildChange::Type::TextMovedInto:
             shadowRoot->didMutateTextNodesOfShadowHost();
             break;
         case ChildChange::Type::NonContentsChildInserted:
         case ChildChange::Type::NonContentsChildRemoved:
+        case ChildChange::Type::NonContentsChildMovedFrom:
+        case ChildChange::Type::NonContentsChildMovedInto:
             break;
         }
     }
diff --git a/Source/WebCore/dom/Element.h b/Source/WebCore/dom/Element.h
index b892c81e730f..aa9cec4722f3 100644
--- a/Source/WebCore/dom/Element.h
+++ b/Source/WebCore/dom/Element.h
@@ -940,7 +940,7 @@ class Element : public ContainerNode {
 
     NeedsPostConnectionSteps insertionSteps(InsertionType, ContainerNode&) override;
     void removingSteps(RemovalType, ContainerNode&) override;
-    void movingSteps(bool, ContainerNode&) override;
+    void movingSteps(IsSubtreeRoot, ContainerNode&) override;
     void childrenChanged(const ChildChange&) override;
     void removeAllEventListeners() override;
 
diff --git a/Source/WebCore/dom/EmptyScriptExecutionContext.h b/Source/WebCore/dom/EmptyScriptExecutionContext.h
index 56d6bc207a46..5eb26ae28086 100644
--- a/Source/WebCore/dom/EmptyScriptExecutionContext.h
+++ b/Source/WebCore/dom/EmptyScriptExecutionContext.h
@@ -100,7 +100,6 @@ class EmptyScriptExecutionContext final : public RefCounted<EmptyScriptExecution
         , m_eventLoop(EmptyEventLoop::create(vm))
         , m_eventLoopTaskGroup(makeUniqueRef<EventLoopTaskGroup>(m_eventLoop))
     {
-        relaxAdoptionRequirement();
         m_eventLoop->addAssociatedContext(*this);
     }
 
diff --git a/Source/WebCore/dom/ImageOverlay.cpp b/Source/WebCore/dom/ImageOverlay.cpp
index 7f453d6a3055..31712aac1037 100644
--- a/Source/WebCore/dom/ImageOverlay.cpp
+++ b/Source/WebCore/dom/ImageOverlay.cpp
@@ -565,8 +565,8 @@ void updateWithTextRecognitionResult(HTMLElement& element, const TextRecognition
             FloatSize sizeBeforeTransform;
             if (CheckedPtr renderer = textContainer->renderBoxModelObject()) {
                 sizeBeforeTransform = {
-                    Style::adjustLayoutUnitForAbsoluteZoom(renderer->offsetWidth(), *renderer).toFloat(),
-                    Style::adjustLayoutUnitForAbsoluteZoom(renderer->offsetHeight(), *renderer).toFloat(),
+                    Style::unapplyingZoom<LayoutUnit>(renderer->offsetWidth(), *renderer).toFloat(),
+                    Style::unapplyingZoom<LayoutUnit>(renderer->offsetHeight(), *renderer).toFloat(),
                 };
             }
 
diff --git a/Source/WebCore/dom/Node.cpp b/Source/WebCore/dom/Node.cpp
index e8e88ad88e2d..4ded6f826aed 100644
--- a/Source/WebCore/dom/Node.cpp
+++ b/Source/WebCore/dom/Node.cpp
@@ -123,7 +123,6 @@ struct SameSizeAsNode : EventTarget, CanMakeCheckedPtr<SameSizeAsNode> {
 public:
 #if ASSERT_ENABLED
     bool inRemovedLastRefFunction;
-    bool adoptionIsRequired;
     bool deletionHasBegun;
 #endif
     uint32_t refCountAndParentBit;
@@ -385,10 +384,7 @@ Node::Node(Document& document, NodeType type, OptionSet<TypeFlag> flags)
     ASSERT(nodeType() == type);
     ASSERT(isMainThread());
 
-    // Allow code to ref the Document while it is being constructed to make our life easier.
-    if (isDocumentNode())
-        relaxAdoptionRequirement();
-    else
+    if (!isDocumentNode())
         document.incrementReferencingNodeCount();
 
 #if !defined(NDEBUG) || DUMP_NODE_STATISTICS
@@ -411,7 +407,6 @@ Node::~Node()
 {
     ASSERT(isMainThread());
     ASSERT(deletionHasBegun());
-    ASSERT(!m_adoptionIsRequired);
 
     InspectorInstrumentation::willDestroyDOMNode(*this);
 
@@ -1523,7 +1518,7 @@ void Node::removingSteps(RemovalType removalType, ContainerNode& oldParentOfRemo
     }
 }
 
-void Node::movingSteps(bool, ContainerNode&)
+void Node::movingSteps(IsSubtreeRoot, ContainerNode&)
 {
     invalidateStyle(Style::Validity::SubtreeInvalid, Style::InvalidationMode::InsertedIntoAncestor);
 }
diff --git a/Source/WebCore/dom/Node.h b/Source/WebCore/dom/Node.h
index 766e6cff4522..87db8583d740 100644
--- a/Source/WebCore/dom/Node.h
+++ b/Source/WebCore/dom/Node.h
@@ -505,8 +505,12 @@ class Node : public EventTarget, public CanMakeCheckedPtr<Node> {
     // https://dom.spec.whatwg.org/#concept-node-remove-ext
     virtual void removingSteps(RemovalType, ContainerNode& oldParentOfRemovedTree);
 
+    enum class IsSubtreeRoot {
+        Yes,
+        No
+    };
     // https://dom.spec.whatwg.org/#concept-node-move-ext
-    virtual void movingSteps(bool, ContainerNode&);
+    virtual void movingSteps(IsSubtreeRoot, ContainerNode&);
 
     void updateShadowIncludingRootForSubtree();
 
@@ -572,8 +576,6 @@ class Node : public EventTarget, public CanMakeCheckedPtr<Node> {
     ALWAYS_INLINE unsigned refCount() const;
     void applyRefDuringDestructionCheck() const;
 
-    inline void relaxAdoptionRequirement();
-
     HashMap<Ref<MutationObserver>, MutationRecordDeliveryOptions> registeredMutationObservers(MutationObserverOptionType, const QualifiedName* attributeName);
     void registerMutationObserver(MutationObserver&, MutationObserverOptions, const MemoryCompactLookupOnlyRobinHoodHashSet<AtomString>& attributeFilter);
     void unregisterMutationObserver(MutationObserverRegistration&);
@@ -812,10 +814,7 @@ class Node : public EventTarget, public CanMakeCheckedPtr<Node> {
 
 #if ASSERT_ENABLED
     mutable bool m_inRemovedLastRefFunction { false };
-    bool m_adoptionIsRequired { true };
     bool m_deletionHasBegun { false };
-
-    friend inline void adopted(Node*);
 #endif
 
     mutable uint32_t m_refCountAndParentBit { s_refCountIncrement };
@@ -843,21 +842,9 @@ WEBCORE_EXPORT std::partial_ordering treeOrderForTesting(TreeType, const Node&,
 
 bool NODELETE isTouchRelatedEventType(const EventTypeInfo&, const EventTarget&);
 
-#if ASSERT_ENABLED
-
-inline void adopted(Node* node)
-{
-    if (!node)
-        return;
-    node->m_adoptionIsRequired = false;
-}
-
-#endif // ASSERT_ENABLED
-
 ALWAYS_INLINE void Node::ref() const
 {
     ASSERT(isMainThread());
-    ASSERT(!m_adoptionIsRequired);
     applyRefDuringDestructionCheck();
     m_refCountAndParentBit += s_refCountIncrement;
 }
@@ -874,7 +861,6 @@ inline void Node::applyRefDuringDestructionCheck() const
 ALWAYS_INLINE void Node::deref() const
 {
     ASSERT(isMainThread());
-    ASSERT(!m_adoptionIsRequired);
 
     ASSERT_WITH_SECURITY_IMPLICATION(refCount());
     auto updatedRefCount = m_refCountAndParentBit - s_refCountIncrement;
diff --git a/Source/WebCore/dom/NodeInlines.h b/Source/WebCore/dom/NodeInlines.h
index 9f203322490c..74e88bbf836e 100644
--- a/Source/WebCore/dom/NodeInlines.h
+++ b/Source/WebCore/dom/NodeInlines.h
@@ -238,15 +238,6 @@ inline NodeClass& Node::traverseToRootNodeInternal(const NodeClass& node)
     return *current;
 }
 
-inline void Node::relaxAdoptionRequirement()
-{
-#if ASSERT_ENABLED
-    ASSERT_WITH_SECURITY_IMPLICATION(!deletionHasBegun());
-    ASSERT(m_adoptionIsRequired);
-    m_adoptionIsRequired = false;
-#endif
-}
-
 inline IntRect Node::pixelSnappedAbsoluteBoundingRect(bool* isReplaced)
 {
     return snappedIntRect(absoluteBoundingRect(isReplaced));
diff --git a/Source/WebCore/dom/ShadowRoot.cpp b/Source/WebCore/dom/ShadowRoot.cpp
index 701275059c27..f2120a1387cb 100644
--- a/Source/WebCore/dom/ShadowRoot.cpp
+++ b/Source/WebCore/dom/ShadowRoot.cpp
@@ -173,12 +173,18 @@ void ShadowRoot::childrenChanged(const ChildChange& childChange)
     case ChildChange::Type::ElementRemoved:
         protect(m_host)->invalidateStyleForSubtree();
         break;
+    case ChildChange::Type::ElementMovedFrom:
+    case ChildChange::Type::ElementMovedInto:
     case ChildChange::Type::TextInserted:
     case ChildChange::Type::TextRemoved:
     case ChildChange::Type::TextChanged:
+    case ChildChange::Type::TextMovedFrom:
+    case ChildChange::Type::TextMovedInto:
     case ChildChange::Type::AllChildrenRemoved:
     case ChildChange::Type::NonContentsChildRemoved:
     case ChildChange::Type::NonContentsChildInserted:
+    case ChildChange::Type::NonContentsChildMovedFrom:
+    case ChildChange::Type::NonContentsChildMovedInto:
     case ChildChange::Type::AllChildrenReplaced:
         break;
     }
diff --git a/Source/WebCore/dom/Subscriber.cpp b/Source/WebCore/dom/Subscriber.cpp
index 1fce0c37b3ea..90221898f43a 100644
--- a/Source/WebCore/dom/Subscriber.cpp
+++ b/Source/WebCore/dom/Subscriber.cpp
@@ -51,7 +51,6 @@ Subscriber::Subscriber(ScriptExecutionContext& context, Ref<InternalObserver>&&
     , m_options(options)
 {
     m_observer->setSubscriber(*this);
-    relaxAdoptionRequirement();
     followSignal(m_signal);
     if (RefPtr signal = options.signal)
         followSignal(*signal);
diff --git a/Source/WebCore/dom/ViewTransition.cpp b/Source/WebCore/dom/ViewTransition.cpp
index ff18981fa020..e7343d2ec451 100644
--- a/Source/WebCore/dom/ViewTransition.cpp
+++ b/Source/WebCore/dom/ViewTransition.cpp
@@ -992,7 +992,7 @@ void ViewTransition::copyElementBaseProperties(RenderLayerModelObject& renderer,
     // Factor out the zoom from the nearest common ancestor of the captured element and the view transition
     // pseudo tree (the document element), so that it doesn't get applied a second time when rendering the
     // snapshots.
-    LayoutSize cssSize = Style::adjustLayoutSizeForAbsoluteZoom(output.size, documentElementRenderer->style());
+    auto cssSize = Style::unapplyingZoom<LayoutSize>(output.size, documentElementRenderer->style());
     protect(output.properties)->setProperty(CSSPropertyWidth, CSSPrimitiveValue::create(cssSize.width(), CSSUnitType::Px));
     protect(output.properties)->setProperty(CSSPropertyHeight, CSSPrimitiveValue::create(cssSize.height(), CSSUnitType::Px));
 }
diff --git a/Source/WebCore/dom/messageports/MessagePortChannel.cpp b/Source/WebCore/dom/messageports/MessagePortChannel.cpp
index 5e680fd5ebfb..e94147222e03 100644
--- a/Source/WebCore/dom/messageports/MessagePortChannel.cpp
+++ b/Source/WebCore/dom/messageports/MessagePortChannel.cpp
@@ -44,8 +44,6 @@ MessagePortChannel::MessagePortChannel(MessagePortChannelRegistry& registry, con
 {
     ASSERT(isMainThread());
 
-    relaxAdoptionRequirement();
-
     m_processes[0] = port1.processIdentifier;
     m_entangledToProcessProtectors[0] = this;
     m_processes[1] = port2.processIdentifier;
diff --git a/Source/WebCore/fileapi/Blob.cpp b/Source/WebCore/fileapi/Blob.cpp
index bd00721caf2c..6831443ec217 100644
--- a/Source/WebCore/fileapi/Blob.cpp
+++ b/Source/WebCore/fileapi/Blob.cpp
@@ -397,7 +397,6 @@ ExceptionOr<Ref<ReadableStream>> Blob::stream()
         BlobStreamSource(ScriptExecutionContext& scriptExecutionContext, Blob& blob)
             : m_loader(FileReaderLoader::create(FileReaderLoader::ReadType::ReadAsBinaryChunks, this))
         {
-            relaxAdoptionRequirement();
             m_loader->start(&scriptExecutionContext, blob);
         }
 
diff --git a/Source/WebCore/html/HTMLImageElement.cpp b/Source/WebCore/html/HTMLImageElement.cpp
index 8d954ae00906..46de95949dd4 100644
--- a/Source/WebCore/html/HTMLImageElement.cpp
+++ b/Source/WebCore/html/HTMLImageElement.cpp
@@ -631,11 +631,11 @@ void HTMLImageElement::removingSteps(RemovalType removalType, ContainerNode& old
     FormAssociatedElement::elementRemovedFromAncestor(*this, removalType);
 }
 
-void HTMLImageElement::movingSteps(bool isSubtreeRoot, ContainerNode& oldParent)
+void HTMLImageElement::movingSteps(IsSubtreeRoot isSubtreeRoot, ContainerNode& oldParent)
 {
     HTMLElement::movingSteps(isSubtreeRoot, oldParent);
 
-    if (!isSubtreeRoot)
+    if (isSubtreeRoot == IsSubtreeRoot::No)
         return;
 
     if (RefPtr parentPicture = dynamicDowncast<HTMLPictureElement>(parentElement())) {
@@ -677,7 +677,7 @@ unsigned HTMLImageElement::width()
     if (!box)
         return 0;
     LayoutRect contentRect = box->contentBoxRect();
-    return Style::adjustLayoutUnitForAbsoluteZoom(contentRect.width(), *box).round();
+    return Style::unapplyingZoom<LayoutUnit>(contentRect.width(), *box).round();
 }
 
 unsigned HTMLImageElement::height()
@@ -700,7 +700,7 @@ unsigned HTMLImageElement::height()
     if (!box)
         return 0;
     LayoutRect contentRect = box->contentBoxRect();
-    return Style::adjustLayoutUnitForAbsoluteZoom(contentRect.height(), *box).round();
+    return Style::unapplyingZoom<LayoutUnit>(contentRect.height(), *box).round();
 }
 
 unsigned HTMLImageElement::naturalWidth() const
diff --git a/Source/WebCore/html/HTMLImageElement.h b/Source/WebCore/html/HTMLImageElement.h
index f5798ad1744a..731e48c7b622 100644
--- a/Source/WebCore/html/HTMLImageElement.h
+++ b/Source/WebCore/html/HTMLImageElement.h
@@ -218,7 +218,7 @@ class HTMLImageElement
 
     NeedsPostConnectionSteps insertionSteps(InsertionType, ContainerNode&) override;
     void removingSteps(RemovalType, ContainerNode&) override;
-    void movingSteps(bool isSubtreeRoot, ContainerNode&) override;
+    void movingSteps(IsSubtreeRoot, ContainerNode&) override;
 
     bool NODELETE isFormListedElement() const final { return false; }
     FormAssociatedElement* NODELETE asFormAssociatedElement() final { return this; }
diff --git a/Source/WebCore/html/HTMLInputElement.cpp b/Source/WebCore/html/HTMLInputElement.cpp
index fe5426df7e1e..abfdfb504aed 100644
--- a/Source/WebCore/html/HTMLInputElement.cpp
+++ b/Source/WebCore/html/HTMLInputElement.cpp
@@ -2269,7 +2269,7 @@ bool HTMLInputElement::shouldTruncateText(const Style::ComputedStyle& style) con
 {
     if (!isTextField())
         return false;
-    return document().focusedElement() != this && style.textOverflow() == TextOverflow::Ellipsis;
+    return document().focusedElement() != this && !style.textOverflow().isClip();
 }
 
 void HTMLInputElement::invalidateStyleOnFocusChangeIfNeeded()
@@ -2277,7 +2277,7 @@ void HTMLInputElement::invalidateStyleOnFocusChangeIfNeeded()
     if (!isTextField())
         return;
     // Focus change may affect the result of shouldTruncateText().
-    if (CheckedPtr style = renderStyle(); style && style->textOverflow() == TextOverflow::Ellipsis)
+    if (CheckedPtr style = renderStyle(); style && !style->textOverflow().isClip())
         invalidateStyleForSubtree();
 }
 
@@ -2368,7 +2368,10 @@ Style::ComputedStyle HTMLInputElement::createInnerTextStyle(const Style::Compute
     textBlockStyle.setOverflowWrap(OverflowWrap::Normal);
     textBlockStyle.setOverflowX(Overflow::Hidden);
     textBlockStyle.setOverflowY(Overflow::Hidden);
-    textBlockStyle.setTextOverflow(shouldTruncateText(style) ? TextOverflow::Ellipsis : TextOverflow::Clip);
+    if (shouldTruncateText(style))
+        textBlockStyle.setTextOverflow(Style::TextOverflow { style.textOverflow() });
+    else
+        textBlockStyle.setTextOverflow(CSS::Keyword::Clip { });
 
     textBlockStyle.setDisplay(Style::DisplayType::BlockFlow);
 
@@ -2376,7 +2379,7 @@ Style::ComputedStyle HTMLInputElement::createInnerTextStyle(const Style::Compute
         textBlockStyle.setDisplay(Style::DisplayType::InlineFlowRoot);
         textBlockStyle.setLogicalMaxWidth(100_css_percentage);
         textBlockStyle.setColor(Color::black.colorWithAlphaByte(153));
-        textBlockStyle.setTextOverflow(TextOverflow::Clip);
+        textBlockStyle.setTextOverflow(CSS::Keyword::Clip { });
         textBlockStyle.setMaskLayers(Style::MaskLayer { autoFillStrongPasswordMaskImage() });
         // A stacking context is needed for the mask.
         if (textBlockStyle.usedZIndex().isAuto())
diff --git a/Source/WebCore/html/HTMLMediaElement.cpp b/Source/WebCore/html/HTMLMediaElement.cpp
index d4f630ee594d..87a4a6b048a4 100644
--- a/Source/WebCore/html/HTMLMediaElement.cpp
+++ b/Source/WebCore/html/HTMLMediaElement.cpp
@@ -2923,12 +2923,13 @@ bool HTMLMediaElement::isSafeToLoadURL(const URL& url, InvalidURLAction actionIf
         return false;
     }
 
-    if (!portAllowed(url) || isIPAddressDisallowed(url)) {
+    bool ipAddressDisallowed = isIPAddressDisallowed(url);
+    if (ipAddressDisallowed || !portAllowed(url)) {
         if (actionIfInvalid == InvalidURLAction::Complain) {
             if (frame)
                 FrameLoader::reportBlockedLoadFailed(*frame, url);
             if (shouldLog) {
-                if (isIPAddressDisallowed(url))
+                if (ipAddressDisallowed)
                     ERROR_LOG(LOGIDENTIFIER, url , " was rejected because the address not allowed");
                 else
                     ERROR_LOG(LOGIDENTIFIER, url , " was rejected because the port is not allowed");
@@ -4769,12 +4770,14 @@ void HTMLMediaElement::pause()
     if (processingUserGestureForMedia())
         removeBehaviorRestrictionsAfterFirstUserGesture(MediaElementSession::RequireUserGestureToControlControlsManager);
 
-    pauseInternal();
+    bool suppressPauseEvent = m_videoFullscreenMode == VideoFullscreenModeStandard && protect(document())->quirks().needsSuppressedPauseEventOnFullscreenExitQuirk();
+
+    pauseInternal(!suppressPauseEvent);
     // If we have a pending seek, ensure playback doesn't resume.
     m_wasPlayingBeforeSeeking = false;
 }
 
-void HTMLMediaElement::pauseInternal()
+void HTMLMediaElement::pauseInternal(bool dispatchPauseEvent)
 {
     HTMLMEDIAELEMENT_RELEASE_LOG(PauseInternal);
 
@@ -4819,7 +4822,8 @@ void HTMLMediaElement::pauseInternal()
     if (!m_paused && !m_pausedInternal) {
         setPaused(true);
         scheduleTimeupdateEvent(false);
-        scheduleEvent(eventNames().pauseEvent);
+        if (dispatchPauseEvent)
+            scheduleEvent(eventNames().pauseEvent);
         if (!hadInFlightPlayRequest || !m_playPromiseSettlementGuaranteed)
             scheduleRejectPendingPlayPromises(DOMException::create(ExceptionCode::AbortError));
         if (MemoryPressureHandler::singleton().isUnderMemoryPressure())
@@ -7997,9 +8001,11 @@ void HTMLMediaElement::exitFullscreen()
     if (!videoElement)
         return;
 
+    bool suppressPauseEvent = protect(document())->quirks().needsSuppressedPauseEventOnFullscreenExitQuirk();
+
     if (!paused() && protect(mediaSession())->requiresFullscreenForVideoPlayback()) {
         if (!document().settings().allowsInlineMediaPlaybackAfterFullscreen() || isVideoTooSmallForInlinePlayback())
-            pauseInternal();
+            pauseInternal(!suppressPauseEvent);
         else {
             // Allow inline playback, but set a flag so pausing and starting again (e.g. when scrubbing or looping) won't go back to fullscreen.
             // Also set the controls attribute so the user will be able to control playback.
@@ -8021,9 +8027,6 @@ void HTMLMediaElement::exitFullscreen()
 
         setChangingVideoFullscreenMode(true);
 
-        if (!paused() && protect(document())->quirks().needsPauseBeforeFullscreenExitQuirk())
-            pauseInternal();
-
         if (isInWindowOrStandardFullscreen(oldVideoFullscreenMode)) {
             setFullscreenMode(VideoFullscreenModeNone);
             // The exit fullscreen request will be sent in dispatchEvent().
diff --git a/Source/WebCore/html/HTMLMediaElement.h b/Source/WebCore/html/HTMLMediaElement.h
index c6dc7b4fbdd0..42ac5d8adc80 100644
--- a/Source/WebCore/html/HTMLMediaElement.h
+++ b/Source/WebCore/html/HTMLMediaElement.h
@@ -1024,7 +1024,7 @@ class HTMLMediaElement
 
     // These "internal" functions do not check user gesture restrictions.
     void playInternal();
-    void pauseInternal();
+    void pauseInternal(bool dispatchPauseEvent = true);
     void completePlayInternal();
 
     enum class IsExplicitLoad : bool { No, Yes };
diff --git a/Source/WebCore/html/HTMLOptionElement.cpp b/Source/WebCore/html/HTMLOptionElement.cpp
index 08c4a13d6161..1bde2dab925a 100644
--- a/Source/WebCore/html/HTMLOptionElement.cpp
+++ b/Source/WebCore/html/HTMLOptionElement.cpp
@@ -211,11 +211,11 @@ void HTMLOptionElement::removingSteps(RemovalType removalType, ContainerNode& ol
     }
 }
 
-void HTMLOptionElement::movingSteps(bool isSubtreeRoot, ContainerNode& oldParent)
+void HTMLOptionElement::movingSteps(IsSubtreeRoot isSubtreeRoot, ContainerNode& oldParent)
 {
     HTMLElement::movingSteps(isSubtreeRoot, oldParent);
 
-    if (!isSubtreeRoot)
+    if (isSubtreeRoot == IsSubtreeRoot::No)
         return;
 
     if (!document().settings().htmlEnhancedSelectParsingEnabled())
diff --git a/Source/WebCore/html/HTMLOptionElement.h b/Source/WebCore/html/HTMLOptionElement.h
index 8ade2c0b0dd7..8d513f26c956 100644
--- a/Source/WebCore/html/HTMLOptionElement.h
+++ b/Source/WebCore/html/HTMLOptionElement.h
@@ -87,7 +87,7 @@ class HTMLOptionElement final : public HTMLElement {
 
     NeedsPostConnectionSteps insertionSteps(InsertionType, ContainerNode&) final;
     void removingSteps(RemovalType, ContainerNode& oldParentOfRemovedTree) final;
-    void movingSteps(bool isSubtreeRoot, ContainerNode&) final;
+    void movingSteps(IsSubtreeRoot, ContainerNode&) final;
 
     bool supportsFocus() const final;
     bool isFocusable() const final;
diff --git a/Source/WebCore/html/HTMLSelectElement.cpp b/Source/WebCore/html/HTMLSelectElement.cpp
index b1046e650bf8..63f9ebfe2018 100644
--- a/Source/WebCore/html/HTMLSelectElement.cpp
+++ b/Source/WebCore/html/HTMLSelectElement.cpp
@@ -696,7 +696,7 @@ CompletionHandlerCallingScope HTMLSelectElement::optionToSelectFromChildChangeSc
     };
 
     RefPtr<HTMLOptionElement> optionToSelect;
-    if (change.type == ChildChange::Type::ElementInserted || change.type == ChildChange::Type::ElementAndTextInserted) {
+    if (change.type == ChildChange::Type::ElementInserted || change.type == ChildChange::Type::ElementAndTextInserted || change.type == ChildChange::Type::ElementMovedInto) {
         auto handleInsertedElement = [&](Element& insertedElement) {
             if (auto* option = dynamicDowncast<HTMLOptionElement>(insertedElement)) {
                 if (option->selectedWithoutUpdate())
diff --git a/Source/WebCore/html/HTMLSourceElement.cpp b/Source/WebCore/html/HTMLSourceElement.cpp
index 8fa9cdeaab9a..3120e9932c7d 100644
--- a/Source/WebCore/html/HTMLSourceElement.cpp
+++ b/Source/WebCore/html/HTMLSourceElement.cpp
@@ -124,11 +124,11 @@ void HTMLSourceElement::removingSteps(RemovalType removalType, ContainerNode& ol
     }
 }
 
-void HTMLSourceElement::movingSteps(bool isSubtreeRoot, ContainerNode& oldParent)
+void HTMLSourceElement::movingSteps(IsSubtreeRoot isSubtreeRoot, ContainerNode& oldParent)
 {
     HTMLElement::movingSteps(isSubtreeRoot, oldParent);
 
-    if (!isSubtreeRoot)
+    if (isSubtreeRoot == IsSubtreeRoot::No)
         return;
 
     RefPtr oldParentPicture = dynamicDowncast<HTMLPictureElement>(oldParent);
diff --git a/Source/WebCore/html/HTMLSourceElement.h b/Source/WebCore/html/HTMLSourceElement.h
index b8313a6888bc..c8710b63c76c 100644
--- a/Source/WebCore/html/HTMLSourceElement.h
+++ b/Source/WebCore/html/HTMLSourceElement.h
@@ -60,7 +60,7 @@ class HTMLSourceElement final
     
     NeedsPostConnectionSteps insertionSteps(InsertionType, ContainerNode&) final;
     void removingSteps(RemovalType, ContainerNode&) final;
-    void movingSteps(bool isSubtreeRoot, ContainerNode&) final;
+    void movingSteps(IsSubtreeRoot, ContainerNode&) final;
     void didMoveToNewDocument(Document& oldDocument, Document& newDocument) final;
 
     bool NODELETE isURLAttribute(const Attribute&) const final;
diff --git a/Source/WebCore/html/HTMLVideoElement.cpp b/Source/WebCore/html/HTMLVideoElement.cpp
index 28380c070376..c78dde641434 100644
--- a/Source/WebCore/html/HTMLVideoElement.cpp
+++ b/Source/WebCore/html/HTMLVideoElement.cpp
@@ -158,7 +158,8 @@ void HTMLVideoElement::acceleratedRenderingStateChanged()
 
 bool HTMLVideoElement::supportsAcceleratedRendering() const
 {
-    return RefPtr { player() } && protect(player())->supportsAcceleratedRendering();
+    RefPtr player = this->player();
+    return player && player->supportsAcceleratedRendering();
 }
 
 void HTMLVideoElement::mediaPlayerRenderingModeChanged()
@@ -251,21 +252,22 @@ void HTMLVideoElement::attributeChanged(const QualifiedName& name, const AtomStr
 
 bool HTMLVideoElement::supportsFullscreen(HTMLMediaElementEnums::VideoFullscreenMode videoFullscreenMode) const
 {
-    if (!player())
+    RefPtr player = this->player();
+    if (!player)
         return false;
-    
+
     if (videoFullscreenMode == HTMLMediaElementEnums::VideoFullscreenModePictureInPicture) {
         if (!mediaSession().allowsPictureInPicture())
             return false;
-        if (!protect(player())->supportsPictureInPicture())
+        if (!player->supportsPictureInPicture())
             return false;
     }
 
     RefPtr page = document().page();
-    if (!page) 
+    if (!page)
         return false;
 
-    if (!protect(player())->supportsFullscreen())
+    if (!player->supportsFullscreen())
         return false;
 
 #if HAVE(AVEXPERIENCECONTROLLER)
@@ -289,7 +291,7 @@ bool HTMLVideoElement::supportsFullscreen(HTMLMediaElementEnums::VideoFullscreen
         return true;
 #endif
 
-    if (!protect(player())->hasVideo())
+    if (!player->hasVideo())
         return false;
 
     return page->chrome().client().supportsVideoFullscreen(videoFullscreenMode);
@@ -306,16 +308,18 @@ void HTMLVideoElement::requestFullscreen(FullscreenOptions&&, RefPtr<DeferredPro
 
 unsigned HTMLVideoElement::videoWidth() const
 {
-    if (!player())
+    RefPtr player = this->player();
+    if (!player)
         return 0;
-    return clampToUnsigned(protect(player())->naturalSize().width());
+    return clampToUnsigned(player->naturalSize().width());
 }
 
 unsigned HTMLVideoElement::videoHeight() const
 {
-    if (!player())
+    RefPtr player = this->player();
+    if (!player)
         return 0;
-    return clampToUnsigned(protect(player())->naturalSize().height());
+    return clampToUnsigned(player->naturalSize().height());
 }
 
 void HTMLVideoElement::scheduleResizeEvent(const FloatSize& naturalSize)
@@ -516,18 +520,20 @@ void HTMLVideoElement::didMoveToNewDocument(Document& oldDocument, Document& new
 #if ENABLE(MEDIA_STATISTICS)
 unsigned HTMLVideoElement::webkitDecodedFrameCount() const
 {
-    if (!player())
+    RefPtr player = this->player();
+    if (!player)
         return 0;
 
-    return player()->decodedFrameCount();
+    return player->decodedFrameCount();
 }
 
 unsigned HTMLVideoElement::webkitDroppedFrameCount() const
 {
-    if (!player())
+    RefPtr player = this->player();
+    if (!player)
         return 0;
 
-    return player()->droppedFrameCount();
+    return player->droppedFrameCount();
 }
 #endif
 
diff --git a/Source/WebCore/html/ImageInputType.cpp b/Source/WebCore/html/ImageInputType.cpp
index 1c7f32d0a09e..95eea5720ff0 100644
--- a/Source/WebCore/html/ImageInputType.cpp
+++ b/Source/WebCore/html/ImageInputType.cpp
@@ -179,7 +179,7 @@ unsigned ImageInputType::height() const
 
     CheckedPtr renderer = element->renderer();
     if (renderer)
-        return Style::adjustForAbsoluteZoom(downcast<RenderBox>(*renderer).contentBoxHeight(), *renderer);
+        return Style::unapplyingZoom<int>(downcast<RenderBox>(*renderer).contentBoxHeight(), *renderer);
 
     // Check the attribute first for an explicit pixel value.
     if (auto optionalHeight = parseHTMLNonNegativeInteger(element->attributeWithoutSynchronization(heightAttr)))
@@ -202,7 +202,7 @@ unsigned ImageInputType::width() const
 
     CheckedPtr renderer = element->renderer();
     if (renderer)
-        return Style::adjustForAbsoluteZoom(downcast<RenderBox>(*renderer).contentBoxWidth(), *renderer);
+        return Style::unapplyingZoom<int>(downcast<RenderBox>(*renderer).contentBoxWidth(), *renderer);
 
     // Check the attribute first for an explicit pixel value.
     if (auto optionalWidth = parseHTMLNonNegativeInteger(element->attributeWithoutSynchronization(widthAttr)))
diff --git a/Source/WebCore/html/canvas/CanvasRenderingContext2DBase.cpp b/Source/WebCore/html/canvas/CanvasRenderingContext2DBase.cpp
index 69cd469fc137..6d0e83a9f9cc 100644
--- a/Source/WebCore/html/canvas/CanvasRenderingContext2DBase.cpp
+++ b/Source/WebCore/html/canvas/CanvasRenderingContext2DBase.cpp
@@ -2902,18 +2902,17 @@ static bool canUseCachedShapedText(const TextRun& textRun)
 
 void CanvasRenderingContext2DBase::drawTextUnchecked(const TextRun& textRun, double x, double y, bool fill, std::optional<double> maxWidth)
 {
-    auto& fontCascade = this->fontProxy()->fontCascade();
-    auto& fontMetrics = fontProxy()->metricsOfPrimaryFont();
-
     auto* cachedShapedText = [&]() -> TextShapingResultAndDisplayList* {
         if (!canUseCachedShapedText(textRun))
             return nullptr;
-        RefPtr fonts = fontCascade.fonts();
+
+        CheckedRef fontCascade = fontProxy()->fontCascade();
+        RefPtr fonts = fontCascade->fonts();
         ASSERT(fonts);
         return fonts->getOrCreateCachedShapedText(textRun, fontCascade, 0, std::nullopt, ForTextEmphasis::No);
     }();
 
-    float fontWidth = cachedShapedText ? cachedShapedText->textShapingResult.width : fontCascade.width(textRun);
+    float fontWidth = cachedShapedText ? cachedShapedText->textShapingResult.width : protect(fontProxy()->fontCascade())->width(textRun);
 
     bool useMaxWidth = maxWidth && maxWidth.value() < fontWidth;
     float width = useMaxWidth ? maxWidth.value() : fontWidth;
@@ -2921,22 +2920,26 @@ void CanvasRenderingContext2DBase::drawTextUnchecked(const TextRun& textRun, dou
     location += textOffset(width, textRun.direction());
 
     // The slop built in to this mask rect matches the heuristic used in FontCGWin.cpp for GDI text.
-    FloatRect textRect = FloatRect(location.x() - fontMetrics.intHeight() / 2, location.y() - fontMetrics.intAscent() - fontMetrics.intLineGap(),
-        width + fontMetrics.intHeight(), fontMetrics.intLineSpacing());
+    FloatRect textRect = [&] () {
+        const auto& fontMetrics = fontProxy()->metricsOfPrimaryFont();
+        return FloatRect(
+            location.x() - fontMetrics.intHeight() / 2,
+            location.y() - fontMetrics.intAscent() - fontMetrics.intLineGap(),
+            width + fontMetrics.intHeight(),
+            fontMetrics.intLineSpacing()
+        );
+    }();
     if (!fill)
         textRect = inflatedStrokeRect(textRect);
 
     auto targetSwitcher = CanvasFilterContextSwitcher::create(*this, textRect);
 
-    // FIXME: Need to refetch fontProxy. CanvasFilterContextSwitcher might have called save().
-    // https://bugs.webkit.org/show_bug.cgi?id=193077.
     auto* c = effectiveDrawingContext();
-    auto& fontProxy = *this->fontProxy();
 
     bool cachedDisplayListNeedsStateSave = false;
     // Any shadow could add display list items to draw glyphs a 2nd time with different context attributes.
     if (cachedShapedText && !cachedShapedText->displayList && !cachedShapedText->textShapingResult.glyphBuffer.isEmpty() && !c->dropShadow()) {
-        cachedShapedText->displayList = fontCascade.displayListForGlyphBuffer(*c, cachedShapedText->textShapingResult.glyphBuffer, FontCascade::CustomFontNotReadyAction::UseFallbackIfFontNotReady);
+        cachedShapedText->displayList = protect(fontProxy()->fontCascade())->displayListForGlyphBuffer(*c, cachedShapedText->textShapingResult.glyphBuffer, FontCascade::CustomFontNotReadyAction::UseFallbackIfFontNotReady);
 
         if (cachedShapedText->displayList) {
             for (auto& item : cachedShapedText->displayList->items()) {
@@ -2965,11 +2968,11 @@ void CanvasRenderingContext2DBase::drawTextUnchecked(const TextRun& textRun, dou
                     }
                 } else {
                     FloatPoint startPoint = point + WebCore::size(glyphBuffer.initialAdvance());
-                    fontCascade.drawGlyphBuffer(context, glyphBuffer, startPoint, FontCascade::CustomFontNotReadyAction::UseFallbackIfFontNotReady);
+                    protect(fontProxy()->fontCascade())->drawGlyphBuffer(context, glyphBuffer, startPoint, FontCascade::CustomFontNotReadyAction::UseFallbackIfFontNotReady);
                 }
             }
         } else
-            fontProxy.drawBidiText(context, textRun, point, FontCascade::CustomFontNotReadyAction::UseFallbackIfFontNotReady);
+            fontProxy()->drawBidiText(context, textRun, point, FontCascade::CustomFontNotReadyAction::UseFallbackIfFontNotReady);
     };
 
 #if USE(CG)
diff --git a/Source/WebCore/html/shadow/TextControlInnerElements.cpp b/Source/WebCore/html/shadow/TextControlInnerElements.cpp
index 71ffa68faea4..a1446f0a07f5 100644
--- a/Source/WebCore/html/shadow/TextControlInnerElements.cpp
+++ b/Source/WebCore/html/shadow/TextControlInnerElements.cpp
@@ -141,7 +141,7 @@ std::optional<Style::UnadjustedStyle> TextControlInnerElement::resolveCustomStyl
 
     if (isStrongPasswordTextField(shadowHost())) {
         newStyle->setFlexShrink(0);
-        newStyle->setTextOverflow(TextOverflow::Clip);
+        newStyle->setTextOverflow(CSS::Keyword::Clip { });
         newStyle->setOverflowX(Overflow::Hidden);
         newStyle->setOverflowY(Overflow::Hidden);
 
@@ -241,7 +241,10 @@ std::optional<Style::UnadjustedStyle> TextControlPlaceholderElement::resolveCust
     styleStyle->setDisplay(controlElement->isPlaceholderVisible() ? Style::DisplayType::BlockFlow : Style::DisplayType::None);
 
     if (RefPtr inputElement = dynamicDowncast<HTMLInputElement>(controlElement)) {
-        styleStyle->setTextOverflow(inputElement->shouldTruncateText(*shadowHostStyle) ? TextOverflow::Ellipsis : TextOverflow::Clip);
+        if (inputElement->shouldTruncateText(*shadowHostStyle))
+            styleStyle->setTextOverflow(CSS::Keyword::Ellipsis { });
+        else
+            styleStyle->setTextOverflow(CSS::Keyword::Clip { });
         styleStyle->setPaddingTop(0_css_px);
         styleStyle->setPaddingBottom(0_css_px);
     }
diff --git a/Source/WebCore/inspector/InspectorOverlay.cpp b/Source/WebCore/inspector/InspectorOverlay.cpp
index 94524c7e2cbd..edbe10a2afed 100644
--- a/Source/WebCore/inspector/InspectorOverlay.cpp
+++ b/Source/WebCore/inspector/InspectorOverlay.cpp
@@ -1195,8 +1195,8 @@ Path InspectorOverlay::drawElementTitle(GraphicsContext& context, Node& node, co
     String elementHeight;
     if (is<RenderBoxModelObject>(renderer)) {
         CheckedPtr modelObject = downcast<RenderBoxModelObject>(renderer.get());
-        elementWidth = String::number(Style::adjustForAbsoluteZoom(roundToInt(modelObject->offsetWidth()), *modelObject));
-        elementHeight = String::number(Style::adjustForAbsoluteZoom(roundToInt(modelObject->offsetHeight()), *modelObject));
+        elementWidth = String::number(Style::unapplyingZoom<int>(roundToInt(modelObject->offsetWidth()), *modelObject));
+        elementHeight = String::number(Style::unapplyingZoom<int>(roundToInt(modelObject->offsetHeight()), *modelObject));
     } else {
         RefPtr containingView = node.document().frame()->view();
         IntRect boundingBox = snappedIntRect(containingView->contentsToRootView(renderer->absoluteBoundingBoxRect()));
diff --git a/Source/WebCore/inspector/agents/InspectorAnimationAgent.cpp b/Source/WebCore/inspector/agents/InspectorAnimationAgent.cpp
index 830387e96336..80caeb6903a3 100644
--- a/Source/WebCore/inspector/agents/InspectorAnimationAgent.cpp
+++ b/Source/WebCore/inspector/agents/InspectorAnimationAgent.cpp
@@ -256,7 +256,7 @@ static Ref<Inspector::Protocol::Animation::Effect> buildObjectForEffect(Animatio
 InspectorAnimationAgent::InspectorAnimationAgent(PageAgentContext& context)
     : InspectorAgentBase("Animation"_s, context)
     , m_frontendDispatcher(makeUniqueRef<Inspector::AnimationFrontendDispatcher>(context.frontendRouter))
-    , m_backendDispatcher(Inspector::AnimationBackendDispatcher::create(context.backendDispatcher, this))
+    , m_backendDispatcher(Inspector::AnimationBackendDispatcher::create(protect(context.backendDispatcher), this))
     , m_injectedScriptManager(context.injectedScriptManager)
     , m_inspectedPage(context.inspectedPage)
     , m_animationBindingTimer(*this, &InspectorAnimationAgent::animationBindingTimerFired)
diff --git a/Source/WebCore/inspector/agents/InspectorCPUProfilerAgent.cpp b/Source/WebCore/inspector/agents/InspectorCPUProfilerAgent.cpp
index 44c01eb210f3..a619f4fbf92c 100644
--- a/Source/WebCore/inspector/agents/InspectorCPUProfilerAgent.cpp
+++ b/Source/WebCore/inspector/agents/InspectorCPUProfilerAgent.cpp
@@ -43,7 +43,7 @@ WTF_MAKE_TZONE_ALLOCATED_IMPL(InspectorCPUProfilerAgent);
 InspectorCPUProfilerAgent::InspectorCPUProfilerAgent(PageAgentContext& context)
     : InspectorAgentBase("CPUProfiler"_s, context)
     , m_frontendDispatcher(makeUniqueRef<Inspector::CPUProfilerFrontendDispatcher>(context.frontendRouter))
-    , m_backendDispatcher(Inspector::CPUProfilerBackendDispatcher::create(context.backendDispatcher, this))
+    , m_backendDispatcher(Inspector::CPUProfilerBackendDispatcher::create(protect(context.backendDispatcher), this))
 {
 }
 
diff --git a/Source/WebCore/inspector/agents/InspectorCanvasAgent.cpp b/Source/WebCore/inspector/agents/InspectorCanvasAgent.cpp
index a04a005d742d..973b7ecee804 100644
--- a/Source/WebCore/inspector/agents/InspectorCanvasAgent.cpp
+++ b/Source/WebCore/inspector/agents/InspectorCanvasAgent.cpp
@@ -97,7 +97,7 @@ WTF_MAKE_TZONE_ALLOCATED_IMPL(InspectorCanvasAgent);
 InspectorCanvasAgent::InspectorCanvasAgent(WebAgentContext& context)
     : InspectorAgentBase("Canvas"_s, context)
     , m_frontendDispatcher(makeUniqueRef<Inspector::CanvasFrontendDispatcher>(context.frontendRouter))
-    , m_backendDispatcher(Inspector::CanvasBackendDispatcher::create(context.backendDispatcher, this))
+    , m_backendDispatcher(Inspector::CanvasBackendDispatcher::create(protect(context.backendDispatcher), this))
     , m_injectedScriptManager(context.injectedScriptManager)
     , m_canvasDestroyedTimer(*this, &InspectorCanvasAgent::canvasDestroyedTimerFired)
     , m_programDestroyedTimer(*this, &InspectorCanvasAgent::programDestroyedTimerFired)
diff --git a/Source/WebCore/inspector/agents/InspectorDOMAgent.cpp b/Source/WebCore/inspector/agents/InspectorDOMAgent.cpp
index 72c7abce7355..6ca5b402cb91 100644
--- a/Source/WebCore/inspector/agents/InspectorDOMAgent.cpp
+++ b/Source/WebCore/inspector/agents/InspectorDOMAgent.cpp
@@ -316,7 +316,7 @@ InspectorDOMAgent::InspectorDOMAgent(PageAgentContext& context, InspectorOverlay
     : InspectorAgentBase("DOM"_s, context)
     , m_injectedScriptManager(context.injectedScriptManager)
     , m_frontendDispatcher(makeUniqueRef<Inspector::DOMFrontendDispatcher>(context.frontendRouter))
-    , m_backendDispatcher(Inspector::DOMBackendDispatcher::create(context.backendDispatcher, this))
+    , m_backendDispatcher(Inspector::DOMBackendDispatcher::create(protect(context.backendDispatcher), this))
     , m_inspectedPage(context.inspectedPage)
     , m_overlay(overlay)
     , m_destroyedNodesTimer(*this, &InspectorDOMAgent::destroyedNodesTimerFired)
diff --git a/Source/WebCore/inspector/agents/InspectorDOMDebuggerAgent.cpp b/Source/WebCore/inspector/agents/InspectorDOMDebuggerAgent.cpp
index ee00f876d6a3..a8753c671acd 100644
--- a/Source/WebCore/inspector/agents/InspectorDOMDebuggerAgent.cpp
+++ b/Source/WebCore/inspector/agents/InspectorDOMDebuggerAgent.cpp
@@ -61,7 +61,7 @@ WTF_MAKE_TZONE_ALLOCATED_IMPL(InspectorDOMDebuggerAgent);
 InspectorDOMDebuggerAgent::InspectorDOMDebuggerAgent(WebAgentContext& context, InspectorDebuggerAgent* debuggerAgent)
     : InspectorAgentBase("DOMDebugger"_s, context)
     , m_debuggerAgent(debuggerAgent)
-    , m_backendDispatcher(Inspector::DOMDebuggerBackendDispatcher::create(context.backendDispatcher, this))
+    , m_backendDispatcher(Inspector::DOMDebuggerBackendDispatcher::create(protect(context.backendDispatcher), this))
     , m_injectedScriptManager(context.injectedScriptManager)
 {
     if (m_debuggerAgent)
diff --git a/Source/WebCore/inspector/agents/InspectorDOMStorageAgent.cpp b/Source/WebCore/inspector/agents/InspectorDOMStorageAgent.cpp
index 96c3c30706d7..19f4c7ee5afc 100644
--- a/Source/WebCore/inspector/agents/InspectorDOMStorageAgent.cpp
+++ b/Source/WebCore/inspector/agents/InspectorDOMStorageAgent.cpp
@@ -61,7 +61,7 @@ WTF_MAKE_TZONE_ALLOCATED_IMPL(InspectorDOMStorageAgent);
 InspectorDOMStorageAgent::InspectorDOMStorageAgent(PageAgentContext& context)
     : InspectorAgentBase("DOMStorage"_s, context)
     , m_frontendDispatcher(makeUniqueRef<Inspector::DOMStorageFrontendDispatcher>(context.frontendRouter))
-    , m_backendDispatcher(Inspector::DOMStorageBackendDispatcher::create(context.backendDispatcher, this))
+    , m_backendDispatcher(Inspector::DOMStorageBackendDispatcher::create(protect(context.backendDispatcher), this))
     , m_inspectedPage(context.inspectedPage)
 {
 }
diff --git a/Source/WebCore/inspector/agents/InspectorLayerTreeAgent.cpp b/Source/WebCore/inspector/agents/InspectorLayerTreeAgent.cpp
index 7316ee07b7e9..426b56692282 100644
--- a/Source/WebCore/inspector/agents/InspectorLayerTreeAgent.cpp
+++ b/Source/WebCore/inspector/agents/InspectorLayerTreeAgent.cpp
@@ -59,7 +59,7 @@ WTF_MAKE_TZONE_ALLOCATED_IMPL(InspectorLayerTreeAgent);
 InspectorLayerTreeAgent::InspectorLayerTreeAgent(WebAgentContext& context)
     : InspectorAgentBase("LayerTree"_s, context)
     , m_frontendDispatcher(makeUniqueRef<Inspector::LayerTreeFrontendDispatcher>(context.frontendRouter))
-    , m_backendDispatcher(Inspector::LayerTreeBackendDispatcher::create(context.backendDispatcher, this))
+    , m_backendDispatcher(Inspector::LayerTreeBackendDispatcher::create(protect(context.backendDispatcher), this))
 {
 }
 
diff --git a/Source/WebCore/inspector/agents/InspectorMemoryAgent.cpp b/Source/WebCore/inspector/agents/InspectorMemoryAgent.cpp
index 2d8b9c5a479a..5509e7b2f8ad 100644
--- a/Source/WebCore/inspector/agents/InspectorMemoryAgent.cpp
+++ b/Source/WebCore/inspector/agents/InspectorMemoryAgent.cpp
@@ -44,7 +44,7 @@ WTF_MAKE_TZONE_ALLOCATED_IMPL(InspectorMemoryAgent);
 InspectorMemoryAgent::InspectorMemoryAgent(PageAgentContext& context)
     : InspectorAgentBase("Memory"_s, context)
     , m_frontendDispatcher(makeUniqueRef<Inspector::MemoryFrontendDispatcher>(context.frontendRouter))
-    , m_backendDispatcher(Inspector::MemoryBackendDispatcher::create(context.backendDispatcher, this))
+    , m_backendDispatcher(Inspector::MemoryBackendDispatcher::create(protect(context.backendDispatcher), this))
 {
 }
 
diff --git a/Source/WebCore/inspector/agents/InspectorNetworkAgent.cpp b/Source/WebCore/inspector/agents/InspectorNetworkAgent.cpp
index 7e67b6e8ea05..9e91fd5d4874 100644
--- a/Source/WebCore/inspector/agents/InspectorNetworkAgent.cpp
+++ b/Source/WebCore/inspector/agents/InspectorNetworkAgent.cpp
@@ -125,7 +125,7 @@ Ref<Inspector::Protocol::Network::WebSocketFrame> buildWebSocketMessage(const We
 InspectorNetworkAgent::InspectorNetworkAgent(WebAgentContext& context, const NetworkResourcesData::Settings& networkResourcesDataSettings)
     : Inspector::NetworkAgentInstrumentation(context)
     , m_frontendDispatcher(makeUniqueRef<Inspector::NetworkFrontendDispatcher>(context.frontendRouter))
-    , m_backendDispatcher(Inspector::NetworkBackendDispatcher::create(context.backendDispatcher, this))
+    , m_backendDispatcher(Inspector::NetworkBackendDispatcher::create(protect(context.backendDispatcher), this))
     , m_injectedScriptManager(context.injectedScriptManager)
     , m_resourcesData(makeUniqueRef<NetworkResourcesData>(networkResourcesDataSettings))
 {
diff --git a/Source/WebCore/inspector/agents/InspectorTimelineAgent.cpp b/Source/WebCore/inspector/agents/InspectorTimelineAgent.cpp
index 6ea506fd4a12..be2f00e1678d 100644
--- a/Source/WebCore/inspector/agents/InspectorTimelineAgent.cpp
+++ b/Source/WebCore/inspector/agents/InspectorTimelineAgent.cpp
@@ -64,7 +64,7 @@ WTF_MAKE_TZONE_ALLOCATED_IMPL(InspectorTimelineAgent);
 InspectorTimelineAgent::InspectorTimelineAgent(WebAgentContext& context)
     : InspectorAgentBase("Timeline"_s, context)
     , m_frontendDispatcher(makeUniqueRef<Inspector::TimelineFrontendDispatcher>(context.frontendRouter))
-    , m_backendDispatcher(Inspector::TimelineBackendDispatcher::create(context.backendDispatcher, this))
+    , m_backendDispatcher(Inspector::TimelineBackendDispatcher::create(protect(context.backendDispatcher), this))
 {
 }
 
diff --git a/Source/WebCore/inspector/agents/InspectorWorkerAgent.cpp b/Source/WebCore/inspector/agents/InspectorWorkerAgent.cpp
index d485f88ba311..c7a1493ead31 100644
--- a/Source/WebCore/inspector/agents/InspectorWorkerAgent.cpp
+++ b/Source/WebCore/inspector/agents/InspectorWorkerAgent.cpp
@@ -40,7 +40,7 @@ InspectorWorkerAgent::InspectorWorkerAgent(WebAgentContext& context)
     : InspectorAgentBase("Worker"_s, context)
     , m_pageChannel(PageChannel::create(*this))
     , m_frontendDispatcher(makeUniqueRef<Inspector::WorkerFrontendDispatcher>(context.frontendRouter))
-    , m_backendDispatcher(Inspector::WorkerBackendDispatcher::create(context.backendDispatcher, this))
+    , m_backendDispatcher(Inspector::WorkerBackendDispatcher::create(protect(context.backendDispatcher), this))
 {
 }
 
diff --git a/Source/WebCore/inspector/agents/worker/ServiceWorkerAgent.cpp b/Source/WebCore/inspector/agents/worker/ServiceWorkerAgent.cpp
index 977b678348f0..25735d9675b8 100644
--- a/Source/WebCore/inspector/agents/worker/ServiceWorkerAgent.cpp
+++ b/Source/WebCore/inspector/agents/worker/ServiceWorkerAgent.cpp
@@ -40,7 +40,7 @@ WTF_MAKE_TZONE_ALLOCATED_IMPL(ServiceWorkerAgent);
 ServiceWorkerAgent::ServiceWorkerAgent(WorkerAgentContext& context)
     : InspectorAgentBase("ServiceWorker"_s, context)
     , m_serviceWorkerGlobalScope(downcast<ServiceWorkerGlobalScope>(context.globalScope.get()))
-    , m_backendDispatcher(Inspector::ServiceWorkerBackendDispatcher::create(context.backendDispatcher, this))
+    , m_backendDispatcher(Inspector::ServiceWorkerBackendDispatcher::create(protect(context.backendDispatcher), this))
 {
     ASSERT(context.globalScope->isContextThread());
 }
diff --git a/Source/WebCore/inspector/agents/worker/WorkerRuntimeAgent.cpp b/Source/WebCore/inspector/agents/worker/WorkerRuntimeAgent.cpp
index 8a4f3266724a..363b939135d3 100644
--- a/Source/WebCore/inspector/agents/worker/WorkerRuntimeAgent.cpp
+++ b/Source/WebCore/inspector/agents/worker/WorkerRuntimeAgent.cpp
@@ -47,7 +47,7 @@ WTF_MAKE_TZONE_ALLOCATED_IMPL(WorkerRuntimeAgent);
 
 WorkerRuntimeAgent::WorkerRuntimeAgent(WorkerAgentContext& context)
     : InspectorRuntimeAgent(context)
-    , m_backendDispatcher(RuntimeBackendDispatcher::create(context.backendDispatcher, this))
+    , m_backendDispatcher(RuntimeBackendDispatcher::create(protect(context.backendDispatcher), this))
     , m_globalScope(context.globalScope)
 {
     ASSERT(context.globalScope->isContextThread());
diff --git a/Source/WebCore/layout/formattingContexts/inline/InlineFormattingUtils.cpp b/Source/WebCore/layout/formattingContexts/inline/InlineFormattingUtils.cpp
index 3d79bf56ab18..ba051368915e 100644
--- a/Source/WebCore/layout/formattingContexts/inline/InlineFormattingUtils.cpp
+++ b/Source/WebCore/layout/formattingContexts/inline/InlineFormattingUtils.cpp
@@ -601,7 +601,7 @@ LineEndingTruncationPolicy InlineFormattingUtils::lineEndingTruncationPolicy(con
     }
 
     // Truncation is in effect when the block container has overflow other than visible.
-    if (rootStyle.overflowX() != Overflow::Visible && rootStyle.textOverflow() == TextOverflow::Ellipsis)
+    if (rootStyle.overflowX() != Overflow::Visible && !rootStyle.textOverflow().isClip())
         return LineEndingTruncationPolicy::WhenContentOverflowsInInlineDirection;
     return LineEndingTruncationPolicy::NoTruncation;
 }
diff --git a/Source/WebCore/layout/formattingContexts/inline/display/InlineDisplayContentBuilder.cpp b/Source/WebCore/layout/formattingContexts/inline/display/InlineDisplayContentBuilder.cpp
index 76a03fb2c5ac..a61697043396 100644
--- a/Source/WebCore/layout/formattingContexts/inline/display/InlineDisplayContentBuilder.cpp
+++ b/Source/WebCore/layout/formattingContexts/inline/display/InlineDisplayContentBuilder.cpp
@@ -1223,20 +1223,34 @@ void InlineDisplayContentBuilder::collectInkOverflowForTextDecorations(std::span
         if (!displayBox.isText())
             continue;
 
-        CheckedRef parentStyle = displayBox.layoutBox().parent().style();
-        auto textDecorations = parentStyle->textDecorationLineInEffect();
-        if (!textDecorations)
-            continue;
-
+        // Note that decoration properties are not inherited but propagated
         auto decorationOverflow = [&] {
-            if (!textDecorations.hasUnderline())
-                return inkOverflowForDecorations(parentStyle);
-
-            if (!logicalBottomForTextDecoration)
-                logicalBottomForTextDecoration = logicalBottomForTextDecorationContent(boxes, isHorizontalWritingMode);
-            auto textRunLogicalOffsetFromLineBottom = *logicalBottomForTextDecoration - (isHorizontalWritingMode ? displayBox.bottom() : displayBox.right());
-            auto textRunLogicalHeight = isHorizontalWritingMode ? displayBox.height() : displayBox.width();
-            return inkOverflowForDecorations(parentStyle, { textRunLogicalHeight, textRunLogicalOffsetFromLineBottom });
+            auto overflowForDecoratingBox = [&](auto& decoratingBoxStyle) {
+                if (!decoratingBoxStyle.textDecorationLineInEffect().hasUnderline())
+                    return inkOverflowForDecorations(decoratingBoxStyle);
+
+                if (!logicalBottomForTextDecoration)
+                    logicalBottomForTextDecoration = logicalBottomForTextDecorationContent(boxes, isHorizontalWritingMode);
+                auto textRunLogicalOffsetFromLineBottom = *logicalBottomForTextDecoration - (isHorizontalWritingMode ? displayBox.bottom() : displayBox.right());
+                auto textRunLogicalHeight = isHorizontalWritingMode ? displayBox.height() : displayBox.width();
+                return inkOverflowForDecorations(decoratingBoxStyle, { textRunLogicalHeight, textRunLogicalOffsetFromLineBottom });
+            };
+
+            // Several ancestors may each decorate this text box, which then has to accommodate whichever of them overflows it the most on each side.
+            auto maximumOverflow = InkOverflowForDecorations { };
+            for (CheckedPtr box = &displayBox.layoutBox().parent(); box; box = &box->parent()) {
+                CheckedRef style = isFirstFormattedLine() ? box->firstLineStyle() : box->style();
+                if (style->textDecorationLine()) {
+                    auto overflow = overflowForDecoratingBox(style.get());
+                    maximumOverflow.top() = std::max(maximumOverflow.top(), overflow.top());
+                    maximumOverflow.right() = std::max(maximumOverflow.right(), overflow.right());
+                    maximumOverflow.bottom() = std::max(maximumOverflow.bottom(), overflow.bottom());
+                    maximumOverflow.left() = std::max(maximumOverflow.left(), overflow.left());
+                }
+                if (box == &root())
+                    break;
+            }
+            return maximumOverflow;
         }();
 
         if (!decorationOverflow.isZero()) {
diff --git a/Source/WebCore/layout/formattingContexts/inline/display/InlineDisplayLineBuilder.cpp b/Source/WebCore/layout/formattingContexts/inline/display/InlineDisplayLineBuilder.cpp
index 2fa8843e048d..3d614bad3977 100644
--- a/Source/WebCore/layout/formattingContexts/inline/display/InlineDisplayLineBuilder.cpp
+++ b/Source/WebCore/layout/formattingContexts/inline/display/InlineDisplayLineBuilder.cpp
@@ -494,7 +494,20 @@ std::optional<InlineDisplay::Line::Ellipsis> InlineDisplayLineBuilder::applyElli
         return { };
 
     auto ellipsisText = [&] -> AtomString {
-        if (truncationPolicy == LineEndingTruncationPolicy::WhenContentOverflowsInInlineDirection || isLegacyLineClamp) {
+        if (truncationPolicy == LineEndingTruncationPolicy::WhenContentOverflowsInInlineDirection) {
+            return WTF::switchOn(displayBoxes[0].layoutBox().style().textOverflow(),
+                [&](const CSS::Keyword::Clip&) -> AtomString {
+                    return nullAtom();
+                },
+                [&](const CSS::Keyword::Ellipsis&) -> AtomString {
+                    return TextUtil::ellipsisTextInInlineDirection(displayLine.isHorizontal());
+                },
+                [&](const Style::String& string) -> AtomString {
+                    return AtomString { string.value };
+                }
+            );
+        }
+        if (isLegacyLineClamp) {
             // Legacy line clamp always uses ...
             return TextUtil::ellipsisTextInInlineDirection(displayLine.isHorizontal());
         }
diff --git a/Source/WebCore/layout/integration/LayoutIntegrationBoxTreeUpdater.cpp b/Source/WebCore/layout/integration/LayoutIntegrationBoxTreeUpdater.cpp
index 9b12110248d2..99a81dcc4111 100644
--- a/Source/WebCore/layout/integration/LayoutIntegrationBoxTreeUpdater.cpp
+++ b/Source/WebCore/layout/integration/LayoutIntegrationBoxTreeUpdater.cpp
@@ -190,7 +190,7 @@ void BoxTreeUpdater::adjustStyleIfNeeded(const RenderElement& renderer, Style::C
                 CheckedRef anonBlockParentStyle = renderer.parent()->style();
                 // overflow and text-overflow property values don't get forwarded to anonymous block boxes.
                 // e.g. <div style="overflow: hidden; text-overflow: ellipsis; width: 100px; white-space: pre;">this text should have ellipsis<div></div></div>
-                styleToAdjust.setTextOverflow(anonBlockParentStyle->textOverflow());
+                styleToAdjust.setTextOverflow(Style::TextOverflow { anonBlockParentStyle->textOverflow() });
                 styleToAdjust.setOverflowX(anonBlockParentStyle->overflowX());
                 styleToAdjust.setOverflowY(anonBlockParentStyle->overflowY());
             }
diff --git a/Source/WebCore/layout/integration/inline/InlineIteratorLineBoxModernPath.h b/Source/WebCore/layout/integration/inline/InlineIteratorLineBoxModernPath.h
index d6b752f8c486..8afec3af7c6f 100644
--- a/Source/WebCore/layout/integration/inline/InlineIteratorLineBoxModernPath.h
+++ b/Source/WebCore/layout/integration/inline/InlineIteratorLineBoxModernPath.h
@@ -55,7 +55,11 @@ class LineBoxIteratorModernPath {
 
     bool hasEllipsis() const { return line().hasEllipsis(); }
     FloatRect ellipsisVisualRectIgnoringBlockDirection() const { return lineEllipsis().visualRect; }
-    TextRun ellipsisText() const { return TextRun { lineEllipsis().text.string() }; }
+    TextRun ellipsisText() const
+    {
+        return TextRun { lineEllipsis().text.string(), 0, 0, ExpansionBehavior::defaultBehavior(),
+            line().isLeftToRightInlineDirection() ? TextDirection::LTR : TextDirection::RTL };
+    }
 
     float contentLogicalTopAdjustedForPrecedingLineBox() const
     {
diff --git a/Source/WebCore/layout/integration/inline/LayoutIntegrationInlineContentBuilder.cpp b/Source/WebCore/layout/integration/inline/LayoutIntegrationInlineContentBuilder.cpp
index 5e855cb84bde..8b8501677f5a 100644
--- a/Source/WebCore/layout/integration/inline/LayoutIntegrationInlineContentBuilder.cpp
+++ b/Source/WebCore/layout/integration/inline/LayoutIntegrationInlineContentBuilder.cpp
@@ -141,6 +141,7 @@ void InlineContentBuilder::adjustDisplayLines(InlineContent& inlineContent, size
 
     auto blockScrollableOverflowRect = FloatRect { };
     auto blockInkOverflowRect = FloatRect { };
+    auto decoratingBoxesWithNegativePercentageInset = DecoratingBoxes { };
 
     for (size_t lineIndex = 0; lineIndex < startIndex; ++lineIndex) {
         auto& line = lines[lineIndex];
@@ -188,6 +189,13 @@ void InlineContentBuilder::adjustDisplayLines(InlineContent& inlineContent, size
         auto lastTextBoxIndex = std::optional<size_t> { };
         for (; boxIndex < boxes.size() && boxes[boxIndex].lineIndex() == lineIndex; ++boxIndex) {
             auto& box = boxes[boxIndex];
+
+            if (box.isInlineBox()) {
+                CheckedRef decoratingBoxStyle = box.style();
+                if (decoratingBoxStyle->textDecorationLineInEffect() && decoratingBoxStyle->textDecorationInset().hasNegativePercentage())
+                    decoratingBoxesWithNegativePercentageInset.add(CheckedRef { box.layoutBox() });
+            }
+
             if (box.isRootInlineBox() || box.isEllipsis() || box.isLineBreak())
                 continue;
 
@@ -256,6 +264,86 @@ void InlineContentBuilder::adjustDisplayLines(InlineContent& inlineContent, size
     }
     inlineContent.setScrollableOverflow(blockScrollableOverflowRect);
     inlineContent.setInkOverflow(blockInkOverflowRect);
+
+    if (!decoratingBoxesWithNegativePercentageInset.isEmpty())
+        adjustInkOverflowForPercentageTextDecorationInsets(inlineContent, startIndex, decoratingBoxesWithNegativePercentageInset);
+}
+
+void InlineContentBuilder::adjustInkOverflowForPercentageTextDecorationInsets(InlineContent& inlineContent, size_t startIndex, const DecoratingBoxes& decoratingBoxes) const
+{
+    // A negative 'text-decoration-inset' extends the decoration past the text box, and that overhang has to be in the ink overflow or it gets clipped.
+    // When the inset is a percentage it resolves against the inline size of the whole decorating box (for box-decoration-break: slice), which spans every fragment
+    // of that box and so is only known once all the lines are built.
+    auto& lines = inlineContent.displayContent().lines;
+    auto& boxes = inlineContent.displayContent().boxes;
+    auto isHorizontalWritingMode = m_blockFlow.writingMode().isHorizontal();
+
+    auto inlineSizeForEachDecoratingBox = [&] {
+        auto inlineSizes = HashMap<CheckedRef<const Layout::Box>, float> { };
+        for (auto& box : boxes) {
+            if (!box.isNonRootInlineBox())
+                continue;
+            CheckedRef layoutBox { box.layoutBox() };
+            if (!decoratingBoxes.contains(layoutBox))
+                continue;
+            inlineSizes.add(layoutBox, 0.f).iterator->value += isHorizontalWritingMode ? box.width() : box.height();
+        }
+        return inlineSizes;
+    };
+
+    auto outwardInsetForEachDecoratingBox = [&] {
+        auto inlineSizes = inlineSizeForEachDecoratingBox();
+        auto outwardInsets = HashMap<CheckedRef<const Layout::Box>, float> { };
+        for (auto& decoratingBox : decoratingBoxes) {
+            auto inlineSize = [&] {
+                if (decoratingBox->isInlineBox())
+                    return inlineSizes.getOptional(decoratingBox).value_or(0.f);
+                auto blockContainerInlineSize = 0.f;
+                for (auto& line : lines)
+                    blockContainerInlineSize += line.contentLogicalWidth();
+                return blockContainerInlineSize;
+            }();
+
+            CheckedRef style = decoratingBox->style();
+            if (auto outwardInset = style->textDecorationInset().outwardExtent(style, inlineSize))
+                outwardInsets.add(decoratingBox, outwardInset);
+        }
+        return outwardInsets;
+    };
+    auto outwardInsets = outwardInsetForEachDecoratingBox();
+    if (outwardInsets.isEmpty()) {
+        ASSERT_NOT_REACHED();
+        return;
+    }
+
+    auto blockInkOverflowRect = inlineContent.inkOverflow();
+    auto boxIndex = !startIndex ? 0 : lines[startIndex - 1].lastBoxIndex() + 1;
+    for (size_t lineIndex = startIndex; lineIndex < lines.size(); ++lineIndex) {
+        auto& line = lines[lineIndex];
+
+        auto outwardInsetOnLine = [&] {
+            auto largestOutwardInset = 0.f;
+            for (; boxIndex < boxes.size() && boxes[boxIndex].lineIndex() == lineIndex; ++boxIndex) {
+                auto& box = boxes[boxIndex];
+                if (!box.isInlineBox())
+                    continue;
+                if (auto outwardInset = outwardInsets.getOptional(CheckedRef { box.layoutBox() }))
+                    largestOutwardInset = std::max(largestOutwardInset, *outwardInset);
+            }
+            return largestOutwardInset;
+        };
+
+        auto outwardInset = outwardInsetOnLine();
+        if (!outwardInset)
+            continue;
+
+        auto lineInkOverflowRect = line.inkOverflow();
+        auto expansion = ceilf(outwardInset);
+        isHorizontalWritingMode ? lineInkOverflowRect.inflate(expansion, 0.f, expansion, 0.f) : lineInkOverflowRect.inflate(0.f, expansion, 0.f, expansion);
+        line.setInkOverflow(lineInkOverflowRect);
+        blockInkOverflowRect.unite(lineInkOverflowRect);
+    }
+    inlineContent.setInkOverflow(blockInkOverflowRect);
 }
 
 void InlineContentBuilder::computeIsFirstIsLastBoxAndBidiReorderingForInlineContent(InlineDisplay::Boxes& boxes) const
diff --git a/Source/WebCore/layout/integration/inline/LayoutIntegrationInlineContentBuilder.h b/Source/WebCore/layout/integration/inline/LayoutIntegrationInlineContentBuilder.h
index 73d6e93e1e7c..6ea7e031e53e 100644
--- a/Source/WebCore/layout/integration/inline/LayoutIntegrationInlineContentBuilder.h
+++ b/Source/WebCore/layout/integration/inline/LayoutIntegrationInlineContentBuilder.h
@@ -46,6 +46,8 @@ class InlineContentBuilder {
 
 private:
     void adjustDisplayLines(InlineContent&, size_t startIndex) const;
+    using DecoratingBoxes = HashSet<CheckedRef<const Layout::Box>>;
+    void adjustInkOverflowForPercentageTextDecorationInsets(InlineContent&, size_t startIndex, const DecoratingBoxes&) const;
     void computeIsFirstIsLastBoxAndBidiReorderingForInlineContent(InlineDisplay::Boxes&) const;
     FloatRect handlePartialDisplayContentUpdate(Layout::InlineLayoutResult&&, InlineContent&, const Layout::InlineDamage*) const;
 
diff --git a/Source/WebCore/loader/DocumentThreadableLoader.cpp b/Source/WebCore/loader/DocumentThreadableLoader.cpp
index 90e9f506335b..f675afeed7ae 100644
--- a/Source/WebCore/loader/DocumentThreadableLoader.cpp
+++ b/Source/WebCore/loader/DocumentThreadableLoader.cpp
@@ -132,8 +132,6 @@ DocumentThreadableLoader::DocumentThreadableLoader(Document& document, Threadabl
     , m_crossOriginEmbedderPolicy(WTF::move(crossOriginEmbedderPolicy))
     , m_shouldLogError(shouldLogError)
 {
-    relaxAdoptionRequirement();
-
     // Setting a referrer header is only supported in the async code path.
     ASSERT(m_async || m_referrer.isEmpty());
 
diff --git a/Source/WebCore/page/Frame.cpp b/Source/WebCore/page/Frame.cpp
index 35fce1e5c23b..45c25db33654 100644
--- a/Source/WebCore/page/Frame.cpp
+++ b/Source/WebCore/page/Frame.cpp
@@ -126,7 +126,6 @@ Frame::Frame(Page& page, FrameIdentifier frameID, FrameType frameType, HTMLFrame
     , m_opener(opener)
     , m_frameTreeSyncData(WTF::move(frameTreeSyncData))
 {
-    relaxAdoptionRequirement();
     if (parent && addToFrameTree == AddToFrameTree::Yes)
         parent->tree().appendChild(*this);
 
@@ -359,6 +358,11 @@ void Frame::updateFrameTreeSyncData(Ref<FrameTreeSyncData>&& data)
 
 void Frame::updateFrameTreeSyncData(const FrameTreeSyncSerializationData& data)
 {
+    if (static_cast<FrameTreeSyncDataType>(data.value.index()) != FrameTreeSyncDataType::FrameGeometry) {
+        protect(frameTreeSyncData())->update(data);
+        return;
+    }
+
     auto invalidateChildFrameForDarkAppearanceChange = [&](const auto& oldMap, const auto& newMap) {
         for (RefPtr child = tree().firstChild(); child; child = child->tree().nextSibling()) {
             RefPtr localChild = dynamicDowncast<LocalFrame>(child);
@@ -370,6 +374,8 @@ void Frame::updateFrameTreeSyncData(const FrameTreeSyncSerializationData& data)
 
             if (!oldFrameInfo || !newFrameInfo || oldFrameInfo->ownerElementAppearance().contains(FrameOwnerElementAppearance::IsDark) != newFrameInfo->ownerElementAppearance().contains(FrameOwnerElementAppearance::IsDark)) {
                 RefPtr localChildView = localChild->view();
+                if (!localChildView)
+                    continue;
 
                 localChildView->invalidateForFrameOwnerColorSchemeChange();
                 protect(localChildView->layoutContext())->scheduleLayout();
@@ -377,11 +383,11 @@ void Frame::updateFrameTreeSyncData(const FrameTreeSyncSerializationData& data)
         }
     };
 
-    auto oldChildrenFrameLayoutMap = m_frameTreeSyncData->childrenFrameLayoutInfo;
+    auto oldChildrenFrameLayoutMap = m_frameTreeSyncData->frameGeometry.childrenFrameLayoutInfo;
 
     protect(frameTreeSyncData())->update(data);
 
-    invalidateChildFrameForDarkAppearanceChange(oldChildrenFrameLayoutMap, m_frameTreeSyncData->childrenFrameLayoutInfo);
+    invalidateChildFrameForDarkAppearanceChange(oldChildrenFrameLayoutMap, m_frameTreeSyncData->frameGeometry.childrenFrameLayoutInfo);
 }
 
 bool Frame::frameCanCreatePaymentSession() const
diff --git a/Source/WebCore/page/FrameGeometrySyncData.cpp b/Source/WebCore/page/FrameGeometrySyncData.cpp
new file mode 100644
index 000000000000..037019559188
--- /dev/null
+++ b/Source/WebCore/page/FrameGeometrySyncData.cpp
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2026 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "FrameGeometrySyncData.h"
+
+#include <wtf/TZoneMallocInlines.h>
+#include <wtf/text/TextStream.h>
+
+namespace WebCore {
+
+WTF_MAKE_STRUCT_TZONE_ALLOCATED_IMPL(FrameGeometrySyncData);
+
+WTF::TextStream& operator<<(WTF::TextStream& ts, const FrameGeometrySyncData& data)
+{
+    WTF::TextStream::GroupScope scope(ts);
+    ts << "FrameGeometrySyncData"_s;
+    ts.dumpProperty("layoutViewportRect"_s, data.layoutViewportRect);
+    ts.dumpProperty("contentsSize"_s, data.contentsSize);
+    ts.dumpProperty("childrenFrameLayoutInfo"_s, data.childrenFrameLayoutInfo);
+    return ts;
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/page/FrameGeometrySyncData.h b/Source/WebCore/page/FrameGeometrySyncData.h
new file mode 100644
index 000000000000..42f26b1ad48b
--- /dev/null
+++ b/Source/WebCore/page/FrameGeometrySyncData.h
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2026 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include <WebCore/FrameIdentifier.h>
+#include <WebCore/IntSize.h>
+#include <WebCore/LayoutRect.h>
+#include <WebCore/RemoteFrameLayoutInfo.h>
+#include <wtf/HashMap.h>
+#include <wtf/TZoneMalloc.h>
+
+namespace WTF {
+class TextStream;
+}
+
+namespace WebCore {
+
+struct FrameGeometrySyncData {
+    WTF_MAKE_STRUCT_TZONE_ALLOCATED_EXPORT(FrameGeometrySyncData, WEBCORE_EXPORT);
+
+    LayoutRect layoutViewportRect;
+    IntSize contentsSize;
+    HashMap<FrameIdentifier, Ref<RemoteFrameLayoutInfo>> childrenFrameLayoutInfo;
+};
+
+WEBCORE_EXPORT WTF::TextStream& operator<<(WTF::TextStream&, const FrameGeometrySyncData&);
+
+} // namespace WebCore
diff --git a/Source/WebCore/page/FrameTreeSyncData.in b/Source/WebCore/page/FrameTreeSyncData.in
index 3bfcaa2ecc29..e6b6ca7ebbd6 100644
--- a/Source/WebCore/page/FrameTreeSyncData.in
+++ b/Source/WebCore/page/FrameTreeSyncData.in
@@ -36,9 +36,4 @@ FrameScrollPosition : WebCore::ScrollPosition [Headers=<WebCore/ScrollTypes.h>]
 
 ## Layout information for Intersection Observer
 
-FrameLayoutViewportRect : WebCore::LayoutRect [Headers=<WebCore/LayoutRect.h>]
-
-FrameContentsSize : WebCore::IntSize [Headers=<WebCore/IntSize.h>]
-
-# Collection of layout info regarding children frames of this frame.
-ChildrenFrameLayoutInfo : HashMap<WebCore::FrameIdentifier, Ref<WebCore::RemoteFrameLayoutInfo>> [Headers=<WebCore/FrameIdentifier.h>,<WebCore/RemoteFrameLayoutInfo.h>]
+FrameGeometry : WebCore::FrameGeometrySyncData [Headers=<WebCore/FrameGeometrySyncData.h>]
diff --git a/Source/WebCore/page/LocalFrameView.cpp b/Source/WebCore/page/LocalFrameView.cpp
index ebdc74076023..2f2b2e242948 100644
--- a/Source/WebCore/page/LocalFrameView.cpp
+++ b/Source/WebCore/page/LocalFrameView.cpp
@@ -2050,16 +2050,6 @@ LayoutRect LocalFrameView::layoutViewportRect() const
     return LayoutRect(m_layoutViewportOrigin, baseLayoutViewportSize());
 }
 
-void LocalFrameView::updateLayoutViewportRect()
-{
-    m_frame->loader().client().broadcastFrameLayoutViewportRectToOtherProcesses(layoutViewportRect());
-}
-
-void LocalFrameView::updateContentsSizeForRemoteFrames()
-{
-    m_frame->loader().client().broadcastFrameContentsSizeToOtherProcesses(contentsSize());
-}
-
 // visibleContentRect is in the bounds of the scroll view content. That consists of an
 // optional header, the document, and an optional footer. Only the document is scaled,
 // so we have to compute the visible part of the document in unscaled document coordinates.
diff --git a/Source/WebCore/page/LocalFrameView.h b/Source/WebCore/page/LocalFrameView.h
index 05a0597d96f2..404628d05be6 100644
--- a/Source/WebCore/page/LocalFrameView.h
+++ b/Source/WebCore/page/LocalFrameView.h
@@ -321,8 +321,6 @@ class LocalFrameView final : public FrameView {
 
     // These are in document coordinates, unaffected by page scale (but affected by zooming).
     WEBCORE_EXPORT LayoutRect layoutViewportRect() const final;
-    void updateLayoutViewportRect();
-    void updateContentsSizeForRemoteFrames();
     WEBCORE_EXPORT LayoutRect visualViewportRect() const;
 
     LayoutRect layoutViewportRectIncludingObscuredInsets() const;
diff --git a/Source/WebCore/page/Page.cpp b/Source/WebCore/page/Page.cpp
index 791e1ee2d55e..15e2ad8f7b83 100644
--- a/Source/WebCore/page/Page.cpp
+++ b/Source/WebCore/page/Page.cpp
@@ -367,7 +367,6 @@ static constexpr OptionSet<ActivityState> pageInitialActivityState()
 
 GCC_MAYBE_NO_INLINE static Ref<Frame> createMainFrame(Page& page, PageConfiguration::MainFrameCreationParameters&& clientCreator, RefPtr<Frame> mainFrameOpener, FrameIdentifier identifier, Ref<FrameTreeSyncData>&& frameTreeSyncData)
 {
-    page.relaxAdoptionRequirement();
     return switchOn(WTF::move(clientCreator), [&] (PageConfiguration::LocalMainFrameCreationParameters&& creationParameters) -> Ref<Frame> {
         return LocalFrame::createMainFrame(page, WTF::move(creationParameters.clientCreator), identifier, creationParameters.effectiveSandboxFlags, creationParameters.effectiveReferrerPolicy, mainFrameOpener.get(), WTF::move(frameTreeSyncData));
     }, [&] (CompletionHandler<UniqueRef<RemoteFrameClient>(RemoteFrame&)>&& remoteFrameClientCreator) -> Ref<Frame> {
@@ -2273,9 +2272,6 @@ void Page::syncLocalFrameInfoToRemote()
     forEachLocalFrame([] (LocalFrame& frame) {
         RefPtr<LocalFrameView> frameView = frame.view();
 
-        frameView->updateLayoutViewportRect();
-        frameView->updateContentsSizeForRemoteFrames();
-
         HashMap<FrameIdentifier, Ref<RemoteFrameLayoutInfo>> childrenFrameLayoutInfo;
         auto windowClipRectInContentCoordinates = [&frameView, rect = std::optional<LayoutRect> { }]() mutable {
             if (!rect)
@@ -2319,7 +2315,11 @@ void Page::syncLocalFrameInfoToRemote()
             ));
         }
 
-        frame.loader().client().broadcastChildrenFrameLayoutInfoToOtherProcesses(childrenFrameLayoutInfo);
+        frame.loader().client().broadcastFrameGeometryToOtherProcesses({
+            frameView->layoutViewportRect(),
+            frameView->contentsSize(),
+            WTF::move(childrenFrameLayoutInfo)
+        });
     });
 }
 
diff --git a/Source/WebCore/page/QuirkNames.h b/Source/WebCore/page/QuirkNames.h
index 993de4021f59..39faf0bfb371 100644
--- a/Source/WebCore/page/QuirkNames.h
+++ b/Source/WebCore/page/QuirkNames.h
@@ -125,7 +125,7 @@ enum class SiteSpecificQuirk {
     NeedsNavigatorUserAgentDataQuirk,
     NeedsNowPlayingFullscreenSwapQuirk,
 #if PLATFORM(IOS_FAMILY)
-    NeedsPauseBeforeFullscreenExitQuirk,
+    NeedsSuppressedPauseEventOnFullscreenExitQuirk,
     NeedsPreloadAutoQuirk,
 #endif
 #if PLATFORM(MAC)
diff --git a/Source/WebCore/page/QuirkTable.cpp b/Source/WebCore/page/QuirkTable.cpp
index 4a624a31a065..8f0c9e838334 100644
--- a/Source/WebCore/page/QuirkTable.cpp
+++ b/Source/WebCore/page/QuirkTable.cpp
@@ -48,33 +48,33 @@ static constexpr std::array claudeDomains { "claude.ai"_s, "claude.com"_s };
 
 namespace SiteSpecificQuirks {
 using enum SiteSpecificQuirk;
-using namespace QuirkRefinement;
+using namespace URLRefinement;
 
 static constexpr Quirk table[] = {
 #if PLATFORM(IOS) || PLATFORM(VISION)
     // 365scores.com rdar://116491386
-    { .match = QuirkMatch::domain("365scores.com"_s),
+    { .match = URLMatch::domain("365scores.com"_s),
         .behaviors = { ShouldSilenceWindowResizeEventsDuringApplicationSnapshotting } },
 #endif
 
 #if ENABLE(MEDIA_STREAM)
     // actesting.org rdar://124017544
-    { .match = QuirkMatch::domain("actesting.org"_s),
+    { .match = URLMatch::domain("actesting.org"_s),
         .behaviors = { ShouldEnableLegacyGetUserMediaQuirk } },
 #endif
 
     // airindiaexpress.com https://webkit.org/b/317375
-    { .match = QuirkMatch::domain("airindiaexpress.com"_s),
+    { .match = URLMatch::domain("airindiaexpress.com"_s),
         .behaviors = { NeedsAirIndiaExpressLayeringQuirk } },
 
     // Note: There is a userAgent override for rdar://117771731, see needsCustomUserAgentOverride()
 #if ENABLE(TOUCH_EVENTS) || ENABLE(TOUCH_EVENT_REGIONS)
     // airtable.com rdar://49124313
-    { .match = QuirkMatch::domain("airtable.com"_s),
+    { .match = URLMatch::domain("airtable.com"_s),
         .behaviors = { ShouldDispatchSimulatedMouseEventsQuirk } },
 #endif
 
-    { .match = QuirkMatch::anyTopLevelDomain("amazon"_s),
+    { .match = URLMatch::anyTopLevelDomain("amazon"_s),
         .behaviors = {
             // amazon.com rdar://49124529
             ShouldDispatchSimulatedMouseEventsAssumeDefaultPreventedQuirk,
@@ -90,31 +90,31 @@ static constexpr Quirk table[] = {
         .site = QuirkSite::Amazon },
 
 #if PLATFORM(IOS_FAMILY)
-    { .match = QuirkMatch::domain("amazon.design"_s),
+    { .match = URLMatch::domain("amazon.design"_s),
         .behaviors = { NeedsAmazonDesignMenuViewportUnitQuirk } },
 #endif
 
     // apple.com rdar://154434137
     // FIXME: Maybe EnsureCaptionVisibilityInFullscreenAndPictureInPicture should apply to apple.com.cn too?
-    { .match = QuirkMatch::domain("apple.com"_s),
+    { .match = URLMatch::domain("apple.com"_s),
         .behaviors = { EnsureCaptionVisibilityInFullscreenAndPictureInPicture } },
 
     // Quirk added for rdar://181007316, remove when rdar://182134549 is fixed.
-    { .match = QuirkMatch::anyTopLevelDomain("apple"_s).when(pathContains("/retail"_s)),
+    { .match = URLMatch::anyTopLevelDomain("apple"_s).when(pathContains("/retail"_s)),
         .behaviors = { ShouldDisableScrollAnchoringQuirk } },
 
 #if PLATFORM(IOS_FAMILY)
     // as.com: rdar://121014613
-    { .match = QuirkMatch::domain("as.com"_s).when(smallScreen()),
+    { .match = URLMatch::domain("as.com"_s).when(smallScreen()),
         .behaviors = { ShouldDisableElementFullscreenQuirk } },
 
     // att.com rdar://55185021
-    { .match = QuirkMatch::domain("att.com"_s),
+    { .match = URLMatch::domain("att.com"_s),
         .behaviors = { ShouldUseLegacySelectPopoverDismissalBehaviorInDataActivationQuirk } },
 #endif
 
     // Login issue on bankofamerica.com (rdar://104938789).
-    { .match = QuirkMatch::domain("bankofamerica.com"_s),
+    { .match = URLMatch::domain("bankofamerica.com"_s),
         .behaviors = {
             MaybeBypassBackForwardCache,
         },
@@ -122,17 +122,17 @@ static constexpr Quirk table[] = {
 
     // bbc.co.uk rdar://126494734
     // bbc.com rdar://157499149
-    { .match = QuirkMatch::domain(bbcDomains),
+    { .match = URLMatch::domain(bbcDomains),
         .behaviors = { ReturnNullPictureInPictureElementDuringFullscreenChangeQuirk } },
 
     // bestbuy.com rdar://136235936
-    { .match = QuirkMatch::domain("bestbuy.com"_s),
+    { .match = URLMatch::domain("bestbuy.com"_s),
         .behaviors = {
             NeedsScriptToEvaluateBeforeRunningScriptFromURLQuirk,
         },
         .site = QuirkSite::BestBuy },
 
-    { .match = QuirkMatch::domain("bing.com"_s),
+    { .match = URLMatch::domain("bing.com"_s),
         .behaviors = {
             // bing.com rdar://133223599
             MaybeBypassBackForwardCache,
@@ -142,22 +142,22 @@ static constexpr Quirk table[] = {
         .site = QuirkSite::Bing },
 
     // bungalow.com rdar://61658940
-    { .match = QuirkMatch::domain("bungalow.com"_s),
+    { .match = URLMatch::domain("bungalow.com"_s),
         .behaviors = { ShouldBypassAsyncScriptDeferring } },
 
-    { .match = QuirkMatch::domain("capitalgroup.com"_s),
+    { .match = URLMatch::domain("capitalgroup.com"_s),
         .behaviors = { ShouldDelayReloadWhenRegisteringServiceWorker } },
 
 #if PLATFORM(IOS_FAMILY)
     // Remove this once rdar://139478801 is resolved.
-    { .match = QuirkMatch::domain("cbssports.com"_s),
+    { .match = URLMatch::domain("cbssports.com"_s),
         .behaviors = {
             ShouldSynthesizeTouchEventsAfterNonSyntheticClickQuirk,
         },
         .site = QuirkSite::CBSSports },
 #endif
 
-    { .match = QuirkMatch::hostOrSubdomainOf("ceac.state.gov"_s),
+    { .match = URLMatch::hostOrSubdomainOf("ceac.state.gov"_s),
         .behaviors = {
 #if PLATFORM(MAC)
             // ceac.state.gov https://bugs.webkit.org/show_bug.cgi?id=193478
@@ -168,10 +168,10 @@ static constexpr Quirk table[] = {
         },
         .site = QuirkSite::CEAC },
 #if PLATFORM(IOS)
-    { .match = QuirkMatch::domain("chess.com"_s).when(smallScreen()),
+    { .match = URLMatch::domain("chess.com"_s).when(smallScreen()),
         .behaviors = { ShouldEnterNativeFullscreenWhenCallingElementRequestFullscreen } },
 #endif
-    { .match = QuirkMatch::domain("claude.ai"_s),
+    { .match = URLMatch::domain("claude.ai"_s),
         .behaviors = {
 #if PLATFORM(IOS_FAMILY)
             NeedsClaudeSidebarViewportUnitQuirk,
@@ -183,12 +183,12 @@ static constexpr Quirk table[] = {
         } },
 
 #if PLATFORM(IOS_FAMILY)
-    { .match = QuirkMatch::domain(claudeDomains),
+    { .match = URLMatch::domain(claudeDomains),
         .behaviors = { NeedsHideSelectionDuringOverflowScrollQuirk } },
 #endif
 
 #if PLATFORM(IOS_FAMILY)
-    { .match = QuirkMatch::domain("cnn.com"_s),
+    { .match = URLMatch::domain("cnn.com"_s),
         .behaviors = {
             // cnn.com rdar://119640248
             NeedsFullscreenObjectFitQuirk,
@@ -203,24 +203,24 @@ static constexpr Quirk table[] = {
 #endif
 
 #if ENABLE(MEDIA_STREAM)
-    { .match = QuirkMatch::host("codepen.io"_s),
+    { .match = URLMatch::host("codepen.io"_s),
         .behaviors = { ShouldEnableSpeakerSelectionPermissionsPolicyQuirk } },
 #endif
 
-    { .match = QuirkMatch::domain("crunchyroll.com"_s),
+    { .match = URLMatch::domain("crunchyroll.com"_s),
         .behaviors = { NeedsSuppressPostLayoutBoundaryEventsQuirk } },
 
-    { .match = QuirkMatch::domain("dailymail.co.uk"_s),
+    { .match = URLMatch::domain("dailymail.co.uk"_s),
         .behaviors = { ShouldUnloadHeavyFrames } },
 
-    { .match = QuirkMatch::host("digits.t-mobile.com"_s),
+    { .match = URLMatch::host("digits.t-mobile.com"_s),
         .behaviors = { NeedsNavigatorUserAgentDataQuirk, NeedsCustomUserAgentData } },
 
     // descript.com rdar://156024693
-    { .match = QuirkMatch::domain("descript.com"_s),
+    { .match = URLMatch::domain("descript.com"_s),
         .behaviors = { ShouldDisableDOMAudioSession } },
 
-    { .match = QuirkMatch::domain("dictionary.com"_s),
+    { .match = URLMatch::domain("dictionary.com"_s),
         .behaviors = {
 #if PLATFORM(IOS_FAMILY)
             NeedsScriptToEvaluateBeforeRunningScriptFromURLQuirk,
@@ -233,14 +233,14 @@ static constexpr Quirk table[] = {
 
 #if PLATFORM(IOS_FAMILY)
     // digitaltrends.com rdar://121014613
-    { .match = QuirkMatch::domain("digitaltrends.com"_s).when(smallScreen()),
+    { .match = URLMatch::domain("digitaltrends.com"_s).when(smallScreen()),
         .behaviors = { ShouldDisableElementFullscreenQuirk } },
 
     // discord.com rdar://162719481
-    { .match = QuirkMatch::domain("discord.com"_s),
+    { .match = URLMatch::domain("discord.com"_s),
         .behaviors = { ShouldUseLayoutViewportForClientRectsQuirk } },
 
-    { .match = QuirkMatch::domain("disneyplus.com"_s),
+    { .match = URLMatch::domain("disneyplus.com"_s),
         .behaviors = {
             // disneyplus rdar://137613110
             ShouldHideCoarsePointerCharacteristicsQuirk,
@@ -251,14 +251,14 @@ static constexpr Quirk table[] = {
         } },
 #endif
 
-    { .match = QuirkMatch::domain("ea.com"_s),
+    { .match = URLMatch::domain("ea.com"_s),
         .site = QuirkSite::EA },
 
-    { .match = QuirkMatch::domain("espn.com"_s),
+    { .match = URLMatch::domain("espn.com"_s),
         .behaviors = {
 #if PLATFORM(IOS)
-            // espn.com rdar://154903596
-            NeedsPauseBeforeFullscreenExitQuirk,
+            // espn.com rdar://184169028
+            NeedsSuppressedPauseEventOnFullscreenExitQuirk,
 #endif
 #if PLATFORM(IOS) || PLATFORM(VISION)
             // espn.com rdar://problem/95651814
@@ -271,14 +271,14 @@ static constexpr Quirk table[] = {
         } },
 
     // Expedia Group rdar://126631968
-    { .match = QuirkMatch::domain(expediaGroupDomains),
+    { .match = URLMatch::domain(expediaGroupDomains),
         .behaviors = { NeedsExpediaGroupAnimationQuirk } },
-    { .match = QuirkMatch::anyTopLevelDomain("ebookers"_s),
+    { .match = URLMatch::anyTopLevelDomain("ebookers"_s),
         .behaviors = { NeedsExpediaGroupAnimationQuirk } },
-    { .match = QuirkMatch::anyTopLevelDomain("expedia"_s),
+    { .match = URLMatch::anyTopLevelDomain("expedia"_s),
         .behaviors = { NeedsExpediaGroupAnimationQuirk } },
 
-    { .match = QuirkMatch::domain("facebook.com"_s),
+    { .match = URLMatch::domain("facebook.com"_s),
         .behaviors = {
             // facebook.com rdar://100871402
             NeedsFacebookRemoveNotSupportedQuirk,
@@ -310,33 +310,33 @@ static constexpr Quirk table[] = {
 
 #if ENABLE(TOUCH_EVENTS) || ENABLE(TOUCH_EVENT_REGIONS)
     // flipkart.com rdar://49648520
-    { .match = QuirkMatch::domain("flipkart.com"_s),
+    { .match = URLMatch::domain("flipkart.com"_s),
         .behaviors = { ShouldDispatchSimulatedMouseEventsQuirk } },
 #endif
 
 #if ENABLE(VIDEO_PRESENTATION_MODE)
     // forbes.com rdar://67273166
-    { .match = QuirkMatch::domain("forbes.com"_s),
+    { .match = URLMatch::domain("forbes.com"_s),
         .behaviors = { RequiresUserGestureToPauseInPictureInPictureQuirk } },
 #endif
 
-    { .match = QuirkMatch::host("play.geforcenow.com"_s),
+    { .match = URLMatch::host("play.geforcenow.com"_s),
         .behaviors = { NeedsGeforcenowWarningDisplayNoneQuirk } },
 
 #if PLATFORM(IOS_FAMILY)
     // gizmodo.com rdar://102227302
-    { .match = QuirkMatch::domain("gizmodo.com"_s),
+    { .match = URLMatch::domain("gizmodo.com"_s),
         .behaviors = { NeedsFullscreenDisplayNoneQuirk } },
 #endif
 
-    { .match = QuirkMatch::anyTopLevelDomain("google"_s),
+    { .match = URLMatch::anyTopLevelDomain("google"_s),
         .behaviors = {
             // docs.google.com rdar://59893415
             MaybeBypassBackForwardCache,
         },
         .site = QuirkSite::GoogleProperty },
 
-    { .match = QuirkMatch::anyTopLevelDomain("google"_s).when(pathStartsWith("/maps/"_s)),
+    { .match = URLMatch::anyTopLevelDomain("google"_s).when(pathStartsWith("/maps/"_s)),
         .behaviors = {
 #if ENABLE(TWO_PHASE_CLICKS)
             // maps.google.com rdar://152194074
@@ -355,7 +355,7 @@ static constexpr Quirk table[] = {
         },
         .site = QuirkSite::GoogleMaps },
 
-    { .match = QuirkMatch::host("docs.google.com"_s),
+    { .match = URLMatch::host("docs.google.com"_s),
         .behaviors = {
             InputMethodUsesCorrectKeyEventOrder,
 #if PLATFORM(MAC)
@@ -372,17 +372,17 @@ static constexpr Quirk table[] = {
 
 #if PLATFORM(IOS_FAMILY)
     // docs.google.com https://bugs.webkit.org/show_bug.cgi?id=199587
-    { .match = QuirkMatch::host("docs.google.com"_s).when(pathStartsWith("/spreadsheets/"_s)),
+    { .match = URLMatch::host("docs.google.com"_s).when(pathStartsWith("/spreadsheets/"_s)),
         .behaviors = { NeedsDeferKeyDownAndKeyPressTimersUntilNextEditingCommandQuirk } },
 
-    { .match = QuirkMatch::host("docs.google.com"_s).when(pathStartsWith("/presentation/"_s)),
+    { .match = URLMatch::host("docs.google.com"_s).when(pathStartsWith("/presentation/"_s)),
         .behaviors = { ShouldIgnoreInputModeNone } },
 
     // mail.google.com rdar://49403416
-    { .match = QuirkMatch::host("mail.google.com"_s),
+    { .match = URLMatch::host("mail.google.com"_s),
         .behaviors = { NeedsGMailOverflowScrollQuirk } },
 
-    { .match = QuirkMatch::host("translate.google.com"_s),
+    { .match = URLMatch::host("translate.google.com"_s),
         .behaviors = {
             // translate.google.com rdar://106539018
             NeedsGoogleTranslateScrollingQuirk,
@@ -392,20 +392,20 @@ static constexpr Quirk table[] = {
 
 #if ENABLE(TOUCH_EVENTS) || ENABLE(TOUCH_EVENT_REGIONS)
     // sites.google.com rdar://58653069
-    { .match = QuirkMatch::host("sites.google.com"_s),
+    { .match = URLMatch::host("sites.google.com"_s),
         .behaviors = { ShouldPreventDispatchOfTouchEventQuirk } },
 #endif
 
 #if ENABLE(MEDIA_STREAM)
-    { .match = QuirkMatch::host("meet.google.com"_s),
+    { .match = URLMatch::host("meet.google.com"_s),
         .behaviors = { ShouldEnableCameraBackgroundPlayback } },
 #endif
 
     // hbomax.com https://bugs.webkit.org/show_bug.cgi?id=244737
-    { .match = QuirkMatch::domain("hbomax.com"_s),
+    { .match = URLMatch::domain("hbomax.com"_s),
         .behaviors = { ShouldEnableFontLoadingAPIQuirk } },
 
-    { .match = QuirkMatch::host("play.hbomax.com"_s),
+    { .match = URLMatch::host("play.hbomax.com"_s),
         .behaviors = {
 #if HAVE(PIP_SKIP_PREROLL)
             // play.hbomax.com rdar://158430821
@@ -419,7 +419,7 @@ static constexpr Quirk table[] = {
 #endif
         } },
 
-    { .match = QuirkMatch::domain("hulu.com"_s),
+    { .match = URLMatch::domain("hulu.com"_s),
         .behaviors = {
             // hulu.com rdar://55041979
             NeedsCanPlayAfterSeekedQuirk,
@@ -431,22 +431,22 @@ static constexpr Quirk table[] = {
 
 #if PLATFORM(IOS_FAMILY)
     // icloud.com rdar://131836301
-    { .match = QuirkMatch::domain("icloud.com"_s).when(pathOrFragmentContains("mail"_s)),
+    { .match = URLMatch::domain("icloud.com"_s).when(pathOrFragmentContains("mail"_s)),
         .behaviors = { ShouldSilenceWindowResizeEventsDuringApplicationSnapshotting } },
 #endif
 #if PLATFORM(MAC)
     // icloud.com rdar://26013388
-    { .match = QuirkMatch::domain("icloud.com"_s).when(pathOrFragmentContains("notes"_s)),
+    { .match = URLMatch::domain("icloud.com"_s).when(pathOrFragmentContains("notes"_s)),
         .behaviors = { IsNeverRichlyEditableForTouchBarQuirk } },
 #endif
 
-    { .match = QuirkMatch::domain("iheart.com"_s),
+    { .match = URLMatch::domain("iheart.com"_s),
         .behaviors = {
             NeedsScriptToEvaluateBeforeRunningScriptFromURLQuirk,
         },
         .site = QuirkSite::IHeart },
 
-    { .match = QuirkMatch::domain("imdb.com"_s),
+    { .match = URLMatch::domain("imdb.com"_s),
         .behaviors = {
             // imdb.com: rdar://137991466
             NeedsChromeMediaControlsPseudoElementQuirk,
@@ -454,7 +454,7 @@ static constexpr Quirk table[] = {
             NeedsZeroMaxTouchPointsQuirk,
         } },
 
-    { .match = QuirkMatch::domain("instagram.com"_s),
+    { .match = URLMatch::domain("instagram.com"_s),
         .behaviors = {
             // rdar://166400170
             NeedsInstagramResizingReelsQuirk,
@@ -466,21 +466,21 @@ static constexpr Quirk table[] = {
 
 #if PLATFORM(IOS_FAMILY)
     // instagram.com rdar://121014613
-    { .match = QuirkMatch::domain("instagram.com"_s),
+    { .match = URLMatch::domain("instagram.com"_s),
         .behaviors = { ShouldDisableElementFullscreenQuirk } },
 #endif
 
     // invideo.io rdar://171741842 https://webkit.org/b/311602
-    { .match = QuirkMatch::domain("invideo.io"_s),
+    { .match = URLMatch::domain("invideo.io"_s),
         .behaviors = {
             NeedsScriptToEvaluateBeforeRunningScriptFromURLQuirk,
         },
         .site = QuirkSite::InVideo },
 
-    { .match = QuirkMatch::domain("linkedin.com"_s),
+    { .match = URLMatch::domain("linkedin.com"_s),
         .site = QuirkSite::LinkedIn },
 
-    { .match = QuirkMatch::domain("live.com"_s),
+    { .match = URLMatch::domain("live.com"_s),
         .behaviors = {
 #if PLATFORM(IOS_FAMILY)
             // live.com: rdar://167489768
@@ -490,7 +490,7 @@ static constexpr Quirk table[] = {
             ShouldAvoidResizingWhenInputViewBoundsChangeQuirk,
         } },
 
-    { .match = QuirkMatch::host("outlook.live.com"_s),
+    { .match = URLMatch::host("outlook.live.com"_s),
         .behaviors = {
             // outlook.live.com: rdar://136624720
             NeedsMozillaFileTypeForDataTransferQuirk,
@@ -506,28 +506,28 @@ static constexpr Quirk table[] = {
         .site = QuirkSite::Outlook },
 
     // Microsoft office online generates data URLs with incorrect padding on Safari only (rdar://114573089).
-    { .match = QuirkMatch::hostOrSubdomainOf("officeapps.live.com"_s),
+    { .match = URLMatch::hostOrSubdomainOf("officeapps.live.com"_s),
         .behaviors = { ShouldDisableDataURLPaddingValidation } },
-    { .match = QuirkMatch::hostOrSubdomainOf("onedrive.live.com"_s),
+    { .match = URLMatch::hostOrSubdomainOf("onedrive.live.com"_s),
         .behaviors = { ShouldDisableDataURLPaddingValidation } },
 
 #if PLATFORM(MAC)
     // onedrive.live.com rdar://26013388
-    { .match = QuirkMatch::host("onedrive.live.com"_s),
+    { .match = URLMatch::host("onedrive.live.com"_s),
         .behaviors = { IsNeverRichlyEditableForTouchBarQuirk } },
 
     // madisoncity.k12.al.us https://bugs.webkit.org/show_bug.cgi?id=296989
-    { .match = QuirkMatch::domain("madisoncity.k12.al.us"_s),
+    { .match = URLMatch::domain("madisoncity.k12.al.us"_s),
         .behaviors = { NeedsFormControlToBeMouseFocusableQuirk } },
 #endif
 
 #if PLATFORM(IOS_FAMILY)
     // mailchimp.com rdar://47868965
-    { .match = QuirkMatch::domain("mailchimp.com"_s),
+    { .match = URLMatch::domain("mailchimp.com"_s),
         .behaviors = { ShouldDisablePointerEventsQuirk } },
 #endif
 
-    { .match = QuirkMatch::domain("marcus.com"_s),
+    { .match = URLMatch::domain("marcus.com"_s),
         .behaviors = {
             // Marcus: <rdar://101086391>.
             ShouldExposeShowModalDialog,
@@ -538,20 +538,20 @@ static constexpr Quirk table[] = {
         } },
 
     // medium.com rdar://50457837
-    { .match = QuirkMatch::domain("medium.com"_s),
+    { .match = URLMatch::domain("medium.com"_s),
         .behaviors = { ShouldDispatchSyntheticMouseEventsWhenModifyingSelectionQuirk } },
 
 #if PLATFORM(IOS_FAMILY)
     // m365.cloud.microsoft rdar://157794706
-    { .match = QuirkMatch::hostOrSubdomainOf("m365.cloud.microsoft"_s),
+    { .match = URLMatch::hostOrSubdomainOf("m365.cloud.microsoft"_s),
         .behaviors = { ShouldAllowPopupFromMicrosoftOfficeToOneDrive } },
 #endif
 
     // safe.menlosecurity.com rdar://135114489
-    { .match = QuirkMatch::host("safe.menlosecurity.com"_s),
+    { .match = URLMatch::host("safe.menlosecurity.com"_s),
         .behaviors = { ShouldDisableWritingSuggestionsByDefaultQuirk } },
 
-    { .match = QuirkMatch::domain("messenger.com"_s),
+    { .match = URLMatch::domain("messenger.com"_s),
         .behaviors = {
 #if ENABLE(MEDIA_STREAM)
             // facebook.com rdar://158736355
@@ -568,29 +568,29 @@ static constexpr Quirk table[] = {
 
 #if PLATFORM(IOS_FAMILY)
     // rdar://147429596
-    { .match = QuirkMatch::domain("nba.com"_s),
+    { .match = URLMatch::domain("nba.com"_s),
         .behaviors = {
             NeedsScriptToEvaluateBeforeRunningScriptFromURLQuirk,
         },
         .site = QuirkSite::NBA },
 #if PLATFORM(IOS)
-    { .match = QuirkMatch::domain("nba.com"_s).when(smallScreen()),
+    { .match = URLMatch::domain("nba.com"_s).when(smallScreen()),
         .behaviors = { ShouldEnterNativeFullscreenWhenCallingElementRequestFullscreen } },
 #endif
 #endif
 
 #if ENABLE(TOUCH_EVENTS) || ENABLE(TOUCH_EVENT_REGIONS)
     // mybinder.org rdar://51770057
-    { .match = QuirkMatch::domain("mybinder.org"_s),
+    { .match = URLMatch::domain("mybinder.org"_s),
         .behaviors = { ShouldDispatchSimulatedMouseEventsQuirk },
         .site = QuirkSite::MyBinder },
 
     // naver.com rdar://48068610
-    { .match = QuirkMatch::hostOrSubdomainOf("naver.com"_s).exceptWhen(hostIs(naverHostsWithoutSimulatedMouseEvents)),
+    { .match = URLMatch::hostOrSubdomainOf("naver.com"_s).exceptWhen(hostIs(naverHostsWithoutSimulatedMouseEvents)),
         .behaviors = { ShouldDispatchSimulatedMouseEventsQuirk } },
 #endif
 
-    { .match = QuirkMatch::domain("netflix.com"_s),
+    { .match = URLMatch::domain("netflix.com"_s),
         .behaviors = {
             // netflix.com https://bugs.webkit.org/show_bug.cgi?id=173030
             NeedsSeekingSupportDisabledQuirk,
@@ -608,28 +608,28 @@ static constexpr Quirk table[] = {
         },
         .site = QuirkSite::Netflix },
 
-    { .match = QuirkMatch::domain("nfl.com"_s),
+    { .match = URLMatch::domain("nfl.com"_s),
         .behaviors = { ShouldSuppressHLSSubtitles } },
 
-    { .match = QuirkMatch::domain("nhl.com"_s),
+    { .match = URLMatch::domain("nhl.com"_s),
         .behaviors = { NeedsWebKitMediaTextTrackDisplayQuirk } },
 
 #if PLATFORM(IOS) || PLATFORM(VISION)
     // nytimes.com: rdar://problem/5976384
-    { .match = QuirkMatch::domain("nytimes.com"_s),
+    { .match = URLMatch::domain("nytimes.com"_s),
         .behaviors = { ShouldSilenceWindowResizeEventsDuringApplicationSnapshotting } },
 #endif
 
     // Pandora: <rdar://100243111>.
-    { .match = QuirkMatch::domain("pandora.com"_s),
+    { .match = URLMatch::domain("pandora.com"_s),
         .behaviors = { ShouldExposeShowModalDialog } },
 
     // pinterest.com rdar://104979314
     // FIXME: Remove this Quirk if Pinterest decides to trigger this notification from an user gesture (rdar://165745719)
-    { .match = QuirkMatch::domain("pinterest.com"_s),
+    { .match = URLMatch::domain("pinterest.com"_s),
         .behaviors = { ShouldAllowNotificationPermissionWithoutUserGesture } },
 
-    { .match = QuirkMatch::domain("premierleague.com"_s),
+    { .match = URLMatch::domain("premierleague.com"_s),
         .behaviors = {
             // premierleague.com: rdar://123721211
             ShouldIgnorePlaysInlineRequirementQuirk,
@@ -641,12 +641,12 @@ static constexpr Quirk table[] = {
 
 #if PLATFORM(IOS_FAMILY)
     // ralphlauren.com rdar://55629493
-    { .match = QuirkMatch::domain("ralphlauren.com"_s),
+    { .match = URLMatch::domain("ralphlauren.com"_s),
         .behaviors = { ShouldIgnoreAriaForFastPathContentObservationCheckQuirk } },
 #endif
 
 #if ENABLE(VIDEO_PRESENTATION_MODE) || PLATFORM(IOS_FAMILY)
-    { .match = QuirkMatch::domain("reddit.com"_s),
+    { .match = URLMatch::domain("reddit.com"_s),
         .behaviors = {
 #if ENABLE(VIDEO_PRESENTATION_MODE)
             // reddit.com: rdar://80550715
@@ -660,19 +660,19 @@ static constexpr Quirk table[] = {
         .site = QuirkSite::Reddit },
 #endif
 
-    { .match = QuirkMatch::domain("scribd.com"_s),
+    { .match = URLMatch::domain("scribd.com"_s),
         .behaviors = { NeedsReuseLiveRangeForSelectionUpdateQuirk } },
 
     // sfusd.edu: rdar://116292738
-    { .match = QuirkMatch::domain("sfusd.edu"_s),
+    { .match = URLMatch::domain("sfusd.edu"_s),
         .behaviors = { ShouldBypassAsyncScriptDeferring } },
 
     // sharepoint.com rdar://52116170
-    { .match = QuirkMatch::domain("sharepoint.com"_s),
+    { .match = URLMatch::domain("sharepoint.com"_s),
         .behaviors = { ShouldAvoidResizingWhenInputViewBoundsChangeQuirk } },
 
 #if PLATFORM(IOS_FAMILY) && ENABLE(META_VIEWPORT)
-    { .match = QuirkMatch::domain("slack.com"_s),
+    { .match = URLMatch::domain("slack.com"_s),
         .behaviors = {
             // slack.com: rdar://138614711
             ShouldIgnoreViewportArgumentsToAvoidEnlargedViewQuirk,
@@ -681,7 +681,7 @@ static constexpr Quirk table[] = {
         } },
 #endif
 
-    { .match = QuirkMatch::domain("soundcloud.com"_s),
+    { .match = URLMatch::domain("soundcloud.com"_s),
         .behaviors = {
             // soundcloud.com rdar://52915981
             ShouldDispatchSimulatedMouseEventsAssumeDefaultPreventedQuirk,
@@ -696,12 +696,12 @@ static constexpr Quirk table[] = {
 
 #if ENABLE(TOUCH_EVENTS)
     // soylent.*: rdar://113314067
-    { .match = QuirkMatch::anyTopLevelDomain("soylent"_s),
+    { .match = URLMatch::anyTopLevelDomain("soylent"_s),
         .behaviors = { ShouldDispatchPointerOutAndLeaveAfterHandlingSyntheticClick } },
 #endif
 
     // spotify.com rdar://138918575
-    { .match = QuirkMatch::host("open.spotify.com"_s),
+    { .match = URLMatch::host("open.spotify.com"_s),
         .behaviors = {
             NeedsBodyScrollbarWidthNoneDisabledQuirk,
             ShouldAvoidStartingSelectionOnMouseDownOverPointerCursor,
@@ -716,20 +716,20 @@ static constexpr Quirk table[] = {
 
 #if ENABLE(CONTENT_CHANGE_OBSERVER)
     // Remove this once rdar://142573562 is resolved.
-    { .match = QuirkMatch::domain("steampowered.com"_s),
+    { .match = URLMatch::domain("steampowered.com"_s),
         .behaviors = { ShouldTreatAddingMouseOutEventListenerAsContentChange } },
 #endif
 
 #if PLATFORM(IOS_FAMILY)
-    { .match = QuirkMatch::anyTopLevelDomain("theguardian"_s),
+    { .match = URLMatch::anyTopLevelDomain("theguardian"_s),
         .behaviors = { ShouldHideSoftTopScrollEdgeEffectDuringFocusQuirk } },
 
     // theguardian.com rdar://166727225
-    { .match = QuirkMatch::anyTopLevelDomain("theguardian"_s).when(documentDomainIs(youTubeEmbedDomains)),
+    { .match = QuirkURLMatch::embeddedDocumentInTopMatch(URLMatch::anyTopLevelDomain("theguardian"_s), URLMatch::domain(youTubeEmbedDomains)),
         .behaviors = { NeedsYouTubeEmbedAutoplayQuirk } },
 #endif
 
-    { .match = QuirkMatch::domain("thesaurus.com"_s),
+    { .match = URLMatch::domain("thesaurus.com"_s),
         .behaviors = {
 #if PLATFORM(IOS_FAMILY)
             NeedsScriptToEvaluateBeforeRunningScriptFromURLQuirk,
@@ -740,7 +740,7 @@ static constexpr Quirk table[] = {
         },
         .site = QuirkSite::Thesaurus },
 
-    { .match = QuirkMatch::domain("tiktok.com"_s),
+    { .match = URLMatch::domain("tiktok.com"_s),
         .behaviors = {
             NeedsTikTokOverflowingContentQuirk,
             // tiktok.com rdar://174179805
@@ -754,31 +754,31 @@ static constexpr Quirk table[] = {
 
 #if PLATFORM(MAC)
     // trix-editor.org rdar://28242210
-    { .match = QuirkMatch::domain("trix-editor.org"_s),
+    { .match = URLMatch::domain("trix-editor.org"_s),
         .behaviors = { IsNeverRichlyEditableForTouchBarQuirk } },
 #endif
 
 #if ENABLE(PICTURE_IN_PICTURE_API)
     // twitch.tv rdar://102420527
-    { .match = QuirkMatch::domain("twitch.tv"_s),
+    { .match = URLMatch::domain("twitch.tv"_s),
         .behaviors = { ShouldReportDocumentAsVisibleIfActivePIPQuirk } },
 #endif
 
     // https://tympanus.net/Tutorials/WebGPUFluid/ does not load (rdar://143839620).
-    { .match = QuirkMatch::domain("tympanus.net"_s),
+    { .match = URLMatch::domain("tympanus.net"_s),
         .behaviors = { ShouldBlockFetchWithNewlineAndLessThan } },
 
 #if ENABLE(MEDIA_SOURCE)
     // unifi.ui.com rdar://180411019
-    { .match = QuirkMatch::domain("ui.com"_s),
+    { .match = URLMatch::domain("ui.com"_s),
         .behaviors = { NeedsSupportsProgressMonitoringQuirk } },
 #endif
 
     // Breaks express checkout on victoriassecret.com (rdar://104818312).
-    { .match = QuirkMatch::domain("victoriassecret.com"_s),
+    { .match = URLMatch::domain("victoriassecret.com"_s),
         .behaviors = { ShouldDisableFetchMetadata } },
 
-    { .match = QuirkMatch::domain("vimeo.com"_s),
+    { .match = URLMatch::domain("vimeo.com"_s),
         .behaviors = {
             // vimeo.com rdar://56996057
             MaybeBypassBackForwardCache,
@@ -801,13 +801,13 @@ static constexpr Quirk table[] = {
 
 #if PLATFORM(IOS_FAMILY)
     // rdar://116531089
-    { .match = QuirkMatch::domain("vimeo.com"_s).when(smallScreen()),
+    { .match = URLMatch::domain("vimeo.com"_s).when(smallScreen()),
         .behaviors = { ShouldDisableElementFullscreenQuirk } },
 #endif
 
 #if ENABLE(TWO_PHASE_CLICKS)
     // walmart.com: rdar://123734840
-    { .match = QuirkMatch::domain("walmart.com"_s),
+    { .match = URLMatch::domain("walmart.com"_s),
         .behaviors = {
             MayNeedToIgnoreContentObservation,
         },
@@ -816,12 +816,12 @@ static constexpr Quirk table[] = {
 
 #if PLATFORM(MAC)
     // weather.com rdar://139689157
-    { .match = QuirkMatch::domain("weather.com"_s),
+    { .match = URLMatch::domain("weather.com"_s),
         .behaviors = { NeedsFormControlToBeMouseFocusableQuirk } },
 #endif
 
 #if PLATFORM(IOS_FAMILY) && ENABLE(DESKTOP_CONTENT_MODE_QUIRKS)
-    { .match = QuirkMatch::domain("webex.com"_s),
+    { .match = URLMatch::domain("webex.com"_s),
         .behaviors = {
             NeedsScriptToEvaluateBeforeRunningScriptFromURLQuirk,
         },
@@ -829,10 +829,10 @@ static constexpr Quirk table[] = {
 #endif
 
     // weebly.com rdar://48003980
-    { .match = QuirkMatch::domain("weebly.com"_s),
+    { .match = URLMatch::domain("weebly.com"_s),
         .behaviors = { ShouldDispatchSyntheticMouseEventsWhenModifyingSelectionQuirk } },
 
-    { .match = QuirkMatch::domain("wikipedia.org"_s),
+    { .match = URLMatch::domain("wikipedia.org"_s),
         .behaviors = {
             // wikipedia.org rdar://54856323
             ShouldLayOutAtMinimumWindowWidthWhenIgnoringScalingConstraintsQuirk,
@@ -845,20 +845,20 @@ static constexpr Quirk table[] = {
     // rdar://170412045, https://bugs.webkit.org/show_bug.cgi?id=307933
 #if ENABLE(TOUCH_EVENTS) || ENABLE(TOUCH_EVENT_REGIONS)
     // wix.com rdar://49124313, except while picking a template.
-    { .match = QuirkMatch::domain("wix.com"_s).exceptWhen(pathStartsWith("/website/templates/"_s)),
+    { .match = URLMatch::domain("wix.com"_s).exceptWhen(pathStartsWith("/website/templates/"_s)),
         .behaviors = { ShouldDispatchSimulatedMouseEventsQuirk } },
 #endif
 
-    { .match = QuirkMatch::domain("workspaces.xyz"_s),
+    { .match = URLMatch::domain("workspaces.xyz"_s),
         .behaviors = { ShouldComparareUsedValuesForBorderWidthForTriggeringTransitions } },
 
 #if PLATFORM(MAC)
     // wpdevelopment.ca rdar://156109518
-    { .match = QuirkMatch::domain("wpdevelopment.ca"_s),
+    { .match = URLMatch::domain("wpdevelopment.ca"_s),
         .behaviors = { NeedsFormControlToBeMouseFocusableQuirk } },
 #endif
 
-    { .match = QuirkMatch::domain("x.com"_s),
+    { .match = URLMatch::domain("x.com"_s),
         .behaviors = {
 #if PLATFORM(VISION)
             // x.com: rdar://132850672
@@ -880,7 +880,7 @@ static constexpr Quirk table[] = {
 #endif
         } },
 
-    { .match = QuirkMatch::anyTopLevelDomain("yahoo"_s),
+    { .match = URLMatch::anyTopLevelDomain("yahoo"_s),
         .behaviors = {
             // yahoo.com: rdar://170502516
             NeedsYahooVolumeSliderQuirk,
@@ -894,11 +894,11 @@ static constexpr Quirk table[] = {
 
 #if ENABLE(TEXT_AUTOSIZING)
     // news.ycombinator.com: rdar://127246368
-    { .match = QuirkMatch::host("news.ycombinator.com"_s),
+    { .match = URLMatch::host("news.ycombinator.com"_s),
         .behaviors = { ShouldIgnoreTextAutoSizingQuirk } },
 #endif
 
-    { .match = QuirkMatch::domain("youtube.com"_s),
+    { .match = URLMatch::domain("youtube.com"_s),
         .behaviors = {
             // youtube.com https://bugs.webkit.org/show_bug.cgi?id=195598
             HasBrokenEncryptedMediaAPISupportQuirk,
@@ -915,65 +915,65 @@ static constexpr Quirk table[] = {
 
 #if PLATFORM(COCOA)
     // Embedded youtube.com players need the caption quirk regardless of the embedding site.
-    { .match = QuirkMatch::anySite().when(embedded(), documentDomainIs(youTubeEmbedDomains)),
+    { .match = QuirkURLMatch::embeddedDocument(URLMatch::domain(youTubeEmbedDomains)),
         .behaviors = { NeedsYouTubeCaptionQuirk } },
 #endif
 
 #if PLATFORM(IOS_FAMILY)
     // YouTube.com does not provide AirPlay controls in fullscreen
     // (Ref: rdar://121471373)
-    { .match = QuirkMatch::domain("youtube.com"_s).when(smallScreen()),
+    { .match = URLMatch::domain("youtube.com"_s).when(smallScreen()),
         .behaviors = { ShouldDisableElementFullscreenQuirk } },
 
     // tiny. (Ref: rdar://121471373, rdar://121473410)
-    { .match = QuirkMatch::anySite().when(embedded(), documentDomainIs(youTubeEmbedDomains), smallScreen()),
+    { .match = QuirkURLMatch::embeddedDocument(URLMatch::domain(youTubeEmbedDomains).when(smallScreen())),
         .behaviors = { ShouldDisableElementFullscreenQuirk } },
 
-    { .match = QuirkMatch::anySite().when(embedded(), documentDomainIs("x.com"_s)),
+    { .match = QuirkURLMatch::embeddedDocument(URLMatch::domain("x.com"_s)),
         .behaviors = { ShouldDisableElementFullscreenQuirk } },
 
     // youtube.com rdar://49582231
-    { .match = QuirkMatch::host("www.youtube.com"_s),
+    { .match = URLMatch::host("www.youtube.com"_s),
         .behaviors = { NeedsYouTubeOverflowScrollQuirk } },
 
-    { .match = QuirkMatch::domain("youtube.com"_s).when(tubularApp()),
+    { .match = URLMatch::domain("youtube.com"_s).when(tubularApp()),
         .behaviors = { ShouldSuppressMediaSessionPauseActionOnInterruption } },
 #endif
 
 #if ENABLE(TWO_PHASE_CLICKS)
     // www.youtube.com rdar://52361019
-    { .match = QuirkMatch::host("www.youtube.com"_s),
+    { .match = URLMatch::host("www.youtube.com"_s),
         .behaviors = { NeedsYouTubeMouseOutQuirk } },
 #endif
 
 #if PLATFORM(VISION) && ENABLE(FULLSCREEN_API)
     // Lens.app rdar://178769976
-    { .match = QuirkMatch::domain("youtube.com"_s).when(lensApp()),
+    { .match = URLMatch::domain("youtube.com"_s).when(lensApp()),
         .behaviors = { RequiresUserGestureToPlayInFullscreenQuirk } },
 #endif
 
 #if ENABLE(MEDIA_RECORDER) && ENABLE(COCOA_WEBM_PLAYER)
     // zencastr.com rdar://143087016
-    { .match = QuirkMatch::domain("zencastr.com"_s),
+    { .match = URLMatch::domain("zencastr.com"_s),
         .behaviors = { NeedsLimitedMatroskaSupportQuirk } },
 #endif
 
     // zillow.com rdar://53103732
-    { .match = QuirkMatch::host("www.zillow.com"_s),
+    { .match = URLMatch::host("www.zillow.com"_s),
         .behaviors = { ShouldAvoidScrollingWhenFocusedContentIsVisibleQuirk } },
 
 #if PLATFORM(IOS) || PLATFORM(VISION)
     // zillow.com rdar://110097836
-    { .match = QuirkMatch::domain("zillow.com"_s),
+    { .match = URLMatch::domain("zillow.com"_s),
         .behaviors = { ShouldSilenceResizeObservers } },
 #endif
 
 #if PLATFORM(MAC)
-    { .match = QuirkMatch::domain("zomato.com"_s),
+    { .match = URLMatch::domain("zomato.com"_s),
         .behaviors = { NeedsZomatoEmailLoginLabelQuirk } },
 #endif
 
-    { .match = QuirkMatch::domain("zoom.us"_s),
+    { .match = URLMatch::domain("zoom.us"_s),
         .behaviors = {
             // zoom.com https://bugs.webkit.org/show_bug.cgi?id=223180
             ShouldAutoplayWebAudioForArbitraryUserGestureQuirk,
@@ -987,6 +987,26 @@ static constexpr Quirk table[] = {
 
 } // namespace SiteSpecificQuirks
 
+bool QuirkURLMatch::matches(const URLMatchContext& topContext, const URLMatchContext& documentContext, IsTopDocument isTopDocument) const
+{
+    switch (m_kind) {
+    case Kind::TopURL:
+        return m_match.matches(topContext);
+    case Kind::EmbeddedDocument:
+        if (isTopDocument == IsTopDocument::Yes)
+            return false;
+        return m_match.matches(documentContext);
+    case Kind::EmbeddedDocumentInTopURL:
+        if (isTopDocument == IsTopDocument::Yes)
+            return false;
+        ASSERT(m_topMatch);
+        return m_topMatch->matches(topContext) && m_match.matches(documentContext);
+    }
+
+    ASSERT_NOT_REACHED();
+    return false;
+}
+
 void Quirk::apply(QuirksData& quirksData) const
 {
     quirksData.activeQuirks.merge(behaviors.bits());
@@ -995,13 +1015,16 @@ void Quirk::apply(QuirksData& quirksData) const
         quirksData.addSite(*site);
 }
 
-QuirksData resolveSiteSpecificQuirks(const QuirkMatchContext& context)
+QuirksData resolveSiteSpecificQuirks(const URL& topURL, const URL& documentURL, IsTopDocument documentIsTopDocument)
 {
+    URLMatchContext topURLContext { topURL };
+    URLMatchContext documentURLContext { documentURL };
     QuirksData quirksData;
     for (auto& quirk : SiteSpecificQuirks::table) {
-        if (quirk.match.matches(context))
+        if (quirk.match.matches(topURLContext, documentURLContext, documentIsTopDocument))
             quirk.apply(quirksData);
     }
+
     return quirksData;
 }
 
diff --git a/Source/WebCore/page/QuirkTable.h b/Source/WebCore/page/QuirkTable.h
index 16c98606e2cc..f174782d5a9a 100644
--- a/Source/WebCore/page/QuirkTable.h
+++ b/Source/WebCore/page/QuirkTable.h
@@ -25,9 +25,9 @@
 
 #pragma once
 
-#include <WebCore/QuirkMatch.h>
 #include <WebCore/QuirkNames.h>
 #include <WebCore/QuirksData.h>
+#include <WebCore/URLMatch.h>
 #include <initializer_list>
 #include <optional>
 
@@ -49,14 +49,51 @@ class QuirkBehaviors {
     QuirkBitSet m_bits;
 };
 
+enum class IsTopDocument : bool { No, Yes };
+
+class QuirkURLMatch {
+public:
+    constexpr QuirkURLMatch(URLMatch match)
+        : m_kind(Kind::TopURL)
+        , m_match(match)
+    {
+    }
+
+    static constexpr QuirkURLMatch embeddedDocument(URLMatch match)
+    {
+        return QuirkURLMatch { Kind::EmbeddedDocument, match };
+    }
+
+    static constexpr QuirkURLMatch embeddedDocumentInTopMatch(URLMatch topMatch, URLMatch documentMatch)
+    {
+        return QuirkURLMatch { Kind::EmbeddedDocumentInTopURL, documentMatch, topMatch };
+    }
+
+    [[nodiscard]] WEBCORE_EXPORT bool matches(const URLMatchContext& topContext, const URLMatchContext& documentContext, IsTopDocument) const;
+
+private:
+    enum class Kind : uint8_t { TopURL, EmbeddedDocument, EmbeddedDocumentInTopURL };
+
+    constexpr QuirkURLMatch(Kind kind, URLMatch match, std::optional<URLMatch> topMatch = std::nullopt)
+        : m_kind(kind)
+        , m_match(match)
+        , m_topMatch(topMatch)
+    {
+    }
+
+    Kind m_kind;
+    URLMatch m_match;
+    std::optional<URLMatch> m_topMatch;
+};
+
 struct Quirk {
-    QuirkMatch match;
+    QuirkURLMatch match;
     QuirkBehaviors behaviors { };
     std::optional<QuirkSite> site { };
 
     void apply(QuirksData&) const;
 };
 
-WEBCORE_EXPORT QuirksData resolveSiteSpecificQuirks(const QuirkMatchContext&);
+WEBCORE_EXPORT QuirksData resolveSiteSpecificQuirks(const URL& topURL, const URL& documentURL, IsTopDocument);
 
 } // namespace WebCore
diff --git a/Source/WebCore/page/Quirks.cpp b/Source/WebCore/page/Quirks.cpp
index 2dbb67f19e07..0e25814df2eb 100644
--- a/Source/WebCore/page/Quirks.cpp
+++ b/Source/WebCore/page/Quirks.cpp
@@ -103,10 +103,6 @@
 #include <wtf/TZoneMallocInlines.h>
 #include <wtf/text/MakeString.h>
 
-#if PLATFORM(IOS_FAMILY)
-#include <pal/system/ios/UserInterfaceIdiom.h>
-#endif
-
 #if PLATFORM(COCOA)
 #include <wtf/cocoa/RuntimeApplicationChecksCocoa.h>
 #endif
@@ -1069,13 +1065,13 @@ bool Quirks::needsPreloadAutoQuirk() const
 #endif
 }
 
-// espn.com rdar://154903596
-bool Quirks::needsPauseBeforeFullscreenExitQuirk() const
+// espn.com rdar://184169028
+bool Quirks::needsSuppressedPauseEventOnFullscreenExitQuirk() const
 {
 #if PLATFORM(IOS_FAMILY)
     QUIRKS_EARLY_RETURN_IF_DISABLED_WITH_VALUE(false);
 
-    return m_quirksData.quirkIsEnabled(SiteSpecificQuirk::NeedsPauseBeforeFullscreenExitQuirk);
+    return m_quirksData.quirkIsEnabled(SiteSpecificQuirk::NeedsSuppressedPauseEventOnFullscreenExitQuirk);
 #else
     return false;
 #endif
@@ -2825,33 +2821,6 @@ void Quirks::setTopDocumentURLForTesting(URL&& url)
     determineRelevantQuirks();
 }
 
-bool evaluateQuirkEnvironment(QuirkEnvironment environment)
-{
-    switch (environment) {
-    case QuirkEnvironment::SmallScreen:
-#if PLATFORM(IOS_FAMILY)
-        return PAL::currentUserInterfaceIdiomIsSmallScreen();
-#else
-        return false;
-#endif
-    case QuirkEnvironment::TubularApp:
-#if PLATFORM(IOS_FAMILY)
-        return WTF::IOSApplication::isTubular();
-#else
-        return false;
-#endif
-    case QuirkEnvironment::LensApp:
-#if PLATFORM(IOS_FAMILY)
-        return WTF::IOSApplication::isLensApp();
-#else
-        return false;
-#endif
-    }
-
-    ASSERT_NOT_REACHED();
-    return false;
-}
-
 void Quirks::determineRelevantQuirks()
 {
     RELEASE_ASSERT(m_document);
@@ -2884,7 +2853,7 @@ void Quirks::determineRelevantQuirks()
         return;
 
     Ref document = *protect(m_document);
-    m_quirksData.merge(resolveSiteSpecificQuirks({ quirksURL, document->url(), document->isTopDocument() ? IsTopDocument::Yes : IsTopDocument::No }));
+    m_quirksData.merge(resolveSiteSpecificQuirks(quirksURL, document->url(), document->isTopDocument() ? IsTopDocument::Yes : IsTopDocument::No));
 
 #if ENABLE(FLIP_SCREEN_DIMENSIONS_QUIRKS)
     // rdar://133423460
diff --git a/Source/WebCore/page/Quirks.h b/Source/WebCore/page/Quirks.h
index a62985ef3a35..ef34eaeb0a7c 100644
--- a/Source/WebCore/page/Quirks.h
+++ b/Source/WebCore/page/Quirks.h
@@ -167,7 +167,7 @@ class Quirks {
 
     bool NODELETE needsPreloadAutoQuirk() const;
 
-    bool NODELETE needsPauseBeforeFullscreenExitQuirk() const;
+    bool NODELETE needsSuppressedPauseEventOnFullscreenExitQuirk() const;
 
     bool shouldBypassBackForwardCache() const;
     bool shouldBypassAsyncScriptDeferring() const;
@@ -262,7 +262,6 @@ class Quirks {
     bool needsToCopyUserSelectNoneQuirk() const { return m_needsToCopyUserSelectNoneQuirk; }
     void setNeedsToCopyUserSelectNoneQuirk() { m_needsToCopyUserSelectNoneQuirk = true; }
 
-    bool shouldEnableCanvas2DAdvancedPrivacyProtectionQuirk() const;
     String advancedPrivacyProtectionSubstituteDataURLForScriptWithFeatures(const String& lastDrawnText, int canvasWidth, int canvasHeight) const;
 
     bool NODELETE needsResettingTransitionCancelsRunningTransitionQuirk() const;
@@ -386,13 +385,6 @@ class Quirks {
 
 private:
     bool needsQuirks() const;
-
-    static bool domainNeedsAvoidResizingWhenInputViewBoundsChangeQuirk(const URL&, QuirksData&);
-    static bool domainNeedsScrollbarWidthThinDisabledQuirk(const URL&, QuirksData&);
-#if ENABLE(VIDEO_PRESENTATION_MODE)
-    static bool domainShouldDisableEndFullscreenEventWhenEnteringPictureInPictureFromFullscreenQuirk(const URL&, QuirksData&);
-#endif
-
     URL topDocumentURL() const;
 
     WeakPtr<Document, WeakPtrImplWithEventTargetData> m_document;
diff --git a/Source/WebCore/page/RemoteFrame.cpp b/Source/WebCore/page/RemoteFrame.cpp
index e096e05a6755..8275ac1c834b 100644
--- a/Source/WebCore/page/RemoteFrame.cpp
+++ b/Source/WebCore/page/RemoteFrame.cpp
@@ -257,7 +257,7 @@ ColorSchemePreference RemoteFrame::colorSchemePreference() const
 
 float RemoteFrame::usedZoomForChild(const Frame& child) const
 {
-    if (RefPtr info = frameTreeSyncData().childrenFrameLayoutInfo.get(child.frameID()))
+    if (RefPtr info = frameTreeSyncData().frameGeometry.childrenFrameLayoutInfo.get(child.frameID()))
         return info->usedZoom();
 
     return 1.0;
diff --git a/Source/WebCore/page/RemoteFrameLayoutInfo.cpp b/Source/WebCore/page/RemoteFrameLayoutInfo.cpp
index c7ce496ea3c7..96ddbdff64d6 100644
--- a/Source/WebCore/page/RemoteFrameLayoutInfo.cpp
+++ b/Source/WebCore/page/RemoteFrameLayoutInfo.cpp
@@ -28,6 +28,7 @@
 
 #include "FloatRect.h"
 #include <wtf/TZoneMallocInlines.h>
+#include <wtf/text/TextStream.h>
 
 namespace WebCore {
 
@@ -78,4 +79,35 @@ std::optional<FloatRect> RemoteFrameLayoutInfo::mapParentContentsToChildWindow(c
     return ownerLocal;
 }
 
+WTF::TextStream& operator<<(WTF::TextStream& ts, FrameOwnerElementAppearance appearance)
+{
+    switch (appearance) {
+    case FrameOwnerElementAppearance::IsDark:
+        ts << "IsDark"_s;
+        break;
+    case FrameOwnerElementAppearance::ExplicitlySet:
+        ts << "ExplicitlySet"_s;
+        break;
+    }
+    return ts;
+}
+
+WTF::TextStream& operator<<(WTF::TextStream& ts, const RemoteFrameLayoutInfo& info)
+{
+    WTF::TextStream::GroupScope scope(ts);
+    ts << "RemoteFrameLayoutInfo"_s;
+    ts.dumpProperty("windowClipRectInParent"_s, info.windowClipRectInParent());
+    ts.dumpProperty("visibleRectInParent"_s, info.visibleRectInParent());
+#if PLATFORM(IOS_FAMILY)
+    ts.dumpProperty("exposedContentRectInParent"_s, info.exposedContentRectInParent());
+#endif
+    ts.dumpProperty("ownerHasRenderer"_s, info.ownerHasRenderer());
+    ts.dumpProperty("childFrameOwnerToRootContentTransform"_s, info.childFrameOwnerToRootContentTransform());
+    ts.dumpProperty("absoluteToChildFrameOwnerLocalTransform"_s, info.absoluteToChildFrameOwnerLocalTransform());
+    ts.dumpProperty("usedZoom"_s, info.usedZoom());
+    ts.dumpProperty("contentBoxLocation"_s, info.contentBoxLocation());
+    ts.dumpProperty("ownerElementAppearance"_s, info.ownerElementAppearance());
+    return ts;
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/page/RemoteFrameLayoutInfo.h b/Source/WebCore/page/RemoteFrameLayoutInfo.h
index b6938a251757..25eaf57fb0ea 100644
--- a/Source/WebCore/page/RemoteFrameLayoutInfo.h
+++ b/Source/WebCore/page/RemoteFrameLayoutInfo.h
@@ -120,4 +120,7 @@ class RemoteFrameLayoutInfo : public RefCounted<RemoteFrameLayoutInfo> {
     OptionSet<FrameOwnerElementAppearance> m_ownerElementAppearance;
 };
 
+WEBCORE_EXPORT WTF::TextStream& operator<<(WTF::TextStream&, FrameOwnerElementAppearance);
+WEBCORE_EXPORT WTF::TextStream& operator<<(WTF::TextStream&, const RemoteFrameLayoutInfo&);
+
 };
diff --git a/Source/WebCore/page/RemoteFrameView.cpp b/Source/WebCore/page/RemoteFrameView.cpp
index 1d71a251348b..2d19cdc484f2 100644
--- a/Source/WebCore/page/RemoteFrameView.cpp
+++ b/Source/WebCore/page/RemoteFrameView.cpp
@@ -74,17 +74,17 @@ void RemoteFrameView::setFrameRect(const IntRect& newRect)
 
 LayoutRect RemoteFrameView::layoutViewportRect() const
 {
-    return m_frame->frameTreeSyncData().frameLayoutViewportRect;
+    return m_frame->frameTreeSyncData().frameGeometry.layoutViewportRect;
 }
 
 IntSize RemoteFrameView::contentsSize() const
 {
-    return m_frame->frameTreeSyncData().frameContentsSize;
+    return m_frame->frameTreeSyncData().frameGeometry.contentsSize;
 }
 
 std::optional<LayoutRect> RemoteFrameView::visibleRectOfChild(const Frame& child) const
 {
-    if (RefPtr info = m_frame->frameTreeSyncData().childrenFrameLayoutInfo.get(child.frameID()))
+    if (RefPtr info = m_frame->frameTreeSyncData().frameGeometry.childrenFrameLayoutInfo.get(child.frameID()))
         return info->visibleRectInParent();
 
     return std::nullopt;
@@ -92,7 +92,7 @@ std::optional<LayoutRect> RemoteFrameView::visibleRectOfChild(const Frame& child
 
 OptionSet<FrameOwnerElementAppearance> RemoteFrameView::appearanceOfOwnerElementOfChildFrame(const Frame& child) const
 {
-    if (RefPtr info = m_frame->frameTreeSyncData().childrenFrameLayoutInfo.get(child.frameID()))
+    if (RefPtr info = m_frame->frameTreeSyncData().frameGeometry.childrenFrameLayoutInfo.get(child.frameID()))
         return info->ownerElementAppearance();
 
     return { };
@@ -100,7 +100,7 @@ OptionSet<FrameOwnerElementAppearance> RemoteFrameView::appearanceOfOwnerElement
 
 LayoutPoint RemoteFrameView::childFrameOwnerContentBoxLocation(const Frame& child) const
 {
-    if (RefPtr info = m_frame->frameTreeSyncData().childrenFrameLayoutInfo.get(child.frameID()))
+    if (RefPtr info = m_frame->frameTreeSyncData().frameGeometry.childrenFrameLayoutInfo.get(child.frameID()))
         return info->contentBoxLocation();
 
     return { };
@@ -108,7 +108,7 @@ LayoutPoint RemoteFrameView::childFrameOwnerContentBoxLocation(const Frame& chil
 
 TransformationMatrix RemoteFrameView::childFrameOwnerToRootContentTransform(const Frame& child) const
 {
-    if (RefPtr info = m_frame->frameTreeSyncData().childrenFrameLayoutInfo.get(child.frameID()))
+    if (RefPtr info = m_frame->frameTreeSyncData().frameGeometry.childrenFrameLayoutInfo.get(child.frameID()))
         return info->childFrameOwnerToRootContentTransform();
 
     return { };
@@ -116,7 +116,7 @@ TransformationMatrix RemoteFrameView::childFrameOwnerToRootContentTransform(cons
 
 TransformationMatrix RemoteFrameView::absoluteToChildFrameOwnerLocalTransform(const Frame& child) const
 {
-    if (RefPtr info = m_frame->frameTreeSyncData().childrenFrameLayoutInfo.get(child.frameID()))
+    if (RefPtr info = m_frame->frameTreeSyncData().frameGeometry.childrenFrameLayoutInfo.get(child.frameID()))
         return info->absoluteToChildFrameOwnerLocalTransform();
 
     return { };
diff --git a/Source/WebCore/page/ResizeObservation.cpp b/Source/WebCore/page/ResizeObservation.cpp
index 9bc8642b834b..952d0e25fa83 100644
--- a/Source/WebCore/page/ResizeObservation.cpp
+++ b/Source/WebCore/page/ResizeObservation.cpp
@@ -81,9 +81,9 @@ auto ResizeObservation::computeObservedSizes() const -> std::optional<BoxSizes>
             if (box->isSkippedContent())
                 return std::nullopt;
             return { {
-                Style::adjustLayoutSizeForAbsoluteZoom(box->contentBoxSize(), *box),
-                Style::adjustLayoutSizeForAbsoluteZoom(box->contentBoxLogicalSize(), *box),
-                Style::adjustLayoutSizeForAbsoluteZoom(box->logicalSize(), *box)
+                Style::unapplyingZoom<LayoutSize>(box->contentBoxSize(), *box),
+                Style::unapplyingZoom<LayoutSize>(box->contentBoxLogicalSize(), *box),
+                Style::unapplyingZoom<LayoutSize>(box->logicalSize(), *box)
             } };
         }
     }
diff --git a/Source/WebCore/page/QuirkMatch.cpp b/Source/WebCore/page/URLMatch.cpp
similarity index 50%
rename from Source/WebCore/page/QuirkMatch.cpp
rename to Source/WebCore/page/URLMatch.cpp
index 1a8f148d3202..1220ac1c6ab7 100644
--- a/Source/WebCore/page/QuirkMatch.cpp
+++ b/Source/WebCore/page/URLMatch.cpp
@@ -24,92 +24,113 @@
  */
 
 #include "config.h"
-#include "QuirkMatch.h"
+#include "URLMatch.h"
 
 #include "PublicSuffixStore.h"
 #include "RegistrableDomain.h"
 
+#if PLATFORM(IOS_FAMILY)
+#include <pal/system/ios/UserInterfaceIdiom.h>
+#include <wtf/cocoa/RuntimeApplicationChecksCocoa.h>
+#endif
+
 namespace WebCore {
 
-const String& QuirkMatchContext::topRegistrableDomain() const
+const String& URLMatchContext::registrableDomain() const
 {
-    if (!m_topRegistrableDomain)
-        m_topRegistrableDomain = RegistrableDomain { m_topURL }.string();
-    return *m_topRegistrableDomain;
+    if (!m_registrableDomain)
+        m_registrableDomain = RegistrableDomain { m_url }.string();
+    return *m_registrableDomain;
 }
 
-const String& QuirkMatchContext::topDomainWithoutPublicSuffix() const
+const String& URLMatchContext::domainWithoutPublicSuffix() const
 {
-    if (!m_topDomainWithoutPublicSuffix)
-        m_topDomainWithoutPublicSuffix = PublicSuffixStore::singleton().domainWithoutPublicSuffix(topRegistrableDomain());
-    return *m_topDomainWithoutPublicSuffix;
+    if (!m_domainWithoutPublicSuffix)
+        m_domainWithoutPublicSuffix = PublicSuffixStore::singleton().domainWithoutPublicSuffix(registrableDomain());
+    return *m_domainWithoutPublicSuffix;
 }
 
-const String& QuirkMatchContext::documentRegistrableDomain() const
+bool evaluateURLEnvironment(URLEnvironment environment)
 {
-    if (!m_documentRegistrableDomain)
-        m_documentRegistrableDomain = RegistrableDomain { m_documentURL }.string();
-    return *m_documentRegistrableDomain;
+    switch (environment) {
+    case URLEnvironment::SmallScreen:
+#if PLATFORM(IOS_FAMILY)
+        return PAL::currentUserInterfaceIdiomIsSmallScreen();
+#else
+        return false;
+#endif
+    case URLEnvironment::TubularApp:
+#if PLATFORM(IOS_FAMILY)
+        return WTF::IOSApplication::isTubular();
+#else
+        return false;
+#endif
+    case URLEnvironment::LensApp:
+#if PLATFORM(IOS_FAMILY)
+        return WTF::IOSApplication::isLensApp();
+#else
+        return false;
+#endif
+    }
+
+    ASSERT_NOT_REACHED();
+    return false;
 }
 
-bool QuirkMatch::RefinementSet::matchesPathPattern(const URL& topURL) const
+bool URLMatch::RefinementSet::matchesPathPattern(const URL& url) const
 {
     switch (pathComparison) {
     case PathComparison::PathContains:
-        return topURL.path().contains(pathPattern);
+        return url.path().contains(pathPattern);
     case PathComparison::PathStartsWith:
-        return startsWithLettersIgnoringASCIICase(topURL.path(), pathPattern);
+        return startsWithLettersIgnoringASCIICase(url.path(), pathPattern);
     case PathComparison::PathOrFragmentContains:
-        return topURL.path().contains(pathPattern) || topURL.fragmentIdentifier().contains(pathPattern);
+        return url.path().contains(pathPattern) || url.fragmentIdentifier().contains(pathPattern);
     }
 
     ASSERT_NOT_REACHED();
     return false;
 }
 
-bool QuirkMatch::RefinementSet::matches(const QuirkMatchContext& context) const
+bool URLMatch::RefinementSet::matches(const URLMatchContext& context) const
 {
-    if (!pathPattern.isNull() && !matchesPathPattern(context.topURL()))
-        return false;
-
-    if (environment && !evaluateQuirkEnvironment(*environment))
-        return false;
-
-    if (requiresEmbeddedDocument && context.isTopDocument())
+    if (!pathPattern.isNull() && !matchesPathPattern(context.url()))
         return false;
 
-    if (!documentDomains.isEmpty() && !documentDomains.contains(context.documentRegistrableDomain()))
+    if (environment && !evaluateURLEnvironment(*environment))
         return false;
 
-    if (!hosts.isEmpty() && !hosts.contains(context.topHost()))
+    if (!hosts.isEmpty() && !hosts.contains(context.host()))
         return false;
 
     return true;
 }
 
-bool QuirkMatch::matchesSite(const QuirkMatchContext& context) const
+bool URLMatch::matchesURL(const URLMatchContext& context) const
 {
     switch (m_kind) {
     case Kind::Domain:
-        return m_patterns.contains(context.topRegistrableDomain());
+        return m_patterns.contains(context.registrableDomain());
     case Kind::Host:
-        return m_patterns.contains(context.topHost());
+        return m_patterns.contains(context.host());
     case Kind::HostOrSubdomainOf:
-        return m_patterns.containsMatching([&](ASCIILiteral pattern) { return context.topURL().isMatchingDomain(pattern); });
+        return m_patterns.containsMatching([&](ASCIILiteral pattern) {
+            return context.url().isMatchingDomain(pattern);
+        });
     case Kind::AnyTopLevelDomain:
-        return m_patterns.contains(context.topDomainWithoutPublicSuffix());
-    case Kind::AnySite:
-        // about:, data:, and other URLs without a host are not sites.
-        return !context.topHost().isEmpty();
+        return m_patterns.contains(context.domainWithoutPublicSuffix());
+    case Kind::Any:
+        // about:, data:, and other URLs without a host are never matched.
+        return !context.host().isEmpty();
     }
 
     ASSERT_NOT_REACHED();
     return false;
 }
 
-bool QuirkMatch::matches(const QuirkMatchContext& context) const
+bool URLMatch::matches(const URLMatchContext& context) const
 {
-    if (!matchesSite(context)) [[likely]]
+    if (!matchesURL(context)) [[likely]]
         return false;
 
     if (!m_refinements.matches(context))
diff --git a/Source/WebCore/page/QuirkMatch.h b/Source/WebCore/page/URLMatch.h
similarity index 56%
rename from Source/WebCore/page/QuirkMatch.h
rename to Source/WebCore/page/URLMatch.h
index 7d6c7a17b938..93b8ed676572 100644
--- a/Source/WebCore/page/QuirkMatch.h
+++ b/Source/WebCore/page/URLMatch.h
@@ -35,62 +35,76 @@
 #include <wtf/text/StringView.h>
 #include <wtf/text/WTFString.h>
 
+// URLMatch is a declarative description of a set of URLs
+//
+// Every match starts with exactly one static factory, which picks how the URL is
+// identified. Each takes a single pattern or a list of them:
+//
+//     domain()             the registrable domain, so "youtube.com" also covers
+//                          player.youtube.com but not youtube.co.uk
+//     host()               the exact host, so "docs.google.com" covers nothing else
+//     hostOrSubdomainOf()  the host or any subdomain of it, respecting label boundaries,
+//                          for HTTP-family URLs only
+//     anyTopLevelDomain()  the domain under every public suffix, so "amazon" covers
+//                          amazon.com and amazon.co.uk
+//     anyURL()             every URL with a host, for matches keyed only on refinements
+//
+// when() then narrows the match with URLRefinement refinements, all of which are ANDed
+// together:
+//
+//     URLMatch::anyTopLevelDomain("apple"_s).when(pathStartsWith("/store"_s))
+//
+// exceptWhen() takes the same refinements to carve matching URLs back out, so a
+// refinement reads identically in either position and its scope is bounded by the call:
+//
+//     URLMatch::domain("wix.com"_s).exceptWhen(pathStartsWith("/website/templates/"_s))
+//
+
 namespace WebCore {
 
-enum class QuirkEnvironment : uint8_t {
+enum class URLEnvironment : uint8_t {
     SmallScreen,
     TubularApp,
     LensApp,
 };
 
-WEBCORE_EXPORT bool evaluateQuirkEnvironment(QuirkEnvironment);
+WEBCORE_EXPORT bool evaluateURLEnvironment(URLEnvironment);
 
-enum class IsTopDocument : bool { No, Yes };
-
-class QuirkMatchContext {
+class URLMatchContext {
 public:
-    QuirkMatchContext(URL topURL, URL documentURL, IsTopDocument isTopDocument)
-        : m_topURL(WTF::move(topURL))
-        , m_documentURL(WTF::move(documentURL))
-        , m_isTopDocument(isTopDocument)
+    URLMatchContext(URL url)
+        : m_url(WTF::move(url))
     {
     }
 
-    const URL& topURL() const LIFETIME_BOUND { return m_topURL; }
-
-    bool isTopDocument() const { return m_isTopDocument == IsTopDocument::Yes; }
-
-    StringView topHost() const LIFETIME_BOUND { return m_topURL.host(); }
+    const URL& url() const LIFETIME_BOUND { return m_url; }
 
-    WEBCORE_EXPORT const String& topRegistrableDomain() const LIFETIME_BOUND;
+    StringView host() const LIFETIME_BOUND { return m_url.host(); }
 
-    WEBCORE_EXPORT const String& topDomainWithoutPublicSuffix() const LIFETIME_BOUND;
+    WEBCORE_EXPORT const String& domainWithoutPublicSuffix() const LIFETIME_BOUND;
 
-    WEBCORE_EXPORT const String& documentRegistrableDomain() const LIFETIME_BOUND;
+    WEBCORE_EXPORT const String& registrableDomain() const LIFETIME_BOUND;
 
 private:
-    const URL m_topURL;
-    const URL m_documentURL;
-    const IsTopDocument m_isTopDocument;
-    mutable std::optional<String> m_topRegistrableDomain;
-    mutable std::optional<String> m_topDomainWithoutPublicSuffix;
-    mutable std::optional<String> m_documentRegistrableDomain;
+    const URL m_url;
+    mutable std::optional<String> m_registrableDomain;
+    mutable std::optional<String> m_domainWithoutPublicSuffix;
 };
 
-class QuirkPatternList {
+class URLPatternList {
 public:
-    constexpr QuirkPatternList() = default;
+    constexpr URLPatternList() = default;
 
-    constexpr QuirkPatternList(ASCIILiteral pattern)
+    constexpr URLPatternList(ASCIILiteral pattern)
         : m_single(pattern)
     {
         RELEASE_ASSERT_UNDER_CONSTEXPR_CONTEXT(!pattern.isNull());
     }
 
-    template<size_t size> constexpr QuirkPatternList(const std::array<ASCIILiteral, size>& patterns LIFETIME_BOUND)
+    template<size_t size> constexpr URLPatternList(const std::array<ASCIILiteral, size>& patterns LIFETIME_BOUND)
         : m_multiple(patterns)
     {
-        static_assert(size, "A quirk pattern list must name at least one pattern.");
+        static_assert(size, "A URL pattern list must name at least one pattern.");
     }
 
     constexpr bool isEmpty() const { return m_single.isNull() && m_multiple.empty(); }
@@ -123,7 +137,7 @@ class QuirkPatternList {
     std::span<const ASCIILiteral> m_multiple;
 };
 
-namespace QuirkRefinement {
+namespace URLRefinement {
 
 struct PathContains {
     ASCIILiteral substring;
@@ -137,20 +151,14 @@ struct PathOrFragmentContains {
     ASCIILiteral substring;
 };
 
-struct DocumentDomainIs {
-    QuirkPatternList domains;
-};
-
 struct HostIs {
-    QuirkPatternList hosts;
+    URLPatternList hosts;
 };
 
 struct EnvironmentIs {
-    QuirkEnvironment environment;
+    URLEnvironment environment;
 };
 
-struct Embedded { };
-
 constexpr PathContains pathContains(ASCIILiteral substring)
 {
     return { substring };
@@ -166,90 +174,56 @@ constexpr PathOrFragmentContains pathOrFragmentContains(ASCIILiteral substring)
     return { substring };
 }
 
-constexpr DocumentDomainIs documentDomainIs(QuirkPatternList domains)
-{
-    return { domains };
-}
-
-constexpr HostIs hostIs(QuirkPatternList hosts)
+constexpr HostIs hostIs(URLPatternList hosts)
 {
     return { hosts };
 }
 
-constexpr Embedded embedded()
-{
-    return { };
-}
-
 constexpr EnvironmentIs smallScreen()
 {
-    return { QuirkEnvironment::SmallScreen };
+    return { URLEnvironment::SmallScreen };
 }
 
 constexpr EnvironmentIs tubularApp()
 {
-    return { QuirkEnvironment::TubularApp };
+    return { URLEnvironment::TubularApp };
 }
 
 constexpr EnvironmentIs lensApp()
 {
-    return { QuirkEnvironment::LensApp };
+    return { URLEnvironment::LensApp };
 }
 
-} // namespace QuirkRefinement
+} // namespace URLRefinement
 
-// QuirkMatch represents a declarative description of which pages a quirk applies to
-//
-// Every match starts with exactly one static factory, which picks how the site is
-// identified. Each takes a single pattern or a list of them:
-//
-//     domain()             the registrable domain, so "youtube.com" also covers
-//                          player.youtube.com but not youtube.co.uk
-//     host()               the exact host, so "docs.google.com" covers nothing else
-//     hostOrSubdomainOf()  the host or any subdomain of it, respecting label boundaries,
-//                          for HTTP-family URLs only
-//     anyTopLevelDomain()  the domain under every public suffix, so "amazon" covers
-//                          amazon.com and amazon.co.uk
-//     anySite()            every page with a host, for quirks keyed only on refinements
-//
-// when() then narrows the match with QuirkRefinement refinements, all of which are ANDed
-// together:
-//
-//     QuirkMatch::anyTopLevelDomain("apple"_s).when(pathStartsWith("/store"_s))
-//
-// exceptWhen() takes the same refinements to carve matching pages back out, so a
-// refinement reads identically in either position and its scope is bounded by the call:
-//
-//     QuirkMatch::domain("wix.com"_s).exceptWhen(pathStartsWith("/website/templates/"_s))
-//
-class QuirkMatch {
+class URLMatch {
 public:
-    static constexpr QuirkMatch domain(QuirkPatternList domains)
+    static constexpr URLMatch domain(URLPatternList domains)
     {
-        return QuirkMatch { Kind::Domain, domains };
+        return URLMatch { Kind::Domain, domains };
     }
 
-    static constexpr QuirkMatch host(QuirkPatternList hosts)
+    static constexpr URLMatch host(URLPatternList hosts)
     {
-        return QuirkMatch { Kind::Host, hosts };
+        return URLMatch { Kind::Host, hosts };
     }
 
-    static constexpr QuirkMatch hostOrSubdomainOf(QuirkPatternList hosts)
+    static constexpr URLMatch hostOrSubdomainOf(URLPatternList hosts)
     {
-        return QuirkMatch { Kind::HostOrSubdomainOf, hosts };
+        return URLMatch { Kind::HostOrSubdomainOf, hosts };
     }
 
-    static constexpr QuirkMatch anyTopLevelDomain(QuirkPatternList names)
+    static constexpr URLMatch anyTopLevelDomain(URLPatternList names)
     {
-        return QuirkMatch { Kind::AnyTopLevelDomain, names };
+        return URLMatch { Kind::AnyTopLevelDomain, names };
     }
 
-    static constexpr QuirkMatch anySite()
+    static constexpr URLMatch anyURL()
     {
-        return QuirkMatch { Kind::AnySite };
+        return URLMatch { Kind::Any };
     }
 
-    template<typename... Refinements> constexpr QuirkMatch when(Refinements... refinements) &&
+    template<typename... Refinements> constexpr URLMatch when(Refinements... refinements) &&
     {
         static_assert(sizeof...(refinements), "when() must name at least one refinement to match.");
 
@@ -257,7 +231,7 @@ class QuirkMatch {
         return WTF::move(*this);
     }
 
-    template<typename... Refinements> constexpr QuirkMatch exceptWhen(Refinements... refinements) &&
+    template<typename... Refinements> constexpr URLMatch exceptWhen(Refinements... refinements) &&
     {
         static_assert(sizeof...(refinements), "exceptWhen() must name at least one refinement to exclude.");
         RELEASE_ASSERT_UNDER_CONSTEXPR_CONTEXT(!m_exception);
@@ -268,7 +242,7 @@ class QuirkMatch {
         return WTF::move(*this);
     }
 
-    WEBCORE_EXPORT bool matches(const QuirkMatchContext&) const;
+    WEBCORE_EXPORT bool matches(const URLMatchContext&) const;
 
 private:
     enum class Kind : uint8_t {
@@ -276,7 +250,7 @@ class QuirkMatch {
         Host,
         HostOrSubdomainOf,
         AnyTopLevelDomain,
-        AnySite,
+        Any,
     };
 
     enum class PathComparison : uint8_t {
@@ -288,15 +262,13 @@ class QuirkMatch {
     struct RefinementSet {
         PathComparison pathComparison { PathComparison::PathContains };
         ASCIILiteral pathPattern;
-        std::optional<QuirkEnvironment> environment;
-        QuirkPatternList documentDomains;
-        QuirkPatternList hosts;
-        bool requiresEmbeddedDocument { false };
+        std::optional<URLEnvironment> environment;
+        URLPatternList hosts;
 
-        bool matches(const QuirkMatchContext&) const;
+        bool matches(const URLMatchContext&) const;
 
     private:
-        bool matchesPathPattern(const URL& topURL) const;
+        bool matchesPathPattern(const URL&) const;
     };
 
     static constexpr void setPathPattern(RefinementSet& set, PathComparison comparison, ASCIILiteral pattern)
@@ -306,60 +278,48 @@ class QuirkMatch {
         set.pathPattern = pattern;
     }
 
-    static constexpr void applyRefinement(RefinementSet& set, QuirkRefinement::PathContains refinement)
+    static constexpr void applyRefinement(RefinementSet& set, URLRefinement::PathContains refinement)
     {
         setPathPattern(set, PathComparison::PathContains, refinement.substring);
     }
 
-    static constexpr void applyRefinement(RefinementSet& set, QuirkRefinement::PathStartsWith refinement)
+    static constexpr void applyRefinement(RefinementSet& set, URLRefinement::PathStartsWith refinement)
     {
         setPathPattern(set, PathComparison::PathStartsWith, refinement.prefix);
     }
 
-    static constexpr void applyRefinement(RefinementSet& set, QuirkRefinement::PathOrFragmentContains refinement)
+    static constexpr void applyRefinement(RefinementSet& set, URLRefinement::PathOrFragmentContains refinement)
     {
         setPathPattern(set, PathComparison::PathOrFragmentContains, refinement.substring);
     }
 
-    static constexpr void applyRefinement(RefinementSet& set, QuirkRefinement::DocumentDomainIs refinement)
-    {
-        RELEASE_ASSERT_UNDER_CONSTEXPR_CONTEXT(set.documentDomains.isEmpty());
-        set.documentDomains = refinement.domains;
-    }
-
-    static constexpr void applyRefinement(RefinementSet& set, QuirkRefinement::HostIs refinement)
+    static constexpr void applyRefinement(RefinementSet& set, URLRefinement::HostIs refinement)
     {
         RELEASE_ASSERT_UNDER_CONSTEXPR_CONTEXT(set.hosts.isEmpty());
         set.hosts = refinement.hosts;
     }
 
-    static constexpr void applyRefinement(RefinementSet& set, QuirkRefinement::EnvironmentIs refinement)
+    static constexpr void applyRefinement(RefinementSet& set, URLRefinement::EnvironmentIs refinement)
     {
         RELEASE_ASSERT_UNDER_CONSTEXPR_CONTEXT(!set.environment);
         set.environment = refinement.environment;
     }
 
-    static constexpr void applyRefinement(RefinementSet& set, QuirkRefinement::Embedded)
-    {
-        RELEASE_ASSERT_UNDER_CONSTEXPR_CONTEXT(!set.requiresEmbeddedDocument);
-        set.requiresEmbeddedDocument = true;
-    }
-
-    constexpr explicit QuirkMatch(Kind kind)
+    constexpr explicit URLMatch(Kind kind)
         : m_kind(kind)
     {
     }
 
-    constexpr QuirkMatch(Kind kind, QuirkPatternList patterns)
+    constexpr URLMatch(Kind kind, URLPatternList patterns)
         : m_kind(kind)
         , m_patterns(patterns)
     {
     }
 
-    bool matchesSite(const QuirkMatchContext&) const;
+    bool matchesURL(const URLMatchContext&) const;
 
     Kind m_kind;
-    QuirkPatternList m_patterns;
+    URLPatternList m_patterns;
     RefinementSet m_refinements;
     std::optional<RefinementSet> m_exception;
 };
diff --git a/Source/WebCore/platform/Cookie.h b/Source/WebCore/platform/Cookie.h
index bef6c7fa47a8..f85e1b8cc959 100644
--- a/Source/WebCore/platform/Cookie.h
+++ b/Source/WebCore/platform/Cookie.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2009 Joseph Pecoraro. All rights reserved.
- * Copyright (C) 2017-2018 Apple Inc. All rights reserved.
+ * Copyright (C) 2017-2026 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,9 +26,10 @@
 
 #pragma once
 
+#include <optional>
+#include <wtf/Forward.h>
 #include <wtf/RetainPtr.h>
 #include <wtf/URL.h>
-#include <wtf/text/StringHash.h>
 #include <wtf/text/WTFString.h>
 
 #ifdef __OBJC__
@@ -127,6 +128,8 @@ namespace CookieUtil {
 
 WEBCORE_EXPORT String defaultPathForURL(const URL&);
 
+std::optional<String> cookieStringWithDayFirstExpires(StringView);
+
 } // namespace CookieUtil
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/PlatformScreen.cpp b/Source/WebCore/platform/PlatformScreen.cpp
index 154251118cd4..3f7835df0d13 100644
--- a/Source/WebCore/platform/PlatformScreen.cpp
+++ b/Source/WebCore/platform/PlatformScreen.cpp
@@ -30,6 +30,7 @@
 
 #include "ScreenProperties.h"
 #include <wtf/Lock.h>
+#include <wtf/MainThread.h>
 #include <wtf/NeverDestroyed.h>
 #include <wtf/TZoneMallocInlines.h>
 
@@ -124,6 +125,19 @@ void PlatformScreen::updateSingletonContentsFormatsForTesting(OptionSet<Contents
 }
 #endif
 
+#if PLATFORM(COCOA) && !PLATFORM(MAC)
+
+void collectScreenPropertiesAsync(CompletionHandler<void(ScreenProperties&&)>&& completionHandler)
+{
+    ASSERT(isMainThread());
+
+    callOnMainThread([screenProperties = collectScreenProperties(), completionHandler = WTF::move(completionHandler)]() mutable {
+        completionHandler(WTF::move(screenProperties));
+    });
+}
+
+#endif // PLATFORM(COCOA) && !PLATFORM(MAC)
+
 } // namespace WebCore
 
 #endif // PLATFORM(COCOA) || PLATFORM(GTK) || (PLATFORM(WPE) && ENABLE(WPE_PLATFORM))
diff --git a/Source/WebCore/platform/PlatformScreen.h b/Source/WebCore/platform/PlatformScreen.h
index 68f7a5502c84..ea0c97d040f3 100644
--- a/Source/WebCore/platform/PlatformScreen.h
+++ b/Source/WebCore/platform/PlatformScreen.h
@@ -28,6 +28,7 @@
 #include <WebCore/ContentsFormat.h>
 #include <WebCore/ScreenProperties.h>
 #include <memory>
+#include <wtf/CompletionHandler.h>
 #include <wtf/Forward.h>
 #include <wtf/Platform.h>
 #include <wtf/ThreadSafeRefCounted.h>
@@ -121,6 +122,7 @@ class PlatformScreen : public ThreadSafeRefCounted<PlatformScreen> {
 };
 
 WEBCORE_EXPORT ScreenProperties collectScreenProperties();
+WEBCORE_EXPORT void collectScreenPropertiesAsync(CompletionHandler<void(ScreenProperties&&)>&&);
 
 #if HAVE(SUPPORT_HDR_DISPLAY)
 WEBCORE_EXPORT float currentEDRHeadroomForDisplay(PlatformDisplayID);
diff --git a/Source/WebCore/platform/TrackInfo.h b/Source/WebCore/platform/TrackInfo.h
index 33563608505f..e37da573883e 100644
--- a/Source/WebCore/platform/TrackInfo.h
+++ b/Source/WebCore/platform/TrackInfo.h
@@ -60,6 +60,15 @@ enum class EncryptionBoxType : uint8_t {
     TransportStreamEncryptionInitData
 };
 
+// Ordering of the two fields of an interlaced frame, both temporally and within
+// the frame buffer.
+enum class PlatformVideoFieldDetail : uint8_t {
+    TemporalTopFirst,
+    TemporalBottomFirst,
+    SpatialFirstLineEarly,
+    SpatialFirstLineLate
+};
+
 using TrackInfoAtomData = std::pair<FourCC, Ref<SharedBuffer>>;
 #if ENABLE(ENCRYPTED_MEDIA)
 using TrackInfoEncryptionData = std::pair<EncryptionBoxType, Ref<SharedBuffer>>;
@@ -147,6 +156,9 @@ struct VideoSpecificInfoData {
     FloatSize displaySize { };
     uint8_t bitDepth { 8 };
     PlatformVideoColorSpace colorSpace { };
+    // Number of fields per frame: 1 for progressive content, 2 for interlaced.
+    std::optional<uint8_t> fieldCount { };
+    std::optional<PlatformVideoFieldDetail> fieldDetail { };
     Vector<TrackInfo::AtomData> extensionAtoms { };
 
 #if PLATFORM(VISION)
@@ -168,6 +180,8 @@ class VideoInfo : public TrackInfo {
     const FloatSize& displaySize() const LIFETIME_BOUND { return m_data.displaySize; }
     uint8_t bitDepth() const { return m_data.bitDepth; }
     const PlatformVideoColorSpace& colorSpace() const LIFETIME_BOUND { return m_data.colorSpace; }
+    std::optional<uint8_t> fieldCount() const { return m_data.fieldCount; }
+    std::optional<PlatformVideoFieldDetail> fieldDetail() const { return m_data.fieldDetail; }
 
     const Vector<AtomData>& extensionAtoms() const LIFETIME_BOUND { return m_data.extensionAtoms; }
 
diff --git a/Source/WebCore/platform/WebCorePersistentCoders.cpp b/Source/WebCore/platform/WebCorePersistentCoders.cpp
index 25a63f5f3498..4a8304a73c68 100644
--- a/Source/WebCore/platform/WebCorePersistentCoders.cpp
+++ b/Source/WebCore/platform/WebCorePersistentCoders.cpp
@@ -699,6 +699,7 @@ void Coder<WebCore::ResourceResponse>::encodeForPersistence(Encoder& encoder, co
     WebCore::WasPrivateRelayed wasPrivateRelayed = instance.m_wasPrivateRelayed;
     encoder << wasPrivateRelayed;
     encoder << instance.m_isRangeRequested;
+    encoder << static_cast<WebCore::IPAddressSpace>(instance.m_ipAddressSpace);
 }
 
 std::optional<WebCore::ResourceResponse> Coder<WebCore::ResourceResponse>::decodeForPersistence(Decoder& decoder)
@@ -810,6 +811,12 @@ std::optional<WebCore::ResourceResponse> Coder<WebCore::ResourceResponse>::decod
         return std::nullopt;
     response.m_isRangeRequested = WTF::move(*isRangeRequested);
 
+    std::optional<WebCore::IPAddressSpace> ipAddressSpace;
+    decoder >> ipAddressSpace;
+    if (!ipAddressSpace)
+        return std::nullopt;
+    response.m_ipAddressSpace = WTF::move(*ipAddressSpace);
+
     return { WTF::move(response) };
 }
 
diff --git a/Source/WebCore/platform/cocoa/CoreVideoSoftLink.cpp b/Source/WebCore/platform/cocoa/CoreVideoSoftLink.cpp
index 622057819eb3..cd6bc8cadb4f 100644
--- a/Source/WebCore/platform/cocoa/CoreVideoSoftLink.cpp
+++ b/Source/WebCore/platform/cocoa/CoreVideoSoftLink.cpp
@@ -96,6 +96,21 @@ SOFT_LINK_CONSTANT_FOR_SOURCE(WebCore, CoreVideo, kCVImageBufferYCbCrMatrix_ITU_
 SOFT_LINK_CONSTANT_FOR_SOURCE(WebCore, CoreVideo, kCVImageBufferPixelAspectRatioKey, CFStringRef)
 SOFT_LINK_CONSTANT_FOR_SOURCE(WebCore, CoreVideo, kCVImageBufferPixelAspectRatioHorizontalSpacingKey, CFStringRef)
 SOFT_LINK_CONSTANT_FOR_SOURCE(WebCore, CoreVideo, kCVImageBufferPixelAspectRatioVerticalSpacingKey, CFStringRef)
+SOFT_LINK_CONSTANT_FOR_SOURCE(WebCore, CoreVideo, kCVImageBufferChromaLocationTopFieldKey, CFStringRef)
+SOFT_LINK_CONSTANT_FOR_SOURCE(WebCore, CoreVideo, kCVImageBufferChromaLocationBottomFieldKey, CFStringRef)
+SOFT_LINK_CONSTANT_FOR_SOURCE(WebCore, CoreVideo, kCVImageBufferChromaLocation_Left, CFStringRef)
+SOFT_LINK_CONSTANT_FOR_SOURCE(WebCore, CoreVideo, kCVImageBufferChromaLocation_Center, CFStringRef)
+SOFT_LINK_CONSTANT_FOR_SOURCE(WebCore, CoreVideo, kCVImageBufferChromaLocation_TopLeft, CFStringRef)
+SOFT_LINK_CONSTANT_FOR_SOURCE(WebCore, CoreVideo, kCVImageBufferChromaLocation_Top, CFStringRef)
+SOFT_LINK_CONSTANT_FOR_SOURCE(WebCore, CoreVideo, kCVImageBufferChromaLocation_BottomLeft, CFStringRef)
+SOFT_LINK_CONSTANT_FOR_SOURCE(WebCore, CoreVideo, kCVImageBufferChromaLocation_Bottom, CFStringRef)
+SOFT_LINK_CONSTANT_FOR_SOURCE(WebCore, CoreVideo, kCVImageBufferChromaLocation_DV420, CFStringRef)
+SOFT_LINK_CONSTANT_FOR_SOURCE(WebCore, CoreVideo, kCVImageBufferFieldCountKey, CFStringRef)
+SOFT_LINK_CONSTANT_FOR_SOURCE(WebCore, CoreVideo, kCVImageBufferFieldDetailKey, CFStringRef)
+SOFT_LINK_CONSTANT_FOR_SOURCE(WebCore, CoreVideo, kCVImageBufferFieldDetailTemporalTopFirst, CFStringRef)
+SOFT_LINK_CONSTANT_FOR_SOURCE(WebCore, CoreVideo, kCVImageBufferFieldDetailTemporalBottomFirst, CFStringRef)
+SOFT_LINK_CONSTANT_FOR_SOURCE(WebCore, CoreVideo, kCVImageBufferFieldDetailSpatialFirstLineEarly, CFStringRef)
+SOFT_LINK_CONSTANT_FOR_SOURCE(WebCore, CoreVideo, kCVImageBufferFieldDetailSpatialFirstLineLate, CFStringRef)
 SOFT_LINK_CONSTANT_FOR_SOURCE(WebCore, CoreVideo, kCVImageBufferCGColorSpaceKey, CFStringRef)
 
 SOFT_LINK_CONSTANT_FOR_SOURCE(WebCore, CoreVideo, kCVImageBufferCleanApertureKey, CFStringRef)
diff --git a/Source/WebCore/platform/cocoa/CoreVideoSoftLink.h b/Source/WebCore/platform/cocoa/CoreVideoSoftLink.h
index d6feca37c86a..f9ef881dbba8 100644
--- a/Source/WebCore/platform/cocoa/CoreVideoSoftLink.h
+++ b/Source/WebCore/platform/cocoa/CoreVideoSoftLink.h
@@ -169,6 +169,36 @@ SOFT_LINK_CONSTANT_FOR_HEADER(WebCore, CoreVideo, kCVImageBufferPixelAspectRatio
 #define kCVImageBufferPixelAspectRatioHorizontalSpacingKey get_CoreVideo_kCVImageBufferPixelAspectRatioHorizontalSpacingKeySingleton()
 SOFT_LINK_CONSTANT_FOR_HEADER(WebCore, CoreVideo, kCVImageBufferPixelAspectRatioVerticalSpacingKey, CFStringRef)
 #define kCVImageBufferPixelAspectRatioVerticalSpacingKey get_CoreVideo_kCVImageBufferPixelAspectRatioVerticalSpacingKeySingleton()
+SOFT_LINK_CONSTANT_FOR_HEADER(WebCore, CoreVideo, kCVImageBufferChromaLocationTopFieldKey, CFStringRef)
+#define kCVImageBufferChromaLocationTopFieldKey get_CoreVideo_kCVImageBufferChromaLocationTopFieldKeySingleton()
+SOFT_LINK_CONSTANT_FOR_HEADER(WebCore, CoreVideo, kCVImageBufferChromaLocationBottomFieldKey, CFStringRef)
+#define kCVImageBufferChromaLocationBottomFieldKey get_CoreVideo_kCVImageBufferChromaLocationBottomFieldKeySingleton()
+SOFT_LINK_CONSTANT_FOR_HEADER(WebCore, CoreVideo, kCVImageBufferChromaLocation_Left, CFStringRef)
+#define kCVImageBufferChromaLocation_Left get_CoreVideo_kCVImageBufferChromaLocation_LeftSingleton()
+SOFT_LINK_CONSTANT_FOR_HEADER(WebCore, CoreVideo, kCVImageBufferChromaLocation_Center, CFStringRef)
+#define kCVImageBufferChromaLocation_Center get_CoreVideo_kCVImageBufferChromaLocation_CenterSingleton()
+SOFT_LINK_CONSTANT_FOR_HEADER(WebCore, CoreVideo, kCVImageBufferChromaLocation_TopLeft, CFStringRef)
+#define kCVImageBufferChromaLocation_TopLeft get_CoreVideo_kCVImageBufferChromaLocation_TopLeftSingleton()
+SOFT_LINK_CONSTANT_FOR_HEADER(WebCore, CoreVideo, kCVImageBufferChromaLocation_Top, CFStringRef)
+#define kCVImageBufferChromaLocation_Top get_CoreVideo_kCVImageBufferChromaLocation_TopSingleton()
+SOFT_LINK_CONSTANT_FOR_HEADER(WebCore, CoreVideo, kCVImageBufferChromaLocation_BottomLeft, CFStringRef)
+#define kCVImageBufferChromaLocation_BottomLeft get_CoreVideo_kCVImageBufferChromaLocation_BottomLeftSingleton()
+SOFT_LINK_CONSTANT_FOR_HEADER(WebCore, CoreVideo, kCVImageBufferChromaLocation_Bottom, CFStringRef)
+#define kCVImageBufferChromaLocation_Bottom get_CoreVideo_kCVImageBufferChromaLocation_BottomSingleton()
+SOFT_LINK_CONSTANT_FOR_HEADER(WebCore, CoreVideo, kCVImageBufferChromaLocation_DV420, CFStringRef)
+#define kCVImageBufferChromaLocation_DV420 get_CoreVideo_kCVImageBufferChromaLocation_DV420Singleton()
+SOFT_LINK_CONSTANT_FOR_HEADER(WebCore, CoreVideo, kCVImageBufferFieldCountKey, CFStringRef)
+#define kCVImageBufferFieldCountKey get_CoreVideo_kCVImageBufferFieldCountKeySingleton()
+SOFT_LINK_CONSTANT_FOR_HEADER(WebCore, CoreVideo, kCVImageBufferFieldDetailKey, CFStringRef)
+#define kCVImageBufferFieldDetailKey get_CoreVideo_kCVImageBufferFieldDetailKeySingleton()
+SOFT_LINK_CONSTANT_FOR_HEADER(WebCore, CoreVideo, kCVImageBufferFieldDetailTemporalTopFirst, CFStringRef)
+#define kCVImageBufferFieldDetailTemporalTopFirst get_CoreVideo_kCVImageBufferFieldDetailTemporalTopFirstSingleton()
+SOFT_LINK_CONSTANT_FOR_HEADER(WebCore, CoreVideo, kCVImageBufferFieldDetailTemporalBottomFirst, CFStringRef)
+#define kCVImageBufferFieldDetailTemporalBottomFirst get_CoreVideo_kCVImageBufferFieldDetailTemporalBottomFirstSingleton()
+SOFT_LINK_CONSTANT_FOR_HEADER(WebCore, CoreVideo, kCVImageBufferFieldDetailSpatialFirstLineEarly, CFStringRef)
+#define kCVImageBufferFieldDetailSpatialFirstLineEarly get_CoreVideo_kCVImageBufferFieldDetailSpatialFirstLineEarlySingleton()
+SOFT_LINK_CONSTANT_FOR_HEADER(WebCore, CoreVideo, kCVImageBufferFieldDetailSpatialFirstLineLate, CFStringRef)
+#define kCVImageBufferFieldDetailSpatialFirstLineLate get_CoreVideo_kCVImageBufferFieldDetailSpatialFirstLineLateSingleton()
 SOFT_LINK_CONSTANT_FOR_HEADER(WebCore, CoreVideo, kCVImageBufferCGColorSpaceKey, CFStringRef)
 #define kCVImageBufferCGColorSpaceKey get_CoreVideo_kCVImageBufferCGColorSpaceKeySingleton()
 SOFT_LINK_CONSTANT_FOR_HEADER(WebCore, CoreVideo, kCVImageBufferCleanApertureKey, CFStringRef)
diff --git a/Source/WebCore/platform/cocoa/NetworkExtensionContentFilter.mm b/Source/WebCore/platform/cocoa/NetworkExtensionContentFilter.mm
index aa0f0d542919..9f9f515b93ed 100644
--- a/Source/WebCore/platform/cocoa/NetworkExtensionContentFilter.mm
+++ b/Source/WebCore/platform/cocoa/NetworkExtensionContentFilter.mm
@@ -44,6 +44,7 @@
 #import <wtf/URL.h>
 #import <wtf/cocoa/RuntimeApplicationChecksCocoa.h>
 #import <wtf/cocoa/TypeCastsCocoa.h>
+#import <wtf/darwin/DispatchExtras.h>
 #import <wtf/threads/BinarySemaphore.h>
 
 static inline NSData *replacementDataFromDecisionInfo(NSDictionary *decisionInfo)
@@ -70,7 +71,7 @@
 {
     ASSERT(!m_queue);
     ASSERT(!m_neFilterSource);
-    m_queue = adoptOSObject(dispatch_queue_create("WebKit NetworkExtension Filtering", DISPATCH_QUEUE_SERIAL));
+    m_queue = adoptOSObject(dispatch_queue_create("WebKit NetworkExtension Filtering", serialQueueWithAutoreleasePoolAttrSingleton()));
     ASSERT_UNUSED(url, !url);
     m_neFilterSource = adoptNS([[NEFilterSource alloc] initWithDecisionQueue:m_queue.get()]);
     [m_neFilterSource setSourceAppIdentifier:applicationBundleIdentifier().createNSString().get()];
diff --git a/Source/WebCore/platform/cocoa/SharedVideoFrameInfo.mm b/Source/WebCore/platform/cocoa/SharedVideoFrameInfo.mm
index a7ff7a820a30..15d0433ec029 100644
--- a/Source/WebCore/platform/cocoa/SharedVideoFrameInfo.mm
+++ b/Source/WebCore/platform/cocoa/SharedVideoFrameInfo.mm
@@ -281,23 +281,53 @@
 }
 
 #if USE(LIBWEBRTC)
+template<typename byteType>
+uint32_t computeStrideY(const webrtc::VideoFrameBuffer& frame)
+{
+    auto width = static_cast<uint32_t>(frame.width());
+    return sizeof(byteType) * width;
+}
+
+template<typename byteType>
+uint32_t computeStrideUV(const webrtc::VideoFrameBuffer& frame)
+{
+    auto width = static_cast<uint32_t>(frame.width());
+    return sizeof(byteType) * (width & 1 ? width + 1 : width);
+}
+
+static uint32_t computeWidthUV(const webrtc::VideoFrameBuffer& frame)
+{
+    auto width = static_cast<uint32_t>(frame.width());
+    return (width + 1) / 2;
+}
+
+static uint32_t computeHeightUV(const webrtc::VideoFrameBuffer& frame)
+{
+    auto height = static_cast<uint32_t>(frame.height());
+    return (height + 1) / 2;
+}
+
 SharedVideoFrameInfo SharedVideoFrameInfo::fromVideoFrameBuffer(const webrtc::VideoFrameBuffer& frame)
 {
     if (frame.type() == webrtc::VideoFrameBuffer::Type::kNative)
         return SharedVideoFrameInfo { };
 
     auto type = frame.type();
-    if (type == webrtc::VideoFrameBuffer::Type::kI420)
-        return SharedVideoFrameInfo { kCVPixelFormatType_420YpCbCr8BiPlanarFullRange,
-            static_cast<uint32_t>(frame.width()), static_cast<uint32_t>(frame.height()), static_cast<uint32_t>(frame.width()),
-            static_cast<uint32_t>(frame.width()) / 2, static_cast<uint32_t>(frame.height()) / 2, static_cast<uint32_t>(frame.width()) };
-
-    if (type == webrtc::VideoFrameBuffer::Type::kI010)
-        return SharedVideoFrameInfo { kCVPixelFormatType_420YpCbCr10BiPlanarFullRange,
-            static_cast<uint32_t>(frame.width()), static_cast<uint32_t>(frame.height()), static_cast<uint32_t>(frame.width() * 2),
-            static_cast<uint32_t>(frame.width()) / 2, static_cast<uint32_t>(frame.height()) / 2, static_cast<uint32_t>(frame.width()) * 2 };
-
-    return SharedVideoFrameInfo { };
+    if (type == webrtc::VideoFrameBuffer::Type::kI420) {
+        return {
+            kCVPixelFormatType_420YpCbCr8BiPlanarFullRange,
+            static_cast<uint32_t>(frame.width()), static_cast<uint32_t>(frame.height()), computeStrideY<uint8_t>(frame),
+            computeWidthUV(frame), computeHeightUV(frame), computeStrideUV<uint8_t>(frame)
+        };
+    }
+    if (type == webrtc::VideoFrameBuffer::Type::kI010) {
+        return {
+            kCVPixelFormatType_420YpCbCr10BiPlanarFullRange,
+            static_cast<uint32_t>(frame.width()), static_cast<uint32_t>(frame.height()), computeStrideY<uint16_t>(frame),
+            computeWidthUV(frame), computeHeightUV(frame), computeStrideUV<uint16_t>(frame)
+        };
+    }
+    return { };
 }
 
 bool SharedVideoFrameInfo::writeVideoFrameBuffer(webrtc::VideoFrameBuffer& frameBuffer, std::span<uint8_t> data)
diff --git a/Source/WebCore/platform/graphics/Font.cpp b/Source/WebCore/platform/graphics/Font.cpp
index f7fb568a4b79..1ebb2d6ce7b2 100644
--- a/Source/WebCore/platform/graphics/Font.cpp
+++ b/Source/WebCore/platform/graphics/Font.cpp
@@ -105,12 +105,11 @@ Font::Font(const FontPlatformData& platformData, Origin origin, IsInterstitial i
     , m_shouldNotBeUsedForArabic(false)
 #endif
 {
-    relaxAdoptionRequirement();
     platformInit();
     platformGlyphInit();
     platformCharWidthInit();
 #if ENABLE(OPENTYPE_VERTICAL)
-    if (platformData.orientation() == FontOrientation::Vertical && orientationFallback == IsOrientationFallback::No) {
+    if (platformData.orientation() == FontOrientation::Vertical && !isTextOrientationFallback()) {
         m_verticalData = FontCache::forCurrentThread().verticalData(platformData);
         m_hasVerticalGlyphs = m_verticalData.get() && m_verticalData->hasVerticalMetrics();
     }
@@ -195,7 +194,7 @@ void Font::platformGlyphInit()
     if (RefPtr page = glyphPage(GlyphPage::pageNumberForCodePoint('0')))
         zeroGlyph = page->glyphDataForCharacter('0').glyph;
     if (zeroGlyph)
-        m_fontMetrics.setZeroWidth(widthForGlyph(zeroGlyph));
+        initZeroWidth(zeroGlyph);
 
     // Use the width of the CJK water ideogram (U+6C34) as the
     // approximated width of ideograms in the font, as mentioned in
@@ -215,6 +214,22 @@ void Font::platformGlyphInit()
     determinePitch();
 }
 
+void Font::initZeroWidth(Glyph zeroGlyph)
+{
+#if ENABLE(OPENTYPE_VERTICAL)
+    // For upright vertical text the CSS 'ch' unit is the '0' glyph's vertical advance.
+    // Use the advance height from the fon't vertical metrics (vmtx) when present, otherwise fall back
+    // to the horizontal advance.
+    RefPtr<OpenTypeVerticalData> verticalData;
+    if (platformData().orientation() == FontOrientation::Vertical && !isTextOrientationFallback())
+        verticalData = FontCache::forCurrentThread().verticalData(platformData());
+    if (verticalData && verticalData->hasVerticalMetrics())
+        m_fontMetrics.setZeroWidth(verticalData->advanceHeight(this, zeroGlyph));
+    else
+#endif
+        m_fontMetrics.setZeroWidth(widthForGlyph(zeroGlyph));
+}
+
 Font::~Font()
 {
     if (auto* cache = SystemFallbackFontCache::forCurrentThreadIfExists())
diff --git a/Source/WebCore/platform/graphics/Font.h b/Source/WebCore/platform/graphics/Font.h
index 00f2d36972e7..937ef57b9130 100644
--- a/Source/WebCore/platform/graphics/Font.h
+++ b/Source/WebCore/platform/graphics/Font.h
@@ -275,6 +275,8 @@ class Font : public RefCounted<Font>, public CanMakeSingleThreadWeakPtr<Font> {
 
     void initCharWidths();
 
+    void initZeroWidth(Glyph);
+
     RefPtr<Font> createFontWithoutSynthesizableFeatures() const;
     RefPtr<Font> createScaledFont(const FontDescription&, float scaleFactor) const;
     RefPtr<Font> platformCreateScaledFont(const FontDescription&, float scaleFactor) const;
diff --git a/Source/WebCore/platform/graphics/GraphicsLayer.h b/Source/WebCore/platform/graphics/GraphicsLayer.h
index cb3d8147df4c..20ffeac30899 100644
--- a/Source/WebCore/platform/graphics/GraphicsLayer.h
+++ b/Source/WebCore/platform/graphics/GraphicsLayer.h
@@ -316,6 +316,9 @@ class GraphicsLayer : public RefCountedAndCanMakeWeakPtr<GraphicsLayer> {
     virtual void setBackdropFiltersRect(const FloatRoundedRect& backdropFiltersRect) { m_backdropFiltersRect = backdropFiltersRect; }
     const FloatRoundedRect& backdropFiltersRect() const LIFETIME_BOUND { return m_backdropFiltersRect; }
 
+    Path backdropFiltersShapePath() const { return m_backdropFiltersShapePath; }
+    virtual void setBackdropFiltersShapePath(const Path& path) { m_backdropFiltersShapePath = path; }
+
     BlendMode blendMode() const { return m_blendMode; }
     virtual void setBlendMode(BlendMode blendMode) { m_blendMode = blendMode; }
 
@@ -699,6 +702,7 @@ class GraphicsLayer : public RefCountedAndCanMakeWeakPtr<GraphicsLayer> {
     ScalingFilter m_contentsMinificationFilter = ScalingFilter::Linear;
     ScalingFilter m_contentsMagnificationFilter = ScalingFilter::Linear;
     FloatRoundedRect m_backdropFiltersRect;
+    Path m_backdropFiltersShapePath;
     std::optional<FloatRect> m_animationExtent;
 
     EventRegion m_eventRegion;
diff --git a/Source/WebCore/platform/graphics/ImageBackingStore.h b/Source/WebCore/platform/graphics/ImageBackingStore.h
index 82baae803e7f..9a93f04da7a4 100644
--- a/Source/WebCore/platform/graphics/ImageBackingStore.h
+++ b/Source/WebCore/platform/graphics/ImageBackingStore.h
@@ -207,7 +207,7 @@ class ImageBackingStore {
         : m_premultiplyAlpha(premultiplyAlpha)
     {
         ASSERT(!size.isEmpty() && !isOverSize(size));
-        setSize(size);
+        RELEASE_ASSERT(setSize(size));
     }
 
     ImageBackingStore(const ImageBackingStore& other)
diff --git a/Source/WebCore/platform/graphics/PlatformVideoChromaLocation.h b/Source/WebCore/platform/graphics/PlatformVideoChromaLocation.h
new file mode 100644
index 000000000000..bb1ecd5db282
--- /dev/null
+++ b/Source/WebCore/platform/graphics/PlatformVideoChromaLocation.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2026 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include <wtf/Forward.h>
+
+namespace WebCore {
+
+// Where a chroma sample sits relative to the luma samples it is shared with. The
+// comments give the matching ISO/IEC 23091-2 chroma_sample_loc_type value.
+enum class PlatformVideoChromaLocation : uint8_t {
+    Left, // 0, the MPEG-2 and H.264 default
+    Center, // 1, as used by MPEG-1 and JPEG
+    TopLeft, // 2
+    Top, // 3
+    BottomLeft, // 4
+    Bottom, // 5
+    // Cr and Cb alternately co-sited with the left luma samples of the same field.
+    // DV only, no ISO/IEC 23091-2 equivalent.
+    Dv420,
+    Unspecified,
+};
+
+WEBCORE_EXPORT WTF::TextStream& operator<<(WTF::TextStream&, PlatformVideoChromaLocation);
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/PlatformVideoColorSpace.cpp b/Source/WebCore/platform/graphics/PlatformVideoColorSpace.cpp
index 97b4616fdf38..68a3a7f2fa27 100644
--- a/Source/WebCore/platform/graphics/PlatformVideoColorSpace.cpp
+++ b/Source/WebCore/platform/graphics/PlatformVideoColorSpace.cpp
@@ -169,6 +169,37 @@ WTF::TextStream& operator<<(WTF::TextStream& ts, PlatformVideoTransferCharacteri
     return ts;
 }
 
+WTF::TextStream& operator<<(WTF::TextStream& ts, PlatformVideoChromaLocation chromaLocation)
+{
+    switch (chromaLocation) {
+    case PlatformVideoChromaLocation::Left:
+        ts << "left"_s;
+        break;
+    case PlatformVideoChromaLocation::Center:
+        ts << "center"_s;
+        break;
+    case PlatformVideoChromaLocation::TopLeft:
+        ts << "top-left"_s;
+        break;
+    case PlatformVideoChromaLocation::Top:
+        ts << "top"_s;
+        break;
+    case PlatformVideoChromaLocation::BottomLeft:
+        ts << "bottom-left"_s;
+        break;
+    case PlatformVideoChromaLocation::Bottom:
+        ts << "bottom"_s;
+        break;
+    case PlatformVideoChromaLocation::Dv420:
+        ts << "dv420"_s;
+        break;
+    case PlatformVideoChromaLocation::Unspecified:
+        ts << "unspecified"_s;
+        break;
+    }
+    return ts;
+}
+
 WTF::TextStream& operator<<(WTF::TextStream& ts, PlatformVideoColorSpace colorSpace)
 {
     ts.dumpProperty("primaries"_s, colorSpace.primaries);
@@ -176,6 +207,8 @@ WTF::TextStream& operator<<(WTF::TextStream& ts, PlatformVideoColorSpace colorSp
     ts.dumpProperty("matrix"_s, colorSpace.matrix);
     if (colorSpace.fullRange)
         ts.dumpProperty("full-range"_s, *colorSpace.fullRange);
+    if (colorSpace.chromaLocation)
+        ts.dumpProperty("chroma-location"_s, *colorSpace.chromaLocation);
     return ts;
 }
 
@@ -191,6 +224,8 @@ void overrideVideoColorSpaceAsNeeded(PlatformVideoColorSpace& colorSpace, const
         colorSpace.matrix = colorSpaceOverride->matrix;
     if (colorSpaceOverride->fullRange)
         colorSpace.fullRange = colorSpaceOverride->fullRange;
+    if (colorSpaceOverride->chromaLocation)
+        colorSpace.chromaLocation = colorSpaceOverride->chromaLocation;
 }
 
 }
diff --git a/Source/WebCore/platform/graphics/PlatformVideoColorSpace.h b/Source/WebCore/platform/graphics/PlatformVideoColorSpace.h
index 47bbdaa795b8..d221eb5315ae 100644
--- a/Source/WebCore/platform/graphics/PlatformVideoColorSpace.h
+++ b/Source/WebCore/platform/graphics/PlatformVideoColorSpace.h
@@ -25,6 +25,7 @@
 
 #pragma once
 
+#include <WebCore/PlatformVideoChromaLocation.h>
 #include <WebCore/PlatformVideoColorPrimaries.h>
 #include <WebCore/PlatformVideoMatrixCoefficients.h>
 #include <WebCore/PlatformVideoTransferCharacteristics.h>
@@ -39,8 +40,11 @@ struct PlatformVideoColorSpace {
     std::optional<PlatformVideoTransferCharacteristics> transfer { };
     std::optional<PlatformVideoMatrixCoefficients> matrix { };
     std::optional<bool> fullRange { };
+    // Must stay after fullRange: VideoColorSpaceInit aliases this struct, and the
+    // bindings generator initialises it positionally in VideoColorSpaceInit.idl order.
+    std::optional<PlatformVideoChromaLocation> chromaLocation { };
 
-    bool isValid() const { return primaries || transfer || matrix || fullRange; }
+    bool isValid() const { return primaries || transfer || matrix || fullRange || chromaLocation; }
     friend bool operator==(const PlatformVideoColorSpace&, const PlatformVideoColorSpace&) = default;
 };
 
diff --git a/Source/WebCore/platform/graphics/UnitBezier.h b/Source/WebCore/platform/graphics/UnitBezier.h
index 38aae7750b90..0e7f01bdd8b1 100644
--- a/Source/WebCore/platform/graphics/UnitBezier.h
+++ b/Source/WebCore/platform/graphics/UnitBezier.h
@@ -37,6 +37,7 @@ namespace WebCore {
 #define CUBIC_BEZIER_SPLINE_SAMPLES 11
 
         static constexpr double kBezierEpsilon = 1e-7;
+        static constexpr double kBisectionEpsilon = 1e-10;
         static constexpr int kMaxNewtonIterations = 4;
 
         UnitBezier(double p1x, double p1y, double p2x, double p2y)
@@ -144,9 +145,10 @@ namespace WebCore {
                 return t2;
 
             // Fall back to the bisection method for reliability.
+            double bisectionEpsilon = std::max(kBisectionEpsilon, epsilon);
             while (t0 < t1) {
                 x2 = sampleCurveX(t2);
-                if (std::abs(x2 - x) < epsilon)
+                if (std::abs(x2 - x) < bisectionEpsilon)
                     return t2;
                 if (x > x2)
                     t0 = t2;
diff --git a/Source/WebCore/platform/graphics/avfoundation/FormatDescriptionUtilities.cpp b/Source/WebCore/platform/graphics/avfoundation/FormatDescriptionUtilities.cpp
index 2048c1bcae4a..5c7c324107bf 100644
--- a/Source/WebCore/platform/graphics/avfoundation/FormatDescriptionUtilities.cpp
+++ b/Source/WebCore/platform/graphics/avfoundation/FormatDescriptionUtilities.cpp
@@ -165,9 +165,69 @@ std::optional<PlatformVideoColorSpace> colorSpaceFromFormatDescription(CMFormatD
     if (RetainPtr fullRange = dynamic_cf_cast<CFBooleanRef>(PAL::CMFormatDescriptionGetExtension(formatDescription, PAL::kCMFormatDescriptionExtension_FullRangeVideo)))
         colorSpace.fullRange = CFBooleanGetValue(fullRange.get());
 
+    // Progressive content carries the same location in both fields. There is no default to fall
+    // back on: an absent key means the decoder picks its own siting.
+    RetainPtr chromaLocation = dynamic_cf_cast<CFStringRef>(PAL::CMFormatDescriptionGetExtension(formatDescription, kCVImageBufferChromaLocationTopFieldKey));
+    if (!chromaLocation)
+        chromaLocation = dynamic_cf_cast<CFStringRef>(PAL::CMFormatDescriptionGetExtension(formatDescription, kCVImageBufferChromaLocationBottomFieldKey));
+
+    if (chromaLocation) {
+        if (safeCFEqual(chromaLocation.get(), kCVImageBufferChromaLocation_Left))
+            colorSpace.chromaLocation = PlatformVideoChromaLocation::Left;
+        else if (safeCFEqual(chromaLocation.get(), kCVImageBufferChromaLocation_Center))
+            colorSpace.chromaLocation = PlatformVideoChromaLocation::Center;
+        else if (safeCFEqual(chromaLocation.get(), kCVImageBufferChromaLocation_TopLeft))
+            colorSpace.chromaLocation = PlatformVideoChromaLocation::TopLeft;
+        else if (safeCFEqual(chromaLocation.get(), kCVImageBufferChromaLocation_Top))
+            colorSpace.chromaLocation = PlatformVideoChromaLocation::Top;
+        else if (safeCFEqual(chromaLocation.get(), kCVImageBufferChromaLocation_BottomLeft))
+            colorSpace.chromaLocation = PlatformVideoChromaLocation::BottomLeft;
+        else if (safeCFEqual(chromaLocation.get(), kCVImageBufferChromaLocation_Bottom))
+            colorSpace.chromaLocation = PlatformVideoChromaLocation::Bottom;
+        else if (safeCFEqual(chromaLocation.get(), kCVImageBufferChromaLocation_DV420))
+            colorSpace.chromaLocation = PlatformVideoChromaLocation::Dv420;
+    }
+
     return colorSpace;
 }
 
+std::optional<uint8_t> fieldCountFromFormatDescription(CMFormatDescriptionRef formatDescription)
+{
+    if (!formatDescription)
+        return { };
+
+    RetainPtr fieldCount = dynamic_cf_cast<CFNumberRef>(PAL::CMFormatDescriptionGetExtension(formatDescription, kCVImageBufferFieldCountKey));
+    if (!fieldCount)
+        return { };
+
+    int value = 0;
+    if (!CFNumberGetValue(fieldCount.get(), kCFNumberIntType, &value) || value < 1 || value > 2)
+        return { };
+
+    return static_cast<uint8_t>(value);
+}
+
+std::optional<PlatformVideoFieldDetail> fieldDetailFromFormatDescription(CMFormatDescriptionRef formatDescription)
+{
+    if (!formatDescription)
+        return { };
+
+    RetainPtr fieldDetail = dynamic_cf_cast<CFStringRef>(PAL::CMFormatDescriptionGetExtension(formatDescription, kCVImageBufferFieldDetailKey));
+    if (!fieldDetail)
+        return { };
+
+    if (safeCFEqual(fieldDetail.get(), kCVImageBufferFieldDetailTemporalTopFirst))
+        return PlatformVideoFieldDetail::TemporalTopFirst;
+    if (safeCFEqual(fieldDetail.get(), kCVImageBufferFieldDetailTemporalBottomFirst))
+        return PlatformVideoFieldDetail::TemporalBottomFirst;
+    if (safeCFEqual(fieldDetail.get(), kCVImageBufferFieldDetailSpatialFirstLineEarly))
+        return PlatformVideoFieldDetail::SpatialFirstLineEarly;
+    if (safeCFEqual(fieldDetail.get(), kCVImageBufferFieldDetailSpatialFirstLineLate))
+        return PlatformVideoFieldDetail::SpatialFirstLineLate;
+
+    return { };
+}
+
 String codecFromFormatDescription(CMFormatDescriptionRef formatDescription)
 {
     if (!formatDescription)
diff --git a/Source/WebCore/platform/graphics/avfoundation/FormatDescriptionUtilities.h b/Source/WebCore/platform/graphics/avfoundation/FormatDescriptionUtilities.h
index 13ae0c6d0a82..81420a6db492 100644
--- a/Source/WebCore/platform/graphics/avfoundation/FormatDescriptionUtilities.h
+++ b/Source/WebCore/platform/graphics/avfoundation/FormatDescriptionUtilities.h
@@ -40,6 +40,8 @@ struct PlatformVideoColorSpace;
 TrackInfoTrackType typeFromFormatDescription(CMFormatDescriptionRef);
 FloatSize presentationSizeFromFormatDescription(CMFormatDescriptionRef);
 WEBCORE_EXPORT std::optional<PlatformVideoColorSpace> colorSpaceFromFormatDescription(CMFormatDescriptionRef);
+WEBCORE_EXPORT std::optional<uint8_t> fieldCountFromFormatDescription(CMFormatDescriptionRef);
+WEBCORE_EXPORT std::optional<PlatformVideoFieldDetail> fieldDetailFromFormatDescription(CMFormatDescriptionRef);
 String codecFromFormatDescription(CMFormatDescriptionRef);
 bool formatDescriptionIsProtected(CMFormatDescriptionRef);
 WEBCORE_EXPORT std::optional<ImmersiveVideoMetadata> immersiveVideoMetadataFromFormatDescription(CMFormatDescriptionRef);
diff --git a/Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm b/Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm
index cac62c6b5823..c8d3921e0271 100644
--- a/Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm
+++ b/Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm
@@ -263,7 +263,7 @@ static String toString(const AVPlayerTimeControlStatus status)
 
 static dispatch_queue_t globalLoaderDelegateQueue()
 {
-    static NeverDestroyed<OSObjectPtr<dispatch_queue_t>> globalQueue = adoptOSObject(dispatch_queue_create("WebCoreAVFLoaderDelegate queue", DISPATCH_QUEUE_SERIAL));
+    static NeverDestroyed<OSObjectPtr<dispatch_queue_t>> globalQueue = adoptOSObject(dispatch_queue_create("WebCoreAVFLoaderDelegate queue", serialQueueWithAutoreleasePoolAttrSingleton()));
     return globalQueue.get().get();
 }
 
diff --git a/Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm b/Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm
index bf78f8dc82d7..59f9455ee111 100644
--- a/Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm
+++ b/Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm
@@ -830,7 +830,7 @@ MediaPlayerScope supportedScope() const final
 
     auto stallAtTime = protect(m_mediaSourcePrivate)->nextStallTime(time);
     ALWAYS_LOG(LOGIDENTIFIER, "will stall playback at time: ", stallAtTime);
-    m_renderer->notifyTimeReachedAndStall(stallAtTime)->whenSettled(RunLoop::mainSingleton(), WTF::move(onStallReached))->track(m_stallRequest);
+    m_renderer->notifyTimeReachedAndStall(stallAtTime)->whenSettled(RunLoop::mainSingleton(), WTF::move(onStallReached))->track(protect(m_stallRequest));
 }
 
 void MediaPlayerPrivateMediaSourceAVFObjC::setLayerRequiresFlush()
diff --git a/Source/WebCore/platform/graphics/avfoundation/objc/QueuedVideoOutput.mm b/Source/WebCore/platform/graphics/avfoundation/objc/QueuedVideoOutput.mm
index 075df2bace22..f1f46577b8fe 100644
--- a/Source/WebCore/platform/graphics/avfoundation/objc/QueuedVideoOutput.mm
+++ b/Source/WebCore/platform/graphics/avfoundation/objc/QueuedVideoOutput.mm
@@ -32,6 +32,7 @@
 #include <pal/avfoundation/MediaTimeAVFoundation.h>
 #include <pal/spi/cocoa/AVFoundationSPI.h>
 #include <wtf/NeverDestroyed.h>
+#include <wtf/darwin/DispatchExtras.h>
 #include <wtf/darwin/DispatchOSObject.h>
 #include <wtf/TZoneMallocInlines.h>
 
@@ -120,7 +121,7 @@ - (void)observeValueForKeyPath:keyPath ofObject:(id)object change:(NSDictionary
 
 static dispatch_queue_t globalOutputDelegateQueue()
 {
-    static NeverDestroyed<OSObjectPtr<dispatch_queue_t>> globalQueue = adoptOSObject(dispatch_queue_create("WebQueuedVideoOutputDelegate queue", DISPATCH_QUEUE_SERIAL));
+    static NeverDestroyed<OSObjectPtr<dispatch_queue_t>> globalQueue = adoptOSObject(dispatch_queue_create("WebQueuedVideoOutputDelegate queue", serialQueueWithAutoreleasePoolAttrSingleton()));
     return globalQueue.get().get();
 }
 
diff --git a/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp b/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp
index 1221eff06464..180e9d470567 100644
--- a/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp
+++ b/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp
@@ -1071,7 +1071,7 @@ void GraphicsLayerCA::setContentsClippingRect(const FloatRoundedRect& rect)
     noteLayerPropertyChanged(ContentsRectsChanged);
 }
 
-static bool contentsClipShapePathsAreEqual(const Path& a, const Path& b)
+static bool shapePathsAreEqual(const Path& a, const Path& b)
 {
     if (a.isEmpty() || b.isEmpty())
         return a.isEmpty() && b.isEmpty();
@@ -1083,13 +1083,22 @@ static bool contentsClipShapePathsAreEqual(const Path& a, const Path& b)
 
 void GraphicsLayerCA::setContentsClipShapePath(const Path& path)
 {
-    if (contentsClipShapePathsAreEqual(contentsClipShapePath(), path))
+    if (shapePathsAreEqual(contentsClipShapePath(), path))
         return;
 
     GraphicsLayer::setContentsClipShapePath(path);
     noteLayerPropertyChanged(ContentsRectsChanged);
 }
 
+void GraphicsLayerCA::setBackdropFiltersShapePath(const Path& path)
+{
+    if (shapePathsAreEqual(backdropFiltersShapePath(), path))
+        return;
+
+    GraphicsLayer::setBackdropFiltersShapePath(path);
+    noteLayerPropertyChanged(BackdropFiltersRectChanged);
+}
+
 void GraphicsLayerCA::setContentsRectClipsDescendants(bool contentsRectClipsDescendants)
 {
     if (contentsRectClipsDescendants == m_contentsRectClipsDescendants)
@@ -2804,7 +2813,7 @@ void GraphicsLayerCA::updateBackdropFiltersRect()
 
     auto backdropRectRelativeToBackdropLayer = m_backdropFiltersRect;
     backdropRectRelativeToBackdropLayer.setLocation({ });
-    updateClippingStrategy(*backdropLayer, m_backdropClippingLayer, backdropRectRelativeToBackdropLayer);
+    updateClippingStrategy(*backdropLayer, m_backdropClippingLayer, backdropRectRelativeToBackdropLayer, m_backdropFiltersShapePath);
 
     if (m_layerClones) {
         for (auto& clone : m_layerClones->backdropLayerClones) {
@@ -2816,7 +2825,7 @@ void GraphicsLayerCA::updateBackdropFiltersRect()
             RefPtr<PlatformCALayer> backdropClippingLayerClone = m_layerClones->backdropClippingLayerClones.get(cloneID);
 
             bool hadBackdropClippingLayer = backdropClippingLayerClone;
-            updateClippingStrategy(backdropCloneLayer, backdropClippingLayerClone, backdropRectRelativeToBackdropLayer);
+            updateClippingStrategy(backdropCloneLayer, backdropClippingLayerClone, backdropRectRelativeToBackdropLayer, m_backdropFiltersShapePath);
 
             if (!backdropClippingLayerClone)
                 m_layerClones->backdropClippingLayerClones.remove(cloneID);
@@ -3257,9 +3266,9 @@ void GraphicsLayerCA::updateContentsColorLayer()
 
 // The clipping strategy depends on whether the rounded rect has equal corner radii.
 // roundedRect is in the coordinate space of clippingLayer.
-void GraphicsLayerCA::updateClippingStrategy(PlatformCALayer& clippingLayer, RefPtr<PlatformCALayer>& shapeMaskLayer, const FloatRoundedRect& roundedRect)
+void GraphicsLayerCA::updateClippingStrategy(PlatformCALayer& clippingLayer, RefPtr<PlatformCALayer>& shapeMaskLayer, const FloatRoundedRect& roundedRect, const Path& shapePath)
 {
-    bool hasShapePath = !contentsClipShapePath().isEmpty();
+    bool hasShapePath = !shapePath.isEmpty();
 
 #if HAVE(CORE_ANIMATION_SEPARATED_LAYERS)
     if (!hasShapePath && m_isSeparated && roundedRect.radii().hasEvenCorners() && clippingLayer.bounds() == roundedRect.rect()) {
@@ -3296,7 +3305,7 @@ void GraphicsLayerCA::updateClippingStrategy(PlatformCALayer& clippingLayer, Ref
     shapeMaskLayer->setBounds(shapeBounds);
     
     if (hasShapePath) {
-        auto localPath = contentsClipShapePath();
+        auto localPath = shapePath;
         localPath.translate(-toFloatSize(rectLocation));
         shapeMaskLayer->setShapePath(localPath);
     } else {
@@ -3336,7 +3345,7 @@ void GraphicsLayerCA::updateContentsRects()
         contentsClippingLayer->setPosition(m_contentsClippingRect.rect().location());
         contentsClippingLayer->setBounds(m_contentsClippingRect.rect());
         
-        updateClippingStrategy(contentsClippingLayer, m_contentsShapeMaskLayer, m_contentsClippingRect);
+        updateClippingStrategy(contentsClippingLayer, m_contentsShapeMaskLayer, m_contentsClippingRect, contentsClipShapePath());
 
         if (RefPtr contentsLayer = m_contentsLayer; contentsLayer && gainedOrLostClippingLayer) {
             contentsLayer->removeFromSuperlayer();
@@ -3379,7 +3388,7 @@ void GraphicsLayerCA::updateContentsRects()
             RefPtr<PlatformCALayer> shapeMaskLayerClone = m_layerClones->contentsShapeMaskLayerClones.get(cloneID);
 
             bool hadShapeMask = shapeMaskLayerClone;
-            updateClippingStrategy(Ref { clone.value }, shapeMaskLayerClone, m_contentsClippingRect);
+            updateClippingStrategy(Ref { clone.value }, shapeMaskLayerClone, m_contentsClippingRect, contentsClipShapePath());
 
             if (!shapeMaskLayerClone)
                 m_layerClones->contentsShapeMaskLayerClones.remove(cloneID);
diff --git a/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.h b/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.h
index f52180bbde3a..27913f6df20d 100644
--- a/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.h
+++ b/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.h
@@ -150,6 +150,7 @@ class GraphicsLayerCA : public GraphicsLayer, public PlatformCALayerClient {
     WEBCORE_EXPORT void setContentsRect(const FloatRect&) override;
     WEBCORE_EXPORT void setContentsClippingRect(const FloatRoundedRect&) override;
     WEBCORE_EXPORT void setContentsClipShapePath(const Path&) override;
+    WEBCORE_EXPORT void setBackdropFiltersShapePath(const Path&) override;
     WEBCORE_EXPORT void setContentsRectClipsDescendants(bool) override;
 
     WEBCORE_EXPORT void setVideoGravity(MediaPlayerVideoGravity) override;
@@ -388,7 +389,7 @@ class GraphicsLayerCA : public GraphicsLayer, public PlatformCALayerClient {
     void setupContentsLayer(PlatformCALayer*, CompositingCoordinatesOrientation = defaultContentsOrientation);
     PlatformCALayer* contentsLayer() const { return m_contentsLayer.get(); }
 
-    void updateClippingStrategy(PlatformCALayer&, RefPtr<PlatformCALayer>& shapeMaskLayer, const FloatRoundedRect&);
+    void updateClippingStrategy(PlatformCALayer&, RefPtr<PlatformCALayer>& shapeMaskLayer, const FloatRoundedRect&, const Path& shapePath);
 
     WEBCORE_EXPORT void setReplicatedByLayer(RefPtr<GraphicsLayer>&&) override;
 
diff --git a/Source/WebCore/platform/graphics/cocoa/CMUtilities.mm b/Source/WebCore/platform/graphics/cocoa/CMUtilities.mm
index a0882392e0e6..651baf43476d 100644
--- a/Source/WebCore/platform/graphics/cocoa/CMUtilities.mm
+++ b/Source/WebCore/platform/graphics/cocoa/CMUtilities.mm
@@ -39,6 +39,8 @@
 #import "SharedBuffer.h"
 #import "WebMAudioUtilitiesCocoa.h"
 #import <CoreMedia/CMFormatDescription.h>
+#import <cmath>
+#import <numeric>
 #import <pal/avfoundation/MediaTimeAVFoundation.h>
 #import <pal/cf/CoreAudioExtras.h>
 #import <pal/spi/cocoa/AudioToolboxSPI.h>
@@ -239,11 +241,15 @@ static FourCC cfStringToFourCC(CFStringRef string)
 #endif
     }
 
+    // A sizing hint only; exceeding it costs a rehash. The video counts include the keys
+    // createFormatDescriptionFromTrackInfo() goes on to add: FullRangeVideo, BitsPerComponent,
+    // ColorPrimaries, TransferFunction, GammaLevel, YCbCrMatrix, both ChromaLocation fields,
+    // FieldCount, FieldDetail and PixelAspectRatio.
     size_t maxNumberOfElements = [&] {
 #if ENABLE(ENCRYPTED_MEDIA) && HAVE(AVCONTENTKEYSESSION)
-        return info.isAudio() ? 5 : 9;
+        return info.isAudio() ? 5 : 15;
 #else
-        return 5;
+        return info.isAudio() ? 5 : 12;
 #endif
     }();
     RetainPtr extensions = adoptCF(CFDictionaryCreateMutable(kCFAllocatorDefault, maxNumberOfElements, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks));
@@ -378,6 +384,44 @@ static CFStringRef convertToCMYCbCRMatrix(PlatformVideoMatrixCoefficients coeffi
     }
 }
 
+static CFStringRef convertToCMChromaLocation(PlatformVideoChromaLocation chromaLocation)
+{
+    switch (chromaLocation) {
+    case PlatformVideoChromaLocation::Left:
+        return kCVImageBufferChromaLocation_Left;
+    case PlatformVideoChromaLocation::Center:
+        return kCVImageBufferChromaLocation_Center;
+    case PlatformVideoChromaLocation::TopLeft:
+        return kCVImageBufferChromaLocation_TopLeft;
+    case PlatformVideoChromaLocation::Top:
+        return kCVImageBufferChromaLocation_Top;
+    case PlatformVideoChromaLocation::BottomLeft:
+        return kCVImageBufferChromaLocation_BottomLeft;
+    case PlatformVideoChromaLocation::Bottom:
+        return kCVImageBufferChromaLocation_Bottom;
+    case PlatformVideoChromaLocation::Dv420:
+        return kCVImageBufferChromaLocation_DV420;
+    default:
+        return nullptr;
+    }
+}
+
+static CFStringRef convertToCMFieldDetail(PlatformVideoFieldDetail fieldDetail)
+{
+    switch (fieldDetail) {
+    case PlatformVideoFieldDetail::TemporalTopFirst:
+        return kCVImageBufferFieldDetailTemporalTopFirst;
+    case PlatformVideoFieldDetail::TemporalBottomFirst:
+        return kCVImageBufferFieldDetailTemporalBottomFirst;
+    case PlatformVideoFieldDetail::SpatialFirstLineEarly:
+        return kCVImageBufferFieldDetailSpatialFirstLineEarly;
+    case PlatformVideoFieldDetail::SpatialFirstLineLate:
+        return kCVImageBufferFieldDetailSpatialFirstLineLate;
+    }
+    ASSERT_NOT_REACHED();
+    return nullptr;
+}
+
 RetainPtr<CMFormatDescriptionRef> createFormatDescriptionFromTrackInfo(const TrackInfo& info)
 {
     ASSERT(info.isVideo() || info.isAudio());
@@ -439,13 +483,37 @@ static CFStringRef convertToCMYCbCRMatrix(PlatformVideoMatrixCoefficients coeffi
         if (RetainPtr cmMatrix = convertToCMYCbCRMatrix(*videoInfo.colorSpace().matrix))
             CFDictionaryAddValue(extensions.get(), kCVImageBufferYCbCrMatrixKey, cmMatrix.get());
     }
-    if (videoInfo.size() != videoInfo.displaySize()) {
-        double horizontalRatio = videoInfo.displaySize().width() / videoInfo.size().width();
-        double verticalRatio = videoInfo.displaySize().height() / videoInfo.size().height();
-        CFDictionaryAddValue(extensions.get(), kCVImageBufferPixelAspectRatioKey, @{
-            (__bridge NSString*)kCVImageBufferPixelAspectRatioHorizontalSpacingKey : @(horizontalRatio),
-            (__bridge NSString*)kCVImageBufferPixelAspectRatioVerticalSpacingKey : @(verticalRatio)
-        });
+
+    if (videoInfo.colorSpace().chromaLocation) {
+        if (RetainPtr cmChromaLocation = convertToCMChromaLocation(*videoInfo.colorSpace().chromaLocation)) {
+            CFDictionaryAddValue(extensions.get(), kCVImageBufferChromaLocationTopFieldKey, cmChromaLocation.get());
+            CFDictionaryAddValue(extensions.get(), kCVImageBufferChromaLocationBottomFieldKey, cmChromaLocation.get());
+        }
+    }
+
+    if (videoInfo.fieldCount())
+        CFDictionaryAddValue(extensions.get(), kCVImageBufferFieldCountKey, (__bridge CFTypeRef)@(*videoInfo.fieldCount()));
+
+    if (videoInfo.fieldDetail()) {
+        if (RetainPtr cmFieldDetail = convertToCMFieldDetail(*videoInfo.fieldDetail()))
+            CFDictionaryAddValue(extensions.get(), kCVImageBufferFieldDetailKey, cmFieldDetail.get());
+    }
+
+    if (!videoInfo.size().isEmpty() && !videoInfo.displaySize().isEmpty() && videoInfo.size() != videoInfo.displaySize()) {
+        // The two spacings are the numerator and denominator of a single fraction, as stored in
+        // the `pasp` box. Emit them as an exact integer pair rather than as the two quotients
+        // displaySize / size, which only approximate the ratio.
+        auto horizontalSpacing = std::llround(videoInfo.displaySize().width() * videoInfo.size().height());
+        auto verticalSpacing = std::llround(videoInfo.displaySize().height() * videoInfo.size().width());
+        if (horizontalSpacing > 0 && verticalSpacing > 0) {
+            auto divisor = std::gcd(horizontalSpacing, verticalSpacing);
+            horizontalSpacing /= divisor;
+            verticalSpacing /= divisor;
+            CFDictionaryAddValue(extensions.get(), kCVImageBufferPixelAspectRatioKey, @{
+                (__bridge NSString*)kCVImageBufferPixelAspectRatioHorizontalSpacingKey : @(horizontalSpacing),
+                (__bridge NSString*)kCVImageBufferPixelAspectRatioVerticalSpacingKey : @(verticalSpacing)
+            });
+        }
     }
 
 #if PLATFORM(VISION)
@@ -534,6 +602,8 @@ static CFStringRef convertToCMYCbCRMatrix(PlatformVideoMatrixCoefficients coeffi
             .displaySize = presentationSizeFromFormatDescription(description),
             .bitDepth = static_cast<uint8_t>(bitDepth),
             .colorSpace = colorSpaceFromFormatDescription(description).value_or(PlatformVideoColorSpace { }),
+            .fieldCount = fieldCountFromFormatDescription(description),
+            .fieldDetail = fieldDetailFromFormatDescription(description),
             .extensionAtoms = WTF::move(extensionAtoms),
 #if PLATFORM(VISION)
             .immersiveVideoMetadata = immersiveVideoMetadataFromFormatDescription(description)
@@ -733,6 +803,12 @@ void attachColorSpaceToPixelBuffer(const PlatformVideoColorSpace& colorSpace, CV
     }
     if (colorSpace.matrix)
         CVBufferSetAttachment(pixelBuffer, kCVImageBufferYCbCrMatrixKey, convertToCMYCbCRMatrix(*colorSpace.matrix), kCVAttachmentMode_ShouldPropagate);
+    if (colorSpace.chromaLocation) {
+        if (RetainPtr cmChromaLocation = convertToCMChromaLocation(*colorSpace.chromaLocation)) {
+            CVBufferSetAttachment(pixelBuffer, kCVImageBufferChromaLocationTopFieldKey, cmChromaLocation.get(), kCVAttachmentMode_ShouldPropagate);
+            CVBufferSetAttachment(pixelBuffer, kCVImageBufferChromaLocationBottomFieldKey, cmChromaLocation.get(), kCVAttachmentMode_ShouldPropagate);
+        }
+    }
 }
 
 PlatformVideoColorSpace computeVideoFrameColorSpace(CVPixelBufferRef pixelBuffer)
@@ -799,7 +875,26 @@ PlatformVideoColorSpace computeVideoFrameColorSpace(CVPixelBufferRef pixelBuffer
     // FIXME: We should do a more comprehensive check.
     bool isFullRange = pixelFormat != kCVPixelFormatType_420YpCbCr8BiPlanarVideoRange && pixelFormat != kCVPixelFormatType_420YpCbCr10BiPlanarVideoRange;
 
-    return { primaries, transfer, matrix, isFullRange };
+    std::optional<PlatformVideoChromaLocation> chromaLocation;
+    RetainPtr pixelChromaLocation = CVBufferGetAttachment(pixelBuffer, kCVImageBufferChromaLocationTopFieldKey, nil);
+    if (!pixelChromaLocation)
+        pixelChromaLocation = CVBufferGetAttachment(pixelBuffer, kCVImageBufferChromaLocationBottomFieldKey, nil);
+    if (safeCFEqual(pixelChromaLocation.get(), kCVImageBufferChromaLocation_Left))
+        chromaLocation = PlatformVideoChromaLocation::Left;
+    else if (safeCFEqual(pixelChromaLocation.get(), kCVImageBufferChromaLocation_Center))
+        chromaLocation = PlatformVideoChromaLocation::Center;
+    else if (safeCFEqual(pixelChromaLocation.get(), kCVImageBufferChromaLocation_TopLeft))
+        chromaLocation = PlatformVideoChromaLocation::TopLeft;
+    else if (safeCFEqual(pixelChromaLocation.get(), kCVImageBufferChromaLocation_Top))
+        chromaLocation = PlatformVideoChromaLocation::Top;
+    else if (safeCFEqual(pixelChromaLocation.get(), kCVImageBufferChromaLocation_BottomLeft))
+        chromaLocation = PlatformVideoChromaLocation::BottomLeft;
+    else if (safeCFEqual(pixelChromaLocation.get(), kCVImageBufferChromaLocation_Bottom))
+        chromaLocation = PlatformVideoChromaLocation::Bottom;
+    else if (safeCFEqual(pixelChromaLocation.get(), kCVImageBufferChromaLocation_DV420))
+        chromaLocation = PlatformVideoChromaLocation::Dv420;
+
+    return { .primaries = primaries, .transfer = transfer, .matrix = matrix, .fullRange = isFullRange, .chromaLocation = chromaLocation };
 }
 
 PacketDurationParser::PacketDurationParser(const AudioInfo& info)
diff --git a/Source/WebCore/platform/graphics/cocoa/MediaPlayerPrivateWebM.mm b/Source/WebCore/platform/graphics/cocoa/MediaPlayerPrivateWebM.mm
index f048f27a1cf1..d8e621e4366d 100644
--- a/Source/WebCore/platform/graphics/cocoa/MediaPlayerPrivateWebM.mm
+++ b/Source/WebCore/platform/graphics/cocoa/MediaPlayerPrivateWebM.mm
@@ -1022,7 +1022,7 @@
             if (RefPtr player = protectedThis->m_player.get())
                 player->timeChanged();
         });
-    })->track(m_stallRequest);
+    })->track(protect(m_stallRequest));
 
     m_duration = WTF::move(duration);
     ensureOnMainThread([weakThis = ThreadSafeWeakPtr { *this }, durationCopy = m_duration] {
diff --git a/Source/WebCore/platform/graphics/cocoa/PeriodicSharedTimer.mm b/Source/WebCore/platform/graphics/cocoa/PeriodicSharedTimer.mm
index 274ad9f4fdc3..4e8de0985d94 100644
--- a/Source/WebCore/platform/graphics/cocoa/PeriodicSharedTimer.mm
+++ b/Source/WebCore/platform/graphics/cocoa/PeriodicSharedTimer.mm
@@ -29,13 +29,14 @@
 #import <wtf/BlockPtr.h>
 #import <wtf/TZoneMallocInlines.h>
 #import <wtf/Vector.h>
+#import <wtf/darwin/DispatchExtras.h>
 
 namespace WebCore {
 
 WTF_MAKE_TZONE_ALLOCATED_IMPL(PeriodicSharedTimer);
 
 PeriodicSharedTimer::PeriodicSharedTimer(Seconds interval)
-    : m_queue(adoptOSObject(dispatch_queue_create("WebCore PeriodicSharedTimer", DISPATCH_QUEUE_SERIAL)))
+    : m_queue(adoptOSObject(dispatch_queue_create("WebCore PeriodicSharedTimer", serialQueueWithAutoreleasePoolAttrSingleton())))
     , m_timer(adoptOSObject(dispatch_source_create(DISPATCH_SOURCE_TYPE_TIMER, 0, 0, m_queue.get())))
 {
     auto intervalNs = interval.nanosecondsAs<uint64_t>();
diff --git a/Source/WebCore/platform/graphics/egl/BitmapTexture.cpp b/Source/WebCore/platform/graphics/egl/BitmapTexture.cpp
index a5a49fa657b6..f392b5ec9088 100644
--- a/Source/WebCore/platform/graphics/egl/BitmapTexture.cpp
+++ b/Source/WebCore/platform/graphics/egl/BitmapTexture.cpp
@@ -109,15 +109,6 @@ unsigned BitmapTexture::textureFormat() const
     return m_flags.contains(Flags::UseBGRALayout) ? GL_BGRA : GL_RGBA;
 }
 
-static GLenum depthBufferFormat()
-{
-    auto* glContext = GLContext::current();
-    if (glContext->version() >= 300 || glContext->glExtensions().OES_packed_depth_stencil)
-        return GL_DEPTH24_STENCIL8;
-
-    return GL_DEPTH_COMPONENT16;
-}
-
 BitmapTexture::BitmapTexture(const IntSize& size, OptionSet<Flags> flags)
     : m_flags(flags)
     , m_size(size)
@@ -241,8 +232,6 @@ BitmapTexture::BitmapTexture(EGLImage image, const IntSize& size, OptionSet<Flag
 void BitmapTexture::swapTexture(BitmapTexture& other)
 {
     RELEASE_ASSERT(m_size == other.m_size);
-    RELEASE_ASSERT(!m_flags.contains(Flags::DepthBuffer));
-    RELEASE_ASSERT(!other.m_flags.contains(Flags::DepthBuffer));
 
 #if USE(GBM)
     std::swap(m_memoryMappedGPUBuffer, other.m_memoryMappedGPUBuffer);
@@ -271,26 +260,19 @@ void BitmapTexture::reset(const IntSize& size, OptionSet<Flags> flags)
     m_pixelFormat = flags.contains(Flags::UseBGRALayout) ? PixelFormat::BGRA8 : PixelFormat::RGBA8;
     m_filterOperation = nullptr;
 
-    if (!flags.contains(Flags::DepthBuffer)) {
-        if (m_fbo) {
-            glDeleteFramebuffers(1, &m_fbo);
-            m_fbo = 0;
-        }
-
-        if (m_depthBufferObject) {
-            glDeleteRenderbuffers(1, &m_depthBufferObject);
-            m_depthBufferObject = 0;
-        }
-
-        if (m_stencilBufferObject) {
-            glDeleteRenderbuffers(1, &m_stencilBufferObject);
-            m_stencilBufferObject = 0;
-        }
+    if (m_fbo) {
+        glDeleteFramebuffers(1, &m_fbo);
+        m_fbo = 0;
+    }
 
-        m_stencilBound = false;
-        m_clipStack = { };
+    if (m_stencilBufferObject) {
+        glDeleteRenderbuffers(1, &m_stencilBufferObject);
+        m_stencilBufferObject = 0;
     }
 
+    m_stencilBound = false;
+    m_clipStack = { };
+
     if (m_size == size)
         return;
     m_size = size;
@@ -446,19 +428,6 @@ void BitmapTexture::updateContents(GraphicsLayer* sourceLayer, const IntRect& ta
 
 void BitmapTexture::initializeStencil()
 {
-    if (m_flags.contains(Flags::DepthBuffer)) {
-        // We have a depth buffer and we're asked to have a stencil buffer as well. This is only
-        // possible if packed depth stencil is available. If that's the case, just bind the depth
-        // buffer as the stencil one if haven't done so. If packed depth stencil is not available
-        // don't do anything, which will cause stencil clips on this surface to fail.
-        if (depthBufferFormat() == GL_DEPTH24_STENCIL8 && !m_stencilBound) {
-            glFramebufferRenderbuffer(GL_FRAMEBUFFER, GL_STENCIL_ATTACHMENT, GL_RENDERBUFFER, m_depthBufferObject);
-            m_stencilBound = true;
-        }
-        return;
-    }
-
-    // We don't have a depth buffer. Use a stencil only buffer.
     if (m_stencilBufferObject)
         return;
 
@@ -471,18 +440,6 @@ void BitmapTexture::initializeStencil()
     glClear(GL_STENCIL_BUFFER_BIT);
 }
 
-void BitmapTexture::initializeDepthBuffer()
-{
-    if (m_depthBufferObject)
-        return;
-
-    glGenRenderbuffers(1, &m_depthBufferObject);
-    glBindRenderbuffer(GL_RENDERBUFFER, m_depthBufferObject);
-    glRenderbufferStorage(GL_RENDERBUFFER, depthBufferFormat(), m_size.width(), m_size.height());
-    glBindRenderbuffer(GL_RENDERBUFFER, 0);
-    glFramebufferRenderbuffer(GL_FRAMEBUFFER, GL_DEPTH_ATTACHMENT, GL_RENDERBUFFER, m_depthBufferObject);
-}
-
 void BitmapTexture::clearIfNeeded()
 {
     if (!m_shouldClear)
@@ -504,8 +461,6 @@ void BitmapTexture::createFboIfNeeded()
     glGenFramebuffers(1, &m_fbo);
     glBindFramebuffer(GL_FRAMEBUFFER, m_fbo);
     glFramebufferTexture2D(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, m_renderTarget, id(), 0);
-    if (m_flags.contains(Flags::DepthBuffer))
-        initializeDepthBuffer();
     m_shouldClear = true;
 }
 
@@ -515,10 +470,6 @@ void BitmapTexture::bindAsSurface()
     createFboIfNeeded();
     glBindFramebuffer(GL_FRAMEBUFFER, m_fbo);
     glViewport(0, 0, m_size.width(), m_size.height());
-    if (m_flags.contains(Flags::DepthBuffer))
-        glEnable(GL_DEPTH_TEST);
-    else
-        glDisable(GL_DEPTH_TEST);
     clearIfNeeded();
     m_clipStack.apply();
 }
@@ -530,9 +481,6 @@ BitmapTexture::~BitmapTexture()
     if (m_fbo)
         glDeleteFramebuffers(1, &m_fbo);
 
-    if (m_depthBufferObject)
-        glDeleteRenderbuffers(1, &m_depthBufferObject);
-
     if (m_stencilBufferObject)
         glDeleteRenderbuffers(1, &m_stencilBufferObject);
 }
diff --git a/Source/WebCore/platform/graphics/egl/BitmapTexture.h b/Source/WebCore/platform/graphics/egl/BitmapTexture.h
index 04a0dfe1ac6c..a0be5630add3 100644
--- a/Source/WebCore/platform/graphics/egl/BitmapTexture.h
+++ b/Source/WebCore/platform/graphics/egl/BitmapTexture.h
@@ -62,15 +62,14 @@ class BitmapTexture final : public ThreadSafeRefCounted<BitmapTexture> {
 public:
     enum class Flags : uint8_t {
         SupportsAlpha = 1 << 0,
-        DepthBuffer = 1 << 1,
 #if USE(GBM)
-        BackedByDMABuf = 1 << 2,
-        ForceLinearBuffer = 1 << 3,
-        ForceVivanteSuperTiledBuffer = 1 << 4,
+        BackedByDMABuf = 1 << 1,
+        ForceLinearBuffer = 1 << 2,
+        ForceVivanteSuperTiledBuffer = 1 << 3,
 #endif
-        UseBGRALayout = 1 << 5,
-        NearestFiltering = 1 << 6,
-        ExternalOESRenderTarget = 1 << 7,
+        UseBGRALayout = 1 << 4,
+        NearestFiltering = 1 << 5,
+        ExternalOESRenderTarget = 1 << 6,
     };
 
     static Ref<BitmapTexture> create(const IntSize& size, OptionSet<Flags> flags = { })
@@ -94,7 +93,6 @@ class BitmapTexture final : public ThreadSafeRefCounted<BitmapTexture> {
 
     void bindAsSurface();
     void initializeStencil();
-    void initializeDepthBuffer();
     uint32_t id() const { return m_id; }
 
     void updateContents(NativeImage*, const IntRect&, const IntPoint& offset);
@@ -149,7 +147,6 @@ class BitmapTexture final : public ThreadSafeRefCounted<BitmapTexture> {
     unsigned m_renderTarget { 0 };
     unsigned m_binding { 0 };
     unsigned m_fbo { 0 };
-    unsigned m_depthBufferObject { 0 };
     unsigned m_stencilBufferObject { 0 };
     bool m_stencilBound { false };
     bool m_shouldClear { true };
diff --git a/Source/WebCore/platform/graphics/egl/BitmapTexturePool.cpp b/Source/WebCore/platform/graphics/egl/BitmapTexturePool.cpp
index 1210c3378ff2..36206e6f966e 100644
--- a/Source/WebCore/platform/graphics/egl/BitmapTexturePool.cpp
+++ b/Source/WebCore/platform/graphics/egl/BitmapTexturePool.cpp
@@ -80,7 +80,6 @@ Ref<BitmapTexture> BitmapTexturePool::acquireTexture(const IntSize& size, Option
             && entry.texture->flags().contains(BitmapTexture::Flags::ForceVivanteSuperTiledBuffer) == flags.contains(BitmapTexture::Flags::ForceVivanteSuperTiledBuffer)
 #endif
             && entry.texture->flags().contains(BitmapTexture::Flags::UseBGRALayout) == flags.contains(BitmapTexture::Flags::UseBGRALayout)
-            && entry.texture->flags().contains(BitmapTexture::Flags::DepthBuffer) == flags.contains(BitmapTexture::Flags::DepthBuffer)
             && entry.texture->flags().contains(BitmapTexture::Flags::NearestFiltering) == flags.contains(BitmapTexture::Flags::NearestFiltering);
     });
 
diff --git a/Source/WebCore/platform/graphics/gstreamer/eme/WebKitThunderParser.cpp b/Source/WebCore/platform/graphics/gstreamer/eme/WebKitThunderParser.cpp
index 7daf81b95e96..a32f9fea3c62 100644
--- a/Source/WebCore/platform/graphics/gstreamer/eme/WebKitThunderParser.cpp
+++ b/Source/WebCore/platform/graphics/gstreamer/eme/WebKitThunderParser.cpp
@@ -135,6 +135,18 @@ static GstPadProbeReturn webkitMediaThunderParserSinkPadProbe(GstPad*, GstPadPro
     return GST_PAD_PROBE_OK;
 }
 
+// parsebin sorts autoplug candidates parsers-first (gst_playback_utils_compare_factories_func, private to
+// gst-plugins-base) so a parser is always plugged before a decoder. Sorting by rank alone lets a decoder
+// outrank its parser.
+static gint compareParserAndDecoderFactories(gconstpointer a, gconstpointer b)
+{
+    bool isParserA = gst_element_factory_list_is_type(static_cast<GstElementFactory*>(const_cast<gpointer>(a)), GST_ELEMENT_FACTORY_TYPE_PARSER);
+    bool isParserB = gst_element_factory_list_is_type(static_cast<GstElementFactory*>(const_cast<gpointer>(b)), GST_ELEMENT_FACTORY_TYPE_PARSER);
+    if (isParserA != isParserB)
+        return isParserA ? -1 : 1;
+    return gst_plugin_feature_rank_compare_func(a, b);
+}
+
 static void webkitMediaThunderParserConstructed(GObject* object)
 {
     G_OBJECT_CLASS(webkit_media_thunder_parser_parent_class)->constructed(object);
@@ -171,7 +183,7 @@ static void webkitMediaThunderParserConstructed(GObject* object)
         GValueArray* result;
 
         auto factories = gst_element_factory_list_get_elements(GST_ELEMENT_FACTORY_TYPE_DECODABLE, GST_RANK_MARGINAL);
-        factories = g_list_sort(factories, gst_plugin_feature_rank_compare_func);
+        factories = g_list_sort(factories, compareParserAndDecoderFactories);
         auto list = gst_element_factory_list_filter(factories, caps, GST_PAD_SINK, gst_caps_is_fixed(caps));
         result = g_value_array_new(g_list_length(list));
         for (GList* tmp = list; tmp; tmp = tmp->next) {
diff --git a/Source/WebCore/platform/graphics/skia/SkiaCompositingLayer.cpp b/Source/WebCore/platform/graphics/skia/SkiaCompositingLayer.cpp
index ecef7c2361e5..3f7e81456286 100644
--- a/Source/WebCore/platform/graphics/skia/SkiaCompositingLayer.cpp
+++ b/Source/WebCore/platform/graphics/skia/SkiaCompositingLayer.cpp
@@ -1189,7 +1189,10 @@ void SkiaCompositingLayer::paintBackdrop(SkCanvas& canvas, PaintContext& context
 
     SkAutoCanvasRestore autoRestore(&canvas, true);
     const auto clipTransform = combinedTransform(context);
-    clipRect(canvas, m_backdrop.clipRect, clipTransform);
+    if (m_backdrop.clipPath)
+        canvas.clipPath(m_backdrop.clipPath->makeTransform(SkM44(clipTransform).asM33()), true);
+    else
+        clipRect(canvas, m_backdrop.clipRect, clipTransform);
 
     // Paint the backdrop root's subtree into a fresh surface (spec step 1),
     // apply the backdrop filter (step 2), and composite via SrcOver so the
diff --git a/Source/WebCore/platform/graphics/skia/SkiaCompositingLayer.h b/Source/WebCore/platform/graphics/skia/SkiaCompositingLayer.h
index 3a24a20046f5..eb6381da34c9 100644
--- a/Source/WebCore/platform/graphics/skia/SkiaCompositingLayer.h
+++ b/Source/WebCore/platform/graphics/skia/SkiaCompositingLayer.h
@@ -96,6 +96,7 @@ class SkiaCompositingLayer final : public RefCountedAndCanMakeWeakPtr<SkiaCompos
     void setFilters(const FilterOperations&);
     void setBackdropFilters(const FilterOperations&);
     void setBackdropFiltersRect(const FloatRoundedRect&);
+    void setBackdropFiltersClipPath(std::optional<SkPath>&& clipPath) { m_backdrop.clipPath = WTF::move(clipPath); }
     void setIsBackdropRoot(bool isBackdropRoot) { m_isBackdropRoot = isBackdropRoot; }
     void setChildren(Vector<Ref<SkiaCompositingLayer>>&&);
 
@@ -352,6 +353,7 @@ class SkiaCompositingLayer final : public RefCountedAndCanMakeWeakPtr<SkiaCompos
     struct {
         sk_sp<SkImageFilter> filter;
         FloatRoundedRect clipRect;
+        std::optional<SkPath> clipPath;
     } m_backdrop;
     bool m_isBackdropRoot { false };
     bool m_shouldBlend { false };
diff --git a/Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedPlatformLayer.cpp b/Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedPlatformLayer.cpp
index 5891fd2f24ca..193086db3504 100644
--- a/Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedPlatformLayer.cpp
+++ b/Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedPlatformLayer.cpp
@@ -727,6 +727,18 @@ void CoordinatedPlatformLayer::setBackdropRect(const FloatRoundedRect& backdropR
     notifyCompositionRequired();
 }
 
+void CoordinatedPlatformLayer::setBackdropShapePath(const Path& path)
+{
+    assertIsHeld(m_lock);
+    if (m_backdropShapePath.definitelyEqual(path))
+        return;
+
+    m_backdropShapePath = path;
+    m_pendingChanges.add(Change::BackdropShapePath);
+    damageWholeLayer();
+    notifyCompositionRequired();
+}
+
 void CoordinatedPlatformLayer::setIsBackdropRoot(bool isBackdropRoot)
 {
     assertIsHeld(m_lock);
@@ -1235,6 +1247,13 @@ void CoordinatedPlatformLayer::flushCompositingStateOnTarget(const OptionSet<Com
             m_pendingChanges.remove(Change::BackdropRect);
         }
 
+        // FIXME: clip the backdrop to the corner-shape contour here too. TextureMapper::beginClip()
+        // takes a ClipPath, a triangulated vertex buffer, so this needs a Path tessellation step that
+        // does not exist yet; until then a non-round corner shape on a backdrop filter is clipped only
+        // by the rounded rect above. The Skia compositor, which GTK and WPE use by default, clips to
+        // the contour.
+        m_pendingChanges.remove(Change::BackdropShapePath);
+
         if (m_pendingChanges.contains(Change::Animations)) {
             layer.setAnimations(m_animations);
             m_pendingChanges.remove(Change::Animations);
@@ -1440,6 +1459,17 @@ void CoordinatedPlatformLayer::flushCompositingStateOnSkiaTarget(const OptionSet
             m_pendingChanges.remove(Change::BackdropRect);
         }
 
+        if (m_pendingChanges.contains(Change::BackdropShapePath)) {
+            if (m_backdropShapePath.isEmpty())
+                layer.setBackdropFiltersClipPath(std::nullopt);
+            else {
+                auto backdropClipPath = *m_backdropShapePath.platformPath();
+                backdropClipPath.setFillType(SkPathFillType::kWinding);
+                layer.setBackdropFiltersClipPath(WTF::move(backdropClipPath));
+            }
+            m_pendingChanges.remove(Change::BackdropShapePath);
+        }
+
         if (m_pendingChanges.contains(Change::BackdropRoot)) {
             layer.setIsBackdropRoot(m_isBackdropRoot);
             m_pendingChanges.remove(Change::BackdropRoot);
diff --git a/Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedPlatformLayer.h b/Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedPlatformLayer.h
index 2c4072ec162c..aa64d9d685f4 100644
--- a/Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedPlatformLayer.h
+++ b/Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedPlatformLayer.h
@@ -179,6 +179,7 @@ class CoordinatedPlatformLayer : public ThreadSafeRefCountedAndCanMakeThreadSafe
     void setBackdrop(CoordinatedPlatformLayer*) WTF_REQUIRES_LOCK(m_lock);
     void notifyBackdropFiltersChanged() WTF_REQUIRES_LOCK(m_lock);
     void setBackdropRect(const FloatRoundedRect&) WTF_REQUIRES_LOCK(m_lock);
+    void setBackdropShapePath(const Path&) WTF_REQUIRES_LOCK(m_lock);
     void setIsBackdropRoot(bool) WTF_REQUIRES_LOCK(m_lock);
 
     void setAnimations(const TextureMapperAnimations&) WTF_REQUIRES_LOCK(m_lock);
@@ -241,6 +242,7 @@ class CoordinatedPlatformLayer : public ThreadSafeRefCountedAndCanMakeThreadSafe
         Backdrop,
         BackdropRect,
         BackdropRoot,
+        BackdropShapePath,
         BackfaceVisibility,
         BackgroundColor,
         BackingStore,
@@ -343,6 +345,7 @@ class CoordinatedPlatformLayer : public ThreadSafeRefCountedAndCanMakeThreadSafe
     RefPtr<CoordinatedPlatformLayer> m_replica WTF_GUARDED_BY_LOCK(m_lock);
     RefPtr<CoordinatedPlatformLayer> m_backdrop WTF_GUARDED_BY_LOCK(m_lock);
     FloatRoundedRect m_backdropRect WTF_GUARDED_BY_LOCK(m_lock);
+    Path m_backdropShapePath WTF_GUARDED_BY_LOCK(m_lock);
     bool m_isBackdropRoot WTF_GUARDED_BY_LOCK(m_lock) { false };
     TextureMapperAnimations m_animations WTF_GUARDED_BY_LOCK(m_lock);
     ThreadSafeWeakPtr<CoordinatedPlatformLayer> m_parent WTF_GUARDED_BY_LOCK(m_lock);
diff --git a/Source/WebCore/platform/graphics/texmap/coordinated/GraphicsLayerCoordinated.cpp b/Source/WebCore/platform/graphics/texmap/coordinated/GraphicsLayerCoordinated.cpp
index b2460aa792e3..9dd58ee8741b 100644
--- a/Source/WebCore/platform/graphics/texmap/coordinated/GraphicsLayerCoordinated.cpp
+++ b/Source/WebCore/platform/graphics/texmap/coordinated/GraphicsLayerCoordinated.cpp
@@ -667,6 +667,15 @@ void GraphicsLayerCoordinated::setBackdropFiltersRect(const FloatRoundedRect& ba
     noteLayerPropertyChanged(Change::BackdropRect, ScheduleFlush::Yes);
 }
 
+void GraphicsLayerCoordinated::setBackdropFiltersShapePath(const Path& path)
+{
+    if (backdropFiltersShapePath().definitelyEqual(path))
+        return;
+
+    GraphicsLayer::setBackdropFiltersShapePath(path);
+    noteLayerPropertyChanged(Change::BackdropShapePath, ScheduleFlush::Yes);
+}
+
 void GraphicsLayerCoordinated::setIsBackdropRoot(bool isBackdropRoot)
 {
     if (m_isBackdropRoot == isBackdropRoot)
@@ -1200,6 +1209,9 @@ void GraphicsLayerCoordinated::commitLayerChanges(CommitState& commitState, floa
     if (m_pendingChanges.contains(Change::BackdropRect))
         updateBackdropFiltersRect();
 
+    if (m_pendingChanges.contains(Change::BackdropShapePath))
+        m_platformLayer->setBackdropShapePath(backdropFiltersShapePath());
+
     if (m_pendingChanges.contains(Change::BackdropRoot))
         m_platformLayer->setIsBackdropRoot(m_isBackdropRoot);
 
diff --git a/Source/WebCore/platform/graphics/texmap/coordinated/GraphicsLayerCoordinated.h b/Source/WebCore/platform/graphics/texmap/coordinated/GraphicsLayerCoordinated.h
index f501c06abda2..a3c1107d04a7 100644
--- a/Source/WebCore/platform/graphics/texmap/coordinated/GraphicsLayerCoordinated.h
+++ b/Source/WebCore/platform/graphics/texmap/coordinated/GraphicsLayerCoordinated.h
@@ -117,6 +117,7 @@ class GraphicsLayerCoordinated final : public GraphicsLayer {
     void setReplicatedByLayer(RefPtr<GraphicsLayer>&&) override;
     bool setBackdropFilters(const FilterOperations&) override;
     void setBackdropFiltersRect(const FloatRoundedRect&) override;
+    void setBackdropFiltersShapePath(const Path&) override;
     void setIsBackdropRoot(bool) override;
 
     bool addAnimation(const GraphicsLayerKeyframeValueList&, const GraphicsLayerAnimation*, const String&, double) override;
@@ -144,6 +145,7 @@ class GraphicsLayerCoordinated final : public GraphicsLayer {
         Backdrop,
         BackdropRect,
         BackdropRoot,
+        BackdropShapePath,
         BackgroundColor,
         BackfaceVisibility,
         BlendMode,
diff --git a/Source/WebCore/platform/image-decoders/gif/GIFImageDecoder.cpp b/Source/WebCore/platform/image-decoders/gif/GIFImageDecoder.cpp
index d850e419dd66..9015ab464a36 100644
--- a/Source/WebCore/platform/image-decoders/gif/GIFImageDecoder.cpp
+++ b/Source/WebCore/platform/image-decoders/gif/GIFImageDecoder.cpp
@@ -312,9 +312,14 @@ bool GIFImageDecoder::frameComplete(unsigned frameIndex, unsigned frameDuration,
             // The only remaining case is a DisposalMethod::RestoreToBackground frame. If
             // it had no alpha, and its rect is contained in the current frame's
             // rect, we know the current frame has no alpha.
-            IntRect prevRect = prevBuffer->backingStore()->frameRect();
-            if ((prevBuffer->disposalMethod() == ScalableImageDecoderFrame::DisposalMethod::RestoreToBackground) && !prevBuffer->hasAlpha() && rect.contains(prevRect))
-                buffer.setHasAlpha(false);
+            //
+            // A frame evicted from the cache has no backing store, so its rect is unknown and
+            // this frame's opacity cannot be established from it.
+            if (prevBuffer->backingStore()) {
+                IntRect prevRect = prevBuffer->backingStore()->frameRect();
+                if ((prevBuffer->disposalMethod() == ScalableImageDecoderFrame::DisposalMethod::RestoreToBackground) && !prevBuffer->hasAlpha() && rect.contains(prevRect))
+                    buffer.setHasAlpha(false);
+            }
         }
     }
 
@@ -396,11 +401,12 @@ bool GIFImageDecoder::initFrameBuffer(unsigned frameIndex)
             prevMethod = prevBuffer->disposalMethod();
         }
 
-        ASSERT(prevBuffer->isComplete());
+        if (!prevBuffer->backingStore())
+            return setFailed();
 
         if ((prevMethod == ScalableImageDecoderFrame::DisposalMethod::Unspecified) || (prevMethod == ScalableImageDecoderFrame::DisposalMethod::DoNotDispose)) {
             // Preserve the last frame as the starting state for this frame.
-            if (!prevBuffer->backingStore() || !buffer->initialize(*prevBuffer->backingStore()))
+            if (!buffer->initialize(*prevBuffer->backingStore()))
                 return setFailed();
         } else {
             // We want to clear the previous frame to transparent, without
@@ -414,7 +420,7 @@ bool GIFImageDecoder::initFrameBuffer(unsigned frameIndex)
                     return setFailed();
             } else {
                 // Copy the whole previous buffer, then clear just its frame.
-                if (!prevBuffer->backingStore() || !buffer->initialize(*prevBuffer->backingStore()))
+                if (!buffer->initialize(*prevBuffer->backingStore()))
                     return setFailed();
                 buffer->backingStore()->clearRect(prevRect);
                 buffer->setHasAlpha(true);
diff --git a/Source/WebCore/platform/image-decoders/ico/ICOImageDecoder.cpp b/Source/WebCore/platform/image-decoders/ico/ICOImageDecoder.cpp
index 15a55da05b2b..f6f7d497d6c7 100644
--- a/Source/WebCore/platform/image-decoders/ico/ICOImageDecoder.cpp
+++ b/Source/WebCore/platform/image-decoders/ico/ICOImageDecoder.cpp
@@ -220,7 +220,13 @@ bool ICOImageDecoder::decodeAtIndex(size_t index)
     if (m_pngDecoders[index]->encodedDataStatus() >= EncodedDataStatus::SizeAvailable && (m_pngDecoders[index]->size() != dirEntry.m_size))
         return setFailed();
 
-    m_frameBufferCache[index] = *static_cast<PNGImageDecoder*>(m_pngDecoders[index].get())->firstFrameBuffer();
+    // firstFrameBuffer() is null until the sub-decoder has parsed its own header, which has not
+    // happened yet when only part of the embedded PNG has arrived.
+    auto* frameBuffer = static_cast<PNGImageDecoder*>(m_pngDecoders[index].get())->firstFrameBuffer();
+    if (!frameBuffer)
+        return false;
+
+    m_frameBufferCache[index] = *frameBuffer;
     return !m_pngDecoders[index]->failed() || setFailed();
 }
 
diff --git a/Source/WebCore/platform/image-decoders/jpegxl/JPEGXLImageDecoder.cpp b/Source/WebCore/platform/image-decoders/jpegxl/JPEGXLImageDecoder.cpp
index 8fdd016f67f7..a3b94d8ecabd 100644
--- a/Source/WebCore/platform/image-decoders/jpegxl/JPEGXLImageDecoder.cpp
+++ b/Source/WebCore/platform/image-decoders/jpegxl/JPEGXLImageDecoder.cpp
@@ -131,6 +131,7 @@ void JPEGXLImageDecoder::clearDecodedPixelDataIfNeeded(size_t clearBeforeFrame)
 
     // Unlike the png and gif cases, we can always try to clear frames before "clearBeforeFrame" because
     // the dependenciy to the previous frame is handled by libjxl.
+    clearBeforeFrame = std::min(clearBeforeFrame, m_frameBufferCache.size());
     const Vector<ScalableImageDecoderFrame>::iterator end(m_frameBufferCache.begin() + clearBeforeFrame);
 
     for (Vector<ScalableImageDecoderFrame>::iterator i(m_frameBufferCache.begin()); i != end; ++i) {
diff --git a/Source/WebCore/platform/image-decoders/png/PNGImageDecoder.cpp b/Source/WebCore/platform/image-decoders/png/PNGImageDecoder.cpp
index a4ebbb8e43ff..70a3bcfbecb7 100644
--- a/Source/WebCore/platform/image-decoders/png/PNGImageDecoder.cpp
+++ b/Source/WebCore/platform/image-decoders/png/PNGImageDecoder.cpp
@@ -256,12 +256,12 @@ ScalableImageDecoderFrame* PNGImageDecoder::frameBufferAtIndex(size_t index)
     if (ScalableImageDecoder::encodedDataStatus() < EncodedDataStatus::SizeAvailable)
         return nullptr;
 
-    if (index >= decodeIfNeededAndGetFrameCount())
-        index = decodeIfNeededAndGetFrameCount() - 1;
-
     if (m_frameBufferCache.isEmpty())
         m_frameBufferCache.grow(1);
 
+    // A malformed acTL can advertise more frames than there are buffers.
+    index = std::min(index, m_frameBufferCache.size() - 1);
+
     auto& frame = m_frameBufferCache[index];
     if (!frame.isComplete())
         decode(false, index, isAllDataReceived());
@@ -444,6 +444,7 @@ void PNGImageDecoder::rowAvailable(unsigned char* rowBuffer, unsigned rowIndex,
     // Initialize the framebuffer if needed.
     if (m_currentFrame >= decodeIfNeededAndGetFrameCount())
         return;
+    RELEASE_ASSERT(m_currentFrame < m_frameBufferCache.size());
     auto& buffer = m_frameBufferCache[m_currentFrame];
     if (buffer.isInvalid()) {
         png_structp png = m_reader->pngPtr();
@@ -589,14 +590,19 @@ void PNGImageDecoder::readChunks(png_unknown_chunkp chunk)
         if (m_hasInfo || m_isAnimated)
             return;
 
-        m_frameCount = png_get_uint_32(chunk->data);
-        m_playCount = png_get_uint_32(chunk->data + 4);
+        // frameCount() reports m_frameCount and callers size per-frame containers from it, so a
+        // rejected count must not be stored.
+        size_t frameCount = png_get_uint_32(chunk->data);
+        unsigned playCount = png_get_uint_32(chunk->data + 4);
 
-        if (!m_frameCount || m_frameCount > cMaxFrameCount || m_playCount > PNG_UINT_31_MAX) {
+        if (!frameCount || frameCount > cMaxFrameCount || playCount > PNG_UINT_31_MAX) {
             fallbackNotAnimated();
             return;
         }
 
+        m_frameCount = frameCount;
+        m_playCount = playCount;
+
         m_isAnimated = true;
         if (!m_frameInfo)
             m_frameIsHidden = true;
@@ -786,11 +792,13 @@ void PNGImageDecoder::initFrameBuffer(size_t frameIndex)
     }
 
     png_structp png = m_reader->pngPtr();
-    ASSERT(prevBuffer->isComplete());
+
+    if (!prevBuffer->backingStore())
+        longjmp(JMPBUF(png), 1);
 
     if (prevMethod == ScalableImageDecoderFrame::DisposalMethod::DoNotDispose) {
         // Preserve the last frame as the starting state for this frame.
-        if (!prevBuffer->backingStore() || !buffer.initialize(*prevBuffer->backingStore()))
+        if (!buffer.initialize(*prevBuffer->backingStore()))
             longjmp(JMPBUF(png), 1);
     } else {
         // We want to clear the previous frame to transparent, without
@@ -803,7 +811,7 @@ void PNGImageDecoder::initFrameBuffer(size_t frameIndex)
             buffer.setHasAlpha(true);
         } else {
             // Copy the whole previous buffer, then clear just its frame.
-            if (!prevBuffer->backingStore() || !buffer.initialize(*prevBuffer->backingStore())) {
+            if (!buffer.initialize(*prevBuffer->backingStore())) {
                 longjmp(JMPBUF(png), 1);
                 return;
             }
@@ -829,6 +837,7 @@ void PNGImageDecoder::frameComplete()
     if (m_frameIsHidden || m_currentFrame >= decodeIfNeededAndGetFrameCount())
         return;
 
+    RELEASE_ASSERT(m_currentFrame < m_frameBufferCache.size());
     auto& buffer = m_frameBufferCache[m_currentFrame];
     buffer.setDecodingStatus(DecodingStatus::Complete);
 
@@ -867,14 +876,17 @@ void PNGImageDecoder::frameComplete()
             if (rect.contains(IntRect(IntPoint(), size())))
                 buffer.setHasAlpha(false);
             else {
+                RELEASE_ASSERT(m_currentFrame);
                 size_t frameIndex = m_currentFrame;
                 const auto* prevBuffer = &m_frameBufferCache[--frameIndex];
                 while (frameIndex && (prevBuffer->disposalMethod() == ScalableImageDecoderFrame::DisposalMethod::RestoreToPrevious))
                     prevBuffer = &m_frameBufferCache[--frameIndex];
 
-                IntRect prevRect = prevBuffer->backingStore()->frameRect();
-                if ((prevBuffer->disposalMethod() == ScalableImageDecoderFrame::DisposalMethod::RestoreToBackground) && !prevBuffer->hasAlpha() && rect.contains(prevRect))
-                    buffer.setHasAlpha(false);
+                if (prevBuffer->backingStore()) {
+                    IntRect prevRect = prevBuffer->backingStore()->frameRect();
+                    if ((prevBuffer->disposalMethod() == ScalableImageDecoderFrame::DisposalMethod::RestoreToBackground) && !prevBuffer->hasAlpha() && rect.contains(prevRect))
+                        buffer.setHasAlpha(false);
+                }
             }
         } else if (!m_blend && !buffer.hasAlpha())
             buffer.setHasAlpha(nonTrivialAlpha);
diff --git a/Source/WebCore/platform/image-decoders/webp/WEBPImageDecoder.cpp b/Source/WebCore/platform/image-decoders/webp/WEBPImageDecoder.cpp
index 7eb310ca293e..d82304fb8d19 100644
--- a/Source/WebCore/platform/image-decoders/webp/WEBPImageDecoder.cpp
+++ b/Source/WebCore/platform/image-decoders/webp/WEBPImageDecoder.cpp
@@ -82,6 +82,11 @@ ScalableImageDecoderFrame* WEBPImageDecoder::frameBufferAtIndex(size_t index)
 
     decode(index, isAllDataReceived());
 
+    // decode() leaves the cache untouched when it bails out early, and m_frameCount comes from a
+    // demuxer that may since have rejected the file.
+    if (index >= m_frameBufferCache.size())
+        return nullptr;
+
     return &m_frameBufferCache[index];
 }
 
diff --git a/Source/WebCore/platform/libwebrtc/LibWebRTCVPXVideoEncoder.cpp b/Source/WebCore/platform/libwebrtc/LibWebRTCVPXVideoEncoder.cpp
index ef146821c19c..42ab446911dc 100644
--- a/Source/WebCore/platform/libwebrtc/LibWebRTCVPXVideoEncoder.cpp
+++ b/Source/WebCore/platform/libwebrtc/LibWebRTCVPXVideoEncoder.cpp
@@ -281,7 +281,7 @@ Ref<VideoEncoder::EncodePromise> LibWebRTCVPXInternalVideoEncoder::encode(VideoE
     if (auto pixelFormat = convertVideoFramePixelFormat(protectedFrame->pixelFormat(), true)) {
         if (isRGBVideoPixelFormat(*pixelFormat)) {
             // We do our own conversion to get matching color space handling, instead of letting libwebrtc do it.
-            colorSpace = { PlatformVideoColorPrimaries::Bt709, PlatformVideoTransferCharacteristics::Bt709, PlatformVideoMatrixCoefficients::Bt709, false };
+            colorSpace = { .primaries = PlatformVideoColorPrimaries::Bt709, .transfer = PlatformVideoTransferCharacteristics::Bt709, .matrix = PlatformVideoMatrixCoefficients::Bt709, .fullRange = false };
             buffer = ImageTransferSessionVT::convertPixelBuffer(buffer.get(), kCVPixelFormatType_420YpCbCr8BiPlanarVideoRange, ImageTransferSessionVT::DestinationColorSpace::BT709);
         }
     }
@@ -343,7 +343,7 @@ webrtc::EncodedImageCallback::Result LibWebRTCVPXInternalVideoEncoder::OnEncoded
     if (m_shouldCallDescriptionCallback) {
         m_shouldCallDescriptionCallback = false;
         VideoEncoder::ActiveConfiguration configuration;
-        configuration.colorSpace = m_currentColorSpace.value_or(PlatformVideoColorSpace { PlatformVideoColorPrimaries::Bt709, PlatformVideoTransferCharacteristics::Bt709, PlatformVideoMatrixCoefficients::Bt709, false });
+        configuration.colorSpace = m_currentColorSpace.value_or(PlatformVideoColorSpace { .primaries = PlatformVideoColorPrimaries::Bt709, .transfer = PlatformVideoTransferCharacteristics::Bt709, .matrix = PlatformVideoMatrixCoefficients::Bt709, .fullRange = false });
         m_descriptionCallback(WTF::move(configuration));
     }
     m_outputCallback({ WTF::move(encodedFrame) });
diff --git a/Source/WebCore/platform/mac/PlatformScreenMac.mm b/Source/WebCore/platform/mac/PlatformScreenMac.mm
index 93c4db7228e4..62e3c8a4bea8 100644
--- a/Source/WebCore/platform/mac/PlatformScreenMac.mm
+++ b/Source/WebCore/platform/mac/PlatformScreenMac.mm
@@ -39,7 +39,10 @@
 #import <pal/cocoa/OpenGLSoftLinkCocoa.h>
 #import <pal/spi/cg/CoreGraphicsSPI.h>
 #import <pal/spi/cocoa/AVFoundationSPI.h>
+#import <wtf/MainThread.h>
+#import <wtf/NeverDestroyed.h>
 #import <wtf/ProcessPrivilege.h>
+#import <wtf/WorkQueue.h>
 
 #import <pal/cocoa/AVFoundationSoftLink.h>
 
@@ -129,37 +132,51 @@ static DynamicRangeMode convertAVVideoRangeToEnum(NSString* range)
 }
 #endif
 
-ScreenProperties collectScreenProperties()
+// May run on the main thread or a background thread.
+static bool collectHDRStateForDisplay(PlatformDisplayID displayID, DynamicRangeMode& dynamicRangeMode)
 {
-    ASSERT(hasProcessPrivilege(ProcessPrivilege::CanCommunicateWithWindowServer));
-
-    ScreenProperties screenProperties;
-    bool screenHasInvertedColors = [[NSWorkspace sharedWorkspace] accessibilityDisplayShouldInvertColors];
-
-    auto screenSupportsHighDynamicRange = [](PlatformDisplayID displayID, DynamicRangeMode& dynamicRangeMode) {
-        bool supportsHighDynamicRange = false;
+    bool supportsHighDynamicRange = false;
 #if HAVE(AVPLAYER_VIDEORANGEOVERRIDE)
-        if (PAL::isAVFoundationFrameworkAvailable()) {
-            dynamicRangeMode = convertAVVideoRangeToEnum([PAL::getAVPlayerClassSingleton() preferredVideoRangeForDisplays:@[ @(displayID) ]]);
-            supportsHighDynamicRange = dynamicRangeMode > DynamicRangeMode::Standard;
-        }
+    if (PAL::isAVFoundationFrameworkAvailable()) {
+        dynamicRangeMode = convertAVVideoRangeToEnum([PAL::getAVPlayerClassSingleton() preferredVideoRangeForDisplays:@[ @(displayID) ]]);
+        supportsHighDynamicRange = dynamicRangeMode > DynamicRangeMode::Standard;
+    }
 #endif
 #if HAVE(AVPLAYER_VIDEORANGEOVERRIDE) && USE(MEDIATOOLBOX)
-        else
+    else
 #endif
 #if USE(MEDIATOOLBOX)
-        if (PAL::isMediaToolboxFrameworkAvailable() && PAL::canLoad_MediaToolbox_MTShouldPlayHDRVideo())
-            supportsHighDynamicRange = PAL::softLink_MediaToolbox_MTShouldPlayHDRVideo((__bridge CFArrayRef)@[ @(displayID) ]);
+    if (PAL::isMediaToolboxFrameworkAvailable() && PAL::canLoad_MediaToolbox_MTShouldPlayHDRVideo())
+        supportsHighDynamicRange = PAL::softLink_MediaToolbox_MTShouldPlayHDRVideo((__bridge CFArrayRef)@[ @(displayID) ]);
 #endif
 
-        if (!supportsHighDynamicRange && dynamicRangeMode > DynamicRangeMode::Standard)
-            dynamicRangeMode = DynamicRangeMode::Standard;
+    if (!supportsHighDynamicRange && dynamicRangeMode > DynamicRangeMode::Standard)
+        dynamicRangeMode = DynamicRangeMode::Standard;
+
+    if (supportsHighDynamicRange && WebCore::ThermalMitigationNotifier::isThermalMitigationEnabled())
+        supportsHighDynamicRange = false;
+
+    return supportsHighDynamicRange;
+}
+
+static void collectHDRState(ScreenProperties& screenProperties)
+{
+    for (auto& [displayID, screenData] : screenProperties.screenDataMap)
+        screenData.screenSupportsHighDynamicRange = collectHDRStateForDisplay(displayID, screenData.preferredDynamicRangeMode);
+}
+
+static WorkQueue& screenPropertiesQueueSingleton()
+{
+    static NeverDestroyed<Ref<WorkQueue>> queue(WorkQueue::create("org.webkit.ScreenProperties"_s, WorkQueue::QOS::UserInitiated));
+    return queue.get();
+}
 
-        if (supportsHighDynamicRange && WebCore::ThermalMitigationNotifier::isThermalMitigationEnabled())
-            supportsHighDynamicRange = false;
+static ScreenProperties collectScreenPropertiesExceptForHDRState()
+{
+    ASSERT(hasProcessPrivilege(ProcessPrivilege::CanCommunicateWithWindowServer));
 
-        return supportsHighDynamicRange;
-    };
+    ScreenProperties screenProperties;
+    bool screenHasInvertedColors = [[NSWorkspace sharedWorkspace] accessibilityDisplayShouldInvertColors];
 
     for (NSScreen *screen in [NSScreen screens]) {
         ScreenData screenData;
@@ -182,7 +199,6 @@ ScreenProperties collectScreenProperties()
 
         screenData.screenSize = FloatSize { CGDisplayScreenSize(displayID) };
         screenData.scaleFactor = screen.backingScaleFactor;
-        screenData.screenSupportsHighDynamicRange = screenSupportsHighDynamicRange(displayID, screenData.preferredDynamicRangeMode);
 #if HAVE(SUPPORT_HDR_DISPLAY)
         screenData.maxEDRHeadroom = [screen maximumPotentialExtendedDynamicRangeColorComponentValue];
         screenData.currentEDRHeadroom = [screen maximumExtendedDynamicRangeColorComponentValue];
@@ -198,6 +214,27 @@ ScreenProperties collectScreenProperties()
     return screenProperties;
 }
 
+ScreenProperties collectScreenProperties()
+{
+    auto screenProperties = collectScreenPropertiesExceptForHDRState();
+    collectHDRState(screenProperties);
+    return screenProperties;
+}
+
+void collectScreenPropertiesAsync(CompletionHandler<void(ScreenProperties&&)>&& completionHandler)
+{
+    ASSERT(isMainThread());
+
+    auto screenProperties = collectScreenPropertiesExceptForHDRState();
+
+    screenPropertiesQueueSingleton().dispatch([screenProperties = WTF::move(screenProperties), completionHandler = WTF::move(completionHandler)]() mutable {
+        collectHDRState(screenProperties);
+        callOnMainThread([screenProperties = WTF::move(screenProperties), completionHandler = WTF::move(completionHandler)]() mutable {
+            completionHandler(WTF::move(screenProperties));
+        });
+    });
+}
+
 void setShouldOverrideScreenSupportsHighDynamicRange(bool shouldOverride, bool supportsHighDynamicRange)
 {
     if (PAL::isMediaToolboxFrameworkAvailable() && PAL::canLoad_MediaToolbox_MTOverrideShouldPlayHDRVideo())
diff --git a/Source/WebCore/platform/mac/PowerObserverMac.cpp b/Source/WebCore/platform/mac/PowerObserverMac.cpp
index ba92b1158ecf..acc479d945f7 100644
--- a/Source/WebCore/platform/mac/PowerObserverMac.cpp
+++ b/Source/WebCore/platform/mac/PowerObserverMac.cpp
@@ -29,6 +29,7 @@
 #import "PowerObserverMac.h"
 #import <wtf/CheckedPtr.h>
 #import <wtf/TZoneMallocInlines.h>
+#import <wtf/darwin/DispatchExtras.h>
 
 namespace WebCore {
 
@@ -41,7 +42,7 @@ PowerObserver::PowerObserver(Function<void()>&& powerOnHander)
     , m_notifierReference(0)
 {
     // FIXME: This is a false positive for dispatch_queue_create. rdar://160931336
-    SUPPRESS_RETAINPTR_CTOR_ADOPT m_dispatchQueue = adoptOSObject(dispatch_queue_create("com.apple.WebKit.PowerObserver", 0));
+    SUPPRESS_RETAINPTR_CTOR_ADOPT m_dispatchQueue = adoptOSObject(dispatch_queue_create("com.apple.WebKit.PowerObserver", serialQueueWithAutoreleasePoolAttrSingleton()));
     m_powerConnection = IORegisterForSystemPower(this, &m_notificationPort, [](void* context, io_service_t service, uint32_t messageType, void* messageArgument) {
         static_cast<PowerObserver*>(context)->didReceiveSystemPowerNotification(service, messageType, messageArgument);
     }, &m_notifierReference);
diff --git a/Source/WebCore/platform/mediastream/cocoa/AVVideoCaptureSource.mm b/Source/WebCore/platform/mediastream/cocoa/AVVideoCaptureSource.mm
index 39b27d166578..99921b0bde64 100644
--- a/Source/WebCore/platform/mediastream/cocoa/AVVideoCaptureSource.mm
+++ b/Source/WebCore/platform/mediastream/cocoa/AVVideoCaptureSource.mm
@@ -126,7 +126,7 @@ static CMVideoDimensions NODELETE toCMVideoDimensions(const IntSize& size)
 
 static dispatch_queue_t globaVideoCaptureSerialQueue()
 {
-    static NeverDestroyed<OSObjectPtr<dispatch_queue_t>> globalQueue = adoptOSObject(dispatch_queue_create_with_target("WebCoreAVVideoCaptureSource video capture queue", DISPATCH_QUEUE_SERIAL, globalDispatchQueueSingleton(DISPATCH_QUEUE_PRIORITY_HIGH, 0)));
+    static NeverDestroyed<OSObjectPtr<dispatch_queue_t>> globalQueue = adoptOSObject(dispatch_queue_create_with_target("WebCoreAVVideoCaptureSource video capture queue", serialQueueWithAutoreleasePoolAttrSingleton(), globalDispatchQueueSingleton(DISPATCH_QUEUE_PRIORITY_HIGH, 0)));
     return globalQueue.get().get();
 }
 
diff --git a/Source/WebCore/platform/mediastream/cocoa/RealtimeOutgoingVideoSourceCocoa.cpp b/Source/WebCore/platform/mediastream/cocoa/RealtimeOutgoingVideoSourceCocoa.cpp
index 8d129e096bf7..86e6760dfff2 100644
--- a/Source/WebCore/platform/mediastream/cocoa/RealtimeOutgoingVideoSourceCocoa.cpp
+++ b/Source/WebCore/platform/mediastream/cocoa/RealtimeOutgoingVideoSourceCocoa.cpp
@@ -90,7 +90,7 @@ void RealtimeOutgoingVideoSourceCocoa::videoFrameAvailable(VideoFrame& videoFram
     auto colorSpace = [&] {
         if (auto pixelFormat = convertVideoFramePixelFormat(videoFrame.pixelFormat(), true)) {
             if (isRGBVideoPixelFormat(*pixelFormat))
-                return PlatformVideoColorSpace { PlatformVideoColorPrimaries::Bt709, PlatformVideoTransferCharacteristics::Bt709, PlatformVideoMatrixCoefficients::Bt709, false };
+                return PlatformVideoColorSpace { .primaries = PlatformVideoColorPrimaries::Bt709, .transfer = PlatformVideoTransferCharacteristics::Bt709, .matrix = PlatformVideoMatrixCoefficients::Bt709, .fullRange = false };
         }
         return videoFrame.colorSpace();
     }();
diff --git a/Source/WebCore/platform/mediastream/cocoa/ScreenCaptureKitCaptureSource.mm b/Source/WebCore/platform/mediastream/cocoa/ScreenCaptureKitCaptureSource.mm
index 99e3e5dbf9bc..123892abe49b 100644
--- a/Source/WebCore/platform/mediastream/cocoa/ScreenCaptureKitCaptureSource.mm
+++ b/Source/WebCore/platform/mediastream/cocoa/ScreenCaptureKitCaptureSource.mm
@@ -43,6 +43,7 @@
 #import <wtf/TZoneMallocInlines.h>
 #import <wtf/cf/TypeCastsCF.h>
 #import <wtf/cocoa/TypeCastsCocoa.h>
+#import <wtf/darwin/DispatchExtras.h>
 #import <wtf/text/StringToIntegerConversion.h>
 
 #import <pal/cf/CoreMediaSoftLink.h>
@@ -639,7 +640,7 @@ - (void)outputVideoEffectDidStopForStream:(SCStream *)stream
 dispatch_queue_t ScreenCaptureKitCaptureSource::captureQueue()
 {
     if (!m_captureQueue)
-        m_captureQueue = adoptOSObject(dispatch_queue_create("CGDisplayStreamCaptureSource Capture Queue", DISPATCH_QUEUE_SERIAL));
+        m_captureQueue = adoptOSObject(dispatch_queue_create("CGDisplayStreamCaptureSource Capture Queue", serialQueueWithAutoreleasePoolAttrSingleton()));
 
     return m_captureQueue.get();
 }
diff --git a/Source/WebCore/platform/mediastream/libwebrtc/LibWebRTCVideoFrameUtilities.cpp b/Source/WebCore/platform/mediastream/libwebrtc/LibWebRTCVideoFrameUtilities.cpp
index 15ed4f2ed791..1f8a6f0f11c3 100644
--- a/Source/WebCore/platform/mediastream/libwebrtc/LibWebRTCVideoFrameUtilities.cpp
+++ b/Source/WebCore/platform/mediastream/libwebrtc/LibWebRTCVideoFrameUtilities.cpp
@@ -183,7 +183,7 @@ std::optional<PlatformVideoColorSpace> colorSpaceFromLibWebRTCColorSpace(const w
         break;
     };
 
-    return PlatformVideoColorSpace { primaries, transfer, matrix, fullRange };
+    return PlatformVideoColorSpace { .primaries = primaries, .transfer = transfer, .matrix = matrix, .fullRange = fullRange };
 }
 
 std::optional<PlatformVideoColorSpace> colorSpaceFromLibWebRTCVideoFrame(const webrtc::VideoFrame& frame)
diff --git a/Source/WebCore/platform/mediastream/libwebrtc/VideoFrameLibWebRTC.cpp b/Source/WebCore/platform/mediastream/libwebrtc/VideoFrameLibWebRTC.cpp
index efe6b118163e..bd2c03bf6b79 100644
--- a/Source/WebCore/platform/mediastream/libwebrtc/VideoFrameLibWebRTC.cpp
+++ b/Source/WebCore/platform/mediastream/libwebrtc/VideoFrameLibWebRTC.cpp
@@ -36,7 +36,7 @@ namespace WebCore {
 
 static PlatformVideoColorSpace NODELETE defaultVPXColorSpace()
 {
-    return { PlatformVideoColorPrimaries::Bt709, PlatformVideoTransferCharacteristics::Bt709, PlatformVideoMatrixCoefficients::Bt709, false };
+    return { .primaries = PlatformVideoColorPrimaries::Bt709, .transfer = PlatformVideoTransferCharacteristics::Bt709, .matrix = PlatformVideoMatrixCoefficients::Bt709, .fullRange = false };
 }
 
 RefPtr<VideoFrameLibWebRTC> VideoFrameLibWebRTC::create(MediaTime presentationTime, bool isMirrored, Rotation rotation, std::optional<PlatformVideoColorSpace>&& colorSpace, Ref<webrtc::VideoFrameBuffer>&& buffer, ConversionCallback&& conversionCallback)
diff --git a/Source/WebCore/platform/mediastream/libwebrtc/gstreamer/RealtimeOutgoingVideoSourceLibWebRTC.cpp b/Source/WebCore/platform/mediastream/libwebrtc/gstreamer/RealtimeOutgoingVideoSourceLibWebRTC.cpp
index 864786c5ffa4..369906116af2 100644
--- a/Source/WebCore/platform/mediastream/libwebrtc/gstreamer/RealtimeOutgoingVideoSourceLibWebRTC.cpp
+++ b/Source/WebCore/platform/mediastream/libwebrtc/gstreamer/RealtimeOutgoingVideoSourceLibWebRTC.cpp
@@ -77,7 +77,7 @@ void RealtimeOutgoingVideoSourceLibWebRTC::videoFrameAvailable(VideoFrame& video
     auto colorSpace = [&] {
         if (auto pixelFormat = convertVideoFramePixelFormat(videoFrame.pixelFormat(), true)) {
             if (isRGBVideoPixelFormat(*pixelFormat))
-                return PlatformVideoColorSpace { PlatformVideoColorPrimaries::Bt709, PlatformVideoTransferCharacteristics::Bt709, PlatformVideoMatrixCoefficients::Bt709, false };
+                return PlatformVideoColorSpace { .primaries = PlatformVideoColorPrimaries::Bt709, .transfer = PlatformVideoTransferCharacteristics::Bt709, .matrix = PlatformVideoMatrixCoefficients::Bt709, .fullRange = false };
         }
         return videoFrame.colorSpace();
     }();
diff --git a/Source/WebCore/platform/network/Cookie.cpp b/Source/WebCore/platform/network/Cookie.cpp
index a056809cf96d..14137546674b 100644
--- a/Source/WebCore/platform/network/Cookie.cpp
+++ b/Source/WebCore/platform/network/Cookie.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2017 Apple Inc. All rights reserved.
+ * Copyright (C) 2017-2026 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,6 +26,14 @@
 #include "config.h"
 #include "Cookie.h"
 
+#include <algorithm>
+#include <wtf/ASCIICType.h>
+#include <wtf/DateMath.h>
+#include <wtf/NotFound.h>
+#include <wtf/text/MakeString.h>
+#include <wtf/text/StringHash.h>
+#include <wtf/text/StringView.h>
+
 namespace WebCore {
     
 #if !PLATFORM(COCOA)
@@ -60,6 +68,97 @@ String defaultPathForURL(const URL& url)
     return path.left(lastSlashPosition);
 }
 
+static bool isMonthNameToken(StringView token)
+{
+    // RFC 6265 section 5.1.1 matches a month by its first three characters, case-insensitively.
+    if (token.length() < 3)
+        return false;
+    auto prefix = token.left(3);
+    return std::ranges::any_of(WTF::monthName, [&](auto month) {
+        return equalIgnoringASCIICase(prefix, month);
+    });
+}
+
+std::optional<String> cookieStringWithDayFirstExpires(StringView cookieString)
+{
+    auto firstSemicolon = cookieString.find(';');
+    if (firstSemicolon == notFound)
+        return std::nullopt;
+
+    // Locate the Expires value within the original string. The last one wins, per RFC 6265
+    // section 5.3.
+    size_t valueStart = notFound;
+    size_t valueEnd = notFound;
+    for (size_t position = firstSemicolon + 1; position <= cookieString.length();) {
+        auto semicolon = cookieString.find(';', position);
+        auto attributeEnd = semicolon == notFound ? cookieString.length() : semicolon;
+        auto attribute = cookieString.substring(position, attributeEnd - position);
+        if (auto equals = attribute.find('='); equals != notFound) {
+            if (equalLettersIgnoringASCIICase(attribute.left(equals).trim(isTabOrSpace<char16_t>), "expires"_s)) {
+                valueStart = position + equals + 1;
+                valueEnd = attributeEnd;
+            }
+        }
+        if (semicolon == notFound)
+            break;
+        position = semicolon + 1;
+    }
+
+    if (valueStart == notFound)
+        return std::nullopt;
+
+    // Find a month name immediately followed by a one or two digit day of the month. In a day-first
+    // value the token after the month is the four digit year, so this does not match and nothing is
+    // rewritten.
+    auto isSeparator = [](char16_t character) {
+        return character == ' ' || character == '\t';
+    };
+    size_t monthStart = notFound;
+    size_t monthEnd = notFound;
+    size_t dayStart = notFound;
+    size_t dayEnd = notFound;
+    for (size_t position = valueStart; position < valueEnd;) {
+        while (position < valueEnd && isSeparator(cookieString[position]))
+            ++position;
+        size_t tokenStart = position;
+        while (position < valueEnd && !isSeparator(cookieString[position]))
+            ++position;
+        if (tokenStart == position)
+            break;
+        if (monthStart == notFound) {
+            if (isMonthNameToken(cookieString.substring(tokenStart, position - tokenStart))) {
+                monthStart = tokenStart;
+                monthEnd = position;
+            }
+            continue;
+        }
+        dayStart = tokenStart;
+        dayEnd = position;
+        break;
+    }
+
+    if (monthStart == notFound || dayStart == notFound)
+        return std::nullopt;
+
+    auto day = cookieString.substring(dayStart, dayEnd - dayStart);
+    if (day.length() > 2 || !day.containsOnly<isASCIIDigit<char16_t>>())
+        return std::nullopt;
+
+    size_t yearStart = dayEnd;
+    while (yearStart < valueEnd && isSeparator(cookieString[yearStart]))
+        ++yearStart;
+    size_t yearEnd = yearStart;
+    while (yearEnd < valueEnd && !isSeparator(cookieString[yearEnd]))
+        ++yearEnd;
+    auto year = cookieString.substring(yearStart, yearEnd - yearStart);
+    if (year.length() != 4 || !year.containsOnly<isASCIIDigit<char16_t>>())
+        return std::nullopt;
+
+    // Return a new string where we have swapped the two tokens.
+    return makeString(cookieString.left(monthStart), day, cookieString.substring(monthEnd, dayStart - monthEnd),
+        cookieString.substring(monthStart, monthEnd - monthStart), cookieString.substring(dayEnd));
+}
+
 } // namespace CookieUtil
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/network/ResourceResponseBase.cpp b/Source/WebCore/platform/network/ResourceResponseBase.cpp
index 4a7da70e5fe4..0725319f8a3a 100644
--- a/Source/WebCore/platform/network/ResourceResponseBase.cpp
+++ b/Source/WebCore/platform/network/ResourceResponseBase.cpp
@@ -950,6 +950,7 @@ void Coder<WebCore::ResourceResponseData>::encodeForPersistence(Encoder& encoder
     encoder << data.wasPrivateRelayed;
     encoder << data.proxyName;
     encoder << data.isRangeRequested;
+    encoder << data.ipAddressSpace;
 }
 
 std::optional<WebCore::ResourceResponseData> Coder<WebCore::ResourceResponseData>::decodeForPersistence(Decoder& decoder)
@@ -1039,6 +1040,11 @@ std::optional<WebCore::ResourceResponseData> Coder<WebCore::ResourceResponseData
     if (!isRangeRequested)
         return std::nullopt;
 
+    std::optional<WebCore::IPAddressSpace> ipAddressSpace;
+    decoder >> ipAddressSpace;
+    if (!ipAddressSpace)
+        return std::nullopt;
+
     return WebCore::ResourceResponseData {
         WTF::move(*url),
         WTF::move(*mimeType),
@@ -1058,7 +1064,7 @@ std::optional<WebCore::ResourceResponseData> Coder<WebCore::ResourceResponseData
         WTF::move(*proxyName),
         *isRangeRequested,
         WTF::move(*certificateInfo),
-        WebCore::IPAddressSpace::Unknown
+        *ipAddressSpace
     };
 }
 
diff --git a/Source/WebCore/platform/network/ResourceResponseBase.h b/Source/WebCore/platform/network/ResourceResponseBase.h
index 3283122f2be3..3845623c1527 100644
--- a/Source/WebCore/platform/network/ResourceResponseBase.h
+++ b/Source/WebCore/platform/network/ResourceResponseBase.h
@@ -395,6 +395,16 @@ template<> struct EnumTraitsForPersistence<WebCore::ResourceResponseBase::Source
     >;
 };
 
+template<> struct EnumTraitsForPersistence<WebCore::IPAddressSpace> {
+    using values = EnumValues<
+        WebCore::IPAddressSpace,
+        WebCore::IPAddressSpace::Public,
+        WebCore::IPAddressSpace::Local,
+        WebCore::IPAddressSpace::Loopback,
+        WebCore::IPAddressSpace::Unknown
+    >;
+};
+
 namespace Persistence {
 
 class Decoder;
diff --git a/Source/WebCore/platform/network/cocoa/NetworkStorageSessionCocoa.mm b/Source/WebCore/platform/network/cocoa/NetworkStorageSessionCocoa.mm
index 3f913649ece7..1d45007892c8 100644
--- a/Source/WebCore/platform/network/cocoa/NetworkStorageSessionCocoa.mm
+++ b/Source/WebCore/platform/network/cocoa/NetworkStorageSessionCocoa.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2015-2023 Apple Inc. All rights reserved.
+ * Copyright (C) 2015-2026 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -47,6 +47,7 @@
 #import <wtf/darwin/DispatchExtras.h>
 #import <wtf/text/MakeString.h>
 #import <wtf/text/StringBuilder.h>
+#import <wtf/text/StringView.h>
 #import <wtf/text/cf/StringConcatenateCF.h>
 
 @interface NSURL ()
@@ -522,6 +523,11 @@ - (CFURLRef)_cfurl;
     // cookiesWithResponseHeaderFields doesn't parse cookies without a value
     cookieString = cookieString.contains('=') ? cookieString : makeString(cookieString, '=');
 
+    // FIXME: <rdar://185837942> Remove this once CFNetwork's cookie-date parser accepts a date that
+    // writes the month before the day of the month. RFC 6265 section 5.1.1 accepts either ordering.
+    if (auto dayFirst = CookieUtil::cookieStringWithDayFirstExpires(cookieString))
+        cookieString = WTF::move(*dayFirst);
+
     return adjustScriptWrittenCookie([NSHTTPCookie _cookieForSetCookieString:cookieString.createNSString().get() forURL:cookieURL partition:nsStringNilIfEmpty(partition).get()], cappedLifetime);
 }
 
diff --git a/Source/WebCore/platform/network/soup/NetworkStorageSessionSoup.cpp b/Source/WebCore/platform/network/soup/NetworkStorageSessionSoup.cpp
index 304d5114057c..7e781ba906d9 100644
--- a/Source/WebCore/platform/network/soup/NetworkStorageSessionSoup.cpp
+++ b/Source/WebCore/platform/network/soup/NetworkStorageSessionSoup.cpp
@@ -427,7 +427,11 @@ void NetworkStorageSession::setCookiesFromDOM(const URL& firstParty, const SameS
     GSList* existingCookies = soup_cookie_jar_get_cookie_list(jar, origin.get(), TRUE);
 
     for (auto& cookieString : value.split('\n')) {
-        GUniquePtr<SoupCookie> cookie(soup_cookie_parse(cookieString.utf8().data(), origin.get()));
+        // FIXME: Remove this once libsoup's cookie-date parser accepts a date that writes the month
+        // before the day of the month. RFC 6265 section 5.1.1 accepts either ordering.
+        auto dayFirst = CookieUtil::cookieStringWithDayFirstExpires(cookieString);
+        auto utf8CookieString = (dayFirst ? *dayFirst : cookieString).utf8();
+        GUniquePtr<SoupCookie> cookie(soup_cookie_parse(utf8CookieString.data(), origin.get()));
 
         if (!cookie)
             continue;
diff --git a/Source/WebCore/rendering/HitTestResult.cpp b/Source/WebCore/rendering/HitTestResult.cpp
index 1fd91f26213e..6e5e610bd97f 100644
--- a/Source/WebCore/rendering/HitTestResult.cpp
+++ b/Source/WebCore/rendering/HitTestResult.cpp
@@ -377,7 +377,7 @@ String HitTestResult::innerTextIfTruncated(TextDirection& dir) const
             continue;
 
         if (auto* block = dynamicDowncast<RenderBlockFlow>(element->renderer())) {
-            if (block->style().textOverflow() == TextOverflow::Ellipsis) {
+            if (block->style().textOverflow().isEllipsis()) {
                 for (auto lineBox = InlineIterator::firstLineBoxFor(*block); lineBox; lineBox.traverseNext()) {
                     if (lineBox->hasEllipsis()) {
                         dir = block->writingMode().computedTextDirection();
diff --git a/Source/WebCore/rendering/RenderBlock.cpp b/Source/WebCore/rendering/RenderBlock.cpp
index bf0899f1cead..ea559e8d68bf 100644
--- a/Source/WebCore/rendering/RenderBlock.cpp
+++ b/Source/WebCore/rendering/RenderBlock.cpp
@@ -556,18 +556,22 @@ static EnumSet<LogicalBoxAxis> sizesAffectedByScrollbarsForSubtreeRoot(const Ren
     if (layoutContext.subtreeScrollbarChangesState())
         return { };
 
+    EnumSet<LogicalBoxAxis> sizesAffected;
+
     auto& style = renderBlock.style();
     auto& computedLogicalWidth = style.logicalWidth();
-    if (computedLogicalWidth.isFixed())
-        return { };
+    if (!computedLogicalWidth.isFixed() && (computedLogicalWidth.isIntrinsic() || computedLogicalWidth.isMinIntrinsic() || renderBlock.sizesLogicalWidthToFitContent()))
+        sizesAffected.add(LogicalBoxAxis::Inline);
 
-    if (computedLogicalWidth.isIntrinsic() || computedLogicalWidth.isMinIntrinsic())
-        return LogicalBoxAxis::Inline;
+    auto& computedLogicalHeight = style.logicalHeight();
 
-    if (renderBlock.sizesLogicalWidthToFitContent())
-        return LogicalBoxAxis::Inline;
+    if (style.display().isFlexibleBox() && renderBlock.isBlockLevelBox() && (computedLogicalHeight.isAuto() || computedLogicalHeight.isIntrinsic()))
+        sizesAffected.add(LogicalBoxAxis::Block);
 
-    return { };
+    if (renderBlock.isRenderGrid() && (computedLogicalHeight.isAuto() || computedLogicalHeight.isIntrinsic()))
+        sizesAffected.add(LogicalBoxAxis::Block);
+
+    return sizesAffected;
 }
 
 static bool canContainDescendantScrollbarChanges(const RenderBlock& renderBlock, const LocalFrameViewLayoutContext& layoutContext)
diff --git a/Source/WebCore/rendering/RenderLayer.cpp b/Source/WebCore/rendering/RenderLayer.cpp
index 2c097c8466ea..97a982e41383 100644
--- a/Source/WebCore/rendering/RenderLayer.cpp
+++ b/Source/WebCore/rendering/RenderLayer.cpp
@@ -5217,15 +5217,18 @@ void RenderLayer::calculateClipRects(const ClipRectsContext& clipRectsContext, C
 
         if (renderer().hasNonVisibleOverflow()) {
             ClipRect newOverflowClip = rendererOverflowClipRectForChildLayers({ }, clipRectsContext.overlayScrollbarSizeRelevancy());
-            if (needsTransform)
-                newOverflowClip = LayoutRect(renderer().localToContainerQuad(FloatRect(newOverflowClip.rect()), &clipRectsContext.rootLayer->renderer()).boundingBox());
-            newOverflowClip.moveBy(offset);
-            newOverflowClip.setAffectedByRadius(renderer().style().border().hasBorderRadius());
-            clipRects.setOverflowClipRect(intersection(newOverflowClip, clipRects.overflowClipRect()));
-            if (renderer().canContainAbsolutelyPositionedObjects())
-                clipRects.setPosClipRect(intersection(newOverflowClip, clipRects.posClipRect()));
-            if (renderer().canContainFixedPositionObjects())
-                clipRects.setFixedClipRect(intersection(newOverflowClip, clipRects.fixedClipRect()));
+
+            if (!newOverflowClip.isInfinite()) {
+                if (needsTransform)
+                    newOverflowClip = LayoutRect(renderer().localToContainerQuad(FloatRect(newOverflowClip.rect()), &clipRectsContext.rootLayer->renderer()).boundingBox());
+                newOverflowClip.moveBy(offset);
+                newOverflowClip.setAffectedByRadius(renderer().style().border().hasBorderRadius());
+                clipRects.setOverflowClipRect(intersection(newOverflowClip, clipRects.overflowClipRect()));
+                if (renderer().canContainAbsolutelyPositionedObjects())
+                    clipRects.setPosClipRect(intersection(newOverflowClip, clipRects.posClipRect()));
+                if (renderer().canContainFixedPositionObjects())
+                    clipRects.setFixedClipRect(intersection(newOverflowClip, clipRects.fixedClipRect()));
+            }
         }
         if (renderer().hasClip()) {
             if (CheckedPtr box = dynamicDowncast<RenderBox>(renderer())) {
@@ -5364,9 +5367,11 @@ ClipRect RenderLayer::calculateForegroundRect(const ClipRectsContext& clipRectsC
 
     // This layer establishes a clip of some kind.
     if (this != clipRectsContext.rootLayer || clipRectsContext.respectOverflowClip()) {
-        auto overflowClipRect = rendererOverflowClipRect(toLayoutPoint(offsetFromRoot), clipRectsContext.overlayScrollbarSizeRelevancy());
-        foregroundRect.intersect(overflowClipRect);
-        foregroundRect.setAffectedByRadius(true);
+        auto overflowClipRect = rendererOverflowClipRectForPainting(toLayoutPoint(offsetFromRoot), clipRectsContext.overlayScrollbarSizeRelevancy());
+        if (!overflowClipRect.isInfinite()) {
+            foregroundRect.intersect(overflowClipRect);
+            foregroundRect.setAffectedByRadius(true);
+        }
         return foregroundRect;
     }
 
diff --git a/Source/WebCore/rendering/RenderLayer.h b/Source/WebCore/rendering/RenderLayer.h
index 01a8d1a0ed14..e1c61c7c823b 100644
--- a/Source/WebCore/rendering/RenderLayer.h
+++ b/Source/WebCore/rendering/RenderLayer.h
@@ -1214,12 +1214,12 @@ class RenderLayer final : public UniquelyOwned<RenderLayer> {
         return { };
     }
 
-    LayoutRect rendererOverflowClipRect(const LayoutPoint& location, OverlayScrollbarSizeRelevancy relevancy) const
+    LayoutRect rendererOverflowClipRectForPainting(const LayoutPoint& location, OverlayScrollbarSizeRelevancy relevancy) const
     {
         if (auto* box = dynamicDowncast<RenderBox>(renderer()))
             return box->overflowClipRect(location, relevancy);
         if (auto* svgModelObject = dynamicDowncast<RenderSVGModelObject>(renderer()))
-            return svgModelObject->overflowClipRect(location, relevancy);
+            return svgModelObject->overflowClipRectForPainting(location, relevancy);
         return { };
     }
 
diff --git a/Source/WebCore/rendering/RenderLayerBacking.cpp b/Source/WebCore/rendering/RenderLayerBacking.cpp
index fe358d990d05..e035d0cf67b9 100644
--- a/Source/WebCore/rendering/RenderLayerBacking.cpp
+++ b/Source/WebCore/rendering/RenderLayerBacking.cpp
@@ -903,12 +903,20 @@ void RenderLayerBacking::updateBackdropFiltersGeometry()
         auto roundedBoxRect = borderShape.deprecatedRoundedRect();
         roundedBoxRect.move(contentOffsetInCompositingLayer());
         backdropFiltersRect = roundedBoxRect.pixelSnappedRoundedRectForPainting(deviceScaleFactor());
+
+        if (renderBox->style().border().hasNonRoundCornerShape()) {
+            auto shapePath = borderShape.pathForOuterShape(deviceScaleFactor());
+            shapePath.translate(FloatSize { contentOffsetInCompositingLayer() });
+            m_graphicsLayer->setBackdropFiltersShapePath(shapePath);
+        } else
+            m_graphicsLayer->setBackdropFiltersShapePath({ });
     } else {
         auto boxRect = renderBox->borderBoxRect();
         if (renderBox->hasClip())
             boxRect.intersect(renderBox->clipRect({ }));
         boxRect.move(contentOffsetInCompositingLayer());
         backdropFiltersRect = FloatRoundedRect(snapRectToDevicePixels(boxRect, deviceScaleFactor()));
+        m_graphicsLayer->setBackdropFiltersShapePath({ });
     }
 
     m_graphicsLayer->setBackdropFiltersRect(backdropFiltersRect);
diff --git a/Source/WebCore/rendering/RenderLayerSVGAdditions.cpp b/Source/WebCore/rendering/RenderLayerSVGAdditions.cpp
index 7ee9652a5763..c1f038f3b17e 100644
--- a/Source/WebCore/rendering/RenderLayerSVGAdditions.cpp
+++ b/Source/WebCore/rendering/RenderLayerSVGAdditions.cpp
@@ -433,10 +433,10 @@ bool RenderLayer::appendChildrenInDOMOrderForSVG(RenderElement& parent, LayoutSi
             continue;
         }
 
-        // Paint a non-layer child that has a clip-path or a mask together with its whole subtree as one
-        // unit, so the clip or mask covers all of it. Splitting the container apart would move its
-        // descendants into the parent's z-order list and paint them outside the clip or mask.
-        if (child->hasClipPath() || child->hasMask()) {
+        // Paint a non-layer child that clips its subtree together with that subtree as one unit, so the
+        // clip covers all of it. Splitting it apart would move its descendants into the parent's
+        // z-order list and paint them outside the clip.
+        if (RenderSVGModelObject::clipsSubtree(child.get())) {
             allChildren.append(SVGPaintOrderLayerItem::makeAtomic(child.get(), ancestorOffset));
             hasIndependentlyPaintedDescendant = true;
             continue;
@@ -493,6 +493,7 @@ bool RenderLayer::appendChildrenInDOMOrderForSVG(RenderElement& parent, LayoutSi
         size_t startIndex = allChildren.size();
         bool subtreeHasIndependentlyPaintedDescendant = appendChildrenInDOMOrderForSVG(child.get(), childOffset, anyNonZeroZIndex);
         if (subtreeHasIndependentlyPaintedDescendant) {
+            ASSERT(!RenderSVGModelObject::clipsSubtree(child.get()));
             allChildren.append(SVGPaintOrderLayerItem::makeOutlineOnly(child.get(), ancestorOffset));
             hasIndependentlyPaintedDescendant = true;
         } else {
diff --git a/Source/WebCore/rendering/RenderScrollbar.cpp b/Source/WebCore/rendering/RenderScrollbar.cpp
index 8decf38b38b9..a109445c4197 100644
--- a/Source/WebCore/rendering/RenderScrollbar.cpp
+++ b/Source/WebCore/rendering/RenderScrollbar.cpp
@@ -55,9 +55,6 @@ RenderScrollbar::RenderScrollbar(ScrollableArea& scrollableArea, ScrollbarOrient
 {
     ASSERT(ownerElement || owningFrame);
 
-    // FIXME: We need to do this because RenderScrollbar::styleChanged is called as soon as the scrollbar is created.
-    relaxAdoptionRequirement();
-
     // Update the scrollbar size.
     int width = 0;
     int height = 0;
diff --git a/Source/WebCore/rendering/RenderWidget.cpp b/Source/WebCore/rendering/RenderWidget.cpp
index f15823b09dae..b5018fa1e410 100644
--- a/Source/WebCore/rendering/RenderWidget.cpp
+++ b/Source/WebCore/rendering/RenderWidget.cpp
@@ -103,7 +103,6 @@ static void moveWidgetToParentSoon(Widget& child, LocalFrameView* parent)
 RenderWidget::RenderWidget(Type type, HTMLFrameOwnerElement& element, Style::ComputedStyle&& style)
     : RenderReplaced(type, element, WTF::move(style), ReplacedFlag::IsWidget)
 {
-    relaxAdoptionRequirement();
     setInline(false);
 }
 
diff --git a/Source/WebCore/rendering/SubtreeScrollbarChangesState.cpp b/Source/WebCore/rendering/SubtreeScrollbarChangesState.cpp
index 660d30e96a15..defff36b4891 100644
--- a/Source/WebCore/rendering/SubtreeScrollbarChangesState.cpp
+++ b/Source/WebCore/rendering/SubtreeScrollbarChangesState.cpp
@@ -147,9 +147,14 @@ SubtreeScrollbarChangesHandler::~SubtreeScrollbarChangesHandler()
 
     auto& subtreeRoot = subtreeScrollbarChangesState->subtreeRoot;
     for (auto& rendererScrollbarChange : descendantsWithScrollbarChange) {
-        if (rendererScrollbarChange.sizesAffectedFromScrollbarChanges.containsOnly(LogicalBoxAxis::Block))
-            continue;
-        protect(rendererScrollbarChange.renderer)->invalidateContentLogicalWidths(MarkingBehavior::MarkContainingBlockChain, protect(subtreeRoot->containingBlock()));
+        CheckedRef renderer = rendererScrollbarChange.renderer;
+        ASSERT(renderer->isDescendantOf(subtreeRoot.ptr()));
+        if (rendererScrollbarChange.sizesAffectedFromScrollbarChanges.contains(LogicalBoxAxis::Block)) {
+            renderer->setNeedsLayout(MarkingBehavior::MarkOnlyThis);
+            renderer->markContainingBlocksForLayout(subtreeRoot.ptr());
+        }
+        if (rendererScrollbarChange.sizesAffectedFromScrollbarChanges.contains(LogicalBoxAxis::Inline))
+            renderer->invalidateContentLogicalWidths(MarkingBehavior::MarkContainingBlockChain, protect(subtreeRoot->containingBlock()));
     }
     descendantsWithScrollbarChange.clear();
 
diff --git a/Source/WebCore/rendering/TextAutoSizing.cpp b/Source/WebCore/rendering/TextAutoSizing.cpp
index c0a4f871cb02..2715c5e9a753 100644
--- a/Source/WebCore/rendering/TextAutoSizing.cpp
+++ b/Source/WebCore/rendering/TextAutoSizing.cpp
@@ -130,7 +130,11 @@ unsigned TextAutoSizingHashTranslator::hash(const Style::ComputedStyle& style)
     hash ^= std::to_underlying(style.rtlOrdering());
     hash ^= std::to_underlying(style.position());
     hash ^= std::to_underlying(style.floating());
-    hash ^= std::to_underlying(style.textOverflow());
+    hash ^= style.textOverflow().switchOn(
+        [](const CSS::Keyword::Clip&) -> unsigned { return computeHash(0); },
+        [](const CSS::Keyword::Ellipsis&) -> unsigned { return computeHash(1); },
+        [](const Style::String& string) -> unsigned { return computeHash(2, string.value); }
+    );
     return hash;
 }
 
diff --git a/Source/WebCore/rendering/TextBoxPainter.cpp b/Source/WebCore/rendering/TextBoxPainter.cpp
index bbeaceb4fcc0..95856d60d4c1 100644
--- a/Source/WebCore/rendering/TextBoxPainter.cpp
+++ b/Source/WebCore/rendering/TextBoxPainter.cpp
@@ -34,6 +34,7 @@
 #include "GraphicsContext.h"
 #include "HTMLAnchorElement.h"
 #include "InlineIteratorBoxInlines.h"
+#include "InlineIteratorInlineBox.h"
 #include "InlineIteratorLineBox.h"
 #include "InlineIteratorTextBoxInlines.h"
 #include "InlineTextBoxStyle.h"
@@ -993,6 +994,23 @@ static float autoTextDecorationInset(const Style::ComputedStyle& style)
     return style.computedFontSize() / 8;
 }
 
+struct DecoratingBoxFragmentInlineSizes {
+    float preceding { 0.f };
+    float current { 0.f };
+    float following { 0.f };
+
+    float total() const { return preceding + current + following; }
+};
+static DecoratingBoxFragmentInlineSizes decoratingBoxFragmentInlineSizes(const InlineIterator::InlineBox& decoratingInlineBox)
+{
+    auto inlineSizes = DecoratingBoxFragmentInlineSizes { .current = decoratingInlineBox.logicalWidth() };
+    for (auto fragment = decoratingInlineBox.nextInlineBoxLineLeftward(); fragment; fragment.traverseInlineBoxLineLeftward())
+        inlineSizes.preceding += fragment->logicalWidth();
+    for (auto fragment = decoratingInlineBox.nextInlineBoxLineRightward(); fragment; fragment.traverseInlineBoxLineRightward())
+        inlineSizes.following += fragment->logicalWidth();
+    return inlineSizes;
+}
+
 std::pair<FloatPoint, float> TextBoxPainter::insetAdjustedDecorationLocationAndWidth(const DecoratingBox& decoratingBox, const StyledMarkedText& markedText) const
 {
     auto boxOrigin = decoratingBox.location;
@@ -1008,55 +1026,54 @@ std::pair<FloatPoint, float> TextBoxPainter::insetAdjustedDecorationLocationAndW
     auto& inset = *insetStyles.inset;
 
     auto& style = decoratingBox.style.get();
+    auto writingMode = style.writingMode();
+    auto decoratingInlineBox = decoratingBox.inlineBox;
+    auto isSliced = insetStyles.boxDecorationBreak != BoxDecorationBreak::Clone;
+
+    auto fragmentInlineSizes = isSliced ? decoratingBoxFragmentInlineSizes(*decoratingInlineBox) : DecoratingBoxFragmentInlineSizes { .current = decoratingInlineBox->logicalWidth() };
     auto autoValue = inset.isAuto() ? autoTextDecorationInset(style) : 0.f;
-    auto startInset = inset.resolvedStart(style, autoValue);
-    auto endInset = inset.resolvedEnd(style, autoValue);
+    auto percentageBasis = fragmentInlineSizes.total();
+    auto startInset = inset.resolvedStart(style, autoValue, percentageBasis);
+    auto endInset = inset.resolvedEnd(style, autoValue, percentageBasis);
     if (!startInset && !endInset)
         return { boxOrigin, width };
 
-    auto writingMode = style.writingMode();
-    auto decoratingInlineBox = decoratingBox.inlineBox;
-
     // box-decoration-break: the start inset applies only to the first fragment's start edge and the
     // end inset only to the last fragment's end edge; for box-decoration-break: clone every fragment is
     // a complete box, so both endpoints are inset on every line.
-    auto closedEdges = [&]() -> RectEdges<bool> {
-        if (!decoratingInlineBox)
-            return { true };
-        if (insetStyles.boxDecorationBreak == BoxDecorationBreak::Clone)
-            return { true };
-        return decoratingInlineBox->closedEdges();
-    }();
+    auto closedEdges = isSliced ? decoratingInlineBox->closedEdges() : RectEdges<bool>(true);
+    auto hasLogicalStartEdge = closedEdges.start(writingMode);
+    auto hasLogicalEndEdge = closedEdges.end(writingMode);
+
+    auto insetForFragment = [](float inset, float inlineSizeToBoxEdge, bool ownsEdge) {
+        if (inset > 0)
+            return std::max(0.f, inset - inlineSizeToBoxEdge);
+        return ownsEdge ? inset : 0.f;
+    };
+    startInset = insetForFragment(startInset, fragmentInlineSizes.preceding, hasLogicalStartEdge);
+    endInset = insetForFragment(endInset, fragmentInlineSizes.following, hasLogicalEndEdge);
+    auto startEdgeOnFragment = hasLogicalStartEdge || startInset > 0;
+    auto endEdgeOnFragment = hasLogicalEndEdge || endInset > 0;
 
     bool isLTR = writingMode.isBidiLTR();
 
-    // A decorating box can span several leaf boxes on a line (its bidi runs), each split into marked-text
-    // sub-ranges. Map the logical start/end insets onto the decoration's visual left/right edges;
-    // displacements below are measured rightward (a positive inset trims inward, a negative one extends
-    // outward). box-decoration-break decides which of the decoration's edges live on this line fragment,
-    // and firstLeafBox/lastLeafBox + the marked-text offsets decide which painted piece actually reaches
-    // that visual edge.
     auto textBox = makeIterator();
     bool ownsLineLeftEdge = !decoratingInlineBox || textBox == decoratingInlineBox->firstLeafBox();
     bool ownsLineRightEdge = !decoratingInlineBox || textBox == decoratingInlineBox->lastLeafBox();
     bool ownsLogicalStart = !markedText.startOffset;
     bool ownsLogicalEnd = markedText.endOffset == m_paintTextRun.length();
 
-    float visualLeftInset = isLTR ? startInset : endInset;
-    float visualRightInset = isLTR ? endInset : startInset;
-    bool leftEdgeOnFragment = isLTR ? closedEdges.start(writingMode) : closedEdges.end(writingMode);
-    bool rightEdgeOnFragment = isLTR ? closedEdges.end(writingMode) : closedEdges.start(writingMode);
+    auto visualLeftInset = isLTR ? startInset : endInset;
+    auto visualRightInset = isLTR ? endInset : startInset;
+    auto leftEdgeOnFragment = isLTR ? startEdgeOnFragment : endEdgeOnFragment;
+    auto rightEdgeOnFragment = isLTR ? endEdgeOnFragment : startEdgeOnFragment;
     float leftEdgeMove = leftEdgeOnFragment ? visualLeftInset : 0.f;
     float rightEdgeMove = rightEdgeOnFragment ? -visualRightInset : 0.f;
 
-    // When the whole decoration lives on this fragment, the part of the inset that moves both visual
-    // edges the same way is an inline-axis shift of the decoration as a whole. Applying that shift to
-    // every painted piece keeps a symmetric inset a rigid shift of the decoration - including the seam
-    // between bidi runs - instead of pinning that interior seam. The remaining per-edge movement is the
-    // extend/trim overhang, applied only at the piece that actually reaches that visual edge; interior
-    // pieces (e.g. superscripts/subscripts at other baselines) get only the whole-decoration shift, so
-    // they stay put for a pure extend/trim. (skip-ink needs no adjustment: its gaps are measured relative
-    // to the underline's bounding box, which already tracks boxOrigin.)
+    // The part of the inset that moves both visual edges the same way is a shift of the whole decoration,
+    // so every painted piece gets it and a symmetric inset stays rigid across bidi runs.
+    // The rest is the extend/trim overhang, which only the piece reaching that visual edge gets, leaving
+    // interior pieces (e.g. a superscript at another baseline) where they are for a pure extend/trim.
     float decorationInlineShift = (leftEdgeOnFragment && rightEdgeOnFragment) ? (leftEdgeMove + rightEdgeMove) / 2.f : 0.f;
     bool reachesVisualLeft = leftEdgeOnFragment && ownsLineLeftEdge && (isLTR ? ownsLogicalStart : ownsLogicalEnd);
     bool reachesVisualRight = rightEdgeOnFragment && ownsLineRightEdge && (isLTR ? ownsLogicalEnd : ownsLogicalStart);
diff --git a/Source/WebCore/rendering/style/RenderStyleConstants.cpp b/Source/WebCore/rendering/style/RenderStyleConstants.cpp
index 8f603c098df9..9b029bd807ef 100644
--- a/Source/WebCore/rendering/style/RenderStyleConstants.cpp
+++ b/Source/WebCore/rendering/style/RenderStyleConstants.cpp
@@ -1147,15 +1147,6 @@ TextStream& operator<<(TextStream& ts, TextJustify justify)
     return ts;
 }
 
-TextStream& operator<<(TextStream& ts, TextOverflow overflow)
-{
-    switch (overflow) {
-    case TextOverflow::Clip: ts << "clip"_s; break;
-    case TextOverflow::Ellipsis: ts << "ellipsis"_s; break;
-    }
-    return ts;
-}
-
 TextStream& operator<<(TextStream& ts, TextSecurity textSecurity)
 {
     switch (textSecurity) {
diff --git a/Source/WebCore/rendering/style/RenderStyleConstants.h b/Source/WebCore/rendering/style/RenderStyleConstants.h
index cc09c50e3885..8f6ffbadfb23 100644
--- a/Source/WebCore/rendering/style/RenderStyleConstants.h
+++ b/Source/WebCore/rendering/style/RenderStyleConstants.h
@@ -812,11 +812,6 @@ enum class TextEmphasisMark : uint8_t {
     Sesame
 };
 
-enum class TextOverflow : bool {
-    Clip,
-    Ellipsis
-};
-
 enum class TextWrapMode : bool {
     Wrap,
     NoWrap
@@ -1247,7 +1242,6 @@ WTF::TextStream& operator<<(WTF::TextStream&, TextEmphasisFill);
 WTF::TextStream& operator<<(WTF::TextStream&, TextEmphasisMark);
 WTF::TextStream& operator<<(WTF::TextStream&, TextGroupAlign);
 WTF::TextStream& operator<<(WTF::TextStream&, TextJustify);
-WTF::TextStream& operator<<(WTF::TextStream&, TextOverflow);
 WTF::TextStream& operator<<(WTF::TextStream&, TextSecurity);
 WTF::TextStream& operator<<(WTF::TextStream&, TextWrapMode);
 WTF::TextStream& operator<<(WTF::TextStream&, TextWrapStyle);
diff --git a/Source/WebCore/rendering/svg/RenderSVGContainer.cpp b/Source/WebCore/rendering/svg/RenderSVGContainer.cpp
index b7de48bac55b..edef5b6fe592 100644
--- a/Source/WebCore/rendering/svg/RenderSVGContainer.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGContainer.cpp
@@ -181,8 +181,10 @@ void RenderSVGContainer::paint(PaintInfo& paintInfo, const LayoutPoint& paintOff
     GraphicsContextStateSaver stateSaver(childPaintInfo.context());
 
     // For layer-backed containers, clipping is handled by RenderLayer::calculateClipRects().
-    if (isRenderSVGViewportContainer() && SVGRenderSupport::isOverflowHidden(*this))
-        childPaintInfo.context().clip(FloatRect(overflowClipRect(adjustedPaintOffset)));
+    if (isRenderSVGViewportContainer() && SVGRenderSupport::isOverflowHidden(*this)) {
+        if (auto clipRect = overflowClipRectForPainting(adjustedPaintOffset); !clipRect.isInfinite())
+            childPaintInfo.context().clip(FloatRect(clipRect));
+    }
 
     childPaintInfo.updateSubtreePaintRootForChildren(this);
     for (CheckedRef child : childrenOfType<RenderElement>(*this)) {
diff --git a/Source/WebCore/rendering/svg/RenderSVGModelObject.cpp b/Source/WebCore/rendering/svg/RenderSVGModelObject.cpp
index ad2608d601df..54bb3a690854 100644
--- a/Source/WebCore/rendering/svg/RenderSVGModelObject.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGModelObject.cpp
@@ -77,7 +77,7 @@ bool RenderSVGModelObject::requiresLayer() const
         return true;
     if (requiresLayerForSVGIntrinsicReasons())
         return true;
-    if ((hasClipPath() || hasMask()) && isRenderSVGContainer())
+    if (clipsSubtree(*this) && isRenderSVGContainer())
         return true;
     // Other renderers inside a resource container are not composited, so the transformed-container rule
     // below (which exists only to expose the induced transform to RenderLayerCompositor) is unneeded.
@@ -119,6 +119,23 @@ LayoutRect RenderSVGModelObject::overflowClipRect(const LayoutPoint&, OverlayScr
     return LayoutRect();
 }
 
+LayoutRect RenderSVGModelObject::overflowClipRectForPainting(const LayoutPoint& location, OverlayScrollbarSizeRelevancy relevancy, PaintPhase phase) const
+{
+    auto clipRect = overflowClipRect(location, relevancy, phase);
+    if (clipRect.isEmpty() || clipRect.isInfinite())
+        return clipRect;
+
+    if (!m_cachedVisualOverflowRect)
+        updateCachedVisualOverflowRect();
+
+    auto contentRect = m_cachedVisualOverflowRect->repaintBoundingBox;
+    contentRect.moveBy(location);
+    if (clipRect.contains(contentRect))
+        return LayoutRect::infiniteRect();
+
+    return clipRect;
+}
+
 auto RenderSVGModelObject::localRectsForRepaint(RepaintOutlineBounds repaintOutlineBounds) const -> RepaintRects
 {
     if (isInsideEntirelyHiddenLayer())
diff --git a/Source/WebCore/rendering/svg/RenderSVGModelObject.h b/Source/WebCore/rendering/svg/RenderSVGModelObject.h
index 553b9c51ff78..8c7c95bafb85 100644
--- a/Source/WebCore/rendering/svg/RenderSVGModelObject.h
+++ b/Source/WebCore/rendering/svg/RenderSVGModelObject.h
@@ -54,6 +54,8 @@ class RenderSVGModelObject : public RenderLayerModelObject {
 
     bool requiresLayer() const override;
 
+    static bool clipsSubtree(const RenderElement&); // Defined in RenderSVGModelObjectInlines.h.
+
     void styleDidChange(Style::Difference, const Style::ComputedStyle* oldStyle) override;
 
     static bool checkIntersection(RenderElement*, const FloatRect&);
@@ -78,16 +80,30 @@ class RenderSVGModelObject : public RenderLayerModelObject {
     LayoutRect borderBoxRectEquivalent() const { return { LayoutPoint(), m_layoutRect.size() }; }
     LayoutRect contentBoxRectEquivalent() const { return borderBoxRectEquivalent(); }
     LayoutRect frameRectEquivalent() const { return m_layoutRect; }
+    LayoutSize locationOffsetEquivalent() const { return toLayoutSize(currentSVGLayoutLocation()); }
+
     LayoutRect visualOverflowRectEquivalent() const
     {
         if (!m_cachedVisualOverflowRect)
-            m_cachedVisualOverflowRect = SVGBoundingBoxComputation::computeVisualOverflowRect(*this);
-        return *m_cachedVisualOverflowRect;
+            updateCachedVisualOverflowRect();
+        return m_cachedVisualOverflowRect->repaintBoundingBoxClippedToViewport;
     }
 
-    std::optional<LayoutRect> cachedVisualOverflowRectIfAvailable() const { return m_cachedVisualOverflowRect; }
-    void updateCachedVisualOverflowRect() { m_cachedVisualOverflowRect = SVGBoundingBoxComputation::computeVisualOverflowRect(*this); }
-    LayoutSize locationOffsetEquivalent() const { return toLayoutSize(currentSVGLayoutLocation()); }
+    std::optional<LayoutRect> cachedVisualOverflowRectIfAvailable() const
+    {
+        if (!m_cachedVisualOverflowRect)
+            return std::nullopt;
+        return m_cachedVisualOverflowRect->repaintBoundingBoxClippedToViewport;
+    }
+
+    void updateCachedVisualOverflowRect() const
+    {
+        auto repaintBoundingBox = SVGBoundingBoxComputation::computeVisualOverflowRectIgnoringViewportClip(*this);
+        auto repaintBoundingBoxClippedToViewport = repaintBoundingBox;
+        if (hasNonVisibleOverflow())
+            repaintBoundingBoxClippedToViewport.intersect(overflowClipRect(LayoutPoint()));
+        m_cachedVisualOverflowRect = CachedVisualOverflowRects { repaintBoundingBoxClippedToViewport, repaintBoundingBox };
+    }
 
     bool hasVisualOverflow() const { return !borderBoxRectEquivalent().contains(visualOverflowRectEquivalent()); }
 
@@ -95,7 +111,8 @@ class RenderSVGModelObject : public RenderLayerModelObject {
     LayoutPoint topLeftLocationEquivalent() const { return currentSVGLayoutLocation(); }
     LayoutRect borderBoxRectInFragmentEquivalent(RenderFragmentContainer*, RenderBox::RenderBoxFragmentInfoFlags = RenderBox::RenderBoxFragmentInfoFlags::CacheRenderBoxFragmentInfo) const { return borderBoxRectEquivalent(); }
     virtual LayoutRect overflowClipRect(const LayoutPoint& location, OverlayScrollbarSizeRelevancy = OverlayScrollbarSizeRelevancy::IgnoreOverlayScrollbarSize, PaintPhase = PaintPhase::BlockBackground) const;
-    LayoutRect overflowClipRectForChildLayers(const LayoutPoint& location, OverlayScrollbarSizeRelevancy relevancy) { return overflowClipRect(location, relevancy); }
+    LayoutRect overflowClipRectForPainting(const LayoutPoint& location, OverlayScrollbarSizeRelevancy = OverlayScrollbarSizeRelevancy::IgnoreOverlayScrollbarSize, PaintPhase = PaintPhase::BlockBackground) const;
+    LayoutRect overflowClipRectForChildLayers(const LayoutPoint& location, OverlayScrollbarSizeRelevancy relevancy) { return overflowClipRectForPainting(location, relevancy); }
 
     Path computeClipPathGeometry() const;
     void computeClipContentTransform(AffineTransform&) const;
@@ -129,7 +146,11 @@ class RenderSVGModelObject : public RenderLayerModelObject {
     // intersection, this return value allows distinguishing between no intersection and zero-area intersection.
     bool applyCachedClipAndScrollPosition(RepaintRects&, const RenderLayerModelObject* container, const VisibleRectContext&) const final;
 
-    mutable std::optional<LayoutRect> m_cachedVisualOverflowRect;
+    struct CachedVisualOverflowRects {
+        LayoutRect repaintBoundingBoxClippedToViewport;
+        LayoutRect repaintBoundingBox;
+    };
+    mutable std::optional<CachedVisualOverflowRects> m_cachedVisualOverflowRect;
 
     void updateLayerTransform() override;
 
diff --git a/Source/WebCore/rendering/svg/RenderSVGModelObjectInlines.h b/Source/WebCore/rendering/svg/RenderSVGModelObjectInlines.h
index 347ad8dab62e..031dfa28f312 100644
--- a/Source/WebCore/rendering/svg/RenderSVGModelObjectInlines.h
+++ b/Source/WebCore/rendering/svg/RenderSVGModelObjectInlines.h
@@ -25,11 +25,17 @@
 
 #pragma once
 
+#include "RenderElementStyleInlines.h"
 #include "RenderSVGModelObject.h"
 #include "SVGElement.h"
 
 namespace WebCore {
 
+inline bool RenderSVGModelObject::clipsSubtree(const RenderElement& renderer)
+{
+    return renderer.hasClipPath() || renderer.hasMask();
+}
+
 inline SVGElement& RenderSVGModelObject::element() const
 {
     return downcast<SVGElement>(nodeForNonAnonymous());
diff --git a/Source/WebCore/rendering/svg/SVGBoundingBoxComputation.cpp b/Source/WebCore/rendering/svg/SVGBoundingBoxComputation.cpp
index 9a5d363e2631..39e3c9db22d7 100644
--- a/Source/WebCore/rendering/svg/SVGBoundingBoxComputation.cpp
+++ b/Source/WebCore/rendering/svg/SVGBoundingBoxComputation.cpp
@@ -208,6 +208,9 @@ FloatRect SVGBoundingBoxComputation::handleRootOrContainer(const SVGBoundingBoxC
     FloatRect box;
     bool boxValid = false;
 
+    auto optionsForChildren = options;
+    optionsForChildren.remove(DecorationOption::IgnoreViewportClip);
+
     // 2. Let parent be the container element if it is one, or the root of the "use" element's shadow tree otherwise.
 
     // 3. For each descendant graphics element child of parent:
@@ -221,7 +224,7 @@ FloatRect SVGBoundingBoxComputation::handleRootOrContainer(const SVGBoundingBoxC
             continue;
 
         SVGBoundingBoxComputation childBoundingBoxComputation(child);
-        auto childBox = childBoundingBoxComputation.computeDecoratedBoundingBox(options);
+        auto childBox = childBoundingBoxComputation.computeDecoratedBoundingBox(optionsForChildren);
         if (options.contains(DecorationOption::OverrideBoxWithFilterBoxForChildren) && is<RenderSVGContainer>(child)) {
             DecorationOptions optionsForChild = { DecorationOption::OverrideBoxWithFilterBox };
             if (options.contains(DecorationOption::CalculateFastRepaintRect))
@@ -249,7 +252,7 @@ FloatRect SVGBoundingBoxComputation::handleRootOrContainer(const SVGBoundingBoxC
     //      system space that contains the intersection of box and the rectangle specified by clip. (TODO!)
     adjustBoxForClippingAndEffects(options, box, { DecorationOption::OverrideBoxWithFilterBox });
 
-    if (options.contains(DecorationOption::IncludeClippers) && m_renderer->hasNonVisibleOverflow()) {
+    if (options.contains(DecorationOption::IncludeClippers) && !options.contains(DecorationOption::IgnoreViewportClip) && m_renderer->hasNonVisibleOverflow()) {
         ASSERT(is<RenderSVGViewportContainer>(m_renderer) || is<RenderSVGResourceMarker>(m_renderer) || is<RenderSVGRoot>(m_renderer));
 
         LayoutRect overflowClipRect;
@@ -334,17 +337,12 @@ void SVGBoundingBoxComputation::adjustBoxForClippingAndEffects(const SVGBounding
         box.inflate(m_renderer->outlineStyleForRepaint().usedOutlineSize(m_renderer->outlineStyleForRepaint().usedZoomForLength(), m_renderer->outlineStyleForRepaint().deviceScaleFactor()));
 }
 
-LayoutRect SVGBoundingBoxComputation::computeVisualOverflowRect(const RenderLayerModelObject& renderer)
+static LayoutRect computeVisualOverflowRectWithOptions(const RenderLayerModelObject& renderer, SVGBoundingBoxComputation::DecorationOptions extraOptions)
 {
-    // Visual overflow must include descendant transforms: a non-layer transformed descendant paints
-    // directly into this renderer, so its transformed bounds belong here. (The transform-ignored
-    // variant is reserved for objectBoundingBoxWithoutTransformations, which defines the SVG layout
-    // location and must stay flattened.) The result is expressed relative to nominalSVGLayoutLocation(),
-    // so a container whose content is shifted by a descendant transform is bounded where it paints.
-    DecorationOptions options = repaintBoundingBoxDecoration | DecorationOption::IncludeOutline;
+    auto options = SVGBoundingBoxComputation::repaintBoundingBoxDecoration | SVGBoundingBoxComputation::DecorationOption::IncludeOutline | extraOptions;
     if (is<RenderSVGContainer>(renderer))
-        options = options | DecorationOption::UseFilterBoxOnEmptyRect;
-    auto decoratedBoundingBox = computeDecoratedBoundingBox(renderer, options);
+        options = options | SVGBoundingBoxComputation::DecorationOption::UseFilterBoxOnEmptyRect;
+    auto decoratedBoundingBox = SVGBoundingBoxComputation::computeDecoratedBoundingBox(renderer, options);
     if (decoratedBoundingBox.isEmpty())
         return { };
 
@@ -353,4 +351,14 @@ LayoutRect SVGBoundingBoxComputation::computeVisualOverflowRect(const RenderLaye
     return visualOverflowRect;
 }
 
+LayoutRect SVGBoundingBoxComputation::computeVisualOverflowRect(const RenderLayerModelObject& renderer)
+{
+    return computeVisualOverflowRectWithOptions(renderer, { });
+}
+
+LayoutRect SVGBoundingBoxComputation::computeVisualOverflowRectIgnoringViewportClip(const RenderLayerModelObject& renderer)
+{
+    return computeVisualOverflowRectWithOptions(renderer, DecorationOption::IgnoreViewportClip);
+}
+
 }
diff --git a/Source/WebCore/rendering/svg/SVGBoundingBoxComputation.h b/Source/WebCore/rendering/svg/SVGBoundingBoxComputation.h
index 8cb85c70808c..4bc8979b5096 100644
--- a/Source/WebCore/rendering/svg/SVGBoundingBoxComputation.h
+++ b/Source/WebCore/rendering/svg/SVGBoundingBoxComputation.h
@@ -44,7 +44,8 @@ class SVGBoundingBoxComputation {
         OverrideBoxWithFilterBox            = 1 << 7, /* WebKit extension - internal    */
         OverrideBoxWithFilterBoxForChildren = 1 << 8, /* WebKit extension - internal    */
         CalculateFastRepaintRect            = 1 << 9, /* WebKit extension - internal    */
-        UseFilterBoxOnEmptyRect             = 1 << 10  /* WebKit extension - internal    */
+        UseFilterBoxOnEmptyRect             = 1 << 10, /* WebKit extension - internal    */
+        IgnoreViewportClip                  = 1 << 11  /* WebKit extension - internal    */
     };
 
     using DecorationOptions = OptionSet<DecorationOption>;
@@ -74,6 +75,7 @@ class SVGBoundingBoxComputation {
     }
 
     static LayoutRect computeVisualOverflowRect(const RenderLayerModelObject&);
+    static LayoutRect computeVisualOverflowRectIgnoringViewportClip(const RenderLayerModelObject&);
 
     // Recompute the transform-dependent bounding boxes shared by RenderSVGContainer and
     // RenderSVGRoot after a descendant transform changed outside layout. Pass objectBoundingBoxValid
diff --git a/Source/WebCore/style/InlineTextBoxStyle.cpp b/Source/WebCore/style/InlineTextBoxStyle.cpp
index acbf824fbac2..62d7f9a73c98 100644
--- a/Source/WebCore/style/InlineTextBoxStyle.cpp
+++ b/Source/WebCore/style/InlineTextBoxStyle.cpp
@@ -231,7 +231,7 @@ static InkOverflowForDecorations computedInkOverflowForDecorations(const Style::
     // or it gets clipped / left unrepainted. A positive inset (and 'auto', which only trims inward)
     // needs no expansion. We expand both inline edges by the largest outward amount, which is a safe
     // superset regardless of writing mode / direction.
-    auto outwardInset = std::max<float>({ 0.f, -lineStyle.textDecorationInset().resolvedStart(lineStyle, 0.f), -lineStyle.textDecorationInset().resolvedEnd(lineStyle, 0.f) });
+    auto outwardInset = lineStyle.textDecorationInset().outwardExtent(lineStyle, 0.f);
     if (outwardInset) {
         overflowResult.left() = std::max(overflowResult.left(), LayoutUnit(ceilf(outwardInset)));
         overflowResult.right() = std::max(overflowResult.right(), LayoutUnit(ceilf(outwardInset)));
diff --git a/Source/WebCore/style/StyleBuilder.cpp b/Source/WebCore/style/StyleBuilder.cpp
index e855e2309b1c..e28f7acb16ce 100644
--- a/Source/WebCore/style/StyleBuilder.cpp
+++ b/Source/WebCore/style/StyleBuilder.cpp
@@ -775,7 +775,14 @@ std::optional<Builder::CustomPropertyOrKeyword> Builder::resolveCustomPropertyVa
     if (!registered)
         return { { CustomProperty::createForVariableData(name, *resolvedData) } };
 
-    auto dependencies = CSSPropertyParser::collectParsedCustomPropertyValueDependencies(registered->syntax, resolvedData->tokens(), resolvedData->context());
+    return computeCustomPropertyValueForSyntax(name, registered->syntax, *resolvedData);
+}
+
+// Parses an already-substituted value against a syntax and computes it on this builder's element.
+// Shared by registered custom properties and by custom function parameters.
+std::optional<Builder::CustomPropertyOrKeyword> Builder::computeCustomPropertyValueForSyntax(const AtomString& name, const CSSCustomPropertySyntax& syntax, const CSSVariableData& resolvedData)
+{
+    auto dependencies = CSSPropertyParser::collectParsedCustomPropertyValueDependencies(syntax, resolvedData.tokens(), resolvedData.context());
 
     // https://drafts.css-houdini.org/css-properties-values-api/#dependency-cycles
     bool hasCycles = false;
@@ -803,18 +810,18 @@ std::optional<Builder::CustomPropertyOrKeyword> Builder::resolveCustomPropertyVa
     if (isFontDependent)
         m_state->updateFont();
 
-    auto isAttrTainted = resolvedData->isAttrTainted();
+    auto isAttrTainted = resolvedData.isAttrTainted();
 
     // https://drafts.csswg.org/css-values-5/#attr-security
     // A registered custom property with <url> or <image> syntax resolved from attr()-tainted data is IACVT.
     if (isAttrTainted == IsAttrTainted::Yes) {
-        for (auto& component : registered->syntax.definition) {
+        for (auto& component : syntax.definition) {
             if (component.type == CSSCustomPropertySyntax::Type::URL || component.type == CSSCustomPropertySyntax::Type::Image)
                 return { };
         }
     }
 
-    return CSSPropertyParser::parseTypedCustomPropertyValue(name, registered->syntax, resolvedData->tokens(), m_state, resolvedData->context(), isAttrTainted);
+    return CSSPropertyParser::parseTypedCustomPropertyValue(name, syntax, resolvedData.tokens(), m_state, resolvedData.context(), isAttrTainted);
 }
 
 void Builder::applyPageSizeDescriptor(CSSValue& value)
diff --git a/Source/WebCore/style/StyleBuilder.h b/Source/WebCore/style/StyleBuilder.h
index 43147d182ba3..3212e5451379 100644
--- a/Source/WebCore/style/StyleBuilder.h
+++ b/Source/WebCore/style/StyleBuilder.h
@@ -32,7 +32,9 @@
 namespace WebCore {
 
 class CSSCustomPropertyValue;
+class CSSVariableData;
 enum class CSSWideKeyword : uint8_t;
+struct CSSCustomPropertySyntax;
 struct CSSRegisteredCustomProperty;
 
 namespace Style {
@@ -63,6 +65,7 @@ class Builder {
 
     RefPtr<const CustomProperty> resolveCustomPropertyForContainerQueries(const CSSCustomPropertyValue&);
     std::optional<CustomPropertyOrKeyword> resolveFunctionResult();
+    std::optional<CustomPropertyOrKeyword> computeCustomPropertyValueForSyntax(const AtomString&, const CSSCustomPropertySyntax&, const CSSVariableData&);
 
     BuilderState& state() { return m_state; }
     const MatchResult& matchResult() const { return m_cascade.matchResult(); }
diff --git a/Source/WebCore/style/StyleCustomProperty.cpp b/Source/WebCore/style/StyleCustomProperty.cpp
index ae929b481a88..ddc1501ebb08 100644
--- a/Source/WebCore/style/StyleCustomProperty.cpp
+++ b/Source/WebCore/style/StyleCustomProperty.cpp
@@ -233,7 +233,8 @@ const Vector<CSSParserToken>& CustomProperty::tokens() const
         },
         [&](auto&) -> const Vector<CSSParserToken>& {
             if (!m_cachedTokens) {
-                CSSTokenizer tokenizer { propertyValueSerializationForTokenization(CSS::defaultSerializationContext(), Style::ComputedStyle::defaultStyleSingleton()) };
+                auto serialization = propertyValueSerializationForTokenization(CSS::defaultSerializationContext(), Style::ComputedStyle::defaultStyleSingleton());
+                CSSTokenizer tokenizer { serialization };
                 m_cachedTokens = CSSVariableData::create(tokenizer.tokenRange(), m_isAttrTainted);
             }
             return m_cachedTokens->tokens();
diff --git a/Source/WebCore/style/StyleDifference.cpp b/Source/WebCore/style/StyleDifference.cpp
index c5833e8e9709..1ad364cde4b9 100644
--- a/Source/WebCore/style/StyleDifference.cpp
+++ b/Source/WebCore/style/StyleDifference.cpp
@@ -127,6 +127,11 @@ class DifferenceFunctions final {
             if (isAlignedForUnder(a) || isAlignedForUnder(b))
                 return true;
 
+            // A percentage value resolves against the decorating box size, which is not known here,
+            // so two different percentages would compare equal below at inkOverflowForDecorations where percent values are resolved against 0.
+            if (a.textDecorationInset() != b.textDecorationInset() && (a.textDecorationInset().hasPercentage() || b.textDecorationInset().hasPercentage()))
+                return true;
+
             if (inkOverflowForDecorations(a) != inkOverflowForDecorations(b))
                 return true;
         }
diff --git a/Source/WebCore/style/StyleExtractor.cpp b/Source/WebCore/style/StyleExtractor.cpp
index 00ee384c44ee..2b945dc3c449 100644
--- a/Source/WebCore/style/StyleExtractor.cpp
+++ b/Source/WebCore/style/StyleExtractor.cpp
@@ -114,7 +114,7 @@ RefPtr<CSSValue> Extractor::getFontSizeCSSValuePreferringKeyword() const
     if (auto sizeIdentifier = style->fontDescription().keywordSizeAsIdentifier())
         return CSSKeywordValue::create(sizeIdentifier);
 
-    return CSSPrimitiveValue::create(adjustFloatForAbsoluteZoom(style->fontDescription().computedSize(), *style), CSSUnitType::Px);
+    return CSSPrimitiveValue::create(unapplyingZoom<float>(style->fontDescription().computedSize(), *style), CSSUnitType::Px);
 }
 
 bool Extractor::useFixedFontDefaultSize() const
diff --git a/Source/WebCore/style/StyleSubstitutionResolver.cpp b/Source/WebCore/style/StyleSubstitutionResolver.cpp
index 37682c5b6446..3b7a71400823 100644
--- a/Source/WebCore/style/StyleSubstitutionResolver.cpp
+++ b/Source/WebCore/style/StyleSubstitutionResolver.cpp
@@ -71,6 +71,8 @@
 #include "StyleResolver.h"
 #include "StyleScope.h"
 #include <wtf/IndexedRange.h>
+#include <wtf/Scope.h>
+#include <wtf/SetForScope.h>
 
 namespace WebCore {
 namespace Style {
@@ -108,29 +110,11 @@ static CSSParserTokenRange unwrapArgumentBraces(CSSParserTokenRange argument)
     return range.atEnd() ? contents : argument;
 }
 
-static Ref<CSSVariableData> createFirstValidVariableData(std::span<const std::span<const CSSParserToken>> candidates, const CSSParserContext& context)
-{
-    // Uses the internal -internal-first-valid name rather than the public first-valid(). The public
-    // function must validate against any property's grammar, which is not implemented yet. See the
-    // FIXME on substituteFirstValid().
-    Vector<CSSParserToken> tokens;
-    tokens.append(CSSParserToken(FunctionToken, "-internal-first-valid"_s, CSSParserToken::BlockStart));
-    bool isFirst = true;
-    for (auto& candidate : candidates) {
-        if (!isFirst)
-            tokens.append(CSSParserToken(CommaToken));
-        isFirst = false;
-        tokens.append(candidate);
-    }
-    tokens.append(CSSParserToken(RightParenthesisToken, CSSParserToken::BlockEnd));
-    return CSSVariableData::create(CSSParserTokenRange { tokens }, context);
-}
-
 void SubstitutionResolver::propagateAttrTaint(IsAttrTainted isAttrTainted, std::span<const CSSParserToken> tokens)
 {
     if (isAttrTainted != IsAttrTainted::Yes)
         return;
-    m_isAttrTainted = true;
+    m_isAttrTainted = IsAttrTainted::Yes;
     if (isInURLContext() || containsURLTokens(tokens))
         m_hasTaintedURL = true;
 }
@@ -146,6 +130,14 @@ RefPtr<const CustomProperty> SubstitutionResolver::propertyValueForVariableName(
     if (functionId == CSSValueEnv)
         return m_styleBuilder.state().document().styleScope().environmentVariables().values().get(variableName);
 
+    // Every parameter of the function whose arguments are being resolved shadows the calling element's
+    // custom property of the same name, resolved or not, so a default can reference an earlier
+    // parameter but never sees the calling element's value of a later one.
+    if (!m_parameterValues.isEmpty() && functionId == CSSValueVar) {
+        if (auto parameter = m_parameterValues.last().getOptional(variableName))
+            return *parameter;
+    }
+
     // Apply this variable first, in case it is still unresolved
     m_styleBuilder.applyCustomProperty(variableName);
 
@@ -189,10 +181,11 @@ auto SubstitutionResolver::substituteVarArgumentGrammar(CSSParserTokenRange rang
     // https://drafts.csswg.org/css-values-5/#attr-security
     // Isolate the flag to see whether resolving the name itself involved attr()-tainted values. Diffing
     // it would miss the taint when something earlier in the same value had already set it.
-    auto wasAttrTainted = std::exchange(m_isAttrTainted, false);
+    auto wasAttrTainted = std::exchange(m_isAttrTainted, IsAttrTainted::No);
     auto substitutedName = substituteTokenRange(nameArgRange, context);
-    auto isNameAttrTainted = m_isAttrTainted ? IsAttrTainted::Yes : IsAttrTainted::No;
-    m_isAttrTainted |= wasAttrTainted;
+    auto isNameAttrTainted = m_isAttrTainted;
+    if (wasAttrTainted == IsAttrTainted::Yes)
+        m_isAttrTainted = IsAttrTainted::Yes;
 
     if (!substitutedName)
         return { { }, fallbackRange, isNameAttrTainted };
@@ -360,9 +353,10 @@ bool SubstitutionResolver::substituteInheritFunction(CSSParserTokenRange range,
 }
 
 // https://drafts.csswg.org/css-mixins/#evaluate-a-custom-function
-// Registers each parameter with its type, resolves argument styles, then updates registrations
-// to universal syntax with resolved values as initial values.
-// Returns resolved argument properties to prepend to the body rule, or nullptr on failure.
+// Computes each parameter from its argument, falling back to the default when there is no argument or
+// the argument does not match the parameter's type. Values are computed against the calling element.
+// Registers each parameter as universal with its computed value, and returns the properties to prepend
+// to the body rule, or nullptr on failure.
 RefPtr<MutableStyleProperties> SubstitutionResolver::resolveAndRegisterDashedFunctionArguments(const Vector<StyleRuleFunction::Parameter>& parameters, const Vector<Vector<CSSParserToken>>& arguments, LocalPropertyRegistry& registrations, ScopeOrdinal definitionScope)
 {
     // A parameter without a default requires a corresponding argument. A missing one makes the whole
@@ -372,82 +366,95 @@ RefPtr<MutableStyleProperties> SubstitutionResolver::resolveAndRegisterDashedFun
             return nullptr;
     }
 
-    // "For each function parameter, create a custom property registration with the parameter's type."
-    auto argumentRegistrations = LocalPropertyRegistry { };
-    for (auto& parameter : parameters) {
-        argumentRegistrations.add({
-            .name = AtomString { parameter.name },
-            .syntax = parameter.type,
-            .inherits = true,
-        });
-    }
+    auto& context = m_substitutionValue->context();
+
+    // A default may invoke another custom function, which resolves its own parameters, so these need a
+    // frame of their own rather than a single set.
+    m_parameterValues.append({ });
+    auto popParameterValues = makeScopeExit([&] {
+        m_parameterValues.removeLast();
+    });
+    // Seeded before any is resolved, so that a default referencing a parameter that is not resolved
+    // yet gets the guaranteed-invalid value instead of the calling element's property of that name.
+    for (auto& parameter : parameters)
+        m_parameterValues.last().set(parameter.name, nullptr);
+
+    SetForScope scopedLookupScope(m_dashedFunctionLookupScope, definitionScope);
+
+    auto resolvedArgumentProperties = MutableStyleProperties::create();
 
-    // "Let argument rule be an initially empty style rule" with first-valid(arg value, default value) for each parameter.
-    auto argumentRule = MutableStyleProperties::create();
     for (auto [i, parameter] : indexedRange(parameters)) {
         bool hasArgument = i < arguments.size() && !arguments[i].isEmpty();
 
-        // first-valid(arg value, default value). A parameter with neither is omitted from the rule,
-        // resolving to the guaranteed-invalid value via its (valueless) registration.
-        auto candidates = [&] {
-            Vector<std::span<const CSSParserToken>, 2> candidates;
-            if (hasArgument)
-                candidates.append(arguments[i].span());
-            if (parameter.defaultValue)
-                candidates.append(parameter.defaultValue->tokens().span());
-            return candidates;
-        }();
-        if (candidates.isEmpty())
-            continue;
+        // Computes a candidate against the parameter's type, or returns null if it does not match.
+        auto computeCandidate = [&](std::span<const CSSParserToken> candidateTokens) -> RefPtr<const CustomProperty> {
+            if (candidateTokens.empty())
+                return nullptr;
 
-        // A bare CSS-wide keyword (e.g. a parameter defaulting to `inherit`) keeps its keyword semantics
-        // rather than becoming a literal value. https://drafts.csswg.org/css-mixins/#evaluating-custom-functions
-        auto primaryTokens = CSSParserTokenRange { candidates.first() };
-        primaryTokens.consumeWhitespace();
-        if (auto keyword = CSSPropertyParserHelpers::consumeCSSWideKeyword(primaryTokens); keyword && primaryTokens.atEnd()) {
-            argumentRule->addParsedProperty({ CSSPropertyCustom, CSSCustomPropertyValue::createWithCSSWideKeyword(parameter.name, *keyword) });
-            continue;
-        }
+            auto data = CSSVariableData::create(CSSParserTokenRange { candidateTokens }, m_isAttrTainted, context);
 
-        // Fast path: an untyped parameter with an argument needs no first-valid(). The argument is
-        // already substituted and, being non-empty, is always valid for the universal syntax, so it
-        // wins outright and the default is irrelevant.
-        if (hasArgument && parameter.type.isUniversal()) {
-            auto value = CSSCustomPropertyValue::createSyntaxAll(parameter.name, CSSVariableData::create(arguments[i], m_substitutionValue->context()));
-            argumentRule->addParsedProperty({ CSSPropertyCustom, WTF::move(value) });
-            continue;
-        }
+            if (parameter.type.isUniversal())
+                return CustomProperty::createForVariableData(parameter.name, WTF::move(data));
 
-        auto firstValidData = createFirstValidVariableData(candidates.span(), m_substitutionValue->context());
-        auto value = CSSCustomPropertyValue::createUnresolved(parameter.name, CSSSubstitutionValue::create(WTF::move(firstValidData)));
-        argumentRule->addParsedProperty({ CSSPropertyCustom, WTF::move(value) });
-    }
+            // https://drafts.csswg.org/css-values-5/#first-valid
+            if (!CSSPropertyParser::isValidCustomPropertyValueForSyntax(parameter.type, data->tokenRange(), context))
+                return nullptr;
 
-    // "Resolve function styles using custom function, argument rule, registrations, and calling context."
-    // The hypothetical element acts as a child of the calling element, inheriting its computed custom
-    // properties on demand, so defaults like `var(--caller-prop)` or `inherit` resolve against it.
-    auto argumentMatchResult = MatchResult::create();
-    argumentMatchResult->authorDeclarations.append({ .properties = WTF::move(argumentRule), .styleScopeOrdinal = definitionScope });
+            auto computed = m_styleBuilder.computeCustomPropertyValueForSyntax(parameter.name, parameter.type, data);
+            if (!computed)
+                return nullptr;
 
-    auto builderContext = BuilderContext {
-        .document = m_styleBuilder.state().document(),
-        .parentStyle = &m_styleBuilder.state().style(),
-        .element = m_styleBuilder.state().element(),
-        .localPropertyRegistry = &argumentRegistrations,
-        .callingContextBuilder = &m_styleBuilder
-    };
+            return WTF::switchOn(*computed,
+                [](const Ref<const CustomProperty>& property) -> RefPtr<const CustomProperty> {
+                    return property.ptr();
+                },
+                // A declared type cannot be a CSS-wide keyword.
+                [](CSSWideKeyword) -> RefPtr<const CustomProperty> {
+                    return nullptr;
+                });
+        };
 
-    auto argumentStyles = Style::ComputedStyle::createPtr();
-    Builder argumentBuilder(*argumentStyles, WTF::move(builderContext), argumentMatchResult);
-    argumentBuilder.state().addGuardedFunctionContexts(m_styleBuilder.state());
-    for (auto& parameter : parameters)
-        argumentBuilder.applyCustomProperty(parameter.name);
+        auto resolvedValue = [&] -> RefPtr<const CustomProperty> {
+            // A bare CSS-wide keyword keeps its keyword semantics rather than becoming a literal value.
+            // https://drafts.csswg.org/css-mixins/#evaluating-custom-functions
+            // An argument that failed to substitute is empty, and may have no default to fall back to.
+            auto primaryTokens = [&] -> CSSParserTokenRange {
+                if (hasArgument)
+                    return CSSParserTokenRange { arguments[i].span() };
+                if (parameter.defaultValue)
+                    return parameter.defaultValue->tokenRange();
+                return { };
+            }();
+            primaryTokens.consumeWhitespace();
+            if (auto keyword = CSSPropertyParserHelpers::consumeCSSWideKeyword(primaryTokens); keyword && primaryTokens.atEnd()) {
+                // `initial` is the parameter's registered initial value, which does not exist yet at this
+                // point, and any keyword other than `inherit` is guaranteed-invalid.
+                if (*keyword != CSSWideKeyword::Inherit)
+                    return nullptr;
+                // `inherit` resolves like inherit() with the parameter name, reinterpreted with the
+                // parameter's type.
+                RefPtr inherited = propertyValueForVariableName(parameter.name, CSSValueInherit);
+                if (!inherited || inherited->isGuaranteedInvalid())
+                    return nullptr;
+                return computeCandidate(inherited->tokens());
+            }
+
+            // first-valid(arg value, default value): the default is used when there is no argument, or
+            // when the argument does not match the parameter's type.
+            // The argument is already substituted; a default is not.
+            if (hasArgument) {
+                if (RefPtr value = computeCandidate(arguments[i].span()))
+                    return value;
+            }
+            if (parameter.defaultValue) {
+                if (auto substituted = substituteTokenRange(parameter.defaultValue->tokenRange(), context))
+                    return computeCandidate(substituted->span());
+            }
+            return nullptr;
+        }();
+
+        m_parameterValues.last().set(parameter.name, resolvedValue);
 
-    // "Set its initial value to the corresponding value in argument styles, set its syntax to the universal syntax definition,
-    // and prepend a custom property to body rule with the property name and value in argument styles."
-    auto resolvedArgumentProperties = MutableStyleProperties::create();
-    for (auto& parameter : parameters) {
-        RefPtr resolvedValue = argumentStyles->customPropertyValue(parameter.name);
         registrations.add({
             .name = AtomString { parameter.name },
             .syntax = CSSCustomPropertySyntax::universal(),
@@ -456,7 +463,7 @@ RefPtr<MutableStyleProperties> SubstitutionResolver::resolveAndRegisterDashedFun
         });
 
         if (resolvedValue && !resolvedValue->isGuaranteedInvalid()) {
-            auto tokenData = CSSVariableData::create(CSSParserTokenRange { resolvedValue->tokens() }, resolvedValue->isAttrTainted(), m_substitutionValue->context());
+            auto tokenData = CSSVariableData::create(CSSParserTokenRange { resolvedValue->tokens() }, resolvedValue->isAttrTainted(), context);
             auto value = CSSCustomPropertyValue::createSyntaxAll(parameter.name, WTF::move(tokenData));
             resolvedArgumentProperties->addParsedProperty({ CSSPropertyCustom, WTF::move(value) });
         }
@@ -472,7 +479,10 @@ bool SubstitutionResolver::substituteDashedFunction(StringView functionName, CSS
     if (!m_styleBuilder.state().element())
         return false;
 
-    auto scopedFunctionName = ScopedName { functionName.toAtomString(), m_styleBuilder.state().styleScopeOrdinal() };
+    // A <dashed-function> in a parameter default resolves in the scope the enclosing function was
+    // defined in, not the calling element's scope.
+    auto scopeOrdinal = m_dashedFunctionLookupScope.value_or(m_styleBuilder.state().styleScopeOrdinal());
+    auto scopedFunctionName = ScopedName { functionName.toAtomString(), scopeOrdinal };
 
     CheckedPtr element = m_styleBuilder.state().element();
     auto resolved = resolveTreeScopedReference(*element, scopedFunctionName, [](const Scope& scope, const ScopedName& scopedName) -> std::optional<std::pair<CheckedRef<const CustomFunction>, ScopeOrdinal>> {
@@ -603,6 +613,9 @@ bool SubstitutionResolver::substituteDashedFunction(StringView functionName, CSS
     };
 
     auto bodyStyles = Style::ComputedStyle::createPtr();
+    // Font-relative units in the body resolve against the hypothetical element's own font, so it has to
+    // inherit one. Custom properties are resolved lazily through the calling context's builder instead.
+    bodyStyles->inheritIgnoringCustomPropertiesFrom(protect(m_styleBuilder.state().style()));
     Builder bodyBuilder(*bodyStyles, WTF::move(builderContext), bodyMatchResult);
     bodyBuilder.state().addGuardedFunctionContexts(m_styleBuilder.state());
 
@@ -1314,7 +1327,7 @@ bool SubstitutionResolver::isBaseAppearance()
 
 RefPtr<CSSVariableData> SubstitutionResolver::substitute(const CSSSubstitutionValue& value)
 {
-    m_isAttrTainted = false;
+    m_isAttrTainted = IsAttrTainted::No;
     m_hasTaintedURL = false;
     m_randomItemAutoIndex = 0;
     m_substitutionValue = &value;
@@ -1332,7 +1345,7 @@ RefPtr<CSSVariableData> SubstitutionResolver::substitute(const CSSSubstitutionVa
         return nullptr;
     }
 
-    auto data = CSSVariableData::create(*substitutedTokens, m_isAttrTainted ? IsAttrTainted::Yes : IsAttrTainted::No, context);
+    auto data = CSSVariableData::create(*substitutedTokens, m_isAttrTainted, context);
     m_intermediateTokenStrings.clear();
     m_intermediateCustomProperties.clear();
     return data;
diff --git a/Source/WebCore/style/StyleSubstitutionResolver.h b/Source/WebCore/style/StyleSubstitutionResolver.h
index 4ae2435f2c71..611e03296c4e 100644
--- a/Source/WebCore/style/StyleSubstitutionResolver.h
+++ b/Source/WebCore/style/StyleSubstitutionResolver.h
@@ -116,11 +116,20 @@ class SubstitutionResolver {
     Builder& m_styleBuilder;
     const CSSRegisteredCustomProperty* m_registration { nullptr };
     RefPtr<const CSSSubstitutionValue> m_substitutionValue;
+    // The scope to look up a <dashed-function> name in, while resolving the parameter defaults of a
+    // custom function: names there refer to the scope the function was defined in, not the calling
+    // element's.
+    std::optional<ScopeOrdinal> m_dashedFunctionLookupScope;
+    // Parameters of the custom functions whose arguments are currently being resolved, innermost last.
+    // A parameter appears once resolved, so a default can reference an earlier one. A null value is the
+    // guaranteed-invalid value. Present names shadow the calling element's custom properties.
+    using ParameterValues = HashMap<AtomString, RefPtr<const CustomProperty>>;
+    Vector<ParameterValues> m_parameterValues;
     Vector<WTF::String> m_intermediateTokenStrings;
     Vector<RefPtr<const CustomProperty>> m_intermediateCustomProperties;
     unsigned m_urlContextDepth { 0 };
     unsigned m_randomItemAutoIndex { 0 };
-    bool m_isAttrTainted { false };
+    IsAttrTainted m_isAttrTainted { IsAttrTainted::No };
     bool m_hasTaintedURL { false };
 };
 
diff --git a/Source/WebCore/style/Styleable.cpp b/Source/WebCore/style/Styleable.cpp
index 5d414c2c2fa4..3438baf7bdba 100644
--- a/Source/WebCore/style/Styleable.cpp
+++ b/Source/WebCore/style/Styleable.cpp
@@ -874,9 +874,9 @@ void Styleable::updateCSSScrollTimelines(const Style::ComputedStyle* currentStyl
             [](CSS::Keyword::None) {
                 // Nothing to register.
             },
-            [&](const Style::CustomIdent& identifier) {
-                styleOriginatedTimelinesController->registerNamedScrollTimeline(identifier.value, *this, scrollTimeline.axis());
-                registeredScrollTimelineNames.add(identifier.value);
+            [&](const Style::ScopedName& scopedName) {
+                styleOriginatedTimelinesController->registerNamedScrollTimeline(scopedName, *this, scrollTimeline.axis());
+                registeredScrollTimelineNames.add(scopedName.name);
             }
         );
     }
@@ -889,9 +889,9 @@ void Styleable::updateCSSScrollTimelines(const Style::ComputedStyle* currentStyl
             [](CSS::Keyword::None) {
                 // Nothing to unregister.
             },
-            [&](const Style::CustomIdent& identifier) {
-                if (!registeredScrollTimelineNames.contains(identifier.value))
-                    styleOriginatedTimelinesController->unregisterNamedTimeline(identifier.value, *this);
+            [&](const Style::ScopedName& scopedName) {
+                if (!registeredScrollTimelineNames.contains(scopedName.name))
+                    styleOriginatedTimelinesController->unregisterNamedTimeline(scopedName.name, *this);
             }
         );
     }
@@ -911,9 +911,9 @@ void Styleable::updateCSSViewTimelines(const Style::ComputedStyle* currentStyle,
             [](CSS::Keyword::None) {
                 // Nothing to register.
             },
-            [&](const Style::CustomIdent& identifier) {
-                styleOriginatedTimelinesController->registerNamedViewTimeline(identifier.value, *this, viewTimeline.axis(), viewTimeline.inset(), afterChangeStyle.usedZoomForLength());
-                registeredViewTimelineNames.add(identifier.value);
+            [&](const Style::ScopedName& scopedName) {
+                styleOriginatedTimelinesController->registerNamedViewTimeline(scopedName, *this, viewTimeline.axis(), viewTimeline.inset(), afterChangeStyle.usedZoomForLength());
+                registeredViewTimelineNames.add(scopedName.name);
             }
         );
     }
@@ -926,9 +926,9 @@ void Styleable::updateCSSViewTimelines(const Style::ComputedStyle* currentStyle,
             [](CSS::Keyword::None) {
                 // Nothing to unregister.
             },
-            [&](const Style::CustomIdent& identifier) {
-                if (!registeredViewTimelineNames.contains(identifier.value))
-                    styleOriginatedTimelinesController->unregisterNamedTimeline(identifier.value, *this);
+            [&](const Style::ScopedName& scopedName) {
+                if (!registeredViewTimelineNames.contains(scopedName.name))
+                    styleOriginatedTimelinesController->unregisterNamedTimeline(scopedName.name, *this);
             }
         );
     }
diff --git a/Source/WebCore/style/computed/StyleComputedStyleBase.h b/Source/WebCore/style/computed/StyleComputedStyleBase.h
index 2a0ff98d224e..e5d33bf577f1 100644
--- a/Source/WebCore/style/computed/StyleComputedStyleBase.h
+++ b/Source/WebCore/style/computed/StyleComputedStyleBase.h
@@ -166,7 +166,6 @@ enum class TextDecorationSkipInk : uint8_t;
 enum class TextDecorationStyle : uint8_t;
 enum class TextGroupAlign : uint8_t;
 enum class TextJustify : uint8_t;
-enum class TextOverflow : bool;
 enum class TextRenderingMode : uint8_t;
 enum class TextSecurity : uint8_t;
 enum class TextTransform : uint8_t;
@@ -364,6 +363,7 @@ struct TextDecorationThickness;
 struct TextEmphasisPosition;
 struct TextEmphasisStyle;
 struct TextIndent;
+struct TextOverflow;
 struct TextShadow;
 struct TextSizeAdjust;
 struct TextSpacingTrim;
diff --git a/Source/WebCore/style/computed/data/StyleNonInheritedMiscData.cpp b/Source/WebCore/style/computed/data/StyleNonInheritedMiscData.cpp
index dcfb32dd42f7..5b2a8f228e87 100644
--- a/Source/WebCore/style/computed/data/StyleNonInheritedMiscData.cpp
+++ b/Source/WebCore/style/computed/data/StyleNonInheritedMiscData.cpp
@@ -60,11 +60,11 @@ NonInheritedMiscData::NonInheritedMiscData()
     , objectPosition(ComputedStyle::initialObjectPosition())
     , objectViewBox(ComputedStyle::initialObjectViewBox())
     , order(ComputedStyle::initialOrder())
+    , textOverflow(ComputedStyle::initialTextOverflow())
     , tableLayout(static_cast<unsigned>(ComputedStyle::initialTableLayout()))
     , appearance(static_cast<unsigned>(ComputedStyle::initialAppearance()))
     , usedAppearance(static_cast<unsigned>(ComputedStyle::initialAppearance()))
     , userSelect(static_cast<unsigned>(ComputedStyle::initialUserSelect()))
-    , textOverflow(static_cast<unsigned>(ComputedStyle::initialTextOverflow()))
     , userDrag(static_cast<unsigned>(ComputedStyle::initialUserDrag()))
     , objectFit(static_cast<unsigned>(ComputedStyle::initialObjectFit()))
     , resize(static_cast<unsigned>(ComputedStyle::initialResize()))
@@ -95,6 +95,7 @@ NonInheritedMiscData::NonInheritedMiscData(const NonInheritedMiscData& o)
     , objectPosition(o.objectPosition)
     , objectViewBox(o.objectViewBox)
     , order(o.order)
+    , textOverflow(o.textOverflow)
     , hasAttrContent(o.hasAttrContent)
     , hasDisplayAffectedByAnimations(o.hasDisplayAffectedByAnimations)
 #if ENABLE(DARK_MODE_CSS)
@@ -108,7 +109,6 @@ NonInheritedMiscData::NonInheritedMiscData(const NonInheritedMiscData& o)
     , appearance(o.appearance)
     , usedAppearance(o.usedAppearance)
     , userSelect(o.userSelect)
-    , textOverflow(o.textOverflow)
     , userDrag(o.userDrag)
     , objectFit(o.objectFit)
     , resize(o.resize)
@@ -146,6 +146,7 @@ bool NonInheritedMiscData::operator==(const NonInheritedMiscData& o) const
         && objectPosition == o.objectPosition
         && objectViewBox == o.objectViewBox
         && order == o.order
+        && textOverflow == o.textOverflow
         && hasAttrContent == o.hasAttrContent
         && hasDisplayAffectedByAnimations == o.hasDisplayAffectedByAnimations
 #if ENABLE(DARK_MODE_CSS)
@@ -159,7 +160,6 @@ bool NonInheritedMiscData::operator==(const NonInheritedMiscData& o) const
         && appearance == o.appearance
         && usedAppearance == o.usedAppearance
         && userSelect == o.userSelect
-        && textOverflow == o.textOverflow
         && userDrag == o.userDrag
         && objectFit == o.objectFit
         && resize == o.resize;
@@ -202,6 +202,7 @@ void NonInheritedMiscData::dumpDifferences(TextStream& ts, const NonInheritedMis
     LOG_IF_DIFFERENT(objectPosition);
     LOG_IF_DIFFERENT(objectViewBox);
     LOG_IF_DIFFERENT(order);
+    LOG_IF_DIFFERENT(textOverflow);
 
     LOG_IF_DIFFERENT_WITH_CAST(bool, hasAttrContent);
     LOG_IF_DIFFERENT_WITH_CAST(bool, hasDisplayAffectedByAnimations);
@@ -220,9 +221,6 @@ void NonInheritedMiscData::dumpDifferences(TextStream& ts, const NonInheritedMis
     LOG_IF_DIFFERENT_WITH_CAST(StyleAppearance, usedAppearance);
 
     LOG_IF_DIFFERENT_WITH_CAST(UserSelect, userSelect);
-
-    LOG_IF_DIFFERENT_WITH_CAST(bool, textOverflow);
-
     LOG_IF_DIFFERENT_WITH_CAST(UserDrag, userDrag);
     LOG_IF_DIFFERENT_WITH_CAST(ObjectFit, objectFit);
     LOG_IF_DIFFERENT_WITH_CAST(Resize, resize);
diff --git a/Source/WebCore/style/computed/data/StyleNonInheritedMiscData.h b/Source/WebCore/style/computed/data/StyleNonInheritedMiscData.h
index 7907e79d1e53..a66c0dbc915d 100644
--- a/Source/WebCore/style/computed/data/StyleNonInheritedMiscData.h
+++ b/Source/WebCore/style/computed/data/StyleNonInheritedMiscData.h
@@ -43,6 +43,7 @@
 #include <WebCore/StyleOpacity.h>
 #include <WebCore/StyleOrder.h>
 #include <WebCore/StyleResize.h>
+#include <WebCore/StyleTextOverflow.h>
 #include <WebCore/StyleTransitions.h>
 #include <wtf/DataRef.h>
 #include <wtf/Ref.h>
@@ -101,6 +102,7 @@ class NonInheritedMiscData : public RefCounted<NonInheritedMiscData> {
     ObjectPosition objectPosition;
     ObjectViewBox objectViewBox;
     Order order;
+    TextOverflow textOverflow;
 
     PREFERRED_TYPE(bool) unsigned hasAttrContent : 1 { false };
     PREFERRED_TYPE(bool) unsigned hasDisplayAffectedByAnimations : 1 { false };
@@ -115,7 +117,6 @@ class NonInheritedMiscData : public RefCounted<NonInheritedMiscData> {
     PREFERRED_TYPE(StyleAppearance) unsigned appearance : appearanceBitWidth;
     PREFERRED_TYPE(StyleAppearance) unsigned usedAppearance : appearanceBitWidth;
     PREFERRED_TYPE(UserSelect) unsigned userSelect : 2;
-    PREFERRED_TYPE(bool) unsigned textOverflow : 1; // Whether or not lines that spill out should be truncated with "..."
     PREFERRED_TYPE(UserDrag) unsigned userDrag : 2;
     PREFERRED_TYPE(ObjectFit) unsigned objectFit : 3;
     PREFERRED_TYPE(Resize) unsigned resize : 3;
diff --git a/Source/WebCore/style/values/animations/StyleSingleAnimationTimeline.cpp b/Source/WebCore/style/values/animations/StyleSingleAnimationTimeline.cpp
index cd9728ed64d5..8eb540c43f76 100644
--- a/Source/WebCore/style/values/animations/StyleSingleAnimationTimeline.cpp
+++ b/Source/WebCore/style/values/animations/StyleSingleAnimationTimeline.cpp
@@ -59,7 +59,7 @@ auto CSSValueConversion<SingleAnimationTimeline>::operator()(BuilderState& state
     if (RefPtr viewValue = dynamicDowncast<CSSViewValue>(value))
         return toStyleFromCSSValue<ViewFunction>(state, *viewValue);
 
-    return toStyleFromCSSValue<CustomIdent>(state, value);
+    return toStyleFromCSSValue<ScopedName>(state, value);
 }
 
 } // namespace Style
diff --git a/Source/WebCore/style/values/animations/StyleSingleAnimationTimeline.h b/Source/WebCore/style/values/animations/StyleSingleAnimationTimeline.h
index 4eaf3be9d4b1..7b9f53465f33 100644
--- a/Source/WebCore/style/values/animations/StyleSingleAnimationTimeline.h
+++ b/Source/WebCore/style/values/animations/StyleSingleAnimationTimeline.h
@@ -24,7 +24,7 @@
 
 #pragma once
 
-#include <WebCore/StyleCustomIdent.h>
+#include <WebCore/ScopedName.h>
 #include <WebCore/StyleScrollFunction.h>
 #include <WebCore/StyleValueTypes.h>
 #include <WebCore/StyleViewFunction.h>
@@ -45,8 +45,8 @@ struct SingleAnimationTimeline {
     {
     }
 
-    SingleAnimationTimeline(CustomIdent&& identifier)
-        : m_value { identifier }
+    SingleAnimationTimeline(ScopedName&& name)
+        : m_value { name }
     {
     }
 
@@ -62,8 +62,8 @@ struct SingleAnimationTimeline {
 
     bool isAuto() const { return std::holds_alternative<CSS::Keyword::Auto>(m_value); }
     bool isNone() const { return std::holds_alternative<CSS::Keyword::None>(m_value); }
-    bool isCustomIdent() const { return std::holds_alternative<CustomIdent>(m_value); }
-    std::optional<CustomIdent> tryCustomIdent() const { return isCustomIdent() ? std::make_optional(std::get<CustomIdent>(m_value)) : std::nullopt; }
+    bool isScopedName() const { return std::holds_alternative<ScopedName>(m_value); }
+    std::optional<ScopedName> tryScopedName() const { return isScopedName() ? std::make_optional(std::get<ScopedName>(m_value)) : std::nullopt; }
     bool isScrollFunction() const { return std::holds_alternative<ScrollFunction>(m_value); }
     std::optional<ScrollFunction> tryScrollFunction() const { return isScrollFunction() ? std::make_optional(std::get<ScrollFunction>(m_value)) : std::nullopt; }
     bool isViewFunction() const { return std::holds_alternative<ViewFunction>(m_value); }
@@ -77,7 +77,7 @@ struct SingleAnimationTimeline {
     bool operator==(const SingleAnimationTimeline&) const = default;
 
 private:
-    Variant<CSS::Keyword::Auto, CSS::Keyword::None, CustomIdent, ScrollFunction, ViewFunction> m_value;
+    Variant<CSS::Keyword::Auto, CSS::Keyword::None, ScopedName, ScrollFunction, ViewFunction> m_value;
 };
 
 // MARK: - Conversion
diff --git a/Source/WebCore/style/values/overflow/StyleTextOverflow.cpp b/Source/WebCore/style/values/overflow/StyleTextOverflow.cpp
new file mode 100644
index 000000000000..9a9a9d545a96
--- /dev/null
+++ b/Source/WebCore/style/values/overflow/StyleTextOverflow.cpp
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2026 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "StyleTextOverflow.h"
+
+#include "CSSKeywordValue.h"
+#include "StyleBuilderChecking.h"
+
+namespace WebCore {
+namespace Style {
+
+// MARK: - Conversion
+
+auto CSSValueConversion<TextOverflow>::operator()(BuilderState& state, const CSSValue& value) -> TextOverflow
+{
+    if (auto* keywordValue = dynamicDowncast<CSSKeywordValue>(value)) {
+        switch (keywordValue->valueID()) {
+        case CSSValueClip:
+            return CSS::Keyword::Clip { };
+        case CSSValueEllipsis:
+            return CSS::Keyword::Ellipsis { };
+        default:
+            state.setCurrentPropertyInvalidAtComputedValueTime();
+            return CSS::Keyword::Clip { };
+        }
+    }
+
+    return toStyleFromCSSValue<String>(state, value);
+}
+
+} // namespace Style
+} // namespace WebCore
diff --git a/Source/WebCore/style/values/overflow/StyleTextOverflow.h b/Source/WebCore/style/values/overflow/StyleTextOverflow.h
new file mode 100644
index 000000000000..f7fc9376c7b0
--- /dev/null
+++ b/Source/WebCore/style/values/overflow/StyleTextOverflow.h
@@ -0,0 +1,90 @@
+/*
+ * Copyright (C) 2026 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include <WebCore/StyleString.h>
+#include <WebCore/StyleValueTypes.h>
+#include <wtf/text/AtomString.h>
+
+namespace WebCore {
+namespace Style {
+
+// <'text-overflow'> = clip | ellipsis | <string>
+// https://drafts.csswg.org/css-overflow-3/#propdef-text-overflow
+struct TextOverflow {
+    TextOverflow(CSS::Keyword::Clip)
+    {
+    }
+
+    TextOverflow(CSS::Keyword::Ellipsis)
+        : m_type { Type::Ellipsis }
+    {
+    }
+
+    TextOverflow(String&& string)
+        : m_type { Type::String }
+        , m_string { WTF::move(string.value) }
+    {
+    }
+
+    bool isClip() const { return m_type == Type::Clip; }
+    bool isEllipsis() const { return m_type == Type::Ellipsis; }
+    bool isString() const { return m_type == Type::String; }
+
+    template<typename... F> decltype(auto) switchOn(F&&... f) const
+    {
+        auto visitor = WTF::makeVisitor(std::forward<F>(f)...);
+
+        switch (m_type) {
+        case Type::Clip:
+            return visitor(CSS::Keyword::Clip { });
+        case Type::Ellipsis:
+            return visitor(CSS::Keyword::Ellipsis { });
+        case Type::String:
+            return visitor(String { m_string });
+        }
+        RELEASE_ASSERT_NOT_REACHED();
+    }
+
+    bool operator==(const TextOverflow&) const = default;
+
+private:
+    enum class Type : uint8_t { Clip, Ellipsis, String };
+
+    Type m_type { Type::Clip };
+    AtomString m_string { nullAtom() };
+};
+
+// MARK: - Conversion
+
+template<> struct CSSValueConversion<TextOverflow> {
+    auto operator()(BuilderState&, const CSSValue&) -> TextOverflow;
+};
+
+} // namespace Style
+} // namespace WebCore
+
+DEFINE_VARIANT_LIKE_CONFORMANCE(WebCore::Style::TextOverflow)
diff --git a/Source/WebCore/style/values/primitives/StyleKeyword+Mappings.h b/Source/WebCore/style/values/primitives/StyleKeyword+Mappings.h
index cc699cfa51e4..bdb3ac131728 100644
--- a/Source/WebCore/style/values/primitives/StyleKeyword+Mappings.h
+++ b/Source/WebCore/style/values/primitives/StyleKeyword+Mappings.h
@@ -1438,12 +1438,6 @@ DEFINE_TO_FROM_CSS_VALUE_ID_FUNCTIONS
 #undef TYPE
 #undef FOR_EACH
 
-#define TYPE TextOverflow
-#define FOR_EACH(CASE) CASE(Clip) CASE(Ellipsis)
-DEFINE_TO_FROM_CSS_VALUE_ID_FUNCTIONS
-#undef TYPE
-#undef FOR_EACH
-
 constexpr CSSValueID toCSSValueID(TextWrapMode wrap)
 {
     switch (wrap) {
diff --git a/Source/WebCore/style/values/scroll-animations/StyleProgressTimelineName.h b/Source/WebCore/style/values/scroll-animations/StyleProgressTimelineName.h
index 9765852c063e..ab4ee3268013 100644
--- a/Source/WebCore/style/values/scroll-animations/StyleProgressTimelineName.h
+++ b/Source/WebCore/style/values/scroll-animations/StyleProgressTimelineName.h
@@ -24,7 +24,7 @@
 
 #pragma once
 
-#include <WebCore/StyleCustomIdent.h>
+#include <WebCore/ScopedName.h>
 #include <WebCore/StyleValueTypes.h>
 
 namespace WebCore {
@@ -32,7 +32,7 @@ namespace Style {
 
 // <single-progress-timeline-name> = none | <dashed-ident>
 // https://drafts.csswg.org/scroll-animations/#propdef-scroll-timeline-name
-struct ProgressTimelineName : ValueOrKeyword<CustomIdent, CSS::Keyword::None> {
+struct ProgressTimelineName : ValueOrKeyword<ScopedName, CSS::Keyword::None> {
     using Base::Base;
 
     bool isNone() const { return isKeyword(); }
diff --git a/Source/WebCore/style/values/text-decoration/StyleTextDecorationInset.cpp b/Source/WebCore/style/values/text-decoration/StyleTextDecorationInset.cpp
index 437c9b1d3e87..820a5b4b80fd 100644
--- a/Source/WebCore/style/values/text-decoration/StyleTextDecorationInset.cpp
+++ b/Source/WebCore/style/values/text-decoration/StyleTextDecorationInset.cpp
@@ -36,28 +36,57 @@ namespace Style {
 
 using namespace CSS::Literals;
 
-float TextDecorationInset::resolvedStart(const Style::ComputedStyle& style, float autoValue) const
+bool TextDecorationInset::hasPercentage() const
+{
+    auto pair = tryValue();
+    return pair && (pair->first().isPercentOrCalculated() || pair->second().isPercentOrCalculated());
+}
+
+bool TextDecorationInset::hasNegativePercentage() const
+{
+    auto pair = tryValue();
+    if (!pair)
+        return false;
+    auto isNegativePercentage = [](const auto& endpoint) {
+        return endpoint.isPercentOrCalculated() && endpoint.isPossiblyNegative();
+    };
+    return isNegativePercentage(pair->first()) || isNegativePercentage(pair->second());
+}
+
+float TextDecorationInset::resolvedStart(const Style::ComputedStyle& style, float autoValue, float percentageBasis) const
 {
     if (auto pair = tryValue())
-        return Style::evaluate<float>(pair->first(), style.usedZoomForLength());
+        return Style::evaluate<float>(pair->first(), percentageBasis, style.usedZoomForLength());
     return autoValue;
 }
 
-float TextDecorationInset::resolvedEnd(const Style::ComputedStyle& style, float autoValue) const
+float TextDecorationInset::resolvedEnd(const Style::ComputedStyle& style, float autoValue, float percentageBasis) const
 {
     if (auto pair = tryValue())
-        return Style::evaluate<float>(pair->second(), style.usedZoomForLength());
+        return Style::evaluate<float>(pair->second(), percentageBasis, style.usedZoomForLength());
     return autoValue;
 }
 
+float TextDecorationInset::outwardExtent(const Style::ComputedStyle& style, float percentageBasis) const
+{
+    auto pair = tryValue();
+    if (!pair)
+        return 0.f; // 'auto' only ever trims inward.
+
+    auto outwardExtent = [&](const auto& endpoint) {
+        return std::max(0.f, -Style::evaluate<float>(endpoint, percentageBasis, style.usedZoomForLength()));
+    };
+    return std::max(outwardExtent(pair->first()), outwardExtent(pair->second()));
+}
+
 // MARK: - Conversion
 
 auto CSSValueConversion<TextDecorationInsetPair>::operator()(BuilderState& state, const CSSValue& value) -> TextDecorationInsetPair
 {
-    using Length = Style::Length<>;
+    using LengthPercentage = Style::LengthPercentage<>;
 
     if (RefPtr primitiveValue = dynamicDowncast<CSSPrimitiveValue>(value)) {
-        auto length = toStyleFromCSSValue<Length>(state, *primitiveValue);
+        auto length = toStyleFromCSSValue<LengthPercentage>(state, *primitiveValue);
         return { length, length };
     }
 
@@ -66,8 +95,8 @@ auto CSSValueConversion<TextDecorationInsetPair>::operator()(BuilderState& state
         return { 0_css_px, 0_css_px };
 
     return {
-        toStyleFromCSSValue<Length>(state, pair->first),
-        toStyleFromCSSValue<Length>(state, pair->second),
+        toStyleFromCSSValue<LengthPercentage>(state, pair->first),
+        toStyleFromCSSValue<LengthPercentage>(state, pair->second),
     };
 }
 
diff --git a/Source/WebCore/style/values/text-decoration/StyleTextDecorationInset.h b/Source/WebCore/style/values/text-decoration/StyleTextDecorationInset.h
index 0c74244530a2..61eda6ec6596 100644
--- a/Source/WebCore/style/values/text-decoration/StyleTextDecorationInset.h
+++ b/Source/WebCore/style/values/text-decoration/StyleTextDecorationInset.h
@@ -29,25 +29,35 @@
 
 namespace WebCore {
 namespace Style {
-using TextDecorationInsetPair = MinimallySerializingSpaceSeparatedPair<Length<>>;
+using TextDecorationInsetPair = MinimallySerializingSpaceSeparatedPair<LengthPercentage<>>;
 }
 }
 
-// text-decoration-inset stores 'auto' or a length pair, so ValueOrKeyword needs a Markable
-// representation of the pair; the pair is empty exactly when its first length is empty.
+// text-decoration-inset stores 'auto' or a length-percentage pair, so ValueOrKeyword needs a Markable
+// representation of the pair; the pair is empty exactly when its first component holds the empty
+// <length> sentinel.
 namespace WTF {
 template<> struct MarkableTraits<WebCore::Style::TextDecorationInsetPair> {
     using Pair = WebCore::Style::TextDecorationInsetPair;
+    using LengthPercentage = WebCore::Style::LengthPercentage<>;
     using Length = WebCore::Style::Length<>;
-    static bool isEmptyValue(const Pair& value) { return MarkableTraits<Length>::isEmptyValue(value.first()); }
-    static Pair emptyValue() { return { MarkableTraits<Length>::emptyValue(), MarkableTraits<Length>::emptyValue() }; }
+
+    static bool isEmptyValue(const Pair& value)
+    {
+        auto length = value.first().tryDimension();
+        return length && MarkableTraits<Length>::isEmptyValue(*length);
+    }
+    static Pair emptyValue()
+    {
+        return { LengthPercentage { MarkableTraits<Length>::emptyValue() }, LengthPercentage { MarkableTraits<Length>::emptyValue() } };
+    }
 };
 }
 
 namespace WebCore {
 namespace Style {
 
-// <'text-decoration-inset'> = auto | <length>{1,2}
+// <'text-decoration-inset'> = auto | <length-percentage>{1,2}
 // The first value applies to the start endpoint, the second to the end endpoint of the line
 // decorations; a single value applies to both. Positive values move an endpoint inward (trimming
 // the decoration), negative values move it outward (extending it). 'auto' lets the UA choose an
@@ -58,16 +68,24 @@ struct TextDecorationInset : ValueOrKeyword<TextDecorationInsetPair, CSS::Keywor
     using Base::Base;
 
     TextDecorationInset(CSS::ValueLiteral<CSS::LengthUnit::Px> literal)
-        : Base(Value { Length<> { literal }, Length<> { literal } })
+        : Base(Value { LengthPercentage<> { literal }, LengthPercentage<> { literal } })
     {
     }
 
     bool isAuto() const { return isKeyword(); }
+    bool hasPercentage() const;
+    bool hasNegativePercentage() const;
 
     // Resolves the start/end inset to used CSS pixels. For 'auto', returns the UA-chosen autoValue
-    // supplied by the caller (which depends on the decorating box's font).
-    float resolvedStart(const Style::ComputedStyle&, float autoValue) const;
-    float resolvedEnd(const Style::ComputedStyle&, float autoValue) const;
+    // supplied by the caller (which depends on the decorating box's font). Percentages resolve
+    // against percentageBasis, the inline size of the decorating box (for box-decoration-break: slice)
+    // or of the individual box fragment (for clone).
+    float resolvedStart(const Style::ComputedStyle&, float autoValue, float percentageBasis) const;
+    float resolvedEnd(const Style::ComputedStyle&, float autoValue, float percentageBasis) const;
+
+    // How far a negative (extending) inset pushes the decoration past the text box, i.e. the outward
+    // overhang that has to be included in ink overflow. Returns 0 for 'auto' and for insets that only trim inward.
+    float outwardExtent(const Style::ComputedStyle&, float percentageBasis) const;
 };
 
 // MARK: - Conversion
diff --git a/Source/WebCore/style/values/viewport/StyleZoomPrimitives.h b/Source/WebCore/style/values/viewport/StyleZoomPrimitives.h
index 8c880819d344..45d3ebf46715 100644
--- a/Source/WebCore/style/values/viewport/StyleZoomPrimitives.h
+++ b/Source/WebCore/style/values/viewport/StyleZoomPrimitives.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2025 Samuel Weinig <sam@webkit.org>
+ * Copyright (C) 2025-2026 Samuel Weinig <sam@webkit.org>
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,8 +26,6 @@
 
 namespace WebCore {
 
-class LayoutSize;
-class LayoutUnit;
 class RenderElement;
 
 namespace Style {
@@ -45,18 +43,19 @@ struct ZoomFactor {
     constexpr bool operator==(const ZoomFactor&) const = default;
 };
 
-// Map from values with zoom applied to web-exposed values, which are zoom-independent.
-inline int adjustForAbsoluteZoom(int, const ComputedStyle&);
-inline int adjustForAbsoluteZoom(int, const RenderElement&);
-inline float adjustFloatForAbsoluteZoom(float, const ComputedStyle&);
-inline float adjustFloatForAbsoluteZoom(float, const RenderElement&);
-inline LayoutUnit adjustLayoutUnitForAbsoluteZoom(LayoutUnit, const ComputedStyle&);
-inline LayoutUnit adjustLayoutUnitForAbsoluteZoom(LayoutUnit, const RenderElement&);
-inline LayoutSize adjustLayoutSizeForAbsoluteZoom(LayoutSize, const ComputedStyle&);
-inline LayoutSize adjustLayoutSizeForAbsoluteZoom(LayoutSize, const RenderElement&);
-
-// Map from zoom-independent style values to with zoom applied.
-inline float applyZoom(float, const ComputedStyle&);
+// Map from values with zoom applied to values which are zoom-independent.
+template<typename T>
+T unapplyingZoom(T, const ComputedStyle&);
+
+template<typename T>
+T unapplyingZoom(T, const RenderElement&);
+
+// Map from values which are zoom-independent to values with zoom applied.
+template<typename T>
+T applyingZoom(T, const ComputedStyle&);
+
+template<typename T>
+T applyingZoom(T, const RenderElement&);
 
 } // namespace Style
 } // namespace WebCore
diff --git a/Source/WebCore/style/values/viewport/StyleZoomPrimitivesInlines.h b/Source/WebCore/style/values/viewport/StyleZoomPrimitivesInlines.h
index cec81821c726..2e72be380e90 100644
--- a/Source/WebCore/style/values/viewport/StyleZoomPrimitivesInlines.h
+++ b/Source/WebCore/style/values/viewport/StyleZoomPrimitivesInlines.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2025 Samuel Weinig <sam@webkit.org>
+ * Copyright (C) 2025-2026 Samuel Weinig <sam@webkit.org>
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -29,65 +29,50 @@
 #include "StyleComputedStyle+GettersInlines.h"
 #include "StylePrimitiveNumericTypes+Rounding.h"
 #include "StyleZoomPrimitives.h"
+#include <concepts>
 
 namespace WebCore {
 namespace Style {
 
-inline int adjustForAbsoluteZoom(int value, const ComputedStyle& style)
+template<typename T>
+T unapplyingZoom(T value, const ComputedStyle& style)
 {
-    double zoomFactor = style.usedZoom();
-    if (zoomFactor == 1)
-        return value;
-    // Needed because resolveAsLength<int> truncates (rather than rounds) when scaling up.
-    if (zoomFactor > 1) {
-        if (value < 0)
-            value--;
-        else
-            value++;
-    }
-
-    return roundForImpreciseConversion<int>(value / zoomFactor);
-}
-
-inline int adjustForAbsoluteZoom(int value, const RenderElement& renderer)
-{
-    return adjustForAbsoluteZoom(value, renderer.style());
-}
-
-inline float adjustFloatForAbsoluteZoom(float value, const ComputedStyle& style)
-{
-    return value / style.usedZoom();
-}
-
-inline float adjustFloatForAbsoluteZoom(float value, const RenderElement& renderer)
-{
-    return adjustFloatForAbsoluteZoom(value, renderer.style());
-}
-
-inline LayoutUnit adjustLayoutUnitForAbsoluteZoom(LayoutUnit value, const ComputedStyle& style)
-{
-    return LayoutUnit(value / style.usedZoom());
-}
+    auto zoom = style.usedZoom();
 
-inline LayoutUnit adjustLayoutUnitForAbsoluteZoom(LayoutUnit value, const RenderElement& renderer)
-{
-    return adjustLayoutUnitForAbsoluteZoom(value, renderer.style());
+    if constexpr (std::integral<T>) {
+        if (zoom == 1)
+            return value;
+        // Needed to match historical `CSSPrimitiveValue::resolveAsLength<int>` behavior which truncated (rather than rounding) when scaling up.
+        if (zoom > 1) {
+            if (value < 0)
+                value--;
+            else
+                value++;
+        }
+        return roundForImpreciseConversion<int>(value / zoom);
+    } else if constexpr (std::floating_point<T> || std::same_as<T, LayoutUnit>) {
+        return T(value / zoom);
+    } else if constexpr (std::same_as<T, LayoutSize>) {
+        return T(value.width() / zoom, value.height() / zoom);
+    }
 }
 
-inline LayoutSize adjustLayoutSizeForAbsoluteZoom(LayoutSize size, const ComputedStyle& style)
+template<typename T>
+T unapplyingZoom(T value, const RenderElement& renderer)
 {
-    auto zoom = style.usedZoom();
-    return { size.width() / zoom, size.height() / zoom };
+    return Style::unapplyingZoom<T>(value, renderer.style());
 }
 
-inline LayoutSize adjustLayoutSizeForAbsoluteZoom(LayoutSize size, const RenderElement& renderer)
+template<typename T>
+inline T applyingZoom(T value, const ComputedStyle& style)
 {
-    return adjustLayoutSizeForAbsoluteZoom(size, renderer.style());
+    return value * style.usedZoom();
 }
 
-inline float applyZoom(float value, const ComputedStyle& style)
+template<typename T>
+inline T applyingZoom(T value, const RenderElement& renderer)
 {
-    return value * style.usedZoom();
+    return Style::applyingZoom<T>(value, renderer.style());
 }
 
 } // namespace Style
diff --git a/Source/WebCore/svg/SVGAnimateMotionElement.cpp b/Source/WebCore/svg/SVGAnimateMotionElement.cpp
index a9e8b0fb51a5..bdf5429a2e19 100644
--- a/Source/WebCore/svg/SVGAnimateMotionElement.cpp
+++ b/Source/WebCore/svg/SVGAnimateMotionElement.cpp
@@ -315,12 +315,18 @@ void SVGAnimateMotionElement::childrenChanged(const ChildChange& change)
         updateAnimationPath();
         break;
     case ChildChange::Type::ElementInserted:
+    case ChildChange::Type::ElementMovedFrom:
+    case ChildChange::Type::ElementMovedInto:
     case ChildChange::Type::ElementAndTextInserted:
     case ChildChange::Type::TextInserted:
     case ChildChange::Type::TextRemoved:
+    case ChildChange::Type::TextMovedFrom:
+    case ChildChange::Type::TextMovedInto:
     case ChildChange::Type::TextChanged:
     case ChildChange::Type::NonContentsChildInserted:
     case ChildChange::Type::NonContentsChildRemoved:
+    case ChildChange::Type::NonContentsChildMovedFrom:
+    case ChildChange::Type::NonContentsChildMovedInto:
         break;
     }
 }
diff --git a/Source/WebCore/svg/SVGLengthValue.cpp b/Source/WebCore/svg/SVGLengthValue.cpp
index 34f202d99964..7b28ddeda693 100644
--- a/Source/WebCore/svg/SVGLengthValue.cpp
+++ b/Source/WebCore/svg/SVGLengthValue.cpp
@@ -365,11 +365,6 @@ ExceptionOr<void> SVGLengthValue::setValueAsString(StringView string)
     if (string.isEmpty())
         return Exception { ExceptionCode::SyntaxError };
 
-    // Trim leading and trailing whitespace to match SVG parsing expectations.
-    auto trimmedString = string.trim(isASCIIWhitespace<char16_t>);
-    if (trimmedString.isEmpty())
-        return Exception { ExceptionCode::SyntaxError };
-
     // CSS::Range only clamps to boundaries, but we historically handled
     // overflow values like "-45e58" to 0 instead of FLT_MAX.
     // FIXME: Consider setting to a proper value
@@ -382,9 +377,13 @@ ExceptionOr<void> SVGLengthValue::setValueAsString(StringView string)
         .context = parserContext
     };
 
-    CSSTokenizer tokenizer(trimmedString.toString());
+    CSSTokenizer tokenizer(string);
     auto tokenRange = tokenizer.tokenRange();
 
+    // Leading whitespace is allowed; the consumers below take care of the trailing
+    // whitespace by way of CSSParserTokenRange::consumeIncludingWhitespace().
+    tokenRange.consumeWhitespace();
+
     auto parsedValue = CSSPropertyParserHelpers::MetaConsumer<CSS::Number<>, CSS::LengthPercentage<>>::consume(tokenRange, parserState, { });
     if (!parsedValue || !tokenRange.atEnd())
         return Exception { ExceptionCode::SyntaxError };
diff --git a/Source/WebCore/testing/Internals.cpp b/Source/WebCore/testing/Internals.cpp
index 5cf42bc344ff..ae8515e27ec7 100644
--- a/Source/WebCore/testing/Internals.cpp
+++ b/Source/WebCore/testing/Internals.cpp
@@ -1213,6 +1213,16 @@ unsigned Internals::imageFrameCount(HTMLImageElement& element)
     return bitmapImage ? bitmapImage->frameCount() : 0;
 }
 
+// Decodes a specific frame synchronously. Drawing an image only decodes what the renderer needs,
+// and does nothing at all for an image that has not finished loading.
+bool Internals::forceDecodeImageFrameAtIndex(HTMLImageElement& element, unsigned index)
+{
+    auto* bitmapImage = bitmapImageFromImageElement(element);
+    if (!bitmapImage)
+        return false;
+    return !!bitmapImage->nativeImageAtIndex(index);
+}
+
 float Internals::imageFrameDurationAtIndex(HTMLImageElement& element, unsigned index)
 {
     auto* bitmapImage = bitmapImageFromImageElement(element);
diff --git a/Source/WebCore/testing/Internals.h b/Source/WebCore/testing/Internals.h
index 55416a7025d9..084b79dd2b0c 100644
--- a/Source/WebCore/testing/Internals.h
+++ b/Source/WebCore/testing/Internals.h
@@ -268,6 +268,7 @@ class Internals final
 
     unsigned imageFrameIndex(HTMLImageElement&);
     unsigned imageFrameCount(HTMLImageElement&);
+    bool forceDecodeImageFrameAtIndex(HTMLImageElement&, unsigned index);
     float imageFrameDurationAtIndex(HTMLImageElement&, unsigned index);
     void setImageFrameDecodingDuration(HTMLImageElement&, float duration);
     void resetImageAnimation(HTMLImageElement&);
diff --git a/Source/WebCore/testing/Internals.idl b/Source/WebCore/testing/Internals.idl
index 46778761f283..4f44323c73f0 100644
--- a/Source/WebCore/testing/Internals.idl
+++ b/Source/WebCore/testing/Internals.idl
@@ -770,6 +770,7 @@ enum ContentsFormat {
 
     unsigned long imageFrameIndex(HTMLImageElement element);
     unsigned long imageFrameCount(HTMLImageElement element);
+    boolean forceDecodeImageFrameAtIndex(HTMLImageElement element, unsigned long index);
     float imageFrameDurationAtIndex(HTMLImageElement element, unsigned long index);
     undefined setImageFrameDecodingDuration(HTMLImageElement element, unrestricted float duration);
     undefined resetImageAnimation(HTMLImageElement element);
diff --git a/Source/WebCore/workers/WorkerOrWorkletGlobalScope.cpp b/Source/WebCore/workers/WorkerOrWorkletGlobalScope.cpp
index 853c36462f53..21bfcd647e70 100644
--- a/Source/WebCore/workers/WorkerOrWorkletGlobalScope.cpp
+++ b/Source/WebCore/workers/WorkerOrWorkletGlobalScope.cpp
@@ -56,7 +56,6 @@ WorkerOrWorkletGlobalScope::WorkerOrWorkletGlobalScope(WorkerThreadType type, PA
     , m_noiseInjectionHashSalt(noiseInjectionHashSalt)
     , m_advancedPrivacyProtections(advancedPrivacyProtections)
 {
-    relaxAdoptionRequirement();
 }
 
 WorkerOrWorkletGlobalScope::~WorkerOrWorkletGlobalScope() = default;
diff --git a/Source/WebCore/workers/service/ServiceWorker.cpp b/Source/WebCore/workers/service/ServiceWorker.cpp
index 88f7ba134117..174b2a36626d 100644
--- a/Source/WebCore/workers/service/ServiceWorker.cpp
+++ b/Source/WebCore/workers/service/ServiceWorker.cpp
@@ -71,7 +71,6 @@ ServiceWorker::ServiceWorker(ScriptExecutionContext& context, ServiceWorkerData&
 {
     context.registerServiceWorker(*this);
 
-    relaxAdoptionRequirement();
     updatePendingActivityForEventDispatch();
 
     WORKER_RELEASE_LOG("serviceWorkerID=%" PRIu64 ", state=%hhu", identifier().toUInt64(), std::to_underlying(m_data.state));
diff --git a/Source/WebCore/workers/service/ServiceWorkerContainer.cpp b/Source/WebCore/workers/service/ServiceWorkerContainer.cpp
index ba18df2c7bc7..ecc335bd8de5 100644
--- a/Source/WebCore/workers/service/ServiceWorkerContainer.cpp
+++ b/Source/WebCore/workers/service/ServiceWorkerContainer.cpp
@@ -609,7 +609,6 @@ SWClientConnection& ServiceWorkerContainer::ensureSWClientConnection()
 {
     ASSERT(scriptExecutionContext());
     if (!m_swConnection || m_swConnection->isClosed()) {
-        // Using RefPtr here results in an m_adoptionIsRequired assert.
         if (RefPtr workerGlobal = dynamicDowncast<WorkerGlobalScope>(*scriptExecutionContext()))
             m_swConnection = workerGlobal->swClientConnection();
         else
diff --git a/Source/WebCore/workers/service/ServiceWorkerRegistration.cpp b/Source/WebCore/workers/service/ServiceWorkerRegistration.cpp
index 8a60436e4bd1..cffcb43be225 100644
--- a/Source/WebCore/workers/service/ServiceWorkerRegistration.cpp
+++ b/Source/WebCore/workers/service/ServiceWorkerRegistration.cpp
@@ -90,8 +90,6 @@ ServiceWorkerRegistration::ServiceWorkerRegistration(ScriptExecutionContext& con
     REGISTRATION_RELEASE_LOG("ServiceWorkerRegistration: ID %" PRIu64 ", installing=%" PRIu64 ", waiting=%" PRIu64 ", active=%" PRIu64, identifier().toUInt64(), m_installingWorker ? m_installingWorker->identifier().toUInt64() : 0, m_waitingWorker ? m_waitingWorker->identifier().toUInt64() : 0, m_activeWorker ? m_activeWorker->identifier().toUInt64() : 0);
 
     m_container->addRegistration(*this);
-
-    relaxAdoptionRequirement();
 }
 
 ServiceWorkerRegistration::~ServiceWorkerRegistration()
diff --git a/Source/WebCore/workers/service/background-fetch/BackgroundFetch.h b/Source/WebCore/workers/service/background-fetch/BackgroundFetch.h
index c85c72499569..a7edad4546e5 100644
--- a/Source/WebCore/workers/service/background-fetch/BackgroundFetch.h
+++ b/Source/WebCore/workers/service/background-fetch/BackgroundFetch.h
@@ -64,7 +64,7 @@ class BackgroundFetch : public RefCountedAndCanMakeWeakPtr<BackgroundFetch> {
         return adoptRef(*new BackgroundFetch(swServerRegistration, WTF::move(identifier), WTF::move(options), WTF::move(store), WTF::move(notificationCallback), pausedFlag));
     }
 
-    ~BackgroundFetch();
+    WEBCORE_EXPORT ~BackgroundFetch();
 
     static RefPtr<BackgroundFetch> createFromStore(std::span<const uint8_t>, SWServer&, Ref<BackgroundFetchStore>&&, NotificationCallback&&);
 
@@ -88,7 +88,7 @@ class BackgroundFetch : public RefCountedAndCanMakeWeakPtr<BackgroundFetch> {
         void deref() const final { RefCounted::deref(); }
 
         static Ref<Record> create(BackgroundFetch& fetch, BackgroundFetchRequest&& request, size_t size) { return adoptRef(*new Record(fetch, WTF::move(request), size)); }
-        ~Record();
+        WEBCORE_EXPORT ~Record();
 
         void complete(const CreateLoaderCallback&);
         void pause();
diff --git a/Source/WebGPU/WGSL/GlobalVariableRewriter.cpp b/Source/WebGPU/WGSL/GlobalVariableRewriter.cpp
index 01e678c3fe95..20144245fb91 100644
--- a/Source/WebGPU/WGSL/GlobalVariableRewriter.cpp
+++ b/Source/WebGPU/WGSL/GlobalVariableRewriter.cpp
@@ -2008,7 +2008,7 @@ static ASCIILiteral nameForPrimitiveKind(Types::Primitive::Kind primitiveKind)
     case Types::Primitive::Sampler:
         return "sampler"_s;
     case Types::Primitive::SamplerComparison:
-        return "sampler_comparion"_s;
+        return "sampler_comparison"_s;
     case Types::Primitive::TextureExternal:
         return "texture_external"_s;
     case Types::Primitive::AccessMode:
diff --git a/Source/WebGPU/WGSL/Types.h b/Source/WebGPU/WGSL/Types.h
index dfd21d428751..cdd343d0d66f 100644
--- a/Source/WebGPU/WGSL/Types.h
+++ b/Source/WebGPU/WGSL/Types.h
@@ -72,7 +72,7 @@ namespace Types {
     f(Void, "void") \
     f(Bool, "bool") \
     f(Sampler, "sampler") \
-    f(SamplerComparison, "sampler_comparion") \
+    f(SamplerComparison, "sampler_comparison") \
     f(TextureExternal, "texture_external") \
     f(AccessMode, "access_mode") \
     f(TexelFormat, "texel_format") \
diff --git a/Source/WebGPU/WebGPU/Buffer.h b/Source/WebGPU/WebGPU/Buffer.h
index 2585f8126a0c..e555c0ded72b 100644
--- a/Source/WebGPU/WebGPU/Buffer.h
+++ b/Source/WebGPU/WebGPU/Buffer.h
@@ -161,6 +161,8 @@ class Buffer : public WGPUBufferImpl, public ThreadSafeRefCountedAndCanMakeThrea
     WGPUMapModeFlags m_mapMode { WGPUMapMode_None };
     uint32_t m_maxUnsignedIndex { 0 };
     uint16_t m_maxUshortIndex { 0 };
+    uint32_t m_maxValidatedUnsignedIndex { 0 };
+    uint16_t m_maxValidatedUshortIndex { 0 };
 
     DrawIndexCacheContainer m_drawIndexedCache;
 
diff --git a/Source/WebGPU/WebGPU/Buffer.mm b/Source/WebGPU/WebGPU/Buffer.mm
index ef6c6d5b48ce..b9f013d4a7e8 100644
--- a/Source/WebGPU/WebGPU/Buffer.mm
+++ b/Source/WebGPU/WebGPU/Buffer.mm
@@ -500,6 +500,11 @@ static DrawIndexCacheContainerKey makeKey(uint32_t firstIndex, uint32_t indexCou
         m_drawIndexedCache.clear();
 
     m_drawIndexedCache.set(makeKey(firstIndex, indexCount, indexType, primitiveOffset, icb), DrawIndexValidationCacheEntry { vertexCount, validationGeneration });
+
+    // Update the validated high-water marks so future writeBuffer calls
+    // with indices at or below these values don't need to invalidate.
+    m_maxValidatedUnsignedIndex = std::max(m_maxValidatedUnsignedIndex, m_maxUnsignedIndex);
+    m_maxValidatedUshortIndex = std::max(m_maxValidatedUshortIndex, m_maxUshortIndex);
 }
 
 template <typename T>
@@ -591,9 +596,11 @@ static size_t computeSize(HashSet<uint64_t, DefaultHash<uint64_t>, WTF::Unsigned
 
 bool Buffer::needsIndexValidation(uint32_t maxUnsignedIndex, uint16_t maxUshortIndex)
 {
-    const bool needsUpdate = maxUnsignedIndex > m_maxUnsignedIndex || maxUshortIndex > m_maxUshortIndex;
-    m_maxUnsignedIndex = std::max(m_maxUnsignedIndex, maxUnsignedIndex);
-    m_maxUshortIndex = std::max(m_maxUshortIndex, maxUshortIndex);
+    const bool needsUpdate = maxUnsignedIndex > m_maxValidatedUnsignedIndex || maxUshortIndex > m_maxValidatedUshortIndex;
+    // Track the current write's max so we can update the validated
+    // threshold after a successful clamp-shader pass.
+    m_maxUnsignedIndex = maxUnsignedIndex;
+    m_maxUshortIndex = maxUshortIndex;
 
     return needsUpdate;
 }
@@ -615,6 +622,8 @@ static size_t computeSize(HashSet<uint64_t, DefaultHash<uint64_t>, WTF::Unsigned
     ++m_indexContentsGeneration;
     m_indexValueUpperBoundUint = UINT32_MAX;
     m_indexValueUpperBoundUshort = UINT16_MAX;
+    m_maxValidatedUnsignedIndex = 0;
+    m_maxValidatedUshortIndex = 0;
 }
 
 void Buffer::removeSkippedValidationCommandEncoder(uint64_t uniqueId)
diff --git a/Source/WebKit/CMakeLists.txt b/Source/WebKit/CMakeLists.txt
index 4ea403d62eef..49f59b7dede5 100644
--- a/Source/WebKit/CMakeLists.txt
+++ b/Source/WebKit/CMakeLists.txt
@@ -1465,6 +1465,7 @@ if (SWIFT_REQUIRED)
         ${WEBKIT_DIR}/Shared/Foundation+Extras.swift
         ${WEBKIT_DIR}/Shared/IPCTesterReceiver.swift
         ${WEBKIT_DIR}/Shared/WTFCompletionHandler+Extras.swift
+        ${WEBKIT_DIR}/Shared/WTFExpected+Extras.swift
         ${WebKit_DERIVED_SOURCES_DIR}/IPCTesterReceiverMessageReceiver.swift
     )
 endif ()
diff --git a/Source/WebKit/GPUProcess/graphics/WebGPU/RemoteCommandEncoder.cpp b/Source/WebKit/GPUProcess/graphics/WebGPU/RemoteCommandEncoder.cpp
index 7a0a060f2309..6afd5bc9a06b 100644
--- a/Source/WebKit/GPUProcess/graphics/WebGPU/RemoteCommandEncoder.cpp
+++ b/Source/WebKit/GPUProcess/graphics/WebGPU/RemoteCommandEncoder.cpp
@@ -113,7 +113,7 @@ void RemoteCommandEncoder::copyBufferToBuffer(
     if (!convertedSource || !convertedDestination)
         return;
 
-    protect(m_backing)->copyBufferToBuffer(*convertedSource, sourceOffset, *convertedDestination, destinationOffset, size);
+    protect(m_backing)->copyBufferToBuffer(protect(*convertedSource), sourceOffset, protect(*convertedDestination), destinationOffset, size);
 }
 
 void RemoteCommandEncoder::copyBufferToTexture(
@@ -177,7 +177,7 @@ void RemoteCommandEncoder::clearBuffer(
     if (!convertedBuffer)
         return;
 
-    protect(m_backing)->clearBuffer(*convertedBuffer, offset, size);
+    protect(m_backing)->clearBuffer(protect(*convertedBuffer), offset, size);
 }
 
 void RemoteCommandEncoder::pushDebugGroup(String&& groupLabel)
@@ -202,7 +202,7 @@ void RemoteCommandEncoder::writeTimestamp(WebGPUIdentifier querySet, WebCore::We
     if (!convertedQuerySet)
         return;
 
-    protect(m_backing)->writeTimestamp(*convertedQuerySet, queryIndex);
+    protect(m_backing)->writeTimestamp(protect(*convertedQuerySet), queryIndex);
 }
 
 void RemoteCommandEncoder::resolveQuerySet(
@@ -220,7 +220,7 @@ void RemoteCommandEncoder::resolveQuerySet(
     if (!convertedQuerySet || !convertedDestination)
         return;
 
-    protect(m_backing)->resolveQuerySet(*convertedQuerySet, firstQuery, queryCount, *convertedDestination, destinationOffset);
+    protect(m_backing)->resolveQuerySet(protect(*convertedQuerySet), firstQuery, queryCount, protect(*convertedDestination), destinationOffset);
 }
 
 void RemoteCommandEncoder::finish(const WebGPU::CommandBufferDescriptor& descriptor, WebGPUIdentifier identifier)
diff --git a/Source/WebKit/GPUProcess/graphics/WebGPU/RemoteCompositorIntegration.cpp b/Source/WebKit/GPUProcess/graphics/WebGPU/RemoteCompositorIntegration.cpp
index c53b605853a3..e4bfe821cdf1 100644
--- a/Source/WebKit/GPUProcess/graphics/WebGPU/RemoteCompositorIntegration.cpp
+++ b/Source/WebKit/GPUProcess/graphics/WebGPU/RemoteCompositorIntegration.cpp
@@ -82,7 +82,7 @@ void RemoteCompositorIntegration::recreateRenderBuffers(int width, int height, W
     auto convertedDevice = protect(m_objectHeap)->convertDeviceFromBacking(deviceIdentifier);
     MESSAGE_CHECK_COMPLETION(convertedDevice, callback({ }));
 
-    callback(protect(m_backing)->recreateRenderBuffers(width, height, WTF::move(destinationColorSpace), alphaMode, textureFormat, bufferCount, *convertedDevice));
+    callback(protect(m_backing)->recreateRenderBuffers(width, height, WTF::move(destinationColorSpace), alphaMode, textureFormat, bufferCount, protect(*convertedDevice)));
 }
 #endif
 
diff --git a/Source/WebKit/GPUProcess/graphics/WebGPU/RemoteComputePassEncoder.cpp b/Source/WebKit/GPUProcess/graphics/WebGPU/RemoteComputePassEncoder.cpp
index 9d6c5f2866a8..40ef557f4ccf 100644
--- a/Source/WebKit/GPUProcess/graphics/WebGPU/RemoteComputePassEncoder.cpp
+++ b/Source/WebKit/GPUProcess/graphics/WebGPU/RemoteComputePassEncoder.cpp
@@ -70,7 +70,7 @@ void RemoteComputePassEncoder::setPipeline(WebGPUIdentifier computePipeline)
     if (!convertedComputePipeline)
         return;
 
-    protect(m_backing)->setPipeline(*convertedComputePipeline);
+    protect(m_backing)->setPipeline(protect(*convertedComputePipeline));
 }
 
 void RemoteComputePassEncoder::dispatch(WebCore::WebGPU::Size32 workgroupCountX, WebCore::WebGPU::Size32 workgroupCountY, WebCore::WebGPU::Size32 workgroupCountZ)
@@ -85,7 +85,7 @@ void RemoteComputePassEncoder::dispatchIndirect(WebGPUIdentifier indirectBuffer,
     if (!convertedIndirectBuffer)
         return;
 
-    protect(m_backing)->dispatchIndirect(*convertedIndirectBuffer, indirectOffset);
+    protect(m_backing)->dispatchIndirect(protect(*convertedIndirectBuffer), indirectOffset);
 }
 
 void RemoteComputePassEncoder::end()
diff --git a/Source/WebKit/GPUProcess/graphics/WebGPU/RemoteDevice.cpp b/Source/WebKit/GPUProcess/graphics/WebGPU/RemoteDevice.cpp
index 8384762c1be1..66befbf26b71 100644
--- a/Source/WebKit/GPUProcess/graphics/WebGPU/RemoteDevice.cpp
+++ b/Source/WebKit/GPUProcess/graphics/WebGPU/RemoteDevice.cpp
@@ -308,7 +308,7 @@ void RemoteDevice::createComputePipelineWithPipelineLayoutFromPipeline(const Web
     WeakPtr<WebCore::WebGPU::ComputePipeline> pipelineToReplace = objectHeap->convertComputePipelineFromBacking(pipelineToReplaceIdentifier);
     MESSAGE_CHECK_COMPLETION(pipelineToReplace, completionHandler(false));
 
-    m_backing->createComputePipelineWithPipelineLayoutFromPipelineAsync(*convertedDescriptor, *pipelineToReplace, [completionHandler = WTF::move(completionHandler), objectHeap, streamConnection = protect(m_streamConnection), gpu = protect(m_gpu), identifier](RefPtr<WebCore::WebGPU::ComputePipeline>&& computePipeline) mutable {
+    m_backing->createComputePipelineWithPipelineLayoutFromPipelineAsync(*convertedDescriptor, protect(*pipelineToReplace), [completionHandler = WTF::move(completionHandler), objectHeap, streamConnection = protect(m_streamConnection), gpu = protect(m_gpu), identifier](RefPtr<WebCore::WebGPU::ComputePipeline>&& computePipeline) mutable {
         if (!computePipeline) {
             completionHandler(false);
             return;
@@ -341,7 +341,7 @@ void RemoteDevice::createRenderPipelineWithPipelineLayoutFromPipeline(const WebG
     WeakPtr<WebCore::WebGPU::RenderPipeline> pipelineToReplace = objectHeap->convertRenderPipelineFromBacking(pipelineToReplaceIdentifier);
     MESSAGE_CHECK_COMPLETION(pipelineToReplace, completionHandler(false));
 
-    m_backing->createRenderPipelineWithPipelineLayoutFromPipelineAsync(*convertedDescriptor, *pipelineToReplace, [completionHandler = WTF::move(completionHandler), objectHeap, streamConnection = protect(m_streamConnection), gpu = protect(m_gpu), identifier](RefPtr<WebCore::WebGPU::RenderPipeline>&& renderPipeline) mutable {
+    m_backing->createRenderPipelineWithPipelineLayoutFromPipelineAsync(*convertedDescriptor, protect(*pipelineToReplace), [completionHandler = WTF::move(completionHandler), objectHeap, streamConnection = protect(m_streamConnection), gpu = protect(m_gpu), identifier](RefPtr<WebCore::WebGPU::RenderPipeline>&& renderPipeline) mutable {
         if (!renderPipeline) {
             completionHandler(false);
             return;
diff --git a/Source/WebKit/GPUProcess/graphics/WebGPU/RemoteQueue.cpp b/Source/WebKit/GPUProcess/graphics/WebGPU/RemoteQueue.cpp
index 84f3b2fb4e72..d9b6cc8bcd55 100644
--- a/Source/WebKit/GPUProcess/graphics/WebGPU/RemoteQueue.cpp
+++ b/Source/WebKit/GPUProcess/graphics/WebGPU/RemoteQueue.cpp
@@ -72,7 +72,7 @@ void RemoteQueue::submit(Vector<WebGPUIdentifier>&& commandBuffers)
         ASSERT(convertedCommandBuffer);
         if (!convertedCommandBuffer)
             return;
-        convertedCommandBuffers.append(*convertedCommandBuffer);
+        convertedCommandBuffers.append(protect(*convertedCommandBuffer));
     }
     protect(m_backing)->submit(WTF::move(convertedCommandBuffers));
 }
@@ -98,7 +98,7 @@ void RemoteQueue::writeBuffer(
         return;
     }
 
-    protect(m_backing)->writeBufferNoCopy(*convertedBuffer, bufferOffset, data ? data->mutableSpan() : std::span<uint8_t> { }, 0, std::nullopt);
+    protect(m_backing)->writeBufferNoCopy(protect(*convertedBuffer), bufferOffset, data ? data->mutableSpan() : std::span<uint8_t> { }, 0, std::nullopt);
     completionHandler(true);
 }
 
@@ -113,7 +113,7 @@ void RemoteQueue::writeBufferWithCopy(
     if (!convertedBuffer)
         return;
 
-    protect(m_backing)->writeBufferNoCopy(*convertedBuffer, bufferOffset, data.mutableSpan(), 0, std::nullopt);
+    protect(m_backing)->writeBufferNoCopy(protect(*convertedBuffer), bufferOffset, data.mutableSpan(), 0, std::nullopt);
 }
 
 void RemoteQueue::writeTexture(
diff --git a/Source/WebKit/GPUProcess/graphics/WebGPU/RemoteRenderBundleEncoder.cpp b/Source/WebKit/GPUProcess/graphics/WebGPU/RemoteRenderBundleEncoder.cpp
index 3d7f69863a88..b781ce443476 100644
--- a/Source/WebKit/GPUProcess/graphics/WebGPU/RemoteRenderBundleEncoder.cpp
+++ b/Source/WebKit/GPUProcess/graphics/WebGPU/RemoteRenderBundleEncoder.cpp
@@ -77,7 +77,7 @@ void RemoteRenderBundleEncoder::setPipeline(WebGPUIdentifier renderPipeline)
     if (!convertedRenderPipeline)
         return;
 
-    protect(m_backing)->setPipeline(*convertedRenderPipeline);
+    protect(m_backing)->setPipeline(protect(*convertedRenderPipeline));
 }
 
 void RemoteRenderBundleEncoder::setIndexBuffer(WebGPUIdentifier buffer, WebCore::WebGPU::IndexFormat indexFormat, WebCore::WebGPU::Size64 offset, std::optional<WebCore::WebGPU::Size64> size)
@@ -87,7 +87,7 @@ void RemoteRenderBundleEncoder::setIndexBuffer(WebGPUIdentifier buffer, WebCore:
     if (!convertedBuffer)
         return;
 
-    protect(m_backing)->setIndexBuffer(*convertedBuffer, indexFormat, offset, size);
+    protect(m_backing)->setIndexBuffer(protect(*convertedBuffer), indexFormat, offset, size);
 }
 
 void RemoteRenderBundleEncoder::setVertexBuffer(WebCore::WebGPU::Index32 slot, WebGPUIdentifier buffer, WebCore::WebGPU::Size64 offset, std::optional<WebCore::WebGPU::Size64> size)
@@ -126,7 +126,7 @@ void RemoteRenderBundleEncoder::drawIndirect(WebGPUIdentifier indirectBuffer, We
     if (!convertedIndirectBuffer)
         return;
 
-    protect(m_backing)->drawIndirect(*convertedIndirectBuffer, indirectOffset);
+    protect(m_backing)->drawIndirect(protect(*convertedIndirectBuffer), indirectOffset);
 }
 
 void RemoteRenderBundleEncoder::drawIndexedIndirect(WebGPUIdentifier indirectBuffer, WebCore::WebGPU::Size64 indirectOffset)
@@ -136,7 +136,7 @@ void RemoteRenderBundleEncoder::drawIndexedIndirect(WebGPUIdentifier indirectBuf
     if (!convertedIndirectBuffer)
         return;
 
-    protect(m_backing)->drawIndexedIndirect(*convertedIndirectBuffer, indirectOffset);
+    protect(m_backing)->drawIndexedIndirect(protect(*convertedIndirectBuffer), indirectOffset);
 }
 
 void RemoteRenderBundleEncoder::setBindGroup(WebCore::WebGPU::Index32 index, std::optional<WebGPUIdentifier> bindGroup,
diff --git a/Source/WebKit/GPUProcess/graphics/WebGPU/RemoteRenderPassEncoder.cpp b/Source/WebKit/GPUProcess/graphics/WebGPU/RemoteRenderPassEncoder.cpp
index 982c3ea89456..d05bc65bff38 100644
--- a/Source/WebKit/GPUProcess/graphics/WebGPU/RemoteRenderPassEncoder.cpp
+++ b/Source/WebKit/GPUProcess/graphics/WebGPU/RemoteRenderPassEncoder.cpp
@@ -71,7 +71,7 @@ void RemoteRenderPassEncoder::setPipeline(WebGPUIdentifier renderPipeline)
     if (!convertedRenderPipeline)
         return;
 
-    protect(m_backing)->setPipeline(*convertedRenderPipeline);
+    protect(m_backing)->setPipeline(protect(*convertedRenderPipeline));
 }
 
 void RemoteRenderPassEncoder::setIndexBuffer(WebGPUIdentifier buffer, WebCore::WebGPU::IndexFormat indexFormat, WebCore::WebGPU::Size64 offset, std::optional<WebCore::WebGPU::Size64> size)
@@ -81,7 +81,7 @@ void RemoteRenderPassEncoder::setIndexBuffer(WebGPUIdentifier buffer, WebCore::W
     if (!convertedBuffer)
         return;
 
-    protect(m_backing)->setIndexBuffer(*convertedBuffer, indexFormat, offset, size);
+    protect(m_backing)->setIndexBuffer(protect(*convertedBuffer), indexFormat, offset, size);
 }
 
 void RemoteRenderPassEncoder::setVertexBuffer(WebCore::WebGPU::Index32 slot, WebGPUIdentifier buffer, WebCore::WebGPU::Size64 offset, std::optional<WebCore::WebGPU::Size64> size)
@@ -121,7 +121,7 @@ void RemoteRenderPassEncoder::drawIndirect(WebGPUIdentifier indirectBuffer, WebC
     if (!convertedIndirectBuffer)
         return;
 
-    protect(m_backing)->drawIndirect(*convertedIndirectBuffer, indirectOffset);
+    protect(m_backing)->drawIndirect(protect(*convertedIndirectBuffer), indirectOffset);
 }
 
 void RemoteRenderPassEncoder::drawIndexedIndirect(WebGPUIdentifier indirectBuffer, WebCore::WebGPU::Size64 indirectOffset)
@@ -131,7 +131,7 @@ void RemoteRenderPassEncoder::drawIndexedIndirect(WebGPUIdentifier indirectBuffe
     if (!convertedIndirectBuffer)
         return;
 
-    protect(m_backing)->drawIndexedIndirect(*convertedIndirectBuffer, indirectOffset);
+    protect(m_backing)->drawIndexedIndirect(protect(*convertedIndirectBuffer), indirectOffset);
 }
 
 void RemoteRenderPassEncoder::setBindGroup(WebCore::WebGPU::Index32 index, std::optional<WebGPUIdentifier> bindGroup,
@@ -211,7 +211,7 @@ void RemoteRenderPassEncoder::executeBundles(Vector<WebGPUIdentifier>&& renderBu
         ASSERT(convertedBundle);
         if (!convertedBundle)
             return;
-        convertedBundles.append(*convertedBundle);
+        convertedBundles.append(protect(*convertedBundle));
     }
     protect(m_backing)->executeBundles(WTF::move(convertedBundles));
 }
diff --git a/Source/WebKit/GPUProcess/graphics/WebGPU/RemoteXRBinding.cpp b/Source/WebKit/GPUProcess/graphics/WebGPU/RemoteXRBinding.cpp
index 9008105b744c..815ca2c37a76 100644
--- a/Source/WebKit/GPUProcess/graphics/WebGPU/RemoteXRBinding.cpp
+++ b/Source/WebKit/GPUProcess/graphics/WebGPU/RemoteXRBinding.cpp
@@ -83,7 +83,7 @@ void RemoteXRBinding::createProjectionLayer(WebCore::WebGPU::TextureFormat color
 void RemoteXRBinding::getViewSubImage(WebGPUIdentifier projectionLayerIdentifier, WebGPUIdentifier identifier)
 {
     Ref objectHeap = m_objectHeap.get();
-    auto projectionLayer = objectHeap->convertXRProjectionLayerFromBacking(projectionLayerIdentifier);
+    RefPtr projectionLayer = objectHeap->convertXRProjectionLayerFromBacking(projectionLayerIdentifier);
     if (!projectionLayer) {
         // FIXME: Add MESSAGE_CHECK call
         return;
diff --git a/Source/WebKit/GPUProcess/webrtc/LibWebRTCCodecsProxy.mm b/Source/WebKit/GPUProcess/webrtc/LibWebRTCCodecsProxy.mm
index 7c339de446b2..037e90a914c0 100644
--- a/Source/WebKit/GPUProcess/webrtc/LibWebRTCCodecsProxy.mm
+++ b/Source/WebKit/GPUProcess/webrtc/LibWebRTCCodecsProxy.mm
@@ -368,7 +368,7 @@ static bool validateEncoderConfiguration(WebCore::VideoCodecType codecType, cons
     });
     auto newConfigurationBlock = makeBlockPtr([connection = m_connection, identifier](const uint8_t* buffer, size_t size) {
         // Current encoders are limited to this configuration. We might want in the future to let encoders notify which colorSpace they are selecting.
-        PlatformVideoColorSpace colorSpace { PlatformVideoColorPrimaries::Bt709, PlatformVideoTransferCharacteristics::Iec6196621, PlatformVideoMatrixCoefficients::Bt709, true };
+        PlatformVideoColorSpace colorSpace { .primaries = PlatformVideoColorPrimaries::Bt709, .transfer = PlatformVideoTransferCharacteristics::Iec6196621, .matrix = PlatformVideoMatrixCoefficients::Bt709, .fullRange = true };
         connection->send(Messages::LibWebRTCCodecs::SetEncodingConfiguration { identifier, unsafeMakeSpan(buffer, size), colorSpace }, 0);
     });
 
diff --git a/Source/WebKit/Modules/Internal/module.modulemap b/Source/WebKit/Modules/Internal/module.modulemap
index 27f1d2d7de7f..b183fa3b2510 100644
--- a/Source/WebKit/Modules/Internal/module.modulemap
+++ b/Source/WebKit/Modules/Internal/module.modulemap
@@ -59,6 +59,12 @@ module WebKit_Internal [system] {
         export *
     }
 
+    module RunJavaScriptResult {
+        requires cplusplus20
+        header "../../Shared/RunJavaScriptResult.h"
+        export *
+    }
+
     module MessageReceiver {
         requires cplusplus20
         header "../../Platform/IPC/MessageReceiver.h"
diff --git a/Source/WebKit/NetworkProcess/Authentication/cocoa/AuthenticationManagerCocoa.mm b/Source/WebKit/NetworkProcess/Authentication/cocoa/AuthenticationManagerCocoa.mm
index 706378470bbd..a954a40b27a6 100644
--- a/Source/WebKit/NetworkProcess/Authentication/cocoa/AuthenticationManagerCocoa.mm
+++ b/Source/WebKit/NetworkProcess/Authentication/cocoa/AuthenticationManagerCocoa.mm
@@ -94,7 +94,11 @@
             RELEASE_ASSERT(isMainRunLoop());
 
             xpc_type_t type = xpc_get_type(event.get());
-            if (type == XPC_TYPE_ERROR || !weakThis)
+            if (type == XPC_TYPE_ERROR)
+                return;
+
+            RefPtr protectedThis = weakThis;
+            if (!protectedThis)
                 return;
 
             if (type != XPC_TYPE_DICTIONARY || xpcDictionaryGetString(event.get(), ClientCertificateAuthentication::XPCMessageNameKey) != ClientCertificateAuthentication::XPCMessageNameValue) {
@@ -112,11 +116,11 @@
             // CFNetwork owns the challenge's completion handler and never times out, so failing to complete it hangs the load forever.
             auto credential = credentialFromClientCertificateMessage(event.get());
             if (!credential) {
-                weakThis->completeAuthenticationChallenge(challengeIdentifier, AuthenticationChallengeDisposition::PerformDefaultHandling, { });
+                protectedThis->completeAuthenticationChallenge(challengeIdentifier, AuthenticationChallengeDisposition::PerformDefaultHandling, { });
                 return;
             }
 
-            weakThis->completeAuthenticationChallenge(challengeIdentifier, AuthenticationChallengeDisposition::UseCredential, WTF::move(*credential));
+            protectedThis->completeAuthenticationChallenge(challengeIdentifier, AuthenticationChallengeDisposition::UseCredential, WTF::move(*credential));
         });
     });
 }
diff --git a/Source/WebKit/NetworkProcess/BackgroundFetchLoad.cpp b/Source/WebKit/NetworkProcess/BackgroundFetchLoad.cpp
index 80292dfdb296..0252930a5655 100644
--- a/Source/WebKit/NetworkProcess/BackgroundFetchLoad.cpp
+++ b/Source/WebKit/NetworkProcess/BackgroundFetchLoad.cpp
@@ -52,7 +52,6 @@ BackgroundFetchLoad::BackgroundFetchLoad(NetworkProcess& networkProcess, PAL::Se
     , m_request(request.internalRequest)
     , m_networkLoadChecker(NetworkLoadChecker::create(networkProcess, nullptr, nullptr, FetchOptions { request.options }, m_sessionID, std::nullopt, HTTPHeaderMap { request.httpHeaders }, URL { m_request.url() }, URL { }, clientOrigin.clientOrigin.securityOrigin(), clientOrigin.topOrigin.securityOrigin(), RefPtr<SecurityOrigin> { }, PreflightPolicy::Consider, String { request.referrer }, true, OptionSet<AdvancedPrivacyProtections> { }))
 {
-    relaxAdoptionRequirement();
     if (!m_request.url().protocolIsInHTTPFamily()) {
         didFinish(ResourceError { String { }, 0, m_request.url(), "URL is not HTTP(S)"_s, ResourceError::Type::Cancellation });
         return;
diff --git a/Source/WebKit/NetworkProcess/Classifier/ResourceLoadStatisticsStore.cpp b/Source/WebKit/NetworkProcess/Classifier/ResourceLoadStatisticsStore.cpp
index 2ebcd857b33c..e362af8f270d 100644
--- a/Source/WebKit/NetworkProcess/Classifier/ResourceLoadStatisticsStore.cpp
+++ b/Source/WebKit/NetworkProcess/Classifier/ResourceLoadStatisticsStore.cpp
@@ -419,23 +419,24 @@ void ResourceLoadStatisticsStore::removeDataRecords(CompletionHandler<void()>&&
     RunLoop::mainSingleton().dispatch([store = Ref { m_store.get() }, domainsToDeleteOrRestrictWebsiteDataFor = crossThreadCopy(WTF::move(domainsToDeleteOrRestrictWebsiteDataFor)), completionHandler = WTF::move(completionHandler), weakThis = WeakPtr { *this }, workQueue = m_workQueue] () mutable {
         store->deleteAndRestrictWebsiteDataForRegistrableDomains(WebResourceLoadStatisticsStore::monitoredDataTypes(), WTF::move(domainsToDeleteOrRestrictWebsiteDataFor), [completionHandler = WTF::move(completionHandler), weakThis = WTF::move(weakThis), workQueue](HashSet<RegistrableDomain>&& domainsWithDeletedWebsiteData) mutable {
             workQueue->dispatch([domainsWithDeletedWebsiteData = crossThreadCopy(WTF::move(domainsWithDeletedWebsiteData)), completionHandler = WTF::move(completionHandler), weakThis = WTF::move(weakThis)] () mutable {
-                if (!weakThis) {
+                RefPtr protectedThis = weakThis;
+                if (!protectedThis) {
                     completionHandler();
                     return;
                 }
 
-                weakThis->incrementRecordsDeletedCountForDomains(WTF::move(domainsWithDeletedWebsiteData));
-                weakThis->setDataRecordsBeingRemoved(false);
+                protectedThis->incrementRecordsDeletedCountForDomains(WTF::move(domainsWithDeletedWebsiteData));
+                protectedThis->setDataRecordsBeingRemoved(false);
 
-                auto dataRecordRemovalCompletionHandlers = WTF::move(weakThis->m_dataRecordRemovalCompletionHandlers);
+                auto dataRecordRemovalCompletionHandlers = WTF::move(protectedThis->m_dataRecordRemovalCompletionHandlers);
                 completionHandler();
 
                 for (auto& dataRecordRemovalCompletionHandler : dataRecordRemovalCompletionHandlers)
                     dataRecordRemovalCompletionHandler();
 
-                if (weakThis->m_debugLoggingEnabled) [[unlikely]] {
+                if (protectedThis->m_debugLoggingEnabled) [[unlikely]] {
                     ITP_DEBUG_MODE_RELEASE_LOG("Done removing data records.");
-                    weakThis->debugBroadcastConsoleMessage(MessageSource::ITPDebug, MessageLevel::Info, "[ITP] Done removing data records"_s);
+                    protectedThis->debugBroadcastConsoleMessage(MessageSource::ITPDebug, MessageLevel::Info, "[ITP] Done removing data records"_s);
                 }
             });
         });
@@ -451,7 +452,7 @@ void ResourceLoadStatisticsStore::processStatisticsAndDataRecords(CompletionHand
     
     removeDataRecords([weakThis = WeakPtr { *this }, completionHandler = WTF::move(completionHandler)] () mutable {
         ASSERT(!RunLoop::isMain());
-        RefPtr protectedThis = weakThis.get();
+        RefPtr protectedThis = weakThis;
         if (!protectedThis) {
             completionHandler();
             return;
@@ -486,15 +487,16 @@ void ResourceLoadStatisticsStore::grandfatherExistingWebsiteData(CompletionHandl
     RunLoop::mainSingleton().dispatch([weakThis = WeakPtr { *this }, callback = WTF::move(callback), workQueue = m_workQueue, store = Ref { m_store.get() }] () mutable {
         store->registrableDomainsWithWebsiteData(WebResourceLoadStatisticsStore::monitoredDataTypes(), [weakThis = WTF::move(weakThis), callback = WTF::move(callback), workQueue] (HashSet<RegistrableDomain>&& domainsWithWebsiteData) mutable {
             workQueue->dispatch([weakThis = WTF::move(weakThis), domainsWithWebsiteData = crossThreadCopy(WTF::move(domainsWithWebsiteData)), callback = WTF::move(callback)] () mutable {
-                if (!weakThis) {
+                RefPtr protectedThis = weakThis;
+                if (!protectedThis) {
                     callback();
                     return;
                 }
 
-                weakThis->grandfatherDataForDomains(domainsWithWebsiteData);
-                weakThis->m_endOfGrandfatheringTimestamp = nowTime(weakThis->m_timeAdvanceForTesting) + weakThis->m_parameters.grandfatheringTime;
+                protectedThis->grandfatherDataForDomains(domainsWithWebsiteData);
+                protectedThis->m_endOfGrandfatheringTimestamp = nowTime(protectedThis->m_timeAdvanceForTesting) + protectedThis->m_parameters.grandfatheringTime;
                 callback();
-                weakThis->logTestingEvent("Grandfathered"_s);
+                protectedThis->logTestingEvent("Grandfathered"_s);
             });
         });
     });
@@ -549,7 +551,7 @@ void ResourceLoadStatisticsStore::scheduleStatisticsProcessingRequestIfNecessary
 
     m_pendingStatisticsProcessingRequestIdentifier = ++m_lastStatisticsProcessingRequestIdentifier;
     m_workQueue->dispatchAfter(minimumStatisticsProcessingInterval, [weakThis = WeakPtr { *this }, statisticsProcessingRequestIdentifier = *m_pendingStatisticsProcessingRequestIdentifier] {
-        RefPtr protectedThis = weakThis.get();
+        RefPtr protectedThis = weakThis;
         if (!protectedThis)
             return;
 
@@ -1837,7 +1839,7 @@ void ResourceLoadStatisticsStore::grantStorageAccess(SubFrameDomain&& subFrameDo
     auto transactionScope = beginTransactionIfNecessary();
 
     auto addGrant = [weakThis = WeakPtr { *this }, frameID, pageID, promptWasShown, scope] (SubFrameDomain&& subFrameDomain, TopFrameDomain&& topFrameDomain, CanRequestStorageAccessWithoutUserInteraction canRequestStorageAccessWithoutUserInteraction, CompletionHandler<void(StorageAccessWasGranted)>&& completionHandler) mutable {
-        RefPtr protectedThis = weakThis.get();
+        RefPtr protectedThis = weakThis;
 
         if (!protectedThis)
             return completionHandler(StorageAccessWasGranted::No);
@@ -2216,7 +2218,7 @@ void ResourceLoadStatisticsStore::dumpResourceLoadStatistics(CompletionHandler<v
     ASSERT(!RunLoop::isMain());
     if (m_dataRecordsBeingRemoved) {
         m_dataRecordRemovalCompletionHandlers.append([weakThis = WeakPtr { *this }, completionHandler = WTF::move(completionHandler)]() mutable {
-            RefPtr protectedThis = weakThis.get();
+            RefPtr protectedThis = weakThis;
             if (protectedThis)
                 protectedThis->dumpResourceLoadStatistics(WTF::move(completionHandler));
             else
@@ -2748,12 +2750,13 @@ void ResourceLoadStatisticsStore::updateCookieBlocking(CompletionHandler<void()>
             store->statisticsQueue().dispatch([weakThis = WTF::move(weakThis), completionHandler = WTF::move(completionHandler)]() mutable {
                 completionHandler();
 
-                if (!weakThis)
+                RefPtr protectedThis = weakThis;
+                if (!protectedThis)
                     return;
 
-                if (weakThis->debugLoggingEnabled()) [[unlikely]] {
+                if (protectedThis->debugLoggingEnabled()) [[unlikely]] {
                     ITP_DEBUG_MODE_RELEASE_LOG("Done applying cross-site tracking restrictions.");
-                    weakThis->debugBroadcastConsoleMessage(MessageSource::ITPDebug, MessageLevel::Info, "[ITP] Done applying cross-site tracking restrictions."_s);
+                    protectedThis->debugBroadcastConsoleMessage(MessageSource::ITPDebug, MessageLevel::Info, "[ITP] Done applying cross-site tracking restrictions."_s);
                 }
             });
         });
diff --git a/Source/WebKit/NetworkProcess/Downloads/PendingDownload.cpp b/Source/WebKit/NetworkProcess/Downloads/PendingDownload.cpp
index 6367e89b0156..4bb56b60d9d2 100644
--- a/Source/WebKit/NetworkProcess/Downloads/PendingDownload.cpp
+++ b/Source/WebKit/NetworkProcess/Downloads/PendingDownload.cpp
@@ -53,8 +53,6 @@ PendingDownload::PendingDownload(IPC::Connection* parentProcessConnection, Netwo
     , m_fromDownloadAttribute(fromDownloadAttribute)
     , m_webProcessID(webProcessID)
 {
-    relaxAdoptionRequirement();
-
 #if ENABLE(CONTENT_FILTERING)
 #if HAVE(BROWSERENGINEKIT_WEBCONTENTFILTER) && !HAVE(WEBCONTENTRESTRICTIONS_PATH_SPI)
     WebParentalControlsURLFilter::setSharedParentalControlsURLFilterIfNecessary();
diff --git a/Source/WebKit/NetworkProcess/EarlyHintsResourceLoader.cpp b/Source/WebKit/NetworkProcess/EarlyHintsResourceLoader.cpp
deleted file mode 100644
index 10582922663c..000000000000
--- a/Source/WebKit/NetworkProcess/EarlyHintsResourceLoader.cpp
+++ /dev/null
@@ -1,160 +0,0 @@
-/*
- * Copyright (C) 2023-2025 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
- * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
- * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
- * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
- * THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "EarlyHintsResourceLoader.h"
-
-#include "MessageSenderInlines.h"
-#include "NetworkLoadParameters.h"
-#include "PreconnectTask.h"
-#include "WebPageMessages.h"
-#include <WebCore/ContentSecurityPolicy.h>
-#include <WebCore/HTTPStatusCodes.h>
-#include <WebCore/LinkHeader.h>
-#include <WebCore/ResourceLoaderOptions.h>
-#include <WebCore/ResourceRequest.h>
-#include <WebCore/ResourceResponse.h>
-#include <WebCore/StoredCredentialsPolicy.h>
-#include <wtf/TZoneMallocInlines.h>
-#include <wtf/text/MakeString.h>
-
-namespace WebKit {
-using namespace WebCore;
-
-WTF_MAKE_TZONE_ALLOCATED_IMPL(EarlyHintsResourceLoader);
-
-EarlyHintsResourceLoader::EarlyHintsResourceLoader(NetworkResourceLoader& loader)
-    : m_loader(&loader)
-{
-}
-
-EarlyHintsResourceLoader::~EarlyHintsResourceLoader() = default;
-
-void EarlyHintsResourceLoader::addConsoleMessage(MessageSource messageSource, MessageLevel messageLevel, const String& message, unsigned long)
-{
-    if (!m_loader)
-        return;
-
-    m_loader->send(Messages::WebPage::AddConsoleMessage { m_loader->frameID(), messageSource, messageLevel, message, m_loader->coreIdentifier() }, m_loader->pageID());
-}
-
-void EarlyHintsResourceLoader::enqueueSecurityPolicyViolationEvent(SecurityPolicyViolationEventInit&&)
-{
-}
-
-void EarlyHintsResourceLoader::handleEarlyHintsResponse(ResourceResponse&& response)
-{
-    RELEASE_ASSERT(response.httpStatusCode() == httpStatus103EarlyHints);
-
-    if (!m_loader)
-        return;
-
-    // For consistency with other browsers, only process early hints for top-level navigation from
-    // secure origins using HTTP/2 or later.
-    if (!m_loader->isMainFrameLoad() || response.url().protocol() != "https"_s || response.httpVersion().startsWith("HTTP/1"_s))
-        return;
-
-    // Only the first early hint response served during the navigation is handled.
-    // FIXME: discard hints on cross-origin redirect once we support early hint preloads.
-    if (m_hasReceivedEarlyHints)
-        return;
-    m_hasReceivedEarlyHints = true;
-
-    auto headerValue = response.httpHeaderField(HTTPHeaderName::Link);
-    if (headerValue.isEmpty())
-        return;
-
-    auto url = response.url();
-    ContentSecurityPolicy contentSecurityPolicy { URL { url }, this, nullptr };
-    contentSecurityPolicy.didReceiveHeaders(ContentSecurityPolicyResponseHeaders { response }, m_loader->originalRequest().httpReferrer());
-
-    LinkHeaderSet headerSet(headerValue);
-    for (const auto& header : headerSet) {
-        if (!header.valid() || header.url().isEmpty() || header.rel().isEmpty() || header.isViewportDependent())
-            continue;
-
-        if (equalLettersIgnoringASCIICase(header.rel(), "preconnect"_s))
-            startPreconnectTask(response.url(), header, contentSecurityPolicy);
-    }
-}
-
-ResourceRequest EarlyHintsResourceLoader::constructPreconnectRequest(const ResourceRequest& originalRequest, const URL& url)
-{
-    ResourceRequest request { URL { url } };
-
-    // firstPartyForCookies and user agent are part of the HTTP socket pool keys in CFNetwork: rdar://59434166
-    auto firstPartyForCookies = originalRequest.firstPartyForCookies();
-    if (firstPartyForCookies.isValid())
-        request.setFirstPartyForCookies(firstPartyForCookies);
-
-    auto userAgent = originalRequest.httpUserAgent();
-    if (!userAgent.isEmpty())
-        request.setHTTPUserAgent(userAgent);
-
-    return request;
-}
-
-void EarlyHintsResourceLoader::startPreconnectTask(const URL& baseURL, const LinkHeader& header, const ContentSecurityPolicy& contentSecurityPolicy)
-{
-#if ENABLE(SERVER_PRECONNECT)
-    RefPtr loader = m_loader.get();
-    if (!loader || !loader->parameters().linkPreconnectEarlyHintsEnabled)
-        return;
-
-    URL url(baseURL, header.url());
-    if (!url.isValid() || url.protocol() != "https"_s)
-        return;
-
-    const auto& originalRequest = loader->originalRequest();
-    if (!contentSecurityPolicy.allowConnectToSource(url, { }, ContentSecurityPolicy::RedirectResponseReceived::No, originalRequest.url()))
-        return;
-
-    CheckedPtr networkSession = protect(loader->connectionToWebProcess())->networkSession();
-    if (!networkSession)
-        return;
-
-    NetworkLoadParameters parameters;
-    auto globalFrameID = m_loader->globalFrameID();
-    parameters.webPageProxyID = globalFrameID.webPageProxyID;
-    parameters.webPageID = globalFrameID.webPageID;
-    parameters.webFrameID = globalFrameID.frameID;
-    parameters.storedCredentialsPolicy = equalLettersIgnoringASCIICase(header.crossOrigin(), "anonymous"_s) ? StoredCredentialsPolicy::DoNotUse : StoredCredentialsPolicy::Use;
-    parameters.contentSniffingPolicy = ContentSniffingPolicy::DoNotSniffContent;
-    parameters.contentEncodingSniffingPolicy = ContentEncodingSniffingPolicy::Default;
-    parameters.shouldPreconnectOnly = PreconnectOnly::Yes;
-    parameters.request = constructPreconnectRequest(originalRequest, url);
-    parameters.isNavigatingToAppBoundDomain = m_loader->parameters().isNavigatingToAppBoundDomain;
-    Ref preconnectTask = PreconnectTask::create(*networkSession, WTF::move(parameters));
-    preconnectTask->start();
-
-    addConsoleMessage(MessageSource::Network, MessageLevel::Info, makeString("Preconnecting to "_s, url.string(), " due to early hint"_s));
-#else
-    UNUSED_PARAM(baseURL);
-    UNUSED_PARAM(header);
-    UNUSED_PARAM(contentSecurityPolicy);
-#endif
-}
-
-} // namespace WebKit
diff --git a/Source/WebKit/NetworkProcess/NetworkCORSPreflightChecker.cpp b/Source/WebKit/NetworkProcess/NetworkCORSPreflightChecker.cpp
index 72a7b594b7c0..601a038c8b5f 100644
--- a/Source/WebKit/NetworkProcess/NetworkCORSPreflightChecker.cpp
+++ b/Source/WebKit/NetworkProcess/NetworkCORSPreflightChecker.cpp
@@ -71,7 +71,7 @@ void NetworkCORSPreflightChecker::startPreflight()
     CORS_CHECKER_RELEASE_LOG("startPreflight");
 
     NetworkLoadParameters loadParameters;
-    loadParameters.request = createAccessControlPreflightRequest(m_parameters.originalRequest, m_parameters.sourceOrigin, m_parameters.referrer, m_parameters.includeFetchMetadata);
+    loadParameters.request = createAccessControlPreflightRequest(m_parameters.originalRequest, protect(m_parameters.sourceOrigin), m_parameters.referrer, m_parameters.includeFetchMetadata);
     loadParameters.advancedPrivacyProtections = m_parameters.advancedPrivacyProtections;
     if (!m_parameters.userAgent.isNull())
         loadParameters.request.setHTTPHeaderField(HTTPHeaderName::UserAgent, m_parameters.userAgent);
@@ -168,7 +168,7 @@ void NetworkCORSPreflightChecker::completePreflight(ResourceError&& preflightErr
 
     CORS_CHECKER_RELEASE_LOG("didComplete http_status_code=%d", m_response.httpStatusCode());
 
-    auto result = validatePreflightResponse(m_parameters.sessionID, m_parameters.originalRequest, m_response, m_parameters.storedCredentialsPolicy, m_parameters.topOrigin, m_parameters.sourceOrigin, m_networkResourceLoader.get());
+    auto result = validatePreflightResponse(m_parameters.sessionID, m_parameters.originalRequest, m_response, m_parameters.storedCredentialsPolicy, protect(m_parameters.topOrigin), protect(m_parameters.sourceOrigin), m_networkResourceLoader);
     if (!result) {
         CORS_CHECKER_RELEASE_LOG("didComplete, AccessControl error: %s", result.error().utf8().data());
         m_completionCallback(ResourceError { errorDomainWebKitInternal, 0, m_parameters.originalRequest.url(), result.error(), ResourceError::Type::AccessControl });
diff --git a/Source/WebKit/NetworkProcess/NetworkContentRuleListManager.cpp b/Source/WebKit/NetworkProcess/NetworkContentRuleListManager.cpp
index be11b2a38a23..a61c53814ff3 100644
--- a/Source/WebKit/NetworkProcess/NetworkContentRuleListManager.cpp
+++ b/Source/WebKit/NetworkProcess/NetworkContentRuleListManager.cpp
@@ -73,7 +73,7 @@ void NetworkContentRuleListManager::contentExtensionsBackend(UserContentControll
     m_pendingCallbacks.ensure(identifier, [] {
         return Vector<BackendCallback> { };
     }).iterator->value.append(WTF::move(callback));
-    m_networkProcess->parentProcessConnection()->send(Messages::NetworkProcessProxy::ContentExtensionRules { identifier }, 0);
+    protect(m_networkProcess->parentProcessConnection())->send(Messages::NetworkProcessProxy::ContentExtensionRules { identifier }, 0);
 }
 
 void NetworkContentRuleListManager::addContentRuleLists(UserContentControllerIdentifier identifier, Vector<std::pair<WebCompiledContentRuleListData, URL>>&& contentRuleLists)
diff --git a/Source/WebKit/NetworkProcess/NetworkLoad.cpp b/Source/WebKit/NetworkProcess/NetworkLoad.cpp
index 8e162807dd86..6b9500387c7b 100644
--- a/Source/WebKit/NetworkProcess/NetworkLoad.cpp
+++ b/Source/WebKit/NetworkProcess/NetworkLoad.cpp
@@ -56,7 +56,6 @@ NetworkLoad::NetworkLoad(NetworkLoadClient& client, NetworkLoadParameters&& para
     , m_parameters(WTF::move(parameters))
     , m_currentRequest(m_parameters.request)
 {
-    relaxAdoptionRequirement();
     if (m_parameters.request.url().protocolIsBlob())
         m_task = NetworkDataTaskBlob::create(networkSession, *this, m_parameters.request, m_parameters.blobFileReferences, m_parameters.topOrigin);
     else
@@ -268,8 +267,8 @@ void NetworkLoad::didReceiveResponse(ResourceResponse&& response, NegotiatedLega
 {
     ASSERT(RunLoop::isMain());
 
-    if (m_task && m_task->isDownload()) {
-        m_networkProcess->findPendingDownloadLocation(*m_task.get(), WTF::move(completionHandler), response);
+    if (RefPtr task = m_task; task && task->isDownload()) {
+        m_networkProcess->findPendingDownloadLocation(*task, WTF::move(completionHandler), response);
         return;
     }
 
@@ -383,7 +382,7 @@ void NetworkLoad::setTimingAllowFailedFlag()
 
 String NetworkLoad::attributedBundleIdentifier(WebPageProxyIdentifier pageID)
 {
-    if (auto* task = m_task.get())
+    if (RefPtr task = m_task)
         return task->attributedBundleIdentifier(pageID);
     return { };
 }
diff --git a/Source/WebKit/NetworkProcess/NetworkLoadChecker.cpp b/Source/WebKit/NetworkProcess/NetworkLoadChecker.cpp
index da0e3ca7f431..d450d3afbe36 100644
--- a/Source/WebKit/NetworkProcess/NetworkLoadChecker.cpp
+++ b/Source/WebKit/NetworkProcess/NetworkLoadChecker.cpp
@@ -81,7 +81,7 @@ NetworkLoadChecker::NetworkLoadChecker(NetworkProcess& networkProcess, NetworkRe
     if (m_requestLoadType == LoadType::MainFrame)
         m_origin = m_topOrigin;
 
-    m_isSameOriginRequest = isSameOrigin(m_url, m_origin.get());
+    m_isSameOriginRequest = isSameOrigin(m_url, protect(m_origin));
     switch (options.credentials) {
     case FetchOptions::Credentials::Include:
         m_storedCredentialsPolicy = StoredCredentialsPolicy::Use;
@@ -150,7 +150,7 @@ void NetworkLoadChecker::checkRedirection(ResourceRequest&& request, ResourceReq
     // FIXME: We should check that redirections are only HTTP(s) as per fetch spec.
     // See https://github.com/whatwg/fetch/issues/393
 
-    if (m_options.mode == FetchOptions::Mode::Cors && (!m_isSameOriginRequest || !isSameOrigin(request.url(), m_origin.get()))) {
+    if (m_options.mode == FetchOptions::Mode::Cors && (!m_isSameOriginRequest || !isSameOrigin(request.url(), protect(m_origin)))) {
         auto location = URL(redirectResponse.url(), redirectResponse.httpHeaderField(HTTPHeaderName::Location));
         if (m_schemeRegistry && !m_schemeRegistry->shouldTreatURLSchemeAsCORSEnabled(location.protocol())) {
             handler(redirectionError(redirectResponse, makeString("Cross-origin redirection to "_s, redirectRequest.url().string(), " denied by Cross-Origin Resource Sharing policy: not allowed to follow a cross-origin CORS redirection with non CORS scheme"_s)));
@@ -475,7 +475,7 @@ void NetworkLoadChecker::continueCheckingRequest(ResourceRequest&& request, Vali
     if (m_options.credentials == FetchOptions::Credentials::SameOrigin)
         m_storedCredentialsPolicy = m_isSameOriginRequest && protect(origin())->canRequest(request.url(), originAccessPatterns()) ? StoredCredentialsPolicy::Use : StoredCredentialsPolicy::DoNotUse;
 
-    m_isSameOriginRequest = m_isSameOriginRequest && isSameOrigin(request.url(), m_origin.get());
+    m_isSameOriginRequest = m_isSameOriginRequest && isSameOrigin(request.url(), protect(m_origin));
 
     if (doesNotNeedCORSCheck(request.url())) {
         handler(WTF::move(request));
diff --git a/Source/WebKit/NetworkProcess/NetworkProcess.cpp b/Source/WebKit/NetworkProcess/NetworkProcess.cpp
index e203541244e7..7eb3a0d16a87 100644
--- a/Source/WebKit/NetworkProcess/NetworkProcess.cpp
+++ b/Source/WebKit/NetworkProcess/NetworkProcess.cpp
@@ -1297,7 +1297,7 @@ void NetworkProcess::hasLocalStorageOrCookies(PAL::SessionID sessionID, const Re
             return completionHandler(true);
 
         if (session) {
-            session->storageManager().fetchData({ WebsiteDataType::LocalStorage }, NetworkStorageManager::ShouldComputeSize::No, [domain, completionHandler = WTF::move(completionHandler)](auto entries) mutable {
+            protect(session->storageManager())->fetchData({ WebsiteDataType::LocalStorage }, NetworkStorageManager::ShouldComputeSize::No, [domain, completionHandler = WTF::move(completionHandler)](auto entries) mutable {
                 completionHandler(std::ranges::any_of(entries, [&domain](auto& entry) {
                     return domain.matches(entry.origin);
                 }));
diff --git a/Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp b/Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp
index 9831ee4993a5..c1334cfba500 100644
--- a/Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp
+++ b/Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2012-2026 Apple Inc. All rights reserved.
+ * Copyright (C) 2026 Shopify Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,7 +28,6 @@
 #include "NetworkResourceLoader.h"
 
 #include "ArgumentCoders.h"
-#include "EarlyHintsResourceLoader.h"
 #include "FormDataReference.h"
 #include "LoadedWebArchive.h"
 #include "Logging.h"
@@ -38,6 +38,7 @@
 #include "NetworkConnectionToWebProcessMessages.h"
 #include "NetworkLoad.h"
 #include "NetworkLoadChecker.h"
+#include "NetworkLoadParameters.h"
 #include "NetworkOriginAccessPatterns.h"
 #include "NetworkProcess.h"
 #include "NetworkProcessConnectionMessages.h"
@@ -45,6 +46,7 @@
 #include "NetworkSchemeRegistry.h"
 #include "NetworkSession.h"
 #include "NetworkStorageManager.h"
+#include "PreconnectTask.h"
 #include "PrivateRelayed.h"
 #include "QualifiedServerTrustFetch.h"
 #include "ResourceLoadInfo.h"
@@ -79,6 +81,7 @@
 #include <WebCore/PendingStreamState.h>
 #include <WebCore/RegistrableDomain.h>
 #include <WebCore/ReportingScope.h>
+#include <WebCore/ResourceLoaderOptions.h>
 #include <WebCore/SWServer.h>
 #include <WebCore/SameSiteInfo.h>
 #include <WebCore/SecurityOrigin.h>
@@ -953,12 +956,94 @@ static BrowsingContextGroupSwitchDecision NODELETE toBrowsingContextGroupSwitchD
 
 void NetworkResourceLoader::didReceiveInformationalResponse(ResourceResponse&& response)
 {
-    if (response.httpStatusCode() != httpStatus103EarlyHints)
+    if (response.httpStatusCode() == httpStatus103EarlyHints)
+        handleEarlyHintsResponse(WTF::move(response));
+}
+
+void NetworkResourceLoader::handleEarlyHintsResponse(ResourceResponse&& response)
+{
+    // For consistency with other browsers, only process early hints for top-level navigation from
+    // secure origins using HTTP/2 or later.
+    if (!isMainFrameLoad() || response.url().protocol() != "https"_s || response.httpVersion().startsWith("HTTP/1"_s))
+        return;
+
+    // Only the first early hint response served during the navigation is handled.
+    // FIXME: discard hints on cross-origin redirect once we support early hint preloads.
+    if (m_hasReceivedEarlyHints)
         return;
+    m_hasReceivedEarlyHints = true;
+
+    auto headerValue = response.httpHeaderField(HTTPHeaderName::Link);
+    if (headerValue.isEmpty())
+        return;
+
+    auto url = response.url();
+    ContentSecurityPolicy contentSecurityPolicy { URL { url }, this, nullptr };
+    contentSecurityPolicy.didReceiveHeaders(ContentSecurityPolicyResponseHeaders { response }, originalRequest().httpReferrer());
+
+    LinkHeaderSet headerSet(headerValue);
+    for (const auto& header : headerSet) {
+        if (!header.valid() || header.url().isEmpty() || header.rel().isEmpty() || header.isViewportDependent())
+            continue;
+
+        if (equalLettersIgnoringASCIICase(header.rel(), "preconnect"_s))
+            startPreconnectTask(url, header, contentSecurityPolicy);
+    }
+}
 
-    if (!m_earlyHintsResourceLoader)
-        m_earlyHintsResourceLoader = WTF::makeUnique<EarlyHintsResourceLoader>(*this);
-    m_earlyHintsResourceLoader->handleEarlyHintsResponse(WTF::move(response));
+ResourceRequest NetworkResourceLoader::constructPreconnectRequest(const ResourceRequest& originalRequest, const URL& url)
+{
+    ResourceRequest request { URL { url } };
+
+    // firstPartyForCookies and user agent are part of the HTTP socket pool keys in CFNetwork: rdar://59434166
+    auto firstPartyForCookies = originalRequest.firstPartyForCookies();
+    if (firstPartyForCookies.isValid())
+        request.setFirstPartyForCookies(firstPartyForCookies);
+
+    auto userAgent = originalRequest.httpUserAgent();
+    if (!userAgent.isEmpty())
+        request.setHTTPUserAgent(userAgent);
+
+    return request;
+}
+
+void NetworkResourceLoader::startPreconnectTask(const URL& baseURL, const LinkHeader& header, const ContentSecurityPolicy& contentSecurityPolicy)
+{
+#if ENABLE(SERVER_PRECONNECT)
+    if (!parameters().linkPreconnectEarlyHintsEnabled)
+        return;
+
+    URL url(baseURL, header.url());
+    if (!url.isValid() || url.protocol() != "https"_s)
+        return;
+
+    if (!contentSecurityPolicy.allowConnectToSource(url, { }, ContentSecurityPolicy::RedirectResponseReceived::No, originalRequest().url()))
+        return;
+
+    CheckedPtr networkSession = protect(connectionToWebProcess())->networkSession();
+    if (!networkSession)
+        return;
+
+    NetworkLoadParameters parameters;
+    auto globalFrameID = this->globalFrameID();
+    parameters.webPageProxyID = globalFrameID.webPageProxyID;
+    parameters.webPageID = globalFrameID.webPageID;
+    parameters.webFrameID = globalFrameID.frameID;
+    parameters.storedCredentialsPolicy = equalLettersIgnoringASCIICase(header.crossOrigin(), "anonymous"_s) ? StoredCredentialsPolicy::DoNotUse : StoredCredentialsPolicy::Use;
+    parameters.contentSniffingPolicy = ContentSniffingPolicy::DoNotSniffContent;
+    parameters.contentEncodingSniffingPolicy = ContentEncodingSniffingPolicy::Default;
+    parameters.shouldPreconnectOnly = PreconnectOnly::Yes;
+    parameters.request = constructPreconnectRequest(originalRequest(), url);
+    parameters.isNavigatingToAppBoundDomain = this->parameters().isNavigatingToAppBoundDomain;
+    Ref preconnectTask = PreconnectTask::create(*networkSession, WTF::move(parameters));
+    preconnectTask->start();
+
+    addConsoleMessage(MessageSource::Network, MessageLevel::Info, makeString("Preconnecting to "_s, url.string(), " due to early hint"_s));
+#else
+    UNUSED_PARAM(baseURL);
+    UNUSED_PARAM(header);
+    UNUSED_PARAM(contentSecurityPolicy);
+#endif
 }
 
 void NetworkResourceLoader::didReceiveResponse(ResourceResponse&& receivedResponse, PrivateRelayed privateRelayed, ResponseCompletionHandler&& completionHandler)
diff --git a/Source/WebKit/NetworkProcess/NetworkResourceLoader.h b/Source/WebKit/NetworkProcess/NetworkResourceLoader.h
index 225f8e00ac3f..50b5410d918b 100644
--- a/Source/WebKit/NetworkProcess/NetworkResourceLoader.h
+++ b/Source/WebKit/NetworkProcess/NetworkResourceLoader.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2012-2026 Apple Inc. All rights reserved.
+ * Copyright (C) 2026 Shopify Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -59,6 +60,7 @@ class SharedBufferReference;
 namespace WebCore {
 class BlobDataFileReference;
 class ContentFilter;
+class ContentSecurityPolicy;
 class FormData;
 class LinkHeader;
 class NetworkStorageSession;
@@ -69,7 +71,6 @@ class ResourceRequest;
 
 namespace WebKit {
 
-class EarlyHintsResourceLoader;
 class NetworkConnectionToWebProcess;
 class NetworkLoad;
 class NetworkLoadChecker;
@@ -293,6 +294,11 @@ class NetworkResourceLoader final
     void addConsoleMessage(MessageSource, MessageLevel, const String&, unsigned long requestIdentifier = 0) final;
     void enqueueSecurityPolicyViolationEvent(WebCore::SecurityPolicyViolationEventInit&&) final;
 
+    // HTTP 103 Early Hints.
+    void handleEarlyHintsResponse(WebCore::ResourceResponse&&);
+    WebCore::ResourceRequest constructPreconnectRequest(const WebCore::ResourceRequest&, const URL&);
+    void startPreconnectTask(const URL& baseURL, const WebCore::LinkHeader&, const WebCore::ContentSecurityPolicy&);
+
     void logSlowCacheRetrieveIfNeeded(const NetworkCache::Cache::RetrieveInfo&);
 
     std::optional<Seconds> validateCacheEntryForMaxAgeCapValidation(const WebCore::ResourceRequest&, const WebCore::ResourceRequest& redirectRequest, const WebCore::ResourceResponse&);
@@ -398,7 +404,7 @@ class NetworkResourceLoader final
 
     bool m_shouldCaptureExtraNetworkLoadMetrics { false };
     bool m_isKeptAlive { false };
-    std::unique_ptr<EarlyHintsResourceLoader> m_earlyHintsResourceLoader;
+    bool m_hasReceivedEarlyHints { false };
 
     std::optional<NetworkActivityTracker> m_networkActivityTracker;
     RefPtr<ServiceWorkerFetchTask> m_serviceWorkerFetchTask;
diff --git a/Source/WebKit/NetworkProcess/NetworkSocketChannel.cpp b/Source/WebKit/NetworkProcess/NetworkSocketChannel.cpp
index 8b62f5edfcbc..2f7ef5bda164 100644
--- a/Source/WebKit/NetworkProcess/NetworkSocketChannel.cpp
+++ b/Source/WebKit/NetworkProcess/NetworkSocketChannel.cpp
@@ -60,7 +60,6 @@ NetworkSocketChannel::NetworkSocketChannel(NetworkConnectionToWebProcess& connec
     , m_errorTimer(*this, &NetworkSocketChannel::sendDelayedError)
     , m_webPageProxyID(webPageProxyID)
 {
-    relaxAdoptionRequirement();
     if (!session)
         return;
 
diff --git a/Source/WebKit/NetworkProcess/PrivateClickMeasurement/PrivateClickMeasurementManager.cpp b/Source/WebKit/NetworkProcess/PrivateClickMeasurement/PrivateClickMeasurementManager.cpp
index 07a74be50f76..c4ba4ad8b602 100644
--- a/Source/WebKit/NetworkProcess/PrivateClickMeasurement/PrivateClickMeasurementManager.cpp
+++ b/Source/WebKit/NetworkProcess/PrivateClickMeasurement/PrivateClickMeasurementManager.cpp
@@ -154,7 +154,7 @@ void PrivateClickMeasurementManager::getTokenPublicKey(PrivateClickMeasurement&&
     m_client->broadcastConsoleMessage(MessageLevel::Log, "[Private Click Measurement] About to fire a token public key request."_s);
 
     PCM::NetworkLoader::start(WTF::move(tokenPublicKeyURL), nullptr, pcmDataCarried, m_applicationBundleIdentifier, [weakThis = WeakPtr { *this }, attribution = WTF::move(attribution), callback = WTF::move(callback)] (auto& errorDescription, auto& jsonObject) mutable {
-        WeakPtr protectedThis = weakThis.get();
+        RefPtr protectedThis = weakThis;
         if (!protectedThis)
             return;
 
@@ -273,7 +273,7 @@ void PrivateClickMeasurementManager::getSignedUnlinkableTokenForSource(PrivateCl
     m_client->broadcastConsoleMessage(MessageLevel::Log, "[Private Click Measurement] About to fire a unlinkable token signing request for the click source."_s);
 
     PCM::NetworkLoader::start(WTF::move(tokenSignatureURL), measurement.tokenSignatureJSON(), pcmDataCarried, m_applicationBundleIdentifier, [weakThis = WeakPtr { *this }, measurement = WTF::move(measurement)] (auto& errorDescription, auto& jsonObject) mutable {
-        WeakPtr protectedThis = weakThis.get();
+        RefPtr protectedThis = weakThis;
         if (!protectedThis)
             return;
 
@@ -401,7 +401,7 @@ void PrivateClickMeasurementManager::handleAttribution(AttributionTriggerData&&
         auto attributionTriggerDataCopy = attributionTriggerData;
         // This is guaranteed to be close in time to the triggering event which makes it likely to be personally identifiable.
         getTokenPublicKey(WTF::move(attributionTriggerDataCopy), WebCore::PCM::AttributionReportEndpoint::Destination, PrivateClickMeasurement::PcmDataCarried::PersonallyIdentifiable, [weakThis = WeakPtr { *this }, sourceSite = SourceSite { WTF::move(sourceDomain) }, destinationSite = AttributionDestinationSite { firstPartyURL }, applicationBundleIdentifier = applicationBundleIdentifier.isolatedCopy()] (AttributionTriggerData&& attributionTriggerData, const String& publicKeyBase64URL) mutable {
-            WeakPtr protectedThis = weakThis.get();
+            RefPtr protectedThis = weakThis;
             if (!protectedThis)
                 return;
 
@@ -464,7 +464,7 @@ void PrivateClickMeasurementManager::attribute(SourceSite&& sourceSite, Attribut
         return;
 
     protect(store())->attributePrivateClickMeasurement(WTF::move(sourceSite), WTF::move(destinationSite), applicationBundleIdentifier, WTF::move(attributionTriggerData), m_isRunningTest ? WebCore::PrivateClickMeasurement::IsRunningLayoutTest::Yes : WebCore::PrivateClickMeasurement::IsRunningLayoutTest::No, [weakThis = WeakPtr { *this }] (auto attributionSecondsUntilSendData, auto debugInfo) {
-        WeakPtr protectedThis = weakThis.get();
+        RefPtr protectedThis = weakThis;
         if (!protectedThis)
             return;
         
diff --git a/Source/WebKit/NetworkProcess/ServiceWorker/ServiceWorkerFetchTask.cpp b/Source/WebKit/NetworkProcess/ServiceWorker/ServiceWorkerFetchTask.cpp
index 991fd1cc5146..ff5eac39d792 100644
--- a/Source/WebKit/NetworkProcess/ServiceWorker/ServiceWorkerFetchTask.cpp
+++ b/Source/WebKit/NetworkProcess/ServiceWorker/ServiceWorkerFetchTask.cpp
@@ -177,7 +177,7 @@ RefPtr<IPC::Connection> ServiceWorkerFetchTask::serviceWorkerConnection()
 template<typename Message> bool ServiceWorkerFetchTask::sendToClient(Message&& message)
 {
     Ref loader = *m_loader;
-    return loader->connectionToWebProcess().connection().send(std::forward<Message>(message), loader->coreIdentifier()) == IPC::Error::NoError;
+    return protect(loader->connectionToWebProcess().connection())->send(std::forward<Message>(message), loader->coreIdentifier()) == IPC::Error::NoError;
 }
 
 void ServiceWorkerFetchTask::start(WebSWServerToContextConnection& serviceWorkerConnection)
diff --git a/Source/WebKit/NetworkProcess/ServiceWorker/ServiceWorkerNavigationPreloader.cpp b/Source/WebKit/NetworkProcess/ServiceWorker/ServiceWorkerNavigationPreloader.cpp
index 4bb01a98b2ab..c9e8bb89f1a2 100644
--- a/Source/WebKit/NetworkProcess/ServiceWorker/ServiceWorkerNavigationPreloader.cpp
+++ b/Source/WebKit/NetworkProcess/ServiceWorker/ServiceWorkerNavigationPreloader.cpp
@@ -54,7 +54,6 @@ ServiceWorkerNavigationPreloader::ServiceWorkerNavigationPreloader(NetworkSessio
     , m_shouldCaptureExtraNetworkLoadMetrics(shouldCaptureExtraNetworkLoadMetrics)
     , m_startTime(MonotonicTime::now())
 {
-    relaxAdoptionRequirement();
     RELEASE_LOG(ServiceWorker, "ServiceWorkerNavigationPreloader::ServiceWorkerNavigationPreloader %p", this);
     start();
 }
diff --git a/Source/WebKit/NetworkProcess/ServiceWorker/ServiceWorkerSoftUpdateLoader.cpp b/Source/WebKit/NetworkProcess/ServiceWorker/ServiceWorkerSoftUpdateLoader.cpp
index f6631cb13e7e..bb712efc6a26 100644
--- a/Source/WebKit/NetworkProcess/ServiceWorker/ServiceWorkerSoftUpdateLoader.cpp
+++ b/Source/WebKit/NetworkProcess/ServiceWorker/ServiceWorkerSoftUpdateLoader.cpp
@@ -54,7 +54,6 @@ ServiceWorkerSoftUpdateLoader::ServiceWorkerSoftUpdateLoader(NetworkSession& ses
     , m_jobData(WTF::move(jobData))
     , m_session(session)
 {
-    relaxAdoptionRequirement();
     ASSERT(!request.isConditional());
 
     if (RefPtr cache = session.cache()) {
diff --git a/Source/WebKit/NetworkProcess/ServiceWorker/WebSWServerToContextConnection.cpp b/Source/WebKit/NetworkProcess/ServiceWorker/WebSWServerToContextConnection.cpp
index 1b3dfb257c42..d46328da5251 100644
--- a/Source/WebKit/NetworkProcess/ServiceWorker/WebSWServerToContextConnection.cpp
+++ b/Source/WebKit/NetworkProcess/ServiceWorker/WebSWServerToContextConnection.cpp
@@ -420,7 +420,7 @@ void WebSWServerToContextConnection::startPendingStreamUploadForwarding(WebCore:
 
     m_requestPendingStreamStates.add(fetchIdentifier, *state);
 
-    loader->connectionToWebProcess().connection().send(Messages::WebResourceLoader::ServiceWorkerPendingStreamForwardingNeedData { }, loader->coreIdentifier());
+    protect(loader->connectionToWebProcess().connection())->send(Messages::WebResourceLoader::ServiceWorkerPendingStreamForwardingNeedData { }, loader->coreIdentifier());
 
     state->setDataAvailableHandler([weakThis = WeakPtr { *this }, fetchIdentifier] {
         if (RefPtr protectedThis = weakThis)
@@ -474,7 +474,7 @@ void WebSWServerToContextConnection::pendingStreamUploadNeedData(WebCore::FetchI
     RefPtr loader = fetch->loader();
     if (!loader)
         return;
-    loader->connectionToWebProcess().connection().send(Messages::WebResourceLoader::ServiceWorkerPendingStreamForwardingNeedData { }, loader->coreIdentifier());
+    protect(loader->connectionToWebProcess().connection())->send(Messages::WebResourceLoader::ServiceWorkerPendingStreamForwardingNeedData { }, loader->coreIdentifier());
 }
 
 void WebSWServerToContextConnection::didReceiveFetchTaskMessage(IPC::Connection& connection, IPC::Decoder& decoder)
diff --git a/Source/WebKit/NetworkProcess/SharedWorker/WebSharedWorkerServerToContextConnection.cpp b/Source/WebKit/NetworkProcess/SharedWorker/WebSharedWorkerServerToContextConnection.cpp
index a5b8d6c3cfb5..68c5d14b3a73 100644
--- a/Source/WebKit/NetworkProcess/SharedWorker/WebSharedWorkerServerToContextConnection.cpp
+++ b/Source/WebKit/NetworkProcess/SharedWorker/WebSharedWorkerServerToContextConnection.cpp
@@ -65,7 +65,6 @@ WebSharedWorkerServerToContextConnection::WebSharedWorkerServerToContextConnecti
     , m_crossOriginEmbedderPolicyValue(crossOriginEmbedderPolicy)
 {
     CONTEXT_CONNECTION_RELEASE_LOG("WebSharedWorkerServerToContextConnection:");
-    relaxAdoptionRequirement();
     server.addContextConnection(*this);
 }
 
diff --git a/Source/WebKit/NetworkProcess/cache/NetworkCache.cpp b/Source/WebKit/NetworkProcess/cache/NetworkCache.cpp
index 8cd0098870c2..bf0d6c9fb81f 100644
--- a/Source/WebKit/NetworkProcess/cache/NetworkCache.cpp
+++ b/Source/WebKit/NetworkProcess/cache/NetworkCache.cpp
@@ -614,6 +614,7 @@ std::unique_ptr<Entry> Cache::update(const WebCore::ResourceRequest& originalReq
 
     WebCore::ResourceResponse response = existingEntry.response();
     WebCore::updateResponseHeadersAfterRevalidation(response, validatingResponse);
+    response.setIPAddressSpace(validatingResponse.ipAddressSpace());
 
     auto updateEntry = makeUnique<Entry>(existingEntry.key(), response, privateRelayed, existingEntry.buffer(), WebCore::collectVaryingRequestHeaders(protect(m_networkProcess->storageSession(m_sessionID)), originalRequest, response));
     auto updateRecord = updateEntry->encodeAsStorageRecord();
diff --git a/Source/WebKit/NetworkProcess/cache/NetworkCacheSpeculativeLoadManager.cpp b/Source/WebKit/NetworkProcess/cache/NetworkCacheSpeculativeLoadManager.cpp
index 5ec9f094f620..43b1d43ceb58 100644
--- a/Source/WebKit/NetworkProcess/cache/NetworkCacheSpeculativeLoadManager.cpp
+++ b/Source/WebKit/NetworkProcess/cache/NetworkCacheSpeculativeLoadManager.cpp
@@ -231,7 +231,6 @@ class SpeculativeLoadManager::PendingFrameLoad : public RefCountedAndCanMakeWeak
                 protectedThis->markLoadAsCompleted();
         })
     {
-        relaxAdoptionRequirement();
         m_loadHysteresisActivity.impulse();
     }
 
diff --git a/Source/WebKit/NetworkProcess/cache/NetworkCacheStorage.h b/Source/WebKit/NetworkProcess/cache/NetworkCacheStorage.h
index 1a5c9fa10b6f..94ebb4052823 100644
--- a/Source/WebKit/NetworkProcess/cache/NetworkCacheStorage.h
+++ b/Source/WebKit/NetworkProcess/cache/NetworkCacheStorage.h
@@ -131,7 +131,7 @@ class Storage : public ThreadSafeRefCountedAndCanMakeThreadSafeWeakPtr<Storage,
     size_t NODELETE approximateSize() const;
 
     // Incrementing this number will delete all existing cache content for everyone. Do you really need to do it?
-    static const unsigned version = 17;
+    static const unsigned version = 18;
 
     String basePathIsolatedCopy() const;
     String versionPath() const;
diff --git a/Source/WebKit/NetworkProcess/cocoa/NetworkSessionCocoa.h b/Source/WebKit/NetworkProcess/cocoa/NetworkSessionCocoa.h
index 87af48c0ab1a..1940c88f55db 100644
--- a/Source/WebKit/NetworkProcess/cocoa/NetworkSessionCocoa.h
+++ b/Source/WebKit/NetworkProcess/cocoa/NetworkSessionCocoa.h
@@ -210,7 +210,7 @@ class NetworkSessionCocoa final : public NetworkSession {
 
     bool isNetworkSessionCocoa() const final { return true; }
 
-    Ref<SessionSet> m_defaultSessionSet;
+    const Ref<SessionSet> m_defaultSessionSet;
     HashMap<WebPageProxyIdentifier, Ref<SessionSet>> m_perPageSessionSets;
     HashMap<WebPageNetworkParameters, WeakPtr<SessionSet>> m_perParametersSessionSets;
 
diff --git a/Source/WebKit/NetworkProcess/cocoa/NetworkSessionCocoa.mm b/Source/WebKit/NetworkProcess/cocoa/NetworkSessionCocoa.mm
index 16b80e08c447..03ff867e547a 100644
--- a/Source/WebKit/NetworkProcess/cocoa/NetworkSessionCocoa.mm
+++ b/Source/WebKit/NetworkProcess/cocoa/NetworkSessionCocoa.mm
@@ -1727,8 +1727,8 @@ - (void)URLSession:(NSURLSession *)session webSocketTask:(NSURLSessionWebSocketT
 void NetworkSessionCocoa::addWebPageNetworkParameters(WebPageProxyIdentifier pageID, WebPageNetworkParameters&& parameters)
 {
     auto addResult1 = m_perParametersSessionSets.add(parameters, nullptr);
-    if (auto set = addResult1.iterator->value) {
-        m_perPageSessionSets.add(pageID, *set);
+    if (RefPtr set = addResult1.iterator->value) {
+        m_perPageSessionSets.add(pageID, set.releaseNonNull());
         return;
     }
 
@@ -1738,7 +1738,7 @@ - (void)URLSession:(NSURLSession *)session webSocketTask:(NSURLSessionWebSocketT
 #if USE(APPLE_INTERNAL_SDK)
     configuration.get()._attributedBundleIdentifier = parameters.attributedBundleIdentifier().createNSString().get();
 #endif
-    initializeNSURLSessionsInSet(addResult2.iterator->value.get(), configuration.get());
+    initializeNSURLSessionsInSet(protect(addResult2.iterator->value), configuration.get());
     addResult1.iterator->value = addResult2.iterator->value.get();
 
     m_attributedBundleIdentifierFromPageIdentifiers.add(pageID, parameters.attributedBundleIdentifier());
@@ -2051,8 +2051,8 @@ void completeWithBlockedError()
     for (auto& set : m_perPageSessionSets.values())
         sessionSetFunction(set);
 
-    for (auto& set : m_perParametersSessionSets.values()) {
-        if (set)
+    for (auto& weakSet : m_perParametersSessionSets.values()) {
+        if (RefPtr set = weakSet)
             sessionSetFunction(*set);
     }
 }
diff --git a/Source/WebKit/NetworkProcess/cocoa/WebSocketTaskCocoa.mm b/Source/WebKit/NetworkProcess/cocoa/WebSocketTaskCocoa.mm
index 3ec71fa1e32d..2ddbcb1d18aa 100644
--- a/Source/WebKit/NetworkProcess/cocoa/WebSocketTaskCocoa.mm
+++ b/Source/WebKit/NetworkProcess/cocoa/WebSocketTaskCocoa.mm
@@ -49,7 +49,7 @@
 }
 
 WebSocketTask::WebSocketTask(NetworkSocketChannel& channel, WebPageProxyIdentifier webProxyPageID, std::optional<FrameIdentifier> frameID, std::optional<PageIdentifier> pageID, WeakPtr<SessionSet>&& sessionSet, const WebCore::ResourceRequest& request, const WebCore::ClientOrigin& clientOrigin, RetainPtr<NSURLSessionWebSocketTask>&& task, WebCore::StoredCredentialsPolicy storedCredentialsPolicy, WebCore::IsInitiatedByDedicatedWorker isInitiatedByDedicatedWorker)
-    : NetworkTaskCocoa(*channel.session())
+    : NetworkTaskCocoa(protect(*channel.session()))
     , m_channel(channel)
     , m_task(WTF::move(task))
     , m_webProxyPageID(webProxyPageID)
diff --git a/Source/WebKit/NetworkProcess/storage/BackgroundFetchStoreImpl.cpp b/Source/WebKit/NetworkProcess/storage/BackgroundFetchStoreImpl.cpp
index 630d04e72d34..811a4004d03d 100644
--- a/Source/WebKit/NetworkProcess/storage/BackgroundFetchStoreImpl.cpp
+++ b/Source/WebKit/NetworkProcess/storage/BackgroundFetchStoreImpl.cpp
@@ -96,9 +96,9 @@ void BackgroundFetchStoreImpl::initializeFetches(const WebCore::ClientOrigin& or
     addResult.iterator->value.initializationCallbacks.append(WTF::move(callback));
 
     initializeFetchesInternal(origin, [origin, weakEngine = WeakPtr { protect(m_server)->backgroundFetchEngine() }, protectedThis = Ref { *this }, manager](Vector<std::pair<RefPtr<WebCore::SharedBuffer>, String>>&& fetches) {
-        if (weakEngine && manager) {
+        if (RefPtr engine = weakEngine; engine && manager) {
             for (auto& fetch : fetches) {
-                weakEngine->addFetchFromStore(Ref { *fetch.first }->span(), [&](auto& key, auto& identifier) {
+                engine->addFetchFromStore(Ref { *fetch.first }->span(), [&](auto& key, auto& identifier) {
                     if (identifier.isEmpty()) {
                         manager->dispatchTaskToBackgroundFetchManager(origin, [identifier = crossThreadCopy(WTF::move(fetch.second))](auto* backgroundFetchManager) {
                             if (backgroundFetchManager)
diff --git a/Source/WebKit/NetworkProcess/storage/BackgroundFetchStoreManager.cpp b/Source/WebKit/NetworkProcess/storage/BackgroundFetchStoreManager.cpp
index bfb2e3d8e887..25ce1e538176 100644
--- a/Source/WebKit/NetworkProcess/storage/BackgroundFetchStoreManager.cpp
+++ b/Source/WebKit/NetworkProcess/storage/BackgroundFetchStoreManager.cpp
@@ -160,7 +160,8 @@ void BackgroundFetchStoreManager::storeFetch(const String& identifier, uint64_t
     }
 
     m_quotaCheckFunction(expectedSpace, [weakThis = WeakPtr { *this }, identifier, downloadTotal, uploadTotal, responseBodyIndexToClear, data = WTF::move(data), callback = WTF::move(callback)](bool result) mutable {
-        if (!weakThis) {
+        RefPtr protectedThis = weakThis;
+        if (!protectedThis) {
             callback(StoreResult::InternalError);
             return;
         }
@@ -168,7 +169,7 @@ void BackgroundFetchStoreManager::storeFetch(const String& identifier, uint64_t
             callback(StoreResult::QuotaError);
             return;
         }
-        weakThis->storeFetchAfterQuotaCheck(identifier, downloadTotal, uploadTotal, responseBodyIndexToClear, WTF::move(data), WTF::move(callback));
+        protectedThis->storeFetchAfterQuotaCheck(identifier, downloadTotal, uploadTotal, responseBodyIndexToClear, WTF::move(data), WTF::move(callback));
     });
 }
 
diff --git a/Source/WebKit/NetworkProcess/storage/IDBStorageRegistry.cpp b/Source/WebKit/NetworkProcess/storage/IDBStorageRegistry.cpp
index dcd466448ca3..a2105b00dd3e 100644
--- a/Source/WebKit/NetworkProcess/storage/IDBStorageRegistry.cpp
+++ b/Source/WebKit/NetworkProcess/storage/IDBStorageRegistry.cpp
@@ -72,7 +72,7 @@ void IDBStorageRegistry::removeConnectionToClient(IPC::Connection::UniqueID conn
             m_connectionsToClient.add(identifier, WTF::move(connectionToClient));
             continue;
         }
-        connectionToClient->connectionToClient().connectionToClientClosed();
+        protect(connectionToClient->connectionToClient())->connectionToClientClosed();
     }
 }
 
diff --git a/Source/WebKit/NetworkProcess/webrtc/NetworkRTCTCPSocketCocoa.mm b/Source/WebKit/NetworkProcess/webrtc/NetworkRTCTCPSocketCocoa.mm
index 4d0d1ad1e1a5..e40222861276 100644
--- a/Source/WebKit/NetworkProcess/webrtc/NetworkRTCTCPSocketCocoa.mm
+++ b/Source/WebKit/NetworkProcess/webrtc/NetworkRTCTCPSocketCocoa.mm
@@ -39,6 +39,7 @@
 #include <wtf/TZoneMallocInlines.h>
 #include <wtf/WeakObjCPtr.h>
 #include <wtf/cocoa/VectorCocoa.h>
+#include <wtf/darwin/DispatchExtras.h>
 #include <wtf/darwin/DispatchOSObject.h>
 
 WTF_IGNORE_WARNINGS_IN_THIRD_PARTY_CODE_BEGIN
@@ -52,7 +53,7 @@
 
 static dispatch_queue_t tcpSocketQueueSingleton()
 {
-    static NeverDestroyed<OSObjectPtr<dispatch_queue_t>> queue = adoptOSObject(dispatch_queue_create("WebRTC TCP socket queue", DISPATCH_QUEUE_SERIAL));
+    static NeverDestroyed<OSObjectPtr<dispatch_queue_t>> queue = adoptOSObject(dispatch_queue_create("WebRTC TCP socket queue", serialQueueWithAutoreleasePoolAttrSingleton()));
     return queue.get().get();
 }
 
diff --git a/Source/WebKit/NetworkProcess/webrtc/NetworkRTCUDPSocketCocoa.mm b/Source/WebKit/NetworkProcess/webrtc/NetworkRTCUDPSocketCocoa.mm
index cfeab5d05cfb..e13b8142d2c3 100644
--- a/Source/WebKit/NetworkProcess/webrtc/NetworkRTCUDPSocketCocoa.mm
+++ b/Source/WebKit/NetworkProcess/webrtc/NetworkRTCUDPSocketCocoa.mm
@@ -44,6 +44,7 @@
 #include <wtf/TZoneMallocInlines.h>
 #include <wtf/ThreadSafeRefCounted.h>
 #include <wtf/cocoa/SpanCocoa.h>
+#include <wtf/darwin/DispatchExtras.h>
 #include <wtf/darwin/DispatchOSObject.h>
 #include <wtf/posix/SocketPOSIX.h>
 
@@ -118,7 +119,7 @@ void NODELETE decrementPendingSendCount()
 
 static dispatch_queue_t udpSocketQueueSingleton()
 {
-    static NeverDestroyed<OSObjectPtr<dispatch_queue_t>> queue = adoptOSObject(dispatch_queue_create("WebRTC UDP socket queue", OSObjectPtr { DISPATCH_QUEUE_CONCURRENT }.get()));
+    static NeverDestroyed<OSObjectPtr<dispatch_queue_t>> queue = adoptOSObject(dispatch_queue_create("WebRTC UDP socket queue", concurrentQueueWithAutoreleasePoolAttrSingleton()));
     return queue.get().get();
 }
 
diff --git a/Source/WebKit/Platform/IPC/SharedBufferReference.cpp b/Source/WebKit/Platform/IPC/SharedBufferReference.cpp
index cec47b609e7c..c0fa8ed4432b 100644
--- a/Source/WebKit/Platform/IPC/SharedBufferReference.cpp
+++ b/Source/WebKit/Platform/IPC/SharedBufferReference.cpp
@@ -99,7 +99,7 @@ std::span<const uint8_t> SharedBufferReference::span() const LIFETIME_BOUND
     if (!m_buffer->isContiguous())
         m_buffer = protect(m_buffer)->makeContiguous();
 
-    return downcast<SharedBuffer>(m_buffer.get())->span().first(m_size);
+    return protect(downcast<SharedBuffer>(*m_buffer))->span().first(m_size);
 }
 
 RefPtr<WebCore::SharedMemory> SharedBufferReference::sharedCopy() const
diff --git a/Source/WebKit/Shared/API/c/WKSharedAPICast.h b/Source/WebKit/Shared/API/c/WKSharedAPICast.h
index e66c8dd3d9eb..69fc10d3fbd7 100644
--- a/Source/WebKit/Shared/API/c/WKSharedAPICast.h
+++ b/Source/WebKit/Shared/API/c/WKSharedAPICast.h
@@ -125,7 +125,7 @@ WK_ADD_API_MAPPING(WKWebArchiveResourceRef, API::WebArchiveResource)
 #endif
 
 template<typename T, typename APIType = typename ImplTypeInfo<T>::APIType>
-auto toAPI(T* t) -> APIType
+auto toAPI(T* t) -> APIType CLANG_POINTER_CONVERSION
 {
     return reinterpret_cast<APIType>(API::Object::wrap(t));
 }
@@ -137,7 +137,7 @@ auto toAPILeakingRef(RefPtr<T>&& t) -> APIType
 }
 
 template<typename T, typename APIType = typename ImplTypeInfo<T>::APIType>
-auto toAPI(T& t) -> APIType
+auto toAPI(T& t) -> APIType CLANG_POINTER_CONVERSION
 {
     SUPPRESS_UNCOUNTED_ARG return reinterpret_cast<APIType>(API::Object::wrap(&t));
 }
@@ -188,11 +188,11 @@ inline WKStringRef toCopiedAPI(const String& string)
     return toAPILeakingRef(API::String::create(string));
 }
 
-inline ProxyingRefPtr<API::URL> toURLRef(StringImpl* string)
+inline ProxyingRefPtr<API::URL> toURLRef(const String& string)
 {
     if (!string)
         return ProxyingRefPtr<API::URL>(nullptr);
-    return ProxyingRefPtr<API::URL>(API::URL::create(String(string)));
+    return ProxyingRefPtr<API::URL>(API::URL::create(string));
 }
 
 inline WKURLRef toCopiedURLAPI(const String& string)
diff --git a/Source/WebKit/Shared/InspectorExtensionTypes.h b/Source/WebKit/Shared/InspectorExtensionTypes.h
index 1bd50b73804e..b924a7203260 100644
--- a/Source/WebKit/Shared/InspectorExtensionTypes.h
+++ b/Source/WebKit/Shared/InspectorExtensionTypes.h
@@ -25,25 +25,18 @@
 
 #pragma once
 
+#include "RunJavaScriptResult.h"
 #include <wtf/Forward.h>
 
 #if ENABLE(INSPECTOR_EXTENSIONS)
 
-namespace WebKit {
-class JavaScriptEvaluationResult;
-}
-
-namespace WebCore {
-struct ExceptionDetails;
-}
-
 namespace Inspector {
 enum class ExtensionError : uint8_t;
 
 using ExtensionTabID = WTF::String;
 using ExtensionID = WTF::String;
 using ExtensionVoidResult = Expected<void, ExtensionError>;
-using ExtensionEvaluationResult = Expected<Expected<WebKit::JavaScriptEvaluationResult, std::optional<WebCore::ExceptionDetails>>, ExtensionError>;
+using ExtensionEvaluationResult = Expected<WebKit::RunJavaScriptResult, ExtensionError>;
 
 enum class ExtensionAppearance : bool {
     Light,
diff --git a/Source/WebKit/Shared/NativeWebGestureEvent.h b/Source/WebKit/Shared/NativeWebGestureEvent.h
index a19712a000e1..16ac4523851f 100644
--- a/Source/WebKit/Shared/NativeWebGestureEvent.h
+++ b/Source/WebKit/Shared/NativeWebGestureEvent.h
@@ -35,6 +35,7 @@ OBJC_CLASS NSView;
 namespace WebKit {
 
 class NativeWebGestureEvent final : public WebGestureEvent {
+    WTF_MAKE_TZONE_ALLOCATED(NativeWebGestureEvent);
 public:
     // Distinguishes magnify from rotate without needing a backing NSEvent.
     enum class Kind : uint8_t { Magnification, Rotation };
@@ -49,16 +50,17 @@ class NativeWebGestureEvent final : public WebGestureEvent {
         bool allowsNativeZoom { true };
     };
 
-    static std::optional<NativeWebGestureEvent> create(NSEvent *, NSView *);
-    static std::optional<NativeWebGestureEvent> create(const Init&, NSView *);
+    // Null when the gesture phase does not map to a WebEventType.
+    static RefPtr<NativeWebGestureEvent> create(NSEvent *, NSView *);
+    static RefPtr<NativeWebGestureEvent> create(const Init&, NSView *);
 
     bool allowsNativeZoom() const { return m_allowsNativeZoom; }
     Kind kind() const { return m_kind; }
     NSEvent *nativeEvent() const { return m_nativeEvent.get(); }
 
 private:
-    static std::optional<NativeWebGestureEvent> create(const Init&, NSView *, NSEvent *);
-    explicit NativeWebGestureEvent(WebEventType, const Init&, NSView *, NSEvent *);
+    static RefPtr<NativeWebGestureEvent> create(const Init&, NSView *, NSEvent *);
+    NativeWebGestureEvent(WebEventType, const Init&, NSView *, NSEvent *);
 
     bool m_allowsNativeZoom { true };
     Kind m_kind;
diff --git a/Source/WebKit/Shared/NativeWebKeyboardEvent.h b/Source/WebKit/Shared/NativeWebKeyboardEvent.h
index 63cfe7fc9385..4552062084ec 100644
--- a/Source/WebKit/Shared/NativeWebKeyboardEvent.h
+++ b/Source/WebKit/Shared/NativeWebKeyboardEvent.h
@@ -66,32 +66,33 @@ namespace WebKit {
 struct EditingRange;
 
 class NativeWebKeyboardEvent : public WebKeyboardEvent {
+    WTF_MAKE_TZONE_ALLOCATED(NativeWebKeyboardEvent);
 public:
 #if USE(APPKIT)
     // FIXME: Share iOS's HandledByInputMethod enum here instead of passing a boolean.
-    NativeWebKeyboardEvent(NSEvent *, bool handledByInputMethod, bool replacesSoftSpace, const Vector<WebCore::KeypressCommand>&);
+    static Ref<NativeWebKeyboardEvent> create(NSEvent *, bool handledByInputMethod, bool replacesSoftSpace, const Vector<WebCore::KeypressCommand>&);
 #elif PLATFORM(GTK)
-    NativeWebKeyboardEvent(const NativeWebKeyboardEvent&);
-    NativeWebKeyboardEvent(GdkEvent*, const String&, bool isAutoRepeat, Vector<String>&& commands);
-    NativeWebKeyboardEvent(const String&, std::optional<Vector<WebCore::CompositionUnderline>>&&, std::optional<EditingRange>&&);
-    NativeWebKeyboardEvent(WebEventType, const String& text, const String& key, const String& code, const String& keyIdentifier, int windowsVirtualKeyCode, int nativeVirtualKeyCode, Vector<String>&& commands, bool isAutoRepeat, bool isKeypad, OptionSet<WebEventModifier>);
+    static Ref<NativeWebKeyboardEvent> create(const NativeWebKeyboardEvent&);
+    static Ref<NativeWebKeyboardEvent> create(GdkEvent*, const String&, bool isAutoRepeat, Vector<String>&& commands);
+    static Ref<NativeWebKeyboardEvent> create(const String&, std::optional<Vector<WebCore::CompositionUnderline>>&&, std::optional<EditingRange>&&);
+    static Ref<NativeWebKeyboardEvent> create(WebEventType, const String& text, const String& key, const String& code, const String& keyIdentifier, int windowsVirtualKeyCode, int nativeVirtualKeyCode, Vector<String>&& commands, bool isAutoRepeat, bool isKeypad, OptionSet<WebEventModifier>);
 #elif PLATFORM(IOS_FAMILY)
     enum class HandledByInputMethod : bool { No, Yes };
-    NativeWebKeyboardEvent(::WebEvent *, HandledByInputMethod);
+    static Ref<NativeWebKeyboardEvent> create(::WebEvent *, HandledByInputMethod);
 #elif PLATFORM(WPE)
 #if USE(LIBWPE)
     enum class HandledByInputMethod : bool { No, Yes };
-    NativeWebKeyboardEvent(struct wpe_input_keyboard_event*, const String&, bool isAutoRepeat, HandledByInputMethod, std::optional<Vector<WebCore::CompositionUnderline>>&&, std::optional<EditingRange>&&);
+    static Ref<NativeWebKeyboardEvent> create(struct wpe_input_keyboard_event*, const String&, bool isAutoRepeat, HandledByInputMethod, std::optional<Vector<WebCore::CompositionUnderline>>&&, std::optional<EditingRange>&&);
 #endif
 #if ENABLE(WPE_PLATFORM)
-    NativeWebKeyboardEvent(WPEEvent*, const String&, bool isAutoRepeat);
-    NativeWebKeyboardEvent(const String&, std::optional<Vector<WebCore::CompositionUnderline>>&&, std::optional<EditingRange>&&);
+    static Ref<NativeWebKeyboardEvent> create(WPEEvent*, const String&, bool isAutoRepeat);
+    static Ref<NativeWebKeyboardEvent> create(const String&, std::optional<Vector<WebCore::CompositionUnderline>>&&, std::optional<EditingRange>&&);
 #endif
 #elif PLATFORM(PLAYSTATION)
     enum class HandledByInputMethod : bool { No, Yes };
-    NativeWebKeyboardEvent(struct wpe_input_keyboard_event*, const String&, bool isAutoRepeat, HandledByInputMethod, std::optional<Vector<WebCore::CompositionUnderline>>&&, std::optional<EditingRange>&&);
+    static Ref<NativeWebKeyboardEvent> create(struct wpe_input_keyboard_event*, const String&, bool isAutoRepeat, HandledByInputMethod, std::optional<Vector<WebCore::CompositionUnderline>>&&, std::optional<EditingRange>&&);
 #elif PLATFORM(WIN)
-    NativeWebKeyboardEvent(HWND, UINT message, WPARAM, LPARAM, Vector<MSG>&& pendingCharEvents);
+    static Ref<NativeWebKeyboardEvent> create(HWND, UINT message, WPARAM, LPARAM, Vector<MSG>&& pendingCharEvents);
 #endif
 
 #if USE(APPKIT)
@@ -109,16 +110,28 @@ class NativeWebKeyboardEvent : public WebKeyboardEvent {
 
 private:
 #if USE(APPKIT)
+    NativeWebKeyboardEvent(WebKeyboardEventInit&&, NSEvent *);
+
     RetainPtr<NSEvent> m_nativeEvent;
 #elif PLATFORM(GTK) && USE(GTK4)
+    NativeWebKeyboardEvent(WebKeyboardEventInit&&, GdkEvent*);
+
     GRefPtr<GdkEvent> m_nativeEvent;
 #elif PLATFORM(GTK)
+    NativeWebKeyboardEvent(WebKeyboardEventInit&&, GdkEvent*);
+
     GUniquePtr<GdkEvent> m_nativeEvent;
 #elif PLATFORM(IOS_FAMILY)
+    NativeWebKeyboardEvent(WebKeyboardEventInit&&, ::WebEvent *);
+
     RetainPtr<::WebEvent> m_nativeEvent;
 #elif PLATFORM(WIN)
+    NativeWebKeyboardEvent(WebKeyboardEventInit&&, const MSG&, Vector<MSG>&&);
+
     MSG m_nativeEvent;
     Vector<MSG> m_pendingCharEvents;
+#else
+    explicit NativeWebKeyboardEvent(WebKeyboardEventInit&&);
 #endif
 };
 
diff --git a/Source/WebKit/Shared/NativeWebMouseEvent.h b/Source/WebKit/Shared/NativeWebMouseEvent.h
index 3f1087581732..a0e9b79c9149 100644
--- a/Source/WebKit/Shared/NativeWebMouseEvent.h
+++ b/Source/WebKit/Shared/NativeWebMouseEvent.h
@@ -65,30 +65,31 @@ struct wpe_input_pointer_event;
 namespace WebKit {
 
 class NativeWebMouseEvent : public WebMouseEvent {
+    WTF_MAKE_TZONE_ALLOCATED(NativeWebMouseEvent);
 public:
 #if USE(APPKIT)
-    NativeWebMouseEvent(NSEvent *, NSEvent *lastPressureEvent, NSView *, WebEventInputSource, WebCore::PlatformMouseEvent::CanInitiateDrag = WebCore::PlatformMouseEvent::CanInitiateDrag::Yes);
+    static Ref<NativeWebMouseEvent> create(NSEvent *, NSEvent *lastPressureEvent, NSView *, WebEventInputSource, WebCore::PlatformMouseEvent::CanInitiateDrag = WebCore::PlatformMouseEvent::CanInitiateDrag::Yes);
 #elif PLATFORM(GTK)
-    NativeWebMouseEvent(const NativeWebMouseEvent&);
-    NativeWebMouseEvent(GdkEvent*, int, std::optional<WebCore::FloatSize>);
-    NativeWebMouseEvent(GdkEvent*, const WebCore::DoublePoint&, int, std::optional<WebCore::FloatSize>);
-    NativeWebMouseEvent(WebEventType, WebMouseEventButton, unsigned short buttons, const WebCore::DoublePoint& position, const WebCore::DoublePoint& globalPosition, int clickCount, OptionSet<WebEventModifier> modifiers, std::optional<WebCore::FloatSize>, WebCore::PointerID, const String& pointerType, WebCore::PlatformMouseEvent::IsTouch isTouchEvent);
-    explicit NativeWebMouseEvent(const WebCore::DoublePoint&);
+    static Ref<NativeWebMouseEvent> create(const NativeWebMouseEvent&);
+    static Ref<NativeWebMouseEvent> create(GdkEvent*, int, std::optional<WebCore::FloatSize>);
+    static Ref<NativeWebMouseEvent> create(GdkEvent*, const WebCore::DoublePoint&, int, std::optional<WebCore::FloatSize>);
+    static Ref<NativeWebMouseEvent> create(WebEventType, WebMouseEventButton, unsigned short buttons, const WebCore::DoublePoint& position, const WebCore::DoublePoint& globalPosition, int clickCount, OptionSet<WebEventModifier> modifiers, std::optional<WebCore::FloatSize>, WebCore::PointerID, const String& pointerType, WebCore::PlatformMouseEvent::IsTouch isTouchEvent);
+    static Ref<NativeWebMouseEvent> create(const WebCore::DoublePoint&);
 #elif PLATFORM(IOS_FAMILY)
-    NativeWebMouseEvent(::WebEvent *);
-    NativeWebMouseEvent(WebEventType, WebMouseEventButton, unsigned short buttons, const WebCore::DoublePoint& position, const WebCore::DoublePoint& globalPosition, float deltaX, float deltaY, float deltaZ, int clickCount, OptionSet<WebEventModifier>, MonotonicTime timestamp, double force, GestureWasCancelled, const String& pointerType);
-    NativeWebMouseEvent(const NativeWebMouseEvent&, const WebCore::DoublePoint& position, const WebCore::DoublePoint& globalPosition, float deltaX, float deltaY, float deltaZ);
+    static Ref<NativeWebMouseEvent> create(::WebEvent *);
+    static Ref<NativeWebMouseEvent> create(WebEventType, WebMouseEventButton, unsigned short buttons, const WebCore::DoublePoint& position, const WebCore::DoublePoint& globalPosition, float deltaX, float deltaY, float deltaZ, int clickCount, OptionSet<WebEventModifier>, MonotonicTime timestamp, double force, GestureWasCancelled, const String& pointerType);
+    static Ref<NativeWebMouseEvent> create(const NativeWebMouseEvent&, const WebCore::DoublePoint& position, const WebCore::DoublePoint& globalPosition, float deltaX, float deltaY, float deltaZ);
 #elif PLATFORM(WPE)
 #if USE(LIBWPE)
-    NativeWebMouseEvent(struct wpe_input_pointer_event*, float deviceScaleFactor, WebMouseEventSyntheticClickType = WebMouseEventSyntheticClickType::NoTap);
+    static Ref<NativeWebMouseEvent> create(struct wpe_input_pointer_event*, float deviceScaleFactor, WebMouseEventSyntheticClickType = WebMouseEventSyntheticClickType::NoTap);
 #endif
 #if ENABLE(WPE_PLATFORM)
-    explicit NativeWebMouseEvent(WPEEvent*);
+    static Ref<NativeWebMouseEvent> create(WPEEvent*);
 #endif
 #elif PLATFORM(PLAYSTATION)
-    NativeWebMouseEvent(struct wpe_input_pointer_event*, float deviceScaleFactor, WebMouseEventSyntheticClickType = WebMouseEventSyntheticClickType::NoTap);
+    static Ref<NativeWebMouseEvent> create(struct wpe_input_pointer_event*, float deviceScaleFactor, WebMouseEventSyntheticClickType = WebMouseEventSyntheticClickType::NoTap);
 #elif PLATFORM(WIN)
-    NativeWebMouseEvent(HWND, UINT message, WPARAM, LPARAM, bool, float deviceScaleFactor);
+    static Ref<NativeWebMouseEvent> create(HWND, UINT message, WPARAM, LPARAM, bool, float deviceScaleFactor);
 #endif
 
 #if USE(APPKIT)
@@ -105,15 +106,27 @@ class NativeWebMouseEvent : public WebMouseEvent {
 
 private:
 #if USE(APPKIT)
+    NativeWebMouseEvent(WebMouseEventInit&&, NSEvent *);
+
     RetainPtr<NSEvent> m_nativeEvent;
 #elif PLATFORM(GTK) && USE(GTK4)
+    NativeWebMouseEvent(WebMouseEventInit&&, GdkEvent*);
+
     GRefPtr<GdkEvent> m_nativeEvent;
 #elif PLATFORM(GTK)
+    NativeWebMouseEvent(WebMouseEventInit&&, GdkEvent*);
+
     GUniquePtr<GdkEvent> m_nativeEvent;
 #elif PLATFORM(IOS_FAMILY)
+    NativeWebMouseEvent(WebMouseEventInit&&, ::WebEvent *);
+
     RetainPtr<::WebEvent> m_nativeEvent;
 #elif PLATFORM(WIN)
+    NativeWebMouseEvent(WebMouseEventInit&&, const MSG&);
+
     MSG m_nativeEvent;
+#else
+    explicit NativeWebMouseEvent(WebMouseEventInit&&);
 #endif
 };
 
diff --git a/Source/WebKit/Shared/NativeWebTouchEvent.h b/Source/WebKit/Shared/NativeWebTouchEvent.h
index de35dbd1f290..8845f3af8098 100644
--- a/Source/WebKit/Shared/NativeWebTouchEvent.h
+++ b/Source/WebKit/Shared/NativeWebTouchEvent.h
@@ -56,48 +56,62 @@ struct WKTouchEvent;
 #if ENABLE(TOUCH_EVENTS)
 
 class NativeWebTouchEvent : public WebTouchEvent {
+    WTF_MAKE_TZONE_ALLOCATED(NativeWebTouchEvent);
 public:
 #if PLATFORM(IOS_FAMILY)
 #if defined(__OBJC__)
-    explicit NativeWebTouchEvent(const WKTouchEvent&, UIKeyModifierFlags);
+    static Ref<NativeWebTouchEvent> create(const WKTouchEvent&, UIKeyModifierFlags);
 #endif
 #elif PLATFORM(GTK)
-    NativeWebTouchEvent(GdkEvent*, Vector<WebPlatformTouchPoint>&&);
-    NativeWebTouchEvent(WebEventType, OptionSet<WebEventModifier>, Vector<WebPlatformTouchPoint>&&);
-    NativeWebTouchEvent(const NativeWebTouchEvent&);
+    static Ref<NativeWebTouchEvent> create(GdkEvent*, Vector<WebPlatformTouchPoint>&&);
+    static Ref<NativeWebTouchEvent> create(WebEventType, OptionSet<WebEventModifier>, Vector<WebPlatformTouchPoint>&&);
+    static Ref<NativeWebTouchEvent> create(const NativeWebTouchEvent&);
     const GdkEvent* nativeEvent() const { return m_nativeEvent.get(); }
 #elif PLATFORM(WPE)
     bool isNativeWebTouchEvent() const final { return true; }
 #if USE(LIBWPE)
-    NativeWebTouchEvent(struct wpe_input_touch_event*, float deviceScaleFactor);
+    static Ref<NativeWebTouchEvent> create(struct wpe_input_touch_event*, float deviceScaleFactor);
     const struct wpe_input_touch_event_raw* nativeFallbackTouchPoint() const { return &m_fallbackTouchPoint; }
 #endif
 #if ENABLE(WPE_PLATFORM)
-    NativeWebTouchEvent(WPEEvent*, Vector<WebPlatformTouchPoint>&&);
+    static Ref<NativeWebTouchEvent> create(WPEEvent*, Vector<WebPlatformTouchPoint>&&);
     WPEEvent* nativeEvent() const { return m_nativeEvent.get(); }
 #endif
 #elif PLATFORM(WIN)
-    NativeWebTouchEvent();
+    static Ref<NativeWebTouchEvent> create();
 #endif
 
 private:
 #if PLATFORM(IOS_FAMILY) && defined(__OBJC__)
-    Vector<WebPlatformTouchPoint> extractWebTouchPoints(const WKTouchEvent&);
-    Vector<WebTouchEvent> extractCoalescedWebTouchEvents(const WKTouchEvent&, UIKeyModifierFlags);
-    Vector<WebTouchEvent> extractPredictedWebTouchEvents(const WKTouchEvent&, UIKeyModifierFlags);
+    explicit NativeWebTouchEvent(WebTouchEventInit&&);
+
+    static Vector<WebPlatformTouchPoint> extractWebTouchPoints(const WKTouchEvent&);
+    static Vector<Ref<WebTouchEvent>> extractCoalescedWebTouchEvents(const WKTouchEvent&, UIKeyModifierFlags);
+    static Vector<Ref<WebTouchEvent>> extractPredictedWebTouchEvents(const WKTouchEvent&, UIKeyModifierFlags);
 #endif
 
 #if PLATFORM(GTK) && USE(GTK4)
+    NativeWebTouchEvent(WebTouchEventInit&&, GdkEvent*);
+
     GRefPtr<GdkEvent> m_nativeEvent;
 #elif PLATFORM(GTK)
+    NativeWebTouchEvent(WebTouchEventInit&&, GdkEvent*);
+
     GUniquePtr<GdkEvent> m_nativeEvent;
 #elif PLATFORM(WPE)
 #if USE(LIBWPE)
+    NativeWebTouchEvent(WebTouchEventInit&&, struct wpe_input_touch_event*);
+
     struct wpe_input_touch_event_raw m_fallbackTouchPoint;
 #endif
 #if ENABLE(WPE_PLATFORM)
+    NativeWebTouchEvent(WebTouchEventInit&&, WPEEvent*);
+
     GRefPtr<WPEEvent> m_nativeEvent;
 #endif
+#elif PLATFORM(WIN)
+    // IOS_FAMILY declares this above, alongside the WKTouchEvent helpers.
+    explicit NativeWebTouchEvent(WebTouchEventInit&&);
 #endif
 };
 
diff --git a/Source/WebKit/Shared/NativeWebWheelEvent.h b/Source/WebKit/Shared/NativeWebWheelEvent.h
index b5361fedd7d9..a02150f5d003 100644
--- a/Source/WebKit/Shared/NativeWebWheelEvent.h
+++ b/Source/WebKit/Shared/NativeWebWheelEvent.h
@@ -58,25 +58,26 @@ struct wpe_input_axis_event;
 namespace WebKit {
 
 class NativeWebWheelEvent : public WebWheelEvent {
+    WTF_MAKE_TZONE_ALLOCATED(NativeWebWheelEvent);
 public:
 #if USE(APPKIT)
-    NativeWebWheelEvent(NSEvent *, NSView *);
-    explicit NativeWebWheelEvent(const WebWheelEvent&);
+    static Ref<NativeWebWheelEvent> create(NSEvent *, NSView *);
+    static Ref<NativeWebWheelEvent> create(const WebWheelEvent&);
 #elif PLATFORM(GTK)
-    NativeWebWheelEvent(const NativeWebWheelEvent&);
-    NativeWebWheelEvent(GdkEvent*, const WebCore::IntPoint& position, const WebCore::IntPoint& globalPosition, const WebCore::FloatSize& delta, const WebCore::FloatSize& wheelTicks, WebWheelEvent::Phase, WebWheelEvent::Phase momentumPhase, bool hasPreciseDeltas = false);
+    static Ref<NativeWebWheelEvent> create(const NativeWebWheelEvent&);
+    static Ref<NativeWebWheelEvent> create(GdkEvent*, const WebCore::IntPoint& position, const WebCore::IntPoint& globalPosition, const WebCore::FloatSize& delta, const WebCore::FloatSize& wheelTicks, WebWheelEvent::Phase, WebWheelEvent::Phase momentumPhase, bool hasPreciseDeltas = false);
 #elif PLATFORM(WPE)
 #if USE(LIBWPE)
-    NativeWebWheelEvent(struct wpe_input_axis_event*, float deviceScaleFactor, WebWheelEvent::Phase, WebWheelEvent::Phase momentumPhase);
+    static Ref<NativeWebWheelEvent> create(struct wpe_input_axis_event*, float deviceScaleFactor, WebWheelEvent::Phase, WebWheelEvent::Phase momentumPhase);
 #endif
 #if ENABLE(WPE_PLATFORM)
-    explicit NativeWebWheelEvent(WPEEvent*);
-    NativeWebWheelEvent(WPEEvent*, WebWheelEvent::Phase);
+    static Ref<NativeWebWheelEvent> create(WPEEvent*);
+    static Ref<NativeWebWheelEvent> create(WPEEvent*, WebWheelEvent::Phase);
 #endif
 #elif PLATFORM(PLAYSTATION)
-    NativeWebWheelEvent(struct wpe_input_axis_event*, float deviceScaleFactor, WebWheelEvent::Phase, WebWheelEvent::Phase momentumPhase);
+    static Ref<NativeWebWheelEvent> create(struct wpe_input_axis_event*, float deviceScaleFactor, WebWheelEvent::Phase, WebWheelEvent::Phase momentumPhase);
 #elif PLATFORM(WIN)
-    NativeWebWheelEvent(HWND, UINT message, WPARAM, LPARAM, float deviceScaleFactor);
+    static Ref<NativeWebWheelEvent> create(HWND, UINT message, WPARAM, LPARAM, float deviceScaleFactor);
 #endif
 
 #if USE(APPKIT)
@@ -91,13 +92,23 @@ class NativeWebWheelEvent : public WebWheelEvent {
 
 private:
 #if USE(APPKIT)
+    NativeWebWheelEvent(WebWheelEventInit&&, NSEvent *);
+
     RetainPtr<NSEvent> m_nativeEvent;
 #elif PLATFORM(GTK) && USE(GTK4)
+    NativeWebWheelEvent(WebWheelEventInit&&, GdkEvent*);
+
     GRefPtr<GdkEvent> m_nativeEvent;
 #elif PLATFORM(GTK)
+    NativeWebWheelEvent(WebWheelEventInit&&, GdkEvent*);
+
     GUniquePtr<GdkEvent> m_nativeEvent;
 #elif PLATFORM(WIN)
+    NativeWebWheelEvent(WebWheelEventInit&&, const MSG&);
+
     MSG m_nativeEvent;
+#else
+    explicit NativeWebWheelEvent(WebWheelEventInit&&);
 #endif
 };
 
diff --git a/Source/WebKit/Shared/RemoteLayerTree/RemoteLayerBackingStoreCollection.mm b/Source/WebKit/Shared/RemoteLayerTree/RemoteLayerBackingStoreCollection.mm
index b44b9c6a6697..f81158e0cecc 100644
--- a/Source/WebKit/Shared/RemoteLayerTree/RemoteLayerBackingStoreCollection.mm
+++ b/Source/WebKit/Shared/RemoteLayerTree/RemoteLayerBackingStoreCollection.mm
@@ -302,8 +302,10 @@
 
         sendMarkBuffersVolatile(WTF::move(identifiers), [weakThis = WeakPtr { *this }](bool succeeded) {
             LOG_WITH_STREAM(RemoteLayerBuffers, stream << "RemoteLayerBackingStoreCollection::markBackingStoreVolatileAfterReachabilityChange - succeeded " << succeeded);
-            if (!succeeded && weakThis)
-                weakThis->scheduleVolatilityTimer();
+            if (!succeeded) {
+                if (RefPtr protectedThis = weakThis)
+                    protectedThis->scheduleVolatilityTimer();
+            }
         });
     } else {
         CheckedRef inProcessBackingStore = downcast<RemoteLayerWithInProcessRenderingBackingStore>(backingStore);
diff --git a/Source/WebKit/Shared/RemoteWebTouchEvent.h b/Source/WebKit/Shared/RemoteWebTouchEvent.h
index 72f2dccfdb0e..325a5776d0a4 100644
--- a/Source/WebKit/Shared/RemoteWebTouchEvent.h
+++ b/Source/WebKit/Shared/RemoteWebTouchEvent.h
@@ -33,7 +33,7 @@ namespace WebKit {
 #if ENABLE(TOUCH_EVENTS)
 struct RemoteWebTouchEvent {
     WebCore::FrameIdentifier targetFrameID;
-    WebTouchEvent transformedEvent;
+    Ref<WebTouchEvent> transformedEvent;
 };
 #endif
 
diff --git a/Source/WebKit/Shared/RemoteWebTouchEvent.serialization.in b/Source/WebKit/Shared/RemoteWebTouchEvent.serialization.in
index 2bb7ae44153c..062a34584777 100644
--- a/Source/WebKit/Shared/RemoteWebTouchEvent.serialization.in
+++ b/Source/WebKit/Shared/RemoteWebTouchEvent.serialization.in
@@ -23,6 +23,6 @@
 #if ENABLE(TOUCH_EVENTS)
 struct WebKit::RemoteWebTouchEvent {
     WebCore::FrameIdentifier targetFrameID;
-    WebKit::WebTouchEvent transformedEvent;
+    Ref<WebKit::WebTouchEvent> transformedEvent;
 };
 #endif
diff --git a/Source/WebKit/Shared/RunJavaScriptResult.h b/Source/WebKit/Shared/RunJavaScriptResult.h
new file mode 100644
index 000000000000..f18df3cf29e3
--- /dev/null
+++ b/Source/WebKit/Shared/RunJavaScriptResult.h
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2026 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include <WebCore/ExceptionDetails.h>
+#include <expected>
+#include <optional>
+
+namespace WebKit {
+
+class JavaScriptEvaluationResult;
+
+using RunJavaScriptResult = std::expected<JavaScriptEvaluationResult, std::optional<WebCore::ExceptionDetails>>;
+
+}
diff --git a/Source/WebKit/Shared/WTFCompletionHandler+Extras.swift b/Source/WebKit/Shared/WTFCompletionHandler+Extras.swift
index 571935a9327f..50a56dfcc854 100644
--- a/Source/WebKit/Shared/WTFCompletionHandler+Extras.swift
+++ b/Source/WebKit/Shared/WTFCompletionHandler+Extras.swift
@@ -197,7 +197,9 @@ extension CxxVoidCompletionHandler where Self: ~Copyable {
 
     /// Creates a `WTF::CompletionHandler` type from a Swift closure.
     ///
-    /// - Parameter body: The Swift closure to use.
+    /// - Parameters:
+    ///   - isolation: The current isolation.
+    ///   - body: The Swift closure to use.
     @safe
     init(isolation: isolated (any Actor)? = #isolation, _ body: @escaping () -> Void) {
         self.init(box: SwiftVoidClosureBox(isolation: isolation, body))
diff --git a/Source/WebKit/Shared/WTFExpected+Extras.swift b/Source/WebKit/Shared/WTFExpected+Extras.swift
new file mode 100644
index 000000000000..6d3ebf7925e8
--- /dev/null
+++ b/Source/WebKit/Shared/WTFExpected+Extras.swift
@@ -0,0 +1,178 @@
+// Copyright (C) 2026 Apple Inc. All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions
+// are met:
+// 1. Redistributions of source code must retain the above copyright
+//    notice, this list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright
+//    notice, this list of conditions and the following disclaimer in the
+//    documentation and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+// THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+// PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+// BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+// SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+// INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+// CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+// ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+// THE POSSIBILITY OF SUCH DAMAGE.
+
+// FIXME: (rdar://164119356) Move this file into WTF.
+
+#if compiler(>=6.4) && !SWIFT_WEBKIT_TOOLCHAIN
+
+/// Represents an `unexpected` value of an `std::expected<T, E>`.
+struct CxxUnexpected<Failure: Sendable>: Error {
+    /// The unexpected error.
+    let error: Failure
+}
+
+/// The machinery shared by ``CxxExpected`` and ``CxxConsumingExpected``.
+///
+/// - Important: Do not conform to this directly. Conform to one of those two instead.
+protocol CxxExpectedBase: ~Copyable {
+    /// The type of the expected value.
+    associatedtype Value: ~Copyable
+
+    /// The type of the unexpected value.
+    associatedtype Failure: Sendable
+
+    /// Checks whether the object contains an expected value.
+    /// - Returns: `true` if the object contains an expected value; `false` otherwise.
+    // swift-format-ignore: AlwaysUseLowerCamelCase
+    func has_value() -> Bool
+
+    /// Returns the expected value.
+    ///
+    /// - Note: Do not call or implement this yourself. It is unsafe to do so.
+    // swift-format-ignore: AlwaysUseLowerCamelCase,NoLeadingUnderscores
+    func __valueUnsafe() -> UnsafePointer<Value>
+
+    /// Returns the unexpected value.
+    ///
+    /// - Note: Do not call or implement this yourself. It is unsafe to do so.
+    // swift-format-ignore: AlwaysUseLowerCamelCase,NoLeadingUnderscores
+    func __errorUnsafe() -> UnsafePointer<Failure>
+}
+
+/// A protocol for concrete specializations of `std::expected<T, E>` to conform to when `T` is `Copyable`.
+///
+/// Conforming a specialization to this protocol allows Swift to safely access properties of the `expected`.
+/// For example, this makes it possible to use a type like
+///
+/// ```cpp
+/// using ExpectedResult = std::expected<int, ErrorCode>;
+/// ```
+///
+/// by creating this conformance:
+///
+/// ```swift
+/// extension ExpectedResult: CxxExpected {}
+/// ```
+///
+/// Swift can then use the `expected` naturally:
+///
+/// ```swift
+/// let expectedResult: ExpectedResult = ...
+/// let value = try expectedResult.value
+/// ```
+///
+protocol CxxExpected: CxxExpectedBase where Value: Copyable {
+}
+
+extension CxxExpected {
+    /// Returns the expected value, or throws the unexpected error if one exists.
+    var value: Value {
+        get throws(CxxUnexpected<Failure>) {
+            // Safety properties:
+            //
+            // Non-null, initialized, aligned: both point into `self`, which is a fully constructed
+            //     `std::expected`, so each is the address of a live object of the type it points to.
+            // Lifetime: `self` is borrowed for the whole of this getter, so neither pointer can dangle
+            //     here. Neither is stored; only the copy taken below escapes.
+            // Aliasing: `self` still owns what both point at, so this may only read them. `.pointee`
+            //     copies, running `Value`'s or `Failure`'s copy constructor, and leaves the `Expected`
+            //     intact and readable again.
+
+            guard has_value() else {
+                throw unsafe CxxUnexpected(error: __errorUnsafe().pointee)
+            }
+
+            return unsafe __valueUnsafe().pointee
+        }
+    }
+}
+
+/// A protocol for concrete specializations of `std::expected<T, E>` for noncopyable `T`s.
+///
+/// This is the same as ``CxxExpected`` except that it matches a C++ signature like:
+///
+/// ```cpp
+/// using ExpectedResult = std::expected<MoveOnlyThing, ErrorCode>;
+/// ```
+///
+/// Conformers to this protocol must explicitly implement the `__take(_:)` requirement like so:
+///
+/// ```swift
+/// extension ExpectedResult: CxxConsumingExpected {
+///     static func __take(_ expected: consuming Self) -> Value {
+///         takeValue(consuming: expected)
+///     }
+/// }
+/// ```
+///
+/// where `takeValue` is a C++ free function implemented exactly as
+///
+/// ```cpp
+/// inline ExpectedResult::value_type takeValue(ExpectedResult&& expected)
+/// {
+///     // Must be non-trivially destructible so that Swift runs the move constructor rather than
+///     // relocating the value byte-wise, which would leave a value holding a pointer into itself
+///     // dangling.
+///     static_assert(!std::is_trivially_destructible_v<ExpectedResult::value_type>);
+///     // Swift copies rather than consumes a copyable `Expected`, so the value would be moved out of
+///     // that copy and the caller's `Expected` left untouched.
+///     static_assert(!std::is_copy_constructible_v<ExpectedResult>);
+///     return WTF::move(*expected);
+/// }
+/// ```
+///
+/// Swift imports that rvalue reference parameter as `consuming`, and destroys the moved-from `expected` once the call
+/// returns.
+///
+/// - Important: Do not implement the protocol requirements yourself. It is unsafe if you do so.
+protocol CxxConsumingExpected: CxxExpectedBase, ~Copyable {
+    /// Consumes the `expected`, moving its value out.
+    ///
+    /// - Parameter expected: The expected to take. It is guaranteed to have a value.
+    /// - Returns: The moved value of the expected.
+    /// - Note: Do not call this yourself.
+    // swift-format-ignore: AlwaysUseLowerCamelCase,NoLeadingUnderscores
+    static func __take(_ expected: consuming Self) -> Value
+}
+
+extension CxxConsumingExpected where Self: ~Copyable, Value: ~Copyable {
+    /// Returns the expected value, or throws the unexpected error if one exists.
+    ///
+    /// - Returns: The consumed value of the expected, if one exists.
+    /// - Throws: The unexpected error, if one exists.
+    consuming func consume() throws(CxxUnexpected<Failure>) -> Value {
+        // Safety properties:
+        //
+        // As in `CxxExpected.value`, with one difference: `self` is consumed here rather than borrowed.
+        // `__errorUnsafe()` only borrows it, and `__take(_:)` is what finally takes it, so `self` is
+        // still live when the error is read out below.
+
+        guard has_value() else {
+            throw unsafe CxxUnexpected(error: __errorUnsafe().pointee)
+        }
+
+        return Self.__take(self)
+    }
+}
+
+#endif // compiler(>=6.4) && !SWIFT_WEBKIT_TOOLCHAIN
diff --git a/Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in b/Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in
index 6fdb08fa4508..56d13d99cb61 100644
--- a/Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in
+++ b/Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in
@@ -1349,6 +1349,13 @@ using WebCore::ScrollPosition = WebCore::IntPoint;
     OptionSet<WebCore::FrameOwnerElementAppearance> ownerElementAppearance();
 };
 
+header: <WebCore/FrameGeometrySyncData.h>
+struct WebCore::FrameGeometrySyncData {
+    WebCore::LayoutRect layoutViewportRect;
+    WebCore::IntSize contentsSize;
+    HashMap<WebCore::FrameIdentifier, Ref<WebCore::RemoteFrameLayoutInfo>> childrenFrameLayoutInfo;
+};
+
 header: <WebCore/VP9Utilities.h>
 [CustomHeader] struct WebCore::ScreenDataOverrides {
     double width;
@@ -3866,11 +3873,23 @@ enum class WebCore::PlatformVideoMatrixCoefficients : uint8_t {
     Unspecified,
 };
 
+enum class WebCore::PlatformVideoChromaLocation : uint8_t {
+    Left,
+    Center,
+    TopLeft,
+    Top,
+    BottomLeft,
+    Bottom,
+    Dv420,
+    Unspecified,
+};
+
 [AdditionalEncoder=StreamConnectionEncoder] struct WebCore::PlatformVideoColorSpace {
     std::optional<WebCore::PlatformVideoColorPrimaries> primaries;
     std::optional<WebCore::PlatformVideoTransferCharacteristics> transfer;
     std::optional<WebCore::PlatformVideoMatrixCoefficients> matrix;
     std::optional<bool> fullRange;
+    std::optional<WebCore::PlatformVideoChromaLocation> chromaLocation;
 };
 
 #if ENABLE(CONTENT_EXTENSIONS)
@@ -6926,6 +6945,14 @@ enum class WebCore::EncryptionBoxType : uint8_t {
     TransportStreamEncryptionInitData
 };
 
+header: <WebCore/TrackInfo.h>
+enum class WebCore::PlatformVideoFieldDetail : uint8_t {
+    TemporalTopFirst,
+    TemporalBottomFirst,
+    SpatialFirstLineEarly,
+    SpatialFirstLineLate
+};
+
 using WebCore::TrackInfoAtomData = std::pair<WebCore::FourCC, Ref<WebCore::SharedBuffer>>;
 
 header: <WebCore/TrackInfo.h>
@@ -6961,6 +6988,8 @@ header: <WebCore/TrackInfo.h>
     WebCore::FloatSize displaySize;
     uint8_t bitDepth;
     WebCore::PlatformVideoColorSpace colorSpace;
+    std::optional<uint8_t> fieldCount;
+    std::optional<WebCore::PlatformVideoFieldDetail> fieldDetail;
     Vector<std::pair<WebCore::FourCC, Ref<WebCore::SharedBuffer>>> extensionAtoms;
 
 #if PLATFORM(VISION)
diff --git a/Source/WebKit/Shared/WebEvent.cpp b/Source/WebKit/Shared/WebEvent.cpp
index edcb4f0f4b40..f5d465ab8f8c 100644
--- a/Source/WebKit/Shared/WebEvent.cpp
+++ b/Source/WebKit/Shared/WebEvent.cpp
@@ -38,43 +38,19 @@ namespace WebKit {
 WTF_MAKE_TZONE_ALLOCATED_IMPL(WebEvent);
 
 #if PLATFORM(GTK) || PLATFORM(WPE)
-static uintptr_t generateSignpostIdentifier()
+uintptr_t generateSignpostIdentifier()
 {
     static std::atomic<uintptr_t> identifier;
     return ++identifier;
 }
-
-WebEvent::WebEvent(WebEventType type, OptionSet<WebEventModifier> modifiers, MonotonicTime timestamp, WTF::UUID authorizationToken, uintptr_t signpostIdentifier)
-    : m_type(type)
-    , m_modifiers(modifiers)
-    , m_timestamp(timestamp)
-    , m_authorizationToken(authorizationToken)
-    , m_signpostIdentifier(signpostIdentifier)
-{
-}
 #endif
 
-WebEvent::WebEvent(WebEventType type, OptionSet<WebEventModifier> modifiers, MonotonicTime timestamp, WTF::UUID authorizationToken)
-    : m_type(type)
-    , m_modifiers(modifiers)
-    , m_timestamp(timestamp)
-    , m_authorizationToken(authorizationToken)
-#if PLATFORM(GTK) || PLATFORM(WPE)
-    , m_signpostIdentifier(generateSignpostIdentifier())
-#endif
+WebEvent::WebEvent(WebEventData&& data)
+    : m_data(WTF::move(data))
 {
 }
 
-WebEvent::WebEvent(WebEventType type, OptionSet<WebEventModifier> modifiers, MonotonicTime timestamp)
-    : m_type(type)
-    , m_modifiers(modifiers)
-    , m_timestamp(timestamp)
-    , m_authorizationToken(WTF::UUID::createVersion4())
-#if PLATFORM(GTK) || PLATFORM(WPE)
-    , m_signpostIdentifier(generateSignpostIdentifier())
-#endif
-{
-}
+WebEvent::~WebEvent() = default;
 
 // https://html.spec.whatwg.org/multipage/interaction.html#activation-triggering-input-event
 bool WebEvent::isActivationTriggeringEvent() const
diff --git a/Source/WebKit/Shared/WebEvent.h b/Source/WebKit/Shared/WebEvent.h
index 78b529ec78c2..9cc6e4b16eef 100644
--- a/Source/WebKit/Shared/WebEvent.h
+++ b/Source/WebKit/Shared/WebEvent.h
@@ -31,11 +31,10 @@
 
 #include "WebEventModifier.h"
 #include "WebEventType.h"
-#include <wtf/CheckedPtr.h>
 #include <wtf/MonotonicTime.h>
 #include <wtf/OptionSet.h>
-#include <wtf/RefCounted.h>
 #include <wtf/TZoneMalloc.h>
+#include <wtf/ThreadSafeRefCounted.h>
 #include <wtf/UUID.h>
 #include <wtf/text/WTFString.h>
 
@@ -48,45 +47,53 @@ namespace WebKit {
 
 enum class WebEventInputSource : uint8_t { UserDriven, Automation };
 
-class WebEvent : public CanMakeThreadSafeCheckedPtr<WebEvent, WTF::DefaultedOperatorEqual::No, WTF::CheckedPtrDeleteCheckException::Yes> {
-    WTF_MAKE_TZONE_ALLOCATED(WebEvent);
-    WTF_OVERRIDE_DELETE_FOR_CHECKED_PTR(WebEvent);
-public:
 #if PLATFORM(GTK) || PLATFORM(WPE)
-    WebEvent(WebEventType, OptionSet<WebEventModifier>, MonotonicTime timestamp, WTF::UUID authorizationToken, uintptr_t signpostIdentifier);
+uintptr_t generateSignpostIdentifier();
+#endif
+
+// Plain data for the fields common to every WebEvent. Passed to the create() function of each
+// concrete event class, which forwards it to the WebEvent constructor.
+struct WebEventData {
+    WebEventType type;
+    OptionSet<WebEventModifier> modifiers;
+    MonotonicTime timestamp;
+    WTF::UUID authorizationToken { WTF::UUID::createVersion4() };
+#if PLATFORM(GTK) || PLATFORM(WPE)
+    uintptr_t signpostIdentifier { generateSignpostIdentifier() };
 #endif
-    WebEvent(WebEventType, OptionSet<WebEventModifier>, MonotonicTime timestamp, WTF::UUID authorizationToken);
-    WebEvent(WebEventType, OptionSet<WebEventModifier>, MonotonicTime timestamp);
+};
 
-    virtual ~WebEvent() = default;
+class WebEvent : public ThreadSafeRefCounted<WebEvent> {
+    WTF_MAKE_TZONE_ALLOCATED(WebEvent);
+public:
+    virtual ~WebEvent();
 
-    WebEventType type() const { return m_type; }
+    WebEventType type() const { return m_data.type; }
 
-    bool shiftKey() const { return m_modifiers.contains(WebEventModifier::ShiftKey); }
-    bool controlKey() const { return m_modifiers.contains(WebEventModifier::ControlKey); }
-    bool altKey() const { return m_modifiers.contains(WebEventModifier::AltKey); }
-    bool metaKey() const { return m_modifiers.contains(WebEventModifier::MetaKey); }
-    bool capsLockKey() const { return m_modifiers.contains(WebEventModifier::CapsLockKey); }
+    bool shiftKey() const { return modifiers().contains(WebEventModifier::ShiftKey); }
+    bool controlKey() const { return modifiers().contains(WebEventModifier::ControlKey); }
+    bool altKey() const { return modifiers().contains(WebEventModifier::AltKey); }
+    bool metaKey() const { return modifiers().contains(WebEventModifier::MetaKey); }
+    bool capsLockKey() const { return modifiers().contains(WebEventModifier::CapsLockKey); }
 
-    OptionSet<WebEventModifier> modifiers() const { return m_modifiers; }
+    OptionSet<WebEventModifier> modifiers() const { return m_data.modifiers; }
 
-    MonotonicTime timestamp() const { return m_timestamp; }
+    MonotonicTime timestamp() const { return m_data.timestamp; }
 
     bool NODELETE isActivationTriggeringEvent() const;
-    WTF::UUID authorizationToken() const { return m_authorizationToken; }
+    WTF::UUID authorizationToken() const { return m_data.authorizationToken; }
 
 #if PLATFORM(GTK) || PLATFORM(WPE)
-    uintptr_t signpostIdentifier() const { return m_signpostIdentifier; }
+    uintptr_t signpostIdentifier() const { return m_data.signpostIdentifier; }
 #endif
 
+    const WebEventData& eventData() const LIFETIME_BOUND { return m_data; }
+
+protected:
+    explicit WebEvent(WebEventData&&);
+
 private:
-    WebEventType m_type;
-    OptionSet<WebEventModifier> m_modifiers;
-    MonotonicTime m_timestamp;
-    WTF::UUID m_authorizationToken;
-#if PLATFORM(GTK) || PLATFORM(WPE)
-    uintptr_t m_signpostIdentifier;
-#endif
+    WebEventData m_data;
 };
 
 WTF::TextStream& operator<<(WTF::TextStream&, WebEventType);
diff --git a/Source/WebKit/Shared/WebEvent.serialization.in b/Source/WebKit/Shared/WebEvent.serialization.in
index db3d623407ff..eeca53620abf 100644
--- a/Source/WebKit/Shared/WebEvent.serialization.in
+++ b/Source/WebKit/Shared/WebEvent.serialization.in
@@ -29,13 +29,13 @@
     AltGraphKey
 };
 
-class WebKit::WebEvent {
-    WebKit::WebEventType type();
-    OptionSet<WebKit::WebEventModifier> modifiers();
-    MonotonicTime timestamp();
-    WTF::UUID authorizationToken();
+[CustomHeader] struct WebKit::WebEventData {
+    WebKit::WebEventType type;
+    OptionSet<WebKit::WebEventModifier> modifiers;
+    MonotonicTime timestamp;
+    WTF::UUID authorizationToken;
 #if PLATFORM(GTK) || PLATFORM(WPE)
-    uintptr_t signpostIdentifier();
+    uintptr_t signpostIdentifier;
 #endif
 };
 
@@ -64,58 +64,68 @@ enum class WebKit::WebEventType : uint32_t {
 #endif
 };
 
-class WebKit::WebKeyboardEvent : WebKit::WebEvent {
-    String text();
+[CustomHeader] struct WebKit::WebKeyboardEventData {
+    String text;
 #if !PLATFORM(GTK) && !USE(LIBWPE) && !ENABLE(WPE_PLATFORM)
-    String unmodifiedText();
+    String unmodifiedText;
 #endif
-    String key();
-    String code();
-    String keyIdentifier();
-    int32_t windowsVirtualKeyCode();
-    int32_t nativeVirtualKeyCode();
+    String key;
+    String code;
+    String keyIdentifier;
+    int32_t windowsVirtualKeyCode;
+    int32_t nativeVirtualKeyCode;
 #if !PLATFORM(GTK) && !USE(LIBWPE) && !ENABLE(WPE_PLATFORM)
-    int32_t macCharCode();
+    int32_t macCharCode;
 #endif
 #if USE(APPKIT) || PLATFORM(IOS_FAMILY) || PLATFORM(GTK) || USE(LIBWPE) || ENABLE(WPE_PLATFORM)
-    bool handledByInputMethod();
+    bool handledByInputMethod;
 #endif
 #if PLATFORM(GTK) || USE(LIBWPE) || ENABLE(WPE_PLATFORM)
-    std::optional<Vector<WebCore::CompositionUnderline>> preeditUnderlines();
-    std::optional<WebKit::EditingRange> preeditSelectionRange();
+    std::optional<Vector<WebCore::CompositionUnderline>> preeditUnderlines;
+    std::optional<WebKit::EditingRange> preeditSelectionRange;
 #endif
 #if USE(APPKIT)
-    Vector<WebCore::KeypressCommand> commands();
+    Vector<WebCore::KeypressCommand> commands;
 #endif
 #if !USE(APPKIT) && PLATFORM(GTK)
-    Vector<String> commands();
+    Vector<String> commands;
 #endif
-    bool isAutoRepeat();
-    bool isKeypad();
+    bool isAutoRepeat;
+    bool isKeypad;
 #if !PLATFORM(GTK) && !USE(LIBWPE) && !ENABLE(WPE_PLATFORM)
-    bool isSystemKey();
+    bool isSystemKey;
 #endif
 };
 
+[RefCounted] class WebKit::WebKeyboardEvent {
+    WebKit::WebEventData eventData();
+    WebKit::WebKeyboardEventData keyboardData();
+};
+
 #if PLATFORM(IOS_FAMILY) && ENABLE(IOS_TOUCH_EVENTS)
 [Nested] enum class WebKit::WebPlatformTouchPoint::TouchType : bool
 #endif
 
 #if ENABLE(TOUCH_EVENTS)
-class WebKit::WebTouchEvent : WebKit::WebEvent {
-    Vector<WebKit::WebPlatformTouchPoint> touchPoints();
-    Vector<WebKit::WebTouchEvent> coalescedEvents();
-    Vector<WebKit::WebTouchEvent> predictedEvents();
+[CustomHeader] struct WebKit::WebTouchEventData {
+    Vector<WebKit::WebPlatformTouchPoint> touchPoints;
+    Vector<Ref<WebKit::WebTouchEvent>> coalescedEvents;
+    Vector<Ref<WebKit::WebTouchEvent>> predictedEvents;
 #if PLATFORM(IOS_FAMILY)
-    WebCore::DoublePoint position();
-    bool isPotentialTap();
-    bool isGesture();
-    float gestureScale();
-    float gestureRotation();
-    bool canPreventNativeGestures();
+    WebCore::DoublePoint position;
+    bool isPotentialTap;
+    bool isGesture;
+    float gestureScale;
+    float gestureRotation;
+    bool canPreventNativeGestures;
 #endif
 };
 
+[RefCounted] class WebKit::WebTouchEvent {
+    WebKit::WebEventData eventData();
+    WebKit::WebTouchEventData touchData();
+};
+
 [Nested] enum class WebKit::WebPlatformTouchPoint::State : uint8_t {
     Released,
     Pressed,
@@ -179,33 +189,38 @@ enum class WebCore::MouseEventCanInitiateDrag : bool;
 
 using WebCore::PointerID = uint32_t;
 
-class WebKit::WebMouseEvent : WebKit::WebEvent {
-    WebKit::WebMouseEventButton button();
-    unsigned short buttons();
-    WebCore::DoublePoint position();
-    WebCore::DoublePoint globalPosition();
-    float deltaX();
-    float deltaY();
-    float deltaZ();
-    int32_t clickCount();
-    double force();
-    WebKit::WebEventInputSource inputSource();
-    WebCore::MouseEventCanInitiateDrag canInitiateDrag();
-    WebKit::WebMouseEventSyntheticClickType syntheticClickType();
+[CustomHeader] struct WebKit::WebMouseEventData {
+    WebKit::WebMouseEventButton button;
+    unsigned short buttons;
+    WebCore::DoublePoint position;
+    WebCore::DoublePoint globalPosition;
+    float deltaX;
+    float deltaY;
+    float deltaZ;
+    int32_t clickCount;
+    double force;
+    WebKit::WebEventInputSource inputSource;
+    WebCore::MouseEventCanInitiateDrag canInitiateDrag;
+    WebKit::WebMouseEventSyntheticClickType syntheticClickType;
 #if PLATFORM(MAC)
-    int32_t eventNumber();
-    int32_t menuTypeForEvent();;
+    int32_t eventNumber;
+    int32_t menuTypeForEvent;
 #endif
 #if !PLATFORM(MAC) && PLATFORM(GTK)
-    WebCore::PlatformMouseEvent::IsTouch isTouchEvent();
+    WebCore::PlatformMouseEvent::IsTouch isTouchEvent;
 #endif
 #if !PLATFORM(MAC)
-    WebCore::PointerID pointerId();
-    String pointerType();
+    WebCore::PointerID pointerId;
+    String pointerType;
 #endif
-    WebKit::GestureWasCancelled gestureWasCancelled();
-    WebCore::DoublePoint unadjustedMovementDelta();
-    Vector<WebKit::WebMouseEvent> coalescedEvents();
+    WebKit::GestureWasCancelled gestureWasCancelled;
+    WebCore::DoublePoint unadjustedMovementDelta;
+    Vector<Ref<WebKit::WebMouseEvent>> coalescedEvents;
+};
+
+[RefCounted] class WebKit::WebMouseEvent {
+    WebKit::WebEventData eventData();
+    WebKit::WebMouseEventData mouseData();
 };
 
 #if !PLATFORM(MAC) && PLATFORM(GTK)
@@ -213,15 +228,20 @@ class WebKit::WebMouseEvent : WebKit::WebEvent {
 #endif
 
 #if ENABLE(MAC_GESTURE_EVENTS)
-class WebKit::WebGestureEvent : WebKit::WebEvent {
-    WebCore::IntPoint position();
-    float gestureScale();
-    float gestureRotation();
-    WebKit::WebEventPhase phase();
+[CustomHeader] struct WebKit::WebGestureEventData {
+    WebCore::IntPoint position;
+    float gestureScale;
+    float gestureRotation;
+    WebKit::WebEventPhase phase;
+};
+
+[RefCounted] class WebKit::WebGestureEvent {
+    WebKit::WebEventData eventData();
+    WebKit::WebGestureEventData gestureData();
 };
 #endif
 
-[Nested] enum class WebKit::WebWheelEvent::Granularity : uint8_t {
+enum class WebKit::WebWheelEventGranularity : uint8_t {
     ScrollByPageWheelEvent,
     ScrollByPixelWheelEvent
 };
@@ -237,34 +257,39 @@ enum class WebKit::WebEventPhase : uint8_t {
     WillBegin,
 };
 
-[Nested] enum class WebKit::WebWheelEvent::MomentumEndType : uint8_t {
+enum class WebKit::WebWheelEventMomentumEndType : uint8_t {
     Unknown,
     Interrupted,
     Natural,
 };
 
-class WebKit::WebWheelEvent : WebKit::WebEvent {
-    WebCore::IntPoint position();
-    WebCore::IntPoint globalPosition();
-    WebCore::FloatSize delta();
-    WebCore::FloatSize wheelTicks();
-    WebKit::WebWheelEvent::Granularity granularity();
+[CustomHeader] struct WebKit::WebWheelEventData {
+    WebCore::IntPoint position;
+    WebCore::IntPoint globalPosition;
+    WebCore::FloatSize delta;
+    WebCore::FloatSize wheelTicks;
+    WebKit::WebWheelEventGranularity granularity;
 #if PLATFORM(COCOA)
-    bool directionInvertedFromDevice();
+    bool directionInvertedFromDevice;
 #endif
 #if PLATFORM(COCOA) || PLATFORM(GTK) || USE(LIBWPE) || ENABLE(WPE_PLATFORM)
-    WebKit::WebEventPhase phase();
-    WebKit::WebEventPhase momentumPhase();
-    bool hasPreciseScrollingDeltas();
+    WebKit::WebEventPhase phase;
+    WebKit::WebEventPhase momentumPhase;
+    bool hasPreciseScrollingDeltas;
 #endif
 #if PLATFORM(COCOA)
-    uint32_t scrollCount();
-    WebCore::FloatSize unacceleratedScrollingDelta();
-    MonotonicTime ioHIDEventTimestamp();
-    std::optional<WebCore::FloatSize> rawPlatformDelta();
-    WebKit::WebWheelEvent::MomentumEndType momentumEndType();
-    WebKit::WebEventInputSource inputSource();
-    float momentumFastScrollMultiplier();
+    uint32_t scrollCount;
+    WebCore::FloatSize unacceleratedScrollingDelta;
+    MonotonicTime ioHIDEventTimestamp;
+    std::optional<WebCore::FloatSize> rawPlatformDelta;
+    WebKit::WebWheelEventMomentumEndType momentumEndType;
+    WebKit::WebEventInputSource inputSource;
+    float momentumFastScrollMultiplier;
 #endif
 };
 
+[RefCounted] class WebKit::WebWheelEvent {
+    WebKit::WebEventData eventData();
+    WebKit::WebWheelEventData wheelData();
+};
+
diff --git a/Source/WebKit/Shared/WebEventConversion.cpp b/Source/WebKit/Shared/WebEventConversion.cpp
index 3ea9ca5f2ddc..6615e66b3a6a 100644
--- a/Source/WebKit/Shared/WebEventConversion.cpp
+++ b/Source/WebKit/Shared/WebEventConversion.cpp
@@ -294,10 +294,10 @@ class WebKit2PlatformMouseEvent : public WebCore::PlatformMouseEvent {
         m_clickCount = webEvent.clickCount();
         m_force = forceForEvent(webEvent);
         m_coalescedEvents = WTF::map(webEvent.coalescedEvents(), [&](const auto& event) {
-            return platform(event);
+            return platform(event.get());
         });
         m_predictedEvents = WTF::map(webEvent.predictedEvents(), [&](const auto& event) {
-            return platform(event);
+            return platform(event.get());
         });
         m_inputSource = platform(webEvent.inputSource());
         m_canInitiateDrag = webEvent.canInitiateDrag();
@@ -523,11 +523,11 @@ class WebKit2PlatformTouchEvent : public WebCore::PlatformTouchEvent {
         });
 
         m_coalescedEvents = WTF::map(webEvent.coalescedEvents(), [&](auto& event) {
-            return platform(event);
+            return platform(event.get());
         });
 
         m_predictedEvents = WTF::map(webEvent.predictedEvents(), [&](auto& event) {
-            return platform(event);
+            return platform(event.get());
         });
 
         m_gestureScale = webEvent.gestureScale();
diff --git a/Source/WebKit/Shared/WebGL.serialization.in b/Source/WebKit/Shared/WebGL.serialization.in
index 7ed1862c2cb2..ecdd4f3a1e9c 100644
--- a/Source/WebKit/Shared/WebGL.serialization.in
+++ b/Source/WebKit/Shared/WebGL.serialization.in
@@ -106,7 +106,7 @@ using WebCore::GraphicsContextGL::ExternalSyncSource = std::tuple<MachSendRight,
 #if OS(ANDROID)
     RefPtr<AHardwareBuffer> hardwareBuffer;
 #else
-    Vector<WTF::UnixFileDescriptor> fds;
+    Vector<UnixFileDescriptor> fds;
     Vector<uint32_t> strides;
     Vector<uint32_t> offsets;
     uint32_t fourcc;
diff --git a/Source/WebKit/Shared/WebKeyboardEvent.cpp b/Source/WebKit/Shared/WebKeyboardEvent.cpp
index fcadde7e024c..155236933650 100644
--- a/Source/WebKit/Shared/WebKeyboardEvent.cpp
+++ b/Source/WebKit/Shared/WebKeyboardEvent.cpp
@@ -27,116 +27,29 @@
 #include "WebKeyboardEvent.h"
 
 #include <WebCore/KeypressCommand.h>
+#include <wtf/TZoneMallocInlines.h>
 
 namespace WebKit {
 
-#if USE(APPKIT)
+WTF_MAKE_TZONE_ALLOCATED_IMPL(WebKeyboardEvent);
 
-WebKeyboardEvent::WebKeyboardEvent(WebEvent&& event, const String& text, const String& unmodifiedText, const String& key, const String& code, const String& keyIdentifier, int windowsVirtualKeyCode, int nativeVirtualKeyCode, int macCharCode, bool handledByInputMethod, const Vector<WebCore::KeypressCommand>& commands, bool isAutoRepeat, bool isKeypad, bool isSystemKey)
-    : WebEvent(WTF::move(event))
-    , m_text(text)
-    , m_unmodifiedText(unmodifiedText)
-    , m_key(key)
-    , m_code(code)
-    , m_keyIdentifier(keyIdentifier)
-    , m_windowsVirtualKeyCode(windowsVirtualKeyCode)
-    , m_nativeVirtualKeyCode(nativeVirtualKeyCode)
-    , m_macCharCode(macCharCode)
-    , m_handledByInputMethod(handledByInputMethod)
-    , m_commands(commands)
-    , m_isAutoRepeat(isAutoRepeat)
-    , m_isKeypad(isKeypad)
-    , m_isSystemKey(isSystemKey)
+Ref<WebKeyboardEvent> WebKeyboardEvent::create(WebEventData&& eventData, WebKeyboardEventData&& keyboardData)
 {
-    ASSERT(isKeyboardEventType(type()));
+    return adoptRef(*new WebKeyboardEvent(WTF::move(eventData), WTF::move(keyboardData)));
 }
 
-#elif PLATFORM(GTK)
-
-WebKeyboardEvent::WebKeyboardEvent(WebEvent&& event, const String& text, const String& key, const String& code, const String& keyIdentifier, int windowsVirtualKeyCode, int nativeVirtualKeyCode, bool handledByInputMethod, std::optional<Vector<WebCore::CompositionUnderline>>&& preeditUnderlines, std::optional<EditingRange>&& preeditSelectionRange, Vector<String>&& commands, bool isAutoRepeat, bool isKeypad)
-    : WebEvent(WTF::move(event))
-    , m_text(text)
-    , m_unmodifiedText(text)
-    , m_key(key)
-    , m_code(code)
-    , m_keyIdentifier(keyIdentifier)
-    , m_windowsVirtualKeyCode(windowsVirtualKeyCode)
-    , m_nativeVirtualKeyCode(nativeVirtualKeyCode)
-    , m_macCharCode(0)
-    , m_handledByInputMethod(handledByInputMethod)
-    , m_preeditUnderlines(WTF::move(preeditUnderlines))
-    , m_preeditSelectionRange(WTF::move(preeditSelectionRange))
-    , m_commands(WTF::move(commands))
-    , m_isAutoRepeat(isAutoRepeat)
-    , m_isKeypad(isKeypad)
-    , m_isSystemKey(false)
+Ref<WebKeyboardEvent> WebKeyboardEvent::create(WebKeyboardEventInit&& init)
 {
-    ASSERT(isKeyboardEventType(type()));
+    return create(WTF::move(init.event), WTF::move(init.keyboard));
 }
 
-#elif PLATFORM(IOS_FAMILY)
-
-WebKeyboardEvent::WebKeyboardEvent(WebEvent&& event, const String& text, const String& unmodifiedText, const String& key, const String& code, const String& keyIdentifier, int windowsVirtualKeyCode, int nativeVirtualKeyCode, int macCharCode, bool handledByInputMethod, bool isAutoRepeat, bool isKeypad, bool isSystemKey)
-    : WebEvent(WTF::move(event))
-    , m_text(text)
-    , m_unmodifiedText(unmodifiedText)
-    , m_key(key)
-    , m_code(code)
-    , m_keyIdentifier(keyIdentifier)
-    , m_windowsVirtualKeyCode(windowsVirtualKeyCode)
-    , m_nativeVirtualKeyCode(nativeVirtualKeyCode)
-    , m_macCharCode(macCharCode)
-    , m_handledByInputMethod(handledByInputMethod)
-    , m_isAutoRepeat(isAutoRepeat)
-    , m_isKeypad(isKeypad)
-    , m_isSystemKey(isSystemKey)
+WebKeyboardEvent::WebKeyboardEvent(WebEventData&& eventData, WebKeyboardEventData&& keyboardData)
+    : WebEvent(WTF::move(eventData))
+    , m_data(WTF::move(keyboardData))
 {
     ASSERT(isKeyboardEventType(type()));
 }
 
-#elif USE(LIBWPE) || ENABLE(WPE_PLATFORM)
-
-WebKeyboardEvent::WebKeyboardEvent(WebEvent&& event, const String& text, const String& key, const String& code, const String& keyIdentifier, int windowsVirtualKeyCode, int nativeVirtualKeyCode, bool handledByInputMethod, std::optional<Vector<WebCore::CompositionUnderline>>&& preeditUnderlines, std::optional<EditingRange>&& preeditSelectionRange, bool isAutoRepeat, bool isKeypad)
-    : WebEvent(WTF::move(event))
-    , m_text(text)
-    , m_unmodifiedText(text)
-    , m_key(key)
-    , m_code(code)
-    , m_keyIdentifier(keyIdentifier)
-    , m_windowsVirtualKeyCode(windowsVirtualKeyCode)
-    , m_nativeVirtualKeyCode(nativeVirtualKeyCode)
-    , m_macCharCode(0)
-    , m_handledByInputMethod(handledByInputMethod)
-    , m_preeditUnderlines(WTF::move(preeditUnderlines))
-    , m_preeditSelectionRange(WTF::move(preeditSelectionRange))
-    , m_isAutoRepeat(isAutoRepeat)
-    , m_isKeypad(isKeypad)
-    , m_isSystemKey(false)
-{
-    ASSERT(isKeyboardEventType(type()));
-}
-
-#else
-
-WebKeyboardEvent::WebKeyboardEvent(WebEvent&& event, const String& text, const String& unmodifiedText, const String& key, const String& code, const String& keyIdentifier, int windowsVirtualKeyCode, int nativeVirtualKeyCode, int macCharCode, bool isAutoRepeat, bool isKeypad, bool isSystemKey)
-    : WebEvent(WTF::move(event))
-    , m_text(text)
-    , m_unmodifiedText(unmodifiedText)
-    , m_key(key)
-    , m_code(code)
-    , m_keyIdentifier(keyIdentifier)
-    , m_windowsVirtualKeyCode(windowsVirtualKeyCode)
-    , m_nativeVirtualKeyCode(nativeVirtualKeyCode)
-    , m_macCharCode(macCharCode)
-    , m_isAutoRepeat(isAutoRepeat)
-    , m_isKeypad(isKeypad)
-    , m_isSystemKey(isSystemKey)
-{
-    ASSERT(isKeyboardEventType(type()));
-}
-
-#endif
-
 WebKeyboardEvent::~WebKeyboardEvent() = default;
 
 bool WebKeyboardEvent::isKeyboardEventType(WebEventType type)
diff --git a/Source/WebKit/Shared/WebKeyboardEvent.h b/Source/WebKit/Shared/WebKeyboardEvent.h
index 8915f44919a1..888b14ef70bd 100644
--- a/Source/WebKit/Shared/WebKeyboardEvent.h
+++ b/Source/WebKit/Shared/WebKeyboardEvent.h
@@ -36,48 +36,96 @@
 
 namespace WebKit {
 
+class WebKeyboardEvent;
+
+// Field order matches WebEvent.serialization.in. On GTK/WPE, unmodifiedText, macCharCode and
+// isSystemKey are not stored because no constructor on those platforms sets them.
+struct WebKeyboardEventData {
+    String text;
+#if !PLATFORM(GTK) && !USE(LIBWPE) && !ENABLE(WPE_PLATFORM)
+    String unmodifiedText;
+#endif
+    String key;
+    String code;
+    String keyIdentifier;
+    int32_t windowsVirtualKeyCode { 0 };
+    int32_t nativeVirtualKeyCode { 0 };
+#if !PLATFORM(GTK) && !USE(LIBWPE) && !ENABLE(WPE_PLATFORM)
+    int32_t macCharCode { 0 };
+#endif
+#if USE(APPKIT) || PLATFORM(IOS_FAMILY) || PLATFORM(GTK) || USE(LIBWPE) || ENABLE(WPE_PLATFORM)
+    bool handledByInputMethod { false };
+#endif
+#if PLATFORM(GTK) || USE(LIBWPE) || ENABLE(WPE_PLATFORM)
+    std::optional<Vector<WebCore::CompositionUnderline>> preeditUnderlines;
+    std::optional<EditingRange> preeditSelectionRange;
+#endif
+#if USE(APPKIT)
+    Vector<WebCore::KeypressCommand> commands;
+#elif PLATFORM(GTK)
+    Vector<String> commands;
+#endif
+    bool isAutoRepeat { false };
+    bool isKeypad { false };
+#if !PLATFORM(GTK) && !USE(LIBWPE) && !ENABLE(WPE_PLATFORM)
+    bool isSystemKey { false };
+#endif
+};
+
+struct WebKeyboardEventInit {
+    WebEventData event;
+    WebKeyboardEventData keyboard;
+};
+
 class WebKeyboardEvent : public WebEvent {
+    WTF_MAKE_TZONE_ALLOCATED(WebKeyboardEvent);
 public:
+    static Ref<WebKeyboardEvent> create(WebEventData&&, WebKeyboardEventData&&);
+    static Ref<WebKeyboardEvent> create(WebKeyboardEventInit&&);
+
     ~WebKeyboardEvent();
 
-#if USE(APPKIT)
-    WebKeyboardEvent(WebEvent&&, const String& text, const String& unmodifiedText, const String& key, const String& code, const String& keyIdentifier, int windowsVirtualKeyCode, int nativeVirtualKeyCode, int macCharCode, bool handledByInputMethod, const Vector<WebCore::KeypressCommand>&, bool isAutoRepeat, bool isKeypad, bool isSystemKey);
-#elif PLATFORM(GTK)
-    WebKeyboardEvent(WebEvent&&, const String& text, const String& key, const String& code, const String& keyIdentifier, int windowsVirtualKeyCode, int nativeVirtualKeyCode, bool handledByInputMethod, std::optional<Vector<WebCore::CompositionUnderline>>&&, std::optional<EditingRange>&&, Vector<String>&& commands, bool isAutoRepeat, bool isKeypad);
-#elif PLATFORM(IOS_FAMILY)
-    WebKeyboardEvent(WebEvent&&, const String& text, const String& unmodifiedText, const String& key, const String& code, const String& keyIdentifier, int windowsVirtualKeyCode, int nativeVirtualKeyCode, int macCharCode, bool handledByInputMethod, bool isAutoRepeat, bool isKeypad, bool isSystemKey);
-#elif USE(LIBWPE) || ENABLE(WPE_PLATFORM)
-    WebKeyboardEvent(WebEvent&&, const String& text, const String& key, const String& code, const String& keyIdentifier, int windowsVirtualKeyCode, int nativeVirtualKeyCode, bool handledByInputMethod, std::optional<Vector<WebCore::CompositionUnderline>>&&, std::optional<EditingRange>&&, bool isAutoRepeat, bool isKeypad);
+    const String& text() const LIFETIME_BOUND { return m_data.text; }
+#if !PLATFORM(GTK) && !USE(LIBWPE) && !ENABLE(WPE_PLATFORM)
+    const String& unmodifiedText() const LIFETIME_BOUND { return m_data.unmodifiedText; }
 #else
-    WebKeyboardEvent(WebEvent&&, const String& text, const String& unmodifiedText, const String& key, const String& code, const String& keyIdentifier, int windowsVirtualKeyCode, int nativeVirtualKeyCode, int macCharCode, bool isAutoRepeat, bool isKeypad, bool isSystemKey);
+    // Always identical to text() on this platform.
+    const String& unmodifiedText() const LIFETIME_BOUND { return m_data.text; }
 #endif
-
-    const String& text() const LIFETIME_BOUND { return m_text; }
-    const String& unmodifiedText() const LIFETIME_BOUND { return m_unmodifiedText; }
-    const String& key() const LIFETIME_BOUND { return m_key; }
-    const String& code() const LIFETIME_BOUND { return m_code; }
-    const String& keyIdentifier() const LIFETIME_BOUND { return m_keyIdentifier; }
-    int32_t windowsVirtualKeyCode() const { return m_windowsVirtualKeyCode; }
+    const String& key() const LIFETIME_BOUND { return m_data.key; }
+    const String& code() const LIFETIME_BOUND { return m_data.code; }
+    const String& keyIdentifier() const LIFETIME_BOUND { return m_data.keyIdentifier; }
+    int32_t windowsVirtualKeyCode() const { return m_data.windowsVirtualKeyCode; }
 #if PLATFORM(WIN)
-    void setWindowsVirtualKeyCode(int32_t keyCode) { m_windowsVirtualKeyCode = keyCode; }
+    void setWindowsVirtualKeyCode(int32_t keyCode) { m_data.windowsVirtualKeyCode = keyCode; }
+#endif
+    int32_t nativeVirtualKeyCode() const { return m_data.nativeVirtualKeyCode; }
+#if !PLATFORM(GTK) && !USE(LIBWPE) && !ENABLE(WPE_PLATFORM)
+    int32_t macCharCode() const { return m_data.macCharCode; }
+#else
+    int32_t macCharCode() const { return 0; }
 #endif
-    int32_t nativeVirtualKeyCode() const { return m_nativeVirtualKeyCode; }
-    int32_t macCharCode() const { return m_macCharCode; }
 #if USE(APPKIT) || PLATFORM(IOS_FAMILY) || PLATFORM(GTK) || USE(LIBWPE) || ENABLE(WPE_PLATFORM)
-    bool handledByInputMethod() const { return m_handledByInputMethod; }
+    bool handledByInputMethod() const { return m_data.handledByInputMethod; }
 #endif
 #if PLATFORM(GTK) || USE(LIBWPE) || ENABLE(WPE_PLATFORM)
-    const std::optional<Vector<WebCore::CompositionUnderline>>& preeditUnderlines() const LIFETIME_BOUND { return m_preeditUnderlines; }
-    const std::optional<EditingRange>& preeditSelectionRange() const LIFETIME_BOUND { return m_preeditSelectionRange; }
+    const std::optional<Vector<WebCore::CompositionUnderline>>& preeditUnderlines() const LIFETIME_BOUND { return m_data.preeditUnderlines; }
+    const std::optional<EditingRange>& preeditSelectionRange() const LIFETIME_BOUND { return m_data.preeditSelectionRange; }
 #endif
 #if USE(APPKIT)
-    const Vector<WebCore::KeypressCommand>& commands() const LIFETIME_BOUND { return m_commands; }
+    const Vector<WebCore::KeypressCommand>& commands() const LIFETIME_BOUND { return m_data.commands; }
 #elif PLATFORM(GTK)
-    const Vector<String>& commands() const LIFETIME_BOUND { return m_commands; }
+    const Vector<String>& commands() const LIFETIME_BOUND { return m_data.commands; }
+#endif
+    bool isAutoRepeat() const { return m_data.isAutoRepeat; }
+    bool isKeypad() const { return m_data.isKeypad; }
+#if !PLATFORM(GTK) && !USE(LIBWPE) && !ENABLE(WPE_PLATFORM)
+    bool isSystemKey() const { return m_data.isSystemKey; }
+#else
+    bool isSystemKey() const { return false; }
 #endif
-    bool isAutoRepeat() const { return m_isAutoRepeat; }
-    bool isKeypad() const { return m_isKeypad; }
-    bool isSystemKey() const { return m_isSystemKey; }
+
+    const WebKeyboardEventData& keyboardData() const LIFETIME_BOUND { return m_data; }
 
     static bool NODELETE isKeyboardEventType(WebEventType);
 
@@ -96,30 +144,11 @@ class WebKeyboardEvent : public WebEvent {
     static String singleCharacterStringForGdkKeyval(unsigned);
 #endif
 
+protected:
+    WebKeyboardEvent(WebEventData&&, WebKeyboardEventData&&);
+
 private:
-    String m_text;
-    String m_unmodifiedText;
-    String m_key;
-    String m_code;
-    String m_keyIdentifier;
-    int32_t m_windowsVirtualKeyCode { 0 };
-    int32_t m_nativeVirtualKeyCode { 0 };
-    int32_t m_macCharCode { 0 };
-#if USE(APPKIT) || PLATFORM(IOS_FAMILY) || PLATFORM(GTK) || USE(LIBWPE) || ENABLE(WPE_PLATFORM)
-    bool m_handledByInputMethod { false };
-#endif
-#if PLATFORM(GTK) || USE(LIBWPE) || ENABLE(WPE_PLATFORM)
-    std::optional<Vector<WebCore::CompositionUnderline>> m_preeditUnderlines;
-    std::optional<EditingRange> m_preeditSelectionRange;
-#endif
-#if USE(APPKIT)
-    Vector<WebCore::KeypressCommand> m_commands;
-#elif PLATFORM(GTK)
-    Vector<String> m_commands;
-#endif
-    bool m_isAutoRepeat { false };
-    bool m_isKeypad { false };
-    bool m_isSystemKey { false };
+    WebKeyboardEventData m_data;
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit/Shared/WebMouseEvent.cpp b/Source/WebKit/Shared/WebMouseEvent.cpp
index 884bd871a816..0472a1472dbc 100644
--- a/Source/WebKit/Shared/WebMouseEvent.cpp
+++ b/Source/WebKit/Shared/WebMouseEvent.cpp
@@ -29,44 +29,33 @@
 #include "WebEventConversion.h"
 #include <WebCore/MouseEventTypes.h>
 #include <WebCore/NavigationAction.h>
+#include <wtf/TZoneMallocInlines.h>
 
 namespace WebKit {
 using namespace WebCore;
 
-#if PLATFORM(MAC)
-WebMouseEvent::WebMouseEvent(WebEvent&& event, WebMouseEventButton button, unsigned short buttons, const DoublePoint& positionInView, const DoublePoint& globalPosition, float deltaX, float deltaY, float deltaZ, int clickCount, double force, WebEventInputSource inputSource, PlatformMouseEvent::CanInitiateDrag canInitiateDrag, WebMouseEventSyntheticClickType syntheticClickType, int eventNumber, int menuType, GestureWasCancelled gestureWasCancelled, const DoublePoint& unadjustedMovementDelta, const Vector<WebMouseEvent>& coalescedEvents, const Vector<WebMouseEvent>& predictedEvents)
-#elif PLATFORM(GTK)
-WebMouseEvent::WebMouseEvent(WebEvent&& event, WebMouseEventButton button, unsigned short buttons, const DoublePoint& positionInView, const DoublePoint& globalPosition, float deltaX, float deltaY, float deltaZ, int clickCount, double force, WebEventInputSource inputSource, PlatformMouseEvent::CanInitiateDrag canInitiateDrag, WebMouseEventSyntheticClickType syntheticClickType, PlatformMouseEvent::IsTouch isTouchEvent, WebCore::PointerID pointerId, const String& pointerType, GestureWasCancelled gestureWasCancelled, const DoublePoint& unadjustedMovementDelta, const Vector<WebMouseEvent>& coalescedEvents, const Vector<WebMouseEvent>& predictedEvents)
-#else
-WebMouseEvent::WebMouseEvent(WebEvent&& event, WebMouseEventButton button, unsigned short buttons, const DoublePoint& positionInView, const DoublePoint& globalPosition, float deltaX, float deltaY, float deltaZ, int clickCount, double force, WebEventInputSource inputSource, PlatformMouseEvent::CanInitiateDrag canInitiateDrag, WebMouseEventSyntheticClickType syntheticClickType, WebCore::PointerID pointerId, const String& pointerType, GestureWasCancelled gestureWasCancelled, const DoublePoint& unadjustedMovementDelta, const Vector<WebMouseEvent>& coalescedEvents, const Vector<WebMouseEvent>& predictedEvents)
-#endif
-    : WebEvent(WTF::move(event))
-    , m_button(button)
-    , m_buttons(buttons)
-    , m_position(positionInView)
-    , m_globalPosition(globalPosition)
-    , m_deltaX(deltaX)
-    , m_deltaY(deltaY)
-    , m_deltaZ(deltaZ)
-    , m_unadjustedMovementDelta(unadjustedMovementDelta)
-    , m_clickCount(clickCount)
-#if PLATFORM(MAC)
-    , m_eventNumber(eventNumber)
-    , m_menuTypeForEvent(menuType)
-#elif PLATFORM(GTK)
-    , m_isTouchEvent(isTouchEvent)
-#endif
-    , m_force(force)
-    , m_inputSource(inputSource)
-    , m_canInitiateDrag(canInitiateDrag)
-    , m_syntheticClickType(syntheticClickType)
-#if !PLATFORM(MAC)
-    , m_pointerId(pointerId)
-    , m_pointerType(pointerType)
-#endif
-    , m_gestureWasCancelled(gestureWasCancelled)
-    , m_coalescedEvents(coalescedEvents)
-    , m_predictedEvents(predictedEvents)
+WTF_MAKE_TZONE_ALLOCATED_IMPL(WebMouseEvent);
+
+Ref<WebMouseEvent> WebMouseEvent::create(WebEventData&& eventData, WebMouseEventData&& mouseData)
+{
+    return adoptRef(*new WebMouseEvent(WTF::move(eventData), WTF::move(mouseData)));
+}
+
+Ref<WebMouseEvent> WebMouseEvent::create(WebMouseEventInit&& init)
+{
+    return create(WTF::move(init.event), WTF::move(init.mouse));
+}
+
+Ref<WebMouseEvent> WebMouseEvent::copy() const
+{
+    Ref copy = create(WebEventData { eventData() }, WebMouseEventData { m_data });
+    copy->setPredictedEvents(m_predictedEvents);
+    return copy;
+}
+
+WebMouseEvent::WebMouseEvent(WebEventData&& eventData, WebMouseEventData&& mouseData)
+    : WebEvent(WTF::move(eventData))
+    , m_data(WTF::move(mouseData))
 {
     ASSERT(isMouseEventType(type()));
 }
diff --git a/Source/WebKit/Shared/WebMouseEvent.h b/Source/WebKit/Shared/WebMouseEvent.h
index 10729b775bca..1b51c9b95bdc 100644
--- a/Source/WebKit/Shared/WebMouseEvent.h
+++ b/Source/WebKit/Shared/WebMouseEvent.h
@@ -62,74 +62,101 @@ enum class WebMouseEventSyntheticClickType : uint8_t {
 WebMouseEventSyntheticClickType NODELETE syntheticClickType(const WebCore::NavigationAction&);
 WebCore::SyntheticClickType NODELETE coreSyntheticClickType(WebMouseEventSyntheticClickType);
 
-class WebMouseEvent : public WebEvent {
-public:
+class WebMouseEvent;
+
+// Field order matches WebEvent.serialization.in. Predicted events are deliberately absent because
+// they are not sent over IPC; WebMouseEvent stores them separately.
+struct WebMouseEventData {
+    WebMouseEventButton button { WebMouseEventButton::None };
+    unsigned short buttons { 0 };
+    WebCore::DoublePoint position; // Relative to the view.
+    WebCore::DoublePoint globalPosition;
+    float deltaX { 0 };
+    float deltaY { 0 };
+    float deltaZ { 0 };
+    int32_t clickCount { 0 };
+    double force { 0 };
+    WebEventInputSource inputSource { WebEventInputSource::UserDriven };
+    WebCore::PlatformMouseEvent::CanInitiateDrag canInitiateDrag { WebCore::PlatformMouseEvent::CanInitiateDrag::Yes };
+    WebMouseEventSyntheticClickType syntheticClickType { WebMouseEventSyntheticClickType::NoTap };
 #if PLATFORM(MAC)
-    WebMouseEvent(WebEvent&&, WebMouseEventButton, unsigned short buttons, const WebCore::DoublePoint& positionInView, const WebCore::DoublePoint& globalPosition, float deltaX, float deltaY, float deltaZ, int clickCount, double force, WebEventInputSource inputSource, WebCore::PlatformMouseEvent::CanInitiateDrag = WebCore::PlatformMouseEvent::CanInitiateDrag::Yes, WebMouseEventSyntheticClickType = WebMouseEventSyntheticClickType::NoTap, int eventNumber = -1, int menuType = 0, GestureWasCancelled = GestureWasCancelled::No, const WebCore::DoublePoint& unadjustedMovementDelta = { }, const Vector<WebMouseEvent>& coalescedEvents = { }, const Vector<WebMouseEvent>& predictedEvents = { });
+    int32_t eventNumber { -1 };
+    int32_t menuTypeForEvent { 0 };
 #elif PLATFORM(GTK)
-    WebMouseEvent(WebEvent&&, WebMouseEventButton, unsigned short buttons, const WebCore::DoublePoint& positionInView, const WebCore::DoublePoint& globalPosition, float deltaX, float deltaY, float deltaZ, int clickCount, double force, WebEventInputSource inputSource, WebCore::PlatformMouseEvent::CanInitiateDrag = WebCore::PlatformMouseEvent::CanInitiateDrag::Yes, WebMouseEventSyntheticClickType = WebMouseEventSyntheticClickType::NoTap, WebCore::PlatformMouseEvent::IsTouch m_isTouchEvent = WebCore::PlatformMouseEvent::IsTouch::No, WebCore::PointerID = WebCore::mousePointerID, const String& pointerType = WebCore::mousePointerEventType(), GestureWasCancelled = GestureWasCancelled::No, const WebCore::DoublePoint& unadjustedMovementDelta = { }, const Vector<WebMouseEvent>& coalescedEvents = { }, const Vector<WebMouseEvent>& predictedEvents = { });
-#else
-    WebMouseEvent(WebEvent&&, WebMouseEventButton, unsigned short buttons, const WebCore::DoublePoint& positionInView, const WebCore::DoublePoint& globalPosition, float deltaX, float deltaY, float deltaZ, int clickCount, double force, WebEventInputSource inputSource, WebCore::PlatformMouseEvent::CanInitiateDrag = WebCore::PlatformMouseEvent::CanInitiateDrag::Yes, WebMouseEventSyntheticClickType = WebMouseEventSyntheticClickType::NoTap, WebCore::PointerID = WebCore::mousePointerID, const String& pointerType = WebCore::mousePointerEventType(), GestureWasCancelled = GestureWasCancelled::No, const WebCore::DoublePoint& unadjustedMovementDelta = { }, const Vector<WebMouseEvent>& coalescedEvents = { }, const Vector<WebMouseEvent>& predictedEvents = { });
+    WebCore::PlatformMouseEvent::IsTouch isTouchEvent { WebCore::PlatformMouseEvent::IsTouch::No };
 #endif
+#if !PLATFORM(MAC)
+    WebCore::PointerID pointerId { WebCore::mousePointerID };
+    String pointerType { WebCore::mousePointerEventType() };
+#endif
+    GestureWasCancelled gestureWasCancelled { GestureWasCancelled::No };
+    WebCore::DoublePoint unadjustedMovementDelta;
+    Vector<Ref<WebMouseEvent>> coalescedEvents;
+};
 
-    WebMouseEventButton button() const { return m_button; }
-    unsigned short buttons() const { return m_buttons; }
-    const WebCore::DoublePoint& position() const { return m_position; } // Relative to the view.
-    void setPosition(const WebCore::DoublePoint& position) { m_position = position; }
-    const WebCore::DoublePoint& globalPosition() const LIFETIME_BOUND { return m_globalPosition; }
-    float deltaX() const { return m_deltaX; }
-    float deltaY() const { return m_deltaY; }
-    float deltaZ() const { return m_deltaZ; }
-    int32_t clickCount() const { return m_clickCount; }
+struct WebMouseEventInit {
+    WebEventData event;
+    WebMouseEventData mouse;
+};
+
+class WebMouseEvent : public WebEvent {
+    WTF_MAKE_TZONE_ALLOCATED(WebMouseEvent);
+public:
+    static Ref<WebMouseEvent> create(WebEventData&&, WebMouseEventData&&);
+    static Ref<WebMouseEvent> create(WebMouseEventInit&&);
+
+    // Callers that mutate an event they did not create must copy first, since events are now shared
+    // rather than copied by value. Shallow: nothing mutates the coalesced or predicted events.
+    Ref<WebMouseEvent> copy() const;
+
+    WebMouseEventButton button() const { return m_data.button; }
+    unsigned short buttons() const { return m_data.buttons; }
+    const WebCore::DoublePoint& position() const LIFETIME_BOUND { return m_data.position; } // Relative to the view.
+    void setPosition(const WebCore::DoublePoint& position) { m_data.position = position; }
+    const WebCore::DoublePoint& globalPosition() const LIFETIME_BOUND { return m_data.globalPosition; }
+    float deltaX() const { return m_data.deltaX; }
+    float deltaY() const { return m_data.deltaY; }
+    float deltaZ() const { return m_data.deltaZ; }
+    int32_t clickCount() const { return m_data.clickCount; }
 #if PLATFORM(MAC)
-    int32_t eventNumber() const { return m_eventNumber; }
-    int32_t menuTypeForEvent() const { return m_menuTypeForEvent; }
+    int32_t eventNumber() const { return m_data.eventNumber; }
+    int32_t menuTypeForEvent() const { return m_data.menuTypeForEvent; }
 #elif PLATFORM(GTK)
-    WebCore::PlatformMouseEvent::IsTouch isTouchEvent() const { return m_isTouchEvent; }
+    WebCore::PlatformMouseEvent::IsTouch isTouchEvent() const { return m_data.isTouchEvent; }
 #endif
-    double force() const { return m_force; }
-    WebEventInputSource inputSource() const { return m_inputSource; }
-    WebCore::PlatformMouseEvent::CanInitiateDrag canInitiateDrag() const { return m_canInitiateDrag; }
-    WebMouseEventSyntheticClickType syntheticClickType() const { return m_syntheticClickType; }
-    WebCore::PointerID pointerId() const { return m_pointerId; }
-    const String& pointerType() const LIFETIME_BOUND { return m_pointerType; }
-    GestureWasCancelled gestureWasCancelled() const { return m_gestureWasCancelled; }
+    double force() const { return m_data.force; }
+    WebEventInputSource inputSource() const { return m_data.inputSource; }
+    WebCore::PlatformMouseEvent::CanInitiateDrag canInitiateDrag() const { return m_data.canInitiateDrag; }
+    WebMouseEventSyntheticClickType syntheticClickType() const { return m_data.syntheticClickType; }
+#if PLATFORM(MAC)
+    // No constructor on this platform takes these, so the defaults are the only possible values.
+    WebCore::PointerID pointerId() const { return WebCore::mousePointerID; }
+    const String& pointerType() const LIFETIME_BOUND { return WebCore::mousePointerEventType(); }
+#else
+    WebCore::PointerID pointerId() const { return m_data.pointerId; }
+    const String& pointerType() const LIFETIME_BOUND { return m_data.pointerType; }
+#endif
+    GestureWasCancelled gestureWasCancelled() const { return m_data.gestureWasCancelled; }
     // Unaccelerated pointer movement
-    const WebCore::DoublePoint& unadjustedMovementDelta() const LIFETIME_BOUND { return m_unadjustedMovementDelta; }
+    const WebCore::DoublePoint& unadjustedMovementDelta() const LIFETIME_BOUND { return m_data.unadjustedMovementDelta; }
+
+    void setCoalescedEvents(const Vector<Ref<WebMouseEvent>>& coalescedEvents) { m_data.coalescedEvents = coalescedEvents; }
+    const Vector<Ref<WebMouseEvent>>& coalescedEvents() const LIFETIME_BOUND { return m_data.coalescedEvents; }
 
-    void setCoalescedEvents(const Vector<WebMouseEvent>& coalescedEvents) { m_coalescedEvents = coalescedEvents; }
-    Vector<WebMouseEvent> coalescedEvents() const { return m_coalescedEvents; }
+    void setPredictedEvents(const Vector<Ref<WebMouseEvent>>& predictedEvents) { m_predictedEvents = predictedEvents; }
+    const Vector<Ref<WebMouseEvent>>& predictedEvents() const LIFETIME_BOUND { return m_predictedEvents; }
 
-    void setPredictedEvents(const Vector<WebMouseEvent>& predictedEvents) { m_predictedEvents = predictedEvents; }
-    Vector<WebMouseEvent> predictedEvents() const { return m_predictedEvents; }
+    const WebMouseEventData& mouseData() const LIFETIME_BOUND { return m_data; }
 
     static bool NODELETE isMouseEventType(WebEventType);
 
+protected:
+    WebMouseEvent(WebEventData&&, WebMouseEventData&&);
+
 private:
-    WebMouseEventButton m_button { WebMouseEventButton::None };
-    unsigned short m_buttons { 0 };
-    WebCore::DoublePoint m_position; // Relative to the view.
-    WebCore::DoublePoint m_globalPosition;
-    float m_deltaX { 0 };
-    float m_deltaY { 0 };
-    float m_deltaZ { 0 };
-    WebCore::DoublePoint m_unadjustedMovementDelta;
-    int32_t m_clickCount { 0 };
-#if PLATFORM(MAC)
-    int32_t m_eventNumber { -1 };
-    int32_t m_menuTypeForEvent { 0 };
-#elif PLATFORM(GTK)
-    WebCore::PlatformMouseEvent::IsTouch m_isTouchEvent { WebCore::PlatformMouseEvent::IsTouch::No };
-#endif
-    double m_force { 0 };
-    WebEventInputSource m_inputSource { WebEventInputSource::UserDriven };
-    WebCore::PlatformMouseEvent::CanInitiateDrag m_canInitiateDrag { WebCore::PlatformMouseEvent::CanInitiateDrag::Yes };
-    WebMouseEventSyntheticClickType m_syntheticClickType { WebMouseEventSyntheticClickType::NoTap };
-    WebCore::PointerID m_pointerId { WebCore::mousePointerID };
-    String m_pointerType { WebCore::mousePointerEventType() };
-    GestureWasCancelled m_gestureWasCancelled { GestureWasCancelled::No };
-    Vector<WebMouseEvent> m_coalescedEvents;
-    Vector<WebMouseEvent> m_predictedEvents;
+    WebMouseEventData m_data;
+    // Not sent over IPC. See WebMouseEventData.
+    Vector<Ref<WebMouseEvent>> m_predictedEvents;
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit/Shared/WebTouchEvent.cpp b/Source/WebKit/Shared/WebTouchEvent.cpp
index 9bef529c796f..1af6065e0fa6 100644
--- a/Source/WebKit/Shared/WebTouchEvent.cpp
+++ b/Source/WebKit/Shared/WebTouchEvent.cpp
@@ -30,39 +30,55 @@
 
 #include "ArgumentCoders.h"
 #include <WebCore/RemoteFrameGeometryTransformer.h>
+#include <wtf/TZoneMallocInlines.h>
 
 namespace WebKit {
 
-#if !PLATFORM(IOS_FAMILY)
+WTF_MAKE_TZONE_ALLOCATED_IMPL(WebTouchEvent);
 
-WebTouchEvent::WebTouchEvent(WebEvent&& event, Vector<WebPlatformTouchPoint>&& touchPoints, Vector<WebTouchEvent>&& coalescedEvents, Vector<WebTouchEvent>&& predictedEvents)
-    : WebEvent(WTF::move(event))
-    , m_touchPoints(WTF::move(touchPoints))
-    , m_coalescedEvents(WTF::move(coalescedEvents))
-    , m_predictedEvents(WTF::move(predictedEvents))
+Ref<WebTouchEvent> WebTouchEvent::create(WebEventData&& eventData, WebTouchEventData&& touchData)
+{
+    return adoptRef(*new WebTouchEvent(WTF::move(eventData), WTF::move(touchData)));
+}
+
+Ref<WebTouchEvent> WebTouchEvent::create(WebTouchEventInit&& init)
+{
+    return create(WTF::move(init.event), WTF::move(init.touch));
+}
+
+WebTouchEvent::WebTouchEvent(WebEventData&& eventData, WebTouchEventData&& touchData)
+    : WebEvent(WTF::move(eventData))
+    , m_data(WTF::move(touchData))
 {
     ASSERT(isTouchEventType(type()));
 }
 
+Ref<WebTouchEvent> WebTouchEvent::copy() const
+{
+    auto data = m_data;
+    data.coalescedEvents = WTF::map(m_data.coalescedEvents, [](auto& event) { return event->copy(); });
+    data.predictedEvents = WTF::map(m_data.predictedEvents, [](auto& event) { return event->copy(); });
+    return create(WebEventData { eventData() }, WTF::move(data));
+}
+
 bool WebTouchEvent::isTouchEventType(WebEventType type)
 {
     return type == WebEventType::TouchStart || type == WebEventType::TouchMove || type == WebEventType::TouchEnd || type == WebEventType::TouchCancel;
 }
 
-#endif // !PLATFORM(IOS_FAMILY)
 
 #if ENABLE(IOS_TOUCH_EVENTS)
 void WebTouchEvent::transformToRemoteFrameCoordinates(const WebCore::RemoteFrameGeometryTransformer& transformer)
 {
     ASSERT(!std::exchange(m_hasTransformedToRemoteFrameCoordinates, true));
 
-    m_position = transformer.transformRootViewPointToRemoteFrameCoordinates(m_position);
-    for (auto& touchPoint : m_touchPoints)
+    m_data.position = transformer.transformRootViewPointToRemoteFrameCoordinates(m_data.position);
+    for (auto& touchPoint : m_data.touchPoints)
         touchPoint.transformToRemoteFrameCoordinates(transformer);
-    for (auto& event : m_coalescedEvents)
-        event.transformToRemoteFrameCoordinates(transformer);
-    for (auto& event : m_predictedEvents)
-        event.transformToRemoteFrameCoordinates(transformer);
+    for (Ref event : m_data.coalescedEvents)
+        event->transformToRemoteFrameCoordinates(transformer);
+    for (Ref event : m_data.predictedEvents)
+        event->transformToRemoteFrameCoordinates(transformer);
 }
 
 void WebPlatformTouchPoint::transformToRemoteFrameCoordinates(const WebCore::RemoteFrameGeometryTransformer& transformer)
diff --git a/Source/WebKit/Shared/WebTouchEvent.h b/Source/WebKit/Shared/WebTouchEvent.h
index 2267f278b54e..ff909e8d81eb 100644
--- a/Source/WebKit/Shared/WebTouchEvent.h
+++ b/Source/WebKit/Shared/WebTouchEvent.h
@@ -130,57 +130,68 @@ class WebPlatformTouchPoint {
 #endif
 };
 
+class WebTouchEvent;
+
+// Field order matches WebEvent.serialization.in.
+struct WebTouchEventData {
+    Vector<WebPlatformTouchPoint> touchPoints;
+    Vector<Ref<WebTouchEvent>> coalescedEvents;
+    Vector<Ref<WebTouchEvent>> predictedEvents;
+    WebCore::DoublePoint position;
+    bool isPotentialTap { false };
+    bool isGesture { false };
+    float gestureScale { 0 };
+    float gestureRotation { 0 };
+    bool canPreventNativeGestures { true };
+};
+
+struct WebTouchEventInit {
+    WebEventData event;
+    WebTouchEventData touch;
+};
+
 class WebTouchEvent : public WebEvent {
+    WTF_MAKE_TZONE_ALLOCATED(WebTouchEvent);
 public:
-    WebTouchEvent(WebEvent&& event, const Vector<WebPlatformTouchPoint>& touchPoints, const Vector<WebTouchEvent>& coalescedEvents, const Vector<WebTouchEvent>& predictedEvents, WebCore::DoublePoint position, bool isPotentialTap, bool isGesture, float gestureScale, float gestureRotation, bool canPreventNativeGestures = true)
-        : WebEvent(WTF::move(event))
-        , m_touchPoints(touchPoints)
-        , m_coalescedEvents(coalescedEvents)
-        , m_predictedEvents(predictedEvents)
-        , m_position(position)
-        , m_canPreventNativeGestures(canPreventNativeGestures)
-        , m_isPotentialTap(isPotentialTap)
-        , m_isGesture(isGesture)
-        , m_gestureScale(gestureScale)
-        , m_gestureRotation(gestureRotation)
-    {
-        ASSERT(type() == WebEventType::TouchStart || type() == WebEventType::TouchMove || type() == WebEventType::TouchEnd || type() == WebEventType::TouchCancel);
-    }
+    static Ref<WebTouchEvent> create(WebEventData&&, WebTouchEventData&&);
+    static Ref<WebTouchEvent> create(WebTouchEventInit&&);
+
+    // Deep copy, including the coalesced and predicted events. Callers that mutate an event they
+    // did not create must copy first, since events are now shared rather than copied by value.
+    Ref<WebTouchEvent> copy() const;
 
-    const Vector<WebPlatformTouchPoint>& touchPoints() const LIFETIME_BOUND { return m_touchPoints; }
+    const Vector<WebPlatformTouchPoint>& touchPoints() const LIFETIME_BOUND { return m_data.touchPoints; }
 
-    const Vector<WebTouchEvent>& coalescedEvents() const LIFETIME_BOUND { return m_coalescedEvents; }
-    void setCoalescedEvents(const Vector<WebTouchEvent>& coalescedEvents) { m_coalescedEvents = coalescedEvents; }
+    const Vector<Ref<WebTouchEvent>>& coalescedEvents() const LIFETIME_BOUND { return m_data.coalescedEvents; }
+    void setCoalescedEvents(const Vector<Ref<WebTouchEvent>>& coalescedEvents) { m_data.coalescedEvents = coalescedEvents; }
 
-    const Vector<WebTouchEvent>& predictedEvents() const LIFETIME_BOUND { return m_predictedEvents; }
-    void setPredictedEvents(const Vector<WebTouchEvent>& predictedEvents) { m_predictedEvents = predictedEvents; }
+    const Vector<Ref<WebTouchEvent>>& predictedEvents() const LIFETIME_BOUND { return m_data.predictedEvents; }
+    void setPredictedEvents(const Vector<Ref<WebTouchEvent>>& predictedEvents) { m_data.predictedEvents = predictedEvents; }
 
-    WebCore::DoublePoint position() const { return m_position; }
+    WebCore::DoublePoint position() const { return m_data.position; }
 
     void transformToRemoteFrameCoordinates(const WebCore::RemoteFrameGeometryTransformer&);
 
-    bool isPotentialTap() const { return m_isPotentialTap; }
+    bool isPotentialTap() const { return m_data.isPotentialTap; }
 
-    bool isGesture() const { return m_isGesture; }
-    float gestureScale() const { return m_gestureScale; }
-    float gestureRotation() const { return m_gestureRotation; }
+    bool isGesture() const { return m_data.isGesture; }
+    float gestureScale() const { return m_data.gestureScale; }
+    float gestureRotation() const { return m_data.gestureRotation; }
 
-    bool canPreventNativeGestures() const { return m_canPreventNativeGestures; }
-    void setCanPreventNativeGestures(bool canPreventNativeGestures) { m_canPreventNativeGestures = canPreventNativeGestures; }
+    bool canPreventNativeGestures() const { return m_data.canPreventNativeGestures; }
+    void setCanPreventNativeGestures(bool canPreventNativeGestures) { m_data.canPreventNativeGestures = canPreventNativeGestures; }
 
     bool allTouchPointsAreReleased() const;
-    
+
+    const WebTouchEventData& touchData() const LIFETIME_BOUND { return m_data; }
+
+protected:
+    WebTouchEvent(WebEventData&&, WebTouchEventData&&);
+
 private:
-    Vector<WebPlatformTouchPoint> m_touchPoints;
-    Vector<WebTouchEvent> m_coalescedEvents;
-    Vector<WebTouchEvent> m_predictedEvents;
+    static bool isTouchEventType(WebEventType);
 
-    WebCore::DoublePoint m_position;
-    bool m_canPreventNativeGestures { false };
-    bool m_isPotentialTap { false };
-    bool m_isGesture { false };
-    float m_gestureScale { 0 };
-    float m_gestureRotation { 0 };
+    WebTouchEventData m_data;
 #if ASSERT_ENABLED
     bool m_hasTransformedToRemoteFrameCoordinates { false };
 #endif
@@ -226,15 +237,34 @@ class WebPlatformTouchPoint {
     float m_force;
 };
 
+class WebTouchEvent;
+
+// Field order matches WebEvent.serialization.in.
+struct WebTouchEventData {
+    Vector<WebPlatformTouchPoint> touchPoints;
+    Vector<Ref<WebTouchEvent>> coalescedEvents;
+    Vector<Ref<WebTouchEvent>> predictedEvents;
+};
+
+struct WebTouchEventInit {
+    WebEventData event;
+    WebTouchEventData touch;
+};
+
 class WebTouchEvent : public WebEvent {
+    WTF_MAKE_TZONE_ALLOCATED(WebTouchEvent);
 public:
-    WebTouchEvent(WebEvent&&, Vector<WebPlatformTouchPoint>&&, Vector<WebTouchEvent>&&, Vector<WebTouchEvent>&&);
+    static Ref<WebTouchEvent> create(WebEventData&&, WebTouchEventData&&);
+    static Ref<WebTouchEvent> create(WebTouchEventInit&&);
+
+    // See the IOS_FAMILY variant.
+    Ref<WebTouchEvent> copy() const;
 
-    const Vector<WebPlatformTouchPoint>& touchPoints() const LIFETIME_BOUND { return m_touchPoints; }
+    const Vector<WebPlatformTouchPoint>& touchPoints() const LIFETIME_BOUND { return m_data.touchPoints; }
 
-    const Vector<WebTouchEvent>& coalescedEvents() const LIFETIME_BOUND { return m_coalescedEvents; }
+    const Vector<Ref<WebTouchEvent>>& coalescedEvents() const LIFETIME_BOUND { return m_data.coalescedEvents; }
 
-    const Vector<WebTouchEvent>& predictedEvents() const LIFETIME_BOUND { return m_predictedEvents; }
+    const Vector<Ref<WebTouchEvent>>& predictedEvents() const LIFETIME_BOUND { return m_data.predictedEvents; }
 
     bool allTouchPointsAreReleased() const;
 
@@ -242,12 +272,15 @@ class WebTouchEvent : public WebEvent {
     virtual bool isNativeWebTouchEvent() const { return false; }
 #endif
 
+    const WebTouchEventData& touchData() const LIFETIME_BOUND { return m_data; }
+
+protected:
+    WebTouchEvent(WebEventData&&, WebTouchEventData&&);
+
 private:
     static bool isTouchEventType(WebEventType);
 
-    Vector<WebPlatformTouchPoint> m_touchPoints;
-    Vector<WebTouchEvent> m_coalescedEvents;
-    Vector<WebTouchEvent> m_predictedEvents;
+    WebTouchEventData m_data;
 };
 
 #endif // PLATFORM(IOS_FAMILY)
diff --git a/Source/WebKit/Shared/WebWheelEvent.cpp b/Source/WebKit/Shared/WebWheelEvent.cpp
index bff2210aedba..5602ecc825c9 100644
--- a/Source/WebKit/Shared/WebWheelEvent.cpp
+++ b/Source/WebKit/Shared/WebWheelEvent.cpp
@@ -25,60 +25,36 @@
 
 #include "config.h"
 #include "WebWheelEvent.h"
+#include <wtf/TZoneMallocInlines.h>
 #include <wtf/text/TextStream.h>
 
 namespace WebKit {
 
 using namespace WebCore;
 
-WebWheelEvent::WebWheelEvent(WebEvent&& event, const IntPoint& position, const IntPoint& globalPosition, const FloatSize& delta, const FloatSize& wheelTicks, Granularity granularity)
-    : WebEvent(WTF::move(event))
-    , m_position(position)
-    , m_globalPosition(globalPosition)
-    , m_delta(delta)
-    , m_wheelTicks(wheelTicks)
-    , m_granularity(granularity)
+WTF_MAKE_TZONE_ALLOCATED_IMPL(WebWheelEvent);
+
+Ref<WebWheelEvent> WebWheelEvent::create(WebEventData&& eventData, WebWheelEventData&& wheelData)
 {
-    ASSERT(isWheelEventType(type()));
+    return adoptRef(*new WebWheelEvent(WTF::move(eventData), WTF::move(wheelData)));
 }
 
-#if PLATFORM(COCOA)
-WebWheelEvent::WebWheelEvent(WebEvent&& event, const IntPoint& position, const IntPoint& globalPosition, const FloatSize& delta, const FloatSize& wheelTicks, Granularity granularity, bool directionInvertedFromDevice, Phase phase, Phase momentumPhase, bool hasPreciseScrollingDeltas, uint32_t scrollCount, const WebCore::FloatSize& unacceleratedScrollingDelta, MonotonicTime ioHIDEventTimestamp, std::optional<WebCore::FloatSize> rawPlatformDelta, MomentumEndType momentumEndType, WebEventInputSource inputSource, float momentumFastScrollMultiplier)
-    : WebEvent(WTF::move(event))
-    , m_position(position)
-    , m_globalPosition(globalPosition)
-    , m_delta(delta)
-    , m_wheelTicks(wheelTicks)
-    , m_granularity(granularity)
-    , m_phase(phase)
-    , m_momentumPhase(momentumPhase)
-    , m_momentumEndType(momentumEndType)
-    , m_directionInvertedFromDevice(directionInvertedFromDevice)
-    , m_hasPreciseScrollingDeltas(hasPreciseScrollingDeltas)
-    , m_ioHIDEventTimestamp(ioHIDEventTimestamp)
-    , m_rawPlatformDelta(rawPlatformDelta)
-    , m_scrollCount(scrollCount)
-    , m_unacceleratedScrollingDelta(unacceleratedScrollingDelta)
-    , m_inputSource(inputSource)
-    , m_momentumFastScrollMultiplier(momentumFastScrollMultiplier)
+Ref<WebWheelEvent> WebWheelEvent::create(WebWheelEventInit&& init)
 {
-    ASSERT(isWheelEventType(type()));
+    return create(WTF::move(init.event), WTF::move(init.wheel));
 }
-#elif PLATFORM(GTK) || USE(LIBWPE) || ENABLE(WPE_PLATFORM)
-WebWheelEvent::WebWheelEvent(WebEvent&& event, const IntPoint& position, const IntPoint& globalPosition, const FloatSize& delta, const FloatSize& wheelTicks, Granularity granularity, Phase phase, Phase momentumPhase, bool hasPreciseScrollingDeltas)
-    : WebEvent(WTF::move(event))
-    , m_position(position)
-    , m_globalPosition(globalPosition)
-    , m_delta(delta)
-    , m_wheelTicks(wheelTicks)
-    , m_granularity(granularity)
-    , m_phase(phase)
-    , m_momentumPhase(momentumPhase)
-    , m_hasPreciseScrollingDeltas(hasPreciseScrollingDeltas)
+
+Ref<WebWheelEvent> WebWheelEvent::copy() const
+{
+    return create(WebEventData { eventData() }, WebWheelEventData { m_data });
+}
+
+WebWheelEvent::WebWheelEvent(WebEventData&& eventData, WebWheelEventData&& wheelData)
+    : WebEvent(WTF::move(eventData))
+    , m_data(WTF::move(wheelData))
 {
     ASSERT(isWheelEventType(type()));
 }
-#endif
 
 bool WebWheelEvent::isWheelEventType(WebEventType type)
 {
diff --git a/Source/WebKit/Shared/WebWheelEvent.h b/Source/WebKit/Shared/WebWheelEvent.h
index 4c398654b08f..e65165b81fa5 100644
--- a/Source/WebKit/Shared/WebWheelEvent.h
+++ b/Source/WebKit/Shared/WebWheelEvent.h
@@ -37,78 +37,109 @@ class TextStream;
 
 namespace WebKit {
 
+// Moved out of WebWheelEvent so that WebWheelEventData can name them. WebWheelEvent keeps aliases,
+// so existing WebWheelEvent::Granularity / ::MomentumEndType spellings continue to work.
+enum class WebWheelEventGranularity : uint8_t {
+    ScrollByPageWheelEvent,
+    ScrollByPixelWheelEvent
+};
+
+enum class WebWheelEventMomentumEndType : uint8_t {
+    Unknown,
+    Interrupted,
+    Natural,
+};
+
+// Field order matches WebEvent.serialization.in. Fields absent on a platform are ones no
+// constructor there sets, so the corresponding accessors return constants.
+struct WebWheelEventData {
+    WebCore::IntPoint position;
+    WebCore::IntPoint globalPosition;
+    WebCore::FloatSize delta;
+    WebCore::FloatSize wheelTicks;
+    WebWheelEventGranularity granularity { WebWheelEventGranularity::ScrollByPageWheelEvent };
+#if PLATFORM(COCOA)
+    bool directionInvertedFromDevice { false };
+#endif
+#if PLATFORM(COCOA) || PLATFORM(GTK) || USE(LIBWPE) || ENABLE(WPE_PLATFORM)
+    WebEventPhase phase { WebEventPhase::None };
+    WebEventPhase momentumPhase { WebEventPhase::None };
+    bool hasPreciseScrollingDeltas { false };
+#endif
+#if PLATFORM(COCOA)
+    uint32_t scrollCount { 0 };
+    WebCore::FloatSize unacceleratedScrollingDelta;
+    MonotonicTime ioHIDEventTimestamp;
+    std::optional<WebCore::FloatSize> rawPlatformDelta;
+    WebWheelEventMomentumEndType momentumEndType { WebWheelEventMomentumEndType::Unknown };
+    WebEventInputSource inputSource { WebEventInputSource::UserDriven };
+    float momentumFastScrollMultiplier { 1 };
+#endif
+};
+
+struct WebWheelEventInit {
+    WebEventData event;
+    WebWheelEventData wheel;
+};
+
 class WebWheelEvent : public WebEvent {
+    WTF_MAKE_TZONE_ALLOCATED(WebWheelEvent);
 public:
-    enum class Granularity : uint8_t {
-        ScrollByPageWheelEvent,
-        ScrollByPixelWheelEvent
-    };
-
+    using Granularity = WebWheelEventGranularity;
     using Phase = WebEventPhase;
+    using MomentumEndType = WebWheelEventMomentumEndType;
 
-    enum class MomentumEndType : uint8_t {
-        Unknown,
-        Interrupted,
-        Natural,
-    };
+    static Ref<WebWheelEvent> create(WebEventData&&, WebWheelEventData&&);
+    static Ref<WebWheelEvent> create(WebWheelEventInit&&);
 
-    WebWheelEvent(WebEvent&&, const WebCore::IntPoint& position, const WebCore::IntPoint& globalPosition, const WebCore::FloatSize& delta, const WebCore::FloatSize& wheelTicks, Granularity);
+    // Callers that mutate an event they did not create must copy first, since events are now shared
+    // rather than copied by value.
+    Ref<WebWheelEvent> copy() const;
+
+    const WebCore::IntPoint position() const { return m_data.position; }
+    void setPosition(WebCore::IntPoint position) { m_data.position = position; }
+    const WebCore::IntPoint globalPosition() const { return m_data.globalPosition; }
+    const WebCore::FloatSize delta() const { return m_data.delta; }
+    const WebCore::FloatSize wheelTicks() const { return m_data.wheelTicks; }
+    Granularity granularity() const { return m_data.granularity; }
 #if PLATFORM(COCOA)
-    WebWheelEvent(WebEvent&&, const WebCore::IntPoint& position, const WebCore::IntPoint& globalPosition, const WebCore::FloatSize& delta, const WebCore::FloatSize& wheelTicks, Granularity, bool directionInvertedFromDevice, Phase, Phase momentumPhase, bool hasPreciseScrollingDeltas, uint32_t scrollCount, const WebCore::FloatSize& unacceleratedScrollingDelta, MonotonicTime ioHIDEventTimestamp, std::optional<WebCore::FloatSize> rawPlatformDelta, MomentumEndType, WebEventInputSource = WebEventInputSource::UserDriven, float momentumFastScrollMultiplier = 1);
-#elif PLATFORM(GTK) || USE(LIBWPE) || ENABLE(WPE_PLATFORM)
-    WebWheelEvent(WebEvent&&, const WebCore::IntPoint& position, const WebCore::IntPoint& globalPosition, const WebCore::FloatSize& delta, const WebCore::FloatSize& wheelTicks, Granularity, Phase, Phase momentumPhase, bool hasPreciseScrollingDeltas);
+    bool directionInvertedFromDevice() const { return m_data.directionInvertedFromDevice; }
+    MomentumEndType momentumEndType() const { return m_data.momentumEndType; }
+#else
+    // No constructor on this platform takes these, so the defaults are the only possible values.
+    bool directionInvertedFromDevice() const { return false; }
+    MomentumEndType momentumEndType() const { return MomentumEndType::Unknown; }
 #endif
-
-    const WebCore::IntPoint position() const { return m_position; }
-    void setPosition(WebCore::IntPoint position) { m_position = position; }
-    const WebCore::IntPoint globalPosition() const { return m_globalPosition; }
-    const WebCore::FloatSize delta() const { return m_delta; }
-    const WebCore::FloatSize wheelTicks() const { return m_wheelTicks; }
-    Granularity granularity() const { return m_granularity; }
-    bool directionInvertedFromDevice() const { return m_directionInvertedFromDevice; }
-    Phase phase() const { return m_phase; }
-    Phase momentumPhase() const { return m_momentumPhase; }
-    MomentumEndType momentumEndType() const { return m_momentumEndType; }
 #if PLATFORM(COCOA) || PLATFORM(GTK) || USE(LIBWPE) || ENABLE(WPE_PLATFORM)
-    bool hasPreciseScrollingDeltas() const { return m_hasPreciseScrollingDeltas; }
+    Phase phase() const { return m_data.phase; }
+    Phase momentumPhase() const { return m_data.momentumPhase; }
+    bool hasPreciseScrollingDeltas() const { return m_data.hasPreciseScrollingDeltas; }
+#else
+    Phase phase() const { return Phase::None; }
+    Phase momentumPhase() const { return Phase::None; }
 #endif
 #if PLATFORM(COCOA)
-    MonotonicTime ioHIDEventTimestamp() const { return m_ioHIDEventTimestamp; }
-    std::optional<WebCore::FloatSize> rawPlatformDelta() const { return m_rawPlatformDelta; }
-    void setRawPlatformDelta(std::optional<WebCore::FloatSize>&& delta) { m_rawPlatformDelta = WTF::move(delta); }
-    uint32_t scrollCount() const { return m_scrollCount; }
-    const WebCore::FloatSize& unacceleratedScrollingDelta() const LIFETIME_BOUND { return m_unacceleratedScrollingDelta; }
-    WebEventInputSource inputSource() const { return m_inputSource; }
-    float momentumFastScrollMultiplier() const { return m_momentumFastScrollMultiplier; }
-    void setMomentumFastScrollMultiplier(float multiplier) { m_momentumFastScrollMultiplier = multiplier; }
+    MonotonicTime ioHIDEventTimestamp() const { return m_data.ioHIDEventTimestamp; }
+    std::optional<WebCore::FloatSize> rawPlatformDelta() const { return m_data.rawPlatformDelta; }
+    void setRawPlatformDelta(std::optional<WebCore::FloatSize>&& delta) { m_data.rawPlatformDelta = WTF::move(delta); }
+    uint32_t scrollCount() const { return m_data.scrollCount; }
+    const WebCore::FloatSize& unacceleratedScrollingDelta() const LIFETIME_BOUND { return m_data.unacceleratedScrollingDelta; }
+    WebEventInputSource inputSource() const { return m_data.inputSource; }
+    float momentumFastScrollMultiplier() const { return m_data.momentumFastScrollMultiplier; }
+    void setMomentumFastScrollMultiplier(float multiplier) { m_data.momentumFastScrollMultiplier = multiplier; }
 #endif // PLATFORM(COCOA)
 
     bool isMomentumEvent() const { return momentumPhase() != Phase::None && momentumPhase() != Phase::WillBegin; }
 
+    const WebWheelEventData& wheelData() const LIFETIME_BOUND { return m_data; }
+
     static bool NODELETE isWheelEventType(WebEventType);
 
+protected:
+    WebWheelEvent(WebEventData&&, WebWheelEventData&&);
+
 private:
-    WebCore::IntPoint m_position;
-    WebCore::IntPoint m_globalPosition;
-    WebCore::FloatSize m_delta;
-    WebCore::FloatSize m_wheelTicks;
-    Granularity m_granularity { Granularity::ScrollByPageWheelEvent };
-    Phase m_phase { Phase::None };
-    Phase m_momentumPhase { Phase::None };
-
-    MomentumEndType m_momentumEndType { MomentumEndType::Unknown };
-    bool m_directionInvertedFromDevice { false };
-#if PLATFORM(COCOA) || PLATFORM(GTK) || USE(LIBWPE) || ENABLE(WPE_PLATFORM)
-    bool m_hasPreciseScrollingDeltas { false };
-#endif
-#if PLATFORM(COCOA)
-    MonotonicTime m_ioHIDEventTimestamp;
-    std::optional<WebCore::FloatSize> m_rawPlatformDelta;
-    uint32_t m_scrollCount { 0 };
-    WebCore::FloatSize m_unacceleratedScrollingDelta;
-    WebEventInputSource m_inputSource { WebEventInputSource::UserDriven };
-    float m_momentumFastScrollMultiplier { 1 };
-#endif // PLATFORM(COCOA)
+    WebWheelEventData m_data;
 };
 
 WTF::TextStream& operator<<(WTF::TextStream&, WebWheelEvent::Granularity);
diff --git a/Source/WebKit/Shared/WebWheelEventCoalescer.cpp b/Source/WebKit/Shared/WebWheelEventCoalescer.cpp
index 95795eae1b4b..2f15e83ad77b 100644
--- a/Source/WebKit/Shared/WebWheelEventCoalescer.cpp
+++ b/Source/WebKit/Shared/WebWheelEventCoalescer.cpp
@@ -37,14 +37,6 @@ namespace WebKit {
 // Represents the number of wheel events we can hold in the queue before we start pushing them preemptively.
 constexpr unsigned wheelEventQueueSizeThreshold = 10;
 
-#if !LOG_DISABLED
-static TextStream& operator<<(TextStream& ts, const NativeWebWheelEvent& nativeWheelEvent)
-{
-    ts << platform(nativeWheelEvent);
-    return ts;
-}
-#endif
-
 WTF_MAKE_TZONE_ALLOCATED_IMPL(WebWheelEventCoalescer);
 
 bool WebWheelEventCoalescer::canCoalesce(const WebWheelEvent& a, const WebWheelEvent& b)
@@ -71,7 +63,7 @@ bool WebWheelEventCoalescer::canCoalesce(const WebWheelEvent& a, const WebWheelE
     return true;
 }
 
-WebWheelEvent WebWheelEventCoalescer::coalesce(const WebWheelEvent& a, const WebWheelEvent& b)
+Ref<WebWheelEvent> WebWheelEventCoalescer::coalesce(const WebWheelEvent& a, const WebWheelEvent& b)
 {
     ASSERT(canCoalesce(a, b));
 
@@ -84,13 +76,44 @@ WebWheelEvent WebWheelEventCoalescer::coalesce(const WebWheelEvent& a, const Web
     if (a.rawPlatformDelta() && b.rawPlatformDelta())
         mergedRawPlatformScrollingDelta = a.rawPlatformDelta().value() + b.rawPlatformDelta().value();
 
-    auto event = WebWheelEvent({ WebEventType::Wheel, b.modifiers(), b.timestamp() }, b.position(), b.globalPosition(), mergedDelta, mergedWheelTicks, b.granularity(), b.directionInvertedFromDevice(), b.phase(), b.momentumPhase(), b.hasPreciseScrollingDeltas(), b.scrollCount(), mergedUnacceleratedScrollingDelta, b.ioHIDEventTimestamp(), mergedRawPlatformScrollingDelta, b.momentumEndType(), b.inputSource());
+    auto wheelData = WebWheelEventData {
+        .position = b.position(),
+        .globalPosition = b.globalPosition(),
+        .delta = mergedDelta,
+        .wheelTicks = mergedWheelTicks,
+        .granularity = b.granularity(),
+        .directionInvertedFromDevice = b.directionInvertedFromDevice(),
+        .phase = b.phase(),
+        .momentumPhase = b.momentumPhase(),
+        .hasPreciseScrollingDeltas = b.hasPreciseScrollingDeltas(),
+        .scrollCount = b.scrollCount(),
+        .unacceleratedScrollingDelta = mergedUnacceleratedScrollingDelta,
+        .ioHIDEventTimestamp = b.ioHIDEventTimestamp(),
+        .rawPlatformDelta = mergedRawPlatformScrollingDelta,
+        .momentumEndType = b.momentumEndType(),
+        .inputSource = b.inputSource(),
+    };
 #elif PLATFORM(GTK) || USE(LIBWPE) || ENABLE(WPE_PLATFORM)
-    auto event = WebWheelEvent({ WebEventType::Wheel, b.modifiers(), b.timestamp() }, b.position(), b.globalPosition(), mergedDelta, mergedWheelTicks, b.granularity(), b.phase(), b.momentumPhase(), b.hasPreciseScrollingDeltas());
+    auto wheelData = WebWheelEventData {
+        .position = b.position(),
+        .globalPosition = b.globalPosition(),
+        .delta = mergedDelta,
+        .wheelTicks = mergedWheelTicks,
+        .granularity = b.granularity(),
+        .phase = b.phase(),
+        .momentumPhase = b.momentumPhase(),
+        .hasPreciseScrollingDeltas = b.hasPreciseScrollingDeltas(),
+    };
 #else
-    auto event = WebWheelEvent({ WebEventType::Wheel, b.modifiers(), b.timestamp() }, b.position(), b.globalPosition(), mergedDelta, mergedWheelTicks, b.granularity());
+    auto wheelData = WebWheelEventData {
+        .position = b.position(),
+        .globalPosition = b.globalPosition(),
+        .delta = mergedDelta,
+        .wheelTicks = mergedWheelTicks,
+        .granularity = b.granularity(),
+    };
 #endif
-    return event;
+    return WebWheelEvent::create({ WebEventType::Wheel, b.modifiers(), b.timestamp() }, WTF::move(wheelData));
 }
 
 bool WebWheelEventCoalescer::shouldDispatchEventNow(const WebWheelEvent& event) const
@@ -113,38 +136,40 @@ bool WebWheelEventCoalescer::shouldDispatchEventNow(const WebWheelEvent& event)
     return m_wheelEventQueue.size() >= wheelEventQueueSizeThreshold;
 }
 
-std::optional<WebWheelEvent> WebWheelEventCoalescer::nextEventToDispatch()
+RefPtr<WebWheelEvent> WebWheelEventCoalescer::nextEventToDispatch()
 {
     if (m_wheelEventQueue.isEmpty())
-        return std::nullopt;
+        return nullptr;
 
-    auto coalescedNativeEvent = m_wheelEventQueue.takeFirst();
+    Ref coalescedNativeEvent = m_wheelEventQueue.takeFirst();
 
     auto coalescedSequence = makeUnique<CoalescedEventSequence>();
     coalescedSequence->append(coalescedNativeEvent);
 
-    auto coalescedWebEvent = WebWheelEvent { coalescedNativeEvent };
+    RefPtr<WebWheelEvent> coalescedWebEvent = coalescedNativeEvent.ptr();
 
-    while (!m_wheelEventQueue.isEmpty() && canCoalesce(coalescedWebEvent, m_wheelEventQueue.first())) {
-        auto firstEvent = m_wheelEventQueue.takeFirst();
+    while (!m_wheelEventQueue.isEmpty() && canCoalesce(*coalescedWebEvent, m_wheelEventQueue.first())) {
+        Ref firstEvent = m_wheelEventQueue.takeFirst();
         coalescedSequence->append(firstEvent);
-        SUPPRESS_UNCHECKED_ARG coalescedWebEvent = coalesce(coalescedWebEvent, WebWheelEvent { firstEvent });
+        coalescedWebEvent = coalesce(*coalescedWebEvent, firstEvent);
     }
 
 #if !LOG_DISABLED
-    if (coalescedSequence->size() > 1)
-        LOG_WITH_STREAM(WheelEvents, stream << "WebWheelEventCoalescer::wheelEventWithCoalescing coalesced " << *coalescedSequence << " into " << platform(coalescedWebEvent));
+    if (coalescedSequence->size() > 1) {
+        auto platformEvents = WTF::map(*coalescedSequence, [](auto& event) { return platform(event.get()); });
+        LOG_WITH_STREAM(WheelEvents, stream << "WebWheelEventCoalescer::wheelEventWithCoalescing coalesced " << platformEvents << " into " << platform(*coalescedWebEvent));
+    }
 #endif
 
     m_eventsBeingProcessed.append(WTF::move(coalescedSequence));
     return coalescedWebEvent;
 }
 
-bool WebWheelEventCoalescer::shouldDispatchEvent(const NativeWebWheelEvent& event)
+bool WebWheelEventCoalescer::shouldDispatchEvent(Ref<NativeWebWheelEvent>&& event)
 {
-    LOG_WITH_STREAM(WheelEvents, stream << "WebWheelEventCoalescer::shouldDispatchEvent " << platform(event) << " (" << m_wheelEventQueue.size() << " events in the queue, " << m_eventsBeingProcessed.size() << " event sequences being processed)");
+    LOG_WITH_STREAM(WheelEvents, stream << "WebWheelEventCoalescer::shouldDispatchEvent " << platform(event.get()) << " (" << m_wheelEventQueue.size() << " events in the queue, " << m_eventsBeingProcessed.size() << " event sequences being processed)");
 
-    m_wheelEventQueue.append(event);
+    m_wheelEventQueue.append(WTF::move(event));
 
     if (!m_eventsBeingProcessed.isEmpty()) {
         if (!shouldDispatchEventNow(m_wheelEventQueue.last())) {
@@ -158,13 +183,13 @@ bool WebWheelEventCoalescer::shouldDispatchEvent(const NativeWebWheelEvent& even
     return true;
 }
 
-std::optional<NativeWebWheelEvent> WebWheelEventCoalescer::takeOldestEventBeingProcessed()
+RefPtr<NativeWebWheelEvent> WebWheelEventCoalescer::takeOldestEventBeingProcessed()
 {
     if (m_eventsBeingProcessed.isEmpty())
-        return { };
+        return nullptr;
 
     auto oldestSequence = m_eventsBeingProcessed.takeFirst();
-    return oldestSequence->last();
+    return oldestSequence->last().ptr();
 }
 
 void WebWheelEventCoalescer::clear()
diff --git a/Source/WebKit/Shared/WebWheelEventCoalescer.h b/Source/WebKit/Shared/WebWheelEventCoalescer.h
index ad0b6a9c71f8..cf8cd9a59bf4 100644
--- a/Source/WebKit/Shared/WebWheelEventCoalescer.h
+++ b/Source/WebKit/Shared/WebWheelEventCoalescer.h
@@ -35,24 +35,24 @@ class WebWheelEventCoalescer {
     WTF_MAKE_TZONE_ALLOCATED(WebWheelEventCoalescer);
 public:
     // If this returns true, use nextEventToDispatch() to get the event to dispatch.
-    bool shouldDispatchEvent(const NativeWebWheelEvent&);
-    std::optional<WebWheelEvent> nextEventToDispatch();
+    bool shouldDispatchEvent(Ref<NativeWebWheelEvent>&&);
+    RefPtr<WebWheelEvent> nextEventToDispatch();
 
-    std::optional<NativeWebWheelEvent> takeOldestEventBeingProcessed();
+    RefPtr<NativeWebWheelEvent> takeOldestEventBeingProcessed();
 
     bool hasEventsBeingProcessed() const { return !m_eventsBeingProcessed.isEmpty(); }
     
     void clear();
 
 private:
-    using CoalescedEventSequence = Vector<NativeWebWheelEvent>;
+    using CoalescedEventSequence = Vector<Ref<NativeWebWheelEvent>>;
 
     static bool NODELETE canCoalesce(const WebWheelEvent&, const WebWheelEvent&);
-    static WebWheelEvent coalesce(const WebWheelEvent&, const WebWheelEvent&);
+    static Ref<WebWheelEvent> coalesce(const WebWheelEvent&, const WebWheelEvent&);
 
     bool NODELETE shouldDispatchEventNow(const WebWheelEvent&) const;
 
-    Deque<NativeWebWheelEvent, 2> m_wheelEventQueue;
+    Deque<Ref<NativeWebWheelEvent>, 2> m_wheelEventQueue;
     Deque<std::unique_ptr<CoalescedEventSequence>> m_eventsBeingProcessed;
 };
 
diff --git a/Source/WebKit/Shared/XR/PlatformXR.serialization.in b/Source/WebKit/Shared/XR/PlatformXR.serialization.in
index 0084a5714222..6c087e39c3fd 100644
--- a/Source/WebKit/Shared/XR/PlatformXR.serialization.in
+++ b/Source/WebKit/Shared/XR/PlatformXR.serialization.in
@@ -151,7 +151,7 @@ header: <WebCore/PlatformXR.h>
     bool isSharedTexture;
 #endif
 #if !PLATFORM(COCOA)
-    Vector<WTF::UnixFileDescriptor> fds;
+    Vector<UnixFileDescriptor> fds;
     Vector<uint32_t> strides;
     Vector<uint32_t> offsets;
     uint32_t fourcc;
@@ -333,7 +333,7 @@ header: <WebCore/PlatformXR.h>
     PlatformXR::LayerHandle handle;
     bool visible;
     Vector<PlatformXR::DeviceLayer::LayerView> views;
-    WTF::UnixFileDescriptor fenceFD;
+    UnixFileDescriptor fenceFD;
 #if ENABLE(WEBXR_LAYERS)
     bool blendTextureSourceAlpha;
     bool forceMonoPresentation;
diff --git a/Source/WebKit/Shared/glib/CoreIPCGUnixFDList.serialization.in b/Source/WebKit/Shared/glib/CoreIPCGUnixFDList.serialization.in
index 4454df57860e..3523d238e418 100644
--- a/Source/WebKit/Shared/glib/CoreIPCGUnixFDList.serialization.in
+++ b/Source/WebKit/Shared/glib/CoreIPCGUnixFDList.serialization.in
@@ -30,7 +30,7 @@ header: "CoreIPCGUnixFDList.h"
 additional_forward_declaration: typedef struct _GUnixFDList GUnixFDList
 
 [GRefPtrWrapped=GUnixFDList] class WebKit::CoreIPCGUnixFDList {
-    Vector<WTF::UnixFileDescriptor> fileDescriptors();
+    Vector<UnixFileDescriptor> fileDescriptors();
 }
 
 #endif
diff --git a/Source/WebKit/Shared/glib/DMABufBufferAttributes.serialization.in b/Source/WebKit/Shared/glib/DMABufBufferAttributes.serialization.in
index 8e87fa7b3171..d6db1a947347 100644
--- a/Source/WebKit/Shared/glib/DMABufBufferAttributes.serialization.in
+++ b/Source/WebKit/Shared/glib/DMABufBufferAttributes.serialization.in
@@ -26,7 +26,7 @@ header: <WebCore/DMABufBufferAttributes.h>
 [RValue, CustomHeader] class WebCore::DMABufBufferAttributes {
     WebCore::IntSize size;
     WebCore::FourCC fourcc;
-    Vector<WTF::UnixFileDescriptor> fds;
+    Vector<UnixFileDescriptor> fds;
     Vector<uint32_t> offsets;
     Vector<uint32_t> strides;
     uint64_t modifier;
diff --git a/Source/WebKit/Shared/gtk/NativeWebKeyboardEventGtk.cpp b/Source/WebKit/Shared/gtk/NativeWebKeyboardEventGtk.cpp
index 6091f843195a..0d98f28bf829 100644
--- a/Source/WebKit/Shared/gtk/NativeWebKeyboardEventGtk.cpp
+++ b/Source/WebKit/Shared/gtk/NativeWebKeyboardEventGtk.cpp
@@ -30,6 +30,7 @@
 
 #include "GtkVersioning.h"
 #include "WebEventFactory.h"
+#include <wtf/TZoneMallocInlines.h>
 
 namespace WebKit {
 
@@ -39,25 +40,64 @@ namespace WebKit {
 #define constructNativeEvent(event) gdk_event_copy(event)
 #endif
 
-NativeWebKeyboardEvent::NativeWebKeyboardEvent(GdkEvent* event, const String& text, bool isAutoRepeat, Vector<String>&& commands)
-    : WebKeyboardEvent(WebEventFactory::createWebKeyboardEvent(event, text, isAutoRepeat, false, std::nullopt, std::nullopt, WTF::move(commands)))
-    , m_nativeEvent(constructNativeEvent(event))
+WTF_MAKE_TZONE_ALLOCATED_IMPL(NativeWebKeyboardEvent);
+
+Ref<NativeWebKeyboardEvent> NativeWebKeyboardEvent::create(GdkEvent* event, const String& text, bool isAutoRepeat, Vector<String>&& commands)
+{
+    return adoptRef(*new NativeWebKeyboardEvent(WebEventFactory::createWebKeyboardEvent(event, text, isAutoRepeat, false, std::nullopt, std::nullopt, WTF::move(commands)), event));
+}
+
+Ref<NativeWebKeyboardEvent> NativeWebKeyboardEvent::create(const String& text, std::optional<Vector<WebCore::CompositionUnderline>>&& preeditUnderlines, std::optional<EditingRange>&& preeditSelectionRange)
 {
+    return adoptRef(*new NativeWebKeyboardEvent(WebKeyboardEventInit {
+        { WebEventType::KeyDown, { }, MonotonicTime::now() },
+        {
+            .text = text,
+            .key = "Unidentified"_s,
+            .code = "Unidentified"_s,
+            .keyIdentifier = "U+0000"_s,
+            .windowsVirtualKeyCode = 229,
+            .nativeVirtualKeyCode = GDK_KEY_VoidSymbol,
+            .handledByInputMethod = true,
+            .preeditUnderlines = WTF::move(preeditUnderlines),
+            .preeditSelectionRange = WTF::move(preeditSelectionRange),
+            .commands = { },
+            .isAutoRepeat = false,
+            .isKeypad = false,
+        }
+    }, nullptr));
 }
 
-NativeWebKeyboardEvent::NativeWebKeyboardEvent(const String& text, std::optional<Vector<WebCore::CompositionUnderline>>&& preeditUnderlines, std::optional<EditingRange>&& preeditSelectionRange)
-    : WebKeyboardEvent(WebEvent(WebEventType::KeyDown, { }, MonotonicTime::now()), text, "Unidentified"_s, "Unidentified"_s, "U+0000"_s, 229, GDK_KEY_VoidSymbol, true, WTF::move(preeditUnderlines), WTF::move(preeditSelectionRange), { }, false, false)
+Ref<NativeWebKeyboardEvent> NativeWebKeyboardEvent::create(WebEventType type, const String& text, const String& key, const String& code, const String& keyIdentifier, int windowsVirtualKeyCode, int nativeVirtualKeyCode, Vector<String>&& commands, bool isAutoRepeat, bool isKeypad, OptionSet<WebEventModifier> modifiers)
 {
+    return adoptRef(*new NativeWebKeyboardEvent(WebKeyboardEventInit {
+        { type, modifiers, MonotonicTime::now() },
+        {
+            .text = text,
+            .key = key,
+            .code = code,
+            .keyIdentifier = keyIdentifier,
+            .windowsVirtualKeyCode = windowsVirtualKeyCode,
+            .nativeVirtualKeyCode = nativeVirtualKeyCode,
+            .handledByInputMethod = false,
+            .preeditUnderlines = std::nullopt,
+            .preeditSelectionRange = std::nullopt,
+            .commands = WTF::move(commands),
+            .isAutoRepeat = isAutoRepeat,
+            .isKeypad = isKeypad,
+        }
+    }, nullptr));
 }
 
-NativeWebKeyboardEvent::NativeWebKeyboardEvent(WebEventType type, const String& text, const String& key, const String& code, const String& keyIdentifier, int windowsVirtualKeyCode, int nativeVirtualKeyCode, Vector<String>&& commands, bool isAutoRepeat, bool isKeypad, OptionSet<WebEventModifier> modifiers)
-    : WebKeyboardEvent(WebEvent(type, modifiers, MonotonicTime::now()), text, key, code, keyIdentifier, windowsVirtualKeyCode, nativeVirtualKeyCode, false, std::nullopt, std::nullopt, WTF::move(commands), isAutoRepeat, isKeypad)
+Ref<NativeWebKeyboardEvent> NativeWebKeyboardEvent::create(const NativeWebKeyboardEvent& event)
 {
+    return adoptRef(*new NativeWebKeyboardEvent(WebKeyboardEventInit { event.eventData(), event.keyboardData() },
+        event.nativeEvent() ? const_cast<GdkEvent*>(event.nativeEvent()) : nullptr));
 }
 
-NativeWebKeyboardEvent::NativeWebKeyboardEvent(const NativeWebKeyboardEvent& event)
-    : WebKeyboardEvent(event)
-    , m_nativeEvent(event.nativeEvent() ? constructNativeEvent(event.nativeEvent()) : nullptr)
+NativeWebKeyboardEvent::NativeWebKeyboardEvent(WebKeyboardEventInit&& init, GdkEvent* event)
+    : WebKeyboardEvent(WTF::move(init.event), WTF::move(init.keyboard))
+    , m_nativeEvent(event ? constructNativeEvent(event) : nullptr)
 {
 }
 
diff --git a/Source/WebKit/Shared/gtk/NativeWebMouseEventGtk.cpp b/Source/WebKit/Shared/gtk/NativeWebMouseEventGtk.cpp
index 85dae6250ad2..fc3ef4c55fc4 100644
--- a/Source/WebKit/Shared/gtk/NativeWebMouseEventGtk.cpp
+++ b/Source/WebKit/Shared/gtk/NativeWebMouseEventGtk.cpp
@@ -28,6 +28,7 @@
 
 #include "GtkVersioning.h"
 #include "WebEventFactory.h"
+#include <wtf/TZoneMallocInlines.h>
 
 namespace WebKit {
 
@@ -37,31 +38,59 @@ namespace WebKit {
 #define constructNativeEvent(event) gdk_event_copy(event)
 #endif
 
-NativeWebMouseEvent::NativeWebMouseEvent(GdkEvent* event, int eventClickCount, std::optional<WebCore::FloatSize> delta)
-    : WebMouseEvent(WebEventFactory::createWebMouseEvent(event, eventClickCount, delta))
-    , m_nativeEvent(constructNativeEvent(event))
+WTF_MAKE_TZONE_ALLOCATED_IMPL(NativeWebMouseEvent);
+
+Ref<NativeWebMouseEvent> NativeWebMouseEvent::create(GdkEvent* event, int eventClickCount, std::optional<WebCore::FloatSize> delta)
+{
+    return adoptRef(*new NativeWebMouseEvent(WebEventFactory::createWebMouseEvent(event, eventClickCount, delta), event));
+}
+
+Ref<NativeWebMouseEvent> NativeWebMouseEvent::create(GdkEvent* event, const WebCore::DoublePoint& position, int eventClickCount, std::optional<WebCore::FloatSize> delta)
 {
+    return adoptRef(*new NativeWebMouseEvent(WebEventFactory::createWebMouseEvent(event, position, eventClickCount, delta), event));
 }
 
-NativeWebMouseEvent::NativeWebMouseEvent(GdkEvent* event, const WebCore::DoublePoint& position, int eventClickCount, std::optional<WebCore::FloatSize> delta)
-    : WebMouseEvent(WebEventFactory::createWebMouseEvent(event, position, eventClickCount, delta))
-    , m_nativeEvent(constructNativeEvent(event))
+Ref<NativeWebMouseEvent> NativeWebMouseEvent::create(const WebCore::DoublePoint& position)
 {
+    return adoptRef(*new NativeWebMouseEvent(WebEventFactory::createWebMouseEvent(position), nullptr));
 }
 
-NativeWebMouseEvent::NativeWebMouseEvent(const WebCore::DoublePoint& position)
-    : WebMouseEvent(WebEventFactory::createWebMouseEvent(position))
+Ref<NativeWebMouseEvent> NativeWebMouseEvent::create(WebEventType type, WebMouseEventButton button, unsigned short buttons, const WebCore::DoublePoint& position, const WebCore::DoublePoint& globalPosition, int clickCount, OptionSet<WebEventModifier> modifiers, std::optional<WebCore::FloatSize> delta, WebCore::PointerID pointerId, const String& pointerType, WebCore::PlatformMouseEvent::IsTouch isTouchEvent)
 {
+    return adoptRef(*new NativeWebMouseEvent(WebMouseEventInit {
+        { type, modifiers, MonotonicTime::now() },
+        {
+            .button = button,
+            .buttons = buttons,
+            .position = position,
+            .globalPosition = globalPosition,
+            .deltaX = delta.value_or(WebCore::FloatSize()).width(),
+            .deltaY = delta.value_or(WebCore::FloatSize()).height(),
+            .deltaZ = 0,
+            .clickCount = clickCount,
+            .force = 0,
+            .inputSource = WebEventInputSource::UserDriven,
+            .canInitiateDrag = WebCore::PlatformMouseEvent::CanInitiateDrag::Yes,
+            .syntheticClickType = WebMouseEventSyntheticClickType::NoTap,
+            .isTouchEvent = isTouchEvent,
+            .pointerId = pointerId,
+            .pointerType = pointerType,
+            .gestureWasCancelled = GestureWasCancelled::No,
+            .unadjustedMovementDelta = { },
+            .coalescedEvents = { },
+        }
+    }, nullptr));
 }
 
-NativeWebMouseEvent::NativeWebMouseEvent(WebEventType type, WebMouseEventButton button, unsigned short buttons, const WebCore::DoublePoint& position, const WebCore::DoublePoint& globalPosition, int clickCount, OptionSet<WebEventModifier> modifiers, std::optional<WebCore::FloatSize> delta, WebCore::PointerID pointerId, const String& pointerType, WebCore::PlatformMouseEvent::IsTouch isTouchEvent)
-    : WebMouseEvent(WebEvent(type, modifiers, MonotonicTime::now()), button, buttons, position, globalPosition, delta.value_or(WebCore::FloatSize()).width(), delta.value_or(WebCore::FloatSize()).height(), 0, clickCount, 0, WebEventInputSource::UserDriven, WebCore::PlatformMouseEvent::CanInitiateDrag::Yes, WebMouseEventSyntheticClickType::NoTap, isTouchEvent, pointerId, pointerType)
+Ref<NativeWebMouseEvent> NativeWebMouseEvent::create(const NativeWebMouseEvent& event)
 {
+    return adoptRef(*new NativeWebMouseEvent(WebMouseEventInit { event.eventData(), event.mouseData() },
+        event.nativeEvent() ? const_cast<GdkEvent*>(event.nativeEvent()) : nullptr));
 }
 
-NativeWebMouseEvent::NativeWebMouseEvent(const NativeWebMouseEvent& event)
-    : WebMouseEvent(event)
-    , m_nativeEvent(event.nativeEvent() ? constructNativeEvent(const_cast<GdkEvent*>(event.nativeEvent())) : nullptr)
+NativeWebMouseEvent::NativeWebMouseEvent(WebMouseEventInit&& init, GdkEvent* event)
+    : WebMouseEvent(WTF::move(init.event), WTF::move(init.mouse))
+    , m_nativeEvent(event ? constructNativeEvent(event) : nullptr)
 {
 }
 
diff --git a/Source/WebKit/Shared/gtk/NativeWebTouchEventGtk.cpp b/Source/WebKit/Shared/gtk/NativeWebTouchEventGtk.cpp
index 5f55875092ab..bf111775eea5 100644
--- a/Source/WebKit/Shared/gtk/NativeWebTouchEventGtk.cpp
+++ b/Source/WebKit/Shared/gtk/NativeWebTouchEventGtk.cpp
@@ -30,6 +30,7 @@
 
 #include "GtkVersioning.h"
 #include "WebEventFactory.h"
+#include <wtf/TZoneMallocInlines.h>
 #include <wtf/MonotonicTime.h>
 
 namespace WebKit {
@@ -40,20 +41,30 @@ namespace WebKit {
 #define constructNativeEvent(event) gdk_event_copy(event)
 #endif
 
-NativeWebTouchEvent::NativeWebTouchEvent(GdkEvent* event, Vector<WebPlatformTouchPoint>&& touchPoints)
-    : WebTouchEvent(WebEventFactory::createWebTouchEvent(event, WTF::move(touchPoints)))
-    , m_nativeEvent(constructNativeEvent(event))
+WTF_MAKE_TZONE_ALLOCATED_IMPL(NativeWebTouchEvent);
+
+Ref<NativeWebTouchEvent> NativeWebTouchEvent::create(GdkEvent* event, Vector<WebPlatformTouchPoint>&& touchPoints)
+{
+    return adoptRef(*new NativeWebTouchEvent(WebEventFactory::createWebTouchEvent(event, WTF::move(touchPoints)), event));
+}
+
+Ref<NativeWebTouchEvent> NativeWebTouchEvent::create(WebEventType type, OptionSet<WebEventModifier> modifiers, Vector<WebPlatformTouchPoint>&& touchPoints)
 {
+    return adoptRef(*new NativeWebTouchEvent(WebTouchEventInit {
+        { type, modifiers, MonotonicTime::now() },
+        { .touchPoints = WTF::move(touchPoints), .coalescedEvents = { }, .predictedEvents = { } }
+    }, nullptr));
 }
 
-NativeWebTouchEvent::NativeWebTouchEvent(WebEventType type, OptionSet<WebEventModifier> modifiers, Vector<WebPlatformTouchPoint>&& touchPoints)
-    : WebTouchEvent({ type, modifiers, MonotonicTime::now() }, WTF::move(touchPoints), { }, { })
+Ref<NativeWebTouchEvent> NativeWebTouchEvent::create(const NativeWebTouchEvent& event)
 {
+    return adoptRef(*new NativeWebTouchEvent(WebTouchEventInit { event.eventData(), event.touchData() },
+        const_cast<GdkEvent*>(event.nativeEvent())));
 }
 
-NativeWebTouchEvent::NativeWebTouchEvent(const NativeWebTouchEvent& event)
-    : WebTouchEvent(event)
-    , m_nativeEvent(constructNativeEvent(const_cast<GdkEvent*>(event.nativeEvent())))
+NativeWebTouchEvent::NativeWebTouchEvent(WebTouchEventInit&& init, GdkEvent* event)
+    : WebTouchEvent(WTF::move(init.event), WTF::move(init.touch))
+    , m_nativeEvent(event ? constructNativeEvent(event) : nullptr)
 {
 }
 
diff --git a/Source/WebKit/Shared/gtk/NativeWebWheelEventGtk.cpp b/Source/WebKit/Shared/gtk/NativeWebWheelEventGtk.cpp
index 867701000d6e..78bda6388e35 100644
--- a/Source/WebKit/Shared/gtk/NativeWebWheelEventGtk.cpp
+++ b/Source/WebKit/Shared/gtk/NativeWebWheelEventGtk.cpp
@@ -28,6 +28,7 @@
 
 #include "GtkVersioning.h"
 #include "WebEventFactory.h"
+#include <wtf/TZoneMallocInlines.h>
 
 #if USE(GTK4)
 #define constructNativeEvent(event) event
@@ -37,15 +38,22 @@
 
 namespace WebKit {
 
-NativeWebWheelEvent::NativeWebWheelEvent(GdkEvent* event, const WebCore::IntPoint& position, const WebCore::IntPoint& globalPosition, const WebCore::FloatSize& delta, const WebCore::FloatSize& wheelTicks, WebWheelEvent::Phase phase, WebWheelEvent::Phase momentumPhase, bool hasPreciseDeltas)
-    : WebWheelEvent(WebEventFactory::createWebWheelEvent(event, position, globalPosition, delta, wheelTicks, phase, momentumPhase, hasPreciseDeltas))
-    , m_nativeEvent(event ? constructNativeEvent(event) : nullptr)
+WTF_MAKE_TZONE_ALLOCATED_IMPL(NativeWebWheelEvent);
+
+Ref<NativeWebWheelEvent> NativeWebWheelEvent::create(GdkEvent* event, const WebCore::IntPoint& position, const WebCore::IntPoint& globalPosition, const WebCore::FloatSize& delta, const WebCore::FloatSize& wheelTicks, WebWheelEvent::Phase phase, WebWheelEvent::Phase momentumPhase, bool hasPreciseDeltas)
+{
+    return adoptRef(*new NativeWebWheelEvent(WebEventFactory::createWebWheelEvent(event, position, globalPosition, delta, wheelTicks, phase, momentumPhase, hasPreciseDeltas), event));
+}
+
+Ref<NativeWebWheelEvent> NativeWebWheelEvent::create(const NativeWebWheelEvent& event)
 {
+    return adoptRef(*new NativeWebWheelEvent(WebWheelEventInit { event.eventData(), event.wheelData() },
+        event.nativeEvent() ? const_cast<GdkEvent*>(event.nativeEvent()) : nullptr));
 }
 
-NativeWebWheelEvent::NativeWebWheelEvent(const NativeWebWheelEvent& event)
-    : WebWheelEvent(event)
-    , m_nativeEvent(event.nativeEvent() ? constructNativeEvent(event.nativeEvent()) : nullptr)
+NativeWebWheelEvent::NativeWebWheelEvent(WebWheelEventInit&& init, GdkEvent* event)
+    : WebWheelEvent(WTF::move(init.event), WTF::move(init.wheel))
+    , m_nativeEvent(event ? constructNativeEvent(event) : nullptr)
 {
 }
 
diff --git a/Source/WebKit/Shared/gtk/WebEventFactory.cpp b/Source/WebKit/Shared/gtk/WebEventFactory.cpp
index 7d581570cce5..baaf77327ce7 100644
--- a/Source/WebKit/Shared/gtk/WebEventFactory.cpp
+++ b/Source/WebKit/Shared/gtk/WebEventFactory.cpp
@@ -200,7 +200,7 @@ static inline short pressedMouseButtons(GdkModifierType state)
     return buttons;
 }
 
-WebMouseEvent WebEventFactory::createWebMouseEvent(const GdkEvent* event, int currentClickCount, std::optional<FloatSize> delta)
+WebMouseEventInit WebEventFactory::createWebMouseEvent(const GdkEvent* event, int currentClickCount, std::optional<FloatSize> delta)
 {
     double x, y;
     gdk_event_get_coords(event, &x, &y);
@@ -208,7 +208,7 @@ WebMouseEvent WebEventFactory::createWebMouseEvent(const GdkEvent* event, int cu
     return createWebMouseEvent(event, DoublePoint(x, y), currentClickCount, delta);
 }
 
-WebMouseEvent WebEventFactory::createWebMouseEvent(const GdkEvent* event, const DoublePoint& position, int currentClickCount, std::optional<FloatSize> delta)
+WebMouseEventInit WebEventFactory::createWebMouseEvent(const GdkEvent* event, const DoublePoint& position, int currentClickCount, std::optional<FloatSize> delta)
 {
 #if USE(GTK4)
     // This can happen when a NativeWebMouseEvent representing a crossing event is copied.
@@ -257,27 +257,60 @@ WebMouseEvent WebEventFactory::createWebMouseEvent(const GdkEvent* event, const
         ASSERT_NOT_REACHED();
     }
 
-    return WebMouseEvent({ type, modifiersForEvent(event), monotonicTimeForEvent(event) },
-        buttonForEvent(event),
-        pressedMouseButtons(state),
-        position,
-        globalPosition,
-        movementDelta.width(),
-        movementDelta.height(),
-        0 /* deltaZ */,
-        currentClickCount,
-        0 /* force */,
-        WebEventInputSource::UserDriven
-        );
+    return {
+        { type, modifiersForEvent(event), monotonicTimeForEvent(event) },
+        {
+            .button = buttonForEvent(event),
+            .buttons = static_cast<unsigned short>(pressedMouseButtons(state)),
+            .position = position,
+            .globalPosition = globalPosition,
+            .deltaX = movementDelta.width(),
+            .deltaY = movementDelta.height(),
+            .deltaZ = 0,
+            .clickCount = currentClickCount,
+            .force = 0,
+            .inputSource = WebEventInputSource::UserDriven,
+            .canInitiateDrag = WebCore::PlatformMouseEvent::CanInitiateDrag::Yes,
+            .syntheticClickType = WebMouseEventSyntheticClickType::NoTap,
+            .isTouchEvent = WebCore::PlatformMouseEvent::IsTouch::No,
+            .pointerId = WebCore::mousePointerID,
+            .pointerType = WebCore::mousePointerEventType(),
+            .gestureWasCancelled = GestureWasCancelled::No,
+            .unadjustedMovementDelta = { },
+            .coalescedEvents = { },
+        }
+    };
 }
 
-WebMouseEvent WebEventFactory::createWebMouseEvent(const DoublePoint& position)
+WebMouseEventInit WebEventFactory::createWebMouseEvent(const DoublePoint& position)
 {
     // Mouse events without GdkEvent are crossing events, handled as a mouse move.
-    return WebMouseEvent({ WebEventType::MouseMove, { }, MonotonicTime::now() }, WebMouseEventButton::None, 0, position, position, 0, 0, 0, 0, 0, WebEventInputSource::UserDriven);
+    return {
+        { WebEventType::MouseMove, { }, MonotonicTime::now() },
+        {
+            .button = WebMouseEventButton::None,
+            .buttons = 0,
+            .position = position,
+            .globalPosition = position,
+            .deltaX = 0,
+            .deltaY = 0,
+            .deltaZ = 0,
+            .clickCount = 0,
+            .force = 0,
+            .inputSource = WebEventInputSource::UserDriven,
+            .canInitiateDrag = WebCore::PlatformMouseEvent::CanInitiateDrag::Yes,
+            .syntheticClickType = WebMouseEventSyntheticClickType::NoTap,
+            .isTouchEvent = WebCore::PlatformMouseEvent::IsTouch::No,
+            .pointerId = WebCore::mousePointerID,
+            .pointerType = WebCore::mousePointerEventType(),
+            .gestureWasCancelled = GestureWasCancelled::No,
+            .unadjustedMovementDelta = { },
+            .coalescedEvents = { },
+        }
+    };
 }
 
-WebKeyboardEvent WebEventFactory::createWebKeyboardEvent(const GdkEvent* event, const String& text, bool isAutoRepeat, bool handledByInputMethod, std::optional<Vector<CompositionUnderline>>&& preeditUnderlines, std::optional<EditingRange>&& preeditSelectionRange, Vector<String>&& commands)
+WebKeyboardEventInit WebEventFactory::createWebKeyboardEvent(const GdkEvent* event, const String& text, bool isAutoRepeat, bool handledByInputMethod, std::optional<Vector<CompositionUnderline>>&& preeditUnderlines, std::optional<EditingRange>&& preeditSelectionRange, Vector<String>&& commands)
 {
     guint keyval;
     gdk_event_get_keyval(event, &keyval);
@@ -285,25 +318,27 @@ WebKeyboardEvent WebEventFactory::createWebKeyboardEvent(const GdkEvent* event,
     gdk_event_get_keycode(event, &keycode);
     GdkEventType type = gdk_event_get_event_type(const_cast<GdkEvent*>(event));
 
-    return WebKeyboardEvent(
+    return {
         { type == GDK_KEY_RELEASE ? WebEventType::KeyUp : WebEventType::KeyDown, modifiersForEvent(event), monotonicTimeForEvent(event) },
-        text.isNull() ? WebKeyboardEvent::singleCharacterStringForGdkKeyval(keyval) : text,
-        WebKeyboardEvent::keyValueStringForGdkKeyval(keyval),
-        WebKeyboardEvent::keyCodeStringForGdkKeycode(keycode),
-        WebKeyboardEvent::keyIdentifierForGdkKeyval(keyval),
-        WebKeyboardEvent::windowsKeyCodeForGdkKeyval(keyval),
-        static_cast<int>(keyval),
-        handledByInputMethod,
-        WTF::move(preeditUnderlines),
-        WTF::move(preeditSelectionRange),
-        WTF::move(commands),
-        isAutoRepeat,
-        isGdkKeyCodeFromKeyPad(keyval)
-        );
+        {
+            .text = text.isNull() ? WebKeyboardEvent::singleCharacterStringForGdkKeyval(keyval) : text,
+            .key = WebKeyboardEvent::keyValueStringForGdkKeyval(keyval),
+            .code = WebKeyboardEvent::keyCodeStringForGdkKeycode(keycode),
+            .keyIdentifier = WebKeyboardEvent::keyIdentifierForGdkKeyval(keyval),
+            .windowsVirtualKeyCode = WebKeyboardEvent::windowsKeyCodeForGdkKeyval(keyval),
+            .nativeVirtualKeyCode = static_cast<int>(keyval),
+            .handledByInputMethod = handledByInputMethod,
+            .preeditUnderlines = WTF::move(preeditUnderlines),
+            .preeditSelectionRange = WTF::move(preeditSelectionRange),
+            .commands = WTF::move(commands),
+            .isAutoRepeat = isAutoRepeat,
+            .isKeypad = isGdkKeyCodeFromKeyPad(keyval),
+        }
+    };
 }
 
 #if ENABLE(TOUCH_EVENTS)
-WebTouchEvent WebEventFactory::createWebTouchEvent(const GdkEvent* event, Vector<WebPlatformTouchPoint>&& touchPoints)
+WebTouchEventInit WebEventFactory::createWebTouchEvent(const GdkEvent* event, Vector<WebPlatformTouchPoint>&& touchPoints)
 {
     auto type = WebEventType::TouchMove;
     GdkEventType eventType = gdk_event_get_event_type(const_cast<GdkEvent*>(event));
@@ -324,13 +359,25 @@ WebTouchEvent WebEventFactory::createWebTouchEvent(const GdkEvent* event, Vector
         ASSERT_NOT_REACHED();
     }
 
-    return WebTouchEvent({ type, modifiersForEvent(event), monotonicTimeForEvent(event) }, WTF::move(touchPoints), { }, { });
+    return { { type, modifiersForEvent(event), monotonicTimeForEvent(event) }, { .touchPoints = WTF::move(touchPoints), .coalescedEvents = { }, .predictedEvents = { } } };
 }
 #endif
 
-WebWheelEvent WebEventFactory::createWebWheelEvent(const GdkEvent* event, const WebCore::IntPoint& position, const WebCore::IntPoint& globalPosition, const WebCore::FloatSize& delta, const WebCore::FloatSize& wheelTicks, WebWheelEvent::Phase phase, WebWheelEvent::Phase momentumPhase, bool hasPreciseDeltas)
+WebWheelEventInit WebEventFactory::createWebWheelEvent(const GdkEvent* event, const WebCore::IntPoint& position, const WebCore::IntPoint& globalPosition, const WebCore::FloatSize& delta, const WebCore::FloatSize& wheelTicks, WebWheelEvent::Phase phase, WebWheelEvent::Phase momentumPhase, bool hasPreciseDeltas)
 {
-    return WebWheelEvent({ WebEventType::Wheel, modifiersForEvent(event), monotonicTimeForEvent(event) }, position, globalPosition, delta, wheelTicks, WebWheelEvent::Granularity::ScrollByPixelWheelEvent, phase, momentumPhase, hasPreciseDeltas);
+    return {
+        { WebEventType::Wheel, modifiersForEvent(event), monotonicTimeForEvent(event) },
+        {
+            .position = position,
+            .globalPosition = globalPosition,
+            .delta = delta,
+            .wheelTicks = wheelTicks,
+            .granularity = WebWheelEvent::Granularity::ScrollByPixelWheelEvent,
+            .phase = phase,
+            .momentumPhase = momentumPhase,
+            .hasPreciseScrollingDeltas = hasPreciseDeltas,
+        }
+    };
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit/Shared/gtk/WebEventFactory.h b/Source/WebKit/Shared/gtk/WebEventFactory.h
index ce0a85cc9360..55e29a44f145 100644
--- a/Source/WebKit/Shared/gtk/WebEventFactory.h
+++ b/Source/WebKit/Shared/gtk/WebEventFactory.h
@@ -44,14 +44,14 @@ namespace WebKit {
 
 class WebEventFactory {
 public:
-    static WebMouseEvent createWebMouseEvent(const GdkEvent*, int, std::optional<WebCore::FloatSize>);
-    static WebMouseEvent createWebMouseEvent(const GdkEvent*, const WebCore::DoublePoint&, int, std::optional<WebCore::FloatSize>);
-    static WebMouseEvent createWebMouseEvent(const WebCore::DoublePoint&);
-    static WebKeyboardEvent createWebKeyboardEvent(const GdkEvent*, const String&, bool isAutoRepeat, bool handledByInputMethod, std::optional<Vector<WebCore::CompositionUnderline>>&&, std::optional<EditingRange>&&, Vector<String>&& commands);
+    static WebMouseEventInit createWebMouseEvent(const GdkEvent*, int, std::optional<WebCore::FloatSize>);
+    static WebMouseEventInit createWebMouseEvent(const GdkEvent*, const WebCore::DoublePoint&, int, std::optional<WebCore::FloatSize>);
+    static WebMouseEventInit createWebMouseEvent(const WebCore::DoublePoint&);
+    static WebKeyboardEventInit createWebKeyboardEvent(const GdkEvent*, const String&, bool isAutoRepeat, bool handledByInputMethod, std::optional<Vector<WebCore::CompositionUnderline>>&&, std::optional<EditingRange>&&, Vector<String>&& commands);
 #if ENABLE(TOUCH_EVENTS)
-    static WebTouchEvent createWebTouchEvent(const GdkEvent*, Vector<WebPlatformTouchPoint>&&);
+    static WebTouchEventInit createWebTouchEvent(const GdkEvent*, Vector<WebPlatformTouchPoint>&&);
 #endif
-    static WebWheelEvent createWebWheelEvent(const GdkEvent*, const WebCore::IntPoint&, const WebCore::IntPoint&, const WebCore::FloatSize&, const WebCore::FloatSize&, WebWheelEvent::Phase, WebWheelEvent::Phase, bool hasPreciseDeltas);
+    static WebWheelEventInit createWebWheelEvent(const GdkEvent*, const WebCore::IntPoint&, const WebCore::IntPoint&, const WebCore::FloatSize&, const WebCore::FloatSize&, WebWheelEvent::Phase, WebWheelEvent::Phase, bool hasPreciseDeltas);
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit/Shared/ios/NativeWebKeyboardEventIOS.mm b/Source/WebKit/Shared/ios/NativeWebKeyboardEventIOS.mm
index a38ef8786e16..83dd71f40856 100644
--- a/Source/WebKit/Shared/ios/NativeWebKeyboardEventIOS.mm
+++ b/Source/WebKit/Shared/ios/NativeWebKeyboardEventIOS.mm
@@ -31,11 +31,19 @@
 #import "UIKitSPI.h"
 #import "WebIOSEventFactory.h"
 #import <wtf/RuntimeApplicationChecks.h>
+#import <wtf/TZoneMallocInlines.h>
 
 namespace WebKit {
 
-NativeWebKeyboardEvent::NativeWebKeyboardEvent(::WebEvent *event, HandledByInputMethod handledByInputMethod)
-    : WebKeyboardEvent(WebIOSEventFactory::createWebKeyboardEvent(event, handledByInputMethod == HandledByInputMethod::Yes))
+WTF_MAKE_TZONE_ALLOCATED_IMPL(NativeWebKeyboardEvent);
+
+Ref<NativeWebKeyboardEvent> NativeWebKeyboardEvent::create(::WebEvent *event, HandledByInputMethod handledByInputMethod)
+{
+    return adoptRef(*new NativeWebKeyboardEvent(WebIOSEventFactory::createWebKeyboardEvent(event, handledByInputMethod == HandledByInputMethod::Yes), event));
+}
+
+NativeWebKeyboardEvent::NativeWebKeyboardEvent(WebKeyboardEventInit&& init, ::WebEvent *event)
+    : WebKeyboardEvent(WTF::move(init.event), WTF::move(init.keyboard))
     , m_nativeEvent(event)
 {
 }
diff --git a/Source/WebKit/Shared/ios/NativeWebMouseEventIOS.mm b/Source/WebKit/Shared/ios/NativeWebMouseEventIOS.mm
index 0cd6d082beba..7374b4595f08 100644
--- a/Source/WebKit/Shared/ios/NativeWebMouseEventIOS.mm
+++ b/Source/WebKit/Shared/ios/NativeWebMouseEventIOS.mm
@@ -29,22 +29,70 @@
 #if PLATFORM(IOS_FAMILY)
 
 #import "WebIOSEventFactory.h"
+#import <wtf/TZoneMallocInlines.h>
 
 namespace WebKit {
 
-NativeWebMouseEvent::NativeWebMouseEvent(::WebEvent *event)
-    : WebMouseEvent(WebIOSEventFactory::createWebMouseEvent(event))
-    , m_nativeEvent(event)
+WTF_MAKE_TZONE_ALLOCATED_IMPL(NativeWebMouseEvent);
+
+Ref<NativeWebMouseEvent> NativeWebMouseEvent::create(::WebEvent *event)
+{
+    return adoptRef(*new NativeWebMouseEvent(WebIOSEventFactory::createWebMouseEvent(event), event));
+}
+
+Ref<NativeWebMouseEvent> NativeWebMouseEvent::create(WebEventType type, WebMouseEventButton button, unsigned short buttons, const WebCore::DoublePoint& position, const WebCore::DoublePoint& globalPosition, float deltaX, float deltaY, float deltaZ, int clickCount, OptionSet<WebEventModifier> modifiers, MonotonicTime timestamp, double force, GestureWasCancelled gestureWasCancelled, const String& pointerType)
 {
+    return adoptRef(*new NativeWebMouseEvent(WebMouseEventInit {
+        { type, modifiers, timestamp },
+        {
+            .button = button,
+            .buttons = buttons,
+            .position = position,
+            .globalPosition = globalPosition,
+            .deltaX = deltaX,
+            .deltaY = deltaY,
+            .deltaZ = deltaZ,
+            .clickCount = clickCount,
+            .force = force,
+            .inputSource = WebEventInputSource::UserDriven,
+            .canInitiateDrag = WebCore::PlatformMouseEvent::CanInitiateDrag::Yes,
+            .syntheticClickType = WebMouseEventSyntheticClickType::NoTap,
+            .pointerId = WebCore::mousePointerID,
+            .pointerType = pointerType,
+            .gestureWasCancelled = gestureWasCancelled,
+            .unadjustedMovementDelta = { deltaX, deltaY },
+        }
+    }, nil));
 }
 
-NativeWebMouseEvent::NativeWebMouseEvent(WebEventType type, WebMouseEventButton button, unsigned short buttons, const WebCore::DoublePoint& position, const WebCore::DoublePoint& globalPosition, float deltaX, float deltaY, float deltaZ, int clickCount, OptionSet<WebEventModifier> modifiers, MonotonicTime timestamp, double force, GestureWasCancelled gestureWasCancelled, const String& pointerType)
-    : WebMouseEvent({ type, modifiers, timestamp }, button, buttons, position, globalPosition, deltaX, deltaY, deltaZ, clickCount, force, WebEventInputSource::UserDriven, WebCore::PlatformMouseEvent::CanInitiateDrag::Yes, WebMouseEventSyntheticClickType::NoTap, WebCore::mousePointerID, pointerType, gestureWasCancelled, { deltaX, deltaY })
+Ref<NativeWebMouseEvent> NativeWebMouseEvent::create(const NativeWebMouseEvent& otherEvent, const WebCore::DoublePoint& position, const WebCore::DoublePoint& globalPosition, float deltaX, float deltaY, float deltaZ)
 {
+    return adoptRef(*new NativeWebMouseEvent(WebMouseEventInit {
+        { otherEvent.type(), otherEvent.modifiers(), otherEvent.timestamp() },
+        {
+            .button = otherEvent.button(),
+            .buttons = otherEvent.buttons(),
+            .position = position,
+            .globalPosition = globalPosition,
+            .deltaX = deltaX,
+            .deltaY = deltaY,
+            .deltaZ = deltaZ,
+            .clickCount = otherEvent.clickCount(),
+            .force = otherEvent.force(),
+            .inputSource = otherEvent.inputSource(),
+            .canInitiateDrag = otherEvent.canInitiateDrag(),
+            .syntheticClickType = otherEvent.syntheticClickType(),
+            .pointerId = otherEvent.pointerId(),
+            .pointerType = otherEvent.pointerType(),
+            .gestureWasCancelled = otherEvent.gestureWasCancelled(),
+            .unadjustedMovementDelta = { deltaX, deltaY },
+        }
+    }, nil));
 }
 
-NativeWebMouseEvent::NativeWebMouseEvent(const NativeWebMouseEvent& otherEvent, const WebCore::DoublePoint& position, const WebCore::DoublePoint& globalPosition, float deltaX, float deltaY, float deltaZ)
-    : WebMouseEvent({ otherEvent.type(), otherEvent.modifiers(), otherEvent.timestamp() }, otherEvent.button(), otherEvent.buttons(), position, globalPosition, deltaX, deltaY, deltaZ, otherEvent.clickCount(), otherEvent.force(), otherEvent.inputSource(), otherEvent.canInitiateDrag(), otherEvent.syntheticClickType(), otherEvent.pointerId(), otherEvent.pointerType(), otherEvent.gestureWasCancelled(), { deltaX, deltaY })
+NativeWebMouseEvent::NativeWebMouseEvent(WebMouseEventInit&& init, ::WebEvent *event)
+    : WebMouseEvent(WTF::move(init.event), WTF::move(init.mouse))
+    , m_nativeEvent(event)
 {
 }
 
diff --git a/Source/WebKit/Shared/ios/NativeWebTouchEventIOS.mm b/Source/WebKit/Shared/ios/NativeWebTouchEventIOS.mm
index 1781ea3dfc7d..980684b29d9d 100644
--- a/Source/WebKit/Shared/ios/NativeWebTouchEventIOS.mm
+++ b/Source/WebKit/Shared/ios/NativeWebTouchEventIOS.mm
@@ -31,11 +31,14 @@
 #import "WKTouchEventsGestureRecognizer.h"
 #import <WebCore/IntPoint.h>
 #import <WebCore/WAKAppKitStubs.h>
+#import <wtf/TZoneMallocInlines.h>
 
 namespace WebKit {
 
 #if ENABLE(TOUCH_EVENTS)
 
+WTF_MAKE_TZONE_ALLOCATED_IMPL(NativeWebTouchEvent);
+
 static inline WebEventType webEventTypeForWKTouchEventType(WKTouchEventType type)
 {
     switch (type) {
@@ -121,31 +124,39 @@ static CGFloat radiusForTouchPoint(const WKTouchPoint& touchPoint)
     });
 }
 
-Vector<WebTouchEvent> NativeWebTouchEvent::extractCoalescedWebTouchEvents(const WKTouchEvent& event, UIKeyModifierFlags flags)
+Vector<Ref<WebTouchEvent>> NativeWebTouchEvent::extractCoalescedWebTouchEvents(const WKTouchEvent& event, UIKeyModifierFlags flags)
 {
-    return event.coalescedEvents.map([&](auto& event) -> WebTouchEvent {
-        return NativeWebTouchEvent { event, flags };
+    return event.coalescedEvents.map([&](auto& event) -> Ref<WebTouchEvent> {
+        return NativeWebTouchEvent::create(event, flags);
     });
 }
 
-Vector<WebTouchEvent> NativeWebTouchEvent::extractPredictedWebTouchEvents(const WKTouchEvent& event, UIKeyModifierFlags flags)
+Vector<Ref<WebTouchEvent>> NativeWebTouchEvent::extractPredictedWebTouchEvents(const WKTouchEvent& event, UIKeyModifierFlags flags)
 {
-    return event.predictedEvents.map([&](auto& event) -> WebTouchEvent {
-        return NativeWebTouchEvent { event, flags };
+    return event.predictedEvents.map([&](auto& event) -> Ref<WebTouchEvent> {
+        return NativeWebTouchEvent::create(event, flags);
     });
 }
 
-NativeWebTouchEvent::NativeWebTouchEvent(const WKTouchEvent& event, UIKeyModifierFlags flags)
-    : WebTouchEvent(
+Ref<NativeWebTouchEvent> NativeWebTouchEvent::create(const WKTouchEvent& event, UIKeyModifierFlags flags)
+{
+    return adoptRef(*new NativeWebTouchEvent(WebTouchEventInit {
         { webEventTypeForWKTouchEventType(event.type), webEventModifierFlags(flags), MonotonicTime::fromRawSeconds(event.timestamp) },
-        extractWebTouchPoints(event),
-        extractCoalescedWebTouchEvents(event, flags),
-        extractPredictedWebTouchEvents(event, flags),
-        positionForCGPoint(event.locationInRootViewCoordinates),
-        event.isPotentialTap,
-        event.inJavaScriptGesture,
-        event.scale,
-        event.rotation)
+        {
+            .touchPoints = extractWebTouchPoints(event),
+            .coalescedEvents = extractCoalescedWebTouchEvents(event, flags),
+            .predictedEvents = extractPredictedWebTouchEvents(event, flags),
+            .position = positionForCGPoint(event.locationInRootViewCoordinates),
+            .isPotentialTap = event.isPotentialTap,
+            .isGesture = event.inJavaScriptGesture,
+            .gestureScale = static_cast<float>(event.scale),
+            .gestureRotation = static_cast<float>(event.rotation),
+        }
+    }));
+}
+
+NativeWebTouchEvent::NativeWebTouchEvent(WebTouchEventInit&& init)
+    : WebTouchEvent(WTF::move(init.event), WTF::move(init.touch))
 {
 }
 
diff --git a/Source/WebKit/Shared/ios/WebIOSEventFactory.h b/Source/WebKit/Shared/ios/WebIOSEventFactory.h
index 3facde4edf74..d7dd31ca5cda 100644
--- a/Source/WebKit/Shared/ios/WebIOSEventFactory.h
+++ b/Source/WebKit/Shared/ios/WebIOSEventFactory.h
@@ -41,11 +41,11 @@ namespace WebKit {
 
 class WebIOSEventFactory {
 public:
-    static WebKit::WebKeyboardEvent createWebKeyboardEvent(::WebEvent *, bool handledByInputMethod);
-    static WebKit::WebMouseEvent createWebMouseEvent(::WebEvent *);
+    static WebKit::WebKeyboardEventInit createWebKeyboardEvent(::WebEvent *, bool handledByInputMethod);
+    static WebKit::WebMouseEventInit createWebMouseEvent(::WebEvent *);
 
 #if HAVE(UISCROLLVIEW_ASYNCHRONOUS_SCROLL_EVENT_HANDLING)
-    static WebKit::WebWheelEvent createWebWheelEvent(WKBEScrollViewScrollUpdate *, UIView *contentView, std::optional<WebKit::WebWheelEvent::Phase> overridePhase = std::nullopt);
+    static WebKit::WebWheelEventInit createWebWheelEvent(WKBEScrollViewScrollUpdate *, UIView *contentView, std::optional<WebKit::WebWheelEvent::Phase> overridePhase = std::nullopt);
     static WebCore::FloatSize translationInView(WKBEScrollViewScrollUpdate *, UIView *);
 #endif
 
diff --git a/Source/WebKit/Shared/ios/WebIOSEventFactory.mm b/Source/WebKit/Shared/ios/WebIOSEventFactory.mm
index e8ec26c6d615..7a7264377435 100644
--- a/Source/WebKit/Shared/ios/WebIOSEventFactory.mm
+++ b/Source/WebKit/Shared/ios/WebIOSEventFactory.mm
@@ -103,7 +103,7 @@
     return modifiers;
 }
 
-WebKeyboardEvent WebIOSEventFactory::createWebKeyboardEvent(::WebEvent *event, bool handledByInputMethod)
+WebKeyboardEventInit WebIOSEventFactory::createWebKeyboardEvent(::WebEvent *event, bool handledByInputMethod)
 {
     WebEventType type = (event.type == WebEventKeyUp) ? WebEventType::KeyUp : WebEventType::KeyDown;
     String text;
@@ -148,10 +148,26 @@
         unmodifiedText = text;
     }
 
-    return WebKeyboardEvent { { type, modifiers, MonotonicTime::fromRawSeconds(timestamp) }, text, unmodifiedText, key, code, keyIdentifier, windowsVirtualKeyCode, nativeVirtualKeyCode, macCharCode, handledByInputMethod, autoRepeat, isKeypad, isSystemKey };
+    return {
+        { type, modifiers, MonotonicTime::fromRawSeconds(timestamp) },
+        {
+            .text = text,
+            .unmodifiedText = unmodifiedText,
+            .key = key,
+            .code = code,
+            .keyIdentifier = keyIdentifier,
+            .windowsVirtualKeyCode = windowsVirtualKeyCode,
+            .nativeVirtualKeyCode = nativeVirtualKeyCode,
+            .macCharCode = macCharCode,
+            .handledByInputMethod = handledByInputMethod,
+            .isAutoRepeat = autoRepeat,
+            .isKeypad = isKeypad,
+            .isSystemKey = isSystemKey,
+        }
+    };
 }
 
-WebMouseEvent WebIOSEventFactory::createWebMouseEvent(::WebEvent *event)
+WebMouseEventInit WebIOSEventFactory::createWebMouseEvent(::WebEvent *event)
 {
     // This currently only supports synthetic mouse moved events with no button pressed.
     ASSERT_ARG(event, event.type == WebEventMouseMoved);
@@ -166,7 +182,21 @@
     int clickCount = 0;
     double timestamp = event.timestamp;
 
-    return WebMouseEvent({ type, OptionSet<WebEventModifier> { }, MonotonicTime::fromRawSeconds(timestamp) }, button, buttons, position, position, deltaX, deltaY, deltaZ, clickCount, 0, WebEventInputSource::UserDriven);
+    return {
+        { type, OptionSet<WebEventModifier> { }, MonotonicTime::fromRawSeconds(timestamp) },
+        {
+            .button = button,
+            .buttons = buttons,
+            .position = position,
+            .globalPosition = position,
+            .deltaX = deltaX,
+            .deltaY = deltaY,
+            .deltaZ = deltaZ,
+            .clickCount = clickCount,
+            .force = 0,
+            .inputSource = WebEventInputSource::UserDriven,
+        }
+    };
 }
 
 #if HAVE(UISCROLLVIEW_ASYNCHRONOUS_SCROLL_EVENT_HANDLING)
@@ -205,7 +235,7 @@
 #endif
 }
 
-WebWheelEvent WebIOSEventFactory::createWebWheelEvent(WKBEScrollViewScrollUpdate *update, UIView *contentView, std::optional<WebWheelEvent::Phase> overridePhase)
+WebWheelEventInit WebIOSEventFactory::createWebWheelEvent(WKBEScrollViewScrollUpdate *update, UIView *contentView, std::optional<WebWheelEvent::Phase> overridePhase)
 {
     WebCore::IntPoint scrollLocation = WebCore::roundedIntPoint([update locationInView:contentView]);
     auto delta = translationInView(update, contentView);
@@ -214,20 +244,22 @@
     auto timestamp = MonotonicTime::fromRawSeconds(update.timestamp);
     return {
         { WebEventType::Wheel, OptionSet<WebEventModifier> { }, timestamp },
-        scrollLocation,
-        scrollLocation,
-        delta,
-        wheelTicks,
-        WebWheelEvent::Granularity::ScrollByPixelWheelEvent,
-        false,
-        overridePhase.value_or(toWebPhase(update.phase)),
-        WebWheelEvent::Phase::None,
-        true,
-        1,
-        delta,
-        timestamp,
-        { },
-        WebWheelEvent::MomentumEndType::Unknown
+        {
+            .position = scrollLocation,
+            .globalPosition = scrollLocation,
+            .delta = delta,
+            .wheelTicks = wheelTicks,
+            .granularity = WebWheelEvent::Granularity::ScrollByPixelWheelEvent,
+            .directionInvertedFromDevice = false,
+            .phase = overridePhase.value_or(toWebPhase(update.phase)),
+            .momentumPhase = WebWheelEvent::Phase::None,
+            .hasPreciseScrollingDeltas = true,
+            .scrollCount = 1,
+            .unacceleratedScrollingDelta = delta,
+            .ioHIDEventTimestamp = timestamp,
+            .rawPlatformDelta = { },
+            .momentumEndType = WebWheelEvent::MomentumEndType::Unknown,
+        }
     };
 }
 #endif
diff --git a/Source/WebKit/Shared/ios/WebParentalControlsURLFilter.mm b/Source/WebKit/Shared/ios/WebParentalControlsURLFilter.mm
index 1f3239218555..3f59a8161ee6 100644
--- a/Source/WebKit/Shared/ios/WebParentalControlsURLFilter.mm
+++ b/Source/WebKit/Shared/ios/WebParentalControlsURLFilter.mm
@@ -94,9 +94,16 @@
         RetainPtr filter = ensureWebContentFilter();
 #if HAVE(WEBCONTENTRESTRICTIONS_TRANSITIVE_TRUST)
 #if __has_include(<WebKitAdditions/BEKAdditions.h>)
-    if (WebCore::DeprecatedGlobalSettings::webContentRestrictionsTransitiveTrustEnabled()) {
-        MAYBE_EVALUATE_URL_WITH_TRANSITIVE_TRUST
-    }
+        if (WebCore::DeprecatedGlobalSettings::webContentRestrictionsTransitiveTrustEnabled()) {
+            BOOL isMainFrameForEvaluation = (isMainFrame == WebCore::IsMainFrameLoad::Yes);
+            if ([filter respondsToSelector:@selector(evaluateURL:mainFrameURL:isMainFrame:completionHandler:)]) {
+                [filter evaluateURL:url.createNSURL().get() mainFrameURL:mainDocumentURL.createNSURL().get() isMainFrame:isMainFrameForEvaluation completionHandler:makeBlockPtr([completionHandler = WTF::move(completionHandler)](BOOL shouldBlock, NSData *replacementData) mutable {
+                    if (completionHandler)
+                        completionHandler(!shouldBlock, replacementData);
+                }).get()];
+                return;
+            }
+        }
 #endif
 #endif
         [filter evaluateURL:url.createNSURL().get() completionHandler:makeBlockPtr([completionHandler = WTF::move(completionHandler)](BOOL shouldBlock, NSData *replacementData) mutable {
@@ -154,11 +161,43 @@
             });
             return;
         }
-        auto filter = ensureWebContentFilter();
+        RetainPtr filter = ensureWebContentFilter();
 #if __has_include(<WebKitAdditions/BEKAdditions.h>)
-        RELEASE_LOG(Loading, "WebParentalControlsURLFilter::requestPermissionForURL starts execution");
-        MAYBE_REQUEST_PERMISSION_ASK_TO
+        if ([filter respondsToSelector:@selector(requestPermissionForURL:referrerURL:presentingView:completionHandler:)]) {
+            auto permissionDecisionCompletionHandler = makeBlockPtr([completionHandler = WTF::move(completionHandler)](BEWebContentFilterPermissionDecision result, NSError *) mutable {
+                switch (result) {
+                case BEWebContentFilterPermissionDecisionError:
+                    RELEASE_LOG(Loading, "WebParentalControlsURLFilter::requestPermissionForURL result is error");
+                    break;
+                case BEWebContentFilterPermissionDecisionAllowed:
+                    RELEASE_LOG(Loading, "WebParentalControlsURLFilter::requestPermissionForURL result is allowed");
+                    break;
+                case BEWebContentFilterPermissionDecisionDenied:
+                    RELEASE_LOG(Loading, "WebParentalControlsURLFilter::requestPermissionForURL result is denied");
+                    break;
+                case BEWebContentFilterPermissionDecisionPending:
+                    RELEASE_LOG(Loading, "WebParentalControlsURLFilter::requestPermissionForURL result is pending");
+                    break;
+                default:
+                    RELEASE_LOG_ERROR(Loading, "WebParentalControlsURLFilter::requestPermissionForURL result is invalid, result:%ld", (long)result);
+                    break;
+                }
+
+                bool didAllow = (result == BEWebContentFilterPermissionDecisionAllowed);
+                callOnMainRunLoop([didAllow, completionHandler = WTF::move(completionHandler)] mutable {
+                    if (completionHandler)
+                        completionHandler(didAllow);
+                });
+            });
+            [filter requestPermissionForURL:url.createNSURL().get() referrerURL:referrerURL.createNSURL().get() presentingView:presentingViewAsUIView completionHandler:permissionDecisionCompletionHandler.get()];
+            return;
+        }
 #endif
+        RELEASE_LOG_ERROR(Loading, "WebParentalControlsURLFilter::requestPermissionForURL is running an unsupported configuration - default to denying permission");
+        callOnMainRunLoop([completionHandler = WTF::move(completionHandler)] mutable {
+            if (completionHandler)
+                completionHandler(false);
+        });
     });
 }
 #endif
diff --git a/Source/WebKit/Shared/libwpe/NativeWebKeyboardEventLibWPE.cpp b/Source/WebKit/Shared/libwpe/NativeWebKeyboardEventLibWPE.cpp
index 306d78f0b3b7..e2ed0e480901 100644
--- a/Source/WebKit/Shared/libwpe/NativeWebKeyboardEventLibWPE.cpp
+++ b/Source/WebKit/Shared/libwpe/NativeWebKeyboardEventLibWPE.cpp
@@ -28,11 +28,19 @@
 
 #if USE(LIBWPE)
 #include "WebEventFactory.h"
+#include <wtf/TZoneMallocInlines.h>
 
 namespace WebKit {
 
-NativeWebKeyboardEvent::NativeWebKeyboardEvent(struct wpe_input_keyboard_event* event, const String& text, bool isAutoRepeat, HandledByInputMethod handledByInputMethod, std::optional<Vector<WebCore::CompositionUnderline>>&& preeditUnderlines, std::optional<EditingRange>&& preeditSelectionRange)
-    : WebKeyboardEvent(WebEventFactory::createWebKeyboardEvent(event, text, isAutoRepeat, handledByInputMethod == HandledByInputMethod::Yes, WTF::move(preeditUnderlines), WTF::move(preeditSelectionRange)))
+WTF_MAKE_TZONE_ALLOCATED_IMPL(NativeWebKeyboardEvent);
+
+Ref<NativeWebKeyboardEvent> NativeWebKeyboardEvent::create(struct wpe_input_keyboard_event* event, const String& text, bool isAutoRepeat, HandledByInputMethod handledByInputMethod, std::optional<Vector<WebCore::CompositionUnderline>>&& preeditUnderlines, std::optional<EditingRange>&& preeditSelectionRange)
+{
+    return adoptRef(*new NativeWebKeyboardEvent(WebEventFactory::createWebKeyboardEvent(event, text, isAutoRepeat, handledByInputMethod == HandledByInputMethod::Yes, WTF::move(preeditUnderlines), WTF::move(preeditSelectionRange))));
+}
+
+NativeWebKeyboardEvent::NativeWebKeyboardEvent(WebKeyboardEventInit&& init)
+    : WebKeyboardEvent(WTF::move(init.event), WTF::move(init.keyboard))
 {
 }
 
diff --git a/Source/WebKit/Shared/libwpe/NativeWebMouseEventLibWPE.cpp b/Source/WebKit/Shared/libwpe/NativeWebMouseEventLibWPE.cpp
index 05ff09009da7..5d8c767c5e87 100644
--- a/Source/WebKit/Shared/libwpe/NativeWebMouseEventLibWPE.cpp
+++ b/Source/WebKit/Shared/libwpe/NativeWebMouseEventLibWPE.cpp
@@ -28,11 +28,19 @@
 
 #if USE(LIBWPE)
 #include "WebEventFactory.h"
+#include <wtf/TZoneMallocInlines.h>
 
 namespace WebKit {
 
-NativeWebMouseEvent::NativeWebMouseEvent(struct wpe_input_pointer_event* event, float deviceScaleFactor, WebMouseEventSyntheticClickType syntheticClickType)
-    : WebMouseEvent(WebEventFactory::createWebMouseEvent(event, deviceScaleFactor, syntheticClickType))
+WTF_MAKE_TZONE_ALLOCATED_IMPL(NativeWebMouseEvent);
+
+Ref<NativeWebMouseEvent> NativeWebMouseEvent::create(struct wpe_input_pointer_event* event, float deviceScaleFactor, WebMouseEventSyntheticClickType syntheticClickType)
+{
+    return adoptRef(*new NativeWebMouseEvent(WebEventFactory::createWebMouseEvent(event, deviceScaleFactor, syntheticClickType)));
+}
+
+NativeWebMouseEvent::NativeWebMouseEvent(WebMouseEventInit&& init)
+    : WebMouseEvent(WTF::move(init.event), WTF::move(init.mouse))
 {
 }
 
diff --git a/Source/WebKit/Shared/libwpe/NativeWebTouchEventLibWPE.cpp b/Source/WebKit/Shared/libwpe/NativeWebTouchEventLibWPE.cpp
index 13bb0ac83774..59de09f974ac 100644
--- a/Source/WebKit/Shared/libwpe/NativeWebTouchEventLibWPE.cpp
+++ b/Source/WebKit/Shared/libwpe/NativeWebTouchEventLibWPE.cpp
@@ -29,11 +29,19 @@
 #if ENABLE(TOUCH_EVENTS) && USE(LIBWPE)
 
 #include "WebEventFactory.h"
+#include <wtf/TZoneMallocInlines.h>
 
 namespace WebKit {
 
-NativeWebTouchEvent::NativeWebTouchEvent(struct wpe_input_touch_event* event, float deviceScaleFactor)
-    : WebTouchEvent(WebEventFactory::createWebTouchEvent(event, deviceScaleFactor))
+WTF_MAKE_TZONE_ALLOCATED_IMPL(NativeWebTouchEvent);
+
+Ref<NativeWebTouchEvent> NativeWebTouchEvent::create(struct wpe_input_touch_event* event, float deviceScaleFactor)
+{
+    return adoptRef(*new NativeWebTouchEvent(WebEventFactory::createWebTouchEvent(event, deviceScaleFactor), event));
+}
+
+NativeWebTouchEvent::NativeWebTouchEvent(WebTouchEventInit&& init, struct wpe_input_touch_event* event)
+    : WebTouchEvent(WTF::move(init.event), WTF::move(init.touch))
     , m_fallbackTouchPoint { wpe_input_touch_event_type_null, 0, 0, 0, 0 }
 {
     for (auto& point : unsafeMakeSpan(event->touchpoints, event->touchpoints_length)) {
diff --git a/Source/WebKit/Shared/libwpe/NativeWebWheelEventLibWPE.cpp b/Source/WebKit/Shared/libwpe/NativeWebWheelEventLibWPE.cpp
index b05a9089a6ea..68be5b320c01 100644
--- a/Source/WebKit/Shared/libwpe/NativeWebWheelEventLibWPE.cpp
+++ b/Source/WebKit/Shared/libwpe/NativeWebWheelEventLibWPE.cpp
@@ -28,12 +28,20 @@
 
 #if USE(LIBWPE)
 #include "WebEventFactory.h"
+#include <wtf/TZoneMallocInlines.h>
 #include <cstdio>
 
 namespace WebKit {
 
-NativeWebWheelEvent::NativeWebWheelEvent(struct wpe_input_axis_event* event, float deviceScaleFactor, WebWheelEvent::Phase phase, WebWheelEvent::Phase momentumPhase)
-    : WebWheelEvent(WebEventFactory::createWebWheelEvent(event, deviceScaleFactor, phase, momentumPhase))
+WTF_MAKE_TZONE_ALLOCATED_IMPL(NativeWebWheelEvent);
+
+Ref<NativeWebWheelEvent> NativeWebWheelEvent::create(struct wpe_input_axis_event* event, float deviceScaleFactor, WebWheelEvent::Phase phase, WebWheelEvent::Phase momentumPhase)
+{
+    return adoptRef(*new NativeWebWheelEvent(WebEventFactory::createWebWheelEvent(event, deviceScaleFactor, phase, momentumPhase)));
+}
+
+NativeWebWheelEvent::NativeWebWheelEvent(WebWheelEventInit&& init)
+    : WebWheelEvent(WTF::move(init.event), WTF::move(init.wheel))
 {
 }
 
diff --git a/Source/WebKit/Shared/libwpe/WebEventFactory.cpp b/Source/WebKit/Shared/libwpe/WebEventFactory.cpp
index d7b30b4ffb9b..440a7f19b809 100644
--- a/Source/WebKit/Shared/libwpe/WebEventFactory.cpp
+++ b/Source/WebKit/Shared/libwpe/WebEventFactory.cpp
@@ -101,21 +101,24 @@ static OptionSet<WebEventModifier> modifiersForKeyboardEvent(struct wpe_input_ke
     return modifiers;
 }
 
-WebKeyboardEvent WebEventFactory::createWebKeyboardEvent(struct wpe_input_keyboard_event* event, const String& text, bool isAutoRepeat, bool handledByInputMethod, std::optional<Vector<WebCore::CompositionUnderline>>&& preeditUnderlines, std::optional<EditingRange>&& preeditSelectionRange)
+WebKeyboardEventInit WebEventFactory::createWebKeyboardEvent(struct wpe_input_keyboard_event* event, const String& text, bool isAutoRepeat, bool handledByInputMethod, std::optional<Vector<WebCore::CompositionUnderline>>&& preeditUnderlines, std::optional<EditingRange>&& preeditSelectionRange)
 {
-    return WebKeyboardEvent({ event->pressed ? WebEventType::KeyDown : WebEventType::KeyUp, modifiersForKeyboardEvent(event), monotonicTimeForEventTimeInMilliseconds(event->time) },
-        text.isNull() ? WebCore::PlatformKeyboardEvent::singleCharacterString(event->key_code) : text,
-        WebCore::PlatformKeyboardEvent::keyValueForWPEKeyCode(event->key_code),
-        WebCore::PlatformKeyboardEvent::keyCodeForHardwareKeyCode(event->hardware_key_code),
-        WebCore::PlatformKeyboardEvent::keyIdentifierForWPEKeyCode(event->key_code),
-        WebCore::PlatformKeyboardEvent::windowsKeyCodeForWPEKeyCode(event->key_code),
-        event->key_code,
-        handledByInputMethod,
-        WTF::move(preeditUnderlines),
-        WTF::move(preeditSelectionRange),
-        isAutoRepeat,
-        isWPEKeyCodeFromKeyPad(event->key_code)
-        );
+    return {
+        { event->pressed ? WebEventType::KeyDown : WebEventType::KeyUp, modifiersForKeyboardEvent(event), monotonicTimeForEventTimeInMilliseconds(event->time) },
+        {
+            .text = text.isNull() ? WebCore::PlatformKeyboardEvent::singleCharacterString(event->key_code) : text,
+            .key = WebCore::PlatformKeyboardEvent::keyValueForWPEKeyCode(event->key_code),
+            .code = WebCore::PlatformKeyboardEvent::keyCodeForHardwareKeyCode(event->hardware_key_code),
+            .keyIdentifier = WebCore::PlatformKeyboardEvent::keyIdentifierForWPEKeyCode(event->key_code),
+            .windowsVirtualKeyCode = WebCore::PlatformKeyboardEvent::windowsKeyCodeForWPEKeyCode(event->key_code),
+            .nativeVirtualKeyCode = static_cast<int32_t>(event->key_code),
+            .handledByInputMethod = handledByInputMethod,
+            .preeditUnderlines = WTF::move(preeditUnderlines),
+            .preeditSelectionRange = WTF::move(preeditSelectionRange),
+            .isAutoRepeat = isAutoRepeat,
+            .isKeypad = isWPEKeyCodeFromKeyPad(event->key_code),
+        }
+    };
 }
 
 static inline short pressedMouseButtons(uint32_t modifiers)
@@ -170,7 +173,7 @@ static inline unsigned clickCount(struct wpe_input_pointer_event* event)
     return gLastClickCount;
 }
 
-WebMouseEvent WebEventFactory::createWebMouseEvent(struct wpe_input_pointer_event* event, float deviceScaleFactor, WebMouseEventSyntheticClickType syntheticClickType)
+WebMouseEventInit WebEventFactory::createWebMouseEvent(struct wpe_input_pointer_event* event, float deviceScaleFactor, WebMouseEventSyntheticClickType syntheticClickType)
 {
     auto type = WebEventType::MouseMove;
     switch (event->type) {
@@ -204,11 +207,31 @@ WebMouseEvent WebEventFactory::createWebMouseEvent(struct wpe_input_pointer_even
     // FIXME: Proper button support. deltaX/Y/Z.
     WebCore::IntPoint position(event->x, event->y);
     position.scale(1 / deviceScaleFactor);
-    return WebMouseEvent({ type, modifiersForEventModifiers(event->modifiers), monotonicTimeForEventTimeInMilliseconds(event->time) }, button, pressedMouseButtons(event->modifiers), position, position,
-        0, 0, 0, clickCount(event), 0, WebEventInputSource::UserDriven, WebCore::PlatformMouseEvent::CanInitiateDrag::Yes, syntheticClickType);
+    return {
+        { type, modifiersForEventModifiers(event->modifiers), monotonicTimeForEventTimeInMilliseconds(event->time) },
+        {
+            .button = button,
+            .buttons = static_cast<unsigned short>(pressedMouseButtons(event->modifiers)),
+            .position = position,
+            .globalPosition = position,
+            .deltaX = 0,
+            .deltaY = 0,
+            .deltaZ = 0,
+            .clickCount = static_cast<int32_t>(clickCount(event)),
+            .force = 0,
+            .inputSource = WebEventInputSource::UserDriven,
+            .canInitiateDrag = WebCore::PlatformMouseEvent::CanInitiateDrag::Yes,
+            .syntheticClickType = syntheticClickType,
+            .pointerId = WebCore::mousePointerID,
+            .pointerType = WebCore::mousePointerEventType(),
+            .gestureWasCancelled = GestureWasCancelled::No,
+            .unadjustedMovementDelta = { },
+            .coalescedEvents = { },
+        }
+    };
 }
 
-WebWheelEvent WebEventFactory::createWebWheelEvent(struct wpe_input_axis_event* event, float deviceScaleFactor, WebWheelEvent::Phase phase, WebWheelEvent::Phase momentumPhase)
+WebWheelEventInit WebEventFactory::createWebWheelEvent(struct wpe_input_axis_event* event, float deviceScaleFactor, WebWheelEvent::Phase phase, WebWheelEvent::Phase momentumPhase)
 {
     WebCore::IntPoint position(event->x, event->y);
     position.scale(1 / deviceScaleFactor);
@@ -235,9 +258,19 @@ WebWheelEvent WebEventFactory::createWebWheelEvent(struct wpe_input_axis_event*
             ASSERT_NOT_REACHED();
         }
 
-        return WebWheelEvent({ WebEventType::Wheel, OptionSet<WebEventModifier> { }, monotonicTimeForEventTimeInMilliseconds(event->time) }, position, position,
-            delta, wheelTicks, WebWheelEvent::Granularity::ScrollByPixelWheelEvent, phase, momentumPhase,
-            hasPreciseScrollingDeltas);
+        return {
+            { WebEventType::Wheel, OptionSet<WebEventModifier> { }, monotonicTimeForEventTimeInMilliseconds(event->time) },
+            {
+                .position = position,
+                .globalPosition = position,
+                .delta = delta,
+                .wheelTicks = wheelTicks,
+                .granularity = WebWheelEvent::Granularity::ScrollByPixelWheelEvent,
+                .phase = phase,
+                .momentumPhase = momentumPhase,
+                .hasPreciseScrollingDeltas = hasPreciseScrollingDeltas,
+            }
+        };
     }
 #endif
 
@@ -268,9 +301,19 @@ WebWheelEvent WebEventFactory::createWebWheelEvent(struct wpe_input_axis_event*
         ASSERT_NOT_REACHED();
     };
 
-    return WebWheelEvent({ WebEventType::Wheel, OptionSet<WebEventModifier> { }, monotonicTimeForEventTimeInMilliseconds(event->time) }, position, position,
-        delta, wheelTicks, WebWheelEvent::Granularity::ScrollByPixelWheelEvent, phase, momentumPhase,
-        hasPreciseScrollingDeltas);
+    return {
+        { WebEventType::Wheel, OptionSet<WebEventModifier> { }, monotonicTimeForEventTimeInMilliseconds(event->time) },
+        {
+            .position = position,
+            .globalPosition = position,
+            .delta = delta,
+            .wheelTicks = wheelTicks,
+            .granularity = WebWheelEvent::Granularity::ScrollByPixelWheelEvent,
+            .phase = phase,
+            .momentumPhase = momentumPhase,
+            .hasPreciseScrollingDeltas = hasPreciseScrollingDeltas,
+        }
+    };
 }
 
 #if ENABLE(TOUCH_EVENTS)
@@ -294,7 +337,7 @@ static WebKit::WebPlatformTouchPoint::State stateForTouchPoint(int mainEventId,
     return WebKit::WebPlatformTouchPoint::State::Stationary;
 }
 
-WebTouchEvent WebEventFactory::createWebTouchEvent(struct wpe_input_touch_event* event, float deviceScaleFactor)
+WebTouchEventInit WebEventFactory::createWebTouchEvent(struct wpe_input_touch_event* event, float deviceScaleFactor)
 {
     WebEventType type;
     switch (event->type) {
@@ -326,7 +369,7 @@ WebTouchEvent WebEventFactory::createWebTouchEvent(struct wpe_input_touch_event*
                 pointCoordinates, pointCoordinates));
     }
 
-    return WebTouchEvent({ type, OptionSet<WebEventModifier> { }, monotonicTimeForEventTimeInMilliseconds(event->time) }, WTF::move(touchPoints), { }, { });
+    return { { type, OptionSet<WebEventModifier> { }, monotonicTimeForEventTimeInMilliseconds(event->time) }, { .touchPoints = WTF::move(touchPoints), .coalescedEvents = { }, .predictedEvents = { } } };
 }
 #endif // ENABLE(TOUCH_EVENTS)
 
diff --git a/Source/WebKit/Shared/libwpe/WebEventFactory.h b/Source/WebKit/Shared/libwpe/WebEventFactory.h
index 284ab0fcbe6c..68af75416f5e 100644
--- a/Source/WebKit/Shared/libwpe/WebEventFactory.h
+++ b/Source/WebKit/Shared/libwpe/WebEventFactory.h
@@ -51,21 +51,21 @@ namespace WebKit {
 class WebEventFactory {
 public:
 #if USE(LIBWPE)
-    static WebKeyboardEvent createWebKeyboardEvent(struct wpe_input_keyboard_event*, const String&, bool isAutoRepeat, bool handledByInputMethod, std::optional<Vector<WebCore::CompositionUnderline>>&&, std::optional<EditingRange>&&);
-    static WebMouseEvent createWebMouseEvent(struct wpe_input_pointer_event*, float deviceScaleFactor, WebMouseEventSyntheticClickType = WebMouseEventSyntheticClickType::NoTap);
-    static WebWheelEvent createWebWheelEvent(struct wpe_input_axis_event*, float deviceScaleFactor, WebWheelEvent::Phase, WebWheelEvent::Phase momentumPhase);
+    static WebKeyboardEventInit createWebKeyboardEvent(struct wpe_input_keyboard_event*, const String&, bool isAutoRepeat, bool handledByInputMethod, std::optional<Vector<WebCore::CompositionUnderline>>&&, std::optional<EditingRange>&&);
+    static WebMouseEventInit createWebMouseEvent(struct wpe_input_pointer_event*, float deviceScaleFactor, WebMouseEventSyntheticClickType = WebMouseEventSyntheticClickType::NoTap);
+    static WebWheelEventInit createWebWheelEvent(struct wpe_input_axis_event*, float deviceScaleFactor, WebWheelEvent::Phase, WebWheelEvent::Phase momentumPhase);
 #if ENABLE(TOUCH_EVENTS)
-    static WebTouchEvent createWebTouchEvent(struct wpe_input_touch_event*, float deviceScaleFactor);
+    static WebTouchEventInit createWebTouchEvent(struct wpe_input_touch_event*, float deviceScaleFactor);
 #endif
 #endif
 
 #if PLATFORM(WPE) && ENABLE(WPE_PLATFORM)
-    static WebMouseEvent createWebMouseEvent(WPEEvent*);
-    static WebWheelEvent createWebWheelEvent(WPEEvent*);
-    static WebWheelEvent createWebWheelEvent(WPEEvent*, WebWheelEvent::Phase);
-    static WebKeyboardEvent createWebKeyboardEvent(WPEEvent*, const String&, bool isAutoRepeat);
+    static WebMouseEventInit createWebMouseEvent(WPEEvent*);
+    static WebWheelEventInit createWebWheelEvent(WPEEvent*);
+    static WebWheelEventInit createWebWheelEvent(WPEEvent*, WebWheelEvent::Phase);
+    static WebKeyboardEventInit createWebKeyboardEvent(WPEEvent*, const String&, bool isAutoRepeat);
 #if ENABLE(TOUCH_EVENTS)
-    static WebTouchEvent createWebTouchEvent(WPEEvent*, Vector<WebPlatformTouchPoint>&&);
+    static WebTouchEventInit createWebTouchEvent(WPEEvent*, Vector<WebPlatformTouchPoint>&&);
 #endif
 #endif
 };
diff --git a/Source/WebKit/Shared/mac/NativeWebGestureEventMac.mm b/Source/WebKit/Shared/mac/NativeWebGestureEventMac.mm
index 4a21997a4033..a2db4aa03855 100644
--- a/Source/WebKit/Shared/mac/NativeWebGestureEventMac.mm
+++ b/Source/WebKit/Shared/mac/NativeWebGestureEventMac.mm
@@ -32,9 +32,12 @@
 #import "WebGestureEvent.h"
 #import <WebCore/IntPoint.h>
 #import <WebCore/PlatformEventFactoryMac.h>
+#import <wtf/TZoneMallocInlines.h>
 
 namespace WebKit {
 
+WTF_MAKE_TZONE_ALLOCATED_IMPL(NativeWebGestureEvent);
+
 static inline std::optional<WebEventType> webEventTypeForPhase(WebEventPhase phase)
 {
     switch (phase) {
@@ -73,31 +76,33 @@
     };
 }
 
-std::optional<NativeWebGestureEvent> NativeWebGestureEvent::create(NSEvent *event, NSView *view)
+RefPtr<NativeWebGestureEvent> NativeWebGestureEvent::create(NSEvent *event, NSView *view)
 {
     return create(initForEvent(event), view, event);
 }
 
-std::optional<NativeWebGestureEvent> NativeWebGestureEvent::create(const Init& init, NSView *view)
+RefPtr<NativeWebGestureEvent> NativeWebGestureEvent::create(const Init& init, NSView *view)
 {
     return create(init, view, nil);
 }
 
-std::optional<NativeWebGestureEvent> NativeWebGestureEvent::create(const Init& init, NSView *view, NSEvent *event)
+RefPtr<NativeWebGestureEvent> NativeWebGestureEvent::create(const Init& init, NSView *view, NSEvent *event)
 {
-    return webEventTypeForPhase(init.phase).
-        and_then([&init, view = RetainPtr { view }, event = RetainPtr { event }](auto type) {
-            return std::optional { NativeWebGestureEvent { type, init, view, event } };
-        });
+    auto type = webEventTypeForPhase(init.phase);
+    if (!type)
+        return nullptr;
+    return adoptRef(*new NativeWebGestureEvent { *type, init, view, event });
 }
 
 NativeWebGestureEvent::NativeWebGestureEvent(WebEventType type, const Init& init, NSView *view, NSEvent *event)
     : WebGestureEvent {
-        { type, { }, init.timestamp },
-        positionInView(init.locationInWindow, view),
-        init.gestureScale,
-        init.gestureRotation,
-        init.phase }
+        WebEventData { type, { }, init.timestamp },
+        WebGestureEventData {
+            .position = positionInView(init.locationInWindow, view),
+            .gestureScale = init.gestureScale,
+            .gestureRotation = init.gestureRotation,
+            .phase = init.phase,
+        } }
     , m_allowsNativeZoom(init.allowsNativeZoom)
     , m_kind(init.kind)
     , m_nativeEvent(event)
diff --git a/Source/WebKit/Shared/mac/NativeWebKeyboardEventMac.mm b/Source/WebKit/Shared/mac/NativeWebKeyboardEventMac.mm
index b70a762d5357..e0021ad41758 100644
--- a/Source/WebKit/Shared/mac/NativeWebKeyboardEventMac.mm
+++ b/Source/WebKit/Shared/mac/NativeWebKeyboardEventMac.mm
@@ -30,13 +30,21 @@
 
 #import "WebEventFactory.h"
 #import <WebCore/KeyboardEvent.h>
+#import <wtf/TZoneMallocInlines.h>
 
 
 namespace WebKit {
 using namespace WebCore;
 
-NativeWebKeyboardEvent::NativeWebKeyboardEvent(NSEvent *event, bool handledByInputMethod, bool replacesSoftSpace, const Vector<KeypressCommand>& commands)
-    : WebKeyboardEvent(WebEventFactory::createWebKeyboardEvent(event, handledByInputMethod, replacesSoftSpace, commands))
+WTF_MAKE_TZONE_ALLOCATED_IMPL(NativeWebKeyboardEvent);
+
+Ref<NativeWebKeyboardEvent> NativeWebKeyboardEvent::create(NSEvent *event, bool handledByInputMethod, bool replacesSoftSpace, const Vector<KeypressCommand>& commands)
+{
+    return adoptRef(*new NativeWebKeyboardEvent(WebEventFactory::createWebKeyboardEvent(event, handledByInputMethod, replacesSoftSpace, commands), event));
+}
+
+NativeWebKeyboardEvent::NativeWebKeyboardEvent(WebKeyboardEventInit&& init, NSEvent *event)
+    : WebKeyboardEvent(WTF::move(init.event), WTF::move(init.keyboard))
     , m_nativeEvent(event)
 {
 }
diff --git a/Source/WebKit/Shared/mac/NativeWebMouseEventMac.mm b/Source/WebKit/Shared/mac/NativeWebMouseEventMac.mm
index ef8494a004a6..0ae3fcb96ce5 100644
--- a/Source/WebKit/Shared/mac/NativeWebMouseEventMac.mm
+++ b/Source/WebKit/Shared/mac/NativeWebMouseEventMac.mm
@@ -29,11 +29,19 @@
 #if USE(APPKIT)
 
 #import "WebEventFactory.h"
+#import <wtf/TZoneMallocInlines.h>
 
 namespace WebKit {
 
-NativeWebMouseEvent::NativeWebMouseEvent(NSEvent *event, NSEvent *lastPressureEvent, NSView *view, WebEventInputSource inputSource, WebCore::PlatformMouseEvent::CanInitiateDrag canInitiateDrag)
-    : WebMouseEvent(WebEventFactory::createWebMouseEvent(event, lastPressureEvent, view, inputSource, canInitiateDrag))
+WTF_MAKE_TZONE_ALLOCATED_IMPL(NativeWebMouseEvent);
+
+Ref<NativeWebMouseEvent> NativeWebMouseEvent::create(NSEvent *event, NSEvent *lastPressureEvent, NSView *view, WebEventInputSource inputSource, WebCore::PlatformMouseEvent::CanInitiateDrag canInitiateDrag)
+{
+    return adoptRef(*new NativeWebMouseEvent(WebEventFactory::createWebMouseEvent(event, lastPressureEvent, view, inputSource, canInitiateDrag), event));
+}
+
+NativeWebMouseEvent::NativeWebMouseEvent(WebMouseEventInit&& init, NSEvent *event)
+    : WebMouseEvent(WTF::move(init.event), WTF::move(init.mouse))
     , m_nativeEvent(event)
 {
 }
diff --git a/Source/WebKit/Shared/mac/NativeWebWheelEventMac.mm b/Source/WebKit/Shared/mac/NativeWebWheelEventMac.mm
index 70bdeb22d5b0..6473d4434488 100644
--- a/Source/WebKit/Shared/mac/NativeWebWheelEventMac.mm
+++ b/Source/WebKit/Shared/mac/NativeWebWheelEventMac.mm
@@ -29,18 +29,25 @@
 #if USE(APPKIT)
 
 #import "WebEventFactory.h"
+#import <wtf/TZoneMallocInlines.h>
 
 namespace WebKit {
 
-NativeWebWheelEvent::NativeWebWheelEvent(NSEvent *event, NSView *view)
-    : WebWheelEvent(WebEventFactory::createWebWheelEvent(event, view))
-    , m_nativeEvent(event)
+WTF_MAKE_TZONE_ALLOCATED_IMPL(NativeWebWheelEvent);
+
+Ref<NativeWebWheelEvent> NativeWebWheelEvent::create(NSEvent *event, NSView *view)
+{
+    return adoptRef(*new NativeWebWheelEvent(WebEventFactory::createWebWheelEvent(event, view), event));
+}
+
+Ref<NativeWebWheelEvent> NativeWebWheelEvent::create(const WebWheelEvent& wheelEvent)
 {
+    return adoptRef(*new NativeWebWheelEvent(WebWheelEventInit { wheelEvent.eventData(), wheelEvent.wheelData() }, nil));
 }
 
-NativeWebWheelEvent::NativeWebWheelEvent(const WebWheelEvent& wheelEvent)
-    : WebWheelEvent(wheelEvent)
-    , m_nativeEvent(nil)
+NativeWebWheelEvent::NativeWebWheelEvent(WebWheelEventInit&& init, NSEvent *event)
+    : WebWheelEvent(WTF::move(init.event), WTF::move(init.wheel))
+    , m_nativeEvent(event)
 {
 }
 
diff --git a/Source/WebKit/Shared/mac/WebEventFactory.h b/Source/WebKit/Shared/mac/WebEventFactory.h
index f0a0086c4085..34ef3cdb89e0 100644
--- a/Source/WebKit/Shared/mac/WebEventFactory.h
+++ b/Source/WebKit/Shared/mac/WebEventFactory.h
@@ -49,9 +49,9 @@ enum class WebEventPhase : uint8_t;
 class WebEventFactory {
 public:
 #if USE(APPKIT)
-    static WebMouseEvent createWebMouseEvent(NSEvent *, NSEvent *lastPressureEvent, NSView *windowView, WebEventInputSource, WebCore::PlatformMouseEvent::CanInitiateDrag = WebCore::PlatformMouseEvent::CanInitiateDrag::Yes);
-    static WebWheelEvent createWebWheelEvent(NSEvent *, NSView *windowView);
-    static WebKeyboardEvent createWebKeyboardEvent(NSEvent *, bool handledByInputMethod, bool replacesSoftSpace, const Vector<WebCore::KeypressCommand>&);
+    static WebMouseEventInit createWebMouseEvent(NSEvent *, NSEvent *lastPressureEvent, NSView *windowView, WebEventInputSource, WebCore::PlatformMouseEvent::CanInitiateDrag = WebCore::PlatformMouseEvent::CanInitiateDrag::Yes);
+    static WebWheelEventInit createWebWheelEvent(NSEvent *, NSView *windowView);
+    static WebKeyboardEventInit createWebKeyboardEvent(NSEvent *, bool handledByInputMethod, bool replacesSoftSpace, const Vector<WebCore::KeypressCommand>&);
     static bool NODELETE shouldBeHandledAsContextClick(const WebCore::PlatformMouseEvent&);
 
 #if defined(__OBJC__)
diff --git a/Source/WebKit/Shared/mac/WebEventFactory.mm b/Source/WebKit/Shared/mac/WebEventFactory.mm
index 313de6c3957d..9e5d6b78484d 100644
--- a/Source/WebKit/Shared/mac/WebEventFactory.mm
+++ b/Source/WebKit/Shared/mac/WebEventFactory.mm
@@ -120,7 +120,7 @@ static int typeForEvent(NSEvent *event)
     return (static_cast<NSMenuType>(event.menuTypeForEvent()) == NSMenuTypeContextMenu);
 }
 
-WebMouseEvent WebEventFactory::createWebMouseEvent(NSEvent *event, NSEvent *lastPressureEvent, NSView *windowView, WebEventInputSource inputSource, WebCore::PlatformMouseEvent::CanInitiateDrag canInitiateDrag)
+WebMouseEventInit WebEventFactory::createWebMouseEvent(NSEvent *event, NSEvent *lastPressureEvent, NSView *windowView, WebEventInputSource inputSource, WebCore::PlatformMouseEvent::CanInitiateDrag canInitiateDrag)
 {
     NSPoint position = WebCore::pointForEvent(event, windowView);
     NSPoint globalPosition = WebCore::globalPointForEvent(event);
@@ -154,10 +154,30 @@ static int typeForEvent(NSEvent *event)
 
     auto unadjustedMovementDelta = WebCore::unadjustedMovementForEvent(event);
 
-    return WebMouseEvent({ type, modifiers, timestamp, WTF::UUID::createVersion4() }, button, buttons, WebCore::DoublePoint(position), WebCore::DoublePoint(globalPosition), deltaX, deltaY, deltaZ, clickCount, force, inputSource, canInitiateDrag, WebMouseEventSyntheticClickType::NoTap, eventNumber, menuTypeForEvent, GestureWasCancelled::No, unadjustedMovementDelta);
+    return {
+        { type, modifiers, timestamp },
+        {
+            .button = button,
+            .buttons = buttons,
+            .position = WebCore::DoublePoint(position),
+            .globalPosition = WebCore::DoublePoint(globalPosition),
+            .deltaX = deltaX,
+            .deltaY = deltaY,
+            .deltaZ = deltaZ,
+            .clickCount = clickCount,
+            .force = force,
+            .inputSource = inputSource,
+            .canInitiateDrag = canInitiateDrag,
+            .syntheticClickType = WebMouseEventSyntheticClickType::NoTap,
+            .eventNumber = eventNumber,
+            .menuTypeForEvent = menuTypeForEvent,
+            .gestureWasCancelled = GestureWasCancelled::No,
+            .unadjustedMovementDelta = unadjustedMovementDelta,
+        }
+    };
 }
 
-WebWheelEvent WebEventFactory::createWebWheelEvent(NSEvent *event, NSView *windowView)
+WebWheelEventInit WebEventFactory::createWebWheelEvent(NSEvent *event, NSView *windowView)
 {
     NSPoint position = WebCore::pointForEvent(event, windowView);
     NSPoint globalPosition = WebCore::globalPointForEvent(event);
@@ -240,12 +260,28 @@ static int typeForEvent(NSEvent *event)
         rawPlatformDelta = std::nullopt;
     }
 
-    return WebWheelEvent({ WebEventType::Wheel, modifiers, timestamp, WTF::UUID::createVersion4() }, WebCore::IntPoint(position), WebCore::IntPoint(globalPosition), WebCore::FloatSize(deltaX, deltaY), WebCore::FloatSize(wheelTicksX, wheelTicksY),
-        granularity, directionInvertedFromDevice, phase, momentumPhase, hasPreciseScrollingDeltas,
-        scrollCount, unacceleratedScrollingDelta, ioHIDEventTimestamp, rawPlatformDelta, momentumEndType);
+    return {
+        { WebEventType::Wheel, modifiers, timestamp },
+        {
+            .position = WebCore::IntPoint(position),
+            .globalPosition = WebCore::IntPoint(globalPosition),
+            .delta = WebCore::FloatSize(deltaX, deltaY),
+            .wheelTicks = WebCore::FloatSize(wheelTicksX, wheelTicksY),
+            .granularity = granularity,
+            .directionInvertedFromDevice = directionInvertedFromDevice,
+            .phase = phase,
+            .momentumPhase = momentumPhase,
+            .hasPreciseScrollingDeltas = hasPreciseScrollingDeltas,
+            .scrollCount = scrollCount,
+            .unacceleratedScrollingDelta = unacceleratedScrollingDelta,
+            .ioHIDEventTimestamp = ioHIDEventTimestamp,
+            .rawPlatformDelta = rawPlatformDelta,
+            .momentumEndType = momentumEndType,
+        }
+    };
 }
 
-WebKeyboardEvent WebEventFactory::createWebKeyboardEvent(NSEvent *event, bool handledByInputMethod, bool replacesSoftSpace, const Vector<WebCore::KeypressCommand>& commands)
+WebKeyboardEventInit WebEventFactory::createWebKeyboardEvent(NSEvent *event, bool handledByInputMethod, bool replacesSoftSpace, const Vector<WebCore::KeypressCommand>& commands)
 {
     WebEventType type = WebCore::isKeyUpEvent(event) ? WebEventType::KeyUp : WebEventType::KeyDown;
     String text = WebCore::textFromEvent(event, replacesSoftSpace);
@@ -280,7 +316,24 @@ static int typeForEvent(NSEvent *event)
         unmodifiedText = text;
     }
 
-    return WebKeyboardEvent({ type, modifiers, timestamp, WTF::UUID::createVersion4() }, text, unmodifiedText, key, code, keyIdentifier, windowsVirtualKeyCode, nativeVirtualKeyCode, macCharCode, handledByInputMethod, commands, autoRepeat, isKeypad, isSystemKey);
+    return {
+        { type, modifiers, timestamp },
+        {
+            .text = text,
+            .unmodifiedText = unmodifiedText,
+            .key = key,
+            .code = code,
+            .keyIdentifier = keyIdentifier,
+            .windowsVirtualKeyCode = windowsVirtualKeyCode,
+            .nativeVirtualKeyCode = nativeVirtualKeyCode,
+            .macCharCode = macCharCode,
+            .handledByInputMethod = handledByInputMethod,
+            .commands = commands,
+            .isAutoRepeat = autoRepeat,
+            .isKeypad = isKeypad,
+            .isSystemKey = isSystemKey,
+        }
+    };
 }
 
 NSEventModifierFlags WebEventFactory::toNSEventModifierFlags(OptionSet<WebKit::WebEventModifier> modifiers)
diff --git a/Source/WebKit/Shared/mac/WebGestureEvent.cpp b/Source/WebKit/Shared/mac/WebGestureEvent.cpp
index 45d7d7274970..adf962190758 100644
--- a/Source/WebKit/Shared/mac/WebGestureEvent.cpp
+++ b/Source/WebKit/Shared/mac/WebGestureEvent.cpp
@@ -29,10 +29,30 @@
 #if ENABLE(MAC_GESTURE_EVENTS)
 
 #include "ArgumentCoders.h"
+#include <wtf/TZoneMallocInlines.h>
 
 namespace WebKit {
 
-bool WebGestureEvent::isGestureEventType(WebEventType type) const
+WTF_MAKE_TZONE_ALLOCATED_IMPL(WebGestureEvent);
+
+Ref<WebGestureEvent> WebGestureEvent::create(WebEventData&& eventData, WebGestureEventData&& gestureData)
+{
+    return adoptRef(*new WebGestureEvent(WTF::move(eventData), WTF::move(gestureData)));
+}
+
+Ref<WebGestureEvent> WebGestureEvent::create(WebGestureEventInit&& init)
+{
+    return create(WTF::move(init.event), WTF::move(init.gesture));
+}
+
+WebGestureEvent::WebGestureEvent(WebEventData&& eventData, WebGestureEventData&& gestureData)
+    : WebEvent(WTF::move(eventData))
+    , m_data(WTF::move(gestureData))
+{
+    ASSERT(isGestureEventType(type()));
+}
+
+bool WebGestureEvent::isGestureEventType(WebEventType type)
 {
     return type == WebEventType::GestureStart || type == WebEventType::GestureChange || type == WebEventType::GestureEnd;
 }
diff --git a/Source/WebKit/Shared/mac/WebGestureEvent.h b/Source/WebKit/Shared/mac/WebGestureEvent.h
index 4cb4b8e006fb..db530ffe37fd 100644
--- a/Source/WebKit/Shared/mac/WebGestureEvent.h
+++ b/Source/WebKit/Shared/mac/WebGestureEvent.h
@@ -42,33 +42,42 @@ class Encoder;
 
 namespace WebKit {
 
+// Field order matches WebEvent.serialization.in.
+struct WebGestureEventData {
+    WebCore::IntPoint position;
+    float gestureScale { 0 };
+    float gestureRotation { 0 };
+    WebEventPhase phase { WebEventPhase::None };
+};
+
+struct WebGestureEventInit {
+    WebEventData event;
+    WebGestureEventData gesture;
+};
+
 class WebGestureEvent : public WebEvent {
+    WTF_MAKE_TZONE_ALLOCATED(WebGestureEvent);
 public:
     using Phase = WebEventPhase;
 
-    WebGestureEvent(WebEvent&& event, WebCore::IntPoint position, float gestureScale, float gestureRotation, Phase phase)
-        : WebEvent(WTF::move(event))
-        , m_position(position)
-        , m_gestureScale(gestureScale)
-        , m_gestureRotation(gestureRotation)
-        , m_phase(phase)
-    {
-        ASSERT(isGestureEventType(type()));
-    }
+    static Ref<WebGestureEvent> create(WebEventData&&, WebGestureEventData&&);
+    static Ref<WebGestureEvent> create(WebGestureEventInit&&);
+
+    WebCore::IntPoint position() const { return m_data.position; }
+
+    float gestureScale() const { return m_data.gestureScale; }
+    float gestureRotation() const { return m_data.gestureRotation; }
+    Phase phase() const { return m_data.phase; }
 
-    WebCore::IntPoint position() const { return m_position; }
+    const WebGestureEventData& gestureData() const LIFETIME_BOUND { return m_data; }
 
-    float gestureScale() const { return m_gestureScale; }
-    float gestureRotation() const { return m_gestureRotation; }
-    Phase phase() const { return m_phase; }
+protected:
+    WebGestureEvent(WebEventData&&, WebGestureEventData&&);
 
 private:
-    bool isGestureEventType(WebEventType) const;
+    static bool isGestureEventType(WebEventType);
 
-    WebCore::IntPoint m_position;
-    float m_gestureScale;
-    float m_gestureRotation;
-    Phase m_phase;
+    WebGestureEventData m_data;
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit/Shared/win/NativeWebKeyboardEventWin.cpp b/Source/WebKit/Shared/win/NativeWebKeyboardEventWin.cpp
index f8f5324dd63d..96628c25a020 100644
--- a/Source/WebKit/Shared/win/NativeWebKeyboardEventWin.cpp
+++ b/Source/WebKit/Shared/win/NativeWebKeyboardEventWin.cpp
@@ -28,14 +28,23 @@
 #include "NativeWebKeyboardEvent.h"
 
 #include "WebEventFactory.h"
+#include <wtf/TZoneMallocInlines.h>
 
 namespace WebKit {
 
 using namespace WebCore;
 
-NativeWebKeyboardEvent::NativeWebKeyboardEvent(HWND hwnd, UINT message, WPARAM wParam, LPARAM lParam, Vector<MSG>&& pendingCharEvents)
-    : WebKeyboardEvent(WebEventFactory::createWebKeyboardEvent(hwnd, message, wParam, lParam))
-    , m_nativeEvent(createNativeEvent(hwnd, message, wParam, lParam))
+WTF_MAKE_TZONE_ALLOCATED_IMPL(NativeWebKeyboardEvent);
+
+Ref<NativeWebKeyboardEvent> NativeWebKeyboardEvent::create(HWND hwnd, UINT message, WPARAM wParam, LPARAM lParam, Vector<MSG>&& pendingCharEvents)
+{
+    return adoptRef(*new NativeWebKeyboardEvent(WebEventFactory::createWebKeyboardEvent(hwnd, message, wParam, lParam),
+        createNativeEvent(hwnd, message, wParam, lParam), WTF::move(pendingCharEvents)));
+}
+
+NativeWebKeyboardEvent::NativeWebKeyboardEvent(WebKeyboardEventInit&& init, const MSG& nativeEvent, Vector<MSG>&& pendingCharEvents)
+    : WebKeyboardEvent(WTF::move(init.event), WTF::move(init.keyboard))
+    , m_nativeEvent(nativeEvent)
     , m_pendingCharEvents(WTF::move(pendingCharEvents))
 {
 }
diff --git a/Source/WebKit/Shared/win/NativeWebMouseEventWin.cpp b/Source/WebKit/Shared/win/NativeWebMouseEventWin.cpp
index 3618a7e8d59f..3dc16138df1d 100644
--- a/Source/WebKit/Shared/win/NativeWebMouseEventWin.cpp
+++ b/Source/WebKit/Shared/win/NativeWebMouseEventWin.cpp
@@ -28,12 +28,21 @@
 #include "NativeWebMouseEvent.h"
 
 #include "WebEventFactory.h"
+#include <wtf/TZoneMallocInlines.h>
 
 namespace WebKit {
 
-NativeWebMouseEvent::NativeWebMouseEvent(HWND hwnd, UINT message, WPARAM wParam, LPARAM lParam, bool didActivateWebView, float deviceScaleFactor)
-    : WebMouseEvent(WebEventFactory::createWebMouseEvent(hwnd, message, wParam, lParam, didActivateWebView, deviceScaleFactor))
-    , m_nativeEvent(createNativeEvent(hwnd, message, wParam, lParam))
+WTF_MAKE_TZONE_ALLOCATED_IMPL(NativeWebMouseEvent);
+
+Ref<NativeWebMouseEvent> NativeWebMouseEvent::create(HWND hwnd, UINT message, WPARAM wParam, LPARAM lParam, bool didActivateWebView, float deviceScaleFactor)
+{
+    return adoptRef(*new NativeWebMouseEvent(WebEventFactory::createWebMouseEvent(hwnd, message, wParam, lParam, didActivateWebView, deviceScaleFactor),
+        createNativeEvent(hwnd, message, wParam, lParam)));
+}
+
+NativeWebMouseEvent::NativeWebMouseEvent(WebMouseEventInit&& init, const MSG& nativeEvent)
+    : WebMouseEvent(WTF::move(init.event), WTF::move(init.mouse))
+    , m_nativeEvent(nativeEvent)
 {
 }
 
diff --git a/Source/WebKit/Shared/win/NativeWebTouchEventWin.cpp b/Source/WebKit/Shared/win/NativeWebTouchEventWin.cpp
index 1dab9f2b3fce..7e02c161cf82 100644
--- a/Source/WebKit/Shared/win/NativeWebTouchEventWin.cpp
+++ b/Source/WebKit/Shared/win/NativeWebTouchEventWin.cpp
@@ -30,11 +30,19 @@
 #if ENABLE(TOUCH_EVENTS)
 
 #include "WebEventFactory.h"
+#include <wtf/TZoneMallocInlines.h>
 
 namespace WebKit {
 
-NativeWebTouchEvent::NativeWebTouchEvent()
-    : WebTouchEvent(WebEventFactory::createWebTouchEvent())
+WTF_MAKE_TZONE_ALLOCATED_IMPL(NativeWebTouchEvent);
+
+Ref<NativeWebTouchEvent> NativeWebTouchEvent::create()
+{
+    return adoptRef(*new NativeWebTouchEvent(WebEventFactory::createWebTouchEvent()));
+}
+
+NativeWebTouchEvent::NativeWebTouchEvent(WebTouchEventInit&& init)
+    : WebTouchEvent(WTF::move(init.event), WTF::move(init.touch))
 {
 }
 
diff --git a/Source/WebKit/Shared/win/NativeWebWheelEventWin.cpp b/Source/WebKit/Shared/win/NativeWebWheelEventWin.cpp
index ade64b0e3f15..3cb8f861358b 100644
--- a/Source/WebKit/Shared/win/NativeWebWheelEventWin.cpp
+++ b/Source/WebKit/Shared/win/NativeWebWheelEventWin.cpp
@@ -28,12 +28,21 @@
 #include "NativeWebWheelEvent.h"
 
 #include "WebEventFactory.h"
+#include <wtf/TZoneMallocInlines.h>
 
 namespace WebKit {
 
-NativeWebWheelEvent::NativeWebWheelEvent(HWND hwnd, UINT message, WPARAM wParam, LPARAM lParam, float deviceScaleFactor)
-    : WebWheelEvent(WebEventFactory::createWebWheelEvent(hwnd, message, wParam, lParam, deviceScaleFactor))
-    , m_nativeEvent(createNativeEvent(hwnd, message, wParam, lParam))
+WTF_MAKE_TZONE_ALLOCATED_IMPL(NativeWebWheelEvent);
+
+Ref<NativeWebWheelEvent> NativeWebWheelEvent::create(HWND hwnd, UINT message, WPARAM wParam, LPARAM lParam, float deviceScaleFactor)
+{
+    return adoptRef(*new NativeWebWheelEvent(WebEventFactory::createWebWheelEvent(hwnd, message, wParam, lParam, deviceScaleFactor),
+        createNativeEvent(hwnd, message, wParam, lParam)));
+}
+
+NativeWebWheelEvent::NativeWebWheelEvent(WebWheelEventInit&& init, const MSG& nativeEvent)
+    : WebWheelEvent(WTF::move(init.event), WTF::move(init.wheel))
+    , m_nativeEvent(nativeEvent)
 {
 }
 
diff --git a/Source/WebKit/Shared/win/WebEventFactory.cpp b/Source/WebKit/Shared/win/WebEventFactory.cpp
index 5c6be67ada8c..6b1e14f977dd 100644
--- a/Source/WebKit/Shared/win/WebEventFactory.cpp
+++ b/Source/WebKit/Shared/win/WebEventFactory.cpp
@@ -344,7 +344,7 @@ static String keyIdentifierFromEvent(WPARAM wparam, WebEventType type)
     }
 }
 
-WebMouseEvent WebEventFactory::createWebMouseEvent(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam, bool didActivateWebView, float deviceScaleFactor)
+WebMouseEventInit WebEventFactory::createWebMouseEvent(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam, bool didActivateWebView, float deviceScaleFactor)
 {
     WebEventType type;
     WebMouseEventButton button = WebMouseEventButton::None;
@@ -417,10 +417,32 @@ WebMouseEvent WebEventFactory::createWebMouseEvent(HWND hWnd, UINT message, WPAR
     auto modifiers = modifiersForEvent(wParam);
     auto buttons = buttonsForEvent(wParam);
 
-    return WebMouseEvent( { type, modifiers, MonotonicTime::now() }, button, buttons, flooredIntPoint(position), flooredIntPoint(globalPosition), 0, 0, 0, clickCount, didActivateWebView, WebEventInputSource::UserDriven);
+    // NOTE: didActivateWebView is deliberately passed as the force value, preserving prior behavior.
+    return {
+        { type, modifiers, MonotonicTime::now() },
+        {
+            .button = button,
+            .buttons = buttons,
+            .position = flooredIntPoint(position),
+            .globalPosition = flooredIntPoint(globalPosition),
+            .deltaX = 0,
+            .deltaY = 0,
+            .deltaZ = 0,
+            .clickCount = clickCount,
+            .force = static_cast<double>(didActivateWebView),
+            .inputSource = WebEventInputSource::UserDriven,
+            .canInitiateDrag = WebCore::PlatformMouseEvent::CanInitiateDrag::Yes,
+            .syntheticClickType = WebMouseEventSyntheticClickType::NoTap,
+            .pointerId = WebCore::mousePointerID,
+            .pointerType = WebCore::mousePointerEventType(),
+            .gestureWasCancelled = GestureWasCancelled::No,
+            .unadjustedMovementDelta = { },
+            .coalescedEvents = { },
+        }
+    };
 }
 
-WebWheelEvent WebEventFactory::createWebWheelEvent(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam, float deviceScaleFactor)
+WebWheelEventInit WebEventFactory::createWebWheelEvent(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam, float deviceScaleFactor)
 {
     POINT positionPoint = point(lParam);
     FloatPoint globalPosition = positionPoint;
@@ -464,10 +486,19 @@ WebWheelEvent WebEventFactory::createWebWheelEvent(HWND hWnd, UINT message, WPAR
         }
     }
 
-    return WebWheelEvent( { WebEventType::Wheel, modifiers, MonotonicTime::now() }, flooredIntPoint(position), flooredIntPoint(globalPosition), FloatSize(deltaX, deltaY), FloatSize(wheelTicksX, wheelTicksY), granularity);
+    return {
+        { WebEventType::Wheel, modifiers, MonotonicTime::now() },
+        {
+            .position = flooredIntPoint(position),
+            .globalPosition = flooredIntPoint(globalPosition),
+            .delta = FloatSize(deltaX, deltaY),
+            .wheelTicks = FloatSize(wheelTicksX, wheelTicksY),
+            .granularity = granularity,
+        }
+    };
 }
 
-WebKeyboardEvent WebEventFactory::createWebKeyboardEvent(HWND hwnd, UINT message, WPARAM wparam, LPARAM lparam)
+WebKeyboardEventInit WebEventFactory::createWebKeyboardEvent(HWND hwnd, UINT message, WPARAM wparam, LPARAM lparam)
 {
     auto type = keyboardEventTypeForEvent(message);
     String text = textFromEvent(wparam, type);
@@ -483,13 +514,28 @@ WebKeyboardEvent WebEventFactory::createWebKeyboardEvent(HWND hwnd, UINT message
     bool isSystemKey = isSystemKeyEvent(message);
     auto modifiers = modifiersForCurrentKeyState(windowsKeyNames().shouldExposeAltGraphForKeyEvent(message, wparam, lparam));
 
-    return WebKeyboardEvent( { type, modifiers, MonotonicTime::now() }, text, unmodifiedText, key, code, keyIdentifier, windowsVirtualKeyCode, nativeVirtualKeyCode, macCharCode, autoRepeat, isKeypad, isSystemKey);
+    return {
+        { type, modifiers, MonotonicTime::now() },
+        {
+            .text = text,
+            .unmodifiedText = unmodifiedText,
+            .key = key,
+            .code = code,
+            .keyIdentifier = keyIdentifier,
+            .windowsVirtualKeyCode = windowsVirtualKeyCode,
+            .nativeVirtualKeyCode = nativeVirtualKeyCode,
+            .macCharCode = macCharCode,
+            .isAutoRepeat = autoRepeat,
+            .isKeypad = isKeypad,
+            .isSystemKey = isSystemKey,
+        }
+    };
 }
 
 #if ENABLE(TOUCH_EVENTS)
-WebTouchEvent WebEventFactory::createWebTouchEvent()
+WebTouchEventInit WebEventFactory::createWebTouchEvent()
 {
-    return WebTouchEvent({ WebEventType::TouchMove, OptionSet<WebEventModifier> { }, MonotonicTime::now() }, { }, { }, { });
+    return { { WebEventType::TouchMove, OptionSet<WebEventModifier> { }, MonotonicTime::now() }, { } };
 }
 #endif // ENABLE(TOUCH_EVENTS)
 
diff --git a/Source/WebKit/Shared/win/WebEventFactory.h b/Source/WebKit/Shared/win/WebEventFactory.h
index e2dd820ae551..d84c86947afc 100644
--- a/Source/WebKit/Shared/win/WebEventFactory.h
+++ b/Source/WebKit/Shared/win/WebEventFactory.h
@@ -40,11 +40,11 @@ namespace WebKit {
 
 class WebEventFactory {
 public:
-    static WebMouseEvent createWebMouseEvent(HWND, UINT message, WPARAM, LPARAM, bool didActivateWebView, float deviceScaleFactor);
-    static WebWheelEvent createWebWheelEvent(HWND, UINT message, WPARAM, LPARAM, float deviceScaleFactor);
-    static WebKeyboardEvent createWebKeyboardEvent(HWND, UINT message, WPARAM, LPARAM);
+    static WebMouseEventInit createWebMouseEvent(HWND, UINT message, WPARAM, LPARAM, bool didActivateWebView, float deviceScaleFactor);
+    static WebWheelEventInit createWebWheelEvent(HWND, UINT message, WPARAM, LPARAM, float deviceScaleFactor);
+    static WebKeyboardEventInit createWebKeyboardEvent(HWND, UINT message, WPARAM, LPARAM);
 #if ENABLE(TOUCH_EVENTS)
-    static WebTouchEvent createWebTouchEvent();
+    static WebTouchEventInit createWebTouchEvent();
 #endif
 };
 
diff --git a/Source/WebKit/Shared/wpe/NativeWebKeyboardEventWPE.cpp b/Source/WebKit/Shared/wpe/NativeWebKeyboardEventWPE.cpp
index a960c5b06f24..5e25226540a3 100644
--- a/Source/WebKit/Shared/wpe/NativeWebKeyboardEventWPE.cpp
+++ b/Source/WebKit/Shared/wpe/NativeWebKeyboardEventWPE.cpp
@@ -29,17 +29,33 @@
 #if ENABLE(WPE_PLATFORM)
 
 #include "WebEventFactory.h"
+#include <wtf/TZoneMallocInlines.h>
 
 namespace WebKit {
 
-NativeWebKeyboardEvent::NativeWebKeyboardEvent(WPEEvent* event, const String& text, bool isAutorepeat)
-    : WebKeyboardEvent(WebEventFactory::createWebKeyboardEvent(event, text, isAutorepeat))
+Ref<NativeWebKeyboardEvent> NativeWebKeyboardEvent::create(WPEEvent* event, const String& text, bool isAutorepeat)
 {
+    return adoptRef(*new NativeWebKeyboardEvent(WebEventFactory::createWebKeyboardEvent(event, text, isAutorepeat)));
 }
 
-NativeWebKeyboardEvent::NativeWebKeyboardEvent(const String& text, std::optional<Vector<WebCore::CompositionUnderline>>&& preeditUnderlines, std::optional<EditingRange>&& preeditSelectionRange)
-    : WebKeyboardEvent(WebEvent(WebEventType::KeyDown, { }, MonotonicTime::now()), text, "Unidentified"_s, "Unidentified"_s, "U+0000"_s, 0, 0, true, WTF::move(preeditUnderlines), WTF::move(preeditSelectionRange), false, false)
+Ref<NativeWebKeyboardEvent> NativeWebKeyboardEvent::create(const String& text, std::optional<Vector<WebCore::CompositionUnderline>>&& preeditUnderlines, std::optional<EditingRange>&& preeditSelectionRange)
 {
+    return adoptRef(*new NativeWebKeyboardEvent(WebKeyboardEventInit {
+        { WebEventType::KeyDown, { }, MonotonicTime::now() },
+        {
+            .text = text,
+            .key = "Unidentified"_s,
+            .code = "Unidentified"_s,
+            .keyIdentifier = "U+0000"_s,
+            .windowsVirtualKeyCode = 0,
+            .nativeVirtualKeyCode = 0,
+            .handledByInputMethod = true,
+            .preeditUnderlines = WTF::move(preeditUnderlines),
+            .preeditSelectionRange = WTF::move(preeditSelectionRange),
+            .isAutoRepeat = false,
+            .isKeypad = false,
+        }
+    }));
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit/Shared/wpe/NativeWebMouseEventWPE.cpp b/Source/WebKit/Shared/wpe/NativeWebMouseEventWPE.cpp
index 9fcd90c5e59b..4769ed741c29 100644
--- a/Source/WebKit/Shared/wpe/NativeWebMouseEventWPE.cpp
+++ b/Source/WebKit/Shared/wpe/NativeWebMouseEventWPE.cpp
@@ -29,12 +29,13 @@
 #if ENABLE(WPE_PLATFORM)
 
 #include "WebEventFactory.h"
+#include <wtf/TZoneMallocInlines.h>
 
 namespace WebKit {
 
-NativeWebMouseEvent::NativeWebMouseEvent(WPEEvent* event)
-    : WebMouseEvent(WebEventFactory::createWebMouseEvent(event))
+Ref<NativeWebMouseEvent> NativeWebMouseEvent::create(WPEEvent* event)
 {
+    return adoptRef(*new NativeWebMouseEvent(WebEventFactory::createWebMouseEvent(event)));
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit/Shared/wpe/NativeWebTouchEventWPE.cpp b/Source/WebKit/Shared/wpe/NativeWebTouchEventWPE.cpp
index e20403ebbc51..e69ced744a3f 100644
--- a/Source/WebKit/Shared/wpe/NativeWebTouchEventWPE.cpp
+++ b/Source/WebKit/Shared/wpe/NativeWebTouchEventWPE.cpp
@@ -29,11 +29,17 @@
 #if ENABLE(TOUCH_EVENTS) && ENABLE(WPE_PLATFORM)
 
 #include "WebEventFactory.h"
+#include <wtf/TZoneMallocInlines.h>
 
 namespace WebKit {
 
-NativeWebTouchEvent::NativeWebTouchEvent(WPEEvent* event, Vector<WebPlatformTouchPoint>&& touchPoints)
-    : WebTouchEvent(WebEventFactory::createWebTouchEvent(event, WTF::move(touchPoints)))
+Ref<NativeWebTouchEvent> NativeWebTouchEvent::create(WPEEvent* event, Vector<WebPlatformTouchPoint>&& touchPoints)
+{
+    return adoptRef(*new NativeWebTouchEvent(WebEventFactory::createWebTouchEvent(event, WTF::move(touchPoints)), event));
+}
+
+NativeWebTouchEvent::NativeWebTouchEvent(WebTouchEventInit&& init, WPEEvent* event)
+    : WebTouchEvent(WTF::move(init.event), WTF::move(init.touch))
     , m_nativeEvent(event)
 {
 }
diff --git a/Source/WebKit/Shared/wpe/NativeWebWheelEventWPE.cpp b/Source/WebKit/Shared/wpe/NativeWebWheelEventWPE.cpp
index 689898a7c5c3..dc418976e141 100644
--- a/Source/WebKit/Shared/wpe/NativeWebWheelEventWPE.cpp
+++ b/Source/WebKit/Shared/wpe/NativeWebWheelEventWPE.cpp
@@ -29,17 +29,18 @@
 #if ENABLE(WPE_PLATFORM)
 
 #include "WebEventFactory.h"
+#include <wtf/TZoneMallocInlines.h>
 
 namespace WebKit {
 
-NativeWebWheelEvent::NativeWebWheelEvent(WPEEvent* event)
-    : WebWheelEvent(WebEventFactory::createWebWheelEvent(event))
+Ref<NativeWebWheelEvent> NativeWebWheelEvent::create(WPEEvent* event)
 {
+    return adoptRef(*new NativeWebWheelEvent(WebEventFactory::createWebWheelEvent(event)));
 }
 
-NativeWebWheelEvent::NativeWebWheelEvent(WPEEvent* event, WebWheelEvent::Phase phase)
-    : WebWheelEvent(WebEventFactory::createWebWheelEvent(event, phase))
+Ref<NativeWebWheelEvent> NativeWebWheelEvent::create(WPEEvent* event, WebWheelEvent::Phase phase)
 {
+    return adoptRef(*new NativeWebWheelEvent(WebEventFactory::createWebWheelEvent(event, phase)));
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit/Shared/wpe/WebEventFactoryWPE.cpp b/Source/WebKit/Shared/wpe/WebEventFactoryWPE.cpp
index 0fe8d9a3e6e6..a792186daec7 100644
--- a/Source/WebKit/Shared/wpe/WebEventFactoryWPE.cpp
+++ b/Source/WebKit/Shared/wpe/WebEventFactoryWPE.cpp
@@ -125,7 +125,7 @@ static IntPoint positionFromEvent(WPEEvent* event)
     return { };
 }
 
-WebMouseEvent WebEventFactory::createWebMouseEvent(WPEEvent* event)
+WebMouseEventInit WebEventFactory::createWebMouseEvent(WPEEvent* event)
 {
     auto modifiers = wpe_event_get_modifiers(event);
     FloatPoint movementDelta;
@@ -160,28 +160,37 @@ WebMouseEvent WebEventFactory::createWebMouseEvent(WPEEvent* event)
         RELEASE_ASSERT_NOT_REACHED();
     }
 
-    return WebMouseEvent({ type.value(), modifiersFromWPEModifiers(modifiers), monotonicTimeForEvent(event) },
-        button,
-        pressedMouseButtons(modifiers),
-        position,
-        position,
-        movementDelta.x(),
-        movementDelta.y(),
-        0 /* deltaZ */,
-        clickCount,
-        0 /* force */,
-        WebEventInputSource::UserDriven,
-        WebCore::PlatformMouseEvent::CanInitiateDrag::Yes,
-        syntheticClickType);
+    return {
+        { type.value(), modifiersFromWPEModifiers(modifiers), monotonicTimeForEvent(event) },
+        {
+            .button = button,
+            .buttons = static_cast<unsigned short>(pressedMouseButtons(modifiers)),
+            .position = position,
+            .globalPosition = position,
+            .deltaX = static_cast<float>(movementDelta.x()),
+            .deltaY = static_cast<float>(movementDelta.y()),
+            .deltaZ = 0,
+            .clickCount = static_cast<int32_t>(clickCount),
+            .force = 0,
+            .inputSource = WebEventInputSource::UserDriven,
+            .canInitiateDrag = WebCore::PlatformMouseEvent::CanInitiateDrag::Yes,
+            .syntheticClickType = syntheticClickType,
+            .pointerId = WebCore::mousePointerID,
+            .pointerType = WebCore::mousePointerEventType(),
+            .gestureWasCancelled = GestureWasCancelled::No,
+            .unadjustedMovementDelta = { },
+            .coalescedEvents = { },
+        }
+    };
 }
 
-WebWheelEvent WebEventFactory::createWebWheelEvent(WPEEvent* event)
+WebWheelEventInit WebEventFactory::createWebWheelEvent(WPEEvent* event)
 {
     auto phase = wpe_event_scroll_is_stop(event) ? WebWheelEvent::Phase::Ended : WebWheelEvent::Phase::Changed;
     return createWebWheelEvent(event, phase);
 }
 
-WebWheelEvent WebEventFactory::createWebWheelEvent(WPEEvent* event, WebWheelEvent::Phase phase)
+WebWheelEventInit WebEventFactory::createWebWheelEvent(WPEEvent* event, WebWheelEvent::Phase phase)
 {
     double deltaX, deltaY;
     wpe_event_scroll_get_deltas(event, &deltaX, &deltaY);
@@ -217,27 +226,46 @@ WebWheelEvent WebEventFactory::createWebWheelEvent(WPEEvent* event, WebWheelEven
         delta = wheelTicks.scaled(stepX, stepY);
     }
 
-    return WebWheelEvent({ WebEventType::Wheel, modifiersFromWPEModifiers(wpe_event_get_modifiers(event)), monotonicTimeForEvent(event) },
-        position, position, delta, wheelTicks, WebWheelEvent::Granularity::ScrollByPixelWheelEvent, phase, WebWheelEvent::Phase::None, hasPreciseScrollingDeltas);
+    return {
+        { WebEventType::Wheel, modifiersFromWPEModifiers(wpe_event_get_modifiers(event)), monotonicTimeForEvent(event) },
+        {
+            .position = position,
+            .globalPosition = position,
+            .delta = delta,
+            .wheelTicks = wheelTicks,
+            .granularity = WebWheelEvent::Granularity::ScrollByPixelWheelEvent,
+            .phase = phase,
+            .momentumPhase = WebWheelEvent::Phase::None,
+            .hasPreciseScrollingDeltas = hasPreciseScrollingDeltas,
+        }
+    };
 }
 
-WebKeyboardEvent WebEventFactory::createWebKeyboardEvent(WPEEvent* event, const String& text, bool isAutoRepeat)
+WebKeyboardEventInit WebEventFactory::createWebKeyboardEvent(WPEEvent* event, const String& text, bool isAutoRepeat)
 {
     auto type = wpe_event_get_event_type(event) == WPE_EVENT_KEYBOARD_KEY_DOWN ? WebEventType::KeyDown : WebEventType::KeyUp;
     auto keyval = wpe_event_keyboard_get_keyval(event);
     auto keycode = wpe_event_keyboard_get_keycode(event);
-    return WebKeyboardEvent({ type, modifiersFromWPEModifiers(wpe_event_get_modifiers(event)), monotonicTimeForEvent(event) },
-        text.isNull() ? WebKeyboardEvent::singleCharacterStringForWPEKeyval(keyval) : text,
-        WebKeyboardEvent::keyValueStringForWPEKeyval(keyval),
-        WebKeyboardEvent::keyCodeStringForWPEKeycode(keycode),
-        WebKeyboardEvent::keyIdentifierForWPEKeyval(keyval),
-        WebKeyboardEvent::windowsKeyCodeForWPEKeyval(keyval),
-        keyval, false, std::nullopt, std::nullopt, isAutoRepeat,
-        keyval >= WPE_KEY_KP_Space && keyval <= WPE_KEY_KP_9);
+    return {
+        { type, modifiersFromWPEModifiers(wpe_event_get_modifiers(event)), monotonicTimeForEvent(event) },
+        {
+            .text = text.isNull() ? WebKeyboardEvent::singleCharacterStringForWPEKeyval(keyval) : text,
+            .key = WebKeyboardEvent::keyValueStringForWPEKeyval(keyval),
+            .code = WebKeyboardEvent::keyCodeStringForWPEKeycode(keycode),
+            .keyIdentifier = WebKeyboardEvent::keyIdentifierForWPEKeyval(keyval),
+            .windowsVirtualKeyCode = WebKeyboardEvent::windowsKeyCodeForWPEKeyval(keyval),
+            .nativeVirtualKeyCode = static_cast<int32_t>(keyval),
+            .handledByInputMethod = false,
+            .preeditUnderlines = std::nullopt,
+            .preeditSelectionRange = std::nullopt,
+            .isAutoRepeat = isAutoRepeat,
+            .isKeypad = keyval >= WPE_KEY_KP_Space && keyval <= WPE_KEY_KP_9,
+        }
+    };
 }
 
 #if ENABLE(TOUCH_EVENTS)
-WebTouchEvent WebEventFactory::createWebTouchEvent(WPEEvent* event, Vector<WebPlatformTouchPoint>&& touchPoints)
+WebTouchEventInit WebEventFactory::createWebTouchEvent(WPEEvent* event, Vector<WebPlatformTouchPoint>&& touchPoints)
 {
     std::optional<WebEventType> type;
     switch (wpe_event_get_event_type(event)) {
@@ -257,7 +285,7 @@ WebTouchEvent WebEventFactory::createWebTouchEvent(WPEEvent* event, Vector<WebPl
         RELEASE_ASSERT_NOT_REACHED();
     }
 
-    return WebTouchEvent({ type.value(), modifiersFromWPEModifiers(wpe_event_get_modifiers(event)), monotonicTimeForEvent(event) }, WTF::move(touchPoints), { }, { });
+    return { { type.value(), modifiersFromWPEModifiers(wpe_event_get_modifiers(event)), monotonicTimeForEvent(event) }, { .touchPoints = WTF::move(touchPoints), .coalescedEvents = { }, .predictedEvents = { } } };
 }
 #endif // ENABLE(TOUCH_EVENTS)
 
diff --git a/Source/WebKit/Sources.txt b/Source/WebKit/Sources.txt
index 1c12dcfb8070..1122067045df 100644
--- a/Source/WebKit/Sources.txt
+++ b/Source/WebKit/Sources.txt
@@ -104,7 +104,6 @@ ModelProcess/ModelProcessModelPlayerManagerProxy.cpp
 
 NetworkProcess/BackgroundFetchLoad.cpp @cost:4
 NetworkProcess/DatabaseUtilities.cpp @cost:3
-NetworkProcess/EarlyHintsResourceLoader.cpp @cost:6
 NetworkProcess/NetworkActivityTracker.cpp
 NetworkProcess/NetworkBroadcastChannelRegistry.cpp @cost:4
 NetworkProcess/NetworkCORSPreflightChecker.cpp @cost:4
diff --git a/Source/WebKit/UIProcess/API/C/WKContext.cpp b/Source/WebKit/UIProcess/API/C/WKContext.cpp
index f21e4119c629..76b4fbd2040e 100644
--- a/Source/WebKit/UIProcess/API/C/WKContext.cpp
+++ b/Source/WebKit/UIProcess/API/C/WKContext.cpp
@@ -128,7 +128,7 @@ void WKContextSetHistoryClient(WKContextRef contextRef, const WKContextHistoryCl
             if (!m_client.didPerformClientRedirect)
                 return;
 
-            m_client.didPerformClientRedirect(WebKit::toAPI(&processPool), WebKit::toAPI(&page), WebKit::toURLRef(sourceURL.impl()), WebKit::toURLRef(destinationURL.impl()), WebKit::toAPI(&frame), m_client.base.clientInfo);
+            m_client.didPerformClientRedirect(WebKit::toAPI(&processPool), WebKit::toAPI(&page), WebKit::toURLRef(sourceURL), WebKit::toURLRef(destinationURL), WebKit::toAPI(&frame), m_client.base.clientInfo);
         }
 
         void didPerformServerRedirect(WebKit::WebProcessPool& processPool, WebKit::WebPageProxy& page, const String& sourceURL, const String& destinationURL, WebKit::WebFrameProxy& frame) override
@@ -136,7 +136,7 @@ void WKContextSetHistoryClient(WKContextRef contextRef, const WKContextHistoryCl
             if (!m_client.didPerformServerRedirect)
                 return;
 
-            m_client.didPerformServerRedirect(WebKit::toAPI(&processPool), WebKit::toAPI(&page), WebKit::toURLRef(sourceURL.impl()), WebKit::toURLRef(destinationURL.impl()), WebKit::toAPI(&frame), m_client.base.clientInfo);
+            m_client.didPerformServerRedirect(WebKit::toAPI(&processPool), WebKit::toAPI(&page), WebKit::toURLRef(sourceURL), WebKit::toURLRef(destinationURL), WebKit::toAPI(&frame), m_client.base.clientInfo);
         }
 
         void didUpdateHistoryTitle(WebKit::WebProcessPool& processPool, WebKit::WebPageProxy& page, const String& title, const String& url, WebKit::WebFrameProxy& frame) override
@@ -144,7 +144,7 @@ void WKContextSetHistoryClient(WKContextRef contextRef, const WKContextHistoryCl
             if (!m_client.didUpdateHistoryTitle)
                 return;
 
-            m_client.didUpdateHistoryTitle(WebKit::toAPI(&processPool), WebKit::toAPI(&page), WebKit::toAPI(title.impl()), WebKit::toURLRef(url.impl()), WebKit::toAPI(&frame), m_client.base.clientInfo);
+            m_client.didUpdateHistoryTitle(WebKit::toAPI(&processPool), WebKit::toAPI(&page), WebKit::toAPI(title.impl()), WebKit::toURLRef(url), WebKit::toAPI(&frame), m_client.base.clientInfo);
         }
 
         void populateVisitedLinks(WebKit::WebProcessPool& processPool) override
@@ -249,7 +249,7 @@ void WKContextSetDownloadClient(WKContextRef context, const WKContextDownloadCli
         void willSendRequest(WebKit::DownloadProxy& downloadProxy, WebCore::ResourceRequest&& request, const WebCore::ResourceResponse&, CompletionHandler<void(WebCore::ResourceRequest&&)>&& completionHandler) final
         {
             if (m_client.didReceiveServerRedirect)
-                m_client.didReceiveServerRedirect(m_context, WebKit::toAPI(&downloadProxy), WebKit::toURLRef(request.url().string().impl()), m_client.base.clientInfo);
+                m_client.didReceiveServerRedirect(m_context, WebKit::toAPI(&downloadProxy), WebKit::toURLRef(request.url().string()), m_client.base.clientInfo);
             completionHandler(WTF::move(request));
         }
         WKContextRef m_context;
@@ -282,12 +282,12 @@ void WKContextAddVisitedLink(WKContextRef contextRef, WKStringRef visitedURL)
     if (visitedURLString.isEmpty())
         return;
 
-    WebKit::toImpl(contextRef)->visitedLinkStore().addVisitedLinkHash(WebCore::computeSharedStringHash(visitedURLString));
+    protect(WebKit::toImpl(contextRef)->visitedLinkStore())->addVisitedLinkHash(WebCore::computeSharedStringHash(visitedURLString));
 }
 
 void WKContextClearVisitedLinks(WKContextRef contextRef)
 {
-    WebKit::toImpl(contextRef)->visitedLinkStore().removeAll();
+    protect(WebKit::toImpl(contextRef)->visitedLinkStore())->removeAll();
 }
 
 void WKContextSetCacheModel(WKContextRef contextRef, WKCacheModel cacheModel)
diff --git a/Source/WebKit/UIProcess/API/C/WKPage.cpp b/Source/WebKit/UIProcess/API/C/WKPage.cpp
index d379e8975e50..fb93fe075c15 100644
--- a/Source/WebKit/UIProcess/API/C/WKPage.cpp
+++ b/Source/WebKit/UIProcess/API/C/WKPage.cpp
@@ -573,7 +573,7 @@ WKTypeRef WKPageCopySessionState(WKPageRef pageRef, void* context, WKPageSession
             if (!filter(pageRef, WKPageGetSessionBackForwardListItemValueType(), toAPI(&item), context))
                 return false;
 
-            if (!filter(pageRef, WKPageGetSessionHistoryURLValueType(), toURLRef(item.originalURL().impl()), context))
+            if (!filter(pageRef, WKPageGetSessionHistoryURLValueType(), toURLRef(item.originalURL()), context))
                 return false;
         }
 
@@ -2144,7 +2144,7 @@ void WKPageSetPageUIClient(WKPageRef pageRef, const WKPageUIClientBase* wkClient
             if (!m_client.saveDataToFileInDownloadsFolder)
                 return;
 
-            m_client.saveDataToFileInDownloadsFolder(toAPI(page), toAPI(suggestedFilename.impl()), toAPI(mimeType.impl()), toURLRef(originatingURL.string().impl()), toAPI(&data), m_client.base.clientInfo);
+            m_client.saveDataToFileInDownloadsFolder(toAPI(page), toAPI(suggestedFilename.impl()), toAPI(mimeType.impl()), toURLRef(originatingURL.string()), toAPI(&data), m_client.base.clientInfo);
         }
 
         void pinnedStateDidChange(WebPageProxy& page) final
@@ -2518,7 +2518,7 @@ void WKPageSetPageNavigationClient(WKPageRef pageRef, const WKPageNavigationClie
             }
 
             if (!apiNotifications.isEmpty())
-                m_client.contentRuleListNotification(toAPI(&page), toURLRef(url.string().impl()), toAPI(API::Array::create(WTF::move(apiListIdentifiers)).ptr()), toAPI(API::Array::create(WTF::move(apiNotifications)).ptr()), m_client.base.clientInfo);
+                m_client.contentRuleListNotification(toAPI(&page), toURLRef(url.string()), toAPI(API::Array::create(WTF::move(apiListIdentifiers)).ptr()), toAPI(API::Array::create(WTF::move(apiNotifications)).ptr()), m_client.base.clientInfo);
         }
 #endif
     };
diff --git a/Source/WebKit/UIProcess/API/C/playstation/WKPagePrivatePlayStation.cpp b/Source/WebKit/UIProcess/API/C/playstation/WKPagePrivatePlayStation.cpp
index 4fa95feb91bc..8a0972133929 100644
--- a/Source/WebKit/UIProcess/API/C/playstation/WKPagePrivatePlayStation.cpp
+++ b/Source/WebKit/UIProcess/API/C/playstation/WKPagePrivatePlayStation.cpp
@@ -90,7 +90,7 @@ void WKPageHandleKeyboardEvent(WKPageRef pageRef, WKKeyboardEvent event)
     NativeWebKeyboardEvent::HandledByInputMethod handledByInputMethod = NativeWebKeyboardEvent::HandledByInputMethod::No;
     std::optional<Vector<WebCore::CompositionUnderline>> preeditUnderlines;
     std::optional<WebKit::EditingRange> preeditSelectionRange;
-    WebKit::toImpl(pageRef)->handleKeyboardEvent(NativeWebKeyboardEvent(&wpeEvent, ""_s, false, handledByInputMethod, WTF::move(preeditUnderlines), WTF::move(preeditSelectionRange)));
+    WebKit::toImpl(pageRef)->handleKeyboardEvent(NativeWebKeyboardEvent::create(&wpeEvent, ""_s, false, handledByInputMethod, WTF::move(preeditUnderlines), WTF::move(preeditSelectionRange)));
 }
 
 void WKPageHandleMouseEvent(WKPageRef pageRef, WKMouseEvent event)
@@ -141,7 +141,7 @@ void WKPageHandleMouseEvent(WKPageRef pageRef, WKMouseEvent event)
 
     const float deviceScaleFactor = 1;
 
-    WebKit::toImpl(pageRef)->handleMouseEvent(NativeWebMouseEvent(&wpeEvent, deviceScaleFactor));
+    WebKit::toImpl(pageRef)->handleMouseEvent(NativeWebMouseEvent::create(&wpeEvent, deviceScaleFactor));
 }
 
 void WKPageHandleWheelEvent(WKPageRef pageRef, WKWheelEvent event)
@@ -159,7 +159,7 @@ void WKPageHandleWheelEvent(WKPageRef pageRef, WKWheelEvent event)
         1, static_cast<int32_t>(event.delta.width), 0
     };
 
-    WebKit::toImpl(pageRef)->handleNativeWheelEvent(NativeWebWheelEvent(&xEvent, deviceScaleFactor, WebWheelEvent::Phase::None, WebWheelEvent::Phase::None));
+    WebKit::toImpl(pageRef)->handleNativeWheelEvent(NativeWebWheelEvent::create(&xEvent, deviceScaleFactor, WebWheelEvent::Phase::None, WebWheelEvent::Phase::None));
 
     struct wpe_input_axis_event yEvent = {
         wpe_input_axis_event_type_motion,
@@ -167,7 +167,7 @@ void WKPageHandleWheelEvent(WKPageRef pageRef, WKWheelEvent event)
         0, static_cast<int32_t>(event.delta.height), 0
     };
 
-    WebKit::toImpl(pageRef)->handleNativeWheelEvent(NativeWebWheelEvent(&yEvent, deviceScaleFactor, WebWheelEvent::Phase::None, WebWheelEvent::Phase::None));
+    WebKit::toImpl(pageRef)->handleNativeWheelEvent(NativeWebWheelEvent::create(&yEvent, deviceScaleFactor, WebWheelEvent::Phase::None, WebWheelEvent::Phase::None));
 }
 
 void WKPagePaint(WKPageRef pageRef, unsigned char* surfaceData, WKSize wkSurfaceSize, WKRect wkPaintRect)
diff --git a/Source/WebKit/UIProcess/API/C/wpe/WKPagePrivateWPE.cpp b/Source/WebKit/UIProcess/API/C/wpe/WKPagePrivateWPE.cpp
index 7ad596243b6c..a7fc90a9a54a 100644
--- a/Source/WebKit/UIProcess/API/C/wpe/WKPagePrivateWPE.cpp
+++ b/Source/WebKit/UIProcess/API/C/wpe/WKPagePrivateWPE.cpp
@@ -64,7 +64,7 @@ void WKPageHandleKeyboardEvent(WKPageRef pageRef, WKKeyboardEvent event)
     if (auto* view = WebKit::toImpl(pageRef)->wpeView()) {
         GRefPtr<WPEEvent> wpeEvent = adoptGRef(wpe_event_keyboard_new(event.type == kWKEventKeyDown ? WPE_EVENT_KEYBOARD_KEY_DOWN : WPE_EVENT_KEYBOARD_KEY_UP,
             view, WPE_INPUT_SOURCE_KEYBOARD, 0, wkEventModifiersToWPE(event.modifiers), event.hardwareKeyCode, event.keyCode));
-        WebKit::toImpl(pageRef)->handleKeyboardEvent(NativeWebKeyboardEvent(wpeEvent.get(), unsafeMakeSpan(event.text, event.length), false));
+        WebKit::toImpl(pageRef)->handleKeyboardEvent(NativeWebKeyboardEvent::create(wpeEvent.get(), unsafeMakeSpan(event.text, event.length), false));
         return;
     }
 #endif
@@ -90,7 +90,7 @@ void WKPageHandleKeyboardEvent(WKPageRef pageRef, WKKeyboardEvent event)
     NativeWebKeyboardEvent::HandledByInputMethod handledByInputMethod = NativeWebKeyboardEvent::HandledByInputMethod::No;
     std::optional<Vector<WebCore::CompositionUnderline>> preeditUnderlines;
     std::optional<WebKit::EditingRange> preeditSelectionRange;
-    WebKit::toImpl(pageRef)->handleKeyboardEvent(NativeWebKeyboardEvent(&wpeEvent, unsafeMakeSpan(event.text, event.length), false, handledByInputMethod, WTF::move(preeditUnderlines), WTF::move(preeditSelectionRange)));
+    WebKit::toImpl(pageRef)->handleKeyboardEvent(NativeWebKeyboardEvent::create(&wpeEvent, unsafeMakeSpan(event.text, event.length), false, handledByInputMethod, WTF::move(preeditUnderlines), WTF::move(preeditSelectionRange)));
 #endif
 }
 
@@ -130,7 +130,7 @@ void WKPageHandleMouseEvent(WKPageRef pageRef, WKMouseEvent event)
             break;
         }
 
-        WebKit::toImpl(pageRef)->handleMouseEvent(NativeWebMouseEvent(wpeEvent.get()));
+        WebKit::toImpl(pageRef)->handleMouseEvent(NativeWebMouseEvent::create(wpeEvent.get()));
         return;
     }
 #endif
@@ -180,6 +180,6 @@ void WKPageHandleMouseEvent(WKPageRef pageRef, WKMouseEvent event)
 
     const float deviceScaleFactor = 1;
 
-    WebKit::toImpl(pageRef)->handleMouseEvent(NativeWebMouseEvent(&wpeEvent, deviceScaleFactor));
+    WebKit::toImpl(pageRef)->handleMouseEvent(NativeWebMouseEvent::create(&wpeEvent, deviceScaleFactor));
 #endif
 }
diff --git a/Source/WebKit/UIProcess/API/gtk/WebKitWebViewBase.cpp b/Source/WebKit/UIProcess/API/gtk/WebKitWebViewBase.cpp
index ecfe01bc5646..56edb11f9f64 100644
--- a/Source/WebKit/UIProcess/API/gtk/WebKitWebViewBase.cpp
+++ b/Source/WebKit/UIProcess/API/gtk/WebKitWebViewBase.cpp
@@ -1197,7 +1197,7 @@ static gboolean webkitWebViewBaseKeyPressEvent(GtkWidget* widget, GdkEventKey* k
 
     auto filterResult = priv->inputMethodFilter.filterKeyEvent(reinterpret_cast<GdkEvent*>(keyEvent));
     if (!filterResult.handled) {
-        priv->pageProxy->handleKeyboardEvent(NativeWebKeyboardEvent(reinterpret_cast<GdkEvent*>(keyEvent), filterResult.keyText, isAutoRepeat,
+        priv->pageProxy->handleKeyboardEvent(NativeWebKeyboardEvent::create(reinterpret_cast<GdkEvent*>(keyEvent), filterResult.keyText, isAutoRepeat,
             priv->keyBindingTranslator.commandsForKeyEvent(keyEvent)));
     }
 
@@ -1212,7 +1212,7 @@ static gboolean webkitWebViewBaseKeyReleaseEvent(GtkWidget* widget, GdkEventKey*
     priv->keyAutoRepeatHandler.keyRelease();
 
     if (!priv->inputMethodFilter.filterKeyEvent(reinterpret_cast<GdkEvent*>(keyEvent)).handled)
-        priv->pageProxy->handleKeyboardEvent(NativeWebKeyboardEvent(reinterpret_cast<GdkEvent*>(keyEvent), { }, false, { }));
+        priv->pageProxy->handleKeyboardEvent(NativeWebKeyboardEvent::create(reinterpret_cast<GdkEvent*>(keyEvent), { }, false, { }));
 
     return GDK_EVENT_STOP;
 }
@@ -1272,7 +1272,7 @@ static gboolean webkitWebViewBaseKeyPressed(WebKitWebViewBase* webViewBase, unsi
 
     auto filterResult = priv->inputMethodFilter.filterKeyEvent(event);
     if (!filterResult.handled) {
-        priv->pageProxy->handleKeyboardEvent(NativeWebKeyboardEvent(event, filterResult.keyText, isAutoRepeat,
+        priv->pageProxy->handleKeyboardEvent(NativeWebKeyboardEvent::create(event, filterResult.keyText, isAutoRepeat,
             priv->keyBindingTranslator.commandsForKeyEvent(GTK_EVENT_CONTROLLER_KEY(controller))));
     }
 
@@ -1287,7 +1287,7 @@ static void webkitWebViewBaseKeyReleased(WebKitWebViewBase* webViewBase, unsigne
 
     auto* event = gtk_event_controller_get_current_event(controller);
     if (!priv->inputMethodFilter.filterKeyEvent(event).handled)
-        priv->pageProxy->handleKeyboardEvent(NativeWebKeyboardEvent(event, { }, false, { }));
+        priv->pageProxy->handleKeyboardEvent(NativeWebKeyboardEvent::create(event, { }, false, { }));
 }
 #endif
 
@@ -1342,7 +1342,7 @@ static void webkitWebViewBaseHandleMouseEvent(WebKitWebViewBase* webViewBase, Gd
         ASSERT_NOT_REACHED();
     }
 
-    priv->pageProxy->handleMouseEvent(NativeWebMouseEvent(event, clickCount, movementDelta));
+    priv->pageProxy->handleMouseEvent(NativeWebMouseEvent::create(event, clickCount, movementDelta));
 }
 
 static gboolean webkitWebViewBaseButtonPressEvent(GtkWidget* widget, GdkEventButton* event)
@@ -1403,7 +1403,7 @@ static void webkitWebViewBaseButtonPressed(WebKitWebViewBase* webViewBase, int c
         priv->contextMenuEvent = event;
 #endif
 
-    priv->pageProxy->handleMouseEvent(NativeWebMouseEvent(event, DoublePoint(x, y), clickCount, std::nullopt));
+    priv->pageProxy->handleMouseEvent(NativeWebMouseEvent::create(event, DoublePoint(x, y), clickCount, std::nullopt));
 }
 
 static void webkitWebViewBaseButtonReleased(WebKitWebViewBase* webViewBase, int clickCount, double x, double y, GtkGesture* gesture)
@@ -1419,7 +1419,7 @@ static void webkitWebViewBaseButtonReleased(WebKitWebViewBase* webViewBase, int
     auto* sequence = gtk_gesture_single_get_current_sequence(GTK_GESTURE_SINGLE(gesture));
     gtk_gesture_set_sequence_state(gesture, sequence, GTK_EVENT_SEQUENCE_CLAIMED);
 
-    priv->pageProxy->handleMouseEvent(NativeWebMouseEvent(gtk_gesture_get_last_event(gesture, sequence), DoublePoint(x, y), clickCount, std::nullopt));
+    priv->pageProxy->handleMouseEvent(NativeWebMouseEvent::create(gtk_gesture_get_last_event(gesture, sequence), DoublePoint(x, y), clickCount, std::nullopt));
 }
 #endif
 
@@ -1522,7 +1522,7 @@ static gboolean webkitWebViewBaseScrollEvent(GtkWidget* widget, GdkEventScroll*
 
     FloatSize delta = wheelTicks.scaled(stepX, stepY);
 
-    priv->pageProxy->handleNativeWheelEvent(NativeWebWheelEvent(event, position, globalPosition, delta, wheelTicks, phase, WebWheelEvent::Phase::None, hasPreciseScrollingDeltas));
+    priv->pageProxy->handleNativeWheelEvent(NativeWebWheelEvent::create(event, position, globalPosition, delta, wheelTicks, phase, WebWheelEvent::Phase::None, hasPreciseScrollingDeltas));
 
     return GDK_EVENT_STOP;
 }
@@ -1598,7 +1598,7 @@ static gboolean handleScroll(WebKitWebViewBase* webViewBase, double deltaX, doub
     delta = wheelTicks.scaled(stepX, stepY);
 #endif
 
-    priv->pageProxy->handleNativeWheelEvent(NativeWebWheelEvent(event, position, position, delta, wheelTicks, phase, WebWheelEvent::Phase::None, hasPreciseScrollingDeltas));
+    priv->pageProxy->handleNativeWheelEvent(NativeWebWheelEvent::create(event, position, position, delta, wheelTicks, phase, WebWheelEvent::Phase::None, hasPreciseScrollingDeltas));
 
     return GDK_EVENT_STOP;
 }
@@ -1728,7 +1728,7 @@ static void webkitWebViewBaseEnter(WebKitWebViewBase* webViewBase, double x, dou
         return;
 #endif
 
-    priv->pageProxy->handleMouseEvent(NativeWebMouseEvent(DoublePoint(x, y)));
+    priv->pageProxy->handleMouseEvent(NativeWebMouseEvent::create(DoublePoint(x, y)));
 }
 
 static gboolean webkitWebViewBaseMotion(WebKitWebViewBase* webViewBase, double x, double y, GtkEventController* controller)
@@ -1749,7 +1749,7 @@ static gboolean webkitWebViewBaseMotion(WebKitWebViewBase* webViewBase, double x
         movementDelta = motionEvent.position - priv->lastMotionEvent->position;
     priv->lastMotionEvent = WTF::move(motionEvent);
 
-    webViewBase->priv->pageProxy->handleMouseEvent(NativeWebMouseEvent(event, DoublePoint(x, y), 0, movementDelta));
+    webViewBase->priv->pageProxy->handleMouseEvent(NativeWebMouseEvent::create(event, DoublePoint(x, y), 0, movementDelta));
 
     return GDK_EVENT_PROPAGATE;
 }
@@ -1786,16 +1786,16 @@ static void webkitWebViewBaseLeave(WebKitWebViewBase* webViewBase, GtkEventContr
     int yDistanceFromBottomEdge = height - previousY;
 
     if (previousX <= xDistanceFromRightEdge && previousX <= previousY && previousX <= yDistanceFromBottomEdge)
-        priv->pageProxy->handleMouseEvent(NativeWebMouseEvent(DoublePoint(-1, previousY)));
+        priv->pageProxy->handleMouseEvent(NativeWebMouseEvent::create(DoublePoint(-1, previousY)));
     else if (xDistanceFromRightEdge <= previousX && xDistanceFromRightEdge <= previousY && xDistanceFromRightEdge <= yDistanceFromBottomEdge)
-        priv->pageProxy->handleMouseEvent(NativeWebMouseEvent(DoublePoint(width, previousY)));
+        priv->pageProxy->handleMouseEvent(NativeWebMouseEvent::create(DoublePoint(width, previousY)));
     else if (previousY <= previousX && previousY <= xDistanceFromRightEdge && previousY <= yDistanceFromBottomEdge)
-        priv->pageProxy->handleMouseEvent(NativeWebMouseEvent(DoublePoint(previousX, -1)));
+        priv->pageProxy->handleMouseEvent(NativeWebMouseEvent::create(DoublePoint(previousX, -1)));
     else {
         ASSERT(yDistanceFromBottomEdge <= previousX);
         ASSERT(yDistanceFromBottomEdge <= previousY);
         ASSERT(yDistanceFromBottomEdge <= xDistanceFromRightEdge);
-        priv->pageProxy->handleMouseEvent(NativeWebMouseEvent(DoublePoint(previousX, height)));
+        priv->pageProxy->handleMouseEvent(NativeWebMouseEvent::create(DoublePoint(previousX, height)));
     }
 }
 #endif
@@ -1909,7 +1909,7 @@ static gboolean webkitWebViewBaseTouchEvent(GtkWidget* widget, GdkEventTouch* ev
 
     Vector<WebPlatformTouchPoint> touchPoints;
     webkitWebViewBaseGetTouchPointsForEvent(webViewBase, touchEvent, touchPoints);
-    priv->pageProxy->handleTouchEvent(nullptr, NativeWebTouchEvent(reinterpret_cast<GdkEvent*>(event), WTF::move(touchPoints)));
+    priv->pageProxy->handleTouchEvent(nullptr, NativeWebTouchEvent::create(reinterpret_cast<GdkEvent*>(event), WTF::move(touchPoints)));
 
 #if USE(GTK4)
     return GDK_EVENT_PROPAGATE;
@@ -3118,7 +3118,7 @@ WebKitInputMethodContext* webkitWebViewBaseGetInputMethodContext(WebKitWebViewBa
 
 void webkitWebViewBaseSynthesizeCompositionKeyPress(WebKitWebViewBase* webViewBase, const String& text, std::optional<Vector<CompositionUnderline>>&& underlines, std::optional<EditingRange>&& selectionRange)
 {
-    webViewBase->priv->pageProxy->handleKeyboardEvent(NativeWebKeyboardEvent(text, WTF::move(underlines), WTF::move(selectionRange)));
+    webViewBase->priv->pageProxy->handleKeyboardEvent(NativeWebKeyboardEvent::create(text, WTF::move(underlines), WTF::move(selectionRange)));
 }
 
 static inline OptionSet<WebEventModifier> toWebKitModifiers(unsigned modifiers)
@@ -3245,7 +3245,7 @@ void webkitWebViewBaseSynthesizeMouseEvent(WebKitWebViewBase* webViewBase, Mouse
         break;
     }
 
-    priv->pageProxy->handleMouseEvent(NativeWebMouseEvent(webEventType, webEventButton, webEventButtons, DoublePoint(x, y),
+    priv->pageProxy->handleMouseEvent(NativeWebMouseEvent::create(webEventType, webEventButton, webEventButtons, DoublePoint(x, y),
         widgetRootCoords(GTK_WIDGET(webViewBase), x, y), clickCount, toWebKitModifiers(modifiers), movementDelta,
         primaryPointerForType(pointerType), pointerType.isNull() ? mousePointerEventType() : pointerType, isTouchEvent));
 }
@@ -3343,7 +3343,7 @@ void webkitWebViewBaseSynthesizeKeyEvent(WebKitWebViewBase* webViewBase, KeyEven
 
         auto filterResult = priv->inputMethodFilter.filterKeyEvent(GDK_KEY_PRESS, keyval, keycode, modifiers);
         if (!filterResult.handled) {
-            priv->pageProxy->handleKeyboardEvent(NativeWebKeyboardEvent(
+            priv->pageProxy->handleKeyboardEvent(NativeWebKeyboardEvent::create(
                 WebEventType::KeyDown,
                 filterResult.keyText.isNull() ? WebKeyboardEvent::singleCharacterStringForGdkKeyval(keyval) : filterResult.keyText,
                 WebKeyboardEvent::keyValueStringForGdkKeyval(keyval),
@@ -3360,7 +3360,7 @@ void webkitWebViewBaseSynthesizeKeyEvent(WebKitWebViewBase* webViewBase, KeyEven
 
     if (type != KeyEventType::Press) {
         if (!priv->inputMethodFilter.filterKeyEvent(GDK_KEY_RELEASE, keyval, keycode, modifiers).handled) {
-            priv->pageProxy->handleKeyboardEvent(NativeWebKeyboardEvent(
+            priv->pageProxy->handleKeyboardEvent(NativeWebKeyboardEvent::create(
                 WebEventType::KeyUp,
                 WebKeyboardEvent::singleCharacterStringForGdkKeyval(keyval),
                 WebKeyboardEvent::keyValueStringForGdkKeyval(keyval),
@@ -3415,7 +3415,7 @@ void webkitWebViewBaseSynthesizeWheelEvent(WebKitWebViewBase* webViewBase, const
     if (!hasPreciseDeltas)
         delta.scale(static_cast<float>(Scrollbar::pixelsPerLineStep()));
 
-    priv->pageProxy->handleNativeWheelEvent(NativeWebWheelEvent(const_cast<GdkEvent*>(event), { x, y }, widgetRootCoords(GTK_WIDGET(webViewBase), x, y),
+    priv->pageProxy->handleNativeWheelEvent(NativeWebWheelEvent::create(const_cast<GdkEvent*>(event), { x, y }, widgetRootCoords(GTK_WIDGET(webViewBase), x, y),
         delta, wheelTicks, toWebKitWheelEventPhase(phase), toWebKitWheelEventPhase(momentumPhase), true));
 }
 
@@ -3464,7 +3464,7 @@ void webkitWebViewBaseSynthesizeTouchEvent(WebKitWebViewBase* webViewBase, Touch
         return WebPlatformTouchPoint(point.id, toWebPlatformTouchPointState(point.state), DoublePoint(rootCoords.x(), rootCoords.y()), DoublePoint(point.x, point.y));
     });
 
-    priv->pageProxy->handleTouchEvent(nullptr, NativeWebTouchEvent(webEventType, toWebKitModifiers(modifiers), WTF::move(touchPoints)));
+    priv->pageProxy->handleTouchEvent(nullptr, NativeWebTouchEvent::create(webEventType, toWebKitModifiers(modifiers), WTF::move(touchPoints)));
 }
 #endif // ENABLE(TOUCH_EVENTS)
 
diff --git a/Source/WebKit/UIProcess/API/ios/WKWebViewIOS.mm b/Source/WebKit/UIProcess/API/ios/WKWebViewIOS.mm
index 83b76c976258..da559aac1e02 100644
--- a/Source/WebKit/UIProcess/API/ios/WKWebViewIOS.mm
+++ b/Source/WebKit/UIProcess/API/ios/WKWebViewIOS.mm
@@ -2277,10 +2277,10 @@ - (void)scrollView:(WKBaseScrollView *)scrollView handleScrollUpdate:(WKBEScroll
     // this may not be a WKBEScrollViewScrollUpdatePhaseBegin event, nor even necessarily the first WKBEScrollViewScrollUpdatePhaseChanged event.
     if (!_wheelEventCountInCurrentScrollGesture)
         overridePhase = WebKit::WebWheelEvent::Phase::Began;
-    auto event = WebKit::WebIOSEventFactory::createWebWheelEvent(update, _contentView.get(), overridePhase);
+    Ref event = WebKit::WebWheelEvent::create(WebKit::WebIOSEventFactory::createWebWheelEvent(update, _contentView.get(), overridePhase));
 
     _wheelEventCountInCurrentScrollGesture++;
-    _page->handleWheelEventWithoutScrolling(event, [weakSelf = WeakObjCPtr<WKWebView>(self), strongCompletion = makeBlockPtr(completion), isCancelable, isHandledByDefault](bool defaultPrevented) {
+    _page->handleWheelEventWithoutScrolling(WTF::move(event), [weakSelf = WeakObjCPtr<WKWebView>(self), strongCompletion = makeBlockPtr(completion), isCancelable, isHandledByDefault](bool defaultPrevented) {
         RetainPtr strongSelf = weakSelf.get();
         if (!strongSelf) {
             if (isCancelable)
diff --git a/Source/WebKit/UIProcess/API/wpe/PageClientImpl.cpp b/Source/WebKit/UIProcess/API/wpe/PageClientImpl.cpp
index 0d535dca6e42..9bea1ee07f51 100644
--- a/Source/WebKit/UIProcess/API/wpe/PageClientImpl.cpp
+++ b/Source/WebKit/UIProcess/API/wpe/PageClientImpl.cpp
@@ -287,7 +287,7 @@ void PageClientImpl::doneWithTouchEvent(const WebTouchEvent& touchEvent, bool wa
 
             // Mouse motion towards the point of the click.
             event->type = wpe_input_pointer_event_type_motion;
-            page.handleMouseEvent(NativeWebMouseEvent(event, page.deviceScaleFactor(), WebMouseEventSyntheticClickType::OneFingerTap));
+            page.handleMouseEvent(NativeWebMouseEvent::create(event, page.deviceScaleFactor(), WebMouseEventSyntheticClickType::OneFingerTap));
 
             event->type = wpe_input_pointer_event_type_button;
             event->button = 1;
@@ -295,12 +295,12 @@ void PageClientImpl::doneWithTouchEvent(const WebTouchEvent& touchEvent, bool wa
             // Mouse down on the point of the click.
             event->state = 1;
             event->modifiers |= wpe_input_pointer_modifier_button1;
-            page.handleMouseEvent(NativeWebMouseEvent(event, page.deviceScaleFactor(), WebMouseEventSyntheticClickType::OneFingerTap));
+            page.handleMouseEvent(NativeWebMouseEvent::create(event, page.deviceScaleFactor(), WebMouseEventSyntheticClickType::OneFingerTap));
 
             // Mouse up on the same location.
             event->state = 0;
             event->modifiers &= ~wpe_input_pointer_modifier_button1;
-            page.handleMouseEvent(NativeWebMouseEvent(event, page.deviceScaleFactor(), WebMouseEventSyntheticClickType::OneFingerTap));
+            page.handleMouseEvent(NativeWebMouseEvent::create(event, page.deviceScaleFactor(), WebMouseEventSyntheticClickType::OneFingerTap));
         },
         [&](TouchGestureController::ContextMenuEvent&) {
             // FIXME: Generate contextmenuevent without accidentally generating mouseup/mousedown events
diff --git a/Source/WebKit/UIProcess/API/wpe/WPEWebViewLegacy.cpp b/Source/WebKit/UIProcess/API/wpe/WPEWebViewLegacy.cpp
index b12555be041c..7f8b3be85ce8 100644
--- a/Source/WebKit/UIProcess/API/wpe/WPEWebViewLegacy.cpp
+++ b/Source/WebKit/UIProcess/API/wpe/WPEWebViewLegacy.cpp
@@ -151,12 +151,12 @@ ViewLegacy::ViewLegacy(struct wpe_view_backend* backend, const API::PageConfigur
             if (event->type == wpe_input_pointer_event_type_button && event->state == 1)
                 view.m_inputMethodFilter.cancelComposition();
             auto& page = view.page();
-            WebKit::NativeWebMouseEvent mouseEvent(event, page.deviceScaleFactor());
+            Ref mouseEvent = WebKit::NativeWebMouseEvent::create(event, page.deviceScaleFactor());
 #if ENABLE(DRAG_SUPPORT)
             if (view.updateDrag(mouseEvent))
                 return;
 #endif
-            page.handleMouseEvent(mouseEvent);
+            page.handleMouseEvent(WTF::move(mouseEvent));
         },
         // handle_axis_event
         [](void* data, struct wpe_input_axis_event* event)
@@ -185,7 +185,7 @@ ViewLegacy::ViewLegacy(struct wpe_view_backend* backend, const API::PageConfigur
                     phase = WebWheelEvent::Phase::Ended;
 
                 auto& page = view.page();
-                page.handleNativeWheelEvent(WebKit::NativeWebWheelEvent(event, page.deviceScaleFactor(), phase, momentumPhase));
+                page.handleNativeWheelEvent(WebKit::NativeWebWheelEvent::create(event, page.deviceScaleFactor(), phase, momentumPhase));
                 return;
             }
 #endif
@@ -207,7 +207,7 @@ ViewLegacy::ViewLegacy(struct wpe_view_backend* backend, const API::PageConfigur
 
             if (shouldDispatch) {
                 auto& page = view.page();
-                page.handleNativeWheelEvent(WebKit::NativeWebWheelEvent(event, page.deviceScaleFactor(), phase, momentumPhase));
+                page.handleNativeWheelEvent(WebKit::NativeWebWheelEvent::create(event, page.deviceScaleFactor(), phase, momentumPhase));
             }
         },
         // handle_touch_event
@@ -217,7 +217,7 @@ ViewLegacy::ViewLegacy(struct wpe_view_backend* backend, const API::PageConfigur
             auto& view = *reinterpret_cast<ViewLegacy*>(data);
             auto& page = view.page();
 
-            WebKit::NativeWebTouchEvent touchEvent(event, page.deviceScaleFactor());
+            Ref touchEvent = WebKit::NativeWebTouchEvent::create(event, page.deviceScaleFactor());
 
             // If already gesturing axis events, short-cut directly to the controller,
             // avoiding the usual roundtrip.
@@ -225,7 +225,7 @@ ViewLegacy::ViewLegacy(struct wpe_view_backend* backend, const API::PageConfigur
             if (touchGestureController.gesturedEvent() == TouchGestureController::GesturedEvent::Axis) {
                 bool handledThroughGestureController = false;
 
-                auto generatedEvent = touchGestureController.handleEvent(touchEvent.nativeFallbackTouchPoint());
+                auto generatedEvent = touchGestureController.handleEvent(touchEvent->nativeFallbackTouchPoint());
                 WTF::switchOn(generatedEvent,
                     [](TouchGestureController::NoEvent&) { },
                     [](TouchGestureController::ClickEvent&) { },
@@ -238,14 +238,14 @@ ViewLegacy::ViewLegacy(struct wpe_view_backend* backend, const API::PageConfigur
                         auto* event = &axisEvent.event;
 #endif
                         if (event->type != wpe_input_axis_event_type_null) {
-                            page.handleNativeWheelEvent(WebKit::NativeWebWheelEvent(event, page.deviceScaleFactor(),
+                            page.handleNativeWheelEvent(WebKit::NativeWebWheelEvent::create(event, page.deviceScaleFactor(),
                                 axisEvent.phase, WebWheelEvent::Phase::None));
                             handledThroughGestureController = true;
                         }
                     });
             }
 
-            page.handleTouchEvent(nullptr, touchEvent);
+            page.handleTouchEvent(nullptr, WTF::move(touchEvent));
 #endif
         },
         // padding
@@ -347,7 +347,7 @@ void ViewLegacy::handleKeyboardEvent(struct wpe_input_keyboard_event* event)
     if (filterResult.handled)
         return;
 
-    page().handleKeyboardEvent(WebKit::NativeWebKeyboardEvent(event, event->pressed ? filterResult.keyText : String(), isAutoRepeat, NativeWebKeyboardEvent::HandledByInputMethod::No, std::nullopt, std::nullopt));
+    page().handleKeyboardEvent(WebKit::NativeWebKeyboardEvent::create(event, event->pressed ? filterResult.keyText : String(), isAutoRepeat, NativeWebKeyboardEvent::HandledByInputMethod::No, std::nullopt, std::nullopt));
 }
 
 void ViewLegacy::synthesizeCompositionKeyPress(const String& text, std::optional<Vector<WebCore::CompositionUnderline>>&& underlines, std::optional<EditingRange>&& selectionRange)
@@ -357,7 +357,7 @@ void ViewLegacy::synthesizeCompositionKeyPress(const String& text, std::optional
     // composition results. WPE doesn't have an equivalent, so we send VoidSymbol
     // here to WebCore. PlatformKeyEvent converts this code into VK_PROCESSKEY.
     static struct wpe_input_keyboard_event event = { 0, WPE_KEY_VoidSymbol, 0, true, 0 };
-    page().handleKeyboardEvent(WebKit::NativeWebKeyboardEvent(&event, text, false, NativeWebKeyboardEvent::HandledByInputMethod::Yes, WTF::move(underlines), WTF::move(selectionRange)));
+    page().handleKeyboardEvent(WebKit::NativeWebKeyboardEvent::create(&event, text, false, NativeWebKeyboardEvent::HandledByInputMethod::Yes, WTF::move(underlines), WTF::move(selectionRange)));
 }
 
 #if ENABLE(FULLSCREEN_API)
diff --git a/Source/WebKit/UIProcess/API/wpe/WPEWebViewPlatform.cpp b/Source/WebKit/UIProcess/API/wpe/WPEWebViewPlatform.cpp
index dff7c5a47202..bd6f9a81e66d 100644
--- a/Source/WebKit/UIProcess/API/wpe/WPEWebViewPlatform.cpp
+++ b/Source/WebKit/UIProcess/API/wpe/WPEWebViewPlatform.cpp
@@ -398,7 +398,7 @@ gboolean ViewPlatform::handleEvent(WPEEvent* event)
 {
 #if ENABLE(TOUCH_EVENTS) && ENABLE(DEVELOPER_MODE)
     if (wpeEventIsTouchForTesting(event)) {
-        page().handleTouchEvent(nullptr, NativeWebTouchEvent(event, platformTouchPoints(wpeEventTouchPointsForTesting(event))));
+        page().handleTouchEvent(nullptr, NativeWebTouchEvent::create(event, platformTouchPoints(wpeEventTouchPointsForTesting(event))));
         return TRUE;
     }
 #endif
@@ -414,16 +414,16 @@ gboolean ViewPlatform::handleEvent(WPEEvent* event)
     case WPE_EVENT_POINTER_MOVE:
     case WPE_EVENT_POINTER_ENTER:
     case WPE_EVENT_POINTER_LEAVE: {
-        WebKit::NativeWebMouseEvent mouseEvent(event);
+        Ref mouseEvent = WebKit::NativeWebMouseEvent::create(event);
 #if ENABLE(DRAG_SUPPORT)
         if (updateDrag(mouseEvent))
             return TRUE;
 #endif
-        page().handleMouseEvent(mouseEvent);
+        page().handleMouseEvent(WTF::move(mouseEvent));
         return TRUE;
     }
     case WPE_EVENT_SCROLL:
-        page().handleNativeWheelEvent(WebKit::NativeWebWheelEvent(event));
+        page().handleNativeWheelEvent(WebKit::NativeWebWheelEvent::create(event));
         return TRUE;
     case WPE_EVENT_KEYBOARD_KEY_DOWN: {
         auto modifiers = wpe_event_get_modifiers(event);
@@ -435,20 +435,20 @@ gboolean ViewPlatform::handleEvent(WPEEvent* event)
         }
         auto filterResult = m_inputMethodFilter.filterKeyEvent(event);
         if (!filterResult.handled)
-            page().handleKeyboardEvent(WebKit::NativeWebKeyboardEvent(event, filterResult.keyText, m_keyAutoRepeatHandler.keyPress(wpe_event_keyboard_get_keycode(event))));
+            page().handleKeyboardEvent(WebKit::NativeWebKeyboardEvent::create(event, filterResult.keyText, m_keyAutoRepeatHandler.keyPress(wpe_event_keyboard_get_keycode(event))));
         return TRUE;
     }
     case WPE_EVENT_KEYBOARD_KEY_UP: {
         m_keyAutoRepeatHandler.keyRelease();
         auto filterResult = m_inputMethodFilter.filterKeyEvent(event);
         if (!filterResult.handled)
-            page().handleKeyboardEvent(WebKit::NativeWebKeyboardEvent(event, String(), false));
+            page().handleKeyboardEvent(WebKit::NativeWebKeyboardEvent::create(event, String(), false));
         return TRUE;
     }
     case WPE_EVENT_TOUCH_DOWN:
 #if ENABLE(TOUCH_EVENTS)
         m_touchEvents.set(wpe_event_touch_get_sequence_id(event), event);
-        page().handleTouchEvent(nullptr, NativeWebTouchEvent(event, touchPointsForEvent(event)));
+        page().handleTouchEvent(nullptr, NativeWebTouchEvent::create(event, touchPointsForEvent(event)));
 #endif
         return TRUE;
     case WPE_EVENT_TOUCH_UP:
@@ -457,14 +457,14 @@ gboolean ViewPlatform::handleEvent(WPEEvent* event)
         m_touchEvents.set(wpe_event_touch_get_sequence_id(event), event);
         auto points = touchPointsForEvent(event);
         m_touchEvents.remove(wpe_event_touch_get_sequence_id(event));
-        page().handleTouchEvent(nullptr, NativeWebTouchEvent(event, WTF::move(points)));
+        page().handleTouchEvent(nullptr, NativeWebTouchEvent::create(event, WTF::move(points)));
 #endif
         return TRUE;
     }
     case WPE_EVENT_TOUCH_MOVE:
 #if ENABLE(TOUCH_EVENTS)
         m_touchEvents.set(wpe_event_touch_get_sequence_id(event), event);
-        page().handleTouchEvent(nullptr, NativeWebTouchEvent(event, touchPointsForEvent(event)));
+        page().handleTouchEvent(nullptr, NativeWebTouchEvent::create(event, touchPointsForEvent(event)));
 #endif
         return TRUE;
     };
@@ -495,7 +495,7 @@ void ViewPlatform::handleGesture(WPEEvent* event)
                 GRefPtr<WPEEvent> simulatedEvent = adoptGRef(wpe_event_pointer_move_new(
                     WPE_EVENT_POINTER_MOVE, m_wpeView.get(), WPE_INPUT_SOURCE_TOUCHSCREEN, 0, static_cast<WPEModifiers>(0), x, y, 0, 0
                 ));
-                page().handleMouseEvent(WebKit::NativeWebMouseEvent(simulatedEvent.get()));
+                page().handleMouseEvent(WebKit::NativeWebMouseEvent::create(simulatedEvent.get()));
             }
 
             // Mouse down on the point of the click.
@@ -503,7 +503,7 @@ void ViewPlatform::handleGesture(WPEEvent* event)
                 GRefPtr<WPEEvent> simulatedEvent = adoptGRef(wpe_event_pointer_button_new(
                     WPE_EVENT_POINTER_DOWN, m_wpeView.get(), WPE_INPUT_SOURCE_TOUCHSCREEN, 0, WPE_MODIFIER_POINTER_BUTTON1, 1, x, y, 1
                 ));
-                page().handleMouseEvent(WebKit::NativeWebMouseEvent(simulatedEvent.get()));
+                page().handleMouseEvent(WebKit::NativeWebMouseEvent::create(simulatedEvent.get()));
             }
 
             wpe_view_focus_in(m_wpeView.get());
@@ -513,7 +513,7 @@ void ViewPlatform::handleGesture(WPEEvent* event)
                 GRefPtr<WPEEvent> simulatedEvent = adoptGRef(wpe_event_pointer_button_new(
                     WPE_EVENT_POINTER_UP, m_wpeView.get(), WPE_INPUT_SOURCE_TOUCHSCREEN, 0, static_cast<WPEModifiers>(0), 1, x, y, 0
                 ));
-                page().handleMouseEvent(WebKit::NativeWebMouseEvent(simulatedEvent.get()));
+                page().handleMouseEvent(WebKit::NativeWebMouseEvent::create(simulatedEvent.get()));
             }
         }
         break;
@@ -532,14 +532,14 @@ void ViewPlatform::handleGesture(WPEEvent* event)
             GRefPtr<WPEEvent> simulatedScrollEvent = adoptGRef(wpe_event_scroll_new(
                 m_wpeView.get(), WPE_INPUT_SOURCE_TOUCHSCREEN, 0, static_cast<WPEModifiers>(0), dx, dy, TRUE, FALSE, x, y
             ));
-            page().handleNativeWheelEvent(WebKit::NativeWebWheelEvent(simulatedScrollEvent.get(), phase));
+            page().handleNativeWheelEvent(WebKit::NativeWebWheelEvent::create(simulatedScrollEvent.get(), phase));
         }
     }
 }
 
 void ViewPlatform::synthesizeCompositionKeyPress(const String& text, std::optional<Vector<WebCore::CompositionUnderline>>&& underlines, std::optional<EditingRange>&& selectionRange)
 {
-    page().handleKeyboardEvent(WebKit::NativeWebKeyboardEvent(text, WTF::move(underlines), WTF::move(selectionRange)));
+    page().handleKeyboardEvent(WebKit::NativeWebKeyboardEvent::create(text, WTF::move(underlines), WTF::move(selectionRange)));
 }
 
 void ViewPlatform::setCursor(const WebCore::Cursor& cursor)
diff --git a/Source/WebKit/UIProcess/Authentication/AuthenticationChallengeProxy.cpp b/Source/WebKit/UIProcess/Authentication/AuthenticationChallengeProxy.cpp
index 7e40069c1fa0..55bfbdb7866d 100644
--- a/Source/WebKit/UIProcess/Authentication/AuthenticationChallengeProxy.cpp
+++ b/Source/WebKit/UIProcess/Authentication/AuthenticationChallengeProxy.cpp
@@ -43,14 +43,14 @@ namespace WebKit {
 
 AuthenticationChallengeProxy::AuthenticationChallengeProxy(WebCore::AuthenticationChallenge&& authenticationChallenge, AuthenticationChallengeIdentifier challengeID, Ref<IPC::Connection>&& connection, WeakPtrSecKeyProxyStore&& secKeyProxyStore)
     : m_coreAuthenticationChallenge(WTF::move(authenticationChallenge))
-    , m_listener(AuthenticationDecisionListener::create([challengeID, connection = WTF::move(connection), secKeyProxyStore = WTF::move(secKeyProxyStore)](AuthenticationChallengeDisposition disposition, const WebCore::Credential& credential) {
+    , m_listener(AuthenticationDecisionListener::create([challengeID, connection = WTF::move(connection), weakSecKeyProxyStore = WTF::move(secKeyProxyStore)](AuthenticationChallengeDisposition disposition, const WebCore::Credential& credential) {
 #if HAVE(SEC_KEY_PROXY)
-        if (secKeyProxyStore && secKeyProxyStore->initialize(credential)) {
+        if (RefPtr secKeyProxyStore = weakSecKeyProxyStore; secKeyProxyStore && secKeyProxyStore->initialize(credential)) {
             sendClientCertificateCredentialOverXpc(connection, *secKeyProxyStore, challengeID, credential);
             return;
         }
 #else
-        UNUSED_PARAM(secKeyProxyStore);
+        UNUSED_PARAM(weakSecKeyProxyStore);
 #endif
         connection->send(Messages::AuthenticationManager::CompleteAuthenticationChallenge(challengeID, disposition, credential), 0);
     }))
diff --git a/Source/WebKit/UIProcess/Automation/ios/WebAutomationSessionIOS.mm b/Source/WebKit/UIProcess/Automation/ios/WebAutomationSessionIOS.mm
index 9256ab2aafd9..740fd8b2b653 100644
--- a/Source/WebKit/UIProcess/Automation/ios/WebAutomationSessionIOS.mm
+++ b/Source/WebKit/UIProcess/Automation/ios/WebAutomationSessionIOS.mm
@@ -60,7 +60,7 @@
 
         case WebEventKeyDown:
         case WebEventKeyUp:
-            page.handleKeyboardEvent(NativeWebKeyboardEvent(event, NativeWebKeyboardEvent::HandledByInputMethod::No));
+            page.handleKeyboardEvent(NativeWebKeyboardEvent::create(event, NativeWebKeyboardEvent::HandledByInputMethod::No));
             break;
         }
     }
diff --git a/Source/WebKit/UIProcess/Automation/win/WebAutomationSessionWin.cpp b/Source/WebKit/UIProcess/Automation/win/WebAutomationSessionWin.cpp
index b0c024f61251..ab9a7c2e4e27 100644
--- a/Source/WebKit/UIProcess/Automation/win/WebAutomationSessionWin.cpp
+++ b/Source/WebKit/UIProcess/Automation/win/WebAutomationSessionWin.cpp
@@ -110,7 +110,7 @@ static void doMouseButtonEvent(WebPageProxy& page, MouseInteraction interaction,
     }
 
     auto hwnd = reinterpret_cast<HWND>(page.viewWidget());
-    page.handleMouseEvent(NativeWebMouseEvent(hwnd, message, wparam, lparam, { }, page.deviceScaleFactor()));
+    page.handleMouseEvent(NativeWebMouseEvent::create(hwnd, message, wparam, lparam, { }, page.deviceScaleFactor()));
 }
 
 void WebAutomationSession::platformSimulateMouseInteraction(WebPageProxy& page, MouseInteraction interaction, MouseButton button, const WebCore::IntPoint& locationInView, OptionSet<WebEventModifier> keyModifiers, const String& pointerType)
@@ -329,8 +329,8 @@ void WebAutomationSession::platformSimulateKeyboardInteraction(WebPageProxy& pag
     }
 
     auto hwnd = reinterpret_cast<HWND>(page.viewWidget());
-    NativeWebKeyboardEvent event(hwnd, message, wparam, lparam, { });
-    page.handleKeyboardEvent(event);
+    Ref event = NativeWebKeyboardEvent::create(hwnd, message, wparam, lparam, { });
+    page.handleKeyboardEvent(WTF::move(event));
 }
 
 OptionSet<WebEventModifier> WebAutomationSession::platformWebModifiersFromRaw(WebPageProxy&, unsigned modifiers)
@@ -359,8 +359,8 @@ void WebAutomationSession::platformSimulateKeySequence(WebPageProxy& page, const
     //        If we need that information, the 4th argument should be set to an appropriate value, not 0.
     // https://learn.microsoft.com/en-us/windows/win32/inputdev/wm-char
     // https://learn.microsoft.com/en-us/windows/win32/inputdev/about-keyboard-input#keystroke-message-flags
-    NativeWebKeyboardEvent event(hwnd, WM_CHAR, keySequence.codeUnitAt(0), 0, { });
-    page.handleKeyboardEvent(event);
+    Ref event = NativeWebKeyboardEvent::create(hwnd, WM_CHAR, keySequence.codeUnitAt(0), 0, { });
+    page.handleKeyboardEvent(WTF::move(event));
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit/UIProcess/Cocoa/GroupActivities/GroupActivitiesSessionNotifier.mm b/Source/WebKit/UIProcess/Cocoa/GroupActivities/GroupActivitiesSessionNotifier.mm
index 3b4681418c05..f4cbb853063b 100644
--- a/Source/WebKit/UIProcess/Cocoa/GroupActivities/GroupActivitiesSessionNotifier.mm
+++ b/Source/WebKit/UIProcess/Cocoa/GroupActivities/GroupActivitiesSessionNotifier.mm
@@ -65,7 +65,7 @@
         auto session = GroupActivitiesSession::create(groupSession);
         session->addStateChangeObserver(protectedThis->m_stateChangeObserver);
 
-        for (auto& page : copyToVector(protectedThis->m_webPages)) {
+        for (RefPtr page : copyToVector(protectedThis->m_webPages)) {
             if (page->mainFrame() && page->mainFrame()->url() == session->fallbackURL()) {
                 auto coordinator = GroupActivitiesCoordinator::create(session);
                 page->createMediaSessionCoordinator(WTF::move(coordinator), [] (bool) { });
diff --git a/Source/WebKit/UIProcess/Cocoa/NavigationState.mm b/Source/WebKit/UIProcess/Cocoa/NavigationState.mm
index 92993558dfe5..fe16d4528071 100644
--- a/Source/WebKit/UIProcess/Cocoa/NavigationState.mm
+++ b/Source/WebKit/UIProcess/Cocoa/NavigationState.mm
@@ -540,13 +540,14 @@ static void tryInterceptNavigation(Ref<API::NavigationAction>&& navigationAction
         auto* localCompletionHandler = new WTF::Function<void (bool)>([navigationAction = WTF::move(navigationAction), weakPage = WeakPtr { page }, completionHandler = WTF::move(completionHandler)] (bool success) mutable {
             ASSERT(RunLoop::isMain());
             RELEASE_LOG(Loading, "tryInterceptNavigation: LSAppLink openWithURL completed, success=%d", success);
-            if (!success && weakPage) {
-                trySOAuthorization(WTF::move(navigationAction), *weakPage, WTF::move(completionHandler));
+            RefPtr page = weakPage;
+            if (!success && page) {
+                trySOAuthorization(WTF::move(navigationAction), *page, WTF::move(completionHandler));
                 return;
             }
 #if PLATFORM(IOS_FAMILY)
-            if (success && weakPage)
-                weakPage->willOpenAppLink();
+            if (success && page)
+                page->willOpenAppLink();
 #endif
             completionHandler(success);
         });
diff --git a/Source/WebKit/UIProcess/Cocoa/UIDelegate.mm b/Source/WebKit/UIProcess/Cocoa/UIDelegate.mm
index e34eb7873be1..00f913e16442 100644
--- a/Source/WebKit/UIProcess/Cocoa/UIDelegate.mm
+++ b/Source/WebKit/UIProcess/Cocoa/UIDelegate.mm
@@ -589,10 +589,11 @@
         || uiDelegate->m_delegateMethods.webViewRequestGeolocationPermissionForOriginDecisionHandler) {
         Ref securityOrigin = WebCore::SecurityOrigin::create(page.pageLoadState().activeURL());
         auto checker = CompletionHandlerCallChecker::create(delegate.get(), @selector(_webView:requestGeolocationPermissionForOrigin:initiatedByFrame:decisionHandler:));
-        auto decisionHandler = makeBlockPtr([completionHandler = std::exchange(completionHandler, nullptr), securityOrigin = securityOrigin->data(), checker = WTF::move(checker), page = WeakPtr { page }] (WKPermissionDecision decision) mutable {
+        auto decisionHandler = makeBlockPtr([completionHandler = std::exchange(completionHandler, nullptr), securityOrigin = securityOrigin->data(), checker = WTF::move(checker), weakPage = WeakPtr { page }] (WKPermissionDecision decision) mutable {
             if (checker->completionHandlerHasBeenCalled())
                 return;
             checker->didCallCompletionHandler();
+            RefPtr page = weakPage;
             if (!page) {
                 completionHandler(false);
                 return;
@@ -1240,10 +1241,11 @@ static _WKAutoplayEvent NODELETE toWKAutoplayEvent(WebCore::AutoplayEvent event)
 
     RetainPtr delegate = uiDelegatePrivate();
     auto checker = CompletionHandlerCallChecker::create(delegate.get(), @selector(webView:requestDeviceOrientationAndMotionPermissionForOrigin:initiatedByFrame:decisionHandler:));
-    auto decisionHandler = makeBlockPtr([completionHandler = WTF::move(completionHandler), securityOrigin = securityOrigin->data(), checker = WTF::move(checker), page = WeakPtr { page }](WKPermissionDecision decision) mutable {
+    auto decisionHandler = makeBlockPtr([completionHandler = WTF::move(completionHandler), securityOrigin = securityOrigin->data(), checker = WTF::move(checker), weakPage = WeakPtr { page }](WKPermissionDecision decision) mutable {
         if (checker->completionHandlerHasBeenCalled())
             return;
         checker->didCallCompletionHandler();
+        RefPtr page = weakPage;
         if (!page) {
             completionHandler(false);
             return;
diff --git a/Source/WebKit/UIProcess/Cocoa/WKScreenTimeConfigurationObserver.mm b/Source/WebKit/UIProcess/Cocoa/WKScreenTimeConfigurationObserver.mm
index c61d2e27897c..20d7b095ec78 100644
--- a/Source/WebKit/UIProcess/Cocoa/WKScreenTimeConfigurationObserver.mm
+++ b/Source/WebKit/UIProcess/Cocoa/WKScreenTimeConfigurationObserver.mm
@@ -41,7 +41,7 @@
 
 static dispatch_queue_t screenTimeUpdateQueueSingleton()
 {
-    static NeverDestroyed<OSObjectPtr<dispatch_queue_t>> queue = adoptOSObject(dispatch_queue_create("com.apple.WebKit.ScreenTimeUpdateQueue", DISPATCH_QUEUE_SERIAL));
+    static NeverDestroyed<OSObjectPtr<dispatch_queue_t>> queue = adoptOSObject(dispatch_queue_create("com.apple.WebKit.ScreenTimeUpdateQueue", serialQueueWithAutoreleasePoolAttrSingleton()));
     return queue.get().get();
 }
 
diff --git a/Source/WebKit/UIProcess/Cocoa/WebPageProxyCocoa.mm b/Source/WebKit/UIProcess/Cocoa/WebPageProxyCocoa.mm
index 5b166051813a..e07ed6b6a822 100644
--- a/Source/WebKit/UIProcess/Cocoa/WebPageProxyCocoa.mm
+++ b/Source/WebKit/UIProcess/Cocoa/WebPageProxyCocoa.mm
@@ -2012,12 +2012,13 @@ static bool NODELETE exceedsRenderTreeSizeSizeThreshold(uint64_t thresholdSize,
     }
 
     for (auto& [process, frameIDs] : processFrames) {
-        protect(process)->sendWithAsyncReply(Messages::WebPage::GetWebArchivesForFrames(frameIDs), [frameIDs, callbackAggregator](auto&& result) {
+        Ref protectedProcess = process;
+        protectedProcess->sendWithAsyncReply(Messages::WebPage::GetWebArchivesForFrames(frameIDs), [frameIDs, callbackAggregator](auto&& result) {
             if (result.size() > frameIDs.size())
                 return;
 
             callbackAggregator->addResult(WTF::move(result));
-        }, webPageIDInProcess(process.get()));
+        }, webPageIDInProcess(protectedProcess));
     }
 }
 
@@ -2122,10 +2123,11 @@ void addResult(HashMap<FrameIdentifier, AttributedString>&& result)
 
     Ref aggregator = AttributedStringMapCallbackAggregator::create(WTF::move(completionHandler));
     for (auto& [process, frameIDs] : processFrames) {
-        protect(process)->sendWithAsyncReply(Messages::WebPage::GetContentsAsAttributedStringForFrames(frameIDs), [frameIDs, aggregator](auto&& result) {
+        Ref protectedProcess = process;
+        protectedProcess->sendWithAsyncReply(Messages::WebPage::GetContentsAsAttributedStringForFrames(frameIDs), [frameIDs, aggregator](auto&& result) {
             if (result.size() <= frameIDs.size())
                 aggregator->addResult(WTF::move(result));
-        }, webPageIDInProcess(process.get()));
+        }, webPageIDInProcess(protectedProcess));
     }
 }
 
diff --git a/Source/WebKit/UIProcess/Cocoa/WebPasteboardProxyCocoa.mm b/Source/WebKit/UIProcess/Cocoa/WebPasteboardProxyCocoa.mm
index 22590cd4932a..9586a47c026b 100644
--- a/Source/WebKit/UIProcess/Cocoa/WebPasteboardProxyCocoa.mm
+++ b/Source/WebKit/UIProcess/Cocoa/WebPasteboardProxyCocoa.mm
@@ -1123,11 +1123,12 @@ static bool validateFrameIdentifiers(FrameIdentifier rootFrameIdentifier, const
     }
 
     for (auto& [process, frameIDs] : frameByProcess) {
-        Ref { process }->sendWithAsyncReply(Messages::WebPage::GetWebArchivesForFrames(frameIDs), [frameIDs, callbackAggregator](auto&& result) {
+        Ref protectedProcess = process;
+        protectedProcess->sendWithAsyncReply(Messages::WebPage::GetWebArchivesForFrames(frameIDs), [frameIDs, callbackAggregator](auto&& result) {
             if (result.size() > frameIDs.size())
                 return;
             callbackAggregator->addResult(WTF::move(result));
-        }, webPage->webPageIDInProcess(process.get()));
+        }, webPage->webPageIDInProcess(protectedProcess));
     }
 }
 
diff --git a/Source/WebKit/UIProcess/Cocoa/WebProcessPoolCocoa.mm b/Source/WebKit/UIProcess/Cocoa/WebProcessPoolCocoa.mm
index b0c42f071a45..dc6b3f01eef0 100644
--- a/Source/WebKit/UIProcess/Cocoa/WebProcessPoolCocoa.mm
+++ b/Source/WebKit/UIProcess/Cocoa/WebProcessPoolCocoa.mm
@@ -290,7 +290,7 @@ static AccessibilityPreferences accessibilityPreferences()
 #if HAVE(MEDIA_ACCESSIBILITY_FRAMEWORK)
 void WebProcessPool::setMediaAccessibilityPreferences(WebProcessProxy& process)
 {
-    static NeverDestroyed<OSObjectPtr<dispatch_queue_t>> mediaAccessibilityQueue = adoptOSObject(dispatch_queue_create("MediaAccessibility queue", DISPATCH_QUEUE_SERIAL));
+    static NeverDestroyed<OSObjectPtr<dispatch_queue_t>> mediaAccessibilityQueue = adoptOSObject(dispatch_queue_create("MediaAccessibility queue", serialQueueWithAutoreleasePoolAttrSingleton()));
 
     dispatch_async(mediaAccessibilityQueue.get().get(), [weakThis = WeakPtr { *this }, weakProcess = WeakPtr { process }] mutable {
         auto captionDisplayMode = WebCore::CaptionUserPreferencesMediaAF::platformCaptionDisplayMode();
@@ -459,10 +459,11 @@ static void logProcessPoolState(const WebProcessPool& pool)
     parameters.shouldLogUserInteraction = [defaults boolForKey:WebKitLogCookieInformationDefaultsKey];
 #endif
 
-    auto screenProperties = WebCore::collectScreenProperties();
-    parameters.screenProperties = WTF::move(screenProperties);
 #if PLATFORM(MAC)
+    parameters.screenProperties = cachedScreenProperties();
     parameters.useOverlayScrollbars = ([NSScroller preferredScrollerStyle] == NSScrollerStyleOverlay);
+#else
+    parameters.screenProperties = WebCore::collectScreenProperties();
 #endif
 
 #if PLATFORM(VISION)
@@ -1302,16 +1303,32 @@ void setLockdownModeEnabledGloballyForTesting(std::optional<bool> enabledForTest
 {
     m_lastScreenPropertiesUpdateTime = ApproximateTime::now();
 
-    auto screenProperties = WebCore::collectScreenProperties();
-#if HAVE(SUPPORT_HDR_DISPLAY)
-    if (m_suppressEDR) {
-        for (auto& properties : screenProperties.screenDataMap.values()) {
-            constexpr auto maxSuppressedHeadroom = 1.6f;
-            auto suppressedHeadroom = std::min(maxSuppressedHeadroom, properties.currentEDRHeadroom);
-            properties.currentEDRHeadroom = suppressedHeadroom;
-            properties.suppressEDR = true;
-        }
+    if (m_screenPropertiesState != ScreenPropertiesState::Idle) {
+        m_screenPropertiesState = ScreenPropertiesState::CollectingWithUpdatePending;
+        return;
     }
+
+    m_screenPropertiesState = ScreenPropertiesState::Collecting;
+    WebCore::collectScreenPropertiesAsync([weakThis = WeakPtr { *this }](WebCore::ScreenProperties&& screenProperties) {
+        if (RefPtr protectedThis = weakThis.get())
+            protectedThis->didCollectScreenProperties(WTF::move(screenProperties));
+    });
+}
+
+void WebProcessPool::didCollectScreenProperties(WebCore::ScreenProperties&& screenProperties)
+{
+    ASSERT(m_screenPropertiesState != ScreenPropertiesState::Idle);
+
+    // If we got a screen change notification while collecting screen properties, then we need to
+    // schedule another screen properties update to reflect the most recent state.
+    bool needsUpdate = m_screenPropertiesState == ScreenPropertiesState::CollectingWithUpdatePending;
+
+    m_screenPropertiesState = ScreenPropertiesState::Idle;
+
+    applyEDRSuppressionIfNeeded(screenProperties);
+
+#if PLATFORM(MAC)
+    m_cachedScreenProperties = screenProperties;
 #endif
 
     sendToAllProcesses(Messages::WebProcess::SetScreenProperties(screenProperties));
@@ -1320,7 +1337,39 @@ void setLockdownModeEnabledGloballyForTesting(std::optional<bool> enabledForTest
     if (RefPtr gpuProcess = this->gpuProcess())
         gpuProcess->setScreenProperties(screenProperties);
 #endif
+
+    if (needsUpdate)
+        screenPropertiesChanged();
+}
+
+void WebProcessPool::applyEDRSuppressionIfNeeded(WebCore::ScreenProperties& screenProperties)
+{
+#if HAVE(SUPPORT_HDR_DISPLAY)
+    if (!m_suppressEDR)
+        return;
+
+    for (auto& properties : screenProperties.screenDataMap.values()) {
+        constexpr auto maxSuppressedHeadroom = 1.6f;
+        properties.currentEDRHeadroom = std::min(maxSuppressedHeadroom, properties.currentEDRHeadroom);
+        properties.suppressEDR = true;
+    }
+#else
+    UNUSED_PARAM(screenProperties);
+#endif
+}
+
+#if PLATFORM(MAC)
+const WebCore::ScreenProperties& WebProcessPool::cachedScreenProperties()
+{
+    if (!m_cachedScreenProperties) {
+        auto screenProperties = WebCore::collectScreenProperties();
+        applyEDRSuppressionIfNeeded(screenProperties);
+        m_cachedScreenProperties = WTF::move(screenProperties);
+    }
+
+    return *m_cachedScreenProperties;
 }
+#endif
 
 void WebProcessPool::screenPropertiesChanged()
 {
diff --git a/Source/WebKit/UIProcess/Cocoa/WebProcessProxyCocoa.mm b/Source/WebKit/UIProcess/Cocoa/WebProcessProxyCocoa.mm
index f1bdd2b210bf..de6059310e3a 100644
--- a/Source/WebKit/UIProcess/Cocoa/WebProcessProxyCocoa.mm
+++ b/Source/WebKit/UIProcess/Cocoa/WebProcessProxyCocoa.mm
@@ -222,10 +222,8 @@
             return;
         
         RunLoop::mainSingleton().dispatch([weakThis = WTF::move(weakThis), registrations = WTF::move(registrations)] () mutable {
-            if (!weakThis)
-                return;
-
-            weakThis->send(Messages::WebProcess::ConsumeAudioComponentRegistrations(IPC::SharedBufferReference(WTF::move(registrations))), 0);
+            if (RefPtr protectedThis = weakThis)
+                protectedThis->send(Messages::WebProcess::ConsumeAudioComponentRegistrations(IPC::SharedBufferReference(WTF::move(registrations))), 0);
         });
     });
 }
diff --git a/Source/WebKit/UIProcess/Downloads/DownloadProxy.cpp b/Source/WebKit/UIProcess/Downloads/DownloadProxy.cpp
index 6537111d8f97..13751ab4dd64 100644
--- a/Source/WebKit/UIProcess/Downloads/DownloadProxy.cpp
+++ b/Source/WebKit/UIProcess/Downloads/DownloadProxy.cpp
@@ -87,12 +87,13 @@ void DownloadProxy::cancel(CompletionHandler<void(API::Data*)>&& completionHandl
     m_downloadIsCancelled = true;
     if (m_dataStore) {
         protect(protect(m_dataStore)->networkProcess())->sendWithAsyncReply(Messages::NetworkProcess::CancelDownload(m_downloadID), [weakThis = WeakPtr { *this }, completionHandler = WTF::move(completionHandler)] (std::span<const uint8_t> resumeData) mutable {
-            RefPtr protectedThis = weakThis.get();
+            RefPtr protectedThis = weakThis;
             if (!protectedThis)
                 return completionHandler(nullptr);
-            protectedThis->m_legacyResumeData = createData(resumeData);
-            completionHandler(protectedThis->m_legacyResumeData.get());
-            if (RefPtr downloadProxyMap = protectedThis->m_downloadProxyMap.get())
+            RefPtr legacyResumeData = createData(resumeData);
+            protectedThis->m_legacyResumeData = legacyResumeData;
+            completionHandler(legacyResumeData);
+            if (RefPtr downloadProxyMap = protectedThis->m_downloadProxyMap)
                 downloadProxyMap->downloadFinished(*protectedThis);
         });
     } else
@@ -248,7 +249,7 @@ void DownloadProxy::didFinish()
         return;
 
     // This can cause the DownloadProxy object to be deleted.
-    if (RefPtr downloadProxyMap = m_downloadProxyMap.get())
+    if (RefPtr downloadProxyMap = m_downloadProxyMap)
         downloadProxyMap->downloadFinished(*this);
 }
 
@@ -257,12 +258,13 @@ void DownloadProxy::didFail(const ResourceError& error, std::span<const uint8_t>
     if (m_downloadIsCancelled)
         return;
 
-    m_legacyResumeData = createData(resumeData);
+    RefPtr legacyResumeData = createData(resumeData);
+    m_legacyResumeData = legacyResumeData;
 
-    protect(client())->didFail(*this, error, m_legacyResumeData.get());
+    protect(client())->didFail(*this, error, legacyResumeData);
 
     // This can cause the DownloadProxy object to be deleted.
-    if (RefPtr downloadProxyMap = m_downloadProxyMap.get())
+    if (RefPtr downloadProxyMap = m_downloadProxyMap)
         downloadProxyMap->downloadFinished(*this);
 }
 
diff --git a/Source/WebKit/UIProcess/Extensions/Cocoa/API/WebExtensionContextAPIDevToolsInspectedWindow.mm b/Source/WebKit/UIProcess/Extensions/Cocoa/API/WebExtensionContextAPIDevToolsInspectedWindow.mm
index 935c0a41e771..fa91ff2726b8 100644
--- a/Source/WebKit/UIProcess/Extensions/Cocoa/API/WebExtensionContextAPIDevToolsInspectedWindow.mm
+++ b/Source/WebKit/UIProcess/Extensions/Cocoa/API/WebExtensionContextAPIDevToolsInspectedWindow.mm
@@ -34,13 +34,14 @@
 
 #import "APIInspectorExtension.h"
 #import "JavaScriptEvaluationResult.h"
+#import "RunJavaScriptResult.h"
 #import "WebExtensionContextProxyMessages.h"
 #import "WebExtensionUtilities.h"
 #import <WebCore/ExceptionDetails.h>
 
 namespace WebKit {
 
-void WebExtensionContext::devToolsInspectedWindowEval(WebPageProxyIdentifier webPageProxyIdentifier, const String& scriptSource, const std::optional<URL>& frameURL, CompletionHandler<void(Expected<Expected<JavaScriptEvaluationResult, std::optional<WebCore::ExceptionDetails>>, WebExtensionError>&&)>&& completionHandler)
+void WebExtensionContext::devToolsInspectedWindowEval(WebPageProxyIdentifier webPageProxyIdentifier, const String& scriptSource, const std::optional<URL>& frameURL, CompletionHandler<void(Expected<RunJavaScriptResult, WebExtensionError>&&)>&& completionHandler)
 {
     static NSString * const apiName = @"devtools.inspectedWindow.eval()";
 
diff --git a/Source/WebKit/UIProcess/Extensions/Cocoa/API/WebExtensionContextAPIOffscreenCocoa.mm b/Source/WebKit/UIProcess/Extensions/Cocoa/API/WebExtensionContextAPIOffscreenCocoa.mm
index b8ec9d3c6cca..3da62b429ce8 100644
--- a/Source/WebKit/UIProcess/Extensions/Cocoa/API/WebExtensionContextAPIOffscreenCocoa.mm
+++ b/Source/WebKit/UIProcess/Extensions/Cocoa/API/WebExtensionContextAPIOffscreenCocoa.mm
@@ -49,6 +49,17 @@
     return false;
 }
 
+#if PLATFORM(IOS_FAMILY)
+static UIWindowScene *windowScene()
+{
+    for (UIScene *scene in UIApplication.sharedApplication.connectedScenes) {
+        if ([scene isKindOfClass:UIWindowScene.class] && (scene.activationState == UISceneActivationStateForegroundActive || scene.activationState == UISceneActivationStateForegroundInactive))
+            return dynamic_objc_cast<UIWindowScene>(scene);
+    }
+    return nil;
+}
+#endif
+
 void WebExtensionContext::offscreenCreateDocument(const WebExtensionOffscreenDocumentParameters& parameters, CompletionHandler<void(Expected<void, WebExtensionError>&&)>&& completionHandler)
 {
     static constexpr auto apiName = "offscreen.createDocument()"_s;
@@ -92,7 +103,7 @@
     m_offscreenWebViewWindow = adoptNS([[NSWindow alloc] initWithContentRect:NSZeroRect styleMask:NSWindowStyleMaskBorderless backing:NSBackingStoreBuffered defer:NO]);
     [m_offscreenWebViewWindow.get().contentView addSubview:m_offscreenWebView.get()];
 #elif PLATFORM(IOS_FAMILY)
-    m_offscreenWebViewWindow = adoptNS([[UIWindow alloc] initWithFrame:CGRectZero]);
+    m_offscreenWebViewWindow = adoptNS([[UIWindow alloc] initWithWindowScene:windowScene()]);
     [m_offscreenWebViewWindow.get() addSubview:m_offscreenWebView.get()];
 #endif
 
diff --git a/Source/WebKit/UIProcess/Extensions/Cocoa/WebExtensionMenuItemCocoa.mm b/Source/WebKit/UIProcess/Extensions/Cocoa/WebExtensionMenuItemCocoa.mm
index 0f06bf34d011..bb8e8bb840c3 100644
--- a/Source/WebKit/UIProcess/Extensions/Cocoa/WebExtensionMenuItemCocoa.mm
+++ b/Source/WebKit/UIProcess/Extensions/Cocoa/WebExtensionMenuItemCocoa.mm
@@ -100,8 +100,6 @@ + (BOOL)usesUserKeyEquivalents
     , m_enabled(parameters.enabled.value_or(true))
     , m_visible(parameters.visible.value_or(true))
 {
-    relaxAdoptionRequirement();
-
     if (parameters.parentIdentifier) {
         if (RefPtr parentMenuItem = extensionContext.menuItem(parameters.parentIdentifier.value()))
             parentMenuItem->addSubmenuItem(*this);
diff --git a/Source/WebKit/UIProcess/Extensions/WebExtensionContext.h b/Source/WebKit/UIProcess/Extensions/WebExtensionContext.h
index 820c029f2552..f9535c1946c5 100644
--- a/Source/WebKit/UIProcess/Extensions/WebExtensionContext.h
+++ b/Source/WebKit/UIProcess/Extensions/WebExtensionContext.h
@@ -33,6 +33,7 @@
 #include "APIUserStyleSheet.h"
 #include "MessageReceiver.h"
 #include "ProcessActivityGroup.h"
+#include "RunJavaScriptResult.h"
 #include "WebExtension.h"
 #include "WebExtensionAction.h"
 #include "WebExtensionAlarm.h"
@@ -921,7 +922,7 @@ class WebExtensionContext : public API::ObjectImpl<API::Object::Type::WebExtensi
     // DevTools APIs
     bool isDevToolsMessageAllowed(IPC::Decoder&);
     void devToolsPanelsCreate(WebPageProxyIdentifier, const String& title, const String& iconPath, const String& pagePath, CompletionHandler<void(Expected<Inspector::ExtensionTabID, WebExtensionError>&&)>&&);
-    void devToolsInspectedWindowEval(WebPageProxyIdentifier, const String& scriptSource, const std::optional<URL>& frameURL, CompletionHandler<void(Expected<Expected<JavaScriptEvaluationResult, std::optional<WebCore::ExceptionDetails>>, WebExtensionError>&&)>&&);
+    void devToolsInspectedWindowEval(WebPageProxyIdentifier, const String& scriptSource, const std::optional<URL>& frameURL, CompletionHandler<void(Expected<RunJavaScriptResult, WebExtensionError>&&)>&&);
     void devToolsInspectedWindowReload(WebPageProxyIdentifier, const std::optional<bool>& ignoreCache);
 #endif
 
diff --git a/Source/WebKit/UIProcess/GPU/GPUProcessProxy.cpp b/Source/WebKit/UIProcess/GPU/GPUProcessProxy.cpp
index a2038d17fe80..802b47eb419f 100644
--- a/Source/WebKit/UIProcess/GPU/GPUProcessProxy.cpp
+++ b/Source/WebKit/UIProcess/GPU/GPUProcessProxy.cpp
@@ -827,13 +827,15 @@ void GPUProcessProxy::updatePreferences(WebProcessProxy& webProcess)
     send(Messages::GPUProcess::UpdateGPUProcessPreferences(gpuPreferences), 0);
 }
 
-void GPUProcessProxy::updateScreenPropertiesIfNeeded()
+void GPUProcessProxy::updateScreenPropertiesIfNeeded(WebProcessPool& processPool)
 {
 #if PLATFORM(MAC)
     if (!canSendMessage())
         return;
 
-    setScreenProperties(collectScreenProperties());
+    setScreenProperties(processPool.cachedScreenProperties());
+#else
+    UNUSED_PARAM(processPool);
 #endif
 }
 
diff --git a/Source/WebKit/UIProcess/GPU/GPUProcessProxy.h b/Source/WebKit/UIProcess/GPU/GPUProcessProxy.h
index 962632397c45..a53b1f8919ac 100644
--- a/Source/WebKit/UIProcess/GPU/GPUProcessProxy.h
+++ b/Source/WebKit/UIProcess/GPU/GPUProcessProxy.h
@@ -73,6 +73,7 @@ enum class ProcessTerminationReason : uint8_t;
 
 class SandboxExtensionHandle;
 class WebPageProxy;
+class WebProcessPool;
 class WebProcessProxy;
 class WebsiteDataStore;
 
@@ -141,7 +142,7 @@ class GPUProcessProxy final : public AuxiliaryProcessProxy {
 #endif
 
     void updatePreferences(WebProcessProxy&);
-    void updateScreenPropertiesIfNeeded();
+    void updateScreenPropertiesIfNeeded(WebProcessPool&);
 
     void childConnectionDidBecomeUnresponsive();
 
diff --git a/Source/WebKit/UIProcess/Inspector/Agents/InspectorBrowserAgent.cpp b/Source/WebKit/UIProcess/Inspector/Agents/InspectorBrowserAgent.cpp
index 6b68da9c80ee..21d6f97b478a 100644
--- a/Source/WebKit/UIProcess/Inspector/Agents/InspectorBrowserAgent.cpp
+++ b/Source/WebKit/UIProcess/Inspector/Agents/InspectorBrowserAgent.cpp
@@ -47,7 +47,7 @@ WTF_MAKE_TZONE_ALLOCATED_IMPL(InspectorBrowserAgent);
 InspectorBrowserAgent::InspectorBrowserAgent(WebPageAgentContext& context)
     : InspectorAgentBase("Browser"_s, context)
     , m_frontendDispatcher(makeUniqueRef<Inspector::BrowserFrontendDispatcher>(context.frontendRouter.get()))
-    , m_backendDispatcher(Inspector::BrowserBackendDispatcher::create(context.backendDispatcher.get(), this))
+    , m_backendDispatcher(Inspector::BrowserBackendDispatcher::create(protect(context.backendDispatcher), this))
     , m_inspectedPage(context.inspectedPage)
 {
 }
diff --git a/Source/WebKit/UIProcess/Inspector/Agents/InspectorStorageAgent.cpp b/Source/WebKit/UIProcess/Inspector/Agents/InspectorStorageAgent.cpp
index 587be589cf33..705bf3e7f59c 100644
--- a/Source/WebKit/UIProcess/Inspector/Agents/InspectorStorageAgent.cpp
+++ b/Source/WebKit/UIProcess/Inspector/Agents/InspectorStorageAgent.cpp
@@ -100,7 +100,7 @@ static Ref<JSON::ArrayOf<Cookie>> buildArrayForCookies(const Vector<WebCore::Coo
 
 InspectorStorageAgent::InspectorStorageAgent(WebPageAgentContext& context)
     : InspectorAgentBase("Storage"_s, context)
-    , m_backendDispatcher(Inspector::StorageBackendDispatcher::create(context.backendDispatcher.get(), this))
+    , m_backendDispatcher(Inspector::StorageBackendDispatcher::create(protect(context.backendDispatcher), this))
     , m_inspectedPage(context.inspectedPage)
 {
 }
diff --git a/Source/WebKit/UIProcess/Inspector/Agents/ProxyingNetworkAgent.cpp b/Source/WebKit/UIProcess/Inspector/Agents/ProxyingNetworkAgent.cpp
index 71f8a986d6ff..30a25f14c222 100644
--- a/Source/WebKit/UIProcess/Inspector/Agents/ProxyingNetworkAgent.cpp
+++ b/Source/WebKit/UIProcess/Inspector/Agents/ProxyingNetworkAgent.cpp
@@ -157,7 +157,7 @@ static RefPtr<Protocol::Network::Response> buildObjectForResourceResponse(const
 ProxyingNetworkAgent::ProxyingNetworkAgent(WebKit::WebPageAgentContext& context)
     : InspectorAgentBase("Network"_s, context)
     , m_frontendDispatcher(makeUniqueRef<NetworkFrontendDispatcher>(context.frontendRouter))
-    , m_backendDispatcher(NetworkBackendDispatcher::create(context.backendDispatcher, this))
+    , m_backendDispatcher(NetworkBackendDispatcher::create(protect(context.backendDispatcher), this))
     , m_inspectedPage(context.inspectedPage)
 {
 }
diff --git a/Source/WebKit/UIProcess/Inspector/Agents/ProxyingPageAgent.cpp b/Source/WebKit/UIProcess/Inspector/Agents/ProxyingPageAgent.cpp
index 511f2c457e0d..bbefd3268595 100644
--- a/Source/WebKit/UIProcess/Inspector/Agents/ProxyingPageAgent.cpp
+++ b/Source/WebKit/UIProcess/Inspector/Agents/ProxyingPageAgent.cpp
@@ -51,7 +51,7 @@ WTF_MAKE_TZONE_ALLOCATED_IMPL(ProxyingPageAgent);
 ProxyingPageAgent::ProxyingPageAgent(WebPageAgentContext& context)
     : InspectorAgentBase("Page"_s, context)
     , m_frontendDispatcher(makeUniqueRef<PageFrontendDispatcher>(context.frontendRouter))
-    , m_backendDispatcher(PageBackendDispatcher::create(context.backendDispatcher, this))
+    , m_backendDispatcher(PageBackendDispatcher::create(protect(context.backendDispatcher), this))
     , m_inspectedPage(context.inspectedPage)
 {
 }
diff --git a/Source/WebKit/UIProcess/Inspector/WebInspectorUIExtensionControllerProxy.cpp b/Source/WebKit/UIProcess/Inspector/WebInspectorUIExtensionControllerProxy.cpp
index ef93399ff06f..5fff855b54e2 100644
--- a/Source/WebKit/UIProcess/Inspector/WebInspectorUIExtensionControllerProxy.cpp
+++ b/Source/WebKit/UIProcess/Inspector/WebInspectorUIExtensionControllerProxy.cpp
@@ -32,6 +32,7 @@
 #include "APIURL.h"
 #include "JavaScriptEvaluationResult.h"
 #include "MessageSenderInlines.h"
+#include "RunJavaScriptResult.h"
 #include "WebInspectorUIExtensionControllerMessages.h"
 #include "WebInspectorUIExtensionControllerProxyMessages.h"
 #include "WebPageProxy.h"
@@ -170,7 +171,7 @@ void WebInspectorUIExtensionControllerProxy::evaluateScriptForExtension(const In
             return;
         }
 
-        protect(protect(weakThis->m_inspectorPage)->legacyMainFrameProcess())->sendWithAsyncReply(Messages::WebInspectorUIExtensionController::EvaluateScriptForExtension { extensionID, scriptSource, frameURL, contextSecurityOrigin, useContentScriptContext }, [completionHandler = WTF::move(completionHandler)](Expected<WebKit::JavaScriptEvaluationResult, std::optional<WebCore::ExceptionDetails>>&& result, const std::optional<Inspector::ExtensionError> error) mutable {
+        protect(protect(weakThis->m_inspectorPage)->legacyMainFrameProcess())->sendWithAsyncReply(Messages::WebInspectorUIExtensionController::EvaluateScriptForExtension { extensionID, scriptSource, frameURL, contextSecurityOrigin, useContentScriptContext }, [completionHandler = WTF::move(completionHandler)](RunJavaScriptResult&& result, const std::optional<Inspector::ExtensionError> error) mutable {
             if (error)
                 return completionHandler(makeUnexpected(error.value()));
 
@@ -232,7 +233,7 @@ void WebInspectorUIExtensionControllerProxy::evaluateScriptInExtensionTab(const
             return;
         }
 
-        protect(protect(weakThis->m_inspectorPage)->legacyMainFrameProcess())->sendWithAsyncReply(Messages::WebInspectorUIExtensionController::EvaluateScriptInExtensionTab { extensionTabID, scriptSource }, [completionHandler = WTF::move(completionHandler)](Expected<WebKit::JavaScriptEvaluationResult, std::optional<WebCore::ExceptionDetails>>&& result, const std::optional<Inspector::ExtensionError>& error) mutable {
+        protect(protect(weakThis->m_inspectorPage)->legacyMainFrameProcess())->sendWithAsyncReply(Messages::WebInspectorUIExtensionController::EvaluateScriptInExtensionTab { extensionTabID, scriptSource }, [completionHandler = WTF::move(completionHandler)](RunJavaScriptResult&& result, const std::optional<Inspector::ExtensionError>& error) mutable {
             if (error)
                 return completionHandler(makeUnexpected(error.value()));
             completionHandler(WTF::move(result));
diff --git a/Source/WebKit/UIProcess/PageLoadState.cpp b/Source/WebKit/UIProcess/PageLoadState.cpp
index ac8c2bc26037..d595ec404266 100644
--- a/Source/WebKit/UIProcess/PageLoadState.cpp
+++ b/Source/WebKit/UIProcess/PageLoadState.cpp
@@ -483,9 +483,10 @@ void PageLoadState::callObserverCallback(void (Observer::*callback)())
 {
     Ref protectedPage { m_webPageProxy.get() };
 
-    for (auto& observer : copyToVector(m_observers)) {
+    for (auto& weakObserver : copyToVector(m_observers)) {
         // This appears potentially inefficient on the surface (searching in a Vector)
         // but in practice - using only API - there will only ever be (1) observer.
+        RefPtr observer = weakObserver;
         if (!observer || !m_observers.contains(*observer))
             continue;
 
diff --git a/Source/WebKit/UIProcess/ProcessThrottler.cpp b/Source/WebKit/UIProcess/ProcessThrottler.cpp
index 86ee2c4f5bcb..34c359fb88d0 100644
--- a/Source/WebKit/UIProcess/ProcessThrottler.cpp
+++ b/Source/WebKit/UIProcess/ProcessThrottler.cpp
@@ -330,15 +330,15 @@ void ProcessThrottler::acquireAssertion(ProcessAssertionType newType)
         if (m_shouldTakeUIBackgroundAssertion) {
             Ref assertion = ProcessAndUIAssertion::create(process, assertionName(newType), newType, ProcessAssertion::Mode::Async, [previousAssertion = WTF::move(previousAssertion)] { });
             assertion->setUIAssertionExpirationHandler([weakThis = WeakPtr { *this }] {
-                if (weakThis)
-                    weakThis->uiAssertionWillExpireImminently();
+                if (RefPtr protectedThis = weakThis)
+                    protectedThis->uiAssertionWillExpireImminently();
             });
             m_assertion = WTF::move(assertion);
         } else
             m_assertion = ProcessAssertion::create(process, assertionName(newType), newType, ProcessAssertion::Mode::Async, [previousAssertion = WTF::move(previousAssertion)] { });
     }
     RefPtr { m_assertion }->setInvalidationHandler([weakThis = WeakPtr { *this }] {
-        if (RefPtr protectedThis = weakThis.get())
+        if (RefPtr protectedThis = weakThis)
             protectedThis->assertionWasInvalidated();
     });
 
diff --git a/Source/WebKit/UIProcess/ProvisionalPageProxy.cpp b/Source/WebKit/UIProcess/ProvisionalPageProxy.cpp
index 0c7d5b24a3f1..cb3cc68c400b 100644
--- a/Source/WebKit/UIProcess/ProvisionalPageProxy.cpp
+++ b/Source/WebKit/UIProcess/ProvisionalPageProxy.cpp
@@ -106,7 +106,6 @@ ProvisionalPageProxy::ProvisionalPageProxy(WebPageProxy& page, Ref<FrameProcess>
 #endif
 #endif
 {
-    relaxAdoptionRequirement();
     PROVISIONALPAGEPROXY_RELEASE_LOG(ProcessSwapping, "ProvisionalPageProxy: suspendedPage=%p", suspendedPage.get());
 
     Ref process = this->process();
@@ -137,7 +136,7 @@ ProvisionalPageProxy::ProvisionalPageProxy(WebPageProxy& page, Ref<FrameProcess>
     } else {
         // Passing previous frame's url to restore the main frame's committed URL
         // as some clients may rely on it until the next load is committed.
-        Ref mainFrame = WebFrameProxy::create(page, m_frameProcess, generateFrameIdentifier(), previousMainFrame->effectiveSandboxFlags(), ReferrerPolicy::EmptyString, previousMainFrame->scrollingMode(), nullptr, nullptr, IsMainFrame::Yes, previousMainFrame->url());
+        Ref mainFrame = WebFrameProxy::create(page, protect(m_frameProcess), generateFrameIdentifier(), previousMainFrame->effectiveSandboxFlags(), ReferrerPolicy::EmptyString, previousMainFrame->scrollingMode(), nullptr, nullptr, IsMainFrame::Yes, previousMainFrame->url());
         m_mainFrame = mainFrame.copyRef();
         previousMainFrame->transferNavigationCallbackToFrame(mainFrame);
     }
@@ -305,7 +304,7 @@ void ProvisionalPageProxy::initializeWebPage(RefPtr<API::WebsitePolicies>&& webs
             } else
                 m_takenRemotePage = WTF::move(existingRemotePageProxy);
         }
-        m_browsingContextGroup->addFrameProcessAndInjectPageContextIf(m_frameProcess, [m_page = m_page](WebPageProxy& page) {
+        m_browsingContextGroup->addFrameProcessAndInjectPageContextIf(protect(m_frameProcess), [m_page = m_page](WebPageProxy& page) {
             return m_page != &page;
         });
     }
diff --git a/Source/WebKit/UIProcess/RemoteLayerTree/RemoteScrollingCoordinatorProxy.cpp b/Source/WebKit/UIProcess/RemoteLayerTree/RemoteScrollingCoordinatorProxy.cpp
index 44ac17408dc0..c01fe3857dc0 100644
--- a/Source/WebKit/UIProcess/RemoteLayerTree/RemoteScrollingCoordinatorProxy.cpp
+++ b/Source/WebKit/UIProcess/RemoteLayerTree/RemoteScrollingCoordinatorProxy.cpp
@@ -219,7 +219,7 @@ void RemoteScrollingCoordinatorProxy::stickyScrollingTreeNodeBeganSticking(Scrol
     protect(webPageProxy())->stickyScrollingTreeNodeBeganSticking();
 }
 
-void RemoteScrollingCoordinatorProxy::handleWheelEvent(const WebWheelEvent& wheelEvent, RectEdges<WebCore::RubberBandingBehavior> rubberBandableEdges)
+void RemoteScrollingCoordinatorProxy::handleWheelEvent(Ref<WebWheelEvent>&& wheelEvent, RectEdges<WebCore::RubberBandingBehavior> rubberBandableEdges)
 {
 #if !(PLATFORM(MAC) && ENABLE(UI_SIDE_COMPOSITING))
     auto platformWheelEvent = platform(wheelEvent);
@@ -231,7 +231,7 @@ void RemoteScrollingCoordinatorProxy::handleWheelEvent(const WebWheelEvent& whee
 
     auto processingSteps = m_scrollingTree->determineWheelEventProcessing(platformWheelEvent);
     if (!processingSteps.contains(WheelEventProcessingSteps::AsyncScrolling)) {
-        continueWheelEventHandling(wheelEvent, { processingSteps, false });
+        continueWheelEventHandling(WTF::move(wheelEvent), { processingSteps, false });
         return;
     }
 
@@ -241,17 +241,17 @@ void RemoteScrollingCoordinatorProxy::handleWheelEvent(const WebWheelEvent& whee
     auto result = m_scrollingTree->handleWheelEvent(filteredEvent, processingSteps);
     didReceiveWheelEvent(result.wasHandled);
 
-    continueWheelEventHandling(wheelEvent, result);
+    continueWheelEventHandling(WTF::move(wheelEvent), result);
 #else
     UNUSED_PARAM(wheelEvent);
     UNUSED_PARAM(rubberBandableEdges);
 #endif
 }
 
-void RemoteScrollingCoordinatorProxy::continueWheelEventHandling(const WebWheelEvent& wheelEvent, WheelEventHandlingResult result)
+void RemoteScrollingCoordinatorProxy::continueWheelEventHandling(Ref<WebWheelEvent>&& wheelEvent, WheelEventHandlingResult result)
 {
     bool willStartSwipe = m_scrollingTree->willWheelEventStartSwipeGesture(platform(wheelEvent));
-    protect(webPageProxy())->continueWheelEventHandling(wheelEvent, result, willStartSwipe);
+    protect(webPageProxy())->continueWheelEventHandling(WTF::move(wheelEvent), result, willStartSwipe);
 }
 
 TrackingType RemoteScrollingCoordinatorProxy::eventTrackingTypeForPoint(WebCore::EventTrackingRegions::EventType eventType, IntPoint p) const
diff --git a/Source/WebKit/UIProcess/RemoteLayerTree/RemoteScrollingCoordinatorProxy.h b/Source/WebKit/UIProcess/RemoteLayerTree/RemoteScrollingCoordinatorProxy.h
index e8bfb5d3ba3e..9a14ccabf840 100644
--- a/Source/WebKit/UIProcess/RemoteLayerTree/RemoteScrollingCoordinatorProxy.h
+++ b/Source/WebKit/UIProcess/RemoteLayerTree/RemoteScrollingCoordinatorProxy.h
@@ -106,8 +106,8 @@ class RemoteScrollingCoordinatorProxy : public CanMakeWeakPtr<RemoteScrollingCoo
     void currentSnapPointIndicesDidChange(WebCore::ScrollingNodeID, std::optional<unsigned> horizontal, std::optional<unsigned> vertical);
 
     virtual void cacheWheelEventScrollingAccelerationCurve(const NativeWebWheelEvent&) { }
-    virtual void handleWheelEvent(const WebWheelEvent&, WebCore::RectEdges<WebCore::RubberBandingBehavior> rubberBandableEdges);
-    void continueWheelEventHandling(const WebWheelEvent&, WebCore::WheelEventHandlingResult);
+    virtual void handleWheelEvent(Ref<WebWheelEvent>&&, WebCore::RectEdges<WebCore::RubberBandingBehavior> rubberBandableEdges);
+    void continueWheelEventHandling(Ref<WebWheelEvent>&&, WebCore::WheelEventHandlingResult);
     virtual void wheelEventHandlingCompleted(const WebCore::PlatformWheelEvent&, std::optional<WebCore::ScrollingNodeID>, std::optional<WebCore::WheelScrollGestureState>, bool /* wasHandled */) { }
 
     virtual WebCore::PlatformWheelEvent filteredWheelEvent(const WebCore::PlatformWheelEvent& wheelEvent) { return wheelEvent; }
diff --git a/Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteLayerTreeDrawingAreaProxyMac.mm b/Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteLayerTreeDrawingAreaProxyMac.mm
index 1ba8f2354273..a2006feda5fd 100644
--- a/Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteLayerTreeDrawingAreaProxyMac.mm
+++ b/Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteLayerTreeDrawingAreaProxyMac.mm
@@ -164,7 +164,7 @@ explicit RemoteLayerTreeDisplayLinkClient(WebPageProxyIdentifier pageID)
 {
     ASSERT(m_displayID);
 
-    auto& displayLinks = page()->configuration().processPool().displayLinks();
+    auto& displayLinks = protect(page()->configuration())->processPool().displayLinks();
     return displayLinks.displayLinkForDisplay(*m_displayID);
 }
 
diff --git a/Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteLayerTreeEventDispatcher.h b/Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteLayerTreeEventDispatcher.h
index 94de342f498c..741f3fa31662 100644
--- a/Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteLayerTreeEventDispatcher.h
+++ b/Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteLayerTreeEventDispatcher.h
@@ -93,7 +93,7 @@ class RemoteLayerTreeEventDispatcher
     
     void cacheWheelEventScrollingAccelerationCurve(const NativeWebWheelEvent&);
 
-    void handleWheelEvent(const WebWheelEvent&, WebCore::RectEdges<WebCore::RubberBandingBehavior> rubberBandableEdges);
+    void handleWheelEvent(Ref<WebWheelEvent>&&, WebCore::RectEdges<WebCore::RubberBandingBehavior> rubberBandableEdges);
     void wheelEventHandlingCompleted(const WebCore::PlatformWheelEvent&, std::optional<WebCore::ScrollingNodeID>, std::optional<WebCore::WheelScrollGestureState>, bool wasHandled);
 
     void setScrollingTree(RefPtr<RemoteScrollingTree>&&);
@@ -129,7 +129,7 @@ class RemoteLayerTreeEventDispatcher
 
     void wheelEventHysteresisUpdated(PAL::HysteresisState);
 
-    void willHandleWheelEvent(const WebWheelEvent&);
+    void willHandleWheelEvent(Ref<WebWheelEvent>&&);
     void continueWheelEventHandling(WebCore::WheelEventHandlingResult);
     void wheelEventWasHandledByScrollingThread(WebCore::WheelEventHandlingResult);
 
@@ -181,7 +181,7 @@ class RemoteLayerTreeEventDispatcher
     Lock m_scrollingTreeLock;
     RefPtr<RemoteScrollingTree> m_scrollingTree WTF_GUARDED_BY_LOCK(m_scrollingTreeLock);
 
-    Deque<WebWheelEvent, 2> m_wheelEventsBeingProcessed; // FIXME: Remove
+    Deque<Ref<WebWheelEvent>, 2> m_wheelEventsBeingProcessed; // FIXME: Remove
 
     const WeakPtr<RemoteScrollingCoordinatorProxyMac> m_scrollingCoordinator;
     WebCore::PageIdentifier m_pageIdentifier;
@@ -219,8 +219,9 @@ class RemoteLayerTreeEventDispatcher
 #endif
 
 #if ENABLE(MOMENTUM_EVENT_DISPATCHER)
-    std::unique_ptr<MomentumEventDispatcher> m_momentumEventDispatcher;
     bool m_momentumEventDispatcherNeedsDisplayLink { false };
+    Lock m_momentumEventDispatcherLock;
+    std::unique_ptr<MomentumEventDispatcher> m_momentumEventDispatcher WTF_GUARDED_BY_LOCK(m_momentumEventDispatcherLock);
 #endif
 };
 
diff --git a/Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteLayerTreeEventDispatcher.mm b/Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteLayerTreeEventDispatcher.mm
index a9a47356deb9..d683288a1bd7 100644
--- a/Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteLayerTreeEventDispatcher.mm
+++ b/Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteLayerTreeEventDispatcher.mm
@@ -110,7 +110,7 @@ void displayLinkFired(PlatformDisplayID displayID, DisplayUpdate, bool wantsFull
 RemoteLayerTreeEventDispatcher::RemoteLayerTreeEventDispatcher(RemoteScrollingCoordinatorProxyMac& scrollingCoordinator, PageIdentifier pageIdentifier)
     : m_scrollingCoordinator(WeakPtr { scrollingCoordinator })
     , m_pageIdentifier(pageIdentifier)
-    , m_processPool(scrollingCoordinator.webPageProxy().configuration().processPool())
+    , m_processPool(protect(scrollingCoordinator.webPageProxy().configuration())->processPool())
     , m_wheelEventDeltaFilter(WheelEventDeltaFilter::create())
     , m_displayLinkClient(makeUnique<RemoteLayerTreeEventDispatcherDisplayLinkClient>(*this))
     , m_wheelEventActivityHysteresis([weakThis = ThreadSafeWeakPtr { *this }](PAL::HysteresisState state) {
@@ -162,7 +162,10 @@ void displayLinkFired(PlatformDisplayID displayID, DisplayUpdate, bool wantsFull
     });
 
 #if ENABLE(MOMENTUM_EVENT_DISPATCHER)
-    m_momentumEventDispatcher = nullptr;
+    {
+        Locker locker { m_momentumEventDispatcherLock };
+        m_momentumEventDispatcher = nullptr;
+    }
 #endif
 
     m_displayLinkClient = nullptr;
@@ -215,34 +218,39 @@ void displayLinkFired(PlatformDisplayID displayID, DisplayUpdate, bool wantsFull
         });
         return curve;
     });
-    m_momentumEventDispatcher->setScrollingAccelerationCurve(m_pageIdentifier, WTF::move(curve));
+
+    {
+        Locker locker { m_momentumEventDispatcherLock };
+        if (m_momentumEventDispatcher)
+            m_momentumEventDispatcher->setScrollingAccelerationCurve(m_pageIdentifier, WTF::move(curve));
+    }
 #endif
 }
 
-void RemoteLayerTreeEventDispatcher::willHandleWheelEvent(const WebWheelEvent& wheelEvent)
+void RemoteLayerTreeEventDispatcher::willHandleWheelEvent(Ref<WebWheelEvent>&& wheelEvent)
 {
     ASSERT(isMainRunLoop());
     
     m_wheelEventActivityHysteresis.impulse();
-    m_wheelEventsBeingProcessed.append(wheelEvent);
+    m_wheelEventsBeingProcessed.append(WTF::move(wheelEvent));
 }
 
-void RemoteLayerTreeEventDispatcher::handleWheelEvent(const WebWheelEvent& wheelEvent, RectEdges<WebCore::RubberBandingBehavior> rubberBandableEdges)
+void RemoteLayerTreeEventDispatcher::handleWheelEvent(Ref<WebWheelEvent>&& wheelEvent, RectEdges<WebCore::RubberBandingBehavior> rubberBandableEdges)
 {
     ASSERT(isMainRunLoop());
 
     auto scrollingTree = this->scrollingTree();
     if (scrollingTree && scrollingTree->scrollingPerformanceTestingEnabled()) {
-        if (wheelEvent.phase() == WebWheelEvent::Phase::Began)
+        if (wheelEvent->phase() == WebWheelEvent::Phase::Began)
             startFingerDownSignpostInterval();
 
-        if (wheelEvent.phase() == WebWheelEvent::Phase::Ended)
+        if (wheelEvent->phase() == WebWheelEvent::Phase::Ended)
             endFingerDownSignpostInterval();
     }
 
-    willHandleWheelEvent(wheelEvent);
+    willHandleWheelEvent(wheelEvent.copyRef());
 
-    ScrollingThread::dispatch([dispatcher = Ref { *this }, wheelEvent, rubberBandableEdges] {
+    ScrollingThread::dispatch([dispatcher = Ref { *this }, wheelEvent = WTF::move(wheelEvent), rubberBandableEdges] {
         dispatcher->scrollingThreadHandleWheelEvent(wheelEvent, rubberBandableEdges);
     });
 }
@@ -278,10 +286,13 @@ void displayLinkFired(PlatformDisplayID displayID, DisplayUpdate, bool wantsFull
     }
 
 #if ENABLE(MOMENTUM_EVENT_DISPATCHER)
-    if (m_momentumEventDispatcher->handleWheelEvent(m_pageIdentifier, webWheelEvent, rubberBandableEdges)) {
-        continueEventHandlingOnMainThread(WheelEventHandlingResult::handled(processingSteps));
-        [CATransaction flush];
-        return;
+    {
+        Locker locker { m_momentumEventDispatcherLock };
+        if (m_momentumEventDispatcher && m_momentumEventDispatcher->handleWheelEvent(m_pageIdentifier, webWheelEvent, rubberBandableEdges)) {
+            continueEventHandlingOnMainThread(WheelEventHandlingResult::handled(processingSteps));
+            [CATransaction flush];
+            return;
+        }
     }
 #endif
 
@@ -299,8 +310,8 @@ void displayLinkFired(PlatformDisplayID displayID, DisplayUpdate, bool wantsFull
 
     LOG_WITH_STREAM(Scrolling, stream << "RemoteLayerTreeEventDispatcher::continueWheelEventHandling - result " << handlingResult);
 
-    auto event = m_wheelEventsBeingProcessed.takeFirst();
-    scrollingCoordinator->continueWheelEventHandling(event, handlingResult);
+    Ref event = m_wheelEventsBeingProcessed.takeFirst();
+    scrollingCoordinator->continueWheelEventHandling(WTF::move(event), handlingResult);
 }
 
 OptionSet<WheelEventProcessingSteps> RemoteLayerTreeEventDispatcher::determineWheelEventProcessing(const PlatformWheelEvent& wheelEvent, RectEdges<WebCore::RubberBandingBehavior> rubberBandableEdges)
@@ -491,7 +502,9 @@ void displayLinkFired(PlatformDisplayID displayID, DisplayUpdate, bool wantsFull
     {
         // Make sure the lock is held for the handleSyntheticWheelEvent callback.
         ScrollingTree::HitTestLocker locker { *scrollingTree };
-        m_momentumEventDispatcher->displayDidRefresh(displayID);
+        Locker momentumEventDispatcherLocker { m_momentumEventDispatcherLock };
+        if (m_momentumEventDispatcher)
+            m_momentumEventDispatcher->displayDidRefresh(displayID);
     }
 #endif
 
@@ -786,7 +799,11 @@ void displayLinkFired(PlatformDisplayID displayID, DisplayUpdate, bool wantsFull
 void RemoteLayerTreeEventDispatcher::windowScreenDidChange(PlatformDisplayID displayID, std::optional<FramesPerSecond> nominalFramesPerSecond)
 {
 #if ENABLE(MOMENTUM_EVENT_DISPATCHER)
-    m_momentumEventDispatcher->pageScreenDidChange(m_pageIdentifier, displayID, nominalFramesPerSecond);
+    {
+        Locker locker { m_momentumEventDispatcherLock };
+        if (m_momentumEventDispatcher)
+            m_momentumEventDispatcher->pageScreenDidChange(m_pageIdentifier, displayID, nominalFramesPerSecond);
+    }
 #else
     UNUSED_PARAM(displayID);
     UNUSED_PARAM(nominalFramesPerSecond);
@@ -874,6 +891,7 @@ void displayLinkFired(PlatformDisplayID displayID, DisplayUpdate, bool wantsFull
 {
     ASSERT(m_momentumEventDispatcherNeedsDisplayLink);
     m_momentumEventDispatcherNeedsDisplayLink = false;
+    assertIsHeld(m_momentumEventDispatcherLock);
     if (m_momentumEventDispatcher)
         startOrStopDisplayLink();
 }
@@ -890,7 +908,9 @@ void displayLinkFired(PlatformDisplayID displayID, DisplayUpdate, bool wantsFull
 void RemoteLayerTreeEventDispatcher::flushMomentumEventLoggingSoon()
 {
     RunLoop::currentSingleton().dispatchAfter(1_s, [protectedThis = Ref { *this }] {
-        protectedThis->m_momentumEventDispatcher->flushLog();
+        Lock locker { protectedThis->m_momentumEventDispatcherLock };
+        if (protectedThis->m_momentumEventDispatcher)
+            protectedThis->m_momentumEventDispatcher->flushLog();
     });
 }
 #endif // ENABLE(MOMENTUM_EVENT_DISPATCHER_TEMPORARY_LOGGING)
diff --git a/Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteScrollingCoordinatorProxyMac.h b/Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteScrollingCoordinatorProxyMac.h
index c9c78f6b672e..7f5a73c35c61 100644
--- a/Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteScrollingCoordinatorProxyMac.h
+++ b/Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteScrollingCoordinatorProxyMac.h
@@ -45,7 +45,7 @@ class RemoteScrollingCoordinatorProxyMac final : public RemoteScrollingCoordinat
 private:
     void cacheWheelEventScrollingAccelerationCurve(const NativeWebWheelEvent&) override;
 
-    void handleWheelEvent(const WebWheelEvent&, WebCore::RectEdges<WebCore::RubberBandingBehavior> rubberBandableEdges) override;
+    void handleWheelEvent(Ref<WebWheelEvent>&&, WebCore::RectEdges<WebCore::RubberBandingBehavior> rubberBandableEdges) override;
     void wheelEventHandlingCompleted(const WebCore::PlatformWheelEvent&, std::optional<WebCore::ScrollingNodeID>, std::optional<WebCore::WheelScrollGestureState>, bool wasHandled) override;
 
     WebCore::RequestsScrollHandling scrollingTreeNodeRequestsScroll(WebCore::ScrollingNodeID, const WebCore::RequestedScrollData&) override;
diff --git a/Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteScrollingCoordinatorProxyMac.mm b/Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteScrollingCoordinatorProxyMac.mm
index b1ddc9d37bc3..c01b2ec29064 100644
--- a/Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteScrollingCoordinatorProxyMac.mm
+++ b/Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteScrollingCoordinatorProxyMac.mm
@@ -70,9 +70,9 @@
     m_eventDispatcher->cacheWheelEventScrollingAccelerationCurve(nativeWheelEvent);
 }
 
-void RemoteScrollingCoordinatorProxyMac::handleWheelEvent(const WebWheelEvent& wheelEvent, RectEdges<WebCore::RubberBandingBehavior> rubberBandableEdges)
+void RemoteScrollingCoordinatorProxyMac::handleWheelEvent(Ref<WebWheelEvent>&& wheelEvent, RectEdges<WebCore::RubberBandingBehavior> rubberBandableEdges)
 {
-    m_eventDispatcher->handleWheelEvent(wheelEvent, rubberBandableEdges);
+    m_eventDispatcher->handleWheelEvent(WTF::move(wheelEvent), rubberBandableEdges);
 }
 
 void RemoteScrollingCoordinatorProxyMac::wheelEventHandlingCompleted(const PlatformWheelEvent& wheelEvent, std::optional<ScrollingNodeID> scrollingNodeID, std::optional<WheelScrollGestureState> gestureState, bool wasHandled)
diff --git a/Source/WebKit/UIProcess/ViewGestureController.h b/Source/WebKit/UIProcess/ViewGestureController.h
index 3b9d52acb304..bb76223ba413 100644
--- a/Source/WebKit/UIProcess/ViewGestureController.h
+++ b/Source/WebKit/UIProcess/ViewGestureController.h
@@ -83,7 +83,9 @@ class Navigation;
 }
 
 #if PLATFORM(MAC)
-typedef WebKit::NativeWebWheelEvent PlatformScrollEvent;
+// A reference rather than a value: events are refcounted now, and this is only ever passed through,
+// never stored.
+typedef const WebKit::NativeWebWheelEvent& PlatformScrollEvent;
 #elif PLATFORM(GTK)
 typedef struct {
     WebCore::FloatSize delta;
diff --git a/Source/WebKit/UIProcess/WebAuthentication/AuthenticatorManager.cpp b/Source/WebKit/UIProcess/WebAuthentication/AuthenticatorManager.cpp
index 7d7093f6529d..e08e7cbbdd6f 100644
--- a/Source/WebKit/UIProcess/WebAuthentication/AuthenticatorManager.cpp
+++ b/Source/WebKit/UIProcess/WebAuthentication/AuthenticatorManager.cpp
@@ -256,9 +256,8 @@ void AuthenticatorManager::enableNativeSupport()
 void AuthenticatorManager::clearStateAsync()
 {
     RunLoop::mainSingleton().dispatch([weakThis = WeakPtr { *this }] {
-        if (!weakThis)
-            return;
-        weakThis->clearState();
+        if (RefPtr protectedThis = weakThis)
+            protectedThis->clearState();
     });
 }
 
@@ -638,9 +637,8 @@ void AuthenticatorManager::dispatchPanelClientCall(Function<void(const API::WebA
     // Call delegates in the next run loop to prevent clients' reentrance that would potentially modify the state
     // of the current run loop in unexpected ways.
     RunLoop::mainSingleton().dispatch([weakPanel = WTF::move(weakPanel), call = WTF::move(call)] () {
-        if (!weakPanel)
-            return;
-        call(*weakPanel);
+        if (RefPtr panel = weakPanel)
+            call(*panel);
     });
 }
 
diff --git a/Source/WebKit/UIProcess/WebAuthentication/AuthenticatorTransportService.cpp b/Source/WebKit/UIProcess/WebAuthentication/AuthenticatorTransportService.cpp
index 060c1219d291..1e76e2a56b67 100644
--- a/Source/WebKit/UIProcess/WebAuthentication/AuthenticatorTransportService.cpp
+++ b/Source/WebKit/UIProcess/WebAuthentication/AuthenticatorTransportService.cpp
@@ -85,18 +85,16 @@ AuthenticatorTransportService::AuthenticatorTransportService(AuthenticatorTransp
 void AuthenticatorTransportService::startDiscovery()
 {
     RunLoop::mainSingleton().dispatch([weakThis = WeakPtr { *this }] {
-        if (!weakThis)
-            return;
-        weakThis->startDiscoveryInternal();
+        if (RefPtr protectedThis = weakThis)
+            protectedThis->startDiscoveryInternal();
     });
 }
 
 void AuthenticatorTransportService::restartDiscovery()
 {
     RunLoop::mainSingleton().dispatch([weakThis = WeakPtr { *this }] {
-        if (!weakThis)
-            return;
-        weakThis->restartDiscoveryInternal();
+        if (RefPtr protectedThis = weakThis)
+            protectedThis->restartDiscoveryInternal();
     });
 }
 
diff --git a/Source/WebKit/UIProcess/WebAuthentication/Cocoa/LocalAuthenticator.mm b/Source/WebKit/UIProcess/WebAuthentication/Cocoa/LocalAuthenticator.mm
index 7d36d9eb1a28..81e660004652 100644
--- a/Source/WebKit/UIProcess/WebAuthentication/Cocoa/LocalAuthenticator.mm
+++ b/Source/WebKit/UIProcess/WebAuthentication/Cocoa/LocalAuthenticator.mm
@@ -665,10 +665,8 @@ SUPPRESS_RETAINPTR_CTOR_ADOPT if (RetainPtr error = adoptCF(rawError)) {
     if (creationOptions.attestation == AttestationConveyancePreference::Enterprise) {
         auto callback = [credentialId = WTF::move(credentialId), weakThis = WeakPtr { *this }] (Vector<uint8_t>&& attestationObject, std::optional<ExceptionData> exception) mutable {
             ASSERT(RunLoop::isMain());
-            if (!weakThis)
-                return;
-
-            weakThis->finishMakeCredential(WTF::move(credentialId), WTF::move(attestationObject), std::nullopt);
+            if (RefPtr protectedThis = weakThis)
+                protectedThis->finishMakeCredential(WTF::move(credentialId), WTF::move(attestationObject), std::nullopt);
         };
 
         performEnterpriseAttestation(creationOptions, WTF::move(authData), requestData().hash, WTF::move(callback));
diff --git a/Source/WebKit/UIProcess/WebAuthentication/Cocoa/WKNFReaderSessionDelegate.mm b/Source/WebKit/UIProcess/WebAuthentication/Cocoa/WKNFReaderSessionDelegate.mm
index d858dd210b87..2fa9796089ef 100644
--- a/Source/WebKit/UIProcess/WebAuthentication/Cocoa/WKNFReaderSessionDelegate.mm
+++ b/Source/WebKit/UIProcess/WebAuthentication/Cocoa/WKNFReaderSessionDelegate.mm
@@ -50,10 +50,9 @@ - (void)readerSession:(NFReaderSession*)theSession didDetectTags:(NSArray<NFTag
 {
     ASSERT(!RunLoop::isMain());
 
-    RunLoop::mainSingleton().dispatch([connection = _connection, tags = retainPtr(tags)] {
-        if (!connection)
-            return;
-        connection->didDetectTags(tags.get());
+    RunLoop::mainSingleton().dispatch([weakConnection = _connection, tags = retainPtr(tags)] {
+        if (RefPtr connection = weakConnection)
+            connection->didDetectTags(tags.get());
     });
 }
 
diff --git a/Source/WebKit/UIProcess/WebAuthentication/Mock/MockHidConnection.cpp b/Source/WebKit/UIProcess/WebAuthentication/Mock/MockHidConnection.cpp
index 70f699cfea70..35b6e68207dd 100644
--- a/Source/WebKit/UIProcess/WebAuthentication/Mock/MockHidConnection.cpp
+++ b/Source/WebKit/UIProcess/WebAuthentication/Mock/MockHidConnection.cpp
@@ -86,15 +86,16 @@ void MockHidConnection::send(Vector<uint8_t>&& data, DataSentCallback&& callback
     auto task = makeBlockPtr([weakThis = WeakPtr { *this }, data = WTF::move(data), callback = WTF::move(callback)]() mutable {
         ASSERT(!RunLoop::isMain());
         RunLoop::mainSingleton().dispatch([weakThis, data = WTF::move(data), callback = WTF::move(callback)]() mutable {
-            if (!weakThis) {
+            RefPtr protectedThis = weakThis;
+            if (!protectedThis) {
                 callback(DataSent::No);
                 return;
             }
 
-            weakThis->assembleRequest(WTF::move(data));
+            protectedThis->assembleRequest(WTF::move(data));
 
             auto sent = DataSent::Yes;
-            if (weakThis->stagesMatch() && weakThis->m_configuration.hid->error == Mock::HidError::DataNotSent)
+            if (protectedThis->stagesMatch() && protectedThis->m_configuration.hid->error == Mock::HidError::DataNotSent)
                 sent = DataSent::No;
             callback(sent);
         });
@@ -302,9 +303,8 @@ void MockHidConnection::feedReports()
             report = FidoHidContinuationPacket(m_currentChannel - 1, 0, { }).getSerializedData();
         // Packets are feed asynchronously to mimic actual data transmission.
         RunLoop::mainSingleton().dispatch([report = WTF::move(report), weakThis = WeakPtr { *this }]() mutable {
-            if (!weakThis)
-                return;
-            weakThis->receiveReport(WTF::move(report));
+            if (RefPtr protectedThis = weakThis)
+                protectedThis->receiveReport(WTF::move(report));
         });
         isFirst = false;
     }
@@ -328,9 +328,8 @@ void MockHidConnection::continueFeedReports()
 {
     // Send actual response for the next run.
     RunLoop::mainSingleton().dispatch([weakThis = WeakPtr { *this }]() mutable {
-        if (!weakThis)
-            return;
-        weakThis->feedReports();
+        if (RefPtr protectedThis = weakThis)
+            protectedThis->feedReports();
     });
 }
 
diff --git a/Source/WebKit/UIProcess/WebAuthentication/Mock/MockNfcService.mm b/Source/WebKit/UIProcess/WebAuthentication/Mock/MockNfcService.mm
index b99e35f97a64..33acb5ee718e 100644
--- a/Source/WebKit/UIProcess/WebAuthentication/Mock/MockNfcService.mm
+++ b/Source/WebKit/UIProcess/WebAuthentication/Mock/MockNfcService.mm
@@ -244,9 +244,8 @@ static void NFHardwareManagerStartReaderSessionWithBusyError(id, SEL, void (^cal
 void MockNfcService::receiveStartPolling()
 {
     RunLoop::mainSingleton().dispatch([weakThis = WeakPtr { *this }] {
-        if (!weakThis)
-            return;
-        weakThis->detectTags();
+        if (RefPtr protectedThis = weakThis)
+            protectedThis->detectTags();
     });
 }
 
diff --git a/Source/WebKit/UIProcess/WebAuthentication/Virtual/VirtualAuthenticatorManager.cpp b/Source/WebKit/UIProcess/WebAuthentication/Virtual/VirtualAuthenticatorManager.cpp
index e7e72607221b..045e077761b8 100644
--- a/Source/WebKit/UIProcess/WebAuthentication/Virtual/VirtualAuthenticatorManager.cpp
+++ b/Source/WebKit/UIProcess/WebAuthentication/Virtual/VirtualAuthenticatorManager.cpp
@@ -100,7 +100,7 @@ void VirtualAuthenticatorManager::runPanel()
 
 void VirtualAuthenticatorManager::selectAssertionResponse(Vector<Ref<WebCore::AuthenticatorAssertionResponse>>&& responses, WebAuthenticationSource source, CompletionHandler<void(WebCore::AuthenticatorAssertionResponse*)>&& completionHandler)
 {
-    completionHandler(responses[0].ptr());
+    completionHandler(protect(responses[0]).ptr());
 }
 
 void VirtualAuthenticatorManager::decidePolicyForLocalAuthenticator(CompletionHandler<void(LocalAuthenticatorPolicy)>&& completionHandler)
diff --git a/Source/WebKit/UIProcess/WebAuthentication/Virtual/VirtualHidConnection.cpp b/Source/WebKit/UIProcess/WebAuthentication/Virtual/VirtualHidConnection.cpp
index aaf75622018f..ef42a2902173 100644
--- a/Source/WebKit/UIProcess/WebAuthentication/Virtual/VirtualHidConnection.cpp
+++ b/Source/WebKit/UIProcess/WebAuthentication/Virtual/VirtualHidConnection.cpp
@@ -81,12 +81,13 @@ void VirtualHidConnection::send(Vector<uint8_t>&& data, DataSentCallback&& callb
     auto task = makeBlockPtr([weakThis = WeakPtr { *this }, data = WTF::move(data), callback = WTF::move(callback)]() mutable {
         ASSERT(!RunLoop::isMain());
         RunLoop::mainSingleton().dispatch([weakThis, data = WTF::move(data), callback = WTF::move(callback)]() mutable {
-            if (!weakThis) {
+            RefPtr protectedThis = weakThis;
+            if (!protectedThis) {
                 callback(DataSent::No);
                 return;
             }
 
-            weakThis->assembleRequest(WTF::move(data));
+            protectedThis->assembleRequest(WTF::move(data));
 
             callback(DataSent::Yes);
         });
@@ -113,9 +114,8 @@ void VirtualHidConnection::receiveHidMessage(fido::FidoHidMessage&& message)
     while (message.numPackets()) {
         auto report = message.popNextPacket();
         RunLoop::mainSingleton().dispatch([report = WTF::move(report), weakThis = WeakPtr { *this }]() mutable {
-            if (!weakThis)
-                return;
-            weakThis->receiveReport(WTF::move(report));
+            if (RefPtr protectedThis = weakThis)
+                protectedThis->receiveReport(WTF::move(report));
         });
     }
 }
diff --git a/Source/WebKit/UIProcess/WebAuthentication/fido/CtapAuthenticator.cpp b/Source/WebKit/UIProcess/WebAuthentication/fido/CtapAuthenticator.cpp
index 438132bf5c6d..6674e0a8a3f8 100644
--- a/Source/WebKit/UIProcess/WebAuthentication/fido/CtapAuthenticator.cpp
+++ b/Source/WebKit/UIProcess/WebAuthentication/fido/CtapAuthenticator.cpp
@@ -161,12 +161,12 @@ void CtapAuthenticator::makeCredential()
         Vector<uint8_t> cborCmd = encodeSilentGetAssertion(options.rp.id, requestData().hash, m_batches[m_currentBatch], pinParameters);
         protect(driver())->transact(WTF::move(cborCmd), [weakThis = WeakPtr { *this }](Vector<uint8_t>&& data) mutable {
             ASSERT(RunLoop::isMain());
-            if (!weakThis)
+            RefPtr protectedThis = weakThis;
+            if (!protectedThis)
                 return;
-            weakThis->continueSilentlyCheckCredentials(WTF::move(data), [weakThis = WTF::move(weakThis)] (bool foundMatch) mutable {
-                if (!weakThis)
-                    return;
-                weakThis->continueMakeCredentialAfterCheckExcludedCredentials(foundMatch);
+            protectedThis->continueSilentlyCheckCredentials(WTF::move(data), [weakThis = WTF::move(weakThis)] (bool foundMatch) mutable {
+                if (RefPtr protectedThis = weakThis)
+                    protectedThis->continueMakeCredentialAfterCheckExcludedCredentials(foundMatch);
             });
         });
     } else
@@ -216,9 +216,10 @@ void CtapAuthenticator::continueSilentlyCheckCredentials(Vector<uint8_t>&& data,
 
     protect(driver())->transact(WTF::move(cborCmd), [weakThis = WeakPtr { *this }, completionHandler = WTF::move(completionHandler)](Vector<uint8_t>&& data) mutable {
         ASSERT(RunLoop::isMain());
-        if (!weakThis)
+        RefPtr protectedThis = weakThis;
+        if (!protectedThis)
             return completionHandler(false);
-        weakThis->continueSilentlyCheckCredentials(WTF::move(data), WTF::move(completionHandler));
+        protectedThis->continueSilentlyCheckCredentials(WTF::move(data), WTF::move(completionHandler));
     });
 }
 
@@ -284,9 +285,8 @@ void CtapAuthenticator::continueMakeCredentialAfterCheckExcludedCredentials(bool
         CTAP_RELEASE_LOG("CtapAuthenticator::makeCredential cmdSize = %lu maxMsgSize = %u", cborCmd.size(), *m_info.maxMsgSize());
     protect(driver())->transact(WTF::move(cborCmd), [weakThis = WeakPtr { *this }](Vector<uint8_t>&& data) {
         ASSERT(RunLoop::isMain());
-        if (!weakThis)
-            return;
-        weakThis->continueMakeCredentialAfterResponseReceived(WTF::move(data));
+        if (RefPtr protectedThis = weakThis)
+            protectedThis->continueMakeCredentialAfterResponseReceived(WTF::move(data));
     });
 }
 
@@ -373,14 +373,16 @@ void CtapAuthenticator::getAssertion()
         Vector<uint8_t> cborCmd = encodeSilentGetAssertion(options.rpId, requestData().hash, m_batches[m_currentBatch], pinParameters);
         protect(driver())->transact(WTF::move(cborCmd), [weakThis = WeakPtr { *this }](Vector<uint8_t>&& data) mutable {
             ASSERT(RunLoop::isMain());
-            if (!weakThis)
+            RefPtr protectedThis = weakThis;
+            if (!protectedThis)
                 return;
-            weakThis->continueSilentlyCheckCredentials(WTF::move(data), [weakThis = WTF::move(weakThis)] (bool foundCredentials) mutable {
-                if (!weakThis)
+            protectedThis->continueSilentlyCheckCredentials(WTF::move(data), [weakThis = WTF::move(weakThis)] (bool foundCredentials) mutable {
+                RefPtr protectedThis = weakThis;
+                if (!protectedThis)
                     return;
-                if (!foundCredentials && weakThis->tryDowngrade())
+                if (!foundCredentials && protectedThis->tryDowngrade())
                     return;
-                weakThis->continueGetAssertionAfterCheckAllowCredentials();
+                protectedThis->continueGetAssertionAfterCheckAllowCredentials();
             });
         });
     } else if (options.allowCredentials.size() == 1 && canDowngradeToU2f()) {
@@ -390,12 +392,13 @@ void CtapAuthenticator::getAssertion()
         Vector<uint8_t> cborCmd = encodeSilentGetAssertion(options.rpId, requestData().hash, options.allowCredentials, pinParameters);
         protect(driver())->transact(WTF::move(cborCmd), [weakThis = WeakPtr { *this }](Vector<uint8_t>&& data) {
             ASSERT(RunLoop::isMain());
-            if (!weakThis)
+            RefPtr protectedThis = weakThis;
+            if (!protectedThis)
                 return;
             auto error = getResponseCode(data);
-            if (error == CtapDeviceResponseCode::kCtap2ErrNoCredentials && weakThis->tryDowngrade())
+            if (error == CtapDeviceResponseCode::kCtap2ErrNoCredentials && protectedThis->tryDowngrade())
                 return;
-            weakThis->continueGetAssertionAfterCheckAllowCredentials();
+            protectedThis->continueGetAssertionAfterCheckAllowCredentials();
         });
     } else
         continueGetAssertionAfterCheckAllowCredentials();
@@ -453,9 +456,8 @@ void CtapAuthenticator::continueGetAssertionAfterCheckAllowCredentials()
     CTAP_RELEASE_LOG("getAssertion: Sending %s", base64EncodeToString(cborCmd).utf8().data());
     protect(driver())->transact(WTF::move(cborCmd), [weakThis = WeakPtr { *this }](Vector<uint8_t>&& data) {
         ASSERT(RunLoop::isMain());
-        if (!weakThis)
-            return;
-        weakThis->continueGetAssertionAfterResponseReceived(WTF::move(data));
+        if (RefPtr protectedThis = weakThis)
+            protectedThis->continueGetAssertionAfterResponseReceived(WTF::move(data));
     });
 }
 
@@ -516,9 +518,8 @@ void CtapAuthenticator::continueGetAssertionAfterResponseReceived(Vector<uint8_t
     CTAP_RELEASE_LOG("continueGetAssertionAfterResponseReceived: Sending %s", base64EncodeToString(cborCmd).utf8().data());
     protect(driver())->transact(WTF::move(cborCmd), [weakThis = WeakPtr { *this }](Vector<uint8_t>&& data) {
         ASSERT(RunLoop::isMain());
-        if (!weakThis)
-            return;
-        weakThis->continueGetNextAssertionAfterResponseReceived(WTF::move(data));
+        if (RefPtr protectedThis = weakThis)
+            protectedThis->continueGetNextAssertionAfterResponseReceived(WTF::move(data));
     });
 }
 
@@ -558,9 +559,8 @@ void CtapAuthenticator::continueGetNextAssertionAfterResponseReceived(Vector<uin
     CTAP_RELEASE_LOG("continueGetNextAssertionAfterResponseReceived: Sending %s", base64EncodeToString(cborCmd).utf8().data());
     protect(driver())->transact(WTF::move(cborCmd), [weakThis = WeakPtr { *this }](Vector<uint8_t>&& data) {
         ASSERT(RunLoop::isMain());
-        if (!weakThis)
-            return;
-        weakThis->continueGetNextAssertionAfterResponseReceived(WTF::move(data));
+        if (RefPtr protectedThis = weakThis)
+            protectedThis->continueGetNextAssertionAfterResponseReceived(WTF::move(data));
     });
 }
 
@@ -620,7 +620,7 @@ void CtapAuthenticator::continueRequestPinAfterGetKeyAgreement(Vector<uint8_t>&&
             if (!protectedThis)
                 return;
             CTAP_RELEASE_LOG_WITH_THIS(protectedThis, "continueRequestPinAfterGetKeyAgreement: Got pin from observer.");
-            protectedThis->continueGetPinTokenAfterRequestPin(pin, keyAgreement.peerKey);
+            protectedThis->continueGetPinTokenAfterRequestPin(pin, protect(keyAgreement.peerKey));
         });
     }
 }
@@ -816,7 +816,7 @@ void CtapAuthenticator::continueSetupPinAfterGetKeyAgreement(Vector<uint8_t>&& d
         receiveRespond(ExceptionData { ExceptionCode::UnknownError, makeString("Unknown internal error. Error code: "_s, static_cast<uint8_t>(error)) });
         return;
     }
-    auto setPinRequest = pin::SetPinRequest::tryCreate(selectPinProtocol(), pin, keyAgreement->peerKey);
+    auto setPinRequest = pin::SetPinRequest::tryCreate(selectPinProtocol(), pin, protect(keyAgreement->peerKey));
     if (!setPinRequest) {
         receiveRespond(ExceptionData { ExceptionCode::UnknownError, "Cannot create a SetPinRequest."_s });
         return;
diff --git a/Source/WebKit/UIProcess/WebAuthentication/fido/CtapHidDriver.cpp b/Source/WebKit/UIProcess/WebAuthentication/fido/CtapHidDriver.cpp
index d15265d0f112..795c734e8e14 100644
--- a/Source/WebKit/UIProcess/WebAuthentication/fido/CtapHidDriver.cpp
+++ b/Source/WebKit/UIProcess/WebAuthentication/fido/CtapHidDriver.cpp
@@ -67,9 +67,8 @@ void CtapHidDriverWorker::transact(fido::FidoHidMessage&& requestMessage, Messag
     m_connection->invalidateCache();
     m_connection->send(m_requestMessage->popNextPacket(), [weakThis = WeakPtr { *this }](HidConnection::DataSent sent) mutable {
         ASSERT(RunLoop::isMain());
-        if (!weakThis)
-            return;
-        weakThis->write(sent);
+        if (RefPtr protectedThis = weakThis)
+            protectedThis->write(sent);
     });
 }
 
@@ -87,18 +86,16 @@ void CtapHidDriverWorker::write(HidConnection::DataSent sent)
         m_state = State::Read;
         m_connection->registerDataReceivedCallback([weakThis = WeakPtr { *this }](Vector<uint8_t>&& data) mutable {
             ASSERT(RunLoop::isMain());
-            if (!weakThis)
-                return;
-            weakThis->read(data);
+            if (RefPtr protectedThis = weakThis)
+                protectedThis->read(data);
         });
         return;
     }
 
     m_connection->send(m_requestMessage->popNextPacket(), [weakThis = WeakPtr { *this }](HidConnection::DataSent sent) mutable {
         ASSERT(RunLoop::isMain());
-        if (!weakThis)
-            return;
-        weakThis->write(sent);
+        if (RefPtr protectedThis = weakThis)
+            protectedThis->write(sent);
     });
 }
 
@@ -199,9 +196,8 @@ void CtapHidDriver::transact(Vector<uint8_t>&& data, ResponseCallback&& callback
     ASSERT(initCommand);
     m_worker->transact(WTF::move(*initCommand), [weakThis = WeakPtr { *this }](std::optional<FidoHidMessage>&& response) mutable {
         ASSERT(RunLoop::isMain());
-        if (!weakThis)
-            return;
-        weakThis->continueAfterChannelAllocated(WTF::move(response));
+        if (RefPtr protectedThis = weakThis)
+            protectedThis->continueAfterChannelAllocated(WTF::move(response));
     });
 }
 
@@ -219,9 +215,8 @@ void CtapHidDriver::continueAfterChannelAllocated(std::optional<FidoHidMessage>&
     if (payload.size() < kHidInitResponseSize || !spanHasPrefix(payload.span(), m_nonce.span())) {
         m_state = State::Idle;
         RunLoop::mainSingleton().dispatch([weakThis = WeakPtr { *this }, data = WTF::move(m_requestData), callback = WTF::move(m_responseCallback)]() mutable {
-            if (!weakThis)
-                return;
-            weakThis->transact(WTF::move(data), WTF::move(callback));
+            if (RefPtr protectedThis = weakThis)
+                protectedThis->transact(WTF::move(data), WTF::move(callback));
         });
         return;
     }
@@ -237,9 +232,8 @@ void CtapHidDriver::continueAfterChannelAllocated(std::optional<FidoHidMessage>&
     ASSERT(cmd);
     m_worker->transact(WTF::move(*cmd), [weakThis = WeakPtr { *this }](std::optional<FidoHidMessage>&& response) mutable {
         ASSERT(RunLoop::isMain());
-        if (!weakThis)
-            return;
-        weakThis->continueAfterResponseReceived(WTF::move(response));
+        if (RefPtr protectedThis = weakThis)
+            protectedThis->continueAfterResponseReceived(WTF::move(response));
     });
 }
 
diff --git a/Source/WebKit/UIProcess/WebAuthentication/fido/U2fAuthenticator.cpp b/Source/WebKit/UIProcess/WebAuthentication/fido/U2fAuthenticator.cpp
index a6bb42f5f2f7..c1e4f89bfabc 100644
--- a/Source/WebKit/UIProcess/WebAuthentication/fido/U2fAuthenticator.cpp
+++ b/Source/WebKit/UIProcess/WebAuthentication/fido/U2fAuthenticator.cpp
@@ -134,9 +134,8 @@ void U2fAuthenticator::issueCommand(const Vector<uint8_t>& command, CommandType
     U2F_RELEASE_LOG("issueCommand: Sending %s", base64EncodeToString(command).utf8().data());
     protect(driver())->transact(Vector<uint8_t>(command), [weakThis = WeakPtr { *this }, type](Vector<uint8_t>&& data) {
         ASSERT(RunLoop::isMain());
-        if (!weakThis)
-            return;
-        weakThis->responseReceived(WTF::move(data), type);
+        if (RefPtr protectedThis = weakThis)
+            protectedThis->responseReceived(WTF::move(data), type);
     });
 }
 
diff --git a/Source/WebKit/UIProcess/WebFrameProxy.cpp b/Source/WebKit/UIProcess/WebFrameProxy.cpp
index 8f42f21e992c..3be71d95b523 100644
--- a/Source/WebKit/UIProcess/WebFrameProxy.cpp
+++ b/Source/WebKit/UIProcess/WebFrameProxy.cpp
@@ -905,7 +905,7 @@ Ref<FrameTreeSyncData> WebFrameProxy::calculateFrameTreeSyncData() const
     bool isSecureForPaymentSession = false;
 #endif
 
-    return FrameTreeSyncData::create(isSecureForPaymentSession, securityOrigin(), m_documentSecurityPolicy, m_effectiveSandboxFlags.contains(WebCore::SandboxFlag::Origin), url().protocol().toString(), IntRect { }, ScrollPosition { }, LayoutRect { }, IntSize { }, HashMap<FrameIdentifier, Ref<RemoteFrameLayoutInfo>> { });
+    return FrameTreeSyncData::create(isSecureForPaymentSession, securityOrigin(), m_documentSecurityPolicy, m_effectiveSandboxFlags.contains(WebCore::SandboxFlag::Origin), url().protocol().toString(), IntRect { }, ScrollPosition { }, FrameGeometrySyncData { });
 }
 
 Ref<SecurityOrigin> WebFrameProxy::securityOrigin() const
diff --git a/Source/WebKit/UIProcess/WebPageProxy.cpp b/Source/WebKit/UIProcess/WebPageProxy.cpp
index 3a280dd1dea0..a335f13a3c21 100644
--- a/Source/WebKit/UIProcess/WebPageProxy.cpp
+++ b/Source/WebKit/UIProcess/WebPageProxy.cpp
@@ -3913,14 +3913,14 @@ IntSize WebPageProxy::viewSize() const
     return pageClient ? pageClient->viewSize() : IntSize { };
 }
 
-void WebPageProxy::setInitialFocus(bool forward, bool isKeyboardEventValid, const std::optional<WebKeyboardEvent>& keyboardEvent, CompletionHandler<void()>&& callbackFunction)
+void WebPageProxy::setInitialFocus(bool forward, bool isKeyboardEventValid, RefPtr<WebKeyboardEvent>&& keyboardEvent, CompletionHandler<void()>&& callbackFunction)
 {
     if (!hasRunningProcess()) {
         callbackFunction();
         return;
     }
 
-    sendWithAsyncReply(Messages::WebPage::SetInitialFocus(forward, isKeyboardEventValid, keyboardEvent), [callbackFunction = WTF::move(callbackFunction), backgroundActivity = protect(m_legacyMainFrameProcess->throttler())->backgroundActivity("WebPageProxy::setInitialFocus"_s)] () mutable {
+    sendWithAsyncReply(Messages::WebPage::SetInitialFocus(forward, isKeyboardEventValid, WTF::move(keyboardEvent)), [callbackFunction = WTF::move(callbackFunction), backgroundActivity = protect(m_legacyMainFrameProcess->throttler())->backgroundActivity("WebPageProxy::setInitialFocus"_s)] () mutable {
         callbackFunction();
     });
 }
@@ -4575,10 +4575,10 @@ void WebPageProxy::stageModeSessionDidEnd(std::optional<NodeIdentifier> nodeID)
 
 template <typename T>
 requires std::derived_from<T, WebEvent>
-static std::optional<T> removeOldRedundantEvent(Deque<T>& queue, WebEventType incomingEventType, OptionSet<WebEventType> eventFilter)
+static RefPtr<T> removeOldRedundantEvent(Deque<Ref<T>>& queue, WebEventType incomingEventType, OptionSet<WebEventType> eventFilter)
 {
     if (!eventFilter.contains(incomingEventType))
-        return std::nullopt;
+        return nullptr;
 
     auto it = queue.rbegin();
     auto end = queue.rend();
@@ -4588,24 +4588,25 @@ static std::optional<T> removeOldRedundantEvent(Deque<T>& queue, WebEventType in
         --end;
 
     for (; it != end; ++it) {
-        auto type = it->type();
+        auto type = (*it)->type();
         if (type == incomingEventType) {
-            auto event = *it;
+            RefPtr event = it->ptr();
             queue.remove(--it.base());
             return event;
         }
         if (!eventFilter.contains(type))
             break;
     }
-    return std::nullopt;
+    return nullptr;
 }
 
-void WebPageProxy::sendMouseEvent(FrameIdentifier frameID, const NativeWebMouseEvent& event, std::optional<Vector<SandboxExtensionHandle>>&& sandboxExtensions)
+void WebPageProxy::sendMouseEvent(FrameIdentifier frameID, Ref<NativeWebMouseEvent>&& event, std::optional<Vector<SandboxExtensionHandle>>&& sandboxExtensions)
 {
-    if (event.type() == WebEventType::MouseDown || event.type() == WebEventType::MouseUp)
-        processContainingFrame(frameID)->recordUserGestureAuthorizationToken(webPageIDInMainFrameProcess(), event.authorizationToken());
+    if (event->type() == WebEventType::MouseDown || event->type() == WebEventType::MouseUp)
+        processContainingFrame(frameID)->recordUserGestureAuthorizationToken(webPageIDInMainFrameProcess(), event->authorizationToken());
 
-    sendWithAsyncReplyToProcessContainingFrame(frameID, Messages::WebPage::MouseEvent(frameID, event, WTF::move(sandboxExtensions)), [weakThis = WeakPtr { *this }, eventType = event.type()] (IPC::Connection* connection, bool handled, std::optional<RemoteUserInputEventData> remoteUserInputEventData) mutable {
+    auto eventType = event->type();
+    sendWithAsyncReplyToProcessContainingFrame(frameID, Messages::WebPage::MouseEvent(frameID, WTF::move(event), WTF::move(sandboxExtensions)), [weakThis = WeakPtr { *this }, eventType] (IPC::Connection* connection, bool handled, std::optional<RemoteUserInputEventData> remoteUserInputEventData) mutable {
         RefPtr protectedThis = weakThis.get();
         if (!protectedThis || !connection)
             return;
@@ -4628,9 +4629,9 @@ void WebPageProxy::recordUIProcessUserActivation(const WebEvent& event)
         internals().lastActivationTimestamp = MonotonicTime::now();
 }
 
-void WebPageProxy::handleMouseEvent(const NativeWebMouseEvent& event)
+void WebPageProxy::handleMouseEvent(Ref<NativeWebMouseEvent>&& event)
 {
-    if (event.type() == WebEventType::MouseDown)
+    if (event->type() == WebEventType::MouseDown)
         launchInitialProcessIfNecessary();
 
     if (!hasRunningProcess())
@@ -4642,11 +4643,11 @@ void WebPageProxy::handleMouseEvent(const NativeWebMouseEvent& event)
     recordUIProcessUserActivation(event);
 
 #if PLATFORM(GTK) || PLATFORM(WPE)
-    WTFBeginSignpost(event.signpostIdentifier(), HandleMouseEvent, "id: %" PRIuPTR ", type: %s", event.signpostIdentifier(), toString(event.type()).characters());
+    WTFBeginSignpost(event->signpostIdentifier(), HandleMouseEvent, "id: %" PRIuPTR ", type: %s", event->signpostIdentifier(), toString(event->type()).characters());
 #endif
 
 #if ENABLE(CONTEXT_MENU_EVENT)
-    if (event.button() == WebMouseEventButton::Right && event.type() == WebEventType::MouseDown) {
+    if (event->button() == WebMouseEventButton::Right && event->type() == WebEventType::MouseDown) {
         ASSERT(m_contextMenuPreventionState != EventPreventionState::Waiting);
         m_contextMenuPreventionState = EventPreventionState::Waiting;
     }
@@ -4655,15 +4656,16 @@ void WebPageProxy::handleMouseEvent(const NativeWebMouseEvent& event)
     // If we receive multiple mousemove or mouseforcechanged events and the most recent mousemove or mouseforcechanged event
     // (respectively) has not yet been sent to WebProcess for processing, remove the pending mouse event and insert the new
     // event in the queue.
-    auto removedEvent = removeOldRedundantEvent(internals().mouseEventQueue, event.type(), { WebEventType::MouseMove, WebEventType::MouseForceChanged });
+    auto removedEvent = removeOldRedundantEvent(internals().mouseEventQueue, event->type(), { WebEventType::MouseMove, WebEventType::MouseForceChanged });
     if (removedEvent && removedEvent->type() == WebEventType::MouseMove)
-        internals().coalescedMouseEvents.append(CheckedRef { *removedEvent }.get());
+        internals().coalescedMouseEvents.append(removedEvent.releaseNonNull());
 
-    internals().mouseEventQueue.append(event);
+    auto eventType = event->type();
+    internals().mouseEventQueue.append(WTF::move(event));
 
-    LOG_WITH_STREAM(MouseHandling, stream << "UIProcess: " << (removedEvent ? "replaced" : "enqueued") << " mouse event " << event.type() << " (queue size " << internals().mouseEventQueue.size() << ", coalesced events size " << internals().coalescedMouseEvents.size() << ")");
+    LOG_WITH_STREAM(MouseHandling, stream << "UIProcess: " << (removedEvent ? "replaced" : "enqueued") << " mouse event " << eventType << " (queue size " << internals().mouseEventQueue.size() << ", coalesced events size " << internals().coalescedMouseEvents.size() << ")");
 
-    if (event.type() != WebEventType::MouseMove)
+    if (eventType != WebEventType::MouseMove)
         send(Messages::WebPage::FlushDeferredDidReceiveMouseEvent());
 
     if (internals().mouseEventQueue.size() == 1) // Otherwise, called from DidReceiveEvent message handler.
@@ -4672,9 +4674,9 @@ void WebPageProxy::handleMouseEvent(const NativeWebMouseEvent& event)
         WEBPAGEPROXY_RELEASE_LOG(MouseHandling, "handleMouseEvent: skipped called processNextQueuedMouseEvent 20 times, possibly stuck?");
 }
 
-void WebPageProxy::dispatchMouseDidMoveOverElementAsynchronously(const NativeWebMouseEvent& event)
+void WebPageProxy::dispatchMouseDidMoveOverElementAsynchronously(Ref<NativeWebMouseEvent>&& event)
 {
-    sendWithAsyncReply(Messages::WebPage::PerformHitTestForMouseEvent { event }, [this, protectedThis = Ref { *this }] (WebHitTestResultData&& hitTestResult, OptionSet<WebEventModifier> modifiers) {
+    sendWithAsyncReply(Messages::WebPage::PerformHitTestForMouseEvent { WTF::move(event) }, [this, protectedThis = Ref { *this }] (WebHitTestResultData&& hitTestResult, OptionSet<WebEventModifier> modifiers) {
         if (!isClosed())
             mouseDidMoveOverElement(WTF::move(hitTestResult), modifiers);
     });
@@ -4702,7 +4704,7 @@ void WebPageProxy::processNextQueuedMouseEvent()
     ASSERT(!internals().mouseEventQueue.isEmpty());
     m_deferredMouseEvents = 0;
 
-    const CheckedRef event = internals().mouseEventQueue.first();
+    const Ref event = internals().mouseEventQueue.first();
 
 #if ENABLE(CONTEXT_MENUS)
     if (m_waitingForContextMenuToShow) {
@@ -4729,16 +4731,16 @@ void WebPageProxy::processNextQueuedMouseEvent()
         sandboxExtensions = SandboxExtension::createHandlesForMachLookup({ "com.apple.iconservices"_s, "com.apple.iconservices.store"_s }, process->auditToken(), SandboxExtension::MachBootstrapOptions::EnableMachBootstrap);
 #endif
 
-    auto eventWithCoalescedEvents = event;
-
     if (event->type() == WebEventType::MouseMove) {
-        internals().coalescedMouseEvents.append(event);
-        eventWithCoalescedEvents->setCoalescedEvents(internals().coalescedMouseEvents);
+        // A copy, not the event itself: the event is about to own this vector, and a Ref to itself
+        // would be a reference cycle.
+        internals().coalescedMouseEvents.append(event->copy());
+        event->setCoalescedEvents(internals().coalescedMouseEvents);
     }
 
     LOG_WITH_STREAM(MouseHandling, stream << "UIProcess: sent mouse event " << eventType << " (queue size " << internals().mouseEventQueue.size() << ", coalesced events size " << internals().coalescedMouseEvents.size() << ")");
 
-    sendMouseEvent(targetFrame->frameID(), eventWithCoalescedEvents, WTF::move(sandboxExtensions));
+    sendMouseEvent(targetFrame->frameID(), event.copyRef(), WTF::move(sandboxExtensions));
 
     internals().coalescedMouseEvents.clear();
 }
@@ -4755,7 +4757,7 @@ void WebPageProxy::processNextQueuedGestureEvent()
     ASSERT(!internals().gestureEventQueue.isEmpty());
     m_deferredGestureEvents = 0;
 
-    const CheckedRef event = internals().gestureEventQueue.first();
+    const Ref event = internals().gestureEventQueue.first();
     const auto eventType = event->type();
 
     RefPtr targetFrame = m_mainFrame;
@@ -4763,7 +4765,7 @@ void WebPageProxy::processNextQueuedGestureEvent()
 
     LOG_WITH_STREAM(GestureHandling, stream << "UIProcess: sent gesture event " << eventType << " (queue size " << internals().gestureEventQueue.size() << ", dropped gestures since last gesture event processed: " << internals().droppedGestureEventCount << ")");
 
-    sendGestureEvent(targetFrame->frameID(), event);
+    sendGestureEvent(targetFrame->frameID(), event.copyRef());
 
     internals().droppedGestureEventCount = 0;
 }
@@ -4861,18 +4863,19 @@ void WebPageProxy::flushPendingTouchEventCallbacks()
 #endif
 
 #if PLATFORM(IOS_FAMILY)
-void WebPageProxy::handleWheelEventWithoutScrolling(const WebWheelEvent& event, CompletionHandler<void(bool)>&& completionHandler)
+void WebPageProxy::handleWheelEventWithoutScrolling(Ref<WebWheelEvent>&& event, CompletionHandler<void(bool)>&& completionHandler)
 {
     if (!m_mainFrame) {
         completionHandler(false);
         return;
     }
-    sendWheelEventWithoutScrolling(m_mainFrame->frameID(), event, WTF::move(completionHandler));
+    sendWheelEventWithoutScrolling(m_mainFrame->frameID(), WTF::move(event), WTF::move(completionHandler));
 }
 
-void WebPageProxy::sendWheelEventWithoutScrolling(WebCore::FrameIdentifier frameID, const WebWheelEvent& event, CompletionHandler<void(bool)>&& completionHandler)
+void WebPageProxy::sendWheelEventWithoutScrolling(WebCore::FrameIdentifier frameID, Ref<WebWheelEvent>&& event, CompletionHandler<void(bool)>&& completionHandler)
 {
-    sendWithAsyncReplyToProcessContainingFrame(frameID, Messages::WebPage::DispatchWheelEventWithoutScrolling(frameID, event), [weakThis = WeakPtr { *this }, event, completionHandler = WTF::move(completionHandler)](bool defaultPrevented, std::optional<RemoteUserInputEventData> remoteWheelEventData) mutable {
+    // The lambda captures an independent copy, since the retry path below mutates its position.
+    sendWithAsyncReplyToProcessContainingFrame(frameID, Messages::WebPage::DispatchWheelEventWithoutScrolling(frameID, event.copyRef()), [weakThis = WeakPtr { *this }, event = event->copy(), completionHandler = WTF::move(completionHandler)](bool defaultPrevented, std::optional<RemoteUserInputEventData> remoteWheelEventData) mutable {
         RefPtr protectedThis = weakThis.get();
         if (!protectedThis) {
             completionHandler(false);
@@ -4880,9 +4883,8 @@ void WebPageProxy::sendWheelEventWithoutScrolling(WebCore::FrameIdentifier frame
         }
 
         if (remoteWheelEventData) {
-            auto transformedEvent = event;
-            transformedEvent.setPosition(roundedIntPoint(remoteWheelEventData->transformedPoint));
-            protectedThis->sendWheelEventWithoutScrolling(remoteWheelEventData->targetFrameID, transformedEvent, WTF::move(completionHandler));
+            event->setPosition(roundedIntPoint(remoteWheelEventData->transformedPoint));
+            protectedThis->sendWheelEventWithoutScrolling(remoteWheelEventData->targetFrameID, WTF::move(event), WTF::move(completionHandler));
             return;
         }
 
@@ -4891,7 +4893,7 @@ void WebPageProxy::sendWheelEventWithoutScrolling(WebCore::FrameIdentifier frame
 }
 #endif
 
-void WebPageProxy::handleNativeWheelEvent(const NativeWebWheelEvent& nativeWheelEvent)
+void WebPageProxy::handleNativeWheelEvent(Ref<NativeWebWheelEvent>&& nativeWheelEvent)
 {
     if (!hasRunningProcess())
         return;
@@ -4900,11 +4902,11 @@ void WebPageProxy::handleNativeWheelEvent(const NativeWebWheelEvent& nativeWheel
 
     cacheWheelEventScrollingAccelerationCurve(nativeWheelEvent);
 
-    if (!wheelEventCoalescer().shouldDispatchEvent(nativeWheelEvent))
+    if (!wheelEventCoalescer().shouldDispatchEvent(WTF::move(nativeWheelEvent)))
         return;
 
-    auto eventToDispatch = *wheelEventCoalescer().nextEventToDispatch();
-    handleWheelEvent(eventToDispatch);
+    RefPtr eventToDispatch = wheelEventCoalescer().nextEventToDispatch();
+    handleWheelEvent(eventToDispatch.releaseNonNull());
 }
 
 static RectEdges<WebCore::RubberBandingBehavior> resolvedRubberBandingBehaviorEdges(RectEdges<bool> rubberBandableEdges, bool alwaysBounceVertical, bool alwaysBounceHorizontal)
@@ -4932,13 +4934,13 @@ static RectEdges<WebCore::RubberBandingBehavior> resolvedRubberBandingBehaviorEd
     return result;
 }
 
-void WebPageProxy::handleWheelEvent(const WebWheelEvent& wheelEvent)
+void WebPageProxy::handleWheelEvent(Ref<WebWheelEvent>&& wheelEvent)
 {
     if (!hasRunningProcess())
         return;
 
     if (protect(drawingArea())->shouldSendWheelEventsToEventDispatcher()) {
-        continueWheelEventHandling(wheelEvent, { WheelEventProcessingSteps::SynchronousScrolling, false }, { });
+        continueWheelEventHandling(WTF::move(wheelEvent), { WheelEventProcessingSteps::SynchronousScrolling, false }, { });
         return;
     }
 
@@ -4947,20 +4949,20 @@ void WebPageProxy::handleWheelEvent(const WebWheelEvent& wheelEvent)
         auto rubberBandableEdges = rubberBandableEdgesRespectingHistorySwipe();
         auto rubberBandingBehavior = resolvedRubberBandingBehaviorEdges(rubberBandableEdges, alwaysBounceVertical(), alwaysBounceHorizontal());
 
-        scrollingCoordinatorProxy->handleWheelEvent(wheelEvent, rubberBandingBehavior);
+        scrollingCoordinatorProxy->handleWheelEvent(WTF::move(wheelEvent), rubberBandingBehavior);
         // continueWheelEventHandling() will get called after the event has been handled by the scrolling thread.
     }
 #endif
 }
 
-void WebPageProxy::continueWheelEventHandling(const WebWheelEvent& wheelEvent, const WheelEventHandlingResult& result, std::optional<bool> willStartSwipe)
+void WebPageProxy::continueWheelEventHandling(Ref<WebWheelEvent>&& wheelEvent, const WheelEventHandlingResult& result, std::optional<bool> willStartSwipe)
 {
     LOG_WITH_STREAM(WheelEvents, stream << "WebPageProxy::continueWheelEventHandling - " << result);
 
     if (!result.needsMainThreadProcessing()) {
-        if (m_mainFrame && wheelEvent.phase() == WebWheelEvent::Phase::Began) {
+        if (m_mainFrame && wheelEvent->phase() == WebWheelEvent::Phase::Began) {
             // When wheel events are handled entirely in the UI process, we still need to tell the web process where the mouse is for cursor updates.
-            sendToProcessContainingFrame(m_mainFrame->frameID(), Messages::WebPage::SetLastKnownMousePosition(m_mainFrame->frameID(), wheelEvent.position(), wheelEvent.globalPosition(), WebCore::LastKnownMousePositionSource::Wheel));
+            sendToProcessContainingFrame(m_mainFrame->frameID(), Messages::WebPage::SetLastKnownMousePosition(m_mainFrame->frameID(), wheelEvent->position(), wheelEvent->globalPosition(), WebCore::LastKnownMousePositionSource::Wheel));
         }
 
         wheelEventHandlingCompleted(result.wasHandled);
@@ -4973,10 +4975,10 @@ void WebPageProxy::continueWheelEventHandling(const WebWheelEvent& wheelEvent, c
     auto rubberBandableEdges = rubberBandableEdgesRespectingHistorySwipe();
     auto rubberBandingBehavior = resolvedRubberBandingBehaviorEdges(rubberBandableEdges, alwaysBounceVertical(), alwaysBounceHorizontal());
 
-    sendWheelEvent(m_mainFrame->frameID(), wheelEvent, result.steps, rubberBandingBehavior, willStartSwipe, result.wasHandled);
+    sendWheelEvent(m_mainFrame->frameID(), WTF::move(wheelEvent), result.steps, rubberBandingBehavior, willStartSwipe, result.wasHandled);
 }
 
-void WebPageProxy::sendWheelEvent(WebCore::FrameIdentifier frameID, const WebWheelEvent& event, OptionSet<WheelEventProcessingSteps> processingSteps, RectEdges<WebCore::RubberBandingBehavior> rubberBandableEdges, std::optional<bool> willStartSwipe, bool wasHandledForScrolling)
+void WebPageProxy::sendWheelEvent(WebCore::FrameIdentifier frameID, Ref<WebWheelEvent>&& event, OptionSet<WheelEventProcessingSteps> processingSteps, RectEdges<WebCore::RubberBandingBehavior> rubberBandableEdges, std::optional<bool> willStartSwipe, bool wasHandledForScrolling)
 {
 #if HAVE(DISPLAY_LINK)
     internals().wheelEventActivityHysteresis.impulse();
@@ -4985,14 +4987,14 @@ void WebPageProxy::sendWheelEvent(WebCore::FrameIdentifier frameID, const WebWhe
     Ref process = processContainingFrame(frameID);
     if (protect(drawingArea())->shouldSendWheelEventsToEventDispatcher()) {
         sendWheelEventScrollingAccelerationCurveIfNecessary(frameID, event);
-        sendWithAsyncReplyToProcessContainingFrame(frameID, Messages::EventDispatcher::WheelEvent(webPageIDInProcess(process), event, rubberBandableEdges), [weakThis = WeakPtr { *this }] (IPC::Connection* connection, bool handled) mutable {
+        sendWithAsyncReplyToProcessContainingFrame(frameID, Messages::EventDispatcher::WheelEvent(webPageIDInProcess(process), WTF::move(event), rubberBandableEdges), [weakThis = WeakPtr { *this }] (IPC::Connection* connection, bool handled) mutable {
             RefPtr protectedThis = weakThis.get();
             if (!protectedThis || !connection)
                 return;
             protectedThis->wheelEventHandlingCompleted(handled);
         });
     } else {
-        sendWithAsyncReplyToProcessContainingFrame(frameID, Messages::WebPage::HandleWheelEvent(frameID, event, processingSteps, willStartSwipe), [weakThis = WeakPtr { *this }, wheelEvent = event, processingSteps, rubberBandableEdges, willStartSwipe, wasHandledForScrolling] (IPC::Connection* connection, std::optional<ScrollingNodeID> nodeID, std::optional<WheelScrollGestureState> gestureState, bool handled, std::optional<RemoteUserInputEventData> remoteWheelEventData) mutable {
+        sendWithAsyncReplyToProcessContainingFrame(frameID, Messages::WebPage::HandleWheelEvent(frameID, event.copyRef(), processingSteps, willStartSwipe), [weakThis = WeakPtr { *this }, wheelEvent = event->copy(), processingSteps, rubberBandableEdges, willStartSwipe, wasHandledForScrolling] (IPC::Connection* connection, std::optional<ScrollingNodeID> nodeID, std::optional<WheelScrollGestureState> gestureState, bool handled, std::optional<RemoteUserInputEventData> remoteWheelEventData) mutable {
             RefPtr protectedThis = weakThis.get();
             if (!protectedThis)
                 return;
@@ -5003,8 +5005,8 @@ void WebPageProxy::sendWheelEvent(WebCore::FrameIdentifier frameID, const WebWhe
             MESSAGE_CHECK_BASE(!remoteWheelEventData || protect(protectedThis->preferences())->siteIsolationEnabled(), connection);
 
             if (remoteWheelEventData) {
-                wheelEvent.setPosition(roundedIntPoint(remoteWheelEventData->transformedPoint));
-                protectedThis->sendWheelEvent(remoteWheelEventData->targetFrameID, wheelEvent, processingSteps, rubberBandableEdges, willStartSwipe, wasHandledForScrolling);
+                wheelEvent->setPosition(roundedIntPoint(remoteWheelEventData->transformedPoint));
+                protectedThis->sendWheelEvent(remoteWheelEventData->targetFrameID, wheelEvent.copyRef(), processingSteps, rubberBandableEdges, willStartSwipe, wasHandledForScrolling);
                 return;
             }
 
@@ -5046,14 +5048,14 @@ void WebPageProxy::wheelEventHandlingCompleted(bool wasHandled)
         LOG_WITH_STREAM(WheelEvents, stream << "WebPageProxy::wheelEventHandlingCompleted - no event, handled " << wasHandled);
 
     if (oldestProcessedEvent && !wasHandled) {
-        CheckedRef event = *oldestProcessedEvent;
+        Ref event = *oldestProcessedEvent;
         m_uiClient->didNotHandleWheelEvent(this, event.get());
         if (RefPtr pageClient = m_pageClient.get())
             pageClient->wheelEventWasNotHandledByWebCore(event.get());
     }
 
-    if (auto eventToSend = wheelEventCoalescer().nextEventToDispatch()) {
-        handleWheelEvent(CheckedRef { *eventToSend }.get());
+    if (RefPtr eventToSend = wheelEventCoalescer().nextEventToDispatch()) {
+        handleWheelEvent(eventToSend.releaseNonNull());
         return;
     }
 
@@ -5154,14 +5156,14 @@ const NativeWebKeyboardEvent& WebPageProxy::firstQueuedKeyEvent() const
     return internals().keyEventQueue.first();
 }
 
-void WebPageProxy::sendKeyEvent(const NativeWebKeyboardEvent& event)
+void WebPageProxy::sendKeyEvent(Ref<NativeWebKeyboardEvent>&& event)
 {
     RefPtr targetFrame = m_focusedFrame ? m_focusedFrame : m_mainFrame;
     auto targetFrameID = targetFrame->frameID();
     Ref targetProcess = targetFrame->process();
-    targetProcess->startResponsivenessTimer(event.type() == WebEventType::KeyDown ? WebProcessProxy::UseLazyStop::Yes : WebProcessProxy::UseLazyStop::No);
-    targetProcess->recordUserGestureAuthorizationToken(webPageIDInMainFrameProcess(), event.authorizationToken());
-    sendWithAsyncReplyToProcessContainingFrame(targetFrameID, Messages::WebPage::KeyEvent(targetFrameID, event), [weakThis = WeakPtr { *this }] (IPC::Connection* connection, bool handled) mutable {
+    targetProcess->startResponsivenessTimer(event->type() == WebEventType::KeyDown ? WebProcessProxy::UseLazyStop::Yes : WebProcessProxy::UseLazyStop::No);
+    targetProcess->recordUserGestureAuthorizationToken(webPageIDInMainFrameProcess(), event->authorizationToken());
+    sendWithAsyncReplyToProcessContainingFrame(targetFrameID, Messages::WebPage::KeyEvent(targetFrameID, WTF::move(event)), [weakThis = WeakPtr { *this }] (IPC::Connection* connection, bool handled) mutable {
         RefPtr protectedThis = weakThis.get();
         if (!protectedThis || !connection)
             return;
@@ -5174,7 +5176,7 @@ void WebPageProxy::sendKeyEvent(const NativeWebKeyboardEvent& event)
     });
 }
 
-bool WebPageProxy::handleKeyboardEvent(const NativeWebKeyboardEvent& event)
+bool WebPageProxy::handleKeyboardEvent(Ref<NativeWebKeyboardEvent>&& event)
 {
     if (!hasRunningProcess())
         return false;
@@ -5186,14 +5188,14 @@ bool WebPageProxy::handleKeyboardEvent(const NativeWebKeyboardEvent& event)
 
     recordUIProcessUserActivation(event);
 
-    LOG_WITH_STREAM(KeyHandling, stream << "WebPageProxy::handleKeyboardEvent: " << event.type());
+    LOG_WITH_STREAM(KeyHandling, stream << "WebPageProxy::handleKeyboardEvent: " << event->type());
 
-    internals().keyEventQueue.append(event);
+    internals().keyEventQueue.append(event.copyRef());
 
     // Otherwise, sent from DidReceiveEvent message handler.
     if (internals().keyEventQueue.size() == 1) {
         LOG(KeyHandling, " UI process: sent keyEvent from handleKeyboardEvent");
-        sendKeyEvent(event);
+        sendKeyEvent(WTF::move(event));
     }
 
     return true;
@@ -5306,9 +5308,9 @@ TrackingType WebPageProxy::touchEventTrackingType(const WebTouchEvent& touchStar
 #endif
 
 #if ENABLE(MAC_GESTURE_EVENTS)
-void WebPageProxy::sendGestureEvent(FrameIdentifier frameID, const NativeWebGestureEvent& event)
+void WebPageProxy::sendGestureEvent(FrameIdentifier frameID, Ref<NativeWebGestureEvent>&& event)
 {
-    sendWithAsyncReplyToProcessContainingFrame(frameID, Messages::EventDispatcher::GestureEvent(frameID, webPageIDInProcess(processContainingFrame(frameID)), event), [protectedThis = Ref { *this }](IPC::Connection* connection, std::optional<WebEventType>&& eventType, bool handled, std::optional<WebCore::RemoteUserInputEventData>&& remoteUserInputEventData) {
+    sendWithAsyncReplyToProcessContainingFrame(frameID, Messages::EventDispatcher::GestureEvent(frameID, webPageIDInProcess(processContainingFrame(frameID)), WTF::move(event)), [protectedThis = Ref { *this }](IPC::Connection* connection, std::optional<WebEventType>&& eventType, bool handled, std::optional<WebCore::RemoteUserInputEventData>&& remoteUserInputEventData) {
         if (!protectedThis->m_pageClient)
             return;
         if (!eventType)
@@ -5325,7 +5327,7 @@ void WebPageProxy::sendGestureEvent(FrameIdentifier frameID, const NativeWebGest
     });
 }
 
-void WebPageProxy::handleGestureEvent(const NativeWebGestureEvent& event)
+void WebPageProxy::handleGestureEvent(Ref<NativeWebGestureEvent>&& event)
 {
     if (!hasRunningProcess())
         return;
@@ -5333,10 +5335,10 @@ void WebPageProxy::handleGestureEvent(const NativeWebGestureEvent& event)
     if (!m_mainFrame)
         return;
 
-    if (removeOldRedundantEvent(internals().gestureEventQueue, event.type(), { WebEventType::GestureChange }))
+    if (removeOldRedundantEvent(internals().gestureEventQueue, event->type(), { WebEventType::GestureChange }))
         internals().droppedGestureEventCount++;
 
-    internals().gestureEventQueue.append(event);
+    internals().gestureEventQueue.append(WTF::move(event));
 
     if (internals().gestureEventQueue.size() == 1) // Otherwise, called from DidReceiveEvent message handler.
         processNextQueuedGestureEvent();
@@ -5346,33 +5348,33 @@ void WebPageProxy::handleGestureEvent(const NativeWebGestureEvent& event)
 #endif
 
 #if ENABLE(IOS_TOUCH_EVENTS)
-void WebPageProxy::sendPreventableTouchEvent(WebCore::FrameIdentifier frameID, const WebTouchEvent& event)
+void WebPageProxy::sendPreventableTouchEvent(WebCore::FrameIdentifier frameID, Ref<WebTouchEvent>&& event)
 {
-    if (event.type() == WebEventType::TouchEnd && protect(preferences())->verifyWindowOpenUserGestureFromUIProcess())
-        processContainingFrame(frameID)->recordUserGestureAuthorizationToken(webPageIDInMainFrameProcess(), event.authorizationToken());
+    if (event->type() == WebEventType::TouchEnd && protect(preferences())->verifyWindowOpenUserGestureFromUIProcess())
+        processContainingFrame(frameID)->recordUserGestureAuthorizationToken(webPageIDInMainFrameProcess(), event->authorizationToken());
 
-    sendWithAsyncReplyToProcessContainingFrame(frameID, Messages::EventDispatcher::TouchEvent(webPageIDInProcess(processContainingFrame(frameID)), frameID, event), [this, weakThis = WeakPtr { *this }, event] (IPC::Connection* connection, bool handled, std::optional<RemoteWebTouchEvent> remoteWebTouchEvent) mutable {
+    sendWithAsyncReplyToProcessContainingFrame(frameID, Messages::EventDispatcher::TouchEvent(webPageIDInProcess(processContainingFrame(frameID)), frameID, event.copyRef()), [this, weakThis = WeakPtr { *this }, event = event.copyRef()] (IPC::Connection* connection, bool handled, std::optional<RemoteWebTouchEvent> remoteWebTouchEvent) mutable {
         RefPtr protectedThis = weakThis.get();
         if (!protectedThis)
             return;
 
         if (remoteWebTouchEvent)
-            return sendPreventableTouchEvent(remoteWebTouchEvent->targetFrameID, remoteWebTouchEvent->transformedEvent);
+            return sendPreventableTouchEvent(remoteWebTouchEvent->targetFrameID, WTF::move(remoteWebTouchEvent->transformedEvent));
 
         bool didFinishDeferringTouchStart = false;
-        ASSERT_IMPLIES(event.type() == WebEventType::TouchStart, m_handlingPreventableTouchStartCount);
-        if (event.type() == WebEventType::TouchStart && m_handlingPreventableTouchStartCount)
+        ASSERT_IMPLIES(event->type() == WebEventType::TouchStart, m_handlingPreventableTouchStartCount);
+        if (event->type() == WebEventType::TouchStart && m_handlingPreventableTouchStartCount)
             didFinishDeferringTouchStart = !--m_handlingPreventableTouchStartCount;
 
         bool didFinishDeferringTouchMove = false;
-        if (event.type() == WebEventType::TouchMove && m_touchMovePreventionState == EventPreventionState::Waiting) {
+        if (event->type() == WebEventType::TouchMove && m_touchMovePreventionState == EventPreventionState::Waiting) {
             m_touchMovePreventionState = handled ? EventPreventionState::Prevented : EventPreventionState::Allowed;
             didFinishDeferringTouchMove = true;
         }
 
         bool didFinishDeferringTouchEnd = false;
-        ASSERT_IMPLIES(event.type() == WebEventType::TouchEnd, m_handlingPreventableTouchEndCount);
-        if (event.type() == WebEventType::TouchEnd && m_handlingPreventableTouchEndCount)
+        ASSERT_IMPLIES(event->type() == WebEventType::TouchEnd, m_handlingPreventableTouchEndCount);
+        if (event->type() == WebEventType::TouchEnd && m_handlingPreventableTouchEndCount)
             didFinishDeferringTouchEnd = !--m_handlingPreventableTouchEndCount;
 
         if (connection)
@@ -5465,7 +5467,7 @@ void WebPageProxy::handlePreventableTouchEvent(NativeWebTouchEvent& event)
     if (isTouchEnd)
         ++m_handlingPreventableTouchEndCount;
 
-    sendPreventableTouchEvent(m_mainFrame->frameID(), event);
+    sendPreventableTouchEvent(m_mainFrame->frameID(), Ref { event });
 }
 
 void WebPageProxy::didBeginTouchPoint(FloatPoint locationInRootView)
@@ -5476,19 +5478,19 @@ void WebPageProxy::didBeginTouchPoint(FloatPoint locationInRootView)
     send(Messages::WebPage::DidBeginTouchPoint(locationInRootView));
 }
 
-void WebPageProxy::sendUnpreventableTouchEvent(WebCore::FrameIdentifier frameID, const WebTouchEvent& event)
+void WebPageProxy::sendUnpreventableTouchEvent(WebCore::FrameIdentifier frameID, Ref<WebTouchEvent>&& event)
 {
-    if (event.type() == WebEventType::TouchEnd && protect(preferences())->verifyWindowOpenUserGestureFromUIProcess())
-        processContainingFrame(frameID)->recordUserGestureAuthorizationToken(webPageIDInMainFrameProcess(), event.authorizationToken());
+    if (event->type() == WebEventType::TouchEnd && protect(preferences())->verifyWindowOpenUserGestureFromUIProcess())
+        processContainingFrame(frameID)->recordUserGestureAuthorizationToken(webPageIDInMainFrameProcess(), event->authorizationToken());
 
-    sendWithAsyncReplyToProcessContainingFrame(frameID, Messages::EventDispatcher::TouchEvent(webPageIDInProcess(processContainingFrame(frameID)), frameID, event), [protectedThis = Ref { *this }] (bool, std::optional<RemoteWebTouchEvent> remoteWebTouchEvent) mutable {
+    sendWithAsyncReplyToProcessContainingFrame(frameID, Messages::EventDispatcher::TouchEvent(webPageIDInProcess(processContainingFrame(frameID)), frameID, WTF::move(event)), [protectedThis = Ref { *this }] (bool, std::optional<RemoteWebTouchEvent> remoteWebTouchEvent) mutable {
         if (!remoteWebTouchEvent)
             return;
-        protectedThis->sendUnpreventableTouchEvent(remoteWebTouchEvent->targetFrameID, remoteWebTouchEvent->transformedEvent);
+        protectedThis->sendUnpreventableTouchEvent(remoteWebTouchEvent->targetFrameID, WTF::move(remoteWebTouchEvent->transformedEvent));
     });
 }
 
-void WebPageProxy::handleUnpreventableTouchEvent(const NativeWebTouchEvent& event)
+void WebPageProxy::handleUnpreventableTouchEvent(NativeWebTouchEvent& event)
 {
     if (!hasRunningProcess())
         return;
@@ -5502,7 +5504,7 @@ void WebPageProxy::handleUnpreventableTouchEvent(const NativeWebTouchEvent& even
     if (touchEventsTrackingType == TrackingType::NotTracking)
         return;
 
-    sendUnpreventableTouchEvent(m_mainFrame->frameID(), event);
+    sendUnpreventableTouchEvent(m_mainFrame->frameID(), Ref { event });
 
     if (event.allTouchPointsAreReleased()) {
         internals().touchEventTracking.reset();
@@ -5523,7 +5525,7 @@ void WebPageProxy::processNextQueuedTouchEvent()
 
     auto& queuedEvent = internals().touchEventQueue.first();
     protect(legacyMainFrameProcess())->startResponsivenessTimer();
-    sendWithAsyncReplyToProcessContainingFrame(frameID, Messages::EventDispatcher::TouchEvent(webPageIDInProcess(processContainingFrame(frameID)), frameID, queuedEvent.forwardedEvent), [this, protectedThis = Ref { *this }] (IPC::Connection* connection, WebKit::WebEventType eventType, bool handled) mutable {
+    sendWithAsyncReplyToProcessContainingFrame(frameID, Messages::EventDispatcher::TouchEvent(webPageIDInProcess(processContainingFrame(frameID)), frameID, queuedEvent.forwardedEvent.copyRef()), [this, protectedThis = Ref { *this }] (IPC::Connection* connection, WebKit::WebEventType eventType, bool handled) mutable {
         RefPtr pageClient = this->pageClient();
         if (!pageClient)
             return;
@@ -5542,7 +5544,7 @@ void WebPageProxy::processNextQueuedTouchEvent()
         MESSAGE_CHECK_BASE(!internals().touchEventQueue.isEmpty(), connection);
         auto queuedEvents = internals().touchEventQueue.takeFirst();
 
-        MESSAGE_CHECK_BASE(eventType == queuedEvents.forwardedEvent.type(), connection);
+        MESSAGE_CHECK_BASE(eventType == queuedEvents.forwardedEvent->type(), connection);
         protect(legacyMainFrameProcess())->stopResponsivenessTimer();
 
         pageClient->doneWithTouchEvent(queuedEvents.forwardedEvent, handled);
@@ -5556,7 +5558,7 @@ void WebPageProxy::processNextQueuedTouchEvent()
     });
 }
 
-void WebPageProxy::handleTouchEvent(IPC::Connection*, const NativeWebTouchEvent& event)
+void WebPageProxy::handleTouchEvent(IPC::Connection*, Ref<NativeWebTouchEvent>&& event)
 {
     if (!hasRunningProcess())
         return;
@@ -5564,15 +5566,15 @@ void WebPageProxy::handleTouchEvent(IPC::Connection*, const NativeWebTouchEvent&
     if (!m_mainFrame)
         return;
 
-    if (event.type() == WebEventType::TouchMove && !internals().touchEventQueue.isEmpty()) {
+    if (event->type() == WebEventType::TouchMove && !internals().touchEventQueue.isEmpty()) {
         QueuedTouchEvents& lastEvent = internals().touchEventQueue.last();
-        if (lastEvent.forwardedEvent.type() == WebEventType::TouchMove) {
-            lastEvent.deferredTouchEvents.append(event);
+        if (lastEvent.forwardedEvent->type() == WebEventType::TouchMove) {
+            lastEvent.deferredTouchEvents.append(WTF::move(event));
             return;
         }
     }
 
-    internals().touchEventQueue.append(event);
+    internals().touchEventQueue.append(WTF::move(event));
 
     if (internals().touchEventQueue.size() == 1)
         processNextQueuedTouchEvent();
@@ -5583,7 +5585,7 @@ void WebPageProxy::touchEventHandlingCompleted(IPC::Connection* connection, std:
     MESSAGE_CHECK_BASE(!internals().touchEventQueue.isEmpty(), connection);
     auto queuedEvents = internals().touchEventQueue.takeFirst();
     if (eventType)
-        MESSAGE_CHECK_BASE(*eventType == queuedEvents.forwardedEvent.type(), connection);
+        MESSAGE_CHECK_BASE(*eventType == queuedEvents.forwardedEvent->type(), connection);
 
     RefPtr pageClient = this->pageClient();
     if (!pageClient)
@@ -5601,7 +5603,7 @@ void WebPageProxy::touchEventHandlingCompleted(IPC::Connection* connection, std:
 #endif
 }
 
-void WebPageProxy::handleTouchEvent(IPC::Connection* connection, const NativeWebTouchEvent& event)
+void WebPageProxy::handleTouchEvent(IPC::Connection* connection, Ref<NativeWebTouchEvent>&& event)
 {
     if (!hasRunningProcess())
         return;
@@ -5615,9 +5617,9 @@ void WebPageProxy::handleTouchEvent(IPC::Connection* connection, const NativeWeb
     // and animation on the page itself (kinetic scrolling, tap to zoom) etc, then
     // we do not send any of the events to the page even if is has listeners.
     if (!m_areActiveDOMObjectsAndAnimationsSuspended) {
-        internals().touchEventQueue.append(event);
+        internals().touchEventQueue.append(event.copyRef());
         protect(legacyMainFrameProcess())->startResponsivenessTimer();
-        sendWithAsyncReply(Messages::WebPage::TouchEvent(event), [this, protectedThis = Ref { *this }] (IPC::Connection* connection, std::optional<WebEventType> eventType, bool handled) {
+        sendWithAsyncReply(Messages::WebPage::TouchEvent(event.copyRef()), [this, protectedThis = Ref { *this }] (IPC::Connection* connection, std::optional<WebEventType> eventType, bool handled) {
             if (!m_pageClient)
                 return;
             if (eventType && connection)
@@ -5633,11 +5635,11 @@ void WebPageProxy::handleTouchEvent(IPC::Connection* connection, const NativeWeb
             // We attach the incoming events to the newest queued event so that all
             // the events are delivered in the correct order when the event is dequed.
             QueuedTouchEvents& lastEvent = internals().touchEventQueue.last();
-            lastEvent.deferredTouchEvents.append(event);
+            lastEvent.deferredTouchEvents.append(event.copyRef());
         }
     }
 
-    if (event.allTouchPointsAreReleased()) {
+    if (event->allTouchPointsAreReleased()) {
         internals().touchEventTracking.reset();
         didReleaseAllTouchPoints();
     }
@@ -7619,12 +7621,12 @@ void WebPageProxy::launchInitialProcessIfNecessary()
         launchProcess(Site(aboutBlankURL()), ProcessLaunchReason::InitialProcess);
 }
 
-void WebPageProxy::runJavaScriptInMainFrame(RunJavaScriptParameters&& parameters, bool wantsResult, CompletionHandler<void(Expected<JavaScriptEvaluationResult, std::optional<WebCore::ExceptionDetails>>)>&& callbackFunction)
+void WebPageProxy::runJavaScriptInMainFrame(RunJavaScriptParameters&& parameters, bool wantsResult, RunJavaScriptInFrameCompletionHandler&& callbackFunction)
 {
     runJavaScriptInFrameInScriptWorld(WTF::move(parameters), std::nullopt, API::ContentWorld::pageContentWorldSingleton(), wantsResult, WTF::move(callbackFunction));
 }
 
-void WebPageProxy::runJavaScriptInFrameInScriptWorld(RunJavaScriptParameters&& parameters, std::optional<WebCore::FrameIdentifier> frameID, API::ContentWorld& world, bool wantsResult, CompletionHandler<void(Expected<JavaScriptEvaluationResult, std::optional<WebCore::ExceptionDetails>>)>&& callbackFunction)
+void WebPageProxy::runJavaScriptInFrameInScriptWorld(RunJavaScriptParameters&& parameters, std::optional<WebCore::FrameIdentifier> frameID, API::ContentWorld& world, bool wantsResult, RunJavaScriptInFrameCompletionHandler&& callbackFunction)
 {
     static uintptr_t nextLoggingIdentifier;
     uintptr_t loggingIdentifier = nextLoggingIdentifier++;
@@ -9236,8 +9238,10 @@ void WebPageProxy::didNotifyUserActivation(IPC::Connection& connection, FrameIde
             addFrame(*descendant);
     }
 
-    for (auto& [process, frameIDs] : framesByProcess)
-        protect(process)->send(Messages::WebPage::UpdateUserActivationState(frameIDs, activationTime), webPageIDInProcess(process));
+    for (auto& [process, frameIDs] : framesByProcess) {
+        Ref protectedProcess = process;
+        protectedProcess->send(Messages::WebPage::UpdateUserActivationState(frameIDs, activationTime), webPageIDInProcess(protectedProcess));
+    }
 }
 
 void WebPageProxy::didHandleFirstUserGesture(IPC::Connection& connection, FrameIdentifier sourceFrameID, MonotonicTime gestureTime)
@@ -9259,8 +9263,10 @@ void WebPageProxy::didHandleFirstUserGesture(IPC::Connection& connection, FrameI
         framesByProcess.add(process, Vector<FrameIdentifier> { }).iterator->value.append(ancestor->frameID());
     }
 
-    for (auto& [process, frameIDs] : framesByProcess)
-        protect(process)->send(Messages::WebPage::UpdateLastHandledUserGestureTimestamp(frameIDs, gestureTime), webPageIDInProcess(process));
+    for (auto& [process, frameIDs] : framesByProcess) {
+        Ref protectedProcess = process;
+        protectedProcess->send(Messages::WebPage::UpdateLastHandledUserGestureTimestamp(frameIDs, gestureTime), webPageIDInProcess(protectedProcess));
+    }
 }
 
 void WebPageProxy::didConsumeUserActivation(IPC::Connection& connection, FrameIdentifier sourceFrameID)
@@ -9286,8 +9292,10 @@ void WebPageProxy::didConsumeUserActivation(IPC::Connection& connection, FrameId
         framesByProcess.add(process, Vector<FrameIdentifier> { }).iterator->value.append(frame->frameID());
     }
 
-    for (auto& [process, frameIDs] : framesByProcess)
-        protect(process)->send(Messages::WebPage::ConsumeUserActivations(frameIDs), webPageIDInProcess(process));
+    for (auto& [process, frameIDs] : framesByProcess) {
+        Ref protectedProcess = process;
+        protectedProcess->send(Messages::WebPage::ConsumeUserActivations(frameIDs), webPageIDInProcess(protectedProcess));
+    }
 }
 
 void WebPageProxy::didFinishLoadForFrame(IPC::Connection& connection, FrameIdentifier frameID, FrameInfoData&& frameInfo, ResourceRequest&& request, std::optional<WebCore::NavigationIdentifier> navigationID, const UserData& userData, WallTime timestamp)
@@ -12777,11 +12785,10 @@ NativeWebMouseEvent* WebPageProxy::Internals::currentlyProcessedMouseDownEvent()
     if (mouseEventQueue.isEmpty())
         return nullptr;
 
-    auto& event = mouseEventQueue.first();
-    if (event.type() != WebEventType::MouseDown)
+    if (mouseEventQueue.first()->type() != WebEventType::MouseDown)
         return nullptr;
 
-    return &event;
+    return mouseEventQueue.first().ptr();
 }
 #endif
 
@@ -13589,14 +13596,14 @@ void WebPageProxy::setCursorHiddenUntilMouseMoves(bool hiddenUntilMouseMoves)
 void WebPageProxy::mouseEventHandlingCompleted(bool handled, std::optional<RemoteUserInputEventData> remoteUserInputEventData)
 {
     if (remoteUserInputEventData) {
-        CheckedRef event = internals().mouseEventQueue.first();
+        Ref event = internals().mouseEventQueue.first();
         const auto originalPosition = event->position();
         const auto transformedPosition = remoteUserInputEventData->transformedPoint;
         event->setPosition(transformedPosition);
 
         const auto offset = originalPosition - transformedPosition;
         auto coalescedEvents = event->coalescedEvents();
-        for (CheckedRef coalescedEvent : coalescedEvents) {
+        for (Ref coalescedEvent : coalescedEvents) {
             const auto adjustedPosition = coalescedEvent->position() - offset;
             coalescedEvent->setPosition(adjustedPosition);
         }
@@ -13605,16 +13612,16 @@ void WebPageProxy::mouseEventHandlingCompleted(bool handled, std::optional<Remot
         // FIXME: If these sandbox extensions are important, find a way to get them to the iframe process.
         if (RefPtr targetFrame = WebFrameProxy::webFrame(remoteUserInputEventData->targetFrameID)) {
             startResponsivenessTimerForMouseEvent(*targetFrame, event->type());
-            sendMouseEvent(remoteUserInputEventData->targetFrameID, event, { });
+            sendMouseEvent(remoteUserInputEventData->targetFrameID, event.copyRef(), { });
         }
         return;
     }
 
     // Retire the last sent event now that WebProcess is done handling it.
-    auto event = internals().mouseEventQueue.takeFirst();
+    Ref event = internals().mouseEventQueue.takeFirst();
 #if ENABLE(CONTEXT_MENU_EVENT)
-    if (event.button() == WebMouseEventButton::Right) {
-        if (event.type() == WebEventType::MouseDown) {
+    if (event->button() == WebMouseEventButton::Right) {
+        if (event->type() == WebEventType::MouseDown) {
             ASSERT(m_contextMenuPreventionState == EventPreventionState::Waiting);
             m_contextMenuPreventionState = handled ? EventPreventionState::Prevented : EventPreventionState::Allowed;
         } else if (m_contextMenuPreventionState != EventPreventionState::Waiting)
@@ -13625,11 +13632,11 @@ void WebPageProxy::mouseEventHandlingCompleted(bool handled, std::optional<Remot
 #endif
 
 #if PLATFORM(GTK) || PLATFORM(WPE)
-    WTFEndSignpost(event.signpostIdentifier(), HandleMouseEvent, "handled: %s", handled ? "yes" : "no");
-    for (auto& coalescedEvent : event.coalescedEvents()) {
-        if (coalescedEvent.signpostIdentifier() == event.signpostIdentifier())
+    WTFEndSignpost(event->signpostIdentifier(), HandleMouseEvent, "handled: %s", handled ? "yes" : "no");
+    for (auto& coalescedEvent : event->coalescedEvents()) {
+        if (coalescedEvent->signpostIdentifier() == event->signpostIdentifier())
             continue;
-        WTFEndSignpost(coalescedEvent.signpostIdentifier(), HandleMouseEvent, "coalesced with: %" PRIuPTR, event.signpostIdentifier());
+        WTFEndSignpost(coalescedEvent->signpostIdentifier(), HandleMouseEvent, "coalesced with: %" PRIuPTR, event->signpostIdentifier());
     }
 #endif
 
@@ -13647,14 +13654,14 @@ void WebPageProxy::mouseEventHandlingCompleted(bool handled, std::optional<Remot
 void WebPageProxy::gestureEventHandlingCompleted(std::optional<WebEventType> eventType, bool handled, std::optional<RemoteUserInputEventData> remoteUserInputEventData)
 {
     if (remoteUserInputEventData) {
-        sendGestureEvent(remoteUserInputEventData->targetFrameID, internals().gestureEventQueue.first());
+        sendGestureEvent(remoteUserInputEventData->targetFrameID, internals().gestureEventQueue.first().copyRef());
         return;
     }
 
     // Retire the last sent event now that WebProcess is done handling it.
-    auto event = internals().gestureEventQueue.takeFirst();
+    Ref event = internals().gestureEventQueue.takeFirst();
     if (eventType)
-        MESSAGE_CHECK(m_legacyMainFrameProcess, *eventType == event.type());
+        MESSAGE_CHECK(m_legacyMainFrameProcess, *eventType == event->type());
 
     if (RefPtr pageClient = this->pageClient(); !handled && pageClient)
         pageClient->gestureEventWasNotHandledByWebCore(event);
@@ -13666,18 +13673,18 @@ void WebPageProxy::gestureEventHandlingCompleted(std::optional<WebEventType> eve
 
 void WebPageProxy::keyEventHandlingCompleted(bool handled)
 {
-    auto event = internals().keyEventQueue.takeFirst();
+    Ref event = internals().keyEventQueue.takeFirst();
 
 #if PLATFORM(WIN)
-    if (!handled && event.type() == WebEventType::RawKeyDown)
+    if (!handled && event->type() == WebEventType::RawKeyDown)
         dispatchPendingCharEvents(event);
 #endif
 
     bool canProcessMoreKeyEvents = !internals().keyEventQueue.isEmpty();
     if (canProcessMoreKeyEvents && m_mainFrame) {
-        auto nextEvent = internals().keyEventQueue.first();
+        Ref nextEvent = internals().keyEventQueue.first();
         LOG(KeyHandling, " UI process: sent keyEvent from keyEventHandlingCompleted");
-        sendKeyEvent(nextEvent);
+        sendKeyEvent(WTF::move(nextEvent));
     }
 
     // The call to doneWithKeyEvent may close this WebPage.
@@ -16534,7 +16541,7 @@ void WebPageProxy::cancelComposition(const String& compositionString)
     if (internals().keyEventQueue.size() > 1) {
         auto event = internals().keyEventQueue.takeFirst();
         internals().keyEventQueue.removeAllMatching([](const auto& event) {
-            return event.handledByInputMethod();
+            return event->handledByInputMethod();
         });
         internals().keyEventQueue.prepend(WTF::move(event));
     }
diff --git a/Source/WebKit/UIProcess/WebPageProxy.h b/Source/WebKit/UIProcess/WebPageProxy.h
index c76bcaf7453f..4ea66eca9f83 100644
--- a/Source/WebKit/UIProcess/WebPageProxy.h
+++ b/Source/WebKit/UIProcess/WebPageProxy.h
@@ -29,6 +29,7 @@
 // Use forward declarations and WebPageProxyInternals.h instead.
 #include "APIObject.h"
 #include "MessageReceiver.h"
+#include "RunJavaScriptResult.h"
 #include "TextExtractionAssertionScope.h"
 #include <WebCore/ProcessIdentifier.h>
 #include <WebCore/UserGestureTokenIdentifier.h>
@@ -1100,7 +1101,7 @@ class WebPageProxy final : public API::ObjectImpl<API::Object::Type::Page>, publ
     void viewWillStartLiveResize();
     void viewWillEndLiveResize();
 
-    void setInitialFocus(bool forward, bool isKeyboardEventValid, const std::optional<WebKeyboardEvent>&, CompletionHandler<void()>&&);
+    void setInitialFocus(bool forward, bool isKeyboardEventValid, RefPtr<WebKeyboardEvent>&&, CompletionHandler<void()>&&);
     
     void clearSelection(std::optional<WebCore::FrameIdentifier> = std::nullopt);
     void restoreSelectionInFocusedEditableElement();
@@ -1375,7 +1376,7 @@ class WebPageProxy final : public API::ObjectImpl<API::Object::Type::Page>, publ
 
     void windowAndViewFramesChanged(const WebCore::FloatRect& viewFrameInWindowCoordinates, const WebCore::FloatPoint& accessibilityViewCoordinates);
     void setMainFrameIsScrollable(bool);
-    bool shouldDelayWindowOrderingForEvent(const WebMouseEvent&);
+    bool shouldDelayWindowOrderingForEvent(Ref<WebMouseEvent>&&);
     void setRemoteLayerTreeRootNode(RemoteLayerTreeNode*);
 
 #if PLATFORM(MAC)
@@ -1470,10 +1471,10 @@ class WebPageProxy final : public API::ObjectImpl<API::Object::Type::Page>, publ
 
     bool NODELETE isProcessingMouseEvents() const;
     void processNextQueuedMouseEvent();
-    void sendMouseEvent(WebCore::FrameIdentifier, const NativeWebMouseEvent&, std::optional<Vector<SandboxExtensionHandle>>&&);
-    void handleMouseEvent(const NativeWebMouseEvent&);
+    void sendMouseEvent(WebCore::FrameIdentifier, Ref<NativeWebMouseEvent>&&, std::optional<Vector<SandboxExtensionHandle>>&&);
+    void handleMouseEvent(Ref<NativeWebMouseEvent>&&);
     void recordUIProcessUserActivation(const WebEvent&);
-    void dispatchMouseDidMoveOverElementAsynchronously(const NativeWebMouseEvent&);
+    void dispatchMouseDidMoveOverElementAsynchronously(Ref<NativeWebMouseEvent>&&);
 
     void doAfterProcessingAllPendingMouseEvents(Function<void()>&&);
     void didFinishProcessingAllPendingMouseEvents();
@@ -1495,32 +1496,32 @@ class WebPageProxy final : public API::ObjectImpl<API::Object::Type::Page>, publ
 #endif
 
     bool NODELETE isProcessingWheelEvents() const;
-    void handleNativeWheelEvent(const NativeWebWheelEvent&);
+    void handleNativeWheelEvent(Ref<NativeWebWheelEvent>&&);
     void interruptSyntheticMomentumScrolling();
-    void continueWheelEventHandling(const WebWheelEvent&, const WebCore::WheelEventHandlingResult&, std::optional<bool> willStartSwipe);
+    void continueWheelEventHandling(Ref<WebWheelEvent>&&, const WebCore::WheelEventHandlingResult&, std::optional<bool> willStartSwipe);
     void wheelEventHandlingCompleted(bool wasHandled);
     void didEndSyntheticMomentumScrolling();
 
     bool NODELETE isProcessingKeyboardEvents() const;
-    void sendKeyEvent(const NativeWebKeyboardEvent&);
-    bool handleKeyboardEvent(const NativeWebKeyboardEvent&);
+    void sendKeyEvent(Ref<NativeWebKeyboardEvent>&&);
+    bool handleKeyboardEvent(Ref<NativeWebKeyboardEvent>&&);
 #if PLATFORM(WIN)
     void dispatchPendingCharEvents(const NativeWebKeyboardEvent&);
 #endif
 
 #if ENABLE(MAC_GESTURE_EVENTS)
-    void sendGestureEvent(WebCore::FrameIdentifier, const NativeWebGestureEvent&);
-    void handleGestureEvent(const NativeWebGestureEvent&);
+    void sendGestureEvent(WebCore::FrameIdentifier, Ref<NativeWebGestureEvent>&&);
+    void handleGestureEvent(Ref<NativeWebGestureEvent>&&);
     void processNextQueuedGestureEvent();
 #endif
 
 #if ENABLE(IOS_TOUCH_EVENTS)
     void didBeginTouchPoint(WebCore::FloatPoint locationInRootView);
     void handlePreventableTouchEvent(NativeWebTouchEvent&);
-    void handleUnpreventableTouchEvent(const NativeWebTouchEvent&);
+    void handleUnpreventableTouchEvent(NativeWebTouchEvent&);
 
 #elif ENABLE(TOUCH_EVENTS)
-    void handleTouchEvent(IPC::Connection*, const NativeWebTouchEvent&);
+    void handleTouchEvent(IPC::Connection*, Ref<NativeWebTouchEvent>&&);
 #endif
 
 #if PLATFORM(MAC)
@@ -1775,8 +1776,9 @@ class WebPageProxy final : public API::ObjectImpl<API::Object::Type::Page>, publ
     void getWebArchiveDataWithFrame(WebFrameProxy&, CompletionHandler<void(API::Data*)>&&);
     void getWebArchiveDataWithSelectedFrames(WebFrameProxy&, const std::optional<HashSet<WebCore::FrameIdentifier>>&, CompletionHandler<void(API::Data*)>&&);
 #endif
-    void runJavaScriptInMainFrame(RunJavaScriptParameters&&, bool, CompletionHandler<void(Expected<JavaScriptEvaluationResult, std::optional<WebCore::ExceptionDetails>>)>&&);
-    void runJavaScriptInFrameInScriptWorld(RunJavaScriptParameters&&, std::optional<WebCore::FrameIdentifier>, API::ContentWorld&, bool, CompletionHandler<void(Expected<JavaScriptEvaluationResult, std::optional<WebCore::ExceptionDetails>>)>&&);
+    using RunJavaScriptInFrameCompletionHandler = CompletionHandler<void(RunJavaScriptResult&&)>;
+    void runJavaScriptInMainFrame(RunJavaScriptParameters&&, bool, RunJavaScriptInFrameCompletionHandler&&);
+    void runJavaScriptInFrameInScriptWorld(RunJavaScriptParameters&&, std::optional<WebCore::FrameIdentifier>, API::ContentWorld&, bool, RunJavaScriptInFrameCompletionHandler&&);
     void clearContentWorld(API::ContentWorld&, CompletionHandler<void()>&&);
     void getAccessibilityTreeData(CompletionHandler<void(API::Data*)>&&);
     void updateRenderingWithForcedRepaint(CompletionHandler<void()>&&);
@@ -2636,14 +2638,14 @@ class WebPageProxy final : public API::ObjectImpl<API::Object::Type::Page>, publ
 #if PLATFORM(MAC)
     void changeUniversalAccessZoomFocus(const WebCore::IntRect&, const WebCore::IntRect&);
 
-    bool acceptsFirstMouse(int eventNumber, const WebMouseEvent&);
+    bool acceptsFirstMouse(int eventNumber, Ref<WebMouseEvent>&&);
 #endif
 
     bool isServiceWorkerPage() const { return m_isServiceWorkerPage; }
 
 #if PLATFORM(IOS_FAMILY)
-    void handleWheelEventWithoutScrolling(const WebWheelEvent&, CompletionHandler<void(bool)>&&);
-    void sendWheelEventWithoutScrolling(WebCore::FrameIdentifier, const WebWheelEvent&, CompletionHandler<void(bool)>&&);
+    void handleWheelEventWithoutScrolling(Ref<WebWheelEvent>&&, CompletionHandler<void(bool)>&&);
+    void sendWheelEventWithoutScrolling(WebCore::FrameIdentifier, Ref<WebWheelEvent>&&, CompletionHandler<void(bool)>&&);
 #endif
 
 #if ENABLE(CONTEXT_MENUS) && ENABLE(IMAGE_ANALYSIS)
@@ -3502,8 +3504,8 @@ class WebPageProxy final : public API::ObjectImpl<API::Object::Type::Page>, publ
 
     void setRenderTreeSize(uint64_t treeSize) { m_renderTreeSize = treeSize; }
 
-    void handleWheelEvent(const WebWheelEvent&);
-    void sendWheelEvent(WebCore::FrameIdentifier, const WebWheelEvent&, OptionSet<WebCore::WheelEventProcessingSteps>, WebCore::RectEdges<WebCore::RubberBandingBehavior> rubberBandableEdges, std::optional<bool> willStartSwipe, bool wasHandledForScrolling);
+    void handleWheelEvent(Ref<WebWheelEvent>&&);
+    void sendWheelEvent(WebCore::FrameIdentifier, Ref<WebWheelEvent>&&, OptionSet<WebCore::WheelEventProcessingSteps>, WebCore::RectEdges<WebCore::RubberBandingBehavior> rubberBandableEdges, std::optional<bool> willStartSwipe, bool wasHandledForScrolling);
     void handleWheelEventReply(IPC::Connection*, const WebWheelEvent&, std::optional<WebCore::ScrollingNodeID>, std::optional<WebCore::WheelScrollGestureState>, bool wasHandledForScrolling, bool wasHandledByWebProcess);
 
     void cacheWheelEventScrollingAccelerationCurve(const NativeWebWheelEvent&);
@@ -3688,8 +3690,8 @@ class WebPageProxy final : public API::ObjectImpl<API::Object::Type::Page>, publ
 
     template<typename F> decltype(auto) sendToWebPage(std::optional<WebCore::FrameIdentifier>, F&&);
 
-    void sendPreventableTouchEvent(WebCore::FrameIdentifier, const WebTouchEvent&);
-    void sendUnpreventableTouchEvent(WebCore::FrameIdentifier, const WebTouchEvent&);
+    void sendPreventableTouchEvent(WebCore::FrameIdentifier, Ref<WebTouchEvent>&&);
+    void sendUnpreventableTouchEvent(WebCore::FrameIdentifier, Ref<WebTouchEvent>&&);
 
     void broadcastFocusedFrameToOtherProcesses(IPC::Connection&, std::optional<WebCore::FrameIdentifier>&&);
 
diff --git a/Source/WebKit/UIProcess/WebPageProxyInternals.h b/Source/WebKit/UIProcess/WebPageProxyInternals.h
index 39c45248e575..65457ab5e40b 100644
--- a/Source/WebKit/UIProcess/WebPageProxyInternals.h
+++ b/Source/WebKit/UIProcess/WebPageProxyInternals.h
@@ -136,12 +136,12 @@ struct SpeechSynthesisData {
 #if ENABLE(TOUCH_EVENTS)
 
 struct QueuedTouchEvents {
-    QueuedTouchEvents(const NativeWebTouchEvent& event)
-        : forwardedEvent(event)
+    QueuedTouchEvents(Ref<NativeWebTouchEvent>&& event)
+        : forwardedEvent(WTF::move(event))
     {
     }
-    NativeWebTouchEvent forwardedEvent;
-    Vector<NativeWebTouchEvent> deferredTouchEvents;
+    Ref<NativeWebTouchEvent> forwardedEvent;
+    Vector<Ref<NativeWebTouchEvent>> deferredTouchEvents;
 };
 
 struct TouchEventTracking {
@@ -236,7 +236,7 @@ struct WebPageProxy::Internals final : WebPopupMenuProxy::Client
     WebCore::IntSize fixedLayoutSize;
     GeolocationPermissionRequestManagerProxy geolocationPermissionRequestManager;
     HiddenPageThrottlingAutoIncreasesCounter::Token hiddenPageDOMTimerThrottlingAutoIncreasesCount;
-    Deque<NativeWebKeyboardEvent> keyEventQueue;
+    Deque<Ref<NativeWebKeyboardEvent>> keyEventQueue;
     WebCore::RectEdges<bool> mainFramePinnedState { true, true, true, true };
     WebCore::LayoutPoint maxStableLayoutViewportOrigin;
     WebCore::FloatSize maximumUnobscuredSize;
@@ -246,8 +246,8 @@ struct WebPageProxy::Internals final : WebPopupMenuProxy::Client
     WebCore::LayoutPoint minStableLayoutViewportOrigin;
     WebCore::IntSize minimumSizeForAutoLayout;
     WebCore::FloatSize minimumUnobscuredSize;
-    Deque<NativeWebMouseEvent> mouseEventQueue;
-    Vector<WebMouseEvent> coalescedMouseEvents;
+    Deque<Ref<NativeWebMouseEvent>> mouseEventQueue;
+    Vector<Ref<WebMouseEvent>> coalescedMouseEvents;
     WebCore::MediaProducerMutedStateFlags mutedState;
     WebNotificationManagerMessageHandler notificationManagerMessageHandler;
     OptionSet<WebCore::LayoutMilestone> observedLayoutMilestones;
@@ -333,7 +333,7 @@ struct WebPageProxy::Internals final : WebPopupMenuProxy::Client
     RefPtr<WebColorPicker> colorPicker;
 
 #if ENABLE(MAC_GESTURE_EVENTS)
-    Deque<NativeWebGestureEvent> gestureEventQueue;
+    Deque<Ref<NativeWebGestureEvent>> gestureEventQueue;
     unsigned droppedGestureEventCount { 0 };
 #endif
 
diff --git a/Source/WebKit/UIProcess/WebPageProxyMessageReceiverRegistration.cpp b/Source/WebKit/UIProcess/WebPageProxyMessageReceiverRegistration.cpp
index 62e19217409b..e8ca17dac08f 100644
--- a/Source/WebKit/UIProcess/WebPageProxyMessageReceiverRegistration.cpp
+++ b/Source/WebKit/UIProcess/WebPageProxyMessageReceiverRegistration.cpp
@@ -57,9 +57,10 @@ void WebPageProxyMessageReceiverRegistration::transferMessageReceivingFrom(WebPa
 {
     ASSERT(!m_data);
     if (auto data = std::exchange(oldRegistration.m_data, std::nullopt)) {
-        protect(data->process)->removeMessageReceiver(Messages::WebPageProxy::messageReceiverName(), data->webPageID);
-        protect(data->process)->removeMessageReceiver(Messages::WebBackForwardList::messageReceiverName(), data->webPageID);
-        startReceivingMessages(data->process, data->webPageID, newWebPageProxyReceiver, newBackForwardListReceiver);
+        Ref process = WTF::move(data->process);
+        process->removeMessageReceiver(Messages::WebPageProxy::messageReceiverName(), data->webPageID);
+        process->removeMessageReceiver(Messages::WebBackForwardList::messageReceiverName(), data->webPageID);
+        startReceivingMessages(process, data->webPageID, newWebPageProxyReceiver, newBackForwardListReceiver);
     } else {
         stopReceivingMessages();
         ASSERT_NOT_REACHED();
diff --git a/Source/WebKit/UIProcess/WebPageProxyMessageReceiverRegistration.h b/Source/WebKit/UIProcess/WebPageProxyMessageReceiverRegistration.h
index d4058ebb1d52..b1bfa492d944 100644
--- a/Source/WebKit/UIProcess/WebPageProxyMessageReceiverRegistration.h
+++ b/Source/WebKit/UIProcess/WebPageProxyMessageReceiverRegistration.h
@@ -45,7 +45,6 @@ class WebPageProxyMessageReceiverRegistration {
     struct Data {
         WebCore::PageIdentifier webPageID;
         Ref<WebProcessProxy> process;
-
     };
     std::optional<Data> m_data;
 };
diff --git a/Source/WebKit/UIProcess/WebProcessPool.cpp b/Source/WebKit/UIProcess/WebProcessPool.cpp
index 8a87dc01f738..058a2121042e 100644
--- a/Source/WebKit/UIProcess/WebProcessPool.cpp
+++ b/Source/WebKit/UIProcess/WebProcessPool.cpp
@@ -542,7 +542,7 @@ GPUProcessProxy& WebProcessPool::ensureGPUProcess()
         m_gpuProcess = gpuProcess.copyRef();
         for (Ref process : m_processes)
             gpuProcess->updatePreferences(process);
-        gpuProcess->updateScreenPropertiesIfNeeded();
+        gpuProcess->updateScreenPropertiesIfNeeded(*this);
     }
     return *m_gpuProcess;
 }
@@ -1447,7 +1447,7 @@ Ref<WebPageProxy> WebProcessPool::createWebPage(PageClient& pageClient, Ref<API:
 
     if (RefPtr gpuProcess = GPUProcessProxy::singletonIfCreated()) {
         gpuProcess->updatePreferences(*process);
-        gpuProcess->updateScreenPropertiesIfNeeded();
+        gpuProcess->updateScreenPropertiesIfNeeded(*this);
     }
 #endif
 
diff --git a/Source/WebKit/UIProcess/WebProcessPool.h b/Source/WebKit/UIProcess/WebProcessPool.h
index 65c5e2fed36e..21f1cb3b0106 100644
--- a/Source/WebKit/UIProcess/WebProcessPool.h
+++ b/Source/WebKit/UIProcess/WebProcessPool.h
@@ -64,6 +64,7 @@ OBJC_CLASS WKProcessPoolWeakObserver;
 
 #if PLATFORM(MAC)
 #include <WebCore/PowerObserverMac.h>
+#include <WebCore/ScreenProperties.h>
 #include <pal/system/SystemSleepListener.h>
 #endif
 
@@ -106,6 +107,7 @@ enum class GamepadHapticEffectType : uint8_t;
 enum class ProcessSwapDisposition : uint8_t;
 struct GamepadEffectParameters;
 struct MockMediaDevice;
+struct ScreenProperties;
 #if PLATFORM(COCOA)
 class PowerSourceNotifier;
 #endif
@@ -259,6 +261,7 @@ class WebProcessPool final
 #endif
 
 #if PLATFORM(MAC)
+    const WebCore::ScreenProperties& cachedScreenProperties();
     void displayPropertiesChanged(WebCore::PlatformDisplayID, CGDisplayChangeSummaryFlags);
 #endif
 
@@ -743,7 +746,15 @@ class WebProcessPool final
     void clearAudibleActivity();
 
 #if PLATFORM(COCOA)
+    enum class ScreenPropertiesState : uint8_t {
+        Idle,
+        Collecting,
+        CollectingWithUpdatePending,
+    };
+
     void screenPropertiesUpdateTimerFired();
+    void didCollectScreenProperties(WebCore::ScreenProperties&&);
+    void applyEDRSuppressionIfNeeded(WebCore::ScreenProperties&);
 #endif
 
 #if PLATFORM(IOS_FAMILY)
@@ -1027,6 +1038,11 @@ class WebProcessPool final
 
     ApproximateTime m_lastScreenPropertiesUpdateTime;
     RunLoop::Timer m_screenPropertiesUpdateTimer;
+    ScreenPropertiesState m_screenPropertiesState { ScreenPropertiesState::Idle };
+#endif
+
+#if PLATFORM(MAC)
+    std::optional<WebCore::ScreenProperties> m_cachedScreenProperties;
 #endif
 
 #if ENABLE(IPC_TESTING_API)
diff --git a/Source/WebKit/UIProcess/WebProcessProxy.cpp b/Source/WebKit/UIProcess/WebProcessProxy.cpp
index 59887853ce62..263aa08905fa 100644
--- a/Source/WebKit/UIProcess/WebProcessProxy.cpp
+++ b/Source/WebKit/UIProcess/WebProcessProxy.cpp
@@ -767,11 +767,12 @@ bool WebProcessProxy::shouldSendPendingMessage(const IPC::Encoder& encoder)
             if (RefPtr page = WebProcessProxy::webPage(*pageID)) {
                 auto url = loadParameters->request.url();
                 page->maybeInitializeSandboxExtensionHandle(static_cast<WebProcessProxy&>(*this), url, *resourceDirectoryURL,  *checkAssumedReadAccessToResourceURL, [weakThis = WeakPtr { *this }, destinationID, loadParameters = WTF::move(loadParameters)] (std::optional<SandboxExtension::Handle>&& sandboxExtension) mutable {
-                    if (!weakThis)
+                    RefPtr protectedThis = weakThis;
+                    if (!protectedThis)
                         return;
                     if (sandboxExtension)
                         loadParameters->sandboxExtensionHandle = WTF::move(*sandboxExtension);
-                    weakThis->send(Messages::WebPage::LoadRequest(WTF::move(*loadParameters)), destinationID);
+                    protectedThis->send(Messages::WebPage::LoadRequest(WTF::move(*loadParameters)), destinationID);
                 });
             }
         } else
@@ -793,11 +794,12 @@ bool WebProcessProxy::shouldSendPendingMessage(const IPC::Encoder& encoder)
         auto destinationID = decoder->destinationID();
         auto frameState = parameters->frameState;
         auto completionHandler = [weakThis = WeakPtr { *this }, parameters = WTF::move(parameters), destinationID] (std::optional<SandboxExtension::Handle>&& sandboxExtension) mutable {
-            if (!weakThis)
+            RefPtr protectedThis = weakThis;
+            if (!protectedThis)
                 return;
             if (sandboxExtension)
                 parameters->sandboxExtensionHandle = WTF::move(*sandboxExtension);
-            weakThis->send(Messages::WebPage::GoToBackForwardItem(WTF::move(*parameters)), destinationID);
+            protectedThis->send(Messages::WebPage::GoToBackForwardItem(WTF::move(*parameters)), destinationID);
         };
         if (RefPtr page = WebProcessProxy::webPage(*pageID)) {
             if (RefPtr item = WebBackForwardListItem::itemForID(*frameState->itemID))
diff --git a/Source/WebKit/UIProcess/XR/ios/WKARPresentationSession.mm b/Source/WebKit/UIProcess/XR/ios/WKARPresentationSession.mm
index 253cf4900c91..887607d4d3fa 100644
--- a/Source/WebKit/UIProcess/XR/ios/WKARPresentationSession.mm
+++ b/Source/WebKit/UIProcess/XR/ios/WKARPresentationSession.mm
@@ -36,6 +36,7 @@
 #import <WebCore/PlatformXRPose.h>
 #import <wtf/RunLoop.h>
 #import <wtf/WeakObjCPtr.h>
+#import <wtf/darwin/DispatchExtras.h>
 #import <wtf/darwin/DispatchOSObject.h>
 
 #import <pal/cocoa/ARKitSoftLink.h>
@@ -396,7 +397,7 @@ - (nullable instancetype)initWithSession:(_WKARPresentationSession *)session
 {
     self = [super init];
     if (self) {
-        _accessQueue = adoptOSObject(dispatch_queue_create("com.apple.WebContent._WKTransientGestureRecognizer.AccessQueue", DISPATCH_QUEUE_SERIAL_WITH_AUTORELEASE_POOL));
+        _accessQueue = adoptOSObject(dispatch_queue_create("com.apple.WebContent._WKTransientGestureRecognizer.AccessQueue", serialQueueWithAutoreleasePoolAttrSingleton()));
         _session = session;
         _transientActions = adoptNS([NSMutableDictionary new]);
     }
diff --git a/Source/WebKit/UIProcess/XR/xros/WKXRTrackingManager.mm b/Source/WebKit/UIProcess/XR/xros/WKXRTrackingManager.mm
index e8b2065859bf..062d74f32c71 100644
--- a/Source/WebKit/UIProcess/XR/xros/WKXRTrackingManager.mm
+++ b/Source/WebKit/UIProcess/XR/xros/WKXRTrackingManager.mm
@@ -31,6 +31,7 @@
 #import "Logging.h"
 #import <WebCore/WebCoreObjCExtras.h>
 #import <wtf/OSObjectPtr.h>
+#import <wtf/darwin/DispatchExtras.h>
 
 #import <pal/cocoa/ARKitSoftLink.h>
 
@@ -101,7 +102,7 @@ - (instancetype)initWithHandTrackingEnabled:(BOOL)handTrackingEnabled layerRende
     if (!(self = [super init]))
         return nil;
 
-    _accessQueue = dispatch_queue_create("com.apple.WebContent.WKXRTrackingManager.AccessQueue", DISPATCH_QUEUE_SERIAL_WITH_AUTORELEASE_POOL);
+    _accessQueue = dispatch_queue_create("com.apple.WebContent.WKXRTrackingManager.AccessQueue", serialQueueWithAutoreleasePoolAttrSingleton());
 #if ENABLE(WEBXR_HANDS) && !PLATFORM(IOS_FAMILY_SIMULATOR)
     _handTrackingEnabled = handTrackingEnabled;
 #else
diff --git a/Source/WebKit/UIProcess/gtk/PointerLockManager.cpp b/Source/WebKit/UIProcess/gtk/PointerLockManager.cpp
index 99148dc7191c..f2b08b514936 100644
--- a/Source/WebKit/UIProcess/gtk/PointerLockManager.cpp
+++ b/Source/WebKit/UIProcess/gtk/PointerLockManager.cpp
@@ -97,7 +97,7 @@ bool PointerLockManager::unlock()
 
 void PointerLockManager::handleMotion(const FloatSize& delta)
 {
-    m_webPage.handleMouseEvent(NativeWebMouseEvent(WebEventType::MouseMove, m_button, m_buttons, IntPoint(m_position), IntPoint(m_initialPoint), 0, m_modifiers, delta, mousePointerID, mousePointerEventType(), PlatformMouseEvent::IsTouch::No));
+    m_webPage.handleMouseEvent(NativeWebMouseEvent::create(WebEventType::MouseMove, m_button, m_buttons, IntPoint(m_position), IntPoint(m_initialPoint), 0, m_modifiers, delta, mousePointerID, mousePointerEventType(), PlatformMouseEvent::IsTouch::No));
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit/UIProcess/gtk/ViewGestureControllerGtk.cpp b/Source/WebKit/UIProcess/gtk/ViewGestureControllerGtk.cpp
index 3bce2ca0eaf4..ff9d65fdc393 100644
--- a/Source/WebKit/UIProcess/gtk/ViewGestureControllerGtk.cpp
+++ b/Source/WebKit/UIProcess/gtk/ViewGestureControllerGtk.cpp
@@ -178,7 +178,7 @@ bool ViewGestureController::SwipeProgressTracker::handleEvent(PlatformGtkScrollD
     }
 
     if (m_state == State::Pending) {
-        m_viewGestureController->beginSwipeGesture(m_targetItem.get(), m_direction);
+        m_viewGestureController->beginSwipeGesture(protect(m_targetItem), m_direction);
         m_state = State::Scrolling;
     }
 
@@ -214,7 +214,7 @@ bool ViewGestureController::SwipeProgressTracker::handleEvent(PlatformGtkScrollD
     float minProgress = !swipingLeft ? -1 : 0;
     m_progress = clampTo<float>(m_progress, minProgress, maxProgress);
 
-    m_viewGestureController->handleSwipeGesture(m_targetItem.get(), m_progress, m_direction);
+    m_viewGestureController->handleSwipeGesture(protect(m_targetItem), m_progress, m_direction);
 
     return true;
 }
@@ -279,7 +279,7 @@ gboolean ViewGestureController::SwipeProgressTracker::onAnimationTick(GdkFrameCl
 
     m_progress = m_startProgress + (m_endProgress - m_startProgress) * easeOutCubic(animationProgress);
 
-    m_viewGestureController->handleSwipeGesture(m_targetItem.get(), m_progress, m_direction);
+    m_viewGestureController->handleSwipeGesture(protect(m_targetItem), m_progress, m_direction);
     if (frameTime >= m_endTime) {
         m_tickCallbackID = 0;
         endAnimation();
@@ -292,7 +292,7 @@ gboolean ViewGestureController::SwipeProgressTracker::onAnimationTick(GdkFrameCl
 void ViewGestureController::SwipeProgressTracker::endAnimation()
 {
     m_state = State::Finishing;
-    m_viewGestureController->endSwipeGesture(m_targetItem.get(), m_cancelled);
+    m_viewGestureController->endSwipeGesture(protect(m_targetItem), m_cancelled);
 }
 
 #if !USE(GTK4)
diff --git a/Source/WebKit/UIProcess/ios/WKContentViewInteraction.mm b/Source/WebKit/UIProcess/ios/WKContentViewInteraction.mm
index acafd3ac6751..41d741eed045 100644
--- a/Source/WebKit/UIProcess/ios/WKContentViewInteraction.mm
+++ b/Source/WebKit/UIProcess/ios/WKContentViewInteraction.mm
@@ -2268,8 +2268,8 @@ - (void)_touchEventsRecognized
     }
 
 #if ENABLE(TOUCH_EVENTS)
-    WebKit::NativeWebTouchEvent nativeWebTouchEvent { lastTouchEvent, [_touchEventGestureRecognizer modifierFlags] };
-    nativeWebTouchEvent.setCanPreventNativeGestures(_touchEventsCanPreventNativeGestures || [_touchEventGestureRecognizer isDefaultPrevented]);
+    Ref nativeWebTouchEvent = WebKit::NativeWebTouchEvent::create(lastTouchEvent, [_touchEventGestureRecognizer modifierFlags]);
+    nativeWebTouchEvent->setCanPreventNativeGestures(_touchEventsCanPreventNativeGestures || [_touchEventGestureRecognizer isDefaultPrevented]);
 
     [self _handleTouchActionsForTouchEvent:nativeWebTouchEvent];
 
@@ -2281,14 +2281,14 @@ - (void)_touchEventsRecognized
     else
         _page->handleUnpreventableTouchEvent(nativeWebTouchEvent);
 
-    if (nativeWebTouchEvent.allTouchPointsAreReleased()) {
+    if (nativeWebTouchEvent->allTouchPointsAreReleased()) {
         _touchEventsCanPreventNativeGestures = YES;
         _touchStartedNearSelectionHandle = NO;
 
         if (!_page->isScrollingOrZooming())
             [self _resetPanningPreventionFlags];
 
-        if (nativeWebTouchEvent.isPotentialTap() && self.hasHiddenContentEditable && self._hasFocusedElement && !self.window.keyWindow)
+        if (nativeWebTouchEvent->isPotentialTap() && self.hasHiddenContentEditable && self._hasFocusedElement && !self.window.keyWindow)
             [self.window makeKeyWindow];
 
         auto stopDeferringNativeGesturesIfNeeded = [] (WKDeferringGestureRecognizer *gestureRecognizer) {
@@ -7782,7 +7782,7 @@ - (void)handleKeyWebEvent:(::WebEvent *)theEvent
 
 - (void)_internalHandleKeyWebEvent:(::WebEvent *)theEvent
 {
-    protect(_page)->handleKeyboardEvent(WebKit::NativeWebKeyboardEvent(theEvent, WebKit::NativeWebKeyboardEvent::HandledByInputMethod::No));
+    protect(_page)->handleKeyboardEvent(WebKit::NativeWebKeyboardEvent::create(theEvent, WebKit::NativeWebKeyboardEvent::HandledByInputMethod::No));
 }
 
 - (void)handleKeyWebEvent:(::WebEvent *)event withCompletionHandler:(void (^)(::WebEvent *theEvent, BOOL wasHandled))completionHandler
@@ -7851,11 +7851,11 @@ - (void)_internalHandleKeyWebEvent:(::WebEvent *)event withCompletionHandler:(vo
     if ([self _deferKeyEventToInputMethodEditing:event]) {
         completionHandler(event, YES);
         _isDeferringKeyEventsToInputMethod = YES;
-        protect(_page)->handleKeyboardEvent(WebKit::NativeWebKeyboardEvent(event, HandledByInputMethod::Yes));
+        protect(_page)->handleKeyboardEvent(WebKit::NativeWebKeyboardEvent::create(event, HandledByInputMethod::Yes));
         return;
     }
 
-    if (protect(_page)->handleKeyboardEvent(WebKit::NativeWebKeyboardEvent(event, HandledByInputMethod::No)))
+    if (protect(_page)->handleKeyboardEvent(WebKit::NativeWebKeyboardEvent::create(event, HandledByInputMethod::No)))
         _keyWebEventHandlers.append({ event, makeBlockPtr(completionHandler) });
     else
         completionHandler(event, NO);
@@ -12433,8 +12433,9 @@ - (void)setUpMouseGestureRecognizer
     [self _configureMouseGestureRecognizer];
 }
 
-- (void)mouseInteraction:(WKMouseInteraction *)interaction changedWithEvent:(const WebKit::NativeWebMouseEvent&)event
+- (void)mouseInteraction:(WKMouseInteraction *)interaction changedWithEvent:(Ref<WebKit::NativeWebMouseEvent>&&)eventRef
 {
+    const auto& event = eventRef.get();
     Ref page = *_page;
     if (!page->hasRunningProcess())
         return;
@@ -12451,7 +12452,7 @@ - (void)mouseInteraction:(WKMouseInteraction *)interaction changedWithEvent:(con
             [self.window makeKeyWindow];
     }
 
-    page->handleMouseEvent(event);
+    page->handleMouseEvent(WTF::move(eventRef));
 }
 
 #if ENABLE(POINTER_LOCK)
diff --git a/Source/WebKit/UIProcess/ios/WKMouseInteraction.h b/Source/WebKit/UIProcess/ios/WKMouseInteraction.h
index a30399ea5f36..d39506fc15e3 100644
--- a/Source/WebKit/UIProcess/ios/WKMouseInteraction.h
+++ b/Source/WebKit/UIProcess/ios/WKMouseInteraction.h
@@ -33,7 +33,7 @@
 @class WKMouseInteraction;
 
 @protocol WKMouseInteractionDelegate<NSObject>
-- (void)mouseInteraction:(WKMouseInteraction *)interaction changedWithEvent:(const WebKit::NativeWebMouseEvent&)event;
+- (void)mouseInteraction:(WKMouseInteraction *)interaction changedWithEvent:(Ref<WebKit::NativeWebMouseEvent>&&)event;
 #if ENABLE(POINTER_LOCK)
 - (void)mouseInteractionDidLoseMouseDeviceDuringPointerLock:(WKMouseInteraction *)interaction;
 #endif
diff --git a/Source/WebKit/UIProcess/ios/WKMouseInteraction.mm b/Source/WebKit/UIProcess/ios/WKMouseInteraction.mm
index 97c67b789a23..425960aface1 100644
--- a/Source/WebKit/UIProcess/ios/WKMouseInteraction.mm
+++ b/Source/WebKit/UIProcess/ios/WKMouseInteraction.mm
@@ -255,10 +255,10 @@ inline static String pointerType(UITouchType type)
     return WebCore::mousePointerEventType();
 }
 
-- (std::optional<WebKit::NativeWebMouseEvent>)createMouseEventWithType:(std::optional<WebKit::WebEventType>)type wasCancelled:(BOOL)cancelled
+- (RefPtr<WebKit::NativeWebMouseEvent>)createMouseEventWithType:(std::optional<WebKit::WebEventType>)type wasCancelled:(BOOL)cancelled
 {
     if (!type)
-        return std::nullopt;
+        return nullptr;
 
     auto modifiers = WebKit::WebIOSEventFactory::webEventModifiersForUIKeyModifierFlags(self._activeGesture.modifierFlags);
     UIEventButtonMask currentButtonMask = _pressedButtonMask.value_or(0);
@@ -311,7 +311,7 @@ inline static String pointerType(UITouchType type)
     }();
     auto delta = point - WebCore::DoublePoint { [currentTouch previousLocationInView:self.view] };
     // UITouch's timestamp uses mach_absolute_time as its timebase, same as MonotonicTime.
-    return WebKit::NativeWebMouseEvent {
+    return WebKit::NativeWebMouseEvent::create(
         *type,
         button,
         static_cast<unsigned short>(buttons),
@@ -325,8 +325,7 @@ inline static String pointerType(UITouchType type)
         MonotonicTime::fromRawSeconds(currentTouch.timestamp),
         0,
         cancelled ? WebKit::GestureWasCancelled::Yes : WebKit::GestureWasCancelled::No,
-        pointerType(currentTouch.type)
-    };
+        pointerType(currentTouch.type));
 }
 
 #pragma mark - UIInteraction
@@ -406,7 +405,7 @@ - (void)_hoverGestureRecognized:(UIHoverGestureRecognizer *)gestureRecognizer
     _lastLocation = location;
     auto mouseEvent = [self createMouseEventWithType:WebKit::WebEventType::MouseMove wasCancelled:isCancelled];
     if (mouseEvent)
-        [protect(_delegate) mouseInteraction:self changedWithEvent:*mouseEvent];
+        [protect(_delegate) mouseInteraction:self changedWithEvent:mouseEvent.releaseNonNull()];
 }
 
 - (void)_updateMouseTouches:(NSSet<UITouch *> *)touches
@@ -443,7 +442,7 @@ - (void)_updateMouseTouches:(NSSet<UITouch *> *)touches
         return;
 
     if (eventType)
-        [protect(_delegate) mouseInteraction:self changedWithEvent:*mouseEvent];
+        [protect(_delegate) mouseInteraction:self changedWithEvent:mouseEvent.releaseNonNull()];
 
     if (eventType == WebKit::WebEventType::MouseUp) {
         _touching = NO;
@@ -517,7 +516,7 @@ - (void)handleGameControllerMouseMove:(float)deltaX deltaY:(float)deltaY
         return;
 
     WebCore::DoublePoint lockedPoint { _pointerLockState.lockedCursorPosition.value_or(CGPointZero) };
-    WebKit::NativeWebMouseEvent mouseEvent {
+    Ref mouseEvent = WebKit::NativeWebMouseEvent::create(
         WebKit::WebEventType::MouseMove,
         WebKit::WebMouseEventButton::None,
         0,
@@ -531,10 +530,9 @@ - (void)handleGameControllerMouseMove:(float)deltaX deltaY:(float)deltaY
         MonotonicTime::now(),
         0,
         WebKit::GestureWasCancelled::No,
-        WebCore::mousePointerEventType()
-    };
+        WebCore::mousePointerEventType());
 
-    [protect(_delegate) mouseInteraction:self changedWithEvent:mouseEvent];
+    [protect(_delegate) mouseInteraction:self changedWithEvent:WTF::move(mouseEvent)];
 }
 
 - (void)_startObservingMouseNotifications
diff --git a/Source/WebKit/UIProcess/ios/WKWebGeolocationPolicyDeciderIOS.mm b/Source/WebKit/UIProcess/ios/WKWebGeolocationPolicyDeciderIOS.mm
index 3255de3e7921..5f3396120a8e 100644
--- a/Source/WebKit/UIProcess/ios/WKWebGeolocationPolicyDeciderIOS.mm
+++ b/Source/WebKit/UIProcess/ios/WKWebGeolocationPolicyDeciderIOS.mm
@@ -132,7 +132,7 @@ - (id)init
     if (!self)
         return nil;
 
-    _diskDispatchQueue = adoptOSObject(dispatch_queue_create("com.apple.WebKit.WKWebGeolocationPolicyDecider", DISPATCH_QUEUE_SERIAL));
+    _diskDispatchQueue = adoptOSObject(dispatch_queue_create("com.apple.WebKit.WKWebGeolocationPolicyDecider", serialQueueWithAutoreleasePoolAttrSingleton()));
 
     CFNotificationCenterAddObserver(CFNotificationCenterGetDarwinNotifyCenterSingleton(), self, clearGeolocationCache, protect(CLAppResetChangedNotification), NULL, CFNotificationSuspensionBehaviorCoalesce);
 
diff --git a/Source/WebKit/UIProcess/ios/WebPageProxyIOS.mm b/Source/WebKit/UIProcess/ios/WebPageProxyIOS.mm
index 9db09d9fe6b2..5a9a87a461f1 100644
--- a/Source/WebKit/UIProcess/ios/WebPageProxyIOS.mm
+++ b/Source/WebKit/UIProcess/ios/WebPageProxyIOS.mm
@@ -782,7 +782,7 @@ static inline float adjustedUnexposedMaxEdge(float documentEdge, float exposedRe
     completionHandler(false);
 }
 
-bool WebPageProxy::shouldDelayWindowOrderingForEvent(const WebKit::WebMouseEvent&)
+bool WebPageProxy::shouldDelayWindowOrderingForEvent(Ref<WebKit::WebMouseEvent>&&)
 {
     notImplemented();
     return false;
diff --git a/Source/WebKit/UIProcess/ios/fullscreen/WKFullScreenWindowControllerIOS.mm b/Source/WebKit/UIProcess/ios/fullscreen/WKFullScreenWindowControllerIOS.mm
index dd81d1a6af96..3507a1fba8ab 100644
--- a/Source/WebKit/UIProcess/ios/fullscreen/WKFullScreenWindowControllerIOS.mm
+++ b/Source/WebKit/UIProcess/ios/fullscreen/WKFullScreenWindowControllerIOS.mm
@@ -198,7 +198,7 @@ static void setLightspillEnabledForElementFullscreenLayer(CALayer *, bool) { }
     BOOL _savedContentInsetAdjustmentBehaviorWasExternallyOverridden = NO;
 #endif
     UIScrollViewContentInsetAdjustmentBehavior _savedContentInsetAdjustmentBehavior = UIScrollViewContentInsetAdjustmentAutomatic;
-    CGPoint _savedContentOffset = CGPointZero;
+    std::optional<CGPoint> _savedContentOffset;
     BOOL _savedBouncesZoom = NO;
     BOOL _savedForceAlwaysUserScalable = NO;
     CGFloat _savedMinimumEffectiveDeviceWidth = baseMinimumEffectiveDeviceWidth;
@@ -224,7 +224,8 @@ void applyTo(WKWebView* webView)
         else
             [scrollView _resetContentInset];
 
-        scrollView.get().contentOffset = _savedContentOffset;
+        if (_savedContentOffset)
+            scrollView.get().contentOffset = *_savedContentOffset;
         scrollView.get().scrollIndicatorInsets = _savedScrollIndicatorInsets;
 
 #if !PLATFORM(WATCHOS) && !PLATFORM(APPLETV)
@@ -1210,7 +1211,6 @@ - (void)_enterFullScreen:(CGSize)mediaDimensions windowScene:(UIWindowScene *)wi
         [webView _setMinimumEffectiveDeviceWidth:0];
         [webView _setViewScale:1.f];
         [webView _setForcesInitialScaleFactor:YES];
-        [webView _resetContentOffset];
         [_window insertSubview:webView.get() atIndex:0];
         WebKit::WKWebViewState().applyTo(webView.get());
         [webView setNeedsLayout];
diff --git a/Source/WebKit/UIProcess/mac/AppKitGestures/WKAppKitGestureController.mm b/Source/WebKit/UIProcess/mac/AppKitGestures/WKAppKitGestureController.mm
index a510d16e9c45..80f27fa3a0a8 100644
--- a/Source/WebKit/UIProcess/mac/AppKitGestures/WKAppKitGestureController.mm
+++ b/Source/WebKit/UIProcess/mac/AppKitGestures/WKAppKitGestureController.mm
@@ -1483,53 +1483,63 @@ - (void)sendWheelEventForGesture:(NSPanGestureRecognizer *)gesture
     bool canScrollVertically = [_panGestureRecognizer _canPanVertically] && !(pinnedState.top() && pinnedState.bottom());
     gestureDelta = WebCore::FloatSize { _directionalScrollLockTracker->update(gestureDelta, canScrollHorizontally, canScrollVertically, prefersUnlockedScroll, [gesture timestamp]) };
 
-    // FIXME: Fold this into WKDirectionalScrollLockTracker as a hard clamp  applied _after_ directional lock heuristics.
+    // This clamping is a workaround for the fact that if an axis is pinned,
+    // the scrolling tree turns it into a rubberband, and the orthogonal delta
+    // is discarded, which stops panning for the rest of the gesture. (if a
+    // transient zoom + pan sequence occurs simultaneously)
+    //
+    // The clamp applies only to the wheel event that reaches the page, though,
+    // since the swipe tracker has to see the unclamped delta, or else it is
+    // unable to determine PendingSwipeTracker::scrollEventCanBecomeSwipe().
+    //
+    // FIXME: Fold this into WKDirectionalScrollLockTracker as a hard clamp applied
+    // _after_ the directional lock heuristics, for the events that reach the page.
+    auto clampedGestureDelta = gestureDelta;
     if (!canScrollVertically)
-        gestureDelta.setHeight(0);
+        clampedGestureDelta.setHeight(0);
     if (!canScrollHorizontally)
-        gestureDelta.setWidth(0);
+        clampedGestureDelta.setWidth(0);
 
-    auto wheelTicks { gestureDelta.scaled(1. / static_cast<float>(WebCore::Scrollbar::pixelsPerLineStep())) };
     auto granularity = WebKit::WebWheelEvent::Granularity::ScrollByPixelWheelEvent;
     bool directionInvertedFromDevice = false;
     auto phase = toWebEventPhase(gesture.state);
     auto momentumPhase = WebKit::WebWheelEvent::Phase::None;
     bool hasPreciseScrollingDeltas = true;
     uint32_t scrollCount = 1;
-    auto unacceleratedScrollingDelta = gestureDelta;
     auto ioHIDEventTimestamp = timestamp;
     std::optional<WebCore::FloatSize> rawPlatformDelta;
     auto momentumEndType = WebKit::WebWheelEvent::MomentumEndType::Unknown;
 
-    WebKit::WebWheelEvent wheelEvent {
-        { WebKit::WebEventType::Wheel, { }, timestamp, WTF::UUID::createVersion4() },
-        WebCore::IntPoint { position },
-        WebCore::IntPoint { globalPosition },
-        gestureDelta,
-        wheelTicks,
-        granularity,
-        directionInvertedFromDevice,
-        phase,
-        momentumPhase,
-        hasPreciseScrollingDeltas,
-        scrollCount,
-        unacceleratedScrollingDelta,
-        ioHIDEventTimestamp,
-        rawPlatformDelta,
-        momentumEndType,
-        WebKit::WebEventInputSource::Automation
+    auto makeWheelEvent = [&](WebCore::FloatSize delta) {
+        auto wheelTicks { delta.scaled(1. / static_cast<float>(WebCore::Scrollbar::pixelsPerLineStep())) };
+        auto unacceleratedScrollingDelta = delta;
+        return WebKit::NativeWebWheelEvent::create(WebKit::WebWheelEvent::create({ WebKit::WebEventType::Wheel, { }, timestamp }, {
+            .position = WebCore::IntPoint { position },
+            .globalPosition = WebCore::IntPoint { globalPosition },
+            .delta = delta,
+            .wheelTicks = wheelTicks,
+            .granularity = granularity,
+            .directionInvertedFromDevice = directionInvertedFromDevice,
+            .phase = phase,
+            .momentumPhase = momentumPhase,
+            .hasPreciseScrollingDeltas = hasPreciseScrollingDeltas,
+            .scrollCount = scrollCount,
+            .unacceleratedScrollingDelta = unacceleratedScrollingDelta,
+            .ioHIDEventTimestamp = ioHIDEventTimestamp,
+            .rawPlatformDelta = rawPlatformDelta,
+            .momentumEndType = momentumEndType,
+            .inputSource = WebKit::WebEventInputSource::Automation,
+        }));
     };
 
-    WebKit::NativeWebWheelEvent nativeEvent { wheelEvent };
-
     CheckedPtr impl = [webView _impl];
     bool forwardToGestureController = impl->allowsBackForwardNavigationGestures() && [self prefersForwardingToGestureController:gesture];
-    if (forwardToGestureController && protect(impl->ensureGestureController())->handleScrollWheelEvent(nativeEvent)) {
+    if (forwardToGestureController && protect(impl->ensureGestureController())->handleScrollWheelEvent(makeWheelEvent(gestureDelta))) {
         WK_APPKIT_GESTURE_CONTROLLER_RELEASE_LOG_DEBUG([webView _protectedPage]->logIdentifier(), "View gesture controller handled gesture");
         return;
     }
 
-    [webView _protectedPage]->handleNativeWheelEvent(nativeEvent);
+    [webView _protectedPage]->handleNativeWheelEvent(makeWheelEvent(clampedGestureDelta));
 }
 
 #pragma mark - Momentum Handling
@@ -1576,28 +1586,24 @@ - (void)startMomentumIfNeededForGesture:(NSPanGestureRecognizer *)gesture
     WebCore::IntPoint position { [gesture locationInView:webView.get()] };
     auto globalPosition = WebCore::globalPoint([gesture locationInView:nil], [webView window]);
 
-    WebKit::WebWheelEvent momentumEvent {
-        { WebKit::WebEventType::Wheel, { }, timestamp, WTF::UUID::createVersion4() },
-        position,
-        WebCore::IntPoint { globalPosition },
-        WebCore::FloatSize { },
-        WebCore::FloatSize { },
-        WebKit::WebWheelEvent::Granularity::ScrollByPixelWheelEvent,
-        false,
-        WebKit::WebWheelEvent::Phase::None,
-        WebKit::WebWheelEvent::Phase::Began,
-        true,
-        1,
-        WebCore::FloatSize { },
-        timestamp,
-        std::nullopt,
-        WebKit::WebWheelEvent::MomentumEndType::Unknown,
-        WebKit::WebEventInputSource::Automation,
-        static_cast<float>(fastScrollMultiplier),
-    };
-    WebKit::NativeWebWheelEvent nativeMomentumEvent { momentumEvent };
+    Ref momentumEvent = WebKit::WebWheelEvent::create({ WebKit::WebEventType::Wheel, { }, timestamp }, {
+        .position = position,
+        .globalPosition = WebCore::IntPoint { globalPosition },
+        .granularity = WebKit::WebWheelEvent::Granularity::ScrollByPixelWheelEvent,
+        .directionInvertedFromDevice = false,
+        .phase = WebKit::WebWheelEvent::Phase::None,
+        .momentumPhase = WebKit::WebWheelEvent::Phase::Began,
+        .hasPreciseScrollingDeltas = true,
+        .scrollCount = 1,
+        .ioHIDEventTimestamp = timestamp,
+        .rawPlatformDelta = std::nullopt,
+        .momentumEndType = WebKit::WebWheelEvent::MomentumEndType::Unknown,
+        .inputSource = WebKit::WebEventInputSource::Automation,
+        .momentumFastScrollMultiplier = static_cast<float>(fastScrollMultiplier),
+    });
+    Ref nativeMomentumEvent = WebKit::NativeWebWheelEvent::create(momentumEvent);
 
-    nativeMomentumEvent.setRawPlatformDelta([&nativeMomentumEvent, velocity] {
+    nativeMomentumEvent->setRawPlatformDelta([&nativeMomentumEvent, velocity] {
         static constexpr WebCore::FramesPerSecond fallbackMomentumFrameRate { 60 };
         auto momentumFrameRate = WebKit::ScrollingAccelerationCurve::fromNativeWheelEvent(nativeMomentumEvent)
             .or_else([] {
@@ -1614,7 +1620,7 @@ - (void)startMomentumIfNeededForGesture:(NSPanGestureRecognizer *)gesture
     protect([webView _impl])->clearRefreshControllerTracking();
 #endif
 
-    [webView _protectedPage]->handleNativeWheelEvent(nativeMomentumEvent);
+    [webView _protectedPage]->handleNativeWheelEvent(WTF::move(nativeMomentumEvent));
     _isMomentumActive = true;
 
     WK_APPKIT_GESTURE_CONTROLLER_RELEASE_LOG([webView _protectedPage]->logIdentifier(), "Started momentum scrolling with velocity %.2f pts/s", velocityMagnitude);
diff --git a/Source/WebKit/UIProcess/mac/ServicesController.mm b/Source/WebKit/UIProcess/mac/ServicesController.mm
index e3af14515ee7..5972b569a26c 100644
--- a/Source/WebKit/UIProcess/mac/ServicesController.mm
+++ b/Source/WebKit/UIProcess/mac/ServicesController.mm
@@ -46,7 +46,7 @@
 }
 
 ServicesController::ServicesController()
-    : m_refreshQueue(adoptOSObject(dispatch_queue_create("com.apple.WebKit.ServicesController", DISPATCH_QUEUE_SERIAL)))
+    : m_refreshQueue(adoptOSObject(dispatch_queue_create("com.apple.WebKit.ServicesController", serialQueueWithAutoreleasePoolAttrSingleton())))
     , m_hasPendingRefresh(false)
     , m_hasImageServices(false)
     , m_hasSelectionServices(false)
diff --git a/Source/WebKit/UIProcess/mac/SwipeProgressTrackerMac.mm b/Source/WebKit/UIProcess/mac/SwipeProgressTrackerMac.mm
index fb4469ade334..a6a886aaa1d6 100644
--- a/Source/WebKit/UIProcess/mac/SwipeProgressTrackerMac.mm
+++ b/Source/WebKit/UIProcess/mac/SwipeProgressTrackerMac.mm
@@ -120,7 +120,7 @@ static double easeOutCubic(double t)
         return false;
 
     case State::Pending:
-        viewGestureController->beginSwipeGesture(m_targetItem.get(), m_direction);
+        viewGestureController->beginSwipeGesture(protect(m_targetItem), m_direction);
         m_state = State::Swiping;
         break;
 
@@ -158,7 +158,7 @@ static double easeOutCubic(double t)
     double minProgress = !swipingLeft ? -1 : 0;
     m_progress = std::clamp(m_progress, minProgress, maxProgress);
 
-    viewGestureController->handleSwipeGesture(m_targetItem.get(), m_progress, m_direction);
+    viewGestureController->handleSwipeGesture(protect(m_targetItem), m_progress, m_direction);
     return true;
 }
 
@@ -214,7 +214,7 @@ static double easeOutCubic(double t)
 
     m_progress = m_animationStartProgress + (m_animationEndProgress - m_animationStartProgress) * easeOutCubic(animationProgress);
 
-    protect(m_viewGestureController)->handleSwipeGesture(m_targetItem.get(), m_progress, m_direction);
+    protect(m_viewGestureController)->handleSwipeGesture(protect(m_targetItem), m_progress, m_direction);
 
     if (now >= m_animationEndTime)
         endAnimation();
@@ -224,7 +224,7 @@ static double easeOutCubic(double t)
 {
     stopDisplayLinkObserver();
     m_state = State::Done;
-    protect(m_viewGestureController)->endSwipeGesture(m_targetItem.get(), m_cancelled);
+    protect(m_viewGestureController)->endSwipeGesture(protect(m_targetItem), m_cancelled);
 }
 
 void SwipeProgressTracker::displayLinkFired(WebCore::PlatformDisplayID, WebCore::DisplayUpdate, bool, bool)
diff --git a/Source/WebKit/UIProcess/mac/ViewGestureControllerMac.mm b/Source/WebKit/UIProcess/mac/ViewGestureControllerMac.mm
index 47221c145683..c4a661883a78 100644
--- a/Source/WebKit/UIProcess/mac/ViewGestureControllerMac.mm
+++ b/Source/WebKit/UIProcess/mac/ViewGestureControllerMac.mm
@@ -266,17 +266,17 @@ static float maximumRectangleComponentDelta(FloatRect a, FloatRect b)
     m_lastMagnificationGestureWasSmartMagnification = true;
 }
 
-bool ViewGestureController::PendingSwipeTracker::scrollEventCanStartSwipe(NativeWebWheelEvent event)
+bool ViewGestureController::PendingSwipeTracker::scrollEventCanStartSwipe(const NativeWebWheelEvent& event)
 {
     return event.phase() == WebWheelEvent::Phase::Began;
 }
 
-bool ViewGestureController::PendingSwipeTracker::scrollEventCanEndSwipe(NativeWebWheelEvent event)
+bool ViewGestureController::PendingSwipeTracker::scrollEventCanEndSwipe(const NativeWebWheelEvent& event)
 {
     return event.phase() == WebWheelEvent::Phase::Ended;
 }
 
-bool ViewGestureController::PendingSwipeTracker::scrollEventCanInfluenceSwipe(NativeWebWheelEvent event)
+bool ViewGestureController::PendingSwipeTracker::scrollEventCanInfluenceSwipe(const NativeWebWheelEvent& event)
 {
     if (!event.hasPreciseScrollingDeltas())
         return false;
@@ -287,12 +287,12 @@ static float maximumRectangleComponentDelta(FloatRect a, FloatRect b)
 #endif
 }
 
-FloatSize ViewGestureController::PendingSwipeTracker::scrollEventGetScrollingDeltas(NativeWebWheelEvent event)
+FloatSize ViewGestureController::PendingSwipeTracker::scrollEventGetScrollingDeltas(const NativeWebWheelEvent& event)
 {
     return event.delta();
 }
 
-bool ViewGestureController::handleScrollWheelEvent(NativeWebWheelEvent event)
+bool ViewGestureController::handleScrollWheelEvent(const NativeWebWheelEvent& event)
 {
     if (m_swipeProgressTracker && protect(*m_swipeProgressTracker)->handleEvent(event))
         return true;
diff --git a/Source/WebKit/UIProcess/mac/WKFullScreenWindowController.mm b/Source/WebKit/UIProcess/mac/WKFullScreenWindowController.mm
index 6f99855d4efc..fb130a56f330 100644
--- a/Source/WebKit/UIProcess/mac/WKFullScreenWindowController.mm
+++ b/Source/WebKit/UIProcess/mac/WKFullScreenWindowController.mm
@@ -564,8 +564,8 @@ - (void)finishedEnterFullScreenAnimation:(bool)completed
             eventNumber:0
             clickCount:0
             pressure:0];
-        WebKit::NativeWebMouseEvent webEvent(fakeEvent.get(), nil, webView.get(), WebKit::WebEventInputSource::UserDriven);
-        page->handleMouseEvent(webEvent);
+        Ref webEvent = WebKit::NativeWebMouseEvent::create(fakeEvent.get(), nil, webView.get(), WebKit::WebEventInputSource::UserDriven);
+        page->handleMouseEvent(WTF::move(webEvent));
     }
     page->flushDeferredResizeEvents();
     page->flushDeferredScrollEvents();
diff --git a/Source/WebKit/UIProcess/mac/WebPageProxyMac.mm b/Source/WebKit/UIProcess/mac/WebPageProxyMac.mm
index 36f5caa9eca1..3b692ffbc9ad 100644
--- a/Source/WebKit/UIProcess/mac/WebPageProxyMac.mm
+++ b/Source/WebKit/UIProcess/mac/WebPageProxyMac.mm
@@ -412,18 +412,18 @@ static inline bool expectsLegacyImplicitRubberBandControl()
     completionHandler(pageClient->executeSavedCommandBySelector(selector));
 }
 
-bool WebPageProxy::shouldDelayWindowOrderingForEvent(const WebKit::WebMouseEvent& event)
+bool WebPageProxy::shouldDelayWindowOrderingForEvent(Ref<WebKit::WebMouseEvent>&& event)
 {
     if (legacyMainFrameProcess().state() != WebProcessProxy::State::Running)
         return false;
 
     const Seconds messageTimeout(3);
-    auto sendResult = protect(legacyMainFrameProcess())->sendSync(Messages::WebPage::ShouldDelayWindowOrderingEvent(event), webPageIDInMainFrameProcess(), messageTimeout);
+    auto sendResult = protect(legacyMainFrameProcess())->sendSync(Messages::WebPage::ShouldDelayWindowOrderingEvent(WTF::move(event)), webPageIDInMainFrameProcess(), messageTimeout);
     auto [result] = sendResult.takeReplyOr(false);
     return result;
 }
 
-bool WebPageProxy::acceptsFirstMouse(int eventNumber, const WebKit::WebMouseEvent& event)
+bool WebPageProxy::acceptsFirstMouse(int eventNumber, Ref<WebKit::WebMouseEvent>&& event)
 {
     if (!hasRunningProcess())
         return false;
@@ -435,7 +435,7 @@ static inline bool expectsLegacyImplicitRubberBandControl()
     if (shouldAvoidSynchronouslyWaitingToPreventDeadlock())
         return false;
 
-    legacyMainFrameProcess->send(Messages::WebPage::RequestAcceptsFirstMouse(eventNumber, event), webPageIDInMainFrameProcess(), IPC::SendOption::DispatchMessageEvenWhenWaitingForUnboundedSyncReply);
+    legacyMainFrameProcess->send(Messages::WebPage::RequestAcceptsFirstMouse(eventNumber, WTF::move(event)), webPageIDInMainFrameProcess(), IPC::SendOption::DispatchMessageEvenWhenWaitingForUnboundedSyncReply);
     bool receivedReply = protect(legacyMainFrameProcess->connection())->waitForAndDispatchImmediately<Messages::WebPageProxy::HandleAcceptsFirstMouse>(webPageIDInMainFrameProcess(), 250_ms, IPC::WaitForOption::InterruptWaitingIfSyncMessageArrives) == IPC::Error::NoError;
 
     if (!receivedReply) {
@@ -1213,25 +1213,19 @@ static inline bool expectsLegacyImplicitRubberBandControl()
 void WebPageProxy::interruptSyntheticMomentumScrolling()
 {
     auto timestamp = MonotonicTime::now();
-    WebWheelEvent cancelEvent {
-        { WebEventType::Wheel, { }, timestamp, WTF::UUID::createVersion4() },
-        WebCore::IntPoint { },
-        WebCore::IntPoint { },
-        WebCore::FloatSize { },
-        WebCore::FloatSize { },
-        WebWheelEvent::Granularity::ScrollByPixelWheelEvent,
-        false,
-        WebWheelEvent::Phase::Cancelled,
-        WebWheelEvent::Phase::None,
-        true,
-        1,
-        WebCore::FloatSize { },
-        timestamp,
-        std::nullopt,
-        WebWheelEvent::MomentumEndType::Interrupted,
-        WebEventInputSource::Automation
-    };
-    handleNativeWheelEvent(NativeWebWheelEvent { cancelEvent });
+    Ref cancelEvent = WebWheelEvent::create({ WebEventType::Wheel, { }, timestamp }, {
+        .granularity = WebWheelEvent::Granularity::ScrollByPixelWheelEvent,
+        .directionInvertedFromDevice = false,
+        .phase = WebWheelEvent::Phase::Cancelled,
+        .momentumPhase = WebWheelEvent::Phase::None,
+        .hasPreciseScrollingDeltas = true,
+        .scrollCount = 1,
+        .ioHIDEventTimestamp = timestamp,
+        .rawPlatformDelta = std::nullopt,
+        .momentumEndType = WebWheelEvent::MomentumEndType::Interrupted,
+        .inputSource = WebEventInputSource::Automation,
+    });
+    handleNativeWheelEvent(NativeWebWheelEvent::create(cancelEvent));
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit/UIProcess/mac/WebViewImpl.mm b/Source/WebKit/UIProcess/mac/WebViewImpl.mm
index 5e9ce1f1b37c..7cc3c37f1053 100644
--- a/Source/WebKit/UIProcess/mac/WebViewImpl.mm
+++ b/Source/WebKit/UIProcess/mac/WebViewImpl.mm
@@ -770,8 +770,8 @@ - (instancetype)initWithWebViewImpl:(WebKit::WebViewImpl&)impl pasteAccessCatego
 
 - (void)menuDidClose:(NSMenu *)menu
 {
-    RunLoop::mainSingleton().dispatch([impl = _impl] {
-        if (impl)
+    RunLoop::mainSingleton().dispatch([weakImpl = _impl] {
+        if (CheckedPtr impl = weakImpl)
             impl->hideDOMPasteMenuWithResult(WebCore::DOMPasteAccessResponse::DeniedForGesture);
     });
 }
@@ -1649,7 +1649,7 @@ static NSTrackingAreaOptions NODELETE flagsChangedEventMonitorTrackingAreaOption
         RetainPtr<NSEvent> keyboardEvent;
         if ([event type] == NSEventTypeKeyDown || [event type] == NSEventTypeKeyUp)
             keyboardEvent = event;
-        m_page->setInitialFocus(direction == NSSelectingNext, !!keyboardEvent, NativeWebKeyboardEvent(keyboardEvent.get(), false, false, { }), [] { });
+        m_page->setInitialFocus(direction == NSSelectingNext, !!keyboardEvent, NativeWebKeyboardEvent::create(keyboardEvent.get(), false, false, { }), [] { });
     }
     return true;
 }
@@ -2530,8 +2530,8 @@ static WKPDFHUDViewAccessibilityDisplayModeState platformAccessibilityDisplayMod
         return false;
 
     auto previousEvent = setLastMouseDownEvent(event);
-    WebMouseEvent mouseEvent = WebEventFactory::createWebMouseEvent(event, m_lastPressureEvent.get(), m_view.get().get(), WebEventInputSource::UserDriven);
-    bool result = m_page->acceptsFirstMouse(event.eventNumber, mouseEvent);
+    Ref mouseEvent = WebMouseEvent::create(WebEventFactory::createWebMouseEvent(event, m_lastPressureEvent.get(), m_view.get().get(), WebEventInputSource::UserDriven));
+    bool result = m_page->acceptsFirstMouse(event.eventNumber, WTF::move(mouseEvent));
     setLastMouseDownEvent(previousEvent.get());
     return result;
 }
@@ -2559,8 +2559,8 @@ static WKPDFHUDViewAccessibilityDisplayModeState platformAccessibilityDisplayMod
     }
 
     auto previousEvent = setLastMouseDownEvent(event);
-    WebMouseEvent mouseEvent = WebEventFactory::createWebMouseEvent(event, m_lastPressureEvent.get(), m_view.get().get(), WebEventInputSource::UserDriven);
-    bool result = m_page->shouldDelayWindowOrderingForEvent(mouseEvent);
+    Ref mouseEvent = WebMouseEvent::create(WebEventFactory::createWebMouseEvent(event, m_lastPressureEvent.get(), m_view.get().get(), WebEventInputSource::UserDriven));
+    bool result = m_page->shouldDelayWindowOrderingForEvent(WTF::move(mouseEvent));
     setLastMouseDownEvent(previousEvent.get());
     return result;
 }
@@ -2828,8 +2828,8 @@ static WKPDFHUDViewAccessibilityDisplayModeState platformAccessibilityDisplayMod
     RetainPtr fakeEvent = [NSEvent mouseEventWithType:NSEventTypeMouseMoved location:flagsChangedEvent.window.mouseLocationOutsideOfEventStream
         modifierFlags:flagsChangedEvent.modifierFlags timestamp:flagsChangedEvent.timestamp windowNumber:flagsChangedEvent.windowNumber
         context:nullptr eventNumber:0 clickCount:0 pressure:0];
-    NativeWebMouseEvent webEvent(fakeEvent.get(), m_lastPressureEvent.get(), m_view.get().get(), WebEventInputSource::UserDriven);
-    m_page->dispatchMouseDidMoveOverElementAsynchronously(webEvent);
+    Ref webEvent = NativeWebMouseEvent::create(fakeEvent.get(), m_lastPressureEvent.get(), m_view.get().get(), WebEventInputSource::UserDriven);
+    m_page->dispatchMouseDidMoveOverElementAsynchronously(WTF::move(webEvent));
 }
 
 WebCore::DestinationColorSpace WebViewImpl::colorSpace()
@@ -3032,8 +3032,8 @@ static WKPDFHUDViewAccessibilityDisplayModeState platformAccessibilityDisplayMod
     if (event.phase != NSEventPhaseChanged && event.phase != NSEventPhaseBegan && event.phase != NSEventPhaseEnded)
         return;
 
-    NativeWebMouseEvent webEvent(event, m_lastPressureEvent.get(), m_view.get().get(), WebEventInputSource::UserDriven);
-    m_page->handleMouseEvent(webEvent);
+    Ref webEvent = NativeWebMouseEvent::create(event, m_lastPressureEvent.get(), m_view.get().get(), WebEventInputSource::UserDriven);
+    m_page->handleMouseEvent(WTF::move(webEvent));
 
     m_lastPressureEvent = event;
 }
@@ -3529,10 +3529,8 @@ static String commandNameForSelector(SEL selector)
         // FIXME: Theoretically, there is a race here; when we get the answer it might be old, from a previous time
         // we asked for the same command; there is no guarantee the answer is still valid.
         m_page->validateCommand(commandName, [weakThis = WeakPtr { *this }, commandName](bool isEnabled, int32_t state) {
-            if (!weakThis)
-                return;
-
-            weakThis->setUserInterfaceItemState(commandName.createNSString().get(), isEnabled, state);
+            if (CheckedPtr checkedThis = weakThis)
+                checkedThis->setUserInterfaceItemState(commandName.createNSString().get(), isEnabled, state);
         });
     }
 
@@ -3826,9 +3824,8 @@ static String commandNameForSelector(SEL selector)
     WeakPtr weakThis { *this };
     m_lastCandidateRequestSequenceNumber = [[NSSpellChecker sharedSpellChecker] requestCandidatesForSelectedRange:selectedRange inString:postLayoutData->paragraphContextForCandidateRequest.createNSString().get() types:checkingTypes options:nil inSpellDocumentWithTag:spellCheckerDocumentTag() completionHandler:[weakThis](NSInteger sequenceNumber, NSArray<NSTextCheckingResult *> *candidates) {
         RunLoop::mainSingleton().dispatch([weakThis, sequenceNumber, candidates = retainPtr(candidates)] {
-            if (!weakThis)
-                return;
-            weakThis->handleRequestedCandidates(sequenceNumber, candidates.get());
+            if (CheckedPtr checkedThis = weakThis)
+                checkedThis->handleRequestedCandidates(sequenceNumber, candidates.get());
         });
     }];
 }
@@ -5712,7 +5709,7 @@ static NSPasteboardName NODELETE pasteboardNameForAccessCategory(WebCore::DOMPas
     bool wasIgnoringPinnedState = gestureController->shouldIgnorePinnedState();
     gestureController->setShouldIgnorePinnedState(ignoringPinnedState);
 
-    NativeWebWheelEvent webEvent { event, m_view.getAutoreleased() };
+    Ref webEvent = NativeWebWheelEvent::create(event, m_view.get());
     bool handledEvent = gestureController->handleScrollWheelEvent(webEvent);
 
     gestureController->setShouldIgnorePinnedState(wasIgnoringPinnedState);
@@ -5742,14 +5739,14 @@ static NSPasteboardName NODELETE pasteboardNameForAccessCategory(WebCore::DOMPas
     updateRefreshControllerForWheelEvent(event);
 #endif
 
-    NativeWebWheelEvent webEvent { event, m_view.getAutoreleased() };
+    Ref webEvent = NativeWebWheelEvent::create(event, m_view.get());
 
     if (m_allowsBackForwardNavigationGestures && protect(ensureGestureController())->handleScrollWheelEvent(webEvent)) {
         RELEASE_LOG(MouseHandling, "[pageProxyID=%lld] WebViewImpl::scrollWheel: Gesture controller handled wheel event", m_page->identifier().toUInt64());
         return;
     }
 
-    m_page->handleNativeWheelEvent(webEvent);
+    m_page->handleNativeWheelEvent(WTF::move(webEvent));
 }
 
 void WebViewImpl::swipeWithEvent(NSEvent *event)
@@ -6355,13 +6352,17 @@ static bool eventKeyCodeIsZeroOrNumLockOrFn(NSEvent *event)
     }
 
     m_page->firstRectForCharacterRangeAsync(range, [weakThis = WeakPtr { *this }, completionHandler = makeBlockPtr(completionHandler)](const WebCore::IntRect& rect, const EditingRange& actualRange) {
-        if (!weakThis) {
-            LOG(TextInput, "    ...firstRectForCharacterRange failed (WebViewImpl was destroyed).");
-            completionHandler(NSZeroRect, NSMakeRange(NSNotFound, 0));
-            return;
-        }
+        NSRect resultRect;
+        {
+            CheckedPtr checkedThis = weakThis;
+            if (!checkedThis) {
+                LOG(TextInput, "    ...firstRectForCharacterRange failed (WebViewImpl was destroyed).");
+                completionHandler(NSZeroRect, NSMakeRange(NSNotFound, 0));
+                return;
+            }
 
-        auto resultRect = weakThis->convertFromViewToScreen(rect);
+            resultRect = checkedThis->convertFromViewToScreen(rect);
+        }
 
         LOG(TextInput, "    -> firstRectForCharacterRange returned (%f, %f, %f, %f)", resultRect.origin.x, resultRect.origin.y, resultRect.size.width, resultRect.size.height);
         completionHandler(resultRect, actualRange);
@@ -6660,7 +6661,8 @@ static BOOL shouldUseHighlightsForMarkedText(NSAttributedString *string)
         rect:offsetSelectionRect
         view:m_view.get().get()
         completionHandler:[weakThis](NSDictionary<NSString *, id> *resultDictionary) {
-        if (!weakThis)
+        CheckedPtr checkedThis = weakThis;
+        if (!checkedThis)
             return;
 
         RetainPtr<NSValue> softSpaceRangeValue = resultDictionary[NSTextCheckingSoftSpaceRangeKey];
@@ -6668,11 +6670,12 @@ static BOOL shouldUseHighlightsForMarkedText(NSAttributedString *string)
             return;
 
         NSRange absoluteSoftSpaceRange = softSpaceRangeValue.get().rangeValue;
-        weakThis->selectedRangeWithCompletionHandler([weakThis, absoluteSoftSpaceRange](NSRange absoluteSelectedRange) {
-            if (!weakThis)
+        checkedThis->selectedRangeWithCompletionHandler([weakThis, absoluteSoftSpaceRange](NSRange absoluteSelectedRange) {
+            CheckedPtr checkedThis = weakThis;
+            if (!checkedThis)
                 return;
 
-            auto postLayoutData = weakThis->postLayoutDataForContentEditable();
+            auto postLayoutData = checkedThis->postLayoutDataForContentEditable();
             if (!postLayoutData)
                 return;
 
@@ -6684,7 +6687,7 @@ static BOOL shouldUseHighlightsForMarkedText(NSAttributedString *string)
             NSUInteger offset = absoluteSelectedRange.location - relativeSelectedRange.location;
             NSRange relativeSoftSpaceRange = NSMakeRange(absoluteSoftSpaceRange.location - offset, absoluteSoftSpaceRange.length);
 
-            weakThis->m_softSpaceRange = relativeSoftSpaceRange;
+            checkedThis->m_softSpaceRange = relativeSoftSpaceRange;
         });
     }];
 }
@@ -6706,12 +6709,9 @@ static BOOL shouldUseHighlightsForMarkedText(NSAttributedString *string)
 
     NSRange relativeSelectedRange = NSMakeRange(postLayoutData->candidateRequestStartPosition, postLayoutData->selectedTextLength);
 
-    WeakPtr weakThis { *this };
-    selectedRangeWithCompletionHandler([weakThis, candidate, relativeSelectedRange](NSRange absoluteSelectedRange) {
-        if (!weakThis)
-            return;
-
-        weakThis->showInlinePredictionsForCandidate(candidate.get(), absoluteSelectedRange, relativeSelectedRange);
+    selectedRangeWithCompletionHandler([weakThis = WeakPtr { *this }, candidate, relativeSelectedRange](NSRange absoluteSelectedRange) {
+        if (CheckedPtr checkedThis = weakThis)
+            checkedThis->showInlinePredictionsForCandidate(candidate.get(), absoluteSelectedRange, relativeSelectedRange);
     });
 }
 #endif
@@ -6783,7 +6783,7 @@ static BOOL shouldUseHighlightsForMarkedText(NSAttributedString *string)
     if (m_view.getAutoreleased() == [m_view.get() window].firstResponder) {
         interpretKeyEvent(event, [weakThis = WeakPtr { *this }, capturedEvent = retainPtr(event)](BOOL handledByInputMethod, const Vector<WebCore::KeypressCommand>& commands) {
             if (weakThis)
-                weakThis->m_page->handleKeyboardEvent(NativeWebKeyboardEvent(capturedEvent.get(), handledByInputMethod, false, commands));
+                weakThis->m_page->handleKeyboardEvent(NativeWebKeyboardEvent::create(capturedEvent.get(), handledByInputMethod, false, commands));
         });
         return YES;
     }
@@ -6801,7 +6801,7 @@ static BOOL shouldUseHighlightsForMarkedText(NSAttributedString *string)
     m_isTextInsertionReplacingSoftSpace = false;
     interpretKeyEvent(event, [weakThis = WeakPtr { *this }, capturedEvent = retainPtr(event)](BOOL handledByInputMethod, const Vector<WebCore::KeypressCommand>& commands) {
         if (weakThis)
-            weakThis->m_page->handleKeyboardEvent(NativeWebKeyboardEvent(capturedEvent.get(), handledByInputMethod, weakThis->m_isTextInsertionReplacingSoftSpace, commands));
+            weakThis->m_page->handleKeyboardEvent(NativeWebKeyboardEvent::create(capturedEvent.get(), handledByInputMethod, weakThis->m_isTextInsertionReplacingSoftSpace, commands));
     });
 }
 
@@ -6824,7 +6824,7 @@ static BOOL shouldUseHighlightsForMarkedText(NSAttributedString *string)
     m_isTextInsertionReplacingSoftSpace = false;
     interpretKeyEvent(event, [weakThis = WeakPtr { *this }, capturedEvent = retainPtr(event)](BOOL handledByInputMethod, const Vector<WebCore::KeypressCommand>& commands) {
         if (weakThis)
-            weakThis->m_page->handleKeyboardEvent(NativeWebKeyboardEvent(capturedEvent.get(), handledByInputMethod, weakThis->m_isTextInsertionReplacingSoftSpace, commands));
+            weakThis->m_page->handleKeyboardEvent(NativeWebKeyboardEvent::create(capturedEvent.get(), handledByInputMethod, weakThis->m_isTextInsertionReplacingSoftSpace, commands));
     });
 }
 
@@ -6841,7 +6841,7 @@ static BOOL shouldUseHighlightsForMarkedText(NSAttributedString *string)
 
     interpretKeyEvent(event, [weakThis = WeakPtr { *this }, capturedEvent = retainPtr(event)](BOOL handledByInputMethod, const Vector<WebCore::KeypressCommand>& commands) {
         if (weakThis)
-            weakThis->m_page->handleKeyboardEvent(NativeWebKeyboardEvent(capturedEvent.get(), handledByInputMethod, false, commands));
+            weakThis->m_page->handleKeyboardEvent(NativeWebKeyboardEvent::create(capturedEvent.get(), handledByInputMethod, false, commands));
     });
 }
 
@@ -6888,14 +6888,14 @@ static BOOL shouldUseHighlightsForMarkedText(NSAttributedString *string)
             if (handled)
                 LOG_WITH_STREAM(TextInput, stream << "Event " << [retainedEvent type] << " was handled by text input context");
             else {
-                NativeWebMouseEvent webEvent(retainedEvent.get(), weakThis->m_lastPressureEvent.get(), weakThis->m_view.getAutoreleased(), inputSource, canInitiateDrag);
-                weakThis->m_page->handleMouseEvent(webEvent);
+                Ref webEvent = NativeWebMouseEvent::create(retainedEvent.get(), weakThis->m_lastPressureEvent.get(), weakThis->m_view.get(), inputSource, canInitiateDrag);
+                weakThis->m_page->handleMouseEvent(WTF::move(webEvent));
             }
         }];
         return;
     }
-    NativeWebMouseEvent webEvent(event, m_lastPressureEvent.get(), m_view.get().get(), inputSource, canInitiateDrag);
-    m_page->handleMouseEvent(webEvent);
+    Ref webEvent = NativeWebMouseEvent::create(event, m_lastPressureEvent.get(), m_view.get().get(), inputSource, canInitiateDrag);
+    m_page->handleMouseEvent(WTF::move(webEvent));
 }
 
 void WebViewImpl::nativeMouseEventHandlerInternal(NSEvent *event, WebEventInputSource inputSource, WebCore::PlatformMouseEvent::CanInitiateDrag canInitiateDrag)
@@ -6917,8 +6917,8 @@ static BOOL shouldUseHighlightsForMarkedText(NSAttributedString *string)
 
     WeakPtr weakThis { *this };
     m_flagsChangedEventMonitor = [NSEvent addLocalMonitorForEventsMatchingMask:NSEventMaskFlagsChanged handler:[weakThis] (NSEvent *flagsChangedEvent) {
-        if (weakThis)
-            weakThis->scheduleMouseDidMoveOverElement(flagsChangedEvent);
+        if (CheckedPtr checkedThis = weakThis)
+            checkedThis->scheduleMouseDidMoveOverElement(flagsChangedEvent);
         return flagsChangedEvent;
     }];
 }
diff --git a/Source/WebKit/UIProcess/win/WebPageProxyWin.cpp b/Source/WebKit/UIProcess/win/WebPageProxyWin.cpp
index 421ef3e17369..b5788f257d63 100644
--- a/Source/WebKit/UIProcess/win/WebPageProxyWin.cpp
+++ b/Source/WebKit/UIProcess/win/WebPageProxyWin.cpp
@@ -82,11 +82,11 @@ void WebPageProxy::dispatchPendingCharEvents(const NativeWebKeyboardEvent& keydo
 {
     auto& pendingCharEvents = keydownEvent.pendingCharEvents();
     for (auto it = pendingCharEvents.rbegin(); it != pendingCharEvents.rend(); it++) {
-        auto nativeKeyPressEvent = NativeWebKeyboardEvent(it->hwnd, it->message, it->wParam, it->lParam, { });
+        Ref nativeKeyPressEvent = NativeWebKeyboardEvent::create(it->hwnd, it->message, it->wParam, it->lParam, { });
         // Allows keypresses generated by the char event to be matched to
         // the originating keydown by its keycode
-        nativeKeyPressEvent.setWindowsVirtualKeyCode(keydownEvent.windowsVirtualKeyCode());
-        internals().keyEventQueue.prepend(nativeKeyPressEvent);
+        nativeKeyPressEvent->setWindowsVirtualKeyCode(keydownEvent.windowsVirtualKeyCode());
+        internals().keyEventQueue.prepend(WTF::move(nativeKeyPressEvent));
     }
 }
 
diff --git a/Source/WebKit/UIProcess/win/WebView.cpp b/Source/WebKit/UIProcess/win/WebView.cpp
index f3beb2f8390b..af4bab9f284e 100644
--- a/Source/WebKit/UIProcess/win/WebView.cpp
+++ b/Source/WebKit/UIProcess/win/WebView.cpp
@@ -341,7 +341,7 @@ void WebView::windowAncestryDidChange()
 
 LRESULT WebView::onMouseEvent(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam, bool& handled)
 {
-    NativeWebMouseEvent mouseEvent = NativeWebMouseEvent(hWnd, message, wParam, lParam, m_wasActivatedByMouseEvent, m_page->intrinsicDeviceScaleFactor());
+    Ref mouseEvent = NativeWebMouseEvent::create(hWnd, message, wParam, lParam, m_wasActivatedByMouseEvent, m_page->intrinsicDeviceScaleFactor());
     setWasActivatedByMouseEvent(false);
 
     switch (message) {
@@ -370,7 +370,7 @@ LRESULT WebView::onMouseEvent(HWND hWnd, UINT message, WPARAM wParam, LPARAM lPa
         ASSERT_NOT_REACHED();
     }
 
-    m_page->handleMouseEvent(mouseEvent);
+    m_page->handleMouseEvent(WTF::move(mouseEvent));
 
     handled = true;
     return 0;
@@ -378,15 +378,15 @@ LRESULT WebView::onMouseEvent(HWND hWnd, UINT message, WPARAM wParam, LPARAM lPa
 
 LRESULT WebView::onWheelEvent(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam, bool& handled)
 {
-    NativeWebWheelEvent wheelEvent(hWnd, message, wParam, lParam, m_page->intrinsicDeviceScaleFactor());
-    if (wheelEvent.controlKey()) {
+    Ref wheelEvent = NativeWebWheelEvent::create(hWnd, message, wParam, lParam, m_page->intrinsicDeviceScaleFactor());
+    if (wheelEvent->controlKey()) {
         // We do not want WebKit to handle Control + Wheel, this should be handled by the client application
         // to zoom the page.
         handled = false;
         return 0;
     }
 
-    m_page->handleNativeWheelEvent(wheelEvent);
+    m_page->handleNativeWheelEvent(WTF::move(wheelEvent));
 
     handled = true;
     return 0;
@@ -467,7 +467,7 @@ LRESULT WebView::onKeyEvent(HWND hWnd, UINT message, WPARAM wParam, LPARAM lPara
                 pendingCharEvents.append(msg);
         }
     }
-    m_page->handleKeyboardEvent(NativeWebKeyboardEvent(hWnd, message, wParam, lParam, WTF::move(pendingCharEvents)));
+    m_page->handleKeyboardEvent(NativeWebKeyboardEvent::create(hWnd, message, wParam, lParam, WTF::move(pendingCharEvents)));
 
     // We claim here to always have handled the event. If the event is not in fact handled, we will
     // find out later in didNotHandleKeyEvent.
diff --git a/Source/WebKit/WebKit.xcodeproj/project.pbxproj b/Source/WebKit/WebKit.xcodeproj/project.pbxproj
index bf5ebaa603d1..98faf1f6e8da 100644
--- a/Source/WebKit/WebKit.xcodeproj/project.pbxproj
+++ b/Source/WebKit/WebKit.xcodeproj/project.pbxproj
@@ -142,6 +142,7 @@
 		029D6BB32C407AA30068CF99 /* JSWebExtensionAPISidebarAction.h in Headers */ = {isa = PBXBuildFile; fileRef = 029D6BAD2C407AA30068CF99 /* JSWebExtensionAPISidebarAction.h */; };
 		029D6BB42C407AA30068CF99 /* JSWebExtensionAPISidePanel.h in Headers */ = {isa = PBXBuildFile; fileRef = 029D6BAF2C407AA30068CF99 /* JSWebExtensionAPISidePanel.h */; };
 		0701789E23BE9CFC005F0FAA /* RemoteMediaPlayerMIMETypeCache.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0701789B23BAE261005F0FAA /* RemoteMediaPlayerMIMETypeCache.cpp */; };
+		0708B49430413DF90014BF6C /* WTFExpected+Extras.swift in Sources */ = {isa = PBXBuildFile; fileRef = 0708B49330413DF90014BF6C /* WTFExpected+Extras.swift */; };
 		071467782DFE84E500F77867 /* WebPage+Transferable.swift in Sources */ = {isa = PBXBuildFile; fileRef = 071467772DFE84E500F77867 /* WebPage+Transferable.swift */; };
 		07152D072F2F037D00B56C0E /* WKTextSelectionController.swift in Sources */ = {isa = PBXBuildFile; fileRef = 07152D062F2F037D00B56C0E /* WKTextSelectionController.swift */; };
 		07152D092F2F038A00B56C0E /* WKTextSelectionController.h in Headers */ = {isa = PBXBuildFile; fileRef = 07152D082F2F038A00B56C0E /* WKTextSelectionController.h */; };
@@ -198,6 +199,7 @@
 		076E884E1A13CADF005E90FC /* APIContextMenuClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 076E884D1A13CADF005E90FC /* APIContextMenuClient.h */; };
 		0772811D21234FF600C8EF2E /* UserMediaPermissionRequestManager.h in Headers */ = {isa = PBXBuildFile; fileRef = 4A410F4319AF7B27002EBAB5 /* UserMediaPermissionRequestManager.h */; };
 		0773A93B3023B0FB002C57FE /* SpatialShim.swift in Sources */ = {isa = PBXBuildFile; fileRef = 0773A93A3023B0FB002C57FE /* SpatialShim.swift */; };
+		077DBAFF303AAE74000AA8FC /* RunJavaScriptResult.h in Headers */ = {isa = PBXBuildFile; fileRef = 077DBAFE303AAE74000AA8FC /* RunJavaScriptResult.h */; };
 		077DD8E7303AE8A2000AA8FC /* WTFCompletionHandler+Extras.swift in Sources */ = {isa = PBXBuildFile; fileRef = 077DD8E6303AE8A2000AA8FC /* WTFCompletionHandler+Extras.swift */; };
 		077FD1A02CC7569200C5D9E0 /* WKIntelligenceReplacementTextEffectCoordinator.swift in Sources */ = {isa = PBXBuildFile; fileRef = 077FD19F2CC7569200C5D9E0 /* WKIntelligenceReplacementTextEffectCoordinator.swift */; };
 		078074F93029A874005492F5 /* WKDOMDoubleClickGestureRecognizer.swift in Sources */ = {isa = PBXBuildFile; fileRef = 078074F83029A874005492F5 /* WKDOMDoubleClickGestureRecognizer.swift */; };
@@ -2566,7 +2568,6 @@
 		EB44A69C2C8A4F6E006595BF /* WebClipCache.h in Headers */ = {isa = PBXBuildFile; fileRef = EB44A6992C8A4F6E006595BF /* WebClipCache.h */; };
 		EB450E0F2996C7B6009724B1 /* WKWebsiteDataStoreRefPrivateMac.h in Headers */ = {isa = PBXBuildFile; fileRef = EB450E0D2996C7A1009724B1 /* WKWebsiteDataStoreRefPrivateMac.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		EB517B802D7C09690019E451 /* AboutSchemeHandlerCocoa.mm in Sources */ = {isa = PBXBuildFile; fileRef = EB517B7A2D7BC03B0019E451 /* AboutSchemeHandlerCocoa.mm */; };
-		EB579C3729AEBD0800894C1C /* EarlyHintsResourceLoader.h in Headers */ = {isa = PBXBuildFile; fileRef = EB579C3629AEBCF100894C1C /* EarlyHintsResourceLoader.h */; };
 		EB7D252B27B31B77009CB586 /* com.apple.WebKit.webpushd.mac.sb in Resources */ = {isa = PBXBuildFile; fileRef = EB7D252A27B31B3F009CB586 /* com.apple.WebKit.webpushd.mac.sb */; };
 		EB8322162D72600C009515DA /* AboutSchemeHandler.h in Headers */ = {isa = PBXBuildFile; fileRef = EB8322132D72600C009515DA /* AboutSchemeHandler.h */; };
 		EBA8D3AB27A5E31300CB7900 /* ApplePushServiceSPI.h in Headers */ = {isa = PBXBuildFile; fileRef = EBA8D3AA27A5E31300CB7900 /* ApplePushServiceSPI.h */; };
@@ -3438,6 +3439,7 @@
 		0701789B23BAE261005F0FAA /* RemoteMediaPlayerMIMETypeCache.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = RemoteMediaPlayerMIMETypeCache.cpp; sourceTree = "<group>"; };
 		0701789C23BAE262005F0FAA /* RemoteMediaPlayerMIMETypeCache.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = RemoteMediaPlayerMIMETypeCache.h; sourceTree = "<group>"; };
 		070259BE2522841C00153405 /* UserMediaPermissionRequestManagerProxy.mm */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.objcpp; path = UserMediaPermissionRequestManagerProxy.mm; sourceTree = "<group>"; };
+		0708B49330413DF90014BF6C /* WTFExpected+Extras.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = "WTFExpected+Extras.swift"; sourceTree = "<group>"; };
 		071467772DFE84E500F77867 /* WebPage+Transferable.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = "WebPage+Transferable.swift"; sourceTree = "<group>"; };
 		07152D062F2F037D00B56C0E /* WKTextSelectionController.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = WKTextSelectionController.swift; sourceTree = "<group>"; };
 		07152D082F2F038A00B56C0E /* WKTextSelectionController.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = WKTextSelectionController.h; sourceTree = "<group>"; };
@@ -3532,6 +3534,7 @@
 		0779D7BB2EA8101800C389D5 /* RemoteMediaSessionProxy.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = RemoteMediaSessionProxy.h; sourceTree = "<group>"; };
 		0779D7BC2EA8101800C389D5 /* RemoteMediaSessionProxy.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = RemoteMediaSessionProxy.cpp; sourceTree = "<group>"; };
 		077BA570260E8F630072F19F /* MediaSessionCoordinatorProxyPrivate.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = MediaSessionCoordinatorProxyPrivate.h; sourceTree = "<group>"; };
+		077DBAFE303AAE74000AA8FC /* RunJavaScriptResult.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = RunJavaScriptResult.h; sourceTree = "<group>"; };
 		077DD8E6303AE8A2000AA8FC /* WTFCompletionHandler+Extras.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = "WTFCompletionHandler+Extras.swift"; sourceTree = "<group>"; };
 		077FD19F2CC7569200C5D9E0 /* WKIntelligenceReplacementTextEffectCoordinator.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = WKIntelligenceReplacementTextEffectCoordinator.swift; sourceTree = "<group>"; };
 		078074F83029A874005492F5 /* WKDOMDoubleClickGestureRecognizer.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = WKDOMDoubleClickGestureRecognizer.swift; sourceTree = "<group>"; };
@@ -8904,8 +8907,6 @@
 		EB450E0D2996C7A1009724B1 /* WKWebsiteDataStoreRefPrivateMac.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; name = WKWebsiteDataStoreRefPrivateMac.h; path = mac/WKWebsiteDataStoreRefPrivateMac.h; sourceTree = "<group>"; };
 		EB450E0E2996C7A1009724B1 /* WKWebsiteDataStoreRefPrivateMac.mm */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.objcpp; name = WKWebsiteDataStoreRefPrivateMac.mm; path = mac/WKWebsiteDataStoreRefPrivateMac.mm; sourceTree = "<group>"; };
 		EB517B7A2D7BC03B0019E451 /* AboutSchemeHandlerCocoa.mm */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.objcpp; path = AboutSchemeHandlerCocoa.mm; sourceTree = "<group>"; };
-		EB579C3529AEBCF100894C1C /* EarlyHintsResourceLoader.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = EarlyHintsResourceLoader.cpp; sourceTree = "<group>"; };
-		EB579C3629AEBCF100894C1C /* EarlyHintsResourceLoader.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = EarlyHintsResourceLoader.h; sourceTree = "<group>"; };
 		EB7D252927B316A6009CB586 /* com.apple.WebKit.webpushd.mac.sb.in */ = {isa = PBXFileReference; lastKnownFileType = text; path = com.apple.WebKit.webpushd.mac.sb.in; sourceTree = "<group>"; };
 		EB7D252A27B31B3F009CB586 /* com.apple.WebKit.webpushd.mac.sb */ = {isa = PBXFileReference; lastKnownFileType = file; path = com.apple.WebKit.webpushd.mac.sb; sourceTree = "<group>"; };
 		EB8322132D72600C009515DA /* AboutSchemeHandler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AboutSchemeHandler.h; sourceTree = "<group>"; };
@@ -10557,6 +10558,7 @@
 				4149E97C2E95204700DA5303 /* RTCSocketCreationFlags.h */,
 				41B8D85628C9B8D100E5FA37 /* RTCWebKitEncodedFrameInfo.h */,
 				FA7036C32D72882A00083D04 /* RunJavaScriptParameters.h */,
+				077DBAFE303AAE74000AA8FC /* RunJavaScriptResult.h */,
 				AE213B932DDE47AA0043DE0F /* SafeBrowsingCheckOngoing.h */,
 				BC2D021612AC41CB00E732A3 /* SameDocumentNavigationType.h */,
 				44122266296A89820057E1A5 /* SameDocumentNavigationType.serialization.in */,
@@ -10734,6 +10736,7 @@
 				E0E1E2E3E4E5E6E700000003 /* WriteWebArchiveToPasteBoardResult.serialization.in */,
 				5CA6A48B28F6621800F92B6E /* WTFArgumentCoders.serialization.in */,
 				077DD8E6303AE8A2000AA8FC /* WTFCompletionHandler+Extras.swift */,
+				0708B49330413DF90014BF6C /* WTFExpected+Extras.swift */,
 			);
 			path = Shared;
 			sourceTree = "<group>";
@@ -14266,8 +14269,6 @@
 				41E4C3F429A3E38800EA6B3A /* BackgroundFetchLoad.h */,
 				5C826D6E26D58A16008AEC91 /* DatabaseUtilities.cpp */,
 				5C826D6F26D58A16008AEC91 /* DatabaseUtilities.h */,
-				EB579C3529AEBCF100894C1C /* EarlyHintsResourceLoader.cpp */,
-				EB579C3629AEBCF100894C1C /* EarlyHintsResourceLoader.h */,
 				53F3CAA5206C443E0086490E /* NetworkActivityTracker.cpp */,
 				535BCB902069C49C00CCCE02 /* NetworkActivityTracker.h */,
 				5C3B0A012DA0000000ABCDEF /* NetworkActivityTracker.serialization.in */,
@@ -18432,7 +18433,6 @@
 				2D50F88F2B21C5170042E139 /* DynamicContentScalingBifurcatedImageBuffer.h in Headers */,
 				BCE579A62634836700F5C5E9 /* DynamicContentScalingImageBufferBackend.h in Headers */,
 				2DA6731A20C754B1003CB401 /* DynamicViewportSizeUpdate.h in Headers */,
-				EB579C3729AEBD0800894C1C /* EarlyHintsResourceLoader.h in Headers */,
 				E105FE5418D7B9DE008F57A8 /* EditingRange.h in Headers */,
 				1AA41AB512C02EC4002BE67B /* EditorState.h in Headers */,
 				DD4DB786280F945A001700D4 /* ElementAttribute.js in Headers */,
@@ -18876,6 +18876,7 @@
 				F499BAA32947C1A4001241D6 /* RevealFocusedElementDeferrer.h in Headers */,
 				442E7BEB27B4586900C69AC1 /* RevealItem.h in Headers */,
 				410482CE1DDD324F00F006D0 /* RTCNetwork.h in Headers */,
+				077DBAFF303AAE74000AA8FC /* RunJavaScriptResult.h in Headers */,
 				46F38E8C2416E6730059375A /* RunningBoardServicesSPI.h in Headers */,
 				DDDFE827284699EC006F1EE5 /* SafariServicesSPI.h in Headers */,
 				AE213B942DDE47AA0043DE0F /* SafeBrowsingCheckOngoing.h in Headers */,
@@ -22686,6 +22687,7 @@
 				075369492DC589E1006446F8 /* WKWebView+TextExtraction.swift in Sources */,
 				079A4DA32D72CDB400CA387F /* WKWebViewConfiguration+Extras.swift in Sources */,
 				077DD8E7303AE8A2000AA8FC /* WTFCompletionHandler+Extras.swift in Sources */,
+				0708B49430413DF90014BF6C /* WTFExpected+Extras.swift in Sources */,
 				C14D306924B79BE000480387 /* XPCEndpoint.mm in Sources */,
 				C14D306A24B79BE400480387 /* XPCEndpointClient.mm in Sources */,
 			);
diff --git a/Source/WebKit/WebProcess/Databases/IndexedDB/WebIDBConnectionToServer.cpp b/Source/WebKit/WebProcess/Databases/IndexedDB/WebIDBConnectionToServer.cpp
index 61ca09d3db8f..a5828dbc007b 100644
--- a/Source/WebKit/WebProcess/Databases/IndexedDB/WebIDBConnectionToServer.cpp
+++ b/Source/WebKit/WebProcess/Databases/IndexedDB/WebIDBConnectionToServer.cpp
@@ -59,7 +59,6 @@ Ref<WebIDBConnectionToServer> WebIDBConnectionToServer::create(PAL::SessionID se
 
 WebIDBConnectionToServer::WebIDBConnectionToServer(PAL::SessionID sessionID)
 {
-    relaxAdoptionRequirement();
     lazyInitialize(m_connectionToServer, IDBClient::IDBConnectionToServer::create(*this, sessionID));
 }
 
diff --git a/Source/WebKit/WebProcess/Extensions/API/Cocoa/WebExtensionAPIDevToolsInspectedWindowCocoa.mm b/Source/WebKit/WebProcess/Extensions/API/Cocoa/WebExtensionAPIDevToolsInspectedWindowCocoa.mm
index ae48e28ed8e4..035bc4150727 100644
--- a/Source/WebKit/WebProcess/Extensions/API/Cocoa/WebExtensionAPIDevToolsInspectedWindowCocoa.mm
+++ b/Source/WebKit/WebProcess/Extensions/API/Cocoa/WebExtensionAPIDevToolsInspectedWindowCocoa.mm
@@ -37,6 +37,7 @@
 #import "JSWebExtensionWrapper.h"
 #import "JavaScriptEvaluationResult.h"
 #import "MessageSenderInlines.h"
+#import "RunJavaScriptResult.h"
 #import "WebExtensionContextMessages.h"
 #import "WebExtensionTabIdentifier.h"
 #import "WebExtensionUtilities.h"
@@ -67,7 +68,7 @@
         }
     }
 
-    WebProcess::singleton().sendWithAsyncReply(Messages::WebExtensionContext::DevToolsInspectedWindowEval(webPageProxyIdentifier, expression, frameURL), [protectedThis = Ref { *this }, callback = WTF::move(callback)](Expected<Expected<JavaScriptEvaluationResult, std::optional<WebCore::ExceptionDetails>>, WebExtensionError>&& result) mutable {
+    WebProcess::singleton().sendWithAsyncReply(Messages::WebExtensionContext::DevToolsInspectedWindowEval(webPageProxyIdentifier, expression, frameURL), [protectedThis = Ref { *this }, callback = WTF::move(callback)](Expected<RunJavaScriptResult, WebExtensionError>&& result) mutable {
         if (!result) {
             callback->reportError(result.error().createNSString().get());
             return;
diff --git a/Source/WebKit/WebProcess/FileAPI/BlobRegistryProxy.cpp b/Source/WebKit/WebProcess/FileAPI/BlobRegistryProxy.cpp
index cc6e7bdbdad3..447787a0a5d5 100644
--- a/Source/WebKit/WebProcess/FileAPI/BlobRegistryProxy.cpp
+++ b/Source/WebKit/WebProcess/FileAPI/BlobRegistryProxy.cpp
@@ -50,55 +50,55 @@ void BlobRegistryProxy::registerInternalFileBlobURL(const URL& url, Ref<BlobData
     }
 
     String replacementPath = path == file->path() ? nullString() : file->path();
-    WebProcess::singleton().ensureNetworkProcessConnection().connection().send(Messages::NetworkConnectionToWebProcess::RegisterInternalFileBlobURL(url, path, replacementPath, WTF::move(extensionHandle), contentType), 0);
+    protect(WebProcess::singleton().ensureNetworkProcessConnection().connection())->send(Messages::NetworkConnectionToWebProcess::RegisterInternalFileBlobURL(url, path, replacementPath, WTF::move(extensionHandle), contentType), 0);
 }
 
 void BlobRegistryProxy::registerInternalBlobURL(const URL& url, Vector<BlobPart>&& blobParts, const String& contentType)
 {
-    WebProcess::singleton().ensureNetworkProcessConnection().connection().send(Messages::NetworkConnectionToWebProcess::RegisterInternalBlobURL(url, blobParts, contentType), 0);
+    protect(WebProcess::singleton().ensureNetworkProcessConnection().connection())->send(Messages::NetworkConnectionToWebProcess::RegisterInternalBlobURL(url, blobParts, contentType), 0);
 }
 
 void BlobRegistryProxy::registerBlobURL(const URL& url, const URL& srcURL, const PolicyContainer& policyContainer, const std::optional<SecurityOriginData>& topOrigin)
 {
-    WebProcess::singleton().ensureNetworkProcessConnection().connection().send(Messages::NetworkConnectionToWebProcess::RegisterBlobURL { url, srcURL, policyContainer, topOrigin }, 0);
+    protect(WebProcess::singleton().ensureNetworkProcessConnection().connection())->send(Messages::NetworkConnectionToWebProcess::RegisterBlobURL { url, srcURL, policyContainer, topOrigin }, 0);
 }
 
 void BlobRegistryProxy::registerInternalBlobURLOptionallyFileBacked(const URL& url, const URL& srcURL, RefPtr<WebCore::BlobDataFileReference>&& file, const String& contentType)
 {
     ASSERT(file);
-    WebProcess::singleton().ensureNetworkProcessConnection().connection().send(Messages::NetworkConnectionToWebProcess::RegisterInternalBlobURLOptionallyFileBacked(url, srcURL, file->path(), contentType), 0);
+    protect(WebProcess::singleton().ensureNetworkProcessConnection().connection())->send(Messages::NetworkConnectionToWebProcess::RegisterInternalBlobURLOptionallyFileBacked(url, srcURL, file->path(), contentType), 0);
 }
 
 void BlobRegistryProxy::unregisterBlobURL(const URL& url, const std::optional<SecurityOriginData>& topOrigin)
 {
-    WebProcess::singleton().ensureNetworkProcessConnection().connection().send(Messages::NetworkConnectionToWebProcess::UnregisterBlobURL(url, topOrigin), 0);
+    protect(WebProcess::singleton().ensureNetworkProcessConnection().connection())->send(Messages::NetworkConnectionToWebProcess::UnregisterBlobURL(url, topOrigin), 0);
 }
 
 void BlobRegistryProxy::registerInternalBlobURLForSlice(const URL& url, const URL& srcURL, long long start, long long end, const String& contentType)
 {
-    WebProcess::singleton().ensureNetworkProcessConnection().connection().send(Messages::NetworkConnectionToWebProcess::RegisterInternalBlobURLForSlice(url, srcURL, start, end, contentType), 0);
+    protect(WebProcess::singleton().ensureNetworkProcessConnection().connection())->send(Messages::NetworkConnectionToWebProcess::RegisterInternalBlobURLForSlice(url, srcURL, start, end, contentType), 0);
 }
 
 void BlobRegistryProxy::registerBlobURLHandle(const URL& url, const std::optional<SecurityOriginData>& topOrigin)
 {
-    WebProcess::singleton().ensureNetworkProcessConnection().connection().send(Messages::NetworkConnectionToWebProcess::RegisterBlobURLHandle(url, topOrigin), 0);
+    protect(WebProcess::singleton().ensureNetworkProcessConnection().connection())->send(Messages::NetworkConnectionToWebProcess::RegisterBlobURLHandle(url, topOrigin), 0);
 }
 
 void BlobRegistryProxy::unregisterBlobURLHandle(const URL& url, const std::optional<SecurityOriginData>& topOrigin)
 {
-    WebProcess::singleton().ensureNetworkProcessConnection().connection().send(Messages::NetworkConnectionToWebProcess::UnregisterBlobURLHandle(url, topOrigin), 0);
+    protect(WebProcess::singleton().ensureNetworkProcessConnection().connection())->send(Messages::NetworkConnectionToWebProcess::UnregisterBlobURLHandle(url, topOrigin), 0);
 }
 
 String BlobRegistryProxy::blobType(const URL& url)
 {
-    auto sendResult = WebProcess::singleton().ensureNetworkProcessConnection().connection().sendSync(Messages::NetworkConnectionToWebProcess::BlobType(url), 0);
+    auto sendResult = protect(WebProcess::singleton().ensureNetworkProcessConnection().connection())->sendSync(Messages::NetworkConnectionToWebProcess::BlobType(url), 0);
     auto [result] = sendResult.takeReplyOr(emptyString());
     return result;
 }
 
 unsigned long long BlobRegistryProxy::blobSize(const URL& url)
 {
-    auto sendResult = WebProcess::singleton().ensureNetworkProcessConnection().connection().sendSync(Messages::NetworkConnectionToWebProcess::BlobSize(url), 0);
+    auto sendResult = protect(WebProcess::singleton().ensureNetworkProcessConnection().connection())->sendSync(Messages::NetworkConnectionToWebProcess::BlobSize(url), 0);
     auto [resultSize] = sendResult.takeReplyOr(0);
     return resultSize;
 }
diff --git a/Source/WebKit/WebProcess/FullScreen/WebFullScreenManager.cpp b/Source/WebKit/WebProcess/FullScreen/WebFullScreenManager.cpp
index 5e3cf76ab1a1..a8a73053a486 100644
--- a/Source/WebKit/WebProcess/FullScreen/WebFullScreenManager.cpp
+++ b/Source/WebKit/WebProcess/FullScreen/WebFullScreenManager.cpp
@@ -187,15 +187,16 @@ void WebFullScreenManager::setPIPStandbyElement(WebCore::HTMLVideoElement* pipSt
 #if !RELEASE_LOG_DISABLED
     auto logIdentifierForElement = [] (auto* element) { return element ? element->logIdentifier() : 0; };
 #endif
-    ALWAYS_LOG(LOGIDENTIFIER, "old element ", logIdentifierForElement(m_pipStandbyElement.get()), ", new element ", logIdentifierForElement(pipStandbyElement));
+    RefPtr previousPIPStandbyElement = m_pipStandbyElement;
+    ALWAYS_LOG(LOGIDENTIFIER, "old element ", logIdentifierForElement(previousPIPStandbyElement.get()), ", new element ", logIdentifierForElement(pipStandbyElement));
 
-    if (m_pipStandbyElement)
-        Ref { *m_pipStandbyElement }->setVideoFullscreenStandby(false);
+    if (previousPIPStandbyElement)
+        previousPIPStandbyElement->setVideoFullscreenStandby(false);
 
     m_pipStandbyElement = pipStandbyElement;
 
-    if (m_pipStandbyElement)
-        Ref { *m_pipStandbyElement }->setVideoFullscreenStandby(true);
+    if (pipStandbyElement)
+        pipStandbyElement->setVideoFullscreenStandby(true);
 #endif
 }
 
diff --git a/Source/WebKit/WebProcess/GPU/graphics/cocoa/ImageBufferShareableMappedIOSurfaceBackend.cpp b/Source/WebKit/WebProcess/GPU/graphics/cocoa/ImageBufferShareableMappedIOSurfaceBackend.cpp
index 78cc34cd8a88..4e5804f9f39f 100644
--- a/Source/WebKit/WebProcess/GPU/graphics/cocoa/ImageBufferShareableMappedIOSurfaceBackend.cpp
+++ b/Source/WebKit/WebProcess/GPU/graphics/cocoa/ImageBufferShareableMappedIOSurfaceBackend.cpp
@@ -59,7 +59,7 @@ std::unique_ptr<ImageBufferShareableMappedIOSurfaceBackend> ImageBufferShareable
 
     CGContextClearRect(cgContext.get(), FloatRect(FloatPoint::zero(), backendSize));
 
-    return std::unique_ptr<ImageBufferShareableMappedIOSurfaceBackend> { new ImageBufferShareableMappedIOSurfaceBackend { parameters, WTF::move(surface), WTF::move(cgContext), 0, creationContext.surfacePool.get() } };
+    return std::unique_ptr<ImageBufferShareableMappedIOSurfaceBackend> { new ImageBufferShareableMappedIOSurfaceBackend { parameters, WTF::move(surface), WTF::move(cgContext), 0, protect(creationContext.surfacePool) } };
 }
 
 std::unique_ptr<ImageBufferShareableMappedIOSurfaceBackend> ImageBufferShareableMappedIOSurfaceBackend::create(const Parameters& parameters, ImageBufferBackendHandle handle)
diff --git a/Source/WebKit/WebProcess/GPU/graphics/cocoa/ImageBufferShareableMappedIOSurfaceBitmapBackend.h b/Source/WebKit/WebProcess/GPU/graphics/cocoa/ImageBufferShareableMappedIOSurfaceBitmapBackend.h
index 4205b6cedbfa..6eed1c3c0d1b 100644
--- a/Source/WebKit/WebProcess/GPU/graphics/cocoa/ImageBufferShareableMappedIOSurfaceBitmapBackend.h
+++ b/Source/WebKit/WebProcess/GPU/graphics/cocoa/ImageBufferShareableMappedIOSurfaceBitmapBackend.h
@@ -77,7 +77,7 @@ class ImageBufferShareableMappedIOSurfaceBitmapBackend final : public WebCore::I
     std::unique_ptr<WebCore::IOSurface> m_surface;
     std::optional<WebCore::IOSurface::Locker<WebCore::IOSurface::AccessMode::ReadWrite>> m_lock;
     WebCore::VolatilityState m_volatilityState { WebCore::VolatilityState::NonVolatile };
-    RefPtr<WebCore::IOSurfacePool> m_ioSurfacePool;
+    const RefPtr<WebCore::IOSurfacePool> m_ioSurfacePool;
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit/WebProcess/GPU/media/AudioVideoRendererRemote.cpp b/Source/WebKit/WebProcess/GPU/media/AudioVideoRendererRemote.cpp
index 29a20ec2a14f..e0e71cc06167 100644
--- a/Source/WebKit/WebProcess/GPU/media/AudioVideoRendererRemote.cpp
+++ b/Source/WebKit/WebProcess/GPU/media/AudioVideoRendererRemote.cpp
@@ -549,7 +549,7 @@ Ref<MediaTimePromise> AudioVideoRendererRemote::prepareToSeek(const MediaTime& t
 
             if (auto producer = std::exchange(protectedThis->m_prepareSeekPromise, std::nullopt))
                 producer->settle(WTF::move(result));
-        })->track(m_prepareSeekRequest);
+        })->track(protect(m_prepareSeekRequest));
 
         return promise;
     });
@@ -590,7 +590,7 @@ Ref<GenericPromise> AudioVideoRendererRemote::finishSeek(const MediaTime& time)
 
             if (auto producer = std::exchange(protectedThis->m_finishSeekPromise, std::nullopt))
                 producer->settle(WTF::move(result));
-        })->track(m_finishSeekRequest);
+        })->track(protect(m_finishSeekRequest));
 
         return promise;
     });
@@ -782,7 +782,7 @@ Ref<MediaTimePromise> AudioVideoRendererRemote::notifyTimeReachedAndStall(const
             protect(protectedThis->m_stallRequest)->complete();
             if (auto producer = std::exchange(protectedThis->m_stallProducer, std::nullopt))
                 producer->settle(WTF::move(result));
-        })->track(m_stallRequest);
+        })->track(protect(m_stallRequest));
         return promise;
     });
 }
diff --git a/Source/WebKit/WebProcess/GPU/media/MediaPlayerPrivateRemote.cpp b/Source/WebKit/WebProcess/GPU/media/MediaPlayerPrivateRemote.cpp
index 21bd3ef11ba6..2a3e2cd5b388 100644
--- a/Source/WebKit/WebProcess/GPU/media/MediaPlayerPrivateRemote.cpp
+++ b/Source/WebKit/WebProcess/GPU/media/MediaPlayerPrivateRemote.cpp
@@ -264,7 +264,7 @@ void MediaPlayerPrivateRemote::load(const URL& url, const LoadOptions& options)
         if (!createExtension()) {
             WTFLogAlways("Unable to create sandbox extension handle for GPUProcess url.\n");
             m_cachedState.networkState = MediaPlayer::NetworkState::FormatError;
-            if (RefPtr player = m_player.get())
+            if (RefPtr player = m_player)
                 player->networkStateChanged();
             return;
         }
@@ -434,7 +434,7 @@ MediaPlayer::MovieLoadType MediaPlayerPrivateRemote::movieLoadType() const
 void MediaPlayerPrivateRemote::networkStateChanged(RemoteMediaPlayerState&& state)
 {
     updateCachedState(WTF::move(state));
-    if (RefPtr player = m_player.get())
+    if (RefPtr player = m_player)
         player->networkStateChanged();
 }
 
@@ -446,7 +446,7 @@ void MediaPlayerPrivateRemote::setReadyState(MediaPlayer::ReadyState readyState)
         return;
     if (readyState > MediaPlayer::ReadyState::HaveCurrentData && m_readyState == MediaPlayer::ReadyState::HaveCurrentData)
         ALWAYS_LOG(LOGIDENTIFIER, "stall detected");
-    if (RefPtr player = m_player.get())
+    if (RefPtr player = m_player)
         player->readyStateChanged();
 }
 
@@ -464,14 +464,14 @@ void MediaPlayerPrivateRemote::readyStateChanged(RemoteMediaPlayerState&& state,
 void MediaPlayerPrivateRemote::volumeChanged(double volume)
 {
     m_volume = volume;
-    if (RefPtr player = m_player.get())
+    if (RefPtr player = m_player)
         player->volumeChanged(volume);
 }
 
 void MediaPlayerPrivateRemote::muteChanged(bool muted)
 {
     m_muted = muted;
-    if (RefPtr player = m_player.get())
+    if (RefPtr player = m_player)
         player->muteChanged(muted);
 }
 
@@ -480,14 +480,14 @@ void MediaPlayerPrivateRemote::timeChanged(RemoteMediaPlayerState&& state, Media
     ALWAYS_LOG(LOGIDENTIFIER, "currentTime:", timeData.currentTime, " effectiveRate:", timeData.effectiveRate);
     updateCachedState(WTF::move(state));
     m_currentTimeEstimator.setTime(timeData);
-    if (RefPtr player = m_player.get())
+    if (RefPtr player = m_player)
         player->timeChanged();
 }
 
 void MediaPlayerPrivateRemote::durationChanged(RemoteMediaPlayerState&& state)
 {
     updateCachedState(WTF::move(state));
-    if (RefPtr player = m_player.get())
+    if (RefPtr player = m_player)
         player->durationChanged();
 }
 
@@ -500,7 +500,7 @@ void MediaPlayerPrivateRemote::rateChanged(double rate, MediaTimeUpdateData&& ti
     // Force to use the cached time so that the next call to currentTime() will return the cached time.
     // Time will progress following the next call to currentTimeChanged.
     m_currentTimeEstimator.forceUseOfCachedTimeUntilNextSetTime();
-    if (RefPtr player = m_player.get())
+    if (RefPtr player = m_player)
         player->rateChanged();
 }
 
@@ -509,28 +509,28 @@ void MediaPlayerPrivateRemote::playbackStateChanged(bool paused, MediaTimeUpdate
     INFO_LOG(LOGIDENTIFIER, "currentTime:", timeData.currentTime, " effectiveRate:", timeData.effectiveRate);
     m_cachedState.paused = paused;
     m_currentTimeEstimator.setTime(timeData);
-    if (RefPtr player = m_player.get())
+    if (RefPtr player = m_player)
         player->playbackStateChanged();
 }
 
 void MediaPlayerPrivateRemote::engineFailedToLoad(int64_t platformErrorCode)
 {
     m_platformErrorCode = platformErrorCode;
-    if (RefPtr player = m_player.get())
+    if (RefPtr player = m_player)
         player->remoteEngineFailedToLoad();
 }
 
 void MediaPlayerPrivateRemote::characteristicChanged(RemoteMediaPlayerState&& state)
 {
     updateCachedState(WTF::move(state));
-    if (RefPtr player = m_player.get())
+    if (RefPtr player = m_player)
         player->characteristicChanged();
 }
 
 void MediaPlayerPrivateRemote::sizeChanged(WebCore::FloatSize naturalSize)
 {
     m_cachedState.naturalSize = naturalSize;
-    if (RefPtr player = m_player.get())
+    if (RefPtr player = m_player)
         player->sizeChanged();
 }
 
@@ -549,7 +549,7 @@ void MediaPlayerPrivateRemote::currentTimeChanged(MediaTimeUpdateData&& timeData
 
     if (reverseJump
         || (timeData.timeIsProgressing() != oldTimeIsProgressing && timeData.currentTime != oldCachedTime && !m_cachedState.paused)) {
-        if (RefPtr player = m_player.get())
+        if (RefPtr player = m_player)
             player->timeChanged();
     }
 }
@@ -557,14 +557,14 @@ void MediaPlayerPrivateRemote::currentTimeChanged(MediaTimeUpdateData&& timeData
 void MediaPlayerPrivateRemote::firstVideoFrameAvailable()
 {
     ALWAYS_LOG(LOGIDENTIFIER);
-    if (RefPtr player = m_player.get())
+    if (RefPtr player = m_player)
         player->firstVideoFrameAvailable();
 }
 
 void MediaPlayerPrivateRemote::renderingModeChanged()
 {
     ALWAYS_LOG(LOGIDENTIFIER);
-    if (RefPtr player = m_player.get())
+    if (RefPtr player = m_player)
         player->renderingModeChanged();
 }
 
@@ -595,7 +595,7 @@ bool MediaPlayerPrivateRemote::supportsAcceleratedRendering() const
 
 void MediaPlayerPrivateRemote::acceleratedRenderingStateChanged()
 {
-    if (RefPtr player = m_player.get()) {
+    if (RefPtr player = m_player) {
         protect(connection())->send(Messages::RemoteMediaPlayerProxy::AcceleratedRenderingStateChanged(player->renderingCanBeAccelerated()), m_id);
     }
 }
@@ -720,8 +720,8 @@ void MediaPlayerPrivateRemote::addRemoteAudioTrack(AudioTrackPrivateRemoteConfig
     auto addResult = m_audioTracks.emplace(configuration.trackId, AudioTrackPrivateRemote::create(protect(manager()->gpuProcessConnection()), m_id, WTF::move(configuration)));
     ASSERT(addResult.second);
 
-    if (RefPtr player = m_player.get())
-        player->addAudioTrack(addResult.first->second);
+    if (RefPtr player = m_player)
+        player->addAudioTrack(protect(addResult.first->second));
 }
 
 void MediaPlayerPrivateRemote::removeRemoteAudioTrack(TrackID trackID)
@@ -732,8 +732,8 @@ void MediaPlayerPrivateRemote::removeRemoteAudioTrack(TrackID trackID)
     ASSERT(m_audioTracks.contains(trackID));
 
     if (auto it = m_audioTracks.find(trackID); it != m_audioTracks.end()) {
-        if (RefPtr player = m_player.get())
-            player->removeAudioTrack(it->second);
+        if (RefPtr player = m_player)
+            player->removeAudioTrack(protect(it->second));
         m_audioTracks.erase(trackID);
     }
 }
@@ -765,8 +765,8 @@ void MediaPlayerPrivateRemote::addRemoteTextTrack(TextTrackPrivateRemoteConfigur
     auto addResult = m_textTracks.emplace(configuration.trackId, TextTrackPrivateRemote::create(protect(manager()->gpuProcessConnection()), m_id, WTF::move(configuration)));
     ASSERT(addResult.second);
 
-    if (RefPtr player = m_player.get())
-        player->addTextTrack(addResult.first->second);
+    if (RefPtr player = m_player)
+        player->addTextTrack(protect(addResult.first->second));
 }
 
 void MediaPlayerPrivateRemote::removeRemoteTextTrack(TrackID trackID)
@@ -777,8 +777,8 @@ void MediaPlayerPrivateRemote::removeRemoteTextTrack(TrackID trackID)
     ASSERT(m_textTracks.contains(trackID));
 
     if (auto it = m_textTracks.find(trackID); it != m_textTracks.end()) {
-        if (RefPtr player = m_player.get())
-            player->removeTextTrack(it->second);
+        if (RefPtr player = m_player)
+            player->removeTextTrack(protect(it->second));
         m_textTracks.erase(trackID);
     }
 }
@@ -924,8 +924,8 @@ void MediaPlayerPrivateRemote::addRemoteVideoTrack(VideoTrackPrivateRemoteConfig
     auto addResult = m_videoTracks.emplace(configuration.trackId, VideoTrackPrivateRemote::create(protect(manager()->gpuProcessConnection()), m_id, WTF::move(configuration)));
     ASSERT(addResult.second);
 
-    if (RefPtr player = m_player.get())
-        player->addVideoTrack(addResult.first->second);
+    if (RefPtr player = m_player)
+        player->addVideoTrack(protect(addResult.first->second));
 }
 
 void MediaPlayerPrivateRemote::removeRemoteVideoTrack(TrackID trackID)
@@ -936,8 +936,8 @@ void MediaPlayerPrivateRemote::removeRemoteVideoTrack(TrackID trackID)
     ASSERT(m_videoTracks.contains(trackID));
 
     if (auto it = m_videoTracks.find(trackID); it != m_videoTracks.end()) {
-        if (RefPtr player = m_player.get())
-            player->removeVideoTrack(it->second);
+        if (RefPtr player = m_player)
+            player->removeVideoTrack(protect(it->second));
         m_videoTracks.erase(trackID);
     }
 }
@@ -1254,7 +1254,7 @@ void MediaPlayerPrivateRemote::setWirelessVideoPlaybackDisabled(bool disabled)
 void MediaPlayerPrivateRemote::currentPlaybackTargetIsWirelessChanged(bool isCurrentPlaybackTargetWireless)
 {
     m_isCurrentPlaybackTargetWireless = isCurrentPlaybackTargetWireless;
-    if (RefPtr player = m_player.get())
+    if (RefPtr player = m_player)
         player->currentPlaybackTargetIsWirelessChanged(isCurrentPlaybackTargetWireless);
 }
 
@@ -1373,7 +1373,7 @@ void MediaPlayerPrivateRemote::keyAdded()
 
 void MediaPlayerPrivateRemote::mediaPlayerKeyNeeded(std::span<const uint8_t> message)
 {
-    if (RefPtr player = m_player.get())
+    if (RefPtr player = m_player)
         player->keyNeeded(SharedBuffer::create(message));
 }
 #endif
@@ -1400,14 +1400,14 @@ void MediaPlayerPrivateRemote::attemptToDecryptWithInstance(CDMInstance& instanc
 void MediaPlayerPrivateRemote::waitingForKeyChanged(bool waitingForKey)
 {
     m_waitingForKey = waitingForKey;
-    if (RefPtr player = m_player.get())
+    if (RefPtr player = m_player)
         player->waitingForKeyChanged();
 }
 
 void MediaPlayerPrivateRemote::initializationDataEncountered(const String& initDataType, std::span<const uint8_t> initData)
 {
     auto initDataBuffer = ArrayBuffer::create(initData);
-    if (RefPtr player = m_player.get())
+    if (RefPtr player = m_player)
         player->initializationDataEncountered(initDataType, WTF::move(initDataBuffer));
 }
 
@@ -1457,7 +1457,7 @@ size_t MediaPlayerPrivateRemote::extraMemoryCost() const
 
 void MediaPlayerPrivateRemote::reportGPUMemoryFootprint(uint64_t footPrint)
 {
-    if (RefPtr player = m_player.get())
+    if (RefPtr player = m_player)
         player->reportGPUMemoryFootprint(footPrint);
 }
 
@@ -1581,14 +1581,14 @@ void MediaPlayerPrivateRemote::setShouldDisableHDR(bool shouldDisable)
 
 void MediaPlayerPrivateRemote::resourceNotSupported()
 {
-    if (RefPtr player = m_player.get())
+    if (RefPtr player = m_player)
         player->resourceNotSupported();
 }
 
 #if PLATFORM(IOS_FAMILY)
 void MediaPlayerPrivateRemote::getRawCookies(const URL& url, WebCore::MediaPlayerClient::GetRawCookiesCallback&& completionHandler) const
 {
-    if (RefPtr player = m_player.get())
+    if (RefPtr player = m_player)
         player->getRawCookies(url, WTF::move(completionHandler));
 }
 #endif
@@ -1698,14 +1698,14 @@ void MediaPlayerPrivateRemote::setSpatialTrackingLabel(const String& spatialTrac
 #if HAVE(SPATIAL_AUDIO_EXPERIENCE)
 void MediaPlayerPrivateRemote::prefersSpatialAudioExperienceChanged()
 {
-    if (RefPtr player = m_player.get())
+    if (RefPtr player = m_player)
         protect(connection())->send(Messages::RemoteMediaPlayerProxy::SetPrefersSpatialAudioExperience(player->prefersSpatialAudioExperience()), m_id);
 }
 #endif
 
 void MediaPlayerPrivateRemote::soundStageSizeDidChange()
 {
-    if (RefPtr player = m_player.get())
+    if (RefPtr player = m_player)
         protect(connection())->send(Messages::RemoteMediaPlayerProxy::SetSoundStageSize(player->soundStageSize()), m_id);
 }
 
@@ -1744,7 +1744,7 @@ bool MediaPlayerPrivateRemote::supportsLinearMediaPlayer() const
 
 void MediaPlayerPrivateRemote::audioOutputDeviceChanged()
 {
-    if (RefPtr player = m_player.get())
+    if (RefPtr player = m_player)
         protect(connection())->send(Messages::RemoteMediaPlayerProxy::AudioOutputDeviceChanged { player->audioOutputDeviceId() }, m_id);
 }
 
@@ -1761,7 +1761,7 @@ Ref<RemoteMediaPlayerManager> MediaPlayerPrivateRemote::manager() const
 #if PLATFORM(IOS_FAMILY)
 void MediaPlayerPrivateRemote::sceneIdentifierDidChange()
 {
-    if (RefPtr player = m_player.get())
+    if (RefPtr player = m_player)
         protect(connection())->send(Messages::RemoteMediaPlayerProxy::SetSceneIdentifier(player->sceneIdentifier()), m_id);
 }
 #endif
diff --git a/Source/WebKit/WebProcess/GPU/media/RemoteCDM.cpp b/Source/WebKit/WebProcess/GPU/media/RemoteCDM.cpp
index 532493d02fa9..5124d86e11b5 100644
--- a/Source/WebKit/WebProcess/GPU/media/RemoteCDM.cpp
+++ b/Source/WebKit/WebProcess/GPU/media/RemoteCDM.cpp
@@ -62,7 +62,7 @@ RemoteCDM::RemoteCDM(WeakPtr<RemoteCDMFactory>&& factory, RemoteCDMIdentifier&&
 void RemoteCDM::setLogIdentifier(uint64_t logIdentifier)
 {
     if (RefPtr factory = m_factory.get())
-        factory->gpuProcessConnection().connection().send(Messages::RemoteCDMProxy::SetLogIdentifier(logIdentifier), m_identifier);
+        protect(factory->gpuProcessConnection().connection())->send(Messages::RemoteCDMProxy::SetLogIdentifier(logIdentifier), m_identifier);
 }
 #endif
 
@@ -74,7 +74,7 @@ void RemoteCDM::getSupportedConfiguration(CDMKeySystemConfiguration&& configurat
         return;
     }
 
-    factory->gpuProcessConnection().connection().sendWithAsyncReply(Messages::RemoteCDMProxy::GetSupportedConfiguration(WTF::move(configuration), access), WTF::move(callback), m_identifier);
+    protect(factory->gpuProcessConnection().connection())->sendWithAsyncReply(Messages::RemoteCDMProxy::GetSupportedConfiguration(WTF::move(configuration), access), WTF::move(callback), m_identifier);
 }
 
 bool RemoteCDM::supportsConfiguration(const CDMKeySystemConfiguration&) const
@@ -125,7 +125,7 @@ RefPtr<CDMInstance> RemoteCDM::createInstance()
     if (!factory)
         return nullptr;
 
-    auto sendResult = factory->gpuProcessConnection().connection().sendSync(Messages::RemoteCDMProxy::CreateInstance(), m_identifier);
+    auto sendResult = protect(factory->gpuProcessConnection().connection())->sendSync(Messages::RemoteCDMProxy::CreateInstance(), m_identifier);
     auto [identifier, configuration] = sendResult.takeReplyOr(std::nullopt, RemoteCDMInstanceConfiguration { });
     if (!identifier)
         return nullptr;
@@ -135,7 +135,7 @@ RefPtr<CDMInstance> RemoteCDM::createInstance()
 void RemoteCDM::loadAndInitialize()
 {
     if (RefPtr factory = m_factory.get())
-        factory->gpuProcessConnection().connection().send(Messages::RemoteCDMProxy::LoadAndInitialize(), m_identifier);
+        protect(factory->gpuProcessConnection().connection())->send(Messages::RemoteCDMProxy::LoadAndInitialize(), m_identifier);
 }
 
 RefPtr<SharedBuffer> RemoteCDM::sanitizeResponse(const SharedBuffer& response) const
diff --git a/Source/WebKit/WebProcess/GPU/media/RemoteCDMFactory.cpp b/Source/WebKit/WebProcess/GPU/media/RemoteCDMFactory.cpp
index 62641f9e8882..b0c8d5b94a3d 100644
--- a/Source/WebKit/WebProcess/GPU/media/RemoteCDMFactory.cpp
+++ b/Source/WebKit/WebProcess/GPU/media/RemoteCDMFactory.cpp
@@ -76,14 +76,14 @@ GPUProcessConnection& RemoteCDMFactory::gpuProcessConnection()
 
 bool RemoteCDMFactory::supportsKeySystem(const String& keySystem)
 {
-    auto sendResult = gpuProcessConnection().connection().sendSync(Messages::RemoteCDMFactoryProxy::SupportsKeySystem(keySystem), { });
+    auto sendResult = protect(gpuProcessConnection().connection())->sendSync(Messages::RemoteCDMFactoryProxy::SupportsKeySystem(keySystem), { });
     auto [supported] = sendResult.takeReplyOr(false);
     return supported;
 }
 
 std::unique_ptr<CDMPrivate> RemoteCDMFactory::createCDM(const String& keySystem, const String& mediaKeysHashSalt, const CDMPrivateClient&)
 {
-    auto sendResult = gpuProcessConnection().connection().sendSync(Messages::RemoteCDMFactoryProxy::CreateCDM(keySystem, mediaKeysHashSalt), { });
+    auto sendResult = protect(gpuProcessConnection().connection())->sendSync(Messages::RemoteCDMFactoryProxy::CreateCDM(keySystem, mediaKeysHashSalt), { });
     auto [identifier, configuration] = sendResult.takeReplyOr(std::nullopt, RemoteCDMConfiguration { });
     if (!identifier)
         return nullptr;
@@ -100,12 +100,12 @@ void RemoteCDMFactory::removeSession(RemoteCDMInstanceSessionIdentifier identifi
 {
     ASSERT(m_sessions.contains(identifier));
     m_sessions.remove(identifier);
-    gpuProcessConnection().connection().send(Messages::RemoteCDMFactoryProxy::RemoveSession(identifier), { });
+    protect(gpuProcessConnection().connection())->send(Messages::RemoteCDMFactoryProxy::RemoveSession(identifier), { });
 }
 
 void RemoteCDMFactory::removeInstance(RemoteCDMInstanceIdentifier identifier)
 {
-    gpuProcessConnection().connection().send(Messages::RemoteCDMFactoryProxy::RemoveInstance(identifier), { });
+    protect(gpuProcessConnection().connection())->send(Messages::RemoteCDMFactoryProxy::RemoveInstance(identifier), { });
 }
 
 void RemoteCDMFactory::didReceiveSessionMessage(IPC::Connection& connection, IPC::Decoder& decoder)
diff --git a/Source/WebKit/WebProcess/GPU/media/RemoteCDMInstance.cpp b/Source/WebKit/WebProcess/GPU/media/RemoteCDMInstance.cpp
index aa662b2dbba5..ff0afa3f8b8e 100644
--- a/Source/WebKit/WebProcess/GPU/media/RemoteCDMInstance.cpp
+++ b/Source/WebKit/WebProcess/GPU/media/RemoteCDMInstance.cpp
@@ -78,7 +78,7 @@ void RemoteCDMInstance::initializeWithConfiguration(const WebCore::CDMKeySystemC
         return;
     }
 
-    factory->gpuProcessConnection().connection().sendWithAsyncReply(Messages::RemoteCDMInstanceProxy::InitializeWithConfiguration(configuration, distinctiveIdentifiers, persistentState), WTF::move(callback), m_identifier);
+    protect(factory->gpuProcessConnection().connection())->sendWithAsyncReply(Messages::RemoteCDMInstanceProxy::InitializeWithConfiguration(configuration, distinctiveIdentifiers, persistentState), WTF::move(callback), m_identifier);
 }
 
 void RemoteCDMInstance::setServerCertificate(Ref<WebCore::SharedBuffer>&& certificate, SuccessCallback&& callback)
@@ -89,13 +89,13 @@ void RemoteCDMInstance::setServerCertificate(Ref<WebCore::SharedBuffer>&& certif
         return;
     }
 
-    factory->gpuProcessConnection().connection().sendWithAsyncReply(Messages::RemoteCDMInstanceProxy::SetServerCertificate(WTF::move(certificate)), WTF::move(callback), m_identifier);
+    protect(factory->gpuProcessConnection().connection())->sendWithAsyncReply(Messages::RemoteCDMInstanceProxy::SetServerCertificate(WTF::move(certificate)), WTF::move(callback), m_identifier);
 }
 
 void RemoteCDMInstance::setStorageDirectory(const String& directory)
 {
     if (RefPtr factory = m_factory.get())
-        factory->gpuProcessConnection().connection().send(Messages::RemoteCDMInstanceProxy::SetStorageDirectory(directory), m_identifier);
+        protect(factory->gpuProcessConnection().connection())->send(Messages::RemoteCDMInstanceProxy::SetStorageDirectory(directory), m_identifier);
 }
 
 RefPtr<WebCore::CDMInstanceSession> RemoteCDMInstance::createSession()
@@ -110,7 +110,7 @@ RefPtr<WebCore::CDMInstanceSession> RemoteCDMInstance::createSession()
         logIdentifier = reinterpret_cast<uint64_t>(client->logIdentifier());
 #endif
 
-    auto sendResult = factory->gpuProcessConnection().connection().sendSync(Messages::RemoteCDMInstanceProxy::CreateSession(logIdentifier), m_identifier);
+    auto sendResult = protect(factory->gpuProcessConnection().connection())->sendSync(Messages::RemoteCDMInstanceProxy::CreateSession(logIdentifier), m_identifier);
     auto [identifier] = sendResult.takeReplyOr(std::nullopt);
     if (!identifier)
         return nullptr;
diff --git a/Source/WebKit/WebProcess/GPU/media/RemoteCDMInstanceSession.cpp b/Source/WebKit/WebProcess/GPU/media/RemoteCDMInstanceSession.cpp
index 62368a794e35..0d5fbaf5b373 100644
--- a/Source/WebKit/WebProcess/GPU/media/RemoteCDMInstanceSession.cpp
+++ b/Source/WebKit/WebProcess/GPU/media/RemoteCDMInstanceSession.cpp
@@ -56,7 +56,7 @@ RemoteCDMInstanceSession::~RemoteCDMInstanceSession()
 #if !RELEASE_LOG_DISABLED
 void RemoteCDMInstanceSession::setLogIdentifier(uint64_t logIdentifier)
 {
-    protect(m_factory.get())->gpuProcessConnection().connection().send(Messages::RemoteCDMInstanceSessionProxy::SetLogIdentifier(reinterpret_cast<uint64_t>(logIdentifier)), m_identifier);
+    protect(protect(m_factory)->gpuProcessConnection().connection())->send(Messages::RemoteCDMInstanceSessionProxy::SetLogIdentifier(reinterpret_cast<uint64_t>(logIdentifier)), m_identifier);
 }
 #endif
 
@@ -68,7 +68,7 @@ void RemoteCDMInstanceSession::requestLicense(LicenseType type, KeyGroupingStrat
         return;
     }
 
-    factory->gpuProcessConnection().connection().sendWithAsyncReply(Messages::RemoteCDMInstanceSessionProxy::RequestLicense(type, keyGroupingStrategy, initDataType, WTF::move(initData)), [callback = WTF::move(callback)] (RefPtr<SharedBuffer>&& message, const String& sessionId, bool needsIndividualization, bool succeeded) mutable {
+    protect(factory->gpuProcessConnection().connection())->sendWithAsyncReply(Messages::RemoteCDMInstanceSessionProxy::RequestLicense(type, keyGroupingStrategy, initDataType, WTF::move(initData)), [callback = WTF::move(callback)] (RefPtr<SharedBuffer>&& message, const String& sessionId, bool needsIndividualization, bool succeeded) mutable {
         if (!message) {
             callback(SharedBuffer::create(), emptyString(), false, Failed);
             return;
@@ -85,7 +85,7 @@ void RemoteCDMInstanceSession::updateLicense(const String& sessionId, LicenseTyp
         return;
     }
 
-    factory->gpuProcessConnection().connection().sendWithAsyncReply(Messages::RemoteCDMInstanceSessionProxy::UpdateLicense(sessionId, type, WTF::move(response)), [callback = WTF::move(callback)] (bool sessionWasClosed, std::optional<KeyStatusVector>&& changedKeys, std::optional<double>&& changedExpiration, std::optional<Message>&& message, bool succeeded) mutable {
+    protect(factory->gpuProcessConnection().connection())->sendWithAsyncReply(Messages::RemoteCDMInstanceSessionProxy::UpdateLicense(sessionId, type, WTF::move(response)), [callback = WTF::move(callback)] (bool sessionWasClosed, std::optional<KeyStatusVector>&& changedKeys, std::optional<double>&& changedExpiration, std::optional<Message>&& message, bool succeeded) mutable {
         callback(sessionWasClosed, WTF::move(changedKeys), WTF::move(changedExpiration), WTF::move(message), succeeded ? Succeeded : Failed);
     }, m_identifier);
 }
@@ -98,7 +98,7 @@ void RemoteCDMInstanceSession::loadSession(LicenseType type, const String& sessi
         return;
     }
 
-    factory->gpuProcessConnection().connection().sendWithAsyncReply(Messages::RemoteCDMInstanceSessionProxy::LoadSession(type, sessionId, origin), [callback = WTF::move(callback)] (std::optional<KeyStatusVector>&& changedKeys, std::optional<double>&& changedExpiration, std::optional<Message>&& message, bool succeeded, SessionLoadFailure loadFailure) mutable {
+    protect(factory->gpuProcessConnection().connection())->sendWithAsyncReply(Messages::RemoteCDMInstanceSessionProxy::LoadSession(type, sessionId, origin), [callback = WTF::move(callback)] (std::optional<KeyStatusVector>&& changedKeys, std::optional<double>&& changedExpiration, std::optional<Message>&& message, bool succeeded, SessionLoadFailure loadFailure) mutable {
         callback(WTF::move(changedKeys), WTF::move(changedExpiration), WTF::move(message), succeeded ? Succeeded : Failed, loadFailure);
     }, m_identifier);
 }
@@ -111,7 +111,7 @@ void RemoteCDMInstanceSession::closeSession(const String& sessionId, CloseSessio
         return;
     }
 
-    factory->gpuProcessConnection().connection().sendWithAsyncReply(Messages::RemoteCDMInstanceSessionProxy::CloseSession(sessionId), [callback = WTF::move(callback)] () mutable {
+    protect(factory->gpuProcessConnection().connection())->sendWithAsyncReply(Messages::RemoteCDMInstanceSessionProxy::CloseSession(sessionId), [callback = WTF::move(callback)] () mutable {
         callback();
     }, m_identifier);
 }
@@ -124,7 +124,7 @@ void RemoteCDMInstanceSession::removeSessionData(const String& sessionId, Licens
         return;
     }
 
-    factory->gpuProcessConnection().connection().sendWithAsyncReply(Messages::RemoteCDMInstanceSessionProxy::RemoveSessionData(sessionId, type), [callback = WTF::move(callback)] (KeyStatusVector&& changedKeys, RefPtr<SharedBuffer>&& message, bool succeeded) mutable {
+    protect(factory->gpuProcessConnection().connection())->sendWithAsyncReply(Messages::RemoteCDMInstanceSessionProxy::RemoveSessionData(sessionId, type), [callback = WTF::move(callback)] (KeyStatusVector&& changedKeys, RefPtr<SharedBuffer>&& message, bool succeeded) mutable {
         callback(WTF::move(changedKeys), WTF::move(message), succeeded ? Succeeded : Failed);
     }, m_identifier);
 }
@@ -132,7 +132,7 @@ void RemoteCDMInstanceSession::removeSessionData(const String& sessionId, Licens
 void RemoteCDMInstanceSession::storeRecordOfKeyUsage(const String& sessionId)
 {
     if (RefPtr factory = m_factory.get())
-        factory->gpuProcessConnection().connection().send(Messages::RemoteCDMInstanceSessionProxy::StoreRecordOfKeyUsage(sessionId), m_identifier);
+        protect(factory->gpuProcessConnection().connection())->send(Messages::RemoteCDMInstanceSessionProxy::StoreRecordOfKeyUsage(sessionId), m_identifier);
 }
 
 void RemoteCDMInstanceSession::updateKeyStatuses(KeyStatusVector&& keyStatuses)
diff --git a/Source/WebKit/WebProcess/GPU/media/RemoteImageDecoderAVFManager.cpp b/Source/WebKit/WebProcess/GPU/media/RemoteImageDecoderAVFManager.cpp
index 219da21709a2..ceada727a9b9 100644
--- a/Source/WebKit/WebProcess/GPU/media/RemoteImageDecoderAVFManager.cpp
+++ b/Source/WebKit/WebProcess/GPU/media/RemoteImageDecoderAVFManager.cpp
@@ -50,7 +50,7 @@ std::optional<ImageDecoderIdentifier> RemoteImageDecoderAVFManager::createRemote
     if (!WebProcess::singleton().mediaPlaybackEnabled())
         return std::nullopt;
 
-    auto sendResult = ensureGPUProcessConnection().connection().sendSync(Messages::RemoteImageDecoderAVFProxy::CreateDecoder(IPC::SharedBufferReference(data), mimeType), 0);
+    auto sendResult = protect(ensureGPUProcessConnection().connection())->sendSync(Messages::RemoteImageDecoderAVFProxy::CreateDecoder(IPC::SharedBufferReference(data), mimeType), 0);
 
     auto [imageDecoderIdentifier] = sendResult.takeReplyOr(std::nullopt);
     return imageDecoderIdentifier;
diff --git a/Source/WebKit/WebProcess/GPU/media/RemoteLegacyCDM.cpp b/Source/WebKit/WebProcess/GPU/media/RemoteLegacyCDM.cpp
index 805e079c9972..6de8408582d3 100644
--- a/Source/WebKit/WebProcess/GPU/media/RemoteLegacyCDM.cpp
+++ b/Source/WebKit/WebProcess/GPU/media/RemoteLegacyCDM.cpp
@@ -50,7 +50,7 @@ RemoteLegacyCDM::~RemoteLegacyCDM() = default;
 
 bool RemoteLegacyCDM::supportsMIMEType(const String& mimeType) const
 {
-    auto sendResult = protect(m_factory)->gpuProcessConnection().connection().sendSync(Messages::RemoteLegacyCDMProxy::SupportsMIMEType(mimeType), m_identifier);
+    auto sendResult = protect(protect(m_factory)->gpuProcessConnection().connection())->sendSync(Messages::RemoteLegacyCDMProxy::SupportsMIMEType(mimeType), m_identifier);
     auto [supported] = sendResult.takeReplyOr(false);
     return supported;
 }
@@ -63,7 +63,7 @@ RefPtr<WebCore::LegacyCDMSession> RemoteLegacyCDM::createSession(WebCore::Legacy
 #endif
 
     Ref factory = m_factory.get();
-    auto sendResult = factory->gpuProcessConnection().connection().sendSync(Messages::RemoteLegacyCDMProxy::CreateSession(logIdentifier), m_identifier);
+    auto sendResult = protect(factory->gpuProcessConnection().connection())->sendSync(Messages::RemoteLegacyCDMProxy::CreateSession(logIdentifier), m_identifier);
     auto [identifier] = sendResult.takeReplyOr(std::nullopt);
     if (!identifier)
         return nullptr;
@@ -72,7 +72,7 @@ RefPtr<WebCore::LegacyCDMSession> RemoteLegacyCDM::createSession(WebCore::Legacy
 
 void RemoteLegacyCDM::setPlayerId(std::optional<MediaPlayerIdentifier> identifier)
 {
-    protect(m_factory)->gpuProcessConnection().connection().send(Messages::RemoteLegacyCDMProxy::SetPlayerId(identifier), m_identifier);
+    protect(protect(m_factory)->gpuProcessConnection().connection())->send(Messages::RemoteLegacyCDMProxy::SetPlayerId(identifier), m_identifier);
 }
 
 void RemoteLegacyCDM::ref() const
diff --git a/Source/WebKit/WebProcess/GPU/media/RemoteLegacyCDMFactory.cpp b/Source/WebKit/WebProcess/GPU/media/RemoteLegacyCDMFactory.cpp
index 0adb6000a78a..1b772b87323f 100644
--- a/Source/WebKit/WebProcess/GPU/media/RemoteLegacyCDMFactory.cpp
+++ b/Source/WebKit/WebProcess/GPU/media/RemoteLegacyCDMFactory.cpp
@@ -94,7 +94,7 @@ bool RemoteLegacyCDMFactory::supportsKeySystem(const String& keySystem)
     if (foundInCache != m_supportsKeySystemCache.end())
         return foundInCache->value;
 
-    auto sendResult = gpuProcessConnection().connection().sendSync(Messages::RemoteLegacyCDMFactoryProxy::SupportsKeySystem(keySystem, std::nullopt), { });
+    auto sendResult = protect(gpuProcessConnection().connection())->sendSync(Messages::RemoteLegacyCDMFactoryProxy::SupportsKeySystem(keySystem, std::nullopt), { });
     auto [supported] = sendResult.takeReplyOr(false);
     m_supportsKeySystemCache.set(keySystem, supported);
     return supported;
@@ -107,7 +107,7 @@ bool RemoteLegacyCDMFactory::supportsKeySystemAndMimeType(const String& keySyste
     if (foundInCache != m_supportsKeySystemAndMimeTypeCache.end())
         return foundInCache->value;
 
-    auto sendResult = gpuProcessConnection().connection().sendSync(Messages::RemoteLegacyCDMFactoryProxy::SupportsKeySystem(keySystem, mimeType), { });
+    auto sendResult = protect(gpuProcessConnection().connection())->sendSync(Messages::RemoteLegacyCDMFactoryProxy::SupportsKeySystem(keySystem, mimeType), { });
     auto [supported] = sendResult.takeReplyOr(false);
     m_supportsKeySystemAndMimeTypeCache.set(key, supported);
     return supported;
@@ -141,7 +141,7 @@ void RemoteLegacyCDMFactory::removeSession(RemoteLegacyCDMSessionIdentifier iden
 {
     ASSERT(m_sessions.contains(identifier));
     RefPtr session = m_sessions.get(identifier);
-    gpuProcessConnection().connection().sendWithAsyncReply(Messages::RemoteLegacyCDMFactoryProxy::RemoveSession(identifier), [protectedThis = Ref { *this }, identifier, session = WTF::move(session)] {
+    protect(gpuProcessConnection().connection())->sendWithAsyncReply(Messages::RemoteLegacyCDMFactoryProxy::RemoveSession(identifier), [protectedThis = Ref { *this }, identifier, session = WTF::move(session)] {
         ASSERT(protectedThis->m_sessions.contains(identifier));
         protectedThis->m_sessions.remove(identifier);
         protectedThis->gpuProcessConnection().messageReceiverMap().removeMessageReceiver(Messages::RemoteLegacyCDMSession::messageReceiverName(), identifier.toUInt64());
diff --git a/Source/WebKit/WebProcess/GPU/media/RemoteLegacyCDMSession.cpp b/Source/WebKit/WebProcess/GPU/media/RemoteLegacyCDMSession.cpp
index a0c85e5d41f7..bcdce889f5f1 100644
--- a/Source/WebKit/WebProcess/GPU/media/RemoteLegacyCDMSession.cpp
+++ b/Source/WebKit/WebProcess/GPU/media/RemoteLegacyCDMSession.cpp
@@ -107,7 +107,7 @@ RefPtr<Uint8Array> RemoteLegacyCDMSession::generateKeyRequest(const String& mime
         return nullptr;
 
     auto ipcInitData = convertToSharedBuffer(initData);
-    auto sendResult = factory->gpuProcessConnection().connection().sendSync(Messages::RemoteLegacyCDMSessionProxy::GenerateKeyRequest(mimeType, ipcInitData, client->mediaKeysHashSalt()), m_identifier);
+    auto sendResult = protect(factory->gpuProcessConnection().connection())->sendSync(Messages::RemoteLegacyCDMSessionProxy::GenerateKeyRequest(mimeType, ipcInitData, client->mediaKeysHashSalt()), m_identifier);
 
     RefPtr<SharedBuffer> ipcNextMessage;
     if (sendResult.succeeded())
@@ -125,7 +125,7 @@ void RemoteLegacyCDMSession::releaseKeys()
     if (!factory)
         return;
 
-    factory->gpuProcessConnection().connection().send(Messages::RemoteLegacyCDMSessionProxy::ReleaseKeys(), m_identifier);
+    protect(factory->gpuProcessConnection().connection())->send(Messages::RemoteLegacyCDMSessionProxy::ReleaseKeys(), m_identifier);
     m_cachedKeyCache.clear();
 }
 
@@ -139,7 +139,7 @@ bool RemoteLegacyCDMSession::update(Uint8Array* keyData, RefPtr<Uint8Array>& nex
         return false;
 
     auto ipcKeyData = convertToSharedBuffer(keyData);
-    auto sendResult = factory->gpuProcessConnection().connection().sendSync(Messages::RemoteLegacyCDMSessionProxy::Update(ipcKeyData), m_identifier);
+    auto sendResult = protect(factory->gpuProcessConnection().connection())->sendSync(Messages::RemoteLegacyCDMSessionProxy::Update(ipcKeyData), m_identifier);
 
     bool succeeded { false };
     RefPtr<SharedBuffer> ipcNextMessage;
@@ -162,7 +162,7 @@ RefPtr<ArrayBuffer> RemoteLegacyCDMSession::cachedKeyForKeyID(const String& keyI
     if (foundInCache != m_cachedKeyCache.end())
         return foundInCache->value;
 
-    auto sendResult = factory->gpuProcessConnection().connection().sendSync(Messages::RemoteLegacyCDMSessionProxy::CachedKeyForKeyID(keyId), m_identifier);
+    auto sendResult = protect(factory->gpuProcessConnection().connection())->sendSync(Messages::RemoteLegacyCDMSessionProxy::CachedKeyForKeyID(keyId), m_identifier);
     auto [ipcKey] = sendResult.takeReplyOr(nullptr);
 
     if (!ipcKey)
diff --git a/Source/WebKit/WebProcess/GPU/media/RemoteMediaEngineConfigurationFactory.cpp b/Source/WebKit/WebProcess/GPU/media/RemoteMediaEngineConfigurationFactory.cpp
index 02baa6b306b9..995b73757491 100644
--- a/Source/WebKit/WebProcess/GPU/media/RemoteMediaEngineConfigurationFactory.cpp
+++ b/Source/WebKit/WebProcess/GPU/media/RemoteMediaEngineConfigurationFactory.cpp
@@ -55,24 +55,26 @@ void RemoteMediaEngineConfigurationFactory::registerFactory()
     PlatformMediaEngineConfigurationFactory::clearFactories();
 
     auto createDecodingConfiguration = [weakThis = WeakPtr { *this }](PlatformMediaDecodingConfiguration&& configuration, PlatformMediaEngineConfigurationFactory::DecodingConfigurationCallback&& callback) {
-        if (!weakThis) {
+        RefPtr protectedThis = weakThis;
+        if (!protectedThis) {
             callback({{ }, WTF::move(configuration)});
             return;
         }
 
-        weakThis->createDecodingConfiguration(WTF::move(configuration), WTF::move(callback));
+        protectedThis->createDecodingConfiguration(WTF::move(configuration), WTF::move(callback));
     };
 
 #if PLATFORM(COCOA)
     PlatformMediaEngineConfigurationFactory::CreateEncodingConfiguration createEncodingConfiguration = nullptr;
 #else
     auto createEncodingConfiguration = [weakThis = WeakPtr { *this }](PlatformMediaEncodingConfiguration&& configuration, PlatformMediaEngineConfigurationFactory::EncodingConfigurationCallback&& callback) {
-        if (!weakThis) {
+        RefPtr protectedThis = weakThis;
+        if (!protectedThis) {
             callback({{ }, WTF::move(configuration)});
             return;
         }
 
-        weakThis->createEncodingConfiguration(WTF::move(configuration), WTF::move(callback));
+        protectedThis->createEncodingConfiguration(WTF::move(configuration), WTF::move(callback));
     };
 #endif
 
@@ -94,7 +96,7 @@ void RemoteMediaEngineConfigurationFactory::createDecodingConfiguration(Platform
     if (!m_webProcess->mediaPlaybackEnabled())
         return callback({ });
 
-    gpuProcessConnection().connection().sendWithAsyncReply(Messages::RemoteMediaEngineConfigurationFactoryProxy::CreateDecodingConfiguration(WTF::move(configuration)), [callback = WTF::move(callback)](PlatformMediaCapabilitiesDecodingInfo&& info) mutable {
+    protect(gpuProcessConnection().connection())->sendWithAsyncReply(Messages::RemoteMediaEngineConfigurationFactoryProxy::CreateDecodingConfiguration(WTF::move(configuration)), [callback = WTF::move(callback)](PlatformMediaCapabilitiesDecodingInfo&& info) mutable {
         callback(WTF::move(info));
     });
 }
@@ -104,7 +106,7 @@ void RemoteMediaEngineConfigurationFactory::createEncodingConfiguration(Platform
     if (!m_webProcess->mediaPlaybackEnabled())
         return callback({ });
 
-    gpuProcessConnection().connection().sendWithAsyncReply(Messages::RemoteMediaEngineConfigurationFactoryProxy::CreateEncodingConfiguration(WTF::move(configuration)), [callback = WTF::move(callback)](PlatformMediaCapabilitiesEncodingInfo&& info) mutable {
+    protect(gpuProcessConnection().connection())->sendWithAsyncReply(Messages::RemoteMediaEngineConfigurationFactoryProxy::CreateEncodingConfiguration(WTF::move(configuration)), [callback = WTF::move(callback)](PlatformMediaCapabilitiesEncodingInfo&& info) mutable {
         callback(WTF::move(info));
     });
 }
diff --git a/Source/WebKit/WebProcess/GPU/media/RemoteMediaPlayerMIMETypeCache.cpp b/Source/WebKit/WebProcess/GPU/media/RemoteMediaPlayerMIMETypeCache.cpp
index ef7a4367ee31..adfb3acbd431 100644
--- a/Source/WebKit/WebProcess/GPU/media/RemoteMediaPlayerMIMETypeCache.cpp
+++ b/Source/WebKit/WebProcess/GPU/media/RemoteMediaPlayerMIMETypeCache.cpp
@@ -59,7 +59,7 @@ HashSet<String>& RemoteMediaPlayerMIMETypeCache::supportedTypes()
 {
     ASSERT(isMainRunLoop());
     if (!m_hasPopulatedSupportedTypesCacheFromGPUProcess) {
-        auto sendResult = manager()->gpuProcessConnection().connection().sendSync(Messages::RemoteMediaPlayerManagerProxy::GetSupportedTypes(m_engineIdentifier), 0);
+        auto sendResult = protect(manager()->gpuProcessConnection().connection())->sendSync(Messages::RemoteMediaPlayerManagerProxy::GetSupportedTypes(m_engineIdentifier), 0);
         if (sendResult.succeeded()) {
             auto& [types] = sendResult.reply();
             addSupportedTypes(types);
@@ -92,7 +92,7 @@ MediaPlayerEnums::SupportsType RemoteMediaPlayerMIMETypeCache::supportsTypeAndCo
     if (!m_supportsTypeAndCodecsCache)
         m_supportsTypeAndCodecsCache = HashMap<SupportedTypesAndCodecsKey, MediaPlayerEnums::SupportsType> { };
 
-    auto sendResult = manager()->gpuProcessConnection().connection().sendSync(Messages::RemoteMediaPlayerManagerProxy::SupportsTypeAndCodecs(m_engineIdentifier, parameters), 0);
+    auto sendResult = protect(manager()->gpuProcessConnection().connection())->sendSync(Messages::RemoteMediaPlayerManagerProxy::SupportsTypeAndCodecs(m_engineIdentifier, parameters), 0);
     auto [result] = sendResult.takeReplyOr(MediaPlayerEnums::SupportsType::IsNotSupported);
     if (sendResult.succeeded())
         m_supportsTypeAndCodecsCache->add(searchKey, result);
diff --git a/Source/WebKit/WebProcess/GPU/media/RemoteMediaPlayerManager.cpp b/Source/WebKit/WebProcess/GPU/media/RemoteMediaPlayerManager.cpp
index f85c691d7877..5e98da496240 100644
--- a/Source/WebKit/WebProcess/GPU/media/RemoteMediaPlayerManager.cpp
+++ b/Source/WebKit/WebProcess/GPU/media/RemoteMediaPlayerManager.cpp
@@ -198,7 +198,7 @@ Ref<MediaPlayerPrivateInterface> RemoteMediaPlayerManager::createRemoteMediaPlay
 
     auto identifier = MediaPlayerIdentifier::generate();
     auto clientIdentifier = player.clientIdentifier();
-    gpuProcessConnection().connection().send(Messages::RemoteMediaPlayerManagerProxy::CreateMediaPlayer(identifier, clientIdentifier, remoteEngineIdentifier, proxyConfiguration), 0);
+    protect(gpuProcessConnection().connection())->send(Messages::RemoteMediaPlayerManagerProxy::CreateMediaPlayer(identifier, clientIdentifier, remoteEngineIdentifier, proxyConfiguration), 0);
 
     auto remotePlayer = MediaPlayerPrivateRemote::create(player, remoteEngineIdentifier, identifier, *this);
     m_players.add(identifier, remotePlayer.get());
@@ -209,7 +209,7 @@ Ref<MediaPlayerPrivateInterface> RemoteMediaPlayerManager::createRemoteMediaPlay
 void RemoteMediaPlayerManager::deleteRemoteMediaPlayer(MediaPlayerIdentifier identifier)
 {
     m_players.remove(identifier);
-    gpuProcessConnection().connection().send(Messages::RemoteMediaPlayerManagerProxy::DeleteMediaPlayer(identifier), 0);
+    protect(gpuProcessConnection().connection())->send(Messages::RemoteMediaPlayerManagerProxy::DeleteMediaPlayer(identifier), 0);
 }
 
 std::optional<MediaPlayerIdentifier> RemoteMediaPlayerManager::findRemotePlayerId(const MediaPlayerPrivateInterface* player)
diff --git a/Source/WebKit/WebProcess/GPU/media/RemoteRemoteCommandListener.cpp b/Source/WebKit/WebProcess/GPU/media/RemoteRemoteCommandListener.cpp
index 03d5909f7057..355736922c7c 100644
--- a/Source/WebKit/WebProcess/GPU/media/RemoteRemoteCommandListener.cpp
+++ b/Source/WebKit/WebProcess/GPU/media/RemoteRemoteCommandListener.cpp
@@ -95,7 +95,7 @@ void RemoteRemoteCommandListener::updateSupportedCommands()
     m_currentCommands = supportedCommands;
     m_currentSupportSeeking = supportsSeeking();
 
-    ensureGPUProcessConnection().connection().send(Messages::RemoteRemoteCommandListenerProxy::UpdateSupportedCommands { copyToVector(supportedCommands), m_currentSupportSeeking }, identifier());
+    protect(ensureGPUProcessConnection().connection())->send(Messages::RemoteRemoteCommandListenerProxy::UpdateSupportedCommands { copyToVector(supportedCommands), m_currentSupportSeeking }, identifier());
 }
 
 }
diff --git a/Source/WebKit/WebProcess/GPU/media/RemoteVideoCodecFactory.cpp b/Source/WebKit/WebProcess/GPU/media/RemoteVideoCodecFactory.cpp
index 24ca1a6f680e..e412e6b875c1 100644
--- a/Source/WebKit/WebProcess/GPU/media/RemoteVideoCodecFactory.cpp
+++ b/Source/WebKit/WebProcess/GPU/media/RemoteVideoCodecFactory.cpp
@@ -278,7 +278,7 @@ RemoteVideoEncoder::~RemoteVideoEncoder()
 Ref<RemoteVideoEncoder::EncodePromise> RemoteVideoEncoder::encode(RawFrame&& rawFrame, bool shouldGenerateKeyFrame)
 {
     Ref codecs = WebProcess::singleton().libWebRTCCodecs();
-    return codecs->encodeFrame(m_internalEncoder, rawFrame.frame.get(), rawFrame.timestamp, rawFrame.duration, shouldGenerateKeyFrame);
+    return codecs->encodeFrame(m_internalEncoder, protect(rawFrame.frame), rawFrame.timestamp, rawFrame.duration, shouldGenerateKeyFrame);
 }
 
 Ref<GenericPromise> RemoteVideoEncoder::setRates(uint64_t bitRate, double frameRate)
diff --git a/Source/WebKit/WebProcess/GPU/webrtc/AudioMediaStreamTrackRendererInternalUnitManager.cpp b/Source/WebKit/WebProcess/GPU/webrtc/AudioMediaStreamTrackRendererInternalUnitManager.cpp
index c79d15791a80..53b043d29171 100644
--- a/Source/WebKit/WebProcess/GPU/webrtc/AudioMediaStreamTrackRendererInternalUnitManager.cpp
+++ b/Source/WebKit/WebProcess/GPU/webrtc/AudioMediaStreamTrackRendererInternalUnitManager.cpp
@@ -151,7 +151,7 @@ AudioMediaStreamTrackRendererInternalUnitManagerProxy::AudioMediaStreamTrackRend
 AudioMediaStreamTrackRendererInternalUnitManagerProxy::~AudioMediaStreamTrackRendererInternalUnitManagerProxy()
 {
     WebProcess::singleton().audioMediaStreamTrackRendererInternalUnitManager().remove(*this);
-    WebProcess::singleton().ensureGPUProcessConnection().connection().send(Messages::RemoteAudioMediaStreamTrackRendererInternalUnitManager::DeleteUnit { identifier() }, 0);
+    protect(WebProcess::singleton().ensureGPUProcessConnection().connection())->send(Messages::RemoteAudioMediaStreamTrackRendererInternalUnitManager::DeleteUnit { identifier() }, 0);
 
     while (!m_descriptionCallbacks.isEmpty())
         m_descriptionCallbacks.takeFirst()(std::nullopt);
@@ -159,7 +159,7 @@ AudioMediaStreamTrackRendererInternalUnitManagerProxy::~AudioMediaStreamTrackRen
 
 void AudioMediaStreamTrackRendererInternalUnitManagerProxy::createRemoteUnit()
 {
-    WebProcess::singleton().ensureGPUProcessConnection().connection().sendWithAsyncReply(Messages::RemoteAudioMediaStreamTrackRendererInternalUnitManager::CreateUnit { identifier(), m_deviceID }, [weakThis = ThreadSafeWeakPtr { *this }](auto&& description, auto frameChunkSize) {
+    protect(WebProcess::singleton().ensureGPUProcessConnection().connection())->sendWithAsyncReply(Messages::RemoteAudioMediaStreamTrackRendererInternalUnitManager::CreateUnit { identifier(), m_deviceID }, [weakThis = ThreadSafeWeakPtr { *this }](auto&& description, auto frameChunkSize) {
         if (RefPtr protectedThis = weakThis.get(); protectedThis && description && frameChunkSize)
             protectedThis->initialize(*description, frameChunkSize);
     }, 0);
@@ -204,7 +204,7 @@ void AudioMediaStreamTrackRendererInternalUnitManagerProxy::start()
     RELEASE_ASSERT(result); // FIXME(https://bugs.webkit.org/show_bug.cgi?id=262690): Handle allocation failure.
     auto [ringBuffer, handle] = WTF::move(*result);
     m_ringBuffer = WTF::move(ringBuffer);
-    WebProcess::singleton().ensureGPUProcessConnection().connection().send(Messages::RemoteAudioMediaStreamTrackRendererInternalUnitManager::StartUnit { identifier(), WTF::move(handle), *m_semaphore }, 0);
+    protect(WebProcess::singleton().ensureGPUProcessConnection().connection())->send(Messages::RemoteAudioMediaStreamTrackRendererInternalUnitManager::StartUnit { identifier(), WTF::move(handle), *m_semaphore }, 0);
 
     m_buffer = makeUnique<WebCore::WebAudioBufferList>(*m_description, m_numberOfFrames);
     m_buffer->setSampleCount(m_frameChunkSize);
@@ -215,7 +215,7 @@ void AudioMediaStreamTrackRendererInternalUnitManagerProxy::start()
 void AudioMediaStreamTrackRendererInternalUnitManagerProxy::stop()
 {
     m_isPlaying = false;
-    WebProcess::singleton().ensureGPUProcessConnection().connection().send(Messages::RemoteAudioMediaStreamTrackRendererInternalUnitManager::StopUnit { identifier() }, 0);
+    protect(WebProcess::singleton().ensureGPUProcessConnection().connection())->send(Messages::RemoteAudioMediaStreamTrackRendererInternalUnitManager::StopUnit { identifier() }, 0);
 }
 
 void AudioMediaStreamTrackRendererInternalUnitManagerProxy::retrieveFormatDescription(CompletionHandler<void(std::optional<WebCore::CAAudioStreamDescription>)>&& callback)
@@ -229,12 +229,12 @@ void AudioMediaStreamTrackRendererInternalUnitManagerProxy::retrieveFormatDescri
 
 void AudioMediaStreamTrackRendererInternalUnitManagerProxy::setLastDeviceUsed(const String& deviceID)
 {
-    WebProcess::singleton().ensureGPUProcessConnection().connection().send(Messages::RemoteAudioMediaStreamTrackRendererInternalUnitManager::SetLastDeviceUsed { deviceID }, 0);
+    protect(WebProcess::singleton().ensureGPUProcessConnection().connection())->send(Messages::RemoteAudioMediaStreamTrackRendererInternalUnitManager::SetLastDeviceUsed { deviceID }, 0);
 }
 
 void AudioMediaStreamTrackRendererInternalUnitManagerProxy::deleteUnitForTesting()
 {
-    WebProcess::singleton().ensureGPUProcessConnection().connection().send(Messages::RemoteAudioMediaStreamTrackRendererInternalUnitManager::DeleteUnit { identifier() }, 0);
+    protect(WebProcess::singleton().ensureGPUProcessConnection().connection())->send(Messages::RemoteAudioMediaStreamTrackRendererInternalUnitManager::DeleteUnit { identifier() }, 0);
 }
 
 void AudioMediaStreamTrackRendererInternalUnitManagerProxy::stopThread()
diff --git a/Source/WebKit/WebProcess/GPU/webrtc/LibWebRTCCodecs.cpp b/Source/WebKit/WebProcess/GPU/webrtc/LibWebRTCCodecs.cpp
index 23fc9e0e32d0..6b82b3056a17 100644
--- a/Source/WebKit/WebProcess/GPU/webrtc/LibWebRTCCodecs.cpp
+++ b/Source/WebKit/WebProcess/GPU/webrtc/LibWebRTCCodecs.cpp
@@ -201,7 +201,7 @@ static inline VideoFrame::Rotation NODELETE toVideoRotation(webrtc::VideoRotatio
 
 static void createRemoteDecoder(LibWebRTCCodecs::Decoder& decoder, IPC::Connection& connection, bool useRemoteFrames, bool enableAdditionalLogging, std::optional<WebCore::PlatformVideoColorSpace> colorSpaceOverride, Function<void(bool)>&& callback)
 {
-    connection.sendWithAsyncReplyOnDispatcher(Messages::LibWebRTCCodecsProxy::CreateDecoder { decoder.identifier, decoder.type, decoder.codec, useRemoteFrames, enableAdditionalLogging, WTF::move(colorSpaceOverride) }, WebProcess::singleton().libWebRTCCodecs().workQueue(), WTF::move(callback), 0);
+    connection.sendWithAsyncReplyOnDispatcher(Messages::LibWebRTCCodecsProxy::CreateDecoder { decoder.identifier, decoder.type, decoder.codec, useRemoteFrames, enableAdditionalLogging, WTF::move(colorSpaceOverride) }, protect(WebProcess::singleton().libWebRTCCodecs().workQueue()), WTF::move(callback), 0);
 }
 
 static int32_t encodeVideoFrame(webrtc::WebKitVideoEncoder encoder, const webrtc::VideoFrame& frame, bool shouldEncodeAsKeyFrame)
@@ -613,7 +613,7 @@ LibWebRTCCodecs::Encoder::PendingFrame::~PendingFrame() = default;
 
 static void createRemoteEncoder(LibWebRTCCodecs::Encoder& encoder, IPC::Connection& connection, const Vector<std::pair<String, String>>& parameters, Function<void(bool)>&& callback)
 {
-    connection.sendWithAsyncReplyOnDispatcher(Messages::LibWebRTCCodecsProxy::CreateEncoder { encoder.identifier, encoder.type, encoder.codec, parameters, encoder.isRealtime, encoder.useAnnexB, encoder.scalabilityMode }, WebProcess::singleton().libWebRTCCodecs().workQueue(), WTF::move(callback), 0);
+    connection.sendWithAsyncReplyOnDispatcher(Messages::LibWebRTCCodecsProxy::CreateEncoder { encoder.identifier, encoder.type, encoder.codec, parameters, encoder.isRealtime, encoder.useAnnexB, encoder.scalabilityMode }, protect(WebProcess::singleton().libWebRTCCodecs().workQueue()), WTF::move(callback), 0);
 }
 
 LibWebRTCCodecs::Encoder* LibWebRTCCodecs::createEncoderInternal(WebCore::VideoCodecType type, const String& codec, const std::map<std::string, std::string>& formatParameters, bool isRealtime, bool useAnnexB, VideoEncoderScalabilityMode scalabilityMode, Function<void(Encoder*)>&& callback)
diff --git a/Source/WebKit/WebProcess/InjectedBundle/API/c/WKBundlePageOverlay.cpp b/Source/WebKit/WebProcess/InjectedBundle/API/c/WKBundlePageOverlay.cpp
index 73b17f6b1f93..ad7ff3dd8768 100644
--- a/Source/WebKit/WebProcess/InjectedBundle/API/c/WKBundlePageOverlay.cpp
+++ b/Source/WebKit/WebProcess/InjectedBundle/API/c/WKBundlePageOverlay.cpp
@@ -151,7 +151,7 @@ class PageOverlayClientImpl : API::Client<WKBundlePageOverlayClientBase>, public
         if (!actionContext || !apiRange)
             return std::nullopt;
 
-        return { { actionContext, makeSimpleRange(WebKit::toImpl(apiRange)->coreRange()) } };
+        return { { actionContext, makeSimpleRange(protect(WebKit::toImpl(apiRange)->coreRange())) } };
     }
 
     void dataDetectorsDidPresentUI(WebKit::WebPageOverlay& pageOverlay) override
diff --git a/Source/WebKit/WebProcess/InjectedBundle/InjectedBundle.cpp b/Source/WebKit/WebProcess/InjectedBundle/InjectedBundle.cpp
index 27e9983caf81..8a65a034e6a7 100644
--- a/Source/WebKit/WebProcess/InjectedBundle/InjectedBundle.cpp
+++ b/Source/WebKit/WebProcess/InjectedBundle/InjectedBundle.cpp
@@ -139,19 +139,19 @@ void InjectedBundle::postSynchronousMessage(const String& messageName, API::Obje
 void InjectedBundle::addOriginAccessAllowListEntry(const String& sourceOrigin, const String& destinationProtocol, const String& destinationHost, bool allowDestinationSubdomains)
 {
     SecurityPolicy::addOriginAccessAllowlistEntry(SecurityOrigin::createFromString(sourceOrigin).get(), destinationProtocol, destinationHost, allowDestinationSubdomains);
-    WebProcess::singleton().ensureNetworkProcessConnection().connection().send(Messages::NetworkConnectionToWebProcess::AddOriginAccessAllowListEntry { sourceOrigin, destinationProtocol, destinationHost, allowDestinationSubdomains }, 0);
+    protect(WebProcess::singleton().ensureNetworkProcessConnection().connection())->send(Messages::NetworkConnectionToWebProcess::AddOriginAccessAllowListEntry { sourceOrigin, destinationProtocol, destinationHost, allowDestinationSubdomains }, 0);
 }
 
 void InjectedBundle::removeOriginAccessAllowListEntry(const String& sourceOrigin, const String& destinationProtocol, const String& destinationHost, bool allowDestinationSubdomains)
 {
     SecurityPolicy::removeOriginAccessAllowlistEntry(SecurityOrigin::createFromString(sourceOrigin).get(), destinationProtocol, destinationHost, allowDestinationSubdomains);
-    WebProcess::singleton().ensureNetworkProcessConnection().connection().send(Messages::NetworkConnectionToWebProcess::RemoveOriginAccessAllowListEntry { sourceOrigin, destinationProtocol, destinationHost, allowDestinationSubdomains }, 0);
+    protect(WebProcess::singleton().ensureNetworkProcessConnection().connection())->send(Messages::NetworkConnectionToWebProcess::RemoveOriginAccessAllowListEntry { sourceOrigin, destinationProtocol, destinationHost, allowDestinationSubdomains }, 0);
 }
 
 void InjectedBundle::resetOriginAccessAllowLists()
 {
     SecurityPolicy::resetOriginAccessAllowlists();
-    WebProcess::singleton().ensureNetworkProcessConnection().connection().send(Messages::NetworkConnectionToWebProcess::ResetOriginAccessAllowLists { }, 0);
+    protect(WebProcess::singleton().ensureNetworkProcessConnection().connection())->send(Messages::NetworkConnectionToWebProcess::ResetOriginAccessAllowLists { }, 0);
 }
 
 void InjectedBundle::setAsynchronousSpellCheckingEnabled(bool enabled)
diff --git a/Source/WebKit/WebProcess/InjectedBundle/InjectedBundlePageLoaderClient.cpp b/Source/WebKit/WebProcess/InjectedBundle/InjectedBundlePageLoaderClient.cpp
index fe48e87b6627..eb74bdfdd51f 100644
--- a/Source/WebKit/WebProcess/InjectedBundle/InjectedBundlePageLoaderClient.cpp
+++ b/Source/WebKit/WebProcess/InjectedBundle/InjectedBundlePageLoaderClient.cpp
@@ -74,7 +74,7 @@ void InjectedBundlePageLoaderClient::willLoadDataRequest(WebPage& page, const Re
         data = API::Data::createWithoutCopying(contiguousBufferSpan, [contiguousBuffer = WTF::move(contiguousBuffer)] { });
     }
 
-    m_client.willLoadDataRequest(toAPI(&page), toAPI(request), toAPI(data.get()), toAPI(MIMEType.impl()), toAPI(encodingName.impl()), toURLRef(unreachableURL.string().impl()), toAPI(userData), m_client.base.clientInfo);
+    m_client.willLoadDataRequest(toAPI(&page), toAPI(request), toAPI(data.get()), toAPI(MIMEType.impl()), toAPI(encodingName.impl()), toURLRef(unreachableURL.string()), toAPI(userData), m_client.base.clientInfo);
 }
 
 void InjectedBundlePageLoaderClient::didStartProvisionalLoadForFrame(WebPage& page, WebFrame& frame, RefPtr<API::Object>& userData)
@@ -244,7 +244,7 @@ void InjectedBundlePageLoaderClient::willPerformClientRedirectForFrame(WebPage&
     if (!m_client.willPerformClientRedirectForFrame)
         return;
 
-    m_client.willPerformClientRedirectForFrame(toAPI(&page), toAPI(&frame), toURLRef(url.impl()), delay, date.secondsSinceEpoch().seconds(), m_client.base.clientInfo);
+    m_client.willPerformClientRedirectForFrame(toAPI(&page), toAPI(&frame), toURLRef(url), delay, date.secondsSinceEpoch().seconds(), m_client.base.clientInfo);
 }
 
 void InjectedBundlePageLoaderClient::didHandleOnloadEventsForFrame(WebPage& page, WebFrame& frame)
diff --git a/Source/WebKit/WebProcess/InjectedBundle/mac/InjectedBundleMac.mm b/Source/WebKit/WebProcess/InjectedBundle/mac/InjectedBundleMac.mm
index 690dbd517e07..14177cb20507 100644
--- a/Source/WebKit/WebProcess/InjectedBundle/mac/InjectedBundleMac.mm
+++ b/Source/WebKit/WebProcess/InjectedBundle/mac/InjectedBundleMac.mm
@@ -167,7 +167,7 @@ static NSEventModifierFlags currentModifierFlags(id self, SEL _cmd)
 
     // First check to see if the bundle has a WKBundleInitialize function.
     if (initializeFunction) {
-        if (!decodeBundleParameters(parameters.bundleParameterData.get()))
+        if (!decodeBundleParameters(protect(parameters.bundleParameterData)))
             return false;
         initializeFunction(toAPI(this), toAPI(initializationUserData.get()));
         return true;
@@ -197,7 +197,7 @@ static NSEventModifierFlags currentModifierFlags(id self, SEL _cmd)
     if ([instance respondsToSelector:@selector(additionalClassesForParameterCoder)])
         [plugInController extendClassesForParameterCoder:[instance additionalClassesForParameterCoder]];
 
-    if (!decodeBundleParameters(parameters.bundleParameterData.get())) {
+    if (!decodeBundleParameters(protect(parameters.bundleParameterData))) {
         RELEASE_LOG_ERROR(Process, "InjectedBundle::initialize failed - decodeBundleParameters returned false; %{public}s will not receive webProcessPlugIn:didCreateBrowserContextController: callbacks", class_getName(principalClass.get()));
         return false;
     }
diff --git a/Source/WebKit/WebProcess/Inspector/WebInspectorUIExtensionController.cpp b/Source/WebKit/WebProcess/Inspector/WebInspectorUIExtensionController.cpp
index dafa5b52cc8e..32f412030a40 100644
--- a/Source/WebKit/WebProcess/Inspector/WebInspectorUIExtensionController.cpp
+++ b/Source/WebKit/WebProcess/Inspector/WebInspectorUIExtensionController.cpp
@@ -30,6 +30,7 @@
 
 #include "JavaScriptEvaluationResult.h"
 #include "Logging.h"
+#include "RunJavaScriptResult.h"
 #include "WebInspectorUI.h"
 #include "WebInspectorUIExtensionControllerMessages.h"
 #include "WebInspectorUIExtensionControllerProxyMessages.h"
@@ -217,7 +218,7 @@ void WebInspectorUIExtensionController::createTabForExtension(const Inspector::E
     });
 }
 
-void WebInspectorUIExtensionController::evaluateScriptForExtension(const Inspector::ExtensionID& extensionID, const String& scriptSource, const std::optional<URL>& frameURL, const std::optional<URL>& contextSecurityOrigin, const std::optional<bool>& useContentScriptContext, CompletionHandler<void(Expected<WebKit::JavaScriptEvaluationResult, std::optional<WebCore::ExceptionDetails>>&&, const std::optional<Inspector::ExtensionError>&)>&& completionHandler)
+void WebInspectorUIExtensionController::evaluateScriptForExtension(const Inspector::ExtensionID& extensionID, const String& scriptSource, const std::optional<URL>& frameURL, const std::optional<URL>& contextSecurityOrigin, const std::optional<bool>& useContentScriptContext, CompletionHandler<void(RunJavaScriptResult&&, const std::optional<Inspector::ExtensionError>&)>&& completionHandler)
 {
     if (!m_frontendClient) {
         completionHandler(makeUnexpected(std::nullopt), Inspector::ExtensionError::InvalidRequest);
@@ -410,7 +411,7 @@ void WebInspectorUIExtensionController::navigateTabForExtension(const Inspector:
 
 // WebInspectorUIExtensionController IPC messages for testing.
 
-void WebInspectorUIExtensionController::evaluateScriptInExtensionTab(const Inspector::ExtensionTabID& extensionTabID, const String& scriptSource, CompletionHandler<void(Expected<JavaScriptEvaluationResult, std::optional<WebCore::ExceptionDetails>>&&, const std::optional<Inspector::ExtensionError>&)>&& completionHandler)
+void WebInspectorUIExtensionController::evaluateScriptInExtensionTab(const Inspector::ExtensionTabID& extensionTabID, const String& scriptSource, CompletionHandler<void(RunJavaScriptResult&&, const std::optional<Inspector::ExtensionError>&)>&& completionHandler)
 {
     if (!m_frontendClient) {
         completionHandler(makeUnexpected(std::nullopt), Inspector::ExtensionError::InvalidRequest);
diff --git a/Source/WebKit/WebProcess/Inspector/WebInspectorUIExtensionController.h b/Source/WebKit/WebProcess/Inspector/WebInspectorUIExtensionController.h
index 8542ea5ea0af..a207bd7a11a1 100644
--- a/Source/WebKit/WebProcess/Inspector/WebInspectorUIExtensionController.h
+++ b/Source/WebKit/WebProcess/Inspector/WebInspectorUIExtensionController.h
@@ -30,6 +30,7 @@
 #include "Connection.h"
 #include "InspectorExtensionTypes.h"
 #include "MessageReceiver.h"
+#include "RunJavaScriptResult.h"
 #include <WebCore/FrameIdentifier.h>
 #include <WebCore/InspectorFrontendAPIDispatcher.h>
 #include <WebCore/PageIdentifier.h>
@@ -76,13 +77,13 @@ class WebInspectorUIExtensionController
     void registerExtension(const Inspector::ExtensionID&, const String& extensionBundleIdentifier, const String& displayName, CompletionHandler<void(Expected<void, Inspector::ExtensionError>)>&&);
     void unregisterExtension(const Inspector::ExtensionID&, CompletionHandler<void(Expected<void, Inspector::ExtensionError>)>&&);
     void createTabForExtension(const Inspector::ExtensionID&, const String& tabName, const URL& tabIconURL, const URL& sourceURL, CompletionHandler<void(Expected<Inspector::ExtensionTabID, Inspector::ExtensionError>)>&&);
-    void evaluateScriptForExtension(const Inspector::ExtensionID&, const String& scriptSource, const std::optional<URL>& frameURL, const std::optional<URL>& contextSecurityOrigin, const std::optional<bool>& useContentScriptContext, CompletionHandler<void(Expected<WebKit::JavaScriptEvaluationResult, std::optional<WebCore::ExceptionDetails>>&&, const std::optional<Inspector::ExtensionError>&)>&&);
+    void evaluateScriptForExtension(const Inspector::ExtensionID&, const String& scriptSource, const std::optional<URL>& frameURL, const std::optional<URL>& contextSecurityOrigin, const std::optional<bool>& useContentScriptContext, CompletionHandler<void(WebKit::RunJavaScriptResult&&, const std::optional<Inspector::ExtensionError>&)>&&);
     void reloadForExtension(const Inspector::ExtensionID&, const std::optional<bool>& ignoreCache, const std::optional<String>& userAgent, const std::optional<String>& injectedScript, CompletionHandler<void(const std::optional<Inspector::ExtensionError>&)>&&);
     void showExtensionTab(const Inspector::ExtensionTabID&, CompletionHandler<void(Expected<void, Inspector::ExtensionError>)>&&);
     void navigateTabForExtension(const Inspector::ExtensionTabID&, const URL& sourceURL, CompletionHandler<void(const std::optional<Inspector::ExtensionError>&)>&&);
 
     // WebInspectorUIExtensionController IPC messages for testing.
-    void evaluateScriptInExtensionTab(const Inspector::ExtensionTabID&, const String& scriptSource, CompletionHandler<void(Expected<JavaScriptEvaluationResult, std::optional<WebCore::ExceptionDetails>>&&, const std::optional<Inspector::ExtensionError>&)>&&);
+    void evaluateScriptInExtensionTab(const Inspector::ExtensionTabID&, const String& scriptSource, CompletionHandler<void(WebKit::RunJavaScriptResult&&, const std::optional<Inspector::ExtensionError>&)>&&);
 
     // Callbacks from the frontend.
     void didShowExtensionTab(const Inspector::ExtensionID&, const Inspector::ExtensionTabID&, WebCore::FrameIdentifier);
diff --git a/Source/WebKit/WebProcess/MediaSession/RemoteMediaSessionCoordinator.cpp b/Source/WebKit/WebProcess/MediaSession/RemoteMediaSessionCoordinator.cpp
index eb93ccebd248..c81855de5745 100644
--- a/Source/WebKit/WebProcess/MediaSession/RemoteMediaSessionCoordinator.cpp
+++ b/Source/WebKit/WebProcess/MediaSession/RemoteMediaSessionCoordinator.cpp
@@ -189,7 +189,7 @@ void RemoteMediaSessionCoordinator::trackIdentifierChanged(const String& identif
 void RemoteMediaSessionCoordinator::seekSessionToTime(double time, CompletionHandler<void(bool)>&& completionHandler)
 {
     ALWAYS_LOG_IF_POSSIBLE(LOGIDENTIFIER, time);
-    if (auto coordinatorClient = client())
+    if (RefPtr coordinatorClient = client())
         coordinatorClient->seekSessionToTime(time, WTF::move((completionHandler)));
     else
         completionHandler(false);
@@ -198,7 +198,7 @@ void RemoteMediaSessionCoordinator::seekSessionToTime(double time, CompletionHan
 void RemoteMediaSessionCoordinator::playSession(std::optional<double> atTime, std::optional<MonotonicTime> hostTime, CompletionHandler<void(bool)>&& completionHandler)
 {
     ALWAYS_LOG_IF_POSSIBLE(LOGIDENTIFIER);
-    if (auto coordinatorClient = client())
+    if (RefPtr coordinatorClient = client())
         coordinatorClient->playSession(WTF::move(atTime), WTF::move(hostTime), WTF::move((completionHandler)));
     else
         completionHandler(false);
@@ -207,7 +207,7 @@ void RemoteMediaSessionCoordinator::playSession(std::optional<double> atTime, st
 void RemoteMediaSessionCoordinator::pauseSession(CompletionHandler<void(bool)>&& completionHandler)
 {
     ALWAYS_LOG_IF_POSSIBLE(LOGIDENTIFIER);
-    if (auto coordinatorClient = client())
+    if (RefPtr coordinatorClient = client())
         coordinatorClient->pauseSession(WTF::move((completionHandler)));
     else
         completionHandler(false);
@@ -216,7 +216,7 @@ void RemoteMediaSessionCoordinator::pauseSession(CompletionHandler<void(bool)>&&
 void RemoteMediaSessionCoordinator::setSessionTrack(const String& trackIdentifier, CompletionHandler<void(bool)>&& completionHandler)
 {
     ALWAYS_LOG_IF_POSSIBLE(LOGIDENTIFIER, trackIdentifier);
-    if (auto coordinatorClient = client())
+    if (RefPtr coordinatorClient = client())
         coordinatorClient->setSessionTrack(trackIdentifier, WTF::move((completionHandler)));
     else
         completionHandler(false);
@@ -225,7 +225,7 @@ void RemoteMediaSessionCoordinator::setSessionTrack(const String& trackIdentifie
 void RemoteMediaSessionCoordinator::coordinatorStateChanged(WebCore::MediaSessionCoordinatorState state)
 {
     ALWAYS_LOG_IF_POSSIBLE(LOGIDENTIFIER, state);
-    if (auto coordinatorClient = client())
+    if (RefPtr coordinatorClient = client())
         coordinatorClient->coordinatorStateChanged(state);
 }
 
diff --git a/Source/WebKit/WebProcess/Network/NetworkProcessConnection.cpp b/Source/WebKit/WebProcess/Network/NetworkProcessConnection.cpp
index b36d1a8a92af..fe032549465c 100644
--- a/Source/WebKit/WebProcess/Network/NetworkProcessConnection.cpp
+++ b/Source/WebKit/WebProcess/Network/NetworkProcessConnection.cpp
@@ -121,7 +121,7 @@ bool NetworkProcessConnection::dispatchMessage(IPC::Connection& connection, IPC:
         return true;
     }
     if (decoder.messageReceiverName() == Messages::StorageAreaMap::messageReceiverName()) {
-        if (auto storageAreaMap = WebProcess::singleton().storageAreaMap(ObjectIdentifier<StorageAreaMapIdentifierType>(decoder.destinationID())))
+        if (RefPtr storageAreaMap = WebProcess::singleton().storageAreaMap(ObjectIdentifier<StorageAreaMapIdentifierType>(decoder.destinationID())))
             storageAreaMap->didReceiveMessage(connection, decoder);
         return true;
     }
diff --git a/Source/WebKit/WebProcess/Network/WebLoaderStrategy.cpp b/Source/WebKit/WebProcess/Network/WebLoaderStrategy.cpp
index f4f72945c273..6d47f4919330 100644
--- a/Source/WebKit/WebProcess/Network/WebLoaderStrategy.cpp
+++ b/Source/WebKit/WebProcess/Network/WebLoaderStrategy.cpp
@@ -658,7 +658,7 @@ void WebLoaderStrategy::scheduleLoadFromNetworkProcess(ResourceLoader& resourceL
     WEBLOADERSTRATEGY_RELEASE_LOG_FORWARDABLE(WebLoaderStrategyScheduleLoadResourceScheduledWithNetworkProcess, static_cast<int>(resourceLoader.request().priority()), existingNetworkResourceLoadIdentifierToResume ? existingNetworkResourceLoadIdentifierToResume->toUInt64() : 0);
 
     loadParameters.isInitiatedByDedicatedWorker = resourceLoader.options().initiatorContext == InitiatorContext::Worker && std::holds_alternative<std::monostate>(resourceLoader.options().workerIdentifier);
-    if (WebProcess::singleton().ensureNetworkProcessConnection().connection().send(Messages::NetworkConnectionToWebProcess::ScheduleResourceLoad(WTF::move(loadParameters), existingNetworkResourceLoadIdentifierToResume), 0) != IPC::Error::NoError) {
+    if (protect(WebProcess::singleton().ensureNetworkProcessConnection().connection())->send(Messages::NetworkConnectionToWebProcess::ScheduleResourceLoad(WTF::move(loadParameters), existingNetworkResourceLoadIdentifierToResume), 0) != IPC::Error::NoError) {
         WEBLOADERSTRATEGY_RELEASE_LOG_ERROR("scheduleLoad: Unable to schedule resource with the NetworkProcess (priority=%d)", static_cast<int>(resourceLoader.request().priority()));
         // We probably failed to schedule this load with the NetworkProcess because it had crashed.
         // This load will never succeed so we will schedule it to fail asynchronously.
@@ -917,7 +917,7 @@ void WebLoaderStrategy::loadResourceSynchronously(FrameLoader& frameLoader, WebC
     HangDetectionDisabler hangDetectionDisabler;
     IPC::UnboundedSynchronousIPCScope unboundedSynchronousIPCScope;
 
-    auto sendResult = WebProcess::singleton().ensureNetworkProcessConnection().connection().sendSync(Messages::NetworkConnectionToWebProcess::PerformSynchronousLoad(WTF::move(loadParameters)), 0);
+    auto sendResult = protect(WebProcess::singleton().ensureNetworkProcessConnection().connection())->sendSync(Messages::NetworkConnectionToWebProcess::PerformSynchronousLoad(WTF::move(loadParameters)), 0);
     if (!sendResult.succeeded()) {
         WEBLOADERSTRATEGY_WITH_FRAMELOADER_RELEASE_LOG_ERROR("loadResourceSynchronously: failed sending synchronous network process message %" PUBLIC_LOG_STRING, IPC::errorAsString(sendResult.error()).characters());
         if (page)
@@ -1006,7 +1006,7 @@ void WebLoaderStrategy::startPingLoad(LocalFrame& frame, ResourceRequest& reques
     if (completionHandler)
         m_pingLoadCompletionHandlers.add(*loadParameters.identifier, WTF::move(completionHandler));
 
-    WebProcess::singleton().ensureNetworkProcessConnection().connection().send(Messages::NetworkConnectionToWebProcess::LoadPing { WTF::move(loadParameters) }, 0);
+    protect(WebProcess::singleton().ensureNetworkProcessConnection().connection())->send(Messages::NetworkConnectionToWebProcess::LoadPing { WTF::move(loadParameters) }, 0);
 }
 
 void WebLoaderStrategy::didFinishPingLoad(WebCore::ResourceLoaderIdentifier pingLoadIdentifier, ResourceError&& error, ResourceResponse&& response)
@@ -1083,7 +1083,7 @@ void WebLoaderStrategy::preconnectTo(WebCore::ResourceRequest&& request, WebPage
 
     // FIXME: Use sendWithAsyncReply instead of preconnectionIdentifier
     // FIXME: don't use WebCore::ResourceLoaderIdentifier for a preconnection identifier, too. It should have its own type.
-    WebProcess::singleton().ensureNetworkProcessConnection().connection().send(Messages::NetworkConnectionToWebProcess::PreconnectTo(WTF::move(preconnectRequest)), 0);
+    protect(WebProcess::singleton().ensureNetworkProcessConnection().connection())->send(Messages::NetworkConnectionToWebProcess::PreconnectTo(WTF::move(preconnectRequest)), 0);
 }
 
 void WebLoaderStrategy::didFinishPreconnection(WebCore::ResourceLoaderIdentifier preconnectionIdentifier, ResourceError&& error)
@@ -1115,7 +1115,7 @@ void WebLoaderStrategy::isResourceLoadFinished(CachedResource& resource, Complet
         return;
     }
 
-    WebProcess::singleton().ensureNetworkProcessConnection().connection().sendWithAsyncReply(Messages::NetworkConnectionToWebProcess::IsResourceLoadFinished(*resource.loader()->identifier()), WTF::move(callback), 0);
+    protect(WebProcess::singleton().ensureNetworkProcessConnection().connection())->sendWithAsyncReply(Messages::NetworkConnectionToWebProcess::IsResourceLoadFinished(*resource.loader()->identifier()), WTF::move(callback), 0);
 }
 
 void WebLoaderStrategy::setOnLineState(bool isOnLine)
@@ -1130,26 +1130,26 @@ void WebLoaderStrategy::setOnLineState(bool isOnLine)
 
 void WebLoaderStrategy::setCaptureExtraNetworkLoadMetricsEnabled(bool enabled)
 {
-    WebProcess::singleton().ensureNetworkProcessConnection().connection().send(Messages::NetworkConnectionToWebProcess::SetCaptureExtraNetworkLoadMetricsEnabled(enabled), 0);
+    protect(WebProcess::singleton().ensureNetworkProcessConnection().connection())->send(Messages::NetworkConnectionToWebProcess::SetCaptureExtraNetworkLoadMetricsEnabled(enabled), 0);
 }
 
 ResourceResponse WebLoaderStrategy::responseFromResourceLoadIdentifier(ResourceLoaderIdentifier resourceLoadIdentifier)
 {
-    auto sendResult = WebProcess::singleton().ensureNetworkProcessConnection().connection().sendSync(Messages::NetworkConnectionToWebProcess::GetNetworkLoadInformationResponse { resourceLoadIdentifier }, 0);
+    auto sendResult = protect(WebProcess::singleton().ensureNetworkProcessConnection().connection())->sendSync(Messages::NetworkConnectionToWebProcess::GetNetworkLoadInformationResponse { resourceLoadIdentifier }, 0);
     auto [response] = sendResult.takeReplyOr(ResourceResponse { });
     return response;
 }
 
 Vector<NetworkTransactionInformation> WebLoaderStrategy::intermediateLoadInformationFromResourceLoadIdentifier(WebCore::ResourceLoaderIdentifier resourceLoadIdentifier)
 {
-    auto sendResult = WebProcess::singleton().ensureNetworkProcessConnection().connection().sendSync(Messages::NetworkConnectionToWebProcess::GetNetworkLoadIntermediateInformation { resourceLoadIdentifier }, 0);
+    auto sendResult = protect(WebProcess::singleton().ensureNetworkProcessConnection().connection())->sendSync(Messages::NetworkConnectionToWebProcess::GetNetworkLoadIntermediateInformation { resourceLoadIdentifier }, 0);
     auto [information] = sendResult.takeReplyOr(Vector<NetworkTransactionInformation> { });
     return information;
 }
 
 NetworkLoadMetrics WebLoaderStrategy::networkMetricsFromResourceLoadIdentifier(WebCore::ResourceLoaderIdentifier resourceLoadIdentifier)
 {
-    auto sendResult = WebProcess::singleton().ensureNetworkProcessConnection().connection().sendSync(Messages::NetworkConnectionToWebProcess::TakeNetworkLoadInformationMetrics { resourceLoadIdentifier }, 0);
+    auto sendResult = protect(WebProcess::singleton().ensureNetworkProcessConnection().connection())->sendSync(Messages::NetworkConnectionToWebProcess::TakeNetworkLoadInformationMetrics { resourceLoadIdentifier }, 0);
     auto [networkMetrics] = sendResult.takeReplyOr(NetworkLoadMetrics { });
     return networkMetrics;
 }
diff --git a/Source/WebKit/WebProcess/Network/WebSocketProvider.cpp b/Source/WebKit/WebProcess/Network/WebSocketProvider.cpp
index 8a369e9686a5..26f9c776c0cb 100644
--- a/Source/WebKit/WebProcess/Network/WebSocketProvider.cpp
+++ b/Source/WebKit/WebProcess/Network/WebSocketProvider.cpp
@@ -51,7 +51,7 @@ RefPtr<ThreadableWebSocketChannel> WebSocketProvider::createWebSocketChannel(Doc
 
 void WebSocketProvider::countWebSocketChannelsForTesting(CompletionHandler<void(unsigned)>&& completionHandler)
 {
-    WebProcess::singleton().ensureNetworkProcessConnection().connection().sendWithAsyncReply(Messages::NetworkConnectionToWebProcess::CountWebSocketChannelsForTesting { }, WTF::move(completionHandler));
+    protect(WebProcess::singleton().ensureNetworkProcessConnection().connection())->sendWithAsyncReply(Messages::NetworkConnectionToWebProcess::CountWebSocketChannelsForTesting { }, WTF::move(completionHandler));
 }
 
 WebSocketProvider::~WebSocketProvider() = default;
diff --git a/Source/WebKit/WebProcess/Network/webrtc/LibWebRTCNetworkManager.cpp b/Source/WebKit/WebProcess/Network/webrtc/LibWebRTCNetworkManager.cpp
index 858c2176377b..6b8d62a41490 100644
--- a/Source/WebKit/WebProcess/Network/webrtc/LibWebRTCNetworkManager.cpp
+++ b/Source/WebKit/WebProcess/Network/webrtc/LibWebRTCNetworkManager.cpp
@@ -170,7 +170,7 @@ void LibWebRTCNetworkManager::networksChanged(const Vector<RTCNetwork>& networks
                     .isRelayDisabled = !document->settings().webRTCRelayBypassDisabled(),
                     .enableServiceClass = false
                 };
-                WebProcess::singleton().ensureNetworkProcessConnection().connection().sendWithAsyncReply(Messages::NetworkRTCProvider::GetInterfaceName { document->url(), webPage->webPageProxyIdentifier(), flags, WTF::move(domain) }, [weakThis = WeakPtr { *this }] (auto&& interfaceName) {
+                protect(WebProcess::singleton().ensureNetworkProcessConnection().connection())->sendWithAsyncReply(Messages::NetworkRTCProvider::GetInterfaceName { document->url(), webPage->webPageProxyIdentifier(), flags, WTF::move(domain) }, [weakThis = WeakPtr { *this }] (auto&& interfaceName) {
                     RefPtr protectedThis = weakThis.get();
                     if (protectedThis && !interfaceName.isNull())
                         protectedThis->signalUsedInterface(WTF::move(interfaceName));
diff --git a/Source/WebKit/WebProcess/Network/webrtc/RTCDataChannelRemoteManager.cpp b/Source/WebKit/WebProcess/Network/webrtc/RTCDataChannelRemoteManager.cpp
index 7ef4d7b8fdb0..a005729614b2 100644
--- a/Source/WebKit/WebProcess/Network/webrtc/RTCDataChannelRemoteManager.cpp
+++ b/Source/WebKit/WebProcess/Network/webrtc/RTCDataChannelRemoteManager.cpp
@@ -105,7 +105,7 @@ void RTCDataChannelRemoteManager::postTaskToHandler(WebCore::RTCDataChannelIdent
 
     WebCore::ScriptExecutionContext::postTaskTo(*remoteHandler.contextIdentifier, [weakHandler = remoteHandler.handler, function = WTF::move(function)](auto&) mutable {
         if (CheckedPtr handler = weakHandler)
-            function(*weakHandler);
+            function(*handler);
     });
 }
 
diff --git a/Source/WebKit/WebProcess/Network/webrtc/WebRTCMonitor.cpp b/Source/WebKit/WebProcess/Network/webrtc/WebRTCMonitor.cpp
index 530ddb84f25c..d32778555ed7 100644
--- a/Source/WebKit/WebProcess/Network/webrtc/WebRTCMonitor.cpp
+++ b/Source/WebKit/WebProcess/Network/webrtc/WebRTCMonitor.cpp
@@ -59,7 +59,7 @@ void WebRTCMonitor::startUpdating()
 {
     WEBRTC_RELEASE_LOG("StartUpdating - Asking network process to start updating");
 
-    WebProcess::singleton().ensureNetworkProcessConnection().connection().send(Messages::NetworkRTCMonitor::StartUpdatingIfNeeded(), 0);
+    protect(WebProcess::singleton().ensureNetworkProcessConnection().connection())->send(Messages::NetworkRTCMonitor::StartUpdatingIfNeeded(), 0);
     ++m_clientCount;
 }
 
@@ -72,7 +72,7 @@ void WebRTCMonitor::stopUpdating()
         return;
 
     WEBRTC_RELEASE_LOG("StopUpdating - Asking network process to stop updating");
-    WebProcess::singleton().ensureNetworkProcessConnection().connection().send(Messages::NetworkRTCMonitor::StopUpdating(), 0);
+    protect(WebProcess::singleton().ensureNetworkProcessConnection().connection())->send(Messages::NetworkRTCMonitor::StopUpdating(), 0);
 }
 
 void WebRTCMonitor::networksChanged(Vector<RTCNetwork>&& networkList, RTCNetwork::IPAddress&& ipv4, RTCNetwork::IPAddress&& ipv6)
diff --git a/Source/WebKit/WebProcess/Plugins/PDF/PDFPlugin.mm b/Source/WebKit/WebProcess/Plugins/PDF/PDFPlugin.mm
index 9b9e203ba6be..7c82423e6d24 100644
--- a/Source/WebKit/WebProcess/Plugins/PDF/PDFPlugin.mm
+++ b/Source/WebKit/WebProcess/Plugins/PDF/PDFPlugin.mm
@@ -1090,7 +1090,14 @@ static bool getEventTypeFromWebEvent(const WebEvent& event, NSEventType& eventTy
     if (!frameView)
         return false;
     IntPoint contentsPoint = frameView->contentsToRootView(point);
-    WebMouseEvent event({ WebEventType::MouseDown, OptionSet<WebEventModifier> { }, MonotonicTime::now() }, WebMouseEventButton::Right, 0, contentsPoint, contentsPoint, 0, 0, 0, 1, WebCore::ForceAtClick);
+    Ref event = WebMouseEvent::create({ WebEventType::MouseDown, OptionSet<WebEventModifier> { }, MonotonicTime::now() }, {
+        .button = WebMouseEventButton::Right,
+        .buttons = 0,
+        .position = contentsPoint,
+        .globalPosition = contentsPoint,
+        .clickCount = 1,
+        .force = WebCore::ForceAtClick,
+    });
     return handleContextMenuEvent(event);
 }
 
diff --git a/Source/WebKit/WebProcess/Plugins/PDF/PDFPluginBase.mm b/Source/WebKit/WebProcess/Plugins/PDF/PDFPluginBase.mm
index 3912a3ca000c..8d6549e941e8 100644
--- a/Source/WebKit/WebProcess/Plugins/PDF/PDFPluginBase.mm
+++ b/Source/WebKit/WebProcess/Plugins/PDF/PDFPluginBase.mm
@@ -1345,7 +1345,15 @@
     if (!frameView)
         return false;
     IntPoint contentsPoint = frameView->contentsToRootView(point);
-    WebMouseEvent event({ WebEventType::MouseDown, OptionSet<WebEventModifier> { }, MonotonicTime::now() }, WebMouseEventButton::Right, 0, contentsPoint, contentsPoint, 0, 0, 0, 1, WebCore::ForceAtClick, WebEventInputSource::UserDriven);
+    Ref event = WebMouseEvent::create({ WebEventType::MouseDown, OptionSet<WebEventModifier> { }, MonotonicTime::now() }, {
+        .button = WebMouseEventButton::Right,
+        .buttons = 0,
+        .position = contentsPoint,
+        .globalPosition = contentsPoint,
+        .clickCount = 1,
+        .force = WebCore::ForceAtClick,
+        .inputSource = WebEventInputSource::UserDriven,
+    });
     return handleContextMenuEvent(event);
 }
 
diff --git a/Source/WebKit/WebProcess/Plugins/PDF/UnifiedPDF/PDFDiscretePresentationController.mm b/Source/WebKit/WebProcess/Plugins/PDF/UnifiedPDF/PDFDiscretePresentationController.mm
index 00617748c03a..003f77d1981c 100644
--- a/Source/WebKit/WebProcess/Plugins/PDF/UnifiedPDF/PDFDiscretePresentationController.mm
+++ b/Source/WebKit/WebProcess/Plugins/PDF/UnifiedPDF/PDFDiscretePresentationController.mm
@@ -1194,13 +1194,13 @@ static float elasticDeltaForTimeDelta(float initialPosition, float initialVeloci
 
     auto updateRowPageContainerLayers = [&](const RowData& row, const FloatRect& rowBounds) {
         auto leftPageIndex = row.pages.pages[0];
-        updatePageContainerLayerBounds(row.leftPageContainerLayer.get(), leftPageIndex, rowBounds);
+        updatePageContainerLayerBounds(protect(row.leftPageContainerLayer), leftPageIndex, rowBounds);
 
         if (row.pages.numPages() == 1)
             return;
 
         auto rightPageIndex = row.pages.pages[1];
-        updatePageContainerLayerBounds(row.rightPageContainerLayer.get(), rightPageIndex, rowBounds);
+        updatePageContainerLayerBounds(protect(row.rightPageContainerLayer), rightPageIndex, rowBounds);
     };
 
     TransformationMatrix transform;
diff --git a/Source/WebKit/WebProcess/Plugins/PDF/UnifiedPDF/PDFScrollingPresentationController.mm b/Source/WebKit/WebProcess/Plugins/PDF/UnifiedPDF/PDFScrollingPresentationController.mm
index d2b278f0de2e..c9856075c672 100644
--- a/Source/WebKit/WebProcess/Plugins/PDF/UnifiedPDF/PDFScrollingPresentationController.mm
+++ b/Source/WebKit/WebProcess/Plugins/PDF/UnifiedPDF/PDFScrollingPresentationController.mm
@@ -306,7 +306,7 @@
         for (auto& pageLayer : m_pageBackgroundsContainerLayer->children()) {
             propagateSettingsToLayer(pageLayer);
             if (pageLayer->children().size())
-                propagateSettingsToLayer(pageLayer->children()[0]);
+                propagateSettingsToLayer(protect(pageLayer->children()[0]));
         }
     }
 
diff --git a/Source/WebKit/WebProcess/Plugins/PDF/UnifiedPDF/UnifiedPDFPlugin.mm b/Source/WebKit/WebProcess/Plugins/PDF/UnifiedPDF/UnifiedPDFPlugin.mm
index 64417684d35d..a04a2a1da674 100644
--- a/Source/WebKit/WebProcess/Plugins/PDF/UnifiedPDF/UnifiedPDFPlugin.mm
+++ b/Source/WebKit/WebProcess/Plugins/PDF/UnifiedPDF/UnifiedPDFPlugin.mm
@@ -911,12 +911,12 @@ static String mutationObserverNotificationString()
     };
 
     if (&layer == layerForHorizontalScrollbar()) {
-        paintScrollbar(m_horizontalScrollbar.get(), context);
+        paintScrollbar(protect(m_horizontalScrollbar), context);
         return;
     }
 
     if (&layer == layerForVerticalScrollbar()) {
-        paintScrollbar(m_verticalScrollbar.get(), context);
+        paintScrollbar(protect(m_verticalScrollbar), context);
         return;
     }
 
diff --git a/Source/WebKit/WebProcess/Plugins/PluginView.cpp b/Source/WebKit/WebProcess/Plugins/PluginView.cpp
index 1776b6d91044..72906ac1f9fc 100644
--- a/Source/WebKit/WebProcess/Plugins/PluginView.cpp
+++ b/Source/WebKit/WebProcess/Plugins/PluginView.cpp
@@ -725,7 +725,7 @@ void PluginView::handleEvent(Event& event)
     if (!shouldForwardToPlugin(event))
         return;
 
-    const CheckedPtr currentEvent = WebPage::currentEvent();
+    const RefPtr currentEvent = WebPage::currentEvent();
     if (!currentEvent)
         return;
 
@@ -1046,7 +1046,7 @@ FetchOptions::Destination PluginView::fetchDestination() const
 
 void PluginView::loadMainResource()
 {
-    auto referrer = SecurityPolicy::generateReferrerHeader(frame()->document()->referrerPolicy(), m_mainResourceURL, frame()->loader().outgoingReferrerURL(), OriginAccessPatternsForWebProcess::singleton());
+    auto referrer = SecurityPolicy::generateReferrerHeader(frame()->document()->referrerPolicy(), m_mainResourceURL, protect(frame()->loader())->outgoingReferrerURL(), OriginAccessPatternsForWebProcess::singleton());
     if (referrer.isEmpty())
         referrer = { };
 
diff --git a/Source/WebKit/WebProcess/Storage/WebSWClientConnection.cpp b/Source/WebKit/WebProcess/Storage/WebSWClientConnection.cpp
index 36e08e261567..411ad5ff57d0 100644
--- a/Source/WebKit/WebProcess/Storage/WebSWClientConnection.cpp
+++ b/Source/WebKit/WebProcess/Storage/WebSWClientConnection.cpp
@@ -533,7 +533,7 @@ Ref<WebSWClientConnection::AddRoutePromise> WebSWClientConnection::addRoutes(Ser
             return makeUnexpected(WebCore::ExceptionData { WebCore::ExceptionCode::TypeError, "Internal error"_s });
         }
     };
-    return WebProcess::singleton().ensureNetworkProcessConnection().connection().sendWithPromisedReply<PromiseConverter>(Messages::WebSWServerConnection::AddRoutes { identifier, routes });
+    return protect(WebProcess::singleton().ensureNetworkProcessConnection().connection())->sendWithPromisedReply<PromiseConverter>(Messages::WebSWServerConnection::AddRoutes { identifier, routes });
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit/WebProcess/WebCoreSupport/ShareableBitmapUtilities.cpp b/Source/WebKit/WebProcess/WebCoreSupport/ShareableBitmapUtilities.cpp
index 98b897d3952d..eba4d16e1ca4 100644
--- a/Source/WebKit/WebProcess/WebCoreSupport/ShareableBitmapUtilities.cpp
+++ b/Source/WebKit/WebProcess/WebCoreSupport/ShareableBitmapUtilities.cpp
@@ -77,7 +77,7 @@ RefPtr<ShareableBitmap> createShareableBitmap(RenderImage& renderImage, CreateSh
     }
 
 #if ENABLE(VIDEO)
-    if (auto* renderVideo = dynamicDowncast<RenderVideo>(renderImage))
+    if (CheckedPtr renderVideo = dynamicDowncast<RenderVideo>(renderImage))
         return protect(renderVideo->videoElement())->bitmapImageForCurrentTimeSync();
 #endif // ENABLE(VIDEO)
 
@@ -114,7 +114,7 @@ RefPtr<ShareableBitmap> createShareableBitmap(RenderImage& renderImage, CreateSh
 Ref<NativePromise<Ref<WebCore::ShareableBitmap>, void>> createShareableBitmapAsync(WebCore::RenderImage& renderImage, CreateShareableBitmapFromImageOptions&& options)
 {
 #if ENABLE(VIDEO)
-    if (auto* renderVideo = dynamicDowncast<RenderVideo>(renderImage))
+    if (CheckedPtr renderVideo = dynamicDowncast<RenderVideo>(renderImage))
         return protect(renderVideo->videoElement())->bitmapImageForCurrentTime();
 #endif
     if (RefPtr shareableBitmap = createShareableBitmap(renderImage, WTF::move(options)))
diff --git a/Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.cpp b/Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.cpp
index a2a36b770f21..92fd5bdf7af5 100644
--- a/Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.cpp
+++ b/Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.cpp
@@ -463,7 +463,7 @@ bool WebChromeClient::testProcessIncomingSyncMessagesWhenWaitingForSyncReply()
 
     IPC::UnboundedSynchronousIPCScope unboundedSynchronousIPCScope;
 
-    auto sendResult = WebProcess::singleton().ensureNetworkProcessConnection().connection().sendSync(Messages::NetworkConnectionToWebProcess::TestProcessIncomingSyncMessagesWhenWaitingForSyncReply(m_page->webPageProxyIdentifier()), 0);
+    auto sendResult = protect(WebProcess::singleton().ensureNetworkProcessConnection().connection())->sendSync(Messages::NetworkConnectionToWebProcess::TestProcessIncomingSyncMessagesWhenWaitingForSyncReply(m_page->webPageProxyIdentifier()), 0);
     auto [handled] = sendResult.takeReplyOr(false);
     return handled;
 }
@@ -1378,7 +1378,7 @@ unsigned WebChromeClient::remoteImagesCountForTesting() const
 
 void WebChromeClient::registerBlobPathForTesting(const String& path, CompletionHandler<void()>&& completionHandler)
 {
-    WebProcess::singleton().ensureNetworkProcessConnection().connection().sendWithAsyncReply(Messages::NetworkConnectionToWebProcess::RegisterBlobPathForTesting(path), WTF::move(completionHandler));
+    protect(WebProcess::singleton().ensureNetworkProcessConnection().connection())->sendWithAsyncReply(Messages::NetworkConnectionToWebProcess::RegisterBlobPathForTesting(path), WTF::move(completionHandler));
 }
 
 
diff --git a/Source/WebKit/WebProcess/WebCoreSupport/WebLocalFrameLoaderClient.cpp b/Source/WebKit/WebProcess/WebCoreSupport/WebLocalFrameLoaderClient.cpp
index 94e5a998b737..ca1d54dae095 100644
--- a/Source/WebKit/WebProcess/WebCoreSupport/WebLocalFrameLoaderClient.cpp
+++ b/Source/WebKit/WebProcess/WebCoreSupport/WebLocalFrameLoaderClient.cpp
@@ -1553,7 +1553,7 @@ void WebLocalFrameLoaderClient::loadStorageAccessQuirksIfNeeded()
     if (!WebProcess::singleton().haveStorageAccessQuirksForDomain(RegistrableDomain { documentURLWithoutFragmentOrQueries }))
         return;
 
-    WebProcess::singleton().ensureNetworkProcessConnection().connection().sendWithAsyncReply(Messages::NetworkConnectionToWebProcess::StorageAccessQuirkForTopFrameDomain(documentURLWithoutFragmentOrQueries), [weakDocument = WeakPtr { *document }](Vector<RegistrableDomain>&& domains) {
+    protect(WebProcess::singleton().ensureNetworkProcessConnection().connection())->sendWithAsyncReply(Messages::NetworkConnectionToWebProcess::StorageAccessQuirkForTopFrameDomain(documentURLWithoutFragmentOrQueries), [weakDocument = WeakPtr { *document }](Vector<RegistrableDomain>&& domains) {
         if (!domains.size())
             return;
         if (RefPtr document = weakDocument)
@@ -2075,7 +2075,7 @@ void WebLocalFrameLoaderClient::sendH2Ping(const URL& url, CompletionHandler<voi
 #if ENABLE(APP_BOUND_DOMAINS)
     isNavigatingToAppBoundDomain = m_frame->isTopFrameNavigatingToAppBoundDomain();
 #endif
-    WebProcess::singleton().ensureNetworkProcessConnection().connection().sendWithAsyncReply(Messages::NetworkConnectionToWebProcess::SendH2Ping(url, webPage->webPageProxyIdentifier(), webPage->identifier(), m_frame->frameID(), isNavigatingToAppBoundDomain), WTF::move(completionHandler));
+    protect(WebProcess::singleton().ensureNetworkProcessConnection().connection())->sendWithAsyncReply(Messages::NetworkConnectionToWebProcess::SendH2Ping(url, webPage->webPageProxyIdentifier(), webPage->identifier(), m_frame->frameID(), isNavigatingToAppBoundDomain), WTF::move(completionHandler));
 }
 
 void WebLocalFrameLoaderClient::didRestoreScrollPosition()
@@ -2212,7 +2212,7 @@ void WebLocalFrameLoaderClient::didExceedNetworkUsageThreshold()
             frame->reportResourceMonitoringWarning();
     };
 
-    WebProcess::singleton().ensureNetworkProcessConnection().connection().sendWithAsyncReply(Messages::NetworkConnectionToWebProcess::ShouldOffloadIFrameForHost(url.host().toStringWithoutCopying()), WTF::move(action), 0);
+    protect(WebProcess::singleton().ensureNetworkProcessConnection().connection())->sendWithAsyncReply(Messages::NetworkConnectionToWebProcess::ShouldOffloadIFrameForHost(url.host().toStringWithoutCopying()), WTF::move(action), 0);
 }
 
 #endif
@@ -2228,7 +2228,7 @@ void WebLocalFrameLoaderClient::applyMonitorUnloadToOwnerFrame(WebCore::IFrameUn
 void WebLocalFrameLoaderClient::removeStorageAccess()
 {
     if (m_frameSpecificStorageAccessIdentifier) {
-        WebProcess::singleton().ensureNetworkProcessConnection().connection().send(Messages::NetworkConnectionToWebProcess::RemoveStorageAccessForFrame(
+        protect(WebProcess::singleton().ensureNetworkProcessConnection().connection())->send(Messages::NetworkConnectionToWebProcess::RemoveStorageAccessForFrame(
             m_frameSpecificStorageAccessIdentifier->frameID, m_frameSpecificStorageAccessIdentifier->pageID), 0);
         m_frameSpecificStorageAccessIdentifier = std::nullopt;
     }
diff --git a/Source/WebKit/WebProcess/WebCoreSupport/WebPlatformStrategies.cpp b/Source/WebKit/WebProcess/WebCoreSupport/WebPlatformStrategies.cpp
index 054aeaf8e7c9..d0533cf46082 100644
--- a/Source/WebKit/WebProcess/WebCoreSupport/WebPlatformStrategies.cpp
+++ b/Source/WebKit/WebProcess/WebCoreSupport/WebPlatformStrategies.cpp
@@ -552,7 +552,7 @@ void WebPlatformStrategies::windowSubscribeToPushService(const URL& scope, const
         callback(WTF::move(*valueOrException));
     };
 
-    WebProcess::singleton().ensureNetworkProcessConnection().connection().sendWithAsyncReply(Messages::NetworkConnectionToWebProcess::NavigatorSubscribeToPushService(scope, applicationServerKey), WTF::move(completionHandler));
+    protect(WebProcess::singleton().ensureNetworkProcessConnection().connection())->sendWithAsyncReply(Messages::NetworkConnectionToWebProcess::NavigatorSubscribeToPushService(scope, applicationServerKey), WTF::move(completionHandler));
 }
 
 void WebPlatformStrategies::windowUnsubscribeFromPushService(const URL& scope, std::optional<PushSubscriptionIdentifier> subscriptionIdentifier, UnsubscribeFromPushServiceCallback&& callback)
@@ -565,7 +565,7 @@ void WebPlatformStrategies::windowUnsubscribeFromPushService(const URL& scope, s
         callback(WTF::move(*valueOrException));
     };
 
-    WebProcess::singleton().ensureNetworkProcessConnection().connection().sendWithAsyncReply(Messages::NetworkConnectionToWebProcess::NavigatorUnsubscribeFromPushService(scope, *subscriptionIdentifier), WTF::move(completionHandler));
+    protect(WebProcess::singleton().ensureNetworkProcessConnection().connection())->sendWithAsyncReply(Messages::NetworkConnectionToWebProcess::NavigatorUnsubscribeFromPushService(scope, *subscriptionIdentifier), WTF::move(completionHandler));
 }
 
 void WebPlatformStrategies::windowGetPushSubscription(const URL& scope, GetPushSubscriptionCallback&& callback)
@@ -578,7 +578,7 @@ void WebPlatformStrategies::windowGetPushSubscription(const URL& scope, GetPushS
         callback(WTF::move(*valueOrException));
     };
 
-    WebProcess::singleton().ensureNetworkProcessConnection().connection().sendWithAsyncReply(Messages::NetworkConnectionToWebProcess::NavigatorGetPushSubscription(scope), WTF::move(completionHandler));
+    protect(WebProcess::singleton().ensureNetworkProcessConnection().connection())->sendWithAsyncReply(Messages::NetworkConnectionToWebProcess::NavigatorGetPushSubscription(scope), WTF::move(completionHandler));
 }
 
 void WebPlatformStrategies::windowGetPushPermissionState(const URL& scope, GetPushPermissionStateCallback&& callback)
@@ -589,7 +589,7 @@ void WebPlatformStrategies::windowGetPushPermissionState(const URL& scope, GetPu
         callback(static_cast<PushPermissionState>(*valueOrException));
     };
 
-    WebProcess::singleton().ensureNetworkProcessConnection().connection().sendWithAsyncReply(Messages::NetworkConnectionToWebProcess::NavigatorGetPushPermissionState(scope), WTF::move(completionHandler));
+    protect(WebProcess::singleton().ensureNetworkProcessConnection().connection())->sendWithAsyncReply(Messages::NetworkConnectionToWebProcess::NavigatorGetPushPermissionState(scope), WTF::move(completionHandler));
 }
 
 #endif // ENABLE(DECLARATIVE_WEB_PUSH)
diff --git a/Source/WebKit/WebProcess/WebPage/Cocoa/TextAnimationController.mm b/Source/WebKit/WebProcess/WebPage/Cocoa/TextAnimationController.mm
index deeebc9e6fba..86e32cfadcf1 100644
--- a/Source/WebKit/WebProcess/WebPage/Cocoa/TextAnimationController.mm
+++ b/Source/WebKit/WebProcess/WebPage/Cocoa/TextAnimationController.mm
@@ -301,10 +301,8 @@
         if (runMode == WebCore::TextAnimationRunMode::DoNotRun)
             return;
 
-        if (!weakWebPage)
-            return;
-
-        weakWebPage->addInitialTextAnimationForActiveWritingToolsSession();
+        if (RefPtr webPage = weakWebPage)
+            webPage->addInitialTextAnimationForActiveWritingToolsSession();
     });
 
     if (m_activeAnimation == sourceAnimationUUID) {
diff --git a/Source/WebKit/WebProcess/WebPage/EventDispatcher.cpp b/Source/WebKit/WebProcess/WebPage/EventDispatcher.cpp
index 0fd4a986ace8..4a8f2e6ff336 100644
--- a/Source/WebKit/WebProcess/WebPage/EventDispatcher.cpp
+++ b/Source/WebKit/WebProcess/WebPage/EventDispatcher.cpp
@@ -168,7 +168,7 @@ void EventDispatcher::internalWheelEvent(PageIdentifier pageID, const WebWheelEv
 
         scrollingTree->willProcessWheelEvent();
 
-        ScrollingThread::dispatch([scrollingTree, wheelEvent, platformWheelEvent, processingSteps, useMainThreadForScrolling, pageID, this, protectedThis = Ref { *this }, completionHandler = WTF::move(completionHandler)] mutable {
+        ScrollingThread::dispatch([scrollingTree, wheelEvent = Ref<const WebWheelEvent> { wheelEvent }, platformWheelEvent, processingSteps, useMainThreadForScrolling, pageID, this, protectedThis = Ref { *this }, completionHandler = WTF::move(completionHandler)] mutable {
             if (useMainThreadForScrolling) {
                 scrollingTree->willSendEventToMainThread(platformWheelEvent);
                 dispatchWheelEventViaMainThread(pageID, wheelEvent, processingSteps, WTF::move(completionHandler));
@@ -198,7 +198,7 @@ void EventDispatcher::internalWheelEvent(PageIdentifier pageID, const WebWheelEv
 #endif
 }
 
-void EventDispatcher::wheelEvent(PageIdentifier pageID, const WebWheelEvent& wheelEvent, RectEdges<WebCore::RubberBandingBehavior> rubberBandableEdges, CompletionHandler<void(bool)>&& completionHandler)
+void EventDispatcher::wheelEvent(PageIdentifier pageID, Ref<WebWheelEvent>&& wheelEvent, RectEdges<WebCore::RubberBandingBehavior> rubberBandableEdges, CompletionHandler<void(bool)>&& completionHandler)
 {
 #if ENABLE(MOMENTUM_EVENT_DISPATCHER)
     if (m_momentumEventDispatcher->handleWheelEvent(pageID, wheelEvent, rubberBandableEdges)) {
@@ -210,18 +210,18 @@ void EventDispatcher::wheelEvent(PageIdentifier pageID, const WebWheelEvent& whe
 }
 
 #if ENABLE(MAC_GESTURE_EVENTS)
-void EventDispatcher::gestureEvent(FrameIdentifier frameID, PageIdentifier pageID, const WebGestureEvent& gestureEvent, CompletionHandler<void(std::optional<WebEventType>, bool, std::optional<RemoteUserInputEventData>)>&& completionHandler)
+void EventDispatcher::gestureEvent(FrameIdentifier frameID, PageIdentifier pageID, Ref<WebGestureEvent>&& gestureEvent, CompletionHandler<void(std::optional<WebEventType>, bool, std::optional<RemoteUserInputEventData>)>&& completionHandler)
 {
-    RunLoop::mainSingleton().dispatch([this, frameID, pageID, gestureEvent, completionHandler = WTF::move(completionHandler)] mutable {
+    RunLoop::mainSingleton().dispatch([this, frameID, pageID, gestureEvent = WTF::move(gestureEvent), completionHandler = WTF::move(completionHandler)] mutable {
         dispatchGestureEvent(frameID, pageID, gestureEvent, WTF::move(completionHandler));
     });
 }
 #endif
 
 #if ENABLE(IOS_TOUCH_EVENTS)
-TouchEventData::TouchEventData(WebCore::FrameIdentifier frameID, const WebTouchEvent& event, CompletionHandler<void(bool, std::optional<RemoteWebTouchEvent>)>&& completionHandler)
+TouchEventData::TouchEventData(WebCore::FrameIdentifier frameID, Ref<WebTouchEvent>&& event, CompletionHandler<void(bool, std::optional<RemoteWebTouchEvent>)>&& completionHandler)
     : frameID(frameID)
-    , event(event)
+    , event(WTF::move(event))
 {
     completionHandlers.append(WTF::move(completionHandler));
 }
@@ -240,7 +240,7 @@ void EventDispatcher::takeQueuedTouchEventsForPage(const WebPage& webPage, Uniqu
         destinationQueue = makeUniqueRefFromNonNullUniquePtr(WTF::move(queue));
 }
 
-void EventDispatcher::touchEvent(PageIdentifier pageID, FrameIdentifier frameID, const WebTouchEvent& touchEvent, CompletionHandler<void(bool, std::optional<RemoteWebTouchEvent>)>&& completionHandler)
+void EventDispatcher::touchEvent(PageIdentifier pageID, FrameIdentifier frameID, Ref<WebTouchEvent>&& touchEvent, CompletionHandler<void(bool, std::optional<RemoteWebTouchEvent>)>&& completionHandler)
 {
     bool updateListWasEmpty;
     {
@@ -248,26 +248,27 @@ void EventDispatcher::touchEvent(PageIdentifier pageID, FrameIdentifier frameID,
         updateListWasEmpty = m_touchEvents.isEmpty();
         auto addResult = m_touchEvents.add(pageID, makeUniqueRef<TouchEventQueue>());
         if (addResult.isNewEntry)
-            addResult.iterator->value->append({ frameID, touchEvent, WTF::move(completionHandler) });
+            addResult.iterator->value->append({ frameID, WTF::move(touchEvent), WTF::move(completionHandler) });
         else {
             auto& queuedEvents = addResult.iterator->value;
             ASSERT(!queuedEvents->isEmpty());
             auto& touchEventData = queuedEvents->last();
             // Coalesce touch move events.
-            if (touchEvent.type() == WebEventType::TouchMove && touchEventData.event.type() == WebEventType::TouchMove) {
-                auto coalescedEvents = Vector<WebTouchEvent> { };
-                coalescedEvents.appendVector(queuedEvents->last().event.coalescedEvents());
-                coalescedEvents.appendVector(touchEvent.coalescedEvents());
+            if (touchEvent->type() == WebEventType::TouchMove && touchEventData.event->type() == WebEventType::TouchMove) {
+                auto coalescedEvents = Vector<Ref<WebTouchEvent>> { };
+                coalescedEvents.appendVector(queuedEvents->last().event->coalescedEvents());
+                coalescedEvents.appendVector(touchEvent->coalescedEvents());
 
-                auto touchEventWithCoalescedEvents = touchEvent;
-                touchEventWithCoalescedEvents.setCoalescedEvents(coalescedEvents);
+                // A copy: the caller's event must not be mutated now that events are shared.
+                Ref touchEventWithCoalescedEvents = touchEvent->copy();
+                touchEventWithCoalescedEvents->setCoalescedEvents(coalescedEvents);
 
                 // Preserve coalesced completion handlers so their state transitions are not lost.
                 queuedEvents->last().frameID = frameID;
-                queuedEvents->last().event = touchEventWithCoalescedEvents;
+                queuedEvents->last().event = WTF::move(touchEventWithCoalescedEvents);
                 queuedEvents->last().completionHandlers.append(WTF::move(completionHandler));
             } else
-                queuedEvents->append({ frameID, touchEvent, WTF::move(completionHandler) });
+                queuedEvents->append({ frameID, WTF::move(touchEvent), WTF::move(completionHandler) });
         }
     }
 
@@ -302,19 +303,19 @@ void EventDispatcher::dispatchTouchEvents()
     }
 }
 #elif ENABLE(COORDINATED_TOUCH_EVENTS)
-void EventDispatcher::dispatchTouchEventViaMainThread(WebCore::PageIdentifier pageID, const WebTouchEvent& touchEvent, CompletionHandler<void(WebEventType, bool)>&& completionHandler)
+void EventDispatcher::dispatchTouchEventViaMainThread(WebCore::PageIdentifier pageID, Ref<WebTouchEvent>&& touchEvent, CompletionHandler<void(WebEventType, bool)>&& completionHandler)
 {
-    RunLoop::mainSingleton().dispatch([protectedThis = Ref { *this }, pageID, touchEvent, completionHandler = WTF::move(completionHandler)] mutable {
+    RunLoop::mainSingleton().dispatch([protectedThis = Ref { *this }, pageID, touchEvent = WTF::move(touchEvent), completionHandler = WTF::move(completionHandler)] mutable {
         RefPtr webPage = WebProcess::singleton().webPage(pageID);
         bool handled = false;
         if (webPage)
-            handled = webPage->dispatchTouchEvent(touchEvent);
+            handled = webPage->dispatchTouchEvent(touchEvent.copyRef());
         if (completionHandler)
-            completionHandler(touchEvent.type(), handled);
+            completionHandler(touchEvent->type(), handled);
     });
 }
 
-void EventDispatcher::touchEvent(PageIdentifier pageID, FrameIdentifier frameID, const WebTouchEvent& touchEvent, CompletionHandler<void(WebEventType, bool)>&& completionHandler)
+void EventDispatcher::touchEvent(PageIdentifier pageID, FrameIdentifier frameID, Ref<WebTouchEvent>&& touchEvent, CompletionHandler<void(WebEventType, bool)>&& completionHandler)
 {
     RefPtr<WebCore::ThreadedScrollingTree> scrollingTree;
     {
@@ -323,29 +324,29 @@ void EventDispatcher::touchEvent(PageIdentifier pageID, FrameIdentifier frameID,
     }
 
     if (!scrollingTree) {
-        dispatchTouchEventViaMainThread(pageID, touchEvent, WTF::move(completionHandler));
+        dispatchTouchEventViaMainThread(pageID, WTF::move(touchEvent), WTF::move(completionHandler));
         return;
     }
 
     auto trackingType = scrollingTree->eventTrackingTypeForTouchEvent(platform(touchEvent));
 
     if (trackingType == TrackingType::NotTracking) {
-        completionHandler(touchEvent.type(), false);
+        completionHandler(touchEvent->type(), false);
         return;
     }
     if (trackingType == TrackingType::Asynchronous) {
-        completionHandler(touchEvent.type(), false);
-        dispatchTouchEventViaMainThread(pageID, touchEvent, nullptr);
+        completionHandler(touchEvent->type(), false);
+        dispatchTouchEventViaMainThread(pageID, WTF::move(touchEvent), nullptr);
         return;
     }
-    dispatchTouchEventViaMainThread(pageID, touchEvent, WTF::move(completionHandler));
+    dispatchTouchEventViaMainThread(pageID, WTF::move(touchEvent), WTF::move(completionHandler));
 }
 #endif
 
 void EventDispatcher::dispatchWheelEventViaMainThread(WebCore::PageIdentifier pageID, const WebWheelEvent& wheelEvent, OptionSet<WheelEventProcessingSteps> processingSteps, CompletionHandler<void(bool)>&& completionHandler)
 {
     ASSERT(!RunLoop::isMain());
-    RunLoop::mainSingleton().dispatch([this, protectedThis = Ref { *this }, pageID, wheelEvent, steps = processingSteps - WheelEventProcessingSteps::AsyncScrolling, completionHandler = WTF::move(completionHandler)] mutable {
+    RunLoop::mainSingleton().dispatch([this, protectedThis = Ref { *this }, pageID, wheelEvent = Ref<const WebWheelEvent> { wheelEvent }, steps = processingSteps - WheelEventProcessingSteps::AsyncScrolling, completionHandler = WTF::move(completionHandler)] mutable {
         dispatchWheelEvent(pageID, wheelEvent, steps, WTF::move(completionHandler));
     });
 }
diff --git a/Source/WebKit/WebProcess/WebPage/EventDispatcher.h b/Source/WebKit/WebProcess/WebPage/EventDispatcher.h
index 37debc2ad825..e55e9b49ddc6 100644
--- a/Source/WebKit/WebProcess/WebPage/EventDispatcher.h
+++ b/Source/WebKit/WebProcess/WebPage/EventDispatcher.h
@@ -71,13 +71,13 @@ struct RemoteWebTouchEvent;
 
 #if ENABLE(IOS_TOUCH_EVENTS)
 struct TouchEventData {
-    TouchEventData(WebCore::FrameIdentifier, const WebTouchEvent&, CompletionHandler<void(bool, std::optional<RemoteWebTouchEvent>)>&&);
+    TouchEventData(WebCore::FrameIdentifier, Ref<WebTouchEvent>&&, CompletionHandler<void(bool, std::optional<RemoteWebTouchEvent>)>&&);
     TouchEventData(TouchEventData&&);
     ~TouchEventData();
     TouchEventData& operator=(TouchEventData&&);
 
     WebCore::FrameIdentifier frameID;
-    WebTouchEvent event;
+    Ref<WebTouchEvent> event;
     Vector<CompletionHandler<void(bool, std::optional<RemoteWebTouchEvent>)>> completionHandlers;
 };
 #endif
@@ -119,18 +119,18 @@ class EventDispatcher final :
     void didReceiveMessage(IPC::Connection&, IPC::Decoder&) override;
 
     // Message handlers
-    void wheelEvent(WebCore::PageIdentifier, const WebWheelEvent&, WebCore::RectEdges<WebCore::RubberBandingBehavior> rubberBandableEdges, CompletionHandler<void(bool)>&&);
+    void wheelEvent(WebCore::PageIdentifier, Ref<WebWheelEvent>&&, WebCore::RectEdges<WebCore::RubberBandingBehavior> rubberBandableEdges, CompletionHandler<void(bool)>&&);
 #if ENABLE(MOMENTUM_EVENT_DISPATCHER)
     void setScrollingAccelerationCurve(WebCore::PageIdentifier, std::optional<ScrollingAccelerationCurve>&&);
 #endif
 #if ENABLE(IOS_TOUCH_EVENTS)
-    void touchEvent(WebCore::PageIdentifier, WebCore::FrameIdentifier, const WebTouchEvent&, CompletionHandler<void(bool, std::optional<RemoteWebTouchEvent>)>&&);
+    void touchEvent(WebCore::PageIdentifier, WebCore::FrameIdentifier, Ref<WebTouchEvent>&&, CompletionHandler<void(bool, std::optional<RemoteWebTouchEvent>)>&&);
 #elif ENABLE(COORDINATED_TOUCH_EVENTS)
-    void dispatchTouchEventViaMainThread(WebCore::PageIdentifier, const WebTouchEvent&, CompletionHandler<void(WebEventType, bool)>&&);
-    void touchEvent(WebCore::PageIdentifier, WebCore::FrameIdentifier, const WebTouchEvent&, CompletionHandler<void(WebEventType, bool)>&&);
+    void dispatchTouchEventViaMainThread(WebCore::PageIdentifier, Ref<WebTouchEvent>&&, CompletionHandler<void(WebEventType, bool)>&&);
+    void touchEvent(WebCore::PageIdentifier, WebCore::FrameIdentifier, Ref<WebTouchEvent>&&, CompletionHandler<void(WebEventType, bool)>&&);
 #endif
 #if ENABLE(MAC_GESTURE_EVENTS)
-    void gestureEvent(WebCore::FrameIdentifier, WebCore::PageIdentifier, const WebGestureEvent&, CompletionHandler<void(std::optional<WebEventType>, bool, std::optional<WebCore::RemoteUserInputEventData>)>&&);
+    void gestureEvent(WebCore::FrameIdentifier, WebCore::PageIdentifier, Ref<WebGestureEvent>&&, CompletionHandler<void(std::optional<WebEventType>, bool, std::optional<WebCore::RemoteUserInputEventData>)>&&);
 #endif
 
     // This is called on the main thread.
diff --git a/Source/WebKit/WebProcess/WebPage/EventDispatcher.messages.in b/Source/WebKit/WebProcess/WebPage/EventDispatcher.messages.in
index 4b04ee25c628..6185f20dfa7c 100644
--- a/Source/WebKit/WebProcess/WebPage/EventDispatcher.messages.in
+++ b/Source/WebKit/WebProcess/WebPage/EventDispatcher.messages.in
@@ -25,15 +25,15 @@
     DispatchedTo=WebContent
 ]
 messages -> EventDispatcher {
-    WheelEvent(WebCore::PageIdentifier pageID, WebKit::WebWheelEvent event, WebCore::RectEdges<WebCore::RubberBandingBehavior> rubberBandableEdges) -> (bool handled) AnyThread
+    WheelEvent(WebCore::PageIdentifier pageID, Ref<WebKit::WebWheelEvent> event, WebCore::RectEdges<WebCore::RubberBandingBehavior> rubberBandableEdges) -> (bool handled) AnyThread
 #if ENABLE(IOS_TOUCH_EVENTS)
-    TouchEvent(WebCore::PageIdentifier pageID, WebCore::FrameIdentifier frameID, WebKit::WebTouchEvent event) -> (bool handled, struct std::optional<WebKit::RemoteWebTouchEvent> transformedEvent) MainThreadCallback
+    TouchEvent(WebCore::PageIdentifier pageID, WebCore::FrameIdentifier frameID, Ref<WebKit::WebTouchEvent> event) -> (bool handled, struct std::optional<WebKit::RemoteWebTouchEvent> transformedEvent) MainThreadCallback
 #endif
 #if ENABLE(COORDINATED_TOUCH_EVENTS)
-    TouchEvent(WebCore::PageIdentifier pageID, WebCore::FrameIdentifier frameID, WebKit::WebTouchEvent event) -> (enum:uint32_t WebKit::WebEventType eventType, bool handled) AnyThread
+    TouchEvent(WebCore::PageIdentifier pageID, WebCore::FrameIdentifier frameID, Ref<WebKit::WebTouchEvent> event) -> (enum:uint32_t WebKit::WebEventType eventType, bool handled) AnyThread
 #endif
 #if ENABLE(MAC_GESTURE_EVENTS)
-    GestureEvent(WebCore::FrameIdentifier frameID, WebCore::PageIdentifier pageID, WebKit::WebGestureEvent event) -> (enum:uint32_t std::optional<WebKit::WebEventType> eventType, bool handled, struct std::optional<WebCore::RemoteUserInputEventData> remoteUserInputEventData) MainThreadCallback
+    GestureEvent(WebCore::FrameIdentifier frameID, WebCore::PageIdentifier pageID, Ref<WebKit::WebGestureEvent> event) -> (enum:uint32_t std::optional<WebKit::WebEventType> eventType, bool handled, struct std::optional<WebCore::RemoteUserInputEventData> remoteUserInputEventData) MainThreadCallback
 #endif
 #if HAVE(DISPLAY_LINK)
     DisplayDidRefresh(uint32_t displayID, struct WebCore::DisplayUpdate update, bool sendToMainThread)
diff --git a/Source/WebKit/WebProcess/WebPage/IPCTestingAPI.cpp b/Source/WebKit/WebProcess/WebPage/IPCTestingAPI.cpp
index de6583625dc1..ec457be3aefc 100644
--- a/Source/WebKit/WebProcess/WebPage/IPCTestingAPI.cpp
+++ b/Source/WebKit/WebProcess/WebPage/IPCTestingAPI.cpp
@@ -63,6 +63,13 @@
 #include <WebCore/RegistrableDomain.h>
 #include <WebCore/ScriptController.h>
 #include <WebCore/SharedMemory.h>
+#if USE(SKIA)
+#include <WebCore/DestinationColorSpace.h>
+#include <WebCore/SkiaSpanExtras.h>
+WTF_IGNORE_WARNINGS_IN_THIRD_PARTY_CODE_BEGIN
+#include <skia/core/SkColorSpace.h>
+WTF_IGNORE_WARNINGS_IN_THIRD_PARTY_CODE_END
+#endif
 #include <wtf/PageBlock.h>
 #include <wtf/RefCountedAndCanMakeWeakPtr.h>
 #include <wtf/Scope.h>
@@ -433,6 +440,7 @@ class JSIPC : public RefCountedAndCanMakeWeakPtr<JSIPC> {
     static JSValueRef createStreamClientConnection(JSContextRef, JSObjectRef, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception);
     static JSValueRef createSemaphore(JSContextRef, JSObjectRef, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception);
     static JSValueRef createSharedMemory(JSContextRef, JSObjectRef, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception);
+    static JSValueRef serializedSRGBColorSpace(JSContextRef, JSObjectRef, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception);
     static JSValueRef addTesterReceiver(JSContextRef, JSObjectRef, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception);
     static JSValueRef removeTesterReceiver(JSContextRef, JSObjectRef, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception);
 
@@ -1895,6 +1903,7 @@ const JSStaticFunction* JSIPC::staticFunctions()
         { "createStreamClientConnection", createStreamClientConnection, kJSPropertyAttributeDontDelete | kJSPropertyAttributeReadOnly },
         { "createSemaphore", createSemaphore, kJSPropertyAttributeDontDelete | kJSPropertyAttributeReadOnly },
         { "createSharedMemory", createSharedMemory, kJSPropertyAttributeDontDelete | kJSPropertyAttributeReadOnly },
+        { "serializedSRGBColorSpace", serializedSRGBColorSpace, kJSPropertyAttributeDontDelete | kJSPropertyAttributeReadOnly },
         { "addTesterReceiver", addTesterReceiver, kJSPropertyAttributeDontDelete | kJSPropertyAttributeReadOnly },
         { "removeTesterReceiver", removeTesterReceiver, kJSPropertyAttributeDontDelete | kJSPropertyAttributeReadOnly },
         { 0, 0, 0 }
@@ -2689,6 +2698,35 @@ JSValueRef JSIPC::createSharedMemory(JSContextRef context, JSObjectRef, JSObject
     return JSSharedMemory::create(*size)->createJSWrapper(context);
 }
 
+JSValueRef JSIPC::serializedSRGBColorSpace(JSContextRef context, JSObjectRef, JSObjectRef thisObject, size_t, const JSValueRef[], JSValueRef* exception)
+{
+    if (!toWrapped(context, thisObject)) {
+        *exception = createTypeError(context, "Wrong type"_s);
+        return JSValueMakeUndefined(context);
+    }
+
+#if USE(SKIA)
+    auto* globalObject = toJS(context);
+    auto& vm = globalObject->vm();
+    JSC::JSLockHolder lock(vm);
+    auto scope = DECLARE_TOP_EXCEPTION_SCOPE(vm);
+
+    sk_sp<SkData> data = WebCore::DestinationColorSpace::SRGB().serializableColorSpace()->serialize();
+    auto bytes = WebCore::span(data);
+
+    JSC::JSObject* array = JSC::constructEmptyArray(globalObject, nullptr);
+    RETURN_IF_EXCEPTION(scope, JSValueMakeUndefined(context));
+    for (size_t i = 0; i < bytes.size(); ++i) {
+        array->putDirectIndex(globalObject, i, JSC::jsNumber(bytes[i]));
+        RETURN_IF_EXCEPTION(scope, JSValueMakeUndefined(context));
+    }
+    return toRef(vm, array);
+#else
+    *exception = createTypeError(context, "serializedSRGBColorSpace is only available on Skia ports"_s);
+    return JSValueMakeUndefined(context);
+#endif
+}
+
 JSValueRef JSIPC::addTesterReceiver(JSContextRef context, JSObjectRef, JSObjectRef thisObject, size_t, const JSValueRef[], JSValueRef* exception)
 {
     auto* globalObject = toJS(context);
diff --git a/Source/WebKit/WebProcess/WebPage/MomentumEventDispatcher.cpp b/Source/WebKit/WebProcess/WebPage/MomentumEventDispatcher.cpp
index 2304d4ebe292..3c04c77d3a3b 100644
--- a/Source/WebKit/WebProcess/WebPage/MomentumEventDispatcher.cpp
+++ b/Source/WebKit/WebProcess/WebPage/MomentumEventDispatcher.cpp
@@ -75,7 +75,7 @@ bool MomentumEventDispatcher::eventShouldStartSyntheticMomentumPhase(WebCore::Pa
 bool MomentumEventDispatcher::handleWheelEvent(WebCore::PageIdentifier pageIdentifier, const WebWheelEvent& event, WebCore::RectEdges<WebCore::RubberBandingBehavior> rubberBandableEdges)
 {
     m_lastRubberBandableEdges = rubberBandableEdges;
-    m_lastIncomingEvent = event;
+    m_lastIncomingEvent = &event;
 
     bool isMomentumEvent = event.isMomentumEvent();
 
@@ -169,7 +169,7 @@ void MomentumEventDispatcher::dispatchSyntheticMomentumEvent(WebWheelEvent::Phas
     ASSERT(m_currentGesture.active);
     ASSERT(m_currentGesture.initiatingEvent);
 
-    CheckedRef initiatingEvent = *m_currentGesture.initiatingEvent;
+    Ref<const WebWheelEvent> initiatingEvent = *m_currentGesture.initiatingEvent;
     auto appKitScrollMultiplier = appKitScrollMultiplierForEvent(initiatingEvent);
     auto appKitAcceleratedDelta = delta * appKitScrollMultiplier;
     auto wheelTicks = appKitAcceleratedDelta / WebCore::Scrollbar::pixelsPerLineStep();
@@ -177,23 +177,23 @@ void MomentumEventDispatcher::dispatchSyntheticMomentumEvent(WebWheelEvent::Phas
 
     // FIXME: Ideally we would stick legitimate rawPlatformDeltas on the event,
     // but currently nothing will consume them, and we'd have to keep track of them separately.
-    WebWheelEvent syntheticEvent(
-        { WebEventType::Wheel, m_lastIncomingEvent->modifiers(), time },
-        initiatingEvent->position(),
-        initiatingEvent->globalPosition(),
-        appKitAcceleratedDelta,
-        wheelTicks,
-        WebWheelEvent::Granularity::ScrollByPixelWheelEvent,
-        initiatingEvent->directionInvertedFromDevice(),
-        WebWheelEvent::Phase::None,
-        phase,
-        true,
-        initiatingEvent->scrollCount(),
-        delta,
-        time,
-        { },
-        WebWheelEvent::MomentumEndType::Unknown,
-        initiatingEvent->inputSource());
+    Ref syntheticEvent = WebWheelEvent::create({ WebEventType::Wheel, m_lastIncomingEvent->modifiers(), time }, {
+        .position = initiatingEvent->position(),
+        .globalPosition = initiatingEvent->globalPosition(),
+        .delta = appKitAcceleratedDelta,
+        .wheelTicks = wheelTicks,
+        .granularity = WebWheelEvent::Granularity::ScrollByPixelWheelEvent,
+        .directionInvertedFromDevice = initiatingEvent->directionInvertedFromDevice(),
+        .phase = WebWheelEvent::Phase::None,
+        .momentumPhase = phase,
+        .hasPreciseScrollingDeltas = true,
+        .scrollCount = initiatingEvent->scrollCount(),
+        .unacceleratedScrollingDelta = delta,
+        .ioHIDEventTimestamp = time,
+        .rawPlatformDelta = { },
+        .momentumEndType = WebWheelEvent::MomentumEndType::Unknown,
+        .inputSource = initiatingEvent->inputSource(),
+    });
 
     m_client->handleSyntheticWheelEvent(*m_currentGesture.pageIdentifier, syntheticEvent, m_lastRubberBandableEdges);
 
@@ -214,7 +214,7 @@ void MomentumEventDispatcher::didStartMomentumPhase(WebCore::PageIdentifier page
     m_currentGesture.active = true;
     m_currentGesture.momentumCurve = event.inputSource() == WebEventInputSource::Automation ? MomentumCurve::Simple : MomentumCurve::Default;
     m_currentGesture.pageIdentifier = pageIdentifier;
-    m_currentGesture.initiatingEvent = event;
+    m_currentGesture.initiatingEvent = &event;
     m_currentGesture.currentOffset = { };
     m_currentGesture.startTime = MonotonicTime::now();
     m_currentGesture.displayNominalFrameRate = displayProperties->nominalFrameRate;
diff --git a/Source/WebKit/WebProcess/WebPage/MomentumEventDispatcher.h b/Source/WebKit/WebProcess/WebPage/MomentumEventDispatcher.h
index acbac0e3a420..265d9a090dc4 100644
--- a/Source/WebKit/WebProcess/WebPage/MomentumEventDispatcher.h
+++ b/Source/WebKit/WebProcess/WebPage/MomentumEventDispatcher.h
@@ -153,7 +153,7 @@ class MomentumEventDispatcher {
     HistoricalDeltas m_deltaHistoryY;
 
     Markable<MonotonicTime> m_lastScrollTimestamp;
-    std::optional<WebWheelEvent> m_lastIncomingEvent;
+    RefPtr<const WebWheelEvent> m_lastIncomingEvent;
     WebCore::RectEdges<WebCore::RubberBandingBehavior> m_lastRubberBandableEdges;
     bool m_isInOverriddenPlatformMomentumGesture { false };
 
@@ -164,7 +164,7 @@ class MomentumEventDispatcher {
 
         Markable<WebCore::PageIdentifier> pageIdentifier;
         std::optional<ScrollingAccelerationCurve> accelerationCurve;
-        std::optional<WebWheelEvent> initiatingEvent;
+        RefPtr<const WebWheelEvent> initiatingEvent;
 
         WebCore::FloatSize currentOffset;
         MonotonicTime startTime;
diff --git a/Source/WebKit/WebProcess/WebPage/RemoteLayerTree/PlatformCAAnimationRemote.mm b/Source/WebKit/WebProcess/WebPage/RemoteLayerTree/PlatformCAAnimationRemote.mm
index d14df7ecb5c5..088140e78370 100644
--- a/Source/WebKit/WebProcess/WebPage/RemoteLayerTree/PlatformCAAnimationRemote.mm
+++ b/Source/WebKit/WebProcess/WebPage/RemoteLayerTree/PlatformCAAnimationRemote.mm
@@ -506,7 +506,7 @@ - (void)animationDidStop:(CAAnimation *)animation finished:(BOOL)finished
         }
 
         if (properties.timingFunctions.size())
-            [basicAnimation setTimingFunction:toCAMediaTimingFunction(properties.timingFunctions[0].get(), properties.reverseTimingFunctions).get()];
+            [basicAnimation setTimingFunction:toCAMediaTimingFunction(protect(properties.timingFunctions[0]), properties.reverseTimingFunctions).get()];
 
         caAnimation = WTF::move(basicAnimation);
         break;
@@ -697,7 +697,7 @@ static void addAnimationToLayer(CALayer *layer, RemoteLayerTreeHost* layerTreeHo
             ts.dumpProperty("time"_s, animation.keyTimes[i]);
 
         if (i < animation.timingFunctions.size())
-            ts.dumpProperty<const TimingFunction&>("timing function"_s, animation.timingFunctions[i]);
+            ts.dumpProperty<const TimingFunction&>("timing function"_s, protect(animation.timingFunctions[i]));
 
         if (i < animation.keyValues.size()) {
             ts.startGroup();
diff --git a/Source/WebKit/WebProcess/WebPage/RemoteLayerTree/RemoteLayerTreeDrawingArea.mm b/Source/WebKit/WebProcess/WebPage/RemoteLayerTree/RemoteLayerTreeDrawingArea.mm
index 9b689a005b63..6b76dc9ebd38 100644
--- a/Source/WebKit/WebProcess/WebPage/RemoteLayerTree/RemoteLayerTreeDrawingArea.mm
+++ b/Source/WebKit/WebProcess/WebPage/RemoteLayerTree/RemoteLayerTreeDrawingArea.mm
@@ -572,10 +572,10 @@
         if (displayDidRefreshIsPending())
             return true;
 
-        callOnMainRunLoop([self = WeakPtr { this }] () {
-            if (self) {
-                self->m_isScheduled = false;
-                self->triggerRenderingUpdate();
+        callOnMainRunLoop([weakThis = WeakPtr { *this }] () {
+            if (RefPtr protectedThis = weakThis) {
+                protectedThis->m_isScheduled = false;
+                protectedThis->triggerRenderingUpdate();
             }
         });
     } else
diff --git a/Source/WebKit/WebProcess/WebPage/RemoteLayerTree/RemoteScrollingCoordinator.mm b/Source/WebKit/WebProcess/WebPage/RemoteLayerTree/RemoteScrollingCoordinator.mm
index d3133a893216..5fe614300259 100644
--- a/Source/WebKit/WebProcess/WebPage/RemoteLayerTree/RemoteScrollingCoordinator.mm
+++ b/Source/WebKit/WebProcess/WebPage/RemoteLayerTree/RemoteScrollingCoordinator.mm
@@ -59,7 +59,7 @@
 WTF_MAKE_TZONE_ALLOCATED_IMPL(RemoteScrollingCoordinator);
 
 RemoteScrollingCoordinator::RemoteScrollingCoordinator(WebPage* page)
-    : AsyncScrollingCoordinator(page->corePage())
+    : AsyncScrollingCoordinator(protect(page->corePage()))
     , m_webPage(page)
     , m_pageIdentifier(page->identifier())
 {
diff --git a/Source/WebKit/WebProcess/WebPage/WebCookieCache.cpp b/Source/WebKit/WebProcess/WebPage/WebCookieCache.cpp
index f7d1047ecaaa..2d6f9c204608 100644
--- a/Source/WebKit/WebProcess/WebPage/WebCookieCache.cpp
+++ b/Source/WebKit/WebProcess/WebPage/WebCookieCache.cpp
@@ -75,7 +75,7 @@ String WebCookieCache::cookiesForDOM(const URL& firstParty, const SameSiteInfo&
         if (!hasCacheForHost)
             protect(WebProcess::singleton().cookieJar())->addChangeListenerWithAccess(url, firstParty, frameID, pageID, webPageProxyID, *this);
 #endif
-        auto sendResult = WebProcess::singleton().ensureNetworkProcessConnection().connection().sendSync(Messages::NetworkConnectionToWebProcess::DomCookiesForHost(url), 0);
+        auto sendResult = protect(WebProcess::singleton().ensureNetworkProcessConnection().connection())->sendSync(Messages::NetworkConnectionToWebProcess::DomCookiesForHost(url), 0);
         if (!sendResult.succeeded())
             return { };
 
diff --git a/Source/WebKit/WebProcess/WebPage/WebCookieJar.cpp b/Source/WebKit/WebProcess/WebPage/WebCookieJar.cpp
index 7768b414032e..8d712f6d4fd5 100644
--- a/Source/WebKit/WebProcess/WebPage/WebCookieJar.cpp
+++ b/Source/WebKit/WebProcess/WebPage/WebCookieJar.cpp
@@ -154,7 +154,7 @@ String WebCookieJar::cookies(WebCore::Document& document, const URL& url) const
     if (isEligibleForCache(*webFrame, document.firstPartyForCookies(), url))
         return m_cache->cookiesForDOM(document.firstPartyForCookies(), sameSiteInfo, url, frameID, pageID, webPageProxyID, includeSecureCookies);
 
-    auto sendResult = WebProcess::singleton().ensureNetworkProcessConnection().connection().sendSync(Messages::NetworkConnectionToWebProcess::CookiesForDOM(document.firstPartyForCookies(), sameSiteInfo, url, frameID, pageID, includeSecureCookies, webPageProxyID), 0);
+    auto sendResult = protect(WebProcess::singleton().ensureNetworkProcessConnection().connection())->sendSync(Messages::NetworkConnectionToWebProcess::CookiesForDOM(document.firstPartyForCookies(), sameSiteInfo, url, frameID, pageID, includeSecureCookies, webPageProxyID), 0);
     auto [cookieString, secureCookiesAccessed] = sendResult.takeReplyOr(String { }, false);
 
     return cookieString;
@@ -181,7 +181,7 @@ void WebCookieJar::setCookies(WebCore::Document& document, const URL& url, const
     if (isEligibleForCache(*webFrame, document.firstPartyForCookies(), url))
         m_cache->setCookiesFromDOM(document.firstPartyForCookies(), sameSiteInfo, url, frameID, pageID, cookieString, shouldRelaxThirdPartyCookieBlocking(webFrame.get()));
 
-    WebProcess::singleton().ensureNetworkProcessConnection().connection().send(Messages::NetworkConnectionToWebProcess::SetCookiesFromDOM(document.firstPartyForCookies(), sameSiteInfo, url, frameID, pageID, cookieString, requiresPrivacyProtections, page->webPageProxyIdentifier()), 0);
+    protect(WebProcess::singleton().ensureNetworkProcessConnection().connection())->send(Messages::NetworkConnectionToWebProcess::SetCookiesFromDOM(document.firstPartyForCookies(), sameSiteInfo, url, frameID, pageID, cookieString, requiresPrivacyProtections, page->webPageProxyIdentifier()), 0);
 }
 
 void WebCookieJar::cookiesAdded(const String& host, Vector<WebCore::Cookie>&& cookies)
@@ -255,7 +255,7 @@ bool WebCookieJar::remoteCookiesEnabledSync(Document& document) const
         return false;
 
     std::optional<FrameIdentifier> frameID = webFrame ? std::make_optional(webFrame->frameID()) : std::nullopt;
-    auto sendResult = WebProcess::singleton().ensureNetworkProcessConnection().connection().sendSync(Messages::NetworkConnectionToWebProcess::CookiesEnabledSync(document.firstPartyForCookies(), cookieURL, frameID, page->identifier(), page->webPageProxyIdentifier()), 0);
+    auto sendResult = protect(WebProcess::singleton().ensureNetworkProcessConnection().connection())->sendSync(Messages::NetworkConnectionToWebProcess::CookiesEnabledSync(document.firstPartyForCookies(), cookieURL, frameID, page->identifier(), page->webPageProxyIdentifier()), 0);
 
     auto [result] = sendResult.takeReplyOr(false);
     return result;
@@ -276,7 +276,7 @@ void WebCookieJar::remoteCookiesEnabled(const Document& document, CompletionHand
         return completionHandler(false);
 
     std::optional<FrameIdentifier> frameID = webFrame ? std::make_optional(webFrame->frameID()) : std::nullopt;
-    WebProcess::singleton().ensureNetworkProcessConnection().connection().sendWithAsyncReply(Messages::NetworkConnectionToWebProcess::CookiesEnabled(document.firstPartyForCookies(), cookieURL, frameID, page->identifier(), page->webPageProxyIdentifier()), WTF::move(completionHandler));
+    protect(WebProcess::singleton().ensureNetworkProcessConnection().connection())->sendWithAsyncReply(Messages::NetworkConnectionToWebProcess::CookiesEnabled(document.firstPartyForCookies(), cookieURL, frameID, page->identifier(), page->webPageProxyIdentifier()), WTF::move(completionHandler));
 }
 
 std::pair<String, WebCore::SecureCookiesAccessed> WebCookieJar::cookieRequestHeaderFieldValue(const URL&, const WebCore::SameSiteInfo&, const URL&, std::optional<FrameIdentifier>, std::optional<PageIdentifier>, WebCore::IncludeSecureCookies) const
@@ -288,7 +288,7 @@ std::pair<String, WebCore::SecureCookiesAccessed> WebCookieJar::cookieRequestHea
 
 std::optional<SHA1::Digest> WebCookieJar::cookieRequestHeaderFieldValueDigest(const URL& firstParty, const WebCore::SameSiteInfo& sameSiteInfo, const URL& url, WebCore::IncludeSecureCookies includeSecureCookies) const
 {
-    auto sendResult = WebProcess::singleton().ensureNetworkProcessConnection().connection().sendSync(Messages::NetworkConnectionToWebProcess::CookieRequestHeaderFieldValueDigest(firstParty, sameSiteInfo, url, includeSecureCookies), 0);
+    auto sendResult = protect(WebProcess::singleton().ensureNetworkProcessConnection().connection())->sendSync(Messages::NetworkConnectionToWebProcess::CookieRequestHeaderFieldValueDigest(firstParty, sameSiteInfo, url, includeSecureCookies), 0);
     if (!sendResult.succeeded())
         return std::nullopt;
 
@@ -305,7 +305,7 @@ bool WebCookieJar::getRawCookies(WebCore::Document& document, const URL& url, Ve
     auto frameID = webFrame ? std::make_optional(webFrame->frameID()) : std::nullopt;
     auto pageID = webFrame && webFrame->page() ? std::make_optional(webFrame->page()->identifier()) : std::nullopt;
     auto webPageProxyID = webFrame && webFrame->page() ? std::make_optional(webFrame->page()->webPageProxyIdentifier()) : std::nullopt;
-    auto sendResult = WebProcess::singleton().ensureNetworkProcessConnection().connection().sendSync(Messages::NetworkConnectionToWebProcess::GetRawCookies(document.firstPartyForCookies(), sameSiteInfo(document), url, frameID, pageID, webPageProxyID), 0);
+    auto sendResult = protect(WebProcess::singleton().ensureNetworkProcessConnection().connection())->sendSync(Messages::NetworkConnectionToWebProcess::GetRawCookies(document.firstPartyForCookies(), sameSiteInfo(document), url, frameID, pageID, webPageProxyID), 0);
     if (!sendResult.succeeded())
         return false;
 
@@ -315,12 +315,12 @@ bool WebCookieJar::getRawCookies(WebCore::Document& document, const URL& url, Ve
 
 void WebCookieJar::setRawCookie(const WebCore::Document& document, const Cookie& cookie, ShouldPartitionCookie shouldPartitionCookie)
 {
-    WebProcess::singleton().ensureNetworkProcessConnection().connection().send(Messages::NetworkConnectionToWebProcess::SetRawCookie(document.firstPartyForCookies(), document.cookieURL(), cookie, shouldPartitionCookie), 0);
+    protect(WebProcess::singleton().ensureNetworkProcessConnection().connection())->send(Messages::NetworkConnectionToWebProcess::SetRawCookie(document.firstPartyForCookies(), document.cookieURL(), cookie, shouldPartitionCookie), 0);
 }
 
 void WebCookieJar::deleteCookie(const WebCore::Document& document, const URL& url, const String& cookieName, CompletionHandler<void()>&& completionHandler)
 {
-    WebProcess::singleton().ensureNetworkProcessConnection().connection().sendWithAsyncReply(Messages::NetworkConnectionToWebProcess::DeleteCookie(document.firstPartyForCookies(), url, cookieName), WTF::move(completionHandler));
+    protect(WebProcess::singleton().ensureNetworkProcessConnection().connection())->sendWithAsyncReply(Messages::NetworkConnectionToWebProcess::DeleteCookie(document.firstPartyForCookies(), url, cookieName), WTF::move(completionHandler));
 }
 
 void WebCookieJar::getCookiesAsync(WebCore::Document& document, const URL& url, const WebCore::CookieStoreGetOptions& options, CompletionHandler<void(std::optional<Vector<WebCore::Cookie>>&&)>&& completionHandler) const
@@ -343,7 +343,7 @@ void WebCookieJar::getCookiesAsync(WebCore::Document& document, const URL& url,
     auto frameID = webFrame ? std::make_optional(webFrame->frameID()) : std::nullopt;
     auto pageID = webFrame && webFrame->page() ? std::make_optional(webFrame->page()->identifier()) : std::nullopt;
     auto webPageProxyID = webFrame && webFrame->page() ? std::make_optional(webFrame->page()->webPageProxyIdentifier()) : std::nullopt;
-    WebProcess::singleton().ensureNetworkProcessConnection().connection().sendWithAsyncReply(Messages::NetworkConnectionToWebProcess::CookiesForDOMAsync(document.firstPartyForCookies(), sameSiteInfo, url, frameID, pageID, includeSecureCookies, options, webPageProxyID), WTF::move(completionHandler));
+    protect(WebProcess::singleton().ensureNetworkProcessConnection().connection())->sendWithAsyncReply(Messages::NetworkConnectionToWebProcess::CookiesForDOMAsync(document.firstPartyForCookies(), sameSiteInfo, url, frameID, pageID, includeSecureCookies, options, webPageProxyID), WTF::move(completionHandler));
 }
 
 void WebCookieJar::setCookieAsync(WebCore::Document& document, const URL& url, const WebCore::Cookie& cookie, CompletionHandler<void(bool)>&& completionHandler) const
@@ -381,7 +381,7 @@ void WebCookieJar::setCookieAsync(WebCore::Document& document, const URL& url, c
         completionHandler(success);
     };
 
-    WebProcess::singleton().ensureNetworkProcessConnection().connection().sendWithAsyncReply(Messages::NetworkConnectionToWebProcess::SetCookieFromDOMAsync(document.firstPartyForCookies(), sameSiteInfo, url, frameID, pageID, cookie, requiresPrivacyProtections, webPageProxyIdentifier), WTF::move(completionHandlerWrapper));
+    protect(WebProcess::singleton().ensureNetworkProcessConnection().connection())->sendWithAsyncReply(Messages::NetworkConnectionToWebProcess::SetCookieFromDOMAsync(document.firstPartyForCookies(), sameSiteInfo, url, frameID, pageID, cookie, requiresPrivacyProtections, webPageProxyIdentifier), WTF::move(completionHandlerWrapper));
 }
 
 #if HAVE(COOKIE_CHANGE_LISTENER_API)
@@ -405,7 +405,7 @@ void WebCookieJar::addChangeListenerWithAccess(const URL& url, const URL& firstP
         listenersForHost.add(*listener);
     };
 
-    WebProcess::singleton().ensureNetworkProcessConnection().connection().sendWithAsyncReply(Messages::NetworkConnectionToWebProcess::SubscribeToCookieChangeNotifications(url, firstParty, frameID, pageID, webPageProxyID), WTF::move(completionHandler), 0, IPC::SendOption::DispatchMessageEvenWhenWaitingForSyncReply);
+    protect(WebProcess::singleton().ensureNetworkProcessConnection().connection())->sendWithAsyncReply(Messages::NetworkConnectionToWebProcess::SubscribeToCookieChangeNotifications(url, firstParty, frameID, pageID, webPageProxyID), WTF::move(completionHandler), 0, IPC::SendOption::DispatchMessageEvenWhenWaitingForSyncReply);
 }
 
 void WebCookieJar::addChangeListener(const WebCore::Document& document, const WebCore::CookieChangeListener& listener)
@@ -435,7 +435,7 @@ void WebCookieJar::removeChangeListener(const String& host, const WebCore::Cooki
         return;
 
     m_changeListeners.remove(it);
-    WebProcess::singleton().ensureNetworkProcessConnection().connection().send(Messages::NetworkConnectionToWebProcess::UnsubscribeFromCookieChangeNotifications(host), 0, IPC::SendOption::DispatchMessageEvenWhenWaitingForSyncReply);
+    protect(WebProcess::singleton().ensureNetworkProcessConnection().connection())->send(Messages::NetworkConnectionToWebProcess::UnsubscribeFromCookieChangeNotifications(host), 0, IPC::SendOption::DispatchMessageEvenWhenWaitingForSyncReply);
 }
 #endif
 
diff --git a/Source/WebKit/WebProcess/WebPage/WebFrame.cpp b/Source/WebKit/WebProcess/WebPage/WebFrame.cpp
index b94924189dc4..28cde143d473 100644
--- a/Source/WebKit/WebProcess/WebPage/WebFrame.cpp
+++ b/Source/WebKit/WebProcess/WebPage/WebFrame.cpp
@@ -780,7 +780,7 @@ void WebFrame::startDownload(const WebCore::ResourceRequest& request, const Stri
     std::optional<NavigatingToAppBoundDomain> isAppBound = NavigatingToAppBoundDomain::No;
     isAppBound = m_isNavigatingToAppBoundDomain;
     if (localFrame)
-        WebProcess::singleton().ensureNetworkProcessConnection().connection().send(Messages::NetworkConnectionToWebProcess::StartDownload(policyDownloadID, request, topOrigin, isAppBound, suggestedName, fromDownloadAttribute, localFrame->frameID(), localFrame->pageID()), 0);
+        protect(WebProcess::singleton().ensureNetworkProcessConnection().connection())->send(Messages::NetworkConnectionToWebProcess::StartDownload(policyDownloadID, request, topOrigin, isAppBound, suggestedName, fromDownloadAttribute, localFrame->frameID(), localFrame->pageID()), 0);
 }
 
 void WebFrame::convertMainResourceLoadToDownload(DocumentLoader* documentLoader, const ResourceRequest& request, const ResourceResponse& response)
diff --git a/Source/WebKit/WebProcess/WebPage/WebPage.cpp b/Source/WebKit/WebProcess/WebPage/WebPage.cpp
index 7c054752f606..b907a0785d3a 100644
--- a/Source/WebKit/WebProcess/WebPage/WebPage.cpp
+++ b/Source/WebKit/WebProcess/WebPage/WebPage.cpp
@@ -1453,7 +1453,7 @@ void WebPage::frameTreeSyncDataChangedInAnotherProcess(FrameIdentifier frameID,
             view->scrollTo(coreFrame->frameTreeSyncData().frameScrollPosition);
         break;
 
-    case FrameTreeSyncDataType::ChildrenFrameLayoutInfo:
+    case FrameTreeSyncDataType::FrameGeometry:
         updateChildFrameVisibleRectsFromParent(*coreFrame);
         break;
 
@@ -1465,8 +1465,7 @@ void WebPage::frameTreeSyncDataChangedInAnotherProcess(FrameIdentifier frameID,
     switch (dataType) {
     case FrameTreeSyncDataType::FrameRect:
     case FrameTreeSyncDataType::FrameScrollPosition:
-    case FrameTreeSyncDataType::FrameLayoutViewportRect:
-    case FrameTreeSyncDataType::ChildrenFrameLayoutInfo:
+    case FrameTreeSyncDataType::FrameGeometry:
         updatePDFHUDLocationsAfterRemoteFrameGeometryChange();
         break;
     default:
@@ -1495,7 +1494,7 @@ void WebPage::updateChildFrameVisibleRectsFromParent(WebCore::Frame& parentCoreF
     if (!m_page || !m_page->settings().siteIsolationEnabled())
         return;
 
-    auto& childrenInfo = parentCoreFrame.frameTreeSyncData().childrenFrameLayoutInfo;
+    auto& childrenInfo = parentCoreFrame.frameTreeSyncData().frameGeometry.childrenFrameLayoutInfo;
     if (childrenInfo.isEmpty())
         return;
 
@@ -4140,7 +4139,10 @@ class CurrentEvent {
     }
 
 private:
-    CheckedPtr<const WebEvent> m_previousCurrentEvent;
+    // Owning: the previous event is alive in an outer scope, and holding a reference is cheaper than
+    // a weak pointer here. g_currentEvent itself stays raw so that dispatching an event, which
+    // happens for every mouse move, does not touch a refcount.
+    RefPtr<const WebEvent> m_previousCurrentEvent;
 };
 
 #if ENABLE(CONTEXT_MENUS)
@@ -4181,8 +4183,9 @@ void WebPage::contextMenuForKeyEvent()
 }
 #endif
 
-void WebPage::mouseEvent(FrameIdentifier frameID, const WebMouseEvent& mouseEvent, std::optional<Vector<SandboxExtension::Handle>>&& sandboxExtensions, CompletionHandler<void(bool, std::optional<RemoteUserInputEventData>)>&& completionHandler)
+void WebPage::mouseEvent(FrameIdentifier frameID, Ref<WebMouseEvent>&& mouseEventRef, std::optional<Vector<SandboxExtension::Handle>>&& sandboxExtensions, CompletionHandler<void(bool, std::optional<RemoteUserInputEventData>)>&& completionHandler)
 {
+    const auto& mouseEvent = mouseEventRef.get();
     SetForScope userIsInteractingChange { m_userIsInteracting, true };
 
     m_internals->userActivity.impulse();
@@ -4307,8 +4310,9 @@ void WebPage::flushDeferredDidReceiveMouseEvent()
         info->completionHandler(info->handled, std::nullopt);
 }
 
-void WebPage::performHitTestForMouseEvent(const WebMouseEvent& event, CompletionHandler<void(WebHitTestResultData&&, OptionSet<WebEventModifier>)>&& completionHandler)
+void WebPage::performHitTestForMouseEvent(Ref<WebMouseEvent>&& eventRef, CompletionHandler<void(WebHitTestResultData&&, OptionSet<WebEventModifier>)>&& completionHandler)
 {
+    const auto& event = eventRef.get();
     auto modifiers = event.modifiers();
     RefPtr localMainFrame = dynamicDowncast<WebCore::LocalFrame>(corePage()->mainFrame());
     if (!localMainFrame || !localMainFrame->view())
@@ -4325,8 +4329,9 @@ void WebPage::performHitTestForMouseEvent(const WebMouseEvent& event, Completion
     completionHandler(WTF::move(hitTestResultData), modifiers);
 }
 
-void WebPage::handleWheelEvent(FrameIdentifier frameID, const WebWheelEvent& event, const OptionSet<WheelEventProcessingSteps>& processingSteps, std::optional<bool> willStartSwipe, CompletionHandler<void(std::optional<WebCore::ScrollingNodeID>, std::optional<WebCore::WheelScrollGestureState>, bool, std::optional<RemoteUserInputEventData>)>&& completionHandler)
+void WebPage::handleWheelEvent(FrameIdentifier frameID, Ref<WebWheelEvent>&& eventRef, const OptionSet<WheelEventProcessingSteps>& processingSteps, std::optional<bool> willStartSwipe, CompletionHandler<void(std::optional<WebCore::ScrollingNodeID>, std::optional<WebCore::WheelScrollGestureState>, bool, std::optional<RemoteUserInputEventData>)>&& completionHandler)
 {
+    const auto& event = eventRef.get();
 #if ENABLE(ASYNC_SCROLLING)
     RefPtr remoteScrollingCoordinator = dynamicDowncast<RemoteScrollingCoordinator>(scrollingCoordinator());
     if (remoteScrollingCoordinator)
@@ -4367,8 +4372,9 @@ std::pair<HandleUserInputEventResult, OptionSet<EventHandling>> WebPage::wheelEv
 }
 
 #if PLATFORM(IOS_FAMILY)
-void WebPage::dispatchWheelEventWithoutScrolling(FrameIdentifier frameID, const WebWheelEvent& wheelEvent, CompletionHandler<void(bool, std::optional<RemoteUserInputEventData>)>&& completionHandler)
+void WebPage::dispatchWheelEventWithoutScrolling(FrameIdentifier frameID, Ref<WebWheelEvent>&& wheelEventRef, CompletionHandler<void(bool, std::optional<RemoteUserInputEventData>)>&& completionHandler)
 {
+    const auto& wheelEvent = wheelEventRef.get();
 #if ENABLE(KINETIC_SCROLLING)
     RefPtr frame = WebProcess::singleton().webFrame(frameID);
     RefPtr localFrame = frame ? frame->coreLocalFrame() : nullptr;
@@ -4383,8 +4389,9 @@ void WebPage::dispatchWheelEventWithoutScrolling(FrameIdentifier frameID, const
 }
 #endif
 
-void WebPage::keyEvent(FrameIdentifier frameID, const WebKeyboardEvent& keyboardEvent, CompletionHandler<void(bool)>&& completionHandler)
+void WebPage::keyEvent(FrameIdentifier frameID, Ref<WebKeyboardEvent>&& keyboardEventRef, CompletionHandler<void(bool)>&& completionHandler)
 {
+    const auto& keyboardEvent = keyboardEventRef.get();
     SetForScope userIsInteractingChange { m_userIsInteracting, true };
 
     m_internals->userActivity.impulse();
@@ -4572,8 +4579,9 @@ void WebPage::updatePotentialTapSecurityOrigin(const WebTouchEvent& touchEvent,
         m_potentialTapSecurityOrigin = targetDocument->securityOrigin();
 }
 #elif ENABLE(TOUCH_EVENTS)
-void WebPage::touchEvent(const WebTouchEvent& touchEvent, CompletionHandler<void(std::optional<WebEventType>, bool)>&& completionHandler)
+void WebPage::touchEvent(Ref<WebTouchEvent>&& touchEventRef, CompletionHandler<void(std::optional<WebEventType>, bool)>&& completionHandler)
 {
+    const auto& touchEvent = touchEventRef.get();
     RefPtr localMainFrame = this->localMainFrame();
     if (!localMainFrame)
         return;
@@ -4587,10 +4595,10 @@ void WebPage::touchEvent(const WebTouchEvent& touchEvent, CompletionHandler<void
 #endif
 
 #if ENABLE(COORDINATED_TOUCH_EVENTS)
-bool WebPage::dispatchTouchEvent(const WebTouchEvent& event)
+bool WebPage::dispatchTouchEvent(Ref<WebTouchEvent>&& event)
 {
     bool result = false;
-    touchEvent(event, [&](std::optional<WebEventType>, bool handled) {
+    touchEvent(WTF::move(event), [&](std::optional<WebEventType>, bool handled) {
         result = handled;
     });
     return result;
@@ -4778,7 +4786,7 @@ void WebPage::viewWillEndLiveResize()
         view->willEndLiveResize();
 }
 
-void WebPage::setInitialFocus(bool forward, bool isKeyboardEventValid, const std::optional<WebKeyboardEvent>& event, CompletionHandler<void()>&& completionHandler)
+void WebPage::setInitialFocus(bool forward, bool isKeyboardEventValid, RefPtr<WebKeyboardEvent>&& event, CompletionHandler<void()>&& completionHandler)
 {
     if (!m_page)
         return completionHandler();
@@ -4792,7 +4800,7 @@ void WebPage::setInitialFocus(bool forward, bool isKeyboardEventValid, const std
     protect(frame->document())->setFocusedElement(nullptr);
 
     if (isKeyboardEventValid && event && event->type() == WebEventType::KeyDown) {
-        PlatformKeyboardEvent platformEvent(platform(CheckedRef { *event }));
+        PlatformKeyboardEvent platformEvent(platform(*event));
         platformEvent.disambiguateKeyDownEvent(PlatformEvent::Type::RawKeyDown);
         focusController->setInitialFocus(forward ? FocusDirection::Forward : FocusDirection::Backward, &KeyboardEvent::create(platformEvent, &frame->windowProxy()).get());
         completionHandler();
@@ -5077,7 +5085,7 @@ KeyboardUIMode WebPage::keyboardUIMode()
     return static_cast<KeyboardUIMode>((fullKeyboardAccessEnabled ? KeyboardAccessFull : KeyboardAccessDefault) | (m_tabToLinks ? KeyboardAccessTabsToLinks : 0));
 }
 
-void WebPage::runJavaScript(WebFrame* frame, RunJavaScriptParameters&& parameters, ContentWorldIdentifier worldIdentifier, bool wantsResult, CompletionHandler<void(Expected<JavaScriptEvaluationResult, std::optional<WebCore::ExceptionDetails>>)>&& completionHandler)
+void WebPage::runJavaScript(WebFrame* frame, RunJavaScriptParameters&& parameters, ContentWorldIdentifier worldIdentifier, bool wantsResult, CompletionHandler<void(RunJavaScriptResult&&)>&& completionHandler)
 {
     // NOTE: We need to be careful when running scripts that the objects we depend on don't
     // disappear during script execution.
@@ -5164,7 +5172,7 @@ void WebPage::runJavaScript(WebFrame* frame, RunJavaScriptParameters&& parameter
     protect(protect(frame->coreLocalFrame())->script())->executeAsynchronousUserAgentScriptInWorld(protect(world->coreWorld()), WTF::move(coreParameters), WTF::move(resolveFunction));
 }
 
-void WebPage::runJavaScriptInFrameInScriptWorld(RunJavaScriptParameters&& parameters, std::optional<WebCore::FrameIdentifier> frameID, const ContentWorldData& worldData, bool wantsResult, CompletionHandler<void(Expected<JavaScriptEvaluationResult, std::optional<WebCore::ExceptionDetails>>)>&& completionHandler)
+void WebPage::runJavaScriptInFrameInScriptWorld(RunJavaScriptParameters&& parameters, std::optional<WebCore::FrameIdentifier> frameID, const ContentWorldData& worldData, bool wantsResult, CompletionHandler<void(RunJavaScriptResult&&)>&& completionHandler)
 {
     WEBPAGE_RELEASE_LOG(Process, "runJavaScriptInFrameInScriptWorld: frameID=%" PRIu64, frameID ? frameID->toUInt64() : 0);
     RefPtr webFrame = frameID ? WebProcess::singleton().webFrame(*frameID) : &mainWebFrame();
@@ -8648,7 +8656,7 @@ void WebPage::loadAndDecodeImage(WebCore::ResourceRequest&& request, std::option
         return completionHandler(makeUnexpected(decodeError(url)));
 
     request.setFirstPartyForCookies(page->mainFrameURL());
-    WebProcess::singleton().ensureNetworkProcessConnection().connection().sendWithAsyncReply(Messages::NetworkConnectionToWebProcess::LoadImageForDecoding(WTF::move(request), m_webPageProxyIdentifier, maximumBytesFromNetwork), [completionHandler = WTF::move(completionHandler), sizeConstraint, url] (Expected<Ref<WebCore::FragmentedSharedBuffer>, WebCore::ResourceError>&& result) mutable {
+    protect(WebProcess::singleton().ensureNetworkProcessConnection().connection())->sendWithAsyncReply(Messages::NetworkConnectionToWebProcess::LoadImageForDecoding(WTF::move(request), m_webPageProxyIdentifier, maximumBytesFromNetwork), [completionHandler = WTF::move(completionHandler), sizeConstraint, url] (Expected<Ref<WebCore::FragmentedSharedBuffer>, WebCore::ResourceError>&& result) mutable {
         if (!result)
             return completionHandler(makeUnexpected(WTF::move(result.error())));
 
@@ -9246,12 +9254,12 @@ void WebPage::hasStorageAccess(RegistrableDomain&& subFrameDomain, RegistrableDo
         return;
     }
 
-    WebProcess::singleton().ensureNetworkProcessConnection().connection().sendWithAsyncReply(Messages::NetworkConnectionToWebProcess::HasStorageAccess(WTF::move(subFrameDomain), WTF::move(topFrameDomain), frame.frameID(), m_identifier), WTF::move(completionHandler));
+    protect(WebProcess::singleton().ensureNetworkProcessConnection().connection())->sendWithAsyncReply(Messages::NetworkConnectionToWebProcess::HasStorageAccess(WTF::move(subFrameDomain), WTF::move(topFrameDomain), frame.frameID(), m_identifier), WTF::move(completionHandler));
 }
 
 void WebPage::requestStorageAccess(RegistrableDomain&& subFrameDomain, RegistrableDomain&& topFrameDomain, WebFrame& frame, StorageAccessScope scope, HasUserGestureOrNoUserGestureRequired hasUserGestureOrNoUserGestureRequired, CompletionHandler<void(WebCore::RequestStorageAccessResult)>&& completionHandler)
 {
-    WebProcess::singleton().ensureNetworkProcessConnection().connection().sendWithAsyncReply(Messages::NetworkConnectionToWebProcess::RequestStorageAccess(WTF::move(subFrameDomain), WTF::move(topFrameDomain), frame.frameID(), m_identifier, m_webPageProxyIdentifier, scope, hasUserGestureOrNoUserGestureRequired), [this, protectedThis = Ref { *this }, completionHandler = WTF::move(completionHandler), frame = Ref { frame }, pageID = m_identifier, frameID = frame.frameID()](RequestStorageAccessResult result) mutable {
+    protect(WebProcess::singleton().ensureNetworkProcessConnection().connection())->sendWithAsyncReply(Messages::NetworkConnectionToWebProcess::RequestStorageAccess(WTF::move(subFrameDomain), WTF::move(topFrameDomain), frame.frameID(), m_identifier, m_webPageProxyIdentifier, scope, hasUserGestureOrNoUserGestureRequired), [this, protectedThis = Ref { *this }, completionHandler = WTF::move(completionHandler), frame = Ref { frame }, pageID = m_identifier, frameID = frame.frameID()](RequestStorageAccessResult result) mutable {
         if (result.wasGranted == StorageAccessWasGranted::Yes) {
             switch (result.scope) {
             case StorageAccessScope::PerFrame:
@@ -9273,12 +9281,12 @@ void WebPage::setLoginStatus(RegistrableDomain&& domain, IsLoggedIn loggedInStat
     if (!page)
         return completionHandler();
     auto lastAuthentication = page->lastAuthentication() ? std::optional(*page->lastAuthentication()) : std::nullopt;
-    WebProcess::singleton().ensureNetworkProcessConnection().connection().sendWithAsyncReply(Messages::NetworkConnectionToWebProcess::SetLoginStatus(WTF::move(domain), loggedInStatus, lastAuthentication), WTF::move(completionHandler));
+    protect(WebProcess::singleton().ensureNetworkProcessConnection().connection())->sendWithAsyncReply(Messages::NetworkConnectionToWebProcess::SetLoginStatus(WTF::move(domain), loggedInStatus, lastAuthentication), WTF::move(completionHandler));
 }
 
 void WebPage::isLoggedIn(RegistrableDomain&& domain, CompletionHandler<void(bool)>&& completionHandler)
 {
-    WebProcess::singleton().ensureNetworkProcessConnection().connection().sendWithAsyncReply(Messages::NetworkConnectionToWebProcess::IsLoggedIn(WTF::move(domain)), WTF::move(completionHandler));
+    protect(WebProcess::singleton().ensureNetworkProcessConnection().connection())->sendWithAsyncReply(Messages::NetworkConnectionToWebProcess::IsLoggedIn(WTF::move(domain)), WTF::move(completionHandler));
 }
 
 void WebPage::addDomainWithPageLevelStorageAccess(const RegistrableDomain& topLevelDomain, const RegistrableDomain& resourceDomain)
@@ -10531,7 +10539,7 @@ void WebPage::useRedirectionForCurrentNavigation(WebCore::ResourceResponse&& res
 
     if (RefPtr resourceLoader = loader->mainResourceLoader()) {
         WEBPAGE_RELEASE_LOG(Loading, "WebPage::useRedirectionForCurrentNavigation to network process");
-        WebProcess::singleton().ensureNetworkProcessConnection().connection().send(Messages::NetworkConnectionToWebProcess::UseRedirectionForCurrentNavigation(*resourceLoader->identifier(), response), 0);
+        protect(WebProcess::singleton().ensureNetworkProcessConnection().connection())->send(Messages::NetworkConnectionToWebProcess::UseRedirectionForCurrentNavigation(*resourceLoader->identifier(), response), 0);
         return;
     }
 
diff --git a/Source/WebKit/WebProcess/WebPage/WebPage.h b/Source/WebKit/WebProcess/WebPage/WebPage.h
index 3d6f8b1c7a75..18638585acb3 100644
--- a/Source/WebKit/WebProcess/WebPage/WebPage.h
+++ b/Source/WebKit/WebProcess/WebPage/WebPage.h
@@ -29,6 +29,7 @@
 #include "MessageReceiver.h"
 #include "MessageSender.h"
 #include "RemoteSnapshotIdentifier.h"
+#include "RunJavaScriptResult.h"
 #include "SandboxExtension.h"
 #include <JavaScriptCore/InspectorFrontendChannel.h>
 #include <WebCore/BoxExtents.h>
@@ -1388,7 +1389,7 @@ class WebPage final : public API::ObjectImpl<API::Object::Type::BundlePage>, pub
     void readSelectionFromPasteboard(const String& pasteboardName, CompletionHandler<void(bool&&)>&&);
     void getStringSelectionForPasteboard(CompletionHandler<void(String&&)>&&);
     void getDataSelectionForPasteboard(const String pasteboardType, CompletionHandler<void(RefPtr<WebCore::SharedBuffer>&&)>&&);
-    void shouldDelayWindowOrderingEvent(const WebKit::WebMouseEvent&, CompletionHandler<void(bool)>&&);
+    void shouldDelayWindowOrderingEvent(Ref<WebKit::WebMouseEvent>&&, CompletionHandler<void(bool)>&&);
     bool performNonEditingBehaviorForSelector(const String&, WebCore::KeyboardEvent*);
 
 #if ENABLE(MULTI_REPRESENTATION_HEIC)
@@ -1407,7 +1408,7 @@ class WebPage final : public API::ObjectImpl<API::Object::Type::BundlePage>, pub
     void setCaretAnimatorType(WebCore::CaretAnimatorType);
     void setCaretBlinkingSuspended(bool);
     void attributedSubstringForCharacterRangeAsync(const EditingRange&, CompletionHandler<void(const WebCore::AttributedString&, const EditingRange&)>&&);
-    void requestAcceptsFirstMouse(int eventNumber, const WebKit::WebMouseEvent&);
+    void requestAcceptsFirstMouse(int eventNumber, Ref<WebKit::WebMouseEvent>&&);
 #endif
 
 #if PLATFORM(COCOA)
@@ -1557,7 +1558,7 @@ class WebPage final : public API::ObjectImpl<API::Object::Type::BundlePage>, pub
     void handleAlternativeTextUIResult(const String&);
 #endif
 
-    void handleWheelEvent(WebCore::FrameIdentifier, const WebWheelEvent&, const OptionSet<WebCore::WheelEventProcessingSteps>&, std::optional<bool> willStartSwipe, CompletionHandler<void(std::optional<WebCore::ScrollingNodeID>, std::optional<WebCore::WheelScrollGestureState>, bool handled, std::optional<WebCore::RemoteUserInputEventData>)>&&);
+    void handleWheelEvent(WebCore::FrameIdentifier, Ref<WebWheelEvent>&&, const OptionSet<WebCore::WheelEventProcessingSteps>&, std::optional<bool> willStartSwipe, CompletionHandler<void(std::optional<WebCore::ScrollingNodeID>, std::optional<WebCore::WheelScrollGestureState>, bool handled, std::optional<WebCore::RemoteUserInputEventData>)>&&);
     std::pair<WebCore::HandleUserInputEventResult, OptionSet<WebCore::EventHandling>> wheelEvent(const WebCore::FrameIdentifier&, const WebWheelEvent&, OptionSet<WebCore::WheelEventProcessingSteps>);
 
     void wheelEventHandlersChanged(bool);
@@ -1624,7 +1625,7 @@ class WebPage final : public API::ObjectImpl<API::Object::Type::BundlePage>, pub
 #if ENABLE(IOS_TOUCH_EVENTS)
     Expected<bool, WebCore::RemoteFrameGeometryTransformer> dispatchTouchEvent(WebCore::FrameIdentifier, const WebTouchEvent&);
 #elif ENABLE(COORDINATED_TOUCH_EVENTS)
-    bool dispatchTouchEvent(const WebTouchEvent&);
+    bool dispatchTouchEvent(Ref<WebTouchEvent>&&);
 #endif
 
     bool shouldUseCustomContentProviderForResponse(const WebCore::ResourceResponse&);
@@ -2031,7 +2032,7 @@ class WebPage final : public API::ObjectImpl<API::Object::Type::BundlePage>, pub
     void didAddOrRemoveViewportConstrainedObjects();
 
 #if PLATFORM(IOS_FAMILY)
-    void dispatchWheelEventWithoutScrolling(WebCore::FrameIdentifier, const WebWheelEvent&, CompletionHandler<void(bool, std::optional<WebCore::RemoteUserInputEventData>)>&&);
+    void dispatchWheelEventWithoutScrolling(WebCore::FrameIdentifier, Ref<WebWheelEvent>&&, CompletionHandler<void(bool, std::optional<WebCore::RemoteUserInputEventData>)>&&);
 #endif
 
 #if ENABLE(PDF_PLUGIN)
@@ -2382,7 +2383,7 @@ class WebPage final : public API::ObjectImpl<API::Object::Type::BundlePage>, pub
     void goToBackForwardItem(GoToBackForwardItemParameters&&);
     [[noreturn]] void NODELETE goToBackForwardItemWaitingForProcessLaunch(GoToBackForwardItemParameters&&, WebKit::WebPageProxyIdentifier);
     void tryRestoreScrollPosition();
-    void setInitialFocus(bool forward, bool isKeyboardEventValid, const std::optional<WebKeyboardEvent>&, CompletionHandler<void()>&&);
+    void setInitialFocus(bool forward, bool isKeyboardEventValid, RefPtr<WebKeyboardEvent>&&, CompletionHandler<void()>&&);
     void updateIsInWindow(bool isInitialState = false);
     void visibilityDidChange();
     void windowActivityDidChange();
@@ -2401,8 +2402,8 @@ class WebPage final : public API::ObjectImpl<API::Object::Type::BundlePage>, pub
 
     void setNeedsFontAttributes(bool);
 
-    void mouseEvent(WebCore::FrameIdentifier, const WebMouseEvent&, std::optional<Vector<SandboxExtensionHandle>>&& sandboxExtensions, CompletionHandler<void(bool handled, std::optional<WebCore::RemoteUserInputEventData>)>&&);
-    void keyEvent(WebCore::FrameIdentifier, const WebKeyboardEvent&, CompletionHandler<void(bool handled)>&&);
+    void mouseEvent(WebCore::FrameIdentifier, Ref<WebMouseEvent>&&, std::optional<Vector<SandboxExtensionHandle>>&& sandboxExtensions, CompletionHandler<void(bool handled, std::optional<WebCore::RemoteUserInputEventData>)>&&);
+    void keyEvent(WebCore::FrameIdentifier, Ref<WebKeyboardEvent>&&, CompletionHandler<void(bool handled)>&&);
 
     void setLastKnownMousePosition(WebCore::FrameIdentifier, const WebCore::DoublePoint&, const WebCore::DoublePoint&, std::optional<WebCore::LastKnownMousePositionSource>&& = std::nullopt);
 
@@ -2411,7 +2412,7 @@ class WebPage final : public API::ObjectImpl<API::Object::Type::BundlePage>, pub
     void didBeginTouchPoint(WebCore::FloatPoint locationInRootView);
     void updatePotentialTapSecurityOrigin(const WebTouchEvent&, bool wasHandled);
 #elif ENABLE(TOUCH_EVENTS)
-    void touchEvent(const WebTouchEvent&, CompletionHandler<void(std::optional<WebEventType>, bool)>&&);
+    void touchEvent(Ref<WebTouchEvent>&&, CompletionHandler<void(std::optional<WebEventType>, bool)>&&);
 #endif
 
     void cancelPointer(WebCore::PointerID, const WebCore::IntPoint&);
@@ -2474,8 +2475,8 @@ class WebPage final : public API::ObjectImpl<API::Object::Type::BundlePage>, pub
     void getContentsAsAttributedStringForFrames(const Vector<WebCore::FrameIdentifier>& frameIdentifiers, CompletionHandler<void(HashMap<WebCore::FrameIdentifier, WebCore::AttributedString>&&)>&&);
 #endif
     void getWebArchiveOfFrameWithFileName(WebCore::FrameIdentifier, const Vector<WebCore::MarkupExclusionRule>&, const String& fileName, CompletionHandler<void(const std::optional<IPC::SharedBufferReference>&)>&&);
-    void runJavaScript(WebFrame*, RunJavaScriptParameters&&, ContentWorldIdentifier, bool, CompletionHandler<void(Expected<JavaScriptEvaluationResult, std::optional<WebCore::ExceptionDetails>>)>&&);
-    void runJavaScriptInFrameInScriptWorld(RunJavaScriptParameters&&, std::optional<WebCore::FrameIdentifier>, const ContentWorldData&, bool, CompletionHandler<void(Expected<JavaScriptEvaluationResult, std::optional<WebCore::ExceptionDetails>>)>&&);
+    void runJavaScript(WebFrame*, RunJavaScriptParameters&&, ContentWorldIdentifier, bool, CompletionHandler<void(RunJavaScriptResult&&)>&&);
+    void runJavaScriptInFrameInScriptWorld(RunJavaScriptParameters&&, std::optional<WebCore::FrameIdentifier>, const ContentWorldData&, bool, CompletionHandler<void(RunJavaScriptResult&&)>&&);
     void clearContentWorld(ContentWorldIdentifier, CompletionHandler<void()>&&);
     void getAccessibilityTreeData(CompletionHandler<void(const std::optional<IPC::SharedBufferReference>&)>&&);
     void updateRenderingWithForcedRepaint(CompletionHandler<void()>&&);
@@ -2652,7 +2653,7 @@ class WebPage final : public API::ObjectImpl<API::Object::Type::BundlePage>, pub
     void handleAcceptedCandidate(WebCore::TextCheckingResult);
 #endif
 
-    void performHitTestForMouseEvent(const WebMouseEvent&, CompletionHandler<void(WebHitTestResultData&&, OptionSet<WebEventModifier>)>&&);
+    void performHitTestForMouseEvent(Ref<WebMouseEvent>&&, CompletionHandler<void(WebHitTestResultData&&, OptionSet<WebEventModifier>)>&&);
 
 #if PLATFORM(COCOA)
     void requestActiveNowPlayingSessionInfo(CompletionHandler<void(bool, WebCore::NowPlayingInfo&&)>&&);
diff --git a/Source/WebKit/WebProcess/WebPage/WebPage.messages.in b/Source/WebKit/WebProcess/WebPage/WebPage.messages.in
index cd260bdd1051..b03c94a9fc8c 100644
--- a/Source/WebKit/WebProcess/WebPage/WebPage.messages.in
+++ b/Source/WebKit/WebProcess/WebPage/WebPage.messages.in
@@ -26,7 +26,7 @@
     DispatchedTo=WebContent
 ]
 messages -> WebPage WantsAsyncDispatchMessage {
-    SetInitialFocus(bool forward, bool isKeyboardEventValid, std::optional<WebKit::WebKeyboardEvent> event) -> ()
+    SetInitialFocus(bool forward, bool isKeyboardEventValid, RefPtr<WebKit::WebKeyboardEvent> event) -> ()
     SetActivityState(OptionSet<WebCore::ActivityState> activityState, WebKit::ActivityStateChangeID activityStateChangeID) -> ()
 
     SetBackgroundColor(std::optional<WebCore::Color> color)
@@ -65,8 +65,8 @@ messages -> WebPage WantsAsyncDispatchMessage {
     ViewWillEndLiveResize()
 
     ExecuteEditCommandWithCallback(String name, String argument) -> ()
-    KeyEvent(WebCore::FrameIdentifier frameID, WebKit::WebKeyboardEvent event) -> (bool handled)
-    MouseEvent(WebCore::FrameIdentifier frameID, WebKit::WebMouseEvent event, std::optional<Vector<WebKit::SandboxExtensionHandle>> sandboxExtensions) -> (bool handled, struct std::optional<WebCore::RemoteUserInputEventData> remoteUserInputEventData)
+    KeyEvent(WebCore::FrameIdentifier frameID, Ref<WebKit::WebKeyboardEvent> event) -> (bool handled)
+    MouseEvent(WebCore::FrameIdentifier frameID, Ref<WebKit::WebMouseEvent> event, std::optional<Vector<WebKit::SandboxExtensionHandle>> sandboxExtensions) -> (bool handled, struct std::optional<WebCore::RemoteUserInputEventData> remoteUserInputEventData)
     SetLastKnownMousePosition(WebCore::FrameIdentifier frameID, WebCore::DoublePoint eventPoint, WebCore::DoublePoint globalPoint, enum:uint8_t std::optional<WebCore::LastKnownMousePositionSource> source);
 
 #if PLATFORM(COCOA)
@@ -186,7 +186,7 @@ messages -> WebPage WantsAsyncDispatchMessage {
     DidBeginTouchPoint(WebCore::FloatPoint locationInRootView)
 #endif
 #if !ENABLE(IOS_TOUCH_EVENTS) && ENABLE(TOUCH_EVENTS)
-    TouchEvent(WebKit::WebTouchEvent event) -> (enum:uint32_t std::optional<WebKit::WebEventType> eventType, bool handled)
+    TouchEvent(Ref<WebKit::WebTouchEvent> event) -> (enum:uint32_t std::optional<WebKit::WebEventType> eventType, bool handled)
 #endif
 
     CancelPointer(WebCore::PointerID pointerId, WebCore::IntPoint documentPoint)
@@ -596,7 +596,7 @@ messages -> WebPage WantsAsyncDispatchMessage {
     InsertMultiRepresentationHEIC(std::span<const uint8_t> data, String altText)
 #endif
 
-    ShouldDelayWindowOrderingEvent(WebKit::WebMouseEvent event) -> (bool result) Synchronous
+    ShouldDelayWindowOrderingEvent(Ref<WebKit::WebMouseEvent> event) -> (bool result) Synchronous
 
     SetTextAsync(String text)
 
@@ -620,7 +620,7 @@ messages -> WebPage WantsAsyncDispatchMessage {
 #endif
 #if PLATFORM(MAC)
     AttributedSubstringForCharacterRangeAsync(struct WebKit::EditingRange range) -> (struct WebCore::AttributedString string, struct WebKit::EditingRange range)
-    RequestAcceptsFirstMouse(int eventNumber, WebKit::WebMouseEvent event) AllowedWhenWaitingForSyncReplyDuringUnboundedIPC
+    RequestAcceptsFirstMouse(int eventNumber, Ref<WebKit::WebMouseEvent> event) AllowedWhenWaitingForSyncReplyDuringUnboundedIPC
     SetCaretAnimatorType(enum:uint8_t WebCore::CaretAnimatorType caretType)
     SetCaretBlinkingSuspended(bool blinkSuspended)
 #endif
@@ -695,7 +695,7 @@ messages -> WebPage WantsAsyncDispatchMessage {
 
     FlushDeferredDidReceiveMouseEvent()
 
-    PerformHitTestForMouseEvent(WebKit::WebMouseEvent event) -> (struct WebKit::WebHitTestResultData hitTestResult, OptionSet<WebKit::WebEventModifier> modifiers)
+    PerformHitTestForMouseEvent(Ref<WebKit::WebMouseEvent> event) -> (struct WebKit::WebHitTestResultData hitTestResult, OptionSet<WebKit::WebEventModifier> modifiers)
 
     SetUseColorAppearance(bool useDarkAppearance, bool useElevatedUserInterfaceLevel)
 
@@ -826,10 +826,10 @@ messages -> WebPage WantsAsyncDispatchMessage {
     CreateTextFragmentDirectiveFromSelection() -> (URL url)
     GetTextFragmentRanges() -> (Vector<WebKit::EditingRange> textFragmentEditingRanges)
 
-    HandleWheelEvent(WebCore::FrameIdentifier frameID, WebKit::WebWheelEvent event, OptionSet<WebCore::WheelEventProcessingSteps> processingSteps, std::optional<bool> willStartSwipe) -> (std::optional<WebCore::ScrollingNodeID> scrollingNodeID, enum:uint8_t std::optional<WebCore::WheelScrollGestureState> gestureState, bool handled, struct std::optional<WebCore::RemoteUserInputEventData> remoteUserInputEventData)
+    HandleWheelEvent(WebCore::FrameIdentifier frameID, Ref<WebKit::WebWheelEvent> event, OptionSet<WebCore::WheelEventProcessingSteps> processingSteps, std::optional<bool> willStartSwipe) -> (std::optional<WebCore::ScrollingNodeID> scrollingNodeID, enum:uint8_t std::optional<WebCore::WheelScrollGestureState> gestureState, bool handled, struct std::optional<WebCore::RemoteUserInputEventData> remoteUserInputEventData)
 
 #if PLATFORM(IOS_FAMILY)
-    DispatchWheelEventWithoutScrolling(WebCore::FrameIdentifier frameID, WebKit::WebWheelEvent event) -> (bool defaultPrevented, struct std::optional<WebCore::RemoteUserInputEventData> remoteUserInputEventData)
+    DispatchWheelEventWithoutScrolling(WebCore::FrameIdentifier frameID, Ref<WebKit::WebWheelEvent> event) -> (bool defaultPrevented, struct std::optional<WebCore::RemoteUserInputEventData> remoteUserInputEventData)
 #endif
 
     LastNavigationWasAppInitiated() -> (bool wasAppBound)
diff --git a/Source/WebKit/WebProcess/WebPage/ios/WebPageIOS.mm b/Source/WebKit/WebProcess/WebPage/ios/WebPageIOS.mm
index a3b2736ddbaa..c4b39991ece4 100644
--- a/Source/WebKit/WebProcess/WebPage/ios/WebPageIOS.mm
+++ b/Source/WebKit/WebProcess/WebPage/ios/WebPageIOS.mm
@@ -808,7 +808,7 @@ static inline FloatRect adjustExposedRectForNewScale(const FloatRect& exposedRec
     return [NSURLConnection canHandleRequest:nsRequest.get()];
 }
 
-void WebPage::shouldDelayWindowOrderingEvent(const WebKit::WebMouseEvent&, CompletionHandler<void(bool)>&& completionHandler)
+void WebPage::shouldDelayWindowOrderingEvent(Ref<WebKit::WebMouseEvent>&&, CompletionHandler<void(bool)>&& completionHandler)
 {
     notImplemented();
     completionHandler(false);
@@ -3926,12 +3926,15 @@ static bool selectionIsInsideFixedPositionContainer(LocalFrame& frame)
 }
 
 #if ENABLE(IOS_TOUCH_EVENTS)
-static std::optional<RemoteWebTouchEvent> transformEventIfNecessary(const Expected<bool, WebCore::RemoteFrameGeometryTransformer>& transformer, WebTouchEvent&& event)
+static std::optional<RemoteWebTouchEvent> transformEventIfNecessary(const Expected<bool, WebCore::RemoteFrameGeometryTransformer>& transformer, const WebTouchEvent& event)
 {
     if (transformer)
         return std::nullopt;
-    event.transformToRemoteFrameCoordinates(transformer.error());
-    return RemoteWebTouchEvent { transformer.error().remoteFrameID(), WTF::move(event) };
+    // A deep copy: transforming mutates the event and its coalesced/predicted children in place, and
+    // the event we were handed is shared with the queue and its completion handlers.
+    Ref transformedEvent = event.copy();
+    transformedEvent->transformToRemoteFrameCoordinates(transformer.error());
+    return RemoteWebTouchEvent { transformer.error().remoteFrameID(), WTF::move(transformedEvent) };
 }
 
 void WebPage::dispatchAsynchronousTouchEvents(UniqueRef<EventDispatcher::TouchEventQueue>&& queue)
@@ -3947,7 +3950,7 @@ static bool selectionIsInsideFixedPositionContainer(LocalFrame& frame)
             completionHandler(handled, std::nullopt);
 
         // The last handler corresponds to the event that was actually dispatched.
-        touchEventData.completionHandlers.last()(handled, transformEventIfNecessary(handleTouchEventResult, WTF::move(touchEventData.event)));
+        touchEventData.completionHandlers.last()(handled, transformEventIfNecessary(handleTouchEventResult, touchEventData.event));
     }
 }
 
diff --git a/Source/WebKit/WebProcess/WebPage/mac/TiledCoreAnimationScrollingCoordinator.mm b/Source/WebKit/WebProcess/WebPage/mac/TiledCoreAnimationScrollingCoordinator.mm
index e39594d40aae..2df3068b14cb 100644
--- a/Source/WebKit/WebProcess/WebPage/mac/TiledCoreAnimationScrollingCoordinator.mm
+++ b/Source/WebKit/WebProcess/WebPage/mac/TiledCoreAnimationScrollingCoordinator.mm
@@ -33,7 +33,7 @@
 namespace WebKit {
 
 TiledCoreAnimationScrollingCoordinator::TiledCoreAnimationScrollingCoordinator(WebPage* page)
-    : ScrollingCoordinatorMac(page->corePage())
+    : ScrollingCoordinatorMac(protect(page->corePage()))
     , m_page(page)
 {
 }
diff --git a/Source/WebKit/WebProcess/WebPage/mac/WebPageMac.mm b/Source/WebKit/WebProcess/WebPage/mac/WebPageMac.mm
index 9dbd15c9f8e0..a272581bfdf2 100644
--- a/Source/WebKit/WebProcess/WebPage/mac/WebPageMac.mm
+++ b/Source/WebKit/WebProcess/WebPage/mac/WebPageMac.mm
@@ -594,8 +594,9 @@ static String commandNameForSelectorName(const String& selectorName)
 #endif
 }
 
-void WebPage::shouldDelayWindowOrderingEvent(const WebKit::WebMouseEvent& event, CompletionHandler<void(bool)>&& completionHandler)
+void WebPage::shouldDelayWindowOrderingEvent(Ref<WebKit::WebMouseEvent>&& eventRef, CompletionHandler<void(bool)>&& completionHandler)
 {
+    const auto& event = eventRef.get();
     RefPtr frame = m_page->focusController().focusedOrMainFrame();
     if (!frame)
         return completionHandler({ });
@@ -610,8 +611,9 @@ static String commandNameForSelectorName(const String& selectorName)
     completionHandler(result);
 }
 
-void WebPage::requestAcceptsFirstMouse(int eventNumber, const WebKit::WebMouseEvent& event)
+void WebPage::requestAcceptsFirstMouse(int eventNumber, Ref<WebKit::WebMouseEvent>&& eventRef)
 {
+    const auto& event = eventRef.get();
     if (WebProcess::singleton().parentProcessConnection()->inSendSync()) {
         // In case we're already inside a sendSync message, it's possible that the page is in a
         // transitionary state, so any hit-testing could cause crashes  so we just return early in that case.
diff --git a/Source/WebKit/WebProcess/WebStorage/StorageAreaMap.cpp b/Source/WebKit/WebProcess/WebStorage/StorageAreaMap.cpp
index cacb192a6875..7eb544aafcaf 100644
--- a/Source/WebKit/WebProcess/WebStorage/StorageAreaMap.cpp
+++ b/Source/WebKit/WebProcess/WebStorage/StorageAreaMap.cpp
@@ -105,8 +105,8 @@ void StorageAreaMap::setItem(LocalFrame& sourceFrame, StorageAreaImpl* sourceAre
     }
 
     auto callback = [weakThis = WeakPtr { *this }, seed = m_currentSeed, key](bool hasError, auto&& allItems) mutable {
-        if (weakThis)
-            weakThis->didSetItem(seed, key, hasError, WTF::move(allItems));
+        if (RefPtr protectedThis = weakThis)
+            protectedThis->didSetItem(seed, key, hasError, WTF::move(allItems));
     };
     Ref connection = WebProcess::singleton().ensureNetworkProcessConnection().connection();
     connection->sendWithAsyncReply(Messages::NetworkStorageManager::SetItem(*m_remoteAreaIdentifier, sourceArea->identifier(), key, value, protect(sourceFrame.document())->url().string()), WTF::move(callback));
@@ -131,10 +131,10 @@ void StorageAreaMap::removeItem(WebCore::LocalFrame& sourceFrame, StorageAreaImp
     }
 
     auto callback = [weakThis = WeakPtr { *this }, seed = m_currentSeed, key](bool hasError, HashMap<String, String>&& allItems) mutable {
-        if (weakThis)
-            weakThis->didRemoveItem(seed, key, hasError, WTF::move(allItems));
+        if (RefPtr protectedThis = weakThis)
+            protectedThis->didRemoveItem(seed, key, hasError, WTF::move(allItems));
     };
-    WebProcess::singleton().ensureNetworkProcessConnection().connection().sendWithAsyncReply(Messages::NetworkStorageManager::RemoveItem(*m_remoteAreaIdentifier, sourceArea->identifier(), key, protect(sourceFrame.document())->url().string()), WTF::move(callback));
+    protect(WebProcess::singleton().ensureNetworkProcessConnection().connection())->sendWithAsyncReply(Messages::NetworkStorageManager::RemoveItem(*m_remoteAreaIdentifier, sourceArea->identifier(), key, protect(sourceFrame.document())->url().string()), WTF::move(callback));
 }
 
 void StorageAreaMap::clear(WebCore::LocalFrame& sourceFrame, StorageAreaImpl* sourceArea)
@@ -150,10 +150,10 @@ void StorageAreaMap::clear(WebCore::LocalFrame& sourceFrame, StorageAreaImpl* so
     }
 
     auto callback = [weakThis = WeakPtr { *this }, seed = m_currentSeed]() mutable {
-        if (weakThis)
-            weakThis->didClear(seed);
+        if (RefPtr protectedThis = weakThis)
+            protectedThis->didClear(seed);
     };
-    WebProcess::singleton().ensureNetworkProcessConnection().connection().sendWithAsyncReply(Messages::NetworkStorageManager::Clear(*m_remoteAreaIdentifier, sourceArea->identifier(), protect(sourceFrame.document())->url().string()), WTF::move(callback));
+    protect(WebProcess::singleton().ensureNetworkProcessConnection().connection())->sendWithAsyncReply(Messages::NetworkStorageManager::Clear(*m_remoteAreaIdentifier, sourceArea->identifier(), protect(sourceFrame.document())->url().string()), WTF::move(callback));
 }
 
 bool StorageAreaMap::contains(const String& key)
@@ -254,7 +254,7 @@ void StorageAreaMap::dispatchSessionStorageEvent(const std::optional<StorageArea
     if (!page)
         return;
 
-    StorageEventDispatcher::dispatchSessionStorageEvents(key, oldValue, newValue, *page, m_securityOrigin, urlString, [storageAreaImplID](auto& storage) {
+    StorageEventDispatcher::dispatchSessionStorageEvents(key, oldValue, newValue, *page, protect(m_securityOrigin), urlString, [storageAreaImplID](auto& storage) {
         return downcast<StorageAreaImpl>(storage.area()).identifier() == storageAreaImplID;
     });
 }
@@ -263,7 +263,7 @@ void StorageAreaMap::dispatchLocalStorageEvent(const std::optional<StorageAreaIm
 {
     ASSERT(isLocalStorage(type()));
 
-    StorageEventDispatcher::dispatchLocalStorageEvents(key, oldValue, newValue, nullptr, m_securityOrigin, urlString, [storageAreaImplID](auto& storage) {
+    StorageEventDispatcher::dispatchLocalStorageEvents(key, oldValue, newValue, nullptr, protect(m_securityOrigin), urlString, [storageAreaImplID](auto& storage) {
         return downcast<StorageAreaImpl>(storage.area()).identifier() == storageAreaImplID;
     });
 }
@@ -305,7 +305,7 @@ void StorageAreaMap::sendConnectMessage(SendMode mode)
     }
 
     auto completionHandler = [weakThis = WeakPtr { *this }](auto remoteAreaIdentifier, auto items, auto messageIdentifier) mutable {
-        if (RefPtr protectedThis = weakThis.get())
+        if (RefPtr protectedThis = weakThis)
             protectedThis->didConnect(remoteAreaIdentifier, WTF::move(items), messageIdentifier);
     };
 
diff --git a/Source/WebKit/WebProcess/cocoa/TextRecognitionRequest.cpp b/Source/WebKit/WebProcess/cocoa/TextRecognitionRequest.cpp
index a8e7147ff204..3db802aa134e 100644
--- a/Source/WebKit/WebProcess/cocoa/TextRecognitionRequest.cpp
+++ b/Source/WebKit/WebProcess/cocoa/TextRecognitionRequest.cpp
@@ -67,7 +67,8 @@ void TextRecognitionRequest::requestTextRecognitionFor(HTMLMediaElementIdentifie
     if (m_timer)
         m_timer->stop();
     m_identifier = identifier;
-    m_timer = makeUnique<RunLoop::Timer>(RunLoop::mainSingleton(), "TextRecognitionRequest"_s, [page = m_page, manager = m_manager, identifier] {
+    m_timer = makeUnique<RunLoop::Timer>(RunLoop::mainSingleton(), "TextRecognitionRequest"_s, [weakPage = m_page, manager = m_manager, identifier] {
+        RefPtr page = weakPage;
         if (!page)
             return;
         RefPtr element = dynamicDowncast<HTMLVideoElement>(manager->mediaElementWithContextId(identifier));
@@ -84,7 +85,7 @@ void TextRecognitionRequest::cancel()
         timer->stop();
 
     m_identifier.reset();
-    if (RefPtr page = m_page.get())
+    if (RefPtr page = m_page)
         page->cancelTextRecognitionForVideoInElementFullScreen();
 }
 
diff --git a/Source/WebKit/webpushd/PushService.mm b/Source/WebKit/webpushd/PushService.mm
index 43b628ab1450..288f75b5ab03 100644
--- a/Source/WebKit/webpushd/PushService.mm
+++ b/Source/WebKit/webpushd/PushService.mm
@@ -183,7 +183,6 @@ static void performAfterFirstUnlock(Function<void()>&& function)
     , m_incomingPushMessageHandler(WTF::move(incomingPushMessageHandler))
 {
     RELEASE_ASSERT(m_incomingPushMessageHandler);
-    relaxAdoptionRequirement();
 
     Ref connection = m_connection;
     connection->startListeningForPublicToken([weakThis = WeakPtr { *this }](auto&& token) mutable {
@@ -417,7 +416,7 @@ void reject(WebCore::ExceptionData&& data)
                 return;
             }
 
-            auto clientKeys = protectedThis->service().connection().generateClientKeys();
+            auto clientKeys = protect(protectedThis->service().connection())->generateClientKeys();
             IGNORE_CLANG_WARNINGS_BEGIN("missing-designated-field-initializers")
             PushRecord record {
                 .subscriptionSetIdentifier = protectedThis->m_identifier,
diff --git a/Source/WebKit/webpushd/_WKMockUserNotificationCenter.mm b/Source/WebKit/webpushd/_WKMockUserNotificationCenter.mm
index 9fa93b886f2c..e6972095acf3 100644
--- a/Source/WebKit/webpushd/_WKMockUserNotificationCenter.mm
+++ b/Source/WebKit/webpushd/_WKMockUserNotificationCenter.mm
@@ -28,6 +28,7 @@
 
 #import <wtf/BlockPtr.h>
 #import <wtf/RetainPtr.h>
+#import <wtf/darwin/DispatchExtras.h>
 #import <wtf/darwin/DispatchOSObject.h>
 
 #if HAVE(FULL_FEATURED_USER_NOTIFICATIONS)
@@ -60,7 +61,7 @@ - (instancetype)initWithBundleIdentifierInternal:(NSString *)bundleIdentifier
     if (!self)
         return nil;
 
-    m_queue = adoptOSObject(dispatch_queue_create(nullptr, OSObjectPtr { DISPATCH_QUEUE_SERIAL_WITH_AUTORELEASE_POOL }.get()));
+    m_queue = adoptOSObject(dispatch_queue_create(nullptr, serialQueueWithAutoreleasePoolAttrSingleton()));
     m_bundleIdentifier = bundleIdentifier;
     m_notifications = adoptNS([[NSMutableArray alloc] init]);
 
diff --git a/Source/WebKitLegacy/mac/WebView/WebPreferences.mm b/Source/WebKitLegacy/mac/WebView/WebPreferences.mm
index 99237c363f64..518c435323d4 100644
--- a/Source/WebKitLegacy/mac/WebView/WebPreferences.mm
+++ b/Source/WebKitLegacy/mac/WebView/WebPreferences.mm
@@ -56,6 +56,7 @@
 #import <wtf/RunLoop.h>
 #import <wtf/RuntimeApplicationChecks.h>
 #import <wtf/cocoa/RuntimeApplicationChecksCocoa.h>
+#import <wtf/darwin/DispatchExtras.h>
 #import <wtf/darwin/DispatchOSObject.h>
 
 
@@ -119,7 +120,7 @@ + (NSString *)_IBCreatorID;
 public:
     WebPreferencesPrivate()
 #if PLATFORM(IOS_FAMILY)
-        : readWriteQueue { adoptOSObject(dispatch_queue_create("com.apple.WebPreferences.ReadWriteQueue", DISPATCH_QUEUE_CONCURRENT)) }
+        : readWriteQueue { adoptOSObject(dispatch_queue_create("com.apple.WebPreferences.ReadWriteQueue", concurrentQueueWithAutoreleasePoolAttrSingleton())) }
 #endif
     {
     }
diff --git a/Source/cmake/OptionsPlayStation.cmake b/Source/cmake/OptionsPlayStation.cmake
index 648ed61142b9..f55771f999f8 100644
--- a/Source/cmake/OptionsPlayStation.cmake
+++ b/Source/cmake/OptionsPlayStation.cmake
@@ -15,6 +15,12 @@ add_definitions(-DSCE_LIBC_DISABLE_CPP14_HEADER_WARNING= -DSCE_LIBC_DISABLE_CPP1
 # bug-224462
 WEBKIT_PREPEND_GLOBAL_COMPILER_FLAGS(-Wno-dll-attribute-on-redeclaration)
 
+# bug-322829
+set(CMAKE_C_LINKER_WRAPPER_FLAG "-Wl,")
+set(CMAKE_C_LINKER_WRAPPER_FLAG_SEP ",")
+set(CMAKE_CXX_LINKER_WRAPPER_FLAG "-Wl,")
+set(CMAKE_CXX_LINKER_WRAPPER_FLAG_SEP ",")
+
 # Set the standard libary version
 WEBKIT_PREPEND_GLOBAL_COMPILER_FLAGS(-sce-stdlib=v2)
 
diff --git a/Tools/CISupport/ews-build/results_db.py b/Tools/CISupport/ews-build/results_db.py
index 09dde1de7cfa..cbf1a284d0d3 100755
--- a/Tools/CISupport/ews-build/results_db.py
+++ b/Tools/CISupport/ews-build/results_db.py
@@ -86,7 +86,7 @@ class ResultsDatabase(object):
     ]
 
     PRS_FOR_DIRTY_TREE_FLAKE = 2
-    AUTHORS_FOR_DIRTY_TREE_FLAKE = 1
+    AUTHORS_FOR_DIRTY_TREE_FLAKE = 2
     PRS_FOR_BETWEEN_BUILD_FLAKE = 3
     AUTHORS_FOR_BETWEEN_BUILD_FLAKE = 2
 
@@ -100,6 +100,11 @@ class ResultsDatabase(object):
     WITHIN_STEP_DIRTY_TREE = 'WithinStepDirtyTree'
     BETWEEN_STEPS_DIRTY_TREE = 'BetweenStepsDirtyTree'
 
+    # What the read path concludes, which is what a caller decides to act on.
+    CLEAN_TREE_VERDICT = 'CleanTree'
+    DIRTY_TREE_VERDICT = 'DirtyTree'
+    BETWEEN_BUILDS_VERDICT = 'BetweenBuilds'
+
     @classmethod
     def platform_for_query(cls, platform):
         if platform.lower() in ('gtk', 'wpe'):
@@ -313,12 +318,12 @@ def _is_intra_build_flake(cls, entries, logger):
 
         if clean_tree := rows.get(cls.WITHIN_STEP_CLEAN_TREE):
             evidence = cls._evidence_in(clean_tree)
-            evidence.flaky_type = 'CleanTree'
+            evidence.flaky_type = cls.CLEAN_TREE_VERDICT
             return evidence
 
         with_change = rows.get(cls.WITHIN_STEP_DIRTY_TREE, []) + rows.get(cls.BETWEEN_STEPS_DIRTY_TREE, [])
         return cls._convict(
-            cls._evidence_in(with_change), 'DirtyTree',
+            cls._evidence_in(with_change), cls.DIRTY_TREE_VERDICT,
             cls.PRS_FOR_DIRTY_TREE_FLAKE, cls.AUTHORS_FOR_DIRTY_TREE_FLAKE,
         )
 
@@ -328,7 +333,7 @@ def _is_inter_build_flake(cls, entries, logger):
         evidence = cls._evidence_in(rows)
 
         if verdict := cls._convict(
-            evidence, 'BetweenBuilds',
+            evidence, cls.BETWEEN_BUILDS_VERDICT,
             cls.PRS_FOR_BETWEEN_BUILD_FLAKE, cls.AUTHORS_FOR_BETWEEN_BUILD_FLAKE,
         ):
             return verdict
diff --git a/Tools/CISupport/ews-build/steps.py b/Tools/CISupport/ews-build/steps.py
index 747e08a9f677..1cd421cf4413 100644
--- a/Tools/CISupport/ews-build/steps.py
+++ b/Tools/CISupport/ews-build/steps.py
@@ -3586,6 +3586,8 @@ def runCommand(self, command):
             self.binaryFailures.append('testdfg')
         if jsc_results.get('allApiTestsPassed') is False:
             self.binaryFailures.append('testapi')
+        if jsc_results.get('allLibJSCToolsTestsPassed') is False:
+            self.binaryFailures.append('testLibJSCTools')
         self.flaky = jsc_results.get('flakyAndPassed')
         if self.flaky:
             self.setProperty(self.prefix + 'flaky_and_passed', self.flaky)
@@ -3947,7 +3949,11 @@ class RunWebKitTests(shell.Test, ResultsDBReportMixin, AddToLogMixin, ShellMixin
     ENABLE_ADDITIONAL_ARGUMENTS = True
     EXIT_AFTER_FAILURES = '60'
     MAX_FAILURES_TO_CHECK_RESULTS_DB = 60
-    SHOULD_IGNORE_FLAKY_TESTS = False
+    INCLUDED_FLAKY_VERDICTS = frozenset({
+        ResultsDatabase.CLEAN_TREE_VERDICT,
+        ResultsDatabase.DIRTY_TREE_VERDICT,
+        ResultsDatabase.BETWEEN_BUILDS_VERDICT,
+    })
     STRESS_MODE = False
     command = ['python3', 'Tools/Scripts/run-webkit-tests',
                '--no-build',
@@ -4123,6 +4129,7 @@ def filter_failures_using_results_db(self, failing_tests):
         if flake_logs:
             yield self._addToLog(self.results_db_log_name, flake_logs)
 
+        ignored, shadowed = [], []
         for test in tests:
             data = pre_existing[test]
             flake = flakes.get(test, FlakyVerdict(request_failed=True))
@@ -4132,11 +4139,14 @@ def filter_failures_using_results_db(self, failing_tests):
                 self.failing_tests_filtered.remove(test)
             elif flake.is_flaky:
                 self.flaky_failures_in_results_db[test] = flake.flaky_type
-                if flake.flaky_type == 'BetweenBuilds' and not flake.intra_build_evidence:
+                if flake.flaky_type == ResultsDatabase.BETWEEN_BUILDS_VERDICT and not flake.intra_build_evidence:
                     self.unsupported_flakes_in_results_db.append(test)
                 flake_summary = f'{flake.flaky_type}: {flake.evidence}'
-                if self.SHOULD_IGNORE_FLAKY_TESTS:
+                if flake.flaky_type in self.INCLUDED_FLAKY_VERDICTS:
+                    ignored.append(test)
                     self.failing_tests_filtered.remove(test)
+                else:
+                    shadowed.append(test)
             elif flake.request_failed:
                 self.unknown_flakes_in_results_db.append(test)
                 flake_summary = 'Unknown'
@@ -4149,13 +4159,12 @@ def filter_failures_using_results_db(self, failing_tests):
                 f"pre-existing-flake={flake_summary}\n"
             )
 
-        if self.flaky_failures_in_results_db:
-            action = 'Ignored' if self.SHOULD_IGNORE_FLAKY_TESTS else 'Would have ignored'
-            yield self._addToLog(
-                self.results_db_log_name,
-                f"\n{action} {len(self.flaky_failures_in_results_db)} flaky "
-                f"test(s): {', '.join(sorted(self.flaky_failures_in_results_db))}\n",
-            )
+        for action, acted_on in (('Ignored', ignored), ('Would have ignored', shadowed)):
+            if acted_on:
+                yield self._addToLog(
+                    self.results_db_log_name,
+                    f"\n{action} {len(acted_on)} flaky test(s): {', '.join(sorted(acted_on))}\n",
+                )
 
     def results_db_ignore_message(self) -> str:
         parts = []
diff --git a/Tools/CISupport/ews-build/steps_unittest.py b/Tools/CISupport/ews-build/steps_unittest.py
index 6b9be0b936e2..ed6924dd8f4e 100644
--- a/Tools/CISupport/ews-build/steps_unittest.py
+++ b/Tools/CISupport/ews-build/steps_unittest.py
@@ -30,6 +30,7 @@
 import sys
 import tempfile
 import time
+from typing import Any, Generator
 from unittest import skip as skipTest
 from unittest.mock import call, create_autospec, patch
 
@@ -3359,8 +3360,7 @@ def test_pre_existing_interleaved_with_real_failure_stripped(self):
         )
 
     @defer.inlineCallbacks
-    def test_a_flaky_verdict_is_recorded_without_ignoring_the_failure(self):
-        # SHOULD_IGNORE_FLAKY_TESTS is False, so the verdict is recorded but the test is not removed.
+    def test_a_verdict_in_the_included_set_removes_the_failure(self) -> Generator[Any, Any, None]:
         step = self._configure(set())
         builds = [f'https://build.webkit.org/#/builders/1/builds/{number}' for number in (11, 12, 13)]
         self.patch(ResultsDatabase, 'flaky_verdicts_for', classmethod(
@@ -3373,11 +3373,28 @@ def test_a_flaky_verdict_is_recorded_without_ignoring_the_failure(self):
 
         yield step.filter_failures_using_results_db(['real.html', 'flaky.html'])
 
-        self.assertEqual(step.failing_tests_filtered, ['real.html', 'flaky.html'])
+        self.assertEqual(step.failing_tests_filtered, ['real.html'])
         self.assertEqual(step.flaky_failures_in_results_db, {'flaky.html': 'DirtyTree'})
         self.assertEqual(step.preexisting_failures_in_results_db, [])
         self.assertEqual(step.results_db_ignore_message(), 'Ignored flaky tests: flaky.html based on results-db')
 
+    @defer.inlineCallbacks
+    def test_a_verdict_outside_the_included_set_is_recorded_without_ignoring_the_failure(self) -> Generator[Any, Any, None]:
+        step = self._configure(set())
+        step.INCLUDED_FLAKY_VERDICTS = frozenset({'CleanTree'})
+        self.patch(ResultsDatabase, 'flaky_verdicts_for', classmethod(
+            lambda cls, tests, **kwargs: defer.succeed(({
+                test: (
+                    FlakyVerdict(flaky_type='BetweenBuilds')
+                    if test == 'flaky.html' else FlakyVerdict()
+                ) for test in tests
+            }, ''))))
+
+        yield step.filter_failures_using_results_db(['real.html', 'flaky.html'])
+
+        self.assertEqual(step.failing_tests_filtered, ['real.html', 'flaky.html'])
+        self.assertEqual(step.flaky_failures_in_results_db, {'flaky.html': 'BetweenBuilds'})
+
     @defer.inlineCallbacks
     def test_a_test_with_no_verdict_is_not_treated_as_sound(self):
         # flaky_verdicts_for answers for every test it is given, so this cannot happen today. If that
@@ -3404,7 +3421,7 @@ def test_the_ignore_message_covers_both_categories(self):
 
         yield step.filter_failures_using_results_db(['pre-existing.html', 'flaky.html'])
 
-        self.assertEqual(step.failing_tests_filtered, ['flaky.html'])
+        self.assertEqual(step.failing_tests_filtered, [])
         self.assertEqual(
             step.results_db_ignore_message(),
             'Ignored pre-existing failures: pre-existing.html; flaky tests: flaky.html based on results-db',
@@ -12590,6 +12607,18 @@ def test_a_missing_pull_request_is_not_a_second_pull_request(self):
             verdicts, _ = yield ResultsDatabase.flaky_verdicts_for(['layout/test.html'], suite='layout-tests')
             self.assertFalse(verdicts['layout/test.html'].is_flaky)
 
+    @defer.inlineCallbacks
+    def test_a_single_author_across_two_pull_requests_is_not_flaky(self) -> Generator[Any, Any, None]:
+        # A stack of pull requests is one author's work, so the parent commit's own regression must
+        # not excuse itself: a build's first run writes rows its own re-run then reads.
+        rows = [
+            self._flaky_row('WithinStepDirtyTree', build_url=f'https://build/1/builds/{n}', pr_number=n, authors=['alice'])
+            for n in range(1, 4)
+        ]
+        with self._mock(self._response(rows=rows), self._response()):
+            verdicts, _ = yield ResultsDatabase.flaky_verdicts_for(['layout/test.html'], suite='layout-tests')
+            self.assertFalse(verdicts['layout/test.html'].is_flaky)
+
     @defer.inlineCallbacks
     def test_dirty_tree_pull_requests_with_no_author_not_flaky(self):
         rows = [
diff --git a/Tools/Scripts/libraries/webkitbugspy/webkitbugspy/__init__.py b/Tools/Scripts/libraries/webkitbugspy/webkitbugspy/__init__.py
index 8b6e4e0ab989..25226b923597 100644
--- a/Tools/Scripts/libraries/webkitbugspy/webkitbugspy/__init__.py
+++ b/Tools/Scripts/libraries/webkitbugspy/webkitbugspy/__init__.py
@@ -50,7 +50,7 @@ def _maybe_add_library_path(path):
         "See https://github.com/WebKit/WebKit/tree/main/Tools/Scripts/libraries/webkitcorepy"
     )
 
-version = Version(0, 15, 4)
+version = Version(0, 15, 5)
 
 from .user import User
 from .issue import Issue
diff --git a/Tools/Scripts/libraries/webkitbugspy/webkitbugspy/bugzilla.py b/Tools/Scripts/libraries/webkitbugspy/webkitbugspy/bugzilla.py
index 41828dd5e7d4..d4b7a42053c6 100644
--- a/Tools/Scripts/libraries/webkitbugspy/webkitbugspy/bugzilla.py
+++ b/Tools/Scripts/libraries/webkitbugspy/webkitbugspy/bugzilla.py
@@ -596,55 +596,58 @@ def add_comment(self, issue, text):
 
         return result
 
+    RELATIONS = ('depends_on', 'blocks', 'regressed_by', 'regressions')
+
     def related_issue_id(self, issue):
         if isinstance(issue.tracker, Tracker):
             return issue.id
         else:
             raise TypeError('Cannot relate issues of different types.')
 
-    def relate(self, issue, depends_on=None, blocks=None, regressed_by=None, regressions=None, **relations):
-        if relations:
-            raise TypeError("'{}' is an invalid relation".format(list(relations.keys())[0]))
+    def _modify_relations(self, issue, action, relations):
+        if invalid := [relation for relation in relations if relation not in self.RELATIONS]:
+            raise TypeError(f"'{invalid[0]}' is an invalid relation")
 
-        update_dict = dict()
-        update_dict['ids'] = [issue.id]
-        if depends_on:
-            update_dict['depends_on'] = {'add': [self.related_issue_id(depends_on)]}
-        if blocks:
-            update_dict['blocks'] = {'add': [self.related_issue_id(blocks)]}
-        if regressed_by:
-            update_dict['regressed_by'] = {'add': [self.related_issue_id(regressed_by)]}
-        if regressions:
-            update_dict['regressions'] = {'add': [self.related_issue_id(regressions)]}
+        update_dict = {'ids': [issue.id]}
+        for relation, related in relations.items():
+            if related:
+                update_dict[relation] = {action: [self.related_issue_id(related)]}
 
         response = None
         try:
             response = self.session.put(
-                '{}/rest/bug/{}{}'.format(self.url, issue.id, self._login_arguments(required=True)),
+                f'{self.url}/rest/bug/{issue.id}{self._login_arguments(required=True)}',
                 json=update_dict,
                 timeout=self.timeout,
             )
         except requests.exceptions.RequestException as e:
-            sys.stderr.write('Request Error: {}\n'.format(e))
+            sys.stderr.write(f'Request Error: {e}\n')
         if response is not None and response.status_code // 100 == 4 and self._logins_left:
             self._logins_left -= 1
         if response is None or response.status_code // 100 != 2:
-            sys.stderr.write("Failed to modify '{}'\n".format(issue))
+            sys.stderr.write(f"Failed to modify '{issue}'\n")
             return None
 
         if not issue._related:
             self.populate(issue, 'related')
-        else:
-            if depends_on:
-                issue._related['depends_on'].append(depends_on)
-            if blocks:
-                issue._related['blocks'].append(blocks)
-            if regressed_by:
-                issue._related['regressed_by'].append(regressed_by)
-            if regressions:
-                issue._related['regressions'].append(regressions)
+            return issue
+
+        for relation, related in relations.items():
+            if not related:
+                continue
+            existing = issue._related.setdefault(relation, [])
+            if action == 'add' and related not in existing:
+                existing.append(related)
+            elif action == 'remove' and related in existing:
+                existing.remove(related)
         return issue
 
+    def relate(self, issue, **relations):
+        return self._modify_relations(issue, 'add', relations)
+
+    def unrelate(self, issue, **relations):
+        return self._modify_relations(issue, 'remove', relations)
+
     @property
     @webkitcorepy.decorators.Memoize()
     def projects(self):
diff --git a/Tools/Scripts/libraries/webkitbugspy/webkitbugspy/issue.py b/Tools/Scripts/libraries/webkitbugspy/webkitbugspy/issue.py
index 253abefc8421..84e8822b4df5 100644
--- a/Tools/Scripts/libraries/webkitbugspy/webkitbugspy/issue.py
+++ b/Tools/Scripts/libraries/webkitbugspy/webkitbugspy/issue.py
@@ -206,6 +206,9 @@ def related(self):
     def relate(self, **relations):
         return self.tracker.relate(self, **relations)
 
+    def unrelate(self, **relations):
+        return self.tracker.unrelate(self, **relations)
+
     @property
     def assignee(self):
         if self._assignee is None:
diff --git a/Tools/Scripts/libraries/webkitbugspy/webkitbugspy/mocks/bugzilla.py b/Tools/Scripts/libraries/webkitbugspy/webkitbugspy/mocks/bugzilla.py
index 95395aea2618..48e59e26b8d6 100644
--- a/Tools/Scripts/libraries/webkitbugspy/webkitbugspy/mocks/bugzilla.py
+++ b/Tools/Scripts/libraries/webkitbugspy/webkitbugspy/mocks/bugzilla.py
@@ -158,18 +158,37 @@ def _issue(self, url, id, credentials=None, data=None):
                 issue['component'] = data['component']
             if data.get('version'):
                 issue['version'] = data['version']
-            issue['related'] = {'blocks': [], 'depends_on': [], 'regressions': [], 'regressed_by': []}
-            if data.get('depends_on'):
-                issue['related']['depends_on'] = data['depends_on']
-            if data.get('blocks'):
-                issue['related']['blocks'] = data['blocks']
-            if data.get('regressed_by'):
-                issue['related']['regressed_by'] = data['regressed_by']
-            if data.get('regressions'):
-                issue['related']['regressions'] = data['regressions']
             if data.get('see_also'):
                 issue['related_links'] = data['see_also']['add']
 
+            # A dependency is one edge, so recording it on this issue also records it on the other
+            INVERSE = {
+                'depends_on': 'blocks',
+                'blocks': 'depends_on',
+                'regressed_by': 'regressions',
+                'regressions': 'regressed_by',
+            }
+
+            def related_for(number, relation):
+                related = self.issues[number].setdefault('related', {key: [] for key in INVERSE})
+                return related.setdefault(relation, [])
+
+            for relation, inverse in INVERSE.items():
+                if not (change := data.get(relation)):
+                    continue
+                for other in change.get('add') or []:
+                    forward, reverse = related_for(id, relation), related_for(other, inverse)
+                    if other not in forward:
+                        forward.append(other)
+                    if id not in reverse:
+                        reverse.append(id)
+                for other in change.get('remove') or []:
+                    forward, reverse = related_for(id, relation), related_for(other, inverse)
+                    if other in forward:
+                        forward.remove(other)
+                    if id in reverse:
+                        reverse.remove(id)
+
             keywords = data.get('keywords', {})
             if keywords:
                 assert len(keywords) == 1
diff --git a/Tools/Scripts/libraries/webkitbugspy/webkitbugspy/mocks/radar.py b/Tools/Scripts/libraries/webkitbugspy/webkitbugspy/mocks/radar.py
index c47c92d1bbc4..c68742e19902 100644
--- a/Tools/Scripts/libraries/webkitbugspy/webkitbugspy/mocks/radar.py
+++ b/Tools/Scripts/libraries/webkitbugspy/webkitbugspy/mocks/radar.py
@@ -176,6 +176,7 @@ def __init__(self, client, issue, additional_fields=None):
             self.state = 'Analyze' if issue['opened'] else 'Verify'
         self.duplicateOfProblemID = issue['original']['id'] if issue.get('original', None) else None
         self.related = list()
+        self.unrelated = list()
         if issue.get('substate'):
             self.substate = issue['substate']
         else:
@@ -288,6 +289,17 @@ def commit_changes(self):
                 self.client.parent.issues[r.related_radar_id]['related'] = list()
             self.client.parent.issues[r.related_radar_id]['related'].append(inverse_r_dict)
 
+        for r in list(self.unrelated):
+            r_dict = {'relationship': r.type, 'related_radar': r.related_radar_id}
+            entries = self.client.parent.issues[self.id].get('related') or []
+            if r_dict in entries:
+                entries.remove(r_dict)
+
+            inverse_r_dict = {'relationship': Radar.Relationship.inverse_map[r.type], 'related_radar': self.id}
+            entries = self.client.parent.issues[r.related_radar_id].get('related') or []
+            if inverse_r_dict in entries:
+                entries.remove(inverse_r_dict)
+
         if getattr(self, 'sourceChanges', None):
             self.client.parent.issues[self.id]['sourceChanges'] = self.sourceChanges
 
@@ -314,6 +326,9 @@ def relationships(self, relationships=None):
     def add_relationship(self, relationship):
         self.related.append(relationship)
 
+    def delete_relationship(self, relationship):
+        self.unrelated.append(relationship)
+
     def remove_keyword(self, keyword):
         if keyword.name in self._issue.get('keywords') or []:
             self._issue['keywords'].remove(keyword.name)
diff --git a/Tools/Scripts/libraries/webkitbugspy/webkitbugspy/radar.py b/Tools/Scripts/libraries/webkitbugspy/webkitbugspy/radar.py
index 2dfca173c59f..9f8f1baa8cd8 100644
--- a/Tools/Scripts/libraries/webkitbugspy/webkitbugspy/radar.py
+++ b/Tools/Scripts/libraries/webkitbugspy/webkitbugspy/radar.py
@@ -612,6 +612,61 @@ def create_relationship(self, issue, issue2, relationship):
         return None
 
     @handle_access_exception
+    def remove_relationship(self, issue, issue2, relationship):
+        if relationship not in self.RELATIONSHIP_TYPES:
+            sys.stderr.write(f'{relationship} is not a valid relationship type.')
+            return None
+        if relationship in (
+            self.radarclient().Relationship.TYPE_DUPLICATE_OF,
+            self.radarclient().Relationship.TYPE_ORIGINAL_OF,
+        ):
+            raise NotImplementedError(f'Cannot remove a {relationship} relationship')
+
+        radar = self.client.radar_for_id(issue.id)
+        if not radar:
+            sys.stderr.write(f"Failed to fetch '{issue.link}'\n")
+            return None
+
+        # 'delete_relationship' only accepts a relationship the radar already has
+        existing = next((
+            candidate for candidate in radar.relationships() or []
+            if candidate.type == relationship and candidate.related_radar_id == issue2.id
+        ), None)
+        if not existing:
+            return issue
+
+        radar.delete_relationship(existing)
+        radar.commit_changes()
+
+        if not issue._related:
+            self.populate(issue, 'related')
+        else:
+            issue._related[relationship] = [
+                candidate for candidate in issue._related[relationship] if candidate.id != issue2.id
+            ]
+        return issue
+
+    @handle_access_exception
+    def unrelate(self, issue, related_to=None, blocked_by=None, blocking=None, parent_of=None, subtask_of=None,
+                 cause_of=None, caused_by=None, duplicate_of=None, original_of=None, **relations):
+        if relations:
+            raise TypeError(f"'{list(relations.keys())[0]}' is an invalid relation")
+
+        for related, relationship in (
+            (related_to, self.radarclient().Relationship.TYPE_RELATED_TO),
+            (blocked_by, self.radarclient().Relationship.TYPE_BLOCKED_BY),
+            (blocking, self.radarclient().Relationship.TYPE_BLOCKING),
+            (parent_of, self.radarclient().Relationship.TYPE_PARENT_OF),
+            (subtask_of, self.radarclient().Relationship.TYPE_SUBTASK_OF),
+            (cause_of, self.radarclient().Relationship.TYPE_CAUSE_OF),
+            (caused_by, self.radarclient().Relationship.TYPE_CAUSED_BY),
+            (duplicate_of, self.radarclient().Relationship.TYPE_DUPLICATE_OF),
+            (original_of, self.radarclient().Relationship.TYPE_ORIGINAL_OF),
+        ):
+            if related:
+                self.remove_relationship(issue, related, relationship)
+        return issue
+
     def relate(self, issue, related_to=None, blocked_by=None, blocking=None, parent_of=None, subtask_of=None,
                cause_of=None, caused_by=None, duplicate_of=None, original_of=None, **relations):
         if relations:
diff --git a/Tools/Scripts/libraries/webkitbugspy/webkitbugspy/tests/bugzilla_unittest.py b/Tools/Scripts/libraries/webkitbugspy/webkitbugspy/tests/bugzilla_unittest.py
index 216f7b900d22..a983fc1e6130 100644
--- a/Tools/Scripts/libraries/webkitbugspy/webkitbugspy/tests/bugzilla_unittest.py
+++ b/Tools/Scripts/libraries/webkitbugspy/webkitbugspy/tests/bugzilla_unittest.py
@@ -1135,6 +1135,13 @@ def test_relate_simple(self):
             self.assertEqual(issue.related['depends_on'], [tracker.issue(2)])
             self.assertEqual(issue.related['blocks'], [])
 
+            # The edge runs both ways
+            self.assertEqual(tracker.issue(2).related['blocks'], [issue])
+
+            issue.unrelate(depends_on=tracker.issue(2))
+            self.assertEqual(issue.related['depends_on'], [])
+            self.assertEqual(tracker.issue(2).related['blocks'], [])
+
     def test_relate(self):
         with mocks.Bugzilla(self.URL.split('://')[1], environment=wkmocks.Environment(
                 BUGS_EXAMPLE_COM_USERNAME='tcontributor@example.com',
diff --git a/Tools/Scripts/libraries/webkitbugspy/webkitbugspy/tests/radar_unittest.py b/Tools/Scripts/libraries/webkitbugspy/webkitbugspy/tests/radar_unittest.py
index da95f30603f0..d73cbfe8da24 100644
--- a/Tools/Scripts/libraries/webkitbugspy/webkitbugspy/tests/radar_unittest.py
+++ b/Tools/Scripts/libraries/webkitbugspy/webkitbugspy/tests/radar_unittest.py
@@ -596,6 +596,11 @@ def test_relate_inverse(self):
             self.assertEqual(tracker.issue(1).related['blocking'], [tracker.issue(2)])
             self.assertEqual(tracker.issue(2).related['blocked-by'], [tracker.issue(1)])
 
+            # Removing it removes both ends, as adding it added both
+            tracker.issue(2).unrelate(blocked_by=tracker.issue(1))
+            self.assertEqual(tracker.issue(2).related['blocked-by'], [])
+            self.assertEqual(tracker.issue(1).related['blocking'], [])
+
             tracker.issue(2).relate(parent_of=tracker.issue(3))
             self.assertEqual(tracker.issue(2).related['parent-of'], [tracker.issue(3)])
             self.assertEqual(tracker.issue(3).related['subtask-of'], [tracker.issue(2)])
diff --git a/Tools/Scripts/libraries/webkitbugspy/webkitbugspy/tracker.py b/Tools/Scripts/libraries/webkitbugspy/webkitbugspy/tracker.py
index 124e61c63b0c..957661cd24e9 100644
--- a/Tools/Scripts/libraries/webkitbugspy/webkitbugspy/tracker.py
+++ b/Tools/Scripts/libraries/webkitbugspy/webkitbugspy/tracker.py
@@ -183,6 +183,9 @@ def set(self, issue, **properties):
     def relate(self, issue, **relations):
         raise NotImplementedError()
 
+    def unrelate(self, issue, **relations):
+        raise NotImplementedError()
+
     def add_comment(self, issue, text):
         raise NotImplementedError()
 
diff --git a/Tools/Scripts/run-javascriptcore-tests b/Tools/Scripts/run-javascriptcore-tests
index ca65f7ce5536..05f94394c5d1 100755
--- a/Tools/Scripts/run-javascriptcore-tests
+++ b/Tools/Scripts/run-javascriptcore-tests
@@ -100,6 +100,7 @@ my $runTestB3 = RUN_IF_NO_TESTS_SPECIFIED;
 my $runTestDFG = RUN_IF_NO_TESTS_SPECIFIED;
 my $runTestAPI = RUN_IF_NO_TESTS_SPECIFIED;
 my $runTestWasmDebugger = RUN_IF_NO_TESTS_SPECIFIED;
+my $runTestLibJSCTools = RUN_IF_NO_TESTS_SPECIFIED;
 my $runJSCStress = RUN_IF_NO_TESTS_SPECIFIED;
 my $runMozillaTests = RUN_IF_NO_TESTS_SPECIFIED;
 
@@ -207,6 +208,17 @@ if ($ENV{RUN_JAVASCRIPTCORE_TESTS_TESTWASMDEBUGGER}) {
     }
 }
 
+if ($ENV{RUN_JAVASCRIPTCORE_TESTS_TESTLIBJSCTOOLS}) {
+    if ($ENV{RUN_JAVASCRIPTCORE_TESTS_TESTLIBJSCTOOLS} eq "true") {
+        $runTestLibJSCTools = ENV_VAR_SAYS_DO_RUN;
+    } elsif ($ENV{RUN_JAVASCRIPTCORE_TESTS_TESTLIBJSCTOOLS} eq "false") {
+        $runTestLibJSCTools = ENV_VAR_SAYS_DONT_RUN;
+    } else {
+        print "Don't recognize value for RUN_JAVASCRIPTCORE_TESTS_TESTLIBJSCTOOLS environment variable: '"
+            . $ENV{RUN_JAVASCRIPTCORE_TESTS_TESTLIBJSCTOOLS} . "'. Should be set to 'true' or 'false'.\n";
+    }
+}
+
 if ($ENV{RUN_JAVASCRIPTCORE_TESTS_BUILD}) {
     if ($ENV{RUN_JAVASCRIPTCORE_TESTS_BUILD} eq "true") {
         $buildJSC = 1;
@@ -255,6 +267,7 @@ my $testb3Default = defaultStringForTestState($runTestB3);
 my $testDFGDefault = defaultStringForTestState($runTestDFG);
 my $testapiDefault = defaultStringForTestState($runTestAPI);
 my $testWasmDebuggerDefault = defaultStringForTestState($runTestWasmDebugger);
+my $testLibJSCToolsDefault = defaultStringForTestState($runTestLibJSCTools);
 my $jscStressDefault = defaultStringForTestState($runJSCStress);
 my $mozillaTestsDefault = defaultStringForTestState($runMozillaTests);
 my $jitStressTestsDefault = $runJITStressTests ? "will run" : " will not run";
@@ -280,6 +293,7 @@ Usage: $programName [options] [options to pass to build system]
   --[no-]testdfg                Only run (or don't run) testdfg (default: $testDFGDefault)
   --[no-]testapi                Only run (or don't run) testapi (default: $testapiDefault)
   --[no-]testwasmdebugger       Only run (or don't run) testwasmdebugger (default: $testWasmDebuggerDefault)
+  --[no-]testlibjsctools        Only run (or don't run) testLibJSCTools (default: $testLibJSCToolsDefault)
   --[no-]jsc-stress             Only run (or don't run) the JSC stress tests (default: $jscStressDefault)
   --[no-]mozilla-tests          Only run (or don't run) the Mozilla tests (default: $mozillaTestsDefault)
   --[no-]jit-stress-tests       Run (or don't run) the JIT stress tests (default: $jitStressTestsDefault)
@@ -347,6 +361,7 @@ Environment Variables:
   - set RUN_JAVASCRIPTCORE_TESTS_TESTDFG to "true" or "false" (no quotes) to determine if we run testdfg by default.
   - set RUN_JAVASCRIPTCORE_TESTS_TESTAPI to "true" or "false" (no quotes) to determine if we run testapi by default.
   - set RUN_JAVASCRIPTCORE_TESTS_TESTWASMDEBUGGER to "true" or "false" (no quotes) to determine if we run testwasmdebugger by default.
+  - set RUN_JAVASCRIPTCORE_TESTS_TESTLIBJSCTOOLS to "true" or "false" (no quotes) to determine if we run testLibJSCTools by default.
   - set RUN_JAVASCRIPTCORE_TESTS_BUILD to "true" or "false" (no quotes) to set the should-we-build-before-running-tests setting.
   - set RUN_JAVASCRIPTCORE_TESTS_EXTRA_TESTS to the path of a yaml file or a directory of JS files to be run as part of run-javascriptcore-tests.
 
@@ -368,6 +383,7 @@ GetOptions(
     'testdfg!' => \$runTestDFG,
     'testapi!' => \$runTestAPI,
     'testwasmdebugger!' => \$runTestWasmDebugger,
+    'testlibjsctools!' => \$runTestLibJSCTools,
     'jsc-stress!' => \$runJSCStress,
     'jitless-wasm!' => \$runJITlessWasm,
     'mozilla-tests!' => \$runMozillaTests,
@@ -423,6 +439,7 @@ if ($runTestMasm == DO_RUN
    || $runTestDFG == DO_RUN
    || $runTestAPI == DO_RUN
    || $runTestWasmDebugger == DO_RUN
+   || $runTestLibJSCTools == DO_RUN
    || $runJSCStress == DO_RUN
    || $runMozillaTests == DO_RUN) {
     $specificTestsSpecified = 1;
@@ -549,9 +566,16 @@ $runTestB3 = enableTestOrNot($runTestB3);
 $runTestDFG = enableTestOrNot($runTestDFG);
 $runTestAPI = enableTestOrNot($runTestAPI);
 $runTestWasmDebugger = enableTestOrNot($runTestWasmDebugger);
+$runTestLibJSCTools = enableTestOrNot($runTestLibJSCTools);
 $runJSCStress = enableTestOrNot($runJSCStress);
 $runMozillaTests = enableTestOrNot($runMozillaTests);
 
+# libJavaScriptCoreTools and its test is built on Mach APIs and only available on Apple platforms.
+if ($runTestLibJSCTools && $^O ne "darwin") {
+    print "Not running testLibJSCTools: it is only available on Apple platforms.\n";
+    $runTestLibJSCTools = DONT_RUN;
+}
+
 my @buildArgs;
 
 if ($buildJSC) {
@@ -815,6 +839,7 @@ if ($runTestAPI) {
     runTest("testapi", "allApiTestsPassedWithSystemMalloc", "Malloc=1");
 }
 if ($runTestWasmDebugger) { runTest("testwasmdebugger", "allWasmDebuggerTestsPassed") }
+if ($runTestLibJSCTools) { runTest("testLibJSCTools", "allLibJSCToolsTestsPassed") }
 
 # Find JavaScriptCore directory
 chdirWebKit();
diff --git a/Tools/Scripts/webkit-sysprof/README.md b/Tools/Scripts/webkit-sysprof/README.md
index 80c5bce2675b..1fdb0df7302f 100644
--- a/Tools/Scripts/webkit-sysprof/README.md
+++ b/Tools/Scripts/webkit-sysprof/README.md
@@ -25,11 +25,13 @@ webkit-sysprof dump [--marks|--counters] [-f csv|json] CAPTURE_FILE
 ```
 
 `--marks` is the default when neither flag is given. `-f`/`--format`: `csv` (default) or
-`json` — `json` prints the same rows as `csv`, just as a JSON array of objects.
+`json`. `json` prints the same rows as `csv`, just as a JSON array of objects. `group`
+names the kind of process a mark came from, e.g. `WebKit (Web)`, and `pid` the process
+itself, which two of one kind share a group name for.
 
 ```
 $ webkit-sysprof dump capture.syscap
-group;name;message;time;duration;end_time
+group;pid;name;message;time;duration;end_time
 ...
 
 $ webkit-sysprof dump --counters capture.syscap
@@ -37,7 +39,7 @@ category;name;description;time;offset;value
 ...
 
 $ webkit-sysprof dump -f json capture.syscap
-[{"group": "...", "name": "...", "message": "...", "time": ..., "duration": ..., "end_time": ...}, ...]
+[{"group": "...", "pid": ..., "name": "...", "message": "...", "time": ..., "duration": ..., "end_time": ...}, ...]
 ```
 
 ### `summary`
@@ -68,17 +70,21 @@ Counters: 53
 ### `analyze`
 
 Compute rendering statistics (vblank intervals, theoretical FPS, frame compositions per
-vblank) and duration/count statistics for a fixed set of WebKit-specific marks (styling,
-layout, rendering, compositing and tiles).
+vblank), a frame cycle breakdown, and duration/count statistics for a fixed set of
+marks (styling, layout, rendering, compositing and tiles).
 
 ```
-webkit-sysprof analyze CAPTURE_FILE [-f text|json] [-t TIMESPAN]
+webkit-sysprof analyze CAPTURE_FILE [-f text|json] [-t TIMESPAN] [-e]
 ```
 
 - `-f`/`--format`: `text` (default) or `json`.
 - `-t`/`--timespan`: restrict the analysis to a window in milliseconds relative to the
-  capture start, e.g. `0-5000`. Either side may be omitted (`500-` means "from 500ms to
-  the end", `-500` means "from the start to 500ms"). Defaults to the whole capture (`-`).
+  capture start, e.g. `0-5000`. Either side may be omitted (`500-` or `500` mean "from
+  500ms to the end", `-500` means "from the start to 500ms"). Defaults to the whole
+  capture (`-`), and is clamped to it.
+- `-e`/`--explain`: interleave the text report with paragraphs explaining how to read
+  it, in particular what theoretical FPS and the frame cycle phases do and do not
+  measure.
 
 ```
 $ webkit-sysprof analyze capture.syscap
@@ -90,27 +96,50 @@ Rendering:
 ...
 
 $ webkit-sysprof analyze -f json -t 0-2000 capture.syscap
-{"document": {...}, "statistics": {...}, "rendering": {...}}
+{"document": {...}, "statistics": {...}, "rendering": {...}, "frame_cycle": {...}}
 ```
 
 Restricting the timespan matters more than it looks: page load dominates the tail of
 most metrics, so a whole-capture run largely measures startup. Skipping the first
 seconds is usually what you want when comparing configurations.
 
+#### Theoretical FPS
+
+`frames rendered` counts `DidRenderFrame` marks of every process (one per composition,
+emitted once it is painted and before the frame is handed over) and
+`theoretical FPS` divides that by the analyzed duration. `analyze --explain` prints
+what that does and does not say, and how it relates to the display refresh rate.
+
+Note that `vblanks per LayerTreeHostRenderingUpdate` (and its `more than 1 per update`
+count) only covers the `LayerTreeHostRenderingUpdate` mark. A rendering update that fits
+inside one vblank interval can still miss frames, because compositing happens after it.
+Use the frame cycle for the complete per-frame budget.
+
+#### Frame cycle
+
+A frame cycle is one turn of the engine's rendering loop, split into the phases the
+frame's time went into. `analyze --explain` prints what a cycle is, which mark
+delimits each phase and how to read every number of the section.
+
 #### Reading the mark statistics
 
-Three marks are easy to misread:
+Three marks measure something other than what their name suggests:
 
-- `StyleRecalc` is an umbrella mark that nests `RenderTreeBuild`,
-  `PerformSubtreesLayout` and `CompositingUpdate`. Its duration is not style resolution
-  alone. Subtract the nested marks to get that.
-- `CompositingUpdate` runs twice per rendering update, once inside `StyleRecalc` and
-  once after it, and the second one is much shorter. Its percentiles are therefore
-  bimodal rather than centered on a typical value.
+- `StyleRecalc` is an umbrella mark: `RenderTreeBuild`, the `CompositingUpdate` that
+  follows a style change and, where style resolution interleaves layout, the layout
+  marks all run inside it, so its duration is not style resolution alone.
+- `CompositingUpdate` is emitted wherever the compositing layers are updated, after a
+  style change, after layout and on scrolling, so its samples mix runs of very
+  different lengths and its percentiles are not centered on a typical value.
 - `PaintTile` runs on the painting threads, so summing it over a frame gives aggregate
   work rather than elapsed time. Its `#pixels` statistic is the dirty area taken from
   the mark's `dirty region <x>x<y>+<width>+<height>` message.
 
+Percentiles (P25, P75 and P99) are interpolated between the samples, so they lie
+between the reported minimum and maximum, and are left out below two samples.
+`analyze --explain` prints the long form of all of this in the report itself, next to
+the table it applies to.
+
 ### `delta-histogram`
 
 Plot a histogram of the time between consecutive occurrences of a given mark (e.g. to
diff --git a/Tools/Scripts/webkit-sysprof/pyproject.toml b/Tools/Scripts/webkit-sysprof/pyproject.toml
index db0306a6b062..ca27bbe94888 100644
--- a/Tools/Scripts/webkit-sysprof/pyproject.toml
+++ b/Tools/Scripts/webkit-sysprof/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "setuptools.build_meta"
 name = "webkitsysprof"
 version = "1.0.0"
 description = "WebKit-specific sysprof capture processing toolkit"
-requires-python = ">=3.8"
+requires-python = ">=3.9"
 dependencies = ["matplotlib"]
 
 [project.scripts]
diff --git a/Tools/Scripts/webkit-sysprof/webkitsysprof/__main__.py b/Tools/Scripts/webkit-sysprof/webkitsysprof/__main__.py
index c09dbb92008c..a15a5193a845 100644
--- a/Tools/Scripts/webkit-sysprof/webkitsysprof/__main__.py
+++ b/Tools/Scripts/webkit-sysprof/webkitsysprof/__main__.py
@@ -2,19 +2,38 @@
 import logging
 import os
 import sys
-from typing import Optional, Sequence
+from typing import Any, Callable, Optional, Sequence
 
 from .analyze import analyze
 from .dump import dump
 from .histogram import delta_histogram
 from .summary import summary
+from .utils import UsageError
+
+TIMESPAN_HELP = (
+    'Window of the capture to read, as "<begin>-<end>" in milliseconds from its'
+    ' start, e.g. 0-5000. Either side may be left out: "500-" and "500" both mean'
+    ' from 500ms to the end, "-500" the first 500ms. Anything else is an error.'
+)
+
+
+def _add_subcommand(
+    subparsers: Any,
+    name: str,
+    help_text: str,
+    func: Callable[[argparse.Namespace], None],
+) -> argparse.ArgumentParser:
+    """Add a subcommand that knows its own parser, for reporting usage errors."""
+    command_parser = subparsers.add_parser(name, help=help_text)
+    command_parser.set_defaults(func=func, command_parser=command_parser)
+    return command_parser
 
 
 def build_parser() -> argparse.ArgumentParser:
     parser = argparse.ArgumentParser(prog="webkit-sysprof")
     subparsers = parser.add_subparsers(dest="command", required=True)
 
-    dump_parser = subparsers.add_parser("dump", help="Dump capture data as CSV")
+    dump_parser = _add_subcommand(subparsers, "dump", "Dump capture data as CSV", dump)
     dump_group = dump_parser.add_mutually_exclusive_group()
     dump_group.add_argument("--marks", action="store_true", help="Dump marks (default)")
     dump_group.add_argument("--counters", action="store_true", help="Dump counters")
@@ -28,17 +47,15 @@ def build_parser() -> argparse.ArgumentParser:
         default="csv",
         help="Format to be printed to STDOUT",
     )
-    dump_parser.set_defaults(func=dump)
 
-    summary_parser = subparsers.add_parser(
-        "summary", help="Print a summary of a capture"
+    summary_parser = _add_subcommand(
+        subparsers, "summary", "Print a summary of a capture", summary
     )
     summary_parser.add_argument(
         "capture_file", metavar="CAPTURE_FILE", help="Path to a .capture file"
     )
-    summary_parser.set_defaults(func=summary)
 
-    analyze_parser = subparsers.add_parser("analyze", help="Analyze capture")
+    analyze_parser = _add_subcommand(subparsers, "analyze", "Analyze capture", analyze)
     analyze_parser.add_argument(
         "capture_file", metavar="CAPTURE_FILE", help="Path to a .capture file"
     )
@@ -54,12 +71,21 @@ def build_parser() -> argparse.ArgumentParser:
         "--timespan",
         type=str,
         default="-",
-        help="Timespan in milliseconds e.g. 0-5000",
+        help=TIMESPAN_HELP,
+    )
+    analyze_parser.add_argument(
+        "-e",
+        "--explain",
+        action="store_true",
+        help="Explain how to read the report, alongside the report itself"
+        " (text format only)",
     )
-    analyze_parser.set_defaults(func=analyze)
 
-    histogram_parser = subparsers.add_parser(
-        "delta-histogram", help="Generate histogram from capture"
+    histogram_parser = _add_subcommand(
+        subparsers,
+        "delta-histogram",
+        "Generate histogram from capture",
+        delta_histogram,
     )
     histogram_parser.add_argument(
         "capture_file", metavar="CAPTURE_FILE", help="Path to a .capture file"
@@ -74,9 +100,8 @@ def build_parser() -> argparse.ArgumentParser:
         "--timespan",
         type=str,
         default="-",
-        help="Timespan in milliseconds e.g. 0-5000",
+        help=TIMESPAN_HELP,
     )
-    histogram_parser.set_defaults(func=delta_histogram)
 
     return parser
 
@@ -90,6 +115,8 @@ def main(argv: Optional[Sequence[str]] = None) -> None:
     args = parser.parse_args(argv)
     try:
         args.func(args)
+    except UsageError as error:
+        args.command_parser.error(str(error))
     except BrokenPipeError:
         devnull = os.open(os.devnull, os.O_WRONLY)
         os.dup2(devnull, sys.stdout.fileno())
diff --git a/Tools/Scripts/webkit-sysprof/webkitsysprof/analyze/__init__.py b/Tools/Scripts/webkit-sysprof/webkitsysprof/analyze/__init__.py
index 88e4a90e1eb0..3facf7b952aa 100644
--- a/Tools/Scripts/webkit-sysprof/webkitsysprof/analyze/__init__.py
+++ b/Tools/Scripts/webkit-sysprof/webkitsysprof/analyze/__init__.py
@@ -1,22 +1,31 @@
 import argparse
+import bisect
 import logging
 import re
-import statistics
 import collections
 import json
 from typing import Any, Callable, Dict, List, Optional, Sequence, Tuple, Union
 
 from ..parser import parse
+from . import explanations
+from ..cycles import PHASES, calculate_frame_cycles
 from ..utils import (
+    UsageError,
+    check_timespan_holds_data,
+    mark_begin,
+    median_vblank_interval,
+    msec_to_sec,
     nsec_to_msec,
     nsec_to_sec,
-    msec_to_sec,
     parse_timespan_argument,
-    trim_sysprof_data_to_timespan,
+    merged_spans,
+    display_refreshes,
+    intervals_between_marks,
+    sample_statistics,
+    sysprof_data_with_marks_by_name,
+    trim_marks_by_name_to_timespan,
 )
 
-RELEVANT_PERCENTILES = [25, 50, 75, 99]
-
 # Columns of the statistics tables, as (label, statistics key, percentile) triples.
 # The percentile is None for statistics that are not percentiles. The median is taken
 # from the "median" key rather than from the 50th percentile: both describe the same
@@ -32,6 +41,15 @@
     ("max", "max", None),
 ]
 
+# Derived from the columns, so the percentiles computed and the ones printed cannot
+# drift apart. The 50th is not a column - the median column prints the exact value -
+# but stays for the JSON report, whose consumers already read it.
+PERCENTILE_SHOWN_AS_MEDIAN = 50
+RELEVANT_PERCENTILES = sorted(
+    {percentile for _, _, percentile in STATISTICS_COLUMNS if percentile is not None}
+    | {PERCENTILE_SHOWN_AS_MEDIAN}
+)
+
 MARKS_RELEVANT_FOR_STATISTICS = [
     "EventLoopRun",
     "RAFCallback",
@@ -56,6 +74,22 @@
 # PaintTile messages look like "Skia/CPU threaded, dirty region 768x512+256+56",
 # where the geometry is "<x>x<y>+<width>+<height>".
 DIRTY_REGION_RE = re.compile(r"(\d+)x(\d+)\+(\d+)\+(\d+)")
+REASONS_RE = re.compile(r"^reasons:([^|\n]*)")
+TASKS_RE = re.compile(r"^tasks:\s*(\d+)")
+SUBTREES_RE = re.compile(r"^subtrees:\s*(\d+)")
+TILES_RE = re.compile(r"^dirty tiles:\s*(\d+)")
+
+
+def _frame_rendering_reason(message: str) -> str:
+    """Why a frame was composited, as the DidRenderFrame message tells it."""
+    match = REASONS_RE.match(message.strip())
+    return (match.group(1).strip() if match is not None else "") or "_none"
+
+
+def _counted(message: str, pattern: "re.Pattern[str]") -> Optional[int]:
+    """The number the pattern names in a mark message, None where it does not."""
+    match = pattern.match(message.strip())
+    return int(match.group(1)) if match is not None else None
 
 
 def _dirty_region_pixels(message: str) -> Optional[int]:
@@ -71,15 +105,15 @@ def _dirty_region_pixels(message: str) -> Optional[int]:
     },
     "EventLoopRun": lambda data: STATISTICAL_DATA_EXTRACTORS["_"](data)
     | {
-        "tasks": int(data["message"].split()[1]),
+        "tasks": _counted(data["message"], TASKS_RE),
     },
     "PerformSubtreesLayout": lambda data: STATISTICAL_DATA_EXTRACTORS["_"](data)
     | {
-        "subtrees": int(data["message"].split()[1]) if data["message"] != "" else None,
+        "subtrees": _counted(data["message"], SUBTREES_RE),
     },
     "UpdateTiles": lambda data: STATISTICAL_DATA_EXTRACTORS["_"](data)
     | {
-        "tiles": int(data["message"].split()[2]) if data["message"] != "" else None,
+        "tiles": _counted(data["message"], TILES_RE),
     },
     "PaintTile": lambda data: STATISTICAL_DATA_EXTRACTORS["_"](data)
     | {
@@ -89,105 +123,102 @@ def _dirty_region_pixels(message: str) -> Optional[int]:
 
 
 def analyze(args: argparse.Namespace) -> None:
+    if args.explain and args.format != "text":
+        raise UsageError("--explain only applies to the text format")
     timespan_begin, timespan_end = parse_timespan_argument(args.timespan)
     parsed_data = parse(args.capture_file, marks=True, counters=False)
-    trimmed_data = trim_sysprof_data_to_timespan(
-        parsed_data, timespan_begin, timespan_end
-    )
-    data = _sysprof_data_to_high_level_representation(trimmed_data)
+    capture_begin, capture_end = parsed_data["document"]["timespan"]
+    check_timespan_holds_data(capture_begin, capture_end, timespan_begin, timespan_end)
+    untrimmed_data = sysprof_data_with_marks_by_name(parsed_data)
+    data = trim_marks_by_name_to_timespan(untrimmed_data, timespan_begin, timespan_end)
     logging.info("Preparing report...")
-    report = _prepare_report(data, timespan_begin, timespan_end)
+    # Frame cycles are built from the untrimmed capture and only then cut down to
+    # the timespan: trimming drops the marks that cross a timespan boundary, and a
+    # cycle at that boundary needs them.
+    report = _prepare_report(data, untrimmed_data)
 
     logging.info("Rendering report...")
     if args.format == "text":
-        _render_text_report(report)
+        _render_text_report(report, args.explain)
     elif args.format == "json":
         print(json.dumps(report))
     else:
         raise NotImplementedError
 
 
-def _sysprof_data_to_high_level_representation(
-    sysprof_data: Dict[str, Any],
-) -> Dict[str, Any]:
-    high_level_representation: Dict[str, Any] = {
-        "document": sysprof_data["document"],
-        "all_marks": sysprof_data["marks"],
-        "marks": {},
-    }
-    high_level_representation["document"]["timespan"] = {
-        "begin": sysprof_data["document"]["timespan"][0],
-        "end": sysprof_data["document"]["timespan"][1],
-    }
-    for mark in sysprof_data["marks"]:
-        high_level_representation["marks"].setdefault(mark["name"], []).append(mark)
-    for mark_name in high_level_representation["marks"]:
-        high_level_representation["marks"][mark_name].sort(key=lambda m: m["end_time"])
-    return high_level_representation
+def _calculate_statistics(values: Sequence[Union[int, float]]) -> Dict[str, Any]:
+    return sample_statistics(values, RELEVANT_PERCENTILES)
 
 
 def _prepare_report(
     sysprof_data: Dict[str, Any],
-    timespan_begin: Optional[int],
-    timespan_end: Optional[int],
+    untrimmed_sysprof_data: Dict[str, Any],
 ) -> Dict[str, Any]:
-    # TODO: Frame time.
     # TODO: Dropped frames.
     # TODO: Interaction latency.
     # TODO: System metrics.
-    report = {
-        "document": sysprof_data["document"],
-        "statistics": {},
-        "rendering": _prepare_rendering_report(sysprof_data),
+    timespan_begin = sysprof_data["document"]["timespan"]["begin"]
+    timespan_end = sysprof_data["document"]["timespan"]["end"]
+    document = dict(sysprof_data["document"])
+    document["timespan"] = {
+        "begin": nsec_to_msec(timespan_begin),
+        "end": nsec_to_msec(timespan_end),
     }
-
-    statistics_input_data = _calculate_statistics_input_data(
+    mark_statistics = _calculate_statistics_input_data(
         MARKS_RELEVANT_FOR_STATISTICS, sysprof_data
     )
-    statistics = statistics_input_data
-    for mark_name in statistics:
-        for input_name in statistics[mark_name]:
-            statistics[mark_name][input_name] = _calculate_statistics(
-                statistics[mark_name][input_name]
+    for mark_name in mark_statistics:
+        for input_name in mark_statistics[mark_name]:
+            mark_statistics[mark_name][input_name] = _calculate_statistics(
+                mark_statistics[mark_name][input_name]
             )
-    report["statistics"].update(statistics)
-    report["document"]["timespan"]["begin"] = nsec_to_msec(
-        report["document"]["timespan"]["begin"]
-    )
-    report["document"]["timespan"]["end"] = nsec_to_msec(
-        report["document"]["timespan"]["end"]
-    )
+    report = {
+        "document": document,
+        "statistics": mark_statistics,
+        "rendering": _prepare_rendering_report(
+            sysprof_data, display_refreshes(sysprof_data)
+        ),
+        "frame_cycle": _prepare_frame_cycle_report(
+            untrimmed_sysprof_data,
+            timespan_begin,
+            timespan_end,
+            # From the whole capture, not from the window: a narrow window holds
+            # too few vblanks, and the cycles come from the whole capture too.
+            median_vblank_interval(
+                display_refreshes(untrimmed_sysprof_data)
+            ),
+        ),
+    }
 
     return report
 
 
-def _prepare_rendering_report(sysprof_data: Dict[str, Any]) -> Dict[str, Any]:
+def _prepare_rendering_report(
+    sysprof_data: Dict[str, Any], vblanks: Sequence[Dict[str, Any]]
+) -> Dict[str, Any]:
     document_duration = nsec_to_sec(
         sysprof_data["document"]["timespan"]["end"]
         - sysprof_data["document"]["timespan"]["begin"]
     )
-    vblanks = sysprof_data["marks"].get("DisplayLinkUpdate", [])
-    vblanks_per_rendering_update = _calculate_vblanks_per_rendering_update(sysprof_data)
+    intervals = intervals_between_marks(vblanks)
+    vblanks_per_rendering_update = _calculate_vblanks_per_rendering_update(
+        vblanks, sysprof_data["marks"].get("LayerTreeHostRenderingUpdate", [])
+    )
     did_render_frames = sysprof_data["marks"].get("DidRenderFrame", [])
     report = {
         "vblanks": len(vblanks),
-        "vblank_interval_statistics": _calculate_statistics(
-            [
-                nsec_to_msec(vblanks[i]["end_time"] - vblanks[i - 1]["end_time"])
-                for i in range(1, len(vblanks))
-            ]
-        ),
+        "vblank_interval_statistics": _calculate_statistics(intervals),
         "frames_rendered": len(did_render_frames),
         "theoretical_fps": (
-            len(did_render_frames) / document_duration if document_duration != 0 else 0
+            len(did_render_frames) / document_duration
+            if document_duration > 0
+            else None
         ),
-        "frame_rendering_reasons": dict(
-            collections.Counter(
-                [mark["message"].split(":")[1].strip() for mark in did_render_frames]
-            )
+        "frame_rendering_reasons": collections.Counter(
+            [_frame_rendering_reason(mark["message"]) for mark in did_render_frames]
         ),
         "frame_compositions_per_vblank_statistics": _calculate_statistics(
-            _calculate_frame_compositions_per_vblank(sysprof_data)
+            _calculate_frame_compositions_per_vblank(vblanks, did_render_frames)
         ),
         "vblanks_per_rendering_update": {
             "n_greater_than_1": len(
@@ -199,62 +230,121 @@ def _prepare_rendering_report(sysprof_data: Dict[str, Any]) -> Dict[str, Any]:
     return report
 
 
-def _calculate_frame_compositions_per_vblank(sysprof_data: Dict[str, Any]) -> List[int]:
-    vblanks = sysprof_data["marks"].get("DisplayLinkUpdate", [])
-    if len(vblanks) == 0:
+def _covered_duration(cycles: Sequence[Dict[str, Any]]) -> float:
+    """How much of the timeline the cycles span, in milliseconds.
+
+    Their spans are merged rather than summed, since the cycles of two processes
+    rendering at once overlap and would otherwise cover more time than there is.
+    """
+    return nsec_to_msec(
+        sum(
+            end - begin
+            for begin, end in merged_spans(
+                (cycle["begin_nsec"], cycle["end_nsec"]) for cycle in cycles
+            )
+        )
+    )
+
+
+def _cycle_in_vblank_intervals(
+    cycles: int,
+    median_duration: float,
+    vblank_interval: Optional[float],
+) -> Tuple[Optional[float], Optional[str]]:
+    if not cycles:
+        return None, "no_cycles"
+    if vblank_interval is None:
+        return None, "no_vblank_interval"
+    if not vblank_interval:
+        return None, "zero_vblank_interval"
+    if not median_duration:
+        return None, "zero_length_cycle"
+    return median_duration / vblank_interval, None
+
+
+def _prepare_frame_cycle_report(
+    sysprof_data: Dict[str, Any],
+    timespan_begin: int,
+    timespan_end: int,
+    vblank_interval: Optional[float],
+) -> Dict[str, Any]:
+    cycles = calculate_frame_cycles(sysprof_data, timespan_begin, timespan_end)
+    durations = [cycle["duration"] for cycle in cycles]
+    resolved = [cycle for cycle in cycles if cycle["phases"] is not None]
+    # The phase statistics cover the resolved cycles only, so the duration they are
+    # shares of has to cover the same ones. Taken from all cycles instead, the four
+    # shares do not sum to 100%.
+    resolved_durations = [cycle["duration"] for cycle in resolved]
+
+    duration_statistics = _calculate_statistics(durations)
+    median_duration = duration_statistics.get("median", 0.0)
+    analyzed_duration = nsec_to_msec(timespan_end - timespan_begin)
+    overrunning = [cycle for cycle in resolved if cycle["composition_overrun"] > 0]
+    intervals_per_cycle, unknown_reason = _cycle_in_vblank_intervals(
+        len(cycles), median_duration, vblank_interval
+    )
+    return {
+        "cycles": len(cycles),
+        "processes": len({cycle["pid"] for cycle in cycles}),
+        "duration_statistics": duration_statistics,
+        "implied_fps": 1 / msec_to_sec(median_duration) if median_duration else None,
+        "coverage": (
+            _covered_duration(cycles) / analyzed_duration
+            if analyzed_duration > 0
+            else None
+        ),
+        "capture_vblank_interval": vblank_interval,
+        "vblank_intervals_per_cycle": intervals_per_cycle,
+        "vblank_intervals_per_cycle_unknown": unknown_reason,
+        "phase_statistics": {
+            phase: _calculate_statistics([cycle["phases"][phase] for cycle in resolved])
+            for phase in PHASES
+        },
+        "resolved_duration_statistics": _calculate_statistics(resolved_durations),
+        "overrunning_composition_statistics": _calculate_statistics(
+            [cycle["composition_overrun"] for cycle in overrunning]
+        ),
+    }
+
+
+def _calculate_frame_compositions_per_vblank(
+    vblanks: Sequence[Dict[str, Any]], compositing_finishes: Sequence[Dict[str, Any]]
+) -> List[int]:
+    """Compositions finished within each interval between two consecutive vblanks."""
+    if len(vblanks) < 2:
         return []
-    compositing_finishes = sysprof_data["marks"].get("DidRenderFrame", [])
-    frame_compositions_per_vblank = [0]
-    vblanks_iterator = 0
+    vblank_ends = [vblank["end_time"] for vblank in vblanks]
+    compositions_per_interval = [0] * (len(vblanks) - 1)
     for compositing_finish in compositing_finishes:
-        while (
-            vblanks_iterator < len(vblanks)
-            and vblanks[vblanks_iterator]["end_time"] <= compositing_finish["end_time"]
-        ):
-            vblanks_iterator += 1
-            if vblanks_iterator < len(vblanks):
-                frame_compositions_per_vblank.append(0)
-        if vblanks_iterator == 0:
+        # Each interval runs from one refresh to the next, the later one included,
+        # so a composition ending exactly on a refresh belongs to the interval that
+        # ends there.
+        interval = bisect.bisect_left(vblank_ends, compositing_finish["end_time"]) - 1
+        if not 0 <= interval < len(compositions_per_interval):
+            # Composited before the first vblank of the timespan or after the last
+            # one, so there is no interval between two refreshes it belongs to.
             continue
-        frame_compositions_per_vblank[vblanks_iterator - 1] += 1
-
-    return frame_compositions_per_vblank
+        compositions_per_interval[interval] += 1
+    return compositions_per_interval
 
 
-def _calculate_vblanks_per_rendering_update(sysprof_data: Dict[str, Any]) -> List[int]:
-    vblanks = sysprof_data["marks"].get("DisplayLinkUpdate", [])
-    if len(vblanks) == 0:
+def _calculate_vblanks_per_rendering_update(
+    vblanks: Sequence[Dict[str, Any]], rendering_updates: Sequence[Dict[str, Any]]
+) -> List[int]:
+    """How many display refreshes each rendering update spanned."""
+    if not vblanks:
         return []
-    rendering_updates = sysprof_data["marks"]["LayerTreeHostRenderingUpdate"]
-    vblanks_iterator = 0
-    vblanks_per_rendering_update = []
+    vblank_ends = [vblank["end_time"] for vblank in vblanks]
+    counts = []
     for rendering_update in rendering_updates:
-        rendering_update_begin = (
-            rendering_update["end_time"] - rendering_update["duration"]
-        )
-        while (
-            vblanks_iterator < len(vblanks)
-            and vblanks[vblanks_iterator]["end_time"] <= rendering_update_begin
-        ):
-            vblanks_iterator += 1
-        if (
-            vblanks_iterator >= len(vblanks)
-            or vblanks[vblanks_iterator]["end_time"] <= rendering_update_begin
-        ):
-            break
-        if vblanks_iterator == 0:
+        begin, end = mark_begin(rendering_update), rendering_update["end_time"]
+        if end < vblank_ends[0] or begin > vblank_ends[-1]:
+            # Outside the refreshes the timespan holds, so they say nothing about
+            # this update, rather than saying it spanned none of them.
             continue
-        vblanks_during_rendering_update = 0
-        while (
-            vblanks_iterator < len(vblanks)
-            and vblanks[vblanks_iterator]["end_time"] <= rendering_update["end_time"]
-        ):
-            vblanks_iterator += 1
-            vblanks_during_rendering_update += 1
-        vblanks_per_rendering_update.append(
-            1 + max(vblanks_during_rendering_update - 1, 0)
-        )
-    return vblanks_per_rendering_update
+        first = bisect.bisect_right(vblank_ends, begin)
+        counts.append(max(bisect.bisect_right(vblank_ends, end) - first, 1))
+    return counts
 
 
 def _calculate_statistics_input_data(
@@ -279,45 +369,14 @@ def _calculate_statistics_input_data(
     return statistics_input_data
 
 
-def _calculate_statistics(values: Sequence[Union[int, float]]) -> Dict[str, Any]:
-    if values == []:
-        return {}
-    result: Dict[str, Any] = {
-        "n": len(values),
-        "min": min(values),
-        "max": max(values),
-        "mean": statistics.mean(values),
-        "stddev": statistics.stdev(values) if len(values) > 1 else 0,
-        "median": statistics.median(values),
-    }
-    if len(values) > 1:
-        result["percentiles"] = {
-            k: v
-            for k, v in dict(
-                zip(range(1, 100), statistics.quantiles(values, n=100))
-            ).items()
-            if k in RELEVANT_PERCENTILES
-        }
-    return result
-
-
-def _render_text_report(report: Dict[str, Any]) -> None:
+def _render_text_report(report: Dict[str, Any], explain: bool = False) -> None:
     print(
         "Timespan: {:.4f} - {:.4f} [s]".format(
-            abs(msec_to_sec(report["document"]["timespan"]["begin"])),
-            abs(msec_to_sec(report["document"]["timespan"]["end"])),
-        )
-    )
-    print(
-        "Duration: {:.4f} [s]".format(
-            abs(
-                msec_to_sec(
-                    report["document"]["timespan"]["end"]
-                    - report["document"]["timespan"]["begin"]
-                )
-            )
+            msec_to_sec(report["document"]["timespan"]["begin"]),
+            msec_to_sec(report["document"]["timespan"]["end"]),
         )
     )
+    print("Duration: {:.4f} [s]".format(_analyzed_duration_sec(report)))
 
     print()
     print("Rendering:")
@@ -333,15 +392,13 @@ def _render_text_report(report: Dict[str, Any]) -> None:
         )
     )
     vblanks_per_rendering_update_statistics = _statistics_to_strings(
-        report["rendering"]["vblanks_per_rendering_update"]["statistics"]
+        report["rendering"]["vblanks_per_rendering_update"]["statistics"], "{:.4g}"
     )
     print("- vblanks per LayerTreeHostRenderingUpdate: ", end="")
     print(
-        "(min: {}, median: {}, P75: {}, P99: {}, max: {})".format(
+        "(min: {}, {}, max: {})".format(
             vblanks_per_rendering_update_statistics["min"],
-            vblanks_per_rendering_update_statistics["median"],
-            vblanks_per_rendering_update_statistics["percentiles"][75],
-            vblanks_per_rendering_update_statistics["percentiles"][99],
+            ", ".join(_percentile_strings(vblanks_per_rendering_update_statistics)),
             vblanks_per_rendering_update_statistics["max"],
         )
     )
@@ -351,24 +408,40 @@ def _render_text_report(report: Dict[str, Any]) -> None:
         )
     )
     print(f"- frames rendered: {report['rendering']['frames_rendered']}")
-    print(f"- theoretical FPS: {report['rendering']['theoretical_fps']:.2f}")
+    theoretical_fps = report["rendering"]["theoretical_fps"]
+    print(
+        "- theoretical FPS: {}".format(
+            "{:.2f}".format(theoretical_fps) if theoretical_fps is not None else "-"
+        )
+    )
     print("- frame rendering reasons:")
     for reason in sorted(report["rendering"]["frame_rendering_reasons"].keys()):
         print(
             "  - {}: {}".format(
-                reason, report["rendering"]["frame_rendering_reasons"][reason]
+                explanations.UNNAMED_FRAME_RENDERING_REASONS.get(reason, reason),
+                report["rendering"]["frame_rendering_reasons"][reason],
             )
         )
     frame_compositions_per_vblank_statistics = _statistics_to_strings(
-        report["rendering"]["frame_compositions_per_vblank_statistics"]
+        report["rendering"]["frame_compositions_per_vblank_statistics"], "{:.4g}"
     )
     print(
-        "- frame compositions per vblank: (min: {}, median: {}, max: {})".format(
+        "- frame compositions per vblank:"
+        " (min: {}, mean: {}, median: {}, max: {})".format(
             frame_compositions_per_vblank_statistics["min"],
+            frame_compositions_per_vblank_statistics["mean"],
             frame_compositions_per_vblank_statistics["median"],
             frame_compositions_per_vblank_statistics["max"],
         )
     )
+    if explain:
+        print()
+        print(_theoretical_fps_explanation(report))
+
+    _render_frame_cycle_numbers(report["frame_cycle"])
+    if explain:
+        print()
+        print(explanations.FRAME_CYCLE)
 
     print()
     print("Statistics (durations):")
@@ -397,17 +470,9 @@ def _render_text_report(report: Dict[str, Any]) -> None:
             report,
         )
     )
-    print()
-    print(
-        "  StyleRecalc is an umbrella mark: it nests RenderTreeBuild,\n"
-        "  PerformSubtreesLayout and CompositingUpdate, so its duration is not\n"
-        "  style resolution alone. Subtract the nested marks to get that.\n"
-        "  CompositingUpdate runs twice per rendering update, once inside\n"
-        "  StyleRecalc and once after it, and the second one is much shorter, so\n"
-        "  its percentiles are bimodal rather than centered on a typical value.\n"
-        "  PaintTile runs on the painting threads, so summing it across a frame\n"
-        "  yields aggregate work rather than elapsed time."
-    )
+    if explain:
+        print()
+        print(explanations.MARK_STATISTICS)
 
     print()
     print("Statistics (other):")
@@ -424,6 +489,170 @@ def _render_text_report(report: Dict[str, Any]) -> None:
     )
 
 
+def _analyzed_duration_sec(report: Dict[str, Any]) -> float:
+    """How long the analyzed timespan is, in seconds."""
+    return msec_to_sec(
+        report["document"]["timespan"]["end"] - report["document"]["timespan"]["begin"]
+    )
+
+
+def _theoretical_fps_explanation(report: Dict[str, Any]) -> str:
+    rendering = report["rendering"]
+    if rendering["theoretical_fps"] is None:
+        return explanations.UNKNOWN_THEORETICAL_FPS.format(
+            frames=rendering["frames_rendered"],
+            refresh_rate=_refresh_rate_explanation(report),
+        )
+    return explanations.THEORETICAL_FPS.format(
+        frames=rendering["frames_rendered"],
+        duration=_analyzed_duration_sec(report),
+        fps="{:.2f}".format(rendering["theoretical_fps"]),
+        refresh_rate=_refresh_rate_explanation(report),
+    )
+
+
+def _refresh_rate_explanation(report: Dict[str, Any]) -> str:
+    rendering = report["rendering"]
+    interval = rendering["vblank_interval_statistics"].get("median")
+    vblanks = rendering["vblanks"]
+    if interval:
+        refresh_rate = explanations.REFRESH_RATE.format(
+            rate=1 / msec_to_sec(interval), interval=interval
+        )
+    elif interval is None:
+        refresh_rate = explanations.REFRESH_RATE_WITHOUT_INTERVAL.format(
+            vblanks=vblanks, plural="" if vblanks == 1 else "s"
+        )
+    else:
+        refresh_rate = explanations.REFRESH_RATE_ZERO_INTERVAL.format(vblanks=vblanks)
+    return refresh_rate
+
+
+def _percentile_strings(strings: Dict[str, Any]) -> List[str]:
+    """The percentiles of a statistic, and its median among them, in order.
+
+    Takes the strings _statistics_to_strings() built, not the statistic itself.
+    """
+    return [
+        (
+            "median: {}".format(strings["median"])
+            if percentile == PERCENTILE_SHOWN_AS_MEDIAN
+            else "P{}: {}".format(percentile, strings["percentiles"][percentile])
+        )
+        for percentile in RELEVANT_PERCENTILES
+    ]
+
+
+def _analyzed_cycles(frame_cycle: Dict[str, Any]) -> int:
+    """How many cycles the phase statistics were taken from."""
+    return frame_cycle["resolved_duration_statistics"].get("n", 0)
+
+
+def _render_frame_cycle_numbers(frame_cycle: Dict[str, Any]) -> None:
+    print()
+    print("Frame cycle:")
+    print(f"- cycles: {frame_cycle['cycles']}")
+    if frame_cycle["processes"] > 1:
+        print(
+            "- rendered by {} processes, whose frames the medians below"
+            " describe together".format(frame_cycle["processes"])
+        )
+
+    if frame_cycle["cycles"] == 0:
+        print(
+            "- no cycles here: no two consecutive LayerTreeHostRenderingUpdate"
+            " marks of one process begin within the analyzed timespan"
+        )
+        return
+
+    duration_statistics = _statistics_to_strings(frame_cycle["duration_statistics"])
+    print(
+        "- cycle duration: (min: {}, {}, max: {}) [ms]".format(
+            duration_statistics["min"],
+            ", ".join(_percentile_strings(duration_statistics)),
+            duration_statistics["max"],
+        )
+    )
+    implied_fps = frame_cycle["implied_fps"]
+    print(
+        "- implied FPS (1000 / median cycle): {}".format(
+            "{:.2f}".format(implied_fps) if implied_fps is not None else "-"
+        )
+    )
+    coverage = frame_cycle["coverage"]
+    print(
+        "- cycles cover {} of the analyzed duration".format(
+            "{:.1f}%".format(coverage * 100) if coverage is not None else "-"
+        )
+    )
+    if frame_cycle["vblank_intervals_per_cycle"] is None:
+        print(
+            "- median cycle in vblank intervals: - ({})".format(
+                explanations.UNKNOWN_VBLANK_INTERVALS_PER_CYCLE[
+                    frame_cycle["vblank_intervals_per_cycle_unknown"]
+                ]
+            )
+        )
+    else:
+        print(
+            "- median cycle in vblank intervals: {:.2f}"
+            " ({:.4f} ms per vblank, from the whole capture)".format(
+                frame_cycle["vblank_intervals_per_cycle"],
+                frame_cycle["capture_vblank_interval"],
+            )
+        )
+
+    # Shares of the median duration of the analyzed cycles, not of all of them,
+    # since the phase medians cover the analyzed ones only.
+    median_duration = frame_cycle["resolved_duration_statistics"].get("median", 0)
+    analyzed = "{} of {} cycles analyzed".format(
+        _analyzed_cycles(frame_cycle), frame_cycle["cycles"]
+    )
+    # Each phase is its own median, and medians do not add up, so the shares below
+    # need not total 100%.
+    if median_duration:
+        analyzed += ", median analyzed cycle {:.4f} ms".format(median_duration)
+    print(f"- phases (median, {analyzed}):")
+    shares_shown = False
+    for phase in PHASES:
+        label = phase.replace("_", " ")
+        phase_statistics = frame_cycle["phase_statistics"][phase]
+        if not phase_statistics:
+            print(f"  - {label}: -")
+            continue
+        share = "-"
+        if median_duration:
+            share = "{:.1f}%".format(phase_statistics["median"] / median_duration * 100)
+            shares_shown = True
+        print(
+            "  - {}: {:.4f} ms ({} of the cycle)".format(
+                label, phase_statistics["median"], share
+            )
+        )
+    if shares_shown:
+        print(
+            "  (each phase is a median of its own,"
+            " so the shares need not total 100%)"
+        )
+    overrun_statistics = frame_cycle["overrunning_composition_statistics"]
+    if not _analyzed_cycles(frame_cycle):
+        print("- composition overrunning the cycle: -")
+    elif overrun_statistics:
+        print(
+            "- composition overrunning the cycle: in {} of {} analyzed cycles,"
+            " by {:.4f} ms median".format(
+                overrun_statistics["n"],
+                _analyzed_cycles(frame_cycle),
+                overrun_statistics["median"],
+            )
+        )
+    else:
+        print(
+            "- composition overrunning the cycle: in none of {} analyzed"
+            " cycles".format(_analyzed_cycles(frame_cycle))
+        )
+
+
 def _render_statistics_rows_to_stdout(statistics_rows: List[List[str]]) -> None:
     column_max_sizes = [
         max([len(row[col]) for row in statistics_rows])
@@ -460,28 +689,34 @@ def _prepare_statistics_row(
     ]
 
 
-def _statistics_to_strings(statistics: Dict[str, Any]) -> Dict[str, Any]:
+def _statistics_to_strings(
+    statistic: Dict[str, Any], number: str = "{:.4f}"
+) -> Dict[str, Any]:
+    """The numbers of a statistic as strings, `-` where it holds none."""
+
     def format_statistic(
         data: Dict[str, Any],
         key: str,
         default: str = "-",
-        subkey: Optional[int] = None,
+        subkey: Optional[str] = None,
     ) -> str:
         if key not in data:
             return default
-        number = data[key]
-        if subkey is not None and subkey in number:
-            number = data[key][subkey]
+        value = data[key]
+        if subkey is not None:
+            if subkey not in value:
+                return default
+            value = value[subkey]
         if key == "n":
-            return str(number)
-        return "{:.4f}".format(number)
+            return str(value)
+        return number.format(value)
 
     return {
-        key: format_statistic(statistics, key, "0" if key == "n" else "-")
+        key: format_statistic(statistic, key, "0" if key == "n" else "-")
         for key in ["n", "min", "max", "mean", "stddev", "median"]
     } | {
         "percentiles": {
-            percentile: format_statistic(statistics, "percentiles", "-", percentile)
+            percentile: format_statistic(statistic, "percentiles", "-", str(percentile))
             for percentile in RELEVANT_PERCENTILES
         }
     }
diff --git a/Tools/Scripts/webkit-sysprof/webkitsysprof/analyze/explanations.py b/Tools/Scripts/webkit-sysprof/webkitsysprof/analyze/explanations.py
new file mode 100644
index 000000000000..2ff83543cc79
--- /dev/null
+++ b/Tools/Scripts/webkit-sysprof/webkitsysprof/analyze/explanations.py
@@ -0,0 +1,110 @@
+"""The paragraphs `analyze --explain` prints, kept apart from the analysis itself.
+
+The long form of what the report means. The README keeps the same caveats short.
+"""
+
+THEORETICAL_FPS = """\
+  Theoretical FPS is the number of DidRenderFrame marks, one per
+  composition, divided by the analyzed duration:
+  {frames} / {duration:.4f} s = {fps}. It is not clamped to the refresh
+  rate, and it counts every process, so two renderers compositing once
+  per refresh read as two.
+{refresh_rate}
+  Matching it means completing one frame per vblank interval. The frame
+  cycle below shows where a frame's time goes."""
+
+UNKNOWN_THEORETICAL_FPS = """\
+  Theoretical FPS is the number of DidRenderFrame marks, one per
+  composition, divided by the analyzed duration. It is unknown here: the
+  analyzed timespan has no length to divide the {frames} of them by.
+{refresh_rate}"""
+
+REFRESH_RATE = """\
+  That rate is {rate:.2f} Hz here, from the median vblank interval of
+  {interval:.4f} ms."""
+
+REFRESH_RATE_WITHOUT_INTERVAL = """\
+  That rate is unknown here: the display link refreshed {vblanks} time{plural},
+  too few for an interval between two refreshes."""
+
+REFRESH_RATE_ZERO_INTERVAL = """\
+  That rate is unknown here: the median interval between two of the {vblanks}
+  refreshes is zero."""
+
+FRAME_CYCLE = """\
+  A frame cycle starts when a LayerTreeHostRenderingUpdate begins and
+  ends when the next one begins, so consecutive cycles tile a rendering
+  period without gaps and the frame rate within it is 1 / cycle
+  duration. The phases are:
+    - rendering update: the LayerTreeHostRenderingUpdate mark itself,
+      i.e. requestAnimationFrame callbacks, style recalc, layout and the
+      compositing update.
+    - compositing: the time after the rendering update spent in
+      RenderLayerTree, FlushCompositingState, PaintToGLContext or
+      WaitForCompositionCompletion. They are merged as spans rather than
+      added up, since they nest and a cycle can composite twice with a
+      wait in between. On GTK and WPE the wait for the GPU and the buffer
+      handover after it both happen inside RenderLayerTree, so getting the
+      frame out is counted here too.
+    - waiting for compositing: what is left of the cycle once the other
+      phases are taken off it, mostly spent waiting for the painting
+      threads to finish their tiles.
+    - idle: from the end of compositing until the next rendering update
+      begins.
+  Each phase is its own median over the cycles it could be read from, so
+  the shares need not total 100%.
+  The loop is vblank-driven, but it does not wait for a refresh it has
+  already missed: a cycle that runs past its vblank deadline schedules
+  the next rendering update as soon as compositing is far enough along
+  rather than at the following refresh, so a cycle longer than one vblank
+  interval means frames cannot be presented on every vblank. Compositing
+  that began in one cycle can then still be running when the next
+  rendering update opens the following one, and since the phases add up
+  to the cycle exactly, that part of it past the cycle end is reported on
+  its own as composition overrunning the cycle rather than as a fifth
+  phase.
+  Implied FPS is the rate of the median cycle, while theoretical FPS
+  averages over the whole analyzed duration, so the two differ by the
+  time no cycle spans, which coverage reports, plus the time the cycles
+  spent idle. A capture that renders for a stretch and then sits still,
+  rather than rendering evenly throughout, keeps a high coverage, since
+  the pause is itself one long cycle, and a high idle share along with
+  it.
+  A cycle reaching past either end of the analyzed timespan is left out
+  of it. Between two rendering periods the engine idles, and that gap is
+  reported as one long, nearly all-idle cycle rather than dropped.
+  A cycle only ever runs between two rendering updates of one process.
+  Where more than one rendered, their cycles are reported together and
+  the count above says so. The refreshes come from the UI process and
+  name no display, so a capture of two displays refreshing at once halves
+  the interval between them and doubles the rate derived from it."""
+
+
+MARK_STATISTICS = """\
+  StyleRecalc is an umbrella mark: RenderTreeBuild, the CompositingUpdate
+  that follows a style change, and layout where style resolution
+  interleaves it all run inside it, so its duration is not style
+  resolution alone. Subtract the nested marks to get that.
+  CompositingUpdate is emitted after a style change, after layout and on
+  scrolling, and those runs are of very different lengths, so its
+  percentiles mix them rather than centering on a typical value.
+  PaintTile runs on the painting threads, so summing it across a frame
+  yields aggregate work rather than elapsed time.
+  Percentiles are interpolated between the samples, so they lie between
+  the minimum and the maximum, and read - below two samples."""
+
+
+# What the report says of a frame whose message named no reason for compositing it,
+# keyed by the token _frame_rendering_reason() buckets it under.
+UNNAMED_FRAME_RENDERING_REASONS = {
+    "_none": "none given",
+}
+
+# What the report says of a median cycle it cannot be given in vblank intervals,
+# keyed by the token _cycle_in_vblank_intervals() reports it with.
+UNKNOWN_VBLANK_INTERVALS_PER_CYCLE = {
+    "no_cycles": "there are no cycles",
+    "no_vblank_interval": "no vblank interval known",
+    "zero_vblank_interval": "the vblank interval is zero",
+    "zero_length_cycle": "the median cycle is of zero length",
+}
diff --git a/Tools/Scripts/webkit-sysprof/webkitsysprof/cycles/__init__.py b/Tools/Scripts/webkit-sysprof/webkitsysprof/cycles/__init__.py
new file mode 100644
index 000000000000..0859a91c21eb
--- /dev/null
+++ b/Tools/Scripts/webkit-sysprof/webkitsysprof/cycles/__init__.py
@@ -0,0 +1,258 @@
+"""Frame cycle reconstruction for the `analyze` command.
+
+What a cycle is, what its phases mean and how to read the numbers taken from them
+is what `analyze --explain` prints, from webkitsysprof.analyze.explanations, which
+is where that is written down rather than here.
+"""
+
+import bisect
+import itertools
+from typing import Any, Dict, List, Optional, Sequence, Tuple
+
+from ..utils import mark_begin, marks_by_process, merged_spans, nsec_to_msec
+
+# Compositing of a cycle is the time any of these marks was running within it,
+# whether the mark began there or in an earlier cycle it overran. All four are read,
+# and as time rather than by name, because which of them a cycle carries varies:
+# renderLayerTree() opens its trace scope before the checks that can return early, so
+# a cycle can hold a RenderLayerTree mark with no flush or paint inside it. Their
+# spans are merged, so listing a mark that RenderLayerTree already encloses adds no
+# time of its own.
+COMPOSITING_MARKS = [
+    "RenderLayerTree",
+    "FlushCompositingState",
+    "PaintToGLContext",
+    "WaitForCompositionCompletion",
+]
+PHASES = [
+    "rendering_update",
+    "waiting_for_compositing",
+    "compositing",
+    "idle",
+]
+RENDERING_UPDATE, WAITING, COMPOSITING, IDLE = PHASES
+
+
+class _MarkIndex:
+    """Marks of a single name, ordered by begin time for lookup within a cycle."""
+
+    def __init__(self, marks: Sequence[Dict[str, Any]]) -> None:
+        self._marks = sorted(marks, key=mark_begin)
+        self._begins = [mark_begin(mark) for mark in self._marks]
+        # The latest end among the first i marks. Every mark still running at a
+        # given time covers that time onwards, so their union is one span reaching
+        # to the latest of their ends, and that is all this has to answer.
+        self._ends_until: List[int] = list(
+            itertools.accumulate((mark["end_time"] for mark in self._marks), max)
+        )
+
+    def spans_within(self, begin: int, end: int) -> List[Tuple[int, int]]:
+        """The [begin, end) spans of time a mark of this name was running.
+
+        Unmerged and in begin order. What began before the window and had not ended
+        by then counts, since a composition of an earlier cycle is what a cycle
+        waiting on the compositor is running, and all of those together reach from
+        the start of the window to the latest of their ends.
+        """
+        first = bisect.bisect_left(self._begins, begin)
+        spans = []
+        still_running = self._ends_until[first - 1] if first else None
+        if still_running is not None and still_running > begin:
+            spans.append((begin, min(still_running, end)))
+        for index in range(first, len(self._marks)):
+            if self._begins[index] >= end:
+                break
+            spans.append(
+                (self._begins[index], min(self._marks[index]["end_time"], end))
+            )
+        return spans
+
+    def last_end_of_marks_beginning_within(self, begin: int, end: int) -> Optional[int]:
+        """End of the last mark beginning within [begin, end), None if there is none.
+
+        The last end, not the first: marks nest, so the first one to end is not the
+        one compositing finished with. Indexing by end time instead has the mirror
+        problem, of returning a short mark of the next cycle when an enclosing mark
+        overruns this one.
+        """
+        first = bisect.bisect_left(self._begins, begin)
+        last = bisect.bisect_left(self._begins, end)
+        if first >= last:
+            return None
+        return max(self._marks[index]["end_time"] for index in range(first, last))
+
+
+def _marks_beginning_within(
+    marks: Sequence[Dict[str, Any]],
+    begin: Optional[int],
+    end: Optional[int],
+    including_end: bool = False,
+) -> List[Dict[str, Any]]:
+    """The marks that begin within the window, which are the only ones read."""
+
+    def within(mark: Dict[str, Any]) -> bool:
+        if begin is not None and mark_begin(mark) < begin:
+            return False
+        if end is None:
+            return True
+        return mark_begin(mark) <= end if including_end else mark_begin(mark) < end
+
+    return [mark for mark in marks if within(mark)]
+
+
+def _compositing_indices_by_process(
+    sysprof_data: Dict[str, Any],
+    timespan_begin: Optional[int],
+    timespan_end: Optional[int],
+) -> Dict[int, List[_MarkIndex]]:
+    """The compositing marks of the capture, grouped by process and by name."""
+    by_pid: Dict[int, Dict[str, List[Dict[str, Any]]]] = {}
+    for mark_name in COMPOSITING_MARKS:
+        marks = [
+            mark
+            for mark in _marks_beginning_within(
+                sysprof_data["marks"].get(mark_name, []), None, timespan_end
+            )
+            if timespan_begin is None or mark["end_time"] >= timespan_begin
+        ]
+        for pid, process_marks in marks_by_process(marks).items():
+            by_pid.setdefault(pid, {})[mark_name] = process_marks
+    return {
+        pid: [_MarkIndex(marks.get(mark_name, [])) for mark_name in COMPOSITING_MARKS]
+        for pid, marks in by_pid.items()
+    }
+
+
+def _compositing_spans(
+    indices: Sequence[_MarkIndex], begin: int, end: int
+) -> List[Tuple[int, int]]:
+    """The spans of [begin, end) that were spent compositing, merged and in order.
+
+    Merged rather than taken as one span from the first mark to the last, because a
+    cycle can composite twice: the tail of a composition it inherited and then one
+    of its own, with the wait for the painting threads in between. Reading that as
+    one span would report the wait as compositing.
+    """
+    return merged_spans(
+        span for index in indices for span in index.spans_within(begin, end)
+    )
+
+
+def _own_compositing_end(
+    indices: Sequence[_MarkIndex], cycle_begin: int, cycle_end: int
+) -> Optional[int]:
+    """When the composition of this cycle was over, None where it has none.
+
+    Only the marks that began within the cycle count, so this is the cycle's own
+    composition rather than one it inherited. It may end after the cycle does: when
+    compositing overruns, the next rendering update is dispatched from within the
+    composition wait. It is usually the RenderLayerTree mark compositing began with,
+    since that encloses the others and runs on through the wait for the GPU to
+    finish the frame, which costs frame time as well.
+    """
+    ends = [
+        index.last_end_of_marks_beginning_within(cycle_begin, cycle_end)
+        for index in indices
+    ]
+    ended = [end for end in ends if end is not None]
+    return max(ended) if ended else None
+
+
+def calculate_frame_cycles(
+    sysprof_data: Dict[str, Any],
+    timespan_begin: Optional[int] = None,
+    timespan_end: Optional[int] = None,
+) -> List[Dict[str, Any]]:
+    """Split the timeline into frame cycles and break each cycle into its phases.
+
+    Each cycle carries its boundaries in nanoseconds, its duration and phases in
+    milliseconds, and the process it belongs to. The phases sum to the cycle
+    duration exactly, so compositing running past the cycle is reported beside them
+    as `composition_overrun` rather than as a fifth phase. A cycle nothing
+    composited in has both set to None, so callers can count it without letting it
+    skew the per-phase statistics.
+
+    A cycle runs between two rendering updates of one process, which the marks name.
+    `timespan_begin`/`timespan_end` keep the cycles
+    lying entirely within that window, in nanoseconds, the way trimming keeps the
+    marks lying entirely within it. Filtering here rather than trimming the marks
+    first keeps the compositing marks of a cycle at the window edge, which trimming
+    drops for reaching past it. `analyze --explain` reads all of this out.
+    """
+    # A cycle ends where the next update begins, and the whole cycle has to fit in
+    # the window, so an update beginning on the very edge still bounds one.
+    all_updates = _marks_beginning_within(
+        sysprof_data["marks"].get("LayerTreeHostRenderingUpdate", []),
+        timespan_begin,
+        timespan_end,
+        including_end=True,
+    )
+    compositing = _compositing_indices_by_process(
+        sysprof_data, timespan_begin, timespan_end
+    )
+    cycles: List[Dict[str, Any]] = []
+    for pid, updates in marks_by_process(all_updates).items():
+        cycles += _cycles_of_one_process(
+            pid, sorted(updates, key=mark_begin), compositing.get(pid, [])
+        )
+    return sorted(cycles, key=lambda cycle: cycle["begin_nsec"])
+
+
+def _cycles_of_one_process(
+    pid: int, updates: Sequence[Dict[str, Any]], indices: Sequence[_MarkIndex]
+) -> List[Dict[str, Any]]:
+    """The cycles between the given rendering updates, all of one process.
+
+    `indices` holds that same process's compositing marks, one index per name.
+    """
+    cycles: List[Dict[str, Any]] = []
+    for update, next_update in zip(updates, itertools.islice(updates, 1, None)):
+        cycle_begin = mark_begin(update)
+        cycle_end = mark_begin(next_update)
+        cycle: Dict[str, Any] = {
+            "pid": pid,
+            "begin_nsec": cycle_begin,
+            "end_nsec": cycle_end,
+            "duration": nsec_to_msec(cycle_end - cycle_begin),
+            "phases": None,
+            "composition_overrun": None,
+        }
+        cycles.append(cycle)
+
+        # LayerTreeHost::updateRendering() asserts it is not re-entered, so an
+        # update cannot outlast its own cycle. The phases cover the cycle, so one
+        # that does anyway is cut off rather than trusted.
+        update_end = min(update["end_time"], cycle_end)
+        # What was traced as compositing within the cycle, whether it began there
+        # or in an earlier one. A composition running entirely beside the rendering
+        # update still says the cycle composited, so it is what decides that, while
+        # the phases below cover the time after the update.
+        within = _compositing_spans(indices, cycle_begin, cycle_end)
+        if not within:
+            # Nothing about compositing can be said of this cycle.
+            continue
+        spans = [
+            (max(span_begin, update_end), span_end)
+            for span_begin, span_end in within
+            if span_end > update_end
+        ]
+        own_end = _own_compositing_end(indices, cycle_begin, cycle_end)
+
+        compositing = sum(span_end - span_begin for span_begin, span_end in spans)
+        # Idle runs from the last thing traced until the next update begins, and
+        # what is neither the update, compositing nor idle was spent waiting.
+        idle = cycle_end - (spans[-1][1] if spans else update_end)
+        cycle["phases"] = {
+            RENDERING_UPDATE: nsec_to_msec(update_end - cycle_begin),
+            WAITING: nsec_to_msec(cycle_end - update_end - compositing - idle),
+            COMPOSITING: nsec_to_msec(compositing),
+            IDLE: nsec_to_msec(idle),
+        }
+        # How far the compositing this cycle began ran past its end. A composition
+        # of an earlier cycle running through this one is that cycle's, not this
+        # one's, so what began here is what counts.
+        cycle["composition_overrun"] = (
+            nsec_to_msec(max(own_end - cycle_end, 0)) if own_end is not None else 0.0
+        )
+
+    return cycles
diff --git a/Tools/Scripts/webkit-sysprof/webkitsysprof/dump/__init__.py b/Tools/Scripts/webkit-sysprof/webkitsysprof/dump/__init__.py
index 09c0aa497358..e5f7d0abbfcf 100644
--- a/Tools/Scripts/webkit-sysprof/webkitsysprof/dump/__init__.py
+++ b/Tools/Scripts/webkit-sysprof/webkitsysprof/dump/__init__.py
@@ -3,6 +3,7 @@
 from typing import Any, Dict, List
 
 from ..parser import parse
+from ..utils import mark_begin, mark_pid
 
 
 def dump(args: argparse.Namespace) -> None:
@@ -12,7 +13,7 @@ def dump(args: argparse.Namespace) -> None:
         headers = ["category", "name", "description", "time", "offset", "value"]
         rows = _counters_to_rows(data["counters"])
     else:
-        headers = ["group", "name", "message", "time", "duration", "end_time"]
+        headers = ["group", "pid", "name", "message", "time", "duration", "end_time"]
         rows = _marks_to_rows(data["marks"])
 
     if args.format == "json":
@@ -25,9 +26,10 @@ def _marks_to_rows(marks: List[Dict[str, Any]]) -> List[Dict[str, Any]]:
     return [
         {
             "group": mark["group"],
+            "pid": mark_pid(mark),
             "name": mark["name"],
             "message": mark["message"],
-            "time": mark["end_time"] - mark["duration"],
+            "time": mark_begin(mark),
             "duration": mark["duration"],
             "end_time": mark["end_time"],
         }
diff --git a/Tools/Scripts/webkit-sysprof/webkitsysprof/histogram/__init__.py b/Tools/Scripts/webkit-sysprof/webkitsysprof/histogram/__init__.py
index 24c919368d9c..44ad53945691 100644
--- a/Tools/Scripts/webkit-sysprof/webkitsysprof/histogram/__init__.py
+++ b/Tools/Scripts/webkit-sysprof/webkitsysprof/histogram/__init__.py
@@ -1,24 +1,31 @@
 import argparse
 import math
-import statistics
 from typing import Any, Dict, List
 
 from ..parser import parse
 from ..utils import (
     MSEC_PER_SEC,
-    nsec_to_msec,
+    check_timespan_holds_data,
+    intervals_between_marks,
+    marks_by_process,
+    marks_in_time_order,
+    percentiles,
+    sample_statistics,
     parse_timespan_argument,
-    trim_sysprof_data_to_timespan,
+    sysprof_data_with_marks_by_name,
+    trim_marks_by_name_to_timespan,
 )
 
 
 def delta_histogram(args: argparse.Namespace) -> None:
     timespan_begin, timespan_end = parse_timespan_argument(args.timespan)
     parsed_data = parse(args.capture_file, marks=True, counters=False)
-    trimmed_data = trim_sysprof_data_to_timespan(
-        parsed_data, timespan_begin, timespan_end
+    capture_begin, capture_end = parsed_data["document"]["timespan"]
+    check_timespan_holds_data(capture_begin, capture_end, timespan_begin, timespan_end)
+    trimmed_data = trim_marks_by_name_to_timespan(
+        sysprof_data_with_marks_by_name(parsed_data), timespan_begin, timespan_end
     )
-    deltas_ms = _calculate_delta_times_ms(trimmed_data["marks"], args.mark_type)
+    deltas_ms = _delta_times_ms(trimmed_data, args.mark_type)
 
     if not deltas_ms:
         print(f"No data available for mark: {args.mark_type}")
@@ -27,27 +34,25 @@ def delta_histogram(args: argparse.Namespace) -> None:
     _plot_delta_time_distribution(args.mark_type, deltas_ms)
 
 
-def _calculate_delta_times_ms(
-    marks: List[Dict[str, Any]], mark_name: str
-) -> List[float]:
-    end_times = sorted(mark["end_time"] for mark in marks if mark["name"] == mark_name)
-    if len(end_times) < 2:
-        return []
+def _delta_times_ms(sysprof_data: Dict[str, Any], mark_name: str) -> List[float]:
+    """Times between consecutive marks of that name, in milliseconds."""
     return [
-        nsec_to_msec(end_times[i] - end_times[i - 1]) for i in range(1, len(end_times))
+        delta
+        for marks in marks_by_process(
+            marks_in_time_order(sysprof_data, mark_name)
+        ).values()
+        for delta in intervals_between_marks(marks)
     ]
 
 
 def _calculate_optimal_bins(deltas_ms: List[float]) -> int:
     # Freedman-Diaconis rule, falling back to Sturges' rule for a tiny IQR.
-    if len(deltas_ms) < 2:
+    low, high = 25, 75
+    quartiles = percentiles(deltas_ms, [low, high], method="exclusive")
+    if not quartiles:
+        # Too few deltas for a quartile, so there is no spread to bin by.
         return 10
-
-    q25, q75 = (
-        statistics.quantiles(deltas_ms, n=4)[0],
-        statistics.quantiles(deltas_ms, n=4)[2],
-    )
-    iqr = q75 - q25
+    iqr = quartiles[str(high)] - quartiles[str(low)]
 
     if iqr > 0:
         n = len(deltas_ms)
@@ -62,17 +67,20 @@ def _calculate_optimal_bins(deltas_ms: List[float]) -> int:
 def _plot_delta_time_distribution(mark_name: str, deltas_ms: List[float]) -> None:
     import matplotlib.pyplot as plt
 
-    mean_val = statistics.mean(deltas_ms)
-    median_val = statistics.median(deltas_ms)
-    min_val = min(deltas_ms)
-    max_val = max(deltas_ms)
-    std_val = statistics.stdev(deltas_ms) if len(deltas_ms) > 1 else 0.0
+    stats = sample_statistics(deltas_ms)
+    mean_val = stats["mean"]
+    median_val = stats["median"]
+    min_val = stats["min"]
+    max_val = stats["max"]
+    std_val = stats["stddev"]
     n_bins = _calculate_optimal_bins(deltas_ms)
 
+    # Marks sharing a timestamp are no time apart, and no frequency either.
+    frequency = f"{MSEC_PER_SEC / mean_val:.1f} Hz" if mean_val else "-"
     stats_text = (
         f"Sample Size: {len(deltas_ms):,}\n"
         f"Std Dev: {std_val:.2f} ms\n"
-        f"Frequency: {MSEC_PER_SEC / mean_val:.1f} Hz"
+        f"Frequency: {frequency}"
     )
 
     fig, (ax1, ax2) = plt.subplots(2, 1, figsize=(16, 12), gridspec_kw={"hspace": 0.15})
diff --git a/Tools/Scripts/webkit-sysprof/webkitsysprof/parser/direct_parser.py b/Tools/Scripts/webkit-sysprof/webkitsysprof/parser/direct_parser.py
index cc18bb4cd443..2bd56c5d6569 100644
--- a/Tools/Scripts/webkit-sysprof/webkitsysprof/parser/direct_parser.py
+++ b/Tools/Scripts/webkit-sysprof/webkitsysprof/parser/direct_parser.py
@@ -112,6 +112,10 @@ def _index_frames(data: mmap.mmap) -> List[Tuple[int, int, int, int]]:
 def _parse_mark(
     data: mmap.mmap, offset: int, length: int, duration: int, end_time: int
 ) -> Dict[str, Any]:
+    # The frame header is len, cpu, pid, time, so the process that emitted the mark
+    # is four bytes in. The group names its kind, e.g. "WebKit (Web)", which two
+    # processes of one kind share.
+    (pid,) = struct.unpack_from("<i", data, offset + 4)
     group = _read_cstring(data, offset + 32, 24) or ""
     name = _read_cstring(data, offset + 56, 40) or ""
     message = _read_cstring(data, offset + 96, length - 96) or ""
@@ -121,6 +125,7 @@ def _parse_mark(
         "duration": duration,
         "end_time": end_time,
         "group": group,
+        "pid": pid,
     }
 
 
diff --git a/Tools/Scripts/webkit-sysprof/webkitsysprof/summary/__init__.py b/Tools/Scripts/webkit-sysprof/webkitsysprof/summary/__init__.py
index 7905e47cfeb1..0d79e4a74297 100644
--- a/Tools/Scripts/webkit-sysprof/webkitsysprof/summary/__init__.py
+++ b/Tools/Scripts/webkit-sysprof/webkitsysprof/summary/__init__.py
@@ -20,8 +20,8 @@ def _print_document_summary(capture_file: str, document: Dict[str, Any]) -> None
     print(f"Subtitle: {document['subtitle']}")
     print(
         "Timespan: {:.4f} - {:.4f} [s]".format(
-            abs(nsec_to_sec(document["timespan"][0])),
-            abs(nsec_to_sec(document["timespan"][1])),
+            nsec_to_sec(document["timespan"][0]),
+            nsec_to_sec(document["timespan"][1]),
         )
     )
     print()
diff --git a/Tools/Scripts/webkit-sysprof/webkitsysprof/tests/frame_cycles_unittest.py b/Tools/Scripts/webkit-sysprof/webkitsysprof/tests/frame_cycles_unittest.py
new file mode 100644
index 000000000000..3392147e4d5f
--- /dev/null
+++ b/Tools/Scripts/webkit-sysprof/webkitsysprof/tests/frame_cycles_unittest.py
@@ -0,0 +1,709 @@
+"""Frame cycle reconstruction on synthetic captures.
+
+The sample capture only covers cycles that all resolve. These build the awkward
+cases by hand.
+"""
+
+import unittest
+
+from .helpers import SysprofTestCase, approx, mark, sysprof_data
+
+from webkitsysprof import analyze
+from webkitsysprof.cycles import calculate_frame_cycles
+from webkitsysprof.utils import (
+    display_refreshes,
+    median_vblank_interval,
+    msec_to_nsec,
+)
+
+
+def frame_cycle_report(data, begin_msec=0, end_msec=1000, vblank_interval=None):
+    return analyze._prepare_frame_cycle_report(
+        data, msec_to_nsec(begin_msec), msec_to_nsec(end_msec), vblank_interval
+    )
+
+
+class FrameCyclesTest(SysprofTestCase):
+    def test_phases_partition_every_resolved_cycle(self):
+        data = sysprof_data(
+            [
+                mark("LayerTreeHostRenderingUpdate", 0, 5),
+                mark("RenderLayerTree", 7, 14),
+                mark("PaintToGLContext", 10, 13),
+                mark("LayerTreeHostRenderingUpdate", 16, 20),
+                mark("RenderLayerTree", 22, 30),
+                mark("PaintToGLContext", 25, 29),
+                mark("LayerTreeHostRenderingUpdate", 32, 36),
+            ]
+        )
+
+        cycles = calculate_frame_cycles(data)
+        self.assertEqual(len(cycles), 2)
+        for cycle in cycles:
+            self.assertIsNotNone(cycle["phases"])
+            self.assertEqual(sum(cycle["phases"].values()), approx(cycle["duration"]))
+
+    def test_composition_ending_after_the_cycle_is_reported_as_an_overrun(self):
+        # RenderLayerTree runs on past PaintToGLContext to wait for the GPU to finish
+        # the frame, and the next rendering update starts during that wait.
+        data = sysprof_data(
+            [
+                mark("LayerTreeHostRenderingUpdate", 0, 5),
+                mark("RenderLayerTree", 7, 30),
+                mark("PaintToGLContext", 10, 13),
+                mark("WaitForCompositionCompletion", 13, 30),
+                mark("LayerTreeHostRenderingUpdate", 20, 25),
+            ]
+        )
+
+        cycle = calculate_frame_cycles(data)[0]
+        self.assertIsNotNone(cycle["phases"])
+        # Compositing covers that wait up to the cycle end, the rest counts as an
+        # overrun rather than being dropped or booked as idle.
+        self.assertEqual(cycle["phases"]["compositing"], approx(13.0))
+        self.assertEqual(cycle["phases"]["idle"], approx(0.0))
+        self.assertEqual(cycle["composition_overrun"], approx(10.0))
+        self.assertEqual(sum(cycle["phases"].values()), approx(cycle["duration"]))
+
+    def test_a_cycle_after_an_overrunning_composition_still_resolves(self):
+        # The first cycle composites past the start of the second. Picking the end mark
+        # in begin order hands that long one to the second cycle too, which used to drop
+        # exactly the slow frames worth looking at.
+        data = sysprof_data(
+            [
+                mark("LayerTreeHostRenderingUpdate", 0, 5),
+                mark("RenderLayerTree", 6, 56),
+                mark("PaintToGLContext", 10, 50),
+                mark("LayerTreeHostRenderingUpdate", 18, 20),
+                mark("RenderLayerTree", 22, 23),
+                mark("PaintToGLContext", 22, 23),
+                mark("LayerTreeHostRenderingUpdate", 30, 35),
+            ]
+        )
+
+        cycles = calculate_frame_cycles(data)
+        self.assertEqual(
+            [cycle["phases"] is not None for cycle in cycles], [True, True]
+        )
+        # The composition begun at 6 ms is still running through the second cycle, so
+        # that cycle is compositing from the end of its update to its own end.
+        self.assertEqual(cycles[1]["phases"]["compositing"], approx(10.0))
+        self.assertEqual(cycles[1]["phases"]["idle"], approx(0.0))
+        # Each cycle reports how far its own composition ran past it, so the long one
+        # counts for the cycle it began in and the short one for the next.
+        self.assertEqual(cycles[0]["composition_overrun"], approx(38.0))
+        self.assertEqual(cycles[1]["composition_overrun"], approx(0.0))
+
+    def test_cycles_without_compositing_marks_are_counted_but_not_analyzed(self):
+        data = sysprof_data(
+            [
+                mark("LayerTreeHostRenderingUpdate", 0, 5),
+                mark("RenderLayerTree", 7, 14),
+                mark("PaintToGLContext", 10, 13),
+                mark("LayerTreeHostRenderingUpdate", 16, 20),
+                mark("LayerTreeHostRenderingUpdate", 24, 28),
+                mark("RenderLayerTree", 30, 36),
+                mark("PaintToGLContext", 32, 35),
+                mark("LayerTreeHostRenderingUpdate", 40, 44),
+            ]
+        )
+
+        report = frame_cycle_report(data)
+        self.assertEqual(report["cycles"], 3)
+        self.assertEqual(report["resolved_duration_statistics"]["n"], 2)
+        # The phase statistics cover the two cycles that composited, not all three.
+        self.assertEqual(report["resolved_duration_statistics"]["n"], 2)
+        self.assertEqual(report["duration_statistics"]["n"], 3)
+
+    def test_the_gap_between_two_rendering_periods_is_reported_as_a_long_cycle(self):
+        data = sysprof_data(
+            [
+                mark("LayerTreeHostRenderingUpdate", 0, 5),
+                mark("RenderLayerTree", 7, 14),
+                mark("PaintToGLContext", 10, 13),
+                mark("LayerTreeHostRenderingUpdate", 16, 20),
+                mark("RenderLayerTree", 22, 30),
+                mark("PaintToGLContext", 25, 29),
+                mark("LayerTreeHostRenderingUpdate", 500, 505),
+                mark("RenderLayerTree", 507, 514),
+                mark("PaintToGLContext", 510, 513),
+                mark("LayerTreeHostRenderingUpdate", 516, 520),
+            ]
+        )
+
+        report = frame_cycle_report(data)
+        # Dropping the 470 ms of idle time between the two bursts would hide it. The
+        # median is what the frames took, and the idle spell is the maximum and the
+        # idle phase, where it can be read as what it is.
+        self.assertEqual(report["cycles"], 3)
+        self.assertEqual(report["duration_statistics"]["median"], approx(16.0))
+        self.assertEqual(report["duration_statistics"]["max"], approx(484.0))
+        self.assertEqual(report["phase_statistics"]["idle"]["max"], approx(470.0))
+
+    def test_the_compositing_mark_name_is_resolved_per_cycle(self):
+        # renderLayerTree() opens its trace scope before the checks that can return
+        # early, so the first cycle holds a RenderLayerTree with nothing inside it.
+        # The marks the second cycle carries must not decide for the first.
+        data = sysprof_data(
+            [
+                mark("LayerTreeHostRenderingUpdate", 0, 5),
+                mark("RenderLayerTree", 7, 14),
+                mark("LayerTreeHostRenderingUpdate", 16, 20),
+                mark("RenderLayerTree", 22, 30),
+                mark("FlushCompositingState", 23, 25),
+                mark("PaintToGLContext", 25, 29),
+                mark("LayerTreeHostRenderingUpdate", 32, 36),
+            ]
+        )
+
+        cycles = calculate_frame_cycles(data)
+        self.assertEqual(
+            [cycle["phases"] is not None for cycle in cycles], [True, True]
+        )
+        self.assertEqual(cycles[0]["phases"]["compositing"], approx(7.0))
+        self.assertEqual(cycles[1]["phases"]["compositing"], approx(8.0))
+
+    def test_compositing_is_over_when_the_last_compositing_mark_is(self):
+        # A second RenderLayerTree after PaintToGLContext. Consulting only the first
+        # mark name that matches would book its 29 ms as idle.
+        data = sysprof_data(
+            [
+                mark("LayerTreeHostRenderingUpdate", 0, 5),
+                mark("RenderLayerTree", 6, 10),
+                mark("PaintToGLContext", 7, 8),
+                mark("RenderLayerTree", 11, 40),
+                mark("LayerTreeHostRenderingUpdate", 50, 55),
+            ]
+        )
+
+        phases = calculate_frame_cycles(data)[0]["phases"]
+        # 6 to 10 and 11 to 40, so the millisecond between the two is a wait rather
+        # than compositing.
+        self.assertEqual(phases["compositing"], approx(33.0))
+        self.assertEqual(phases["waiting_for_compositing"], approx(2.0))
+        self.assertEqual(phases["idle"], approx(10.0))
+
+    def test_compositing_overlapping_the_rendering_update_still_counts(self):
+        # RenderLayerTree starts on the compositing thread 1 ms before the rendering
+        # update mark ends. Skipping it would measure the cycle off PaintToGLContext.
+        data = sysprof_data(
+            [
+                mark("LayerTreeHostRenderingUpdate", 0, 10),
+                mark("RenderLayerTree", 9, 20),
+                mark("PaintToGLContext", 12, 18),
+                mark("LayerTreeHostRenderingUpdate", 30, 35),
+            ]
+        )
+
+        phases = calculate_frame_cycles(data)[0]["phases"]
+        self.assertEqual(phases["rendering_update"], approx(10.0))
+        self.assertEqual(phases["waiting_for_compositing"], approx(0.0))
+        self.assertEqual(phases["compositing"], approx(10.0))
+        self.assertEqual(phases["idle"], approx(10.0))
+
+    def test_a_cycle_reaching_past_the_timespan_is_left_out_of_it(self):
+        # Like a mark crossing the boundary, which trimming drops: a frame half
+        # outside the window must not contribute a whole frame's timing to it.
+        data = sysprof_data(
+            [
+                mark("LayerTreeHostRenderingUpdate", 0, 5),
+                mark("RenderLayerTree", 7, 190),
+                mark("PaintToGLContext", 10, 180),
+                mark("LayerTreeHostRenderingUpdate", 200, 205),
+            ],
+            end_msec=10,
+        )
+
+        report = frame_cycle_report(data, end_msec=10)
+        self.assertEqual(report["cycles"], 0)
+        self.assertEqual(report["coverage"], approx(0.0))
+
+    def test_a_capture_without_compositing_marks_keeps_its_cycles(self):
+        # Rendering updates that composited nothing, so no cycle can be split into
+        # phases. The cycles themselves are still measured and reported.
+        marks = [
+            mark("LayerTreeHostRenderingUpdate", i * 50, i * 50 + 8) for i in range(10)
+        ]
+        marks += [
+            mark("DisplayLinkUpdate", i * 16.67, i * 16.67 + 0.1) for i in range(60)
+        ]
+
+        report = frame_cycle_report(sysprof_data(marks))
+        self.assertEqual(report["cycles"], 9)
+        self.assertEqual(report["resolved_duration_statistics"], {})
+        self.assertEqual(report["duration_statistics"]["median"], approx(50.0))
+
+    def test_coverage_is_the_share_of_the_window_the_analyzed_cycles_took(self):
+        data = sysprof_data(
+            [
+                mark("LayerTreeHostRenderingUpdate", 0, 5),
+                mark("RenderLayerTree", 7, 90),
+                mark("PaintToGLContext", 10, 88),
+                mark("LayerTreeHostRenderingUpdate", 100, 105),
+                mark("RenderLayerTree", 107, 190),
+                mark("PaintToGLContext", 110, 188),
+                mark("LayerTreeHostRenderingUpdate", 200, 205),
+            ]
+        )
+
+        report = frame_cycle_report(data, begin_msec=100, end_msec=300)
+        # Only the second cycle lies within the window, and it fills half of it.
+        self.assertEqual(report["cycles"], 1)
+        self.assertEqual(report["coverage"], approx(0.5))
+
+    def test_a_single_cycle_reports_no_percentiles_rather_than_failing(self):
+        # statistics.quantiles() raises below two data points before Python 3.13.
+        data = sysprof_data(
+            [
+                mark("LayerTreeHostRenderingUpdate", 0, 5),
+                mark("RenderLayerTree", 7, 14),
+                mark("PaintToGLContext", 10, 13),
+                mark("LayerTreeHostRenderingUpdate", 16, 20),
+            ]
+        )
+
+        report = frame_cycle_report(data)
+        self.assertEqual(report["cycles"], 1)
+        self.assertEqual(report["duration_statistics"]["percentiles"], {})
+        self.assertEqual(report["phase_statistics"]["compositing"]["percentiles"], {})
+
+    def test_no_cycles_at_all(self):
+        report = frame_cycle_report(
+            sysprof_data([mark("LayerTreeHostRenderingUpdate", 0, 5)])
+        )
+        self.assertEqual(report["cycles"], 0)
+        self.assertEqual(report["resolved_duration_statistics"], {})
+        self.assertEqual(report["duration_statistics"], {})
+        # No cycle is no rate, and reporting 0 would read as an infinitely slow one.
+        self.assertIsNone(report["implied_fps"])
+        self.assertIsNone(report["vblank_intervals_per_cycle"])
+
+    def test_cycles_per_vblank_interval_is_unknown_without_vblank_marks(self):
+        data = sysprof_data(
+            [
+                mark("LayerTreeHostRenderingUpdate", 0, 5),
+                mark("RenderLayerTree", 7, 14),
+                mark("PaintToGLContext", 10, 13),
+                mark("LayerTreeHostRenderingUpdate", 16, 20),
+            ]
+        )
+
+        self.assertIsNone(
+            median_vblank_interval(display_refreshes(data))
+        )
+        # Reporting 0 here would read as "the cycle fits in zero vblank intervals".
+        self.assertIsNone(frame_cycle_report(data)["vblank_intervals_per_cycle"])
+
+    def test_cycles_are_restricted_to_the_ones_lying_within_the_timespan(self):
+        data = sysprof_data(
+            [
+                mark("LayerTreeHostRenderingUpdate", 0, 5),
+                mark("RenderLayerTree", 7, 14),
+                mark("PaintToGLContext", 10, 13),
+                mark("LayerTreeHostRenderingUpdate", 100, 105),
+                mark("RenderLayerTree", 107, 114),
+                mark("PaintToGLContext", 110, 113),
+                mark("LayerTreeHostRenderingUpdate", 200, 205),
+            ]
+        )
+
+        self.assertEqual(len(calculate_frame_cycles(data)), 2)
+        # 50 ms falls inside the first cycle, so that cycle belongs to neither side.
+        self.assertEqual(len(calculate_frame_cycles(data, msec_to_nsec(50), None)), 1)
+        self.assertEqual(len(calculate_frame_cycles(data, None, msec_to_nsec(50))), 0)
+        self.assertEqual(len(calculate_frame_cycles(data, None, msec_to_nsec(100))), 1)
+        self.assertEqual(
+            calculate_frame_cycles(data, msec_to_nsec(50), None)[0]["begin_nsec"],
+            msec_to_nsec(100),
+        )
+
+    def test_compositing_running_inside_the_rendering_update_still_resolves(self):
+        # The compositing thread finished while the rendering update mark was still
+        # open. There is no compositing phase to report, but the cycle is measured.
+        data = sysprof_data(
+            [
+                mark("LayerTreeHostRenderingUpdate", 0, 100),
+                mark("RenderLayerTree", 10, 50),
+                mark("LayerTreeHostRenderingUpdate", 200, 205),
+            ]
+        )
+
+        cycle = calculate_frame_cycles(data)[0]
+        self.assertEqual(
+            cycle["phases"],
+            {
+                "rendering_update": approx(100.0),
+                "waiting_for_compositing": approx(0.0),
+                "compositing": approx(0.0),
+                "idle": approx(100.0),
+            },
+        )
+
+    def test_a_cycle_never_runs_between_two_processes(self):
+        # Two web processes rendering at once, which a system-wide capture holds. A
+        # cycle spanning both would be a frame of neither.
+        marks = []
+        for i in range(3):
+            marks += [
+                mark("LayerTreeHostRenderingUpdate", i * 20, i * 20 + 5, pid=1),
+                mark("RenderLayerTree", i * 20 + 6, i * 20 + 12, pid=1),
+                mark("LayerTreeHostRenderingUpdate", i * 20 + 10, i * 20 + 15, pid=2),
+                mark("RenderLayerTree", i * 20 + 16, i * 20 + 19, pid=2),
+            ]
+
+        cycles = calculate_frame_cycles(sysprof_data(marks))
+        self.assertEqual(len(cycles), 4)
+        self.assertEqual(
+            [cycle["duration"] for cycle in cycles], [approx(20.0) for _ in cycles]
+        )
+        self.assertEqual(sorted({cycle["pid"] for cycle in cycles}), [1, 2])
+        # Compositing of one process never lands in the other one's phases.
+        for cycle in cycles:
+            self.assertEqual(
+                cycle["phases"]["compositing"],
+                approx(6.0 if cycle["pid"] == 1 else 3.0),
+            )
+
+    def test_a_cycle_spent_entirely_on_an_earlier_composition_is_analyzed(self):
+        # Compositing that overruns covers the whole of the next cycle, so that cycle
+        # holds no compositing mark of its own. Dropping it would leave the phase
+        # medians describing the fast frames only.
+        data = sysprof_data(
+            [
+                mark("LayerTreeHostRenderingUpdate", 0, 5),
+                mark("RenderLayerTree", 6, 120),
+                mark("LayerTreeHostRenderingUpdate", 50, 55),
+                mark("LayerTreeHostRenderingUpdate", 100, 105),
+                mark("RenderLayerTree", 106, 115),
+                mark("LayerTreeHostRenderingUpdate", 150, 155),
+            ]
+        )
+
+        cycles = calculate_frame_cycles(data)
+        self.assertEqual(
+            cycles[1]["phases"],
+            {
+                "rendering_update": approx(5.0),
+                "waiting_for_compositing": approx(0.0),
+                "compositing": approx(45.0),
+                "idle": approx(0.0),
+            },
+        )
+        # The composition overran by 70 ms past the cycle it began in, and is counted
+        # there rather than once more in every cycle it runs through.
+        self.assertEqual(cycles[0]["composition_overrun"], approx(70.0))
+        self.assertEqual(cycles[1]["composition_overrun"], approx(0.0))
+
+    def test_coverage_merges_the_cycles_of_two_processes(self):
+        marks = []
+        for i in range(10):
+            for pid in (1, 2):
+                marks += [
+                    mark("LayerTreeHostRenderingUpdate", i * 100, i * 100 + 5, pid=pid),
+                    mark("RenderLayerTree", i * 100 + 6, i * 100 + 50, pid=pid),
+                ]
+
+        report = frame_cycle_report(sysprof_data(marks))
+        # Both processes render throughout, so together they cover the 900 ms their
+        # cycles span, not the 1800 ms of summing them up.
+        self.assertEqual(report["cycles"], 18)
+        self.assertEqual(report["coverage"], approx(0.9))
+
+    def test_a_composition_begun_before_the_window_is_still_seen_in_it(self):
+        # The stall began at 6 ms, before the window, and holds up the cycle inside it.
+        data = sysprof_data(
+            [
+                mark("LayerTreeHostRenderingUpdate", 0, 5),
+                mark("RenderLayerTree", 6, 120),
+                mark("LayerTreeHostRenderingUpdate", 50, 55),
+                mark("LayerTreeHostRenderingUpdate", 100, 105),
+                mark("RenderLayerTree", 106, 115),
+                mark("LayerTreeHostRenderingUpdate", 150, 155),
+            ]
+        )
+
+        windowed = calculate_frame_cycles(data, msec_to_nsec(40), None)
+        self.assertEqual(
+            [cycle["phases"] is not None for cycle in windowed], [True, True]
+        )
+        self.assertEqual(windowed[0]["phases"]["compositing"], approx(45.0))
+
+    def test_a_stall_is_seen_past_a_shorter_mark_of_the_same_name(self):
+        # One process can emit two marks of one name that overlap, a long composition
+        # with a shorter one inside it, and the shorter one must not hide the stall.
+        data = sysprof_data(
+            [
+                mark("LayerTreeHostRenderingUpdate", 0, 2),
+                mark("RenderLayerTree", 2, 200),
+                mark("RenderLayerTree", 10, 15),
+                mark("LayerTreeHostRenderingUpdate", 20, 22),
+                mark("LayerTreeHostRenderingUpdate", 40, 42),
+            ]
+        )
+
+        cycles = calculate_frame_cycles(data)
+        self.assertEqual(
+            [cycle["phases"] is not None for cycle in cycles], [True, True]
+        )
+        self.assertEqual(cycles[1]["phases"]["compositing"], approx(18.0))
+
+    def test_a_capture_of_negative_length_reports_no_rate(self):
+        data = sysprof_data(
+            [
+                mark("LayerTreeHostRenderingUpdate", 0, 5),
+                mark("RenderLayerTree", 6, 10),
+                mark("LayerTreeHostRenderingUpdate", 20, 25),
+            ]
+        )
+
+        report = analyze._prepare_frame_cycle_report(data, 0, msec_to_nsec(-5), 16.67)
+        # A window of less than no length is no duration to be a share of.
+        self.assertIsNone(report["coverage"])
+
+    def test_no_cycles_says_so_rather_than_blaming_a_zero_median(self):
+        report = frame_cycle_report(
+            sysprof_data([mark("LayerTreeHostRenderingUpdate", 10, 15)]),
+            vblank_interval=16.67,
+        )
+        self.assertEqual(report["cycles"], 0)
+        # A token, so that rewording the report cannot break a JSON consumer.
+        self.assertEqual(report["vblank_intervals_per_cycle_unknown"], "no_cycles")
+        self.assertTrue(
+            analyze.explanations.UNKNOWN_VBLANK_INTERVALS_PER_CYCLE["no_cycles"]
+        )
+
+    def test_every_overrunning_composition_of_a_stall_is_counted(self):
+        # Six 16 ms cycles, each compositing 9 ms past its own end. Counting only the
+        # first would report a sustained stall as a single slow frame.
+        marks = []
+        for i in range(6):
+            marks += [
+                mark("LayerTreeHostRenderingUpdate", i * 16, i * 16 + 3),
+                mark("RenderLayerTree", i * 16 + 5, i * 16 + 25),
+            ]
+
+        cycles = calculate_frame_cycles(sysprof_data(marks))
+        self.assertEqual(
+            [cycle["composition_overrun"] for cycle in cycles],
+            [approx(9.0) for _ in cycles],
+        )
+
+    def test_a_cycle_running_a_sliver_of_an_inherited_composition_is_measured(self):
+        # The composition of the first cycle ends a microsecond after the second one's
+        # rendering update does, so the second ran a sliver of it.
+        data = sysprof_data(
+            [
+                mark("LayerTreeHostRenderingUpdate", 0, 2),
+                mark("RenderLayerTree", 3, 12.001),
+                mark("LayerTreeHostRenderingUpdate", 10, 12),
+                mark("LayerTreeHostRenderingUpdate", 30, 32),
+            ]
+        )
+
+        phases = calculate_frame_cycles(data)[1]["phases"]
+        self.assertEqual(phases["compositing"], approx(0.001))
+        self.assertEqual(phases["idle"], approx(17.999))
+
+    def test_a_cycle_running_only_an_inherited_composition_is_measured(self):
+        # The composition began before the cycle and ran through the first half of its
+        # rendering update. Nothing began within the cycle, but something composited
+        # in it, so it is measured like a cycle whose own composition did the same.
+        data = sysprof_data(
+            [
+                mark("LayerTreeHostRenderingUpdate", 0, 5),
+                mark("RenderLayerTree", 10, 100),
+                mark("LayerTreeHostRenderingUpdate", 50, 150),
+                mark("LayerTreeHostRenderingUpdate", 250, 255),
+            ]
+        )
+
+        phases = calculate_frame_cycles(data)[1]["phases"]
+        self.assertEqual(phases["rendering_update"], approx(100.0))
+        self.assertEqual(phases["compositing"], approx(0.0))
+        self.assertEqual(phases["idle"], approx(100.0))
+
+    def test_a_cycle_composited_beside_its_update_only_is_measured_as_zero(self):
+        # The same capture with the composition ending a microsecond earlier: the
+        # second cycle ran it only beside its own rendering update, so it composited
+        # for no time of its own. A microsecond of the phase separates the two cases,
+        # rather than one of them being measured and the other not.
+        data = sysprof_data(
+            [
+                mark("LayerTreeHostRenderingUpdate", 0, 2),
+                mark("RenderLayerTree", 3, 11.999),
+                mark("LayerTreeHostRenderingUpdate", 10, 12),
+                mark("LayerTreeHostRenderingUpdate", 30, 32),
+            ]
+        )
+
+        phases = calculate_frame_cycles(data)[1]["phases"]
+        self.assertEqual(phases["compositing"], approx(0.0))
+        self.assertEqual(phases["idle"], approx(18.0))
+
+    def test_a_mark_ending_before_the_capture_keeps_its_own_end(self):
+        # The parser shifts timestamps, so a mark that began before the capture ends
+        # at a negative time. Reporting it as ending at 0 would make it look like it
+        # was still running when the capture started.
+        data = sysprof_data(
+            [
+                mark("LayerTreeHostRenderingUpdate", -20, -18),
+                mark("RenderLayerTree", -19, -17),
+                mark("LayerTreeHostRenderingUpdate", 0, 5),
+                mark("RenderLayerTree", 6, 12),
+                mark("LayerTreeHostRenderingUpdate", 20, 25),
+            ]
+        )
+
+        cycles = calculate_frame_cycles(data)
+        # The first cycle ends before the second begins, so the second waits for its
+        # own composition rather than inheriting one that was over long before.
+        self.assertEqual(cycles[1]["phases"]["waiting_for_compositing"], approx(1.0))
+
+    def test_a_gap_between_two_compositions_is_a_wait_not_compositing(self):
+        for inherited_end in [12.001, 11.999]:
+            with self.subTest(inherited_end=inherited_end):
+                # The cycle 10 -> 40 runs the tail of the composition it
+                # inherited, waits, and then composites again. Reading that as
+                # one span from the first mark to the last would report the wait
+                # as compositing, and a microsecond either side of the update
+                # would move 18 ms between the two phases.
+                data = sysprof_data(
+                    [
+                        mark("LayerTreeHostRenderingUpdate", 0, 2),
+                        mark("RenderLayerTree", 3, inherited_end),
+                        mark("LayerTreeHostRenderingUpdate", 10, 12),
+                        mark("RenderLayerTree", 30, 38),
+                        mark("LayerTreeHostRenderingUpdate", 40, 42),
+                    ]
+                )
+
+                phases = calculate_frame_cycles(data)[1]["phases"]
+                self.assertEqual(
+                    phases["waiting_for_compositing"], approx(18.0, abs=0.002)
+                )
+                self.assertEqual(phases["compositing"], approx(8.0, abs=0.002))
+                self.assertEqual(phases["idle"], approx(2.0))
+                self.assertEqual(sum(phases.values()), approx(30.0))
+
+    def test_two_renderers_of_one_kind_are_told_apart_by_their_process(self):
+        # Two web processes rendering every 16 ms, 8 ms apart, both naming themselves
+        # "WebKit (Web)". Read by kind they would pair into 8 ms cycles and twice the
+        # frame rate of either.
+        marks = []
+        for i in range(4):
+            marks += [
+                mark("LayerTreeHostRenderingUpdate", i * 16, i * 16 + 2, pid=1),
+                mark("RenderLayerTree", i * 16 + 2, i * 16 + 9, pid=1),
+                mark("LayerTreeHostRenderingUpdate", i * 16 + 8, i * 16 + 10, pid=2),
+                mark("RenderLayerTree", i * 16 + 10, i * 16 + 15, pid=2),
+            ]
+
+        report = frame_cycle_report(sysprof_data(marks, end_msec=200))
+        self.assertEqual(report["processes"], 2)
+        self.assertEqual(report["duration_statistics"]["median"], approx(16.0))
+        self.assertEqual(report["implied_fps"], approx(62.5))
+
+    def test_two_updates_at_one_instant_belong_to_two_processes(self):
+        # One process cannot open two updates at once, so a pair beginning together is
+        # two of them, and neither has a second update to close a cycle with.
+        data = sysprof_data(
+            [
+                mark("LayerTreeHostRenderingUpdate", 10, 12, pid=1),
+                mark("LayerTreeHostRenderingUpdate", 10, 13, pid=2),
+            ]
+        )
+
+        self.assertEqual(calculate_frame_cycles(data), [])
+
+    def test_a_report_without_a_rate_prints_no_rate(self):
+        # implied_fps is None wherever there is no median cycle to take it from, and
+        # the renderer must print that rather than formatting a number that is not one.
+        frame_cycle = {
+            "cycles": 1,
+            "processes": 1,
+            "duration_statistics": {"n": 1, "min": 0, "max": 0, "median": 0, "mean": 0},
+            "resolved_duration_statistics": {},
+            "phase_statistics": {phase: {} for phase in analyze.PHASES},
+            "overrunning_composition_statistics": {},
+            "implied_fps": None,
+            "coverage": None,
+            "capture_vblank_interval": 16.67,
+            "vblank_intervals_per_cycle": None,
+            "vblank_intervals_per_cycle_unknown": "zero_length_cycle",
+        }
+
+        analyze._render_frame_cycle_numbers(frame_cycle)
+
+        stdout = self.stdout()
+        self.assertIn("implied FPS (1000 / median cycle): -", stdout)
+        self.assertIn("cycles cover - of the analyzed duration", stdout)
+
+    def test_a_steady_slow_capture_keeps_its_cycles(self):
+        # 20 FPS, so every cycle idles for 42 of its 50 ms. That is the rhythm of this
+        # capture, not the engine running out of work.
+        marks = []
+        for i in range(20):
+            marks += [
+                mark("LayerTreeHostRenderingUpdate", i * 50, i * 50 + 3),
+                mark("RenderLayerTree", i * 50 + 3, i * 50 + 8),
+            ]
+
+        report = frame_cycle_report(sysprof_data(marks), vblank_interval=16.67)
+        self.assertEqual(report["cycles"], 19)
+        self.assertEqual(report["implied_fps"], approx(20.0))
+        self.assertEqual(report["phase_statistics"]["idle"]["median"], approx(42.0))
+
+    def test_the_composition_overrun_median_describes_the_overrunning_cycles(self):
+        marks = []
+        for i in range(10):
+            begin = i * 100
+            # Two of the ten compositions run past the start of the next cycle.
+            compositing_end = begin + 150 if i in (3, 7) else begin + 50
+            marks += [
+                mark("LayerTreeHostRenderingUpdate", begin, begin + 10),
+                mark("RenderLayerTree", begin + 20, compositing_end),
+            ]
+        marks.append(mark("LayerTreeHostRenderingUpdate", 1000, 1010))
+
+        report = frame_cycle_report(sysprof_data(marks, end_msec=2000))
+        self.assertEqual(report["overrunning_composition_statistics"]["n"], 2)
+        # The eight cycles that did not overrun must not median the number down to 0.
+        self.assertEqual(
+            report["overrunning_composition_statistics"]["median"], approx(50.0)
+        )
+
+    def test_an_unknown_refresh_rate_is_not_reported_as_zero(self):
+        report = {
+            "document": {"timespan": {"begin": 0.0, "end": 1000.0}},
+            "rendering": {
+                "frames_rendered": 10,
+                "theoretical_fps": 10.0,
+                "vblanks": 1,
+                "vblank_interval_statistics": {},
+            },
+        }
+
+        explanation = analyze._theoretical_fps_explanation(report)
+        # One mark is not none, and it is no reason to claim a 0 Hz display either.
+        self.assertIn("refreshed 1 time,", explanation)
+        self.assertNotIn("0.00 Hz", explanation)
+
+    def test_a_zero_median_vblank_interval_is_not_reported_as_shared_timestamps(self):
+        report = {
+            "document": {"timespan": {"begin": 0.0, "end": 1000.0}},
+            "rendering": {
+                "frames_rendered": 10,
+                "theoretical_fps": 10.0,
+                "vblanks": 4,
+                # Two of the four share a timestamp, which is enough for a zero median
+                # without the marks being the same instant.
+                "vblank_interval_statistics": {"median": 0.0},
+            },
+        }
+
+        explanation = analyze._theoretical_fps_explanation(report)
+        self.assertIn("the median interval between two of the 4", explanation)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/Tools/Scripts/webkit-sysprof/webkitsysprof/tests/helpers.py b/Tools/Scripts/webkit-sysprof/webkitsysprof/tests/helpers.py
new file mode 100644
index 000000000000..1eaca3018129
--- /dev/null
+++ b/Tools/Scripts/webkit-sysprof/webkitsysprof/tests/helpers.py
@@ -0,0 +1,76 @@
+"""What the tests build captures from, and read what a command printed with.
+
+A synthetic mark is shaped like what the parser produces: it carries no begin
+time, so everything derives one from `end_time` and `duration`, and it names the
+process that emitted it by pid as well as by kind.
+"""
+
+import builtins
+import unittest
+
+from webkitcorepy import OutputCapture
+
+from webkitsysprof.utils import msec_to_nsec
+
+
+def mark(name, begin_msec, end_msec, group="WebKit (Web)", pid=1):
+    return {
+        "group": group,
+        "pid": pid,
+        "name": name,
+        "message": "",
+        "duration": msec_to_nsec(end_msec - begin_msec),
+        "end_time": msec_to_nsec(end_msec),
+    }
+
+
+def sysprof_data(marks, begin_msec=0, end_msec=1000):
+    marks_by_name = {}
+    for a_mark in marks:
+        marks_by_name.setdefault(a_mark["name"], []).append(a_mark)
+    return {
+        "document": {
+            "timespan": {
+                "begin": msec_to_nsec(begin_msec),
+                "end": msec_to_nsec(end_msec),
+            }
+        },
+        "marks": marks_by_name,
+    }
+
+
+class approx:
+    """A number equal to another within a tolerance, relative unless `abs` says so.
+
+    Durations are divided and summed before they are compared, so comparing them
+    exactly would test the rounding of binary floating point rather than the
+    analysis. Works inside a list or a dict too, since a float compared against one
+    of these defers to it.
+    """
+
+    def __init__(self, value, rel=1e-6, abs=None):
+        self.value = value
+        self.tolerance = abs if abs is not None else rel * max(builtins.abs(value), 1.0)
+
+    def __eq__(self, other):
+        return builtins.abs(other - self.value) <= self.tolerance
+
+    def __repr__(self):
+        return f"~{self.value!r}"
+
+
+class SysprofTestCase(unittest.TestCase):
+    """A test reading back what the command under it printed.
+
+    OutputCapture keeps stdout and the root logger to itself, so that a command
+    configuring logging does not outlive the test that ran it.
+    """
+
+    def setUp(self):
+        capture = OutputCapture()
+        capture.__enter__()
+        self.addCleanup(capture.__exit__, None, None, None)
+        self._capture = capture
+
+    def stdout(self):
+        return self._capture.stdout.getvalue()
diff --git a/Tools/Scripts/webkit-sysprof/webkitsysprof/tests/subcommands_unittest.py b/Tools/Scripts/webkit-sysprof/webkitsysprof/tests/subcommands_unittest.py
index 494c48de33bd..cee37270457e 100644
--- a/Tools/Scripts/webkit-sysprof/webkitsysprof/tests/subcommands_unittest.py
+++ b/Tools/Scripts/webkit-sysprof/webkitsysprof/tests/subcommands_unittest.py
@@ -1,26 +1,30 @@
 import argparse
 import json
-import unittest
 from pathlib import Path
 
-from webkitcorepy import OutputCapture
+import unittest
 
-from webkitsysprof import summary, dump, analyze
+from .helpers import SysprofTestCase, approx, mark, sysprof_data
 
-SAMPLE_CAPTURE_FILE = str(Path(__file__).parent / "assets" / "sample.syscap")
+from webkitsysprof import summary, dump, analyze, histogram
+from webkitsysprof.__main__ import main
+from webkitsysprof.utils import (
+    UsageError,
+    display_refreshes,
+    check_timespan_holds_data,
+    msec_to_nsec,
+    trim_marks_by_name_to_timespan,
+)
 
-
-def _capture_stdout(func, args):
-    with OutputCapture() as captured:
-        func(args)
-    return captured.stdout.getvalue()
+SAMPLE_CAPTURE_FILE = str(Path(__file__).parent / "assets" / "sample.syscap")
 
 
-class SubcommandsTest(unittest.TestCase):
+class SubcommandsTest(SysprofTestCase):
     def test_summary(self):
         args = argparse.Namespace(capture_file=SAMPLE_CAPTURE_FILE)
-        stdout = _capture_stdout(summary.summary, args)
+        summary.summary(args)
 
+        stdout = self.stdout()
         self.assertIn(f"File: {SAMPLE_CAPTURE_FILE}", stdout)
         self.assertIn("Marks: 669", stdout)
         self.assertIn("Counters: 53", stdout)
@@ -29,105 +33,631 @@ def test_dump_marks_csv(self):
         args = argparse.Namespace(
             capture_file=SAMPLE_CAPTURE_FILE, marks=True, counters=False, format="csv"
         )
-        stdout = _capture_stdout(dump.dump, args)
+        dump.dump(args)
 
-        stdout_lines = stdout.split("\n")
+        stdout_lines = self.stdout().split("\n")
         self.assertEqual(len(stdout_lines), 669 + 1 + 1)
 
     def test_dump_counters_csv(self):
         args = argparse.Namespace(
             capture_file=SAMPLE_CAPTURE_FILE, marks=False, counters=True, format="csv"
         )
-        stdout = _capture_stdout(dump.dump, args)
+        dump.dump(args)
 
-        stdout_lines = stdout.split("\n")
+        stdout_lines = self.stdout().split("\n")
         self.assertEqual(len(stdout_lines), 540 + 1 + 1)
 
     def test_dump_marks_json(self):
         args = argparse.Namespace(
             capture_file=SAMPLE_CAPTURE_FILE, marks=True, counters=False, format="json"
         )
-        stdout = _capture_stdout(dump.dump, args)
+        dump.dump(args)
 
-        marks = json.loads(stdout)
+        marks = json.loads(self.stdout())
         self.assertEqual(len(marks), 669)
         self.assertEqual(
             set(marks[0].keys()),
-            {"group", "name", "message", "time", "duration", "end_time"},
+            {
+                "group",
+                "pid",
+                "name",
+                "message",
+                "time",
+                "duration",
+                "end_time",
+            },
         )
 
     def test_dump_counters_json(self):
         args = argparse.Namespace(
             capture_file=SAMPLE_CAPTURE_FILE, marks=False, counters=True, format="json"
         )
-        stdout = _capture_stdout(dump.dump, args)
+        dump.dump(args)
 
-        counter_values = json.loads(stdout)
+        counter_values = json.loads(self.stdout())
         self.assertEqual(len(counter_values), 540)
         self.assertEqual(
             set(counter_values[0].keys()),
-            {"category", "name", "description", "time", "offset", "value"},
+            {
+                "category",
+                "name",
+                "description",
+                "time",
+                "offset",
+                "value",
+            },
         )
 
     def test_analyze_text(self):
         args = argparse.Namespace(
-            capture_file=SAMPLE_CAPTURE_FILE, format="text", timespan="-"
+            capture_file=SAMPLE_CAPTURE_FILE, format="text", timespan="-", explain=False
         )
-        stdout = _capture_stdout(analyze.analyze, args)
+        analyze.analyze(args)
 
+        stdout = self.stdout()
         self.assertIn("Timespan: 0.0000 - 4.4673 [s]", stdout)
         self.assertIn("vblanks: 35", stdout)
+        self.assertIn("Frame cycle:", stdout)
+        self.assertIn("- cycles: 2", stdout)
+        # The explanations are opt-in, so the report itself stays diffable.
+        self.assertNotIn(
+            "Theoretical FPS is the number of DidRenderFrame marks", stdout
+        )
+        self.assertNotIn(
+            "A frame cycle starts when a LayerTreeHostRenderingUpdate", stdout
+        )
+
+    def test_analyze_text_with_explanations(self):
+        args = argparse.Namespace(
+            capture_file=SAMPLE_CAPTURE_FILE, format="text", timespan="-", explain=True
+        )
+        analyze.analyze(args)
+
+        stdout = self.stdout()
+        self.assertIn("Theoretical FPS is the number of DidRenderFrame marks", stdout)
+        self.assertIn(
+            "A frame cycle starts when a LayerTreeHostRenderingUpdate begins", stdout
+        )
+        self.assertIn("StyleRecalc is an umbrella mark", stdout)
+
+    def test_analyze_json_percentiles_stay_within_the_data_range(self):
+        args = argparse.Namespace(
+            capture_file=SAMPLE_CAPTURE_FILE, format="json", timespan="-", explain=False
+        )
+        analyze.analyze(args)
+
+        report = json.loads(self.stdout())
+        all_statistics = (
+            [
+                statistics
+                for mark in report["statistics"].values()
+                for statistics in mark.values()
+            ]
+            + [
+                report["frame_cycle"]["duration_statistics"],
+                report["frame_cycle"]["resolved_duration_statistics"],
+                # The ones the text report prints percentiles of inline.
+                report["rendering"]["vblank_interval_statistics"],
+                report["rendering"]["vblanks_per_rendering_update"]["statistics"],
+                report["rendering"]["frame_compositions_per_vblank_statistics"],
+            ]
+            + list(report["frame_cycle"]["phase_statistics"].values())
+        )
+
+        # Extrapolating past the samples used to yield a P25 below the minimum, a P99
+        # above the maximum and negative durations.
+        for statistics in all_statistics:
+            for percentile in statistics.get("percentiles", {}).values():
+                self.assertTrue(statistics["min"] <= percentile <= statistics["max"])
 
     def test_analyze_json(self):
         args = argparse.Namespace(
-            capture_file=SAMPLE_CAPTURE_FILE, format="json", timespan="-"
+            capture_file=SAMPLE_CAPTURE_FILE, format="json", timespan="-", explain=False
         )
-        stdout = _capture_stdout(analyze.analyze, args)
+        analyze.analyze(args)
 
+        stdout = self.stdout()
         report = json.loads(stdout)
         self.assertEqual(int(report["document"]["timespan"]["begin"]), 0)
         self.assertEqual(int(report["document"]["timespan"]["end"]), 4467)
         self.assertEqual(report["rendering"]["vblanks"], 35)
+        self.assertEqual(report["frame_cycle"]["cycles"], 2)
+        self.assertEqual(report["frame_cycle"]["resolved_duration_statistics"]["n"], 2)
+        self.assertEqual(
+            set(report["frame_cycle"]["phase_statistics"]),
+            {
+                "rendering_update",
+                "waiting_for_compositing",
+                "compositing",
+                "idle",
+            },
+        )
+
+    def test_analyze_json_frame_cycle_phases_add_up_to_cycle_duration(self):
+        args = argparse.Namespace(
+            capture_file=SAMPLE_CAPTURE_FILE, format="json", timespan="-", explain=False
+        )
+        analyze.analyze(args)
+
+        frame_cycle = json.loads(self.stdout())["frame_cycle"]
+        phases_mean = sum(
+            statistics["mean"]
+            for statistics in frame_cycle["phase_statistics"].values()
+        )
+        # Against the cycles the phases came from, not all of them: the two differ as
+        # soon as one cycle cannot be split into phases.
+        self.assertEqual(
+            phases_mean,
+            approx(frame_cycle["resolved_duration_statistics"]["mean"], rel=1e-6),
+        )
 
     def test_analyze_json_statistics_cover_all_relevant_marks(self):
         args = argparse.Namespace(
-            capture_file=SAMPLE_CAPTURE_FILE, format="json", timespan="-"
+            capture_file=SAMPLE_CAPTURE_FILE, format="json", timespan="-", explain=False
         )
-        stdout = _capture_stdout(analyze.analyze, args)
+        analyze.analyze(args)
 
-        statistics = json.loads(stdout)["statistics"]
+        statistics = json.loads(self.stdout())["statistics"]
         self.assertEqual(set(statistics), set(analyze.MARKS_RELEVANT_FOR_STATISTICS))
         self.assertEqual(statistics["CompositingUpdate"]["duration"]["n"], 7)
         self.assertEqual(statistics["RenderTreeBuild"]["duration"]["n"], 3)
-        # Tile geometry depends on the rendering backend, so only check that
-        # the dirty area was extracted from every PaintTile message.
+        # Tile geometry depends on the rendering backend, so only check that the
+        # dirty area was extracted from every PaintTile message.
         self.assertEqual(statistics["PaintTile"]["dirty_pixels"]["n"], 80)
         self.assertGreater(statistics["PaintTile"]["dirty_pixels"]["min"], 0)
 
+    def test_analyze_with_a_timespan_holding_vblanks_but_no_rendering_update(self):
+        # The window has vblanks, so the no-vblanks early return does not save it, and
+        # trimming drops the first rendering update for reaching past the window end.
+        args = argparse.Namespace(
+            capture_file=SAMPLE_CAPTURE_FILE,
+            format="text",
+            timespan="0-370",
+            explain=False,
+        )
+        analyze.analyze(args)
+
+        stdout = self.stdout()
+        self.assertIn("- cycles: 0", stdout)
+        self.assertIn("no two consecutive LayerTreeHostRenderingUpdate marks", stdout)
+
+    def test_analyze_json_leaves_out_a_cycle_reaching_past_the_timespan(self):
+        # The only cycle of this window begins at 371.6 ms and ends at 524.2 ms, so it
+        # is no frame of the window and must not be timed as one.
+        args = argparse.Namespace(
+            capture_file=SAMPLE_CAPTURE_FILE,
+            format="json",
+            timespan="0-400",
+            explain=False,
+        )
+        analyze.analyze(args)
+
+        frame_cycle = json.loads(self.stdout())["frame_cycle"]
+        self.assertEqual(frame_cycle["cycles"], 0)
+        self.assertEqual(frame_cycle["coverage"], approx(0.0))
+
+    def test_analyze_resolves_a_cycle_whose_compositing_marks_trimming_drops(self):
+        # The cycle 524.2 -> 560.8 ms lies within this window, but composites in
+        # RenderLayerTree 549.8 -> 571.1, which reaches past the window end and is
+        # trimmed away. Reconstructing from the untrimmed capture keeps it.
+        args = argparse.Namespace(
+            capture_file=SAMPLE_CAPTURE_FILE,
+            format="json",
+            timespan="370-561",
+            explain=False,
+        )
+        analyze.analyze(args)
+
+        frame_cycle = json.loads(self.stdout())["frame_cycle"]
+        self.assertEqual(frame_cycle["cycles"], 2)
+        self.assertEqual(frame_cycle["resolved_duration_statistics"]["n"], 2)
+        # Without that mark the composition looks as if it ended with PaintToGLContext
+        # at 560.6 ms, just inside its cycle, so the overrun would go unnoticed.
+        self.assertEqual(frame_cycle["overrunning_composition_statistics"]["n"], 2)
+
+    def test_explain_is_rejected_for_the_json_format_by_the_module_api(self):
+        args = argparse.Namespace(
+            capture_file=SAMPLE_CAPTURE_FILE, format="json", timespan="-", explain=True
+        )
+        with self.assertRaises(UsageError):
+            analyze.analyze(args)
+
+    def test_analyze_rejects_a_timespan_it_cannot_honour(self):
+        # Silently analyzing the whole capture, or a window the argument never asked
+        # for, reads as a result for the requested window.
+        for timespan in [
+            "abc",
+            "0-1e3",
+            "1-2-3",
+            "5000-",
+            "5000-6000",
+            "",
+            # Of no length, so it encloses nothing to analyze.
+            "0-0",
+            "500-500",
+        ]:
+            with self.subTest(timespan=timespan):
+                args = argparse.Namespace(
+                    capture_file=SAMPLE_CAPTURE_FILE,
+                    format="text",
+                    timespan=timespan,
+                    explain=False,
+                )
+                with self.assertRaises(UsageError):
+                    analyze.analyze(args)
+
+                with self.assertRaises(SystemExit):
+                    main(["analyze", "-t", timespan, SAMPLE_CAPTURE_FILE])
+
+    def test_analyze_clamps_a_timespan_reaching_past_the_capture(self):
+        args = argparse.Namespace(
+            capture_file=SAMPLE_CAPTURE_FILE,
+            format="json",
+            timespan="0-100000",
+            explain=False,
+        )
+        analyze.analyze(args)
+
+        report = json.loads(self.stdout())
+        # The rates divide by the analyzed duration, so a window stretching past the
+        # capture would water every one of them down.
+        self.assertEqual(int(report["document"]["timespan"]["end"]), 4467)
+        self.assertEqual(
+            report["rendering"]["theoretical_fps"], approx(0.448, abs=0.001)
+        )
+
+    def test_vblanks_per_rendering_update_does_not_depend_on_the_mark_order(self):
+        # The walk needs the updates in begin order, which the grouping does not grant.
+        parsed = analyze.parse(SAMPLE_CAPTURE_FILE, marks=True, counters=False)
+        data = analyze.sysprof_data_with_marks_by_name(parsed)
+        in_parse_order = analyze._prepare_rendering_report(
+            data, display_refreshes(data)
+        )
+
+        for marks in data["marks"].values():
+            marks.reverse()
+        self.assertEqual(
+            analyze._prepare_rendering_report(
+                data, display_refreshes(data)
+            )["vblanks_per_rendering_update"],
+            in_parse_order["vblanks_per_rendering_update"],
+        )
+        self.assertEqual(
+            analyze._prepare_rendering_report(
+                data, display_refreshes(data)
+            )["vblank_interval_statistics"],
+            in_parse_order["vblank_interval_statistics"],
+        )
+
+    def test_a_capture_of_no_length_reports_no_rate(self):
+        # A window of no length is rejected, but a capture of no length is the
+        # capture's own doing and still has to be reported on.
+        data = sysprof_data(
+            [mark("DidRenderFrame", 0, 0)], begin_msec=0, end_msec=0
+        )
+
+        report = analyze._prepare_report(data, data)
+
+        frame_cycle = report["frame_cycle"]
+        # No cycle and no duration to divide, rather than a cycle of zero length that
+        # fits in zero vblank intervals and covers 0% of nothing.
+        self.assertEqual(frame_cycle["cycles"], 0)
+        self.assertIsNone(frame_cycle["implied_fps"])
+        self.assertIsNone(frame_cycle["vblank_intervals_per_cycle"])
+        self.assertIsNone(frame_cycle["coverage"])
+        # No duration to divide frames by either.
+        self.assertIsNone(report["rendering"]["theoretical_fps"])
+
+    def test_delta_histogram_deltas_come_from_the_requested_mark(self):
+        parsed = histogram.parse(SAMPLE_CAPTURE_FILE, marks=True, counters=False)
+        data = histogram.sysprof_data_with_marks_by_name(parsed)
+
+        deltas = histogram.intervals_between_marks(
+            histogram.marks_in_time_order(data, "DisplayLinkUpdate")
+        )
+        self.assertEqual(len(deltas), 34)
+        self.assertGreater(min(deltas), 0)
+        self.assertEqual(
+            histogram.intervals_between_marks(
+                histogram.marks_in_time_order(data, "NoSuchMark")
+            ),
+            [],
+        )
+        self.assertTrue(10 <= histogram._calculate_optimal_bins(deltas) <= 100)
+
+    def test_delta_histogram_honours_the_timespan(self):
+        parsed = histogram.parse(SAMPLE_CAPTURE_FILE, marks=True, counters=False)
+        data = histogram.trim_marks_by_name_to_timespan(
+            histogram.sysprof_data_with_marks_by_name(parsed), None, msec_to_nsec(500)
+        )
+
+        self.assertEqual(len(data["marks"]["DisplayLinkUpdate"]), 10)
+        self.assertEqual(
+            len(
+                histogram.intervals_between_marks(
+                    histogram.marks_in_time_order(data, "DisplayLinkUpdate")
+                )
+            ),
+            9,
+        )
+
+    def test_analyze_json_counts_every_vblank_interval_of_the_timespan(self):
+        args = argparse.Namespace(
+            capture_file=SAMPLE_CAPTURE_FILE, format="json", timespan="-", explain=False
+        )
+        analyze.analyze(args)
+
+        rendering = json.loads(self.stdout())["rendering"]
+        # 35 vblanks are 34 intervals, and the ones after the last composition are
+        # samples too. Counting only up to it used to report 15 and a mean twice as
+        # high as the capture actually composited.
+        self.assertEqual(rendering["vblanks"], 35)
+        self.assertEqual(rendering["frame_compositions_per_vblank_statistics"]["n"], 34)
+        self.assertEqual(
+            rendering["frame_compositions_per_vblank_statistics"]["mean"],
+            approx(2 / 34),
+        )
+
+    def test_frame_compositions_outside_the_vblank_range_are_left_out(self):
+        vblanks = [mark("DisplayLinkUpdate", msec, msec) for msec in (0, 16, 32)]
+        compositions = [
+            mark("DidRenderFrame", msec, msec) for msec in (5, 40, 45, 50, 55)
+        ]
+
+        # The four compositions after the last vblank belong to no interval between
+        # two refreshes. Booking them into the last one made up a burst that the
+        # capture never had.
+        self.assertEqual(
+            analyze._calculate_frame_compositions_per_vblank(vblanks, compositions),
+            [
+                1,
+                0,
+            ],
+        )
+
+    def test_frame_rendering_reasons_bucket_a_frame_that_named_none(self):
+        def did_render_frame(message, msec=0):
+            return {
+                "name": "DidRenderFrame",
+                "message": message,
+                "duration": 0,
+                "end_time": msec_to_nsec(msec),
+            }
+
+        data = {
+            "document": {"timespan": {"begin": 0, "end": msec_to_nsec(1000)}},
+            "marks": {
+                "DidRenderFrame": [
+                    did_render_frame("reasons: Scrolling"),
+                    did_render_frame("reasons: Scrolling, AsyncScrolling", 1),
+                    did_render_frame("reasons: ", 2),
+                    did_render_frame("reasons: ", 3),
+                ]
+            },
+        }
+
+        # The reasons of a frame are one bucket, however many it names, and the
+        # frames that named none share one of their own.
+        self.assertEqual(
+            analyze._prepare_rendering_report(data, display_refreshes(data))[
+                "frame_rendering_reasons"
+            ],
+            {"Scrolling": 1, "Scrolling, AsyncScrolling": 1, "_none": 2},
+        )
+
+    def test_explain_reaches_the_report_through_the_command_line(self):
+        # Through main(), so that renaming the flag or its dest cannot quietly stop the
+        # explanations from being printed.
+        main(["analyze", "-e", SAMPLE_CAPTURE_FILE])
+
+        stdout = self.stdout()
+        self.assertIn(
+            "A frame cycle starts when a LayerTreeHostRenderingUpdate begins", stdout
+        )
+        self.assertIn("StyleRecalc is an umbrella mark", stdout)
+
+    def test_a_capture_of_its_own_broken_timespan_is_no_usage_error(self):
+        # No -t was passed, so nothing the user typed can be at fault.
+        data = {"document": {"timespan": {"begin": 0, "end": -5}}, "marks": {}}
+        self.assertEqual(
+            trim_marks_by_name_to_timespan(data, None, None)["document"]["timespan"][
+                "end"
+            ],
+            -5,
+        )
+
+    def test_statistics_are_matched_by_wording_rather_than_word_position(self):
+        extract = analyze.STATISTICAL_DATA_EXTRACTORS["UpdateTiles"]
+
+        self.assertEqual(
+            extract({"message": "dirty tiles: 40", "duration": 0})["tiles"], 40
+        )
+        # A mark that carries no message at all leaves the statistic out, rather
+        # than reporting a number read from somewhere else.
+        self.assertIsNone(extract({"message": "", "duration": 0})["tiles"])
+
+    def test_explaining_an_empty_frame_cycle_section_still_explains_it(self):
+        args = argparse.Namespace(
+            capture_file=SAMPLE_CAPTURE_FILE,
+            format="text",
+            timespan="0-370",
+            explain=True,
+        )
+        analyze.analyze(args)
+
+        stdout = self.stdout()
+        self.assertIn("- cycles: 0", stdout)
+        # An empty section is what raises the question the explanation answers.
+        self.assertIn(
+            "A frame cycle starts when a LayerTreeHostRenderingUpdate begins", stdout
+        )
+
+    def test_a_broken_capture_is_no_usage_error_even_with_a_timespan(self):
+        # -t 0- asks for exactly the capture's own range, so nothing the user typed
+        # can be at fault when that range runs backwards or is of no length.
+        check_timespan_holds_data(0, msec_to_nsec(-5), 0, None)
+        check_timespan_holds_data(0, msec_to_nsec(-5), None, None)
+        check_timespan_holds_data(0, 0, 0, msec_to_nsec(5))
+
+    def test_a_window_meeting_the_capture_at_one_point_is_rejected(self):
+        capture = (msec_to_nsec(100), msec_to_nsec(200))
+        # Clamped to the capture, either of these encloses a single instant, which
+        # is no duration to divide by and no range for a mark to fall inside.
+        with self.assertRaises(UsageError):
+            check_timespan_holds_data(*capture, msec_to_nsec(200), None)
+        with self.assertRaises(UsageError):
+            check_timespan_holds_data(*capture, None, msec_to_nsec(100))
+        # One millisecond of overlap is still a window.
+        check_timespan_holds_data(*capture, msec_to_nsec(199), None)
+        check_timespan_holds_data(*capture, None, msec_to_nsec(101))
+
+    def test_json_percentiles_keep_the_fiftieth(self):
+        args = argparse.Namespace(
+            capture_file=SAMPLE_CAPTURE_FILE, format="json", timespan="-", explain=False
+        )
+        analyze.analyze(args)
+
+        percentiles = json.loads(self.stdout())["statistics"]["StyleRecalc"][
+            "duration"
+        ]["percentiles"]
+        # Read by consumers since before the frame cycle section existed.
+        self.assertEqual(sorted(percentiles), ["25", "50", "75", "99"])
+
+    def test_delta_histogram_keeps_the_processes_apart(self):
+        # Two processes rendering at 16 ms, offset by 8 ms from one another.
+        marks = []
+        for i in range(5):
+            marks.append(
+                mark("LayerTreeHostRenderingUpdate", i * 16, i * 16 + 2, pid=1)
+            )
+            marks.append(
+                mark("LayerTreeHostRenderingUpdate", i * 16 + 8, i * 16 + 10, pid=2)
+            )
+        data = sysprof_data(marks, end_msec=100)
+
+        # Merged, the deltas would read 8 ms and the histogram would peak at half the
+        # frame interval of either process.
+        deltas = histogram._delta_times_ms(data, "LayerTreeHostRenderingUpdate")
+        self.assertEqual(deltas, [approx(16.0)] * 8)
+
+    def test_composition_overrun_says_nothing_where_nothing_was_analyzed(self):
+        frame_cycle = {
+            "cycles": 9,
+            "processes": 1,
+            "duration_statistics": {"n": 9, "min": 1, "max": 1, "median": 1, "mean": 1},
+            "resolved_duration_statistics": {},
+            "phase_statistics": {phase: {} for phase in analyze.PHASES},
+            "overrunning_composition_statistics": {},
+            "implied_fps": 1.0,
+            "coverage": 0.5,
+            "capture_vblank_interval": 16.0,
+            "vblank_intervals_per_cycle": 1.0,
+            "vblank_intervals_per_cycle_unknown": None,
+        }
+
+        analyze._render_frame_cycle_numbers(frame_cycle)
+
+        stdout = self.stdout()
+        # "in none of 0 analyzed cycles" would read as a measurement never made.
+        self.assertIn("- composition overrunning the cycle: -", stdout)
+        # The note explains shares, and every phase here reads as -.
+        self.assertNotIn("need not total 100%", stdout)
+
+    def test_an_update_ending_on_the_first_refresh_spans_it(self):
+        vblanks = [mark("DisplayLinkUpdate", msec, msec) for msec in (100, 116, 132)]
+        update = [mark("LayerTreeHostRenderingUpdate", 90, 100)]
+
+        # It ran up to that refresh, so it spanned one, and both ends of the range
+        # are read the same way.
+        self.assertEqual(
+            analyze._calculate_vblanks_per_rendering_update(vblanks, update), [1]
+        )
+
+    def test_refreshes_that_composited_nothing_are_samples_of_nothing(self):
+        vblanks = [
+            mark("DisplayLinkUpdate", i * 16, i * 16, "WebKit (UI)", pid=1)
+            for i in range(60)
+        ]
+        data = sysprof_data(vblanks, end_msec=1000)
+
+        rendering = analyze._prepare_rendering_report(data, vblanks)
+
+        # A capture that composited nothing is not a capture without refreshes: every
+        # interval held no composition, which is 59 samples of zero.
+        statistics = rendering["frame_compositions_per_vblank_statistics"]
+        self.assertEqual(statistics["n"], 59)
+        self.assertEqual(statistics["max"], 0)
+
+    def test_dump_csv_carries_every_column_of_a_row(self):
+        args = argparse.Namespace(
+            capture_file=SAMPLE_CAPTURE_FILE, marks=True, counters=False, format="csv"
+        )
+        dump.dump(args)
+
+        header = self.stdout().splitlines()[0]
+        self.assertEqual(header, "group;pid;name;message;time;duration;end_time")
+
+    def test_a_window_without_refreshes_keeps_the_capture_interval(self):
+        # The link stops before the window begins. Its interval is a property of the
+        # display, so the cycles of the window are still measured in it.
+        marks = [
+            mark("DisplayLinkUpdate", i * 16, i * 16, "WebKit (UI)", pid=1)
+            for i in range(30)
+        ]
+        marks += [
+            mark("LayerTreeHostRenderingUpdate", 600 + i * 20, 600 + i * 20 + 5, pid=2)
+            for i in range(10)
+        ]
+        parsed = {"document": {"timespan": [0, msec_to_nsec(1000)]}, "marks": marks}
+        untrimmed = analyze.sysprof_data_with_marks_by_name(parsed)
+        window = analyze.trim_marks_by_name_to_timespan(
+            untrimmed, msec_to_nsec(600), msec_to_nsec(800)
+        )
+
+        report = analyze._prepare_report(window, untrimmed)
+
+        self.assertEqual(report["rendering"]["vblanks"], 0)
+        self.assertEqual(report["frame_cycle"]["capture_vblank_interval"], approx(16.0))
+        self.assertEqual(
+            report["frame_cycle"]["vblank_intervals_per_cycle"], approx(20 / 16)
+        )
+
     def test_analyze_with_custom_timespan(self):
         args = argparse.Namespace(
-            capture_file=SAMPLE_CAPTURE_FILE, format="text", timespan="0-0"
+            capture_file=SAMPLE_CAPTURE_FILE,
+            format="text",
+            timespan="0-370",
+            explain=False,
         )
-        stdout = _capture_stdout(analyze.analyze, args)
+        analyze.analyze(args)
 
-        self.assertIn("Timespan: 0.0000 - 0.0000 [s]", stdout)
-        self.assertIn("vblanks: 0", stdout)
+        stdout = self.stdout()
+        self.assertIn("Timespan: 0.0000 - 0.3700 [s]", stdout)
+        self.assertIn("vblanks: 2", stdout)
 
     def test_analyze_with_custom_timespan_begin(self):
         args = argparse.Namespace(
-            capture_file=SAMPLE_CAPTURE_FILE, format="text", timespan="500-"
+            capture_file=SAMPLE_CAPTURE_FILE,
+            format="text",
+            timespan="500-",
+            explain=False,
         )
-        stdout = _capture_stdout(analyze.analyze, args)
+        analyze.analyze(args)
 
+        stdout = self.stdout()
         self.assertIn("Timespan: 0.5000 - 4.4673 [s]", stdout)
         self.assertIn("vblanks: 25", stdout)
 
     def test_analyze_with_custom_timespan_end(self):
         args = argparse.Namespace(
-            capture_file=SAMPLE_CAPTURE_FILE, format="text", timespan="-500"
+            capture_file=SAMPLE_CAPTURE_FILE,
+            format="text",
+            timespan="-500",
+            explain=False,
         )
-        stdout = _capture_stdout(analyze.analyze, args)
+        analyze.analyze(args)
 
+        stdout = self.stdout()
         self.assertIn("Timespan: 0.0000 - 0.5000 [s]", stdout)
         self.assertIn("vblanks: 10", stdout)
 
diff --git a/Tools/Scripts/webkit-sysprof/webkitsysprof/tests/utils_unittest.py b/Tools/Scripts/webkit-sysprof/webkitsysprof/tests/utils_unittest.py
new file mode 100644
index 000000000000..013a0da2b20f
--- /dev/null
+++ b/Tools/Scripts/webkit-sysprof/webkitsysprof/tests/utils_unittest.py
@@ -0,0 +1,92 @@
+"""The helpers webkitsysprof.utils holds, which every command reads marks with."""
+
+import unittest
+
+from .helpers import SysprofTestCase, approx, mark, sysprof_data
+
+from webkitsysprof.utils import (
+    UsageError,
+    marks_in_time_order,
+    merged_spans,
+    msec_to_nsec,
+    parse_timespan_argument,
+    percentiles,
+    sysprof_data_with_marks_by_name,
+    intervals_between_marks,
+    median_vblank_interval,
+    display_refreshes,
+)
+
+
+class UtilsTest(SysprofTestCase):
+    def test_spans_are_merged_where_they_overlap_or_touch(self):
+        self.assertEqual(
+            merged_spans([(0, 5), (3, 8), (8, 9), (20, 25)]), [(0, 9), (20, 25)]
+        )
+        # An empty span is no span at all, rather than one of no length in between.
+        self.assertEqual(merged_spans([(5, 5), (10, 12)]), [(10, 12)])
+        self.assertEqual(merged_spans([]), [])
+
+    def test_a_timespan_bound_is_digits_and_nothing_else(self):
+        # int() would take every one of these and analyze a window nobody asked for.
+        for timespan in [
+            "  5",
+            "+5",
+            "0-1_000",
+            "5\n",
+            "500-100",
+            # Of no length, so it encloses nothing between its bounds.
+            "0-0",
+            "500-500",
+            "abc",
+            "0-1e3",
+            "1-2-3",
+            "",
+        ]:
+            with self.subTest(timespan=timespan), self.assertRaises(UsageError):
+                parse_timespan_argument(timespan)
+
+    def test_percentiles_outside_the_range_of_the_quantiles_are_rejected(self):
+        # Percentile 0 used to index the list from the back and report P99 as P0.
+        for percentile in [0, 100, -1]:
+            with self.subTest(percentile=percentile), self.assertRaises(ValueError):
+                percentiles([1.0, 2.0, 3.0], [percentile])
+
+    def test_a_bare_bound_is_the_begin_of_the_timespan(self):
+        self.assertEqual(parse_timespan_argument("500"), (msec_to_nsec(500), None))
+
+    def test_vblank_intervals_do_not_depend_on_the_order_of_the_marks(self):
+        data = sysprof_data(
+            [
+                mark("DisplayLinkUpdate", 32, 33),
+                mark("DisplayLinkUpdate", 0, 1),
+                mark("DisplayLinkUpdate", 16, 17),
+            ]
+        )
+
+        self.assertEqual(
+            intervals_between_marks(marks_in_time_order(data, "DisplayLinkUpdate")),
+            [
+                approx(16.0),
+                approx(16.0),
+            ],
+        )
+        self.assertEqual(
+            median_vblank_interval(display_refreshes(data)),
+            approx(16.0),
+        )
+
+    def test_reshaping_the_same_parsed_data_twice_yields_the_same_result(self):
+        parsed_data = {
+            "document": {"timespan": [0, msec_to_nsec(1000)]},
+            "marks": [mark("LayerTreeHostRenderingUpdate", 0, 5)],
+        }
+
+        first = sysprof_data_with_marks_by_name(parsed_data)
+        second = sysprof_data_with_marks_by_name(parsed_data)
+        self.assertEqual(first["document"]["timespan"], second["document"]["timespan"])
+        self.assertEqual(parsed_data["document"]["timespan"], [0, msec_to_nsec(1000)])
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/Tools/Scripts/webkit-sysprof/webkitsysprof/utils/__init__.py b/Tools/Scripts/webkit-sysprof/webkitsysprof/utils/__init__.py
index 50960215cf25..f0a8791006bf 100644
--- a/Tools/Scripts/webkit-sysprof/webkitsysprof/utils/__init__.py
+++ b/Tools/Scripts/webkit-sysprof/webkitsysprof/utils/__init__.py
@@ -1,4 +1,18 @@
-from typing import Any, Dict, Optional, Tuple, Union
+import collections
+import logging
+import re
+import statistics
+from typing import (
+    Any,
+    Dict,
+    Iterable,
+    List,
+    Literal,
+    Optional,
+    Sequence,
+    Tuple,
+    Union,
+)
 
 NSEC_PER_MSEC = 1_000_000
 NSEC_PER_SEC = 1_000_000_000
@@ -21,20 +35,56 @@ def msec_to_nsec(msec: int) -> int:
     return msec * NSEC_PER_MSEC
 
 
+# A timespan bound is a plain number of milliseconds, nothing int() would also take.
+# Ended with \Z rather than $, which would let a trailing newline through.
+MILLISECONDS_RE = re.compile(r"^\d+\Z")
+
+
+class UsageError(ValueError):
+    """The user asked for something the tool cannot do, e.g. a backwards timespan.
+
+    Told apart from the other ValueErrors so that the command line can report it as
+    a usage error while a broken capture still raises where it broke.
+    """
+
+
+def mark_begin(mark: Dict[str, Any]) -> int:
+    """Marks carry an end time and a duration, so a begin time has to be derived."""
+    return int(mark["end_time"] - mark["duration"])
+
+
 def parse_timespan_argument(arg: str) -> Tuple[Optional[int], Optional[int]]:
-    timespan_begin, timespan_end = None, None
+    """Parse "<begin>-<end>" in milliseconds, either side of which may be empty.
+
+    A single bound without a dash is the begin, e.g. "500" is "from 500 ms on".
+    """
+
+    def parse_bound(value: str) -> Optional[int]:
+        if value == "":
+            return None
+        # Digits and nothing else: int() would take " 5", "+5" and "1_000" too, and
+        # a timespan the tool reads as something other than what was typed is what
+        # rejecting a malformed one is meant to prevent.
+        if not MILLISECONDS_RE.match(value):
+            raise UsageError(f"timespan bound is no number of milliseconds: {value}")
+        return int(value)
+
+    if arg == "":
+        raise UsageError("timespan is empty")
     values = arg.split("-")
+    if len(values) > 2:
+        raise UsageError(f'timespan is no "<begin>-<end>" in milliseconds: {arg}')
+    timespan_begin = parse_bound(values[0])
+    timespan_end = parse_bound(values[1]) if len(values) == 2 else None
 
-    if len(values) > 0:
-        try:
-            timespan_begin = int(values[0])
-        except ValueError:
-            pass
-    if len(values) > 1:
-        try:
-            timespan_end = int(values[1])
-        except ValueError:
-            pass
+    if timespan_begin is not None and timespan_end is not None:
+        if timespan_begin > timespan_end:
+            raise UsageError(f"timespan begins after it ends: {arg}")
+        # A window of no length encloses no data and is no duration to divide by,
+        # so every rate taken over it is unknown. Rejected rather than reported as
+        # a row of zeroes, which reads as a measurement that was made.
+        if timespan_begin == timespan_end:
+            raise UsageError(f"timespan is of no length: {arg}")
 
     return (
         msec_to_nsec(timespan_begin) if timespan_begin is not None else None,
@@ -42,24 +92,212 @@ def parse_timespan_argument(arg: str) -> Tuple[Optional[int], Optional[int]]:
     )
 
 
-def trim_sysprof_data_to_timespan(
+def sysprof_data_with_marks_by_name(sysprof_data: Dict[str, Any]) -> Dict[str, Any]:
+    """Reshape parsed data so that marks are grouped by name.
+
+    The groups keep the order the marks were parsed in, so the callers that walk
+    them in time order sort them the way they need. The input is left untouched.
+    """
+    document = dict(sysprof_data["document"])
+    document["timespan"] = {
+        "begin": sysprof_data["document"]["timespan"][0],
+        "end": sysprof_data["document"]["timespan"][1],
+    }
+    marks_by_name: Dict[str, List[Dict[str, Any]]] = collections.defaultdict(list)
+    for mark in sysprof_data["marks"]:
+        marks_by_name[mark["name"]].append(mark)
+    # Handed out as a plain dict, so that a name the capture never held is a
+    # KeyError for the callers that subscript it rather than an empty list.
+    return {"document": document, "marks": dict(marks_by_name)}
+
+
+def check_timespan_holds_data(
+    capture_begin: int,
+    capture_end: int,
+    timespan_begin: Optional[int],
+    timespan_end: Optional[int],
+) -> None:
+    """Reject a timespan the caller asked for that the capture cannot answer."""
+    if capture_begin >= capture_end:
+        # The capture holds no range for a window to miss, so there is nothing the
+        # caller could have asked for that would be right, and blaming the window
+        # for what the capture lacks would point at the wrong thing. Say so, so
+        # that the empty report below carries its reason with it.
+        logging.warning(
+            "The capture spans no time (begins at %d, ends at %d), so the report "
+            "has no rate to give.",
+            capture_begin,
+            capture_end,
+        )
+        return
+    if timespan_begin is not None and timespan_begin >= capture_end:
+        raise UsageError(
+            "timespan begins at or after the capture ends, so it holds no data"
+        )
+    if timespan_end is not None and timespan_end <= capture_begin:
+        raise UsageError(
+            "timespan ends at or before the capture begins, so it holds no data"
+        )
+
+
+def trim_marks_by_name_to_timespan(
     sysprof_data: Dict[str, Any],
     timespan_begin: Optional[int],
     timespan_end: Optional[int],
 ) -> Dict[str, Any]:
-    trimmed_document = sysprof_data["document"]
+    """Narrow data grouped by sysprof_data_with_marks_by_name() to a timespan.
 
+    Marks that cross a boundary are dropped, since only part of them happened
+    within the window. The input is left untouched, so its callers keep the
+    untrimmed data, which the frame cycles need.
+    """
+    # Narrowed even where no bound was given, since the capture holds marks that
+    # begin before its own timespan does, and the frame cycles are cut to that
+    # timespan either way.
+    timespan = dict(sysprof_data["document"]["timespan"])
+    # Clamped to the capture, so that a window reaching past it does not stretch
+    # the analyzed duration that every rate is divided by.
     if timespan_begin is not None:
-        trimmed_document["timespan"][0] = timespan_begin
+        timespan["begin"] = max(timespan_begin, timespan["begin"])
     if timespan_end is not None:
-        trimmed_document["timespan"][1] = timespan_end
+        timespan["end"] = min(timespan_end, timespan["end"])
 
     def mark_in_timespan(mark: Dict[str, Any]) -> bool:
         return (
-            (mark["end_time"] - mark["duration"]) >= trimmed_document["timespan"][0]
-        ) and mark["end_time"] <= trimmed_document["timespan"][1]
+            mark_begin(mark) >= timespan["begin"]
+            and mark["end_time"] <= timespan["end"]
+        )
 
+    trimmed_document = dict(sysprof_data["document"])
+    trimmed_document["timespan"] = timespan
     return {
         "document": trimmed_document,
-        "marks": [mark for mark in sysprof_data["marks"] if mark_in_timespan(mark)],
+        "marks": {
+            mark_name: [mark for mark in marks if mark_in_timespan(mark)]
+            for mark_name, marks in sysprof_data["marks"].items()
+        },
     }
+
+
+def merged_spans(spans: Iterable[Tuple[int, int]]) -> List[Tuple[int, int]]:
+    """The [begin, end) spans merged where they overlap or touch, in order.
+
+    Empty spans are dropped, so that a mark clipped to nothing does not become a
+    span of no length between two real ones.
+    """
+    merged: List[Tuple[int, int]] = []
+    for begin, end in sorted(spans):
+        if end <= begin:
+            continue
+        if merged and begin <= merged[-1][1]:
+            merged[-1] = (merged[-1][0], max(merged[-1][1], end))
+        else:
+            merged.append((begin, end))
+    return merged
+
+
+def sample_statistics(
+    values: Sequence[Union[int, float]], wanted: Sequence[int] = ()
+) -> Dict[str, Any]:
+    if not values:
+        return {}
+    return {
+        "n": len(values),
+        "min": min(values),
+        "max": max(values),
+        "mean": statistics.mean(values),
+        "stddev": statistics.stdev(values) if len(values) > 1 else 0,
+        # Both of these sort what they are given, so handing them a sorted sequence
+        # would add a sort rather than save the two they do.
+        "median": statistics.median(values),
+        "percentiles": percentiles(values, wanted),
+    }
+
+
+def percentiles(
+    values: Sequence[Union[int, float]],
+    wanted: Sequence[int],
+    method: Literal["inclusive", "exclusive"] = "inclusive",
+) -> Dict[str, float]:
+    """Percentiles interpolated between the data points, empty below two of them.
+
+    Keyed by the percentile as a string, the shape json.dumps() turns an int key
+    into anyway, so that a report read back from JSON is the report written.
+
+    The inclusive method stays between the smallest and the largest sample, while
+    the exclusive one extrapolates past them: on few samples it reports a P25 below
+    the minimum, a P99 above the maximum and negative durations. Reporting the
+    samples wants the former, estimating the spread of what they were drawn from
+    wants the latter. Both need two data points, and below that quantiles() raises
+    before Python 3.13.
+    """
+    for percentile in wanted:
+        if not 1 <= percentile <= 99:
+            raise ValueError(f"no percentile between 1 and 99: {percentile}")
+    # Before the sort quantiles() does, which nothing would read.
+    if not wanted:
+        return {}
+    if len(values) < 2:
+        return {}
+    quantiles: List[float] = statistics.quantiles(values, n=100, method=method)
+    return {str(percentile): quantiles[percentile - 1] for percentile in wanted}
+
+
+def mark_pid(mark: Dict[str, Any]) -> int:
+    """The process a mark was emitted by, as the capture records it."""
+    return int(mark.get("pid", 0))
+
+
+def marks_by_process(
+    marks: Sequence[Dict[str, Any]],
+) -> Dict[int, List[Dict[str, Any]]]:
+    """The marks grouped by the process they came from, in process order."""
+    by_pid: Dict[int, List[Dict[str, Any]]] = collections.defaultdict(list)
+    for mark in marks:
+        by_pid[mark_pid(mark)].append(mark)
+    return dict(sorted(by_pid.items()))
+
+
+def marks_in_time_order(
+    sysprof_data: Dict[str, Any], mark_name: str
+) -> List[Dict[str, Any]]:
+    """The marks of that name, ordered by when they ended.
+
+    The grouping keeps the marks in parse order, so every walk that depends on
+    time order sorts them here.
+    """
+    return sorted(
+        sysprof_data["marks"].get(mark_name, []), key=lambda mark: mark["end_time"]
+    )
+
+
+def intervals_between_marks(marks: Sequence[Dict[str, Any]]) -> List[float]:
+    """Times between the ends of consecutive marks, in milliseconds.
+
+    Takes the marks in time order, as marks_in_time_order() returns them.
+    """
+    return [
+        nsec_to_msec(marks[i]["end_time"] - marks[i - 1]["end_time"])
+        for i in range(1, len(marks))
+    ]
+
+
+def display_refreshes(sysprof_data: Dict[str, Any]) -> List[Dict[str, Any]]:
+    """The DisplayLinkUpdate marks of the capture, in time order.
+
+    All of them: the display links all live in the UI process, one per display, so
+    the marks of a capture are the refreshes of one process either way. Two displays
+    driven at once are merged, which no mark tells apart, and so is a link that
+    stopped and started again: the gap it leaves counts as one very long interval
+    between two refreshes.
+    """
+    return marks_in_time_order(sysprof_data, "DisplayLinkUpdate")
+
+
+def median_vblank_interval(refreshes: Sequence[Dict[str, Any]]) -> Optional[float]:
+    """Median time between display refreshes in milliseconds, None if unknown.
+
+    Takes the refreshes as display_refreshes() returns them.
+    """
+    intervals = intervals_between_marks(refreshes)
+    return statistics.median(intervals) if intervals else None
diff --git a/Tools/Scripts/webkitperl/BuildSubproject.pm b/Tools/Scripts/webkitperl/BuildSubproject.pm
index 61575d672e99..6e6a22565777 100644
--- a/Tools/Scripts/webkitperl/BuildSubproject.pm
+++ b/Tools/Scripts/webkitperl/BuildSubproject.pm
@@ -171,7 +171,9 @@ if (isCMakeBuild()) {
     unless (isAnyWindows()) {
         # By default we build using all of the available CPUs
         $makeArgs .= ($makeArgs ? " " : "") . "-j" . numberOfCPUs() if $makeArgs !~ /-j\s*\d+/;
-        $buildTarget = "jsc testb3 testair testapi testmasm testdfg testwasmdebugger $makeArgs";
+        $buildTarget = "jsc testb3 testair testapi testmasm testdfg testwasmdebugger";
+        $buildTarget .= " testLibJSCTools" if $^O eq "darwin"; # libJavaScriptCoreTools only available on Apple platforms.
+        $buildTarget .= " $makeArgs";
     } elsif (canUseNinja()) {
         $buildTarget .= "jsc testapi testmasm";
     }
diff --git a/Tools/Scripts/webkitpy/__init__.py b/Tools/Scripts/webkitpy/__init__.py
index 260f981d37fb..d4f1688dee9b 100644
--- a/Tools/Scripts/webkitpy/__init__.py
+++ b/Tools/Scripts/webkitpy/__init__.py
@@ -97,7 +97,7 @@ def _get_main_repo_autoinstall_path():
             wheel=True,
             )
 )
-AutoInstall.register(Package('pytest_asyncio', Version(1, 1, 1), pypi_name='pytest-asyncio', implicit_deps=['pytest'] + (['backports.asyncio_runner'] if sys.version_info < (3, 11) else []), wheel=True))
+AutoInstall.register(Package('pytest_asyncio', Version(0, 19, 0), pypi_name='pytest-asyncio', implicit_deps=['pytest'], wheel=True))
 AutoInstall.register(Package('pytest_timeout', Version(2, 4, 0), pypi_name='pytest-timeout', implicit_deps=['pytest'], wheel=True))
 AutoInstall.register(Package('websockets', Version(12, 0), wheel=True))
 
diff --git a/Tools/Scripts/webkitpy/common/config/ports.py b/Tools/Scripts/webkitpy/common/config/ports.py
index e0076f90c565..2f1f6d218bcd 100644
--- a/Tools/Scripts/webkitpy/common/config/ports.py
+++ b/Tools/Scripts/webkitpy/common/config/ports.py
@@ -219,6 +219,7 @@ def run_javascriptcore_tests_command(self, build_style=None):
         command.append("--no-testdfg")
         command.append("--no-testapi")
         command.append("--no-testwasmdebugger")
+        command.append("--no-testlibjsctools")
         if 'JSCTESTS_OPTIONS' in os.environ:
             command += os.environ['JSCTESTS_OPTIONS'].split()
         return self._append_build_style_flag(command, build_style)
diff --git a/Tools/Scripts/webkitpy/common/config/ports_unittest.py b/Tools/Scripts/webkitpy/common/config/ports_unittest.py
index 05aa71aa459c..b3cb23bd688a 100644
--- a/Tools/Scripts/webkitpy/common/config/ports_unittest.py
+++ b/Tools/Scripts/webkitpy/common/config/ports_unittest.py
@@ -67,4 +67,4 @@ def test_jsconly_port(self):
         self.assertEqual(JscOnlyPort().build_jsc_command(), DeprecatedPort().script_shell_command("build-jsc") + ["--jsc-only"])
         self.assertEqual(JscOnlyPort().build_jsc_command(build_style="release"), DeprecatedPort().script_shell_command("build-jsc") + ["--jsc-only", "--release"])
         self.assertEqual(JscOnlyPort().build_jsc_command(build_style="debug"), DeprecatedPort().script_shell_command("build-jsc") + ["--jsc-only", "--debug"])
-        self.assertEqual(JscOnlyPort().run_javascriptcore_tests_command(build_style="debug"), DeprecatedPort().script_shell_command("run-javascriptcore-tests") + ['--no-fail-fast', '--no-testmasm', '--no-testair', '--no-testb3', '--no-testdfg', '--no-testapi', '--no-testwasmdebugger', '--debug'])
+        self.assertEqual(JscOnlyPort().run_javascriptcore_tests_command(build_style="debug"), DeprecatedPort().script_shell_command("run-javascriptcore-tests") + ['--no-fail-fast', '--no-testmasm', '--no-testair', '--no-testb3', '--no-testdfg', '--no-testapi', '--no-testwasmdebugger', '--no-testlibjsctools', '--debug'])
diff --git a/Tools/Scripts/webkitpy/style/checkers/cpp.py b/Tools/Scripts/webkitpy/style/checkers/cpp.py
index 1898f39429ea..4f1145062df6 100644
--- a/Tools/Scripts/webkitpy/style/checkers/cpp.py
+++ b/Tools/Scripts/webkitpy/style/checkers/cpp.py
@@ -4502,6 +4502,18 @@ def check_language(filename, clean_lines, line_number, file_extension, include_s
         error(line_number, 'runtime/dispatch_set_target_queue', 5,
               'Never use dispatch_set_target_queue.  Use dispatch_queue_create_with_target instead.')
 
+    matched = search(r'\bDISPATCH_QUEUE_(SERIAL|CONCURRENT)\b', line)
+    if matched:
+        error(line_number, 'runtime/dispatch_queue_autorelease_pool', 5,
+              'Use %sQueueWithAutoreleasePoolAttrSingleton() instead of %s so that each work item runs with its '
+              'own autorelease pool.' % (matched.group(1).lower(), matched.group(0)))
+
+    matched = search(r'\bDISPATCH_QUEUE_(SERIAL|CONCURRENT)_WITH_AUTORELEASE_POOL\b', line)
+    if matched:
+        error(line_number, 'runtime/dispatch_queue_autorelease_pool', 5,
+              'Use %sQueueWithAutoreleasePoolAttrSingleton() instead of %s so that static analysis knows the '
+              'attribute does not need to be retained.' % (matched.group(1).lower(), matched.group(0)))
+
     matched = search(r'\b(RetainPtr<.*)', line)
     if matched:
         match_line = matched.group(1)
@@ -5345,6 +5357,7 @@ class CppChecker(object):
         'runtime/callonmainthread',
         'runtime/casting',
         'runtime/ctype_function',
+        'runtime/dispatch_queue_autorelease_pool',
         'runtime/dispatch_set_target_queue',
         'runtime/enum_bitfields',
         'runtime/explicit',
diff --git a/Tools/Scripts/webkitpy/style/checkers/cpp_unittest.py b/Tools/Scripts/webkitpy/style/checkers/cpp_unittest.py
index ff07d83aeaec..88c3aba72aeb 100644
--- a/Tools/Scripts/webkitpy/style/checkers/cpp_unittest.py
+++ b/Tools/Scripts/webkitpy/style/checkers/cpp_unittest.py
@@ -1868,11 +1868,36 @@ def test_insecure_temp_file(self):
     def test_dispatch_set_target_queue(self):
         self.assert_lint(
             '''\
-            globalQueue = dispatch_queue_create("My Serial Queue", DISPATCH_QUEUE_SERIAL);
+            globalQueue = dispatch_queue_create("My Serial Queue", serialQueueWithAutoreleasePoolAttrSingleton());
             dispatch_set_target_queue(globalQueue, globalDispatchQueueSingleton(DISPATCH_QUEUE_PRIORITY_HIGH, 0));''',
             'Never use dispatch_set_target_queue.  Use dispatch_queue_create_with_target instead.'
             '  [runtime/dispatch_set_target_queue] [5]')
-        self.assert_lint('globalQueue = dispatch_queue_create_with_target("My Serial Queue", DISPATCH_QUEUE_SERIAL, globalDispatchQueueSingleton(DISPATCH_QUEUE_PRIORITY_HIGH, 0));', '')
+        self.assert_lint('globalQueue = dispatch_queue_create_with_target("My Serial Queue", serialQueueWithAutoreleasePoolAttrSingleton(), globalDispatchQueueSingleton(DISPATCH_QUEUE_PRIORITY_HIGH, 0));', '')
+
+    def test_dispatch_queue_autorelease_pool(self):
+        self.assert_lint(
+            'globalQueue = dispatch_queue_create("My Serial Queue", DISPATCH_QUEUE_SERIAL);',
+            'Use serialQueueWithAutoreleasePoolAttrSingleton() instead of DISPATCH_QUEUE_SERIAL so that each work '
+            'item runs with its own autorelease pool.'
+            '  [runtime/dispatch_queue_autorelease_pool] [5]')
+        self.assert_lint(
+            'globalQueue = dispatch_queue_create("My Concurrent Queue", DISPATCH_QUEUE_CONCURRENT);',
+            'Use concurrentQueueWithAutoreleasePoolAttrSingleton() instead of DISPATCH_QUEUE_CONCURRENT so that '
+            'each work item runs with its own autorelease pool.'
+            '  [runtime/dispatch_queue_autorelease_pool] [5]')
+        self.assert_lint(
+            'globalQueue = dispatch_queue_create("My Serial Queue", DISPATCH_QUEUE_SERIAL_WITH_AUTORELEASE_POOL);',
+            'Use serialQueueWithAutoreleasePoolAttrSingleton() instead of DISPATCH_QUEUE_SERIAL_WITH_AUTORELEASE_POOL '
+            'so that static analysis knows the attribute does not need to be retained.'
+            '  [runtime/dispatch_queue_autorelease_pool] [5]')
+        self.assert_lint(
+            'globalQueue = dispatch_queue_create("My Concurrent Queue", DISPATCH_QUEUE_CONCURRENT_WITH_AUTORELEASE_POOL);',
+            'Use concurrentQueueWithAutoreleasePoolAttrSingleton() instead of '
+            'DISPATCH_QUEUE_CONCURRENT_WITH_AUTORELEASE_POOL so that static analysis knows the attribute does not '
+            'need to be retained.'
+            '  [runtime/dispatch_queue_autorelease_pool] [5]')
+        self.assert_lint('globalQueue = dispatch_queue_create("My Serial Queue", serialQueueWithAutoreleasePoolAttrSingleton());', '')
+        self.assert_lint('globalQueue = dispatch_queue_create("My Concurrent Queue", concurrentQueueWithAutoreleasePoolAttrSingleton());', '')
 
     def test_retainptr_pointer(self):
         self.assert_lint(
@@ -6213,7 +6238,7 @@ def test_auto_with_adopt(self):
             "  [runtime/auto_with_adopt] [4]",
             'foo.cpp')
         self.assert_lint(
-            'auto queue = adoptOSObject(dispatch_queue_create("foo", DISPATCH_QUEUE_SERIAL));',
+            'auto queue = adoptOSObject(dispatch_queue_create("foo", serialQueueWithAutoreleasePoolAttrSingleton()));',
             "Use 'OSObjectPtr' instead of 'auto' with 'adoptOSObject()'."
             "  [runtime/auto_with_adopt] [4]",
             'foo.cpp')
@@ -6526,16 +6551,16 @@ def test_wtf_never_destroyed(self):
 
     def test_wtf_os_object_ptr(self):
         self.assert_lint(
-            'auto queue = adoptOSObject(dispatch_queue_create("foo", DISPATCH_QUEUE_SERIAL));',
+            'auto queue = adoptOSObject(dispatch_queue_create("foo", serialQueueWithAutoreleasePoolAttrSingleton()));',
             "Use 'OSObjectPtr' instead of 'auto' with 'adoptOSObject()'."
             "  [runtime/auto_with_adopt] [4]",
             'foo.cpp')
         self.assert_lint(
-            'OSObjectPtr queue = adoptOSObject(dispatch_queue_create("foo", DISPATCH_QUEUE_SERIAL));',
+            'OSObjectPtr queue = adoptOSObject(dispatch_queue_create("foo", serialQueueWithAutoreleasePoolAttrSingleton()));',
             '',
             'foo.cpp')
         self.assert_lint(
-            'OSObjectPtr<dispatch_queue_t> queue = adoptOSObject(dispatch_queue_create("foo", DISPATCH_QUEUE_SERIAL));',
+            'OSObjectPtr<dispatch_queue_t> queue = adoptOSObject(dispatch_queue_create("foo", serialQueueWithAutoreleasePoolAttrSingleton()));',
             '',
             'foo.cpp')
         self.assert_lint(
@@ -6564,7 +6589,7 @@ def test_wtf_os_object_ptr(self):
             "  [runtime/wtf_os_object_ptr] [4]",
             'foo.mm')
         self.assert_lint_one_of_many_errors_re(
-            'auto queue = adoptNS(dispatch_queue_create("foo", DISPATCH_QUEUE_SERIAL));',
+            'auto queue = adoptNS(dispatch_queue_create("foo", serialQueueWithAutoreleasePoolAttrSingleton()));',
             r"Use 'adoptOSObject\(\)' instead of 'adoptNS\(\)' for dispatch objects.",
             'foo.mm')
         self.assert_lint_one_of_many_errors_re(
@@ -6572,19 +6597,19 @@ def test_wtf_os_object_ptr(self):
             r"Use 'adoptOSObject\(\)' instead of 'adoptNS\(\)' for dispatch objects.",
             'foo.mm')
         self.assert_lint_one_of_many_errors_re(
-            'auto queue = adoptOSObject(dispatch_queue_create("foo", RetainPtr { DISPATCH_QUEUE_CONCURRENT }.get()));',
+            'auto queue = adoptOSObject(dispatch_queue_create("foo", RetainPtr { DISPATCH_QUEUE_CONCURRENT_WITH_AUTORELEASE_POOL }.get()));',
             r"Use 'OSObjectPtr' instead of 'RetainPtr' for dispatch objects.",
             'foo.mm')
         self.assert_lint_one_of_many_errors_re(
-            'auto queue = adoptOSObject(dispatch_queue_create("foo", RetainPtr { DISPATCH_QUEUE_SERIAL }.get()));',
+            'auto queue = adoptOSObject(dispatch_queue_create("foo", RetainPtr { DISPATCH_QUEUE_SERIAL_WITH_AUTORELEASE_POOL }.get()));',
             r"Use 'OSObjectPtr' instead of 'RetainPtr' for dispatch objects.",
             'foo.mm')
         self.assert_lint_one_of_many_errors_re(
-            'auto queue = adoptOSObject(dispatch_queue_create("foo", retainPtr(DISPATCH_QUEUE_CONCURRENT).get()));',
+            'auto queue = adoptOSObject(dispatch_queue_create("foo", retainPtr(DISPATCH_QUEUE_CONCURRENT_WITH_AUTORELEASE_POOL).get()));',
             r"Use 'OSObjectPtr' instead of 'RetainPtr' for dispatch objects.",
             'foo.mm')
         self.assert_lint_one_of_many_errors_re(
-            'auto queue = adoptOSObject(dispatch_queue_create("foo", retainPtr(DISPATCH_QUEUE_SERIAL).get()));',
+            'auto queue = adoptOSObject(dispatch_queue_create("foo", retainPtr(DISPATCH_QUEUE_SERIAL_WITH_AUTORELEASE_POOL).get()));',
             r"Use 'OSObjectPtr' instead of 'RetainPtr' for dispatch objects.",
             'foo.mm')
 
diff --git a/Tools/TestWebKitAPI/CMakeLists.txt b/Tools/TestWebKitAPI/CMakeLists.txt
index 40ddad9271b4..180bcb7faae8 100644
--- a/Tools/TestWebKitAPI/CMakeLists.txt
+++ b/Tools/TestWebKitAPI/CMakeLists.txt
@@ -351,8 +351,8 @@ if (ENABLE_WEBKIT)
     set(TestWebKit_SOURCES
         Helpers/Utilities.cpp
 
-        Tests/WebCore/QuirkMatch.cpp
         Tests/WebCore/Quirks.cpp
+        Tests/WebCore/URLMatch.cpp
 
         Tests/WebKit/WKPage/AboutBlankLoad.cpp
         Tests/WebKit/WKPage/CanHandleRequest.cpp
diff --git a/Tools/TestWebKitAPI/Configurations/Base.xcconfig b/Tools/TestWebKitAPI/Configurations/Base.xcconfig
index fa2529f333e7..40779526a7bc 100644
--- a/Tools/TestWebKitAPI/Configurations/Base.xcconfig
+++ b/Tools/TestWebKitAPI/Configurations/Base.xcconfig
@@ -48,10 +48,10 @@ PROJECT_HEADER_SEARCH_PATHS_cocoatouch = $(inherited) $(SRCROOT)/../../Source/We
 SWIFT_INCLUDE_PATHS = $(inherited) $(SWIFT_INCLUDE_PATHS_$(USE_INTERNAL_SDK));
 SWIFT_INCLUDE_PATHS_ = $(SRCROOT)/../../Source/WebKit/Platform/spi/Cocoa;
 
-HEADER_SEARCH_PATHS = $(ALTERNATE_HEADER_SEARCH_PATHS) ${BUILT_PRODUCTS_DIR}/usr/local/include $(WEBCORE_PRIVATE_HEADERS_DIR)/ForwardingHeaders $(BUILT_PRODUCTS_DIR)/WebKitTestSupport $(WEBKIT_TESTSUPPORT_INSTALLED_DIR) ${SRCROOT} $(PROJECT_HEADER_SEARCH_PATHS);
+HEADER_SEARCH_PATHS = $(ALTERNATE_HEADER_SEARCH_PATHS) ${BUILT_PRODUCTS_DIR}/usr/local/include $(LIBWEBRTC_HEADER_SEARCH_PATHS) $(WEBCORE_PRIVATE_HEADERS_DIR)/ForwardingHeaders $(BUILT_PRODUCTS_DIR)/WebKitTestSupport $(WEBKIT_TESTSUPPORT_INSTALLED_DIR) ${SRCROOT} $(PROJECT_HEADER_SEARCH_PATHS);
 
 WEBKIT_TESTSUPPORT_INSTALLED_DIR[config=Production] = $(SDK_DIR)$(WK_ALTERNATE_WEBKIT_SDK_PATH)$(WK_LIBRARY_HEADERS_FOLDER_PATH)/WebKitTestSupport;
-LIBRARY_SEARCH_PATHS = $(SDK_DIR)$(WK_ALTERNATE_WEBKIT_SDK_PATH)$(WK_LIBRARY_INSTALL_PATH) $(inherited);
+LIBRARY_SEARCH_PATHS = $(SDK_DIR)$(WK_ALTERNATE_WEBKIT_SDK_PATH)$(WK_LIBRARY_INSTALL_PATH) "$(SDK_DIR)$(WEBCORE_LIBRARY_DIR)" $(inherited);
 SYSTEM_HEADER_SEARCH_PATHS = $(inherited) $(WK_PRIVATE_SDK_DIR)$(WK_ALTERNATE_WEBKIT_SDK_PATH)$(WK_LIBRARY_HEADERS_FOLDER_PATH);
 
 SYSTEM_FRAMEWORK_SEARCH_PATHS = $(inherited) $(SYSTEM_FRAMEWORK_SEARCH_PATHS_$(WK_USE_ALTERNATE_FRAMEWORKS_DIR)) $(SYSTEM_FRAMEWORK_SEARCH_PATHS_WEBCORE_$(WK_COCOA_TOUCH));
diff --git a/Tools/TestWebKitAPI/Configurations/TestWebKitAPIBase.xcconfig b/Tools/TestWebKitAPI/Configurations/TestWebKitAPIBase.xcconfig
index dcf80fd688a0..48cff520e661 100644
--- a/Tools/TestWebKitAPI/Configurations/TestWebKitAPIBase.xcconfig
+++ b/Tools/TestWebKitAPI/Configurations/TestWebKitAPIBase.xcconfig
@@ -114,7 +114,15 @@ WK_GAMECONTROLLER_LDFLAGS_iphonesimulator = -framework GameController
 WK_GAMECONTROLLER_LDFLAGS_xros = -framework GameController
 WK_GAMECONTROLLER_LDFLAGS_xrsimulator = -framework GameController
 
-OTHER_LDFLAGS = $(inherited) $(GTEST_LDFLAGS) -lxml2 -force_load $(BUILT_PRODUCTS_DIR)/libTestWebKitAPI.a -framework JavaScriptCore -framework WebCore -framework WebKit -lWebCoreTestSupport -framework Metal -framework IOSurface $(WK_APPSERVERSUPPORT_LDFLAGS) $(WK_AUTHKIT_LDFLAGS) -framework Network -framework UniformTypeIdentifiers -framework CoreFoundation -framework CoreServices -framework CFNetwork -framework CoreGraphics -framework CoreLocation -framework CoreText -framework IOKit -lboringssl -licucore -framework LocalAuthentication -framework QuartzCore -framework Security -framework AVKit $(WK_BROWSERENGINEKIT_LDFLAGS) $(WK_HID_LDFLAGS) $(WK_IMAGEIO_LDFLAGS) $(WK_OPENGL_LDFLAGS) $(WK_PDFKIT_LDFLAGS) $(WK_SYSTEM_LDFLAGS) $(WK_UIKITMACHELPER_LDFLAGS) $(WK_VISIONKITCORE_LDFLAGS) $(WK_WEBCORE_LDFLAGS) $(WK_REVEAL_LDFLAGS) $(WK_WRITING_TOOLS_LDFLAGS) $(WK_WRITING_TOOLS_UI_LDFLAGS) $(WK_GAMECONTROLLER_LDFLAGS) $(OTHER_LDFLAGS_DELAY_INIT) $(OTHER_LDFLAGS_PLATFORM_$(WK_COCOA_TOUCH)) $(OTHER_LDFLAGS_ENTITLEMENTS);
+// See ENABLE_WEB_RTC in FeatureDefines.xcconfig in WebCore and WebKit.
+WK_LIBWEBRTC_LDFLAGS = $(WK_LIBWEBRTC_LDFLAGS_$(WK_PLATFORM_NAME))
+WK_LIBWEBRTC_LDFLAGS_iphoneos = -weak-lwebrtc
+WK_LIBWEBRTC_LDFLAGS_iphonesimulator = -weak-lwebrtc
+WK_LIBWEBRTC_LDFLAGS_macosx = -weak-lwebrtc
+WK_LIBWEBRTC_LDFLAGS_xros = -weak-lwebrtc
+WK_LIBWEBRTC_LDFLAGS_xrsimulator = -weak-lwebrtc
+
+OTHER_LDFLAGS = $(inherited) $(GTEST_LDFLAGS) -lxml2 -force_load $(BUILT_PRODUCTS_DIR)/libTestWebKitAPI.a -framework JavaScriptCore -framework WebCore -framework WebKit -lWebCoreTestSupport -framework Metal -framework IOSurface $(WK_APPSERVERSUPPORT_LDFLAGS) $(WK_AUTHKIT_LDFLAGS) -framework Network -framework UniformTypeIdentifiers -framework CoreFoundation -framework CoreServices -framework CFNetwork -framework CoreGraphics -framework CoreLocation -framework CoreText -framework IOKit -lboringssl -licucore -framework LocalAuthentication -framework QuartzCore -framework Security -framework AVKit $(WK_BROWSERENGINEKIT_LDFLAGS) $(WK_HID_LDFLAGS) $(WK_IMAGEIO_LDFLAGS) $(WK_OPENGL_LDFLAGS) $(WK_PDFKIT_LDFLAGS) $(WK_SYSTEM_LDFLAGS) $(WK_UIKITMACHELPER_LDFLAGS) $(WK_VISIONKITCORE_LDFLAGS) $(WK_WEBCORE_LDFLAGS) $(WK_REVEAL_LDFLAGS) $(WK_WRITING_TOOLS_LDFLAGS) $(WK_WRITING_TOOLS_UI_LDFLAGS) $(WK_GAMECONTROLLER_LDFLAGS) $(WK_LIBWEBRTC_LDFLAGS) $(OTHER_LDFLAGS_DELAY_INIT) $(OTHER_LDFLAGS_PLATFORM_$(WK_COCOA_TOUCH)) $(OTHER_LDFLAGS_ENTITLEMENTS) -Xlinker --no-demangle;
 
 OTHER_LDFLAGS_DELAY_INIT[sdk=iphone*] = -Wl,-delay_framework,CoreTelephony;
 OTHER_LDFLAGS_DELAY_INIT[sdk=appletv*] = ;
diff --git a/Tools/TestWebKitAPI/Helpers/WTFCompletionHandler+Extras.swift b/Tools/TestWebKitAPI/Helpers/WTFCompletionHandler+Extras.swift
index 81b3d836feb6..35cae88f2cd5 100644
--- a/Tools/TestWebKitAPI/Helpers/WTFCompletionHandler+Extras.swift
+++ b/Tools/TestWebKitAPI/Helpers/WTFCompletionHandler+Extras.swift
@@ -156,7 +156,9 @@ extension CxxCompletionHandler where Self: ~Copyable {
 
     /// Creates a `WTF::CompletionHandler` type from a Swift closure.
     ///
-    /// - Parameter body: The Swift closure to use.
+    /// - Parameters:
+    ///   - isolation: The current isolation.
+    ///   - body: The Swift closure to use.
     @safe
     public init(isolation: isolated (any Actor)? = #isolation, _ body: @escaping (Argument) -> Void) {
         self.init(box: SwiftCopyingClosureBox(isolation: isolation, body))
diff --git a/Tools/TestWebKitAPI/Helpers/WTFExpected+Extras.swift b/Tools/TestWebKitAPI/Helpers/WTFExpected+Extras.swift
new file mode 100644
index 000000000000..5f6bf31fea36
--- /dev/null
+++ b/Tools/TestWebKitAPI/Helpers/WTFExpected+Extras.swift
@@ -0,0 +1,178 @@
+// Copyright (C) 2026 Apple Inc. All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions
+// are met:
+// 1. Redistributions of source code must retain the above copyright
+//    notice, this list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright
+//    notice, this list of conditions and the following disclaimer in the
+//    documentation and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+// THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+// PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+// BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+// SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+// INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+// CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+// ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+// THE POSSIBILITY OF SUCH DAMAGE.
+
+// FIXME: (rdar://164119356) Move this file into WTF.
+
+#if compiler(>=6.4) && !SWIFT_WEBKIT_TOOLCHAIN
+
+/// Represents an `unexpected` value of an `std::expected<T, E>`.
+public struct CxxUnexpected<Failure: Sendable>: Error {
+    /// The unexpected error.
+    public let error: Failure
+}
+
+/// The machinery shared by ``CxxExpected`` and ``CxxConsumingExpected``.
+///
+/// - Important: Do not conform to this directly. Conform to one of those two instead.
+public protocol CxxExpectedBase: ~Copyable {
+    /// The type of the expected value.
+    associatedtype Value: ~Copyable
+
+    /// The type of the unexpected value.
+    associatedtype Failure: Sendable
+
+    /// Checks whether the object contains an expected value.
+    /// - Returns: `true` if the object contains an expected value; `false` otherwise.
+    // swift-format-ignore: AlwaysUseLowerCamelCase
+    func has_value() -> Bool
+
+    /// Returns the expected value.
+    ///
+    /// - Note: Do not call or implement this yourself. It is unsafe to do so.
+    // swift-format-ignore: AlwaysUseLowerCamelCase,NoLeadingUnderscores
+    func __valueUnsafe() -> UnsafePointer<Value>
+
+    /// Returns the unexpected value.
+    ///
+    /// - Note: Do not call or implement this yourself. It is unsafe to do so.
+    // swift-format-ignore: AlwaysUseLowerCamelCase,NoLeadingUnderscores
+    func __errorUnsafe() -> UnsafePointer<Failure>
+}
+
+/// A protocol for concrete specializations of `std::expected<T, E>` to conform to when `T` is `Copyable`.
+///
+/// Conforming a specialization to this protocol allows Swift to safely access properties of the `expected`.
+/// For example, this makes it possible to use a type like
+///
+/// ```cpp
+/// using ExpectedResult = std::expected<int, ErrorCode>;
+/// ```
+///
+/// by creating this conformance:
+///
+/// ```swift
+/// extension ExpectedResult: CxxExpected {}
+/// ```
+///
+/// Swift can then use the `expected` naturally:
+///
+/// ```swift
+/// let expectedResult: ExpectedResult = ...
+/// let value = try expectedResult.value
+/// ```
+///
+public protocol CxxExpected: CxxExpectedBase where Value: Copyable {
+}
+
+extension CxxExpected {
+    /// Returns the expected value, or throws the unexpected error if one exists.
+    public var value: Value {
+        get throws(CxxUnexpected<Failure>) {
+            // Safety properties:
+            //
+            // Non-null, initialized, aligned: both point into `self`, which is a fully constructed
+            //     `std::expected`, so each is the address of a live object of the type it points to.
+            // Lifetime: `self` is borrowed for the whole of this getter, so neither pointer can dangle
+            //     here. Neither is stored; only the copy taken below escapes.
+            // Aliasing: `self` still owns what both point at, so this may only read them. `.pointee`
+            //     copies, running `Value`'s or `Failure`'s copy constructor, and leaves the `Expected`
+            //     intact and readable again.
+
+            guard has_value() else {
+                throw unsafe CxxUnexpected(error: __errorUnsafe().pointee)
+            }
+
+            return unsafe __valueUnsafe().pointee
+        }
+    }
+}
+
+/// A protocol for concrete specializations of `std::expected<T, E>` for noncopyable `T`s.
+///
+/// This is the same as ``CxxExpected`` except that it matches a C++ signature like:
+///
+/// ```cpp
+/// using ExpectedResult = std::expected<MoveOnlyThing, ErrorCode>;
+/// ```
+///
+/// Conformers to this protocol must explicitly implement the `__take(_:)` requirement like so:
+///
+/// ```swift
+/// extension ExpectedResult: CxxConsumingExpected {
+///     static func __take(_ expected: consuming Self) -> Value {
+///         takeValue(consuming: expected)
+///     }
+/// }
+/// ```
+///
+/// where `takeValue` is a C++ free function implemented exactly as
+///
+/// ```cpp
+/// inline ExpectedResult::value_type takeValue(ExpectedResult&& expected)
+/// {
+///     // Must be non-trivially destructible so that Swift runs the move constructor rather than
+///     // relocating the value byte-wise, which would leave a value holding a pointer into itself
+///     // dangling.
+///     static_assert(!std::is_trivially_destructible_v<ExpectedResult::value_type>);
+///     // Swift copies rather than consumes a copyable `Expected`, so the value would be moved out of
+///     // that copy and the caller's `Expected` left untouched.
+///     static_assert(!std::is_copy_constructible_v<ExpectedResult>);
+///     return WTF::move(*expected);
+/// }
+/// ```
+///
+/// Swift imports that rvalue reference parameter as `consuming`, and destroys the moved-from `expected` once the call
+/// returns.
+///
+/// - Important: Do not implement the protocol requirements yourself. It is unsafe if you do so.
+public protocol CxxConsumingExpected: CxxExpectedBase, ~Copyable {
+    /// Consumes the `expected`, moving its value out.
+    ///
+    /// - Parameter expected: The expected to take. It is guaranteed to have a value.
+    /// - Returns: The moved value of the expected.
+    /// - Note: Do not call this yourself.
+    // swift-format-ignore: AlwaysUseLowerCamelCase,NoLeadingUnderscores
+    static func __take(_ expected: consuming Self) -> Value
+}
+
+extension CxxConsumingExpected where Self: ~Copyable, Value: ~Copyable {
+    /// Returns the expected value, or throws the unexpected error if one exists.
+    ///
+    /// - Returns: The consumed value of the expected, if one exists.
+    /// - Throws: The unexpected error, if one exists.
+    public consuming func consume() throws(CxxUnexpected<Failure>) -> Value {
+        // Safety properties:
+        //
+        // As in `CxxExpected.value`, with one difference: `self` is consumed here rather than borrowed.
+        // `__errorUnsafe()` only borrows it, and `__take(_:)` is what finally takes it, so `self` is
+        // still live when the error is read out below.
+
+        guard has_value() else {
+            throw unsafe CxxUnexpected(error: __errorUnsafe().pointee)
+        }
+
+        return Self.__take(self)
+    }
+}
+
+#endif // compiler(>=6.4) && !SWIFT_WEBKIT_TOOLCHAIN
diff --git a/Tools/TestWebKitAPI/Helpers/mac/VirtualGamepad.mm b/Tools/TestWebKitAPI/Helpers/mac/VirtualGamepad.mm
index 61c795ebccaf..b526d4677cbf 100644
--- a/Tools/TestWebKitAPI/Helpers/mac/VirtualGamepad.mm
+++ b/Tools/TestWebKitAPI/Helpers/mac/VirtualGamepad.mm
@@ -43,7 +43,7 @@
 VirtualGamepad::VirtualGamepad(const GamepadMapping& gamepadMapping)
     : m_gamepadMapping(gamepadMapping)
 {
-    m_dispatchQueue = adoptOSObject(dispatch_queue_create(0, DISPATCH_QUEUE_SERIAL));
+    m_dispatchQueue = adoptOSObject(dispatch_queue_create(0, serialQueueWithAutoreleasePoolAttrSingleton()));
     m_uniqueID = NSUUID.UUID.UUIDString;
 
     m_buttonValues = Vector<float>(FillWith { }, m_gamepadMapping.buttonCount, 0.0);
diff --git a/Tools/TestWebKitAPI/PlatformCocoa.cmake b/Tools/TestWebKitAPI/PlatformCocoa.cmake
index c061c1922da1..b10f0fcf0797 100644
--- a/Tools/TestWebKitAPI/PlatformCocoa.cmake
+++ b/Tools/TestWebKitAPI/PlatformCocoa.cmake
@@ -190,6 +190,7 @@ list(APPEND TestWebKit_SOURCES
     Tests/WebCore/TestPlatformStrategies.cpp
 
     Tests/WebCore/cocoa/ISOBMFFTrackInfoParserTests.cpp
+    Tests/WebCore/cocoa/PlatformScreenTests.mm
 
     Tests/WebKit/WKWebView/WKBackForwardListTests.mm
 )
diff --git a/Tools/TestWebKitAPI/PlatformGTK.cmake b/Tools/TestWebKitAPI/PlatformGTK.cmake
index 37f2582433b1..1145f8ff74bd 100644
--- a/Tools/TestWebKitAPI/PlatformGTK.cmake
+++ b/Tools/TestWebKitAPI/PlatformGTK.cmake
@@ -41,6 +41,8 @@ list(APPEND TestJavaScriptCore_LIBRARIES
 
 # TestWebCore
 list(APPEND TestWebCore_SOURCES
+    Tests/WebCore/ImageDecoderTests.cpp
+
     Tests/WebCore/glib/Damage.cpp
     Tests/WebCore/glib/GraphicsContextGLTextureMapper.cpp
     Tests/WebCore/glib/RunLoopObserver.cpp
diff --git a/Tools/TestWebKitAPI/PlatformWPE.cmake b/Tools/TestWebKitAPI/PlatformWPE.cmake
index 80c7e2c4fcb8..e2d0fd716d4f 100644
--- a/Tools/TestWebKitAPI/PlatformWPE.cmake
+++ b/Tools/TestWebKitAPI/PlatformWPE.cmake
@@ -37,6 +37,8 @@ list(APPEND TestJavaScriptCore_SOURCES
 list(APPEND TestWebCore_SOURCES
     ${test_main_SOURCES}
 
+    Tests/WebCore/ImageDecoderTests.cpp
+
     Tests/WebCore/glib/Damage.cpp
     Tests/WebCore/glib/GraphicsContextGLTextureMapper.cpp
     Tests/WebCore/glib/RunLoopObserver.cpp
diff --git a/Tools/TestWebKitAPI/TestWTFLibrary/SwiftCxxInteropTestbed.cpp b/Tools/TestWebKitAPI/TestWTFLibrary/SwiftCxxInteropTestbed.cpp
index b17836642a34..c02587eb4d2a 100644
--- a/Tools/TestWebKitAPI/TestWTFLibrary/SwiftCxxInteropTestbed.cpp
+++ b/Tools/TestWebKitAPI/TestWTFLibrary/SwiftCxxInteropTestbed.cpp
@@ -119,6 +119,34 @@ void resetCopyCountingProbeCounts()
     copyCountingProbeCopies() = 0;
 }
 
+static int& liveCountingProbeErrors()
+{
+    static int count = 0;
+    return count;
+}
+
+CountingProbeError::CountingProbeError(ProbeError value)
+    : m_value(value)
+{
+    ++liveCountingProbeErrors();
+}
+
+CountingProbeError::CountingProbeError(const CountingProbeError& other)
+    : m_value(other.m_value)
+{
+    ++liveCountingProbeErrors();
+}
+
+CountingProbeError::~CountingProbeError()
+{
+    --liveCountingProbeErrors();
+}
+
+int liveCountingProbeErrorCount()
+{
+    return liveCountingProbeErrors();
+}
+
 int callIntBoolFunction(bool argument, IntBoolFunction&& function)
 {
     return function(argument);
@@ -261,6 +289,11 @@ int sharedProbeDerefCalls()
     return sharedProbeDerefs();
 }
 
+int sharedProbeRefCount()
+{
+    return sharedProbe().refCount();
+}
+
 void resetSharedProbe()
 {
     sharedProbeRefs() = 0;
@@ -293,4 +326,66 @@ void callSelfReferentialProbeCompletionHandler(int argument, SelfReferentialProb
     completionHandler(SelfReferentialProbe { argument });
 }
 
+IntExpected makeIntExpected(int value)
+{
+    return IntExpected { value };
+}
+
+IntExpected makeIntUnexpected(ProbeError error)
+{
+    return IntExpected { makeUnexpected(error) };
+}
+
+CopyCountingProbeExpected makeCopyCountingProbeExpected(int value)
+{
+    // In place, so that the probe the `Expected` holds is the only one this constructed: a test counting
+    // copies is measuring what Swift did, not what building the `Expected` did.
+    return CopyCountingProbeExpected { std::in_place, value };
+}
+
+CopyCountingProbeExpected makeCopyCountingProbeUnexpected(ProbeError error)
+{
+    return CopyCountingProbeExpected { makeUnexpected(error) };
+}
+
+SharedProbeHolderExpected makeSharedProbeHolderExpected()
+{
+    return SharedProbeHolderExpected { SharedProbeHolder { &sharedProbe() } };
+}
+
+SharedProbeHolderExpected makeSharedProbeHolderUnexpected(ProbeError error)
+{
+    return SharedProbeHolderExpected { makeUnexpected(error) };
+}
+
+MoveOnlyProbeExpected makeMoveOnlyProbeExpected(int value)
+{
+    return MoveOnlyProbeExpected { std::in_place, value };
+}
+
+MoveOnlyProbeExpected makeMoveOnlyProbeUnexpected(ProbeError error)
+{
+    return MoveOnlyProbeExpected { makeUnexpected(error) };
+}
+
+SelfReferentialProbeExpected makeSelfReferentialProbeExpected(int value)
+{
+    return SelfReferentialProbeExpected { std::in_place, value };
+}
+
+SelfReferentialProbeExpected makeSelfReferentialProbeUnexpected(ProbeError error)
+{
+    return SelfReferentialProbeExpected { makeUnexpected(error) };
+}
+
+CountedErrorExpected makeCountedErrorExpected(int value)
+{
+    return CountedErrorExpected { std::in_place, value };
+}
+
+CountedErrorExpected makeCountedErrorUnexpected(ProbeError error)
+{
+    return CountedErrorExpected { makeUnexpected(CountingProbeError { error }) };
+}
+
 };
diff --git a/Tools/TestWebKitAPI/TestWTFLibrary/SwiftCxxInteropTestbed.h b/Tools/TestWebKitAPI/TestWTFLibrary/SwiftCxxInteropTestbed.h
index edd6fdc0c64f..977575ad4582 100644
--- a/Tools/TestWebKitAPI/TestWTFLibrary/SwiftCxxInteropTestbed.h
+++ b/Tools/TestWebKitAPI/TestWTFLibrary/SwiftCxxInteropTestbed.h
@@ -28,6 +28,7 @@
 #ifdef __cplusplus
 
 #import <wtf/CompletionHandler.h>
+#import <wtf/Expected.h>
 #import <wtf/Function.h>
 #import <wtf/StdLibExtras.h>
 
@@ -106,6 +107,28 @@ class SelfReferentialProbe {
     int* m_self;
 };
 
+// The unexpected half of every `Expected` below. A scoped enum so that a test can tell one failure from
+// another, and numbered from one so that a zeroed-out read does not look like a valid error.
+enum class ProbeError : uint8_t {
+    TooSmall = 1,
+    TooLarge = 2,
+};
+
+// An error that counts its own lifetime. An `Expected` holding an error holds no value, so the value-side
+// counters cannot say anything about the failure path; this is what proves that path destroys the
+// `Expected` it consumed, exactly once, rather than leaking or double-destroying it.
+class SWIFT_UNCHECKED_SENDABLE CountingProbeError {
+public:
+    explicit CountingProbeError(ProbeError);
+    CountingProbeError(const CountingProbeError&);
+    ~CountingProbeError();
+
+    ProbeError value() const { return m_value; }
+
+private:
+    ProbeError m_value;
+};
+
 // MARK: Using declarations
 
 using IntBoolFunction = WTF::Function<int(bool)>;
@@ -118,6 +141,13 @@ using CopyCountingProbeCompletionHandler = WTF::CompletionHandler<void(CopyCount
 using SharedProbeHolderCompletionHandler = WTF::CompletionHandler<void(SharedProbeHolder)>;
 using SelfReferentialProbeCompletionHandler = WTF::CompletionHandler<void(SelfReferentialProbe&&)>;
 
+using IntExpected = Expected<int, ProbeError>;
+using CopyCountingProbeExpected = Expected<CopyCountingProbe, ProbeError>;
+using SharedProbeHolderExpected = Expected<SharedProbeHolder, ProbeError>;
+using MoveOnlyProbeExpected = Expected<MoveOnlyProbe, ProbeError>;
+using SelfReferentialProbeExpected = Expected<SelfReferentialProbe, ProbeError>;
+using CountedErrorExpected = Expected<MoveOnlyProbe, CountingProbeError>;
+
 // MARK: Function declarations
 
 int callIntBoolFunction(bool, IntBoolFunction&&);
@@ -158,10 +188,70 @@ int callSharedProbeHolderCompletionHandler(SharedProbeHolderCompletionHandler&&)
 // How many times the bridge caused a retain or a release. These must match.
 int sharedProbeRefCalls();
 int sharedProbeDerefCalls();
+
+// The shared probe's current reference count. One means nothing but the caller's own reference is left.
+int sharedProbeRefCount();
+
 void resetSharedProbe();
 
 void callSelfReferentialProbeCompletionHandler(int, SelfReferentialProbeCompletionHandler&&);
 
+// MARK: Expected
+
+IntExpected makeIntExpected(int);
+IntExpected makeIntUnexpected(ProbeError);
+
+// A copyable value has to be copied out of the `Expected`, so exactly one copy constructor call should be
+// observable per read.
+CopyCountingProbeExpected makeCopyCountingProbeExpected(int);
+CopyCountingProbeExpected makeCopyCountingProbeUnexpected(ProbeError);
+
+// Holds a borrowed reference to the shared probe, like callSharedProbeHolderCompletionHandler() passes.
+SharedProbeHolderExpected makeSharedProbeHolderExpected();
+SharedProbeHolderExpected makeSharedProbeHolderUnexpected(ProbeError);
+
+MoveOnlyProbeExpected makeMoveOnlyProbeExpected(int);
+MoveOnlyProbeExpected makeMoveOnlyProbeUnexpected(ProbeError);
+
+SelfReferentialProbeExpected makeSelfReferentialProbeExpected(int);
+SelfReferentialProbeExpected makeSelfReferentialProbeUnexpected(ProbeError);
+
+CountedErrorExpected makeCountedErrorExpected(int);
+CountedErrorExpected makeCountedErrorUnexpected(ProbeError);
+
+// Zero once every error the bridge constructed has been destroyed. See CountingProbeError.
+int liveCountingProbeErrorCount();
+
+// The `__take(_:)` witnesses for the `CxxConsumingExpected` conformances. Swift imports the rvalue
+// reference as the `consuming` the protocol hands over, and destroys the moved-from `Expected` once the
+// call returns.
+//
+// The three checks each of these repeats are what make a witness safe to write; none of them is
+// diagnosed at the call site. See CxxConsumingExpected's documentation.
+
+inline MoveOnlyProbeExpected::value_type takeMoveOnlyProbeValue(MoveOnlyProbeExpected&& expected)
+{
+    static_assert(!std::is_trivially_destructible_v<MoveOnlyProbeExpected::value_type>);
+    static_assert(!std::is_copy_constructible_v<MoveOnlyProbeExpected>);
+    return WTF::move(*expected);
+}
+
+inline SelfReferentialProbeExpected::value_type takeSelfReferentialProbeValue(SelfReferentialProbeExpected&& expected)
+{
+    // See takeMoveOnlyProbeValue().
+    static_assert(!std::is_trivially_destructible_v<SelfReferentialProbeExpected::value_type>);
+    static_assert(!std::is_copy_constructible_v<SelfReferentialProbeExpected>);
+    return WTF::move(*expected);
+}
+
+inline CountedErrorExpected::value_type takeCountedErrorValue(CountedErrorExpected&& expected)
+{
+    // See takeMoveOnlyProbeValue().
+    static_assert(!std::is_trivially_destructible_v<CountedErrorExpected::value_type>);
+    static_assert(!std::is_copy_constructible_v<CountedErrorExpected>);
+    return WTF::move(*expected);
+}
+
 }
 
 inline void refSharedProbe(SwiftCxxInteropTestbed::SharedProbe* WTF_NONNULL probe)
diff --git a/Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj b/Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj
index 41f2dff7e062..322ad5ff2263 100644
--- a/Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj
+++ b/Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj
@@ -652,6 +652,7 @@
 				mac/VirtualGamepad.mm,
 				mac/WebKitAgnosticTest.mm,
 				"WTFCompletionHandler+Extras.swift",
+				"WTFExpected+Extras.swift",
 			);
 			target = 7CCE7E8B1A41144E00447C4C /* TestWebKitAPILibrary */;
 		};
@@ -661,6 +662,7 @@
 				cocoa/UtilitiesCocoa.mm,
 				Counters.cpp,
 				"WTFCompletionHandler+Extras.swift",
+				"WTFExpected+Extras.swift",
 			);
 			target = 7C83DE951D0A590C00FEBCF3 /* TestWTFLibrary */;
 		};
@@ -736,6 +738,7 @@
 				WebCore/cocoa/ISOBMFFTrackInfoParserTests.cpp,
 				WebCore/cocoa/MediaPlayerPrivateAVFoundationObjCTests.mm,
 				WebCore/cocoa/MediaRecorderPrivateWriterTests.cpp,
+				WebCore/cocoa/PlatformScreenTests.mm,
 				WebCore/cocoa/PrivateClickMeasurementCocoa.mm,
 				WebCore/cocoa/ResourceMonitor.mm,
 				WebCore/cocoa/ScrollbarWidthCrash.mm,
@@ -817,10 +820,10 @@
 				WebCore/PublicSuffix.cpp,
 				WebCore/PushDatabase.cpp,
 				WebCore/PushMessageCrypto.cpp,
-				WebCore/QuirkMatch.cpp,
 				WebCore/Quirks.cpp,
 				WebCore/RegionTests.cpp,
 				WebCore/RegistrableDomain.cpp,
+				WebCore/URLMatch.cpp,
 				WebCore/WellKnownOriginList.cpp,
 				WebCore/RenderStyleChange.cpp,
 				WebCore/SampleMap.cpp,
diff --git a/Tools/TestWebKitAPI/Tests/WTF/cocoa/SwiftCxxInteropTests.swift b/Tools/TestWebKitAPI/Tests/WTF/cocoa/SwiftCxxInteropTests.swift
index 8f6173fd33e4..7471c9ddb52c 100644
--- a/Tools/TestWebKitAPI/Tests/WTF/cocoa/SwiftCxxInteropTests.swift
+++ b/Tools/TestWebKitAPI/Tests/WTF/cocoa/SwiftCxxInteropTests.swift
@@ -65,6 +65,42 @@ extension Cxx.SelfReferentialProbeCompletionHandler: @unsafe TestWTFLibrary.CxxC
     public typealias Argument = SwiftCxxInteropTestbed.SelfReferentialProbe
 }
 
+// The simplest `Expected` shape, and the one ``CxxExpected``'s documentation uses as its example.
+extension Cxx.IntExpected: TestWTFLibrary.CxxExpected {}
+
+// Copyable but not trivially copyable: reading this value out has to run its copy constructor.
+extension Cxx.CopyCountingProbeExpected: TestWTFLibrary.CxxExpected {}
+
+// Trivially copyable in C++, but Swift imports the `probe` field as a managed reference, so reading the
+// value has to leave the C++ side's ownership alone.
+extension Cxx.SharedProbeHolderExpected: TestWTFLibrary.CxxExpected {}
+
+// `MoveOnlyProbe` is move-only in C++, so the `Expected` holding one is noncopyable too and its value can
+// only be moved out, which is what `CxxConsumingExpected` is for.
+extension Cxx.MoveOnlyProbeExpected: TestWTFLibrary.CxxConsumingExpected {
+    // swift-format-ignore: AllPublicDeclarationsHaveDocumentation, AlwaysUseLowerCamelCase, NoLeadingUnderscores
+    public static func __take(_ expected: consuming Self) -> Value {
+        Cxx.takeMoveOnlyProbeValue(consuming: expected)
+    }
+}
+
+// Noncopyable, and notices if the value is relocated byte-wise on its way out.
+extension Cxx.SelfReferentialProbeExpected: @unsafe TestWTFLibrary.CxxConsumingExpected {
+    // swift-format-ignore: AllPublicDeclarationsHaveDocumentation, AlwaysUseLowerCamelCase, NoLeadingUnderscores
+    public static func __take(_ expected: consuming Self) -> Value {
+        unsafe Cxx.takeSelfReferentialProbeValue(consuming: expected)
+    }
+}
+
+// An error that counts its own lifetime, so that the failure path -- which holds no value, and so moves
+// none of the counters above -- can be checked at all.
+extension Cxx.CountedErrorExpected: TestWTFLibrary.CxxConsumingExpected {
+    // swift-format-ignore: AllPublicDeclarationsHaveDocumentation, AlwaysUseLowerCamelCase, NoLeadingUnderscores
+    public static func __take(_ expected: consuming Self) -> Value {
+        Cxx.takeCountedErrorValue(consuming: expected)
+    }
+}
+
 // MARK: - Helpers
 
 /// Observed via a weak reference to prove the closure context was released.
@@ -305,6 +341,255 @@ struct SwiftCxxInteropTests {
             "a noncopyable argument must be relocated with its move constructor, not by copying its bytes"
         )
     }
+
+    // MARK: Expected
+
+    @Test
+    func expectedExposesItsValue() async throws {
+        let value = try Cxx.makeIntExpected(3).value
+
+        #expect(value == 3)
+    }
+
+    @Test
+    func unexpectedThrowsItsError() async throws {
+        let unexpected = Cxx.makeIntUnexpected(.TooLarge)
+
+        #expect(!unexpected.has_value())
+
+        let thrown = try #require(throws: CxxUnexpected<Cxx.ProbeError>.self) {
+            _ = try unexpected.value
+        }
+        #expect(thrown.error == .TooLarge)
+    }
+
+    @Test
+    func readingTheValueLeavesTheExpectedAlone() async throws {
+        let expected = Cxx.makeIntExpected(7)
+
+        // `value` borrows rather than takes, so nothing here should be a one-shot read.
+        let first = try expected.value
+        let second = try expected.value
+
+        #expect(first == 7)
+        #expect(second == 7)
+        #expect(expected.has_value())
+    }
+
+    @Test
+    func readingAnUnexpectedLeavesTheErrorInPlace() async throws {
+        let unexpected = Cxx.makeIntUnexpected(.TooSmall)
+
+        // See readingTheValueLeavesTheExpectedAlone(): the failure path has to be repeatable too.
+        for _ in 0..<2 {
+            let thrown = try #require(throws: CxxUnexpected<Cxx.ProbeError>.self) {
+                _ = try unexpected.value
+            }
+            #expect(thrown.error == .TooSmall)
+        }
+    }
+
+    // MARK: Copyable, non-trivially-copyable values
+
+    @Test
+    func readingACopyableValueCopiesItExactlyOnce() async throws {
+        Cxx.resetCopyCountingProbeCounts()
+
+        // Sampled rather than assumed to be zero. There is no way to reset a count of live objects, so a
+        // probe stranded by an earlier test would otherwise fail this one and point the reader here
+        // rather than at the leak.
+        let baseline = Cxx.liveCopyCountingProbeCount()
+
+        do {
+            let expected = Cxx.makeCopyCountingProbeExpected(11)
+            let probe = try expected.value
+
+            // Sampled before the last use of either probe below, so neither can have been released early
+            // by the time these are read.
+            let copies = Cxx.copyCountingProbeCopyCount()
+            let live = Cxx.liveCopyCountingProbeCount() - baseline
+
+            #expect(probe.value() == 11, "Swift should see the value C++ stored")
+            #expect(expected.has_value(), "reading the value should not have emptied the expected")
+            #expect(copies == 1, "exactly one copy should be made for Swift")
+            #expect(live == 2, "the expected should still hold its own probe")
+        }
+
+        #expect(Cxx.liveCopyCountingProbeCount() == baseline, "every probe should be destroyed")
+    }
+
+    @Test
+    func theValueOutlivesTheExpectedItWasReadFrom() async throws {
+        Cxx.resetCopyCountingProbeCounts()
+
+        // See readingACopyableValueCopiesItExactlyOnce().
+        let baseline = Cxx.liveCopyCountingProbeCount()
+
+        let probe: Cxx.CopyCountingProbe
+        do {
+            let expected = Cxx.makeCopyCountingProbeExpected(12)
+            probe = try expected.value
+        }
+
+        let live = Cxx.liveCopyCountingProbeCount() - baseline
+
+        // The expected -- and the probe it held -- are gone, so a `value` that handed Swift a pointer into
+        // the expected rather than a copy would be reading freed storage here.
+        #expect(probe.value() == 12)
+        #expect(live == 1, "only Swift's copy should still be alive")
+    }
+
+    @Test
+    func readingAnUnexpectedNeverTouchesTheValue() async throws {
+        Cxx.resetCopyCountingProbeCounts()
+
+        // See readingACopyableValueCopiesItExactlyOnce().
+        let baseline = Cxx.liveCopyCountingProbeCount()
+
+        do {
+            let unexpected = Cxx.makeCopyCountingProbeUnexpected(.TooSmall)
+
+            let thrown = try #require(throws: CxxUnexpected<Cxx.ProbeError>.self) {
+                _ = try unexpected.value
+            }
+
+            #expect(thrown.error == .TooSmall)
+            #expect(Cxx.copyCountingProbeCopyCount() == 0, "an expected holding an error has no value to copy")
+        }
+
+        #expect(Cxx.liveCopyCountingProbeCount() == baseline, "every probe should be destroyed")
+    }
+
+    // MARK: Values holding a managed reference
+
+    @Test
+    func valueHoldingAManagedReferenceLeavesTheCallersCountAlone() async throws {
+        Cxx.resetSharedProbe()
+
+        do {
+            let holder = try Cxx.makeSharedProbeHolderExpected().value
+
+            // See readingACopyableValueCopiesItExactlyOnce(): sampled before the last use of `holder`, so
+            // its reference is certainly still held here.
+            let countWhileHeld = Cxx.sharedProbeRefCount()
+            withExtendedLifetime(holder) {}
+
+            #expect(countWhileHeld == 2, "Swift's copy of the value should hold a reference of its own")
+        }
+
+        #expect(
+            Cxx.sharedProbeRefCalls() == Cxx.sharedProbeDerefCalls(),
+            "reading the value must balance every retain and release it causes"
+        )
+        #expect(Cxx.sharedProbeRefCount() == 1, "the C++ side's own reference must survive the read")
+    }
+
+    @Test
+    func readingAnUnexpectedNeverRetainsTheManagedReference() async throws {
+        Cxx.resetSharedProbe()
+
+        do {
+            let unexpected = Cxx.makeSharedProbeHolderUnexpected(.TooSmall)
+
+            let thrown = try #require(throws: CxxUnexpected<Cxx.ProbeError>.self) {
+                _ = try unexpected.value
+            }
+
+            // A bridge that loaded the value union before checking has_value() would have retained the
+            // shared probe by now.
+            #expect(thrown.error == .TooSmall)
+            #expect(Cxx.sharedProbeRefCount() == 1, "an expected holding an error has no value to retain")
+        }
+
+        #expect(
+            Cxx.sharedProbeRefCalls() == Cxx.sharedProbeDerefCalls(),
+            "reading the error must balance every retain and release it causes"
+        )
+        #expect(Cxx.sharedProbeRefCount() == 1, "the C++ side's own reference must survive the read")
+    }
+
+    // MARK: Noncopyable values
+
+    @Test
+    func noncopyableValueCanBeConsumed() async throws {
+        // See readingACopyableValueCopiesItExactlyOnce().
+        let baseline = Cxx.liveMoveOnlyProbeCount()
+
+        do {
+            let probe = try Cxx.makeMoveOnlyProbeExpected(5).consume()
+
+            let live = Cxx.liveMoveOnlyProbeCount() - baseline
+
+            // A moved-from probe reports -1, so this also proves Swift was handed the destination of the
+            // move rather than its source.
+            #expect(probe.value() == 5)
+            #expect(live == 1, "only the consumed value should still be alive")
+        }
+
+        #expect(
+            Cxx.liveMoveOnlyProbeCount() == baseline,
+            "the consumed value should be destroyed exactly once"
+        )
+    }
+
+    @Test
+    func consumingAnUnexpectedThrowsItsError() async throws {
+        let thrown = try #require(throws: CxxUnexpected<Cxx.ProbeError>.self) {
+            _ = try Cxx.makeMoveOnlyProbeUnexpected(.TooLarge).consume()
+        }
+
+        #expect(thrown.error == .TooLarge)
+    }
+
+    @Test
+    func consumingAnUnsafeUnexpectedThrowsItsError() async throws {
+        // consumingAnUnexpectedThrowsItsError() covers the failure path for a value Swift imports as
+        // safe; this covers it for one Swift imports as `@unsafe`.
+        let thrown = try #require(throws: CxxUnexpected<Cxx.ProbeError>.self) {
+            _ = try unsafe Cxx.makeSelfReferentialProbeUnexpected(.TooSmall).consume()
+        }
+
+        #expect(thrown.error == .TooSmall)
+    }
+
+    @Test
+    func consumingAnUnexpectedDestroysTheExpectedItConsumed() async throws {
+        // An expected holding an error holds no value, so none of the value-side counters can see what
+        // the failure path did with the expected it was handed. An error that counts its own lifetime
+        // can: this is what proves `consume()` neither leaks nor double-destroys on the way out.
+        let baseline = Cxx.liveCountingProbeErrorCount()
+
+        do {
+            let thrown = try #require(throws: CxxUnexpected<Cxx.CountingProbeError>.self) {
+                _ = try Cxx.makeCountedErrorUnexpected(.TooLarge).consume()
+            }
+
+            #expect(thrown.error.value() == .TooLarge)
+        }
+
+        #expect(
+            Cxx.liveCountingProbeErrorCount() == baseline,
+            "the failure path should destroy the expected it consumed, exactly once"
+        )
+    }
+
+    @Test
+    func consumedNoncopyableValueIsRelocatedWithItsMoveConstructor() async throws {
+        // The same property noncopyableArgumentIsRelocatedWithItsMoveConstructor() pins, on the way out of
+        // an expected rather than into a completion handler: taking the value has to run the C++ move
+        // constructor, or the probe's pointer into itself is left aimed at storage C++ has abandoned.
+        // takeSelfReferentialProbeValue()'s static assertion is what makes Swift do that.
+        let probe = try unsafe Cxx.makeSelfReferentialProbeExpected(7).consume()
+
+        let interiorPointerIsValid = unsafe probe.interiorPointerIsValid()
+        let valueThroughInteriorPointer = unsafe probe.valueThroughInteriorPointer()
+
+        #expect(
+            interiorPointerIsValid,
+            "a noncopyable value must be relocated with its move constructor, not by copying its bytes"
+        )
+        #expect(valueThroughInteriorPointer == 7)
+    }
 }
 
 #endif // ENABLE_CXX_INTEROP && compiler(>=6.4) && !SWIFT_WEBKIT_TOOLCHAIN
diff --git a/Tools/TestWebKitAPI/Tests/WTF/darwin/OSObjectPtr.cpp b/Tools/TestWebKitAPI/Tests/WTF/darwin/OSObjectPtr.cpp
index 31da0a68a64c..38978a727b6b 100644
--- a/Tools/TestWebKitAPI/Tests/WTF/darwin/OSObjectPtr.cpp
+++ b/Tools/TestWebKitAPI/Tests/WTF/darwin/OSObjectPtr.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 
 #include <CoreFoundation/CoreFoundation.h>
+#include <wtf/darwin/DispatchExtras.h>
 #include <wtf/darwin/DispatchOSObject.h>
 
 #if __has_feature(objc_arc) && !defined(NDEBUG)
@@ -45,7 +46,7 @@ namespace TestWebKitAPI {
 
 TEST(OS_OBJECT_PTR_TEST_NAME, AdoptOSObject)
 {
-    OSObjectPtr<dispatch_queue_t> foo = adoptOSObject(dispatch_queue_create(0, DISPATCH_QUEUE_SERIAL));
+    OSObjectPtr<dispatch_queue_t> foo = adoptOSObject(dispatch_queue_create(0, serialQueueWithAutoreleasePoolAttrSingleton()));
     uintptr_t fooPtr;
     AUTORELEASEPOOL_FOR_ARC_DEBUG {
         fooPtr = reinterpret_cast<uintptr_t>(foo.get());
@@ -55,7 +56,7 @@ TEST(OS_OBJECT_PTR_TEST_NAME, AdoptOSObject)
 
 TEST(OS_OBJECT_PTR_TEST_NAME, RetainRelease)
 {
-    dispatch_queue_t foo = dispatch_queue_create(0, DISPATCH_QUEUE_SERIAL);
+    dispatch_queue_t foo = dispatch_queue_create(0, serialQueueWithAutoreleasePoolAttrSingleton());
     auto fooPtr = reinterpret_cast<uintptr_t>(foo);
     EXPECT_EQ(1, CFGetRetainCount((CFTypeRef)fooPtr));
 
@@ -74,7 +75,7 @@ TEST(OS_OBJECT_PTR_TEST_NAME, RetainRelease)
 
 TEST(OS_OBJECT_PTR_TEST_NAME, LeakRef)
 {
-    OSObjectPtr<dispatch_queue_t> foo = adoptOSObject(dispatch_queue_create(0, DISPATCH_QUEUE_SERIAL));
+    OSObjectPtr<dispatch_queue_t> foo = adoptOSObject(dispatch_queue_create(0, serialQueueWithAutoreleasePoolAttrSingleton()));
     uintptr_t fooPtr;
     AUTORELEASEPOOL_FOR_ARC_DEBUG {
         fooPtr = reinterpret_cast<uintptr_t>(foo.get());
diff --git a/Tools/TestWebKitAPI/Tests/WebCore/IPAddressSpaceTests.cpp b/Tools/TestWebKitAPI/Tests/WebCore/IPAddressSpaceTests.cpp
index ca0bf3375ea1..4e8ce8718b83 100644
--- a/Tools/TestWebKitAPI/Tests/WebCore/IPAddressSpaceTests.cpp
+++ b/Tools/TestWebKitAPI/Tests/WebCore/IPAddressSpaceTests.cpp
@@ -29,7 +29,11 @@
 #include <WebCore/IPAddressSpace.h>
 #include <WebCore/ResourceResponse.h>
 #include <WebCore/Site.h>
+#include <WebCore/WebCorePersistentCoders.h>
 #include <wtf/URL.h>
+#include <wtf/persistence/PersistentCoders.h>
+#include <wtf/persistence/PersistentDecoder.h>
+#include <wtf/persistence/PersistentEncoder.h>
 
 namespace TestWebKitAPI {
 
@@ -459,4 +463,43 @@ TEST(IPAddressSpace, DoesNotOvermatchReservedNames)
     EXPECT_EQ(WebCore::determineIPAddressSpace(URL("https://local.example.com/"_s)), WebCore::IPAddressSpace::Public);
 }
 
+// Both persistence coders are covered: ResourceResponseData is what the network cache stores, and
+// ResourceResponse is what other persistent callers encode.
+TEST(IPAddressSpace, SurvivesResponseDataPersistenceRoundTrip)
+{
+    for (auto space : { WebCore::IPAddressSpace::Public, WebCore::IPAddressSpace::Local, WebCore::IPAddressSpace::Loopback, WebCore::IPAddressSpace::Unknown }) {
+        WebCore::ResourceResponse response { URL { "http://192.168.1.1/"_s }, "text/plain"_s, 5, "UTF-8"_s };
+        response.setIPAddressSpace(space);
+
+        auto data = response.getResponseData();
+        ASSERT_TRUE(data.has_value());
+
+        WTF::Persistence::Encoder encoder;
+        WTF::Persistence::Coder<WebCore::ResourceResponseData>::encodeForPersistence(encoder, *data);
+
+        WTF::Persistence::Decoder decoder(encoder.span());
+        auto decoded = WTF::Persistence::Coder<WebCore::ResourceResponseData>::decodeForPersistence(decoder);
+        ASSERT_TRUE(decoded.has_value());
+
+        EXPECT_EQ(decoded->ipAddressSpace, space);
+    }
+}
+
+TEST(IPAddressSpace, SurvivesResourceResponsePersistenceRoundTrip)
+{
+    for (auto space : { WebCore::IPAddressSpace::Public, WebCore::IPAddressSpace::Local, WebCore::IPAddressSpace::Loopback, WebCore::IPAddressSpace::Unknown }) {
+        WebCore::ResourceResponse response { URL { "http://192.168.1.1/"_s }, "text/plain"_s, 5, "UTF-8"_s };
+        response.setIPAddressSpace(space);
+
+        WTF::Persistence::Encoder encoder;
+        WTF::Persistence::Coder<WebCore::ResourceResponse>::encodeForPersistence(encoder, response);
+
+        WTF::Persistence::Decoder decoder(encoder.span());
+        auto decoded = WTF::Persistence::Coder<WebCore::ResourceResponse>::decodeForPersistence(decoder);
+        ASSERT_TRUE(decoded.has_value());
+
+        EXPECT_EQ(decoded->ipAddressSpace(), space);
+    }
+}
+
 }
diff --git a/Tools/TestWebKitAPI/Tests/WebCore/ImageDecoderTests.cpp b/Tools/TestWebKitAPI/Tests/WebCore/ImageDecoderTests.cpp
new file mode 100644
index 000000000000..c0e40a9f2b5b
--- /dev/null
+++ b/Tools/TestWebKitAPI/Tests/WebCore/ImageDecoderTests.cpp
@@ -0,0 +1,726 @@
+/*
+ * Copyright (C) 2026 Igalia S.L.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "Helpers/Test.h"
+#include <WebCore/ImageDecoder.h>
+#include <WebCore/IntSize.h>
+#include <WebCore/SharedBuffer.h>
+#include <wtf/Vector.h>
+
+// These drive ImageDecoder directly. Going through BitmapImageSource instead would hide most of
+// this: it stops asking a decoder for frames as soon as the decoder reports an error, so the code
+// paths that run after a malformed chunk is rejected are unreachable from a layout test.
+
+namespace TestWebKitAPI {
+
+using namespace WebCore;
+
+static void append32(Vector<uint8_t>& data, uint32_t value)
+{
+    data.append(value >> 24);
+    data.append((value >> 16) & 0xff);
+    data.append((value >> 8) & 0xff);
+    data.append(value & 0xff);
+}
+
+static uint32_t crc32For(std::span<const uint8_t> data)
+{
+    // PNG uses the standard CRC-32; computing it here keeps the fixtures self-contained.
+    uint32_t crc = 0xffffffff;
+    for (auto byte : data) {
+        crc ^= byte;
+        for (int bit = 0; bit < 8; ++bit)
+            crc = (crc >> 1) ^ (0xedb88320 & (~(crc & 1) + 1));
+    }
+    return crc ^ 0xffffffff;
+}
+
+static void appendChunk(Vector<uint8_t>& data, const char (&tag)[5], std::span<const uint8_t> payload)
+{
+    append32(data, payload.size());
+    Vector<uint8_t> tagged;
+    for (int i = 0; i < 4; ++i)
+        tagged.append(static_cast<uint8_t>(tag[i]));
+    tagged.append(payload);
+    data.append(tagged.span());
+    append32(data, crc32For(tagged.span()));
+}
+
+// Filtered scanlines for a 4x4 opaque red image: a leading filter byte per row, then RGB triples.
+static Vector<uint8_t> redScanlines()
+{
+    Vector<uint8_t> raw;
+    for (int y = 0; y < 4; ++y) {
+        raw.append(0);
+        for (int x = 0; x < 4; ++x)
+            raw.appendList({ 0xff, 0x00, 0x00 });
+    }
+    return raw;
+}
+
+// A stored (uncompressed) zlib stream wrapping |raw|.
+static Vector<uint8_t> storedZlibStream(std::span<const uint8_t> raw)
+{
+    Vector<uint8_t> stream { 0x78, 0x01, 0x01 };
+    stream.append(raw.size() & 0xff);
+    stream.append((raw.size() >> 8) & 0xff);
+    stream.append(~raw.size() & 0xff);
+    stream.append((~raw.size() >> 8) & 0xff);
+    stream.append(raw);
+    uint32_t s1 = 1, s2 = 0;
+    for (auto byte : raw) {
+        s1 = (s1 + byte) % 65521;
+        s2 = (s2 + s1) % 65521;
+    }
+    append32(stream, (s2 << 16) | s1);
+    return stream;
+}
+
+// A 4x4 opaque red PNG, optionally carrying an acTL that declares |frameCount| frames but no
+// per-frame (fcTL/fdAT) data. Used to exercise header handling, not real animation decoding.
+static Ref<SharedBuffer> makeAnimatedPNG(uint32_t frameCount)
+{
+    Vector<uint8_t> data { 0x89, 'P', 'N', 'G', '\r', '\n', 0x1a, '\n' };
+
+    Vector<uint8_t> ihdr;
+    append32(ihdr, 4);
+    append32(ihdr, 4);
+    ihdr.appendList({ 8, 2, 0, 0, 0 });
+    appendChunk(data, "IHDR", ihdr.span());
+
+    Vector<uint8_t> actl;
+    append32(actl, frameCount);
+    append32(actl, 0);
+    appendChunk(data, "acTL", actl.span());
+
+    appendChunk(data, "IDAT", storedZlibStream(redScanlines().span()).span());
+
+    appendChunk(data, "IEND", { });
+    return SharedBuffer::create(WTF::move(data));
+}
+
+// A genuine two-frame 4x4 APNG. The second frame does not dispose the first, so decoding it reads
+// the first frame's backing store; if the first frame has been evicted from the cache, that read
+// is against a null backing store. See PNGImageDecoder::initFrameBuffer() and frameComplete().
+static Ref<SharedBuffer> makeTwoFrameAPNG()
+{
+    Vector<uint8_t> data { 0x89, 'P', 'N', 'G', '\r', '\n', 0x1a, '\n' };
+
+    Vector<uint8_t> ihdr;
+    append32(ihdr, 4);
+    append32(ihdr, 4);
+    ihdr.appendList({ 8, 2, 0, 0, 0 });
+    appendChunk(data, "IHDR", ihdr.span());
+
+    Vector<uint8_t> actl;
+    append32(actl, 2); // num_frames
+    append32(actl, 0); // num_plays (infinite)
+    appendChunk(data, "acTL", actl.span());
+
+    auto appendFrameControl = [&](uint32_t sequenceNumber) {
+        Vector<uint8_t> fctl;
+        append32(fctl, sequenceNumber);
+        append32(fctl, 4); // width
+        append32(fctl, 4); // height
+        append32(fctl, 0); // x_offset
+        append32(fctl, 0); // y_offset
+        fctl.appendList({ 0, 1 }); // delay_num = 1
+        fctl.appendList({ 0, 10 }); // delay_den = 10
+        fctl.append(0); // dispose_op = APNG_DISPOSE_OP_NONE
+        fctl.append(0); // blend_op = APNG_BLEND_OP_SOURCE
+        appendChunk(data, "fcTL", fctl.span());
+    };
+
+    auto zlib = storedZlibStream(redScanlines().span());
+
+    // Frame 0: fcTL then IDAT (the default image is also the first animation frame). fcTL and fdAT
+    // share one sequence counter that must have no gaps; IDAT is not numbered.
+    appendFrameControl(0);
+    appendChunk(data, "IDAT", zlib.span());
+
+    // Frame 1: fcTL then fdAT (sequence number, then the same zlib stream as an IDAT payload).
+    appendFrameControl(1);
+    Vector<uint8_t> fdat;
+    append32(fdat, 2); // sequence number
+    fdat.append(zlib.span());
+    appendChunk(data, "fdAT", fdat.span());
+
+    appendChunk(data, "IEND", { });
+    return SharedBuffer::create(WTF::move(data));
+}
+
+static RefPtr<ImageDecoder> createDecoder(SharedBuffer& buffer, bool allDataReceived = true)
+{
+    RefPtr decoder = ImageDecoder::create(buffer, "image/png"_s, AlphaOption::Premultiplied, GammaAndColorProfileOption::Applied);
+    if (decoder)
+        decoder->setData(buffer, allDataReceived);
+    return decoder;
+}
+
+static Ref<SharedBuffer> makeSubRectAPNG(size_t frameCount)
+{
+    Vector<uint8_t> data { 0x89, 'P', 'N', 'G', '\r', '\n', 0x1a, '\n' };
+
+    Vector<uint8_t> ihdr;
+    append32(ihdr, 4);
+    append32(ihdr, 4);
+    ihdr.appendList({ 8, 2, 0, 0, 0 });
+    appendChunk(data, "IHDR", ihdr.span());
+
+    Vector<uint8_t> actl;
+    append32(actl, frameCount);
+    append32(actl, 0);
+    appendChunk(data, "acTL", actl.span());
+
+    // Filtered scanlines for an opaque red block of |width| x |height|.
+    auto scanlines = [](uint32_t width, uint32_t height) {
+        Vector<uint8_t> raw;
+        for (uint32_t y = 0; y < height; ++y) {
+            raw.append(0);
+            for (uint32_t x = 0; x < width; ++x)
+                raw.appendList({ 0xff, 0x00, 0x00 });
+        }
+        return raw;
+    };
+
+    uint32_t sequence = 0;
+    auto appendFrameControl = [&](uint32_t width, uint32_t height, uint32_t x, uint32_t y, uint8_t disposeOp) {
+        Vector<uint8_t> fctl;
+        append32(fctl, sequence++);
+        append32(fctl, width);
+        append32(fctl, height);
+        append32(fctl, x);
+        append32(fctl, y);
+        fctl.appendList({ 0, 1 });
+        fctl.appendList({ 0, 10 });
+        fctl.append(disposeOp);
+        fctl.append(0); // blend_op = APNG_BLEND_OP_SOURCE
+        appendChunk(data, "fcTL", fctl.span());
+    };
+
+    // Frame 0 covers the canvas, so its own opacity is decided without consulting any earlier frame.
+    appendFrameControl(4, 4, 0, 0, 0);
+    appendChunk(data, "IDAT", storedZlibStream(scanlines(4, 4).span()).span());
+
+    // A sub-rectangle makes frameComplete() consult the previous frame rather than settle its
+    // opacity from the frame rect, and APNG_DISPOSE_OP_PREVIOUS makes the frame evictable.
+    auto zlib = storedZlibStream(scanlines(2, 2).span());
+    for (size_t frame = 1; frame < frameCount; ++frame) {
+        appendFrameControl(2, 2, 1, 1, 2);
+        Vector<uint8_t> fdat;
+        append32(fdat, sequence++);
+        fdat.append(zlib.span());
+        appendChunk(data, "fdAT", fdat.span());
+    }
+
+    appendChunk(data, "IEND", { });
+    return SharedBuffer::create(WTF::move(data));
+}
+
+// A frame count that PNGImageDecoder rejects must not reach frameCount(), because callers size
+// per-frame containers from it. See PNGImageDecoder::readChunks().
+TEST(ImageDecoder, APNGRejectedFrameCountIsNotReported)
+{
+    // Well over cMaxFrameCount, and large enough that a caller sizing an array from it would ask
+    // for hundreds of gigabytes.
+    auto buffer = makeAnimatedPNG(0xffffff00);
+    RefPtr decoder = createDecoder(buffer.get());
+    ASSERT_TRUE(decoder);
+
+    EXPECT_TRUE(decoder->isSizeAvailable());
+    EXPECT_EQ(1u, decoder->frameCount());
+}
+
+// A zero frame count is not an animation, so the default image must still decode.
+TEST(ImageDecoder, APNGZeroFrameCountStillDecodesDefaultImage)
+{
+    auto buffer = makeAnimatedPNG(0);
+    RefPtr decoder = createDecoder(buffer.get());
+    ASSERT_TRUE(decoder);
+
+    EXPECT_EQ(1u, decoder->frameCount());
+    EXPECT_EQ(4, decoder->size().width());
+    EXPECT_EQ(4, decoder->size().height());
+    EXPECT_TRUE(!!decoder->createFrameImageAtIndex(0));
+}
+
+// A well-formed acTL is still honoured, and both frames of a real APNG decode.
+TEST(ImageDecoder, APNGValidFrameCountIsReported)
+{
+    auto buffer = makeTwoFrameAPNG();
+    RefPtr decoder = createDecoder(buffer.get());
+    ASSERT_TRUE(decoder);
+
+    EXPECT_EQ(2u, decoder->frameCount());
+    EXPECT_TRUE(!!decoder->createFrameImageAtIndex(0));
+    EXPECT_TRUE(!!decoder->createFrameImageAtIndex(1));
+}
+
+// Dropping decoded frames must not leave a later frame reading a cleared frame's backing store.
+// See the null checks in GIFImageDecoder/PNGImageDecoder initFrameBuffer() and frameComplete().
+TEST(ImageDecoder, ClearFrameBufferCacheThenDecodeAgain)
+{
+    // Four frames, because clearDecodedPixelDataIfNeeded() clears neither the first frame nor the
+    // last, so two frames leaves it nothing to evict. RestoreToPrevious is what it evicts.
+    auto buffer = makeSubRectAPNG(4);
+    RefPtr decoder = createDecoder(buffer.get());
+    ASSERT_TRUE(decoder);
+    ASSERT_EQ(4u, decoder->frameCount());
+
+    for (size_t index = 0; index < decoder->frameCount(); ++index)
+        decoder->createFrameImageAtIndex(index);
+
+    decoder->clearFrameBufferCache(decoder->frameCount());
+    ASSERT_FALSE(decoder->frameIsCompleteAtIndex(1));
+    ASSERT_FALSE(decoder->frameIsCompleteAtIndex(2));
+
+    for (size_t index = 0; index < decoder->frameCount(); ++index)
+        decoder->createFrameImageAtIndex(index);
+
+    for (size_t index = 0; index < decoder->frameCount(); ++index)
+        ASSERT_TRUE(decoder->frameIsCompleteAtIndex(index));
+}
+
+// Asking for a frame past the end must be answered, not indexed blindly.
+TEST(ImageDecoder, FrameIndexPastEndIsHandled)
+{
+    auto buffer = makeAnimatedPNG(2);
+    RefPtr decoder = createDecoder(buffer.get());
+    ASSERT_TRUE(decoder);
+
+    decoder->createFrameImageAtIndex(decoder->frameCount() + 1000);
+}
+
+// Data arriving in pieces must not let a frame be requested against a cache that was never sized.
+TEST(ImageDecoder, PartialDataThenFullData)
+{
+    auto full = makeAnimatedPNG(2);
+    auto partial = SharedBuffer::create(full->span().first(full->size() / 2));
+
+    RefPtr decoder = ImageDecoder::create(partial.get(), "image/png"_s, AlphaOption::Premultiplied, GammaAndColorProfileOption::Applied);
+    ASSERT_TRUE(decoder);
+
+    decoder->setData(partial.get(), false);
+    decoder->createFrameImageAtIndex(0);
+
+    decoder->setData(full.get(), true);
+    decoder->createFrameImageAtIndex(0);
+}
+
+// An ICO whose sub-image is a PNG, used to exercise the point where only part of the embedded PNG
+// has arrived.
+static Ref<SharedBuffer> makeICOWithPNGSubImage()
+{
+    auto png = makeAnimatedPNG(1);
+    auto pngSpan = png->span();
+
+    Vector<uint8_t> data;
+    auto append16 = [&](uint16_t value) {
+        data.append(value & 0xff);
+        data.append(value >> 8);
+    };
+    auto append32LE = [&](uint32_t value) {
+        data.append(value & 0xff);
+        data.append((value >> 8) & 0xff);
+        data.append((value >> 16) & 0xff);
+        data.append(value >> 24);
+    };
+
+    append16(0); // reserved
+    append16(1); // type: icon
+    append16(1); // one directory entry
+    data.append(4); // width
+    data.append(4); // height
+    data.append(0); // colour count
+    data.append(0); // reserved
+    append16(1); // colour planes
+    append16(32); // bits per pixel
+    append32LE(pngSpan.size());
+    append32LE(22); // image offset, just past the directory
+    data.append(pngSpan);
+
+    return SharedBuffer::create(WTF::move(data));
+}
+
+// The sub-decoder has no frame buffer until it has parsed its own header, which has not happened
+// while only the PNG signature has arrived. See ICOImageDecoder::decodeAtIndex().
+TEST(ImageDecoder, ICOWithPartiallyReceivedPNGSubImage)
+{
+    auto full = makeICOWithPNGSubImage();
+
+    // Past the icon directory and the PNG signature, but short of the sub-image's IHDR.
+    auto partial = SharedBuffer::create(full->span().first(30));
+
+    RefPtr decoder = ImageDecoder::create(partial.get(), "image/vnd.microsoft.icon"_s, AlphaOption::Premultiplied, GammaAndColorProfileOption::Applied);
+    ASSERT_TRUE(decoder);
+
+    decoder->setData(partial.get(), false);
+    decoder->createFrameImageAtIndex(0);
+
+    decoder->setData(full.get(), true);
+    decoder->createFrameImageAtIndex(0);
+}
+
+// Evict a frame from the middle of the cache, then decode a later one -- the sequence
+// PNGImageDecoder::frameComplete()'s null check exists for. It does not reach that check: the
+// evicted frame is re-decoded first, because clear() resets the disposal method that
+// findFirstRequiredFrameToDecode() uses to decide a frame can be skipped. So this passes with the
+// check removed, and guards the sequence rather than the branch.
+TEST(ImageDecoder, APNGSubRectFrameWithEvictedPreviousFrame)
+{
+    auto buffer = makeSubRectAPNG(4);
+    RefPtr decoder = createDecoder(buffer.get());
+    ASSERT_TRUE(decoder);
+    ASSERT_EQ(4u, decoder->frameCount());
+
+    for (size_t index = 0; index < decoder->frameCount(); ++index)
+        decoder->createFrameImageAtIndex(index);
+
+    // Evicts frames 1 and 2; the first and last are never cleared.
+    decoder->clearFrameBufferCache(decoder->frameCount());
+    ASSERT_TRUE(decoder->frameIsCompleteAtIndex(0));
+    ASSERT_FALSE(decoder->frameIsCompleteAtIndex(1));
+    ASSERT_FALSE(decoder->frameIsCompleteAtIndex(2));
+
+    // Frame 2 only: asking for frame 1 first would restore the backing store under test.
+    decoder->createFrameImageAtIndex(2);
+}
+
+// --- GIF ----------------------------------------------------------------------------------------
+
+// Single-pixel frames on a 2x2 canvas, so every frame after the first is a sub-rectangle, with
+// disposal method 3 (restore to previous) so the middle ones are evictable.
+static Ref<SharedBuffer> makeSubRectGIF(size_t frameCount)
+{
+    Vector<uint8_t> data;
+    for (auto c : { 'G', 'I', 'F', '8', '9', 'a' })
+        data.append(static_cast<uint8_t>(c));
+
+    auto append16LE = [&](uint16_t value) {
+        data.append(value & 0xff);
+        data.append(value >> 8);
+    };
+
+    // Logical screen descriptor: 2x2, global colour table of two entries.
+    append16LE(2);
+    append16LE(2);
+    data.append(0x80);
+    data.append(0);
+    data.append(0);
+    data.appendList({ 0xff, 0x00, 0x00 }); // index 0: red
+    data.appendList({ 0x00, 0x00, 0x00 }); // index 1: black
+
+    // One pixel of colour index 0: CLEAR(4), 0, END(5) as 3-bit LZW codes packed low bit first.
+    // Nothing is ever reused, so the code width never grows.
+    auto appendImage = [&](uint16_t left, uint16_t top, uint8_t disposalMethod) {
+        data.appendList({ 0x21, 0xf9, 0x04 });
+        data.append(static_cast<uint8_t>(disposalMethod << 2));
+        append16LE(10); // delay, in hundredths
+        data.append(0); // transparent colour index
+        data.append(0); // block terminator
+
+        data.append(0x2c); // image separator
+        append16LE(left);
+        append16LE(top);
+        append16LE(1); // width
+        append16LE(1); // height
+        data.append(0); // no local colour table, not interlaced
+
+        data.append(2); // LZW minimum code size
+        data.append(2); // sub-block length
+        data.appendList({ 0x44, 0x01 });
+        data.append(0); // block terminator
+    };
+
+    appendImage(0, 0, 1); // frame 0: do not dispose
+    for (size_t frame = 1; frame < frameCount; ++frame)
+        appendImage(1, 1, 3); // restore to previous
+
+    data.append(0x3b); // trailer
+    return SharedBuffer::create(WTF::move(data));
+}
+
+// The GIF twin of the case above, unreachable for the same reason.
+// See GIFImageDecoder::frameComplete().
+TEST(ImageDecoder, GIFSubRectFrameWithEvictedPreviousFrame)
+{
+    auto buffer = makeSubRectGIF(4);
+    RefPtr decoder = ImageDecoder::create(buffer.get(), "image/gif"_s, AlphaOption::Premultiplied, GammaAndColorProfileOption::Applied);
+    ASSERT_TRUE(decoder);
+    decoder->setData(buffer.get(), true);
+    ASSERT_EQ(4u, decoder->frameCount());
+
+    for (size_t index = 0; index < decoder->frameCount(); ++index)
+        decoder->createFrameImageAtIndex(index);
+
+    decoder->clearFrameBufferCache(decoder->frameCount());
+    ASSERT_TRUE(decoder->frameIsCompleteAtIndex(0));
+    ASSERT_FALSE(decoder->frameIsCompleteAtIndex(1));
+    ASSERT_FALSE(decoder->frameIsCompleteAtIndex(2));
+
+    decoder->createFrameImageAtIndex(2);
+}
+
+// --- WebP ---------------------------------------------------------------------------------------
+
+// LayoutTests/fast/images/resources/awebp00.webp, byte for byte. The demuxer has to accept the
+// file well enough to report a frame count, which it will not do for hand-built bytes.
+static Ref<SharedBuffer> makeAnimatedWebP()
+{
+    static constexpr std::array<uint8_t, 948> bytes { {
+        0x52, 0x49, 0x46, 0x46, 0xac, 0x03, 0x00, 0x00, 0x57, 0x45, 0x42, 0x50,
+        0x56, 0x50, 0x38, 0x58, 0x0a, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00,
+        0x3e, 0x00, 0x00, 0x3e, 0x00, 0x00, 0x41, 0x4e, 0x49, 0x4d, 0x06, 0x00,
+        0x00, 0x00, 0xff, 0xff, 0xff, 0xff, 0x01, 0x00, 0x41, 0x4e, 0x4d, 0x46,
+        0x2c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x3e, 0x00,
+        0x00, 0x3e, 0x00, 0x00, 0x0b, 0x00, 0x00, 0x00, 0x56, 0x50, 0x38, 0x4c,
+        0x14, 0x00, 0x00, 0x00, 0x2f, 0x3e, 0x80, 0x0f, 0x00, 0x07, 0x10, 0x11,
+        0xfd, 0x0f, 0x00, 0x09, 0xe1, 0xff, 0x7b, 0x2d, 0xa2, 0xff, 0xa9, 0x1d,
+        0x41, 0x4e, 0x4d, 0x46, 0x44, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x3e, 0x00, 0x00, 0x3e, 0x00, 0x00, 0x0b, 0x00, 0x00, 0x00,
+        0x56, 0x50, 0x38, 0x4c, 0x2b, 0x00, 0x00, 0x00, 0x2f, 0x3e, 0x80, 0x0f,
+        0x00, 0x0f, 0x30, 0xff, 0xf3, 0x3f, 0xff, 0xf3, 0x1f, 0x78, 0x50, 0xd3,
+        0x48, 0x0a, 0x74, 0x4e, 0x4e, 0x0a, 0xd2, 0x40, 0x1a, 0xde, 0xe8, 0x7e,
+        0xca, 0x88, 0xfe, 0x4f, 0x80, 0x3a, 0x11, 0xf3, 0x99, 0xa0, 0x88, 0x3a,
+        0x8b, 0xfc, 0x33, 0x00, 0x41, 0x4e, 0x4d, 0x46, 0x4e, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x3e, 0x00, 0x00, 0x3e, 0x00, 0x00,
+        0x0b, 0x00, 0x00, 0x00, 0x56, 0x50, 0x38, 0x4c, 0x36, 0x00, 0x00, 0x00,
+        0x2f, 0x3e, 0x80, 0x0f, 0x00, 0x0f, 0x30, 0xff, 0xf3, 0x3f, 0xff, 0xf3,
+        0x1f, 0x78, 0x50, 0x1b, 0xdb, 0x36, 0x74, 0xff, 0xb7, 0x85, 0x4a, 0x52,
+        0x1a, 0xa5, 0x29, 0x49, 0x28, 0x93, 0xef, 0xc2, 0x88, 0xfe, 0x0b, 0x08,
+        0x8a, 0x2c, 0x70, 0x23, 0xd7, 0x11, 0xbb, 0x81, 0xf9, 0x4a, 0xa2, 0x05,
+        0x56, 0x58, 0xf6, 0xf9, 0x9f, 0x01, 0x41, 0x4e, 0x4d, 0x46, 0x4c, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x3e, 0x00, 0x00, 0x3e,
+        0x00, 0x00, 0x0b, 0x00, 0x00, 0x00, 0x56, 0x50, 0x38, 0x4c, 0x33, 0x00,
+        0x00, 0x00, 0x2f, 0x3e, 0x80, 0x0f, 0x00, 0x0f, 0x30, 0xff, 0xf3, 0x3f,
+        0xff, 0xf3, 0x1f, 0x78, 0x50, 0x15, 0xdb, 0x36, 0xb5, 0x24, 0x11, 0x45,
+        0xb4, 0x2b, 0x9a, 0x60, 0x46, 0x80, 0xb7, 0xcf, 0x88, 0xfe, 0x0b, 0x08,
+        0x8a, 0x2c, 0x70, 0x23, 0x5a, 0xa6, 0xa7, 0x98, 0xaf, 0x16, 0x18, 0xe6,
+        0x5b, 0xf7, 0xe9, 0x37, 0x03, 0x00, 0x41, 0x4e, 0x4d, 0x46, 0x50, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x3e, 0x00, 0x00, 0x3e,
+        0x00, 0x00, 0x0b, 0x00, 0x00, 0x00, 0x56, 0x50, 0x38, 0x4c, 0x38, 0x00,
+        0x00, 0x00, 0x2f, 0x3e, 0x80, 0x0f, 0x00, 0x0f, 0x30, 0xff, 0xf3, 0x3f,
+        0xff, 0xf3, 0x1f, 0x78, 0x50, 0xd4, 0x48, 0x8a, 0xd4, 0x28, 0x19, 0x29,
+        0x48, 0x1b, 0xa4, 0x21, 0x8c, 0xac, 0x80, 0xf3, 0x1d, 0xd1, 0xff, 0x09,
+        0x70, 0x0b, 0x26, 0xbc, 0x5f, 0x25, 0xc0, 0x62, 0x3f, 0xb7, 0x60, 0xc2,
+        0x87, 0x00, 0xfb, 0x55, 0x72, 0x88, 0x5b, 0x87, 0xfc, 0x33, 0x41, 0x4e,
+        0x4d, 0x46, 0x5e, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x3e, 0x00, 0x00, 0x3e, 0x00, 0x00, 0x0b, 0x00, 0x00, 0x00, 0x56, 0x50,
+        0x38, 0x4c, 0x45, 0x00, 0x00, 0x00, 0x2f, 0x3e, 0x80, 0x0f, 0x00, 0x0f,
+        0x30, 0xff, 0xf3, 0x3f, 0xff, 0xf3, 0x1f, 0x78, 0x60, 0x14, 0xdb, 0x56,
+        0x9b, 0x4b, 0x5f, 0x22, 0x01, 0x29, 0x48, 0xfb, 0x48, 0x43, 0x0a, 0x12,
+        0x58, 0xb6, 0x24, 0x02, 0xea, 0x3a, 0xa2, 0xff, 0x13, 0x20, 0x35, 0xc1,
+        0xa1, 0xe4, 0x7e, 0x25, 0x03, 0x5c, 0xdc, 0x4f, 0x6a, 0x82, 0x43, 0xc9,
+        0xfd, 0xa0, 0xc5, 0x61, 0xe0, 0x09, 0xf4, 0xc0, 0x33, 0x5a, 0x1c, 0xe6,
+        0x19, 0x7f, 0x19, 0x00, 0x41, 0x4e, 0x4d, 0x46, 0x5a, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x3e, 0x00, 0x00, 0x3e, 0x00, 0x00,
+        0x0b, 0x00, 0x00, 0x00, 0x56, 0x50, 0x38, 0x4c, 0x42, 0x00, 0x00, 0x00,
+        0x2f, 0x3e, 0x80, 0x0f, 0x00, 0x0f, 0x30, 0xff, 0xf3, 0x3f, 0xff, 0xf3,
+        0x1f, 0x78, 0x50, 0x12, 0xdb, 0x56, 0x74, 0x51, 0x48, 0x22, 0x10, 0x85,
+        0x68, 0x9f, 0x68, 0x44, 0x21, 0x02, 0x72, 0x07, 0xbf, 0xea, 0x88, 0xfe,
+        0x0b, 0x08, 0x8a, 0x2c, 0x70, 0x43, 0x82, 0x85, 0xae, 0x64, 0x3f, 0xef,
+        0x00, 0x26, 0xfb, 0x9d, 0xfb, 0x84, 0x68, 0xf2, 0x3a, 0x83, 0xa4, 0x99,
+        0x1c, 0x70, 0xee, 0xf3, 0x97, 0x01, 0x41, 0x4e, 0x4d, 0x46, 0x64, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x3e, 0x00, 0x00, 0x3e,
+        0x00, 0x00, 0x0b, 0x00, 0x00, 0x00, 0x56, 0x50, 0x38, 0x4c, 0x4c, 0x00,
+        0x00, 0x00, 0x2f, 0x3e, 0x80, 0x0f, 0x00, 0x0f, 0x30, 0xff, 0xf3, 0x3f,
+        0xff, 0xf3, 0x1f, 0x78, 0x60, 0x13, 0xd9, 0x6e, 0xa3, 0x77, 0xb9, 0x34,
+        0x04, 0x41, 0x31, 0x34, 0x19, 0x9a, 0xa0, 0x18, 0xc2, 0x95, 0x39, 0x77,
+        0x12, 0x81, 0x88, 0xfe, 0x4f, 0x80, 0x9a, 0xc0, 0xd1, 0xa8, 0xbf, 0x92,
+        0x01, 0x2e, 0xfc, 0xa9, 0x09, 0x1c, 0x8d, 0xfa, 0x83, 0x9a, 0x96, 0x0e,
+        0x22, 0x30, 0x4f, 0xc4, 0xa8, 0x69, 0xe9, 0x22, 0xa8, 0x09, 0x7f, 0x7f,
+        0x25, 0x13, 0x44, 0x4d, 0x82, 0x00, 0x41, 0x4e, 0x4d, 0x46, 0x64, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x3e, 0x00, 0x00, 0x3e,
+        0x00, 0x00, 0x0b, 0x00, 0x00, 0x00, 0x56, 0x50, 0x38, 0x4c, 0x4c, 0x00,
+        0x00, 0x00, 0x2f, 0x3e, 0x80, 0x0f, 0x00, 0x0f, 0x30, 0xff, 0xf3, 0x3f,
+        0xff, 0xf3, 0x1f, 0x78, 0x60, 0x13, 0xdb, 0x56, 0x9c, 0x4b, 0xd6, 0xf2,
+        0x4b, 0x40, 0x0a, 0xd2, 0x1e, 0xd2, 0xbe, 0x14, 0x24, 0x50, 0x66, 0x4f,
+        0xcf, 0x37, 0x10, 0xd1, 0xff, 0x90, 0x67, 0x78, 0x92, 0xc6, 0xd7, 0x02,
+        0xf0, 0x31, 0x5e, 0x9e, 0xe1, 0x49, 0x1a, 0x0f, 0xcd, 0x8e, 0x19, 0x22,
+        0xe8, 0x3b, 0x31, 0xcd, 0x8e, 0x39, 0x42, 0xfe, 0x07, 0xd5, 0x42, 0xdf,
+        0x89, 0x90, 0xff, 0x76, 0xcc, 0x11, 0x41, 0x4e, 0x4d, 0x46, 0x5e, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x3e, 0x00, 0x00, 0x3e,
+        0x00, 0x00, 0x0b, 0x00, 0x00, 0x00, 0x56, 0x50, 0x38, 0x4c, 0x46, 0x00,
+        0x00, 0x00, 0x2f, 0x3e, 0x80, 0x0f, 0x00, 0x0f, 0x30, 0xff, 0xf3, 0x3f,
+        0xff, 0xf3, 0x1f, 0x78, 0x60, 0x14, 0xdb, 0x56, 0x9b, 0x4b, 0x5f, 0x22,
+        0x01, 0x29, 0x48, 0xfb, 0x48, 0x43, 0x0a, 0x12, 0x58, 0xb6, 0x24, 0x02,
+        0xea, 0x3a, 0xa2, 0xff, 0x02, 0x92, 0xc4, 0x07, 0xd1, 0x0b, 0xa9, 0x09,
+        0x0e, 0x25, 0xf7, 0x2b, 0x19, 0xe0, 0xe2, 0x7e, 0xcf, 0x75, 0x42, 0x8b,
+        0xc3, 0xc0, 0x13, 0xe8, 0x81, 0x47, 0x3c, 0xd6, 0xf9, 0x9b, 0x1f, 0x05
+    } };
+    return SharedBuffer::create(std::span<const uint8_t> { bytes });
+}
+
+// frameCount() comes from the demuxer, and decode() returns before sizing the cache when the
+// demuxer rejects the data, so the two can disagree. The frame count is established from a good
+// prefix and survives a buffer too short for parseHeader() to re-read it from -- which is also
+// what makes WebPDemuxPartial() fail. See WEBPImageDecoder::frameBufferAtIndex().
+TEST(ImageDecoder, WEBPFrameIndexBeyondCacheAfterFailedDecode)
+{
+    auto full = makeAnimatedWebP();
+
+    // Enough to count frames, and nothing decoded, so the cache is still empty.
+    auto prefix = SharedBuffer::create(full->span().first(full->size() / 2));
+    RefPtr decoder = ImageDecoder::create(prefix.get(), "image/webp"_s, AlphaOption::Premultiplied, GammaAndColorProfileOption::Applied);
+    ASSERT_TRUE(decoder);
+    decoder->setData(prefix.get(), false);
+
+    auto frameCount = decoder->frameCount();
+    ASSERT_GT(frameCount, 1u);
+
+    // Under the 30 bytes parseHeader() needs, so the count above stands, and far too little for
+    // WebPDemuxPartial().
+    Vector<uint8_t> stub;
+    for (size_t i = 0; i < 16; ++i)
+        stub.append(0xff);
+    auto truncated = SharedBuffer::create(WTF::move(stub));
+    decoder->setData(truncated.get(), false);
+    ASSERT_EQ(frameCount, decoder->frameCount());
+
+    // Highest index first: it is the furthest outside the empty cache.
+    for (size_t index = frameCount; index-- > 0;)
+        decoder->createFrameImageAtIndex(index);
+}
+
+// --- JPEG XL ------------------------------------------------------------------------------------
+
+#if USE(JPEGXL)
+
+// A three-frame animated JXL, byte for byte
+// LayoutTests/fast/images/resources/animated-red-green-blue-repeat-2.jxl.
+static Ref<SharedBuffer> makeAnimatedJPEGXL()
+{
+    static constexpr std::array<uint8_t, 99> bytes { {
+        0xff, 0x0a, 0x18, 0x13, 0x41, 0x48, 0x10, 0x13, 0x08, 0x04, 0x0a, 0x08,
+        0x00, 0x00, 0x64, 0x00, 0x4b, 0x18, 0x8b, 0x15, 0x00, 0xd4, 0x1b, 0x63,
+        0x30, 0x76, 0x2f, 0x10, 0x01, 0x00, 0x20, 0x01, 0x52, 0xa7, 0x3f, 0x00,
+        0x41, 0x7f, 0x5f, 0x3c, 0x1a, 0x08, 0x04, 0x0a, 0x08, 0x00, 0x00, 0x60,
+        0x00, 0x4b, 0x18, 0x8b, 0x15, 0x00, 0xd4, 0x1b, 0x63, 0x30, 0x76, 0x2f,
+        0x10, 0x01, 0x00, 0x6f, 0x75, 0x02, 0x00, 0x00, 0x01, 0x40, 0x5f, 0xfc,
+        0x1f, 0x08, 0x04, 0x0a, 0x04, 0x00, 0x4c, 0x00, 0x4b, 0x18, 0x8b, 0x15,
+        0x80, 0x5d, 0xfe, 0xff, 0x02, 0x11, 0x00, 0xd8, 0x98, 0x36, 0x00, 0x28,
+        0x02, 0xfa, 0x03
+    } };
+    return SharedBuffer::create(std::span<const uint8_t> { bytes });
+}
+
+// clearFrameBufferCache() takes whatever index its caller has, which can be past the end of the
+// cache, so the end iterator has to be clamped to the cache rather than to that index.
+// See JPEGXLImageDecoder::clearDecodedPixelDataIfNeeded().
+TEST(ImageDecoder, JPEGXLClearFrameBufferCachePastEnd)
+{
+    auto buffer = makeAnimatedJPEGXL();
+    RefPtr decoder = ImageDecoder::create(buffer.get(), "image/jxl"_s, AlphaOption::Premultiplied, GammaAndColorProfileOption::Applied);
+    ASSERT_TRUE(decoder);
+    decoder->setData(buffer.get(), true);
+
+    decoder->createFrameImageAtIndex(0);
+
+    // Far enough past the end to leave mapped memory. A few entries past would be a silent heap
+    // overwrite that only a sanitizer would catch.
+    decoder->clearFrameBufferCache(1 << 28);
+}
+
+#endif // USE(JPEGXL)
+
+static Vector<uint8_t> makeThreeFrameAPNGWithDisposePrevious(size_t& cutAfterSecondFrame)
+{
+    Vector<uint8_t> data { 0x89, 'P', 'N', 'G', '\r', '\n', 0x1a, '\n' };
+
+    Vector<uint8_t> ihdr;
+    append32(ihdr, 4);
+    append32(ihdr, 4);
+    ihdr.appendList({ 8, 2, 0, 0, 0 });
+    appendChunk(data, "IHDR", ihdr.span());
+
+    Vector<uint8_t> actl;
+    append32(actl, 3); // num_frames
+    append32(actl, 0); // num_plays (infinite)
+    appendChunk(data, "acTL", actl.span());
+
+    auto appendFrameControl = [&](uint32_t sequenceNumber, uint8_t disposeOp) {
+        Vector<uint8_t> fctl;
+        append32(fctl, sequenceNumber);
+        append32(fctl, 4); // width
+        append32(fctl, 4); // height
+        append32(fctl, 0); // x_offset
+        append32(fctl, 0); // y_offset
+        fctl.appendList({ 0, 1 }); // delay_num = 1
+        fctl.appendList({ 0, 10 }); // delay_den = 10
+        fctl.append(disposeOp);
+        fctl.append(0); // blend_op = APNG_BLEND_OP_SOURCE
+        appendChunk(data, "fcTL", fctl.span());
+    };
+
+    auto zlib = storedZlibStream(redScanlines().span());
+    auto appendFrameData = [&](uint32_t sequenceNumber) {
+        Vector<uint8_t> fdat;
+        append32(fdat, sequenceNumber);
+        fdat.append(zlib.span());
+        appendChunk(data, "fdAT", fdat.span());
+    };
+
+    appendFrameControl(0, 0); // APNG_DISPOSE_OP_NONE
+    appendChunk(data, "IDAT", zlib.span());
+
+    appendFrameControl(1, 2); // APNG_DISPOSE_OP_PREVIOUS
+    appendFrameData(2);
+
+    // Frame 1 is only marked complete once the next fcTL is parsed, so the cut point must include
+    // this chunk for the eviction below to find a complete frame.
+    appendFrameControl(3, 0);
+    cutAfterSecondFrame = data.size();
+
+    appendFrameData(4);
+
+    appendChunk(data, "IEND", { });
+    return data;
+}
+
+// Decode two frames from partial data, evict the complete RestoreToPrevious frame while the
+// reader is still alive, then let the decode continue: initFrameBuffer() for frame 2 walks back
+// to the evicted frame and reads its backing store.
+TEST(ImageDecoder, EvictRestoreToPreviousFrameMidStream)
+{
+    size_t cut = 0;
+    auto bytes = makeThreeFrameAPNGWithDisposePrevious(cut);
+    auto full = SharedBuffer::create(Vector<uint8_t>(bytes));
+    auto partial = SharedBuffer::create(bytes.span().first(cut));
+
+    RefPtr decoder = ImageDecoder::create(partial.get(), "image/png"_s, AlphaOption::Premultiplied, GammaAndColorProfileOption::Applied);
+    ASSERT_TRUE(decoder);
+
+    decoder->setData(partial.get(), false);
+    decoder->createFrameImageAtIndex(1);
+
+    decoder->clearFrameBufferCache(3);
+
+    decoder->setData(full.get(), true);
+    decoder->createFrameImageAtIndex(2);
+}
+
+} // namespace TestWebKitAPI
diff --git a/Tools/TestWebKitAPI/Tests/WebCore/QuirkMatch.cpp b/Tools/TestWebKitAPI/Tests/WebCore/QuirkMatch.cpp
deleted file mode 100644
index ab59def12ee8..000000000000
--- a/Tools/TestWebKitAPI/Tests/WebCore/QuirkMatch.cpp
+++ /dev/null
@@ -1,404 +0,0 @@
-/*
- * Copyright (C) 2026 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
- * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
- * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
- * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
- * THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#include <WebCore/QuirkMatch.h>
-#include <array>
-#include <wtf/URL.h>
-#include <wtf/text/WTFString.h>
-
-namespace TestWebKitAPI {
-
-using WebCore::QuirkEnvironment;
-using WebCore::QuirkMatch;
-using WebCore::QuirkMatchContext;
-using namespace WebCore::QuirkRefinement;
-
-static bool matchesURL(const QuirkMatch& match, ASCIILiteral urlString)
-{
-    return match.matches(QuirkMatchContext { URL { urlString }, URL { urlString }, WebCore::IsTopDocument::Yes });
-}
-
-static bool matchesEmbeddedURL(const QuirkMatch& match, ASCIILiteral topURLString, ASCIILiteral documentURLString)
-{
-    return match.matches(QuirkMatchContext { URL { topURLString }, URL { documentURLString }, WebCore::IsTopDocument::No });
-}
-
-static constexpr std::array expediaGroupDomains { "hotels.com"_s, "orbitz.com"_s, "wotif.co.nz"_s };
-static constexpr std::array youTubeEmbedDomains { "youtube.com"_s, "youtube-nocookie.com"_s };
-static constexpr std::array vimeoDomains { "vimeo.com"_s };
-static constexpr std::array excludedNaverHosts { "tv.naver.com"_s, "mail.naver.com"_s, "m.naver.com"_s };
-
-TEST(QuirkMatchTest, DomainMatchesRegistrableDomain)
-{
-    auto match = QuirkMatch::domain("example.com"_s);
-
-    EXPECT_TRUE(matchesURL(match, "https://example.com/"_s));
-    EXPECT_TRUE(matchesURL(match, "https://www.example.com/"_s));
-    EXPECT_TRUE(matchesURL(match, "https://deep.sub.example.com/some/path?query#fragment"_s));
-    EXPECT_TRUE(matchesURL(match, "http://example.com:8080/"_s));
-
-    EXPECT_FALSE(matchesURL(match, "https://example.org/"_s));
-    EXPECT_FALSE(matchesURL(match, "https://notexample.com/"_s));
-
-    EXPECT_FALSE(matchesURL(match, "https://example.com.evil.com/"_s));
-}
-
-TEST(QuirkMatchTest, DomainUnderstandsMultiLabelPublicSuffixes)
-{
-    auto match = QuirkMatch::domain("bbc.co.uk"_s);
-
-    EXPECT_TRUE(matchesURL(match, "https://www.bbc.co.uk/news"_s));
-    EXPECT_TRUE(matchesURL(match, "https://bbc.co.uk/"_s));
-
-    EXPECT_FALSE(matchesURL(match, "https://bbc.com/"_s));
-}
-
-TEST(QuirkMatchTest, DomainsMatchesAnyPatternInTheList)
-{
-    auto match = QuirkMatch::domain(expediaGroupDomains);
-
-    EXPECT_TRUE(matchesURL(match, "https://www.hotels.com/"_s));
-    EXPECT_TRUE(matchesURL(match, "https://orbitz.com/flights"_s));
-    EXPECT_TRUE(matchesURL(match, "https://www.wotif.co.nz/"_s));
-
-    EXPECT_FALSE(matchesURL(match, "https://www.expedia.com/"_s));
-    EXPECT_FALSE(matchesURL(match, "https://wotif.com/"_s));
-}
-
-TEST(QuirkMatchTest, HostMatchesExactHostOnly)
-{
-    auto match = QuirkMatch::host("docs.google.com"_s);
-
-    EXPECT_TRUE(matchesURL(match, "https://docs.google.com/spreadsheets/d/abc"_s));
-    EXPECT_TRUE(matchesURL(match, "https://DOCS.GOOGLE.COM/"_s));
-
-    EXPECT_FALSE(matchesURL(match, "https://google.com/"_s));
-    EXPECT_FALSE(matchesURL(match, "https://www.docs.google.com/"_s));
-    EXPECT_FALSE(matchesURL(match, "https://sheets.docs.google.com/"_s));
-}
-
-TEST(QuirkMatchTest, HostOrSubdomainOfRespectsLabelBoundaries)
-{
-    auto match = QuirkMatch::hostOrSubdomainOf("ceac.state.gov"_s);
-
-    EXPECT_TRUE(matchesURL(match, "https://ceac.state.gov/CEAC/"_s));
-    EXPECT_TRUE(matchesURL(match, "https://travel.ceac.state.gov/"_s));
-
-    EXPECT_FALSE(matchesURL(match, "https://notceac.state.gov/"_s));
-    EXPECT_FALSE(matchesURL(match, "https://state.gov/"_s));
-
-    EXPECT_FALSE(matchesURL(match, "ftp://ceac.state.gov/"_s));
-}
-
-TEST(QuirkMatchTest, HostOrSubdomainOfCoversShardedHosts)
-{
-    auto match = QuirkMatch::hostOrSubdomainOf("onedrive.live.com"_s);
-
-    EXPECT_TRUE(matchesURL(match, "https://onedrive.live.com/"_s));
-    EXPECT_TRUE(matchesURL(match, "https://p123.onedrive.live.com/"_s));
-    EXPECT_TRUE(matchesURL(match, "https://ONEDRIVE.LIVE.COM/"_s));
-
-    EXPECT_FALSE(matchesURL(match, "https://myonedrive.live.com/"_s));
-    EXPECT_FALSE(matchesURL(match, "https://live.com/"_s));
-    EXPECT_FALSE(matchesURL(match, "https://onedrive.live.com.evil.com/"_s));
-}
-
-TEST(QuirkMatchTest, AnyTopLevelDomainMatchesEveryPublicSuffix)
-{
-    auto match = QuirkMatch::anyTopLevelDomain("amazon"_s);
-
-    EXPECT_TRUE(matchesURL(match, "https://www.amazon.com/"_s));
-    EXPECT_TRUE(matchesURL(match, "https://www.amazon.co.uk/gp/video/"_s));
-    EXPECT_TRUE(matchesURL(match, "https://amazon.de/"_s));
-    EXPECT_TRUE(matchesURL(match, "https://smile.amazon.com/"_s));
-
-    EXPECT_FALSE(matchesURL(match, "https://notamazon.com/"_s));
-    EXPECT_FALSE(matchesURL(match, "https://amazon.com.evil.com/"_s));
-
-    EXPECT_FALSE(matchesURL(match, "https://amazon.invalidtld/"_s));
-}
-
-TEST(QuirkMatchTest, PathContainsMatchesAnywhereInThePath)
-{
-    auto match = QuirkMatch::anyTopLevelDomain("apple"_s).when(pathContains("/retail"_s));
-
-    EXPECT_TRUE(matchesURL(match, "https://www.apple.com/retail/"_s));
-    EXPECT_TRUE(matchesURL(match, "https://www.apple.com/us/retail/store"_s));
-    EXPECT_TRUE(matchesURL(match, "https://www.apple.co.uk/retail/"_s));
-
-    EXPECT_FALSE(matchesURL(match, "https://www.apple.com/"_s));
-    EXPECT_FALSE(matchesURL(match, "https://www.apple.com/RETAIL/"_s));
-    EXPECT_FALSE(matchesURL(match, "https://www.apple.com/?section=/retail"_s));
-    EXPECT_FALSE(matchesURL(match, "https://www.apple.com/#/retail"_s));
-
-    EXPECT_FALSE(matchesURL(match, "https://www.example.com/retail/"_s));
-}
-
-TEST(QuirkMatchTest, PathStartsWithIsAnchored)
-{
-    auto match = QuirkMatch::host("docs.google.com"_s).when(pathStartsWith("/spreadsheets/"_s));
-
-    EXPECT_TRUE(matchesURL(match, "https://docs.google.com/spreadsheets/d/abc/edit"_s));
-    EXPECT_TRUE(matchesURL(match, "https://docs.google.com/SpreadSheets/d/abc"_s));
-
-    EXPECT_FALSE(matchesURL(match, "https://docs.google.com/"_s));
-    EXPECT_FALSE(matchesURL(match, "https://docs.google.com/spreadsheets"_s));
-    EXPECT_FALSE(matchesURL(match, "https://docs.google.com/a/spreadsheets/d/abc"_s));
-}
-
-TEST(QuirkMatchTest, PathOrFragmentContainsSearchesBoth)
-{
-    auto match = QuirkMatch::domain("icloud.com"_s).when(pathOrFragmentContains("mail"_s));
-
-    EXPECT_TRUE(matchesURL(match, "https://www.icloud.com/mail/"_s));
-    EXPECT_TRUE(matchesURL(match, "https://www.icloud.com/#mail"_s));
-
-    EXPECT_FALSE(matchesURL(match, "https://www.icloud.com/"_s));
-    EXPECT_FALSE(matchesURL(match, "https://www.icloud.com/notes/"_s));
-
-    EXPECT_FALSE(matchesURL(match, "https://www.icloud.com/?app=mail"_s));
-}
-
-TEST(QuirkMatchTest, EnvironmentIsANDedWithTheSiteMatch)
-{
-    auto smallScreenOnly = QuirkMatch::domain("youtube.com"_s).when(smallScreen());
-
-    EXPECT_EQ(matchesURL(smallScreenOnly, "https://www.youtube.com/"_s), WebCore::evaluateQuirkEnvironment(QuirkEnvironment::SmallScreen));
-
-    EXPECT_FALSE(matchesURL(smallScreenOnly, "https://www.example.com/"_s));
-
-#if !PLATFORM(IOS_FAMILY)
-    EXPECT_FALSE(WebCore::evaluateQuirkEnvironment(QuirkEnvironment::SmallScreen));
-    EXPECT_FALSE(WebCore::evaluateQuirkEnvironment(QuirkEnvironment::TubularApp));
-    EXPECT_FALSE(WebCore::evaluateQuirkEnvironment(QuirkEnvironment::LensApp));
-
-    EXPECT_FALSE(matchesURL(smallScreenOnly, "https://www.youtube.com/"_s));
-#endif
-}
-
-TEST(QuirkMatchTest, DocumentDomainIsMatchesEmbeddedDocuments)
-{
-    auto match = QuirkMatch::anyTopLevelDomain("theguardian"_s).when(documentDomainIs(youTubeEmbedDomains));
-
-    EXPECT_TRUE(matchesEmbeddedURL(match, "https://www.theguardian.com/film"_s, "https://www.youtube.com/embed/abc"_s));
-    EXPECT_TRUE(matchesEmbeddedURL(match, "https://www.theguardian.co.uk/film"_s, "https://www.youtube-nocookie.com/embed/abc"_s));
-
-    EXPECT_TRUE(matchesEmbeddedURL(match, "https://www.theguardian.com/film"_s, "https://foo.bar.youtube.com/embed/abc"_s));
-
-    EXPECT_FALSE(matchesURL(match, "https://www.theguardian.com/film"_s));
-    EXPECT_FALSE(matchesEmbeddedURL(match, "https://www.theguardian.com/film"_s, "https://vimeo.com/12345"_s));
-
-    EXPECT_FALSE(matchesEmbeddedURL(match, "https://www.example.com/"_s, "https://www.youtube.com/embed/abc"_s));
-    EXPECT_FALSE(matchesEmbeddedURL(match, "https://www.youtube.com/"_s, "https://www.theguardian.com/film"_s));
-}
-
-TEST(QuirkMatchTest, DocumentDomainIsAcceptsASinglePattern)
-{
-    auto match = QuirkMatch::anySite().when(embedded(), documentDomainIs("x.com"_s));
-
-    EXPECT_TRUE(matchesEmbeddedURL(match, "https://www.theguardian.com/film"_s, "https://x.com/i/status/123"_s));
-    EXPECT_TRUE(matchesEmbeddedURL(match, "https://www.example.com/"_s, "https://platform.x.com/embed/Tweet.html"_s));
-
-    EXPECT_FALSE(matchesEmbeddedURL(match, "https://www.example.com/"_s, "https://vimeo.com/12345"_s));
-    EXPECT_FALSE(matchesURL(match, "https://x.com/i/status/123"_s));
-}
-
-TEST(QuirkMatchTest, AnySiteWithOnlyIfEmbeddedMatchesEmbedsAnywhereButNeverTheTopDocument)
-{
-    auto match = QuirkMatch::anySite().when(embedded(), documentDomainIs(youTubeEmbedDomains));
-
-    EXPECT_TRUE(matchesEmbeddedURL(match, "https://www.theguardian.com/film"_s, "https://www.youtube.com/embed/abc"_s));
-    EXPECT_TRUE(matchesEmbeddedURL(match, "https://www.example.com/"_s, "https://www.youtube-nocookie.com/embed/abc"_s));
-
-    EXPECT_FALSE(matchesEmbeddedURL(match, "https://www.example.com/"_s, "https://vimeo.com/12345"_s));
-    // youtube.com at the top level, and youtube.com embedded in itself, are both the top document.
-    EXPECT_FALSE(matchesURL(match, "https://www.youtube.com/watch?v=abc"_s));
-}
-
-TEST(QuirkMatchTest, AnySiteMatchesEverySiteWithoutFurtherRefinement)
-{
-    auto match = QuirkMatch::anySite();
-
-    EXPECT_TRUE(matchesURL(match, "https://www.example.com/"_s));
-    EXPECT_TRUE(matchesURL(match, "https://webkit.org/"_s));
-    EXPECT_FALSE(matchesURL(match, "about:blank"_s));
-}
-
-TEST(QuirkMatchTest, ExceptWhenCarvesOutPagesOfAMatchedSite)
-{
-    auto match = QuirkMatch::domain("wix.com"_s).exceptWhen(pathStartsWith("/website/templates/"_s));
-
-    EXPECT_TRUE(matchesURL(match, "https://www.wix.com/"_s));
-    EXPECT_TRUE(matchesURL(match, "https://www.wix.com/website/other"_s));
-    // The exception reuses pathStartsWith(), so it is anchored the same way.
-    EXPECT_TRUE(matchesURL(match, "https://www.wix.com/x/website/templates/blank"_s));
-
-    EXPECT_FALSE(matchesURL(match, "https://www.wix.com/website/templates/"_s));
-    EXPECT_FALSE(matchesURL(match, "https://www.wix.com/website/templates/blank"_s));
-
-    // The exception only ever narrows: a page it describes on another site is still no match.
-    EXPECT_FALSE(matchesURL(match, "https://www.example.com/website/other"_s));
-}
-
-TEST(QuirkMatchTest, ExceptWhenCarvesOutHostsOfAMatchedSite)
-{
-    auto match = QuirkMatch::hostOrSubdomainOf("naver.com"_s).exceptWhen(hostIs(excludedNaverHosts));
-
-    EXPECT_TRUE(matchesURL(match, "https://naver.com/"_s));
-    EXPECT_TRUE(matchesURL(match, "https://news.naver.com/"_s));
-
-    EXPECT_FALSE(matchesURL(match, "https://tv.naver.com/"_s));
-    EXPECT_FALSE(matchesURL(match, "https://m.naver.com/"_s));
-
-    EXPECT_TRUE(matchesURL(match, "https://sub.tv.naver.com/"_s));
-}
-
-TEST(QuirkMatchTest, ExceptWhenCarvesOutASingleHost)
-{
-    auto match = QuirkMatch::hostOrSubdomainOf("naver.com"_s).exceptWhen(hostIs("tv.naver.com"_s));
-
-    EXPECT_TRUE(matchesURL(match, "https://naver.com/"_s));
-    EXPECT_TRUE(matchesURL(match, "https://news.naver.com/"_s));
-
-    EXPECT_FALSE(matchesURL(match, "https://tv.naver.com/"_s));
-
-    EXPECT_TRUE(matchesURL(match, "https://sub.tv.naver.com/"_s));
-}
-
-TEST(QuirkMatchTest, HostIsNarrowsAMatchToOneHost)
-{
-    auto match = QuirkMatch::domain("naver.com"_s).when(hostIs("tv.naver.com"_s));
-
-    EXPECT_TRUE(matchesURL(match, "https://tv.naver.com/"_s));
-
-    EXPECT_FALSE(matchesURL(match, "https://naver.com/"_s));
-    EXPECT_FALSE(matchesURL(match, "https://news.naver.com/"_s));
-}
-
-TEST(QuirkMatchTest, ExceptWhenTakesEveryRefinementIncludingEmbeddedDocuments)
-{
-    auto match = QuirkMatch::domain("theguardian.com"_s).exceptWhen(embedded(), documentDomainIs(vimeoDomains));
-
-    EXPECT_TRUE(matchesURL(match, "https://www.theguardian.com/film"_s));
-    EXPECT_TRUE(matchesEmbeddedURL(match, "https://www.theguardian.com/film"_s, "https://www.youtube.com/embed/abc"_s));
-
-    EXPECT_FALSE(matchesEmbeddedURL(match, "https://www.theguardian.com/film"_s, "https://vimeo.com/12345"_s));
-}
-
-TEST(QuirkMatchTest, ExceptWhenAndTheMatchKeepSeparateRefinements)
-{
-    auto match = QuirkMatch::domain("example.com"_s).when(pathStartsWith("/app"_s)).exceptWhen(pathStartsWith("/app/legacy"_s));
-
-    EXPECT_TRUE(matchesURL(match, "https://www.example.com/app/main"_s));
-    EXPECT_FALSE(matchesURL(match, "https://www.example.com/other"_s));
-    EXPECT_FALSE(matchesURL(match, "https://www.example.com/app/legacy/page"_s));
-}
-
-TEST(QuirkMatchTest, ExceptWhenRequiresEveryRefinementToExclude)
-{
-    auto match = QuirkMatch::domain("example.com"_s).exceptWhen(pathStartsWith("/embed"_s), embedded());
-
-    EXPECT_FALSE(matchesEmbeddedURL(match, "https://www.example.com/embed/abc"_s, "https://vimeo.com/12345"_s));
-
-    EXPECT_TRUE(matchesURL(match, "https://www.example.com/embed/abc"_s));
-    EXPECT_TRUE(matchesEmbeddedURL(match, "https://www.example.com/other"_s, "https://vimeo.com/12345"_s));
-
-    EXPECT_FALSE(matchesURL(match, "https://webkit.org/"_s));
-}
-
-TEST(QuirkMatchTest, MatchesIgnoreTheDocumentURLByDefault)
-{
-    auto match = QuirkMatch::domain("theguardian.com"_s);
-
-    EXPECT_TRUE(matchesEmbeddedURL(match, "https://www.theguardian.com/film"_s, "https://www.youtube.com/embed/abc"_s));
-    EXPECT_FALSE(matchesEmbeddedURL(match, "https://www.youtube.com/"_s, "https://www.theguardian.com/film"_s));
-}
-
-TEST(QuirkMatchTest, RefinementsOfDifferentKindsAreAllANDed)
-{
-    auto match = QuirkMatch::anyTopLevelDomain("theguardian"_s).when(pathStartsWith("/film/"_s), documentDomainIs(youTubeEmbedDomains));
-
-    EXPECT_TRUE(matchesEmbeddedURL(match, "https://www.theguardian.com/film/2026/trailer"_s, "https://www.youtube.com/embed/abc"_s));
-    EXPECT_TRUE(matchesEmbeddedURL(match, "https://www.theguardian.co.uk/film/2026/trailer"_s, "https://www.youtube-nocookie.com/embed/abc"_s));
-
-    EXPECT_FALSE(matchesEmbeddedURL(match, "https://www.example.com/film/2026/trailer"_s, "https://www.youtube.com/embed/abc"_s));
-    EXPECT_FALSE(matchesEmbeddedURL(match, "https://www.theguardian.com/news/2026/story"_s, "https://www.youtube.com/embed/abc"_s));
-    EXPECT_FALSE(matchesEmbeddedURL(match, "https://www.theguardian.com/film/2026/trailer"_s, "https://vimeo.com/12345"_s));
-}
-
-TEST(QuirkMatchTest, EnvironmentStacksWithAPathRefinement)
-{
-    auto match = QuirkMatch::domain("youtube.com"_s).when(pathStartsWith("/shorts/"_s), smallScreen());
-
-    EXPECT_EQ(matchesURL(match, "https://www.youtube.com/shorts/abc"_s), WebCore::evaluateQuirkEnvironment(QuirkEnvironment::SmallScreen));
-    EXPECT_FALSE(matchesURL(match, "https://www.youtube.com/watch?v=abc"_s));
-}
-
-TEST(QuirkMatchTest, ContextDerivesValuesFromTheRightURL)
-{
-    URL topURL { "https://www.bbc.co.uk/news?live=1#top"_s };
-    URL documentURL { "https://player.youtube-nocookie.com/embed/abc"_s };
-    QuirkMatchContext context { topURL, documentURL, WebCore::IsTopDocument::Yes };
-
-    EXPECT_EQ(context.topURL(), topURL);
-    EXPECT_EQ(context.topHost(), "www.bbc.co.uk"_s);
-    EXPECT_EQ(context.topRegistrableDomain(), "bbc.co.uk"_s);
-    EXPECT_EQ(context.topDomainWithoutPublicSuffix(), "bbc"_s);
-    EXPECT_EQ(context.documentRegistrableDomain(), "youtube-nocookie.com"_s);
-}
-
-TEST(QuirkMatchTest, ContextCachesDerivedValues)
-{
-    URL url { "https://www.example.com/"_s };
-    QuirkMatchContext context { url, url, WebCore::IsTopDocument::Yes };
-
-    EXPECT_EQ(&context.topRegistrableDomain(), &context.topRegistrableDomain());
-    EXPECT_EQ(&context.topDomainWithoutPublicSuffix(), &context.topDomainWithoutPublicSuffix());
-    EXPECT_EQ(&context.documentRegistrableDomain(), &context.documentRegistrableDomain());
-}
-
-TEST(QuirkMatchTest, HostsWithoutAPublicSuffixFallBackToTheHost)
-{
-    EXPECT_TRUE(matchesURL(QuirkMatch::domain("localhost"_s), "http://localhost:8080/"_s));
-    EXPECT_TRUE(matchesURL(QuirkMatch::domain("127.0.0.1"_s), "http://127.0.0.1/"_s));
-    EXPECT_TRUE(matchesURL(QuirkMatch::anyTopLevelDomain("127.0.0.1"_s), "http://127.0.0.1/"_s));
-}
-
-TEST(QuirkMatchTest, URLsWithoutAHostMatchNothing)
-{
-    for (auto urlString : { "about:blank"_s, "data:text/html,hello"_s, ""_s }) {
-        URL url { urlString };
-        QuirkMatchContext context { url, url, WebCore::IsTopDocument::Yes };
-
-        EXPECT_FALSE(QuirkMatch::domain("example.com"_s).matches(context));
-        EXPECT_FALSE(QuirkMatch::host("example.com"_s).matches(context));
-        EXPECT_FALSE(QuirkMatch::hostOrSubdomainOf("example.com"_s).matches(context));
-        EXPECT_FALSE(QuirkMatch::anyTopLevelDomain("example"_s).matches(context));
-    }
-}
-
-} // namespace TestWebKitAPI
diff --git a/Tools/TestWebKitAPI/Tests/WebCore/Quirks.cpp b/Tools/TestWebKitAPI/Tests/WebCore/Quirks.cpp
index 0f6fcb8a4e83..5e6498d6a8a5 100644
--- a/Tools/TestWebKitAPI/Tests/WebCore/Quirks.cpp
+++ b/Tools/TestWebKitAPI/Tests/WebCore/Quirks.cpp
@@ -27,6 +27,7 @@
 
 #include <WebCore/QuirkTable.h>
 #include <WebCore/Quirks.h>
+#include <array>
 #include <wtf/MainThread.h>
 #include <wtf/URL.h>
 #include <wtf/text/WTFString.h>
@@ -48,9 +49,85 @@ static std::optional<String> customUserAgentFor(ASCIILiteral urlString)
 
 static WebCore::QuirksData resolveQuirksForTopURL(ASCIILiteral urlString)
 {
-    return WebCore::resolveSiteSpecificQuirks({ URL { urlString }, URL { urlString }, WebCore::IsTopDocument::Yes });
+    return WebCore::resolveSiteSpecificQuirks(URL { urlString }, URL { urlString }, WebCore::IsTopDocument::Yes);
 }
 
+static bool matchesTopURL(const WebCore::QuirkURLMatch& match, ASCIILiteral urlString)
+{
+    return match.matches(WebCore::URLMatchContext { URL { urlString } }, WebCore::URLMatchContext { URL { urlString } }, WebCore::IsTopDocument::Yes);
+}
+
+static bool matchesEmbeddedDocument(const WebCore::QuirkURLMatch& match, ASCIILiteral topURLString, ASCIILiteral documentURLString)
+{
+    return match.matches(WebCore::URLMatchContext { URL { topURLString } }, WebCore::URLMatchContext { URL { documentURLString } }, WebCore::IsTopDocument::No);
+}
+
+static constexpr std::array youTubeEmbedDomains { "youtube.com"_s, "youtube-nocookie.com"_s };
+
+TEST_F(QuirksTest, TopURLMatchIgnoresTheDocumentURL)
+{
+    WebCore::QuirkURLMatch match = WebCore::URLMatch::domain("theguardian.com"_s);
+
+    EXPECT_TRUE(matchesTopURL(match, "https://www.theguardian.com/film"_s));
+
+    EXPECT_TRUE(matchesEmbeddedDocument(match, "https://www.theguardian.com/film"_s, "https://www.youtube.com/embed/abc"_s));
+
+    EXPECT_FALSE(matchesEmbeddedDocument(match, "https://www.youtube.com/"_s, "https://www.theguardian.com/film"_s));
+}
+
+TEST_F(QuirksTest, EmbeddedDocumentMatchesTheDocumentURLNotTheTopURL)
+{
+    auto match = WebCore::QuirkURLMatch::embeddedDocument(WebCore::URLMatch::domain(youTubeEmbedDomains));
+
+    EXPECT_TRUE(matchesEmbeddedDocument(match, "https://www.theguardian.com/film"_s, "https://www.youtube.com/embed/abc"_s));
+    EXPECT_TRUE(matchesEmbeddedDocument(match, "https://www.example.com/"_s, "https://www.youtube-nocookie.com/embed/abc"_s));
+    EXPECT_TRUE(matchesEmbeddedDocument(match, "https://www.example.com/"_s, "https://foo.bar.youtube.com/embed/abc"_s));
+
+    EXPECT_FALSE(matchesEmbeddedDocument(match, "https://www.example.com/"_s, "https://vimeo.com/12345"_s));
+
+    EXPECT_FALSE(matchesEmbeddedDocument(match, "https://www.youtube.com/watch?v=abc"_s, "https://vimeo.com/12345"_s));
+
+    EXPECT_FALSE(matchesTopURL(match, "https://www.youtube.com/watch?v=abc"_s));
+}
+
+TEST_F(QuirksTest, EmbeddedDocumentInTopMatchRequiresBothURLsToMatch)
+{
+    auto match = WebCore::QuirkURLMatch::embeddedDocumentInTopMatch(WebCore::URLMatch::anyTopLevelDomain("theguardian"_s), WebCore::URLMatch::domain(youTubeEmbedDomains));
+
+    EXPECT_TRUE(matchesEmbeddedDocument(match, "https://www.theguardian.com/film"_s, "https://www.youtube.com/embed/abc"_s));
+    EXPECT_TRUE(matchesEmbeddedDocument(match, "https://www.theguardian.co.uk/film"_s, "https://www.youtube-nocookie.com/embed/abc"_s));
+
+    EXPECT_FALSE(matchesEmbeddedDocument(match, "https://www.example.com/"_s, "https://www.youtube.com/embed/abc"_s));
+    EXPECT_FALSE(matchesEmbeddedDocument(match, "https://www.theguardian.com/film"_s, "https://vimeo.com/12345"_s));
+    EXPECT_FALSE(matchesTopURL(match, "https://www.theguardian.com/film"_s));
+}
+
+TEST_F(QuirksTest, EmbeddedMatchesNeverApplyToTheTopDocument)
+{
+    auto match = WebCore::QuirkURLMatch::embeddedDocumentInTopMatch(WebCore::URLMatch::anyURL(), WebCore::URLMatch::domain("youtube.com"_s));
+
+    EXPECT_TRUE(matchesEmbeddedDocument(match, "https://www.example.com/"_s, "https://www.youtube.com/embed/abc"_s));
+    EXPECT_FALSE(matchesTopURL(match, "https://www.youtube.com/watch?v=abc"_s));
+}
+
+#if PLATFORM(COCOA)
+static WebCore::QuirksData resolveQuirksForEmbeddedDocument(ASCIILiteral topURLString, ASCIILiteral documentURLString)
+{
+    return WebCore::resolveSiteSpecificQuirks(URL { topURLString }, URL { documentURLString }, WebCore::IsTopDocument::No);
+}
+
+TEST_F(QuirksTest, EmbeddedQuirksResolveFromTheDocumentURL)
+{
+    using SiteSpecificQuirk = WebCore::SiteSpecificQuirk;
+
+    EXPECT_TRUE(resolveQuirksForEmbeddedDocument("https://www.example.com/"_s, "https://www.youtube.com/embed/abc"_s).quirkIsEnabled(SiteSpecificQuirk::NeedsYouTubeCaptionQuirk));
+
+    EXPECT_FALSE(resolveQuirksForEmbeddedDocument("https://www.example.com/"_s, "https://vimeo.com/12345"_s).quirkIsEnabled(SiteSpecificQuirk::NeedsYouTubeCaptionQuirk));
+
+    EXPECT_FALSE(resolveQuirksForTopURL("https://www.example.com/"_s).quirkIsEnabled(SiteSpecificQuirk::NeedsYouTubeCaptionQuirk));
+}
+#endif
+
 TEST_F(QuirksTest, SiteSpecificQuirksResolveWithoutADocument)
 {
     using SiteSpecificQuirk = WebCore::SiteSpecificQuirk;
diff --git a/Tools/TestWebKitAPI/Tests/WebCore/URLMatch.cpp b/Tools/TestWebKitAPI/Tests/WebCore/URLMatch.cpp
new file mode 100644
index 000000000000..04b4bd17fe26
--- /dev/null
+++ b/Tools/TestWebKitAPI/Tests/WebCore/URLMatch.cpp
@@ -0,0 +1,310 @@
+/*
+ * Copyright (C) 2026 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include <WebCore/URLMatch.h>
+#include <array>
+#include <wtf/text/WTFString.h>
+
+namespace TestWebKitAPI {
+
+using WebCore::URLEnvironment;
+using WebCore::URLMatch;
+using WebCore::URLMatchContext;
+using namespace WebCore::URLRefinement;
+
+static bool matchesURL(const URLMatch& match, ASCIILiteral urlString)
+{
+    return match.matches(URLMatchContext { URL { urlString } });
+}
+
+static constexpr std::array expediaGroupDomains { "hotels.com"_s, "orbitz.com"_s, "wotif.co.nz"_s };
+static constexpr std::array excludedNaverHosts { "tv.naver.com"_s, "mail.naver.com"_s, "m.naver.com"_s };
+
+TEST(URLMatchTest, DomainMatchesRegistrableDomain)
+{
+    auto match = URLMatch::domain("example.com"_s);
+
+    EXPECT_TRUE(matchesURL(match, "https://example.com/"_s));
+    EXPECT_TRUE(matchesURL(match, "https://www.example.com/"_s));
+    EXPECT_TRUE(matchesURL(match, "https://deep.sub.example.com/some/path?query#fragment"_s));
+    EXPECT_TRUE(matchesURL(match, "http://example.com:8080/"_s));
+
+    EXPECT_FALSE(matchesURL(match, "https://example.org/"_s));
+    EXPECT_FALSE(matchesURL(match, "https://notexample.com/"_s));
+
+    EXPECT_FALSE(matchesURL(match, "https://example.com.evil.com/"_s));
+}
+
+TEST(URLMatchTest, DomainUnderstandsMultiLabelPublicSuffixes)
+{
+    auto match = URLMatch::domain("bbc.co.uk"_s);
+
+    EXPECT_TRUE(matchesURL(match, "https://www.bbc.co.uk/news"_s));
+    EXPECT_TRUE(matchesURL(match, "https://bbc.co.uk/"_s));
+
+    EXPECT_FALSE(matchesURL(match, "https://bbc.com/"_s));
+}
+
+TEST(URLMatchTest, DomainsMatchesAnyPatternInTheList)
+{
+    auto match = URLMatch::domain(expediaGroupDomains);
+
+    EXPECT_TRUE(matchesURL(match, "https://www.hotels.com/"_s));
+    EXPECT_TRUE(matchesURL(match, "https://orbitz.com/flights"_s));
+    EXPECT_TRUE(matchesURL(match, "https://www.wotif.co.nz/"_s));
+
+    EXPECT_FALSE(matchesURL(match, "https://www.expedia.com/"_s));
+    EXPECT_FALSE(matchesURL(match, "https://wotif.com/"_s));
+}
+
+TEST(URLMatchTest, HostMatchesExactHostOnly)
+{
+    auto match = URLMatch::host("docs.google.com"_s);
+
+    EXPECT_TRUE(matchesURL(match, "https://docs.google.com/spreadsheets/d/abc"_s));
+    EXPECT_TRUE(matchesURL(match, "https://DOCS.GOOGLE.COM/"_s));
+
+    EXPECT_FALSE(matchesURL(match, "https://google.com/"_s));
+    EXPECT_FALSE(matchesURL(match, "https://www.docs.google.com/"_s));
+    EXPECT_FALSE(matchesURL(match, "https://sheets.docs.google.com/"_s));
+}
+
+TEST(URLMatchTest, HostOrSubdomainOfRespectsLabelBoundaries)
+{
+    auto match = URLMatch::hostOrSubdomainOf("ceac.state.gov"_s);
+
+    EXPECT_TRUE(matchesURL(match, "https://ceac.state.gov/CEAC/"_s));
+    EXPECT_TRUE(matchesURL(match, "https://travel.ceac.state.gov/"_s));
+
+    EXPECT_FALSE(matchesURL(match, "https://notceac.state.gov/"_s));
+    EXPECT_FALSE(matchesURL(match, "https://state.gov/"_s));
+
+    EXPECT_FALSE(matchesURL(match, "ftp://ceac.state.gov/"_s));
+}
+
+TEST(URLMatchTest, HostOrSubdomainOfCoversShardedHosts)
+{
+    auto match = URLMatch::hostOrSubdomainOf("onedrive.live.com"_s);
+
+    EXPECT_TRUE(matchesURL(match, "https://onedrive.live.com/"_s));
+    EXPECT_TRUE(matchesURL(match, "https://p123.onedrive.live.com/"_s));
+    EXPECT_TRUE(matchesURL(match, "https://ONEDRIVE.LIVE.COM/"_s));
+
+    EXPECT_FALSE(matchesURL(match, "https://myonedrive.live.com/"_s));
+    EXPECT_FALSE(matchesURL(match, "https://live.com/"_s));
+    EXPECT_FALSE(matchesURL(match, "https://onedrive.live.com.evil.com/"_s));
+}
+
+TEST(URLMatchTest, AnyTopLevelDomainMatchesEveryPublicSuffix)
+{
+    auto match = URLMatch::anyTopLevelDomain("amazon"_s);
+
+    EXPECT_TRUE(matchesURL(match, "https://www.amazon.com/"_s));
+    EXPECT_TRUE(matchesURL(match, "https://www.amazon.co.uk/gp/video/"_s));
+    EXPECT_TRUE(matchesURL(match, "https://amazon.de/"_s));
+    EXPECT_TRUE(matchesURL(match, "https://smile.amazon.com/"_s));
+
+    EXPECT_FALSE(matchesURL(match, "https://notamazon.com/"_s));
+    EXPECT_FALSE(matchesURL(match, "https://amazon.com.evil.com/"_s));
+
+    EXPECT_FALSE(matchesURL(match, "https://amazon.invalidtld/"_s));
+}
+
+TEST(URLMatchTest, PathContainsMatchesAnywhereInThePath)
+{
+    auto match = URLMatch::anyTopLevelDomain("apple"_s).when(pathContains("/retail"_s));
+
+    EXPECT_TRUE(matchesURL(match, "https://www.apple.com/retail/"_s));
+    EXPECT_TRUE(matchesURL(match, "https://www.apple.com/us/retail/store"_s));
+    EXPECT_TRUE(matchesURL(match, "https://www.apple.co.uk/retail/"_s));
+
+    EXPECT_FALSE(matchesURL(match, "https://www.apple.com/"_s));
+    EXPECT_FALSE(matchesURL(match, "https://www.apple.com/RETAIL/"_s));
+    EXPECT_FALSE(matchesURL(match, "https://www.apple.com/?section=/retail"_s));
+    EXPECT_FALSE(matchesURL(match, "https://www.apple.com/#/retail"_s));
+
+    EXPECT_FALSE(matchesURL(match, "https://www.example.com/retail/"_s));
+}
+
+TEST(URLMatchTest, PathStartsWithIsAnchored)
+{
+    auto match = URLMatch::host("docs.google.com"_s).when(pathStartsWith("/spreadsheets/"_s));
+
+    EXPECT_TRUE(matchesURL(match, "https://docs.google.com/spreadsheets/d/abc/edit"_s));
+    EXPECT_TRUE(matchesURL(match, "https://docs.google.com/SpreadSheets/d/abc"_s));
+
+    EXPECT_FALSE(matchesURL(match, "https://docs.google.com/"_s));
+    EXPECT_FALSE(matchesURL(match, "https://docs.google.com/spreadsheets"_s));
+    EXPECT_FALSE(matchesURL(match, "https://docs.google.com/a/spreadsheets/d/abc"_s));
+}
+
+TEST(URLMatchTest, PathOrFragmentContainsSearchesBoth)
+{
+    auto match = URLMatch::domain("icloud.com"_s).when(pathOrFragmentContains("mail"_s));
+
+    EXPECT_TRUE(matchesURL(match, "https://www.icloud.com/mail/"_s));
+    EXPECT_TRUE(matchesURL(match, "https://www.icloud.com/#mail"_s));
+
+    EXPECT_FALSE(matchesURL(match, "https://www.icloud.com/"_s));
+    EXPECT_FALSE(matchesURL(match, "https://www.icloud.com/notes/"_s));
+
+    EXPECT_FALSE(matchesURL(match, "https://www.icloud.com/?app=mail"_s));
+}
+
+TEST(URLMatchTest, EnvironmentIsANDedWithTheSiteMatch)
+{
+    auto smallScreenOnly = URLMatch::domain("youtube.com"_s).when(smallScreen());
+
+    EXPECT_EQ(matchesURL(smallScreenOnly, "https://www.youtube.com/"_s), WebCore::evaluateURLEnvironment(URLEnvironment::SmallScreen));
+
+    EXPECT_FALSE(matchesURL(smallScreenOnly, "https://www.example.com/"_s));
+
+#if !PLATFORM(IOS_FAMILY)
+    EXPECT_FALSE(WebCore::evaluateURLEnvironment(URLEnvironment::SmallScreen));
+    EXPECT_FALSE(WebCore::evaluateURLEnvironment(URLEnvironment::TubularApp));
+    EXPECT_FALSE(WebCore::evaluateURLEnvironment(URLEnvironment::LensApp));
+
+    EXPECT_FALSE(matchesURL(smallScreenOnly, "https://www.youtube.com/"_s));
+#endif
+}
+
+TEST(URLMatchTest, AnyURLMatchesEverySiteWithoutFurtherRefinement)
+{
+    auto match = URLMatch::anyURL();
+
+    EXPECT_TRUE(matchesURL(match, "https://www.example.com/"_s));
+    EXPECT_TRUE(matchesURL(match, "https://webkit.org/"_s));
+    EXPECT_FALSE(matchesURL(match, "about:blank"_s));
+}
+
+TEST(URLMatchTest, ExceptWhenCarvesOutPagesOfAMatchedSite)
+{
+    auto match = URLMatch::domain("wix.com"_s).exceptWhen(pathStartsWith("/website/templates/"_s));
+
+    EXPECT_TRUE(matchesURL(match, "https://www.wix.com/"_s));
+    EXPECT_TRUE(matchesURL(match, "https://www.wix.com/website/other"_s));
+    EXPECT_TRUE(matchesURL(match, "https://www.wix.com/x/website/templates/blank"_s));
+
+    EXPECT_FALSE(matchesURL(match, "https://www.wix.com/website/templates/"_s));
+    EXPECT_FALSE(matchesURL(match, "https://www.wix.com/website/templates/blank"_s));
+
+    EXPECT_FALSE(matchesURL(match, "https://www.example.com/website/other"_s));
+}
+
+TEST(URLMatchTest, ExceptWhenCarvesOutHostsOfAMatchedSite)
+{
+    auto match = URLMatch::hostOrSubdomainOf("naver.com"_s).exceptWhen(hostIs(excludedNaverHosts));
+
+    EXPECT_TRUE(matchesURL(match, "https://naver.com/"_s));
+    EXPECT_TRUE(matchesURL(match, "https://news.naver.com/"_s));
+
+    EXPECT_FALSE(matchesURL(match, "https://tv.naver.com/"_s));
+    EXPECT_FALSE(matchesURL(match, "https://m.naver.com/"_s));
+
+    EXPECT_TRUE(matchesURL(match, "https://sub.tv.naver.com/"_s));
+}
+
+TEST(URLMatchTest, ExceptWhenCarvesOutASingleHost)
+{
+    auto match = URLMatch::hostOrSubdomainOf("naver.com"_s).exceptWhen(hostIs("tv.naver.com"_s));
+
+    EXPECT_TRUE(matchesURL(match, "https://naver.com/"_s));
+    EXPECT_TRUE(matchesURL(match, "https://news.naver.com/"_s));
+
+    EXPECT_FALSE(matchesURL(match, "https://tv.naver.com/"_s));
+
+    EXPECT_TRUE(matchesURL(match, "https://sub.tv.naver.com/"_s));
+}
+
+TEST(URLMatchTest, HostIsNarrowsAMatchToOneHost)
+{
+    auto match = URLMatch::domain("naver.com"_s).when(hostIs("tv.naver.com"_s));
+
+    EXPECT_TRUE(matchesURL(match, "https://tv.naver.com/"_s));
+
+    EXPECT_FALSE(matchesURL(match, "https://naver.com/"_s));
+    EXPECT_FALSE(matchesURL(match, "https://news.naver.com/"_s));
+}
+
+TEST(URLMatchTest, ExceptWhenAndTheMatchKeepSeparateRefinements)
+{
+    auto match = URLMatch::domain("example.com"_s).when(pathStartsWith("/app"_s)).exceptWhen(pathStartsWith("/app/legacy"_s));
+
+    EXPECT_TRUE(matchesURL(match, "https://www.example.com/app/main"_s));
+    EXPECT_FALSE(matchesURL(match, "https://www.example.com/other"_s));
+    EXPECT_FALSE(matchesURL(match, "https://www.example.com/app/legacy/page"_s));
+}
+
+TEST(URLMatchTest, EnvironmentStacksWithAPathRefinement)
+{
+    auto match = URLMatch::domain("youtube.com"_s).when(pathStartsWith("/shorts/"_s), smallScreen());
+
+    EXPECT_EQ(matchesURL(match, "https://www.youtube.com/shorts/abc"_s), WebCore::evaluateURLEnvironment(URLEnvironment::SmallScreen));
+    EXPECT_FALSE(matchesURL(match, "https://www.youtube.com/watch?v=abc"_s));
+}
+
+TEST(URLMatchTest, HostsWithoutAPublicSuffixFallBackToTheHost)
+{
+    EXPECT_TRUE(matchesURL(URLMatch::domain("localhost"_s), "http://localhost:8080/"_s));
+    EXPECT_TRUE(matchesURL(URLMatch::domain("127.0.0.1"_s), "http://127.0.0.1/"_s));
+    EXPECT_TRUE(matchesURL(URLMatch::anyTopLevelDomain("127.0.0.1"_s), "http://127.0.0.1/"_s));
+}
+
+TEST(URLMatchTest, URLsWithoutAHostMatchNothing)
+{
+    for (auto urlString : { "about:blank"_s, "data:text/html,hello"_s, ""_s }) {
+        URL url { urlString };
+        URLMatchContext context { url };
+
+        EXPECT_FALSE(URLMatch::domain("example.com"_s).matches(context));
+        EXPECT_FALSE(URLMatch::host("example.com"_s).matches(context));
+        EXPECT_FALSE(URLMatch::hostOrSubdomainOf("example.com"_s).matches(context));
+        EXPECT_FALSE(URLMatch::anyTopLevelDomain("example"_s).matches(context));
+    }
+}
+
+TEST(URLMatchTest, ContextDerivesValuesFromItsURL)
+{
+    URL url { "https://www.bbc.co.uk/news?live=1#top"_s };
+    URLMatchContext context { url };
+
+    EXPECT_EQ(context.url(), url);
+    EXPECT_EQ(context.host(), "www.bbc.co.uk"_s);
+    EXPECT_EQ(context.registrableDomain(), "bbc.co.uk"_s);
+    EXPECT_EQ(context.domainWithoutPublicSuffix(), "bbc"_s);
+}
+
+TEST(URLMatchTest, ContextCachesDerivedValues)
+{
+    URL url { "https://www.example.com/"_s };
+    URLMatchContext context { url };
+
+    EXPECT_EQ(&context.registrableDomain(), &context.registrableDomain());
+    EXPECT_EQ(&context.domainWithoutPublicSuffix(), &context.domainWithoutPublicSuffix());
+}
+
+} // namespace TestWebKitAPI
diff --git a/Tools/TestWebKitAPI/Tests/WebCore/cocoa/CoreMediaUtilities.mm b/Tools/TestWebKitAPI/Tests/WebCore/cocoa/CoreMediaUtilities.mm
index 5efab2daa408..68a13d083d8d 100644
--- a/Tools/TestWebKitAPI/Tests/WebCore/cocoa/CoreMediaUtilities.mm
+++ b/Tools/TestWebKitAPI/Tests/WebCore/cocoa/CoreMediaUtilities.mm
@@ -28,9 +28,11 @@
 #if USE(AVFOUNDATION)
 
 #import <CoreMedia/CMFormatDescription.h>
+#import <CoreVideo/CVImageBuffer.h>
 #import <JavaScriptCore/JavaScriptCore.h>
 #import <WebCore/CMUtilities.h>
 #import <WebCore/FormatDescriptionUtilities.h>
+#import <WebCore/PlatformVideoChromaLocation.h>
 #import <WebCore/PlatformVideoColorPrimaries.h>
 #import <WebCore/PlatformVideoColorSpace.h>
 #import <WebCore/PlatformVideoMatrixCoefficients.h>
@@ -655,6 +657,208 @@
     EXPECT_EQ(span1[2], 0x05);
 }
 
+// ---- Chroma Location ----
+
+TEST(CMUtilities, ChromaLocationRoundTrip)
+{
+    using C = WebCore::PlatformVideoChromaLocation;
+
+    // The exhaustive switch (no default) ensures the compiler warns when new
+    // PlatformVideoChromaLocation values are added without updating this test.
+    // std::nullopt means the value has no CoreVideo mapping and is not tested.
+    auto testChromaLocation = [&](C input) {
+        std::optional<C> expected;
+        switch (input) {
+        case C::Left:        expected = C::Left;       break;
+        case C::Center:      expected = C::Center;     break;
+        case C::TopLeft:     expected = C::TopLeft;    break;
+        case C::Top:         expected = C::Top;        break;
+        case C::BottomLeft:  expected = C::BottomLeft; break;
+        case C::Bottom:      expected = C::Bottom;     break;
+        case C::Dv420:       expected = C::Dv420;      break;
+        case C::Unspecified: /* no CV mapping */       break;
+        }
+        if (!expected)
+            return;
+        auto cs = baselineColorSpace();
+        cs.chromaLocation = input;
+        auto desc = makeColorSpaceFormatDescription(cs);
+        ASSERT_TRUE(desc) << "createFormatDescriptionFromTrackInfo returned null for chroma location " << (int)input;
+        auto result = WebCore::colorSpaceFromFormatDescription(desc.get());
+        ASSERT_TRUE(result.has_value());
+        EXPECT_EQ(result->chromaLocation, expected);
+    };
+
+    testChromaLocation(C::Left);
+    testChromaLocation(C::Center);
+    testChromaLocation(C::TopLeft);
+    testChromaLocation(C::Top);
+    testChromaLocation(C::BottomLeft);
+    testChromaLocation(C::Bottom);
+    testChromaLocation(C::Dv420);
+    testChromaLocation(C::Unspecified);
+}
+
+// A CMFormatDescription with no chroma location extension must not be given one,
+// so that the decoder keeps applying its own default siting.
+TEST(CMUtilities, AbsentChromaLocationStaysAbsent)
+{
+    NSDictionary *extensions = @{
+        (__bridge NSString *)kCVImageBufferColorPrimariesKey: (__bridge NSString *)kCVImageBufferColorPrimaries_ITU_R_709_2,
+        (__bridge NSString *)kCVImageBufferTransferFunctionKey: (__bridge NSString *)kCVImageBufferTransferFunction_ITU_R_709_2,
+        (__bridge NSString *)kCVImageBufferYCbCrMatrixKey: (__bridge NSString *)kCVImageBufferYCbCrMatrix_ITU_R_709_2,
+    };
+    CMFormatDescriptionRef rawDesc = nullptr;
+    PAL::CMVideoFormatDescriptionCreate(kCFAllocatorDefault, kCMVideoCodecType_H264, 640, 480, (__bridge CFDictionaryRef)extensions, &rawDesc);
+    RetainPtr desc = adoptCF(rawDesc);
+    ASSERT_TRUE(desc);
+
+    auto colorSpace = WebCore::colorSpaceFromFormatDescription(desc.get());
+    ASSERT_TRUE(colorSpace.has_value());
+    EXPECT_FALSE(colorSpace->chromaLocation.has_value());
+
+    RefPtr videoInfo = WebCore::createVideoInfoFromFormatDescription(desc.get());
+    ASSERT_TRUE(videoInfo);
+    RetainPtr reconstructed = WebCore::createFormatDescriptionFromTrackInfo(*videoInfo);
+    ASSERT_TRUE(reconstructed);
+    RetainPtr topField = PAL::CMFormatDescriptionGetExtension(reconstructed.get(), kCVImageBufferChromaLocationTopFieldKey);
+    EXPECT_FALSE(topField);
+    RetainPtr bottomField = PAL::CMFormatDescriptionGetExtension(reconstructed.get(), kCVImageBufferChromaLocationBottomFieldKey);
+    EXPECT_FALSE(bottomField);
+}
+
+// Verifies the WebContent -> GPU-process round trip preserves a non-default chroma
+// siting. H.264 content signalling chroma_sample_loc_type 1 (Center) reaches the GPU
+// process as a rebuilt CMFormatDescription; without the chroma location extension
+// VideoToolbox would fall back to Left siting.
+TEST(CMUtilities, ChromaLocationSurvivesFormatDescriptionRoundTrip)
+{
+    NSDictionary *extensions = @{
+        (__bridge NSString *)kCVImageBufferChromaLocationTopFieldKey: (__bridge NSString *)kCVImageBufferChromaLocation_Center,
+        (__bridge NSString *)kCVImageBufferChromaLocationBottomFieldKey: (__bridge NSString *)kCVImageBufferChromaLocation_Center,
+        (__bridge NSString *)kCVImageBufferColorPrimariesKey: (__bridge NSString *)kCVImageBufferColorPrimaries_SMPTE_C,
+        (__bridge NSString *)kCVImageBufferTransferFunctionKey: (__bridge NSString *)kCVImageBufferTransferFunction_ITU_R_709_2,
+        (__bridge NSString *)kCVImageBufferYCbCrMatrixKey: (__bridge NSString *)kCVImageBufferYCbCrMatrix_ITU_R_601_4,
+    };
+    CMFormatDescriptionRef rawDesc = nullptr;
+    PAL::CMVideoFormatDescriptionCreate(kCFAllocatorDefault, kCMVideoCodecType_H264, 480, 360, (__bridge CFDictionaryRef)extensions, &rawDesc);
+    RetainPtr desc = adoptCF(rawDesc);
+    ASSERT_TRUE(desc);
+
+    RefPtr videoInfo = WebCore::createVideoInfoFromFormatDescription(desc.get());
+    ASSERT_TRUE(videoInfo);
+    EXPECT_EQ(videoInfo->colorSpace().chromaLocation, WebCore::PlatformVideoChromaLocation::Center);
+
+    RetainPtr reconstructed = WebCore::createFormatDescriptionFromTrackInfo(*videoInfo);
+    ASSERT_TRUE(reconstructed);
+
+    RetainPtr topField = dynamic_cf_cast<CFStringRef>(PAL::CMFormatDescriptionGetExtension(reconstructed.get(), kCVImageBufferChromaLocationTopFieldKey));
+    ASSERT_TRUE(topField);
+    EXPECT_TRUE(CFEqual(topField.get(), kCVImageBufferChromaLocation_Center));
+
+    RetainPtr bottomField = dynamic_cf_cast<CFStringRef>(PAL::CMFormatDescriptionGetExtension(reconstructed.get(), kCVImageBufferChromaLocationBottomFieldKey));
+    ASSERT_TRUE(bottomField);
+    EXPECT_TRUE(CFEqual(bottomField.get(), kCVImageBufferChromaLocation_Center));
+}
+
+// ---- Field Count and Field Detail ----
+
+TEST(CMUtilities, FieldCountAndDetailRoundTrip)
+{
+    using F = WebCore::PlatformVideoFieldDetail;
+
+    auto testFieldDetail = [&](uint8_t fieldCount, F input) {
+        auto videoInfo = WebCore::VideoInfo::create({
+            { .codecName = WebCore::FourCC('avc1') }, {
+                .size = { 640, 480 },
+                .displaySize = { 640, 480 },
+                .fieldCount = fieldCount,
+                .fieldDetail = input,
+            }
+        });
+        RetainPtr desc = WebCore::createFormatDescriptionFromTrackInfo(videoInfo);
+        ASSERT_TRUE(desc) << "createFormatDescriptionFromTrackInfo returned null for field detail " << (int)input;
+        EXPECT_EQ(WebCore::fieldCountFromFormatDescription(desc.get()), fieldCount);
+        EXPECT_EQ(WebCore::fieldDetailFromFormatDescription(desc.get()), input);
+    };
+
+    testFieldDetail(2, F::TemporalTopFirst);
+    testFieldDetail(2, F::TemporalBottomFirst);
+    testFieldDetail(2, F::SpatialFirstLineEarly);
+    testFieldDetail(2, F::SpatialFirstLineLate);
+    testFieldDetail(1, F::TemporalTopFirst);
+}
+
+TEST(CMUtilities, AbsentFieldInfoStaysAbsent)
+{
+    auto videoInfo = WebCore::VideoInfo::create({
+        { .codecName = WebCore::FourCC('avc1') }, {
+            .size = { 640, 480 },
+            .displaySize = { 640, 480 },
+        }
+    });
+    RetainPtr desc = WebCore::createFormatDescriptionFromTrackInfo(videoInfo);
+    ASSERT_TRUE(desc);
+    EXPECT_FALSE(WebCore::fieldCountFromFormatDescription(desc.get()).has_value());
+    EXPECT_FALSE(WebCore::fieldDetailFromFormatDescription(desc.get()).has_value());
+}
+
+// ---- Pixel Aspect Ratio ----
+
+// The two pixel-aspect-ratio spacings form a single fraction, as stored in the `pasp` box.
+// A non-square ratio must be emitted as an exact reduced integer pair rather than as the two
+// fractional quotients displaySize / size.
+TEST(CMUtilities, PixelAspectRatioUsesIntegerSpacings)
+{
+    // 720x480 displayed at 16:9 gives a 32:27 pixel aspect ratio.
+    auto videoInfo = WebCore::VideoInfo::create({
+        { .codecName = WebCore::FourCC('avc1') }, {
+            .size = { 720, 480 },
+            .displaySize = { 853.3333333, 480 },
+        }
+    });
+    RetainPtr desc = WebCore::createFormatDescriptionFromTrackInfo(videoInfo);
+    ASSERT_TRUE(desc);
+
+    RetainPtr pixelAspectRatio = dynamic_cf_cast<CFDictionaryRef>(PAL::CMFormatDescriptionGetExtension(desc.get(), kCVImageBufferPixelAspectRatioKey));
+    ASSERT_TRUE(pixelAspectRatio);
+
+    RetainPtr horizontal = dynamic_cf_cast<CFNumberRef>(CFDictionaryGetValue(pixelAspectRatio.get(), kCVImageBufferPixelAspectRatioHorizontalSpacingKey));
+    ASSERT_TRUE(horizontal);
+    EXPECT_FALSE(CFNumberIsFloatType(horizontal.get()));
+
+    RetainPtr vertical = dynamic_cf_cast<CFNumberRef>(CFDictionaryGetValue(pixelAspectRatio.get(), kCVImageBufferPixelAspectRatioVerticalSpacingKey));
+    ASSERT_TRUE(vertical);
+    EXPECT_FALSE(CFNumberIsFloatType(vertical.get()));
+
+    int64_t horizontalSpacing = 0;
+    int64_t verticalSpacing = 0;
+    ASSERT_TRUE(CFNumberGetValue(horizontal.get(), kCFNumberSInt64Type, &horizontalSpacing));
+    ASSERT_TRUE(CFNumberGetValue(vertical.get(), kCFNumberSInt64Type, &verticalSpacing));
+    EXPECT_EQ(horizontalSpacing, 32);
+    EXPECT_EQ(verticalSpacing, 27);
+
+    // The emitted ratio must still make the presentation dimensions match displaySize.
+    auto presentationSize = PAL::CMVideoFormatDescriptionGetPresentationDimensions(desc.get(), true, true);
+    EXPECT_NEAR(presentationSize.width, videoInfo->displaySize().width(), 1);
+    EXPECT_EQ(presentationSize.height, videoInfo->displaySize().height());
+}
+
+// A square pixel aspect ratio carries no extension, matching CoreVideo's default.
+TEST(CMUtilities, SquarePixelAspectRatioEmitsNoExtension)
+{
+    auto videoInfo = WebCore::VideoInfo::create({
+        { .codecName = WebCore::FourCC('avc1') }, {
+            .size = { 480, 360 },
+            .displaySize = { 480, 360 },
+        }
+    });
+    RetainPtr desc = WebCore::createFormatDescriptionFromTrackInfo(videoInfo);
+    ASSERT_TRUE(desc);
+    RetainPtr pixelAspectRatio = PAL::CMFormatDescriptionGetExtension(desc.get(), kCVImageBufferPixelAspectRatioKey);
+    EXPECT_FALSE(pixelAspectRatio);
+}
+
 } // namespace TestWebKitAPI
 
 #endif // USE(AVFOUNDATION)
diff --git a/Tools/TestWebKitAPI/Tests/WebCore/cocoa/PlatformScreenTests.mm b/Tools/TestWebKitAPI/Tests/WebCore/cocoa/PlatformScreenTests.mm
new file mode 100644
index 000000000000..6d7a35047c38
--- /dev/null
+++ b/Tools/TestWebKitAPI/Tests/WebCore/cocoa/PlatformScreenTests.mm
@@ -0,0 +1,73 @@
+/*
+ * Copyright (C) 2026 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import "config.h"
+
+#if PLATFORM(COCOA)
+
+#import "Helpers/Test.h"
+#import "Helpers/Utilities.h"
+#import <WebCore/PlatformScreen.h>
+#import <WebCore/ScreenProperties.h>
+#import <wtf/MainThread.h>
+
+namespace TestWebKitAPI {
+
+TEST(PlatformScreen, CollectScreenPropertiesAsync)
+{
+    auto expectedProperties = WebCore::collectScreenProperties();
+
+    bool done = false;
+    std::optional<WebCore::ScreenProperties> actualProperties;
+    WebCore::collectScreenPropertiesAsync([&](WebCore::ScreenProperties&& properties) {
+        EXPECT_TRUE(isMainThread());
+        actualProperties = WTF::move(properties);
+        done = true;
+    });
+
+    EXPECT_FALSE(done);
+
+    Util::run(&done);
+
+    ASSERT_TRUE(actualProperties.has_value());
+    EXPECT_EQ(actualProperties->primaryDisplayID, expectedProperties.primaryDisplayID);
+    EXPECT_EQ(actualProperties->screenDataMap.size(), expectedProperties.screenDataMap.size());
+
+    // Only the dynamic range state is collected differently by the two functions, so limit the
+    // comparison to that. The other properties might differ (e.g. currentEDRHeadroom is affected by
+    // display brightness).
+    for (auto& [displayID, expectedScreenData] : expectedProperties.screenDataMap) {
+        auto iterator = actualProperties->screenDataMap.find(displayID);
+        ASSERT_TRUE(iterator != actualProperties->screenDataMap.end());
+        EXPECT_EQ(iterator->value.screenSupportsHighDynamicRange, expectedScreenData.screenSupportsHighDynamicRange);
+#if PLATFORM(MAC)
+        EXPECT_EQ(iterator->value.preferredDynamicRangeMode, expectedScreenData.preferredDynamicRangeMode);
+#endif
+    }
+}
+
+} // namespace TestWebKitAPI
+
+#endif // PLATFORM(COCOA)
diff --git a/Tools/TestWebKitAPI/Tests/WebCore/cocoa/SharedVideoFrame.mm b/Tools/TestWebKitAPI/Tests/WebCore/cocoa/SharedVideoFrame.mm
index fd95a943ada2..336f80891ce7 100644
--- a/Tools/TestWebKitAPI/Tests/WebCore/cocoa/SharedVideoFrame.mm
+++ b/Tools/TestWebKitAPI/Tests/WebCore/cocoa/SharedVideoFrame.mm
@@ -29,9 +29,16 @@
 #import <WebCore/SharedVideoFrameInfo.h>
 #include <wtf/Vector.h>
 
+#if USE(LIBWEBRTC)
+WTF_IGNORE_WARNINGS_IN_THIRD_PARTY_CODE_BEGIN
+#include <webrtc/api/video/i010_buffer.h>
+#include <webrtc/api/video/i420_buffer.h>
+WTF_IGNORE_WARNINGS_IN_THIRD_PARTY_CODE_END
+#endif
+
 namespace TestWebKitAPI {
 
-TEST(WebCore, SharedVideoFramePlaneAlphaSize)
+TEST(SharedVideoFrame, PlaneAlphaSize)
 {
     Vector<uint8_t> data(128);
     WebCore::SharedVideoFrameInfo info {
@@ -54,4 +61,125 @@
     EXPECT_FALSE(info2);
 }
 
+#if USE(LIBWEBRTC)
+
+template<typename SampleType, typename Buffer>
+static void testSharedVideoFrameInfoRoundTrip(Buffer& buffer)
+{
+    static_assert(sizeof(SampleType) == 1 || sizeof(SampleType) == 2);
+
+    const int width = buffer.width();
+    const int height = buffer.height();
+    const int chromaWidth = (width + 1) / 2;
+    const int chromaHeight = (height + 1) / 2;
+
+    // I420 stores 8-bit samples; I010 stores 10-bit samples in uint16_t.
+    constexpr unsigned valueMask = sizeof(SampleType) == 1 ? 0xFFu : 0x3FFu;
+    constexpr unsigned msbShift = sizeof(SampleType) == 1 ? 0u : 6u;
+
+    auto fillPlane = [&](std::span<SampleType> plane, int stride, int planeWidth, int planeHeight, unsigned seed) {
+        for (int y = 0; y < planeHeight; ++y) {
+            auto row = plane.subspan(y * stride, planeWidth);
+            for (int x = 0; x < planeWidth; ++x)
+                row[x] = static_cast<SampleType>((seed + 31u * y + 7u * x) & valueMask);
+        }
+    };
+    fillPlane(unsafeMakeSpan(buffer.MutableDataY(), buffer.StrideY() * height), buffer.StrideY(), width, height, 1);
+    fillPlane(unsafeMakeSpan(buffer.MutableDataU(), buffer.StrideU() * chromaHeight), buffer.StrideU(), chromaWidth, chromaHeight, 101);
+    fillPlane(unsafeMakeSpan(buffer.MutableDataV(), buffer.StrideV() * chromaHeight), buffer.StrideV(), chromaWidth, chromaHeight, 211);
+
+    auto info = WebCore::SharedVideoFrameInfo::fromVideoFrameBuffer(buffer);
+    EXPECT_GT(info.storageSize(), 0u);
+
+    constexpr size_t guardSize = 64;
+    constexpr uint8_t guardByte = 0xCD;
+
+    Vector<uint8_t> storage(info.storageSize() + guardSize);
+    auto allBytes = storage.mutableSpan();
+    auto frameBytes = allBytes.subspan(0, info.storageSize());
+    auto guardBytes = allBytes.subspan(info.storageSize());
+    for (auto& b : guardBytes)
+        b = guardByte;
+
+    EXPECT_TRUE(info.writeVideoFrameBuffer(buffer, frameBytes));
+
+    for (auto byte : guardBytes)
+        EXPECT_EQ(byte, guardByte);
+
+    auto payload = spanReinterpretCast<const SampleType>(frameBytes.subspan(sizeof(WebCore::SharedVideoFrameInfo)));
+    const int outStrideY = width;
+    const int outStrideUV = (width & 1) ? width + 1 : width;
+    auto outY = payload.first(outStrideY * height);
+    auto outUV = payload.subspan(outStrideY * height, outStrideUV * chromaHeight);
+
+    auto srcY = unsafeMakeSpan(buffer.DataY(), buffer.StrideY() * height);
+    auto srcU = unsafeMakeSpan(buffer.DataU(), buffer.StrideU() * chromaHeight);
+    auto srcV = unsafeMakeSpan(buffer.DataV(), buffer.StrideV() * chromaHeight);
+
+    for (int y = 0; y < height; ++y) {
+        auto srcRow = srcY.subspan(y * buffer.StrideY(), width);
+        auto outRow = outY.subspan(y * outStrideY, width);
+        for (int x = 0; x < width; ++x) {
+            auto expected = static_cast<SampleType>(static_cast<uint32_t>(srcRow[x]) << msbShift);
+            EXPECT_EQ(outRow[x], expected) << "Y mismatch at (" << x << ", " << y << ")";
+        }
+    }
+
+    for (int y = 0; y < chromaHeight; ++y) {
+        auto srcURow = srcU.subspan(y * buffer.StrideU(), chromaWidth);
+        auto srcVRow = srcV.subspan(y * buffer.StrideV(), chromaWidth);
+        auto outRow = outUV.subspan(y * outStrideUV, 2 * chromaWidth);
+        for (int x = 0; x < chromaWidth; ++x) {
+            auto expectedU = static_cast<SampleType>(static_cast<uint32_t>(srcURow[x]) << msbShift);
+            auto expectedV = static_cast<SampleType>(static_cast<uint32_t>(srcVRow[x]) << msbShift);
+            EXPECT_EQ(outRow[2 * x], expectedU) << "U mismatch at (" << x << ", " << y << ")";
+            EXPECT_EQ(outRow[2 * x + 1], expectedV) << "V mismatch at (" << x << ", " << y << ")";
+        }
+    }
+}
+
+TEST(SharedVideoFrame, OddWidthI420)
+{
+    auto buffer = webrtc::I420Buffer::Create(681, 1280);
+    ASSERT_TRUE(buffer);
+    testSharedVideoFrameInfoRoundTrip<uint8_t>(*buffer);
+}
+
+TEST(SharedVideoFrame, OddHeightI420)
+{
+    auto buffer = webrtc::I420Buffer::Create(680, 15);
+    ASSERT_TRUE(buffer);
+    testSharedVideoFrameInfoRoundTrip<uint8_t>(*buffer);
+}
+
+TEST(SharedVideoFrame, OddWidthAndHeightI420)
+{
+    auto buffer = webrtc::I420Buffer::Create(681, 15);
+    ASSERT_TRUE(buffer);
+    testSharedVideoFrameInfoRoundTrip<uint8_t>(*buffer);
+}
+
+TEST(SharedVideoFrame, OddWidthI010)
+{
+    auto buffer = webrtc::I010Buffer::Create(681, 1280);
+    ASSERT_TRUE(buffer);
+    testSharedVideoFrameInfoRoundTrip<uint16_t>(*buffer);
+}
+
+TEST(SharedVideoFrame, OddHeightI010)
+{
+    auto buffer = webrtc::I010Buffer::Create(680, 15);
+    ASSERT_TRUE(buffer);
+    testSharedVideoFrameInfoRoundTrip<uint16_t>(*buffer);
+}
+
+TEST(SharedVideoFrame, OddWidthAndHeightI010)
+{
+    auto buffer = webrtc::I010Buffer::Create(681, 15);
+    ASSERT_TRUE(buffer);
+    testSharedVideoFrameInfoRoundTrip<uint16_t>(*buffer);
+}
+
+#endif // USE(LIBWEBRTC)
+
 }; // namespace TestWebKitAPI
diff --git a/Tools/TestWebKitAPI/Tests/WebKit/WebPage/AppKit Gesture Tests/BasicAppKitGesturesTests.swift b/Tools/TestWebKitAPI/Tests/WebKit/WebPage/AppKit Gesture Tests/BasicAppKitGesturesTests.swift
index 0e2ffb3fd727..59e25a78be93 100644
--- a/Tools/TestWebKitAPI/Tests/WebKit/WebPage/AppKit Gesture Tests/BasicAppKitGesturesTests.swift	
+++ b/Tools/TestWebKitAPI/Tests/WebKit/WebPage/AppKit Gesture Tests/BasicAppKitGesturesTests.swift	
@@ -1254,6 +1254,47 @@ extension AppKitGesturesTests.Basic {
         #expect(page.backForwardList.backList.count == 1)
     }
 
+    @Test(
+        .bug("https://webkit.org/b/322776", "Swiping at pinned state should trigger page navigation")
+    )
+    func swipingAtPinnedStateShouldTriggerPageNavigation() async throws {
+        // Establish a back-forward history entry so that a swiping would have somewhere to navigate to.
+        try await page.load(URL(string: "about:blank?1")).wait()
+        let firstPageURL = page.url
+
+        let testURL = try #require(Bundle.testResources.url(forResource: "red", withExtension: "html"))
+        try await page.load(testURL).wait()
+        await page.waitForNextPresentationUpdate()
+        let secondPageURL = page.url
+
+        #expect(page.backForwardList.backList.count == 1)
+
+        let start = screenBounds(ofPointInWindowCoordinates: CGPoint(x: window.frame.width / 4, y: window.frame.height / 2))
+        let end = screenBounds(ofPointInWindowCoordinates: CGPoint(x: 3 * window.frame.width / 4, y: window.frame.height / 2))
+
+        // Swipe right, back navigation.
+        await recap.play { composer in
+            composer._wk_scroll(withStart: start, end: end, duration: .seconds(0.5))
+        }
+
+        try await Task.sleep(for: .seconds(1))
+
+        #expect(page.url == firstPageURL)
+        #expect(page.backForwardList.backList.count == 0)
+        #expect(page.backForwardList.forwardList.count == 1)
+
+        // Swipe left, forward navigation.
+        await recap.play { composer in
+            composer._wk_scroll(withStart: end, end: start, duration: .seconds(0.5))
+        }
+
+        try await Task.sleep(for: .seconds(1))
+
+        #expect(page.url == secondPageURL)
+        #expect(page.backForwardList.backList.count == 1)
+        #expect(page.backForwardList.forwardList.count == 0)
+    }
+
     @Test(arguments: [Duration.zero, .seconds(1)])
     func longPressAndDragOnImageSelectsEntireText(delay: Duration) async throws {
         let baseURL = try #require(Bundle.testResources.resourceURL)
diff --git a/Tools/glib/dependencies/apt b/Tools/glib/dependencies/apt
index cbb017f11b57..4530f890d7db 100755
--- a/Tools/glib/dependencies/apt
+++ b/Tools/glib/dependencies/apt
@@ -98,6 +98,9 @@ PACKAGES=(
     hyphen-en-us
     gdb
     libcgi-pm-perl
+    $(aptIfExists monado-cli)
+    $(aptIfExists monado-service)
+    $(aptIfExists libopenxr1-monado)
     psmisc
     $(aptIfExists python3-legacy-cgi)
     pulseaudio-utils
diff --git a/WebDriverTests/TestExpectations.json b/WebDriverTests/TestExpectations.json
index 413511854a95..6fe9137c355b 100644
--- a/WebDriverTests/TestExpectations.json
+++ b/WebDriverTests/TestExpectations.json
@@ -4180,8 +4180,8 @@
     "imported/w3c/webdriver/tests/bidi/browsing_context/user_prompt_opened/handler.py": {
         "expected": { "all": { "status": ["TIMEOUT"], "bug": "webkit.org/b/288344"}},
         "subtests": {
-            "test_accept": {"expected": {"all": {"status": ["SKIP"], "bug": "webkit.org/b/321148"}}},
-            "test_accept_and_notify": {"expected": {"all": {"status": ["SKIP"], "bug": "webkit.org/b/321148"}}}
+            "test_accept": {"expected": {"all": {"status": ["PASS"] }}},
+            "test_accept_and_notify": {"expected": {"all": {"status": ["PASS"] }}}
         }
     },
 
@@ -5504,15 +5504,6 @@
             "test_subscribe_to_one_context": {
                 "expected": { "all": { "status": ["FAIL"], "bug": "webkit.org/b/288067"}}
             },
-            "test_close_context[tab]": {
-                "expected": { "all": { "status": ["SKIP"], "bug": "webkit.org/b/321148"}}
-            },
-            "test_close_context[window]": {
-                "expected": { "all": { "status": ["SKIP"], "bug": "webkit.org/b/321148"}}
-            },
-            "test_navigate": {
-                "expected": { "all": { "status": ["SKIP"], "bug": "webkit.org/b/321148"}}
-            },
             "test_sandbox[evaluate]": {
                 "expected": { "all": { "status": ["FAIL"], "bug": "webkit.org/b/288067"}}
             },
@@ -5740,7 +5731,7 @@
             "test_params_events_value_invalid_event_name[]": {"expected": {"all": {"status": ["PASS"]}}},
             "test_params_events_value_invalid_event_name[foo]": {"expected": {"all": {"status": ["PASS"]}}},
             "test_params_events_value_invalid_event_name[foo.bar]": {"expected": {"all": {"status": ["PASS"]}}},
-            "test_params_events_value_valid_and_invalid_event_name": {"expected": {"all": {"status": ["SKIP"], "bug": "webkit.org/b/321148"}}},
+            "test_params_events_value_valid_and_invalid_event_name": {"expected": {"all": {"status": ["FAIL"], "bug": "webkit.org/b/282977"}}},
             "test_params_contexts_invalid_type[True]": {"expected": {"all": {"status": ["PASS"]}}},
             "test_params_contexts_invalid_type[foo]": {"expected": {"all": {"status": ["PASS"]}}},
             "test_params_contexts_invalid_type[42]": {"expected": {"all": {"status": ["PASS"]}}},
diff --git a/Websites/perf.webkit.org/tools/sync-commits.py b/Websites/perf.webkit.org/tools/sync-commits.py
index 126076e354ed..e7b709e3e1e4 100755
--- a/Websites/perf.webkit.org/tools/sync-commits.py
+++ b/Websites/perf.webkit.org/tools/sync-commits.py
@@ -19,7 +19,7 @@
 
 # There are some buggy commit messages:
 # Canonical link: https://commits.webkit.org/https://commits.webkit.org/232477@main
-REVISION_IDENTIFIER_IN_MSG_RE = re.compile(r'^Canonical link: (https\://commits\.webkit\.org/)+(?P<revision_identifier>\d+\.?\d*@(?P<branch_name>[\w\.\-]+))\n', flags=re.MULTILINE)
+REVISION_IDENTIFIER_IN_MSG_RE = re.compile(r'^Canonical-link: (https\://commits\.webkit\.org/)+(?P<revision_identifier>\d+\.?\d*@(?P<branch_name>[\w\.\-]+))\n', flags=re.MULTILINE)
 REVISION_IN_MSG_RE = re.compile(r'^git-svn-id: https://svn\.webkit\.org/repository/webkit/[\w\W]+@(?P<revision>\d+) [\w\d\-]+\n', flags=re.MULTILINE)
 HASH_RE = re.compile(r'^[a-f0-9A-F]+$')
 REVISION_RE = re.compile(r'^[Rr]?(?P<revision>\d+)$')
@@ -266,7 +266,16 @@ def _revision_from_tokens(self, tokens):
 
         revision_identifier = None
         if self._report_revision_identifier_in_commit_msg:
-            for revision_identifier_match in REVISION_IDENTIFIER_IN_MSG_RE.finditer(message):
+            trailer_output = subprocess.check_output(
+                ['git', '-C', self._git_checkout,
+                 '-c', 'trailer.Canonical-link.key=Canonical-link',
+                 '-c', 'trailer.Identifier.key=Identifier',
+                 '-c', 'trailer.git-svn-id.key=git-svn-id',
+                 'interpret-trailers', '--parse', '--no-divider'],
+                input=message.replace('\nCanonical link:', '\nCanonical-link:'),
+                encoding='utf-8',
+            )
+            for revision_identifier_match in REVISION_IDENTIFIER_IN_MSG_RE.finditer(trailer_output):
                 if self._git_branch and revision_identifier_match.group('branch_name') != self._git_branch:
                     continue
                 revision_identifier = revision_identifier_match.group('revision_identifier')